# Latest **URL:** https://discuss.elastic.co/latest.md?page=962 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 963 --- ## [Logstash number of threads keeps increasing until crash](https://discuss.elastic.co/t/logstash-number-of-threads-keeps-increasing-until-crash/313463)
**Author:** [@Alain\_Bod](https://discuss.elastic.co/u/Alain_Bod)\ **Replies:** 13\ **Last updated:** [September 19, 2022, 1:06pm UTC](https://discuss.elastic.co/t/logstash-number-of-threads-keeps-increasing-until-crash/313463 "2022-09-19T13:06:06Z")
Hi, I'm testing the following pipeline (stack version 8.4.1): input { google\_cloud\_storage {...} } filter {csv {...} mutate {...} } output { elasticsearch {...} } with a large number of events (3M+). After a few min… --- ## [How to find or query duplicate offsets?](https://discuss.elastic.co/t/how-to-find-or-query-duplicate-offsets/314456)
**Author:** [@connectgeeks](https://discuss.elastic.co/u/connectgeeks)\ **Replies:** 6\ **Last updated:** [September 19, 2022, 1:04pm UTC](https://discuss.elastic.co/t/how-to-find-or-query-duplicate-offsets/314456 "2022-09-19T13:04:33Z")
I’m having duplicate records in my indexes. How can I find list of duplicate records ? Duplicate records have same offset, can you suggest the query to find list of offset with more than one count ? Or any other way to… --- ## [Sorting by Fields After Text Score](https://discuss.elastic.co/t/sorting-by-fields-after-text-score/314673)
**Author:** [@AymanHamdoun](https://discuss.elastic.co/u/AymanHamdoun)\ **Replies:** 1\ **Last updated:** [September 19, 2022, 12:37pm UTC](https://discuss.elastic.co/t/sorting-by-fields-after-text-score/314673 "2022-09-19T12:37:35Z")
Hello, I was wondering if elastic has the ability to sort by certain indexed fields in a document but not prioritize them over the textual match... For instance, lets say i have an index of products that has the follow… --- ## [KV filter on ugly json log](https://discuss.elastic.co/t/kv-filter-on-ugly-json-log/314575)
**Author:** [@stanley783](https://discuss.elastic.co/u/stanley783)\ **Replies:** 4\ **Last updated:** [September 19, 2022, 10:43am UTC](https://discuss.elastic.co/t/kv-filter-on-ugly-json-log/314575 "2022-09-19T10:43:07Z")
Hi, received log in json format, json filter parsed correctly but one field, "details", is in a unfinished/incorrect format lets say and json cant handle it, therefore i applied kv but cant get desired outcome - correct… --- ## [How to store documents (word/ppt/excel/pdf) and search its content using elastic search](https://discuss.elastic.co/t/how-to-store-documents-word-ppt-excel-pdf-and-search-its-content-using-elastic-search/314674)
**Author:** [@avinash.parameswaran](https://discuss.elastic.co/u/avinash.parameswaran)\ **Replies:** 1\ **Last updated:** [September 19, 2022, 10:26am UTC](https://discuss.elastic.co/t/how-to-store-documents-word-ppt-excel-pdf-and-search-its-content-using-elastic-search/314674 "2022-09-19T10:26:15Z")
How to store document as blob to create indexes and search document content as full text search?Any suggestion on above approach to proceed would be helpful Thanks. --- ## [High CPU usage caused by Lucene merge thread](https://discuss.elastic.co/t/high-cpu-usage-caused-by-lucene-merge-thread/314664)
**Author:** [@kent010341](https://discuss.elastic.co/u/kent010341)\ **Replies:** 5\ **Last updated:** [September 19, 2022, 9:07am UTC](https://discuss.elastic.co/t/high-cpu-usage-caused-by-lucene-merge-thread/314664 "2022-09-19T09:07:20Z")
I run ELK stack, APM server, and Metricbeat (Docker and System module) with Docker. The Logstash is used for reading log files, and both the APM server and Metricbeat are for monitoring with a period of 10 seconds. Som… --- ## [Show number as percentile in elasticsearch DSL](https://discuss.elastic.co/t/show-number-as-percentile-in-elasticsearch-dsl/314506)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 5\ **Last updated:** [September 19, 2022, 9:01am UTC](https://discuss.elastic.co/t/show-number-as-percentile-in-elasticsearch-dsl/314506 "2022-09-19T09:01:38Z")
Sample data Name response\_code abc 6780 abc2 9999 abc3 1000 abc4 3456 . . . abc20 9700 I want two perform following task Show those response\_code whoes value is greater than 3000 Sh… --- ## [Filebeat 8.3](https://discuss.elastic.co/t/filebeat-8-3/314630)
**Author:** [@abaltan](https://discuss.elastic.co/u/abaltan)\ **Replies:** 8\ **Last updated:** [September 19, 2022, 8:40am UTC](https://discuss.elastic.co/t/filebeat-8-3/314630 "2022-09-19T08:40:52Z")
Hello, Hope you doing well. we are upgrading Filebeat from 7.12 to 8.3 and we are using the config file below. But for some reason filebeat is not working. Could you please check if there is anything we need to modify … --- ## [Post\_filter on aggregated results](https://discuss.elastic.co/t/post-filter-on-aggregated-results/314671)
**Author:** [@Emna\_Jaoua](https://discuss.elastic.co/u/Emna_Jaoua)\ **Replies:** 0\ **Last updated:** [September 19, 2022, 7:58am UTC](https://discuss.elastic.co/t/post-filter-on-aggregated-results/314671 "2022-09-19T07:58:18Z")
Hello everyone, I have some trouble filtering on aggregated results although the post\_filter is applied on the nested path. To give some context, I m aggregating on nested path aggregationTr.subField.countryId using thi… --- ## [Snapshot incrémental après update de document et segment](https://discuss.elastic.co/t/snapshot-incremental-apres-update-de-document-et-segment/314662)
**Author:** [@bricevalenza](https://discuss.elastic.co/u/bricevalenza)\ **Replies:** 0\ **Last updated:** [September 19, 2022, 7:12am UTC](https://discuss.elastic.co/t/snapshot-incremental-apres-update-de-document-et-segment/314662 "2022-09-19T07:12:01Z")
Bonjour, Sur une architecture assez conséquente (environs 32 To de donnée x2 pour le replica), nous réalisons régulièrement des mises à jours de document (besoin en terme de moteur de recherche donc pas d'ingestion régu… --- ## [Saved object not found & cannot delete it](https://discuss.elastic.co/t/saved-object-not-found-cannot-delete-it/314164)
**Author:** [@uae\_user](https://discuss.elastic.co/u/uae_user)\ **Replies:** 4\ **Last updated:** [September 19, 2022, 5:50am UTC](https://discuss.elastic.co/t/saved-object-not-found-cannot-delete-it/314164 "2022-09-19T05:50:50Z")
Hello, I re-indexed my data and created a new data view after deleting the old one. There are some visualization objects linked to the old data view which I managed to create again and remove the old one however there a… --- ## [Specify the naming space](https://discuss.elastic.co/t/specify-the-naming-space/314619)
**Author:** [@aluopy](https://discuss.elastic.co/u/aluopy)\ **Replies:** 1\ **Last updated:** [September 19, 2022, 4:28am UTC](https://discuss.elastic.co/t/specify-the-naming-space/314619 "2022-09-19T04:28:31Z")
HI, Use ECK to deploy ES and Kibana, how to specify the naming space running ES and Kibana Thanks --- ## [Elastic Cluster change to applyingphase after receiving data stream and logs](https://discuss.elastic.co/t/elastic-cluster-change-to-applyingphase-after-receiving-data-stream-and-logs/313120)
**Author:** [@steveytam](https://discuss.elastic.co/u/steveytam)\ **Replies:** 12\ **Last updated:** [September 19, 2022, 3:10am UTC](https://discuss.elastic.co/t/elastic-cluster-change-to-applyingphase-after-receiving-data-stream-and-logs/313120 "2022-09-19T03:10:12Z")
My elastic cluster is just crashing after I installed one elastic agent, I use ECK 2.4 and deploy Elasticsearch 8.3.3 apiVersion: elasticsearch.k8s.elastic.co/v1 kind: Elasticsearch metadata: name: elasticsearch spec:… --- ## [Adding new data nodes to busy ingesting cluster](https://discuss.elastic.co/t/adding-new-data-nodes-to-busy-ingesting-cluster/314614)
**Author:** [@Todd\_Lyons](https://discuss.elastic.co/u/Todd_Lyons)\ **Replies:** 2\ **Last updated:** [September 19, 2022, 12:26am UTC](https://discuss.elastic.co/t/adding-new-data-nodes-to-busy-ingesting-cluster/314614 "2022-09-19T00:26:10Z")
We have a 7.17.4 cluster with 10 data nodes. Our main index is 10 shards with 1 replica, and it rolls over at 500 GB. I added 2 data nodes, expecting the incoming shards to spread out over the 12 nodes, maybe 2 per new… --- ## [What's the cause of This Error and how to fix It?](https://discuss.elastic.co/t/whats-the-cause-of-this-error-and-how-to-fix-it/314507)
**Author:** [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\ **Replies:** 1\ **Last updated:** [September 18, 2022, 11:15pm UTC](https://discuss.elastic.co/t/whats-the-cause-of-this-error-and-how-to-fix-it/314507 "2022-09-18T23:15:36Z")
I installed Elasticsearch and Kibana 8.4.1 in VM ubuntu 22.04 ad I give this VM 2G RAM, 50 G disk, and 2 CPU, i try in the first time to browze kibana , it's work i can access kibana GUI and relate it to elasticsearch bu… --- ## [What's the cause of this Eroor and how to fix it?](https://discuss.elastic.co/t/whats-the-cause-of-this-eroor-and-how-to-fix-it/314505)
**Author:** [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\ **Replies:** 1\ **Last updated:** [September 18, 2022, 11:15pm UTC](https://discuss.elastic.co/t/whats-the-cause-of-this-eroor-and-how-to-fix-it/314505 "2022-09-18T23:15:12Z")
I installed elasticsearch and kibana 8.4.1 in VM ubuntu 22.04 ad i give to this VM 2G RAM , 50 G disk and 2 cpu Caused by: java.io.IOException: No space left on device elastic@elqstic:~$ sudo systemctl status elasticse… --- ## [Converting large fields during reindex ends with 429](https://discuss.elastic.co/t/converting-large-fields-during-reindex-ends-with-429/314568)
**Author:** [@lubosvr](https://discuss.elastic.co/u/lubosvr)\ **Replies:** 1\ **Last updated:** [September 18, 2022, 11:12pm UTC](https://discuss.elastic.co/t/converting-large-fields-during-reindex-ends-with-429/314568 "2022-09-18T23:12:48Z")
I'm trying to reindex a complex document into a simple one and I have troubles with embedded fields. I have a document like this: POST from/\_doc/1 { "systemMetadata" : { "a:b:c:searchContentHTML" : { "textV… --- ## [ERROR: Aborting enrolling to cluster. Could not communicate with the node on any of the addresses from the enrollment token. All of \[ip:9200\] were attempted](https://discuss.elastic.co/t/error-aborting-enrolling-to-cluster-could-not-communicate-with-the-node-on-any-of-the-addresses-from-the-enrollment-token-all-of-ip-9200-were-attempted/314651)
**Author:** [@hiruni.insyncit.net](https://discuss.elastic.co/u/hiruni.insyncit.net)\ **Replies:** 0\ **Last updated:** [September 18, 2022, 9:18pm UTC](https://discuss.elastic.co/t/error-aborting-enrolling-to-cluster-could-not-communicate-with-the-node-on-any-of-the-addresses-from-the-enrollment-token-all-of-ip-9200-were-attempted/314651 "2022-09-18T21:18:05Z")
Hi, I tried to join new node to existing Elastic cluster. I'm using Elasticsearch version 8.4.1 Tried steps for new node: sudo rpm --install elasticsearch-8.4.1-x86\_64.rpm /usr/share/elasticsearch/bin/elasticsearch-… --- ## [Elasticsearch: find closest/nearest docs in reference to one (calculated from known date)](https://discuss.elastic.co/t/elasticsearch-find-closest-nearest-docs-in-reference-to-one-calculated-from-known-date/314648)
**Author:** [@err](https://discuss.elastic.co/u/err)\ **Replies:** 0\ **Last updated:** [September 18, 2022, 4:52pm UTC](https://discuss.elastic.co/t/elasticsearch-find-closest-nearest-docs-in-reference-to-one-calculated-from-known-date/314648 "2022-09-18T16:52:14Z")
Is there a standard seach possibility to find closest docs to one reference doc by date criteria (if I don not know range yet) Example dataset index “person” - doc : name=\>Alice birthday=\>01.01.1991 - doc : name=\>Bob… --- ## [Best practice for integrating automated created\_at & updated\_at fields in Elasticsearch 8.4](https://discuss.elastic.co/t/best-practice-for-integrating-automated-created-at-updated-at-fields-in-elasticsearch-8-4/314634)
**Author:** [@Sabbir\_Talukdar](https://discuss.elastic.co/u/Sabbir_Talukdar)\ **Replies:** 5\ **Last updated:** [September 18, 2022, 4:47pm UTC](https://discuss.elastic.co/t/best-practice-for-integrating-automated-created-at-updated-at-fields-in-elasticsearch-8-4/314634 "2022-09-18T16:47:39Z")
Hello, this is my first transition from other DB (SQL / NOSQL based) to Elasticsearch. I am having troubles choosing the best practiced methods of integrating created\_at & updated\_at fields. I am familiar with ingest\_p… --- ## [Unable to access kibana dashboard](https://discuss.elastic.co/t/unable-to-access-kibana-dashboard/314637)
**Author:** [@Cipta\_Daffa](https://discuss.elastic.co/u/Cipta_Daffa)\ **Replies:** 1\ **Last updated:** [September 18, 2022, 2:59pm UTC](https://discuss.elastic.co/t/unable-to-access-kibana-dashboard/314637 "2022-09-18T14:59:39Z")
With this configuration, i can't access kibana dashboard? there's anybody can help me? thank you --- ## [Error while running Functinbeat](https://discuss.elastic.co/t/error-while-running-functinbeat/314642)
**Author:** [@Shubham\_Shah](https://discuss.elastic.co/u/Shubham_Shah)\ **Replies:** 0\ **Last updated:** [September 18, 2022, 12:02pm UTC](https://discuss.elastic.co/t/error-while-running-functinbeat/314642 "2022-09-18T12:02:27Z")
Hi Team, While running functionbeat for my testing instance, I got following error as Creation Failed for cloudformation. Error - "Specified ReservedConcurrentExecutions for function decreases account's UnreservedConc… --- ## [Aggregations on \_routing](https://discuss.elastic.co/t/aggregations-on-routing/314640)
**Author:** [@Alexandr\_Maximov](https://discuss.elastic.co/u/Alexandr_Maximov)\ **Replies:** 0\ **Last updated:** [September 18, 2022, 11:24am UTC](https://discuss.elastic.co/t/aggregations-on-routing/314640 "2022-09-18T11:24:50Z")
Hey folks, is there any way how to aggregate on \_routing meta field? I'd like to do an aggregation on \_routing to make sure we don't have any stale data in our indices. --- ## [Very large index , delete and recreate replica](https://discuss.elastic.co/t/very-large-index-delete-and-recreate-replica/314608)
**Author:** [@Paul-Ayo](https://discuss.elastic.co/u/Paul-Ayo)\ **Replies:** 8\ **Last updated:** [September 18, 2022, 10:03am UTC](https://discuss.elastic.co/t/very-large-index-delete-and-recreate-replica/314608 "2022-09-18T10:03:26Z")
I have a huge index which i want to split or reindex , the index has one primary and one replica shard both 118gb . I need to create a new index from the current to be able to use ILM as the index name does not fulfill t… --- ## [Elastic security](https://discuss.elastic.co/t/elastic-security/314297)
**Author:** [@dockerdeploys](https://discuss.elastic.co/u/dockerdeploys)\ **Replies:** 2\ **Last updated:** [September 18, 2022, 3:39am UTC](https://discuss.elastic.co/t/elastic-security/314297 "2022-09-18T03:39:19Z")
Continuing the discussion from ERROR: Failed to set password for user \[apm\_system\] yet again: Hello good time I encountered the following security error in Elasticsearch Thank you for your guidance --- ## [ElasticSearch-6.8 - querying with hyphens in fields does not get results](https://discuss.elastic.co/t/elasticsearch-6-8-querying-with-hyphens-in-fields-does-not-get-results/314467)
**Author:** [@spp125](https://discuss.elastic.co/u/spp125)\ **Replies:** 7\ **Last updated:** [September 18, 2022, 2:08am UTC](https://discuss.elastic.co/t/elasticsearch-6-8-querying-with-hyphens-in-fields-does-not-get-results/314467 "2022-09-18T02:08:17Z")
I have a users index in that there is a field called groupName that have value like "ad-users" when I query to match how many users belong to "ad-users" groupName. Upon querying to match on groupName I got no results. He… --- ## [Can't index new docs due to type error; sending to old indices still works](https://discuss.elastic.co/t/cant-index-new-docs-due-to-type-error-sending-to-old-indices-still-works/314628)
**Author:** [@emw](https://discuss.elastic.co/u/emw)\ **Replies:** 2\ **Last updated:** [September 18, 2022, 12:23am UTC](https://discuss.elastic.co/t/cant-index-new-docs-due-to-type-error-sending-to-old-indices-still-works/314628 "2022-09-18T00:23:13Z")
In my ES 7.17 cluster, I'm using index templates to create a new weekly index where I send log data. The index names are generated by my application, not by ES; the template handles index patterns, field limits, and alia… --- ## [How to config OpenTelemetry Log](https://discuss.elastic.co/t/how-to-config-opentelemetry-log/314622)
**Author:** [@yingziisme](https://discuss.elastic.co/u/yingziisme)\ **Replies:** 1\ **Last updated:** [September 17, 2022, 2:56pm UTC](https://discuss.elastic.co/t/how-to-config-opentelemetry-log/314622 "2022-09-17T14:56:02Z")
In Observability Page, find the error "Expected ")", ":", "\<", "\<=", "\>", "\>=", AND, OR, whitespace but end of input found." like below picture. but I can find Log from Trace details By Trace logs --- ## [NET::ERR\_CERT\_INVALID - Kibana](https://discuss.elastic.co/t/net-err-cert-invalid-kibana/314629)
**Author:** [@Phildefer](https://discuss.elastic.co/u/Phildefer)\ **Replies:** 0\ **Last updated:** [September 17, 2022, 10:48pm UTC](https://discuss.elastic.co/t/net-err-cert-invalid-kibana/314629 "2022-09-17T22:48:03Z")
Bonjour, Après avoir pas mal galéré et exploré différentes pistes pour autohéberger via Portainer (docker) sur un NAS la suite ELK, j'ai enfin réussi à configurer les images officielles de la stack ELK. Tout fonctionne … --- ## [\[LogStash::Runner\] runner - Logstash shut down](https://discuss.elastic.co/t/logstash-runner-runner-logstash-shut-down/314612)
**Author:** [@Veera\_V](https://discuss.elastic.co/u/Veera_V)\ **Replies:** 2\ **Last updated:** [September 17, 2022, 1:16pm UTC](https://discuss.elastic.co/t/logstash-runner-runner-logstash-shut-down/314612 "2022-09-17T13:16:41Z")
Hi there, I'm trying to connect logstash and Opensearch, but I'm getting error "Logstash::Runner\] runner - Logstash shutdown. Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. … [Previous page](https://discuss.elastic.co/latest.md?page=961) [Next page](https://discuss.elastic.co/latest.md?page=963)