# Latest **URL:** https://discuss.elastic.co/latest.md?page=1996 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1997 --- ## [Parent/child relationship with child having certain records](https://discuss.elastic.co/t/parent-child-relationship-with-child-having-certain-records/255615)
**Author:** [@ChrisNicPaps](https://discuss.elastic.co/u/ChrisNicPaps)\ **Replies:** 0\ **Last updated:** [November 17, 2020, 4:01am UTC](https://discuss.elastic.co/t/parent-child-relationship-with-child-having-certain-records/255615 "2020-11-17T04:01:54Z")
I have a parent/child relationship where students have subjects that they pass. So Student have many subject. I would like to write a query that returns all student that have "math" and "english" and 3 other subjects. --- ## [Snapshot Repositories](https://discuss.elastic.co/t/snapshot-repositories/255610)
**Author:** [@bevano](https://discuss.elastic.co/u/bevano)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 2:20am UTC](https://discuss.elastic.co/t/snapshot-repositories/255610 "2020-11-17T02:20:09Z")
Hi All, Wondering if there was a best-practices/recommendations with Snapshot Repositories. The new feature of searchable snapshots is very intriguing for my use case, and I am currently exploring it. I will be purchas… --- ## [How to encrypt Elasticsearch document source?](https://discuss.elastic.co/t/how-to-encrypt-elasticsearch-document-source/255488)
**Author:** [@Yao\_Pan](https://discuss.elastic.co/u/Yao_Pan)\ **Replies:** 3\ **Last updated:** [November 17, 2020, 12:21am UTC](https://discuss.elastic.co/t/how-to-encrypt-elasticsearch-document-source/255488 "2020-11-17T00:21:09Z")
I need to encrypt Elasticsearch document source content for security. The final effect to be achieved is as follows: input: { "title":"you know, for search", "viewcount": 20 } In es: { … --- ## [Mapping geo\_point to dynamically named indexes](https://discuss.elastic.co/t/mapping-geo-point-to-dynamically-named-indexes/255588)
**Author:** [@francisaugusto](https://discuss.elastic.co/u/francisaugusto)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 12:04am UTC](https://discuss.elastic.co/t/mapping-geo-point-to-dynamically-named-indexes/255588 "2020-11-17T00:04:57Z")
Hi, I installed ES 7.9.3 and somehow geoip.location doesn't get mapped to a geo\_point. I did the mapping, and it worked, but when I try to do the same mapping for a dynamically created index (with custom dates, for exam… --- ## [How to install APM agent on Kibana server?](https://discuss.elastic.co/t/how-to-install-apm-agent-on-kibana-server/254844)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 6\ **Last updated:** [November 17, 2020, 12:01am UTC](https://discuss.elastic.co/t/how-to-install-apm-agent-on-kibana-server/254844 "2020-11-17T00:01:43Z")
Hi All, Any documents on installing APM agent on Kibana node? Followed the documentation, but am confused. Which agent? Java? How to set up the properties? etc. Any lead will be much appreciated. Thanks --- ## [Rx packet errors metricbeat stat doesn't match netstat output](https://discuss.elastic.co/t/rx-packet-errors-metricbeat-stat-doesnt-match-netstat-output/255583)
**Author:** [@eeijlar](https://discuss.elastic.co/u/eeijlar)\ **Replies:** 0\ **Last updated:** [November 16, 2020, 6:00pm UTC](https://discuss.elastic.co/t/rx-packet-errors-metricbeat-stat-doesnt-match-netstat-output/255583 "2020-11-16T18:00:19Z")
I am using the following query: The stat I am trying to monitor is: kubernetes.pod.network.rx.errors. If I log onto one of the pods which has metricbeat running and my application and do netstat -s -u (-u for udp pa… --- ## [Ilm.json file](https://discuss.elastic.co/t/ilm-json-file/254974)
**Author:** [@Armen\_Khachikyan](https://discuss.elastic.co/u/Armen_Khachikyan)\ **Replies:** 2\ **Last updated:** [November 16, 2020, 11:32pm UTC](https://discuss.elastic.co/t/ilm-json-file/254974 "2020-11-16T23:32:00Z")
Please help me. is there anyway to create an JSON file, put there our ILM policy, and force elasticsearch to read that file(or add the path of location ILM policies in elasticsearch.yml)? --- ## [Dotnet APM context propgagation](https://discuss.elastic.co/t/dotnet-apm-context-propgagation/255597)
**Author:** [@illegalnumbers](https://discuss.elastic.co/u/illegalnumbers)\ **Replies:** 3\ **Last updated:** [November 16, 2020, 10:49pm UTC](https://discuss.elastic.co/t/dotnet-apm-context-propgagation/255597 "2020-11-16T22:49:17Z")
Does something similar to https://github.com/elastic/apm-agent-java/pull/396 exist for the latest version of the Kibana APM agent? I'd like to forward a transaction if the headers for the trace are available. --- ## [How to reindex data from a Async search?](https://discuss.elastic.co/t/how-to-reindex-data-from-a-async-search/255592)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 1\ **Last updated:** [November 16, 2020, 10:30pm UTC](https://discuss.elastic.co/t/how-to-reindex-data-from-a-async-search/255592 "2020-11-16T22:30:57Z")
we have a large dataset which times out in normal watcher/search and were planning to use "async" search. But after posting such an async search, how to then put the output into another index? We need the summary inform… --- ## [Adding a new node to the cluster - shows offline](https://discuss.elastic.co/t/adding-a-new-node-to-the-cluster-shows-offline/255467)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 9\ **Last updated:** [November 16, 2020, 10:06pm UTC](https://discuss.elastic.co/t/adding-a-new-node-to-the-cluster-shows-offline/255467 "2020-11-16T22:06:50Z")
Hey Added a new node to the cluster. But it is not getting added?! Any ideas? Says it has 5 nodes, but node 5 is offline? Thanks! --- ## [Parsing syslog param1=value1 param2="value2"](https://discuss.elastic.co/t/parsing-syslog-param1-value1-param2-value2/255565)
**Author:** [@Elitlogik](https://discuss.elastic.co/u/Elitlogik)\ **Replies:** 3\ **Last updated:** [November 16, 2020, 9:52pm UTC](https://discuss.elastic.co/t/parsing-syslog-param1-value1-param2-value2/255565 "2020-11-16T21:52:00Z")
Trying to learn GROK by using the GROK debugger tool in Kibana. Data is stuctured like this: param1=value1 param2="value 2" param4=param4 param1=value1 param2="value 2" param3=param3 param4=param4 Questions are: W… --- ## [Endpoint 7.9 "Degraded and dashboards"](https://discuss.elastic.co/t/endpoint-7-9-degraded-and-dashboards/247452)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 28\ **Last updated:** [November 16, 2020, 8:50pm UTC](https://discuss.elastic.co/t/endpoint-7-9-degraded-and-dashboards/247452 "2020-11-16T20:50:26Z")
So first things first I know it's beta. But I've come into a few odd ball issues I haven't been able to stumble my way around. I have the Endpoint installed on a around 50 dev nodes now and I'm seeing a couple common ev… --- ## [Logs nicely parsed but not showing in dashboards for nginx module in kubernetes](https://discuss.elastic.co/t/logs-nicely-parsed-but-not-showing-in-dashboards-for-nginx-module-in-kubernetes/255443)
**Author:** [@Palino1611](https://discuss.elastic.co/u/Palino1611)\ **Replies:** 2\ **Last updated:** [November 16, 2020, 8:48pm UTC](https://discuss.elastic.co/t/logs-nicely-parsed-but-not-showing-in-dashboards-for-nginx-module-in-kubernetes/255443 "2020-11-16T20:48:42Z")
Hello, I am running my nginx container in kubernetes and using nginx module I am able to parse logs and show them nicely in kibana discover. I also see ingest pipelines for nginx in kibana. My setup is: Filebeat daemon… --- ## [EQL: How to get a simple query working from DEV tools?](https://discuss.elastic.co/t/eql-how-to-get-a-simple-query-working-from-dev-tools/255444)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 1\ **Last updated:** [November 16, 2020, 8:19pm UTC](https://discuss.elastic.co/t/eql-how-to-get-a-simple-query-working-from-dev-tools/255444 "2020-11-16T20:19:12Z")
hi, I'm trying to simulate a basic EQL query via the dev tools. Some data POST \_bulk { "index" : { "\_index" : "win\_test", "\_id" : "1" } } { "@timestamp": "2020-11-12T02:00:00Z", "host\_name" : "myhost1" , "event": {"cod… --- ## [Metricbeat gives me certificate issue](https://discuss.elastic.co/t/metricbeat-gives-me-certificate-issue/255590)
**Author:** [@adityak248](https://discuss.elastic.co/u/adityak248)\ **Replies:** 0\ **Last updated:** [November 16, 2020, 8:15pm UTC](https://discuss.elastic.co/t/metricbeat-gives-me-certificate-issue/255590 "2020-11-16T20:15:39Z")
Hello Team, I have been trying to configure the metricbeat over SSL and i keep getting the following error metricbeat\_1 | Exiting: error initializing publisher: 2 errors: open $CERTS\_DIR/elk/elk.crt: no such file or d… --- ## [Attempting to enable TLS](https://discuss.elastic.co/t/attempting-to-enable-tls/255453)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 9\ **Last updated:** [November 16, 2020, 7:55pm UTC](https://discuss.elastic.co/t/attempting-to-enable-tls/255453 "2020-11-16T19:55:15Z")
Elasticsearch 6.8.12 I have an existing cluster which was set up before x-pack was free. I now want to setup the security "properly". I have used Letsencrypt to install certificates on each of the cluster members and … --- ## [New plugin architecture: How to build?](https://discuss.elastic.co/t/new-plugin-architecture-how-to-build/253036)
**Author:** [@Dasko](https://discuss.elastic.co/u/Dasko)\ **Replies:** 10\ **Last updated:** [November 16, 2020, 7:42pm UTC](https://discuss.elastic.co/t/new-plugin-architecture-how-to-build/253036 "2020-11-16T19:42:41Z")
Hello, We are currently switching to Elasticsearch/Kibana 7.9.1 and creating new plugins, following the new architecture. We were already using our own plugins before, and were building them via the build command of th… --- ## [Logstash error after updating to 7.9.1](https://discuss.elastic.co/t/logstash-error-after-updating-to-7-9-1/255366)
**Author:** [@noobman2logstash](https://discuss.elastic.co/u/noobman2logstash)\ **Replies:** 8\ **Last updated:** [November 16, 2020, 6:46pm UTC](https://discuss.elastic.co/t/logstash-error-after-updating-to-7-9-1/255366 "2020-11-16T18:46:07Z")
\[2020-11-13T16:36:21,302\]\[ERROR\]\[logstash.agent \] Failed to execute action {:id=\>:default, :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Could not execute action: PipelineAction::Create, acti… --- ## [Checking ReIndex Status - Seems wrong, why?](https://discuss.elastic.co/t/checking-reindex-status-seems-wrong-why/255582)
**Author:** [@21908](https://discuss.elastic.co/u/21908)\ **Replies:** 1\ **Last updated:** [November 16, 2020, 6:34pm UTC](https://discuss.elastic.co/t/checking-reindex-status-seems-wrong-why/255582 "2020-11-16T18:34:23Z")
I'm going off of Kibana document page at: https://www.elastic.co/guide/en/kibana/current/check-reindex-status.html I ran the "reindex status" command and am seeing this result in the browser: This result appears wro… --- ## [Scripted fields in vega visualization - Getting Bad request as error](https://discuss.elastic.co/t/scripted-fields-in-vega-visualization-getting-bad-request-as-error/254395)
**Author:** [@Pranusha119](https://discuss.elastic.co/u/Pranusha119)\ **Replies:** 6\ **Last updated:** [November 16, 2020, 6:29pm UTC](https://discuss.elastic.co/t/scripted-fields-in-vega-visualization-getting-bad-request-as-error/254395 "2020-11-16T18:29:47Z")
{ $schema: "https://vega.github.io/schema/vega-lite/v2.json" data: { url: { %context%: true index: index\_ssd\_2 body: { size: 10000, \_source: \["mediatype","pred\_comp\_sem","Gender","PhotoOfP… --- ## [Is there any active development or just bug fixes?](https://discuss.elastic.co/t/is-there-any-active-development-or-just-bug-fixes/255431)
**Author:** [@Mindtech](https://discuss.elastic.co/u/Mindtech)\ **Replies:** 3\ **Last updated:** [November 16, 2020, 6:27pm UTC](https://discuss.elastic.co/t/is-there-any-active-development-or-just-bug-fixes/255431 "2020-11-16T18:27:09Z")
Hi, we think about moving from Algolia to the hosted App Search in Elastic Cloud. But is there any active development on App Search? In the changelogs I can only find bug fixes and minor optimizations, but no features… --- ## [Elasticsearch Node Segregation](https://discuss.elastic.co/t/elasticsearch-node-segregation/255537)
**Author:** [@ajesh](https://discuss.elastic.co/u/ajesh)\ **Replies:** 4\ **Last updated:** [November 16, 2020, 5:41pm UTC](https://discuss.elastic.co/t/elasticsearch-node-segregation/255537 "2020-11-16T17:41:39Z")
Hi Team, I am planning to have one more node to my Elasticsearch cluster, but only for a specific use case. I need that node to be used only for ingesting logs from our Cisco ASA using filebeat. How can i restrict this… --- ## [In Scripted fields no option to select lucene expression language - kibana version 7.9](https://discuss.elastic.co/t/in-scripted-fields-no-option-to-select-lucene-expression-language-kibana-version-7-9/253528)
**Author:** [@Pranusha119](https://discuss.elastic.co/u/Pranusha119)\ **Replies:** 4\ **Last updated:** [November 16, 2020, 5:41pm UTC](https://discuss.elastic.co/t/in-scripted-fields-no-option-to-select-lucene-expression-language-kibana-version-7-9/253528 "2020-11-16T17:41:38Z")
--- ## [Bettering response time by using lesser number of bigger-sized shards](https://discuss.elastic.co/t/bettering-response-time-by-using-lesser-number-of-bigger-sized-shards/254475)
**Author:** [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Replies:** 10\ **Last updated:** [November 16, 2020, 4:34pm UTC](https://discuss.elastic.co/t/bettering-response-time-by-using-lesser-number-of-bigger-sized-shards/254475 "2020-11-16T16:34:23Z")
I have an ES 6.8.6 cluster containing about 1200 day-wise indices. Today indexing happens only on today's day-wise index. There are no updates. This cluster contains about 45 TB data including preserving historical data … --- ## [Display date without time in Elasticsearch](https://discuss.elastic.co/t/display-date-without-time-in-elasticsearch/255266)
**Author:** [@VeeT](https://discuss.elastic.co/u/VeeT)\ **Replies:** 5\ **Last updated:** [November 16, 2020, 4:33pm UTC](https://discuss.elastic.co/t/display-date-without-time-in-elasticsearch/255266 "2020-11-16T16:33:46Z")
Hi, I have the following input in a "Date" field: Date=2020.11.12 Currently, it's displaying as this in Kibana: Date Nov 12, 2020 @ 00:00:00.000 I would like to display this as is in Kibana, i.e., Date: 2020.11.12. … --- ## [Kibana don't start visTypeTimeseries plugin](https://discuss.elastic.co/t/kibana-dont-start-vistypetimeseries-plugin/255258)
**Author:** [@16318a22907f3cbfa04b](https://discuss.elastic.co/u/16318a22907f3cbfa04b)\ **Replies:** 3\ **Last updated:** [November 16, 2020, 4:31pm UTC](https://discuss.elastic.co/t/kibana-dont-start-vistypetimeseries-plugin/255258 "2020-11-16T16:31:23Z")
Kibana development environment v7.9.1 yarn kbn bootstrap yarn start --oss np bld log \[23:25:19.560\] \[error\]\[@kbn/optimizer\] webpack compile errors │np bld log \[23:25:19.561\] \[error\]\[@kbn/optimizer\] \[visTy… --- ## [Split string in scripted fields, using \_ as a delimiter](https://discuss.elastic.co/t/split-string-in-scripted-fields-using-as-a-delimiter/253803)
**Author:** [@goncalobsantos](https://discuss.elastic.co/u/goncalobsantos)\ **Replies:** 6\ **Last updated:** [November 16, 2020, 4:25pm UTC](https://discuss.elastic.co/t/split-string-in-scripted-fields-using-as-a-delimiter/253803 "2020-11-16T16:25:03Z")
I have a string field "myfield.keyword", where each entry has the following format: AAA\_BBBB\_CC DDD\_EEE\_F I am trying to create a scripted field that outputs the substring before the first \_, a scripted field that out… --- ## [Active\_primary\_shards \> 1 when you have more than 1 data node](https://discuss.elastic.co/t/active-primary-shards-1-when-you-have-more-than-1-data-node/255545)
**Author:** [@21908](https://discuss.elastic.co/u/21908)\ **Replies:** 3\ **Last updated:** [November 16, 2020, 4:22pm UTC](https://discuss.elastic.co/t/active-primary-shards-1-when-you-have-more-than-1-data-node/255545 "2020-11-16T16:22:13Z")
I have a 3 node Elasticsearch cluster. All nodes are data bearing nodes. If active\_primary\_shards is set to 1 my data would not be distributed among the 3 nodes, is that a correct understanding? My single shard would … --- ## [Script field not returning value](https://discuss.elastic.co/t/script-field-not-returning-value/255549)
**Author:** [@pmo](https://discuss.elastic.co/u/pmo)\ **Replies:** 5\ **Last updated:** [November 16, 2020, 4:15pm UTC](https://discuss.elastic.co/t/script-field-not-returning-value/255549 "2020-11-16T16:15:15Z")
Hi support, I've created this Script Field in Kibana index pattern, but I've an issue, nothing is return... Each time I have a field name : category\_name that match "Router", I should have a value (netflow value), But … --- ## [Closed+hot index or warm+hot index](https://discuss.elastic.co/t/closed-hot-index-or-warm-hot-index/255078)
**Author:** [@nyquillus](https://discuss.elastic.co/u/nyquillus)\ **Replies:** 3\ **Last updated:** [November 16, 2020, 4:02pm UTC](https://discuss.elastic.co/t/closed-hot-index-or-warm-hot-index/255078 "2020-11-16T16:02:49Z")
Hello, I'm administrating an elastic stack at the moment and my current method right now is closing indexes older than 2 weeks and keeping the last 2 weeks in hot state. If people need to check logs older than 2 weeks t… [Previous page](https://discuss.elastic.co/latest.md?page=1995) [Next page](https://discuss.elastic.co/latest.md?page=1997)