# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1281 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1282 --- ## [APM and Heartbeat timestamp does not match with logs timestamp having 5:30 hour difference](https://discuss.elastic.co/t/apm-and-heartbeat-timestamp-does-not-match-with-logs-timestamp-having-5-30-hour-difference/244992)
**Author:** [@Shefali](https://discuss.elastic.co/u/Shefali)\ **Replies:** 0\ **Last updated:** [August 14, 2020, 10:37am UTC](https://discuss.elastic.co/t/apm-and-heartbeat-timestamp-does-not-match-with-logs-timestamp-having-5-30-hour-difference/244992 "2020-08-14T10:37:42Z")
I have created dashboard with APM related visualizations and Application logs. While parsing logs, i used grok debugger in logstash configuration as : 'date { match =\> \[ "newtimestamp", "ISO8601" \] target =\> "@timest… --- ## [How can i use ELK Stack with Infra as code?](https://discuss.elastic.co/t/how-can-i-use-elk-stack-with-infra-as-code/245126)
**Author:** [@jonhmb](https://discuss.elastic.co/u/jonhmb)\ **Replies:** 0\ **Last updated:** [August 16, 2020, 7:10am UTC](https://discuss.elastic.co/t/how-can-i-use-elk-stack-with-infra-as-code/245126 "2020-08-16T07:10:50Z")
Hi, can anyone help me with an idea? I need to use elk stack with infra as code to not lose my data when something happens with my server..... can anyone give a idea on how can i do it ? --- ## [Logstash](https://discuss.elastic.co/t/logstash/245152)
**Author:** [@shashanksingh](https://discuss.elastic.co/u/shashanksingh)\ **Replies:** 1\ **Last updated:** [August 16, 2020, 6:54pm UTC](https://discuss.elastic.co/t/logstash/245152 "2020-08-16T18:54:18Z")
hi , i am new to elastic stack . i am configuring filebeat logstash elasticsearch kibana. and i am getting some error. please help me as soon as possible. thank you. root@ip-10-0-1-187:~# sudo /usr/share/logstash/bin/lo… --- ## [Max aggregation in transforms](https://discuss.elastic.co/t/max-aggregation-in-transforms/245159)
**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\ **Replies:** 0\ **Last updated:** [August 16, 2020, 6:45pm UTC](https://discuss.elastic.co/t/max-aggregation-in-transforms/245159 "2020-08-16T18:45:39Z")
Hi, In transform, i have created one max field with the below script, but when the documents are not present it is returning as null value and getting fail. can you please suggest how to handle it. "MaxHandlingDuratio… --- ## [ctx.containksKey is not working in 7.6 version](https://discuss.elastic.co/t/ctx-containkskey-is-not-working-in-7-6-version/244846)
**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\ **Replies:** 4\ **Last updated:** [August 16, 2020, 6:43pm UTC](https://discuss.elastic.co/t/ctx-containkskey-is-not-working-in-7-6-version/244846 "2020-08-16T18:43:09Z")
Hi I am using ctx.containsKey in ingestpipeline, it is not working in 7.6.2 vesrsion. but it is working in 7.8 version. can you please help here is it expected behaviour in 7.6 versions --- ## [CompositeAggregation pagination's consistent behavior during indexing being frequently update period](https://discuss.elastic.co/t/compositeaggregation-paginations-consistent-behavior-during-indexing-being-frequently-update-period/245155)
**Author:** [@slodevppw](https://discuss.elastic.co/u/slodevppw)\ **Replies:** 0\ **Last updated:** [August 16, 2020, 4:01pm UTC](https://discuss.elastic.co/t/compositeaggregation-paginations-consistent-behavior-during-indexing-being-frequently-update-period/245155 "2020-08-16T16:01:58Z")
We recently use ES CompositeAggregation to generate a report, which requires sorting and the result (can up-to 1M records sometime) is large which requires pagination. However, duplicated records have been identified (… --- ## [java.io.IOException: listener timeout after waiting for \[90000\] ms](https://discuss.elastic.co/t/java-io-ioexception-listener-timeout-after-waiting-for-90000-ms/245153)
**Author:** [@itaydvir](https://discuss.elastic.co/u/itaydvir)\ **Replies:** 0\ **Last updated:** [August 16, 2020, 3:50pm UTC](https://discuss.elastic.co/t/java-io-ioexception-listener-timeout-after-waiting-for-90000-ms/245153 "2020-08-16T15:50:20Z")
Hello, I've upgraded to version 6.8 and using java RestHighLevelClient. Cluster is behind SearchGuard plugin and usually everything is working well. Sometimes (I assume when there are some network issues) i'm getting … --- ## [Logstash S3 Input Plugin Error](https://discuss.elastic.co/t/logstash-s3-input-plugin-error/245104)
**Author:** [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\ **Replies:** 14\ **Last updated:** [August 16, 2020, 3:19pm UTC](https://discuss.elastic.co/t/logstash-s3-input-plugin-error/245104 "2020-08-16T15:19:56Z")
Hi All, I am using S3 plugin to ingest logs from Oracle Cloud Infrastructure bucket. They have advised that the S3 plugin is what can be used. So I have now configured the input config as: input { s3 { bucket =\> … --- ## [Filter on distinct count on aggregation result](https://discuss.elastic.co/t/filter-on-distinct-count-on-aggregation-result/245144)
**Author:** [@Bharat\_Data](https://discuss.elastic.co/u/Bharat_Data)\ **Replies:** 0\ **Last updated:** [August 16, 2020, 1:16pm UTC](https://discuss.elastic.co/t/filter-on-distinct-count-on-aggregation-result/245144 "2020-08-16T13:16:20Z")
I have a use case in which I want to filter the results which have the more than one distinct value. For example :- Query - Returns all the distinct models under each different category { "aggs": { "distinct\_cat… --- ## [Search for value NOT equal to something](https://discuss.elastic.co/t/search-for-value-not-equal-to-something/245132)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 1\ **Last updated:** [August 16, 2020, 12:22pm UTC](https://discuss.elastic.co/t/search-for-value-not-equal-to-something/245132 "2020-08-16T12:22:08Z")
In kibana, I want to see all results are the value of auditd.data.tty is NOT equal to (none). Is it possible to do such a query? Thanks ahead! --- ## [How to transfer log files from log collector(client side) to gateway collector(server side) using logstash](https://discuss.elastic.co/t/how-to-transfer-log-files-from-log-collector-client-side-to-gateway-collector-server-side-using-logstash/245131)
**Author:** [@Gunda\_Someswararao](https://discuss.elastic.co/u/Gunda_Someswararao)\ **Replies:** 0\ **Last updated:** [August 16, 2020, 10:22am UTC](https://discuss.elastic.co/t/how-to-transfer-log-files-from-log-collector-client-side-to-gateway-collector-server-side-using-logstash/245131 "2020-08-16T10:22:07Z")
How to transfer log files from log collector(client side) to gateway collector(server side) using logstash. I am new in ES. please help me, and give some reference links for learning. Thank you. --- ## [Autocomplete for terms aggregations](https://discuss.elastic.co/t/autocomplete-for-terms-aggregations/244914)
**Author:** [@Peter\_Steenbergen](https://discuss.elastic.co/u/Peter_Steenbergen)\ **Replies:** 4\ **Last updated:** [August 16, 2020, 10:02am UTC](https://discuss.elastic.co/t/autocomplete-for-terms-aggregations/244914 "2020-08-16T10:02:28Z")
Hi, There is a search-as-you-type fields since 7.x but is it possible to get similar results for filtered aggregations for autocomplete? Example you have documents with categories on it: holiday vacation images Ther… --- ## [Cannot search JSON logs in Kibana](https://discuss.elastic.co/t/cannot-search-json-logs-in-kibana/244855)
**Author:** [@bc\_andrew](https://discuss.elastic.co/u/bc_andrew)\ **Replies:** 9\ **Last updated:** [August 16, 2020, 9:24am UTC](https://discuss.elastic.co/t/cannot-search-json-logs-in-kibana/244855 "2020-08-16T09:24:15Z")
Hi. I'm sending custom JSON logs to ES/Kibana v 7.8.1 using filebeat. My filebeat config is: cloud.auth: \ cloud.id: \ filebeat.inputs: - enabled: true json.add\_error\_key… --- ## [How to publish elasticsearch to remote maven repository](https://discuss.elastic.co/t/how-to-publish-elasticsearch-to-remote-maven-repository/245128)
**Author:** [@calm4wei](https://discuss.elastic.co/u/calm4wei)\ **Replies:** 0\ **Last updated:** [August 16, 2020, 8:53am UTC](https://discuss.elastic.co/t/how-to-publish-elasticsearch-to-remote-maven-repository/245128 "2020-08-16T08:53:17Z")
Recently, I made some changes to the elasticsearch source code, and plans to push it to the company's maven repository. The maven repository address has been modified to the company's maven address, but Using gradle publ… --- ## [Why is this logstah filter not working as intended?](https://discuss.elastic.co/t/why-is-this-logstah-filter-not-working-as-intended/244874)
**Author:** [@drjosephliu](https://discuss.elastic.co/u/drjosephliu)\ **Replies:** 1\ **Last updated:** [August 16, 2020, 8:06am UTC](https://discuss.elastic.co/t/why-is-this-logstah-filter-not-working-as-intended/244874 "2020-08-16T08:06:25Z")
Sorry if this is too related to my previous post, but here goes: I have two types of messages that I want to send to logstash. One is a "standard" log type message and the other is a JSON object. I only want the message… --- ## [Grok parse failure](https://discuss.elastic.co/t/grok-parse-failure/245124)
**Author:** [@jclemons7](https://discuss.elastic.co/u/jclemons7)\ **Replies:** 1\ **Last updated:** [August 16, 2020, 8:00am UTC](https://discuss.elastic.co/t/grok-parse-failure/245124 "2020-08-16T08:00:59Z")
Hello, I have the following log from snort (from PFSense) roku \[classification: misc activity\] \[priority: 3\] {tcp} 10.0.2.11:37183 -\> 151.101.65.190:80 I've created the following GROK pattern, which works fine in the … --- ## [Named queries confusion](https://discuss.elastic.co/t/named-queries-confusion/245122)
**Author:** [@liamwhite1](https://discuss.elastic.co/u/liamwhite1)\ **Replies:** 1\ **Last updated:** [August 16, 2020, 6:31am UTC](https://discuss.elastic.co/t/named-queries-confusion/245122 "2020-08-16T06:31:33Z")
After reading the documentation for named queries, and attempting to perform some myself, I am thoroughly confused on how to name queries. This doesn't work: { "term": { "tag\_id": 1, "\_name": "test"… --- ## [Logstash is not starting](https://discuss.elastic.co/t/logstash-is-not-starting/245082)
**Author:** [@H158880](https://discuss.elastic.co/u/H158880)\ **Replies:** 8\ **Last updated:** [August 16, 2020, 4:00am UTC](https://discuss.elastic.co/t/logstash-is-not-starting/245082 "2020-08-16T04:00:07Z")
I am trying to initiate logstash how ever getting below error. Can this forum help? C:\\Users\\h158880\\Documents\\lib\\logstash-7.8.1\\bin\>logstash -f apache\_logsatsh.conf Java HotSpot(TM) 64-Bit Server VM warning: Ignoring… --- ## [Kibana Discover problem, Two sources of data, one index](https://discuss.elastic.co/t/kibana-discover-problem-two-sources-of-data-one-index/245113)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 0\ **Last updated:** [August 16, 2020, 3:44am UTC](https://discuss.elastic.co/t/kibana-discover-problem-two-sources-of-data-one-index/245113 "2020-08-16T03:44:52Z")
I create an index with data comming from a Database (network events) and data from UDP port (syslogs events), this logs have different numbers of fields and diferent names, but four in common (same name): timestamp, mess… --- ## [Elasticsearch real time data sync with sql server](https://discuss.elastic.co/t/elasticsearch-real-time-data-sync-with-sql-server/244760)
**Author:** [@Coder\_Cub](https://discuss.elastic.co/u/Coder_Cub)\ **Replies:** 8\ **Last updated:** [August 16, 2020, 3:05am UTC](https://discuss.elastic.co/t/elasticsearch-real-time-data-sync-with-sql-server/244760 "2020-08-16T03:05:21Z")
I am new to Elastic Search and I am trying to figure it out below scenarios How/which tool to sync/insert data into Elastic search when new record is created in SQL Server?(Near Real time) How to transformation for leg… --- ## [Kibana : Error SavedObject view: { \[Error\] res: {}, body: null } when modifying the vistate section of a saved object](https://discuss.elastic.co/t/kibana-error-savedobject-view-error-res-body-null-when-modifying-the-vistate-section-of-a-saved-object/244762)
**Author:** [@Selim\_Sliman](https://discuss.elastic.co/u/Selim_Sliman)\ **Replies:** 6\ **Last updated:** [August 16, 2020, 2:21am UTC](https://discuss.elastic.co/t/kibana-error-savedobject-view-error-res-body-null-when-modifying-the-vistate-section-of-a-saved-object/244762 "2020-08-16T02:21:00Z")
Hello team, I am encountering an issue when trying to modify the json in the vistate section of a saved object, i encounter the following error : SavedObject view: { \[Error\] res: {}, body: null } So what i'm trying to … --- ## [Elasticsearch nodes not used for search](https://discuss.elastic.co/t/elasticsearch-nodes-not-used-for-search/245066)
**Author:** [@kidrik](https://discuss.elastic.co/u/kidrik)\ **Replies:** 7\ **Last updated:** [August 15, 2020, 9:06pm UTC](https://discuss.elastic.co/t/elasticsearch-nodes-not-used-for-search/245066 "2020-08-15T21:06:42Z")
We have an Elasticsearch 7.1 cluster (AWS) with 2 indexes. The parent index has one shard and two replicas, whereas the child index has 3 shards and 2 replicas. Right now we’re running on 8 data nodes and the shard all… --- ## [Querying dense\_vector from the High Level REST Java API](https://discuss.elastic.co/t/querying-dense-vector-from-the-high-level-rest-java-api/244956)
**Author:** [@MJB](https://discuss.elastic.co/u/MJB)\ **Replies:** 4\ **Last updated:** [August 15, 2020, 8:26pm UTC](https://discuss.elastic.co/t/querying-dense-vector-from-the-high-level-rest-java-api/244956 "2020-08-15T20:26:27Z")
All the examples I can find for querying dense vector mention script queries, eg. https://discuss.elastic.co/t/searching-with-dense-vector/213374 However, I have no idea on how to use those with the HL API. Is this pos… --- ## [Watcher results returning similar terms instead of specific one while using match query](https://discuss.elastic.co/t/watcher-results-returning-similar-terms-instead-of-specific-one-while-using-match-query/245005)
**Author:** [@suryanaj](https://discuss.elastic.co/u/suryanaj)\ **Replies:** 1\ **Last updated:** [August 15, 2020, 8:17pm UTC](https://discuss.elastic.co/t/watcher-results-returning-similar-terms-instead-of-specific-one-while-using-match-query/245005 "2020-08-15T20:17:38Z")
my watcher alert query is not returning the exact match of url it returns all similar search of http.url keyword. i am using 6.8.3. I want exact match or search of http.url. Please suggest . { "trigger": { "schedule"… --- ## [Help with aggregation query to calculate relative volume](https://discuss.elastic.co/t/help-with-aggregation-query-to-calculate-relative-volume/245103)
**Author:** [@JGor](https://discuss.elastic.co/u/JGor)\ **Replies:** 0\ **Last updated:** [August 15, 2020, 5:55pm UTC](https://discuss.elastic.co/t/help-with-aggregation-query-to-calculate-relative-volume/245103 "2020-08-15T17:55:31Z")
Relative Volume (often times called RVOL) is an indicator that tells traders how current trading volume is compared to past trading volume over a given period. Hello guys, I was wondering if someone can point me… --- ## [I have problem installing elastic stack 7.8.0](https://discuss.elastic.co/t/i-have-problem-installing-elastic-stack-7-8-0/245037)
**Author:** [@jhayvee](https://discuss.elastic.co/u/jhayvee)\ **Replies:** 1\ **Last updated:** [August 15, 2020, 1:02pm UTC](https://discuss.elastic.co/t/i-have-problem-installing-elastic-stack-7-8-0/245037 "2020-08-15T13:02:19Z")
\*\*there is no error but I'm stuck in recovered \[0\] indices into cluster\_state \*\* \[2020-08-14T23:13:18,457\]\[INFO \]\[o.e.n.Node \] \[win-ar0l46fhmer\] initialized \[2020-08-14T23:13:18,457\]\[INFO \]\[o.e.n.Node … --- ## [Regarding Index Sorting](https://discuss.elastic.co/t/regarding-index-sorting/244984)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 3\ **Last updated:** [August 14, 2020, 4:54pm UTC](https://discuss.elastic.co/t/regarding-index-sorting/244984 "2020-08-14T16:54:39Z")
Hi, When considering index sorting would it be correct to assume the following cost/benefits: Pros: faster searching for standard queries Better index compression Cons: Significantly reduced indexing throughput, s… --- ## [Does EdgeNGram autocomplete\_filter make sense with prefix search?](https://discuss.elastic.co/t/does-edgengram-autocomplete-filter-make-sense-with-prefix-search/245086)
**Author:** [@AleksandarT](https://discuss.elastic.co/u/AleksandarT)\ **Replies:** 0\ **Last updated:** [August 15, 2020, 9:22am UTC](https://discuss.elastic.co/t/does-edgengram-autocomplete-filter-make-sense-with-prefix-search/245086 "2020-08-15T09:22:44Z")
i have Elastic Search Index with around 1 million records. I want to do multi prefix search against 2 fields in the Elastic Search Index, Name and ID (there are around 10 total). Does creating EdgeNGram autocomplete fi… --- ## [Data node using different cluster id](https://discuss.elastic.co/t/data-node-using-different-cluster-id/244991)
**Author:** [@Shambu\_Pujar](https://discuss.elastic.co/u/Shambu_Pujar)\ **Replies:** 5\ **Last updated:** [August 15, 2020, 8:24am UTC](https://discuss.elastic.co/t/data-node-using-different-cluster-id/244991 "2020-08-15T08:24:42Z")
Hi For some of the maintenance exercise, I had to bring down the master. In that process, I made data node as master as well. Now with new master, I am not able to get data node join master Data node throws following … --- ## [OutOfMemoryError: unable to create new native thread](https://discuss.elastic.co/t/outofmemoryerror-unable-to-create-new-native-thread/245079)
**Author:** [@Goutham\_Pratapa](https://discuss.elastic.co/u/Goutham_Pratapa)\ **Replies:** 0\ **Last updated:** [August 15, 2020, 7:36am UTC](https://discuss.elastic.co/t/outofmemoryerror-unable-to-create-new-native-thread/245079 "2020-08-15T07:36:09Z")
Hi all, I am relatively new to ElasticSearch and I Am running into this issue almost every day in my machine. The following are details about my hardware. $ ulimit -a core file size (blocks, -c) 0 data seg si… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1280) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1282)