# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1024 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1025 --- ## [Graph in Kibana is empty](https://discuss.elastic.co/t/graph-in-kibana-is-empty/298204)
**Author:** [@Soumanou\_Karimou](https://discuss.elastic.co/u/Soumanou_Karimou)\ **Replies:** 1\ **Last updated:** [March 7, 2022, 4:20pm UTC](https://discuss.elastic.co/t/graph-in-kibana-is-empty/298204 "2022-03-07T16:20:54Z")
Hello, I've ingested two columns data in an elastic index. The values are related: spi,ip spi1,ip1 spi2,ip1 spi3,ip1 spi4,ip2 spi5,ip2 spi6,ip2 Nothing appears in the Kibana graph when choosing ip,sip as columns… --- ## [Pulling aggregations for use in watchers](https://discuss.elastic.co/t/pulling-aggregations-for-use-in-watchers/298977)
**Author:** [@walshe06](https://discuss.elastic.co/u/walshe06)\ **Replies:** 0\ **Last updated:** [March 7, 2022, 2:31pm UTC](https://discuss.elastic.co/t/pulling-aggregations-for-use-in-watchers/298977 "2022-03-07T14:31:38Z")
Hi all In the below example, I have added terms to pull out the referer in the aggregation so I can use it in my watcher action. I can pull each referer individually with the following 'referer': e.per\_15m.buckets\[0\].re… --- ## [Master node role cannot be removed in 8.0.0](https://discuss.elastic.co/t/master-node-role-cannot-be-removed-in-8-0-0/298526)
**Author:** [@jean.bissonnette](https://discuss.elastic.co/u/jean.bissonnette)\ **Replies:** 28\ **Last updated:** [March 7, 2022, 2:24pm UTC](https://discuss.elastic.co/t/master-node-role-cannot-be-removed-in-8-0-0/298526 "2022-03-07T14:24:38Z")
I have 5 nodes, 3 of them are master. Running on podman on RHEL as systemD service. By error, I set the 2 others as master and ran the cluster but they should be data only. When I change their Elasticsearch.yml to rem… --- ## [Unbalanced shards](https://discuss.elastic.co/t/unbalanced-shards/298520)
**Author:** [@Sashi](https://discuss.elastic.co/u/Sashi)\ **Replies:** 6\ **Last updated:** [March 7, 2022, 2:17pm UTC](https://discuss.elastic.co/t/unbalanced-shards/298520 "2022-03-07T14:17:40Z")
Hello, I have a cluster of over 25 nodes and the indices are balanced on all the nodes except for one node. Let's call the node as problematic node. The problematic node has less indices and shards when compared to othe… --- ## [Errors with High Level Rest Client After Upgrading to Elasticsearch 8.0.1](https://discuss.elastic.co/t/errors-with-high-level-rest-client-after-upgrading-to-elasticsearch-8-0-1/298972)
**Author:** [@chris.stack.bb](https://discuss.elastic.co/u/chris.stack.bb)\ **Replies:** 1\ **Last updated:** [March 7, 2022, 1:56pm UTC](https://discuss.elastic.co/t/errors-with-high-level-rest-client-after-upgrading-to-elasticsearch-8-0-1/298972 "2022-03-07T13:56:50Z")
Hello, After upgrading to Elasticsearch 8.0.1, I am having a variety of errors interfacing from my Java High Level Rest Client version 7.17.1 (originally tried with 7.15.2). The code now seems extremely sensitive to nul… --- ## [How to pass variable base parameter in http\_poller logstash input plugin](https://discuss.elastic.co/t/how-to-pass-variable-base-parameter-in-http-poller-logstash-input-plugin/298621)
**Author:** [@Purushottam22](https://discuss.elastic.co/u/Purushottam22)\ **Replies:** 1\ **Last updated:** [March 2, 2022, 8:16pm UTC](https://discuss.elastic.co/t/how-to-pass-variable-base-parameter-in-http-poller-logstash-input-plugin/298621 "2022-03-02T20:16:41Z")
Hi All, Can you please help me with below issue, I am trying to hit two rest api for below two conditions: First is used for providing the login credentials and it will give an response as session id. I have to use t… --- ## [Filebeat: MISP automation](https://discuss.elastic.co/t/filebeat-misp-automation/298963)
**Author:** [@filip.wozniak](https://discuss.elastic.co/u/filip.wozniak)\ **Replies:** 0\ **Last updated:** [March 7, 2022, 12:08pm UTC](https://discuss.elastic.co/t/filebeat-misp-automation/298963 "2022-03-07T12:08:03Z")
Greetings! Is there any way to make MISP module update deleted entries from MISP so they will be deleted also in Elasticsearch? Yours, Filip --- ## [Flush syncing on rotated indicies](https://discuss.elastic.co/t/flush-syncing-on-rotated-indicies/298911)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 4\ **Last updated:** [March 7, 2022, 11:30am UTC](https://discuss.elastic.co/t/flush-syncing-on-rotated-indicies/298911 "2022-03-07T11:30:48Z")
Thinking about running an operation procedure that should do flushed sync on daily 'rotated' indices and wondering... Would this be a feasible and good idea and what to avoid? If we after midnight do synced flush per i… --- ## [Two DC cluster setup](https://discuss.elastic.co/t/two-dc-cluster-setup/298912)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 2\ **Last updated:** [March 7, 2022, 11:29am UTC](https://discuss.elastic.co/t/two-dc-cluster-setup/298912 "2022-03-07T11:29:34Z")
Have startedin a new position where we currently have a two Data Center cluster with 5 master/data nodes + 1 master-only node and indices having replication of 1. Wondering if we better ought to do few (+3) dedicated ma… --- ## [Elasticsearch-dsl python connection timeout](https://discuss.elastic.co/t/elasticsearch-dsl-python-connection-timeout/293762)
**Author:** [@maph](https://discuss.elastic.co/u/maph)\ **Replies:** 6\ **Last updated:** [March 7, 2022, 10:19am UTC](https://discuss.elastic.co/t/elasticsearch-dsl-python-connection-timeout/293762 "2022-03-07T10:19:42Z")
Hi all, Fairly new to Elasticsearch and hoping that some of you might be able to help me troubleshoot an attempt to use the python Elasticsearch-dsl to perform a search in a public database? I am able to access the dat… --- ## [Create a dashboard using two different Data stream index](https://discuss.elastic.co/t/create-a-dashboard-using-two-different-data-stream-index/298388)
**Author:** [@niveditakathal](https://discuss.elastic.co/u/niveditakathal)\ **Replies:** 3\ **Last updated:** [March 7, 2022, 9:57am UTC](https://discuss.elastic.co/t/create-a-dashboard-using-two-different-data-stream-index/298388 "2022-03-07T09:57:48Z")
Hi Experts, I want to create a dashboard using two different Data stream index {as mentioned below under notes}. when I checked the available options to do so , I read about \_aliases option; however in my use-case that … --- ## [\[Vega\] Function setMapView not recognized anymore](https://discuss.elastic.co/t/vega-function-setmapview-not-recognized-anymore/296983)
**Author:** [@Kayak007](https://discuss.elastic.co/u/Kayak007)\ **Replies:** 5\ **Last updated:** [March 7, 2022, 9:01am UTC](https://discuss.elastic.co/t/vega-function-setmapview-not-recognized-anymore/296983 "2022-03-07T09:01:29Z")
Hi, Some time ago, when using 7.10.x, I used to use (...) the function setMapView in Vega visualizations in order to modify signals latitude, longitude and zoom simultaneously. I hadn't looked at these in quite some ti… --- ## [Logstash Performance](https://discuss.elastic.co/t/logstash-performance/298942)
**Author:** [@mani1](https://discuss.elastic.co/u/mani1)\ **Replies:** 0\ **Last updated:** [March 7, 2022, 8:46am UTC](https://discuss.elastic.co/t/logstash-performance/298942 "2022-03-07T08:46:41Z")
Hello , We have maximize the Logstash performance in terms of processed events per sec, by tuning vcpus, Heap, pipeline workers, Consumer Threads, N/w bandwidth, Batch size etc. There is no scarcity of resources assigne… --- ## [Elasticsearch automatic reindex](https://discuss.elastic.co/t/elasticsearch-automatic-reindex/298847)
**Author:** [@bianca6](https://discuss.elastic.co/u/bianca6)\ **Replies:** 3\ **Last updated:** [March 7, 2022, 8:25am UTC](https://discuss.elastic.co/t/elasticsearch-automatic-reindex/298847 "2022-03-07T08:25:38Z")
Hello, I am using a pipeline with Filebeat / Logstash / Elasticsearch / Kibana version 8 to deal with logs. One of the field is a nano second timestamp. Long story, I can't send it as a 'date\_nanos', so, what I'm doin… --- ## [Winlogbeat - Footprint as a shipper?](https://discuss.elastic.co/t/winlogbeat-footprint-as-a-shipper/298937)
**Author:** [@arunhk3](https://discuss.elastic.co/u/arunhk3)\ **Replies:** 0\ **Last updated:** [March 7, 2022, 7:41am UTC](https://discuss.elastic.co/t/winlogbeat-footprint-as-a-shipper/298937 "2022-03-07T07:41:17Z")
Hi All, I have a question where I would like to know the footprint (resource usage) when Winlogbeat is operating on a Windows Server when collecting and shipping logs. Also I would like to know as to what would happen … --- ## [Elasticsearch startup problemse](https://discuss.elastic.co/t/elasticsearch-startup-problemse/298831)
**Author:** [@zx\_emo](https://discuss.elastic.co/u/zx_emo)\ **Replies:** 5\ **Last updated:** [March 7, 2022, 7:20am UTC](https://discuss.elastic.co/t/elasticsearch-startup-problemse/298831 "2022-03-07T07:20:59Z")
Hello, my Yml file looks like this #xpack.license.self\_generated.type: basic xpack.security.enabled: true #xpack.security.enrollment.enabled: true #xpack.security.enrollment.enabled: true # Enable encryption for HTTP … --- ## [Alerts in kibana](https://discuss.elastic.co/t/alerts-in-kibana/298696)
**Author:** [@tharunkumar](https://discuss.elastic.co/u/tharunkumar)\ **Replies:** 4\ **Last updated:** [March 7, 2022, 6:19am UTC](https://discuss.elastic.co/t/alerts-in-kibana/298696 "2022-03-07T06:19:14Z")
log \[10:06:16.242\] \[error\]\[alerting\]\[alerts\]\[plugins\]\[plugins\] Executing Alert "34af2110-24f6-11ec-8071-63a4b456f636" has resulted in Error: Unable to create alerts client because the Encrypted Saved Objects plugin is … --- ## [Timepicker sync using mustache template kibana](https://discuss.elastic.co/t/timepicker-sync-using-mustache-template-kibana/298752)
**Author:** [@yangesh4u1](https://discuss.elastic.co/u/yangesh4u1)\ **Replies:** 1\ **Last updated:** [March 7, 2022, 4:40am UTC](https://discuss.elastic.co/t/timepicker-sync-using-mustache-template-kibana/298752 "2022-03-07T04:40:43Z")
Hi Team, I created a redirection link in kibana TSVB visualization using Mustache Template like below. I am wondering if Last selected timeframe in current page of Kibana can be synced if i am navigating to another… --- ## [Fetch specific data](https://discuss.elastic.co/t/fetch-specific-data/298927)
**Author:** [@mahmoudmaani](https://discuss.elastic.co/u/mahmoudmaani)\ **Replies:** 0\ **Last updated:** [March 7, 2022, 2:35am UTC](https://discuss.elastic.co/t/fetch-specific-data/298927 "2022-03-07T02:35:12Z")
Guys I am trying to fetch some data from the alert's index ".siem-signals-default-\*" I am trying to retrieve just the "alert id", "alert name", "ancestor index", "ancestor ID", and "group index" I used the below query: … --- ## [How to use field-value-factor when mapping missing field in java?](https://discuss.elastic.co/t/how-to-use-field-value-factor-when-mapping-missing-field-in-java/298930)
**Author:** [@ifree-zm](https://discuss.elastic.co/u/ifree-zm)\ **Replies:** 1\ **Last updated:** [March 7, 2022, 2:56am UTC](https://discuss.elastic.co/t/how-to-use-field-value-factor-when-mapping-missing-field-in-java/298930 "2022-03-07T02:56:38Z")
If mapping does not have a field, field-value-factor is used; otherwise, field-value-factor is not used --- ## [Migration data from a cluster to another cluster](https://discuss.elastic.co/t/migration-data-from-a-cluster-to-another-cluster/298915)
**Author:** [@alicango](https://discuss.elastic.co/u/alicango)\ **Replies:** 6\ **Last updated:** [March 6, 2022, 11:41pm UTC](https://discuss.elastic.co/t/migration-data-from-a-cluster-to-another-cluster/298915 "2022-03-06T23:41:53Z")
Hello, dear community, Assume that I have got 2 different clusters(Cluster-A and Cluster-B). Each cluster has 3 master nodes, 2 hot nodes, 2 warm nodes, and 2 cold nodes. My goal is to migrate all data from Cluster-A t… --- ## [ElasticSearch to Analysis Services](https://discuss.elastic.co/t/elasticsearch-to-analysis-services/298727)
**Author:** [@LSCZZ](https://discuss.elastic.co/u/LSCZZ)\ **Replies:** 0\ **Last updated:** [March 3, 2022, 11:07am UTC](https://discuss.elastic.co/t/elasticsearch-to-analysis-services/298727 "2022-03-03T11:07:52Z")
is it possible to connect Elasticsearch to Analysis Services? I already got a ODBC Elastic Driver installed which is working fine because I'm able to pull data into Power BI, however I'd like to connect on Analysis Serv… --- ## [General question about Elasticsearch cluster](https://discuss.elastic.co/t/general-question-about-elasticsearch-cluster/298913)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 1\ **Last updated:** [March 6, 2022, 10:19pm UTC](https://discuss.elastic.co/t/general-question-about-elasticsearch-cluster/298913 "2022-03-06T22:19:02Z")
Hi, I am using ELK 8, if I have 4 servers with Logstash and one of them have also additionally Elasticsearch and Kibana... ..and if I will create Elasticsearch cluster, can each of Logstash report to local Elasticsearch… --- ## [Sample data](https://discuss.elastic.co/t/sample-data/298340)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 5\ **Last updated:** [March 6, 2022, 4:07pm UTC](https://discuss.elastic.co/t/sample-data/298340 "2022-03-06T16:07:39Z")
I have a lot sample/example/automatic data after install ELK, sometimes it is loaded again. Can I delete it somehow? or I need do it always manually :(? --- ## [After upgrading to Kibana 7.16.2 I cannot create aggregation in Kibana based on nested fields](https://discuss.elastic.co/t/after-upgrading-to-kibana-7-16-2-i-cannot-create-aggregation-in-kibana-based-on-nested-fields/298910)
**Author:** [@Nicole\_Hirshler](https://discuss.elastic.co/u/Nicole_Hirshler)\ **Replies:** 0\ **Last updated:** [March 6, 2022, 10:57am UTC](https://discuss.elastic.co/t/after-upgrading-to-kibana-7-16-2-i-cannot-create-aggregation-in-kibana-based-on-nested-fields/298910 "2022-03-06T10:57:59Z")
Using Kibana 7.16.2 I'm trying to create new simple visualization as table, using aggregation based on nested field and it is not available for selection. Using Dev Tools I can search nested fields. I use the simplest e… --- ## [Slow search in Kibana / ElasticSearch](https://discuss.elastic.co/t/slow-search-in-kibana-elasticsearch/297368)
**Author:** [@notgurev](https://discuss.elastic.co/u/notgurev)\ **Replies:** 14\ **Last updated:** [March 6, 2022, 10:44am UTC](https://discuss.elastic.co/t/slow-search-in-kibana-elasticsearch/297368 "2022-03-06T10:44:29Z")
When trying to visualize data, it takes a lot of time to get even the most recent data. I'm trying to figure out what's wrong with our setup that causes this: 3 nodes (1 hot, 2 cold) Hourly indices, 1 shard per index (… --- ## [ElasticSearch aggregate on a scripted nested field](https://discuss.elastic.co/t/elasticsearch-aggregate-on-a-scripted-nested-field/298841)
**Author:** [@doogyatnesta](https://discuss.elastic.co/u/doogyatnesta)\ **Replies:** 2\ **Last updated:** [March 6, 2022, 10:32am UTC](https://discuss.elastic.co/t/elasticsearch-aggregate-on-a-scripted-nested-field/298841 "2022-03-06T10:32:30Z")
I have the following mapping in my Elasticsearch index (simplified as the other fields are irrelevant: { "test": { "mappings": { "properties": { "name": { "type": "keyword" }, … --- ## [How to create a index from \_security\\user so nonpriv user could view](https://discuss.elastic.co/t/how-to-create-a-index-from-security-user-so-nonpriv-user-could-view/298908)
**Author:** [@stobbe99](https://discuss.elastic.co/u/stobbe99)\ **Replies:** 0\ **Last updated:** [March 6, 2022, 9:52am UTC](https://discuss.elastic.co/t/how-to-create-a-index-from-security-user-so-nonpriv-user-could-view/298908 "2022-03-06T09:52:41Z")
Hello, To access \_security\\user you need full priv. I found \_reindex does not work on this. Does anybody know what the best way is to create an index that contains the native users so that it becomes accessable for non … --- ## [ELK6.8 vs Search on object/array elements](https://discuss.elastic.co/t/elk6-8-vs-search-on-object-array-elements/298291)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 6\ **Last updated:** [March 6, 2022, 9:18am UTC](https://discuss.elastic.co/t/elk6-8-vs-search-on-object-array-elements/298291 "2022-03-06T09:18:39Z")
Got doc.s in a v.6.8 cluster looking like these: and are wondering how to discover/search for doc.s, which has a specific array element value. Say logContext.processingIds\[\*\]="some value" as simple string search li… --- ## [Elastic upgrade results in spikes of IOPS](https://discuss.elastic.co/t/elastic-upgrade-results-in-spikes-of-iops/298874)
**Author:** [@Idan\_Koch](https://discuss.elastic.co/u/Idan_Koch)\ **Replies:** 2\ **Last updated:** [March 6, 2022, 9:11am UTC](https://discuss.elastic.co/t/elastic-upgrade-results-in-spikes-of-iops/298874 "2022-03-06T09:11:47Z")
Hi, We recently upgraded from v6 to v7. We hold 400M documents. in the processor the upgrade we: reduced document size by half made schema strict increased number of shards from 20 to 30 in v6 we used elastic4s clie… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1023) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1025)