# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=665 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 666 --- ## [Getting error - Error: Object type "" is not registered in case of uptime duration anomaly alert rule](https://discuss.elastic.co/t/getting-error-error-object-type-is-not-registered-in-case-of-uptime-duration-anomaly-alert-rule/301087)
**Author:** [@Mehakdeep\_singh](https://discuss.elastic.co/u/Mehakdeep_singh)\ **Replies:** 1\ **Last updated:** [April 1, 2022, 9:38am UTC](https://discuss.elastic.co/t/getting-error-error-object-type-is-not-registered-in-case-of-uptime-duration-anomaly-alert-rule/301087 "2022-04-01T09:38:07Z")
I've created an uptime duration anomaly rule for a monitor. But after reopening the alert rule window I get an error (screenshot attached). Even, I'm not able to receive any alert whenever there's an anomaly. Please guid… --- ## [Dashboard based on data from 2 indexes](https://discuss.elastic.co/t/dashboard-based-on-data-from-2-indexes/300419)
**Author:** [@shinobu](https://discuss.elastic.co/u/shinobu)\ **Replies:** 2\ **Last updated:** [April 1, 2022, 8:57am UTC](https://discuss.elastic.co/t/dashboard-based-on-data-from-2-indexes/300419 "2022-04-01T08:57:25Z")
Hello, I want to create a Dashboard with a table thats showing me every url that does not a specific value in another field. So basically i have 2 indexes: Alert index: { "url": "sometemplateurl.com" } Lookup Inde… --- ## [Doubts about Multifields](https://discuss.elastic.co/t/doubts-about-multifields/301244)
**Author:** [@RabBit\_BR](https://discuss.elastic.co/u/RabBit_BR)\ **Replies:** 1\ **Last updated:** [April 1, 2022, 8:30am UTC](https://discuss.elastic.co/t/doubts-about-multifields/301244 "2022-04-01T08:30:10Z")
Hi! Can anyone tell me if using the multifields strategy (strategy A) would be better than individually separating (strategy B) each field? What would be the advantages between one and the other? Strategy A { "titl… --- ## [Date range matching in ES](https://discuss.elastic.co/t/date-range-matching-in-es/301289)
**Author:** [@TheGreatBaldOne](https://discuss.elastic.co/u/TheGreatBaldOne)\ **Replies:** 0\ **Last updated:** [April 1, 2022, 7:47am UTC](https://discuss.elastic.co/t/date-range-matching-in-es/301289 "2022-04-01T07:47:56Z")
I would like to create a small scheduling app. Lets say we have Joe and he needs to teach online multiple people individually about .. gardening. He cannot teach more than 1 person at a time. He has a calendar of 'ava… --- ## [Logstash.filters.mutate](https://discuss.elastic.co/t/logstash-filters-mutate/301241)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 6\ **Last updated:** [April 1, 2022, 7:17am UTC](https://discuss.elastic.co/t/logstash-filters-mutate/301241 "2022-04-01T07:17:34Z")
Hi I'm facing the problem with filters.mutate \[2022-03-31T17:49:26,980\]\[WARN \]\[logstash.filters.mutate \]\[subscriberstrunk\]\[11ac345049d68c6fc55061d82c036ef3c26cf4e2fe68230c4df255bc3403de66\] Exception caught while apply… --- ## [Logstash 401 error](https://discuss.elastic.co/t/logstash-401-error/301247)
**Author:** [@chaishiqi](https://discuss.elastic.co/u/chaishiqi)\ **Replies:** 2\ **Last updated:** [April 1, 2022, 6:28am UTC](https://discuss.elastic.co/t/logstash-401-error/301247 "2022-04-01T06:28:08Z")
Here is my logstash config: input { file { path =\> "/var/log/nginx/access.log" codec =\> "json" } } output { elasticsearch { hosts =\> \["https://10.0.5.132:9200"\] ssl =\> true cacert =\> "/etc/logs… --- ## [DSL query : How to parse message contain slash](https://discuss.elastic.co/t/dsl-query-how-to-parse-message-contain-slash/300216)
**Author:** [@RickT](https://discuss.elastic.co/u/RickT)\ **Replies:** 7\ **Last updated:** [April 1, 2022, 6:27am UTC](https://discuss.elastic.co/t/dsl-query-how-to-parse-message-contain-slash/300216 "2022-04-01T06:27:56Z")
Hi, How can i parse a message field wich contain slashes ? I'm trying with query regexp, but without result. Thanks all --- ## [Returning the number of results which match a large query?](https://discuss.elastic.co/t/returning-the-number-of-results-which-match-a-large-query/301275)
**Author:** [@catmanjan](https://discuss.elastic.co/u/catmanjan)\ **Replies:** 3\ **Last updated:** [April 1, 2022, 4:27am UTC](https://discuss.elastic.co/t/returning-the-number-of-results-which-match-a-large-query/301275 "2022-04-01T04:27:33Z")
I have an index with 100 million documents What's the fastest way for me to count the number of documents which meet a certain query? I don't want the documents, just the number of documents that match the query. I am … --- ## [No space left on device - Logstash](https://discuss.elastic.co/t/no-space-left-on-device-logstash/301154)
**Author:** [@Victorv18](https://discuss.elastic.co/u/Victorv18)\ **Replies:** 3\ **Last updated:** [March 31, 2022, 11:18pm UTC](https://discuss.elastic.co/t/no-space-left-on-device-logstash/301154 "2022-03-31T23:18:52Z")
I have an ELK stack, hosted on a Linux, an EC2 VM running at AWS and my logstash works in the background on that same environment I used to start logstash as a service using "systemctl start logstash" and it works norma… --- ## [TSVB links on each\_all](https://discuss.elastic.co/t/tsvb-links-on-each-all/301271)
**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 10:48pm UTC](https://discuss.elastic.co/t/tsvb-links-on-each-all/301271 "2022-03-31T22:48:24Z")
I'm trying to create a list of links based on some fields value, but the markdown syntax is not working. Is there any way to do each\_all links? {{#each \_all}} - \[{{ label }}\](http://google.com) {{/each}} … --- ## [Total Shards Differs (dev console vs. script output)](https://discuss.elastic.co/t/total-shards-differs-dev-console-vs-script-output/301258)
**Author:** [@codewriterguy](https://discuss.elastic.co/u/codewriterguy)\ **Replies:** 2\ **Last updated:** [March 31, 2022, 10:07pm UTC](https://discuss.elastic.co/t/total-shards-differs-dev-console-vs-script-output/301258 "2022-03-31T22:07:44Z")
Hi lovely Elastic folks, I have a script that rolls over a few data streams and my cluster quickly became oversharded. The rollover requests are now failing with: elasticsearch.exceptions.RequestError: RequestError(40… --- ## [:client:rest-high-level:qa does not exist](https://discuss.elastic.co/t/rest-high-level-qa-does-not-exist/301255)
**Author:** [@erdemtuna](https://discuss.elastic.co/u/erdemtuna)\ **Replies:** 0\ **Last updated:** [March 31, 2022, 8:36pm UTC](https://discuss.elastic.co/t/rest-high-level-qa-does-not-exist/301255 "2022-03-31T20:36:51Z")
I am using SonarQube - \* Community Edition Version 9.3 (build 51899). I wanted to run SonarQube (SonarScanner) on Elasticsearch. I could build the project (Elasticsearch) with its native gradle command ./gradlew localDis… --- ## [Transform group by showing data that's not in the original index](https://discuss.elastic.co/t/transform-group-by-showing-data-thats-not-in-the-original-index/301239)
**Author:** [@Matt\_McGovern](https://discuss.elastic.co/u/Matt_McGovern)\ **Replies:** 0\ **Last updated:** [March 31, 2022, 5:51pm UTC](https://discuss.elastic.co/t/transform-group-by-showing-data-thats-not-in-the-original-index/301239 "2022-03-31T17:51:56Z")
I've got a tranform set up that has multiple group fields and aggregations. The first group by field shows data in the resulting index that is not anywhere in the original index. It starts with the text: deleterulebyrule… --- ## [Rally 2.4.0 released](https://discuss.elastic.co/t/rally-2-4-0-released/301236)
**Author:** [@RickBoyd](https://discuss.elastic.co/u/RickBoyd)\ **Replies:** 0\ **Last updated:** [March 31, 2022, 5:26pm UTC](https://discuss.elastic.co/t/rally-2-4-0-released/301236 "2022-03-31T17:26:47Z")
We have just released Rally 2.4.0. Highlights: Rally has dropped support for Elasticsearch \< 6.8.0. We now allow tracks to declare additional dependencies For the full list of changes please see the changelog . Quick… --- ## [Multiple grok pattern, really multiple?](https://discuss.elastic.co/t/multiple-grok-pattern-really-multiple/301166)
**Author:** [@lgllrd](https://discuss.elastic.co/u/lgllrd)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 5:05pm UTC](https://discuss.elastic.co/t/multiple-grok-pattern-really-multiple/301166 "2022-03-31T17:05:04Z")
Hello, I'm trying to use the multiple grok pattern as in the documentation ( Grok filter plugin | Logstash Reference \[8.1\] | Elastic ) but I notice that it only handles the first two patterns. Here is my filter : { … --- ## [Geoip\_databases index allocation failed](https://discuss.elastic.co/t/geoip-databases-index-allocation-failed/300783)
**Author:** [@roman.huesler](https://discuss.elastic.co/u/roman.huesler)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 3:52pm UTC](https://discuss.elastic.co/t/geoip-databases-index-allocation-failed/300783 "2022-03-31T15:52:17Z")
Im learning and playing around with Elasticsearch. Just setup a new local test cluster with 3 nodes on kubernetes (Elasticsearch 8.1.0) and also set up kibana 8.1.0. In kubernetes its a StateFulset with storage on NFS. T… --- ## [HTTP Filter --- Body Syntax](https://discuss.elastic.co/t/http-filter-body-syntax/301217)
**Author:** [@JeremyP](https://discuss.elastic.co/u/JeremyP)\ **Replies:** 0\ **Last updated:** [March 31, 2022, 2:59pm UTC](https://discuss.elastic.co/t/http-filter-body-syntax/301217 "2022-03-31T14:59:21Z")
Hello, I'm trying to use an HTTP filter with a POST and body and I'm having a hard time nailing down the syntax. The JSON body which I can get working using postman is as follows: { "filters": \[ { "day… --- ## [Cluster down after upgrade](https://discuss.elastic.co/t/cluster-down-after-upgrade/301004)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 4\ **Last updated:** [March 31, 2022, 1:46pm UTC](https://discuss.elastic.co/t/cluster-down-after-upgrade/301004 "2022-03-31T13:46:20Z")
I have three Linux container as data node and three as master and it fails with following error. can't figure out why. whole file system /s1/Elasticsearch/ndoes is clean on all container. I can run full find /s1 on all … --- ## [Sorting documents with same multiple fields in one bucket](https://discuss.elastic.co/t/sorting-documents-with-same-multiple-fields-in-one-bucket/301202)
**Author:** [@Hella\_Konnecker](https://discuss.elastic.co/u/Hella_Konnecker)\ **Replies:** 0\ **Last updated:** [March 31, 2022, 1:38pm UTC](https://discuss.elastic.co/t/sorting-documents-with-same-multiple-fields-in-one-bucket/301202 "2022-03-31T13:38:47Z")
Hello, I have a dataset with 3 000 000 indices from a shipping platform. Each index describes one product, and I would like to put similar products in one bucket. To be considered “similar” five fields have to be the sa… --- ## [APM agent console log formatting from log4j2 configuration](https://discuss.elastic.co/t/apm-agent-console-log-formatting-from-log4j2-configuration/301196)
**Author:** [@Rudolfs\_Sulcs](https://discuss.elastic.co/u/Rudolfs_Sulcs)\ **Replies:** 0\ **Last updated:** [March 31, 2022, 1:07pm UTC](https://discuss.elastic.co/t/apm-agent-console-log-formatting-from-log4j2-configuration/301196 "2022-03-31T13:07:07Z")
Hi, is there any way format elastic apm agent console logging message? For example: 2022-03-31 15:53:38,437 \[main\] INFO co.elastic.apm.agent.util.JmxUtils - Found JVM-specific OperatingSystemMXBean interface: com.sun.m… --- ## [Json split multiple event in Logstash Pipeline](https://discuss.elastic.co/t/json-split-multiple-event-in-logstash-pipeline/301080)
**Author:** [@Purushottam22](https://discuss.elastic.co/u/Purushottam22)\ **Replies:** 3\ **Last updated:** [March 31, 2022, 1:05pm UTC](https://discuss.elastic.co/t/json-split-multiple-event-in-logstash-pipeline/301080 "2022-03-31T13:05:40Z")
Hi All, I am trying to ingest the python script output using exec input plugin filter but i am facing issue while performing split operation on message. I am not sure how can I split into fields, below sample output whi… --- ## [Kibana: Unable to calculate average](https://discuss.elastic.co/t/kibana-unable-to-calculate-average/300847)
**Author:** [@sravanreddy.t](https://discuss.elastic.co/u/sravanreddy.t)\ **Replies:** 5\ **Last updated:** [March 31, 2022, 12:41pm UTC](https://discuss.elastic.co/t/kibana-unable-to-calculate-average/300847 "2022-03-31T12:41:14Z")
Hi, Need your help to calculate the average for the test cases. For Ex: No of test cases executed: 0,0,1,2 Total Builds : 4 My requirement is to calculate the average only for the no of test cases are more than zero.… --- ## [Nested multiple date-range intervals](https://discuss.elastic.co/t/nested-multiple-date-range-intervals/301121)
**Author:** [@TheGreatBaldOne](https://discuss.elastic.co/u/TheGreatBaldOne)\ **Replies:** 2\ **Last updated:** [March 31, 2022, 11:57am UTC](https://discuss.elastic.co/t/nested-multiple-date-range-intervals/301121 "2022-03-31T11:57:02Z")
I have an index, that will hold a 'job' and each job will have a couple of date-intervals where that job can be performed. In our case it a plumbing job :slight\_smile: These date-intervals are limited, so they do not ex… --- ## [How to get the average between two timestamp](https://discuss.elastic.co/t/how-to-get-the-average-between-two-timestamp/301100)
**Author:** [@Roberto\_Mejri](https://discuss.elastic.co/u/Roberto_Mejri)\ **Replies:** 4\ **Last updated:** [March 31, 2022, 10:12am UTC](https://discuss.elastic.co/t/how-to-get-the-average-between-two-timestamp/301100 "2022-03-31T10:12:51Z")
HI, (I'm literally new on Kibana). My Team leader asked to me to do the visualize on Kibana with the count... of the log got on Spring microservice. The problem is now I have to display the average between timestamps of … --- ## [Unable to use grok pattern on GREEDYDATA message](https://discuss.elastic.co/t/unable-to-use-grok-pattern-on-greedydata-message/301086)
**Author:** [@rahulgupta18](https://discuss.elastic.co/u/rahulgupta18)\ **Replies:** 4\ **Last updated:** [March 31, 2022, 10:04am UTC](https://discuss.elastic.co/t/unable-to-use-grok-pattern-on-greedydata-message/301086 "2022-03-31T10:04:32Z")
Hi, I have this log message - 2022-03-08 04:16:04 \[DEBUG\] Creating linked clone: from Template-CentOS, to CentOS-001122 My logstash config. file is as follows - filter { grok { match =\> { "message" … --- ## [Kibana Donut chart with small inner circle](https://discuss.elastic.co/t/kibana-donut-chart-with-small-inner-circle/300977)
**Author:** [@santy1](https://discuss.elastic.co/u/santy1)\ **Replies:** 5\ **Last updated:** [March 31, 2022, 8:39am UTC](https://discuss.elastic.co/t/kibana-donut-chart-with-small-inner-circle/300977 "2022-03-31T08:39:36Z")
Hello Team, I am on ELK v7.17. I have created donut chart to represent some data, using Lens. However, I see that the inner circle is quite small. I read somewhere, that there is an options tab that can be used to chan… --- ## [Logstash output to Kibana](https://discuss.elastic.co/t/logstash-output-to-kibana/300919)
**Author:** [@RomanKau](https://discuss.elastic.co/u/RomanKau)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 8:28am UTC](https://discuss.elastic.co/t/logstash-output-to-kibana/300919 "2022-03-31T08:28:02Z")
Running Windows 10, Logstash 8.1.0, Elasticsearch, kibana and filebeat 8.0.0 all on the same machine. Getting the data from filebeat to kibana works great but the problem is that the whole log is in the field message an… --- ## [Unable to connect to secondary master node, when manually stopping primary master node](https://discuss.elastic.co/t/unable-to-connect-to-secondary-master-node-when-manually-stopping-primary-master-node/300917)
**Author:** [@Dhamodharan](https://discuss.elastic.co/u/Dhamodharan)\ **Replies:** 5\ **Last updated:** [March 31, 2022, 7:32am UTC](https://discuss.elastic.co/t/unable-to-connect-to-secondary-master-node-when-manually-stopping-primary-master-node/300917 "2022-03-31T07:32:53Z")
I got a small project so thought to go with only 2nodes ES cluster and maintain HA. Both nodes are act as Master and data node, i wanted to maintain any 1 node should be up all the time. Both machine having the same conf… --- ## [Install Kibana 7.16 fails with parse mapping](https://discuss.elastic.co/t/install-kibana-7-16-fails-with-parse-mapping/300946)
**Author:** [@Karel\_Cech](https://discuss.elastic.co/u/Karel_Cech)\ **Replies:** 4\ **Last updated:** [March 30, 2022, 9:44pm UTC](https://discuss.elastic.co/t/install-kibana-7-16-fails-with-parse-mapping/300946 "2022-03-30T21:44:14Z")
Hi, we try to install Kibana 7.16.3 in our Openshift environment, but it fails with "Failed to parse mapping \[\_doc\]" : {"type":"log","@timestamp":"2022-03-29T12:09:24+02:00","tags":\["info","savedobjects-service"\],"pid"… --- ## [Group by Count equals value](https://discuss.elastic.co/t/group-by-count-equals-value/301161)
**Author:** [@chivas](https://discuss.elastic.co/u/chivas)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 7:04am UTC](https://discuss.elastic.co/t/group-by-count-equals-value/301161 "2022-03-31T07:04:09Z")
Hello, I am using below query to group by a field and return the count, is there a way to return documents whose doc\_count equals 1 (or less than 2) GET logs-test\*/\_search { "aggs": { "2": { "terms": { … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=664) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=666)