# Latest **URL:** https://discuss.elastic.co/latest.md?page=863 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 864 --- ## [Different same-field highlighting with alias fields and highlight queries broken](https://discuss.elastic.co/t/different-same-field-highlighting-with-alias-fields-and-highlight-queries-broken/320940)
**Author:** [@Erik\_Fassler](https://discuss.elastic.co/u/Erik_Fassler)\ **Replies:** 1\ **Last updated:** [December 10, 2022, 9:35am UTC](https://discuss.elastic.co/t/different-same-field-highlighting-with-alias-fields-and-highlight-queries-broken/320940 "2022-12-10T09:35:18Z")
I am using alias fields to do different highlighting on basically the same field. I use highlight\_queries to highlight different parts of the same field. This worked fine in ES up to 7.9.1 but changed its behaviour in ne… --- ## [Problem with range search with datetime field](https://discuss.elastic.co/t/problem-with-range-search-with-datetime-field/320878)
**Author:** [@abkrim](https://discuss.elastic.co/u/abkrim)\ **Replies:** 4\ **Last updated:** [December 10, 2022, 9:33am UTC](https://discuss.elastic.co/t/problem-with-range-search-with-datetime-field/320878 "2022-12-10T09:33:36Z")
I have a strange problem when I make queries in date range Mapping index . . . "datetime": { "type": "date", "format": "epoch\_second||yyyy-MM-dd HH:mm:ss", "ignore\_malformed": true … --- ## [Degrading search performance and old recods](https://discuss.elastic.co/t/degrading-search-performance-and-old-recods/320892)
**Author:** [@rvallel](https://discuss.elastic.co/u/rvallel)\ **Replies:** 3\ **Last updated:** [December 10, 2022, 9:02am UTC](https://discuss.elastic.co/t/degrading-search-performance-and-old-recods/320892 "2022-12-10T09:02:41Z")
Hi! My searches become slower and slower as the number of indexed documents grow. However, we only query the documents that happen to be produced in the last 3 months. I wonder if it is possible to have an alias or an… --- ## [Error: unable to load mongojdbc4.8.jar from :jdbc\_driver\_library, file not readable (please check user and group permissions for the path)](https://discuss.elastic.co/t/error-unable-to-load-mongojdbc4-8-jar-from-jdbc-driver-library-file-not-readable-please-check-user-and-group-permissions-for-the-path/320937)
**Author:** [@Vasanth2](https://discuss.elastic.co/u/Vasanth2)\ **Replies:** 0\ **Last updated:** [December 10, 2022, 6:08am UTC](https://discuss.elastic.co/t/error-unable-to-load-mongojdbc4-8-jar-from-jdbc-driver-library-file-not-readable-please-check-user-and-group-permissions-for-the-path/320937 "2022-12-10T06:08:02Z")
Error: unable to load mongojdbc4.8.jar from :jdbc\_driver\_library, file not readable (please check user and group permissions for the path) --- ## [How to configure 'ls.cgroup.cpu.path.override' in the Logstash JAVA\_OPTS environment variable](https://discuss.elastic.co/t/how-to-configure-ls-cgroup-cpu-path-override-in-the-logstash-java-opts-environment-variable/320880)
**Author:** [@jijesh\_vu](https://discuss.elastic.co/u/jijesh_vu)\ **Replies:** 2\ **Last updated:** [December 10, 2022, 5:46am UTC](https://discuss.elastic.co/t/how-to-configure-ls-cgroup-cpu-path-override-in-the-logstash-java-opts-environment-variable/320880 "2022-12-10T05:46:44Z")
I would like to know how to configure ls.cgroup.cpu.path.override and what this is means actaully? \[DEBUG\] 2022-12-09 12:27:37.592 \[pool-6-thread-1\] cpuresource - File /sys/fs/cgroup/cpu/kubepods.slice/kubepods-burstabl… --- ## [Metricbeat on RHEL 9 / Alma 9 / Rocky 9](https://discuss.elastic.co/t/metricbeat-on-rhel-9-alma-9-rocky-9/320703)
**Author:** [@fieryfly](https://discuss.elastic.co/u/fieryfly)\ **Replies:** 3\ **Last updated:** [December 10, 2022, 5:08am UTC](https://discuss.elastic.co/t/metricbeat-on-rhel-9-alma-9-rocky-9/320703 "2022-12-10T05:08:54Z")
Hello, I was looking through the product compatibility page Support Matrix | Elastic and didn't see a column for RHEL 9 under metricbeat. While running metricbeat, I see an error: runtime/cgo: pthread\_create failed: O… --- ## [Field names not parsing in Auditbeat](https://discuss.elastic.co/t/field-names-not-parsing-in-auditbeat/320914)
**Author:** [@kossde](https://discuss.elastic.co/u/kossde)\ **Replies:** 2\ **Last updated:** [December 10, 2022, 3:17am UTC](https://discuss.elastic.co/t/field-names-not-parsing-in-auditbeat/320914 "2022-12-10T03:17:56Z")
I feel like I'm missing something here. Auditbeat is up and running on an ubunutu server and I'm getting auditd, system, and file integrity logs but some fields referenced by the Elasticsearch prebuilt linux rules aren… --- ## [Missing required fields in duplicated rules](https://discuss.elastic.co/t/missing-required-fields-in-duplicated-rules/320874)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [December 9, 2022, 10:22pm UTC](https://discuss.elastic.co/t/missing-required-fields-in-duplicated-rules/320874 "2022-12-09T22:22:09Z")
When I duplicate a rule, I don't immediately see an option to select required fields? (I could be looking over it?) --- ## [Logstash Aggregate filter inside Elasticsearch](https://discuss.elastic.co/t/logstash-aggregate-filter-inside-elasticsearch/320934)
**Author:** [@watercannons](https://discuss.elastic.co/u/watercannons)\ **Replies:** 0\ **Last updated:** [December 9, 2022, 9:53pm UTC](https://discuss.elastic.co/t/logstash-aggregate-filter-inside-elasticsearch/320934 "2022-12-09T21:53:11Z")
Hi, first time on this forum, sorry if this is a duplicate. I'm running into some weird hardware-specific issues running LogStash that's causing the aggregate plugin to not apply on certain events. However, all of the da… --- ## [Where is Logstash installed by default?](https://discuss.elastic.co/t/where-is-logstash-installed-by-default/320913)
**Author:** [@timer5764](https://discuss.elastic.co/u/timer5764)\ **Replies:** 2\ **Last updated:** [December 9, 2022, 8:42pm UTC](https://discuss.elastic.co/t/where-is-logstash-installed-by-default/320913 "2022-12-09T20:42:47Z")
I have a CentOS machine that I recently installed Logstash on, using the following command: sudo yum install logstash The command executed successfully and Logstash was installed, as shown in the screenshot below: H… --- ## [ES Field Capabilities API does not return non-indexed/disabled fields when include\_unmapped=true](https://discuss.elastic.co/t/es-field-capabilities-api-does-not-return-non-indexed-disabled-fields-when-include-unmapped-true/320810)
**Author:** [@Alsheh](https://discuss.elastic.co/u/Alsheh)\ **Replies:** 3\ **Last updated:** [December 9, 2022, 8:07pm UTC](https://discuss.elastic.co/t/es-field-capabilities-api-does-not-return-non-indexed-disabled-fields-when-include-unmapped-true/320810 "2022-12-09T20:07:21Z")
Hi, I'm trying to list all fields in a certain index, indexed and non-indexed fields. I'm using the ES Field capabilities API: GET \/\_field\_caps?fields=\*&include\_unmapped=true. However, the API is not returni… --- ## [Metricbeat/system cpuinfo metricset tests fail on non-amd64 platforms](https://discuss.elastic.co/t/metricbeat-system-cpuinfo-metricset-tests-fail-on-non-amd64-platforms/320929)
**Author:** [@Jonathan\_Albrecht](https://discuss.elastic.co/u/Jonathan_Albrecht)\ **Replies:** 0\ **Last updated:** [December 9, 2022, 7:52pm UTC](https://discuss.elastic.co/t/metricbeat-system-cpuinfo-metricset-tests-fail-on-non-amd64-platforms/320929 "2022-12-09T19:52:37Z")
Two tests in metricbeat/module/system/test\_system.py: test\_core test\_core\_with\_cpu\_ticks fail on at least arm64 and s390x because the parser for /proc/cpuinfo only supports linux amd64 cpuinfo file format currently. I… --- ## [Aggregate logs of different grok matches](https://discuss.elastic.co/t/aggregate-logs-of-different-grok-matches/320901)
**Author:** [@stefanocog](https://discuss.elastic.co/u/stefanocog)\ **Replies:** 1\ **Last updated:** [December 9, 2022, 7:51pm UTC](https://discuss.elastic.co/t/aggregate-logs-of-different-grok-matches/320901 "2022-12-09T19:51:43Z")
Hi, I apologize in advance if the request appears incorrect I need calculate the time difference between a request and response of a REST service, this service produce two logs, one for request e and one for response an… --- ## [Elastic Deployment on minukube cluster Failing](https://discuss.elastic.co/t/elastic-deployment-on-minukube-cluster-failing/320924)
**Author:** [@akansha.agarwal1](https://discuss.elastic.co/u/akansha.agarwal1)\ **Replies:** 0\ **Last updated:** [December 9, 2022, 7:42pm UTC](https://discuss.elastic.co/t/elastic-deployment-on-minukube-cluster-failing/320924 "2022-12-09T19:42:04Z")
Hi, I am trying to deploy Elastic 8.5.2 on minukube cluster using: Helm, Statefulset & simple Elasticsearch cluster specification. But all deployments are failing with error: CrashLoopBackOff Although, deployment for… --- ## [authorizeIndexAction never gets called for custom AuthorizationEngine plugin](https://discuss.elastic.co/t/authorizeindexaction-never-gets-called-for-custom-authorizationengine-plugin/320921)
**Author:** [@adamsandor](https://discuss.elastic.co/u/adamsandor)\ **Replies:** 0\ **Last updated:** [December 9, 2022, 7:23pm UTC](https://discuss.elastic.co/t/authorizeindexaction-never-gets-called-for-custom-authorizationengine-plugin/320921 "2022-12-09T19:23:16Z")
I'm building a plugin that would execute some custom authorization logic, namely integrating the OpenPolicyAgent into the authorization flow of ES. I have implemented the org.elasticsearch.xpack.core.security.authz.Autho… --- ## [Centerlized Dashboard](https://discuss.elastic.co/t/centerlized-dashboard/316518)
**Author:** [@Milan\_Dangol](https://discuss.elastic.co/u/Milan_Dangol)\ **Replies:** 3\ **Last updated:** [October 16, 2022, 10:27pm UTC](https://discuss.elastic.co/t/centerlized-dashboard/316518 "2022-10-16T22:27:10Z")
Hello team, I have a query about the centralized dashboard. I am planning to integrate 60 VMs into my Kibana and I want to view all those individual 60 VM's graphs in a single dashboard. Thank you in advance \<3 --- ## [Enable soundex level search](https://discuss.elastic.co/t/enable-soundex-level-search/320904)
**Author:** [@ryendluri](https://discuss.elastic.co/u/ryendluri)\ **Replies:** 2\ **Last updated:** [December 9, 2022, 5:17pm UTC](https://discuss.elastic.co/t/enable-soundex-level-search/320904 "2022-12-09T17:17:32Z")
how to enable soundex search in querying data from Elastic search DB? thanks --- ## [Можно ли кастомизировать ukrainian\_analyzer с пощью shingle filter?](https://discuss.elastic.co/t/ukrainian-analyzer-shingle-filter/320887)
**Author:** [@va2dim](https://discuss.elastic.co/u/va2dim)\ **Replies:** 0\ **Last updated:** [December 9, 2022, 1:38pm UTC](https://discuss.elastic.co/t/ukrainian-analyzer-shingle-filter/320887 "2022-12-09T13:38:54Z")
Необходима комбинация ukrainian\_analyzer с shingle filter. С русским языком проблем нет - можно собрать кастомный анализатор: есть russian\_stemmer который можем передать как фильтр в кастомный анализатор. В реализаци… --- ## [Beat -\> Logstash -\> Elasticsearch configuration problem](https://discuss.elastic.co/t/beat-logstash-elasticsearch-configuration-problem/320801)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 1\ **Last updated:** [December 9, 2022, 3:18pm UTC](https://discuss.elastic.co/t/beat-logstash-elasticsearch-configuration-problem/320801 "2022-12-09T15:18:40Z")
I have a problem with the data flow configuration: Beat -\> Logstash -\> Elasticsearch I initially configured everything in the flow: Beat -\> Elasticsearch of course I initially did the required setup (adding standard … --- ## [Is it possible to reimplemented ukrainian build-in analyzer as a custom analyzer (extend ukrainian\_analyzer with shingle filter)?](https://discuss.elastic.co/t/is-it-possible-to-reimplemented-ukrainian-build-in-analyzer-as-a-custom-analyzer-extend-ukrainian-analyzer-with-shingle-filter/320888)
**Author:** [@va2dim](https://discuss.elastic.co/u/va2dim)\ **Replies:** 0\ **Last updated:** [December 9, 2022, 1:46pm UTC](https://discuss.elastic.co/t/is-it-possible-to-reimplemented-ukrainian-build-in-analyzer-as-a-custom-analyzer-extend-ukrainian-analyzer-with-shingle-filter/320888 "2022-12-09T13:46:27Z")
Need to reimplemented ukrainian build-in language analyzer as a custom analyzer (extend ukrainian analyzer with shingle filter). In russian we have russian\_stemmer that could be passed to custom analyzer. In ukrainian… --- ## [Kibana Can't store an async search response larger than?](https://discuss.elastic.co/t/kibana-cant-store-an-async-search-response-larger-than/316677)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 0\ **Last updated:** [October 15, 2022, 9:53am UTC](https://discuss.elastic.co/t/kibana-cant-store-an-async-search-response-larger-than/316677 "2022-10-15T09:53:13Z")
Can't store an async search response larger than \[10485760\] bytes. This limit can be set by changing the \[search.max\_async\_search\_response\_size\] setting. --- ## [How to create snapshot on datastream](https://discuss.elastic.co/t/how-to-create-snapshot-on-datastream/320778)
**Author:** [@meternich](https://discuss.elastic.co/u/meternich)\ **Replies:** 1\ **Last updated:** [December 9, 2022, 1:43pm UTC](https://discuss.elastic.co/t/how-to-create-snapshot-on-datastream/320778 "2022-12-09T13:43:00Z")
Hello. Until recently I was using regular indexes for data collection. Every month there was a new index and i could snapshot indices by month and send them to my repo and delete them in elastic. Now I've changed data co… --- ## [Filebeat filestream input pause when disk queue full?](https://discuss.elastic.co/t/filebeat-filestream-input-pause-when-disk-queue-full/320881)
**Author:** [@KanekaGuidos](https://discuss.elastic.co/u/KanekaGuidos)\ **Replies:** 2\ **Last updated:** [December 9, 2022, 1:37pm UTC](https://discuss.elastic.co/t/filebeat-filestream-input-pause-when-disk-queue-full/320881 "2022-12-09T13:37:57Z")
Dear, I tried searching for an answer, but didn't immediately find one. I'm using filebeat's filestream input (works great!) and setup the disk queue to a max\_size. The documentation of the internal queue states the f… --- ## [Reindex vs Split index speeds](https://discuss.elastic.co/t/reindex-vs-split-index-speeds/320779)
**Author:** [@Daithi\_O\_Conchobhair](https://discuss.elastic.co/u/Daithi_O_Conchobhair)\ **Replies:** 8\ **Last updated:** [December 9, 2022, 1:23pm UTC](https://discuss.elastic.co/t/reindex-vs-split-index-speeds/320779 "2022-12-09T13:23:46Z")
Hi there, I have a relatively large index, 1.1TB, which currently has one shard due to a misconfiguration. I would like to keep my shard size around 50GB. I have two options I guess Split the index into a new index wi… --- ## [Unexpected type mapstr.M warning](https://discuss.elastic.co/t/unexpected-type-mapstr-m-warning/320834)
**Author:** [@Alex\_Lavrov](https://discuss.elastic.co/u/Alex_Lavrov)\ **Replies:** 3\ **Last updated:** [December 9, 2022, 1:05pm UTC](https://discuss.elastic.co/t/unexpected-type-mapstr-m-warning/320834 "2022-12-09T13:05:11Z")
Hello, I'm sending JSON logs using filebeat and suddenly I started to get this error: {"log.level":"warn","@timestamp":"2022-12-08T23:33:51.575+0200","log.logger":"conditions","log.origin":{"file.name":"conditions/matc… --- ## [Percolator issue, matching queries](https://discuss.elastic.co/t/percolator-issue-matching-queries/320884)
**Author:** [@Mahesh\_Hegde](https://discuss.elastic.co/u/Mahesh_Hegde)\ **Replies:** 0\ **Last updated:** [December 9, 2022, 1:02pm UTC](https://discuss.elastic.co/t/percolator-issue-matching-queries/320884 "2022-12-09T13:02:43Z")
Hi Team, Issue module - percolator Issue Version - 8.3 & 8.4 Configuration Number of shards of percolator index - 2 Total documents indexed - 78000 approximate Index size = 30MB Details - We have about 78000 quer… --- ## [Help to convert hardcoded data values in Vega to ElasticSearch](https://discuss.elastic.co/t/help-to-convert-hardcoded-data-values-in-vega-to-elasticsearch/320694)
**Author:** [@tinrik](https://discuss.elastic.co/u/tinrik)\ **Replies:** 10\ **Last updated:** [December 9, 2022, 12:50pm UTC](https://discuss.elastic.co/t/help-to-convert-hardcoded-data-values-in-vega-to-elasticsearch/320694 "2022-12-09T12:50:38Z")
Hi! I have a Vega visualization working with harcoded data points. I have pasted the code in Kibana and works identically to the Vega editor. Now I want to replace hardcoded data points with the equivalent Elasticsearc… --- ## [How can i display string on yaxis of timelion?](https://discuss.elastic.co/t/how-can-i-display-string-on-yaxis-of-timelion/320879)
**Author:** [@Cusis\_Eel](https://discuss.elastic.co/u/Cusis_Eel)\ **Replies:** 0\ **Last updated:** [December 9, 2022, 12:06pm UTC](https://discuss.elastic.co/t/how-can-i-display-string-on-yaxis-of-timelion/320879 "2022-12-09T12:06:50Z")
i did use this code .es(index=timelion\_01, timefield=input\_date,metric='max:value').fit(carry).lines(fill=5) { "input\_date" : "2022-12-09T03:00:00.00", "value" : 2 (type is maybe long) } value is only 0 to 2 … --- ## [Composant output jdbc dans logstash](https://discuss.elastic.co/t/composant-output-jdbc-dans-logstash/320806)
**Author:** [@yannt](https://discuss.elastic.co/u/yannt)\ **Replies:** 4\ **Last updated:** [December 9, 2022, 11:31am UTC](https://discuss.elastic.co/t/composant-output-jdbc-dans-logstash/320806 "2022-12-09T11:31:48Z")
Bonjour nous avons installé logstash au droit d'un serveur postgresql que nous interrogeons via le composant input jdbc pour alimenter en ligne un cloud elastic. Nous cherchons maintenant à faire une opération de mise à… --- ## [How to get average number of samples for time series data with DSL query?](https://discuss.elastic.co/t/how-to-get-average-number-of-samples-for-time-series-data-with-dsl-query/320841)
**Author:** [@bgyomorei\_c](https://discuss.elastic.co/u/bgyomorei_c)\ **Replies:** 2\ **Last updated:** [December 9, 2022, 11:26am UTC](https://discuss.elastic.co/t/how-to-get-average-number-of-samples-for-time-series-data-with-dsl-query/320841 "2022-12-09T11:26:28Z")
I want to get the average number of request per second(or minute) for performance testing data, but the basic aggregation possibilities i've found so far doesn't cover this. I could only do a count on a field, but that … [Previous page](https://discuss.elastic.co/latest.md?page=862) [Next page](https://discuss.elastic.co/latest.md?page=864)