# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1162 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1163 --- ## [Beginner question: Skipping the filtering of id into \[@metadata\]\[\_id\]](https://discuss.elastic.co/t/beginner-question-skipping-the-filtering-of-id-into-metadata-id/254508)
**Author:** [@pyrovoice](https://discuss.elastic.co/u/pyrovoice)\ **Replies:** 0\ **Last updated:** [November 6, 2020, 9:16am UTC](https://discuss.elastic.co/t/beginner-question-skipping-the-filtering-of-id-into-metadata-id/254508 "2020-11-06T09:16:53Z")
I followed the following tutorial: https://www.elastic.co/blog/how-to-keep-elasticsearch-synchronized-with-a-relational-database-using-logstash The configuration file for the pipeline contains the following: input … --- ## [Getting all documents in Elastic Search Shard](https://discuss.elastic.co/t/getting-all-documents-in-elastic-search-shard/254690)
**Author:** [@asagarwal10](https://discuss.elastic.co/u/asagarwal10)\ **Replies:** 0\ **Last updated:** [November 8, 2020, 7:41pm UTC](https://discuss.elastic.co/t/getting-all-documents-in-elastic-search-shard/254690 "2020-11-08T19:41:31Z")
I am trying to get all documents in a shard. When creating the index, I used the query: PUT mortgages-stage { "mappings": { "\_routing": { "required": true } } } When adding documents to the index, I … --- ## [How do the "query" and "suggest" blocks relate in a suggestion request?](https://discuss.elastic.co/t/how-do-the-query-and-suggest-blocks-relate-in-a-suggestion-request/254685)
**Author:** [@Timothy\_Wall](https://discuss.elastic.co/u/Timothy_Wall)\ **Replies:** 2\ **Last updated:** [November 8, 2020, 7:09pm UTC](https://discuss.elastic.co/t/how-do-the-query-and-suggest-blocks-relate-in-a-suggestion-request/254685 "2020-11-08T19:09:50Z")
If I'm doing a suggestion request like below, how do the "query" and "suggest" blocks relate to one another? POST /\_search { "query": {...}, "suggest": {...}, } --- ## [Elasticsearch RestHighLevelClient behind a corporate firewall via a proxy](https://discuss.elastic.co/t/elasticsearch-resthighlevelclient-behind-a-corporate-firewall-via-a-proxy/254642)
**Author:** [@Ilya\_I](https://discuss.elastic.co/u/Ilya_I)\ **Replies:** 1\ **Last updated:** [November 8, 2020, 6:29pm UTC](https://discuss.elastic.co/t/elasticsearch-resthighlevelclient-behind-a-corporate-firewall-via-a-proxy/254642 "2020-11-08T18:29:41Z")
I am trying to access cloud Elasticsearch installation from our network that requires using a proxy for external requests. This is the snippet of code I use to pass Elasticsearch credentials and our proxy settings: Cred… --- ## [Snapshot retention question](https://discuss.elastic.co/t/snapshot-retention-question/254677)
**Author:** [@mwise29](https://discuss.elastic.co/u/mwise29)\ **Replies:** 9\ **Last updated:** [November 8, 2020, 4:40pm UTC](https://discuss.elastic.co/t/snapshot-retention-question/254677 "2020-11-08T16:40:58Z")
I'm new to ElasticSearch administration. From what I've gathered so far for snapshots is they are always incremental. My question is regarding snapshot retention. The documentation mentions that the snapshots can be c… --- ## [One word fields (keyword vs text types)](https://discuss.elastic.co/t/one-word-fields-keyword-vs-text-types/252408)
**Author:** [@aviadhaham](https://discuss.elastic.co/u/aviadhaham)\ **Replies:** 9\ **Last updated:** [November 8, 2020, 4:23pm UTC](https://discuss.elastic.co/t/one-word-fields-keyword-vs-text-types/252408 "2020-11-08T16:23:36Z")
If, for example, I have a field in which I know that the data ingested to it is only one-word strings. Why would I still use type "text" and not type "keyword" for this field's mapping? Setting it to be of type "keyword… --- ## [Aggregate "array" length's across documents](https://discuss.elastic.co/t/aggregate-array-lengths-across-documents/254646)
**Author:** [@Courtan](https://discuss.elastic.co/u/Courtan)\ **Replies:** 1\ **Last updated:** [November 8, 2020, 2:53pm UTC](https://discuss.elastic.co/t/aggregate-array-lengths-across-documents/254646 "2020-11-08T14:53:55Z")
I am trying to count Array Elements across all documents and sum them up, but I keep getting this error: "No field found for \[offers\] in mapping with types \[ \]" Mappings { "mappings": { "properties": { "of… --- ## [Tableau Connector for Elasticsearch connecting string details](https://discuss.elastic.co/t/tableau-connector-for-elasticsearch-connecting-string-details/251907)
**Author:** [@Prabhu.292](https://discuss.elastic.co/u/Prabhu.292)\ **Replies:** 10\ **Last updated:** [November 8, 2020, 12:34pm UTC](https://discuss.elastic.co/t/tableau-connector-for-elasticsearch-connecting-string-details/251907 "2020-11-08T12:34:33Z")
Hi Team, By using this link : https://extensiongallery.tableau.com/connectors/180?version=2019.4&per-page=50&loginRedirected Using this above link from the Tableau gallery I have installed the JDBC driver and it is suc… --- ## [Installed plugin](https://discuss.elastic.co/t/installed-plugin/254394)
**Author:** [@omerf](https://discuss.elastic.co/u/omerf)\ **Replies:** 3\ **Last updated:** [November 8, 2020, 10:21am UTC](https://discuss.elastic.co/t/installed-plugin/254394 "2020-11-08T10:21:31Z")
I created a plugin, using the yarn kbn and the script plugin generator, and zipped it in the right structure. I am now running a different kibana to test the installation, and it is successful- I cant see the plugin … --- ## [Configure two outputs in Logstash](https://discuss.elastic.co/t/configure-two-outputs-in-logstash/254658)
**Author:** [@Falikou1](https://discuss.elastic.co/u/Falikou1)\ **Replies:** 3\ **Last updated:** [November 8, 2020, 10:19am UTC](https://discuss.elastic.co/t/configure-two-outputs-in-logstash/254658 "2020-11-08T10:19:56Z")
Logstash is a log aggregator that collects data from various input sources, performs various transformations and enhancements, and then sends the data to various supported output destinations. Is it possible to configur… --- ## [Journal impossible de récupérer les informations de version à partir des nœuds elasticsearch - Comment résoudre les problèmes connexes](https://discuss.elastic.co/t/journal-impossible-de-recuperer-les-informations-de-version-a-partir-des-noeuds-elasticsearch-comment-resoudre-les-problemes-connexes/254604)
**Author:** [@Ramond](https://discuss.elastic.co/u/Ramond)\ **Replies:** 8\ **Last updated:** [November 8, 2020, 8:50am UTC](https://discuss.elastic.co/t/journal-impossible-de-recuperer-les-informations-de-version-a-partir-des-noeuds-elasticsearch-comment-resoudre-les-problemes-connexes/254604 "2020-11-08T08:50:31Z")
log \[09:52:49.855\] \[error\]\[savedobjects-service\] Unable to retrieve version information from Elasticsearch nodes. log \[09:52:49.863\] \[warning\]\[licensing\]\[plugins\] License information could not be obtained from Elast… --- ## [Huge dictionary in logstash translate filter](https://discuss.elastic.co/t/huge-dictionary-in-logstash-translate-filter/253857)
**Author:** [@heric](https://discuss.elastic.co/u/heric)\ **Replies:** 11\ **Last updated:** [November 8, 2020, 8:41am UTC](https://discuss.elastic.co/t/huge-dictionary-in-logstash-translate-filter/253857 "2020-11-08T08:41:25Z")
I have huge dictionary file to be used in logstash translate filter , around 180k entries. I tried to reduce it to around 80k but still always getting error when starting the pipeline , as below : \[2020-10-30T22:11:47,1… --- ## [Starting kibana fails](https://discuss.elastic.co/t/starting-kibana-fails/254613)
**Author:** [@flamant](https://discuss.elastic.co/u/flamant)\ **Replies:** 1\ **Last updated:** [November 8, 2020, 8:12am UTC](https://discuss.elastic.co/t/starting-kibana-fails/254613 "2020-11-08T08:12:27Z")
Hello, I try to setup elasticsearch plus kibana. I use version 7.9.3 for both. I have no problem with elasticsearch, but get problems with kibana start. Before launching kibana, I run curl -XDELETE http://localhost:920… --- ## [Elasticsearch mTLS connection to S3 (minio based) to store snapshots](https://discuss.elastic.co/t/elasticsearch-mtls-connection-to-s3-minio-based-to-store-snapshots/226690)
**Author:** [@bikkina\_mahesh](https://discuss.elastic.co/u/bikkina_mahesh)\ **Replies:** 3\ **Last updated:** [November 8, 2020, 7:17am UTC](https://discuss.elastic.co/t/elasticsearch-mtls-connection-to-s3-minio-based-to-store-snapshots/226690 "2020-11-08T07:17:09Z")
Hi All, I want to store snapshots in s3 storage where it requires mutual auth (mTLS) ( Note : S3 is minio based) I have client.crt, client.key, root.crt at the client side. I tried these steps, apiVersion: elasticsea… --- ## [Debugging geoip plugin - Ruby @logger statements appear but not Java logger](https://discuss.elastic.co/t/debugging-geoip-plugin-ruby-logger-statements-appear-but-not-java-logger/254644)
**Author:** [@hukel](https://discuss.elastic.co/u/hukel)\ **Replies:** 2\ **Last updated:** [November 8, 2020, 12:15am UTC](https://discuss.elastic.co/t/debugging-geoip-plugin-ruby-logger-statements-appear-but-not-java-logger/254644 "2020-11-08T00:15:56Z")
I know the geoip plugin has some limitations when handling private IP addresses so I am not trying to solve that problem. I am trying to get debug output from the plugin to explain where it is giving up when processi… --- ## [Exists query calls DocValuesFieldExistsQuery for all subfields of an object under the field](https://discuss.elastic.co/t/exists-query-calls-docvaluesfieldexistsquery-for-all-subfields-of-an-object-under-the-field/254627)
**Author:** [@bek](https://discuss.elastic.co/u/bek)\ **Replies:** 0\ **Last updated:** [November 7, 2020, 4:11pm UTC](https://discuss.elastic.co/t/exists-query-calls-docvaluesfieldexistsquery-for-all-subfields-of-an-object-under-the-field/254627 "2020-11-07T16:11:17Z")
While upgrading elasticsearch from 5.6 to 7.9, we noticed that the DocValuesFieldExistsQuery is getting called for all child fields of a field, causing wait times up to a minute. Is there a way to prevent triggering DocV… --- ## [\[Errno 111\] Connection refused)](https://discuss.elastic.co/t/errno-111-connection-refused/253813)
**Author:** [@subham\_p](https://discuss.elastic.co/u/subham_p)\ **Replies:** 5\ **Last updated:** [November 7, 2020, 7:27pm UTC](https://discuss.elastic.co/t/errno-111-connection-refused/253813 "2020-11-07T19:27:26Z")
During handling of the above exception, another exception occurred: Traceback (most recent call last): File "for\_bulk\_insert.py", line 61, in es.indices.delete(index=index\_name, ignore=\[400, 404\]) File "/home/subham… --- ## [How to change the contributor text on maps](https://discuss.elastic.co/t/how-to-change-the-contributor-text-on-maps/254478)
**Author:** [@witcher](https://discuss.elastic.co/u/witcher)\ **Replies:** 5\ **Last updated:** [November 7, 2020, 7:26pm UTC](https://discuss.elastic.co/t/how-to-change-the-contributor-text-on-maps/254478 "2020-11-07T19:26:53Z")
--- ## [Combine logstash and metricbeat graph together](https://discuss.elastic.co/t/combine-logstash-and-metricbeat-graph-together/254625)
**Author:** [@tarunmendon](https://discuss.elastic.co/u/tarunmendon)\ **Replies:** 1\ **Last updated:** [November 7, 2020, 7:11pm UTC](https://discuss.elastic.co/t/combine-logstash-and-metricbeat-graph-together/254625 "2020-11-07T19:11:26Z")
I have setup logstash pipeline and metricbeat. I can see a graph for both of these but they are in different dashboard. Is it possible to collate this both and show this in one single dashboard? PFA logstash and metricb… --- ## [Can not create topic](https://discuss.elastic.co/t/can-not-create-topic/254622)
**Author:** [@bek](https://discuss.elastic.co/u/bek)\ **Replies:** 1\ **Last updated:** [November 7, 2020, 5:57pm UTC](https://discuss.elastic.co/t/can-not-create-topic/254622 "2020-11-07T17:57:32Z")
After entering the contents of my question, pressing "+Create Topic" does nothing. Developer tools show that there are no errors in either javascript or server side. --- ## [Help me](https://discuss.elastic.co/t/help-me/254626)
**Author:** [@YONGZHI](https://discuss.elastic.co/u/YONGZHI)\ **Replies:** 1\ **Last updated:** [November 7, 2020, 4:25pm UTC](https://discuss.elastic.co/t/help-me/254626 "2020-11-07T16:25:40Z")
I dont know why... could someone can help me, please. --- ## [Searching multifield with nested object not working in the nested object](https://discuss.elastic.co/t/searching-multifield-with-nested-object-not-working-in-the-nested-object/254623)
**Author:** [@Diogo\_Filipe](https://discuss.elastic.co/u/Diogo_Filipe)\ **Replies:** 0\ **Last updated:** [November 7, 2020, 3:54pm UTC](https://discuss.elastic.co/t/searching-multifield-with-nested-object-not-working-in-the-nested-object/254623 "2020-11-07T15:54:35Z")
Hi, I'm using Elastic 7.9.2 with ECK 1.2.1. Using Java and Spring too. I'm trying to query a nested object directly to the id variable(inside the 2nd object) but it always returns zero results. An example of my mappin… --- ## [Can we create kibana deployment replicas more than 1 in kubernetes?](https://discuss.elastic.co/t/can-we-create-kibana-deployment-replicas-more-than-1-in-kubernetes/254564)
**Author:** [@devopsmd](https://discuss.elastic.co/u/devopsmd)\ **Replies:** 3\ **Last updated:** [November 7, 2020, 2:43pm UTC](https://discuss.elastic.co/t/can-we-create-kibana-deployment-replicas-more-than-1-in-kubernetes/254564 "2020-11-07T14:43:20Z")
apiVersion: apps/v1 kind: Deployment metadata: name: kibana-logging #namespace: kube-system labels: k8s-app: kibana-logging spec: replicas: 3 selector: matchLabels: k8s-app: kibana-logging templ… --- ## [Kibana SaveObject API](https://discuss.elastic.co/t/kibana-saveobject-api/252557)
**Author:** [@mhr](https://discuss.elastic.co/u/mhr)\ **Replies:** 2\ **Last updated:** [November 7, 2020, 2:16pm UTC](https://discuss.elastic.co/t/kibana-saveobject-api/252557 "2020-11-07T14:16:20Z")
HI Support, How to Import selective save object using Curl Command. I do not want to import IndexPattern using curl API from ndjson file. --- ## [Shard sizing as per the RAM available for an instance](https://discuss.elastic.co/t/shard-sizing-as-per-the-ram-available-for-an-instance/254594)
**Author:** [@SaitejaParsi](https://discuss.elastic.co/u/SaitejaParsi)\ **Replies:** 1\ **Last updated:** [November 7, 2020, 2:57am UTC](https://discuss.elastic.co/t/shard-sizing-as-per-the-ram-available-for-an-instance/254594 "2020-11-07T02:57:40Z")
How do the shard size related to the RAM capacity of the es instance? From the articles I read, 20 - 25 shards per GB is ideal and each shard can be from few GB to 10s of GB but should be less than 50GB. Also, the recomm… --- ## [Kibana aggregations help](https://discuss.elastic.co/t/kibana-aggregations-help/254582)
**Author:** [@smruthip](https://discuss.elastic.co/u/smruthip)\ **Replies:** 2\ **Last updated:** [November 7, 2020, 12:41am UTC](https://discuss.elastic.co/t/kibana-aggregations-help/254582 "2020-11-07T00:41:00Z")
Hi all, I am trying to get the latest document based on a field example ''' container\_id state time 1 A 2pm 1 B 1pm 1 C 6pm 2 … --- ## [Custom SIEM rules: illegal\_argument\_exception permission issue](https://discuss.elastic.co/t/custom-siem-rules-illegal-argument-exception-permission-issue/253787)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 5\ **Last updated:** [November 6, 2020, 11:34pm UTC](https://discuss.elastic.co/t/custom-siem-rules-illegal-argument-exception-permission-issue/253787 "2020-11-06T23:34:27Z")
I've created a custom rule, which seems working if I run via the console. But when I put it as a SIEM rule, below error occurs Any idea which permission/privilege I need to do to fix the issue? An error occurred during… --- ## [Logstash not adding new field tag](https://discuss.elastic.co/t/logstash-not-adding-new-field-tag/254579)
**Author:** [@inuygoku](https://discuss.elastic.co/u/inuygoku)\ **Replies:** 2\ **Last updated:** [November 6, 2020, 9:04pm UTC](https://discuss.elastic.co/t/logstash-not-adding-new-field-tag/254579 "2020-11-06T21:04:13Z")
I am trying to create a filter that will for event in my logs and add it to a field called "detected\_event". The filter I created is the following: filter { if "Scan completed" in \[logline\] { mutate { … --- ## [Recreate new field from old field](https://discuss.elastic.co/t/recreate-new-field-from-old-field/254567)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [November 6, 2020, 7:20pm UTC](https://discuss.elastic.co/t/recreate-new-field-from-old-field/254567 "2020-11-06T19:20:24Z")
I have used add\_filed, remove\_field, rename etc.. many time over on logstash now I have something different that I can't quite figure out. runnign nvidiabeat and it gives me following { "clocks":{"mem":405,"sm… --- ## [How to modify overview tap in elastic security app](https://discuss.elastic.co/t/how-to-modify-overview-tap-in-elastic-security-app/254193)
**Author:** [@111387](https://discuss.elastic.co/u/111387)\ **Replies:** 3\ **Last updated:** [November 6, 2020, 6:14pm UTC](https://discuss.elastic.co/t/how-to-modify-overview-tap-in-elastic-security-app/254193 "2020-11-06T18:14:37Z")
I set some IPS logs into ECS format using Fluentd and then delivered them to elasticsearch. And you can see that the log is coming in from kibana. The problem is that Elastic Security's Overview tap doesn't show the nu… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1161) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1163)