# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=773 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 774 --- ## [Persisting latest state in separated index](https://discuss.elastic.co/t/persisting-latest-state-in-separated-index/289628)
**Author:** [@nestor1](https://discuss.elastic.co/u/nestor1)\ **Replies:** 1\ **Last updated:** [November 21, 2021, 11:39pm UTC](https://discuss.elastic.co/t/persisting-latest-state-in-separated-index/289628 "2021-11-21T23:39:30Z")
I have stream of data like this: userid: 1, taskid: 1, start\_time: 01:00:00, completed: 10 userid: 1, taskid: 1, start\_time: 02:00:00, completed: 30 userid: 1, taskid: 1, start\_time: 03:00:00, completed: 70 userid: 1, t… --- ## [Changed layout of coordinates (geopoint) after upgrade 7.10 to 7.15](https://discuss.elastic.co/t/changed-layout-of-coordinates-geopoint-after-upgrade-7-10-to-7-15/287365)
**Author:** [@tjswe](https://discuss.elastic.co/u/tjswe)\ **Replies:** 5\ **Last updated:** [November 21, 2021, 5:57pm UTC](https://discuss.elastic.co/t/changed-layout-of-coordinates-geopoint-after-upgrade-7-10-to-7-15/287365 "2021-11-21T17:57:11Z")
Hi! Did an upgrade of the ELK-stack from 7.10 to 7.15 and in that jump the format of coordinates in Kibana changed Previously it was just like any other field in the discovery view location : 11.111 , 22.222 now it… --- ## [MONGODB | Error checking \:\: Mongo::Error::MaxMessageSize: Message exceeds allowed max message size. The max is 50331648](https://discuss.elastic.co/t/mongodb-error-checking-ip-port-mongo-message-exceeds-allowed-max-message-size-the-max-is-50331648/289750)
**Author:** [@Bugsbee](https://discuss.elastic.co/u/Bugsbee)\ **Replies:** 2\ **Last updated:** [November 21, 2021, 2:18am UTC](https://discuss.elastic.co/t/mongodb-error-checking-ip-port-mongo-message-exceeds-allowed-max-message-size-the-max-is-50331648/289750 "2021-11-21T02:18:54Z")
hello, any idea as to why i get the error below? my ELK has been working on. its just today i chnaged he password.. and nothing else. however this time when i start elk , i get the error below anything else i need t… --- ## [Questions about using must, should words together and Turkish char problem](https://discuss.elastic.co/t/questions-about-using-must-should-words-together-and-turkish-char-problem/289755)
**Author:** [@aox](https://discuss.elastic.co/u/aox)\ **Replies:** 1\ **Last updated:** [November 20, 2021, 9:06pm UTC](https://discuss.elastic.co/t/questions-about-using-must-should-words-together-and-turkish-char-problem/289755 "2021-11-20T21:06:05Z")
Hello I am using Elasticsearch-oss-7.10.2-1.x86\_64. I have 2 questions: Question 1) I want to combine this query results: GET /turkish\_example/\_search { "query": { "bool": { "should": \[ { "simple\_q… --- ## [How much clusters must I use in elastic stack?](https://discuss.elastic.co/t/how-much-clusters-must-i-use-in-elastic-stack/289735)
**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\ **Replies:** 1\ **Last updated:** [November 20, 2021, 7:10pm UTC](https://discuss.elastic.co/t/how-much-clusters-must-i-use-in-elastic-stack/289735 "2021-11-20T19:10:27Z")
I am confused which approach would be better having single cluster with 12 nodes or having 3 cluster with 4 nodes each in elastic stack. What are the advantages and disadvantages of single cluster? Does elastic charge me… --- ## [Documents are getting duplicated in mongodb](https://discuss.elastic.co/t/documents-are-getting-duplicated-in-mongodb/289745)
**Author:** [@Husnain](https://discuss.elastic.co/u/Husnain)\ **Replies:** 0\ **Last updated:** [November 20, 2021, 3:37pm UTC](https://discuss.elastic.co/t/documents-are-getting-duplicated-in-mongodb/289745 "2021-11-20T15:37:26Z")
Hi, I am trying to fetch data from mysql using logstash and storing them into Elasticsearch and mongodb.Document is getting stored in Elasticsearch properly and no duplicate documents are inserted,but in mongodb same do… --- ## [工作日常：如何从kibana 处转到Elasticsearch Service Console](https://discuss.elastic.co/t/kibana-elasticsearch-service-console/289733)
**Author:** [@monica\_l\_dp](https://discuss.elastic.co/u/monica_l_dp)\ **Replies:** 0\ **Last updated:** [November 20, 2021, 4:46am UTC](https://discuss.elastic.co/t/kibana-elasticsearch-service-console/289733 "2021-11-20T04:46:41Z")
大家好，我的公司给了我kibana的权限。（可以上去进行查询并实验） 但当我去Elasticsearch service console的时候，要求我从新注册一个账号。 我想问问，这两个不是连在一起的吗？ 我的目的是想看一看cluster performance。 尤其是search response times（ms）那个图表。 --- ## [New to Logstash - can't get it to connect to my Elasticsearch](https://discuss.elastic.co/t/new-to-logstash-cant-get-it-to-connect-to-my-elasticsearch/289727)
**Author:** [@aluminex](https://discuss.elastic.co/u/aluminex)\ **Replies:** 1\ **Last updated:** [November 20, 2021, 3:28am UTC](https://discuss.elastic.co/t/new-to-logstash-cant-get-it-to-connect-to-my-elasticsearch/289727 "2021-11-20T03:28:55Z")
I have Elasticsearch and Kibana on a different host. I'm trying to get my Logstash instance to output to Elasticsearch on a remote host. I can forward my logs to Filebeat and then to Elastic, but I am trying to write/t… --- ## [Faile to start Elasticsearch 7.12.1](https://discuss.elastic.co/t/faile-to-start-elasticsearch-7-12-1/289718)
**Author:** [@tranha31](https://discuss.elastic.co/u/tranha31)\ **Replies:** 2\ **Last updated:** [November 20, 2021, 1:27am UTC](https://discuss.elastic.co/t/faile-to-start-elasticsearch-7-12-1/289718 "2021-11-20T01:27:05Z")
I install vietnamese-analysis for Elasticsearch 7.12.1. But when I restart Elasticsearch, I get the following error: \[2021-11-20T01:56:57,505\]\[ERROR\]\[o.e.b.ElasticsearchUncaughtExceptionHandler\] \[dell-Precision-M4800… --- ## [Elasticsearch Synonyms - can phrases be used?](https://discuss.elastic.co/t/elasticsearch-synonyms-can-phrases-be-used/289723)
**Author:** [@pmono](https://discuss.elastic.co/u/pmono)\ **Replies:** 0\ **Last updated:** [November 19, 2021, 11:08pm UTC](https://discuss.elastic.co/t/elasticsearch-synonyms-can-phrases-be-used/289723 "2021-11-19T23:08:08Z")
Howdy, is it possible to use Phrase Synonyms for indexing? We had issues on ES 7.8 where it would crash indexing. We recently switched to 7.13.2. Are there any changes in terms of synonyms? Can phrases be used? Examp… --- ## [Tuning queries](https://discuss.elastic.co/t/tuning-queries/289721)
**Author:** [@Nick\_Hatfield](https://discuss.elastic.co/u/Nick_Hatfield)\ **Replies:** 0\ **Last updated:** [November 19, 2021, 10:50pm UTC](https://discuss.elastic.co/t/tuning-queries/289721 "2021-11-19T22:50:38Z")
Hey gang is there anyone that can help me with an Elasticsearch query? I'm trying to make the query more efficient by returning only unique hits. My query is structured like this currently: { "query": { "bool":… --- ## [Kibana not showing recent Elasticsearch data](https://discuss.elastic.co/t/kibana-not-showing-recent-elasticsearch-data/289647)
**Author:** [@sanjpatil](https://discuss.elastic.co/u/sanjpatil)\ **Replies:** 2\ **Last updated:** [November 19, 2021, 10:24pm UTC](https://discuss.elastic.co/t/kibana-not-showing-recent-elasticsearch-data/289647 "2021-11-19T22:24:30Z")
Hello, We observed kibana stopped showing recent ES data from 31st October. If i query Elasticsearch index it has all the data its just not displaying on the dashboard. Can some one help with this ? Elasticsearch versi… --- ## [How to monitor events in chain or to detect if transaction was completed or not](https://discuss.elastic.co/t/how-to-monitor-events-in-chain-or-to-detect-if-transaction-was-completed-or-not/289596)
**Author:** [@sagarseth](https://discuss.elastic.co/u/sagarseth)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 9:08pm UTC](https://discuss.elastic.co/t/how-to-monitor-events-in-chain-or-to-detect-if-transaction-was-completed-or-not/289596 "2021-11-19T21:08:54Z")
Hello Friends, lets imagine i have following state , i get a message ordered timeStamp1,transactionA,Status\_ordered I want to check if for this transaction if the order was delivered in the next 15 mins or not,, if no… --- ## [How can I delete remote index via Kibana's "Index Management" feature?](https://discuss.elastic.co/t/how-can-i-delete-remote-index-via-kibanas-index-management-feature/289719)
**Author:** [@jwmocs](https://discuss.elastic.co/u/jwmocs)\ **Replies:** 0\ **Last updated:** [November 19, 2021, 8:34pm UTC](https://discuss.elastic.co/t/how-can-i-delete-remote-index-via-kibanas-index-management-feature/289719 "2021-11-19T20:34:39Z")
Is it possible to remove old index data on a remote cluster using Kibana? I can delete indices on the local cluster fine in Kibana UI, but do I have to resort to the API to do the same for indices on a remote cluster? --- ## [Apply best\_compression to save disk space](https://discuss.elastic.co/t/apply-best-compression-to-save-disk-space/289705)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 2\ **Last updated:** [November 19, 2021, 7:27pm UTC](https://discuss.elastic.co/t/apply-best-compression-to-save-disk-space/289705 "2021-11-19T19:27:41Z")
Hi All, We are struggling with disk space issues on the Elasticsearch nodes. I came across the best\_compression option and the suggested way is as follows using dev tools: 1. Close all indices: POST \_all/\_close 2. A… --- ## [Kibana log to cloud storage](https://discuss.elastic.co/t/kibana-log-to-cloud-storage/289692)
**Author:** [@aditi\_salunke](https://discuss.elastic.co/u/aditi_salunke)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 7:04pm UTC](https://discuss.elastic.co/t/kibana-log-to-cloud-storage/289692 "2021-11-19T19:04:43Z")
Hello, Can we have direct connectivity to upload kibana.log file after reaching to specific size of file to cloud storage? Or Can we specify cloud uploading path in kibana.yml itself for log.path setting? Because aft… --- ## [Logstash rewrite value for the same key instead of append](https://discuss.elastic.co/t/logstash-rewrite-value-for-the-same-key-instead-of-append/289702)
**Author:** [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 6:30pm UTC](https://discuss.elastic.co/t/logstash-rewrite-value-for-the-same-key-instead-of-append/289702 "2021-11-19T18:30:08Z")
Hello! I'm trying to parse CheckPoint log which contains data like this \_\_policy\_id\_tag:"product=APP1 & APP2\[db\_tag={ABCDEF};mgmt=abcd;date=123456789;policy\_name=foo\]";product:"APP3" I use the filter filter { kv { … --- ## [Add json object](https://discuss.elastic.co/t/add-json-object/289682)
**Author:** [@Roberto\_B](https://discuss.elastic.co/u/Roberto_B)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 6:08pm UTC](https://discuss.elastic.co/t/add-json-object/289682 "2021-11-19T18:08:15Z")
Hi there, I would like to add a field liek this: field : {sub1 : null} which is the best way to do that? Kind Regards Roberto --- ## [Logstash information](https://discuss.elastic.co/t/logstash-information/289595)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 3\ **Last updated:** [November 19, 2021, 6:00pm UTC](https://discuss.elastic.co/t/logstash-information/289595 "2021-11-19T18:00:55Z")
I am really struggling to understand the documentation, and as such cannot work out what I need to do to get logstash to work. So logstash arrives as a zip (Is there an msi?) But nothing configured. The documentation … --- ## [Getting logstash to run](https://discuss.elastic.co/t/getting-logstash-to-run/289673)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 5:37pm UTC](https://discuss.elastic.co/t/getting-logstash-to-run/289673 "2021-11-19T17:37:15Z")
I have downloaded the 7.15 version on logstash and unzipped. Unfortunately the lack of an installer leaves the solution in a non working state. My current - first - challenge is getting logstash to use the bundled jdk.… --- ## [Parsing issues](https://discuss.elastic.co/t/parsing-issues/289681)
**Author:** [@nickel43](https://discuss.elastic.co/u/nickel43)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 5:32pm UTC](https://discuss.elastic.co/t/parsing-issues/289681 "2021-11-19T17:32:13Z")
Hello, I'm new to Elastic and trying to parse JSON files in order to have multiple fields, so that I can make statistics out of it in Kibana. Here is a sample: { "info": { "generated\_on": "2017-12-03 08:41… --- ## [Security dashboard user (7.15)](https://discuss.elastic.co/t/security-dashboard-user-7-15/289592)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 5:05pm UTC](https://discuss.elastic.co/t/security-dashboard-user-7-15/289592 "2021-11-19T17:05:14Z")
I have found some docs that suggests that I need to create a user that has access to spaces, and put my dashboard into that space. My issue here is that that documentation doesn't supply the how! Can someone point me t… --- ## [Kibana not ready yet error after upgrading from 7.6.1 to 7.15.2](https://discuss.elastic.co/t/kibana-not-ready-yet-error-after-upgrading-from-7-6-1-to-7-15-2/289696)
**Author:** [@3c3m](https://discuss.elastic.co/u/3c3m)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 4:10pm UTC](https://discuss.elastic.co/t/kibana-not-ready-yet-error-after-upgrading-from-7-6-1-to-7-15-2/289696 "2021-11-19T16:10:03Z")
Hello, We upgraded our elastic stack to logstash, Elasticsearch and kibana from version 7.6.1 to 7.15.2 respectively. But we get Kibana server is not ready yet error in kibana interface. kibana service is running but … --- ## [Logstash not sending syslog to elasticsearch](https://discuss.elastic.co/t/logstash-not-sending-syslog-to-elasticsearch/289020)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 41\ **Last updated:** [November 19, 2021, 3:36pm UTC](https://discuss.elastic.co/t/logstash-not-sending-syslog-to-elasticsearch/289020 "2021-11-19T15:36:16Z")
Hello Elastic team. I have been asking tons of questions and have been slowly making my way through the final part of my ELK SIEM installation. I am running a small environment with Elasticsearch, Logstash and Kibana i… --- ## [Logstash Lookup Fields](https://discuss.elastic.co/t/logstash-lookup-fields/289357)
**Author:** [@John\_snow](https://discuss.elastic.co/u/John_snow)\ **Replies:** 35\ **Last updated:** [November 18, 2021, 6:30pm UTC](https://discuss.elastic.co/t/logstash-lookup-fields/289357 "2021-11-18T18:30:57Z")
i wanted to use a lookup table in Logstash to check if account id exisits in lookub table then it will grab the output location from the lookup file. e--g Lookup File account\_id, output\_location, secrets, 123, s3, abcde… --- ## [Global Ordinals execution hint](https://discuss.elastic.co/t/global-ordinals-execution-hint/289699)
**Author:** [@ananth](https://discuss.elastic.co/u/ananth)\ **Replies:** 0\ **Last updated:** [November 19, 2021, 2:42pm UTC](https://discuss.elastic.co/t/global-ordinals-execution-hint/289699 "2021-11-19T14:42:30Z")
Hi All, I went through all the global ordinal related blogs and previous questions such as Global ordinals performance and size on-heap" Whether execution\_hint = map will operate in segment-private ordinal space ? My … --- ## [Efficient filtering in custom plugin](https://discuss.elastic.co/t/efficient-filtering-in-custom-plugin/289697)
**Author:** [@mjanuszkiewicz-tt](https://discuss.elastic.co/u/mjanuszkiewicz-tt)\ **Replies:** 0\ **Last updated:** [November 19, 2021, 2:40pm UTC](https://discuss.elastic.co/t/efficient-filtering-in-custom-plugin/289697 "2021-11-19T14:40:37Z")
Hello, I'm writing a custom plugin that allows filtering/scoring using an external service. The overhead of calling the service is relatively high: filtering a single document takes 80ms, filtering 10k documents takes 1… --- ## [Rename field problem](https://discuss.elastic.co/t/rename-field-problem/289669)
**Author:** [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Replies:** 2\ **Last updated:** [November 19, 2021, 2:12pm UTC](https://discuss.elastic.co/t/rename-field-problem/289669 "2021-11-19T14:12:09Z")
Hello! I have input data like "abc":"123";"def":"456";"ghi":"789" I use the following filter to parse data and rename "abc" field to "blabla" filter { kv { source =\> "message" field\_split =\> ";" value\_s… --- ## [How to get search results with exact matches sorted by popularity within themselves and then partial matches sorted by popularity within themselves?](https://discuss.elastic.co/t/how-to-get-search-results-with-exact-matches-sorted-by-popularity-within-themselves-and-then-partial-matches-sorted-by-popularity-within-themselves/289685)
**Author:** [@f3dd3rn](https://discuss.elastic.co/u/f3dd3rn)\ **Replies:** 0\ **Last updated:** [November 19, 2021, 12:49pm UTC](https://discuss.elastic.co/t/how-to-get-search-results-with-exact-matches-sorted-by-popularity-within-themselves-and-then-partial-matches-sorted-by-popularity-within-themselves/289685 "2021-11-19T12:49:06Z")
Hello Elastic community, I am new to Elasticsearch and feel lost as to how to accomplish this. I have tried a lot of different things, but was not able to accomplish this. Let me explain the expected search results wi… --- ## [Split chart with individual y axis?](https://discuss.elastic.co/t/split-chart-with-individual-y-axis/288492)
**Author:** [@NiclasK](https://discuss.elastic.co/u/NiclasK)\ **Replies:** 2\ **Last updated:** [November 19, 2021, 12:40pm UTC](https://discuss.elastic.co/t/split-chart-with-individual-y-axis/288492 "2021-11-19T12:40:52Z")
Hi, I have a field that contains a string representation of a state. Some states are normal which means that there are many documents with these states. Other states represents errors. Usually, the number of documents c… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=772) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=774)