# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1691 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1692 --- ## [Analyse difference of count parameters](https://discuss.elastic.co/t/analyse-difference-of-count-parameters/214406)
**Author:** [@Manjula\_Piyumal](https://discuss.elastic.co/u/Manjula_Piyumal)\ **Replies:** 6\ **Last updated:** [January 10, 2020, 7:45am UTC](https://discuss.elastic.co/t/analyse-difference-of-count-parameters/214406 "2020-01-10T07:45:25Z")
Hi All, I'm currently reporting user login and logout logs to Elasticsearch. Now I want to get the current logged i user count. Document structure is simply as below { "userId": "user1", "eventType": "LOGIN" ... } … --- ## [Fatal Error in thread Elasticsearch](https://discuss.elastic.co/t/fatal-error-in-thread-elasticsearch/214360)
**Author:** [@vivektsb](https://discuss.elastic.co/u/vivektsb)\ **Replies:** 7\ **Last updated:** [January 10, 2020, 7:42am UTC](https://discuss.elastic.co/t/fatal-error-in-thread-elasticsearch/214360 "2020-01-10T07:42:13Z")
Hi Team, We have 7 node elasticsearch cluster we are facing sometimes facing the same issue in the following topic. Please find our cluster statistics please let us know are we doing something wrong with shard size o… --- ## [How to create a table visualization like this](https://discuss.elastic.co/t/how-to-create-a-table-visualization-like-this/214033)
**Author:** [@reyhanadp](https://discuss.elastic.co/u/reyhanadp)\ **Replies:** 1\ **Last updated:** [January 10, 2020, 7:19am UTC](https://discuss.elastic.co/t/how-to-create-a-table-visualization-like-this/214033 "2020-01-10T07:19:10Z")
hi, I want to make a table visualization for server monitoring like this --- ## [Visualize: blocked by: \[FORBIDDEN/12/index read-only / allow delete (api)\]](https://discuss.elastic.co/t/visualize-blocked-by-forbidden-12-index-read-only-allow-delete-api/214545)
**Author:** [@reyhanadp](https://discuss.elastic.co/u/reyhanadp)\ **Replies:** 1\ **Last updated:** [January 10, 2020, 7:12am UTC](https://discuss.elastic.co/t/visualize-blocked-by-forbidden-12-index-read-only-allow-delete-api/214545 "2020-01-10T07:12:53Z")
hi, i get the following error when i want to delete, change, and add a visualize. The error appears as follows: Visualize: blocked by: \[FORBIDDEN/12/index read-only / allow delete (api)\];: \[cluster\_block\_exception\] bl… --- ## [Ingest Node - Script Processor not recognizing field as number](https://discuss.elastic.co/t/ingest-node-script-processor-not-recognizing-field-as-number/214053)
**Author:** [@gferrette](https://discuss.elastic.co/u/gferrette)\ **Replies:** 4\ **Last updated:** [January 10, 2020, 6:49am UTC](https://discuss.elastic.co/t/ingest-node-script-processor-not-recognizing-field-as-number/214053 "2020-01-10T06:49:35Z")
Hello! I'm trying to create a new field (of type double) that is the result of a calculation of another field, that is of type double too. I'm using filebeat to send the data to an ingest pipeline, and the ingest pipel… --- ## [Shards fail in high amount on certain Index](https://discuss.elastic.co/t/shards-fail-in-high-amount-on-certain-index/214030)
**Author:** [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)\ **Replies:** 2\ **Last updated:** [January 10, 2020, 6:42am UTC](https://discuss.elastic.co/t/shards-fail-in-high-amount-on-certain-index/214030 "2020-01-10T06:42:03Z")
Hi guys, when i take a look at one of my dashboards, which uses the Auditbeat-Index as an Input, i get an "20/24 Shards failed" Error like 20 Times on the side of my screen. It's stated as an illegal\_arguement\_expressi… --- ## [Tsvb - Sort by bucket script's value?](https://discuss.elastic.co/t/tsvb-sort-by-bucket-scripts-value/214073)
**Author:** [@Skeeve](https://discuss.elastic.co/u/Skeeve)\ **Replies:** 2\ **Last updated:** [January 10, 2020, 6:37am UTC](https://discuss.elastic.co/t/tsvb-sort-by-bucket-scripts-value/214073 "2020-01-10T06:37:06Z")
My data contains informat about several companies sending mail. Each document contains company name (tenant\_name) sending domain total amount of mails sent (total\_volume) amount of mails considered spam (spam\_complai… --- ## [CPU suddenly high jumped](https://discuss.elastic.co/t/cpu-suddenly-high-jumped/214521)
**Author:** [@jams008](https://discuss.elastic.co/u/jams008)\ **Replies:** 2\ **Last updated:** [January 10, 2020, 6:34am UTC](https://discuss.elastic.co/t/cpu-suddenly-high-jumped/214521 "2020-01-10T06:34:24Z")
hello sir, I encountered my elastic search problem, suddenly the CPU was very high in use, I used 1 node with elastic search version 7.5.1 and I have tried optimizing it by adding the cache in the configuration but it re… --- ## [How to achieve good performance (huge daily indices)](https://discuss.elastic.co/t/how-to-achieve-good-performance-huge-daily-indices/214270)
**Author:** [@Naseem](https://discuss.elastic.co/u/Naseem)\ **Replies:** 6\ **Last updated:** [January 10, 2020, 6:14am UTC](https://discuss.elastic.co/t/how-to-achieve-good-performance-huge-daily-indices/214270 "2020-01-10T06:14:37Z")
Hello, Our free text search is unusable. We have a 3 master + 4 data/ingester setup. We have 1 primary shard and 1 replica per index. Indices are appended by date, and a new one is created every day (typical). The da… --- ## [Elasticsearch Heapsize query](https://discuss.elastic.co/t/elasticsearch-heapsize-query/214537)
**Author:** [@vivektsb](https://discuss.elastic.co/u/vivektsb)\ **Replies:** 2\ **Last updated:** [January 10, 2020, 6:13am UTC](https://discuss.elastic.co/t/elasticsearch-heapsize-query/214537 "2020-01-10T06:13:13Z")
HI Team, Can we configure heap size morethan 50 % of RAM Size.If we have 64 GB RAM can we configure \>32 GB say 48 GB .? Regards, Vivek --- ## [Log correlation with threat feeds](https://discuss.elastic.co/t/log-correlation-with-threat-feeds/214540)
**Author:** [@yayemail](https://discuss.elastic.co/u/yayemail)\ **Replies:** 0\ **Last updated:** [January 10, 2020, 6:05am UTC](https://discuss.elastic.co/t/log-correlation-with-threat-feeds/214540 "2020-01-10T06:05:01Z")
Hi everyone, I am working on ELK currently, using the Apache httpd web server as a sample. I'm trying to match/correlate my apache access logs with signatures ( https://gist.github.com/xsscx/530fa25964f94e74d7c1 ). Can … --- ## [JDBC static loader to create local table from index rater than a database](https://discuss.elastic.co/t/jdbc-static-loader-to-create-local-table-from-index-rater-than-a-database/214536)
**Author:** [@ishu.singla](https://discuss.elastic.co/u/ishu.singla)\ **Replies:** 0\ **Last updated:** [January 10, 2020, 5:50am UTC](https://discuss.elastic.co/t/jdbc-static-loader-to-create-local-table-from-index-rater-than-a-database/214536 "2020-01-10T05:50:01Z")
I am using JDBC streaming for my local lookups because I need to replace data from another legacy database. This process is very very slow. I cannot create a local table out of it because data is in millions. Is there a … --- ## [Group By (Aggregation) to get only latest fields value](https://discuss.elastic.co/t/group-by-aggregation-to-get-only-latest-fields-value/214353)
**Author:** [@arvindK\_sharma](https://discuss.elastic.co/u/arvindK_sharma)\ **Replies:** 4\ **Last updated:** [January 10, 2020, 4:01am UTC](https://discuss.elastic.co/t/group-by-aggregation-to-get-only-latest-fields-value/214353 "2020-01-10T04:01:55Z")
I write a query to read the metricbeat file. This gives me the whatever I want but it repeats the value multiple time. I want to group by this on latest timestamp so I can get only latest record. Below is my query str… --- ## [Aggregation count filter with type](https://discuss.elastic.co/t/aggregation-count-filter-with-type/214355)
**Author:** [@MHaciyev](https://discuss.elastic.co/u/MHaciyev)\ **Replies:** 2\ **Last updated:** [January 10, 2020, 5:47am UTC](https://discuss.elastic.co/t/aggregation-count-filter-with-type/214355 "2020-01-10T05:47:13Z")
After searching Elastic search, I want to count the IDs in entities. But I want to count entities.fk\_entity\_type = 1 or entities.fk\_entity\_type = 2. How can I do that? my query \` GET smartinfo/\_search { "query… --- ## [Using the Vault to store the credentials/secrets of beats](https://discuss.elastic.co/t/using-the-vault-to-store-the-credentials-secrets-of-beats/214531)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 0\ **Last updated:** [January 10, 2020, 5:18am UTC](https://discuss.elastic.co/t/using-the-vault-to-store-the-credentials-secrets-of-beats/214531 "2020-01-10T05:18:27Z")
Would like to know whether the beats secrets can be stored in Vault. I know about the supported keystore approach, (https://www.elastic.co/guide/en/beats/filebeat/current/keystore.html), but would like to know whether b… --- ## [Elasticsearch Suggestion Completes return incorrect number of suggestions](https://discuss.elastic.co/t/elasticsearch-suggestion-completes-return-incorrect-number-of-suggestions/214522)
**Author:** [@davidbkemp](https://discuss.elastic.co/u/davidbkemp)\ **Replies:** 0\ **Last updated:** [January 10, 2020, 4:03am UTC](https://discuss.elastic.co/t/elasticsearch-suggestion-completes-return-incorrect-number-of-suggestions/214522 "2020-01-10T04:03:43Z")
We are using Elasticsearch version 6.7 and have implemented completion suggestion successfully without weights. We now want to add weights to suggestions and are encountering issues. When using completion suggester with… --- ## [Example of how to use scrollAsync in a loop with High Level Rest Client](https://discuss.elastic.co/t/example-of-how-to-use-scrollasync-in-a-loop-with-high-level-rest-client/214515)
**Author:** [@indrgun](https://discuss.elastic.co/u/indrgun)\ **Replies:** 0\ **Last updated:** [January 10, 2020, 1:43am UTC](https://discuss.elastic.co/t/example-of-how-to-use-scrollasync-in-a-loop-with-high-level-rest-client/214515 "2020-01-10T01:43:41Z")
How do you use client.scrollAsync multiple times in a loop like below of Synchronous version of scroll: while (searchHits != null && searchHits.length \> 0) { SearchScrollRequest scrollRequest = new SearchScrollRequest(… --- ## [Can i get day wise data from elasticsearch?](https://discuss.elastic.co/t/can-i-get-day-wise-data-from-elasticsearch/209643)
**Author:** [@Ashish\_Saini](https://discuss.elastic.co/u/Ashish_Saini)\ **Replies:** 3\ **Last updated:** [December 19, 2019, 11:35pm UTC](https://discuss.elastic.co/t/can-i-get-day-wise-data-from-elasticsearch/209643 "2019-12-19T23:35:51Z")
if yes, how can i get day wise data? --- ## [Using my own date field instead of using the default timestamp in index creation](https://discuss.elastic.co/t/using-my-own-date-field-instead-of-using-the-default-timestamp-in-index-creation/214479)
**Author:** [@kumar4](https://discuss.elastic.co/u/kumar4)\ **Replies:** 4\ **Last updated:** [January 9, 2020, 11:51pm UTC](https://discuss.elastic.co/t/using-my-own-date-field-instead-of-using-the-default-timestamp-in-index-creation/214479 "2020-01-09T23:51:27Z")
hello, i want to use the date in column named time in my csv file instead of timestamp when creating index,i indexed a csv file containing multiple columns, among the columns there is a date field in Y-m-d H:M:S format, … --- ## [Logstash optionally set output options](https://discuss.elastic.co/t/logstash-optionally-set-output-options/214504)
**Author:** [@Riddhesh](https://discuss.elastic.co/u/Riddhesh)\ **Replies:** 0\ **Last updated:** [January 9, 2020, 10:40pm UTC](https://discuss.elastic.co/t/logstash-optionally-set-output-options/214504 "2020-01-09T22:40:13Z")
Suppose I have some documents with join field, so they may have parent(e.g. \[join\_field\]\[parent\]) field in them, so as per docs, I need to pass that to \_routing in logstash elasticsearch output: ... output { elasticse… --- ## [Is it possible to balance shard with size in consideration?](https://discuss.elastic.co/t/is-it-possible-to-balance-shard-with-size-in-consideration/214296)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 7\ **Last updated:** [January 9, 2020, 10:07pm UTC](https://discuss.elastic.co/t/is-it-possible-to-balance-shard-with-size-in-consideration/214296 "2020-01-09T22:07:46Z")
Is this possible? I know the default is simply shard count, which is important. But not all shards have the same size. Is it possible to configure size as a secondary consideration? Meaning pick a larger (or smaller)… --- ## [Error when definining a mapping for pcap index](https://discuss.elastic.co/t/error-when-definining-a-mapping-for-pcap-index/213980)
**Author:** [@l4m4l](https://discuss.elastic.co/u/l4m4l)\ **Replies:** 1\ **Last updated:** [January 8, 2020, 11:51pm UTC](https://discuss.elastic.co/t/error-when-definining-a-mapping-for-pcap-index/213980 "2020-01-08T23:51:12Z")
Hi everyone, I am currently attempting to use tshark 3.2.0 and elasticsearch 7.4.1 to visualise network traffic from a pcap file. The steps I am following are: Generate test.json in elasticsearch bulk API format: ts… --- ## [Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:test, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #,](https://discuss.elastic.co/t/failed-to-execute-action-action-logstash-create-pipeline-id-test-exception-logstash-configurationerror-message-expected-one-of/214486)
**Author:** [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)\ **Replies:** 4\ **Last updated:** [January 9, 2020, 9:32pm UTC](https://discuss.elastic.co/t/failed-to-execute-action-action-logstash-create-pipeline-id-test-exception-logstash-configurationerror-message-expected-one-of/214486 "2020-01-09T21:32:03Z")
I am not sure why is the if\[fields\]\[log\_type\] throwing error here Here is the error my pipeline.conf file is giving below \[2020-01-09T11:51:31,810\]\[ERROR\]\[logstash.agent \] Failed to execute action {:action=\>L… --- ## [Tag Cloud panel is not filtering the data](https://discuss.elastic.co/t/tag-cloud-panel-is-not-filtering-the-data/214409)
**Author:** [@Aadesh\_Sharma](https://discuss.elastic.co/u/Aadesh_Sharma)\ **Replies:** 1\ **Last updated:** [January 9, 2020, 9:09pm UTC](https://discuss.elastic.co/t/tag-cloud-panel-is-not-filtering-the-data/214409 "2020-01-09T21:09:36Z")
Hi, I have made a filter on tag cloud to filter the data we are showing in the dashboard. In visualize when click on a word it is working fine but when i add that panel into dashboard it stops working in it. When I clic… --- ## [How to install kiban-plugins which is hosted on kubernetes pod?](https://discuss.elastic.co/t/how-to-install-kiban-plugins-which-is-hosted-on-kubernetes-pod/214383)
**Author:** [@N\_Lohidasu\_Reddy](https://discuss.elastic.co/u/N_Lohidasu_Reddy)\ **Replies:** 1\ **Last updated:** [January 9, 2020, 8:58pm UTC](https://discuss.elastic.co/t/how-to-install-kiban-plugins-which-is-hosted-on-kubernetes-pod/214383 "2020-01-09T20:58:56Z")
We have hosted the kibana service, we need to install a kibana-plugin. How to do that? --- ## [(NoMethodError) undefined method \`deep\_merge'?](https://discuss.elastic.co/t/nomethoderror-undefined-method-deep-merge/214367)
**Author:** [@Kenneth\_M\_Kolano](https://discuss.elastic.co/u/Kenneth_M_Kolano)\ **Replies:** 6\ **Last updated:** [January 9, 2020, 8:37pm UTC](https://discuss.elastic.co/t/nomethoderror-undefined-method-deep-merge/214367 "2020-01-09T20:37:56Z")
I'm unexpectedly seeing this error when starting my Logstash 7.5.1 service on a new deployment on Ubuntu 19.04, and can find no relevant info online. \[ERROR\] 2020-01-09 08:18:37.084 \[main\] Logstash - java.lang.IllegalSt… --- ## ["not opting out of query cache; authorization is not alowed"](https://discuss.elastic.co/t/not-opting-out-of-query-cache-authorization-is-not-alowed/214487)
**Author:** [@dstromberg](https://discuss.elastic.co/u/dstromberg)\ **Replies:** 0\ **Last updated:** [January 9, 2020, 8:15pm UTC](https://discuss.elastic.co/t/not-opting-out-of-query-cache-authorization-is-not-alowed/214487 "2020-01-09T20:15:56Z")
Hello people. I'm getting a lot of the following in my Elasticsearch 7.3.2 logs: \[index\_name\] not opting out of the query cache; authorization is not allowed ...for several indexes, and the messages repeat. I googled… --- ## [Problem in integrating external script in Kibana Plugin](https://discuss.elastic.co/t/problem-in-integrating-external-script-in-kibana-plugin/214170)
**Author:** [@RaghibHuda](https://discuss.elastic.co/u/RaghibHuda)\ **Replies:** 1\ **Last updated:** [January 9, 2020, 7:53pm UTC](https://discuss.elastic.co/t/problem-in-integrating-external-script-in-kibana-plugin/214170 "2020-01-09T19:53:58Z")
I am developing a plugin in Kibana with React. I need google map API for that. But when I render my component with mp API script it gives an error. I searched and found that and the reason behind it is the content securi… --- ## [Problem with reading aggregation map file](https://discuss.elastic.co/t/problem-with-reading-aggregation-map-file/213375)
**Author:** [@lens](https://discuss.elastic.co/u/lens)\ **Replies:** 1\ **Last updated:** [January 9, 2020, 7:48pm UTC](https://discuss.elastic.co/t/problem-with-reading-aggregation-map-file/213375 "2020-01-09T19:48:39Z")
I'm using the aggregate plugin and currently testing to see if using the aggregate\_maps\_path option works to write the aggregation maps to a file when I stop logstash and read them when I restart it. I'm getting these e… --- ## [Help needed in grok](https://discuss.elastic.co/t/help-needed-in-grok/213827)
**Author:** [@adeel109](https://discuss.elastic.co/u/adeel109)\ **Replies:** 4\ **Last updated:** [January 9, 2020, 5:35pm UTC](https://discuss.elastic.co/t/help-needed-in-grok/213827 "2020-01-09T17:35:12Z")
I've been searching this and am directed to the same page most of the time. I am trying to write grok patterns for my custom logs. For example, below is a log line: 2020/01/02 08:40:16 UUID: 5E82093B:7550\_B0092619:01BB… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1690) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1692)