# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=736 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 737 --- ## [Access heartbeat fields on rule action](https://discuss.elastic.co/t/access-heartbeat-fields-on-rule-action/293955)
**Author:** [@mojohoho](https://discuss.elastic.co/u/mojohoho)\ **Replies:** 1\ **Last updated:** [January 10, 2022, 11:49pm UTC](https://discuss.elastic.co/t/access-heartbeat-fields-on-rule-action/293955 "2022-01-10T23:49:43Z")
I have a heartbeat monitor with custom fields and fields\_under\_root: true How can I access these custom fields in a rule action? For example, I have the below monitor: - type: http id: dummy-nonexistent-url3 name:… --- ## [Logstash S3 output requires bucket object permissions at the root of the bucket, regardless of prefix config](https://discuss.elastic.co/t/logstash-s3-output-requires-bucket-object-permissions-at-the-root-of-the-bucket-regardless-of-prefix-config/293951)
**Author:** [@mdebord](https://discuss.elastic.co/u/mdebord)\ **Replies:** 0\ **Last updated:** [January 10, 2022, 10:30pm UTC](https://discuss.elastic.co/t/logstash-s3-output-requires-bucket-object-permissions-at-the-root-of-the-bucket-regardless-of-prefix-config/293951 "2022-01-10T22:30:54Z")
Logstash requires write access to the root of the bucket, regardless of the prefix defined in config. There are a few issues to note with this behavior: Logstash should be isolating its work into the defined prefix p… --- ## [Evacuate node for maintenance](https://discuss.elastic.co/t/evacuate-node-for-maintenance/293914)
**Author:** [@windows95](https://discuss.elastic.co/u/windows95)\ **Replies:** 1\ **Last updated:** [January 10, 2022, 9:54pm UTC](https://discuss.elastic.co/t/evacuate-node-for-maintenance/293914 "2022-01-10T21:54:54Z")
Hi, when I have a 3 node cluster and and 3 shards (1 primary, 2 replica) per index, as to my experience it is not possible to evacuate a node completely, which makes sense to me. Is it safe in this case to stop Elastics… --- ## [Question about release scheduling](https://discuss.elastic.co/t/question-about-release-scheduling/293926)
**Author:** [@Miguel\_Lopez1](https://discuss.elastic.co/u/Miguel_Lopez1)\ **Replies:** 1\ **Last updated:** [January 10, 2022, 9:01pm UTC](https://discuss.elastic.co/t/question-about-release-scheduling/293926 "2022-01-10T21:01:54Z")
Hi, As part of a masters degree assignment we need to address some questions about the Elasticsearch to the developers. The question is: How are the release schedule planned in relation to deciding when to increase a … --- ## [Logstash Servers Stopping Each Others Logging](https://discuss.elastic.co/t/logstash-servers-stopping-each-others-logging/293784)
**Author:** [@daniel.talbot](https://discuss.elastic.co/u/daniel.talbot)\ **Replies:** 4\ **Last updated:** [January 10, 2022, 8:56pm UTC](https://discuss.elastic.co/t/logstash-servers-stopping-each-others-logging/293784 "2022-01-10T20:56:40Z")
Hi all, Currently I am troubleshooting a configuration that is working in our prod environment but not in our development environment. We are running multiple servers in Dev so I am testing changes on one while I let t… --- ## [Drop previous csv lines if field value already exists](https://discuss.elastic.co/t/drop-previous-csv-lines-if-field-value-already-exists/293947)
**Author:** [@Micah\_Barsness](https://discuss.elastic.co/u/Micah_Barsness)\ **Replies:** 1\ **Last updated:** [January 10, 2022, 8:55pm UTC](https://discuss.elastic.co/t/drop-previous-csv-lines-if-field-value-already-exists/293947 "2022-01-10T20:55:38Z")
I'd like to know if there is a way to drop/overwrite previous csv documents if a field value already exists. In my screenshot above globalCallID is what I want to match on. Take globalCallID\_callID number 263504... … --- ## [Endpoint monitoring Report](https://discuss.elastic.co/t/endpoint-monitoring-report/293931)
**Author:** [@RSundareswaran](https://discuss.elastic.co/u/RSundareswaran)\ **Replies:** 1\ **Last updated:** [January 10, 2022, 8:01pm UTC](https://discuss.elastic.co/t/endpoint-monitoring-report/293931 "2022-01-10T20:01:20Z")
Hi, We are monitoring status of network endpoints via HTTP/S, TCP, and ICMP through Heartbeat and Uptime in Kibana. To leveage the functionality and promote ELK, our team needs to submit some kind of report to manageme… --- ## [Installation steps for elastic agnet in specific kubernetes namesapce](https://discuss.elastic.co/t/installation-steps-for-elastic-agnet-in-specific-kubernetes-namesapce/293942)
**Author:** [@senyam08](https://discuss.elastic.co/u/senyam08)\ **Replies:** 0\ **Last updated:** [January 10, 2022, 7:57pm UTC](https://discuss.elastic.co/t/installation-steps-for-elastic-agnet-in-specific-kubernetes-namesapce/293942 "2022-01-10T19:57:48Z")
I am working on a POC to showcase elastic stack features with elastic agent & fleet. We got kubernetes cluster with option to create namespace/nodegroup. Can i deploy Elasticsearch/kibana/fleet in one of the namespace an… --- ## [Fleet - adding multiple outputs](https://discuss.elastic.co/t/fleet-adding-multiple-outputs/293887)
**Author:** [@mybyte](https://discuss.elastic.co/u/mybyte)\ **Replies:** 1\ **Last updated:** [January 10, 2022, 7:54pm UTC](https://discuss.elastic.co/t/fleet-adding-multiple-outputs/293887 "2022-01-10T19:54:37Z")
Is it possible to add more than one output when using fleet? I.e. adding elastic and logstash servers? Bonus question: how can I specify the output when adding integrations via fleet? --- ## [Boosting Boolean Should's & Best Approach for Address](https://discuss.elastic.co/t/boosting-boolean-shoulds-best-approach-for-address/293916)
**Author:** [@snoopy20](https://discuss.elastic.co/u/snoopy20)\ **Replies:** 0\ **Last updated:** [January 10, 2022, 5:06pm UTC](https://discuss.elastic.co/t/boosting-boolean-shoulds-best-approach-for-address/293916 "2022-01-10T17:06:25Z")
Hi, Couldn't find anything in the documentation about how do you go about boosting an individual should match? I'd hoped it would be a simple case of adding the boost: n into the object as with multi\_search but it's not… --- ## [Count over Time](https://discuss.elastic.co/t/count-over-time/293653)
**Author:** [@BoKu](https://discuss.elastic.co/u/BoKu)\ **Replies:** 11\ **Last updated:** [January 10, 2022, 3:56pm UTC](https://discuss.elastic.co/t/count-over-time/293653 "2022-01-10T15:56:23Z")
Hello and a happy new year, i ingest the Transports Logs from several Exchange Server via Logstash into Elastic. I'd like to count the TOP 10 Sender Adresses and TOP 10 Recipient Adresses in a given Timerange, like the… --- ## [Hello, I wanted output like attched tableau in kibana..but I am getting something different onlywhat to do? Please help me on this](https://discuss.elastic.co/t/hello-i-wanted-output-like-attched-tableau-in-kibana-but-i-am-getting-something-different-onlywhat-to-do-please-help-me-on-this/293814)
**Author:** [@swati\_pal](https://discuss.elastic.co/u/swati_pal)\ **Replies:** 1\ **Last updated:** [January 10, 2022, 3:37pm UTC](https://discuss.elastic.co/t/hello-i-wanted-output-like-attched-tableau-in-kibana-but-i-am-getting-something-different-onlywhat-to-do-please-help-me-on-this/293814 "2022-01-10T15:37:43Z")
--- ## [\[7.15\] Kibana plugin development - Import saved objects to specific space](https://discuss.elastic.co/t/7-15-kibana-plugin-development-import-saved-objects-to-specific-space/293869)
**Author:** [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\ **Replies:** 4\ **Last updated:** [January 10, 2022, 3:18pm UTC](https://discuss.elastic.co/t/7-15-kibana-plugin-development-import-saved-objects-to-specific-space/293869 "2022-01-10T15:18:17Z")
Hi there, my team and I are developing a custom Kibana plugin and during the initialization phase we'd like to import some custom Saved Objects into a new space. Basically, we managed to create the space during the ini… --- ## [Dec 24th, 2021: \[en\] Elastic Docs - give the gift of feedback](https://discuss.elastic.co/t/dec-24th-2021-en-elastic-docs-give-the-gift-of-feedback/292183)
**Author:** [@OliverHowell](https://discuss.elastic.co/u/OliverHowell)\ **Replies:** 1\ **Last updated:** [January 10, 2022, 3:11pm UTC](https://discuss.elastic.co/t/dec-24th-2021-en-elastic-docs-give-the-gift-of-feedback/292183 "2022-01-10T15:11:26Z")
'Twas the night before Christmas, when all through Elastic Not a creature was typing, not even a mouse; The docs were hung by the website with care In hopes our users would soon read it there; The writers were nestle… --- ## [Document delete spike in elastic v7](https://discuss.elastic.co/t/document-delete-spike-in-elastic-v7/293903)
**Author:** [@Idan\_Koch](https://discuss.elastic.co/u/Idan_Koch)\ **Replies:** 0\ **Last updated:** [January 10, 2022, 3:03pm UTC](https://discuss.elastic.co/t/document-delete-spike-in-elastic-v7/293903 "2022-01-10T15:03:32Z")
Hi, Recently we are upgrading from Elasticsearch v6 to Elasticsearch v7 we are basically doing the same thing but we see that we have huge spikes in document deleted (unlike v6) and that IOPS are higher 10x can you pl… --- ## [Disaster Recovery - Non-Enterprise version](https://discuss.elastic.co/t/disaster-recovery-non-enterprise-version/293897)
**Author:** [@rajeev.j.khanna](https://discuss.elastic.co/u/rajeev.j.khanna)\ **Replies:** 1\ **Last updated:** [January 10, 2022, 2:50pm UTC](https://discuss.elastic.co/t/disaster-recovery-non-enterprise-version/293897 "2022-01-10T14:50:06Z")
Hi Team, We are using the open-source version of ELK. We want to implement a Disaster Recovery (DR) solution for our application. That means ELK LOGS has to be replicated. How can we do this? (Please do not share the… --- ## [EQL correlation query help look up value within a message](https://discuss.elastic.co/t/eql-correlation-query-help-look-up-value-within-a-message/293474)
**Author:** [@krabel1ze](https://discuss.elastic.co/u/krabel1ze)\ **Replies:** 5\ **Last updated:** [January 10, 2022, 1:59pm UTC](https://discuss.elastic.co/t/eql-correlation-query-help-look-up-value-within-a-message/293474 "2022-01-10T13:59:08Z")
Hello! I want to created an Okta SSO authentication alert in Elastic.co based on geo-ip information. The query in LOGIC terms should look something like this: If client.user.id {133713371337} event.outcome == "success" … --- ## [How to sync elasticsearch data between DC, DR](https://discuss.elastic.co/t/how-to-sync-elasticsearch-data-between-dc-dr/293651)
**Author:** [@banf](https://discuss.elastic.co/u/banf)\ **Replies:** 6\ **Last updated:** [January 10, 2022, 1:41pm UTC](https://discuss.elastic.co/t/how-to-sync-elasticsearch-data-between-dc-dr/293651 "2022-01-10T13:41:24Z")
Hi Team, We have elasticsearch running on our DC side so standalone as of now. We would like to know how can we sync elasticsearch data to DR side so that if DR happens, we can still see data in kibana. It is installe… --- ## [How to format sum\_bucket aggregation float output?](https://discuss.elastic.co/t/how-to-format-sum-bucket-aggregation-float-output/293851)
**Author:** [@Eduardo\_Montes](https://discuss.elastic.co/u/Eduardo_Montes)\ **Replies:** 3\ **Last updated:** [January 10, 2022, 1:16pm UTC](https://discuss.elastic.co/t/how-to-format-sum-bucket-aggregation-float-output/293851 "2022-01-10T13:16:32Z")
I use Elasticsearch for my Search Service and I use this JSON request for sum\_bucket aggregation: "from": 0, "size": 0, "aggregations": { "aggr": { "type": "term", "field": "type.… --- ## [Migration error](https://discuss.elastic.co/t/migration-error/293764)
**Author:** [@pawars21](https://discuss.elastic.co/u/pawars21)\ **Replies:** 1\ **Last updated:** [January 10, 2022, 12:25pm UTC](https://discuss.elastic.co/t/migration-error/293764 "2022-01-10T12:25:28Z")
I'm getting below error while running kibana.bat for 7.16.2 version. Error: Unable to complete saved object migrations for the \[.kibana\_task\_manager\] index: Migrations failed. Reason: 2 corrupt saved object documents we… --- ## [Heap issue - OutofMemory](https://discuss.elastic.co/t/heap-issue-outofmemory/291432)
**Author:** [@alicango](https://discuss.elastic.co/u/alicango)\ **Replies:** 7\ **Last updated:** [January 10, 2022, 12:23pm UTC](https://discuss.elastic.co/t/heap-issue-outofmemory/291432 "2022-01-10T12:23:12Z")
With the latest version of Elasticsearch, the HEAP is automatically defined by Elasticsearch... So I upgraded my elk system from 7.7.0 to 7.15.2 with rpm I tried to leave jvm.options config file as a default (i mean, I… --- ## [Is there any way to search specific index according to time range?](https://discuss.elastic.co/t/is-there-any-way-to-search-specific-index-according-to-time-range/293822)
**Author:** [@Zephery\_Wen](https://discuss.elastic.co/u/Zephery_Wen)\ **Replies:** 1\ **Last updated:** [January 9, 2022, 9:29pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-search-specific-index-according-to-time-range/293822 "2022-01-09T21:29:05Z")
When i use aaaa-\* and limit time range to search, es will search all of index begin with aaaa index, if there any way to search specific index according to time range? for example: aaaa-\* have these index: aaaa-2022-01… --- ## [What is the best way to build an auto complete](https://discuss.elastic.co/t/what-is-the-best-way-to-build-an-auto-complete/293829)
**Author:** [@Amir\_Faramarzi](https://discuss.elastic.co/u/Amir_Faramarzi)\ **Replies:** 5\ **Last updated:** [January 10, 2022, 11:18am UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-build-an-auto-complete/293829 "2022-01-10T11:18:55Z")
Hello friends What is the best way to build an auto complete program in terms of performance ?? Also consider that I want to prioritize information whose names start with the text that the user is searching for. --- ## [Stop autoformat dates in kibana filters](https://discuss.elastic.co/t/stop-autoformat-dates-in-kibana-filters/293776)
**Author:** [@Michael\_Ubry](https://discuss.elastic.co/u/Michael_Ubry)\ **Replies:** 4\ **Last updated:** [January 10, 2022, 11:11am UTC](https://discuss.elastic.co/t/stop-autoformat-dates-in-kibana-filters/293776 "2022-01-10T11:11:37Z")
Hi, is there way to stop Kibana from autoformat date inputs in filters ? my dates are in format DD.MM.YYYY but when I input it manully in filters its gonna convert automatically to 2018-01-01T00:00:00.000+01:00... As u… --- ## [Kibana intermittently losing connectivity to Elasticsearch](https://discuss.elastic.co/t/kibana-intermittently-losing-connectivity-to-elasticsearch/293682)
**Author:** [@aidofitz](https://discuss.elastic.co/u/aidofitz)\ **Replies:** 2\ **Last updated:** [January 10, 2022, 9:59am UTC](https://discuss.elastic.co/t/kibana-intermittently-losing-connectivity-to-elasticsearch/293682 "2022-01-10T09:59:24Z")
Hi, Am seeing an issue in my v7.8 cluster with 16 x Kibana nodes, 16 x Elastic nodes. Kibana nodes keep reporting status as red, with error as in screenshot. However, my Elastic cluster seems to be fine and I can test … --- ## [Elasticsearch aggregation on million or more data](https://discuss.elastic.co/t/elasticsearch-aggregation-on-million-or-more-data/293641)
**Author:** [@Nowrin\_Hossain](https://discuss.elastic.co/u/Nowrin_Hossain)\ **Replies:** 5\ **Last updated:** [January 10, 2022, 9:42am UTC](https://discuss.elastic.co/t/elasticsearch-aggregation-on-million-or-more-data/293641 "2022-01-10T09:42:08Z")
I have an index which can have millions of documents with time. I need to make several aggregation on those huge amount of documents fields. In these documents, I need to count number of unique value of a field which may… --- ## [Kibana dashboard with two timestamps](https://discuss.elastic.co/t/kibana-dashboard-with-two-timestamps/293684)
**Author:** [@Michael\_Ubry](https://discuss.elastic.co/u/Michael_Ubry)\ **Replies:** 2\ **Last updated:** [January 10, 2022, 9:33am UTC](https://discuss.elastic.co/t/kibana-dashboard-with-two-timestamps/293684 "2022-01-10T09:33:52Z")
Hi, is it possible to have two different timestamps within one dashboard? There is always one which is in calendar in up right corner and applies to whole dashboard (lets say its production date) but what if I want ano… --- ## [Total doc\_count aggregations](https://discuss.elastic.co/t/total-doc-count-aggregations/293832)
**Author:** [@Miguel\_BA](https://discuss.elastic.co/u/Miguel_BA)\ **Replies:** 1\ **Last updated:** [January 10, 2022, 9:11am UTC](https://discuss.elastic.co/t/total-doc-count-aggregations/293832 "2022-01-10T09:11:05Z")
I am looking for a way to sum up the Total doc\_count aggregations that I have defined in the query. I will try to explain my question through the following simple representative example: { "name" : false, "… --- ## [Configuring multiple nodes in one Elastic installation](https://discuss.elastic.co/t/configuring-multiple-nodes-in-one-elastic-installation/291936)
**Author:** [@arthytrip](https://discuss.elastic.co/u/arthytrip)\ **Replies:** 1\ **Last updated:** [January 10, 2022, 9:07am UTC](https://discuss.elastic.co/t/configuring-multiple-nodes-in-one-elastic-installation/291936 "2022-01-10T09:07:46Z")
Hello everybody, I'm trying to set up multiple Elasticsearch nodes in one installation. For the moment it is a test so I have no performance problems (but any advice is welcome). Based on some readings on the net I tr… --- ## [Circuit Breaker Exception](https://discuss.elastic.co/t/circuit-breaker-exception/293737)
**Author:** [@Suresh\_Ghatuwa](https://discuss.elastic.co/u/Suresh_Ghatuwa)\ **Replies:** 9\ **Last updated:** [January 10, 2022, 9:00am UTC](https://discuss.elastic.co/t/circuit-breaker-exception/293737 "2022-01-10T09:00:50Z")
I am working on ES Circuit Breaker implementation. I got circuit breaker exception if heavy terms aggregation. But if multiple es query with less JVM usage than limit is executed, then we got Out Of Memory exception. Qu… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=735) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=737)