# Latest **URL:** https://discuss.elastic.co/latest.md?page=945 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 946 --- ## [Error create snapshot and restore](https://discuss.elastic.co/t/error-create-snapshot-and-restore/315498)
**Author:** [@user\_redes](https://discuss.elastic.co/u/user_redes)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 5:09am UTC](https://discuss.elastic.co/t/error-create-snapshot-and-restore/315498 "2022-10-04T05:09:59Z")
Hello, I'm trying to create a repository using AWS S3 but I'm getting some errors when performing Verification Status: { "name": "ResponseError", "meta": { "body": { "error": { "root\_cause": \[ { "type": "reposi… --- ## [Use Elastic APM without search.allow\_expensive\_queries config](https://discuss.elastic.co/t/use-elastic-apm-without-search-allow-expensive-queries-config/315499)
**Author:** [@Leonardo\_Henrique](https://discuss.elastic.co/u/Leonardo_Henrique)\ **Replies:** 0\ **Last updated:** [September 29, 2022, 7:58pm UTC](https://discuss.elastic.co/t/use-elastic-apm-without-search-allow-expensive-queries-config/315499 "2022-09-29T19:58:46Z")
Hello, everyone! How have you been? I recently updated a Elastic cluster from 7.9.3 to 8.3.2 (intermediate upgrade to 7.17.5). When I updated the APM Server to 8.3.2 I got the error referred to the APM Integration not … --- ## [How to restore security snapshots?](https://discuss.elastic.co/t/how-to-restore-security-snapshots/315636)
**Author:** [@Siavash\_Fazli](https://discuss.elastic.co/u/Siavash_Fazli)\ **Replies:** 0\ **Last updated:** [October 2, 2022, 2:52pm UTC](https://discuss.elastic.co/t/how-to-restore-security-snapshots/315636 "2022-10-02T14:52:52Z")
Hi Guys. I upgraded my ELK stack version 7.16.2 to 8.4.2. I need to restore my security settings (users, roles,...) In the last step of restoring I got this message: Unable to restore snapshot \[es.sec\_daily\_2022.09.… --- ## [Monthly rolling index with custom routing](https://discuss.elastic.co/t/monthly-rolling-index-with-custom-routing/315706)
**Author:** [@PV2000](https://discuss.elastic.co/u/PV2000)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 5:02am UTC](https://discuss.elastic.co/t/monthly-rolling-index-with-custom-routing/315706 "2022-10-04T05:02:55Z")
Hi, I am trying to figure out the how to create a monthly rolling index with custom routing (multi-tenancy scenario) , with these requirements : WRITE flow : Each document will have a timestamp and the document shoul… --- ## [Got error in elastic search](https://discuss.elastic.co/t/got-error-in-elastic-search/315718)
**Author:** [@Rahul1300](https://discuss.elastic.co/u/Rahul1300)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 5:01am UTC](https://discuss.elastic.co/t/got-error-in-elastic-search/315718 "2022-10-04T05:01:09Z")
i started new cluster i got this error plz help me to resolve this address \[127.0.0.1:9302\], node \[null\], requesting \[false\] discovery result: \[127.0.0.1:9302\] connect\_exception: Connection refused: /127.0.0.1:9302: Con… --- ## [Renaming Nodes and Clusters in Elastic Cloud](https://discuss.elastic.co/t/renaming-nodes-and-clusters-in-elastic-cloud/315729)
**Author:** [@mpky](https://discuss.elastic.co/u/mpky)\ **Replies:** 4\ **Last updated:** [October 4, 2022, 4:59am UTC](https://discuss.elastic.co/t/renaming-nodes-and-clusters-in-elastic-cloud/315729 "2022-10-04T04:59:05Z")
How do you go about renaming nodes and clusters in Elastic Cloud since there is no YML file to edit? I tried in the deployment settings but was getting errors and am wondering if there's a way to do this in Dev Tools? --- ## [Primary term and sequence number VS \_version meta field](https://discuss.elastic.co/t/primary-term-and-sequence-number-vs-version-meta-field/315733)
**Author:** [@bhavya](https://discuss.elastic.co/u/bhavya)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 4:58am UTC](https://discuss.elastic.co/t/primary-term-and-sequence-number-vs-version-meta-field/315733 "2022-10-04T04:58:50Z")
Consider that there are three primary shards in my index. For indexing and update requests, the primary shards are used. Elasticsearch can distribute incoming requests (such as massive bulk requests) to various primary s… --- ## [Nested Aggregation with AND always return 0 match](https://discuss.elastic.co/t/nested-aggregation-with-and-always-return-0-match/315722)
**Author:** [@chattes](https://discuss.elastic.co/u/chattes)\ **Replies:** 3\ **Last updated:** [October 4, 2022, 1:26am UTC](https://discuss.elastic.co/t/nested-aggregation-with-and-always-return-0-match/315722 "2022-10-04T01:26:03Z")
Mapping { "example-profiles" : { "mappings" : { "dynamic" : "false", "properties" : { "organization" : { "properties" : { "enabled" : { "type" : "boolean" … --- ## [Java client put logstash pipeline last\_modified error](https://discuss.elastic.co/t/java-client-put-logstash-pipeline-last-modified-error/313425)
**Author:** [@Alain\_Bod](https://discuss.elastic.co/u/Alain_Bod)\ **Replies:** 5\ **Last updated:** [October 3, 2022, 8:39pm UTC](https://discuss.elastic.co/t/java-client-put-logstash-pipeline-last-modified-error/313425 "2022-10-03T20:39:33Z")
Hi, I'm using the new Java elasticsearch client to PUT a logstash pipeline (client version 8.4.1, server 8.4.1) client.logstash().putPipeline(b -\> b .id(id) .pipeline(p -\>… --- ## [Unable to use msearch with curl](https://discuss.elastic.co/t/unable-to-use-msearch-with-curl/315713)
**Author:** [@Guilherme\_Mello](https://discuss.elastic.co/u/Guilherme_Mello)\ **Replies:** 4\ **Last updated:** [October 3, 2022, 8:25pm UTC](https://discuss.elastic.co/t/unable-to-use-msearch-with-curl/315713 "2022-10-03T20:25:59Z")
I'm trying to use \_msearch like this: curl -XGET "https://host.com/index/\_msearch" -H "Content-Type: application/json" -d' { } {"query" : {"match" : { "title": "vestido"}}, "from":0,"size":2 } ' But I get t… --- ## [Elastic SIEM cloud data storage location? Canadian Data Residency](https://discuss.elastic.co/t/elastic-siem-cloud-data-storage-location-canadian-data-residency/315712)
**Author:** [@DabLab](https://discuss.elastic.co/u/DabLab)\ **Replies:** 1\ **Last updated:** [October 3, 2022, 8:13pm UTC](https://discuss.elastic.co/t/elastic-siem-cloud-data-storage-location-canadian-data-residency/315712 "2022-10-03T20:13:37Z")
I need to know if Elastic meets Canadian Data Residency requirements. Meaning the solution for a canadian company would store its data in canada. Thank you! --- ## [Docker-compose: Switching from environment variables to kibana.yml fails during preboot stage](https://discuss.elastic.co/t/docker-compose-switching-from-environment-variables-to-kibana-yml-fails-during-preboot-stage/315674)
**Author:** [@Malec](https://discuss.elastic.co/u/Malec)\ **Replies:** 1\ **Last updated:** [October 3, 2022, 8:00pm UTC](https://discuss.elastic.co/t/docker-compose-switching-from-environment-variables-to-kibana-yml-fails-during-preboot-stage/315674 "2022-10-03T20:00:23Z")
Hi everyone, I have been using the docker-compose file for a while now and it works quite well, but I needed to add some advanced authentication methods (anonymous + basic). So I tried switching to kibana.yml and to vol… --- ## [Getting two intervals in the result for fixed\_interval](https://discuss.elastic.co/t/getting-two-intervals-in-the-result-for-fixed-interval/314754)
**Author:** [@Divin](https://discuss.elastic.co/u/Divin)\ **Replies:** 7\ **Last updated:** [October 3, 2022, 6:05pm UTC](https://discuss.elastic.co/t/getting-two-intervals-in-the-result-for-fixed-interval/314754 "2022-10-03T18:05:22Z")
I have an ES query that search for 2 set of strings and calculating percentage based on the results of the match. This is expected to have work on fixed\_interval \[5 min\]on date histogram. But when I am getting the result… --- ## [Upgrade from ELK 7.7.1 to ELK 8.4.1](https://discuss.elastic.co/t/upgrade-from-elk-7-7-1-to-elk-8-4-1/315423)
**Author:** [@Ravi\_S1](https://discuss.elastic.co/u/Ravi_S1)\ **Replies:** 3\ **Last updated:** [October 3, 2022, 5:46pm UTC](https://discuss.elastic.co/t/upgrade-from-elk-7-7-1-to-elk-8-4-1/315423 "2022-10-03T17:46:24Z")
I upgraded recently ELK 7.7.1 to ELK 8.4.1. I am looking out the logs of ELK 8.4.1, finds the below logs. Is there any view point from these logs. {"@timestamp":"2022-09-15T16:17:36.167Z", "log.level": "WARN", "message… --- ## [Update By Query - status counts do not add up to total](https://discuss.elastic.co/t/update-by-query-status-counts-do-not-add-up-to-total/315709)
**Author:** [@BobH](https://discuss.elastic.co/u/BobH)\ **Replies:** 0\ **Last updated:** [October 3, 2022, 5:15pm UTC](https://discuss.elastic.co/t/update-by-query-status-counts-do-not-add-up-to-total/315709 "2022-10-03T17:15:44Z")
I'm running ES 7.17.3 with an index with 2.1M documents. I executed an update-by-query request with a script to clean up some data (there was no query, so it ran against all documents in the index). The script sets ctx.o… --- ## [Monitor specific AWS Cloudwatch log\_stream](https://discuss.elastic.co/t/monitor-specific-aws-cloudwatch-log-stream/315395)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 0\ **Last updated:** [September 28, 2022, 5:35pm UTC](https://discuss.elastic.co/t/monitor-specific-aws-cloudwatch-log-stream/315395 "2022-09-28T17:35:19Z")
I'm using a Fleet-managed Elastic Agent with the AWS Custom Log integration to monitor logs from Cloudwatch. My configuration in Fleet generates the following in the policy: - id: aws-cloudwatch-aws\_logs-334607ab-b4fe-4… --- ## [Log events not being recognized as separate events in Microsoft SQL Server Integration](https://discuss.elastic.co/t/log-events-not-being-recognized-as-separate-events-in-microsoft-sql-server-integration/315707)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 0\ **Last updated:** [October 3, 2022, 5:08pm UTC](https://discuss.elastic.co/t/log-events-not-being-recognized-as-separate-events-in-microsoft-sql-server-integration/315707 "2022-10-03T17:08:19Z")
I am using the Microsoft SQL Server Integration, v1.4.0 with a fleet-managed policy running on Elastic Agent 8.4.2. I am noticing two things. First, even with "Preserve original event" set to false, the SQL Server error … --- ## [Engineer Lab Instructions](https://discuss.elastic.co/t/engineer-lab-instructions/315695)
**Author:** [@Sonia1](https://discuss.elastic.co/u/Sonia1)\ **Replies:** 1\ **Last updated:** [October 3, 2022, 5:00pm UTC](https://discuss.elastic.co/t/engineer-lab-instructions/315695 "2022-10-03T17:00:15Z")
Hi I have started the Elasticsearch Engineer on-demand, but my strigo access have expired. I wanted to set up my own lab, but i cant find the download link for the lab instructions. Can somebody help me? Thanks --- ## [CSV Filter - Backslash double quote parse failure](https://discuss.elastic.co/t/csv-filter-backslash-double-quote-parse-failure/315703)
**Author:** [@Michele\_De\_Benedet](https://discuss.elastic.co/u/Michele_De_Benedet)\ **Replies:** 1\ **Last updated:** [October 3, 2022, 4:54pm UTC](https://discuss.elastic.co/t/csv-filter-backslash-double-quote-parse-failure/315703 "2022-10-03T16:54:07Z")
Hi, I am using version 7.12.0 I'm parsing a csv which looks like this: colA;colB;colC x;"hello \\"world\\" ";0 y;"hello world";1 I cannot parse the x row because I get the following: Error parsing csv {:field=\>"messag… --- ## [Beats on multiple Cloud environments](https://discuss.elastic.co/t/beats-on-multiple-cloud-environments/314887)
**Author:** [@lcui\_dxc](https://discuss.elastic.co/u/lcui_dxc)\ **Replies:** 2\ **Last updated:** [October 3, 2022, 4:53pm UTC](https://discuss.elastic.co/t/beats-on-multiple-cloud-environments/314887 "2022-10-03T16:53:29Z")
Hello there" Working on a task to setup Elastic Cloud on AWS and some of the beats (meticbeat, heartbeat, filebeat, and packetbeat) are on AWS some of the beats need to be on Azure and GCP. In this situation,should we p… --- ## [Elasticsearch certificate error when access with public ip](https://discuss.elastic.co/t/elasticsearch-certificate-error-when-access-with-public-ip/315213)
**Author:** [@jay.annapureddy](https://discuss.elastic.co/u/jay.annapureddy)\ **Replies:** 13\ **Last updated:** [October 3, 2022, 4:26pm UTC](https://discuss.elastic.co/t/elasticsearch-certificate-error-when-access-with-public-ip/315213 "2022-10-03T16:26:49Z")
Hi, Problem: Elasticsearch cluster url having a certificate error, needed this to configure on beats on other vm. I am experimenting it on Azure VM with ubuntu operating system. Followed this official guide to install… --- ## [Split the Field values by comma](https://discuss.elastic.co/t/split-the-field-values-by-comma/315673)
**Author:** [@Maruthappan\_Muthu](https://discuss.elastic.co/u/Maruthappan_Muthu)\ **Replies:** 1\ **Last updated:** [October 3, 2022, 4:06pm UTC](https://discuss.elastic.co/t/split-the-field-values-by-comma/315673 "2022-10-03T16:06:23Z")
My field contains multiple values, which separated by comma. How can I split the each comma separated values and put on the same filed name. Ex. The consider the below field and values, SerialNumber =\> \[abc23, cde56, … --- ## [Custom visualizations with Vega, Source Control, and Upper Environments](https://discuss.elastic.co/t/custom-visualizations-with-vega-source-control-and-upper-environments/315505)
**Author:** [@qd-danh](https://discuss.elastic.co/u/qd-danh)\ **Replies:** 2\ **Last updated:** [October 3, 2022, 4:02pm UTC](https://discuss.elastic.co/t/custom-visualizations-with-vega-source-control-and-upper-environments/315505 "2022-10-03T16:02:11Z")
I have been searching these forums and the web for guidance and haven't found much. We plan to use at least one, likely more, custom visualizations via Vega in our Kibana dashboards. When thinking through productionali… --- ## [Parent/Child vs Nested. The real Performance difference](https://discuss.elastic.co/t/parent-child-vs-nested-the-real-performance-difference/315698)
**Author:** [@amirm](https://discuss.elastic.co/u/amirm)\ **Replies:** 0\ **Last updated:** [October 3, 2022, 3:11pm UTC](https://discuss.elastic.co/t/parent-child-vs-nested-the-real-performance-difference/315698 "2022-10-03T15:11:01Z")
Greeting. We all know that Elasticsearch is basically a NoSQL database. it means there is no relation between data and documents that need to be denormalized and flattened to index properly. In spite of all these thing… --- ## [Question regarding index stats - warmer](https://discuss.elastic.co/t/question-regarding-index-stats-warmer/315696)
**Author:** [@robbe482](https://discuss.elastic.co/u/robbe482)\ **Replies:** 0\ **Last updated:** [October 3, 2022, 3:03pm UTC](https://discuss.elastic.co/t/question-regarding-index-stats-warmer/315696 "2022-10-03T15:03:20Z")
Hello, we are running Elasticsearch 6.8.23. For one of our indices we are having performance problems. When checking the stats on that index one thing stands out, very high total\_time under the warmer section. Reading … --- ## [Crash of ECK Operator after disabling TLS on elastic agent in fleet mode](https://discuss.elastic.co/t/crash-of-eck-operator-after-disabling-tls-on-elastic-agent-in-fleet-mode/315679)
**Author:** [@p0sql](https://discuss.elastic.co/u/p0sql)\ **Replies:** 1\ **Last updated:** [October 3, 2022, 2:04pm UTC](https://discuss.elastic.co/t/crash-of-eck-operator-after-disabling-tls-on-elastic-agent-in-fleet-mode/315679 "2022-10-03T14:04:52Z")
Disable TLS on Fleet Server agent leads to panic runtime error (invalid memory address or nil pointer dereference) for the ECK Operator. I can't deploy anything after this crash until I delete the configuration. Moreove… --- ## [LDAP doubt](https://discuss.elastic.co/t/ldap-doubt/315671)
**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\ **Replies:** 1\ **Last updated:** [October 3, 2022, 1:23pm UTC](https://discuss.elastic.co/t/ldap-doubt/315671 "2022-10-03T13:23:51Z")
Hello! im integrating elk with ldap. when i enable ldap at config im not able to login kibana with my old users. Can't be both enable ? im going to be able to log in only with ldap users ? --- ## [Example of a 3 node production ready docker-compose for Elasticsearch?](https://discuss.elastic.co/t/example-of-a-3-node-production-ready-docker-compose-for-elasticsearch/315647)
**Author:** [@Amphagory](https://discuss.elastic.co/u/Amphagory)\ **Replies:** 2\ **Last updated:** [October 3, 2022, 4:26am UTC](https://discuss.elastic.co/t/example-of-a-3-node-production-ready-docker-compose-for-elasticsearch/315647 "2022-10-03T04:26:56Z")
Hello, I was wondering if anyone had or can point to an example of a multi-node production ready docker-compose yaml file for Elasticsearch. I've started with the docker-compose example from the elastic documentation … --- ## [How to suggest queries to user](https://discuss.elastic.co/t/how-to-suggest-queries-to-user/315685)
**Author:** [@Guilherme\_Mello](https://discuss.elastic.co/u/Guilherme_Mello)\ **Replies:** 0\ **Last updated:** [October 3, 2022, 12:27pm UTC](https://discuss.elastic.co/t/how-to-suggest-queries-to-user/315685 "2022-10-03T12:27:16Z")
Hi, is there a way to suggest queries to the user based on terms? This feature is common in searches to suggest other queries to the user. I saw that there is appsearch, is that the only way to make it work? --- ## [Runtime field script String to Integer](https://discuss.elastic.co/t/runtime-field-script-string-to-integer/315678)
**Author:** [@kibanauser4](https://discuss.elastic.co/u/kibanauser4)\ **Replies:** 1\ **Last updated:** [October 3, 2022, 12:21pm UTC](https://discuss.elastic.co/t/runtime-field-script-string-to-integer/315678 "2022-10-03T12:21:15Z")
Hi. I want to create a runtime field using this script: if (doc.containsKey('price') ) { return Integer.parseInt(doc\['price.keyword'\].value) } but I'm getting this error: Cannot cast from \[int\] to \[void\]. What does i… [Previous page](https://discuss.elastic.co/latest.md?page=944) [Next page](https://discuss.elastic.co/latest.md?page=946)