# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1179 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1180 --- ## [LOSING OUTPUT DELETE TAKES HOURS](https://discuss.elastic.co/t/losing-output-delete-takes-hours/253305)
**Author:** [@Daniel\_Lopez](https://discuss.elastic.co/u/Daniel_Lopez)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 12:37pm UTC](https://discuss.elastic.co/t/losing-output-delete-takes-hours/253305 "2020-10-26T12:37:06Z")
HI to all I will try to explain this issue: I have these lines in log 08:41:39.691 new resources port:6215 trunk:1 08:41:40.128 Release resources port:6215 The First line is index at 08:46, so late i think, but wit… --- ## [Count of each API in a different table](https://discuss.elastic.co/t/count-of-each-api-in-a-different-table/253302)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 1\ **Last updated:** [October 26, 2020, 12:28pm UTC](https://discuss.elastic.co/t/count-of-each-api-in-a-different-table/253302 "2020-10-26T12:28:24Z")
Hi All, We need to create a table where we can store daily counts of all the apis. We actually keep data of around 1 month in ELK but will be needing count details for around an year for analysis. Is there a way to do … --- ## [Grok parser date processor problem](https://discuss.elastic.co/t/grok-parser-date-processor-problem/253207)
**Author:** [@gizem](https://discuss.elastic.co/u/gizem)\ **Replies:** 4\ **Last updated:** [October 26, 2020, 12:23pm UTC](https://discuss.elastic.co/t/grok-parser-date-processor-problem/253207 "2020-10-26T12:23:04Z")
Hi, I have the grok parser below: { "description": "pipeline", "processors": \[ { "grok": { "if": "ctx.message.contains('LOG1')", "field": "message", "patterns": \[ "\\\\\[%{G… --- ## [Dataset of IP's to query against Index](https://discuss.elastic.co/t/dataset-of-ips-to-query-against-index/253056)
**Author:** [@MichaelHuff](https://discuss.elastic.co/u/MichaelHuff)\ **Replies:** 3\ **Last updated:** [October 26, 2020, 12:22pm UTC](https://discuss.elastic.co/t/dataset-of-ips-to-query-against-index/253056 "2020-10-26T12:22:19Z")
I have a data set of around 40k of IP Addresses that are known bad IP's. I am wanting to query that data set against an index in my stack. When I query the data I wanna bring back any specific username that has had a suc… --- ## [ES aggregation query](https://discuss.elastic.co/t/es-aggregation-query/253284)
**Author:** [@niraj\_pandey](https://discuss.elastic.co/u/niraj_pandey)\ **Replies:** 4\ **Last updated:** [October 26, 2020, 12:05pm UTC](https://discuss.elastic.co/t/es-aggregation-query/253284 "2020-10-26T12:05:22Z")
I am running a huge aggregation query and getting the following error. This aggregation creates too many buckets (10001) and will throw an error in future versions. You should update the \[search.max\_buckets\] cluster set… --- ## [How to give priority to exact search in multiple should match?](https://discuss.elastic.co/t/how-to-give-priority-to-exact-search-in-multiple-should-match/253300)
**Author:** [@darshan\_ambre](https://discuss.elastic.co/u/darshan_ambre)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 11:54am UTC](https://discuss.elastic.co/t/how-to-give-priority-to-exact-search-in-multiple-should-match/253300 "2020-10-26T11:54:57Z")
How to return only exact match if exists else perform wildcard search. for e.g. for the below given set of data \[ { "\_index" : "priority\_test", "\_type" : "\_doc", "\_id" : "3IkeZHUBYJCjRl… --- ## [CircuitBreakingException: \[parent\] Data too large](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large/253299)
**Author:** [@Grant\_Zietsman](https://discuss.elastic.co/u/Grant_Zietsman)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 11:28am UTC](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large/253299 "2020-10-26T11:28:49Z")
Running into a CircuitBreakingException when doing a restore for Elasticsearch 7.7.1 Based on this issue, I suspect that I can try disabling indices.breaker.total.use\_real\_memory. Alternatively, I can try reducing CMSIn… --- ## [Elasticsearch dead but pid file exists](https://discuss.elastic.co/t/elasticsearch-dead-but-pid-file-exists/252684)
**Author:** [@muthug](https://discuss.elastic.co/u/muthug)\ **Replies:** 3\ **Last updated:** [October 26, 2020, 11:19am UTC](https://discuss.elastic.co/t/elasticsearch-dead-but-pid-file-exists/252684 "2020-10-26T11:19:39Z")
Why it is happening very frequently? is there any thing crashed ? i have removed the dead file from /var/lock/subsys but again and again i am getting this. Elasticsearch dead but pid file exists --- ## [RDP from Internet rule triggering on bogon ip address](https://discuss.elastic.co/t/rdp-from-internet-rule-triggering-on-bogon-ip-address/253269)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [October 26, 2020, 10:53am UTC](https://discuss.elastic.co/t/rdp-from-internet-rule-triggering-on-bogon-ip-address/253269 "2020-10-26T10:53:32Z")
Hello, Noticed the SIEM rule" RDP (Remote Desktop Protocol) from the Internet" triggered on source.ip: "169.254.231.41" which is a bogon link-local address. So this should not be considered as "from the Internet" and… --- ## [When selecting \[Metricbeat System\] ECS Dashboard panel with time today everything shows 0](https://discuss.elastic.co/t/when-selecting-metricbeat-system-ecs-dashboard-panel-with-time-today-everything-shows-0/253153)
**Author:** [@plegault](https://discuss.elastic.co/u/plegault)\ **Replies:** 2\ **Last updated:** [October 26, 2020, 10:25am UTC](https://discuss.elastic.co/t/when-selecting-metricbeat-system-ecs-dashboard-panel-with-time-today-everything-shows-0/253153 "2020-10-26T10:25:18Z")
I'm using metricbeat and dashboard System Navigation \[Metricbeat System\] ECS Dashboard panel: System Navigation \[Metricbeat System\] ECS Under quick select, I select Today and all bars show as 0% for cpu and memory ver… --- ## [Kibana Authentication Accounts](https://discuss.elastic.co/t/kibana-authentication-accounts/253026)
**Author:** [@Craig2188](https://discuss.elastic.co/u/Craig2188)\ **Replies:** 5\ **Last updated:** [October 26, 2020, 9:38am UTC](https://discuss.elastic.co/t/kibana-authentication-accounts/253026 "2020-10-26T09:38:42Z")
Hi, How can I create accounts on Kibana for other people to access it? Currently, it goes straight into the dashboard when browsing to the URL. It is the Basic version so no AD integration possible. Also, if adding thi… --- ## [Elasticsearch error](https://discuss.elastic.co/t/elasticsearch-error/253176)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 1\ **Last updated:** [October 26, 2020, 9:25am UTC](https://discuss.elastic.co/t/elasticsearch-error/253176 "2020-10-26T09:25:48Z")
Hello there, I have been using ELK 7.9.2 and now I am trying to set up a cluster with ELK 7.9.3. when I run elasticsearch it gives me following errors? \[2020-10-23T11:51:05,352\]\[WARN \]\[o.e.x.m.e.l.LocalExporter\] \[mast… --- ## [Filter/Collapse on multiple fields](https://discuss.elastic.co/t/filter-collapse-on-multiple-fields/252858)
**Author:** [@Turbo-555](https://discuss.elastic.co/u/Turbo-555)\ **Replies:** 2\ **Last updated:** [October 26, 2020, 9:22am UTC](https://discuss.elastic.co/t/filter-collapse-on-multiple-fields/252858 "2020-10-26T09:22:01Z")
Hi all, I'm trying to find documents that have distinct values over 2 separate fields. Documents have \_id, filters.10,filters.20 For Example: 1, f10\_1, f20\_1 2, f10\_1, f20\_1 3, f10\_2, f20\_1 4, f10\_3, … --- ## [Unable to start the elasticsearch as it says "failed to start ElasticSearch"](https://discuss.elastic.co/t/unable-to-start-the-elasticsearch-as-it-says-failed-to-start-elasticsearch/253257)
**Author:** [@aknraj](https://discuss.elastic.co/u/aknraj)\ **Replies:** 1\ **Last updated:** [October 26, 2020, 9:07am UTC](https://discuss.elastic.co/t/unable-to-start-the-elasticsearch-as-it-says-failed-to-start-elasticsearch/253257 "2020-10-26T09:07:12Z")
Hi - I am receiving the following error while starting the elasticsearch, can you please advise if i am missing any step to follow? â elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasti… --- ## [Context Suggester: FST size estimate (RAM)](https://discuss.elastic.co/t/context-suggester-fst-size-estimate-ram/252642)
**Author:** [@Bhavik92](https://discuss.elastic.co/u/Bhavik92)\ **Replies:** 5\ **Last updated:** [October 26, 2020, 9:03am UTC](https://discuss.elastic.co/t/context-suggester-fst-size-estimate-ram/252642 "2020-10-26T09:03:24Z")
I've heard about the high memory (heap) occupancy in case FST. Is there any thumb rule I can use to calculate the size of FST / heap given the amount of data that'll be fed as input to suggester. Any benchmarking studie… --- ## ["refresh" index as a background task](https://discuss.elastic.co/t/refresh-index-as-a-background-task/253280)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 9:02am UTC](https://discuss.elastic.co/t/refresh-index-as-a-background-task/253280 "2020-10-26T09:02:05Z")
We have a big index, calling "\_refresh" API take more than 30 secondes and timeout our HTTP client. what about to add a new parameter wait\_for\_completion (like for reindex API), so this possible to run it asynchronously… --- ## [Enrich processor](https://discuss.elastic.co/t/enrich-processor/252987)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 3\ **Last updated:** [October 26, 2020, 8:55am UTC](https://discuss.elastic.co/t/enrich-processor/252987 "2020-10-26T08:55:15Z")
Hello Is it possible to use the enrich processor, with documents from the same index? In addition, when running POST /\_enrich/policy/my-enrich-test-policy/\_execute it creates an index (.enrich....) with all the value… --- ## [Not getting new columns with aggregation](https://discuss.elastic.co/t/not-getting-new-columns-with-aggregation/253273)
**Author:** [@micobarac](https://discuss.elastic.co/u/micobarac)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 8:23am UTC](https://discuss.elastic.co/t/not-getting-new-columns-with-aggregation/253273 "2020-10-26T08:23:24Z")
This is my variation of the Logstash aggregation filter: filter { if !\[messageid\] { drop {} } else if \[program\] == "amavis" and \[message\] =~ /(?i)message\\-id/ { aggregate { task\_id =\> "%{messageid}" … --- ## [Piechart revert customized colors when no data is displayed](https://discuss.elastic.co/t/piechart-revert-customized-colors-when-no-data-is-displayed/252220)
**Author:** [@Paal\_Aaserud](https://discuss.elastic.co/u/Paal_Aaserud)\ **Replies:** 4\ **Last updated:** [October 26, 2020, 8:45am UTC](https://discuss.elastic.co/t/piechart-revert-customized-colors-when-no-data-is-displayed/252220 "2020-10-26T08:45:42Z")
I have created a visualisation with a pie chart and customized the colors and then saved, this works well until I choose a date range that does not return any data. In this case the chart is empty, and when I change the … --- ## [TSVB Timeline partially missing 30min intervals when Interval set to auto](https://discuss.elastic.co/t/tsvb-timeline-partially-missing-30min-intervals-when-interval-set-to-auto/252626)
**Author:** [@isarib](https://discuss.elastic.co/u/isarib)\ **Replies:** 4\ **Last updated:** [October 26, 2020, 8:40am UTC](https://discuss.elastic.co/t/tsvb-timeline-partially-missing-30min-intervals-when-interval-set-to-auto/252626 "2020-10-26T08:40:51Z")
I noticed what may seem like a bug. I have the interval:auto set, and it looks like the TSVB timeline goes partially missing when you Time Pick Last 2-3 Days, as the timeline uses per 30min intervals. If you Time Pick … --- ## [Can't make ECK to work with microk8s](https://discuss.elastic.co/t/cant-make-eck-to-work-with-microk8s/253192)
**Author:** [@umbertoeklat](https://discuss.elastic.co/u/umbertoeklat)\ **Replies:** 1\ **Last updated:** [October 26, 2020, 8:20am UTC](https://discuss.elastic.co/t/cant-make-eck-to-work-with-microk8s/253192 "2020-10-26T08:20:34Z")
Can't make ECK to work with microk8s. Upon elastic search cluster deployment it never turns green. using describe, I got this... "0/1 nodes are available: 1 pod has unbound immediate PersistentVolumeClaims." Is it rea… --- ## [Grok proccessor UI bug](https://discuss.elastic.co/t/grok-proccessor-ui-bug/253200)
**Author:** [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Replies:** 5\ **Last updated:** [October 26, 2020, 8:04am UTC](https://discuss.elastic.co/t/grok-proccessor-ui-bug/253200 "2020-10-26T08:04:07Z")
HI, I'm trying a very simple grok pattern and in Grok Debugger it works fine: But when I tried the same pattern in ingest pipeline I got this "Bad String" Error: Any idea why? I'm using ELK 7.9.2 --- ## [org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: 34](https://discuss.elastic.co/t/org-logstash-beats-invalidframeprotocolexception-invalid-version-of-beats-protocol-34/253267)
**Author:** [@tuawow](https://discuss.elastic.co/u/tuawow)\ **Replies:** 1\ **Last updated:** [October 26, 2020, 7:23am UTC](https://discuss.elastic.co/t/org-logstash-beats-invalidframeprotocolexception-invalid-version-of-beats-protocol-34/253267 "2020-10-26T07:23:43Z")
\]\[io.netty.channel.DefaultChannelPipeline\]\[main\]\[f73510d0a1046ae249c9c684ab7752f124dc9801416a7a8bc674b1874ca37218\] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the la… --- ## [How to build a custom query endpoint against Elastic in an Open API?](https://discuss.elastic.co/t/how-to-build-a-custom-query-endpoint-against-elastic-in-an-open-api/253263)
**Author:** [@Elasticjerk](https://discuss.elastic.co/u/Elasticjerk)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 6:57am UTC](https://discuss.elastic.co/t/how-to-build-a-custom-query-endpoint-against-elastic-in-an-open-api/253263 "2020-10-26T06:57:45Z")
Hi! Im hoping to find inspiration, tips or examples on how to open up more possibilities for independent devs and other organisations using our data. We are running an open API for ad search based on Elastic and would … --- ## [Incorrect query analyzing that don't correspond to the search\_analyzer setting](https://discuss.elastic.co/t/incorrect-query-analyzing-that-dont-correspond-to-the-search-analyzer-setting/253256)
**Author:** [@Alex\_Pravdin](https://discuss.elastic.co/u/Alex_Pravdin)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 3:06am UTC](https://discuss.elastic.co/t/incorrect-query-analyzing-that-dont-correspond-to-the-search-analyzer-setting/253256 "2020-10-26T03:06:54Z")
I'm trying to transform search query against a field replacing parentheses by underscores making them regular letters available for search. The same process is made both for index and for the query. I expect that my quer… --- ## [How to disable task manager](https://discuss.elastic.co/t/how-to-disable-task-manager/252763)
**Author:** [@praveenmak](https://discuss.elastic.co/u/praveenmak)\ **Replies:** 2\ **Last updated:** [October 26, 2020, 2:22am UTC](https://discuss.elastic.co/t/how-to-disable-task-manager/252763 "2020-10-26T02:22:33Z")
Hi, I am seeing lot of these logs in kibana.logs. Its failing authentication and I don't know from where these requests are coming into Kibana. I believe its from Task manager. Does anyone know how to disable Task ma… --- ## [What is the purpose of ingest node?](https://discuss.elastic.co/t/what-is-the-purpose-of-ingest-node/253230)
**Author:** [@Burga](https://discuss.elastic.co/u/Burga)\ **Replies:** 2\ **Last updated:** [October 25, 2020, 10:05pm UTC](https://discuss.elastic.co/t/what-is-the-purpose-of-ingest-node/253230 "2020-10-25T22:05:45Z")
What is the purpose of ingest node ? Thanks in advance. --- ## [Elasticsearch ECK : Kubernetes deployment via default settings showing error](https://discuss.elastic.co/t/elasticsearch-eck-kubernetes-deployment-via-default-settings-showing-error/253231)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 2\ **Last updated:** [October 25, 2020, 8:26pm UTC](https://discuss.elastic.co/t/elasticsearch-eck-kubernetes-deployment-via-default-settings-showing-error/253231 "2020-10-25T20:26:05Z")
I was following as per quickstart summary of : https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-deploy-elasticsearch.html But when i start , I'm getting below error 0/1 nodes are available: 1 Insufficient memor… --- ## [Map issue on kibana 7.9 and elasticsearch 7.9](https://discuss.elastic.co/t/map-issue-on-kibana-7-9-and-elasticsearch-7-9/253222)
**Author:** [@asma1\_11](https://discuss.elastic.co/u/asma1_11)\ **Replies:** 1\ **Last updated:** [October 25, 2020, 6:53pm UTC](https://discuss.elastic.co/t/map-issue-on-kibana-7-9-and-elasticsearch-7-9/253222 "2020-10-25T18:53:15Z")
Hello All, I have this issue when I tried to visualize map on Elasticsearch 7.9 "Elasticsearch request failed, bad request " I also make sure that the index contains geo\_point location when i run this command GET p… --- ## [Does the field used in field\_value\_factor function scoring need to be an 'indexed' field, or can it just be 'stored'?](https://discuss.elastic.co/t/does-the-field-used-in-field-value-factor-function-scoring-need-to-be-an-indexed-field-or-can-it-just-be-stored/253244)
**Author:** [@jbalakrishnan](https://discuss.elastic.co/u/jbalakrishnan)\ **Replies:** 0\ **Last updated:** [October 25, 2020, 6:06pm UTC](https://discuss.elastic.co/t/does-the-field-used-in-field-value-factor-function-scoring-need-to-be-an-indexed-field-or-can-it-just-be-stored/253244 "2020-10-25T18:06:49Z")
I need to use a positive-valued float or double value field, one field value per document, that I compute at index time. I want to use this value to boost the score of each document matching an arbitrary query, by the va… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1178) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1180)