# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1040 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1041 --- ## [Count of unique events](https://discuss.elastic.co/t/count-of-unique-events/265037)
**Author:** [@artobstrel](https://discuss.elastic.co/u/artobstrel)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 10:51am UTC](https://discuss.elastic.co/t/count-of-unique-events/265037 "2021-02-22T10:51:08Z")
I have 5000 unique events. If I try to unique count with default precision value, I get the wrong value: How can I calculate truly unique values without changing the precision? --- ## [How to filter date field by days and hours separately](https://discuss.elastic.co/t/how-to-filter-date-field-by-days-and-hours-separately/265046)
**Author:** [@Hi\_u\_Nguy\_n\_Dang](https://discuss.elastic.co/u/Hi_u_Nguy_n_Dang)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 10:40am UTC](https://discuss.elastic.co/t/how-to-filter-date-field-by-days-and-hours-separately/265046 "2021-02-22T10:40:58Z")
Hi, I want to create a query that returns all the data from last 30 days and only between 09:00 AM - 18:00 PM. My date field contains both the date and the time of the day (For example "time" : "2021-02-06T06:40:55Z"). … --- ## [Can't merge a non object mapping with an object mapping](https://discuss.elastic.co/t/cant-merge-a-non-object-mapping-with-an-object-mapping/264066)
**Author:** [@Infoxd](https://discuss.elastic.co/u/Infoxd)\ **Replies:** 2\ **Last updated:** [February 22, 2021, 10:25am UTC](https://discuss.elastic.co/t/cant-merge-a-non-object-mapping-with-an-object-mapping/264066 "2021-02-22T10:25:43Z")
Hello, When I'm trying to import this json: { "data": { "args": \["v7.0/4529900134935424/feed", { "limit": 100 }\] }, "@timestamp": "2021-02-11T11:07:02.189Z", "@version": "1" } I'm getting this error: can't… --- ## [Accessing field values in script processor](https://discuss.elastic.co/t/accessing-field-values-in-script-processor/265048)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 0\ **Last updated:** [February 22, 2021, 9:38am UTC](https://discuss.elastic.co/t/accessing-field-values-in-script-processor/265048 "2021-02-22T09:38:32Z")
Hi, I'm studding for the ECE and when reading about script processors to be used in ingestion pipelines I see in the documentation that in order to access the field value I should use the ctx variables You can access th… --- ## [Indices won't close](https://discuss.elastic.co/t/indices-wont-close/262254)
**Author:** [@JuddyBuddy77](https://discuss.elastic.co/u/JuddyBuddy77)\ **Replies:** 3\ **Last updated:** [February 22, 2021, 9:33am UTC](https://discuss.elastic.co/t/indices-wont-close/262254 "2021-02-22T09:33:48Z")
Hello, first post, still learning. Having an issue closing "random" indices, after removing replica shards and using shard allocation awareness. ES 6.8.3, although indices may have been created in ES 5 (I know). Remov… --- ## [Elasticsearch seach using wildcard, range and terms](https://discuss.elastic.co/t/elasticsearch-seach-using-wildcard-range-and-terms/264811)
**Author:** [@lalitesh](https://discuss.elastic.co/u/lalitesh)\ **Replies:** 2\ **Last updated:** [February 22, 2021, 9:28am UTC](https://discuss.elastic.co/t/elasticsearch-seach-using-wildcard-range-and-terms/264811 "2021-02-22T09:28:15Z")
I am trying to write a search DSL query on a Elasticsearch ( Version 7.1 ) index that has fields like, product\_name, exported\_at and category\_id. From the document I understand that I would need to use the wildcard, ran… --- ## [Way aren't Event details under security using the same query as you put in Elasticsearch indices](https://discuss.elastic.co/t/way-arent-event-details-under-security-using-the-same-query-as-you-put-in-elasticsearch-indices/265044)
**Author:** [@tellus83](https://discuss.elastic.co/u/tellus83)\ **Replies:** 0\ **Last updated:** [February 22, 2021, 9:04am UTC](https://discuss.elastic.co/t/way-arent-event-details-under-security-using-the-same-query-as-you-put-in-elasticsearch-indices/265044 "2021-02-22T09:04:01Z")
I have a soc-filebeat alias whit filter on filebeat-7.11.1-\* and use soc-\* for Elasticsearch indices in settings. And have created a user that have full access to soc-. All dashboards are OK under Security network and … --- ## [Logstash input plugin jdbc schedule issue on k8s](https://discuss.elastic.co/t/logstash-input-plugin-jdbc-schedule-issue-on-k8s/263535)
**Author:** [@Dongsheng\_XI](https://discuss.elastic.co/u/Dongsheng_XI)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 9:01am UTC](https://discuss.elastic.co/t/logstash-input-plugin-jdbc-schedule-issue-on-k8s/263535 "2021-02-22T09:01:14Z")
our team is using logstash to sync data between MySQL and ElasticSearch, I am following How to keep Elasticsearch synchronized with a relational database using Logstash and JDBC to set up my pipeline. when the logstash i… --- ## [Aggregation bucket sum + max group by time with filtering](https://discuss.elastic.co/t/aggregation-bucket-sum-max-group-by-time-with-filtering/264718)
**Author:** [@Tim4](https://discuss.elastic.co/u/Tim4)\ **Replies:** 2\ **Last updated:** [February 22, 2021, 8:14am UTC](https://discuss.elastic.co/t/aggregation-bucket-sum-max-group-by-time-with-filtering/264718 "2021-02-22T08:14:23Z")
Hi, I'm in need of some help. Let's start of with some sample data: Datetime \_\_\_\_\_\_\_\_\_\_\_\_| User | Mbps 18/02/2021 12:00:00 | a \_\_\_ | 10 18/02/2021 12:00:00 | b \_\_\_ | 5 18/02/2021 12:20:00 | a … --- ## [Elasticsearch bulk operation: insert if not existing, otherwise update or add a nested element](https://discuss.elastic.co/t/elasticsearch-bulk-operation-insert-if-not-existing-otherwise-update-or-add-a-nested-element/265034)
**Author:** [@corlee](https://discuss.elastic.co/u/corlee)\ **Replies:** 0\ **Last updated:** [February 22, 2021, 7:50am UTC](https://discuss.elastic.co/t/elasticsearch-bulk-operation-insert-if-not-existing-otherwise-update-or-add-a-nested-element/265034 "2021-02-22T07:50:24Z")
In elasticsearch 7.11.0 I have products as described. { "\_index" : "products", "\_type" : "\_doc", "\_id" : "1234567890123", "\_source" : { "ean" : "1234567890123", "title" : "Very nice product", "mercha… --- ## [Quickstart Deploy an Elasticsearch cluster get stuck in unknown Health & ApplyingChanges Phase](https://discuss.elastic.co/t/quickstart-deploy-an-elasticsearch-cluster-get-stuck-in-unknown-health-applyingchanges-phase/264791)
**Author:** [@scollector65](https://discuss.elastic.co/u/scollector65)\ **Replies:** 2\ **Last updated:** [February 22, 2021, 7:21am UTC](https://discuss.elastic.co/t/quickstart-deploy-an-elasticsearch-cluster-get-stuck-in-unknown-health-applyingchanges-phase/264791 "2021-02-22T07:21:14Z")
I just started ECK and I try Quickstart docs. https://www.elastic.co/guide/en/cloud-on-k8s/1.4/k8s-deploy-eck.html https://www.elastic.co/guide/en/cloud-on-k8s/1.4/k8s-deploy-elasticsearch.html but my elasticsearch ge… --- ## [Create search request from available json unit test](https://discuss.elastic.co/t/create-search-request-from-available-json-unit-test/264952)
**Author:** [@Rohit\_Sharma](https://discuss.elastic.co/u/Rohit_Sharma)\ **Replies:** 3\ **Last updated:** [February 22, 2021, 6:58am UTC](https://discuss.elastic.co/t/create-search-request-from-available-json-unit-test/264952 "2021-02-22T06:58:27Z")
Hi, I'm new to elastic search. I need to write unit test where I need to create search request object and search response object. I have search response and search request available in JSON. My search request contain… --- ## [Is Xpack related to "master\_not\_discovered\_exception"? 503](https://discuss.elastic.co/t/is-xpack-related-to-master-not-discovered-exception-503/264539)
**Author:** [@rojin](https://discuss.elastic.co/u/rojin)\ **Replies:** 4\ **Last updated:** [February 22, 2021, 6:48am UTC](https://discuss.elastic.co/t/is-xpack-related-to-master-not-discovered-exception-503/264539 "2021-02-22T06:48:01Z")
Hello everyone! I have a single-node cluster running which I have enabled the Xpack security on. I'd like to add a node to this cluster, but I get "master\_not\_discovered\_exception". I have set the discovery.seed\_hosts as… --- ## [Kibana to access data from multiple Elastic Search Clusters](https://discuss.elastic.co/t/kibana-to-access-data-from-multiple-elastic-search-clusters/265027)
**Author:** [@Sudarshan\_Reddy](https://discuss.elastic.co/u/Sudarshan_Reddy)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 5:28am UTC](https://discuss.elastic.co/t/kibana-to-access-data-from-multiple-elastic-search-clusters/265027 "2021-02-22T05:28:41Z")
Hi, we are building dashboard for test results . Same test cases execute in multiple k8s clusters ( we organized as devus1, qaus1, produs1,prodeu1 ,prodanz1 ) . each environment we have seperate elastic search instance r… --- ## [How to enable shards allocation of node that was disabled the shards allocation](https://discuss.elastic.co/t/how-to-enable-shards-allocation-of-node-that-was-disabled-the-shards-allocation/264790)
**Author:** [@testsemd\_email](https://discuss.elastic.co/u/testsemd_email)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 5:23am UTC](https://discuss.elastic.co/t/how-to-enable-shards-allocation-of-node-that-was-disabled-the-shards-allocation/264790 "2021-02-22T05:23:03Z")
I disabled shards allocation using curl -XPUT “http://username:password@host:port/\_cluster/settings” -d '{ "transient" :{ "cluster.routing.allocation.exclude.\_ip" : "X.X.X.X" } }' command. Then again enabled usin… --- ## [How i can store field in kibana](https://discuss.elastic.co/t/how-i-can-store-field-in-kibana/263950)
**Author:** [@Nazakat](https://discuss.elastic.co/u/Nazakat)\ **Replies:** 4\ **Last updated:** [February 22, 2021, 4:41am UTC](https://discuss.elastic.co/t/how-i-can-store-field-in-kibana/263950 "2021-02-22T04:41:51Z")
How i can store field in kibana? --- ## [Elastic node not connecting to master](https://discuss.elastic.co/t/elastic-node-not-connecting-to-master/265026)
**Author:** [@jelbatn](https://discuss.elastic.co/u/jelbatn)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 4:26am UTC](https://discuss.elastic.co/t/elastic-node-not-connecting-to-master/265026 "2021-02-22T04:26:08Z")
I have the following configuration for a multi node elastic cluster. both nodes are running part of a docker swarm. here is the docker yaml config elasticsearch: image: {imagerepo}/elasticsearch:0.0.7-6892bb5 … --- ## [Does Index/Shard size affects the performance of search/insert/update query?](https://discuss.elastic.co/t/does-index-shard-size-affects-the-performance-of-search-insert-update-query/264878)
**Author:** [@Nikunj210903](https://discuss.elastic.co/u/Nikunj210903)\ **Replies:** 2\ **Last updated:** [February 22, 2021, 3:59am UTC](https://discuss.elastic.co/t/does-index-shard-size-affects-the-performance-of-search-insert-update-query/264878 "2021-02-22T03:59:07Z")
Does Index/Shard size affects the performance of search/create/update query? So suppose I have 2 indexes. In one index I have 2 GB data and in another index I have 10 GB data. If I fire same search/insert/update query on… --- ## [In rollover, Is it possible to update the document of old indexes?](https://discuss.elastic.co/t/in-rollover-is-it-possible-to-update-the-document-of-old-indexes/264512)
**Author:** [@Nikunj210903](https://discuss.elastic.co/u/Nikunj210903)\ **Replies:** 16\ **Last updated:** [February 22, 2021, 3:57am UTC](https://discuss.elastic.co/t/in-rollover-is-it-possible-to-update-the-document-of-old-indexes/264512 "2021-02-22T03:57:41Z")
Hello community.I have implemented rollover feature of elastic search. It will create a new index every day. Below is my question Is it possible to update the document of old indexes ? I have read somewhere that old in… --- ## [Elasticsearch cluster performance degradation](https://discuss.elastic.co/t/elasticsearch-cluster-performance-degradation/264915)
**Author:** [@mario12](https://discuss.elastic.co/u/mario12)\ **Replies:** 5\ **Last updated:** [February 22, 2021, 2:37am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-performance-degradation/264915 "2021-02-22T02:37:01Z")
We had a performance degradation for 5-10 minutes intervals. We looked into our monitoring tool and found there was high CPU utilization on the elasticsearch cluster. During this time we also noticed high fetch requests … --- ## [Jre crash after running for days or hours](https://discuss.elastic.co/t/jre-crash-after-running-for-days-or-hours/262439)
**Author:** [@billhong-just](https://discuss.elastic.co/u/billhong-just)\ **Replies:** 8\ **Last updated:** [February 22, 2021, 1:19am UTC](https://discuss.elastic.co/t/jre-crash-after-running-for-days-or-hours/262439 "2021-02-22T01:19:19Z")
Hi community, My single node elasticsearch cluster crashed after running for days or hours. And here are relevant information and logs. Elasticsearch version (bin/elasticsearch --version): 7.10.2 Plugins installed: I… --- ## [Logstash conditional output](https://discuss.elastic.co/t/logstash-conditional-output/264826)
**Author:** [@petegriggs](https://discuss.elastic.co/u/petegriggs)\ **Replies:** 6\ **Last updated:** [February 22, 2021, 12:54am UTC](https://discuss.elastic.co/t/logstash-conditional-output/264826 "2021-02-22T00:54:11Z")
Hello, Looking to use logstash to host multiple syslog listeners to start to aggregate logs from different vendors and then forward on for now to another syslog server. The question is whether we can set the syslog out… --- ## [Cluster rebalancing parameters](https://discuss.elastic.co/t/cluster-rebalancing-parameters/264868)
**Author:** [@gorek](https://discuss.elastic.co/u/gorek)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 12:47am UTC](https://discuss.elastic.co/t/cluster-rebalancing-parameters/264868 "2021-02-22T00:47:23Z")
Currently we have one-node-cluster. This node has high heap usage (from time to time we even see "circuit breaking exception") and high disk usage (currently over high disk watermark value) because it keep lots of indice… --- ## [Kibana has stopped](https://discuss.elastic.co/t/kibana-has-stopped/264882)
**Author:** [@Prabhath\_samarasingh](https://discuss.elastic.co/u/Prabhath_samarasingh)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 12:44am UTC](https://discuss.elastic.co/t/kibana-has-stopped/264882 "2021-02-22T00:44:19Z")
Hi, I'm very new to elk and configured stack.Work fine. So I ship my syslog data to stack and now kibana stops. Stack run on Ubunto 20.04 AMD 64 server. cat /var/log/elasticsearch/elasticsearch.log \[2021-02-19T21:29… --- ## [Summing Timeseries](https://discuss.elastic.co/t/summing-timeseries/264883)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 12:42am UTC](https://discuss.elastic.co/t/summing-timeseries/264883 "2021-02-22T00:42:55Z")
Hi, How, in an aggregation, can I sum or do any other calculation across more than one timeseries? Thx D --- ## [Kibana now supports ARM64, but ECK Kibana fails](https://discuss.elastic.co/t/kibana-now-supports-arm64-but-eck-kibana-fails/264904)
**Author:** [@simonpg](https://discuss.elastic.co/u/simonpg)\ **Replies:** 3\ **Last updated:** [February 22, 2021, 12:16am UTC](https://discuss.elastic.co/t/kibana-now-supports-arm64-but-eck-kibana-fails/264904 "2021-02-22T00:16:23Z")
I have elastic search running fine on my ARM64 five node k3s cluster. :smiley: I have moved on to kibana. The status of the kibana pod is Init:CrashLoopBackOff. :face\_with\_raised\_eyebrow: logging the elastic-internal-… --- ## [Kibana 7.11 Legacy GUI](https://discuss.elastic.co/t/kibana-7-11-legacy-gui/265009)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 2\ **Last updated:** [February 21, 2021, 9:46pm UTC](https://discuss.elastic.co/t/kibana-7-11-legacy-gui/265009 "2021-02-21T21:46:53Z")
Any way to change the UI to Legacy in 7.11? I don't like the big black bar at the top, we embed Kibana in our client portal and now the clients see 3 bars, it's too much. --- ## [Why does it have duplicate ID with normal logstash output and fingerprint filter?](https://discuss.elastic.co/t/why-does-it-have-duplicate-id-with-normal-logstash-output-and-fingerprint-filter/264931)
**Author:** [@Bo\_Pham\_Nguyen](https://discuss.elastic.co/u/Bo_Pham_Nguyen)\ **Replies:** 1\ **Last updated:** [February 21, 2021, 9:47pm UTC](https://discuss.elastic.co/t/why-does-it-have-duplicate-id-with-normal-logstash-output-and-fingerprint-filter/264931 "2021-02-21T21:47:43Z")
Hi team, This is my logstash config to get data, and I use fingerprint as \_id in order to prevent duplication from data. But it still has duplicated event as below. Any help? filter { if \[type\] == "cve" { … --- ## [Elastic search using more RAM and not release](https://discuss.elastic.co/t/elastic-search-using-more-ram-and-not-release/264928)
**Author:** [@xgx](https://discuss.elastic.co/u/xgx)\ **Replies:** 1\ **Last updated:** [February 21, 2021, 9:45pm UTC](https://discuss.elastic.co/t/elastic-search-using-more-ram-and-not-release/264928 "2021-02-21T21:45:52Z")
Hi, I have a problem with elastic search uses a lot of os memory (non buff / cache).Here are some details： 1.I am using a 64 GB Ram machine . 2.I have allocated 26gb as ES heap size. 3.only elasticsearch service runn… --- ## [Can you export the data from a bar chart into a csv?](https://discuss.elastic.co/t/can-you-export-the-data-from-a-bar-chart-into-a-csv/265007)
**Author:** [@Amphagory](https://discuss.elastic.co/u/Amphagory)\ **Replies:** 1\ **Last updated:** [February 21, 2021, 9:44pm UTC](https://discuss.elastic.co/t/can-you-export-the-data-from-a-bar-chart-into-a-csv/265007 "2021-02-21T21:44:11Z")
Like tables visuals, I was hoping there would be a nice link in the bar chart visual to down the data to CSV. Any thought how I can download the data for a char chart? Ideally a link in the visual would be preferred. M… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1039) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1041)