# Latest **URL:** https://discuss.elastic.co/latest.md?page=944 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 945 --- ## [How can I encrypt the data stored in indexes?](https://discuss.elastic.co/t/how-can-i-encrypt-the-data-stored-in-indexes/315691)
**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\ **Replies:** 5\ **Last updated:** [October 4, 2022, 1:32pm UTC](https://discuss.elastic.co/t/how-can-i-encrypt-the-data-stored-in-indexes/315691 "2022-10-04T13:32:25Z")
Hi, I am developing my own external custom plugin in React. And I am planning to store personal information of customers and their inventory data as well in Elasticsearch, in addition to logging data. I am planning to … --- ## [Using scroll for very large indices](https://discuss.elastic.co/t/using-scroll-for-very-large-indices/315776)
**Author:** [@SFarhanizade](https://discuss.elastic.co/u/SFarhanizade)\ **Replies:** 0\ **Last updated:** [October 4, 2022, 1:20pm UTC](https://discuss.elastic.co/t/using-scroll-for-very-large-indices/315776 "2022-10-04T13:20:25Z")
Hi. There is an index having arround 200 million documents. I want to scroll over all its documents, so I prefered to use sliced scroll to do so, but every time I use scroll for this index, after some minutes of getting … --- ## [Error logs not coming in for @Async method in using Java APM agent for SpringBoot application](https://discuss.elastic.co/t/error-logs-not-coming-in-for-async-method-in-using-java-apm-agent-for-springboot-application/315743)
**Author:** [@Jawed-Aquib](https://discuss.elastic.co/u/Jawed-Aquib)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 1:08pm UTC](https://discuss.elastic.co/t/error-logs-not-coming-in-for-async-method-in-using-java-apm-agent-for-springboot-application/315743 "2022-10-04T13:08:43Z")
I have configured the java APM agent through the elastic.apm.service\_name config for my spring-boot application. When there is any error occurring for my method annotated with @Async the error from this isn't availab… --- ## [How to get a single count only per document when using nested term aggregation?](https://discuss.elastic.co/t/how-to-get-a-single-count-only-per-document-when-using-nested-term-aggregation/315774)
**Author:** [@binoiii](https://discuss.elastic.co/u/binoiii)\ **Replies:** 0\ **Last updated:** [October 4, 2022, 12:59pm UTC](https://discuss.elastic.co/t/how-to-get-a-single-count-only-per-document-when-using-nested-term-aggregation/315774 "2022-10-04T12:59:17Z")
Mapping "work\_rights": { "type": "nested", "properties": { "country\_tid": { "type": "keyword" }, "work\_right\_type": { "properties": { "tid": { "type": "keyword" } … --- ## [Metricbeat showing failure](https://discuss.elastic.co/t/metricbeat-showing-failure/315203)
**Author:** [@Akaren](https://discuss.elastic.co/u/Akaren)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 12:35pm UTC](https://discuss.elastic.co/t/metricbeat-showing-failure/315203 "2022-10-04T12:35:36Z")
Hi, I started playing with metricbeat. I set logstash module module: logstash #metricsets: - node - node\_stats period: 30s hosts: \["localhost:9600"\] and it works, output is ES index. When I get last event it shows… --- ## [Amazon\_s3\_exception when trying to create repo, even though it still creates test folder](https://discuss.elastic.co/t/amazon-s3-exception-when-trying-to-create-repo-even-though-it-still-creates-test-folder/315728)
**Author:** [@javadevmtl](https://discuss.elastic.co/u/javadevmtl)\ **Replies:** 2\ **Last updated:** [October 4, 2022, 12:23pm UTC](https://discuss.elastic.co/t/amazon-s3-exception-when-trying-to-create-repo-even-though-it-still-creates-test-folder/315728 "2022-10-04T12:23:42Z")
Hi getting the below error, but the funny thing is there's a test folder created in the bucker. For example: tests--v15dKjeS5uBICtqKNVEdg/ and the master.dat file is inside. { "type": "s3", "settings": { "bucket… --- ## [Elasticsearch cluster \[6.8\] becomes unresponsive for a small duration when one of the nodes in the cluster does not respond to any requests & is not part of the cluster. Is this the expected behaviour?](https://discuss.elastic.co/t/elasticsearch-cluster-6-8-becomes-unresponsive-for-a-small-duration-when-one-of-the-nodes-in-the-cluster-does-not-respond-to-any-requests-is-not-part-of-the-cluster-is-this-the-expected-behaviour/315421)
**Author:** [@srivatsa](https://discuss.elastic.co/u/srivatsa)\ **Replies:** 4\ **Last updated:** [October 4, 2022, 11:54am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-6-8-becomes-unresponsive-for-a-small-duration-when-one-of-the-nodes-in-the-cluster-does-not-respond-to-any-requests-is-not-part-of-the-cluster-is-this-the-expected-behaviour/315421 "2022-10-04T11:54:19Z")
Hi Folks, The observation in our ES cluster (6.8 version) consisting of 40 nodes is that when any one of the nodes becomes unresponsive, especially in scenarios where the thread pools on the machine are full & rejection… --- ## [Filter first match only using Grok or ruby code](https://discuss.elastic.co/t/filter-first-match-only-using-grok-or-ruby-code/315758)
**Author:** [@rootk1d](https://discuss.elastic.co/u/rootk1d)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 11:52am UTC](https://discuss.elastic.co/t/filter-first-match-only-using-grok-or-ruby-code/315758 "2022-10-04T11:52:44Z")
I have a field that contains the following data "REQUEST-941-APPLICATION-ATTACK-XSS, REQUEST-941-APPLICATION-ATTACK-XSS, REQUEST-941-APPLICATION-ATTACK-XSS, REQUEST-942-APPLICATION-ATTACK-SQLI, REQUEST-949-BLOCKING-EVAL… --- ## [Help on getting query to count avg, min and max nestings](https://discuss.elastic.co/t/help-on-getting-query-to-count-avg-min-and-max-nestings/315768)
**Author:** [@sreekanth](https://discuss.elastic.co/u/sreekanth)\ **Replies:** 0\ **Last updated:** [October 4, 2022, 11:10am UTC](https://discuss.elastic.co/t/help-on-getting-query-to-count-avg-min-and-max-nestings/315768 "2022-10-04T11:10:04Z")
I have an index with one nested field. Some docs have 10 nested docs and a few may have thousands of nested docs. I want to find the average/min and max count of nested items count across the index. Sample data: in thi… --- ## [Logstash Cloudwatch Input Plugin](https://discuss.elastic.co/t/logstash-cloudwatch-input-plugin/314694)
**Author:** [@connectgeeks](https://discuss.elastic.co/u/connectgeeks)\ **Replies:** 2\ **Last updated:** [October 4, 2022, 11:09am UTC](https://discuss.elastic.co/t/logstash-cloudwatch-input-plugin/314694 "2022-10-04T11:09:23Z")
Hi I'm using input cloudwatch plugin for aws cloudwatch ingestion using logstash. I want to reingest the entire data now. How can I achieve that ? Also, where (path) logstash keeps the registry file to maintain the seq… --- ## [Helm chart - logstash elasticsearch connection configuration?](https://discuss.elastic.co/t/helm-chart-logstash-elasticsearch-connection-configuration/315756)
**Author:** [@tirelibirefe](https://discuss.elastic.co/u/tirelibirefe)\ **Replies:** 0\ **Last updated:** [October 4, 2022, 9:34am UTC](https://discuss.elastic.co/t/helm-chart-logstash-elasticsearch-connection-configuration/315756 "2022-10-04T09:34:01Z")
Hello, I installed Logstash by using Helm Chart here and need to configure Elasticsearch connection. I looked for documentation but couldn't have found... How can I configure elasticsearch connection? Thanks & Regar… --- ## [Sort performance since elastic 7.16](https://discuss.elastic.co/t/sort-performance-since-elastic-7-16/315740)
**Author:** [@vjgorla](https://discuss.elastic.co/u/vjgorla)\ **Replies:** 0\ **Last updated:** [October 4, 2022, 6:51am UTC](https://discuss.elastic.co/t/sort-performance-since-elastic-7-16/315740 "2022-10-04T06:51:43Z")
A query that sorts by a keyword field that we have been using on elastic 7.13.2 now performs quite badly on 8.4.1. There is no change to the query or mappings. Only change is the elastic version. This query is crucial i… --- ## [Configuration for shipping Docker logs to a locally installed Logstash](https://discuss.elastic.co/t/configuration-for-shipping-docker-logs-to-a-locally-installed-logstash/315725)
**Author:** [@Chma](https://discuss.elastic.co/u/Chma)\ **Replies:** 0\ **Last updated:** [October 3, 2022, 10:27pm UTC](https://discuss.elastic.co/t/configuration-for-shipping-docker-logs-to-a-locally-installed-logstash/315725 "2022-10-03T22:27:30Z")
I have my ELK deployed on an ec2 instance and a dockerized application running on a different instance. I am trying to use gelf to collect the different service logs and send to logstash. But my current configuration doe… --- ## [Data management](https://discuss.elastic.co/t/data-management/315371)
**Author:** [@Juanfer](https://discuss.elastic.co/u/Juanfer)\ **Replies:** 2\ **Last updated:** [October 4, 2022, 8:27am UTC](https://discuss.elastic.co/t/data-management/315371 "2022-10-04T08:27:12Z")
Hi there, I have a question regarding the organization in Kibana. Since I am a beginner I want to understand the scope and best practices for my data storage in there. I will have 3 datasets which at some point I will li… --- ## [Elasticsearch Group By](https://discuss.elastic.co/t/elasticsearch-group-by/315360)
**Author:** [@Ashish\_Grover](https://discuss.elastic.co/u/Ashish_Grover)\ **Replies:** 4\ **Last updated:** [October 4, 2022, 7:48am UTC](https://discuss.elastic.co/t/elasticsearch-group-by/315360 "2022-10-04T07:48:19Z")
Hi i want to convert this sql query to elasticsearch " Select field1,field2,field3,field4 From myTable Group By field1; " I want group by on field1 and on the basis of this i want field2, field3, and field4 --- ## [Kibana APM sourcemaps delete all](https://discuss.elastic.co/t/kibana-apm-sourcemaps-delete-all/315681)
**Author:** [@mkf1](https://discuss.elastic.co/u/mkf1)\ **Replies:** 1\ **Last updated:** [October 3, 2022, 2:36pm UTC](https://discuss.elastic.co/t/kibana-apm-sourcemaps-delete-all/315681 "2022-10-03T14:36:41Z")
Hi, I have uploaded many sourcemaps to Kibana/APM at /api/apm/sourcemaps. I know you can delete them using curl like it says here: RUM source map API | Kibana Guide \[8.4\] | Elastic But is there anyway to delete all of… --- ## [Date diff elasticsearch wrong?](https://discuss.elastic.co/t/date-diff-elasticsearch-wrong/315745)
**Author:** [@robocon20x](https://discuss.elastic.co/u/robocon20x)\ **Replies:** 0\ **Last updated:** [October 4, 2022, 7:18am UTC](https://discuss.elastic.co/t/date-diff-elasticsearch-wrong/315745 "2022-10-04T07:18:36Z")
Hi everyone, i found a different between datediff function on my ES and phoenix,trino. when use SQL below my ES return 4 while phoenix and trino return 5. How this different could happened? POST \_sql?format=json { … --- ## [Trouble with nginx logs - filebeat configured but seeing gork error](https://discuss.elastic.co/t/trouble-with-nginx-logs-filebeat-configured-but-seeing-gork-error/315381)
**Author:** [@sunil106](https://discuss.elastic.co/u/sunil106)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 7:03am UTC](https://discuss.elastic.co/t/trouble-with-nginx-logs-filebeat-configured-but-seeing-gork-error/315381 "2022-10-04T07:03:02Z")
having trouble with parsing nginx logs. I am using nginx and running filebeat to push nginx logs directly to elasticsearch This are nginx caching servers that has following log format nginx log format log\_format cach… --- ## [Method with @async annotation, not getting logged in APM for errors for spring application](https://discuss.elastic.co/t/method-with-async-annotation-not-getting-logged-in-apm-for-errors-for-spring-application/315741)
**Author:** [@Jawed-Aquib](https://discuss.elastic.co/u/Jawed-Aquib)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 7:00am UTC](https://discuss.elastic.co/t/method-with-async-annotation-not-getting-logged-in-apm-for-errors-for-spring-application/315741 "2022-10-04T07:00:52Z")
I have configured the java APM agent through the elastic.apm.service\_name config for my springboot application. When there is any error occurring for my method annotated with @Async the error form this isn't availble… --- ## [Can APM agent configuration be stored in application properties](https://discuss.elastic.co/t/can-apm-agent-configuration-be-stored-in-application-properties/315676)
**Author:** [@Ong](https://discuss.elastic.co/u/Ong)\ **Replies:** 2\ **Last updated:** [October 4, 2022, 6:53am UTC](https://discuss.elastic.co/t/can-apm-agent-configuration-be-stored-in-application-properties/315676 "2022-10-04T06:53:46Z")
I am setting up APM and am using a Java APM agent for a Springboot app. Based on this documentation, the configuration is stored in src/main/resources/elasticapm.properties . Can these configuration be stored in applic… --- ## [Field level security based on the value of another field in the document](https://discuss.elastic.co/t/field-level-security-based-on-the-value-of-another-field-in-the-document/315356)
**Author:** [@Ram\_Rana](https://discuss.elastic.co/u/Ram_Rana)\ **Replies:** 4\ **Last updated:** [October 4, 2022, 5:58am UTC](https://discuss.elastic.co/t/field-level-security-based-on-the-value-of-another-field-in-the-document/315356 "2022-10-04T05:58:46Z")
We have one use case where we need to put some field level security based on another field in the document. We have some documents, each document contain one field called type and based on that type we want to put restr… --- ## [How does the GET API function internally in real time?](https://discuss.elastic.co/t/how-does-the-get-api-function-internally-in-real-time/315734)
**Author:** [@bhavya](https://discuss.elastic.co/u/bhavya)\ **Replies:** 0\ **Last updated:** [October 4, 2022, 5:54am UTC](https://discuss.elastic.co/t/how-does-the-get-api-function-internally-in-real-time/315734 "2022-10-04T05:54:46Z")
Under the hood of the most recent operation, Elasticsearch records the value of the \_version meta field, primary term, and sequence number. We may use the GET API to obtain these meta field values and add them to the sea… --- ## [Elasticsearch do not shows passwords and token when start](https://discuss.elastic.co/t/elasticsearch-do-not-shows-passwords-and-token-when-start/315338)
**Author:** [@Kostyantyn\_Dobriohlo](https://discuss.elastic.co/u/Kostyantyn_Dobriohlo)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 5:41am UTC](https://discuss.elastic.co/t/elasticsearch-do-not-shows-passwords-and-token-when-start/315338 "2022-10-04T05:41:14Z")
I am starting ELK with enabled xpack.security, and as I know elasticsearch shoud display passwords, enrollment token for kibana and other nodes and sha fingerprint. But there is no such information in logs. I am sure of … --- ## [Writing to two data streams](https://discuss.elastic.co/t/writing-to-two-data-streams/315493)
**Author:** [@Ulrik](https://discuss.elastic.co/u/Ulrik)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 5:19am UTC](https://discuss.elastic.co/t/writing-to-two-data-streams/315493 "2022-10-04T05:19:02Z")
We are collecting logs and uses fleet with agents. I would like to configure some agents to write data in two data streams instead of just one. As far as I can understand you specify the data stream to use in the integ… --- ## [503 Service Unavailable in Docker kibana (ELK Stack)](https://discuss.elastic.co/t/503-service-unavailable-in-docker-kibana-elk-stack/315268)
**Author:** [@MdRashid](https://discuss.elastic.co/u/MdRashid)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 5:17am UTC](https://discuss.elastic.co/t/503-service-unavailable-in-docker-kibana-elk-stack/315268 "2022-10-04T05:17:26Z")
Hi, Need help not able to access kibana in browser All container is running kibana, elasticsearch and logstash as ELK Stack docker logs KIBANA-CONTAINER {"type":"log","@timestamp":"2022-09-27T13:52:24Z","tags":\["info… --- ## [Different ILM-Policies for "some" Elastic Agents](https://discuss.elastic.co/t/different-ilm-policies-for-some-elastic-agents/315348)
**Author:** [@BoKu](https://discuss.elastic.co/u/BoKu)\ **Replies:** 0\ **Last updated:** [September 28, 2022, 9:55am UTC](https://discuss.elastic.co/t/different-ilm-policies-for-some-elastic-agents/315348 "2022-09-28T09:55:32Z")
Hello there, let's say i do have an Department Networking. Their servers get an elastic-agent, like every other non-networking server, but this Department wants to delete their logs after less days then any other depart… --- ## [Watcher webhook issue with call include triple double quote](https://discuss.elastic.co/t/watcher-webhook-issue-with-call-include-triple-double-quote/315387)
**Author:** [@JohnJ\_M](https://discuss.elastic.co/u/JohnJ_M)\ **Replies:** 0\ **Last updated:** [September 28, 2022, 3:43pm UTC](https://discuss.elastic.co/t/watcher-webhook-issue-with-call-include-triple-double-quote/315387 "2022-09-28T15:43:03Z")
I am working on a watcher that create watcher depending an index. I use for that a weebhook call in the watcher. Problem: the webhook call need the use of """ for the body part: "webhook": { "scheme": "h… --- ## [Problem with integration fleet server](https://discuss.elastic.co/t/problem-with-integration-fleet-server/315433)
**Author:** [@sultan2224](https://discuss.elastic.co/u/sultan2224)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 5:13am UTC](https://discuss.elastic.co/t/problem-with-integration-fleet-server/315433 "2022-10-04T05:13:22Z")
problem with integration fleet server and I can't take logs --- ## [Snapshot and Restore from kibana](https://discuss.elastic.co/t/snapshot-and-restore-from-kibana/315432)
**Author:** [@Rakhshunda\_Noorein\_J](https://discuss.elastic.co/u/Rakhshunda_Noorein_J)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 5:12am UTC](https://discuss.elastic.co/t/snapshot-and-restore-from-kibana/315432 "2022-10-04T05:12:47Z")
Hello, I am restoring snapshots from 1 cluster to another cluster. I took a snapshot from 1 cluster including indices and global state and then restore that snapshot to another cluster. Both the clusters sharing the sa… --- ## [Update All by changing data of a field using a function](https://discuss.elastic.co/t/update-all-by-changing-data-of-a-field-using-a-function/315476)
**Author:** [@sadiki-dev](https://discuss.elastic.co/u/sadiki-dev)\ **Replies:** 0\ **Last updated:** [September 29, 2022, 4:05pm UTC](https://discuss.elastic.co/t/update-all-by-changing-data-of-a-field-using-a-function/315476 "2022-09-29T16:05:49Z")
I have some data in an index for example called products. the data stored has structure like this : \[ { "name" : " product A ", "price": 1000, "quantity": 10 }, { "name" : " product B ", "price": 2000, "qua… [Previous page](https://discuss.elastic.co/latest.md?page=943) [Next page](https://discuss.elastic.co/latest.md?page=945)