# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1316 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1317 --- ## [Add mapping to unmapped field](https://discuss.elastic.co/t/add-mapping-to-unmapped-field/242369)
**Author:** [@JulienCarnec](https://discuss.elastic.co/u/JulienCarnec)\ **Replies:** 2\ **Last updated:** [July 23, 2020, 8:45pm UTC](https://discuss.elastic.co/t/add-mapping-to-unmapped-field/242369 "2020-07-23T20:45:16Z")
Is there a way to store an unmapped field in documents, and then later on, create a mapping for this unmapped field to have it searchable, without having to reindex all my docs in a new index? Here is what I do: 1- cre… --- ## [How I can set up logstash with debian packages](https://discuss.elastic.co/t/how-i-can-set-up-logstash-with-debian-packages/241533)
**Author:** [@Splunk](https://discuss.elastic.co/u/Splunk)\ **Replies:** 3\ **Last updated:** [July 16, 2020, 11:11pm UTC](https://discuss.elastic.co/t/how-i-can-set-up-logstash-with-debian-packages/241533 "2020-07-16T23:11:45Z")
I feel like it is a waste of time to deal with Debian packages, can anyone tell me how I can set up logstash with Debian packages? I followed the instruction on elastic website, how can i access to logstash conf file h… --- ## [Logstash multiple pipelines processing](https://discuss.elastic.co/t/logstash-multiple-pipelines-processing/242392)
**Author:** [@FranB](https://discuss.elastic.co/u/FranB)\ **Replies:** 2\ **Last updated:** [July 23, 2020, 8:27pm UTC](https://discuss.elastic.co/t/logstash-multiple-pipelines-processing/242392 "2020-07-23T20:27:22Z")
Hello, i have this doubt: if i have 4 pipelines in the pipelines.yml file, one instance of logstash will process and output at the same time/in parallel for those 4 different type of pipelines or will they work as the f… --- ## [Passing Parent Aggregate Key into the child Aggregate Scripting language](https://discuss.elastic.co/t/passing-parent-aggregate-key-into-the-child-aggregate-scripting-language/242398)
**Author:** [@amrit.khatri](https://discuss.elastic.co/u/amrit.khatri)\ **Replies:** 0\ **Last updated:** [July 23, 2020, 8:23pm UTC](https://discuss.elastic.co/t/passing-parent-aggregate-key-into-the-child-aggregate-scripting-language/242398 "2020-07-23T20:23:16Z")
I have a quick question about passing the filters key to the scripted language from parent aggregate to child aggregate. Basically, I have defined the filters as below, In my scripted query, I want to use the filter ke… --- ## [Filebeat and data.json file, field meaning and service tunning](https://discuss.elastic.co/t/filebeat-and-data-json-file-field-meaning-and-service-tunning/242278)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 0\ **Last updated:** [July 23, 2020, 5:54am UTC](https://discuss.elastic.co/t/filebeat-and-data-json-file-field-meaning-and-service-tunning/242278 "2020-07-23T05:54:05Z")
Dears, The filebeat service have file data.json in /var/lib/filebeat/registry/filebeat. The content of this file looks like: \[ "soure":"/apps/logs/my\_apps/file.log","offset":"308017933","timestamp":"2020-07-23T07:20:38… --- ## [Logstash error after configuring ssl in the logstash.conf](https://discuss.elastic.co/t/logstash-error-after-configuring-ssl-in-the-logstash-conf/242262)
**Author:** [@Matish\_Bhuyan](https://discuss.elastic.co/u/Matish_Bhuyan)\ **Replies:** 9\ **Last updated:** [July 23, 2020, 7:39pm UTC](https://discuss.elastic.co/t/logstash-error-after-configuring-ssl-in-the-logstash-conf/242262 "2020-07-23T19:39:59Z")
Hi All , I have configured my elk stack to use ssl settings and after the change in Kibana and elasticsearch i have updated the logstash configuration , I am able to connect to my elasticsearch cluster from logstash as… --- ## [How to create key value from Nested fields](https://discuss.elastic.co/t/how-to-create-key-value-from-nested-fields/242084)
**Author:** [@Ramalakshmi](https://discuss.elastic.co/u/Ramalakshmi)\ **Replies:** 12\ **Last updated:** [July 23, 2020, 6:52pm UTC](https://discuss.elastic.co/t/how-to-create-key-value-from-nested-fields/242084 "2020-07-23T18:52:30Z")
Hi, I am getting json data in kibana. The data having nested fields like aws.datasource.resource.instanceDetails.tags { "key": "Environment", "value": "true" }, { "key": "nga", "… --- ## [Steps to change elastic password](https://discuss.elastic.co/t/steps-to-change-elastic-password/242374)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 2\ **Last updated:** [July 23, 2020, 6:43pm UTC](https://discuss.elastic.co/t/steps-to-change-elastic-password/242374 "2020-07-23T18:43:20Z")
I try changing password for user elastic. I had many pipeline running and they all use this password. this is what I did and it starting giving me lot of error in logstash. is there step I missed? stop logstash went … --- ## [Creating/Manipulating Histograms in Scripts](https://discuss.elastic.co/t/creating-manipulating-histograms-in-scripts/242390)
**Author:** [@micah.williamson](https://discuss.elastic.co/u/micah.williamson)\ **Replies:** 0\ **Last updated:** [July 23, 2020, 6:43pm UTC](https://discuss.elastic.co/t/creating-manipulating-histograms-in-scripts/242390 "2020-07-23T18:43:07Z")
I want to store a histogram in elasticsearch but I'm having trouble finding an example of a way to do this via script. The histogram buckets will be values 0-23, and I need to be able to increment buckets individually vi… --- ## [Yet Another Elastic SIEM Not Showing Hosts](https://discuss.elastic.co/t/yet-another-elastic-siem-not-showing-hosts/241332)
**Author:** [@brian\_m](https://discuss.elastic.co/u/brian_m)\ **Replies:** 10\ **Last updated:** [July 23, 2020, 6:19pm UTC](https://discuss.elastic.co/t/yet-another-elastic-siem-not-showing-hosts/241332 "2020-07-23T18:19:16Z")
I started playing with Elastic a few months ago, and very recently started trying to get Elastic SIEM to work. I have not been able to get it to recognize anything, and the only host showing up is the Elastic node itself… --- ## [Date range filter using strict\_date\_time\_no\_millis format failing](https://discuss.elastic.co/t/date-range-filter-using-strict-date-time-no-millis-format-failing/242255)
**Author:** [@russinholi](https://discuss.elastic.co/u/russinholi)\ **Replies:** 3\ **Last updated:** [July 23, 2020, 5:10pm UTC](https://discuss.elastic.co/t/date-range-filter-using-strict-date-time-no-millis-format-failing/242255 "2020-07-23T17:10:23Z")
Hi all, I'm porting a query of an old app we have, from ES2.0 to ES7.8, and I'm getting this error: failed to parse date field \[2020-07-23T02:59:59+0000\] with format \[strict\_date\_time\_no\_millis\] while running a query w… --- ## [Documentation page for ESSingleNodeTestCase in 7.8](https://discuss.elastic.co/t/documentation-page-for-essinglenodetestcase-in-7-8/242373)
**Author:** [@Deb](https://discuss.elastic.co/u/Deb)\ **Replies:** 0\ **Last updated:** [July 23, 2020, 4:36pm UTC](https://discuss.elastic.co/t/documentation-page-for-essinglenodetestcase-in-7-8/242373 "2020-07-23T16:36:10Z")
Hi Can someone let me know where is the documentation for ESSingleNodeTestCase for the latest elasticsearch? The page below seems to have been deleted https://www.elastic.co/guide/en/elasticsearch/reference/current/uni… --- ## [Parallel search after](https://discuss.elastic.co/t/parallel-search-after/241777)
**Author:** [@liron\_gofberg](https://discuss.elastic.co/u/liron_gofberg)\ **Replies:** 2\ **Last updated:** [July 23, 2020, 4:35pm UTC](https://discuss.elastic.co/t/parallel-search-after/241777 "2020-07-23T16:35:54Z")
Hi, How can search after can be parallel if results from the previous page help the retrieval of the next page? but I can see in the documentation that it is parallel thanks, Liron --- ## [Logstash not saving additional fields](https://discuss.elastic.co/t/logstash-not-saving-additional-fields/242220)
**Author:** [@tomba2k](https://discuss.elastic.co/u/tomba2k)\ **Replies:** 6\ **Last updated:** [July 23, 2020, 4:26pm UTC](https://discuss.elastic.co/t/logstash-not-saving-additional-fields/242220 "2020-07-23T16:26:14Z")
On working elastic stack I'm trying to send mysql slowlog to OSS elasticsearch cluster. Data is saved to ES, including \[event\]\[dataset\] for example, but everything under \[mysql\]\[slowlog\] or even \[mysql\] arrays is being … --- ## [Feature Request: trigger suppresion on signal actions](https://discuss.elastic.co/t/feature-request-trigger-suppresion-on-signal-actions/242335)
**Author:** [@The1WhoPrtNocks](https://discuss.elastic.co/u/The1WhoPrtNocks)\ **Replies:** 2\ **Last updated:** [July 23, 2020, 3:29pm UTC](https://discuss.elastic.co/t/feature-request-trigger-suppresion-on-signal-actions/242335 "2020-07-23T15:29:42Z")
Hi, Are we able to get a feature so that when a signal rul runs it only triggers the rule Actions if it has seen X hits in the last Y minuets. Is very helpfull for weeding out false posatives and I am having to do it ex… --- ## [Customize Columns for SIEM Signals and External Alerts not persistent?](https://discuss.elastic.co/t/customize-columns-for-siem-signals-and-external-alerts-not-persistent/229825)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [July 23, 2020, 3:25pm UTC](https://discuss.elastic.co/t/customize-columns-for-siem-signals-and-external-alerts-not-persistent/229825 "2020-07-23T15:25:18Z")
Hello, Is there a way to make changes to columns for Signals and External Alerts consistent? Because currently by default (7.6.1) External Alerts colums are always reverted to this: Which makes no sense.. As: event.… --- ## [Alerting and customizing SIEM app](https://discuss.elastic.co/t/alerting-and-customizing-siem-app/230207)
**Author:** [@gar](https://discuss.elastic.co/u/gar)\ **Replies:** 11\ **Last updated:** [July 23, 2020, 3:25pm UTC](https://discuss.elastic.co/t/alerting-and-customizing-siem-app/230207 "2020-07-23T15:25:09Z")
Hi SIEM admins, a couple quick questions. Are there any pans to add alerting to the SIEM app? Specifically the ability to create a watch as part of the Detection Rule setup? I see others have requested allowing custom … --- ## [Field access in filter script](https://discuss.elastic.co/t/field-access-in-filter-script/242354)
**Author:** [@tudro](https://discuss.elastic.co/u/tudro)\ **Replies:** 0\ **Last updated:** [July 23, 2020, 2:22pm UTC](https://discuss.elastic.co/t/field-access-in-filter-script/242354 "2020-07-23T14:22:22Z")
Hello, I have a mapping like this "user": { "mappings": { "properties": { "profile": { "properties": { "cars": {...} }}}}} I am trying t… --- ## [Count of nested documents by aggregation](https://discuss.elastic.co/t/count-of-nested-documents-by-aggregation/242362)
**Author:** [@Divyanshu\_Tyagi](https://discuss.elastic.co/u/Divyanshu_Tyagi)\ **Replies:** 0\ **Last updated:** [July 23, 2020, 3:24pm UTC](https://discuss.elastic.co/t/count-of-nested-documents-by-aggregation/242362 "2020-07-23T15:24:02Z")
I have 2 level of nesting in my mapping: business -\> funds -\> admins/market I want count of f\_id's that matches with particular admin\_name ES MAPPING { "text\_index" : { "mappings" : { "prop… --- ## [Logstash relay](https://discuss.elastic.co/t/logstash-relay/242100)
**Author:** [@mariof](https://discuss.elastic.co/u/mariof)\ **Replies:** 6\ **Last updated:** [July 23, 2020, 3:21pm UTC](https://discuss.elastic.co/t/logstash-relay/242100 "2020-07-23T15:21:25Z")
i'm interested in setting up a logstash relay. i need to be able to listen for syslog and forward the messages via at least one other logstash server before hitting a group of logstash servers. do you think this is poss… --- ## [Partial phrase or exact phrase matching](https://discuss.elastic.co/t/partial-phrase-or-exact-phrase-matching/242320)
**Author:** [@bradconor](https://discuss.elastic.co/u/bradconor)\ **Replies:** 9\ **Last updated:** [July 23, 2020, 2:53pm UTC](https://discuss.elastic.co/t/partial-phrase-or-exact-phrase-matching/242320 "2020-07-23T14:53:56Z")
Hi there, I am new to elasticsearch and I want to search for a phrase. Suppose I query with this phrase : i am new to elasticsearch And I have some data like new to elasticsearch I have tried with match\_phrase but … --- ## [Logstash Error: Unrecognized SSL message, plaintext connection?](https://discuss.elastic.co/t/logstash-error-unrecognized-ssl-message-plaintext-connection/242356)
**Author:** [@Marios\_Karatisoglou](https://discuss.elastic.co/u/Marios_Karatisoglou)\ **Replies:** 0\ **Last updated:** [July 23, 2020, 2:42pm UTC](https://discuss.elastic.co/t/logstash-error-unrecognized-ssl-message-plaintext-connection/242356 "2020-07-23T14:42:01Z")
Hello community, I use Logstash in centos 7 and when I start it, it gives the following error \*\*\[2020-07-23T10:37:01,699\]\[INFO \]\[logstash.runner \] Starting Logstash {"logstash.version"=\>"6.8.10"}\*\* \*\*\[2020… --- ## [Embed Kibana Log Stream Widget to Web page](https://discuss.elastic.co/t/embed-kibana-log-stream-widget-to-web-page/242348)
**Author:** [@Istvan\_Romhany](https://discuss.elastic.co/u/Istvan_Romhany)\ **Replies:** 1\ **Last updated:** [July 23, 2020, 2:12pm UTC](https://discuss.elastic.co/t/embed-kibana-log-stream-widget-to-web-page/242348 "2020-07-23T14:12:46Z")
Hello! I am new to the ELK stack, it's awesome, but for our use case we need just the Log Stream page of kibana (/app/logs/stream) and we need to embed it into our own web application. I see that we could utilize ifram… --- ## [Serch text with special character](https://discuss.elastic.co/t/serch-text-with-special-character/242040)
**Author:** [@Katia](https://discuss.elastic.co/u/Katia)\ **Replies:** 9\ **Last updated:** [July 23, 2020, 1:38pm UTC](https://discuss.elastic.co/t/serch-text-with-special-character/242040 "2020-07-23T13:38:56Z")
I really need help. I indexed my data using logstash. The data is as follows: 20200807 00:10:02.934 Mes émis à l'appli Hôte 3 3 -1 The issue is that, I need to search "3 3-1", but it seems that the caracter "-" cau… --- ## [Query with more than one field](https://discuss.elastic.co/t/query-with-more-than-one-field/241509)
**Author:** [@schneider](https://discuss.elastic.co/u/schneider)\ **Replies:** 7\ **Last updated:** [July 23, 2020, 12:50pm UTC](https://discuss.elastic.co/t/query-with-more-than-one-field/241509 "2020-07-23T12:50:34Z")
Hello, i want the data witch : field "transacao" = " QuarantineTransac" and the field "assunto" = "qualquerassunto", but is retrieving data witch one OR another no the 2 at the same time { "query": { "boo… --- ## [Config Elasticsearch for a headless system](https://discuss.elastic.co/t/config-elasticsearch-for-a-headless-system/242312)
**Author:** [@Peter\_Boos](https://discuss.elastic.co/u/Peter_Boos)\ **Replies:** 3\ **Last updated:** [July 23, 2020, 12:36pm UTC](https://discuss.elastic.co/t/config-elasticsearch-for-a-headless-system/242312 "2020-07-23T12:36:26Z")
I'm (trying) to run ELK on a headless console only system. So far it only says: Kibana server is not ready yet through a ssh i can see the tail -f /var/log/syslog Logging this error which is a bit long oneliner : … --- ## [Disable Kibana info (Dismiss)](https://discuss.elastic.co/t/disable-kibana-info-dismiss/242145)
**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\ **Replies:** 1\ **Last updated:** [July 23, 2020, 12:29pm UTC](https://discuss.elastic.co/t/disable-kibana-info-dismiss/242145 "2020-07-23T12:29:34Z")
Hello, It is possible to disable permanently information messages on Kibana (currently, we must click on dismiss button). Thanks for reply. Rosm --- ## [Analytics Queries and pagination](https://discuss.elastic.co/t/analytics-queries-and-pagination/242329)
**Author:** [@Sam\_S](https://discuss.elastic.co/u/Sam_S)\ **Replies:** 1\ **Last updated:** [July 23, 2020, 12:25pm UTC](https://discuss.elastic.co/t/analytics-queries-and-pagination/242329 "2020-07-23T12:25:33Z")
Although pagination is somewhat mentioned in the docs here https://www.elastic.co/guide/en/app-search/current/queries.html#queries-more-queries, it seems like pagination doesn't work like it does in the documents result… --- ## ["statusCode":500 when going to localhost:5601](https://discuss.elastic.co/t/statuscode-500-when-going-to-localhost-5601/242017)
**Author:** [@eslepakurov](https://discuss.elastic.co/u/eslepakurov)\ **Replies:** 1\ **Last updated:** [July 23, 2020, 12:11pm UTC](https://discuss.elastic.co/t/statuscode-500-when-going-to-localhost-5601/242017 "2020-07-23T12:11:55Z")
Hi, I've installed everything like here https://www.youtube.com/watch?v=FImTcHECpC0 When I paste http://localhost:5601/ to browser, {"statusCode":500,"error":"Internal Server Error","message":"An internal server error o… --- ## [Elastic search cluster](https://discuss.elastic.co/t/elastic-search-cluster/242334)
**Author:** [@Pradeep\_K\_S](https://discuss.elastic.co/u/Pradeep_K_S)\ **Replies:** 3\ **Last updated:** [July 23, 2020, 12:09pm UTC](https://discuss.elastic.co/t/elastic-search-cluster/242334 "2020-07-23T12:09:03Z")
Hi, I am not sure where exactly i can find the Elastic search logs, if any node failure or cluster is red. Also can i get information where ES index schema will be stored? is it in nodes or client/master instance? Than… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1315) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1317)