# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1026 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1027 --- ## [Kibana server is not yet ready after adding basic licensed x-pack security](https://discuss.elastic.co/t/kibana-server-is-not-yet-ready-after-adding-basic-licensed-x-pack-security/298572)
**Author:** [@edk](https://discuss.elastic.co/u/edk)\ **Replies:** 4\ **Last updated:** [March 4, 2022, 2:53pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-yet-ready-after-adding-basic-licensed-x-pack-security/298572 "2022-03-04T14:53:44Z")
I'm trying to setup minimal security for Elasticsearch and kibana on an existing test instance running 6.8.23 on a single server running both Elasticsearch and kibana, deployed on windows. I've gotten Elasticsearch to … --- ## [Deserialization of results in the Output section](https://discuss.elastic.co/t/deserialization-of-results-in-the-output-section/298634)
**Author:** [@puneet\_makhija](https://discuss.elastic.co/u/puneet_makhija)\ **Replies:** 6\ **Last updated:** [March 4, 2022, 2:43pm UTC](https://discuss.elastic.co/t/deserialization-of-results-in-the-output-section/298634 "2022-03-04T14:43:22Z")
@DavidTurner hope you are doing well can you please assist me into this one , I am stuck in this one I successfully implemented LogStash, here below is my logstash.conf code which is working perfectly input { kafka {… --- ## [TSVB "Your query attempted to fetch too much data."](https://discuss.elastic.co/t/tsvb-your-query-attempted-to-fetch-too-much-data/298620)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 1\ **Last updated:** [March 4, 2022, 2:23pm UTC](https://discuss.elastic.co/t/tsvb-your-query-attempted-to-fetch-too-much-data/298620 "2022-03-04T14:23:38Z")
Hello, I find using TSVB for my dashboard very handy but there is one drawback that I don't know how to overcome. Your query attempted to fetch too much data. Reducing the time range or changing the interval used usua… --- ## [Unable to form a cluster elasticsearch 8.0.0](https://discuss.elastic.co/t/unable-to-form-a-cluster-elasticsearch-8-0-0/298828)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 0\ **Last updated:** [March 4, 2022, 7:57am UTC](https://discuss.elastic.co/t/unable-to-form-a-cluster-elasticsearch-8-0-0/298828 "2022-03-04T07:57:30Z")
Hi Team, I have downloaded elasticsearch 8.0.0 on windows 2019. I am trying to make a 3 node cluster with master + data eligibility. Below is my Node 1 configuration cluster.name: test node.name: node-1 node.roles: \[… --- ## [SELECT the last three rows in DATA with IN list](https://discuss.elastic.co/t/select-the-last-three-rows-in-data-with-in-list/298771)
**Author:** [@fastxl](https://discuss.elastic.co/u/fastxl)\ **Replies:** 3\ **Last updated:** [March 4, 2022, 2:06pm UTC](https://discuss.elastic.co/t/select-the-last-three-rows-in-data-with-in-list/298771 "2022-03-04T14:06:32Z")
Trying to select the last 3 rows of a group. If I run this query POST /\_sql?format=txt { "query": "SELECT \\"Samples.AccumulatedTime.@@data\\",\\"Samples.AccumulatedTime.name\\",deviceName,timestamp FROM \\"mtconnect-demo\\… --- ## [Xpack.security.authc.api\_key.enabled in ECK with TLS self signed certificate disabled](https://discuss.elastic.co/t/xpack-security-authc-api-key-enabled-in-eck-with-tls-self-signed-certificate-disabled/298767)
**Author:** [@trudesea](https://discuss.elastic.co/u/trudesea)\ **Replies:** 2\ **Last updated:** [March 4, 2022, 1:58pm UTC](https://discuss.elastic.co/t/xpack-security-authc-api-key-enabled-in-eck-with-tls-self-signed-certificate-disabled/298767 "2022-03-04T13:58:59Z")
Hi, I'm using ECK on GKE and terminating SSL with LBs and Google managed certs. I have an issue where I cannot implement Fleet because of TLS being disabled. I remember seeing a post where this requirement would be … --- ## [User & Roles issue](https://discuss.elastic.co/t/user-roles-issue/298829)
**Author:** [@Vinay\_Menon1](https://discuss.elastic.co/u/Vinay_Menon1)\ **Replies:** 1\ **Last updated:** [March 4, 2022, 1:41pm UTC](https://discuss.elastic.co/t/user-roles-issue/298829 "2022-03-04T13:41:13Z")
Hi, I am new to to Elasticsearch I have zero knowledge in it. let me provide a brief intro to my setup what I could understand . We are using elastic cloud based version in that we are using elastic as a monitoring too… --- ## [Language matters - blacklist\_ and whitelist\_](https://discuss.elastic.co/t/language-matters-blacklist-and-whitelist/298803)
**Author:** [@eclctcjp](https://discuss.elastic.co/u/eclctcjp)\ **Replies:** 2\ **Last updated:** [March 4, 2022, 1:06pm UTC](https://discuss.elastic.co/t/language-matters-blacklist-and-whitelist/298803 "2022-03-04T13:06:10Z")
For the prune filter, please change to more neutral language the 4 values: blacklist\_names blacklist\_values whitelist\_names whitelist\_values I noticed this post, but it looks like we missed the settings in "prune" --- ## [How to audit search on an Elasticsearch indexes](https://discuss.elastic.co/t/how-to-audit-search-on-an-elasticsearch-indexes/298754)
**Author:** [@chriselk](https://discuss.elastic.co/u/chriselk)\ **Replies:** 6\ **Last updated:** [March 4, 2022, 10:50am UTC](https://discuss.elastic.co/t/how-to-audit-search-on-an-elasticsearch-indexes/298754 "2022-03-04T10:50:52Z")
We would like to have report on what type of search we have on some Elastic index, I cannot find the search in the servers logs, not sure how we could audit the search request done on an index ? kind of 10 most field /… --- ## [Kibana Setting "logging.dest" is deprecated can't be fixed](https://discuss.elastic.co/t/kibana-setting-logging-dest-is-deprecated-cant-be-fixed/291424)
**Author:** [@KillianS](https://discuss.elastic.co/u/KillianS)\ **Replies:** 13\ **Last updated:** [March 4, 2022, 10:19am UTC](https://discuss.elastic.co/t/kibana-setting-logging-dest-is-deprecated-cant-be-fixed/291424 "2022-03-04T10:19:48Z")
Hi all, We are facing an issue with Kibana 7.16.0 on Ubuntu 18.04. In Kibana log I can see a warning message \["warning","config","deprecation"\],"pid":24471,"message":""logging.dest" has been deprecated and will be remov… --- ## [Compare fields values in two different documents](https://discuss.elastic.co/t/compare-fields-values-in-two-different-documents/298833)
**Author:** [@elasticity2](https://discuss.elastic.co/u/elasticity2)\ **Replies:** 0\ **Last updated:** [March 4, 2022, 10:18am UTC](https://discuss.elastic.co/t/compare-fields-values-in-two-different-documents/298833 "2022-03-04T10:18:46Z")
Hi All, I am trying to achieve the following search based on the data shown in the screenshot. This is just an example to provide context as to what I am trying to do. For a given PID, in this examples (smss.exe) I nee… --- ## [Logstash + XML + Multiple split](https://discuss.elastic.co/t/logstash-xml-multiple-split/298821)
**Author:** [@Stek\_new](https://discuss.elastic.co/u/Stek_new)\ **Replies:** 1\ **Last updated:** [March 4, 2022, 9:44am UTC](https://discuss.elastic.co/t/logstash-xml-multiple-split/298821 "2022-03-04T09:44:06Z")
Hello! Wonder if someone could help me how to divide my XML into several events for their further parsing I have the following XML file (yes, everything in one row): \\\ **Author:** [@Shane\_Gannon](https://discuss.elastic.co/u/Shane_Gannon)\ **Replies:** 14\ **Last updated:** [March 4, 2022, 9:37am UTC](https://discuss.elastic.co/t/elasticsearch-2-3-purge-of-deleted-documents/296492 "2022-03-04T09:37:21Z") I've a legacy Elasticsearch 2.3 index. It is no longer being updated with new entries, instead the only modifications are deletes. All our new data targets an Elasticsearch 7 cluster. Though we do still read from the ES2… --- ## [Getting search\_phase\_execution\_exception in Kibana Discover pane](https://discuss.elastic.co/t/getting-search-phase-execution-exception-in-kibana-discover-pane/298622)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 2\ **Last updated:** [March 4, 2022, 7:44am UTC](https://discuss.elastic.co/t/getting-search-phase-execution-exception-in-kibana-discover-pane/298622 "2022-03-04T07:44:43Z")
I have many indices such as cloud-audit-aws, cloud-audit-azure, cloud-audit-gsuite, cloud-audit-secret-tools, cloud-audit-github, and many more starting with cloud-audit. I have created an index pattern cloud-audit\* to m… --- ## [Error writing registrar state to statestore: failed in store/get operation on store 'filebeat': rename /var/lib/filebeat/registry/filebeat/checkpoint.new /var/lib/filebeat/registry/filebeat/4102615046.json: no such file or directory](https://discuss.elastic.co/t/error-writing-registrar-state-to-statestore-failed-in-store-get-operation-on-store-filebeat-rename-var-lib-filebeat-registry-filebeat-checkpoint-new-var-lib-filebeat-registry-filebeat-4102615046-json-no-such-file-or-directory/298825)
**Author:** [@lucy0108](https://discuss.elastic.co/u/lucy0108)\ **Replies:** 0\ **Last updated:** [March 4, 2022, 7:36am UTC](https://discuss.elastic.co/t/error-writing-registrar-state-to-statestore-failed-in-store-get-operation-on-store-filebeat-rename-var-lib-filebeat-registry-filebeat-checkpoint-new-var-lib-filebeat-registry-filebeat-4102615046-json-no-such-file-or-directory/298825 "2022-03-04T07:36:22Z")
Hi , I see error as below while running filebeat. 2022-03-03T02:04:20.142Z ERROR \[registrar\] registrar/registrar.go:202 Error writing registrar state to statestore: failed in store/get operation on store… --- ## [Create kibana visualizations using Chart.js or elastic-charts](https://discuss.elastic.co/t/create-kibana-visualizations-using-chart-js-or-elastic-charts/298805)
**Author:** [@frank3nst3in](https://discuss.elastic.co/u/frank3nst3in)\ **Replies:** 1\ **Last updated:** [March 4, 2022, 6:55am UTC](https://discuss.elastic.co/t/create-kibana-visualizations-using-chart-js-or-elastic-charts/298805 "2022-03-04T06:55:07Z")
I want to create the visualization similar to one which are created by kibana (in dashboard). By using chart.js / elastic-charts on frontend and the data present in my Elasticsearch instance. how can I do that ? --- ## [Unable to get local issuer certificate error while building kibana - yarn build](https://discuss.elastic.co/t/unable-to-get-local-issuer-certificate-error-while-building-kibana-yarn-build/298139)
**Author:** [@Shreeya\_Rajguru](https://discuss.elastic.co/u/Shreeya_Rajguru)\ **Replies:** 4\ **Last updated:** [March 4, 2022, 5:34am UTC](https://discuss.elastic.co/t/unable-to-get-local-issuer-certificate-error-while-building-kibana-yarn-build/298139 "2022-03-04T05:34:14Z")
I am facing the unable to get local issuer certificate error when I try to build kibana using the command - yarn build --skip-os-packages I have tried these solutions before which didn't work : disabling TLS connectio… --- ## [How to maintain sql\_last\_value for different source queries](https://discuss.elastic.co/t/how-to-maintain-sql-last-value-for-different-source-queries/298812)
**Author:** [@rbnalluri](https://discuss.elastic.co/u/rbnalluri)\ **Replies:** 0\ **Last updated:** [March 4, 2022, 4:43am UTC](https://discuss.elastic.co/t/how-to-maintain-sql-last-value-for-different-source-queries/298812 "2022-03-04T04:43:31Z")
Hi, I have couple of scripts which reads data from oracle database and creates respective index files on Elasticsearch.I have implemented delta extraction logic by using the inbuilt feature of logstash by using :sql\_las… --- ## [How to change to desc without sorts in es?](https://discuss.elastic.co/t/how-to-change-to-desc-without-sorts-in-es/298801)
**Author:** [@ifree-zm](https://discuss.elastic.co/u/ifree-zm)\ **Replies:** 8\ **Last updated:** [March 4, 2022, 4:40am UTC](https://discuss.elastic.co/t/how-to-change-to-desc-without-sorts-in-es/298801 "2022-03-04T04:40:45Z")
Sort Orderedit The order option can have the following values: asc Sort in ascending order desc Sort in descending order The order defaults to desc when sorting on the \_score , and defaults to asc when sortin… --- ## [Does Logstash Persistent Queue support Syslog Plugin](https://discuss.elastic.co/t/does-logstash-persistent-queue-support-syslog-plugin/298809)
**Author:** [@ivanchak](https://discuss.elastic.co/u/ivanchak)\ **Replies:** 3\ **Last updated:** [March 4, 2022, 4:30am UTC](https://discuss.elastic.co/t/does-logstash-persistent-queue-support-syslog-plugin/298809 "2022-03-04T04:30:42Z")
Dear all, I have a pipeline that has been configured to use the syslog plugin as its input data source. And I would like to enable the Persistent Queue feature to prevent potential data loss due to a crash on Logstash. … --- ## [ElasticsearchError(error: "Routing Error. The path you have requested is invalid.", status: nil)](https://discuss.elastic.co/t/elasticsearcherror-error-routing-error-the-path-you-have-requested-is-invalid-status-nil/297977)
**Author:** [@tenna.churiki](https://discuss.elastic.co/u/tenna.churiki)\ **Replies:** 14\ **Last updated:** [March 4, 2022, 1:59am UTC](https://discuss.elastic.co/t/elasticsearcherror-error-routing-error-the-path-you-have-requested-is-invalid-status-nil/297977 "2022-03-04T01:59:17Z")
Hi, I am trying to send query with Swift, but it returns error below. Routing Error. The path you have requested is invalid. My code is below (Using ElasticSwift) let host = "myEndPoint" … --- ## [Enable Kibana Security WITHOUT Elasticsearch security](https://discuss.elastic.co/t/enable-kibana-security-without-elasticsearch-security/298695)
**Author:** [@KrishnaCh](https://discuss.elastic.co/u/KrishnaCh)\ **Replies:** 3\ **Last updated:** [March 4, 2022, 12:19am UTC](https://discuss.elastic.co/t/enable-kibana-security-without-elasticsearch-security/298695 "2022-03-04T00:19:28Z")
Hi Team, Is it possible to enable Kibana level security like creating username and passwords for Kibana login and dashboards (for role level access), without enabling the security in Elasticsearch level (username & pass… --- ## [+HeapDumpOnOutOfMemoryError](https://discuss.elastic.co/t/heapdumponoutofmemoryerror/298786)
**Author:** [@d6036de2b54af16665f4](https://discuss.elastic.co/u/d6036de2b54af16665f4)\ **Replies:** 1\ **Last updated:** [March 3, 2022, 11:27pm UTC](https://discuss.elastic.co/t/heapdumponoutofmemoryerror/298786 "2022-03-03T23:27:54Z")
Hello I am getting Heapdump out of memory error on my Production.. DUe to which i am getting incosistant data on kibana Can you please help me to solve this.. I will send you error messages It's Instance type is t3a.… --- ## ['Index' json 'message' field without Logstash but within Filebeat? Filebeat \> ES \> Kibana](https://discuss.elastic.co/t/index-json-message-field-without-logstash-but-within-filebeat-filebeat-es-kibana/298775)
**Author:** [@GB88](https://discuss.elastic.co/u/GB88)\ **Replies:** 1\ **Last updated:** [March 3, 2022, 11:21pm UTC](https://discuss.elastic.co/t/index-json-message-field-without-logstash-but-within-filebeat-filebeat-es-kibana/298775 "2022-03-03T23:21:38Z")
Hello, on to the next challange. I've setup Elasticsearch, Kibana and Filebeat. Filebeat is sending json files to ES\>Kibana. This part is working. Though, in Kibana the data is only in the 'Discover' menu. A few ques… --- ## [Kibana: Unable to retrieve version information from Elasticsearch nodes. error:0909006C:PEM](https://discuss.elastic.co/t/kibana-unable-to-retrieve-version-information-from-elasticsearch-nodes-errorpem/298650)
**Author:** [@GB88](https://discuss.elastic.co/u/GB88)\ **Replies:** 4\ **Last updated:** [March 3, 2022, 11:19pm UTC](https://discuss.elastic.co/t/kibana-unable-to-retrieve-version-information-from-elasticsearch-nodes-errorpem/298650 "2022-03-03T23:19:01Z")
Hello, When starting Kibana, the log shows, amongst other info's, this Error: Unable to retrieve version information from Elasticsearch nodes. error:0909006C:PEM I'm able to browse to https://172.1.1.50:5601, and the … --- ## [Force execute watcher does not stop sending the alerts](https://discuss.elastic.co/t/force-execute-watcher-does-not-stop-sending-the-alerts/298760)
**Author:** [@vee](https://discuss.elastic.co/u/vee)\ **Replies:** 1\ **Last updated:** [March 3, 2022, 10:14pm UTC](https://discuss.elastic.co/t/force-execute-watcher-does-not-stop-sending-the-alerts/298760 "2022-03-03T22:14:49Z")
Hi, running into an issue where when I tried to force execute a watcher - it's supposed to be sending a report and stop. But now, I'm seeing an issue where it just doesn't stop sending the alerts even after deleting the … --- ## [Kibana server is not ready yet error](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-error/298789)
**Author:** [@CoreyCBurton](https://discuss.elastic.co/u/CoreyCBurton)\ **Replies:** 4\ **Last updated:** [March 3, 2022, 10:04pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-error/298789 "2022-03-03T22:04:21Z")
I am getting an error that is shown below when I visit localhost:5601 Kibana server is not ready yet. When I enter the command curl -cacert /etc/elasticsearch/certs/http\_ca.crt -u Elasticsearch https://localhost:9200,… --- ## [Filter for using a unique value regardless of date](https://discuss.elastic.co/t/filter-for-using-a-unique-value-regardless-of-date/298790)
**Author:** [@pball](https://discuss.elastic.co/u/pball)\ **Replies:** 1\ **Last updated:** [March 3, 2022, 9:57pm UTC](https://discuss.elastic.co/t/filter-for-using-a-unique-value-regardless-of-date/298790 "2022-03-03T21:57:53Z")
Hi All, I have searched and read many articles but have not found an answer or post which matches my criteria. This is a very simplistic example but I hope it makes it clear. I have 5 users and 3 bats. The green bat has… --- ## [Winlogbeat issue with ca\_trusted\_fingerprint keystore](https://discuss.elastic.co/t/winlogbeat-issue-with-ca-trusted-fingerprint-keystore/298561)
**Author:** [@bcantrell](https://discuss.elastic.co/u/bcantrell)\ **Replies:** 1\ **Last updated:** [March 3, 2022, 9:39pm UTC](https://discuss.elastic.co/t/winlogbeat-issue-with-ca-trusted-fingerprint-keystore/298561 "2022-03-03T21:39:10Z")
Hello, I am new to setting up ELK stack, currently working in a lab environment to understand setup before moving to production. Everything is on 8.0. The problem I am having with Winlogbeat is that when I have a keys… --- ## [Winlogbeat](https://discuss.elastic.co/t/winlogbeat/296963)
**Author:** [@AnisBY](https://discuss.elastic.co/u/AnisBY)\ **Replies:** 1\ **Last updated:** [March 3, 2022, 9:23pm UTC](https://discuss.elastic.co/t/winlogbeat/296963 "2022-03-03T21:23:35Z")
Hi all, trying to find out what is the root cause of this error : // ERROR checkpoint/checkpoint.go:200 rename X:\\Directory\\winlogbeat\\data.winlogbeat.yml.new X:\\Directory\\winlogbeat\\data.winlogbeat.yml: Access is den… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1025) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1027)