# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=875 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 876 --- ## [Aggregation Pagination](https://discuss.elastic.co/t/aggregation-pagination/279444)
**Author:** [@raonic](https://discuss.elastic.co/u/raonic)\ **Replies:** 0\ **Last updated:** [July 23, 2021, 4:07am UTC](https://discuss.elastic.co/t/aggregation-pagination/279444 "2021-07-23T04:07:53Z")
Hello, I am using ElasticSearch aggregations to group results. More specifically, I am using a composite aggregation at the top level and then using a bucket selector sub-aggregation to determine what buckets are to be … --- ## [Loosing logs with logstash-trasnfer protocol](https://discuss.elastic.co/t/loosing-logs-with-logstash-trasnfer-protocol/279439)
**Author:** [@Francisco\_Yanez](https://discuss.elastic.co/u/Francisco_Yanez)\ **Replies:** 0\ **Last updated:** [July 23, 2021, 3:09am UTC](https://discuss.elastic.co/t/loosing-logs-with-logstash-trasnfer-protocol/279439 "2021-07-23T03:09:34Z")
I recently realized that our replication between our clusters is broken. we loose logs every minute (not a lot but we are loosing data). The way we replicate from master to slave is with Logstash-transfer. I tried to imp… --- ## [Execute reindex and the task is not found](https://discuss.elastic.co/t/execute-reindex-and-the-task-is-not-found/279414)
**Author:** [@asasas234](https://discuss.elastic.co/u/asasas234)\ **Replies:** 4\ **Last updated:** [July 23, 2021, 2:40am UTC](https://discuss.elastic.co/t/execute-reindex-and-the-task-is-not-found/279414 "2021-07-23T02:40:37Z")
First I execute the reindex POST \_reindex?wait\_for\_completion=false { "conflicts": "proceed", "source": { "index": "wh\_crm\_student\_order\_2020.11.09" }, "dest": { "index": "wh\_crm\_student\_order\_new\_2020.1… --- ## [How to show timestamp difference between max and min in data table](https://discuss.elastic.co/t/how-to-show-timestamp-difference-between-max-and-min-in-data-table/279347)
**Author:** [@byun618](https://discuss.elastic.co/u/byun618)\ **Replies:** 0\ **Last updated:** [July 22, 2021, 6:51am UTC](https://discuss.elastic.co/t/how-to-show-timestamp-difference-between-max-and-min-in-data-table/279347 "2021-07-22T06:51:41Z")
hello everyone i did show max timestamp and min stamp of each orderId. i want to show difference of them. i did in dev tools with this query. GET /toss-v2-confirmed-confirm\_response/\_search { "aggs": { "grou… --- ## [Unable To Access Kibana After Enabling Security](https://discuss.elastic.co/t/unable-to-access-kibana-after-enabling-security/279323)
**Author:** [@Jared9922](https://discuss.elastic.co/u/Jared9922)\ **Replies:** 17\ **Last updated:** [July 22, 2021, 11:36pm UTC](https://discuss.elastic.co/t/unable-to-access-kibana-after-enabling-security/279323 "2021-07-22T23:36:24Z")
Hello, I am currently trying to setup detection and monitoring for my self hosted Elasticstack. I have been following the guidelines found in this tutorial: Detections prerequisites and requirements | Elastic Security S… --- ## [How to disable JSON parser](https://discuss.elastic.co/t/how-to-disable-json-parser/279336)
**Author:** [@maxim.mokhov](https://discuss.elastic.co/u/maxim.mokhov)\ **Replies:** 2\ **Last updated:** [July 22, 2021, 11:22pm UTC](https://discuss.elastic.co/t/how-to-disable-json-parser/279336 "2021-07-22T23:22:37Z")
I have different logs from applications, and I want sent it to elasticsearch. In some cases in logs appear JSON. I want to send it in elasticsearch as plaintext. But in log logstash I see "JSON parse failure": \[2021-07… --- ## [How to use kafka output plugin with OAUTH authentication](https://discuss.elastic.co/t/how-to-use-kafka-output-plugin-with-oauth-authentication/279427)
**Author:** [@burkeg](https://discuss.elastic.co/u/burkeg)\ **Replies:** 0\ **Last updated:** [July 22, 2021, 9:26pm UTC](https://discuss.elastic.co/t/how-to-use-kafka-output-plugin-with-oauth-authentication/279427 "2021-07-22T21:26:44Z")
How do i configure custom login call back handler with kafka output plugin? I'm using oauth authentication to my broker and not sure how to configure. Any leads/suggestions will be helpful --- ## [How to pass urlparam value to KQL](https://discuss.elastic.co/t/how-to-pass-urlparam-value-to-kql/279172)
**Author:** [@tangkalo](https://discuss.elastic.co/u/tangkalo)\ **Replies:** 10\ **Last updated:** [July 22, 2021, 9:01pm UTC](https://discuss.elastic.co/t/how-to-pass-urlparam-value-to-kql/279172 "2021-07-22T21:01:52Z")
Hi, I read about threads related to this need and know that there is currently not a way to directly plug in the value in the KQL using urlparam; however, is there a way to do it indirectly? I am thinking about using var… --- ## [Как донастроить визуализацию, помогите, плиз](https://discuss.elastic.co/t/topic/279247)
**Author:** [@Evgen](https://discuss.elastic.co/u/Evgen)\ **Replies:** 3\ **Last updated:** [July 22, 2021, 8:21pm UTC](https://discuss.elastic.co/t/topic/279247 "2021-07-22T20:21:29Z")
всем привет, помогите визуализировать данные, плиз. Вроде сделал, но чет не могу понять, как дошлифовать отображение. Я отправляю в Elastic много Событий. Каждое Событие содержит: время старта события в виде Long, … --- ## [Same config file for test and development](https://discuss.elastic.co/t/same-config-file-for-test-and-development/279263)
**Author:** [@Loulou](https://discuss.elastic.co/u/Loulou)\ **Replies:** 6\ **Last updated:** [July 22, 2021, 8:15pm UTC](https://discuss.elastic.co/t/same-config-file-for-test-and-development/279263 "2021-07-22T20:15:50Z")
Hi, What I am trying to do is having the same logstash.conf file for my test and deployment/shipping. However for testing I want the output to go to my local elastic search, and for deployment to a http address. I trie… --- ## [How can I pass field reference in ruby filter while constructing a big string](https://discuss.elastic.co/t/how-can-i-pass-field-reference-in-ruby-filter-while-constructing-a-big-string/279419)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 7:16pm UTC](https://discuss.elastic.co/t/how-can-i-pass-field-reference-in-ruby-filter-while-constructing-a-big-string/279419 "2021-07-22T19:16:10Z")
I would want to construct a sentence having multiple dynamic values, for example ruby { code =\> ' my\_object = { "reason" =\> "I received event.get("baseValueUnitAmount") event.get("currency") having di… --- ## [Updating kibana plugin to 7.13.3](https://discuss.elastic.co/t/updating-kibana-plugin-to-7-13-3/279081)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 3\ **Last updated:** [July 22, 2021, 5:33pm UTC](https://discuss.elastic.co/t/updating-kibana-plugin-to-7-13-3/279081 "2021-07-22T17:33:41Z")
Hello all, First of all, I would like to thank this platform and all the volunteers for helping me getting to know Elasticstack and work with it. My question is, I have a kibana custom plugin that I am using with ver… --- ## [Slack notifications timing out](https://discuss.elastic.co/t/slack-notifications-timing-out/279366)
**Author:** [@pup\_seba](https://discuss.elastic.co/u/pup_seba)\ **Replies:** 5\ **Last updated:** [July 22, 2021, 5:10pm UTC](https://discuss.elastic.co/t/slack-notifications-timing-out/279366 "2021-07-22T17:10:44Z")
Hi, We are trying to enable the posibility to send slack messages when a condition is met, by using "Alerts and Actions". We configured the keystore with slack accounts but when testing the slack connector it fails and… --- ## [Split the field and add the fields dynamically in ingest pipeline](https://discuss.elastic.co/t/split-the-field-and-add-the-fields-dynamically-in-ingest-pipeline/279416)
**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\ **Replies:** 0\ **Last updated:** [July 22, 2021, 4:57pm UTC](https://discuss.elastic.co/t/split-the-field-and-add-the-fields-dynamically-in-ingest-pipeline/279416 "2021-07-22T16:57:12Z")
Hi Team, We have scenario like audio files field with the values as path1,path2,path3 ( the number of paths are dynamic), In ingest pipeline need to split this field and create audio1 =path1, audio2=path2, audio3=path3… --- ## [ElasticSearch - Match or less](https://discuss.elastic.co/t/elasticsearch-match-or-less/279341)
**Author:** [@zhadad](https://discuss.elastic.co/u/zhadad)\ **Replies:** 2\ **Last updated:** [July 22, 2021, 4:05pm UTC](https://discuss.elastic.co/t/elasticsearch-match-or-less/279341 "2021-07-22T16:05:25Z")
is there an way to query the following using elasticsearch (version 2) : indexed documents examples : {\_id=1 , "tags": \[ "t1"\]} {\_id=2 , "tags": \[ "t1", "t2" \]} {\_id=3 , "tags": \[ "t1", "t2", "t3" \]} The followin… --- ## [Logstash mutate add field not showing the added field](https://discuss.elastic.co/t/logstash-mutate-add-field-not-showing-the-added-field/279385)
**Author:** [@Hamza\_El\_Aouane](https://discuss.elastic.co/u/Hamza_El_Aouane)\ **Replies:** 3\ **Last updated:** [July 22, 2021, 3:55pm UTC](https://discuss.elastic.co/t/logstash-mutate-add-field-not-showing-the-added-field/279385 "2021-07-22T15:55:51Z")
Hello guys. I am testing some functionalities of logstash but I am a bit confused about the process of implementing a filter mutate. Just for testing purpose I have a kiwi syslog generating random logs. Those logs have… --- ## [Job for elasticsearch.service failed because the control process exited with error code. See "systemctl status elasticsearch.service" and "journalctl -xe" for details](https://discuss.elastic.co/t/job-for-elasticsearch-service-failed-because-the-control-process-exited-with-error-code-see-systemctl-status-elasticsearch-service-and-journalctl-xe-for-details/279405)
**Author:** [@scriptdil](https://discuss.elastic.co/u/scriptdil)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 3:51pm UTC](https://discuss.elastic.co/t/job-for-elasticsearch-service-failed-because-the-control-process-exited-with-error-code-see-systemctl-status-elasticsearch-service-and-journalctl-xe-for-details/279405 "2021-07-22T15:51:37Z")
Hi i am new here. I have been trying to install Elastic search on a second server without success. I cant figure out what is wrong Error Message: Job for elasticsearch.service failed because the control process exited … --- ## [Kibana not starting fatal error is coming up](https://discuss.elastic.co/t/kibana-not-starting-fatal-error-is-coming-up/279390)
**Author:** [@0d153a83fd88577dba87](https://discuss.elastic.co/u/0d153a83fd88577dba87)\ **Replies:** 4\ **Last updated:** [July 22, 2021, 3:38pm UTC](https://discuss.elastic.co/t/kibana-not-starting-fatal-error-is-coming-up/279390 "2021-07-22T15:38:03Z")
log \[15:12:03.239\] \[fatal\]\[root\] Error: Cannot find module '../../../task\_manager/server' Require stack: - /etc/default/kibana-7.13.0-linux-x86\_64/x-pack/plugins/actions/server/cleanup\_failed\_executions/ensure\_schedule… --- ## [Float value is matched as integer](https://discuss.elastic.co/t/float-value-is-matched-as-integer/279406)
**Author:** [@Leuteris](https://discuss.elastic.co/u/Leuteris)\ **Replies:** 0\ **Last updated:** [July 22, 2021, 3:22pm UTC](https://discuss.elastic.co/t/float-value-is-matched-as-integer/279406 "2021-07-22T15:22:07Z")
I've indexed the following document: { "\_index": "index\_name", "\_type": "\_doc", "\_id": "ePvEB-X7TNSfKMdwxOcGTw", "\_score": 1.0, "\_source"… --- ## [Boosting per field and index when searching multiple indexes](https://discuss.elastic.co/t/boosting-per-field-and-index-when-searching-multiple-indexes/279287)
**Author:** [@bsharma](https://discuss.elastic.co/u/bsharma)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 3:09pm UTC](https://discuss.elastic.co/t/boosting-per-field-and-index-when-searching-multiple-indexes/279287 "2021-07-22T15:09:27Z")
I am searching multiple indexes. I want to be able to boost specific fields of specific indexes. I could not find a way to specify boost for a field of a index. I found examples in documentation where boosts are specifie… --- ## [Elasticsearch lookup email from different index](https://discuss.elastic.co/t/elasticsearch-lookup-email-from-different-index/279302)
**Author:** [@Jathin](https://discuss.elastic.co/u/Jathin)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 3:03pm UTC](https://discuss.elastic.co/t/elasticsearch-lookup-email-from-different-index/279302 "2021-07-22T15:03:38Z")
PUT audit/doc { "userid": "some\_guid", "operation": "performed action a" } PUT audit/doc { "userid": "some\_guid", "operation": "performed action b" } PUT audit/doc { "userid": "some\_guid", "operation": "performed action… --- ## [Lumberjack vs TCP for encrypted and compressed communication between logstash instances](https://discuss.elastic.co/t/lumberjack-vs-tcp-for-encrypted-and-compressed-communication-between-logstash-instances/279400)
**Author:** [@Akshay\_Sarvankar](https://discuss.elastic.co/u/Akshay_Sarvankar)\ **Replies:** 0\ **Last updated:** [July 22, 2021, 2:54pm UTC](https://discuss.elastic.co/t/lumberjack-vs-tcp-for-encrypted-and-compressed-communication-between-logstash-instances/279400 "2021-07-22T14:54:06Z")
Hi All, We have implemented Logstash to Logstash communication using TCP output and input in source and destination logstash instances. This communication is encrypted with SSL certificate. As per elastic documention, … --- ## [Best way to parse response from /\_nodes/stats API using java](https://discuss.elastic.co/t/best-way-to-parse-response-from-nodes-stats-api-using-java/279356)
**Author:** [@Praveen\_Atluri](https://discuss.elastic.co/u/Praveen_Atluri)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 2:53pm UTC](https://discuss.elastic.co/t/best-way-to-parse-response-from-nodes-stats-api-using-java/279356 "2021-07-22T14:53:00Z")
I am trying to write a java program which frequently calls the /\_nodes/stats endpoint and other metrics endpoints and plot them. What is the best way to parse the output from above endpoints and extract specific data fro… --- ## [Applying a filter to the last x nested documents in the selected period, to find if one of them match a condition](https://discuss.elastic.co/t/applying-a-filter-to-the-last-x-nested-documents-in-the-selected-period-to-find-if-one-of-them-match-a-condition/279399)
**Author:** [@ChqThomas](https://discuss.elastic.co/u/ChqThomas)\ **Replies:** 0\ **Last updated:** [July 22, 2021, 2:48pm UTC](https://discuss.elastic.co/t/applying-a-filter-to-the-last-x-nested-documents-in-the-selected-period-to-find-if-one-of-them-match-a-condition/279399 "2021-07-22T14:48:40Z")
Hi, I'm trying to retrieve the number of users who bought the product "123" at least once in their last three sales in the selected period. With this data structure : mapping : { "properties": { "user\_id": { … --- ## [Filter Script with array](https://discuss.elastic.co/t/filter-script-with-array/279190)
**Author:** [@hdlinh1808](https://discuss.elastic.co/u/hdlinh1808)\ **Replies:** 3\ **Last updated:** [July 22, 2021, 2:29pm UTC](https://discuss.elastic.co/t/filter-script-with-array/279190 "2021-07-22T14:29:42Z")
Hi everyone, I have a question about filter script for array in ES I have documents or schema like this: { "name": "linh", "array": \[ { "ts": 1, … --- ## [\_search filter data: is possible to do this?](https://discuss.elastic.co/t/search-filter-data-is-possible-to-do-this/279387)
**Author:** [@Marcsu](https://discuss.elastic.co/u/Marcsu)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 2:27pm UTC](https://discuss.elastic.co/t/search-filter-data-is-possible-to-do-this/279387 "2021-07-22T14:27:57Z")
Hi, I'm trying to return only content that do match with a specific field value and not return the rest data of document... I mean, I try to realize a filter over data of document. I'm new in ES. Some idea to do that… --- ## [Get The id of the ES document created by FSCrawler](https://discuss.elastic.co/t/get-the-id-of-the-es-document-created-by-fscrawler/278939)
**Author:** [@Francois\_Saab](https://discuss.elastic.co/u/Francois_Saab)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 2:20pm UTC](https://discuss.elastic.co/t/get-the-id-of-the-es-document-created-by-fscrawler/278939 "2021-07-22T14:20:57Z")
When FSCrawler sends a document to ES, i need to associate the \_id of the doc created by FSCrawler with an internal ID in our DB. How to get the \_id of the doc created by FSCrawler each time a new document is being inde… --- ## [Send splunk log using logstash](https://discuss.elastic.co/t/send-splunk-log-using-logstash/279376)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 2\ **Last updated:** [July 22, 2021, 2:05pm UTC](https://discuss.elastic.co/t/send-splunk-log-using-logstash/279376 "2021-07-22T14:05:16Z")
hi eeveryone, i have a splunk server, and i want to migrate splunk's log using logstash to my elasticsearch's server. is it possible? and how it is? --- ## [Advantages of using redis](https://discuss.elastic.co/t/advantages-of-using-redis/279216)
**Author:** [@111387](https://discuss.elastic.co/u/111387)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 1:58pm UTC](https://discuss.elastic.co/t/advantages-of-using-redis/279216 "2021-07-22T13:58:49Z")
Look at some documentation when building the ELK. Sometimes install Redis in front of Logstash. Even though Logstash provides a buffer, is there any advantage to installing Logstash in front? If Redis is present but n… --- ## [Unable to use TSVB visualization even after specifying index](https://discuss.elastic.co/t/unable-to-use-tsvb-visualization-even-after-specifying-index/279311)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 5\ **Last updated:** [July 22, 2021, 1:47pm UTC](https://discuss.elastic.co/t/unable-to-use-tsvb-visualization-even-after-specifying-index/279311 "2021-07-22T13:47:19Z")
I'm trying out TSVB viz on kibana, and the visualization doesnt work as expected . Are there any rules to creating a TSVB viz ? like use a particular date format or visualize only a certain data pattern ? [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=874) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=876)