# Latest

**URL:** https://discuss.elastic.co/latest.md?page=949

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 950

---

## [Salesforce Integration in Elastic](https://discuss.elastic.co/t/salesforce-integration-in-elastic/314961)

<div class="topic-metadata">

**Author:** [@sakib3833](https://discuss.elastic.co/u/sakib3833)\
**Replies:** 7\
**Last updated:** [September 29, 2022, 4:00pm UTC](https://discuss.elastic.co/t/salesforce-integration-in-elastic/314961 "2022-09-29T16:00:39Z")

</div>

I've connected Salesforce to Workplace Search source with proper authentication. I also get content items in Source overview section. I am wondering how I can visualize Salesforce data in Kibana like other integration.…

---

## [How to view docs.deleted data](https://discuss.elastic.co/t/how-to-view-docs-deleted-data/315459)

<div class="topic-metadata">

**Author:** [@KrishnaCh](https://discuss.elastic.co/u/KrishnaCh)\
**Replies:** 2\
**Last updated:** [September 29, 2022, 2:29pm UTC](https://discuss.elastic.co/t/how-to-view-docs-deleted-data/315459 "2022-09-29T14:29:41Z")

</div>

Hi All, In my elastic cluster, I see there are some records in docs.deleted for some of the indices, and I am not sure how to find out who deleted the docs? My 3 node elastic cluster version is 7.16.1 and it is Not an …

---

## [How to set Max\_analyzed\_offset setting for all searches in Discover](https://discuss.elastic.co/t/how-to-set-max-analyzed-offset-setting-for-all-searches-in-discover/315466)

<div class="topic-metadata">

**Author:** [@Quentin\_vk](https://discuss.elastic.co/u/Quentin_vk)\
**Replies:** 0\
**Last updated:** [September 29, 2022, 2:14pm UTC](https://discuss.elastic.co/t/how-to-set-max-analyzed-offset-setting-for-all-searches-in-discover/315466 "2022-09-29T14:14:51Z")

</div>

Hi, we're having this very well known error "the length of field\[...\] index has exceed maximum allowed to be analyzed for highlighting". We're trying to use the max\_analyzed\_offset setting as a global search setting in …

---

## [I have a problem elasticsearch](https://discuss.elastic.co/t/i-have-a-problem-elasticsearch/315366)

<div class="topic-metadata">

**Author:** [@Marcelo\_F\_Costa](https://discuss.elastic.co/u/Marcelo_F_Costa)\
**Replies:** 2\
**Last updated:** [September 29, 2022, 2:03pm UTC](https://discuss.elastic.co/t/i-have-a-problem-elasticsearch/315366 "2022-09-29T14:03:04Z")

</div>

I have this problem and I have no idea what it is. Can someone help me? Follow the log. \[2022-09-28T02:21:14,224\]\[WARN \]\[o.e.m.j.JvmGcMonitorService\] \[VM-Elasticsearch\] \[gc\]\[young\]\[365947\]\[70063\] duration \[1.5s\], coll…

---

## [Is java API Client 7.16 be used with Elasticsearch version 7.9.2?](https://discuss.elastic.co/t/is-java-api-client-7-16-be-used-with-elasticsearch-version-7-9-2/315465)

<div class="topic-metadata">

**Author:** [@Karthik\_Amar](https://discuss.elastic.co/u/Karthik_Amar)\
**Replies:** 1\
**Last updated:** [September 29, 2022, 1:57pm UTC](https://discuss.elastic.co/t/is-java-api-client-7-16-be-used-with-elasticsearch-version-7-9-2/315465 "2022-09-29T13:57:26Z")

</div>

Hi all. Sorry if this very obvious question. As per documentation The Elasticsearch Java client is forward compatible; meaning that the client supports communicating with greater or equal minor versions of Elasticsearc…

---

## [Is Fuzzy sentence search in elasticsearch based on edit distance of words?](https://discuss.elastic.co/t/is-fuzzy-sentence-search-in-elasticsearch-based-on-edit-distance-of-words/315464)

<div class="topic-metadata">

**Author:** [@swapnil3597](https://discuss.elastic.co/u/swapnil3597)\
**Replies:** 0\
**Last updated:** [September 29, 2022, 1:57pm UTC](https://discuss.elastic.co/t/is-fuzzy-sentence-search-in-elasticsearch-based-on-edit-distance-of-words/315464 "2022-09-29T13:57:19Z")

</div>

For a given index I have added documents like: \[ {"expression": "tell me something about elasticsearch"}, {"expression": "this is a new feature for elasticsearch"}, {"expression": "tell me something about kibana"}, # ..…

---

## [Easiest way to decrease Persistent Volume size?](https://discuss.elastic.co/t/easiest-way-to-decrease-persistent-volume-size/315415)

<div class="topic-metadata">

**Author:** [@elastic\_dude](https://discuss.elastic.co/u/elastic_dude)\
**Replies:** 2\
**Last updated:** [September 29, 2022, 1:38pm UTC](https://discuss.elastic.co/t/easiest-way-to-decrease-persistent-volume-size/315415 "2022-09-29T13:38:09Z")

</div>

Hello, I am trying to decrease the storage size of our Persistent Volumes in a particular cluster while still retaining all the data that is currently on the existing Persistent Volumes. The storage is currently over-pr…

---

## [Heartbeat.config.monitors path to c:/program files](https://discuss.elastic.co/t/heartbeat-config-monitors-path-to-c-program-files/315458)

<div class="topic-metadata">

**Author:** [@miguelbatista](https://discuss.elastic.co/u/miguelbatista)\
**Replies:** 0\
**Last updated:** [September 29, 2022, 1:35pm UTC](https://discuss.elastic.co/t/heartbeat-config-monitors-path-to-c-program-files/315458 "2022-09-29T13:35:59Z")

</div>

Hi, I've installed Heartbeat on a Windows server VM in here "C:\\Program Files\\Heartbeat" and can't get heartbeat.yml config.monitors path right to read the monitors.d files.

---

## [Elasticsearch "snapshot\_restore\_exception" "reason": snapshot does not exist" when snapshot status is SUCCESS](https://discuss.elastic.co/t/elasticsearch-snapshot-restore-exception-reason-snapshot-does-not-exist-when-snapshot-status-is-success/315457)

<div class="topic-metadata">

**Author:** [@arozaki](https://discuss.elastic.co/u/arozaki)\
**Replies:** 0\
**Last updated:** [September 29, 2022, 1:24pm UTC](https://discuss.elastic.co/t/elasticsearch-snapshot-restore-exception-reason-snapshot-does-not-exist-when-snapshot-status-is-success/315457 "2022-09-29T13:24:49Z")

</div>

I am using the Java/Groovy client for Elasticsearch and I am trying to restore an ES snapshot during an upgrade. I am using the Groovy code I have so far for setting up my old and new clients and making them create & res…

---

## [Sharing resources (Data views and Dashboards) across Spaces](https://discuss.elastic.co/t/sharing-resources-data-views-and-dashboards-across-spaces/312933)

<div class="topic-metadata">

**Author:** [@yelloyonder](https://discuss.elastic.co/u/yelloyonder)\
**Replies:** 3\
**Last updated:** [September 29, 2022, 1:10pm UTC](https://discuss.elastic.co/t/sharing-resources-data-views-and-dashboards-across-spaces/312933 "2022-09-29T13:10:06Z")

</div>

Hi, I've been trying to setup Spaces in Kibana (Elastic cloud) for non-admin teams so they only see the Kibana resources they need e.g. Discover and Dashboards under Analytics and not Security. When moving to the new S…

---

## [Query document array is a subset of search input](https://discuss.elastic.co/t/query-document-array-is-a-subset-of-search-input/315419)

<div class="topic-metadata">

**Author:** [@bwly](https://discuss.elastic.co/u/bwly)\
**Replies:** 1\
**Last updated:** [September 29, 2022, 1:03pm UTC](https://discuss.elastic.co/t/query-document-array-is-a-subset-of-search-input/315419 "2022-09-29T13:03:13Z")

</div>

I have document that has the this array attribute {array\_attr: \[ { id: "A", name: "A\_name" }, { id: "B", name: "B\_name" }, { id: "C", name: "B\_name" } \]} In my search query, I have…

---

## [Pyspark: from curl to correct settings](https://discuss.elastic.co/t/pyspark-from-curl-to-correct-settings/314999)

<div class="topic-metadata">

**Author:** [@obi134](https://discuss.elastic.co/u/obi134)\
**Replies:** 2\
**Last updated:** [September 29, 2022, 12:58pm UTC](https://discuss.elastic.co/t/pyspark-from-curl-to-correct-settings/314999 "2022-09-29T12:58:17Z")

</div>

Hi there, I'm trying to push data from databricks/pyspark to elasticsearch following these instructions: ElasticSearch | Databricks on AWS Unfortunately I'm getting this error: org.elasticsearch.hadoop.EsHadoopIllega…

---

## [Issue with implement proxy in elasticsearch/kibana](https://discuss.elastic.co/t/issue-with-implement-proxy-in-elasticsearch-kibana/315452)

<div class="topic-metadata">

**Author:** [@lgriger](https://discuss.elastic.co/u/lgriger)\
**Replies:** 0\
**Last updated:** [September 29, 2022, 12:41pm UTC](https://discuss.elastic.co/t/issue-with-implement-proxy-in-elasticsearch-kibana/315452 "2022-09-29T12:41:23Z")

</div>

elasticsearch config xpack.http.proxy.host: http:// xpack.http.proxy.port: 8080 xpack.http.proxy.scheme:http kibana config xpack.fleet.registryProxyUrl: http://\<user:password@url\> xpack.actions.proxyUrl: http://\<us…

---

## [Stemming and the near span query](https://discuss.elastic.co/t/stemming-and-the-near-span-query/315449)

<div class="topic-metadata">

**Author:** [@af1](https://discuss.elastic.co/u/af1)\
**Replies:** 0\
**Last updated:** [September 29, 2022, 11:51am UTC](https://discuss.elastic.co/t/stemming-and-the-near-span-query/315449 "2022-09-29T11:51:59Z")

</div>

Hello community, hope to get your help on an issue we are having, we are using the english stemming and are running a near span query that basically searches for "buying near before" now if I search for a match phras…

---

## [Packetbeat interfere with defender for identity on Windows Server 2012-2022](https://discuss.elastic.co/t/packetbeat-interfere-with-defender-for-identity-on-windows-server-2012-2022/314509)

<div class="topic-metadata">

**Author:** [@splitmessage88](https://discuss.elastic.co/u/splitmessage88)\
**Replies:** 3\
**Last updated:** [September 29, 2022, 10:51am UTC](https://discuss.elastic.co/t/packetbeat-interfere-with-defender-for-identity-on-windows-server-2012-2022/314509 "2022-09-29T10:51:58Z")

</div>

Hi, We are using Packetbeat for capturing DNS traffic from our Windows servers (10 servers) and are having an issue with packetbeat interfering with the defender sensor. We are getting the following error message from D…

---

## [Granular user-document level permissions](https://discuss.elastic.co/t/granular-user-document-level-permissions/315438)

<div class="topic-metadata">

**Author:** [@mattkallo](https://discuss.elastic.co/u/mattkallo)\
**Replies:** 5\
**Last updated:** [September 29, 2022, 10:33am UTC](https://discuss.elastic.co/t/granular-user-document-level-permissions/315438 "2022-09-29T10:33:54Z")

</div>

Hi, In our search index we want to specify access at very granular level. For eg. Say we have doc1, doc2, doc3 in index and user1 has access to doc1 and doc2, similarly user2 to doc2 and doc3, user3 to doc3 and doc1. T…

---

## [Logstash: Variable substitution FAILS for "api\_key" in elasticsearch output](https://discuss.elastic.co/t/logstash-variable-substitution-fails-for-api-key-in-elasticsearch-output/315339)

<div class="topic-metadata">

**Author:** [@George\_Kossionis](https://discuss.elastic.co/u/George_Kossionis)\
**Replies:** 1\
**Last updated:** [September 29, 2022, 10:29am UTC](https://discuss.elastic.co/t/logstash-variable-substitution-fails-for-api-key-in-elasticsearch-output/315339 "2022-09-29T10:29:14Z")

</div>

Hello, I have configured logstash to use logstash.keystore to store secure credentials. The ${ES\_PASSWD} substitutions are working perfectly on the following configuration: elasticsearch { ... user…

---

## [Alert rule for windows commands like ping](https://discuss.elastic.co/t/alert-rule-for-windows-commands-like-ping/315441)

<div class="topic-metadata">

**Author:** [@Kiko1](https://discuss.elastic.co/u/Kiko1)\
**Replies:** 0\
**Last updated:** [September 29, 2022, 9:42am UTC](https://discuss.elastic.co/t/alert-rule-for-windows-commands-like-ping/315441 "2022-09-29T09:42:57Z")

</div>

Hi! I created a rule to detect the ping command but it doesn't work for me. Rule: process.name:"PING.exe" and process.state:"running" The same rule with for example the powershell.exe works. Thx

---

## [Search\_phase\_execution\_exception in partitioned terms aggregation](https://discuss.elastic.co/t/search-phase-execution-exception-in-partitioned-terms-aggregation/315443)

<div class="topic-metadata">

**Author:** [@Sederfo](https://discuss.elastic.co/u/Sederfo)\
**Replies:** 0\
**Last updated:** [September 29, 2022, 10:00am UTC](https://discuss.elastic.co/t/search-phase-execution-exception-in-partitioned-terms-aggregation/315443 "2022-09-29T10:00:04Z")

</div>

I have an index which contains millions of documents that I want to aggregate. This is the query I am using to obtain the aggregated results. aggs = { "0": { "terms": { …

---

## [Failed Reroute unassigned index](https://discuss.elastic.co/t/failed-reroute-unassigned-index/315437)

<div class="topic-metadata">

**Author:** [@GithubRyze](https://discuss.elastic.co/u/GithubRyze)\
**Replies:** 2\
**Last updated:** [September 29, 2022, 9:17am UTC](https://discuss.elastic.co/t/failed-reroute-unassigned-index/315437 "2022-09-29T09:17:58Z")

</div>

Elasticsearch Version docker image 8.1.3 Installed Plugins No response Java Version openJDK 8 OS Version linux Problem Description index shard prirep state node unassigned.r…

---

## [Lens Metric: split by keyword](https://discuss.elastic.co/t/lens-metric-split-by-keyword/310755)

<div class="topic-metadata">

**Author:** [@obi134](https://discuss.elastic.co/u/obi134)\
**Replies:** 3\
**Last updated:** [September 29, 2022, 9:17am UTC](https://discuss.elastic.co/t/lens-metric-split-by-keyword/310755 "2022-09-29T09:17:43Z")

</div>

Hi there, Currently I am using Metric visualization to show a status of different devices: In this metric I am showing the last status and split the group by device id. Additionally I defined ranges and selected a co…

---

## [Convert es (Bucket aggregation) query to java](https://discuss.elastic.co/t/convert-es-bucket-aggregation-query-to-java/315321)

<div class="topic-metadata">

**Author:** [@Shubh](https://discuss.elastic.co/u/Shubh)\
**Replies:** 8\
**Last updated:** [September 29, 2022, 9:15am UTC](https://discuss.elastic.co/t/convert-es-bucket-aggregation-query-to-java/315321 "2022-09-29T09:15:05Z")

</div>

Hi, Can anyone help me convert this query in java program and how would i get only the aggreagtion result from query. The query is given below. GET /\_search { "size": 0, "query": { "bool": { "filter": \[ …

---

## [How to create a kibana dashboard which could search through index relations?](https://discuss.elastic.co/t/how-to-create-a-kibana-dashboard-which-could-search-through-index-relations/315276)

<div class="topic-metadata">

**Author:** [@Ibrahim\_Z\_HIDIR](https://discuss.elastic.co/u/Ibrahim_Z_HIDIR)\
**Replies:** 8\
**Last updated:** [September 29, 2022, 8:25am UTC](https://discuss.elastic.co/t/how-to-create-a-kibana-dashboard-which-could-search-through-index-relations/315276 "2022-09-29T08:25:16Z")

</div>

Hi everybody I have 3 different indices, A, B and C A and B both sharing a field suppose F1 B and C also sharing another field suppose F2 I've added 3 different saved search to a dash board. So when I want to sear…

---

## [Deleting index suddenly](https://discuss.elastic.co/t/deleting-index-suddenly/315334)

<div class="topic-metadata">

**Author:** [@Emre\_Kurt](https://discuss.elastic.co/u/Emre_Kurt)\
**Replies:** 8\
**Last updated:** [September 29, 2022, 8:03am UTC](https://discuss.elastic.co/t/deleting-index-suddenly/315334 "2022-09-29T08:03:20Z")

</div>

Hi everyone, I've been having a very annoying problem lately. Something deleting my indexes suddenly. Here is my situations; 9200 port is closed to outside. Only server ip can access the port. There is a lot of docker…

---

## [Index origination date based on logs age](https://discuss.elastic.co/t/index-origination-date-based-on-logs-age/315159)

<div class="topic-metadata">

**Author:** [@booboo](https://discuss.elastic.co/u/booboo)\
**Replies:** 2\
**Last updated:** [September 29, 2022, 7:59am UTC](https://discuss.elastic.co/t/index-origination-date-based-on-logs-age/315159 "2022-09-29T07:59:11Z")

</div>

Hello everyone, I am trying to set a dynamic lifecycle "origination\_date" in order in inject old logs into Elastic, does anybody know how to do this ? Here is my situation. I need monthly indexes so I can't use "parse\_…

---

## [ILM Pattern suffix reach max count](https://discuss.elastic.co/t/ilm-pattern-suffix-reach-max-count/315425)

<div class="topic-metadata">

**Author:** [@alfianaf](https://discuss.elastic.co/u/alfianaf)\
**Replies:** 4\
**Last updated:** [September 29, 2022, 7:54am UTC](https://discuss.elastic.co/t/ilm-pattern-suffix-reach-max-count/315425 "2022-09-29T07:54:17Z")

</div>

Hello, I want to ask about ILM pattern count, what will happen if the pattern reach 999999? lets give an example I have : index-000001 then what happen if someday my index reached : index-999999 does the number re…

---

## [Rolling Restart doubt](https://discuss.elastic.co/t/rolling-restart-doubt/315429)

<div class="topic-metadata">

**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\
**Replies:** 2\
**Last updated:** [September 29, 2022, 7:49am UTC](https://discuss.elastic.co/t/rolling-restart-doubt/315429 "2022-09-29T07:49:01Z")

</div>

hello! i have a cluster with 20 data nodes, 3 masters and 2 ml. We want to do a rolling restart so that there is no loss of service. i know the method to follow.... disable shard allocation, temporarily stop ml jobs, r…

---

## [Can we use MinIO with NFS for snapshot/restore repo +50TB?](https://discuss.elastic.co/t/can-we-use-minio-with-nfs-for-snapshot-restore-repo-50tb/315426)

<div class="topic-metadata">

**Author:** [@markn](https://discuss.elastic.co/u/markn)\
**Replies:** 2\
**Last updated:** [September 29, 2022, 7:03am UTC](https://discuss.elastic.co/t/can-we-use-minio-with-nfs-for-snapshot-restore-repo-50tb/315426 "2022-09-29T07:03:09Z")

</div>

Hi all, we cannot backup outside our data center. Hence we want to use MinIO according to the documentation: Only our cheapest storage is NFSv3 but MinIO recommends not to use that: https://min.io/docs/minio/containe…

---

## [Import Elastic DNF/Yum repos into Artifactory](https://discuss.elastic.co/t/import-elastic-dnf-yum-repos-into-artifactory/315375)

<div class="topic-metadata">

**Author:** [@UPPERCASE](https://discuss.elastic.co/u/UPPERCASE)\
**Replies:** 0\
**Last updated:** [September 28, 2022, 1:05pm UTC](https://discuss.elastic.co/t/import-elastic-dnf-yum-repos-into-artifactory/315375 "2022-09-28T13:05:03Z")

</div>

I want to include this repo. \[elastic-8.x\] name=Elastic repository for 8.x packages baseurl=https://artifacts.elastic.co/packages/8.x/yum gpgcheck=1 gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch enabled=1 au…

---

## [Windows system configuration](https://discuss.elastic.co/t/windows-system-configuration/315427)

<div class="topic-metadata">

**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\
**Replies:** 0\
**Last updated:** [September 29, 2022, 6:46am UTC](https://discuss.elastic.co/t/windows-system-configuration/315427 "2022-09-29T06:46:24Z")

</div>

In documentation there are explanation on configuration related to Linux, such file descriptor, virtual memory, etc. Is there any special configuration for Windows?

[Previous page](https://discuss.elastic.co/latest.md?page=948)

[Next page](https://discuss.elastic.co/latest.md?page=950)
