# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1029 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1030 --- ## [Elasticsearch node limitations and scaling](https://discuss.elastic.co/t/elasticsearch-node-limitations-and-scaling/298594)
**Author:** [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)\ **Replies:** 1\ **Last updated:** [March 2, 2022, 11:07pm UTC](https://discuss.elastic.co/t/elasticsearch-node-limitations-and-scaling/298594 "2022-03-02T23:07:27Z")
Hi, I'm having some anomalies with my 3 nodes cluster, my nodes have some instability, I keep losing a node each time and sometimes the cluster take long time to recover, but i'm not sure if the root cause is a cluster … --- ## [Elasticsearch.yml after startup is not showing in RHEL 8](https://discuss.elastic.co/t/elasticsearch-yml-after-startup-is-not-showing-in-rhel-8/298680)
**Author:** [@CoreyCBurton](https://discuss.elastic.co/u/CoreyCBurton)\ **Replies:** 5\ **Last updated:** [March 2, 2022, 11:02pm UTC](https://discuss.elastic.co/t/elasticsearch-yml-after-startup-is-not-showing-in-rhel-8/298680 "2022-03-02T23:02:39Z")
I have installed Elasticsearch on RHEL 8. I followed this guide below. Everything went smoothly and I started the service. I am trying to edit the Elasticsearch.yml and I can't seem to find it. I am also trying to tu… --- ## [Netflow - Qos Channels](https://discuss.elastic.co/t/netflow-qos-channels/298681)
**Author:** [@Rossana](https://discuss.elastic.co/u/Rossana)\ **Replies:** 0\ **Last updated:** [March 2, 2022, 10:45pm UTC](https://discuss.elastic.co/t/netflow-qos-channels/298681 "2022-03-02T22:45:38Z")
Hi, I want to know if the filebeat module Netflow, has monitor of channels Qos?? Regards, --- ## [Incomplete number of total integrations under "Browse Integrations"](https://discuss.elastic.co/t/incomplete-number-of-total-integrations-under-browse-integrations/298675)
**Author:** [@sfinxone](https://discuss.elastic.co/u/sfinxone)\ **Replies:** 1\ **Last updated:** [March 2, 2022, 9:13pm UTC](https://discuss.elastic.co/t/incomplete-number-of-total-integrations-under-browse-integrations/298675 "2022-03-02T21:13:13Z")
Hi, I'm having a weird issue with an ELK deployment on a particular system. After starting and configuring Elasticsearch and Kibana, I don't get the complete list of integrations under "browse integrations". I am getting… --- ## [Kibana- Unable to Retrieve Version information from Elasticsearch](https://discuss.elastic.co/t/kibana-unable-to-retrieve-version-information-from-elasticsearch/298673)
**Author:** [@userR](https://discuss.elastic.co/u/userR)\ **Replies:** 1\ **Last updated:** [March 2, 2022, 8:25pm UTC](https://discuss.elastic.co/t/kibana-unable-to-retrieve-version-information-from-elasticsearch/298673 "2022-03-02T20:25:36Z")
Hi, I am using 8.0.0 for Elasticsearch and Kibana, with a docker-compose set up. Elasticsearch is running with no issues, how I do get the title message error. Error: \[ERROR\]\[elasticsearch-service\] Unable to retrieve v… --- ## [Can't seem to use socket dataset on rocky linux](https://discuss.elastic.co/t/cant-seem-to-use-socket-dataset-on-rocky-linux/298102)
**Author:** [@jhbigler](https://discuss.elastic.co/u/jhbigler)\ **Replies:** 7\ **Last updated:** [March 2, 2022, 9:00pm UTC](https://discuss.elastic.co/t/cant-seem-to-use-socket-dataset-on-rocky-linux/298102 "2022-03-02T21:00:08Z")
Auditbeat version: 7.15.2 Operating system: Rocky Linux (4.18.0-348.12.2.el8\_5.x86\_64) My issue is similar to the one discussed here, but the fixes that were put in 7.10 do not work here. Commenting out the socket data… --- ## [Core vs extended field regarding a mutate error](https://discuss.elastic.co/t/core-vs-extended-field-regarding-a-mutate-error/298653)
**Author:** [@itschobot](https://discuss.elastic.co/u/itschobot)\ **Replies:** 3\ **Last updated:** [March 2, 2022, 8:24pm UTC](https://discuss.elastic.co/t/core-vs-extended-field-regarding-a-mutate-error/298653 "2022-03-02T20:24:25Z")
I'm getting a mutate error where the "host" value is being set to the "device\_hostname"but was wondering if it's because one is a core field and the other is an extended field? Here is what is being applied in my filter… --- ## [Using a Counter to Flexibly Return to Most Recent Data in Dashboard](https://discuss.elastic.co/t/using-a-counter-to-flexibly-return-to-most-recent-data-in-dashboard/298575)
**Author:** [@clibassi](https://discuss.elastic.co/u/clibassi)\ **Replies:** 2\ **Last updated:** [March 2, 2022, 7:14pm UTC](https://discuss.elastic.co/t/using-a-counter-to-flexibly-return-to-most-recent-data-in-dashboard/298575 "2022-03-02T19:14:01Z")
Cross posting this from a r/kibana post I made that has yet to receive any responses Maybe a bit of an oddball question here. I have a workflow that automatically downloads data from a federal website each week, process… --- ## [Elastic Search Lowercase analyser does not return search result](https://discuss.elastic.co/t/elastic-search-lowercase-analyser-does-not-return-search-result/298662)
**Author:** [@Leo\_Baby\_Jacob](https://discuss.elastic.co/u/Leo_Baby_Jacob)\ **Replies:** 0\ **Last updated:** [March 2, 2022, 6:47pm UTC](https://discuss.elastic.co/t/elastic-search-lowercase-analyser-does-not-return-search-result/298662 "2022-03-02T18:47:39Z")
I have a text based index like below. I am trying to maintain both exact search and ambiguous search based on tokens based on user input. While text based search works fine(partial search) when it comes to term search it… --- ## [How to make ILM work in ES v 7.10.0](https://discuss.elastic.co/t/how-to-make-ilm-work-in-es-v-7-10-0/298619)
**Author:** [@Vikrant\_Aggarwal](https://discuss.elastic.co/u/Vikrant_Aggarwal)\ **Replies:** 5\ **Last updated:** [March 2, 2022, 6:37pm UTC](https://discuss.elastic.co/t/how-to-make-ilm-work-in-es-v-7-10-0/298619 "2022-03-02T18:37:37Z")
Hello Team, May be a naive query but I couldn't find information on this topic. Issuing: GET \_ilm/status giving me the following error: { "error" : "Incorrect HTTP method for uri \[/\_ilm/status?pretty=true\] and meth… --- ## [Delete previous document](https://discuss.elastic.co/t/delete-previous-document/298602)
**Author:** [@Nasser](https://discuss.elastic.co/u/Nasser)\ **Replies:** 1\ **Last updated:** [March 2, 2022, 6:35pm UTC](https://discuss.elastic.co/t/delete-previous-document/298602 "2022-03-02T18:35:15Z")
Hi i have jdbc input run every min and i want to delete the previous document that inserted in the index once the schedule run how the logstash structure will be ? --- ## [Disable response logging (access log) in Kibana \[7.16.3\]](https://discuss.elastic.co/t/disable-response-logging-access-log-in-kibana-7-16-3/297889)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 4\ **Last updated:** [March 2, 2022, 6:15pm UTC](https://discuss.elastic.co/t/disable-response-logging-access-log-in-kibana-7-16-3/297889 "2022-03-02T18:15:59Z")
Hi, everyone I have configured Kibana 7.16.3 logging in order not to be so verbose. Here you are an example: logging: root: level: error However, I would like to disable response information: {"type":"response"… --- ## [Help for parsing with Grok filter](https://discuss.elastic.co/t/help-for-parsing-with-grok-filter/298635)
**Author:** [@ASRLO](https://discuss.elastic.co/u/ASRLO)\ **Replies:** 1\ **Last updated:** [March 2, 2022, 6:13pm UTC](https://discuss.elastic.co/t/help-for-parsing-with-grok-filter/298635 "2022-03-02T18:13:28Z")
Hello, I would like to split my message field on my logs but I don't master the grok filter at all, can you suggest a split? Here is the message field to cut: Windows Installer a reconfiguré le produit. Nom du produit… --- ## [Fleet automatic import visualizations and dashboards by default](https://discuss.elastic.co/t/fleet-automatic-import-visualizations-and-dashboards-by-default/297915)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 0\ **Last updated:** [February 22, 2022, 3:00pm UTC](https://discuss.elastic.co/t/fleet-automatic-import-visualizations-and-dashboards-by-default/297915 "2022-02-22T15:00:25Z")
Hi, everyone I have just upgraded from Kibana 7.9.2 to Kibana 7.16.3 and I have realised that Kibana has imported some index-patterns, visualizations and dashboards after entering in Fleet section. Index Pattern screen… --- ## [Issues with NXLog log rotation and Filebeat](https://discuss.elastic.co/t/issues-with-nxlog-log-rotation-and-filebeat/297952)
**Author:** [@ganesh\_tarone](https://discuss.elastic.co/u/ganesh_tarone)\ **Replies:** 3\ **Last updated:** [March 2, 2022, 5:14pm UTC](https://discuss.elastic.co/t/issues-with-nxlog-log-rotation-and-filebeat/297952 "2022-03-02T17:14:03Z")
I am using NXLog to output some events to a .json file. Basically, I'm using nxlog filecycle() method (find more here) to rotate log files. But the way nxlog does it is as below, (For weekly retention as an example) F… --- ## [Calling a search template from Kibana](https://discuss.elastic.co/t/calling-a-search-template-from-kibana/298377)
**Author:** [@jkulcsar](https://discuss.elastic.co/u/jkulcsar)\ **Replies:** 4\ **Last updated:** [March 2, 2022, 5:13pm UTC](https://discuss.elastic.co/t/calling-a-search-template-from-kibana/298377 "2022-03-02T17:13:17Z")
Hello everybody Is it possible to "wire up" a call/visualize a search template in Kibana? I've defined a search template that takes a few parameters and when I call this through the API, it works great. I even wrote a … --- ## [Embed Elastic Cloud (7.10.1) Kibana visualisation to VueJS application without asking for log in](https://discuss.elastic.co/t/embed-elastic-cloud-7-10-1-kibana-visualisation-to-vuejs-application-without-asking-for-log-in/298236)
**Author:** [@SUMANT\_MISHRA](https://discuss.elastic.co/u/SUMANT_MISHRA)\ **Replies:** 1\ **Last updated:** [March 2, 2022, 4:08pm UTC](https://discuss.elastic.co/t/embed-elastic-cloud-7-10-1-kibana-visualisation-to-vuejs-application-without-asking-for-log-in/298236 "2022-03-02T16:08:23Z")
Hi, I want to embed my Kibana visualizations in my VueJS web application. If I use "Copy iFrame Code" from the share option and use that in my HTML page, it asks for login. Is there any way to embed the kibana visualiz… --- ## [Autocomplete with range](https://discuss.elastic.co/t/autocomplete-with-range/298644)
**Author:** [@earlyriser01](https://discuss.elastic.co/u/earlyriser01)\ **Replies:** 0\ **Last updated:** [March 2, 2022, 3:50pm UTC](https://discuss.elastic.co/t/autocomplete-with-range/298644 "2022-03-02T15:50:08Z")
Hi all! I want to use my custom analyzer (autocomplete -- below) on a number field that I have indexed as shown below. I am using Ruby on Rails Elasticsearch version. settings index: { analysis: { filter:… --- ## [Automate re-index process](https://discuss.elastic.co/t/automate-re-index-process/293876)
**Author:** [@gerardgorrion](https://discuss.elastic.co/u/gerardgorrion)\ **Replies:** 5\ **Last updated:** [March 2, 2022, 3:46pm UTC](https://discuss.elastic.co/t/automate-re-index-process/293876 "2022-03-02T15:46:26Z")
We are using: elastic operator 1.8 Elasticsearch 7.15.2 Current problem: we have 2 shards for every index and 7 data/masters nodes on Elasticsearch (impossible to scale it by license number), we need to retain 6 days … --- ## [Share the Kibana dashboard to outside network users](https://discuss.elastic.co/t/share-the-kibana-dashboard-to-outside-network-users/298145)
**Author:** [@abhishek\_dixit](https://discuss.elastic.co/u/abhishek_dixit)\ **Replies:** 1\ **Last updated:** [March 2, 2022, 3:30pm UTC](https://discuss.elastic.co/t/share-the-kibana-dashboard-to-outside-network-users/298145 "2022-03-02T15:30:43Z")
Hi Team I have created the dashboard in our local network, i need to share the dashboard to outside network users. Is there any way we can acchive this in kibana. --- ## [How do we create a trend line on Kibana?](https://discuss.elastic.co/t/how-do-we-create-a-trend-line-on-kibana/298624)
**Author:** [@Priyanka\_Rajpal](https://discuss.elastic.co/u/Priyanka_Rajpal)\ **Replies:** 3\ **Last updated:** [March 2, 2022, 3:13pm UTC](https://discuss.elastic.co/t/how-do-we-create-a-trend-line-on-kibana/298624 "2022-03-02T15:13:17Z")
How do I create a trend line for a bar graph, where on X axis I have date histogram and on Y axis sum/count? (Not referring to line graph when saying trend line) Thanks --- ## [Plugin enhanced-table on Kibana cloud](https://discuss.elastic.co/t/plugin-enhanced-table-on-kibana-cloud/298004)
**Author:** [@rituzza](https://discuss.elastic.co/u/rituzza)\ **Replies:** 11\ **Last updated:** [March 2, 2022, 2:57pm UTC](https://discuss.elastic.co/t/plugin-enhanced-table-on-kibana-cloud/298004 "2022-03-02T14:57:25Z")
Good morning, we need to setup enhanced-table plugin on the Kibana AWS environment but at this moment it isn't not allowed. Please Please consider that this plugin is widely used in on-premises environments and therefo… --- ## [Exist Elasticsearch ingest pipeline if specific field exists](https://discuss.elastic.co/t/exist-elasticsearch-ingest-pipeline-if-specific-field-exists/298563)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 12\ **Last updated:** [March 2, 2022, 2:30pm UTC](https://discuss.elastic.co/t/exist-elasticsearch-ingest-pipeline-if-specific-field-exists/298563 "2022-03-02T14:30:22Z")
In an Elasticsearch Ingest Pipeline, how can I validate whether a specific field exists, and exit the pipeline immediately without processing if it does? --- ## [Adding scripted fields to document source](https://discuss.elastic.co/t/adding-scripted-fields-to-document-source/298552)
**Author:** [@andersnelson](https://discuss.elastic.co/u/andersnelson)\ **Replies:** 2\ **Last updated:** [March 2, 2022, 2:01pm UTC](https://discuss.elastic.co/t/adding-scripted-fields-to-document-source/298552 "2022-03-02T14:01:31Z")
I am trying to move away from scripted fields in our Elasticsearch cluster. I have updated our Logstash config files to add the relevant fields to new incoming documents, but am having trouble figuring out how to update… --- ## [Field selector for a parameterized visualization](https://discuss.elastic.co/t/field-selector-for-a-parameterized-visualization/298589)
**Author:** [@Ignacio\_Garcia](https://discuss.elastic.co/u/Ignacio_Garcia)\ **Replies:** 2\ **Last updated:** [March 2, 2022, 1:58pm UTC](https://discuss.elastic.co/t/field-selector-for-a-parameterized-visualization/298589 "2022-03-02T13:58:20Z")
Hi, I'm new to ELK so i'm playing around with visualizations to test them. I'd like to replicate jconsole on kibana 7.17 (using jolokia) First: It seems is not possible to have tabs for building a composed dashboard, s… --- ## [Pass each matched record value to filter in Elasticsearch](https://discuss.elastic.co/t/pass-each-matched-record-value-to-filter-in-elasticsearch/298541)
**Author:** [@ZulQ](https://discuss.elastic.co/u/ZulQ)\ **Replies:** 2\ **Last updated:** [March 2, 2022, 1:39pm UTC](https://discuss.elastic.co/t/pass-each-matched-record-value-to-filter-in-elasticsearch/298541 "2022-03-02T13:39:37Z")
For geo\_distance query I'm using a constant value for distance. I need to make it dynamic. So I want to pass the above matched record radius value to distance. Here's the code: let searchRadius = '12KM' query:… --- ## [Modify date key/key\_as\_string format](https://discuss.elastic.co/t/modify-date-key-key-as-string-format/298557)
**Author:** [@bsmith](https://discuss.elastic.co/u/bsmith)\ **Replies:** 2\ **Last updated:** [March 2, 2022, 1:25pm UTC](https://discuss.elastic.co/t/modify-date-key-key-as-string-format/298557 "2022-03-02T13:25:24Z")
Is there any way to modify the date format of the key? or provide maybe an additional key field in a format that I like for use later in Vega? Currently sorting by key\_as\_string but it's lengthy { "size": 0, "aggs":… --- ## [There is no grok expression that can parse 100% of the following log information](https://discuss.elastic.co/t/there-is-no-grok-expression-that-can-parse-100-of-the-following-log-information/298462)
**Author:** [@jie](https://discuss.elastic.co/u/jie)\ **Replies:** 4\ **Last updated:** [March 2, 2022, 1:10pm UTC](https://discuss.elastic.co/t/there-is-no-grok-expression-that-can-parse-100-of-the-following-log-information/298462 "2022-03-02T13:10:11Z")
hello logtfile 12Jul20 10:18:09.561645: hello IT00S451.uaes.com (port 57276) 12Jul20 10:18:09.561645: info request for enable\_MULTI\_v7 from IT00S451.uaes.com (port 57276) 12Jul20 10:18:09.561645: exit IT00S451.uaes.co… --- ## [Filebeat for rotated logs: the old harvest always is handled before new harvest?](https://discuss.elastic.co/t/filebeat-for-rotated-logs-the-old-harvest-always-is-handled-before-new-harvest/298613)
**Author:** [@newtofilebeat](https://discuss.elastic.co/u/newtofilebeat)\ **Replies:** 0\ **Last updated:** [March 2, 2022, 11:41am UTC](https://discuss.elastic.co/t/filebeat-for-rotated-logs-the-old-harvest-always-is-handled-before-new-harvest/298613 "2022-03-02T11:41:43Z")
we need use filebeat to collect our application logs but the logs will rotated weekly. The log file is updated every 5 minutes My question is: when a.log is rotated to a.log.1 and new file a.log is created, a.log.1 wil… --- ## [Fleet Server - To queue or not to queue, that is the question](https://discuss.elastic.co/t/fleet-server-to-queue-or-not-to-queue-that-is-the-question/298596)
**Author:** [@Luca\_SWU](https://discuss.elastic.co/u/Luca_SWU)\ **Replies:** 2\ **Last updated:** [March 2, 2022, 11:33am UTC](https://discuss.elastic.co/t/fleet-server-to-queue-or-not-to-queue-that-is-the-question/298596 "2022-03-02T11:33:25Z")
Hello Elastic Community, Currently I am doing research about how to deploy Fleet Server and Elastic Agents in a self-managed Production environment. In this environment we would like to have the Elastic Agents and Flee… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1028) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1030)