# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=707 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 708 --- ## [Date format err in query?](https://discuss.elastic.co/t/date-format-err-in-query/296964)
**Author:** [@kin122](https://discuss.elastic.co/u/kin122)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 10:38am UTC](https://discuss.elastic.co/t/date-format-err-in-query/296964 "2022-02-11T10:38:21Z")
hi,i got a error in the following query. but its ok in this format Officially, the two formats are the same. I'm confused, please tell me the reason --- ## [Finding the first occurrence of all Unique IDs within a term](https://discuss.elastic.co/t/finding-the-first-occurrence-of-all-unique-ids-within-a-term/296908)
**Author:** [@SkipJ](https://discuss.elastic.co/u/SkipJ)\ **Replies:** 2\ **Last updated:** [February 11, 2022, 10:35am UTC](https://discuss.elastic.co/t/finding-the-first-occurrence-of-all-unique-ids-within-a-term/296908 "2022-02-11T10:35:12Z")
I'm trying to create a visualization that captures all new users a from the last month (now/M-1 to now/M), then capture the amount of sessions they've ran from counting their unique session IDs. The challenge I'm facing… --- ## [3.0.0 Released](https://discuss.elastic.co/t/3-0-0-released/296957)
**Author:** [@atorok](https://discuss.elastic.co/u/atorok)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 10:12am UTC](https://discuss.elastic.co/t/3-0-0-released/296957 "2022-02-11T10:12:34Z")
We are pleased to announce that a new major, ECE 3.0.0 has been released today. Release notes: https://www.elastic.co/guide/en/cloud-enterprise/current/ece-release-notes-3.0.0.html --- ## [Is it possible for buckets\_path to reference a scripted\_metric aggregation?](https://discuss.elastic.co/t/is-it-possible-for-buckets-path-to-reference-a-scripted-metric-aggregation/296953)
**Author:** [@saurab](https://discuss.elastic.co/u/saurab)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 9:03am UTC](https://discuss.elastic.co/t/is-it-possible-for-buckets-path-to-reference-a-scripted-metric-aggregation/296953 "2022-02-11T09:03:30Z")
I am working on the kibana\_sample\_data\_logs index. I ran the following aggregation: GET kibana\_sample\_data\_logs/\_search?size=0 { "query": { "match\_all": {} }, "aggs": { "doc\_buckets\_for\_terms\_aggregation… --- ## [Netflow v9 upload bytes and download bytes](https://discuss.elastic.co/t/netflow-v9-upload-bytes-and-download-bytes/296951)
**Author:** [@111401](https://discuss.elastic.co/u/111401)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 8:59am UTC](https://discuss.elastic.co/t/netflow-v9-upload-bytes-and-download-bytes/296951 "2022-02-11T08:59:27Z")
Hi all, I have configured netflow v9 and try to use elk to monitor the upload and download bytes. I tried to upload the file (4MB) from local (192.168.x.x ) to the ftp server (211.x.x.x), log is like this Convers… --- ## [Kibana Discover Filter "There aren't any options available"](https://discuss.elastic.co/t/kibana-discover-filter-there-arent-any-options-available/296821)
**Author:** [@WookWook](https://discuss.elastic.co/u/WookWook)\ **Replies:** 4\ **Last updated:** [February 11, 2022, 8:29am UTC](https://discuss.elastic.co/t/kibana-discover-filter-there-arent-any-options-available/296821 "2022-02-11T08:29:45Z")
Hi, I created a new role to seperate access to see only filebeat logs from specific Openshift namespaces. So far so good. The user with the role can only see logs from the granted namespaces. Granted Kibana privileg… --- ## [PUT "ignore\_malformed" on index\_template](https://discuss.elastic.co/t/put-ignore-malformed-on-index-template/296861)
**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\ **Replies:** 3\ **Last updated:** [February 11, 2022, 8:17am UTC](https://discuss.elastic.co/t/put-ignore-malformed-on-index-template/296861 "2022-02-11T08:17:42Z")
Hi, Is it possible to insert the parameter "ignore\_malformed" on a template by a PUT? My actual config is: GET \_template/http-access { "http-access" : { "order" : 0, "version" : 60001, "index\_patterns" … --- ## [ES 7.13.2 - Not starting up - elasticsearch.bat error Invalid initial heap size](https://discuss.elastic.co/t/es-7-13-2-not-starting-up-elasticsearch-bat-error-invalid-initial-heap-size/296945)
**Author:** [@Jothi\_Kiruthika](https://discuss.elastic.co/u/Jothi_Kiruthika)\ **Replies:** 1\ **Last updated:** [February 11, 2022, 8:08am UTC](https://discuss.elastic.co/t/es-7-13-2-not-starting-up-elasticsearch-bat-error-invalid-initial-heap-size/296945 "2022-02-11T08:08:16Z")
HI I am trying to start up ES by running Elasticsearch.bat. I have created an options file under JVM.options.d folder setting the heap size to 2 gb as below - -Xms2g -Xmx2g But When running the batch file, i get the … --- ## [Get indexed Elasticsearch document body from Logstash](https://discuss.elastic.co/t/get-indexed-elasticsearch-document-body-from-logstash/296865)
**Author:** [@NominaSumpta](https://discuss.elastic.co/u/NominaSumpta)\ **Replies:** 2\ **Last updated:** [February 11, 2022, 8:01am UTC](https://discuss.elastic.co/t/get-indexed-elasticsearch-document-body-from-logstash/296865 "2022-02-11T08:01:42Z")
Hi, Is there a way to see the exact body of a document that Logstash indexed? I'm using the Elasticsearch output plugin. Context: in our production environment, some data is output into Elasticsearch by Logstash. In El… --- ## [Pipeline aggregation throwing an error](https://discuss.elastic.co/t/pipeline-aggregation-throwing-an-error/296839)
**Author:** [@saurab](https://discuss.elastic.co/u/saurab)\ **Replies:** 2\ **Last updated:** [February 11, 2022, 6:57am UTC](https://discuss.elastic.co/t/pipeline-aggregation-throwing-an-error/296839 "2022-02-11T06:57:50Z")
I am working with the kibana\_sample\_data\_ecommerce index. I will display two queries here: GET kibana\_sample\_data\_ecommerce/\_search?size=0 { "aggs": { "customer\_centric": { "terms": { "field": "custo… --- ## [Logstash in K8s: Deployment vs StatefulSet](https://discuss.elastic.co/t/logstash-in-k8s-deployment-vs-statefulset/296595)
**Author:** [@Nadiia\_Maltseva](https://discuss.elastic.co/u/Nadiia_Maltseva)\ **Replies:** 1\ **Last updated:** [February 11, 2022, 6:43am UTC](https://discuss.elastic.co/t/logstash-in-k8s-deployment-vs-statefulset/296595 "2022-02-11T06:43:50Z")
Hi, community! I am running Logstash on an EC2 instance in AWS. And I want to migrate to Kubernetes (since all our applications are running there). Could you, please, advise me on what factors should be taken into acco… --- ## [Logstash cmd displaying wrong output](https://discuss.elastic.co/t/logstash-cmd-displaying-wrong-output/296938)
**Author:** [@anushka1203](https://discuss.elastic.co/u/anushka1203)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 6:40am UTC](https://discuss.elastic.co/t/logstash-cmd-displaying-wrong-output/296938 "2022-02-11T06:40:45Z")
Hi, I am new to ELK stack and I am trying to test out parsing sample syslog messages by following the steps mentioned on the official website -- https://www.elastic.co/guide/en/logstash/current/config-examples.html#\_pro… --- ## [Kibana configuration to automatically add visualization and add it into the dashboard for a microservice](https://discuss.elastic.co/t/kibana-configuration-to-automatically-add-visualization-and-add-it-into-the-dashboard-for-a-microservice/296928)
**Author:** [@thujitha\_p](https://discuss.elastic.co/u/thujitha_p)\ **Replies:** 11\ **Last updated:** [February 11, 2022, 6:16am UTC](https://discuss.elastic.co/t/kibana-configuration-to-automatically-add-visualization-and-add-it-into-the-dashboard-for-a-microservice/296928 "2022-02-11T06:16:38Z")
Hi there, I'm using kibana version 7.17.0. I have created couple of microservices and set up them to send logs to kibana using logstash and Elasticsearch. Then I have created visualization for each microservice to vie… --- ## [Elasticsearch Log deletion not happening as per defined days in log4j.pproperties file](https://discuss.elastic.co/t/elasticsearch-log-deletion-not-happening-as-per-defined-days-in-log4j-pproperties-file/296934)
**Author:** [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 5:21am UTC](https://discuss.elastic.co/t/elasticsearch-log-deletion-not-happening-as-per-defined-days-in-log4j-pproperties-file/296934 "2022-02-11T05:21:29Z")
Dear Team, We are facing an issue where Elasticsearch logging with log4j2.properties not performing the log rotation on the basis of lfLastmodified age condition, we want to rotate the logs every after 7days but it is n… --- ## [Scripted Field in Data Table](https://discuss.elastic.co/t/scripted-field-in-data-table/296871)
**Author:** [@stemons](https://discuss.elastic.co/u/stemons)\ **Replies:** 1\ **Last updated:** [February 11, 2022, 4:04am UTC](https://discuss.elastic.co/t/scripted-field-in-data-table/296871 "2022-02-11T04:04:48Z")
Hello, I'm working with data tables in kibana and would like to create an additional column from a script. The following script is working { "script" : "if (doc\['cpu.used.pct'\].value \> 100) { return 1 }" } But I w… --- ## [I am new to Elastic search and trying to fetch data for one of the attribute whose value(lengh \>15)](https://discuss.elastic.co/t/i-am-new-to-elastic-search-and-trying-to-fetch-data-for-one-of-the-attribute-whose-value-lengh-15/294984)
**Author:** [@anji.nersu](https://discuss.elastic.co/u/anji.nersu)\ **Replies:** 1\ **Last updated:** [February 11, 2022, 3:21am UTC](https://discuss.elastic.co/t/i-am-new-to-elastic-search-and-trying-to-fetch-data-for-one-of-the-attribute-whose-value-lengh-15/294984 "2022-02-11T03:21:44Z")
GET catalog-us/\_search { "query": { "bool": { "must": \[ { "term": { "relation\_type": { "value": "product" } } }, { … --- ## [Invert Axis](https://discuss.elastic.co/t/invert-axis/296902)
**Author:** [@NJ.SE](https://discuss.elastic.co/u/NJ.SE)\ **Replies:** 8\ **Last updated:** [February 11, 2022, 1:32am UTC](https://discuss.elastic.co/t/invert-axis/296902 "2022-02-11T01:32:30Z")
Using for RSSI values whereas negative numbers are worse than positive. So I want -80 to be at the top, not the bottom. Any easy way to flip the values? --- ## [How to change Enterprise Search logs to eastern time (ET)](https://discuss.elastic.co/t/how-to-change-enterprise-search-logs-to-eastern-time-et/296892)
**Author:** [@ymoriarty](https://discuss.elastic.co/u/ymoriarty)\ **Replies:** 1\ **Last updated:** [February 11, 2022, 12:39am UTC](https://discuss.elastic.co/t/how-to-change-enterprise-search-logs-to-eastern-time-et/296892 "2022-02-11T00:39:52Z")
The logs are written in GMT (UTC) time. How do I convert this to ET? Thanks. --- ## [Kibana login loop while use iframe](https://discuss.elastic.co/t/kibana-login-loop-while-use-iframe/296542)
**Author:** [@petertw6235](https://discuss.elastic.co/u/petertw6235)\ **Replies:** 1\ **Last updated:** [February 11, 2022, 12:31am UTC](https://discuss.elastic.co/t/kibana-login-loop-while-use-iframe/296542 "2022-02-11T00:31:57Z")
Hi, I shared my Kibana dashboard with public link(anonymous) and user can visit my dashboard in our website used iframe. But the browser will try to login again and again without showing anything. I got the following … --- ## [The 2022 Elastic Community Conference starts very soon!](https://discuss.elastic.co/t/the-2022-elastic-community-conference-starts-very-soon/296917)
**Author:** [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Replies:** 0\ **Last updated:** [February 10, 2022, 11:55pm UTC](https://discuss.elastic.co/t/the-2022-elastic-community-conference-starts-very-soon/296917 "2022-02-10T23:55:22Z")
The 2022 Elastic Community Conference starts very soon! Check out the full schedule right here. You can also head directly to our YouTube channel to follow the specific language tracks using the links below. ElasticCC: … --- ## [Elastic indexed data but response has error](https://discuss.elastic.co/t/elastic-indexed-data-but-response-has-error/296859)
**Author:** [@tleduong](https://discuss.elastic.co/u/tleduong)\ **Replies:** 1\ **Last updated:** [February 10, 2022, 11:46pm UTC](https://discuss.elastic.co/t/elastic-indexed-data-but-response-has-error/296859 "2022-02-10T23:46:39Z")
Data was indexed successfully but we got the response below from Elastic. Is there a reason why Elastic returned error but data is still indexed? Error: %{"errors" =\> true, "items" =\> \[%{"index" =\> %{"\_id" =\> "tracts-59… --- ## [3 Single Node Elastic search to 3 Node cluster](https://discuss.elastic.co/t/3-single-node-elastic-search-to-3-node-cluster/296866)
**Author:** [@shivam060897](https://discuss.elastic.co/u/shivam060897)\ **Replies:** 1\ **Last updated:** [February 10, 2022, 11:32pm UTC](https://discuss.elastic.co/t/3-single-node-elastic-search-to-3-node-cluster/296866 "2022-02-10T23:32:04Z")
Hi, I have 3 single-node Elasticsearch nodes on 3 hosts all working file. As of now all my data is on first host (say host-1) and ES on host-2 and host-3 are not being used. Now my requirement is to have all 3 running … --- ## [Nodes out of memory with completion suggester / ngrams](https://discuss.elastic.co/t/nodes-out-of-memory-with-completion-suggester-ngrams/296907)
**Author:** [@ravib](https://discuss.elastic.co/u/ravib)\ **Replies:** 1\ **Last updated:** [February 10, 2022, 10:01pm UTC](https://discuss.elastic.co/t/nodes-out-of-memory-with-completion-suggester-ngrams/296907 "2022-02-10T22:01:32Z")
Hello, I am still using Elasticsearch 5.6 version I have an index with a completion suggest field and also a text field with edge ngram size 3 to 10 \[i don't query both of them at the same time\]…. so I got few queries … --- ## [FsCrawler does not do anything, does not index pfd's](https://discuss.elastic.co/t/fscrawler-does-not-do-anything-does-not-index-pfds/296747)
**Author:** [@jank12](https://discuss.elastic.co/u/jank12)\ **Replies:** 3\ **Last updated:** [February 10, 2022, 11:21pm UTC](https://discuss.elastic.co/t/fscrawler-does-not-do-anything-does-not-index-pfds/296747 "2022-02-10T23:21:16Z")
This n00b is thoroughly confused. I have severa quite large pdf files I want to be able to full text search. They comrpise of raw text and images contaning text. So I want to index the text in the pdf, OCR the images a… --- ## [Indexing 100GB of Dataa](https://discuss.elastic.co/t/indexing-100gb-of-dataa/296891)
**Author:** [@deepakray](https://discuss.elastic.co/u/deepakray)\ **Replies:** 1\ **Last updated:** [February 10, 2022, 9:43pm UTC](https://discuss.elastic.co/t/indexing-100gb-of-dataa/296891 "2022-02-10T21:43:05Z")
Hello, We are trying to index having 83,286,866 documents. It takes around 3 days to index. This is the first time we are creating the indexes. Configuration: Elasticsearch 7.10 Windows Server 2016 Heap Size 16Gb … --- ## [APM Notifications: Feasibility Question](https://discuss.elastic.co/t/apm-notifications-feasibility-question/296896)
**Author:** [@Tim\_Estes](https://discuss.elastic.co/u/Tim_Estes)\ **Replies:** 0\ **Last updated:** [February 10, 2022, 8:59pm UTC](https://discuss.elastic.co/t/apm-notifications-feasibility-question/296896 "2022-02-10T20:59:15Z")
Hello, I've setup an APM integration via a python APM agent. I would like to send an email every time there is an error in the application. Here's the catch: I would like the email body to contain the actual error mes… --- ## [Syntax error shown in EQL queries for correlation](https://discuss.elastic.co/t/syntax-error-shown-in-eql-queries-for-correlation/296836)
**Author:** [@wsouza](https://discuss.elastic.co/u/wsouza)\ **Replies:** 0\ **Last updated:** [February 10, 2022, 12:25pm UTC](https://discuss.elastic.co/t/syntax-error-shown-in-eql-queries-for-correlation/296836 "2022-02-10T12:25:26Z")
Hi folks! I'm running a query, through EQL, for event correlation, however, it's returning a syntax error. The strange thing is that the same query is made in another Elastic SIEM and it doesn't return an error. Has any… --- ## [Elastic agent complete container in azure](https://discuss.elastic.co/t/elastic-agent-complete-container-in-azure/296893)
**Author:** [@Garry](https://discuss.elastic.co/u/Garry)\ **Replies:** 0\ **Last updated:** [February 10, 2022, 7:40pm UTC](https://discuss.elastic.co/t/elastic-agent-complete-container-in-azure/296893 "2022-02-10T19:40:51Z")
Has anyone else much experience running the elastic agent complete container in an azure container instance? I am looking to update he host file in the container. Any ideas? --- ## [Logging configuration issues in Kibana 7.16](https://discuss.elastic.co/t/logging-configuration-issues-in-kibana-7-16/295517)
**Author:** [@quality](https://discuss.elastic.co/u/quality)\ **Replies:** 2\ **Last updated:** [February 10, 2022, 6:58pm UTC](https://discuss.elastic.co/t/logging-configuration-issues-in-kibana-7-16/295517 "2022-02-10T18:58:59Z")
Kibana 7.16 END GOAL: All Kibana logging options can be configured from kibana.yml All Kibana logs should be visible with journalctl. (they stream to journald) BACKGROUND: The below issues were discovered after … --- ## [How to automatically set the server date/time when adding data?](https://discuss.elastic.co/t/how-to-automatically-set-the-server-date-time-when-adding-data/296708)
**Author:** [@vmassol](https://discuss.elastic.co/u/vmassol)\ **Replies:** 15\ **Last updated:** [February 10, 2022, 6:14pm UTC](https://discuss.elastic.co/t/how-to-automatically-set-the-server-date-time-when-adding-data/296708 "2022-02-10T18:14:13Z")
Hi there, In old ES versions, I was using the \_timestamp field but it's been removed and it's now recommended to set the date on the client side. However, I'm surprised to not find any easy way to continue to set it on … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=706) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=708)