# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=834 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 835 --- ## [Cluster stops workning when shutting down master marked with a star? \[7.11.2\]](https://discuss.elastic.co/t/cluster-stops-workning-when-shutting-down-master-marked-with-a-star-7-11-2/283545)
**Author:** [@mbooh](https://discuss.elastic.co/u/mbooh)\ **Replies:** 9\ **Last updated:** [September 7, 2021, 3:40pm UTC](https://discuss.elastic.co/t/cluster-stops-workning-when-shutting-down-master-marked-with-a-star-7-11-2/283545 "2021-09-07T15:40:17Z")
Hi! I have a three node cluster where all nodes are maste nodes and I'm using Kibana for checking status and running queries. Running the command: GET \_cat/nodes Gives me: ip heap.percent ram.percent cpu lo… --- ## [Else if condition is not working?](https://discuss.elastic.co/t/else-if-condition-is-not-working/283544)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 4\ **Last updated:** [September 7, 2021, 2:46pm UTC](https://discuss.elastic.co/t/else-if-condition-is-not-working/283544 "2021-09-07T14:46:14Z")
I want if SubmittedOn is null then add New field with value 1 mutate{ add\_field=\>{"Queue"=\>1} } if \[SubmittedOn\]{ if \[null\] not in \[SubmittedOn\]{ date { m… --- ## [Is there documentation regarding the field names in the logs?](https://discuss.elastic.co/t/is-there-documentation-regarding-the-field-names-in-the-logs/283320)
**Author:** [@a24](https://discuss.elastic.co/u/a24)\ **Replies:** 3\ **Last updated:** [September 7, 2021, 2:44pm UTC](https://discuss.elastic.co/t/is-there-documentation-regarding-the-field-names-in-the-logs/283320 "2021-09-07T14:44:18Z")
I am brand new to kibana. I am looking at my logs and there are some field names I am not familiar with. Is there documentation that will explain the field names to me? thank you --- ## [7.14.0 Kibana discover table layout: message field as raw xml](https://discuss.elastic.co/t/7-14-0-kibana-discover-table-layout-message-field-as-raw-xml/282819)
**Author:** [@jsteenkamp](https://discuss.elastic.co/u/jsteenkamp)\ **Replies:** 2\ **Last updated:** [September 7, 2021, 2:42pm UTC](https://discuss.elastic.co/t/7-14-0-kibana-discover-table-layout-message-field-as-raw-xml/282819 "2021-09-07T14:42:34Z")
In both the classic and new table layout, message xml content is being parsed as html. Is there a way to get a table view that shows the message field content as raw xml. It is possible to see the raw xml content one by… --- ## [Logstash unable to connect to elasticsearch](https://discuss.elastic.co/t/logstash-unable-to-connect-to-elasticsearch/283548)
**Author:** [@geetika\_gopi](https://discuss.elastic.co/u/geetika_gopi)\ **Replies:** 0\ **Last updated:** [September 7, 2021, 2:39pm UTC](https://discuss.elastic.co/t/logstash-unable-to-connect-to-elasticsearch/283548 "2021-09-07T14:39:14Z")
I have SSL enabled on all my elastic nodes, using a self signed certificate. However logstash is unable to connect to elasticsearch. Gives the following error \[2021-09-07T10:34:50,283\]\[WARN \]\[logstash.outputs.elasticsea… --- ## [Does logstash support having a list/array in root (top level) of the event](https://discuss.elastic.co/t/does-logstash-support-having-a-list-array-in-root-top-level-of-the-event/283524)
**Author:** [@Renjith\_PK](https://discuss.elastic.co/u/Renjith_PK)\ **Replies:** 4\ **Last updated:** [September 7, 2021, 2:35pm UTC](https://discuss.elastic.co/t/does-logstash-support-having-a-list-array-in-root-top-level-of-the-event/283524 "2021-09-07T14:35:29Z")
We have input data like this message:\[{key1:value1},{key2:value2}\] and we need value of message, which is a list, directly on root of event (to use as zipkin storage) without any additional field. I tried using json fi… --- ## [How do I get past the 500 record limitation?](https://discuss.elastic.co/t/how-do-i-get-past-the-500-record-limitation/283319)
**Author:** [@a24](https://discuss.elastic.co/u/a24)\ **Replies:** 3\ **Last updated:** [September 7, 2021, 2:18pm UTC](https://discuss.elastic.co/t/how-do-i-get-past-the-500-record-limitation/283319 "2021-09-07T14:18:45Z")
I am brand new to kibana, how do I load more than the 500 record limit? I read somewhere in a post to go to settings. I have no clue where settings even is. I think I am on version 7.8.1. --- ## [Using dense\_vector field in appsearch engine](https://discuss.elastic.co/t/using-dense-vector-field-in-appsearch-engine/283536)
**Author:** [@sureshj](https://discuss.elastic.co/u/sureshj)\ **Replies:** 1\ **Last updated:** [September 7, 2021, 2:03pm UTC](https://discuss.elastic.co/t/using-dense-vector-field-in-appsearch-engine/283536 "2021-09-07T14:03:13Z")
I want to use fields of type dense\_vector in an engine. It appears it is supported on elastic search but not on app search (Enterprise search). The documentation at Schema API | Elastic App Search Documentation \[7.14\] … --- ## [Preset time ranges for dashboard or canvas](https://discuss.elastic.co/t/preset-time-ranges-for-dashboard-or-canvas/283057)
**Author:** [@Janujc](https://discuss.elastic.co/u/Janujc)\ **Replies:** 3\ **Last updated:** [September 7, 2021, 1:59pm UTC](https://discuss.elastic.co/t/preset-time-ranges-for-dashboard-or-canvas/283057 "2021-09-07T13:59:14Z")
Hello, I've managed to create a very useful dashboard and canvas but I'm having problems with the time selection. I know the time selection in Kibana has a high degree of flexibility, but I'm creating a dashboard for us… --- ## [How to get the completness of each column by group](https://discuss.elastic.co/t/how-to-get-the-completness-of-each-column-by-group/283542)
**Author:** [@MichaelG](https://discuss.elastic.co/u/MichaelG)\ **Replies:** 0\ **Last updated:** [September 7, 2021, 1:51pm UTC](https://discuss.elastic.co/t/how-to-get-the-completness-of-each-column-by-group/283542 "2021-09-07T13:51:49Z")
I'm trying to get the completeness of every column grouped by a categorical field that know to be 100% complete. Currently I'm able to get the completeness for any given column, grouped by the grouping field like this: … --- ## [Doesn't match any of the locations specified by path.repo because this setting is empty"](https://discuss.elastic.co/t/doesnt-match-any-of-the-locations-specified-by-path-repo-because-this-setting-is-empty/283527)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 4\ **Last updated:** [September 7, 2021, 1:06pm UTC](https://discuss.elastic.co/t/doesnt-match-any-of-the-locations-specified-by-path-repo-because-this-setting-is-empty/283527 "2021-09-07T13:06:03Z")
Hello friends i have a problem. I can't backup indices. my elasticsearch.yml file: # ----------------------------------- Paths ------------------------------------ # # Path to directory where to store the data (separat… --- ## [Is it possible to have calculation on aggregation](https://discuss.elastic.co/t/is-it-possible-to-have-calculation-on-aggregation/283359)
**Author:** [@vijay\_kaali](https://discuss.elastic.co/u/vijay_kaali)\ **Replies:** 2\ **Last updated:** [September 7, 2021, 12:07pm UTC](https://discuss.elastic.co/t/is-it-possible-to-have-calculation-on-aggregation/283359 "2021-09-07T12:07:56Z")
Hi i have a requirement wherein on host metric i want , mount point , total, used\_bytes, used\_pct in tsvb but it is not showing in table timeseries option I did a workaround by having multiple max of metric total, … --- ## [Threshold Rule type - not able to send more than three field values in email action](https://discuss.elastic.co/t/threshold-rule-type-not-able-to-send-more-than-three-field-values-in-email-action/283525)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 0\ **Last updated:** [September 7, 2021, 12:02pm UTC](https://discuss.elastic.co/t/threshold-rule-type-not-able-to-send-more-than-three-field-values-in-email-action/283525 "2021-09-07T12:02:44Z")
Continuing the discussion from Threshold Rule type - not able to send more than three field values in email action: Waiting for a reply for this issue. --- ## [Creating Table Visualization with 3 indices](https://discuss.elastic.co/t/creating-table-visualization-with-3-indices/281571)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 2\ **Last updated:** [September 7, 2021, 11:16am UTC](https://discuss.elastic.co/t/creating-table-visualization-with-3-indices/281571 "2021-09-07T11:16:03Z")
Hi, I'm trying to create a data table with multiple terms aggregations from each index. I've created an index-pattern that matches against the 3 indices that I want to search across, but whenever I create a terms agg fo… --- ## [Fingerprint duplicate hash for different events](https://discuss.elastic.co/t/fingerprint-duplicate-hash-for-different-events/282462)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 3\ **Last updated:** [September 7, 2021, 10:51am UTC](https://discuss.elastic.co/t/fingerprint-duplicate-hash-for-different-events/282462 "2021-09-07T10:51:11Z")
Hi, I have a strange issue which came to light after starting to use datastreams (and thus create events instead of updates). The following fingerprint config we have in logstash: ### Add a fingerprint to… --- ## [ECK Install repository-s3 plugin](https://discuss.elastic.co/t/eck-install-repository-s3-plugin/283514)
**Author:** [@Fleming7612](https://discuss.elastic.co/u/Fleming7612)\ **Replies:** 1\ **Last updated:** [September 7, 2021, 10:30am UTC](https://discuss.elastic.co/t/eck-install-repository-s3-plugin/283514 "2021-09-07T10:30:38Z")
Hi there, I'd downloaded repository-s3-7.12.jar but i don't know how to install it. Any suggestion would be appreciated. Best wishes --- ## [Is it possible to cumulative\_sum over the metric of a moving interval?](https://discuss.elastic.co/t/is-it-possible-to-cumulative-sum-over-the-metric-of-a-moving-interval/283519)
**Author:** [@di.lu](https://discuss.elastic.co/u/di.lu)\ **Replies:** 1\ **Last updated:** [September 7, 2021, 10:15am UTC](https://discuss.elastic.co/t/is-it-possible-to-cumulative-sum-over-the-metric-of-a-moving-interval/283519 "2021-09-07T10:15:31Z")
Hiii ES community! I've been stuck on a tricky requirement for quite a while.. So I have a time series data capturing when a user has used what feature as which identity, lie this: | feature | is\_free\_trial | trac… --- ## [Upgrade from Basic license to Gold License](https://discuss.elastic.co/t/upgrade-from-basic-license-to-gold-license/283499)
**Author:** [@David\_Dennis](https://discuss.elastic.co/u/David_Dennis)\ **Replies:** 2\ **Last updated:** [September 7, 2021, 10:10am UTC](https://discuss.elastic.co/t/upgrade-from-basic-license-to-gold-license/283499 "2021-09-07T10:10:34Z")
Hi, I will like to seek guidance here. I have an Elasticsearch cluster and Kibana, currently an On-prem deployment. I want to enable Alerting, but the basic license does not provide connectors like Slack, Pagerduty, etc… --- ## [Fast ingest](https://discuss.elastic.co/t/fast-ingest/283518)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 0\ **Last updated:** [September 7, 2021, 9:52am UTC](https://discuss.elastic.co/t/fast-ingest/283518 "2021-09-07T09:52:36Z")
Hello, I have a project where we are considering using elasticsearch for some very high amount of data around 150billion documents/day is there a way we can ingest that amount of data in a real life scenario? I underst… --- ## [TSVB - How to use Annotations: display when a count of field LEVEL exceeds 500](https://discuss.elastic.co/t/tsvb-how-to-use-annotations-display-when-a-count-of-field-level-exceeds-500/281812)
**Author:** [@MWLonKso](https://discuss.elastic.co/u/MWLonKso)\ **Replies:** 1\ **Last updated:** [September 7, 2021, 9:26am UTC](https://discuss.elastic.co/t/tsvb-how-to-use-annotations-display-when-a-count-of-field-level-exceeds-500/281812 "2021-09-07T09:26:47Z")
Hi there. The premise is pretty simple. I'm counting Events that match one of four possible values for a field called Level. In the TSVB I've split the graph using filters. What I'd like to be able to do is to put an Ann… --- ## [Gauge with dynamic Max and Min value](https://discuss.elastic.co/t/gauge-with-dynamic-max-and-min-value/282335)
**Author:** [@LL\_FED](https://discuss.elastic.co/u/LL_FED)\ **Replies:** 1\ **Last updated:** [September 7, 2021, 9:10am UTC](https://discuss.elastic.co/t/gauge-with-dynamic-max-and-min-value/282335 "2021-09-07T09:10:40Z")
I have Data like this: Max = 10; Min = 5; Value = 8; Is it possible to create a Gauge-Visualisation, where I can define the range (max and min) with my data? --- ## [TSVB two Counts division](https://discuss.elastic.co/t/tsvb-two-counts-division/282331)
**Author:** [@Aaron\_Yu](https://discuss.elastic.co/u/Aaron_Yu)\ **Replies:** 1\ **Last updated:** [September 7, 2021, 8:55am UTC](https://discuss.elastic.co/t/tsvb-two-counts-division/282331 "2021-09-07T08:55:52Z")
Can you help me? How can I draw the line that count2/count1 in this TSVB? --- ## [Index stays at massive size after split](https://discuss.elastic.co/t/index-stays-at-massive-size-after-split/283453)
**Author:** [@rcz](https://discuss.elastic.co/u/rcz)\ **Replies:** 5\ **Last updated:** [September 7, 2021, 8:50am UTC](https://discuss.elastic.co/t/index-stays-at-massive-size-after-split/283453 "2021-09-07T08:50:26Z")
Hi, I had mistakenly made a very large index: 1 shard of 406 GB (1.8b documents). Then I split it into 16 shards hoping to get ~25GB sizes. I think the new index triggered a template, since it also got 1 replica shard… --- ## [Client SSL and Server SSL - ES Java Client](https://discuss.elastic.co/t/client-ssl-and-server-ssl-es-java-client/283507)
**Author:** [@Muthukumaran\_Kothand](https://discuss.elastic.co/u/Muthukumaran_Kothand)\ **Replies:** 0\ **Last updated:** [September 7, 2021, 8:40am UTC](https://discuss.elastic.co/t/client-ssl-and-server-ssl-es-java-client/283507 "2021-09-07T08:40:59Z")
Initial excuse - we are still using TransportClient ( PreBuiltXPackTransportClient). Migrating to High Level Rest Client is in progress. This question would still be relevant for High Level Rest Client Meta: Elasticse… --- ## [Rate\_1min keeps dropping for my kafka to s3 batching on logstash](https://discuss.elastic.co/t/rate-1min-keeps-dropping-for-my-kafka-to-s3-batching-on-logstash/283508)
**Author:** [@Varsha1](https://discuss.elastic.co/u/Varsha1)\ **Replies:** 0\ **Last updated:** [September 7, 2021, 8:45am UTC](https://discuss.elastic.co/t/rate-1min-keeps-dropping-for-my-kafka-to-s3-batching-on-logstash/283508 "2021-09-07T08:45:22Z")
I'm trying to transfer data from kafka to s3, without any data transformation filters. I added metrics filter plugin to calculate the rate of transfer, which keeps falling from ~16k to as low as ~3k. Is this expected an… --- ## [Compare/Merge 2 type of dataset](https://discuss.elastic.co/t/compare-merge-2-type-of-dataset/282624)
**Author:** [@Peter\_Ch](https://discuss.elastic.co/u/Peter_Ch)\ **Replies:** 4\ **Last updated:** [September 7, 2021, 8:22am UTC](https://discuss.elastic.co/t/compare-merge-2-type-of-dataset/282624 "2021-09-07T08:22:37Z")
Dear All, I user winlogbeat to collet my window log which include username. And I have a csv file which contain the username and user department. May I know is it possible to compare those datasets username field, if th… --- ## [MIgrate ELK setup from cloud to on-prem](https://discuss.elastic.co/t/migrate-elk-setup-from-cloud-to-on-prem/283503)
**Author:** [@Bryce\_Fernandes](https://discuss.elastic.co/u/Bryce_Fernandes)\ **Replies:** 1\ **Last updated:** [September 7, 2021, 8:09am UTC](https://discuss.elastic.co/t/migrate-elk-setup-from-cloud-to-on-prem/283503 "2021-09-07T08:09:33Z")
Hi, I currently have elk setup on cloud and want to replicate it on onprem and remove cloud setup. I want to migrate development part like dashboards, index-patterns, users created etc. Will vm snapshot backup restore… --- ## [Logstash udp input listen on port 5044 but doesn't receive syslog messages](https://discuss.elastic.co/t/logstash-udp-input-listen-on-port-5044-but-doesnt-receive-syslog-messages/283496)
**Author:** [@kiran80511](https://discuss.elastic.co/u/kiran80511)\ **Replies:** 0\ **Last updated:** [September 7, 2021, 7:17am UTC](https://discuss.elastic.co/t/logstash-udp-input-listen-on-port-5044-but-doesnt-receive-syslog-messages/283496 "2021-09-07T07:17:57Z")
I have tried with this command tcpdump -vvv -A -i any port 5044 It receive the syslog messages 12:41:34.438831 IP (tos 0x0, ttl 128, id 37582, offset 0, flags \[none\], proto UDP (17), length 374) gateway.lxi-evntsv… --- ## [Search performance difference between from&size and search&after](https://discuss.elastic.co/t/search-performance-difference-between-from-size-and-search-after/283400)
**Author:** [@MarvinLiu](https://discuss.elastic.co/u/MarvinLiu)\ **Replies:** 6\ **Last updated:** [September 7, 2021, 7:16am UTC](https://discuss.elastic.co/t/search-performance-difference-between-from-size-and-search-after/283400 "2021-09-07T07:16:43Z")
There are hundreds of millions of documents in my index. When I search, I find that search&after is much slower than from&size。 Use from&size，search is quick，took several ms return，but use search after，it took 20 seconds… --- ## [Misplaced codec footer keystore](https://discuss.elastic.co/t/misplaced-codec-footer-keystore/283493)
**Author:** [@itslogesh](https://discuss.elastic.co/u/itslogesh)\ **Replies:** 1\ **Last updated:** [September 7, 2021, 6:59am UTC](https://discuss.elastic.co/t/misplaced-codec-footer-keystore/283493 "2021-09-07T06:59:12Z")
org.apache.lucene.index.CorruptIndexException: misplaced codec footer (file extended?): remaining=17, expected=16, fp=183 (resource=BufferedChecksumIndexInput(SimpleFSIndexInput(path="/etc/elasticsearch/elasticsearch.key… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=833) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=835)