# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1157 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1158 --- ## [KQL filter if more values](https://discuss.elastic.co/t/kql-filter-if-more-values/254961)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 3\ **Last updated:** [November 11, 2020, 12:12pm UTC](https://discuss.elastic.co/t/kql-filter-if-more-values/254961 "2020-11-11T12:12:50Z")
Hi, Looking to query a field such as process.args:"atbroker.exe" but would only want a hit if there is more in process.args than just atbroker.exe Is this possible? Thanks Phil --- ## [Restore saved objects from a remote .kibana index](https://discuss.elastic.co/t/restore-saved-objects-from-a-remote-kibana-index/254933)
**Author:** [@Angelos](https://discuss.elastic.co/u/Angelos)\ **Replies:** 8\ **Last updated:** [November 11, 2020, 12:00pm UTC](https://discuss.elastic.co/t/restore-saved-objects-from-a-remote-kibana-index/254933 "2020-11-11T12:00:33Z")
Hello, I tried to reindex .kibana\_2(latest) of our production elastic to my local elastic. The problem is that Not all the saved objects have been transferred. What kind of data .kibana\_2 includes? Shouldn't all saved … --- ## [Sort and Stats Aggregation](https://discuss.elastic.co/t/sort-and-stats-aggregation/254426)
**Author:** [@abhinav\_elk](https://discuss.elastic.co/u/abhinav_elk)\ **Replies:** 1\ **Last updated:** [November 11, 2020, 11:28am UTC](https://discuss.elastic.co/t/sort-and-stats-aggregation/254426 "2020-11-11T11:28:11Z")
I have a mapping of type { "properties":{ "Costs":{ "type":"nested", "properties":{ "price":{ "type":"integer" } … --- ## [Auto interval date histogram illegal argument exception, buckets must be less than 333](https://discuss.elastic.co/t/auto-interval-date-histogram-illegal-argument-exception-buckets-must-be-less-than-333/255042)
**Author:** [@dyegoe](https://discuss.elastic.co/u/dyegoe)\ **Replies:** 2\ **Last updated:** [November 11, 2020, 11:14am UTC](https://discuss.elastic.co/t/auto-interval-date-histogram-illegal-argument-exception-buckets-must-be-less-than-333/255042 "2020-11-11T11:14:38Z")
I tried to create an auto\_date\_histogram to generate some graphs in our application and I would like to keep the length of this graph as 360 points (buckets). I'm trying to achieve at least for the last 6h a graph per m… --- ## [Logstash output script not working: Append array while upserting](https://discuss.elastic.co/t/logstash-output-script-not-working-append-array-while-upserting/250824)
**Author:** [@Bastian\_Jager](https://discuss.elastic.co/u/Bastian_Jager)\ **Replies:** 4\ **Last updated:** [November 11, 2020, 10:27am UTC](https://discuss.elastic.co/t/logstash-output-script-not-working-append-array-while-upserting/250824 "2020-11-11T10:27:55Z")
My plan is to uploads logs with logstash and update a field if this is present already in ES. There is the field "origin" with maybe this “origin” : \[ “live” \] and on upload it should become “origin” : \[ “live, “upload\].… --- ## [Search Request are Getting Socket Timeout](https://discuss.elastic.co/t/search-request-are-getting-socket-timeout/255014)
**Author:** [@dillibabu.mekala](https://discuss.elastic.co/u/dillibabu.mekala)\ **Replies:** 6\ **Last updated:** [November 11, 2020, 10:02am UTC](https://discuss.elastic.co/t/search-request-are-getting-socket-timeout/255014 "2020-11-11T10:02:57Z")
Hi Team, We have an index containing 365 days data. We have started reprocessing existing 1-Day data (i.e reprocessing includes-\> Insert New Data + then delete the Old data), we observed that while reprocessing is goin… --- ## [How can we mount NFS mount on elastic operator based pods (Elasticsearch on Kubernetes)](https://discuss.elastic.co/t/how-can-we-mount-nfs-mount-on-elastic-operator-based-pods-elasticsearch-on-kubernetes/236077)
**Author:** [@nethisandeep](https://discuss.elastic.co/u/nethisandeep)\ **Replies:** 3\ **Last updated:** [June 7, 2020, 11:47am UTC](https://discuss.elastic.co/t/how-can-we-mount-nfs-mount-on-elastic-operator-based-pods-elasticsearch-on-kubernetes/236077 "2020-06-07T11:47:29Z")
Hi Team, I'm trying to use elasticsearch operator on our Kuberenetes cluster and found some limitations around volume mounts. Looks like with the current version it's only possible to attach storage volume and cloud plu… --- ## [Snmp v3 logstash not working in pipeline](https://discuss.elastic.co/t/snmp-v3-logstash-not-working-in-pipeline/254940)
**Author:** [@BenoitSERRA](https://discuss.elastic.co/u/BenoitSERRA)\ **Replies:** 5\ **Last updated:** [November 11, 2020, 9:48am UTC](https://discuss.elastic.co/t/snmp-v3-logstash-not-working-in-pipeline/254940 "2020-11-11T09:48:56Z")
Hello, I'm struggling with a strange problem with Logstash. I've created a config to query a few switches with SNMP v3 et get targeted interfaces statistics When I run logstash with the config file, everything works f… --- ## [Elasticsearch 6.8.10 memory leak](https://discuss.elastic.co/t/elasticsearch-6-8-10-memory-leak/253972)
**Author:** [@zcola](https://discuss.elastic.co/u/zcola)\ **Replies:** 6\ **Last updated:** [November 11, 2020, 9:33am UTC](https://discuss.elastic.co/t/elasticsearch-6-8-10-memory-leak/253972 "2020-11-11T09:33:01Z")
100+ node es cluster , hot/warm arch The stale node heap is 31gb, and multiple nodes occupy 90% of the heap irregularly. It will appear again one week after restarting. segment memory(14g), query cache(2.6g), single st… --- ## [Elasticsearch Datasheet Documentation](https://discuss.elastic.co/t/elasticsearch-datasheet-documentation/255028)
**Author:** [@syafeera](https://discuss.elastic.co/u/syafeera)\ **Replies:** 0\ **Last updated:** [November 11, 2020, 9:05am UTC](https://discuss.elastic.co/t/elasticsearch-datasheet-documentation/255028 "2020-11-11T09:05:51Z")
Hi, Is anyone here have elastic-search datasheet documentation? --- ## [Integer instead of Float](https://discuss.elastic.co/t/integer-instead-of-float/255025)
**Author:** [@M2M](https://discuss.elastic.co/u/M2M)\ **Replies:** 0\ **Last updated:** [November 11, 2020, 8:59am UTC](https://discuss.elastic.co/t/integer-instead-of-float/255025 "2020-11-11T08:59:53Z")
Hi I have problem when trying to display a value as float. kindly note that I can displayed properly in Discover but not the case for any type of visualisation for more details please refer to the below snapshots from… --- ## [Queries without fully qualified field names failing in the latest versions of Elasticsearch](https://discuss.elastic.co/t/queries-without-fully-qualified-field-names-failing-in-the-latest-versions-of-elasticsearch/254958)
**Author:** [@Bhargav\_Balu](https://discuss.elastic.co/u/Bhargav_Balu)\ **Replies:** 4\ **Last updated:** [November 11, 2020, 6:55am UTC](https://discuss.elastic.co/t/queries-without-fully-qualified-field-names-failing-in-the-latest-versions-of-elasticsearch/254958 "2020-11-11T06:55:30Z")
Hi, We are currently running Elasticsearch 1.4 and are trying to upgrade to the newer versions 7.x. As part of that effort, we noticed our queries are failing on the latest versions i.e 7.x if the fileds used in queries… --- ## [Delete the data in Elasticsearch index based on a date/timestamp column in that index using python](https://discuss.elastic.co/t/delete-the-data-in-elasticsearch-index-based-on-a-date-timestamp-column-in-that-index-using-python/254775)
**Author:** [@vidhyadhara](https://discuss.elastic.co/u/vidhyadhara)\ **Replies:** 4\ **Last updated:** [November 11, 2020, 6:42am UTC](https://discuss.elastic.co/t/delete-the-data-in-elasticsearch-index-based-on-a-date-timestamp-column-in-that-index-using-python/254775 "2020-11-11T06:42:35Z")
I have several indexes which has a column named "date" or "timestamp", I want to delete only the data from that index which older than certain days/weeks. I do not want to delete the entire index. In fact I want to do i… --- ## [What is the use of internal verison\_type now that one should use seq\_no and primary\_term for Optimistic Concurrency Control?](https://discuss.elastic.co/t/what-is-the-use-of-internal-verison-type-now-that-one-should-use-seq-no-and-primary-term-for-optimistic-concurrency-control/252061)
**Author:** [@Bhargav\_Balu](https://discuss.elastic.co/u/Bhargav_Balu)\ **Replies:** 1\ **Last updated:** [November 11, 2020, 6:29am UTC](https://discuss.elastic.co/t/what-is-the-use-of-internal-verison-type-now-that-one-should-use-seq-no-and-primary-term-for-optimistic-concurrency-control/252061 "2020-11-11T06:29:23Z")
Hi, Why is internal version type still supported here The latest versions doesn't support this way of concurrency control anymore and one should use seq\_no and primary\_term right? --- ## [What should I do if the 'state' file is corrupted](https://discuss.elastic.co/t/what-should-i-do-if-the-state-file-is-corrupted/254999)
**Author:** [@cigarl](https://discuss.elastic.co/u/cigarl)\ **Replies:** 1\ **Last updated:** [November 11, 2020, 6:09am UTC](https://discuss.elastic.co/t/what-should-i-do-if-the-state-file-is-corrupted/254999 "2020-11-11T06:09:31Z")
When shard-data is corrupt, I can use 'reroute' or 'elasticSearch-shard' to restore the cluster, even if some data of the shard could be lost. But when the 'state' file is corrupted, the cluster cannot even be started. … --- ## [Limit of total fields \[1000\] exceeded](https://discuss.elastic.co/t/limit-of-total-fields-1000-exceeded/254747)
**Author:** [@ahmedbrandver](https://discuss.elastic.co/u/ahmedbrandver)\ **Replies:** 17\ **Last updated:** [November 11, 2020, 4:26am UTC](https://discuss.elastic.co/t/limit-of-total-fields-1000-exceeded/254747 "2020-11-11T04:26:36Z")
I am getting Limit of total fields \[1000\] in index \[products\] has been exceeded. Although total number of properties that is added dynamically is 499. Every where I search is asking me to increase total\_fields length sin… --- ## [Regex question on dsl](https://discuss.elastic.co/t/regex-question-on-dsl/254998)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 1\ **Last updated:** [November 11, 2020, 3:23am UTC](https://discuss.elastic.co/t/regex-question-on-dsl/254998 "2020-11-11T03:23:45Z")
Hi all The regex on the search api have some limitation that i need to overcome somehow so please help me. i would like to search for something like this: test123.test\[.\]com something.test\[.\]com now the regex that i… --- ## [Visualization TSVB Error message: The request for this panel failed Cannot cast from \[boolean\] to \[java.lang.Number\]](https://discuss.elastic.co/t/visualization-tsvb-error-message-the-request-for-this-panel-failed-cannot-cast-from-boolean-to-java-lang-number/254869)
**Author:** [@111207](https://discuss.elastic.co/u/111207)\ **Replies:** 2\ **Last updated:** [November 11, 2020, 2:37am UTC](https://discuss.elastic.co/t/visualization-tsvb-error-message-the-request-for-this-panel-failed-cannot-cast-from-boolean-to-java-lang-number/254869 "2020-11-11T02:37:22Z")
I have create the visualization type TSVB on elasticsearch version 7.5.2 I need to Unique Count of Serail ID of sum value Duration \< 1 But error message "The request for this panel failed Cannot cast from \[boolean\] t… --- ## [Save queries elsewhere besides inside Python app](https://discuss.elastic.co/t/save-queries-elsewhere-besides-inside-python-app/254965)
**Author:** [@ErikvdVen](https://discuss.elastic.co/u/ErikvdVen)\ **Replies:** 2\ **Last updated:** [November 10, 2020, 11:55pm UTC](https://discuss.elastic.co/t/save-queries-elsewhere-besides-inside-python-app/254965 "2020-11-10T23:55:13Z")
We use Elasticsearch queries inside our Python application, which are quite big. For now we saved them as JSON files, to keep the code a bit clean. But I was wondering if anyone knows a better solution? I guess it would… --- ## [How to re-index Elasticsearch without stale reads?](https://discuss.elastic.co/t/how-to-re-index-elasticsearch-without-stale-reads/254860)
**Author:** [@Callonski](https://discuss.elastic.co/u/Callonski)\ **Replies:** 1\ **Last updated:** [November 10, 2020, 11:40pm UTC](https://discuss.elastic.co/t/how-to-re-index-elasticsearch-without-stale-reads/254860 "2020-11-10T23:40:22Z")
I have indices with heavy read/write operations. My indices have a read and a write alias. When I need to update the mapping in my indices I go about this process: create a new index with the new mapping, add write-ali… --- ## [Load LimeSurvey results in ELK for analysis](https://discuss.elastic.co/t/load-limesurvey-results-in-elk-for-analysis/254971)
**Author:** [@BkQc](https://discuss.elastic.co/u/BkQc)\ **Replies:** 1\ **Last updated:** [November 10, 2020, 11:32pm UTC](https://discuss.elastic.co/t/load-limesurvey-results-in-elk-for-analysis/254971 "2020-11-10T23:32:39Z")
Does anyone knows of a Beat product that would allow to load in realtime LimeSurvey results in ELK for analysis and Dashboard in Kibana? Or maybe there is something even more efficient? Thanks. --- ## [ELK stack 5.4 to 6.6 Upgrade](https://discuss.elastic.co/t/elk-stack-5-4-to-6-6-upgrade/254580)
**Author:** [@Bader](https://discuss.elastic.co/u/Bader)\ **Replies:** 6\ **Last updated:** [November 10, 2020, 11:29pm UTC](https://discuss.elastic.co/t/elk-stack-5-4-to-6-6-upgrade/254580 "2020-11-10T23:29:15Z")
Hello! I am looking to upgrade a single-node ELK stack cluster running version 5.4.0 to 6.6.0 on RHEL 7.6. I have read through the ELK documentation and have found that a "rolling upgrade" is the way to go. I do have a… --- ## [Ignoring certain values in average aggregation](https://discuss.elastic.co/t/ignoring-certain-values-in-average-aggregation/254820)
**Author:** [@jonVR](https://discuss.elastic.co/u/jonVR)\ **Replies:** 2\ **Last updated:** [November 10, 2020, 10:57pm UTC](https://discuss.elastic.co/t/ignoring-certain-values-in-average-aggregation/254820 "2020-11-10T22:57:47Z")
I'm in the Visualize section of Kibana, and I'm trying to create a Metric that is an average. However, I want the calculation of the average to ignore values under 15 (or actually, under 900, but the point is I want to i… --- ## [Few questions as I take over from an external Dev](https://discuss.elastic.co/t/few-questions-as-i-take-over-from-an-external-dev/254705)
**Author:** [@M\_Gibbs](https://discuss.elastic.co/u/M_Gibbs)\ **Replies:** 5\ **Last updated:** [November 10, 2020, 10:49pm UTC](https://discuss.elastic.co/t/few-questions-as-i-take-over-from-an-external-dev/254705 "2020-11-10T22:49:13Z")
Hey all, I'm starting to transition our ES from our external dev to myself. I'm no developer, but can generally learn most things. I have a few questions just to stat getting my head around things. Our current mappi… --- ## [Templates matching specific date patterns](https://discuss.elastic.co/t/templates-matching-specific-date-patterns/254972)
**Author:** [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Replies:** 1\ **Last updated:** [November 10, 2020, 10:48pm UTC](https://discuss.elastic.co/t/templates-matching-specific-date-patterns/254972 "2020-11-10T22:48:50Z")
I have day-wise indices that are named like prefix-yyyy-mm-dd e.g myindex-2020-10-01, myindex-2020-10-02 and so on. I want to re-index them into monthly indices named prefix-yyyy-mm e.g. myindex-2020-10, myindex-2020-09 … --- ## [List of Elasticsearch error states when at a RED state](https://discuss.elastic.co/t/list-of-elasticsearch-error-states-when-at-a-red-state/254985)
**Author:** [@21908](https://discuss.elastic.co/u/21908)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 10:33pm UTC](https://discuss.elastic.co/t/list-of-elasticsearch-error-states-when-at-a-red-state/254985 "2020-11-10T22:33:06Z")
I’m interested in getting a list of states/reasons on why an Elasticsearch cluster would be in the RED state. Is there a full list somewhere within the Elasticsearch documentation? I would then like to take this a step… --- ## [How to delete bunch of documents by list of ids](https://discuss.elastic.co/t/how-to-delete-bunch-of-documents-by-list-of-ids/254511)
**Author:** [@Alex12](https://discuss.elastic.co/u/Alex12)\ **Replies:** 6\ **Last updated:** [November 6, 2020, 12:33pm UTC](https://discuss.elastic.co/t/how-to-delete-bunch-of-documents-by-list-of-ids/254511 "2020-11-06T12:33:33Z")
Is it possible to delete list of documents by list of documents id? i tryed like this but it does not work at all deleteAllByIdIn(List\ ids); from ElasticsearchRepository and it does not work at all please guid me… --- ## [Statistical Mode, on visualizations?](https://discuss.elastic.co/t/statistical-mode-on-visualizations/254970)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 3\ **Last updated:** [November 10, 2020, 9:42pm UTC](https://discuss.elastic.co/t/statistical-mode-on-visualizations/254970 "2020-11-10T21:42:29Z")
Hi, is there any vizualization on wich you can display the mode of the data? the definition of mode: The mode is the value that appears most often in a set of data values. --- ## [Updating elasticsearch entities with bulk](https://discuss.elastic.co/t/updating-elasticsearch-entities-with-bulk/254936)
**Author:** [@Alex12](https://discuss.elastic.co/u/Alex12)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 3:30pm UTC](https://discuss.elastic.co/t/updating-elasticsearch-entities-with-bulk/254936 "2020-11-10T15:30:12Z")
I have this database data as below (ES 7.xx) version { "id":"1234", "expirationDate":"17343234234", "paths":"http:localhost:9090", "work":"software dev", "family":{ "baba":"jams", "mother"… --- ## [How to access nested docs in scripted\_metric after nested aggregation](https://discuss.elastic.co/t/how-to-access-nested-docs-in-scripted-metric-after-nested-aggregation/254947)
**Author:** [@drewblin](https://discuss.elastic.co/u/drewblin)\ **Replies:** 1\ **Last updated:** [November 10, 2020, 8:53pm UTC](https://discuss.elastic.co/t/how-to-access-nested-docs-in-scripted-metric-after-nested-aggregation/254947 "2020-11-10T20:53:55Z")
How can i access nested docs in scripted\_metric after nested aggregation? I make request { "query": { "match\_all": {} }, "aggs": { "q1": { "nested": { "path": "pp" }, "aggs": { "q2": { "scripted… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1156) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1158)