# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=676 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 677 --- ## [Difference between aggs and aggregations](https://discuss.elastic.co/t/difference-between-aggs-and-aggregations/300155)
**Author:** [@Malika\_Srivastava](https://discuss.elastic.co/u/Malika_Srivastava)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 7:36am UTC](https://discuss.elastic.co/t/difference-between-aggs-and-aggregations/300155 "2022-03-21T07:36:00Z")
Hi All, New to learning ELK and I have been going through the playlist on Elastic YT page hosted by Lisa Jung. Lisa Jung's Elastic Repo I am confused as to difference between the keywords aggs and aggregations Dataset… --- ## [Creating interdependent filters without disabling them](https://discuss.elastic.co/t/creating-interdependent-filters-without-disabling-them/299710)
**Author:** [@sukhwinder\_kumar](https://discuss.elastic.co/u/sukhwinder_kumar)\ **Replies:** 1\ **Last updated:** [March 15, 2022, 3:25pm UTC](https://discuss.elastic.co/t/creating-interdependent-filters-without-disabling-them/299710 "2022-03-15T15:25:39Z")
Can I create interdependent filters without disabling them as it says "Options are based on the value of parent control. Disabled if parent is not set." I dont want to disable any filters but filters should be filtered o… --- ## [Index wildcard Performance](https://discuss.elastic.co/t/index-wildcard-performance/300153)
**Author:** [@111505](https://discuss.elastic.co/u/111505)\ **Replies:** 0\ **Last updated:** [March 21, 2022, 4:57am UTC](https://discuss.elastic.co/t/index-wildcard-performance/300153 "2022-03-21T04:57:31Z")
log-1 log-2 log-3 If there is an index, I use "log-" But suppose that the data I want is only in log-1. Is there a difference in actual operation and performance between using it as log- and using it as log-1? Search… --- ## [Embed Kibana Lens Visualizations in html page](https://discuss.elastic.co/t/embed-kibana-lens-visualizations-in-html-page/299707)
**Author:** [@SUMANT\_MISHRA](https://discuss.elastic.co/u/SUMANT_MISHRA)\ **Replies:** 2\ **Last updated:** [March 21, 2022, 4:25am UTC](https://discuss.elastic.co/t/embed-kibana-lens-visualizations-in-html-page/299707 "2022-03-21T04:25:34Z")
Hi, Is there any way to embed the visualizations created using Kibana Lens in the HTML page just like we can do in the case of other visualizations? In the case of Non-Lens visualizations, it gives the option to get the… --- ## [Best practice for elastic server and elastic agent](https://discuss.elastic.co/t/best-practice-for-elastic-server-and-elastic-agent/300148)
**Author:** [@sevenout](https://discuss.elastic.co/u/sevenout)\ **Replies:** 0\ **Last updated:** [March 21, 2022, 3:58am UTC](https://discuss.elastic.co/t/best-practice-for-elastic-server-and-elastic-agent/300148 "2022-03-21T03:58:24Z")
Hi guys, i just wanna ask about the best practice for elastic server and elastic agent. These are my conditions right now: I've installed Elasticsearch and kibana dashboard on a local server (only for Elasticsearch) I'… --- ## [How do I map fields with ECS if I am using my own grok filters](https://discuss.elastic.co/t/how-do-i-map-fields-with-ecs-if-i-am-using-my-own-grok-filters/300147)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 0\ **Last updated:** [March 21, 2022, 3:46am UTC](https://discuss.elastic.co/t/how-do-i-map-fields-with-ecs-if-i-am-using-my-own-grok-filters/300147 "2022-03-21T03:46:36Z")
Hi Team, Here is my grok parser match =\> { "message" =\> "(?\%{MONTHDAY}-%{MONTH}-%{YEAR} %{TIME}) rpz: info: client @%{WORD:data} %{IPV4:clientipaddr}#%{INT:sport} \\(%{NOTSPA CE:qdomain}\\): rpz QNAME Local-Da… --- ## [Can any one help me with this exception](https://discuss.elastic.co/t/can-any-one-help-me-with-this-exception/300101)
**Author:** [@Kandlavath\_Dasaradhi](https://discuss.elastic.co/u/Kandlavath_Dasaradhi)\ **Replies:** 2\ **Last updated:** [March 21, 2022, 2:57am UTC](https://discuss.elastic.co/t/can-any-one-help-me-with-this-exception/300101 "2022-03-21T02:57:46Z")
C:\\Elasticsearch-7.3.2\\bin\>Elasticsearch Exception in thread "main" java.nio.file.NoSuchFileException: C:\\Elasticsearch-8.0.1\\config\\jvm.options at java.base/sun.nio.fs.WindowsException.translateToIOException(WindowsEx… --- ## [Upgrade assistant in Kibana not showing "Start" button](https://discuss.elastic.co/t/upgrade-assistant-in-kibana-not-showing-start-button/300142)
**Author:** [@dlalex83](https://discuss.elastic.co/u/dlalex83)\ **Replies:** 0\ **Last updated:** [March 20, 2022, 9:17pm UTC](https://discuss.elastic.co/t/upgrade-assistant-in-kibana-not-showing-start-button/300142 "2022-03-20T21:17:54Z")
Hi there, I'm on Elastic Stack 7.9.2 and when I navigate to the Upgrade Assistant page in Kibana I have no issues highlighted but no way to start the upgrade (see screenshot). Any ideas? Many thanks --- ## [Visibility of Data view in Space](https://discuss.elastic.co/t/visibility-of-data-view-in-space/300120)
**Author:** [@Petr\_Vancl\_Hochberge](https://discuss.elastic.co/u/Petr_Vancl_Hochberge)\ **Replies:** 2\ **Last updated:** [March 20, 2022, 3:08pm UTC](https://discuss.elastic.co/t/visibility-of-data-view-in-space/300120 "2022-03-20T15:08:01Z")
Hi. I am building “workflow” in Kibana for my users. I have around 50 spaces for each department of my organization. I have one Data view created which all should have access to, but I have no idea how to achieve it wit… --- ## [Mutate or grok product/price that keep changing everyday](https://discuss.elastic.co/t/mutate-or-grok-product-price-that-keep-changing-everyday/300134)
**Author:** [@travlest](https://discuss.elastic.co/u/travlest)\ **Replies:** 0\ **Last updated:** [March 20, 2022, 3:02pm UTC](https://discuss.elastic.co/t/mutate-or-grok-product-price-that-keep-changing-everyday/300134 "2022-03-20T15:02:01Z")
Hi, I have a question about logstash for CSV. My situation is, I have multiple CSV files being uploaded into logstash. the log will continue to update for product or price but the domain will remain the same. my questio… --- ## [Remove \_value in watcher output from REST call](https://discuss.elastic.co/t/remove-value-in-watcher-output-from-rest-call/300119)
**Author:** [@stobbe99](https://discuss.elastic.co/u/stobbe99)\ **Replies:** 1\ **Last updated:** [March 20, 2022, 2:13pm UTC](https://discuss.elastic.co/t/remove-value-in-watcher-output-from-rest-call/300119 "2022-03-20T14:13:32Z")
I my watcher I collect a record from the rest interface, retrieve a nice Json. But in the index part of the watcher it adds \_value to the index: This means all fields in the index get "\_value." before there name. D… --- ## [Cross-cluster search](https://discuss.elastic.co/t/cross-cluster-search/300132)
**Author:** [@ufuk\_varol](https://discuss.elastic.co/u/ufuk_varol)\ **Replies:** 1\ **Last updated:** [March 20, 2022, 1:55pm UTC](https://discuss.elastic.co/t/cross-cluster-search/300132 "2022-03-20T13:55:06Z")
Does standard version of Elasticsearch support "cross-cluster search" feature explained below link detailly? --- ## [Split json fields of similar type in logstash](https://discuss.elastic.co/t/split-json-fields-of-similar-type-in-logstash/300133)
**Author:** [@zubair\_aftab](https://discuss.elastic.co/u/zubair_aftab)\ **Replies:** 1\ **Last updated:** [March 20, 2022, 1:48pm UTC](https://discuss.elastic.co/t/split-json-fields-of-similar-type-in-logstash/300133 "2022-03-20T13:48:40Z")
I have a json file converted from pcap using tshark. There are different layers inside the json and each layer has different fields. Some fields are repeating inside the same message for example "bicc\_bicc\_cic" as shown … --- ## [Restoration of indices from aws](https://discuss.elastic.co/t/restoration-of-indices-from-aws/300129)
**Author:** [@Mahendra\_Choudhary](https://discuss.elastic.co/u/Mahendra_Choudhary)\ **Replies:** 0\ **Last updated:** [March 20, 2022, 1:11pm UTC](https://discuss.elastic.co/t/restoration-of-indices-from-aws/300129 "2022-03-20T13:11:03Z")
Hello all, I am new in ELK stack. Often I need to restore indices from aws. But most of time it interrupt and fails, I need to start again from beginning. Also, restoration seems to be very slow. Is there any faster … --- ## [What is the meaning of query\_string with 1~ or ~AUTO?](https://discuss.elastic.co/t/what-is-the-meaning-of-query-string-with-1-or-auto/300128)
**Author:** [@asil](https://discuss.elastic.co/u/asil)\ **Replies:** 0\ **Last updated:** [March 20, 2022, 12:58pm UTC](https://discuss.elastic.co/t/what-is-the-meaning-of-query-string-with-1-or-auto/300128 "2022-03-20T12:58:18Z")
I read the documentation of (Query string query | Elasticsearch Guide \[8.1\] | Elastic) and still don't understand the following example: GET /\_search { "query": { "bool": { "must": \[{ "… --- ## [Master\_not\_discovered\_exception](https://discuss.elastic.co/t/master-not-discovered-exception/300125)
**Author:** [@kzltp](https://discuss.elastic.co/u/kzltp)\ **Replies:** 2\ **Last updated:** [March 20, 2022, 12:25pm UTC](https://discuss.elastic.co/t/master-not-discovered-exception/300125 "2022-03-20T12:25:24Z")
Hello Everyone; I created elastic environment with 4 nodes. 2 nodes set master role other 2 role set data node. When all node was starting everything is okey. but when any master node down, my cluster not working. Other… --- ## [How can make sub aggregation code in elasticsearch-java:7.17.1](https://discuss.elastic.co/t/how-can-make-sub-aggregation-code-in-elasticsearch-java-7-17-1/300001)
**Author:** [@mzinboy](https://discuss.elastic.co/u/mzinboy)\ **Replies:** 2\ **Last updated:** [March 20, 2022, 8:57am UTC](https://discuss.elastic.co/t/how-can-make-sub-aggregation-code-in-elasticsearch-java-7-17-1/300001 "2022-03-20T08:57:54Z")
Hi, I can't make code to aggregation with sub aggregation using "Elasticsearch-java:7.17.1" Java library. There is no subAggregation method in TermsAggregation.Builder class. How to complete the code that has with su… --- ## [Undocumented behaviour: Term query on date field becomes a range query](https://discuss.elastic.co/t/undocumented-behaviour-term-query-on-date-field-becomes-a-range-query/300113)
**Author:** [@whatgeorgemade](https://discuss.elastic.co/u/whatgeorgemade)\ **Replies:** 0\ **Last updated:** [March 19, 2022, 9:36pm UTC](https://discuss.elastic.co/t/undocumented-behaviour-term-query-on-date-field-becomes-a-range-query/300113 "2022-03-19T21:36:40Z")
I was speaking with a colleague recently and I mentioned I use a term query over a date field to find matches on a certain day, like this: { "query": { "term": { "@timestamp": { "value": "2021-10-08"… --- ## [7.16.2 - ILM - max primary shard size not working](https://discuss.elastic.co/t/7-16-2-ilm-max-primary-shard-size-not-working/299975)
**Author:** [@SteveParker](https://discuss.elastic.co/u/SteveParker)\ **Replies:** 2\ **Last updated:** [March 19, 2022, 5:14pm UTC](https://discuss.elastic.co/t/7-16-2-ilm-max-primary-shard-size-not-working/299975 "2022-03-19T17:14:04Z")
My ILM policy has a max shard size of 50gb but my indexes are growing to 100gb+, I must have missed something, help required please --- ## [ELK 8.1: loading std. dashboards failing w/error 403](https://discuss.elastic.co/t/elk-8-1-loading-std-dashboards-failing-w-error-403/300093)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 1\ **Last updated:** [March 19, 2022, 2:00am UTC](https://discuss.elastic.co/t/elk-8-1-loading-std-dashboards-failing-w-error-403/300093 "2022-03-19T02:00:31Z")
On a PoC v.8.1 single elastic node + kibana + grafana, I'm trying to load std. metricbeat dashboards etc. into kibana like below only it returns an 403 error: $ metricbeat setup dashboards -c /etc/metricbeat/metricbeat.… --- ## [Is there a way to have visulisation's use the most recent event even if its outside of the specified time range?](https://discuss.elastic.co/t/is-there-a-way-to-have-visulisations-use-the-most-recent-event-even-if-its-outside-of-the-specified-time-range/300067)
**Author:** [@Tooty-Fruity](https://discuss.elastic.co/u/Tooty-Fruity)\ **Replies:** 1\ **Last updated:** [March 18, 2022, 8:30pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-have-visulisations-use-the-most-recent-event-even-if-its-outside-of-the-specified-time-range/300067 "2022-03-18T20:30:36Z")
Hi there, I have a Kibana dashboard where new events are continuously pushed into Elasticsearch. If I were to use the time range filter and set it to lets say 15 mins, my dashboard would only show me events that have ar… --- ## [Vector Tile API response id: (integer) Unique ID for the feature within the layer not found in hits or aggs layer](https://discuss.elastic.co/t/vector-tile-api-response-id-integer-unique-id-for-the-feature-within-the-layer-not-found-in-hits-or-aggs-layer/299952)
**Author:** [@Joseph\_Parish](https://discuss.elastic.co/u/Joseph_Parish)\ **Replies:** 6\ **Last updated:** [March 18, 2022, 8:26pm UTC](https://discuss.elastic.co/t/vector-tile-api-response-id-integer-unique-id-for-the-feature-within-the-layer-not-found-in-hits-or-aggs-layer/299952 "2022-03-18T20:26:32Z")
Hi I am testing the Vector Tile API using this repo which is an excellent tool. I would like to use the feature-id within the hits layer of a polygon, but get this: Error: The feature id parameter must be provided. I … --- ## [Logstash concatenate two field values from metricbeat](https://discuss.elastic.co/t/logstash-concatenate-two-field-values-from-metricbeat/300060)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 3\ **Last updated:** [March 18, 2022, 5:11pm UTC](https://discuss.elastic.co/t/logstash-concatenate-two-field-values-from-metricbeat/300060 "2022-03-18T17:11:10Z")
Hello All, Can someone help with this,I need to concatenate two fileds from metricbeat and create other filed with this concatenated value.Tried to use mutate filter didn't worked. filter{ mutate { add\_field =\> { "moun… --- ## [How to make writing on ElasticSearch safe?](https://discuss.elastic.co/t/how-to-make-writing-on-elasticsearch-safe/300018)
**Author:** [@TonyAgosta](https://discuss.elastic.co/u/TonyAgosta)\ **Replies:** 0\ **Last updated:** [March 18, 2022, 9:18am UTC](https://discuss.elastic.co/t/how-to-make-writing-on-elasticsearch-safe/300018 "2022-03-18T09:18:34Z")
Hi to all, I'm new on this community. My application write on Elasticsearch index using Apache Camel routes. Sometimes it happens that my Elasticsearch is not reachable and therefore the data that should be written at … --- ## [Configuring Filebeat to use an AWS PrivateLink endpoint to index into CloudWatch](https://discuss.elastic.co/t/configuring-filebeat-to-use-an-aws-privatelink-endpoint-to-index-into-cloudwatch/300056)
**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Replies:** 1\ **Last updated:** [March 18, 2022, 3:37pm UTC](https://discuss.elastic.co/t/configuring-filebeat-to-use-an-aws-privatelink-endpoint-to-index-into-cloudwatch/300056 "2022-03-18T15:37:40Z")
Continuing the discussion from AWS PrivateLinkの使用方法: I also want to do this. I can't find any documentation to configure an endpoint override. I also need to do the same thing with the S3 snapshots repository. Is it e… --- ## [Labs not accessible on strigo with the credentials given in the training](https://discuss.elastic.co/t/labs-not-accessible-on-strigo-with-the-credentials-given-in-the-training/300053)
**Author:** [@kartik.rajesh](https://discuss.elastic.co/u/kartik.rajesh)\ **Replies:** 2\ **Last updated:** [March 18, 2022, 3:36pm UTC](https://discuss.elastic.co/t/labs-not-accessible-on-strigo-with-the-credentials-given-in-the-training/300053 "2022-03-18T15:36:23Z")
I tried to access the lab for Observability Fundamentals today. On clicking "Lab" it takes me to the strigo page and asks me for an email login and not a username. I tried to create a new account but it doesn't s… --- ## [Logstash 8.1.0-1 fails to start](https://discuss.elastic.co/t/logstash-8-1-0-1-fails-to-start/300059)
**Author:** [@lmalossi](https://discuss.elastic.co/u/lmalossi)\ **Replies:** 0\ **Last updated:** [March 18, 2022, 3:13pm UTC](https://discuss.elastic.co/t/logstash-8-1-0-1-fails-to-start/300059 "2022-03-18T15:13:12Z")
Hi all, I'm trying to start logstash with systemctl but in log i get the following \[2022-03-18T16:07:32,888\]\[INFO \]\[logstash.runner \] Log4j configuration path used is: /etc/logstash/log4j2.properties \[2022-03-… --- ## [Kibana service failed to start](https://discuss.elastic.co/t/kibana-service-failed-to-start/296334)
**Author:** [@gabal007](https://discuss.elastic.co/u/gabal007)\ **Replies:** 5\ **Last updated:** [March 18, 2022, 1:58pm UTC](https://discuss.elastic.co/t/kibana-service-failed-to-start/296334 "2022-03-18T13:58:25Z")
Hi all, I hope that message finds you well. I have installed elk version 7.17 on CentOS Linux release 7.9.2009. I've tried to install kibana as a service, and it's failing to start. Based on what I'm reading on other … --- ## [Kibana Document download limit at 10,000](https://discuss.elastic.co/t/kibana-document-download-limit-at-10-000/300010)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 3\ **Last updated:** [March 18, 2022, 11:35am UTC](https://discuss.elastic.co/t/kibana-document-download-limit-at-10-000/300010 "2022-03-18T11:35:55Z")
Hi all, I'm trying to download discover search data with some of my filters. However, When i download I see that document limit in CSV is at 10,000 documents. Any way or setting to increase document download limit? --- ## [Frozen tier heap space](https://discuss.elastic.co/t/frozen-tier-heap-space/300032)
**Author:** [@bolemebrige](https://discuss.elastic.co/u/bolemebrige)\ **Replies:** 0\ **Last updated:** [March 18, 2022, 11:23am UTC](https://discuss.elastic.co/t/frozen-tier-heap-space/300032 "2022-03-18T11:23:58Z")
What are recommendations for size of heap space on frozen data tier nodes? [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=675) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=677)