# Latest **URL:** https://discuss.elastic.co/latest.md?page=878 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 879 --- ## [“distinct” query in elasticsearch java api](https://discuss.elastic.co/t/distinct-query-in-elasticsearch-java-api/319349)
**Author:** [@hmkhitaryan](https://discuss.elastic.co/u/hmkhitaryan)\ **Replies:** 18\ **Last updated:** [November 29, 2022, 11:19pm UTC](https://discuss.elastic.co/t/distinct-query-in-elasticsearch-java-api/319349 "2022-11-29T23:19:05Z")
How to create “distinct” query in elasticsearch java api, like we do in sql. here is my query, which kibana generated, so I should do the same with java, and I'm trying many ways, but again getting with duplicates. "agg… --- ## [How robust is an Elastic cluster for planned single host outages?](https://discuss.elastic.co/t/how-robust-is-an-elastic-cluster-for-planned-single-host-outages/319794)
**Author:** [@ankh](https://discuss.elastic.co/u/ankh)\ **Replies:** 8\ **Last updated:** [November 29, 2022, 9:33pm UTC](https://discuss.elastic.co/t/how-robust-is-an-elastic-cluster-for-planned-single-host-outages/319794 "2022-11-29T21:33:37Z")
We are doing some network changes on about a dozen or so Elastic hosts, necessitating taking each host off the network briefly (up to a few minutes). We have at least 2 replicas for every index (ie 1 primary + 2 replica… --- ## [Normalizing Host Name](https://discuss.elastic.co/t/normalizing-host-name/319124)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 4\ **Last updated:** [November 29, 2022, 9:16pm UTC](https://discuss.elastic.co/t/normalizing-host-name/319124 "2022-11-29T21:16:00Z")
I am getting values for the host.name field in both upper and lower case, which makes searches difficult. What is the simplest way to normalize this field so that it in converted to all caps? --- ## [Kibana Alerts add fields property](https://discuss.elastic.co/t/kibana-alerts-add-fields-property/317999)
**Author:** [@gadelkareem](https://discuss.elastic.co/u/gadelkareem)\ **Replies:** 4\ **Last updated:** [November 2, 2022, 5:24pm UTC](https://discuss.elastic.co/t/kibana-alerts-add-fields-property/317999 "2022-11-02T17:24:41Z")
I am trying to add an extra fields using script\_fields or runtime\_mappings to Kibana alerts. But Kibana replaces the property fields with some timestamp. Is there a solution or workaround? Edit #1 to add code Query /my… --- ## [ELK 7.12.1 version ssl and tsl certificate issue](https://discuss.elastic.co/t/elk-7-12-1-version-ssl-and-tsl-certificate-issue/319411)
**Author:** [@Yog](https://discuss.elastic.co/u/Yog)\ **Replies:** 14\ **Last updated:** [November 29, 2022, 6:47pm UTC](https://discuss.elastic.co/t/elk-7-12-1-version-ssl-and-tsl-certificate-issue/319411 "2022-11-29T18:47:12Z")
I have 3 nodes , in that 1 is master node and 2 are child node , while enable ssl and tsl certificate i am getting an error : below is the error. at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.j… --- ## [\[Integrations\] F5 Integration, Radware Integration Out Of Date](https://discuss.elastic.co/t/integrations-f5-integration-radware-integration-out-of-date/319241)
**Author:** [@cmendez92](https://discuss.elastic.co/u/cmendez92)\ **Replies:** 2\ **Last updated:** [November 29, 2022, 5:53pm UTC](https://discuss.elastic.co/t/integrations-f5-integration-radware-integration-out-of-date/319241 "2022-11-29T17:53:09Z")
F5 and Radware integrations are deprecated. Let me explain, it is not normal that they have an intermediate parser in JS (without posibility of change fron integration), it is practically better to let the message throug… --- ## [Prevent collision of field types of structured logs](https://discuss.elastic.co/t/prevent-collision-of-field-types-of-structured-logs/319806)
**Author:** [@katexochen](https://discuss.elastic.co/u/katexochen)\ **Replies:** 3\ **Last updated:** [November 29, 2022, 5:01pm UTC](https://discuss.elastic.co/t/prevent-collision-of-field-types-of-structured-logs/319806 "2022-11-29T17:01:09Z")
I'm collecting logs to filebeat, sending them to logstash and from there to elastic. As the logs are structured, I'm using the json filter in logstash to parse the message. Let's say I'm having two messages/logs in json… --- ## [Ignore-above](https://discuss.elastic.co/t/ignore-above/320064)
**Author:** [@Anil\_Alapati](https://discuss.elastic.co/u/Anil_Alapati)\ **Replies:** 1\ **Last updated:** [November 29, 2022, 4:15pm UTC](https://discuss.elastic.co/t/ignore-above/320064 "2022-11-29T16:15:29Z")
Hi, i could see ignore-above variable in index settings. What does this mean and does this applicable to both ELASTIC SEARCH Discovery and Kibana Lens view? --- ## [How to create an alert for windows event log?](https://discuss.elastic.co/t/how-to-create-an-alert-for-windows-event-log/319996)
**Author:** [@jisha](https://discuss.elastic.co/u/jisha)\ **Replies:** 1\ **Last updated:** [November 29, 2022, 4:06pm UTC](https://discuss.elastic.co/t/how-to-create-an-alert-for-windows-event-log/319996 "2022-11-29T16:06:02Z")
Hi , I am completely new to this Alert creation. Need to create alert for winlogbeat with search guard. Does anyone have a template or know where I can find an example watch for an event log? --- ## [I am trying to create a memory usage alert in kibana but its showing 422 statuscode](https://discuss.elastic.co/t/i-am-trying-to-create-a-memory-usage-alert-in-kibana-but-its-showing-422-statuscode/319548)
**Author:** [@jisha](https://discuss.elastic.co/u/jisha)\ **Replies:** 1\ **Last updated:** [November 29, 2022, 4:03pm UTC](https://discuss.elastic.co/t/i-am-trying-to-create-a-memory-usage-alert-in-kibana-but-its-showing-422-statuscode/319548 "2022-11-29T16:03:04Z")
Hi , i am trying to create a memory usage alert in kibana but its showing 422 statuscode, while i define & return application details. This is the source which i used where error is showing up. if i removed applicati… --- ## [\[again\] Endpoint security immediately degraded](https://discuss.elastic.co/t/again-endpoint-security-immediately-degraded/318765)
**Author:** [@CrazyDumpling](https://discuss.elastic.co/u/CrazyDumpling)\ **Replies:** 8\ **Last updated:** [November 29, 2022, 3:35pm UTC](https://discuss.elastic.co/t/again-endpoint-security-immediately-degraded/318765 "2022-11-29T15:35:46Z")
Hello. I know this has been asked a million times here, but i've tried everything i know and i still can't get it to work. I have an Agent Policies with Network Packet Capture, Elastic Defend, and System integrations. … --- ## [Unable to delete datastream using delete datastream api](https://discuss.elastic.co/t/unable-to-delete-datastream-using-delete-datastream-api/320053)
**Author:** [@chinmoy\_padhi](https://discuss.elastic.co/u/chinmoy_padhi)\ **Replies:** 1\ **Last updated:** [November 29, 2022, 3:22pm UTC](https://discuss.elastic.co/t/unable-to-delete-datastream-using-delete-datastream-api/320053 "2022-11-29T15:22:54Z")
Hi I have referred the following link Delete data stream API | Elasticsearch Guide \[7.17\] | Elastic to delete Data stream. Unfortunately, not able to succeed Whenever I tried from console curl -X DELETE localhost:9200/… --- ## [Docker or binaries?](https://discuss.elastic.co/t/docker-or-binaries/320057)
**Author:** [@turboclick](https://discuss.elastic.co/u/turboclick)\ **Replies:** 1\ **Last updated:** [November 29, 2022, 3:10pm UTC](https://discuss.elastic.co/t/docker-or-binaries/320057 "2022-11-29T15:10:19Z")
Hi, I would discover and try ELK. I would install it on ma personal computer. Could you tell me what is the better solution between launch the binaries into a simple folder or use docker and why ? Thanks a lot for y… --- ## [Packetbeat 8.5 high CPU usage after updade from 7.17.7](https://discuss.elastic.co/t/packetbeat-8-5-high-cpu-usage-after-updade-from-7-17-7/320058)
**Author:** [@Alexander\_A](https://discuss.elastic.co/u/Alexander_A)\ **Replies:** 1\ **Last updated:** [November 29, 2022, 2:50pm UTC](https://discuss.elastic.co/t/packetbeat-8-5-high-cpu-usage-after-updade-from-7-17-7/320058 "2022-11-29T14:50:15Z")
After packetbeat update from 7.17.7 to 8.5.0 all our hosts show high CPU usage. Packetbeat used only for DNS traffic screening. Even after we enabled only ICMP in config we see more than 15% CPU usage but before it was … --- ## [One of the nodes disk usage is almost full](https://discuss.elastic.co/t/one-of-the-nodes-disk-usage-is-almost-full/318977)
**Author:** [@catadetest](https://discuss.elastic.co/u/catadetest)\ **Replies:** 8\ **Last updated:** [November 29, 2022, 2:44pm UTC](https://discuss.elastic.co/t/one-of-the-nodes-disk-usage-is-almost-full/318977 "2022-11-29T14:44:39Z")
We have 3 nodes in an elasticsearch cluster on version: 6.8.21 All of them are master and data nodes. Today, we observed that one node disk usage is almost full (88%), while the others are only 13%, 25% used. curl -s … --- ## [Wildcard queries slow since ES 5.x](https://discuss.elastic.co/t/wildcard-queries-slow-since-es-5-x/320054)
**Author:** [@nesretep](https://discuss.elastic.co/u/nesretep)\ **Replies:** 1\ **Last updated:** [November 29, 2022, 2:33pm UTC](https://discuss.elastic.co/t/wildcard-queries-slow-since-es-5-x/320054 "2022-11-29T14:33:18Z")
Hi there In the past, to my knowledge untill ES 6, queries - especially wildcard queries - were in general blisteringly fast. Since then, performance has degraded dramatically, with small improvements up through ES 7 an… --- ## [Error when exporting more than 1000 saved objects](https://discuss.elastic.co/t/error-when-exporting-more-than-1000-saved-objects/317497)
**Author:** [@jonas27](https://discuss.elastic.co/u/jonas27)\ **Replies:** 7\ **Last updated:** [November 2, 2022, 12:57pm UTC](https://discuss.elastic.co/t/error-when-exporting-more-than-1000-saved-objects/317497 "2022-11-02T12:57:58Z")
Hi, I am hitting an error in our infrastructure when exporting more than =\< 1000 saved objects (visualizations in particular) from either the API or inside the dev tools. However, when exporting the same objects via a li… --- ## ["TypeError: You provided 'undefined' where a stream was expected. You can provide an Observable](https://discuss.elastic.co/t/typeerror-you-provided-undefined-where-a-stream-was-expected-you-can-provide-an-observable/320056)
**Author:** [@Rajitha\_Bizz](https://discuss.elastic.co/u/Rajitha_Bizz)\ **Replies:** 0\ **Last updated:** [November 29, 2022, 2:12pm UTC](https://discuss.elastic.co/t/typeerror-you-provided-undefined-where-a-stream-was-expected-you-can-provide-an-observable/320056 "2022-11-29T14:12:38Z")
I facing this issue when we update kibana from 7.10.2 to 7.17.7. It is kind of strange behavior, there is a nginx proxy in between. {"type":"log","@timestamp":"2022-11-29T13:32:08+00:00","tags":\["error","http"\],"pid":2… --- ## [LiteSpeed Webserver Monitor](https://discuss.elastic.co/t/litespeed-webserver-monitor/320047)
**Author:** [@acosta353](https://discuss.elastic.co/u/acosta353)\ **Replies:** 0\ **Last updated:** [November 29, 2022, 1:25pm UTC](https://discuss.elastic.co/t/litespeed-webserver-monitor/320047 "2022-11-29T13:25:05Z")
Hello, Is there any way to monitor (filebeat and most important with metricbeats) a litespeed Webserver? I would like to have some graphs with statistics of number of requests, and other things as we have in Apache and… --- ## [Custom Ingest Pipeline](https://discuss.elastic.co/t/custom-ingest-pipeline/319316)
**Author:** [@acosta353](https://discuss.elastic.co/u/acosta353)\ **Replies:** 2\ **Last updated:** [November 29, 2022, 1:22pm UTC](https://discuss.elastic.co/t/custom-ingest-pipeline/319316 "2022-11-29T13:22:27Z")
Hello, I'm new to Elastic, and I'm trying to search how to configure properly a custom ingest pipeline to Apache integration. In fact, I need to add some different groks and time formats so that some logs can be parsed… --- ## [Elasticsearch search querry](https://discuss.elastic.co/t/elasticsearch-search-querry/320021)
**Author:** [@Ali5](https://discuss.elastic.co/u/Ali5)\ **Replies:** 4\ **Last updated:** [November 29, 2022, 11:56am UTC](https://discuss.elastic.co/t/elasticsearch-search-querry/320021 "2022-11-29T11:56:35Z")
GET products/\_search { "query": { "multi\_match" : { "query": "novel", "fields": \[ "description", "name","id" ,"price"\] } } } this is the querry which get my results done i want to convert it into java api in … --- ## [Filebeat logs not sent on a server for which chocolatey installed](https://discuss.elastic.co/t/filebeat-logs-not-sent-on-a-server-for-which-chocolatey-installed/318569)
**Author:** [@khadija70](https://discuss.elastic.co/u/khadija70)\ **Replies:** 1\ **Last updated:** [November 29, 2022, 11:43am UTC](https://discuss.elastic.co/t/filebeat-logs-not-sent-on-a-server-for-which-chocolatey-installed/318569 "2022-11-29T11:43:55Z")
Hi , We are configuring a server whith filebeat agent to send costum logs , however no logs are received on Kibana . Just to mention that the server for which we don't receive logs , we have chocolatey installed but it … --- ## [EOF while reading](https://discuss.elastic.co/t/eof-while-reading/319538)
**Author:** [@leschev](https://discuss.elastic.co/u/leschev)\ **Replies:** 6\ **Last updated:** [November 29, 2022, 10:45am UTC](https://discuss.elastic.co/t/eof-while-reading/319538 "2022-11-29T10:45:29Z")
Hello! I have a problem with debugging apm-server. I take example request body from here. curl --request POST http://\*.\*.\*.\*:\*/intake/v2/events -H "Content-Type: application/x-ndjson" -d @payload.ndjson I get response… --- ## [Mirror Kibanas on separate clusters](https://discuss.elastic.co/t/mirror-kibanas-on-separate-clusters/319814)
**Author:** [@lduvnjak](https://discuss.elastic.co/u/lduvnjak)\ **Replies:** 9\ **Last updated:** [November 29, 2022, 9:50am UTC](https://discuss.elastic.co/t/mirror-kibanas-on-separate-clusters/319814 "2022-11-29T09:50:59Z")
Hey Everyone, Is there any way to sync Kibanas across multiple clusters? Essentially, a way to sync all visualizations, dashboards, queries, etc. from one Kibana to another. I'm aware that you can use remote reindex, an… --- ## [Install Elasticsearch as a service - Windows](https://discuss.elastic.co/t/install-elasticsearch-as-a-service-windows/319463)
**Author:** [@Clonky](https://discuss.elastic.co/u/Clonky)\ **Replies:** 4\ **Last updated:** [November 29, 2022, 9:41am UTC](https://discuss.elastic.co/t/install-elasticsearch-as-a-service-windows/319463 "2022-11-29T09:41:19Z")
HI all, I have a fresh installation of Elasticsearch 8.5 and Kibana 8.5 on my Windows Server. I would like to install Elasticsearch as a Service that it gets started as soon as the Server starts and Kibana as well. Ho… --- ## [How to convert this ES querry into java?](https://discuss.elastic.co/t/how-to-convert-this-es-querry-into-java/320019)
**Author:** [@Ali5](https://discuss.elastic.co/u/Ali5)\ **Replies:** 0\ **Last updated:** [November 29, 2022, 9:37am UTC](https://discuss.elastic.co/t/how-to-convert-this-es-querry-into-java/320019 "2022-11-29T09:37:33Z")
GET products/\_search { "query": { "multi\_match" : { "query": "novel", "fields": \[ "description", "name","id" ,"price"\] } } } \`\`\`\`\`\`\`\`\`\`\`\`\`\`\`\`\` --- ## [Runtime field issue creating a date/time field](https://discuss.elastic.co/t/runtime-field-issue-creating-a-date-time-field/317551)
**Author:** [@Garry](https://discuss.elastic.co/u/Garry)\ **Replies:** 5\ **Last updated:** [November 2, 2022, 11:24am UTC](https://discuss.elastic.co/t/runtime-field-issue-creating-a-date-time-field/317551 "2022-11-02T11:24:12Z")
I am creating a new date field through Lens. The original field is coming through as text in the format '2022-10-25T16:04:35.320' In the Set Value field i have... if (doc.containsKey('sql.metrics.string.starttime')) { … --- ## [Multiple URL links in one field](https://discuss.elastic.co/t/multiple-url-links-in-one-field/319965)
**Author:** [@Harold\_Van\_der\_Veken](https://discuss.elastic.co/u/Harold_Van_der_Veken)\ **Replies:** 3\ **Last updated:** [November 29, 2022, 9:15am UTC](https://discuss.elastic.co/t/multiple-url-links-in-one-field/319965 "2022-11-29T09:15:00Z")
Is there a way to create a field that has more than 1 link to another resource. Can I create (and format) a string that holds 2 urls. E.g. "Goto \ or \" \ can be selected to open the url. \<… --- ## [Collector \[cluster\_stats\] timed out when collecting data: node](https://discuss.elastic.co/t/collector-cluster-stats-timed-out-when-collecting-data-node/319955)
**Author:** [@rh05](https://discuss.elastic.co/u/rh05)\ **Replies:** 3\ **Last updated:** [November 29, 2022, 9:12am UTC](https://discuss.elastic.co/t/collector-cluster-stats-timed-out-when-collecting-data-node/319955 "2022-11-29T09:12:54Z")
Hello everyone, I have a problem if someone can help me it would be very appreciated. For several weeks I have noticed that my elastic cluster is unavailable for about 1 hour almost all the time at the same time on Sun… --- ## [How to setup the text of an alert in Kibana?](https://discuss.elastic.co/t/how-to-setup-the-text-of-an-alert-in-kibana/320016)
**Author:** [@alytkowski](https://discuss.elastic.co/u/alytkowski)\ **Replies:** 0\ **Last updated:** [November 29, 2022, 9:05am UTC](https://discuss.elastic.co/t/how-to-setup-the-text-of-an-alert-in-kibana/320016 "2022-11-29T09:05:01Z")
I have a question which I cannot find the answer for in docs: How t setup the text of an alert in Kibana? In above image, you can see some alerts from my rules. I'd like to change the text of the reason field to som… [Previous page](https://discuss.elastic.co/latest.md?page=877) [Next page](https://discuss.elastic.co/latest.md?page=879)