# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1011

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1012

---

## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/299872)

<div class="topic-metadata">

**Author:** [@juliano.maciel](https://discuss.elastic.co/u/juliano.maciel)\
**Replies:** 6\
**Last updated:** [March 16, 2022, 8:10pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/299872 "2022-03-16T20:10:15Z")

</div>

Hi, i'am tring to conifg Elastic Stack 7.16.2 with a windows server. My configs: Elasticsearch APM-server Kibana When i try to acess Kibana, is show the message at the browser

---

## [Vega select box aggregations](https://discuss.elastic.co/t/vega-select-box-aggregations/299028)

<div class="topic-metadata">

**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\
**Replies:** 5\
**Last updated:** [March 16, 2022, 8:06pm UTC](https://discuss.elastic.co/t/vega-select-box-aggregations/299028 "2022-03-16T20:06:56Z")

</div>

Hello, I need to create a chart where Y axis can be changed based on a select box. I saw this example in Vega, but not sure how to replicate in Elasticsearch. Link to visualization: Vega Editor thanks

---

## [Pattern not defined](https://discuss.elastic.co/t/pattern-not-defined/299893)

<div class="topic-metadata">

**Author:** [@Guif](https://discuss.elastic.co/u/Guif)\
**Replies:** 1\
**Last updated:** [March 16, 2022, 7:48pm UTC](https://discuss.elastic.co/t/pattern-not-defined/299893 "2022-03-16T19:48:30Z")

</div>

Hi, I try to ingest the logs /var/log/maillog with the following pattern via logstash: POSTFIX\_QUEUEID (\[0-9A-F\]{6,}|\[0-9a-zA-Z\]{15,}) POSTFIX\_STATUS (?\<=status=)(.\*)(?= \\() POSTFIX\_PROCESS (?=postfix\\/)(.\*?\\\[)(.\*?)(?=…

---

## [Sum of values from Nested field as per the Global filter for Currency unit in Bar chart](https://discuss.elastic.co/t/sum-of-values-from-nested-field-as-per-the-global-filter-for-currency-unit-in-bar-chart/299892)

<div class="topic-metadata">

**Author:** [@Kirubanandhan](https://discuss.elastic.co/u/Kirubanandhan)\
**Replies:** 0\
**Last updated:** [March 16, 2022, 6:39pm UTC](https://discuss.elastic.co/t/sum-of-values-from-nested-field-as-per-the-global-filter-for-currency-unit-in-bar-chart/299892 "2022-03-16T18:39:35Z")

</div>

I have different types of currency values in each record as per user selects the Currency\_unit, Bar chart should make sum of Currency\_value. How to acheive this. PFB for the result. If the index data type needs to me mod…

---

## [Upgrading 6.2.4 to 8.1](https://discuss.elastic.co/t/upgrading-6-2-4-to-8-1/299887)

<div class="topic-metadata">

**Author:** [@Foggie](https://discuss.elastic.co/u/Foggie)\
**Replies:** 3\
**Last updated:** [March 16, 2022, 6:26pm UTC](https://discuss.elastic.co/t/upgrading-6-2-4-to-8-1/299887 "2022-03-16T18:26:31Z")

</div>

We have developed an application based on Elasticsearch. The data held is currently relatively small and the user interaction is very low. The application was first developed a few years ago based on Elasticsearch 6.2.4.…

---

## [Azure Filebeats Module](https://discuss.elastic.co/t/azure-filebeats-module/299878)

<div class="topic-metadata">

**Author:** [@tman5](https://discuss.elastic.co/u/tman5)\
**Replies:** 4\
**Last updated:** [March 16, 2022, 6:06pm UTC](https://discuss.elastic.co/t/azure-filebeats-module/299878 "2022-03-16T18:06:44Z")

</div>

We're looking to configure Azure module | Filebeat Reference \[7.17\] | Elastic and I had a question. Our filebeats is outputing to logstash which then in turn writes out to Graylog. I have filebeat setup to gather logs f…

---

## [Help with Fleet setup](https://discuss.elastic.co/t/help-with-fleet-setup/299759)

<div class="topic-metadata">

**Author:** [@bigdamhero](https://discuss.elastic.co/u/bigdamhero)\
**Replies:** 3\
**Last updated:** [March 16, 2022, 4:55pm UTC](https://discuss.elastic.co/t/help-with-fleet-setup/299759 "2022-03-16T16:55:22Z")

</div>

I got a fleet server to connect to my sandbox cluster to test and setup this framework. I am trying to get an agent to connect with my fleet server. I am trying to just get the quickstart going so useing the --insecur…

---

## [I want synthetic Monitoring for my webapp which is login based url](https://discuss.elastic.co/t/i-want-synthetic-monitoring-for-my-webapp-which-is-login-based-url/299871)

<div class="topic-metadata">

**Author:** [@loka89](https://discuss.elastic.co/u/loka89)\
**Replies:** 1\
**Last updated:** [March 16, 2022, 4:54pm UTC](https://discuss.elastic.co/t/i-want-synthetic-monitoring-for-my-webapp-which-is-login-based-url/299871 "2022-03-16T16:54:49Z")

</div>

How can I do that because I setup the agent in my host machine which is linux based

---

## [How to Configure FileBeat to be used with an Existing Index while deploying in Kubernetes as DaemonSet](https://discuss.elastic.co/t/how-to-configure-filebeat-to-be-used-with-an-existing-index-while-deploying-in-kubernetes-as-daemonset/299601)

<div class="topic-metadata">

**Author:** [@roy3861](https://discuss.elastic.co/u/roy3861)\
**Replies:** 1\
**Last updated:** [March 16, 2022, 4:20pm UTC](https://discuss.elastic.co/t/how-to-configure-filebeat-to-be-used-with-an-existing-index-while-deploying-in-kubernetes-as-daemonset/299601 "2022-03-16T16:20:24Z")

</div>

Hi, We are trying to deploy filebeat in our Kuberenets cluster following: Running Filebeat on Kubernetes | Filebeat Reference \[6.8\] | Elastic However we want the Pod logs to go to a pre defined Index in Elastic. How to…

---

## [Ingest vs Data](https://discuss.elastic.co/t/ingest-vs-data/299662)

<div class="topic-metadata">

**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\
**Replies:** 3\
**Last updated:** [March 16, 2022, 3:57pm UTC](https://discuss.elastic.co/t/ingest-vs-data/299662 "2022-03-16T15:57:55Z")

</div>

I have read the Node Roles documentation, but am still unclear on the difference between the ingest and data roles. In particular, if a node has the data role but not the ingest role, does that mean that incoming data (e…

---

## [Labels / characters / texts are not visible properly for Legend Position in Kibana Dashboard](https://discuss.elastic.co/t/labels-characters-texts-are-not-visible-properly-for-legend-position-in-kibana-dashboard/299686)

<div class="topic-metadata">

**Author:** [@hitnalli\_praveen](https://discuss.elastic.co/u/hitnalli_praveen)\
**Replies:** 3\
**Last updated:** [March 16, 2022, 3:19pm UTC](https://discuss.elastic.co/t/labels-characters-texts-are-not-visible-properly-for-legend-position-in-kibana-dashboard/299686 "2022-03-16T15:19:33Z")

</div>

I've setup a Visualization with few Required fields for the different systems with Split Series in Kibana. (for e.g. systems are numbered like SU01, SU02 ... SU013) and each system is installed with different Software (S…

---

## [Logstash date filter plugin adds \_dateparsefailure tag on event data from JDBC](https://discuss.elastic.co/t/logstash-date-filter-plugin-adds-dateparsefailure-tag-on-event-data-from-jdbc/299855)

<div class="topic-metadata">

**Author:** [@nilei](https://discuss.elastic.co/u/nilei)\
**Replies:** 2\
**Last updated:** [March 16, 2022, 3:18pm UTC](https://discuss.elastic.co/t/logstash-date-filter-plugin-adds-dateparsefailure-tag-on-event-data-from-jdbc/299855 "2022-03-16T15:18:47Z")

</div>

Dear all, I fetch data from a MySQL database via the JDBC input plugin. Here is an excerpt from the SQL result: +---------------------------+--------------------------+ | History.Created.DateValue | History.Number.KeyV…

---

## [How to set min\_doc\_count for bucket in Lens visualization?](https://discuss.elastic.co/t/how-to-set-min-doc-count-for-bucket-in-lens-visualization/298519)

<div class="topic-metadata">

**Author:** [@jakn](https://discuss.elastic.co/u/jakn)\
**Replies:** 2\
**Last updated:** [March 16, 2022, 3:05pm UTC](https://discuss.elastic.co/t/how-to-set-min-doc-count-for-bucket-in-lens-visualization/298519 "2022-03-16T15:05:26Z")

</div>

I need to create a Formula Metric in a Lens visualization on some terms/top value buckets. I only want to calculate the metric for buckets with at least 10 records. How do I ensure that? I know that in the aggregation-…

---

## [Need help with Kibana Visual](https://discuss.elastic.co/t/need-help-with-kibana-visual/298224)

<div class="topic-metadata">

**Author:** [@mohitspacee](https://discuss.elastic.co/u/mohitspacee)\
**Replies:** 1\
**Last updated:** [March 16, 2022, 2:50pm UTC](https://discuss.elastic.co/t/need-help-with-kibana-visual/298224 "2022-03-16T14:50:41Z")

</div>

Hello! I am trying to set up a simple Kibana line chart with these conditions - I'm trying to set up a Power vs Timestamp chart. In elastic, I have the metrics Current and Voltage. I'll calculate the Power from that. P…

---

## [Best compression codec](https://discuss.elastic.co/t/best-compression-codec/299869)

<div class="topic-metadata">

**Author:** [@Rollup\_eval](https://discuss.elastic.co/u/Rollup_eval)\
**Replies:** 1\
**Last updated:** [March 16, 2022, 2:47pm UTC](https://discuss.elastic.co/t/best-compression-codec/299869 "2022-03-16T14:47:36Z")

</div>

Hello, I'm using Elasticsearch 7.10.2. I have created a new index with index.codec: best\_compression in its settings. Is the best\_compression for this new index taken on account during hot phase ? (or only during the…

---

## [Filebeat Modules for Syslog-ng files not creating index](https://discuss.elastic.co/t/filebeat-modules-for-syslog-ng-files-not-creating-index/299767)

<div class="topic-metadata">

**Author:** [@sevtech](https://discuss.elastic.co/u/sevtech)\
**Replies:** 1\
**Last updated:** [March 16, 2022, 2:25pm UTC](https://discuss.elastic.co/t/filebeat-modules-for-syslog-ng-files-not-creating-index/299767 "2022-03-16T14:25:20Z")

</div>

I have a Syslog-NG server that has been upgraded from 7.4 to 8.0.1 via YUM on CentOS. I am new to ELK. I have mostly switch syslog data and Palo Alto FW syslog data on the Syslog -NG server. When I set the filebeat co…

---

## [\[Kibana\]Data from Multiple Tables MySQL](https://discuss.elastic.co/t/kibana-data-from-multiple-tables-mysql/299867)

<div class="topic-metadata">

**Author:** [@legolas\_bilbao](https://discuss.elastic.co/u/legolas_bilbao)\
**Replies:** 0\
**Last updated:** [March 16, 2022, 2:23pm UTC](https://discuss.elastic.co/t/kibana-data-from-multiple-tables-mysql/299867 "2022-03-16T14:23:49Z")

</div>

Good morning, I've several tables assets (hostname, idos,oss, lastview) rules( idrule,idos,value) compliance(idrule,idos,date,valueserver) and i wanna make / visualice tables like this Assets OSSS Date1 Date2 Date3…

---

## [Canvas Expression Syntax NewLine & Comments](https://discuss.elastic.co/t/canvas-expression-syntax-newline-comments/299796)

<div class="topic-metadata">

**Author:** [@GoncaloCarvalho](https://discuss.elastic.co/u/GoncaloCarvalho)\
**Replies:** 1\
**Last updated:** [March 16, 2022, 1:59pm UTC](https://discuss.elastic.co/t/canvas-expression-syntax-newline-comments/299796 "2022-03-16T13:59:34Z")

</div>

Greetings, I need help with two specific features, would greatly appreciate any help you could hand me. I'm setting up a canvas Workpad and I wanted to add some sort of documentation through comments in my code, so oth…

---

## [How to generate /Fetch report in pdf or excel for APM logs, transection data from Kibana](https://discuss.elastic.co/t/how-to-generate-fetch-report-in-pdf-or-excel-for-apm-logs-transection-data-from-kibana/299865)

<div class="topic-metadata">

**Author:** [@Sharma3007](https://discuss.elastic.co/u/Sharma3007)\
**Replies:** 0\
**Last updated:** [March 16, 2022, 1:56pm UTC](https://discuss.elastic.co/t/how-to-generate-fetch-report-in-pdf-or-excel-for-apm-logs-transection-data-from-kibana/299865 "2022-03-16T13:56:17Z")

</div>

Hi Team, We are successfully able to configure APM transection log in Kibana & we are able to see all the APM logs related information on Kibana. But our requirement is to export all those logs in one excel or pdf rep…

---

## [Elasticsearch SQL sub query: IN query not supported yet](https://discuss.elastic.co/t/elasticsearch-sql-sub-query-in-query-not-supported-yet/299864)

<div class="topic-metadata">

**Author:** [@tg295](https://discuss.elastic.co/u/tg295)\
**Replies:** 0\
**Last updated:** [March 16, 2022, 1:42pm UTC](https://discuss.elastic.co/t/elasticsearch-sql-sub-query-in-query-not-supported-yet/299864 "2022-03-16T13:42:14Z")

</div>

I'm trying to learn to learn how to use Elasticsearch SQL for use in the Kibana canvas. What I would like to do is aggregate sales by some metric over country and date, but filter those results so i'm looking at two spe…

---

## [Sql query cannot be cancelled and long running](https://discuss.elastic.co/t/sql-query-cannot-be-cancelled-and-long-running/299070)

<div class="topic-metadata">

**Author:** [@Sathish\_smart](https://discuss.elastic.co/u/Sathish_smart)\
**Replies:** 2\
**Last updated:** [March 16, 2022, 1:39pm UTC](https://discuss.elastic.co/t/sql-query-cannot-be-cancelled-and-long-running/299070 "2022-03-16T13:39:35Z")

</div>

I am unable to cancel the Elasticsearch sql query which is long running and I would like to know whether there is any option to make 'cancellable' true in the sql API. { "completed": false, "task": { "node": "5yiolpw…

---

## [Unable to load beats input plugin after installing it locally](https://discuss.elastic.co/t/unable-to-load-beats-input-plugin-after-installing-it-locally/299863)

<div class="topic-metadata">

**Author:** [@Nikhitha](https://discuss.elastic.co/u/Nikhitha)\
**Replies:** 0\
**Last updated:** [March 16, 2022, 1:32pm UTC](https://discuss.elastic.co/t/unable-to-load-beats-input-plugin-after-installing-it-locally/299863 "2022-03-16T13:32:07Z")

</div>

After installing beats input plugin after dowloadong from github and generating .gem file, it appears when listed the plugins in logstash, but when ran any configuration file on beats, it says pluginLoading error. Can s…

---

## [Data Stream Backing Index Naming](https://discuss.elastic.co/t/data-stream-backing-index-naming/299861)

<div class="topic-metadata">

**Author:** [@omer](https://discuss.elastic.co/u/omer)\
**Replies:** 0\
**Last updated:** [March 16, 2022, 1:24pm UTC](https://discuss.elastic.co/t/data-stream-backing-index-naming/299861 "2022-03-16T13:24:26Z")

</div>

Hi, I am using data stream to index my log records. In documentation, it is said that the backing index is named using the following convention: .ds-\[data-stream\]-\[yyyy.MM.dd\]-\[generation\] but in my case, time segment…

---

## [Discovery 8.1](https://discuss.elastic.co/t/discovery-8-1/299789)

<div class="topic-metadata">

**Author:** [@Vurijano\_Pinas](https://discuss.elastic.co/u/Vurijano_Pinas)\
**Replies:** 5\
**Last updated:** [March 16, 2022, 1:03pm UTC](https://discuss.elastic.co/t/discovery-8-1/299789 "2022-03-16T13:03:35Z")

</div>

Hi, so i installing 8.1 and struggeling to get my node active after editting the config file. Now i cannot find any good guide to help me to the process. I would like to know howto install multi-node whitout having my n…

---

## [Logstash Geoip plugin](https://discuss.elastic.co/t/logstash-geoip-plugin/299044)

<div class="topic-metadata">

**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\
**Replies:** 10\
**Last updated:** [March 16, 2022, 12:55pm UTC](https://discuss.elastic.co/t/logstash-geoip-plugin/299044 "2022-03-16T12:55:53Z")

</div>

Hi Im using Logstash Geoip Plugin as below geoip { source =\> "sourceIP" target =\> "geoIP" add\_field =\> { "countryCode" =\> "%{\[geoIP\]\[country\_code2\]}" } } But at…

---

## [ConnectException using REST client in Java](https://discuss.elastic.co/t/connectexception-using-rest-client-in-java/299853)

<div class="topic-metadata">

**Author:** [@Chaitanya\_Varanasi](https://discuss.elastic.co/u/Chaitanya_Varanasi)\
**Replies:** 2\
**Last updated:** [March 16, 2022, 12:20pm UTC](https://discuss.elastic.co/t/connectexception-using-rest-client-in-java/299853 "2022-03-16T12:20:24Z")

</div>

RestClient is initialised well, but while trying to use the high level client , getting the following error java.net.ConnectException: null at org.apache.http.nio.pool.RouteSpecificPool.timeout(RouteSpecificPool…

---

## [S3 input dont delete/backup files after processing](https://discuss.elastic.co/t/s3-input-dont-delete-backup-files-after-processing/299187)

<div class="topic-metadata">

**Author:** [@froheik](https://discuss.elastic.co/u/froheik)\
**Replies:** 2\
**Last updated:** [March 16, 2022, 11:21am UTC](https://discuss.elastic.co/t/s3-input-dont-delete-backup-files-after-processing/299187 "2022-03-16T11:21:00Z")

</div>

Hello. Trouble with setting S3 input plugin with private S3 like AWS Minio. Logstash version OSS 7.16, 7.17, 8.0, 8.1. Logstash normally read object and send to output, but backup or delete is not working. Object stay…

---

## [Query DSL count distinct](https://discuss.elastic.co/t/query-dsl-count-distinct/299751)

<div class="topic-metadata">

**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\
**Replies:** 15\
**Last updated:** [March 16, 2022, 11:09am UTC](https://discuss.elastic.co/t/query-dsl-count-distinct/299751 "2022-03-16T11:09:35Z")

</div>

Hi, I am looking for precise count results for index with over 70 millions documents. Equal to this: SQL: select count(distinct column) from table; I already tried Terms-aggregation, composite-aggregation, cardinality…

---

## [How to update a field with null using NEST and the Update API](https://discuss.elastic.co/t/how-to-update-a-field-with-null-using-nest-and-the-update-api/299390)

<div class="topic-metadata">

**Author:** [@xef](https://discuss.elastic.co/u/xef)\
**Replies:** 3\
**Last updated:** [March 16, 2022, 11:06am UTC](https://discuss.elastic.co/t/how-to-update-a-field-with-null-using-nest-and-the-update-api/299390 "2022-03-16T11:06:35Z")

</div>

We are using the NEST library with Elasticsearch versions 7.14. Lets say we have assigned a field Greeting with a value of "hello World". The filed is mapped as a Keyword type and Not Indexed. If you update that docum…

---

## [Metricbeat kibana no stable](https://discuss.elastic.co/t/metricbeat-kibana-no-stable/299091)

<div class="topic-metadata">

**Author:** [@gerardgorrion](https://discuss.elastic.co/u/gerardgorrion)\
**Replies:** 3\
**Last updated:** [March 16, 2022, 10:48am UTC](https://discuss.elastic.co/t/metricbeat-kibana-no-stable/299091 "2022-03-16T10:48:51Z")

</div>

We are triying to deploy metricbeat to monitor kibana in eck with stack monitoring. The problem is, the monitoring is not working fine: Kibana stack monitoring: Last 15 min of a single kibana node (continous monitor…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1010)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1012)
