# Latest **URL:** https://discuss.elastic.co/latest.md?page=928 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 929 --- ## [Combine value for a common field from search results and remove one of the result](https://discuss.elastic.co/t/combine-value-for-a-common-field-from-search-results-and-remove-one-of-the-result/316831)
**Author:** [@Calvin\_Feng](https://discuss.elastic.co/u/Calvin_Feng)\ **Replies:** 2\ **Last updated:** [October 18, 2022, 12:46am UTC](https://discuss.elastic.co/t/combine-value-for-a-common-field-from-search-results-and-remove-one-of-the-result/316831 "2022-10-18T00:46:49Z")
Hi dear, We have a some documents saved in Elasticsearch with a common value, like group\_id. When we do the search, we'd like to combine the value of specific field if the documents are having the same group\_id. Then we… --- ## [Eland - exactly which of the pandas are supported?](https://discuss.elastic.co/t/eland-exactly-which-of-the-pandas-are-supported/316829)
**Author:** [@sachinsdesai](https://discuss.elastic.co/u/sachinsdesai)\ **Replies:** 0\ **Last updated:** [October 17, 2022, 10:10pm UTC](https://discuss.elastic.co/t/eland-exactly-which-of-the-pandas-are-supported/316829 "2022-10-17T22:10:38Z")
I am looking at Supported Pandas APIs — eland 8.3.0 documentation and several of the APIs are not supported. An an example, sort\_values is not supported, but the documentation says it is. Where can I get info about exact… --- ## [Docker Image not uploading to ecr from jenkins](https://discuss.elastic.co/t/docker-image-not-uploading-to-ecr-from-jenkins/316616)
**Author:** [@veera\_ravala](https://discuss.elastic.co/u/veera_ravala)\ **Replies:** 1\ **Last updated:** [October 17, 2022, 11:54pm UTC](https://discuss.elastic.co/t/docker-image-not-uploading-to-ecr-from-jenkins/316616 "2022-10-17T23:54:40Z")
=I created a CI/CD pipline which builds a docker image and pushes to docker image to amazon ecr. The docker image build perfectly but does not upload to ecr After building the image it keeps retrying to upload the imag… --- ## [Elasticsearch cross cluster data migration approach](https://discuss.elastic.co/t/elasticsearch-cross-cluster-data-migration-approach/316692)
**Author:** [@Sarthak\_Agarwal](https://discuss.elastic.co/u/Sarthak_Agarwal)\ **Replies:** 1\ **Last updated:** [October 17, 2022, 11:50pm UTC](https://discuss.elastic.co/t/elasticsearch-cross-cluster-data-migration-approach/316692 "2022-10-17T23:50:19Z")
Hi, We have an existing cluster running ES 5.6.7 version. We want to create a new cluster running ES 7.17.5 version and migrate all data to this cluster. We have close to 300 Million documents present on the existing c… --- ## [LDAP Group members can't login in elasticsearch](https://discuss.elastic.co/t/ldap-group-members-cant-login-in-elasticsearch/316446)
**Author:** [@Tarah](https://discuss.elastic.co/u/Tarah)\ **Replies:** 7\ **Last updated:** [October 17, 2022, 11:39pm UTC](https://discuss.elastic.co/t/ldap-group-members-cant-login-in-elasticsearch/316446 "2022-10-17T23:39:41Z")
Hi Elastic Team, I think I'm missing something here. E456 uid can't login to elasticsearch even if it is a member of ou=people,ou=ec,o=world. But when using E123 uid, it is successful. E456 and E123 belongs to the same … --- ## [EQL with time filter](https://discuss.elastic.co/t/eql-with-time-filter/316781)
**Author:** [@kmz161](https://discuss.elastic.co/u/kmz161)\ **Replies:** 0\ **Last updated:** [October 17, 2022, 12:24pm UTC](https://discuss.elastic.co/t/eql-with-time-filter/316781 "2022-10-17T12:24:31Z")
Hello! I use rule for checking Sysmon logs '''any where event.code == 1 and process.executable: "C:\\Windows\\System32\\sc.exe" ''' The rule is working, but it checks all existing indexes. And my ELK is very loaded. How… --- ## [OpenTelemetry Metrics exporter (DotNet)](https://discuss.elastic.co/t/opentelemetry-metrics-exporter-dotnet/305578)
**Author:** [@piotrkula](https://discuss.elastic.co/u/piotrkula)\ **Replies:** 0\ **Last updated:** [May 25, 2022, 8:44am UTC](https://discuss.elastic.co/t/opentelemetry-metrics-exporter-dotnet/305578 "2022-05-25T08:44:23Z")
Hello I have hooked up metrics instrumentation in dotnet and use the OpenTelemetry exporter, which is supposed to map all metrics to the OTLP standard. I can see metrics in the metric analyser but I do not understand w… --- ## [Replace the last search result in the log](https://discuss.elastic.co/t/replace-the-last-search-result-in-the-log/316801)
**Author:** [@lmo](https://discuss.elastic.co/u/lmo)\ **Replies:** 0\ **Last updated:** [October 17, 2022, 2:34pm UTC](https://discuss.elastic.co/t/replace-the-last-search-result-in-the-log/316801 "2022-10-17T14:34:00Z")
I am currently monitoring the database(Jdbc). This bank refers to product sales, where at first the status of the sale receives "WAITING FOR PAYMENT" and after payment it receives the status of "PAID". however, when th… --- ## [Zone aware topologySpreadConstraints not working](https://discuss.elastic.co/t/zone-aware-topologyspreadconstraints-not-working/316825)
**Author:** [@ejsmith](https://discuss.elastic.co/u/ejsmith)\ **Replies:** 0\ **Last updated:** [October 17, 2022, 8:22pm UTC](https://discuss.elastic.co/t/zone-aware-topologyspreadconstraints-not-working/316825 "2022-10-17T20:22:46Z")
What did you do? Followed instructions for making the ES cluster zone aware. What did you expect to see? Pods scheduled evenly across all zones. What did you see instead? Under which circumstances? 3 total zones, 3 … --- ## [Elastic Agent / Endpoint no longer can connect to fleet server](https://discuss.elastic.co/t/elastic-agent-endpoint-no-longer-can-connect-to-fleet-server/316702)
**Author:** [@Ting\_sf](https://discuss.elastic.co/u/Ting_sf)\ **Replies:** 1\ **Last updated:** [October 17, 2022, 8:07pm UTC](https://discuss.elastic.co/t/elastic-agent-endpoint-no-longer-can-connect-to-fleet-server/316702 "2022-10-17T20:07:44Z")
I had elastic agent / end point installed on about 10 computers, they were working for pass months, I just noted today that all pcs are showing offline status, and I check logs, all show following error: \[elastic\_agent\]… --- ## [Disk Usage - Something isnt adding up](https://discuss.elastic.co/t/disk-usage-something-isnt-adding-up/316822)
**Author:** [@Kurtis\_Schlienger](https://discuss.elastic.co/u/Kurtis_Schlienger)\ **Replies:** 1\ **Last updated:** [October 17, 2022, 7:17pm UTC](https://discuss.elastic.co/t/disk-usage-something-isnt-adding-up/316822 "2022-10-17T19:17:43Z")
I recently was looking into the shard distribution in my Elasticsearch cluster, and I noticed a heavy weighting on half of my cluster (some nodes have barely any shards on them). When looking into the distribution what I… --- ## [Getting Configuration Error (No configuration found in the configured sources) : Logstash in Windows 11 Systems](https://discuss.elastic.co/t/getting-configuration-error-no-configuration-found-in-the-configured-sources-logstash-in-windows-11-systems/316784)
**Author:** [@SP003](https://discuss.elastic.co/u/SP003)\ **Replies:** 6\ **Last updated:** [October 17, 2022, 7:14pm UTC](https://discuss.elastic.co/t/getting-configuration-error-no-configuration-found-in-the-configured-sources-logstash-in-windows-11-systems/316784 "2022-10-17T19:14:07Z")
Hello, Greetings ! I am running Logstash from my system (windows 11) I have configured Elasticsearch and Kibana and its running fine. But Getting below error, while configuring log stash. Could you please tell me w… --- ## [Data node left cluster. /media/Data/elasticsearch missing](https://discuss.elastic.co/t/data-node-left-cluster-media-data-elasticsearch-missing/316800)
**Author:** [@mhoward](https://discuss.elastic.co/u/mhoward)\ **Replies:** 2\ **Last updated:** [October 17, 2022, 7:01pm UTC](https://discuss.elastic.co/t/data-node-left-cluster-media-data-elasticsearch-missing/316800 "2022-10-17T19:01:41Z")
Hello. Yesterday one of our data nodes left our cluster and we've been unable to get it to rejoin. I'm still able to SSH into the physical server and noticed an error in the elasticsearch logs that led me to discover t… --- ## [RestHighLevelClient 7.17 not able to parse extended\_stats response](https://discuss.elastic.co/t/resthighlevelclient-7-17-not-able-to-parse-extended-stats-response/316368)
**Author:** [@swamy\_sandeep\_kommur](https://discuss.elastic.co/u/swamy_sandeep_kommur)\ **Replies:** 3\ **Last updated:** [October 17, 2022, 6:59pm UTC](https://discuss.elastic.co/t/resthighlevelclient-7-17-not-able-to-parse-extended-stats-response/316368 "2022-10-17T18:59:56Z")
Below is the query I am trying to make on Elasticsearch 8.3, using RestHighLevelClient 7.17 Query --------- { "size": 0, "timeout": "600000ms", "query": { "bool": { "filter": \[ { "range… --- ## [Need some help for Elastic Observability Engineer Lab 1.2 setting up the ICMP](https://discuss.elastic.co/t/need-some-help-for-elastic-observability-engineer-lab-1-2-setting-up-the-icmp/315803)
**Author:** [@Jsarath](https://discuss.elastic.co/u/Jsarath)\ **Replies:** 4\ **Last updated:** [October 17, 2022, 6:54pm UTC](https://discuss.elastic.co/t/need-some-help-for-elastic-observability-engineer-lab-1-2-setting-up-the-icmp/315803 "2022-10-17T18:54:50Z")
Hello, I am having trouble setting up the ICMP in Lab 1.2. I put in the solution and it tells me I need a key for it, but it does not provide one in the lab. --- ## [Filebeat's logs doesn't create](https://discuss.elastic.co/t/filebeats-logs-doesnt-create/316710)
**Author:** [@sevbans](https://discuss.elastic.co/u/sevbans)\ **Replies:** 10\ **Last updated:** [October 17, 2022, 6:40pm UTC](https://discuss.elastic.co/t/filebeats-logs-doesnt-create/316710 "2022-10-17T18:40:02Z")
This is my current configuration file. filebeat.inputs: - type: log enabled: true paths: - /var/log/\*.log output.elasticsearch: hosts: \["localhost:9200"\] username: "elastic" password: "1" enabled: false… --- ## [Time for apm data to show up in kibana apm interface](https://discuss.elastic.co/t/time-for-apm-data-to-show-up-in-kibana-apm-interface/316253)
**Author:** [@Peter\_Li](https://discuss.elastic.co/u/Peter_Li)\ **Replies:** 6\ **Last updated:** [October 17, 2022, 5:46pm UTC](https://discuss.elastic.co/t/time-for-apm-data-to-show-up-in-kibana-apm-interface/316253 "2022-10-17T17:46:29Z")
I am wondering what is the expected time for a transaction/span data to show up in kibana ? I noticed that it is taking 1-2 minutes after the close of transaction before data shows up in kibana. I am running 8.4.2 (ela… --- ## [ERROR checkpoint/checkpoint.go:200](https://discuss.elastic.co/t/error-checkpoint-checkpoint-go-200/316644)
**Author:** [@lsbitri88](https://discuss.elastic.co/u/lsbitri88)\ **Replies:** 4\ **Last updated:** [October 17, 2022, 5:45pm UTC](https://discuss.elastic.co/t/error-checkpoint-checkpoint-go-200/316644 "2022-10-17T17:45:40Z")
Hi all, trying to find out what is the root cause of this error : // ERROR checkpoint/checkpoint.go:200 rename X:\\Directory\\winlogbeat\\data.winlogbeat.yml.new X:\\Directory\\winlogbeat\\data.winlogbeat.yml: Access is den… --- ## [Uptime does not display the details accurately](https://discuss.elastic.co/t/uptime-does-not-display-the-details-accurately/316214)
**Author:** [@swchandu](https://discuss.elastic.co/u/swchandu)\ **Replies:** 9\ **Last updated:** [October 17, 2022, 3:09pm UTC](https://discuss.elastic.co/t/uptime-does-not-display-the-details-accurately/316214 "2022-10-17T15:09:25Z")
Hi, ELK 8.4.1 does not show correct details in uptime home. The graph is blank and monitors does not show correct time. But I can go through the monitor and check latest steps's data by clicking on next Did any one f… --- ## [Filebeat unable to ship logs to Logstash](https://discuss.elastic.co/t/filebeat-unable-to-ship-logs-to-logstash/316802)
**Author:** [@charlot\_Attard](https://discuss.elastic.co/u/charlot_Attard)\ **Replies:** 1\ **Last updated:** [October 17, 2022, 3:05pm UTC](https://discuss.elastic.co/t/filebeat-unable-to-ship-logs-to-logstash/316802 "2022-10-17T15:05:52Z")
Dear all, I am encountering a strange issue. I am configuring filebeat on a windows server forwarding logs to logstash on a linux server. Network access is reachable. When configuring filebeat agents to connect to logst… --- ## [Dynamic mapping](https://discuss.elastic.co/t/dynamic-mapping/316475)
**Author:** [@cool999](https://discuss.elastic.co/u/cool999)\ **Replies:** 8\ **Last updated:** [October 17, 2022, 2:48pm UTC](https://discuss.elastic.co/t/dynamic-mapping/316475 "2022-10-17T14:48:04Z")
Hi Team, I am trying to understand if we can partially customize elasticsearch's dynamic mapping i.e for some of the fields we will set the data type explicitely and all the remaining fields (which are not mentioned exp… --- ## [How to edit role descriptor for a service account](https://discuss.elastic.co/t/how-to-edit-role-descriptor-for-a-service-account/316379)
**Author:** [@CarlosD](https://discuss.elastic.co/u/CarlosD)\ **Replies:** 4\ **Last updated:** [October 17, 2022, 2:20pm UTC](https://discuss.elastic.co/t/how-to-edit-role-descriptor-for-a-service-account/316379 "2022-10-17T14:20:38Z")
I would like to edit the default role descriptor for service account elastic/kibana, however, I do not find a way to achieve this. Alternatively, I created a role with the privileges I want to have on service account el… --- ## [Update\_by\_query fails to update all documents in ElasticSearch, getting true in between](https://discuss.elastic.co/t/update-by-query-fails-to-update-all-documents-in-elasticsearch-getting-true-in-between/316744)
**Author:** [@PriyaSmartShore](https://discuss.elastic.co/u/PriyaSmartShore)\ **Replies:** 1\ **Last updated:** [October 17, 2022, 1:55pm UTC](https://discuss.elastic.co/t/update-by-query-fails-to-update-all-documents-in-elasticsearch-getting-true-in-between/316744 "2022-10-17T13:55:27Z")
I have over 25 million documents in Elasticsearch (version - 7.6.2), those are having duplicates among them. So I have written a script in painless to delete one instance of duplicated document. I have tried running the … --- ## [Unbalanced distribution of index (shards) between HOT servers ES](https://discuss.elastic.co/t/unbalanced-distribution-of-index-shards-between-hot-servers-es/315603)
**Author:** [@Aleksei](https://discuss.elastic.co/u/Aleksei)\ **Replies:** 6\ **Last updated:** [October 17, 2022, 1:44pm UTC](https://discuss.elastic.co/t/unbalanced-distribution-of-index-shards-between-hot-servers-es/315603 "2022-10-17T13:44:03Z")
Hi community ! I apologize if this topic has been covered for a long time. But I never found it in the open Elastic Сommunity. :face\_with\_peeking\_eye: We have 11 cluster servers in the infrastructure ES: Servers HOT … --- ## [Kubernetes Filebeat autodiscover does not find containers](https://discuss.elastic.co/t/kubernetes-filebeat-autodiscover-does-not-find-containers/316713)
**Author:** [@akiks](https://discuss.elastic.co/u/akiks)\ **Replies:** 0\ **Last updated:** [October 16, 2022, 9:17pm UTC](https://discuss.elastic.co/t/kubernetes-filebeat-autodiscover-does-not-find-containers/316713 "2022-10-16T21:17:53Z")
I'm trying to let filebeat collect logs of containers running within Kubernetes using a conditional autodiscover template, but filebeat does never print any of the containers logs. Here is an example container whose lo… --- ## [Heartbeat auto discovery generates second monitor which is always down](https://discuss.elastic.co/t/heartbeat-auto-discovery-generates-second-monitor-which-is-always-down/315491)
**Author:** [@kintetsu](https://discuss.elastic.co/u/kintetsu)\ **Replies:** 12\ **Last updated:** [October 17, 2022, 10:29am UTC](https://discuss.elastic.co/t/heartbeat-auto-discovery-generates-second-monitor-which-is-always-down/315491 "2022-10-17T10:29:04Z")
Hi, since we updated Heartbeat in our Kubernetes cluster from version 7.17.x to 8.3.3, we have a second monitor for every pod we have annotated. Both monitors have the same name and the same tags. Just one has no UR… --- ## [Exporting and visualizing with surrounding documents](https://discuss.elastic.co/t/exporting-and-visualizing-with-surrounding-documents/316753)
**Author:** [@Jose\_E](https://discuss.elastic.co/u/Jose_E)\ **Replies:** 2\ **Last updated:** [October 17, 2022, 10:28am UTC](https://discuss.elastic.co/t/exporting-and-visualizing-with-surrounding-documents/316753 "2022-10-17T10:28:20Z")
Hello, I've encountered a rather simple scenario that I don't know how to solve with Kibana. Our current deployment receives logs from all machines in the network, and our goal is to switch to Kibana as a way of debuggin… --- ## [What's the cause and the solution of this error](https://discuss.elastic.co/t/whats-the-cause-and-the-solution-of-this-error/315055)
**Author:** [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\ **Replies:** 9\ **Last updated:** [October 17, 2022, 9:51am UTC](https://discuss.elastic.co/t/whats-the-cause-and-the-solution-of-this-error/315055 "2022-10-17T09:51:03Z")
ubuntu 22.04 VM elasticsearch,kibana,filebeat8.4.1 ,elastalert,suricata i have this error in the log of elasticsearch when i try to start elasticsearch it failed to start Failed to get the temporary directory; falling… --- ## [Elastic Aggregate](https://discuss.elastic.co/t/elastic-aggregate/316485)
**Author:** [@edhbs31](https://discuss.elastic.co/u/edhbs31)\ **Replies:** 5\ **Last updated:** [October 17, 2022, 9:40am UTC](https://discuss.elastic.co/t/elastic-aggregate/316485 "2022-10-17T09:40:26Z")
Hi Guys, I am very new at elastic.. and i need some help or advice.. i have elastic's json result like this: "results": \[ { "discount": "", }, And Aggregate like this.. "data": \[ { "count": 17081, "value": "" … --- ## [Why "conf.dfs.replication" : "1" is not SUCCESS?](https://discuss.elastic.co/t/why-conf-dfs-replication-1-is-not-success/316405)
**Author:** [@bo8888](https://discuss.elastic.co/u/bo8888)\ **Replies:** 12\ **Last updated:** [October 17, 2022, 9:38am UTC](https://discuss.elastic.co/t/why-conf-dfs-replication-1-is-not-success/316405 "2022-10-17T09:38:23Z")
I set snapshot use hdfs with conf conf.dfs.replication = 1 ,but I found the replication of data is also 3，i need to hdfs dfs -setrep -R -w 1 /es\_snapshots GET \_snapshot/es\_snapshots { "es\_snapshots" : { "type" : … [Previous page](https://discuss.elastic.co/latest.md?page=927) [Next page](https://discuss.elastic.co/latest.md?page=929)