# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1012 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1013 --- ## [Use per field analyzer wrapper in elasticsearch](https://discuss.elastic.co/t/use-per-field-analyzer-wrapper-in-elasticsearch/299850)
**Author:** [@dishant.sharma](https://discuss.elastic.co/u/dishant.sharma)\ **Replies:** 0\ **Last updated:** [March 16, 2022, 10:48am UTC](https://discuss.elastic.co/t/use-per-field-analyzer-wrapper-in-elasticsearch/299850 "2022-03-16T10:48:50Z")
I am creating an Elasticsearch plugin where I am writing code for tokenizer and analyzer in java. There is a case scenario where I have to use the multi fields to analyze something. There are some examples available to u… --- ## [Login loop and error 401 on /api/licensing/info](https://discuss.elastic.co/t/login-loop-and-error-401-on-api-licensing-info/298933)
**Author:** [@ETspielberg](https://discuss.elastic.co/u/ETspielberg)\ **Replies:** 1\ **Last updated:** [March 16, 2022, 10:44am UTC](https://discuss.elastic.co/t/login-loop-and-error-401-on-api-licensing-info/298933 "2022-03-16T10:44:53Z")
Hi everyone, I have a strange problem with kibana, which I cannot figure out. It is similar to a number of topics here (e.g. https://discuss.elastic.co/t/http-error-401-on-api-licensing-info/281542, https://discuss.elas… --- ## [The fastest way to export to Text](https://discuss.elastic.co/t/the-fastest-way-to-export-to-text/299849)
**Author:** [@xodn0812](https://discuss.elastic.co/u/xodn0812)\ **Replies:** 0\ **Last updated:** [March 16, 2022, 10:23am UTC](https://discuss.elastic.co/t/the-fastest-way-to-export-to-text/299849 "2022-03-16T10:23:24Z")
Hi. I want to create a function to export logs stored in Elasticsearch to Text using Java APIs. Currently, I have used the Scroll API to implement it, but I want it to be more than twice as fast. Is the Scroll API the… --- ## [Failed to restore the incdices](https://discuss.elastic.co/t/failed-to-restore-the-incdices/299848)
**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Replies:** 0\ **Last updated:** [March 16, 2022, 10:16am UTC](https://discuss.elastic.co/t/failed-to-restore-the-incdices/299848 "2022-03-16T10:16:29Z")
we are unable to restore some indices and get json\_parse\_exception. repo is in S3 bucket. curl -u user:passwd - H 'Content-Type: application/json' -XPOST https://\:9200/\_snapshot/\/\/\_res… --- ## [Premature file delete when file\_completed\_action is set to "delete"](https://discuss.elastic.co/t/premature-file-delete-when-file-completed-action-is-set-to-delete/299845)
**Author:** [@pinehk](https://discuss.elastic.co/u/pinehk)\ **Replies:** 0\ **Last updated:** [March 16, 2022, 9:12am UTC](https://discuss.elastic.co/t/premature-file-delete-when-file-completed-action-is-set-to-delete/299845 "2022-03-16T09:12:01Z")
Hi, The files i needed to push to Elasticsearch for indexing are all "completed" files. To avoid duplicated document I'm trying the file\_completed\_action switch. Setting a document ID is not an option as my data files a… --- ## [Relationship between Elasticsearch and Nagios](https://discuss.elastic.co/t/relationship-between-elasticsearch-and-nagios/299844)
**Author:** [@nour41\_nour41](https://discuss.elastic.co/u/nour41_nour41)\ **Replies:** 6\ **Last updated:** [March 16, 2022, 10:04am UTC](https://discuss.elastic.co/t/relationship-between-elasticsearch-and-nagios/299844 "2022-03-16T10:04:35Z")
relationship between Elasticsearch and Nagios and communication . thanks --- ## [Unable to upgrade elasticsearch from 6.8.1 to 7.16.3](https://discuss.elastic.co/t/unable-to-upgrade-elasticsearch-from-6-8-1-to-7-16-3/299697)
**Author:** [@karthik\_s4](https://discuss.elastic.co/u/karthik_s4)\ **Replies:** 13\ **Last updated:** [March 16, 2022, 9:54am UTC](https://discuss.elastic.co/t/unable-to-upgrade-elasticsearch-from-6-8-1-to-7-16-3/299697 "2022-03-16T09:54:18Z")
Hi, Unable to upgrade Elasticsearch to 7.16.3 from 6.81 in our elastic cluster with 4 nodes. getting below messages in log file with this. please help. \[2022-03-12T17:04:36,236\]\[INFO \]\[o.e.x.m.e.l.LocalExporter\] \[10.4.… --- ## [Kibana lens visualization is very slow](https://discuss.elastic.co/t/kibana-lens-visualization-is-very-slow/299198)
**Author:** [@notgurev](https://discuss.elastic.co/u/notgurev)\ **Replies:** 10\ **Last updated:** [March 16, 2022, 9:45am UTC](https://discuss.elastic.co/t/kibana-lens-visualization-is-very-slow/299198 "2022-03-16T09:45:25Z")
I have a cluster consisting of 1 hot (40 cores, 2 SSDs) and 2 cold nodes. I use a data stream to index a lot of data into 50gb one-shard indices with rollover, ILM, etc. Data is also sorted by @timestamp (asc) -- so I be… --- ## [Elasticsearch user creation fails](https://discuss.elastic.co/t/elasticsearch-user-creation-fails/299478)
**Author:** [@nandatibco](https://discuss.elastic.co/u/nandatibco)\ **Replies:** 2\ **Last updated:** [March 16, 2022, 8:50am UTC](https://discuss.elastic.co/t/elasticsearch-user-creation-fails/299478 "2022-03-16T08:50:50Z")
Hello team, When I try to create user with below command getting below error in ES version:7.17.0, please help.... ./elasticsearch-setup-passwords interactive -u "https://test.com:9085" But following settings are in e… --- ## [Error: failed to publish events: temporary bulk send failure](https://discuss.elastic.co/t/error-failed-to-publish-events-temporary-bulk-send-failure/299270)
**Author:** [@samettozbay](https://discuss.elastic.co/u/samettozbay)\ **Replies:** 4\ **Last updated:** [March 16, 2022, 9:00am UTC](https://discuss.elastic.co/t/error-failed-to-publish-events-temporary-bulk-send-failure/299270 "2022-03-16T09:00:39Z")
I have issue about sending logs with filebeat. I have checked all the topics related this issue but i couldn't figure out it yet . I have Elasticsearch v 7.10.2 and i am using filebeat 7.10.0. I created my pipeline as… --- ## [Kibana Panel Filter](https://discuss.elastic.co/t/kibana-panel-filter/299468)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 1\ **Last updated:** [March 16, 2022, 8:25am UTC](https://discuss.elastic.co/t/kibana-panel-filter/299468 "2022-03-16T08:25:33Z")
Hello All, Can some tell me how can this can be achieved,just show all CPU ,Memory,Diskusage ,Process Memory etc with host name that are critical based on threshhold.Currently I am able to achieve this but issue is some… --- ## [Elasticsearch - solving \`No space left on device\`](https://discuss.elastic.co/t/elasticsearch-solving-no-space-left-on-device/299838)
**Author:** [@sokolmateusz](https://discuss.elastic.co/u/sokolmateusz)\ **Replies:** 0\ **Last updated:** [March 16, 2022, 8:34am UTC](https://discuss.elastic.co/t/elasticsearch-solving-no-space-left-on-device/299838 "2022-03-16T08:34:34Z")
Hi! I'm using ELK (Elasticsearch, kibana, filebeat, metricbeat) deployed via Helm. I'm collecting small amount logs from a few containers and PVC for Elasticsearch is set to 2Gi. For some reason this space after one n… --- ## [Keycloak Elasticsearch/Kibana Configuration](https://discuss.elastic.co/t/keycloak-elasticsearch-kibana-configuration/299624)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 8\ **Last updated:** [March 16, 2022, 7:42am UTC](https://discuss.elastic.co/t/keycloak-elasticsearch-kibana-configuration/299624 "2022-03-16T07:42:27Z")
Hi, I'm having trouble configuring Kibana and Keycloak to use SSO. I am getting an error like the one below: Failed to authenticate user with OpenID Connect (Caused by ElasticsearchSecurityException\[Failed to exchange … --- ## [Your browser does not meet the security requirements for kibana?](https://discuss.elastic.co/t/your-browser-does-not-meet-the-security-requirements-for-kibana/299813)
**Author:** [@pinehk](https://discuss.elastic.co/u/pinehk)\ **Replies:** 1\ **Last updated:** [March 16, 2022, 7:31am UTC](https://discuss.elastic.co/t/your-browser-does-not-meet-the-security-requirements-for-kibana/299813 "2022-03-16T07:31:30Z")
There is a small popup with the message "your browser does not meet the security requirements for kibana" everytime opening Kibana. From related posts it seems to be complaining a non-CSP compliant browser and especially… --- ## [How to find missing logs](https://discuss.elastic.co/t/how-to-find-missing-logs/299823)
**Author:** [@dginfi](https://discuss.elastic.co/u/dginfi)\ **Replies:** 0\ **Last updated:** [March 16, 2022, 7:01am UTC](https://discuss.elastic.co/t/how-to-find-missing-logs/299823 "2022-03-16T07:01:12Z")
I have logs being forwarding from Panorama to ELK. On ELK server I have filebeats setup with panw module enabled which receives the logs and forwards to logstash. In logstash filter I am using jdbc\_streaming filter for… --- ## [Need to Push cloudtrail log to ELK using Filebeat](https://discuss.elastic.co/t/need-to-push-cloudtrail-log-to-elk-using-filebeat/299818)
**Author:** [@Anwar](https://discuss.elastic.co/u/Anwar)\ **Replies:** 0\ **Last updated:** [March 16, 2022, 5:42am UTC](https://discuss.elastic.co/t/need-to-push-cloudtrail-log-to-elk-using-filebeat/299818 "2022-03-16T05:42:42Z")
Hi, I want to push my cloudtrail logs to elk using filebeat. The Elasticsearch is a customised one. So I can't able to push the filebeat output directly to Elasticsearch. So I will use Logstash as output. From Logstash … --- ## [Nagios Performance data =\> Kafka Topic =\> Elastic search(Need to process Nagios performance data)](https://discuss.elastic.co/t/nagios-performance-data-kafka-topic-elastic-search-need-to-process-nagios-performance-data/299594)
**Author:** [@ranjithkodumbu](https://discuss.elastic.co/u/ranjithkodumbu)\ **Replies:** 4\ **Last updated:** [March 16, 2022, 5:13am UTC](https://discuss.elastic.co/t/nagios-performance-data-kafka-topic-elastic-search-need-to-process-nagios-performance-data/299594 "2022-03-16T05:13:20Z")
Hello team, I am trying to process Nagios performance data to ELK using logstash, I am receiving Nagios performance data format below, need to process and update it to the Elastic index. {"check\_type": "service", "chec… --- ## [Cannot add 10 or more rows to Visualize Library in table view in Kibana](https://discuss.elastic.co/t/cannot-add-10-or-more-rows-to-visualize-library-in-table-view-in-kibana/299350)
**Author:** [@Stek\_new](https://discuss.elastic.co/u/Stek_new)\ **Replies:** 2\ **Last updated:** [March 16, 2022, 5:12am UTC](https://discuss.elastic.co/t/cannot-add-10-or-more-rows-to-visualize-library-in-table-view-in-kibana/299350 "2022-03-16T05:12:27Z")
Hello! I cannot add 10 or more rows to Visualize Library in table view in Kibana Steps on how to reproduce the issue: Go Dev Tools and run the following query: POST logs-my\_app-default/\_doc { "@timestamp": "2099-… --- ## [Run elasticsearch without initial master nodes configured](https://discuss.elastic.co/t/run-elasticsearch-without-initial-master-nodes-configured/299812)
**Author:** [@auto\_reply\_007](https://discuss.elastic.co/u/auto_reply_007)\ **Replies:** 0\ **Last updated:** [March 16, 2022, 4:24am UTC](https://discuss.elastic.co/t/run-elasticsearch-without-initial-master-nodes-configured/299812 "2022-03-16T04:24:24Z")
Hi! i have 3 node cluster ( 7.16.2 ) with this config ( example from first node ) cluster.name: sactions cluster.routing.allocation.awareness.attributes: zone cluster.routing.allocation.awareness.force.zone.values: zo… --- ## [How to collect all types of logs from my fortinet firewall using ELK](https://discuss.elastic.co/t/how-to-collect-all-types-of-logs-from-my-fortinet-firewall-using-elk/296830)
**Author:** [@randyvinoth](https://discuss.elastic.co/u/randyvinoth)\ **Replies:** 20\ **Last updated:** [March 16, 2022, 4:20am UTC](https://discuss.elastic.co/t/how-to-collect-all-types-of-logs-from-my-fortinet-firewall-using-elk/296830 "2022-03-16T04:20:54Z")
I configured Elasticsearch, Logstash and Kibana after lots of errors. I also configured my fortinet firewall for syslogd server to send the logs to ELK server. But I am not getting any data from my firewall. Also I confi… --- ## [AWS CloudTrail SQS integration issues](https://discuss.elastic.co/t/aws-cloudtrail-sqs-integration-issues/299783)
**Author:** [@bil15](https://discuss.elastic.co/u/bil15)\ **Replies:** 1\ **Last updated:** [March 16, 2022, 3:16am UTC](https://discuss.elastic.co/t/aws-cloudtrail-sqs-integration-issues/299783 "2022-03-16T03:16:32Z")
Hello! I'm trying to ingest AWS CloudTrail logs via AWS integration in Fleet using S3 input (SQS). I followed this article to configure CloudTrail logs forwarding to SQS: https://docs.rapid7.com/insightidr/aws-cloudtr… --- ## [Applying slowlog setting on daily rotated search index](https://discuss.elastic.co/t/applying-slowlog-setting-on-daily-rotated-search-index/299298)
**Author:** [@Nobuaki\_Ito](https://discuss.elastic.co/u/Nobuaki_Ito)\ **Replies:** 4\ **Last updated:** [March 16, 2022, 2:58am UTC](https://discuss.elastic.co/t/applying-slowlog-setting-on-daily-rotated-search-index/299298 "2022-03-16T02:58:45Z")
My team currently own an Elasticsearch with daily rotated index. The index name changes once the daily rotation completes, and hence it requires to have slowlog threshold configured after each daily rotation completes. W… --- ## [Custom Journald logs and Elastic 8](https://discuss.elastic.co/t/custom-journald-logs-and-elastic-8/299805)
**Author:** [@ooraini](https://discuss.elastic.co/u/ooraini)\ **Replies:** 0\ **Last updated:** [March 16, 2022, 12:43am UTC](https://discuss.elastic.co/t/custom-journald-logs-and-elastic-8/299805 "2022-03-16T00:43:25Z")
The Journald integration is not yet supported in Elastic 8 as indicated in package page: I did a test installation of Elastic 8.1, and indeed the package doesn't appear when searching for it in the integrations page in… --- ## [Logstash didn't send logs to Elasticsearch after upgrade](https://discuss.elastic.co/t/logstash-didnt-send-logs-to-elasticsearch-after-upgrade/299802)
**Author:** [@Othmane\_CHHAIBI](https://discuss.elastic.co/u/Othmane_CHHAIBI)\ **Replies:** 2\ **Last updated:** [March 16, 2022, 12:17am UTC](https://discuss.elastic.co/t/logstash-didnt-send-logs-to-elasticsearch-after-upgrade/299802 "2022-03-16T00:17:34Z")
hi, i upgrade logstash from version 6.8 to 7.16.2 but after this upgrade the status of logstash is running and it didn't sent logs to Elasticsearch (version 7.16.2). Here the error message from logs of logstash server : … --- ## [Elasticsearch 8.1.0 on Windows VM running in Azure not showing or creating Indices](https://discuss.elastic.co/t/elasticsearch-8-1-0-on-windows-vm-running-in-azure-not-showing-or-creating-indices/299561)
**Author:** [@ddynamight](https://discuss.elastic.co/u/ddynamight)\ **Replies:** 5\ **Last updated:** [March 16, 2022, 12:04am UTC](https://discuss.elastic.co/t/elasticsearch-8-1-0-on-windows-vm-running-in-azure-not-showing-or-creating-indices/299561 "2022-03-16T00:04:01Z")
I have just set up Elasticsearch 8.1.0 on a Windows Server 2022 VM running inside Azure, but the indexing is not working. I am unable to create new indices or view the default indices. A get request to localhost:9200/\_c… --- ## [How to deal with Elastic Cloud?](https://discuss.elastic.co/t/how-to-deal-with-elastic-cloud/299670)
**Author:** [@iNikolas](https://discuss.elastic.co/u/iNikolas)\ **Replies:** 8\ **Last updated:** [March 15, 2022, 11:38pm UTC](https://discuss.elastic.co/t/how-to-deal-with-elastic-cloud/299670 "2022-03-15T23:38:21Z")
Hi all. I have studied Elasticsearch for a while by means of DevTools, where everything worked just fine: index creation; tweaking search and data Analyzers; data population with CSV files. But for now, I decided to … --- ## [Kibana multi-line chart with legend help](https://discuss.elastic.co/t/kibana-multi-line-chart-with-legend-help/299769)
**Author:** [@Tingda\_Du](https://discuss.elastic.co/u/Tingda_Du)\ **Replies:** 2\ **Last updated:** [March 15, 2022, 9:38pm UTC](https://discuss.elastic.co/t/kibana-multi-line-chart-with-legend-help/299769 "2022-03-15T21:38:11Z")
I would like to draw a multi-line chart with legend from a query with format like the following: "aggregations": { "time\_buckets": { "buckets": \[ { "key\_as\_string": "2022-02-22T00:00:00.000… --- ## [Column event.dataset is empty](https://discuss.elastic.co/t/column-event-dataset-is-empty/299792)
**Author:** [@Guif](https://discuss.elastic.co/u/Guif)\ **Replies:** 0\ **Last updated:** [March 15, 2022, 9:29pm UTC](https://discuss.elastic.co/t/column-event-dataset-is-empty/299792 "2022-03-15T21:29:05Z")
Hi, Inside ELK when goes to check the logs (/app/logs/stream) column "event.dataset" is empty but if I click on certain event (View Details) the value of "fields.event.dataset" are correctly informed (mylog) Value of "… --- ## [Getting multiple fields out of agent](https://discuss.elastic.co/t/getting-multiple-fields-out-of-agent/298228)
**Author:** [@itschobot](https://discuss.elastic.co/u/itschobot)\ **Replies:** 3\ **Last updated:** [March 15, 2022, 8:22pm UTC](https://discuss.elastic.co/t/getting-multiple-fields-out-of-agent/298228 "2022-03-15T20:22:25Z")
still new and learning filters... how would I get multiple fields out of agent? "agent" =\> { "hostname" =\> "2487b31167e2", "name" =\> "123b456c", "ephemeral\_id" =\> "123b456c", "version" =\> "7.15.1", "id" =\> "123b45… --- ## [How to add cluster name in the event using add-kubernetes-metadata processor](https://discuss.elastic.co/t/how-to-add-cluster-name-in-the-event-using-add-kubernetes-metadata-processor/299784)
**Author:** [@Dario\_Louzado](https://discuss.elastic.co/u/Dario_Louzado)\ **Replies:** 0\ **Last updated:** [March 15, 2022, 8:17pm UTC](https://discuss.elastic.co/t/how-to-add-cluster-name-in-the-event-using-add-kubernetes-metadata-processor/299784 "2022-03-15T20:17:12Z")
Hi, I'm using kubernetes autodiscover with add-kubernetes-metadata processor. In the log event I could not find the kubernetes cluster name. Only the namespace. How can I get this information? Thanks in advance. Reg… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1011) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1013)