# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1290 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1291 --- ## [Paging and sorting results after a term aggregation by doc fields](https://discuss.elastic.co/t/paging-and-sorting-results-after-a-term-aggregation-by-doc-fields/244526)
**Author:** [@Walter\_Chicca](https://discuss.elastic.co/u/Walter_Chicca)\ **Replies:** 0\ **Last updated:** [August 11, 2020, 9:50am UTC](https://discuss.elastic.co/t/paging-and-sorting-results-after-a-term-aggregation-by-doc-fields/244526 "2020-08-11T09:50:38Z")
Hi everyone, what i'm trying to do is sorting the results from a term aggregation using the fields in the starting document, the final goal is to be able sorting and paging a datatable server side because there're too m… --- ## [Hot - Warm Architecture with 3 Node Cluster](https://discuss.elastic.co/t/hot-warm-architecture-with-3-node-cluster/244496)
**Author:** [@rakesh15](https://discuss.elastic.co/u/rakesh15)\ **Replies:** 6\ **Last updated:** [August 11, 2020, 8:48am UTC](https://discuss.elastic.co/t/hot-warm-architecture-with-3-node-cluster/244496 "2020-08-11T08:48:37Z")
Hi Team, I'm trying to create the 3 Node Elasticsearch Cluster to store the time series logging data. The shards will have only 1 replication count to minimize the storage utilization. Need help to understand the below… --- ## [Unable to install offline plugin analysis-icu-7.3.1.zip - error - NoSuchFileException](https://discuss.elastic.co/t/unable-to-install-offline-plugin-analysis-icu-7-3-1-zip-error-nosuchfileexception/244348)
**Author:** [@WaseemSiddiqui](https://discuss.elastic.co/u/WaseemSiddiqui)\ **Replies:** 2\ **Last updated:** [August 11, 2020, 8:08am UTC](https://discuss.elastic.co/t/unable-to-install-offline-plugin-analysis-icu-7-3-1-zip-error-nosuchfileexception/244348 "2020-08-11T08:08:56Z")
On Elastic Search 7.3.1 version I am installing Plugin - analysis-icu-7.3.1.zip in offline mode. while passing the command: elasticsearch-plugin.bat install file:///mypath/analysis-icu-7.3.1.zip Unfortunately I am ge… --- ## [Request Rate changes at a specific hour](https://discuss.elastic.co/t/request-rate-changes-at-a-specific-hour/244291)
**Author:** [@Burga](https://discuss.elastic.co/u/Burga)\ **Replies:** 5\ **Last updated:** [August 11, 2020, 8:05am UTC](https://discuss.elastic.co/t/request-rate-changes-at-a-specific-hour/244291 "2020-08-11T08:05:23Z")
Hi i'm handling request rate degradation and I noticed that some of my nodes behaving strange , exactly at 03:04 every night request rate Either drops from 900 to 200 or climb up from 200 to 900 I'm not sure this is … --- ## [Kibana dashboard without timestamp field](https://discuss.elastic.co/t/kibana-dashboard-without-timestamp-field/243850)
**Author:** [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\ **Replies:** 2\ **Last updated:** [August 11, 2020, 7:48am UTC](https://discuss.elastic.co/t/kibana-dashboard-without-timestamp-field/243850 "2020-08-11T07:48:32Z")
Hello, I have created a dashboard in kibana. All 2 objects of that dashboard are generated from the index pattern of the following image that do not contain a timestamp field because i dont need it. My problem is th… --- ## [Delete\_by\_query performance optimization](https://discuss.elastic.co/t/delete-by-query-performance-optimization/244437)
**Author:** [@nickgregz](https://discuss.elastic.co/u/nickgregz)\ **Replies:** 4\ **Last updated:** [August 11, 2020, 7:48am UTC](https://discuss.elastic.co/t/delete-by-query-performance-optimization/244437 "2020-08-11T07:48:03Z")
Hello, Multiple topics mention time-based indices as a go to method for clearing old (index) data but in cases where that is not possible the alternative is delete\_by\_query which poses a performance impact if we are wor… --- ## [Kibana visualization - Count occurence of term in multiple fields](https://discuss.elastic.co/t/kibana-visualization-count-occurence-of-term-in-multiple-fields/244405)
**Author:** [@Ilya\_Geller](https://discuss.elastic.co/u/Ilya_Geller)\ **Replies:** 4\ **Last updated:** [August 11, 2020, 7:37am UTC](https://discuss.elastic.co/t/kibana-visualization-count-occurence-of-term-in-multiple-fields/244405 "2020-08-11T07:37:39Z")
Hello, I have index that containts documents with fields: source\_address and destination\_address for each event. I would like to create a visualization in Kibana to show the top 10 most popular addresses in the databas… --- ## [Elasticsearch 7.6 is underperforming 6.8](https://discuss.elastic.co/t/elasticsearch-7-6-is-underperforming-6-8/244211)
**Author:** [@danksim](https://discuss.elastic.co/u/danksim)\ **Replies:** 17\ **Last updated:** [August 11, 2020, 7:18am UTC](https://discuss.elastic.co/t/elasticsearch-7-6-is-underperforming-6-8/244211 "2020-08-11T07:18:32Z")
Hello, I upgraded Elastic Stack from 6.8.2 to 7.6.2 (currently both clusters are running on EKS with kubernetes nodes on AWS m5.4xlarge machines 16CPUs 64GB - these are NOT SSDs) and I am experiencing degraded performan… --- ## [Is it possible to have an alias that points two multiple indexes with duplicate IDs with preference ordering?](https://discuss.elastic.co/t/is-it-possible-to-have-an-alias-that-points-two-multiple-indexes-with-duplicate-ids-with-preference-ordering/244480)
**Author:** [@jacobm](https://discuss.elastic.co/u/jacobm)\ **Replies:** 1\ **Last updated:** [August 11, 2020, 7:06am UTC](https://discuss.elastic.co/t/is-it-possible-to-have-an-alias-that-points-two-multiple-indexes-with-duplicate-ids-with-preference-ordering/244480 "2020-08-11T07:06:52Z")
My situation is: I have a big index (let's call it old) that allows search on documents that I derive from information in a relational database. I need to change the index mapping and add data to every document, and the … --- ## [Aggregate filter cache](https://discuss.elastic.co/t/aggregate-filter-cache/244432)
**Author:** [@kvtang](https://discuss.elastic.co/u/kvtang)\ **Replies:** 2\ **Last updated:** [August 11, 2020, 6:38am UTC](https://discuss.elastic.co/t/aggregate-filter-cache/244432 "2020-08-11T06:38:00Z")
Hi guys, If I'm using aggregate filter plugin, and after a start event, my collector node restarted for whatever reason. When my end event comes, is it able to find my start event? Is there any cache storing task\_id? T… --- ## [Logstash in the cloud](https://discuss.elastic.co/t/logstash-in-the-cloud/244492)
**Author:** [@mykael](https://discuss.elastic.co/u/mykael)\ **Replies:** 1\ **Last updated:** [August 11, 2020, 6:25am UTC](https://discuss.elastic.co/t/logstash-in-the-cloud/244492 "2020-08-11T06:25:24Z")
Am I right in thinking that if I want to use a customized logstash to ingest data into elastic search running under elastic cloud, then I need to get a separate cloud machine to run the logstash instance and connect it, … --- ## ["cluster\_concurrent\_rebalance" : "40" was ignored](https://discuss.elastic.co/t/cluster-concurrent-rebalance-40-was-ignored/243556)
**Author:** [@mannoj87](https://discuss.elastic.co/u/mannoj87)\ **Replies:** 18\ **Last updated:** [August 11, 2020, 6:17am UTC](https://discuss.elastic.co/t/cluster-concurrent-rebalance-40-was-ignored/243556 "2020-08-11T06:17:56Z")
"cluster\_concurrent\_rebalance" : "40" -\> We had this as the setting, when I changed cluster.routing.allocation.awareness.attributes=rack\_id After this I see relocating\_shards = 1000, and it was relocating almost all th… --- ## [What can cause heap size to fluctuate wildly (hacksaw graphs) on a new 7.8.0 cluster?](https://discuss.elastic.co/t/what-can-cause-heap-size-to-fluctuate-wildly-hacksaw-graphs-on-a-new-7-8-0-cluster/244120)
**Author:** [@Jacket](https://discuss.elastic.co/u/Jacket)\ **Replies:** 5\ **Last updated:** [August 11, 2020, 6:04am UTC](https://discuss.elastic.co/t/what-can-cause-heap-size-to-fluctuate-wildly-hacksaw-graphs-on-a-new-7-8-0-cluster/244120 "2020-08-11T06:04:52Z")
Hi there, I've recently migrated a medium sized cluster (15TB, 25B documents) from 6.8 to 7.8.0 and noticed the heap constantly fluctuates between \<1GB and the maximum set size (22GB). However the cluster is working per… --- ## [Can we backup index pattern](https://discuss.elastic.co/t/can-we-backup-index-pattern/244484)
**Author:** [@syafeera](https://discuss.elastic.co/u/syafeera)\ **Replies:** 2\ **Last updated:** [August 11, 2020, 5:57am UTC](https://discuss.elastic.co/t/can-we-backup-index-pattern/244484 "2020-08-11T05:57:13Z")
Hi, may i know can we backup index pattern? --- ## [Create a table of links to dashboards in Kibana](https://discuss.elastic.co/t/create-a-table-of-links-to-dashboards-in-kibana/244486)
**Author:** [@pranayv66](https://discuss.elastic.co/u/pranayv66)\ **Replies:** 5\ **Last updated:** [August 11, 2020, 5:56am UTC](https://discuss.elastic.co/t/create-a-table-of-links-to-dashboards-in-kibana/244486 "2020-08-11T05:56:15Z")
Hi Community, I've a couple of dashboards created in Kibana. I want to create a "table of contents" on the home page dashboard, that will navigate to a new dashboard on its click. I'm using Kibana version 6.3. Can anyon… --- ## [Elastic stack configuration for logs, metrics and apm](https://discuss.elastic.co/t/elastic-stack-configuration-for-logs-metrics-and-apm/244389)
**Author:** [@vamsikrishna\_medeti](https://discuss.elastic.co/u/vamsikrishna_medeti)\ **Replies:** 1\ **Last updated:** [August 11, 2020, 1:53am UTC](https://discuss.elastic.co/t/elastic-stack-configuration-for-logs-metrics-and-apm/244389 "2020-08-11T01:53:57Z")
Hi, We are building an application hosted on AWS EKS. We would like to have elastic stack along with metrics and apm to monitoring our infrastructure, application and logs. As a whole, we might be having the ingested da… --- ## [Why I can't use Elasticsearch for as primary database? not the same way](https://discuss.elastic.co/t/why-i-cant-use-elasticsearch-for-as-primary-database-not-the-same-way/244476)
**Author:** [@chawki](https://discuss.elastic.co/u/chawki)\ **Replies:** 0\ **Last updated:** [August 11, 2020, 1:41am UTC](https://discuss.elastic.co/t/why-i-cant-use-elasticsearch-for-as-primary-database-not-the-same-way/244476 "2020-08-11T01:41:10Z")
This is a common question but in different use case. My application is a buy and sells platform does not launch yet. It uses MongoDB on the server(local) as the primary database to store Ads and I have integrated elasti… --- ## [Low Watermak warning](https://discuss.elastic.co/t/low-watermak-warning/244334)
**Author:** [@ecarmona](https://discuss.elastic.co/u/ecarmona)\ **Replies:** 8\ **Last updated:** [August 10, 2020, 11:17pm UTC](https://discuss.elastic.co/t/low-watermak-warning/244334 "2020-08-10T23:17:41Z")
Dear All, I hope this message finds you all well. I am working in a mechanism that get the Cluster health every now and then to know if elastic is up and running (Green or Yellow) and then trigger an alert in the case … --- ## [Set processor for a specific Index](https://discuss.elastic.co/t/set-processor-for-a-specific-index/243960)
**Author:** [@Sajal\_Chakraborty](https://discuss.elastic.co/u/Sajal_Chakraborty)\ **Replies:** 2\ **Last updated:** [August 10, 2020, 10:51pm UTC](https://discuss.elastic.co/t/set-processor-for-a-specific-index/243960 "2020-08-10T22:51:12Z")
I am trying to use the below code to create a Set Processor for Index default-\*, but somehow it's not working PUT /\_ingest/pipeline/addaht { "description" : "sets queue wise AHT constants", "processors": \[ { "set":… --- ## [Using Elastic SIEM and ML with Beats and Logstash](https://discuss.elastic.co/t/using-elastic-siem-and-ml-with-beats-and-logstash/242560)
**Author:** [@chancewwr](https://discuss.elastic.co/u/chancewwr)\ **Replies:** 12\ **Last updated:** [August 10, 2020, 10:16pm UTC](https://discuss.elastic.co/t/using-elastic-siem-and-ml-with-beats-and-logstash/242560 "2020-08-10T22:16:04Z")
Hello all. My question is what is the general method for using beats with logstash if you want access to Elastic SIEM and the like? Elastic SIEM works well when the data is gathered via beats and sent directly to Elasti… --- ## [Mapping issue](https://discuss.elastic.co/t/mapping-issue/244421)
**Author:** [@gbasic](https://discuss.elastic.co/u/gbasic)\ **Replies:** 1\ **Last updated:** [August 10, 2020, 10:04pm UTC](https://discuss.elastic.co/t/mapping-issue/244421 "2020-08-10T22:04:14Z")
Hi I am a beginner in Elasticsearch so pardon my silly questions. I am trying to feed a json file through Logstash to Elasticsearch so I can later create visualizations in Kibana. However after I create the index and set… --- ## [Enable Logstash to Talk with Outside Server?](https://discuss.elastic.co/t/enable-logstash-to-talk-with-outside-server/244321)
**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Replies:** 2\ **Last updated:** [August 10, 2020, 10:01pm UTC](https://discuss.elastic.co/t/enable-logstash-to-talk-with-outside-server/244321 "2020-08-10T22:01:42Z")
Hi Logstash, While processing data records, I need my Logstash instance (ver 7.7.1) to send a copy of the entire data record to an outside server. The server does some processing, then sends back a one-string response.… --- ## [Elasticsearch and AWS authenticating using IP instead of IAM user](https://discuss.elastic.co/t/elasticsearch-and-aws-authenticating-using-ip-instead-of-iam-user/244408)
**Author:** [@clevallyAstute](https://discuss.elastic.co/u/clevallyAstute)\ **Replies:** 2\ **Last updated:** [August 10, 2020, 9:56pm UTC](https://discuss.elastic.co/t/elasticsearch-and-aws-authenticating-using-ip-instead-of-iam-user/244408 "2020-08-10T21:56:24Z")
I have an AWS Elasticsearch environment and I believe I’m having trouble authenticating to the Elasticsearch server via IP. We’d like not to use any IAM user policy for this piece of software if possible, and only use an… --- ## [Cross Cluster with 9300 Port](https://discuss.elastic.co/t/cross-cluster-with-9300-port/243818)
**Author:** [@3c3m](https://discuss.elastic.co/u/3c3m)\ **Replies:** 3\ **Last updated:** [August 10, 2020, 9:17pm UTC](https://discuss.elastic.co/t/cross-cluster-with-9300-port/243818 "2020-08-10T21:17:25Z")
Hi, In a scenario, I have 3 different clusters. Do each cluster added to Remote Clusters have to see each other on port 9300? Thanks, Ecem --- ## [Blank message field](https://discuss.elastic.co/t/blank-message-field/244441)
**Author:** [@matheus.santoro](https://discuss.elastic.co/u/matheus.santoro)\ **Replies:** 5\ **Last updated:** [August 10, 2020, 9:17pm UTC](https://discuss.elastic.co/t/blank-message-field/244441 "2020-08-10T21:17:23Z")
Trying to create a simple, non-filtered pipeline, but Kibana shows the message field as blank Pipeline conf is input { tcp { port =\> 9600 codec =\> json mode =\> server } } output { elasticsearch { … --- ## [Replace field value when equals "-"](https://discuss.elastic.co/t/replace-field-value-when-equals/244453)
**Author:** [@gbasic](https://discuss.elastic.co/u/gbasic)\ **Replies:** 1\ **Last updated:** [August 10, 2020, 9:00pm UTC](https://discuss.elastic.co/t/replace-field-value-when-equals/244453 "2020-08-10T21:00:33Z")
Hi I would need to replace a field value (WindDirection,Temp,CityName,WindSpeed,Humidity) to some other value when it equals "-" This is my data: { "@timestamp" =\> 2020-08-10T18:54:08.055Z, "Europe" =\> { … --- ## [Elasticsearch scan of all IDs slows down dramatically (exponentially?)](https://discuss.elastic.co/t/elasticsearch-scan-of-all-ids-slows-down-dramatically-exponentially/242076)
**Author:** [@Timothy\_Wall](https://discuss.elastic.co/u/Timothy_Wall)\ **Replies:** 3\ **Last updated:** [August 10, 2020, 7:59pm UTC](https://discuss.elastic.co/t/elasticsearch-scan-of-all-ids-slows-down-dramatically-exponentially/242076 "2020-08-10T19:59:32Z")
I'm trying to dump all IDs from an index. The dump starts with an ETA of under ten minutes, but then progressively slows down, ultimately taking over an hour to finish. Configuration: single node, two shards, no replic… --- ## [SIEM Overview Page : Modify Security Settings Kibana](https://discuss.elastic.co/t/siem-overview-page-modify-security-settings-kibana/244372)
**Author:** [@Saurabh\_Singh1](https://discuss.elastic.co/u/Saurabh_Singh1)\ **Replies:** 4\ **Last updated:** [August 10, 2020, 7:53pm UTC](https://discuss.elastic.co/t/siem-overview-page-modify-security-settings-kibana/244372 "2020-08-10T19:53:12Z")
Hi I have created two spaces in Kibana : a.) Default b.) Saurabh In saurabh space , i tried to open SIEM overview page , it opened properly. Now we have a link here to modify(enable/disable) security settings in kibana… --- ## [Using missing\_bucket with a composite aggregation with a date\_histogram source doesn't seem to create missing buckets](https://discuss.elastic.co/t/using-missing-bucket-with-a-composite-aggregation-with-a-date-histogram-source-doesnt-seem-to-create-missing-buckets/243635)
**Author:** [@acommend](https://discuss.elastic.co/u/acommend)\ **Replies:** 1\ **Last updated:** [August 10, 2020, 6:21pm UTC](https://discuss.elastic.co/t/using-missing-bucket-with-a-composite-aggregation-with-a-date-histogram-source-doesnt-seem-to-create-missing-buckets/243635 "2020-08-10T18:21:24Z")
Using missing\_bucket with a composite aggregation with a date\_histogram source doesn't seem to create missing buckets. In the example below, 2 documents are created with a date field that are 45 minutes apart. Using a … --- ## [Number\_format\_exception: Elasticsearch Query Template - check if value of int field present inside array\[int\] field](https://discuss.elastic.co/t/number-format-exception-elasticsearch-query-template-check-if-value-of-int-field-present-inside-array-int-field/244220)
**Author:** [@tinhn](https://discuss.elastic.co/u/tinhn)\ **Replies:** 2\ **Last updated:** [August 10, 2020, 6:07pm UTC](https://discuss.elastic.co/t/number-format-exception-elasticsearch-query-template-check-if-value-of-int-field-present-inside-array-int-field/244220 "2020-08-10T18:07:44Z")
Hello, I'm trying to write a logstash filter that reads from an elasticsearch index using a template. I want to check if an integer matches a value stored in an array of ints. // incoming record { "id": 2 } // query… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1289) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1291)