# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1034 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1035 --- ## [Filebeat w/ Iptables Module to Logstash to Elastic: Expected Fields Not Populated](https://discuss.elastic.co/t/filebeat-w-iptables-module-to-logstash-to-elastic-expected-fields-not-populated/295720)
**Author:** [@Jarbird](https://discuss.elastic.co/u/Jarbird)\ **Replies:** 4\ **Last updated:** [February 28, 2022, 11:49am UTC](https://discuss.elastic.co/t/filebeat-w-iptables-module-to-logstash-to-elastic-expected-fields-not-populated/295720 "2022-02-28T11:49:32Z")
Hello: I'm pretty new at the ecosystem. I've learned a lot in the past few weeks however I think I've hit a roadblock where I can't seem to figure out why log lines are not being broken out into the expected fields and t… --- ## [Need to run two separate elk stack using docker](https://discuss.elastic.co/t/need-to-run-two-separate-elk-stack-using-docker/298402)
**Author:** [@auasad](https://discuss.elastic.co/u/auasad)\ **Replies:** 0\ **Last updated:** [February 28, 2022, 12:33pm UTC](https://discuss.elastic.co/t/need-to-run-two-separate-elk-stack-using-docker/298402 "2022-02-28T12:33:13Z")
Hello community, I need to run two separate elk stack, i.e. elk7.17 and elk8.0 on same machine in docker containers using docker-compose. I have already changed the port for both like 9200, 9300 for elk7.17 and 9202 and … --- ## [Sub aggregration in Kibana Canvas](https://discuss.elastic.co/t/sub-aggregration-in-kibana-canvas/296433)
**Author:** [@Alphonse\_Kambo](https://discuss.elastic.co/u/Alphonse_Kambo)\ **Replies:** 2\ **Last updated:** [February 28, 2022, 10:45am UTC](https://discuss.elastic.co/t/sub-aggregration-in-kibana-canvas/296433 "2022-02-28T10:45:16Z")
Hi everyone, is there a possibility to use sub aggregation in Kibana Canvas? --- ## [Parsing message for haproxy logs no matched](https://discuss.elastic.co/t/parsing-message-for-haproxy-logs-no-matched/298395)
**Author:** [@Romain.Depreux](https://discuss.elastic.co/u/Romain.Depreux)\ **Replies:** 0\ **Last updated:** [February 28, 2022, 10:31am UTC](https://discuss.elastic.co/t/parsing-message-for-haproxy-logs-no-matched/298395 "2022-02-28T10:31:43Z")
Hello, can anyone kindly help me to solve this problem? I'm trying to parse the fields of a haproxy log then dissect that message to map the different message values into fields for logstash. But I have the impression … --- ## [Function: cloudwatch, could not deploy, error: bucket 'functionbeat-deploy' already exist and you don't have permission to access it](https://discuss.elastic.co/t/function-cloudwatch-could-not-deploy-error-bucket-functionbeat-deploy-already-exist-and-you-dont-have-permission-to-access-it/293455)
**Author:** [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\ **Replies:** 5\ **Last updated:** [February 28, 2022, 9:10am UTC](https://discuss.elastic.co/t/function-cloudwatch-could-not-deploy-error-bucket-functionbeat-deploy-already-exist-and-you-dont-have-permission-to-access-it/293455 "2022-02-28T09:10:26Z")
I had version 7.12 deployed of functionbeat, i removed it successfully using ./functionbeat -v -e -d "\*" remove cloudwatch I then configurd version 7.16 version of functionbeat and i am trying to deploy it but i get the… --- ## [Logstash and MongoDB input](https://discuss.elastic.co/t/logstash-and-mongodb-input/297535)
**Author:** [@serfisar](https://discuss.elastic.co/u/serfisar)\ **Replies:** 4\ **Last updated:** [February 28, 2022, 10:20am UTC](https://discuss.elastic.co/t/logstash-and-mongodb-input/297535 "2022-02-28T10:20:15Z")
Hi! Logstash version: 7.17.0 Could you help me with logstash-mongodb issue, in view of input plugin for Logstash. I work on some task, where I need to get logs from postgre and mongo. Regarding to postgre - everythi… --- ## [SQL Vs. Query DSL](https://discuss.elastic.co/t/sql-vs-query-dsl/298384)
**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\ **Replies:** 1\ **Last updated:** [February 28, 2022, 10:13am UTC](https://discuss.elastic.co/t/sql-vs-query-dsl/298384 "2022-02-28T10:13:33Z")
Hi, I see huge difference in the performance when running the same query in the different approach. SQL: GET \_sql?format=json { "query": """ SELECT \* FROM "baseelements" WHERE "sessionId" = '621786a4186dc944ccb… --- ## [Interpret Text field as Date field during search](https://discuss.elastic.co/t/interpret-text-field-as-date-field-during-search/298385)
**Author:** [@Gokulnath\_Thangavel](https://discuss.elastic.co/u/Gokulnath_Thangavel)\ **Replies:** 1\ **Last updated:** [February 28, 2022, 10:01am UTC](https://discuss.elastic.co/t/interpret-text-field-as-date-field-during-search/298385 "2022-02-28T10:01:54Z")
When we initially started using Elasticsearch we missed to add mappings to one of our indices. So all the Fields are having default type of "keyword". Is there any way to perform the date range search by interpreting tim… --- ## [Cluster setup issue when path.data and path.logs are configured](https://discuss.elastic.co/t/cluster-setup-issue-when-path-data-and-path-logs-are-configured/298124)
**Author:** [@Newbie111985](https://discuss.elastic.co/u/Newbie111985)\ **Replies:** 7\ **Last updated:** [February 28, 2022, 9:38am UTC](https://discuss.elastic.co/t/cluster-setup-issue-when-path-data-and-path-logs-are-configured/298124 "2022-02-28T09:38:08Z")
I am trying to setup a 3 node cluster using Elasticsearch-7.17.0 in linux. I have made the following configurations in elasticsearch.yml file of all 3 nodes: path.data: /some/path/data path.logs: /some/path/logs network… --- ## [Wordpiece tokenizer](https://discuss.elastic.co/t/wordpiece-tokenizer/296276)
**Author:** [@Quentin\_Feuillade](https://discuss.elastic.co/u/Quentin_Feuillade)\ **Replies:** 3\ **Last updated:** [February 28, 2022, 8:53am UTC](https://discuss.elastic.co/t/wordpiece-tokenizer/296276 "2022-02-28T08:53:22Z")
I am trying to use Worpiece tokenization (the tokenization method used in BERT) directly as a elastic tokenizer. After some digging i found this file in the official elastic source code but i can't find any way to use i… --- ## [I have a problem when I want to send logs of PFSense (2.5.2 amd64) to EK version 7.14.2](https://discuss.elastic.co/t/i-have-a-problem-when-i-want-to-send-logs-of-pfsense-2-5-2-amd64-to-ek-version-7-14-2/297603)
**Author:** [@khouloud1](https://discuss.elastic.co/u/khouloud1)\ **Replies:** 18\ **Last updated:** [February 28, 2022, 9:19am UTC](https://discuss.elastic.co/t/i-have-a-problem-when-i-want-to-send-logs-of-pfsense-2-5-2-amd64-to-ek-version-7-14-2/297603 "2022-02-28T09:19:20Z")
I have a problem when I want to send logs from PFSense (2.5.2 amd64) to EK version 7.14.2 I did configure PFSense to send logs to EK but I did not find the best procedure to configure Elasticsearch and Kibana (7.14.2) --- ## [DELETED INDEXES UNABLE TO RESTORE USING SNAPSHOT BACKUP AND RESTORE](https://discuss.elastic.co/t/deleted-indexes-unable-to-restore-using-snapshot-backup-and-restore/297346)
**Author:** [@indrajit\_kal](https://discuss.elastic.co/u/indrajit_kal)\ **Replies:** 5\ **Last updated:** [February 28, 2022, 9:12am UTC](https://discuss.elastic.co/t/deleted-indexes-unable-to-restore-using-snapshot-backup-and-restore/297346 "2022-02-28T09:12:46Z")
ERROR \[backup\_repo:test-snapshot-2022.02.11-kxyy8jd4sumangv5kozy3q/9uLE7UaUQamgAH9pYbKAAA\] cannot restore index \[.siem-signals-default-000001\] because an open index with same name already exists in the cluster. Either c… --- ## [Should I prefer beats or Elastic Agent for monitoring application deployed using docker stack and not kubernetes?](https://discuss.elastic.co/t/should-i-prefer-beats-or-elastic-agent-for-monitoring-application-deployed-using-docker-stack-and-not-kubernetes/298079)
**Author:** [@Mahesh\_Abnave](https://discuss.elastic.co/u/Mahesh_Abnave)\ **Replies:** 1\ **Last updated:** [February 28, 2022, 9:07am UTC](https://discuss.elastic.co/t/should-i-prefer-beats-or-elastic-agent-for-monitoring-application-deployed-using-docker-stack-and-not-kubernetes/298079 "2022-02-28T09:07:08Z")
I have an application up and running in set of docker containers (deployed using docker stack and not kubernetes). I want to do performance monitoring for this application. I am confused about whether I should go for bea… --- ## [How to determines if a geo point is within a polygon](https://discuss.elastic.co/t/how-to-determines-if-a-geo-point-is-within-a-polygon/298383)
**Author:** [@yeziblo](https://discuss.elastic.co/u/yeziblo)\ **Replies:** 0\ **Last updated:** [February 28, 2022, 8:56am UTC](https://discuss.elastic.co/t/how-to-determines-if-a-geo-point-is-within-a-polygon/298383 "2022-02-28T08:56:42Z")
Hi team! I have a question for geo query. For example, I have a index which name is city, and in this index, I create a field which type is geo\_shape. Now I have a address's longitude and latitude, I want to get the c… --- ## [Elastic Search High level Client for OSS 7.4](https://discuss.elastic.co/t/elastic-search-high-level-client-for-oss-7-4/298369)
**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\ **Replies:** 2\ **Last updated:** [February 28, 2022, 8:14am UTC](https://discuss.elastic.co/t/elastic-search-high-level-client-for-oss-7-4/298369 "2022-02-28T08:14:48Z")
I am using Elasticsearch 7.4.0 OSS version server and want to connect via java rest api service. So I used EL rest high level client \ \org.elasticsearch.client\ \elastics… --- ## [Kibana pin filters from embeded dashboard are not applied when we navigate to another dashboard](https://discuss.elastic.co/t/kibana-pin-filters-from-embeded-dashboard-are-not-applied-when-we-navigate-to-another-dashboard/298367)
**Author:** [@Prathibha\_Y](https://discuss.elastic.co/u/Prathibha_Y)\ **Replies:** 1\ **Last updated:** [February 28, 2022, 8:08am UTC](https://discuss.elastic.co/t/kibana-pin-filters-from-embeded-dashboard-are-not-applied-when-we-navigate-to-another-dashboard/298367 "2022-02-28T08:08:03Z")
Pin filters works perfectly when we navigate from one dashboard to another using hyperlink(configured link in url template of index patterns) inside Kibana, where as we try navigating from embedded dashboard to another … --- ## [The truststore does not contain any trusted certificate entries after upgrade to 8.0](https://discuss.elastic.co/t/the-truststore-does-not-contain-any-trusted-certificate-entries-after-upgrade-to-8-0/298338)
**Author:** [@testshock](https://discuss.elastic.co/u/testshock)\ **Replies:** 4\ **Last updated:** [February 28, 2022, 7:56am UTC](https://discuss.elastic.co/t/the-truststore-does-not-contain-any-trusted-certificate-entries-after-upgrade-to-8-0/298338 "2022-02-28T07:56:24Z")
I was doing offline upgrade from 7.16 to 8.0. With all servers stopped upgrade with rpm and started again. From 7.16 to 7.17 no problems at all. Cluster came up green. From 7.17 to 8.0 elastic i got Exception org.elas… --- ## [Last value of syste.uptime.duration.ms](https://discuss.elastic.co/t/last-value-of-syste-uptime-duration-ms/298119)
**Author:** [@ratseba](https://discuss.elastic.co/u/ratseba)\ **Replies:** 2\ **Last updated:** [February 28, 2022, 7:30am UTC](https://discuss.elastic.co/t/last-value-of-syste-uptime-duration-ms/298119 "2022-02-28T07:30:45Z")
Hi, I need show on dashboard uptime for server. I tried do this by Lens -\> Metric. When i set for metric: Last value od system.uptime.duration.ms and sort by @timestamp then i dont see anything. In index i have this dat… --- ## [What is taking up disk space if I disable indexing of all properties and \_source?](https://discuss.elastic.co/t/what-is-taking-up-disk-space-if-i-disable-indexing-of-all-properties-and-source/298372)
**Author:** [@Adnukator](https://discuss.elastic.co/u/Adnukator)\ **Replies:** 2\ **Last updated:** [February 28, 2022, 6:56am UTC](https://discuss.elastic.co/t/what-is-taking-up-disk-space-if-i-disable-indexing-of-all-properties-and-source/298372 "2022-02-28T06:56:07Z")
I'm trying to restructure our Elasticsearch settings to be more space efficient, even if at the price of less comfort. I have a set of 150k documents from a live server where I'm trying to measure the impact of different… --- ## [Script condition for not matching records](https://discuss.elastic.co/t/script-condition-for-not-matching-records/298293)
**Author:** [@vradder](https://discuss.elastic.co/u/vradder)\ **Replies:** 4\ **Last updated:** [February 28, 2022, 5:19am UTC](https://discuss.elastic.co/t/script-condition-for-not-matching-records/298293 "2022-02-28T05:19:00Z")
Hi, I am selecting records based on range query. /\_update\_by\_query?conflicts=proceed { "query":{"range":{"dateTime":{"gte":"xxx","lte":"xxx"}}}, "script":{"source":"ctx.\_source.selected = true"} } how can i unselect… --- ## [Docker Elasticsearch up but not connecting python script](https://discuss.elastic.co/t/docker-elasticsearch-up-but-not-connecting-python-script/298360)
**Author:** [@Dilip\_Kumar](https://discuss.elastic.co/u/Dilip_Kumar)\ **Replies:** 1\ **Last updated:** [February 28, 2022, 12:10am UTC](https://discuss.elastic.co/t/docker-elasticsearch-up-but-not-connecting-python-script/298360 "2022-02-28T00:10:17Z")
Hi, I am have install Elasticsearch with docker it up but not able to make connection from python client. docker-compose.yaml version: '2.2' services: elasticsearch: image: docker.elastic.co/elasticsearch/elasti… --- ## [Slow listing indices in Kibana Index Management](https://discuss.elastic.co/t/slow-listing-indices-in-kibana-index-management/298143)
**Author:** [@tellus83](https://discuss.elastic.co/u/tellus83)\ **Replies:** 1\ **Last updated:** [February 27, 2022, 11:49pm UTC](https://discuss.elastic.co/t/slow-listing-indices-in-kibana-index-management/298143 "2022-02-27T23:49:05Z")
We are runing a cluster whit 15 Nodes, Detecated master, data-hot, data-warm, data-cold, ingest and coordinating nodes. And only 1222 Indices. Normal querys and indexing looks like its ok. But listing listing indices in… --- ## [Transforming documents after they have been retrieved?](https://discuss.elastic.co/t/transforming-documents-after-they-have-been-retrieved/298213)
**Author:** [@mafej](https://discuss.elastic.co/u/mafej)\ **Replies:** 2\ **Last updated:** [February 27, 2022, 11:34pm UTC](https://discuss.elastic.co/t/transforming-documents-after-they-have-been-retrieved/298213 "2022-02-27T23:34:20Z")
I'm wondering, is there functionality similar to ingest pipelines, but for output instead of input? Being able to transform data when it's ingested is nice, but what about the opposite of that, transforming documents aft… --- ## [Logs delay in Kibana](https://discuss.elastic.co/t/logs-delay-in-kibana/298332)
**Author:** [@vijayja](https://discuss.elastic.co/u/vijayja)\ **Replies:** 1\ **Last updated:** [February 27, 2022, 11:33pm UTC](https://discuss.elastic.co/t/logs-delay-in-kibana/298332 "2022-02-27T23:33:08Z")
Hi Team, We are facing the log delay issue in Kibana dashboard, Logs are getting delay by 2 hours, 2.5 hours and sometimes 3 hours, We have two identical kubernetes cluster, But facing the issue with only one cluster, n… --- ## [Elastics search date range issue](https://discuss.elastic.co/t/elastics-search-date-range-issue/298364)
**Author:** [@riya9](https://discuss.elastic.co/u/riya9)\ **Replies:** 0\ **Last updated:** [February 27, 2022, 8:06pm UTC](https://discuss.elastic.co/t/elastics-search-date-range-issue/298364 "2022-02-27T20:06:14Z")
Hello, I am newbie to Kibana and having hard time to create an alert for job which is not in success state for last 90 min ..am trying below query but somehow when using "gte": "now-90m", it get converted to below in … --- ## [SAML authentication request scoping (using IDP proxy)](https://discuss.elastic.co/t/saml-authentication-request-scoping-using-idp-proxy/297932)
**Author:** [@Cap\_Ho](https://discuss.elastic.co/u/Cap_Ho)\ **Replies:** 5\ **Last updated:** [February 27, 2022, 4:04pm UTC](https://discuss.elastic.co/t/saml-authentication-request-scoping-using-idp-proxy/297932 "2022-02-27T16:04:34Z")
Hi all, I am now trying to test the ELK do auth using SAML. the basic flow is ok since i may follow the documentation. But i think that one of the case is not fit. i would like to use ELK as SP and connect to a IDP prox… --- ## [Kibana Dashboard field value count](https://discuss.elastic.co/t/kibana-dashboard-field-value-count/297494)
**Author:** [@shanthveeresh](https://discuss.elastic.co/u/shanthveeresh)\ **Replies:** 4\ **Last updated:** [February 27, 2022, 3:30pm UTC](https://discuss.elastic.co/t/kibana-dashboard-field-value-count/297494 "2022-02-27T15:30:20Z")
Hi All, I am trying to find a .json script or keyword to count the number of field value count in Kibana dashboard, let me know if there is any way to do it, it will be very helpful. --- ## [Logstash input: Twitter](https://discuss.elastic.co/t/logstash-input-twitter/298351)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 1\ **Last updated:** [February 27, 2022, 2:42pm UTC](https://discuss.elastic.co/t/logstash-input-twitter/298351 "2022-02-27T14:42:32Z")
Hello, I have a simple pipeline setup in Logstash (keys changed of course): input { twitter { consumer\_key =\> "rcLfXIhprrPKLgVI467Slbux0" consumer\_secret =\>"uYk68znfoDQq70lfWXS3I… --- ## [Timestamp does not match data](https://discuss.elastic.co/t/timestamp-does-not-match-data/298344)
**Author:** [@tjunge](https://discuss.elastic.co/u/tjunge)\ **Replies:** 2\ **Last updated:** [February 27, 2022, 2:21pm UTC](https://discuss.elastic.co/t/timestamp-does-not-match-data/298344 "2022-02-27T14:21:44Z")
Hi, I am new to Elastic Stack and trying to filter my fail2ban log. In Grok Debugger I tried to simulate my Grok pattern on my data but have problems with the timestamp. I always get the simulate error: Provided Grok p… --- ## [Help getting started with text embeddings](https://discuss.elastic.co/t/help-getting-started-with-text-embeddings/297185)
**Author:** [@spruitt](https://discuss.elastic.co/u/spruitt)\ **Replies:** 2\ **Last updated:** [February 27, 2022, 1:41pm UTC](https://discuss.elastic.co/t/help-getting-started-with-text-embeddings/297185 "2022-02-27T13:41:55Z")
I am getting up to speed with semantic search. I started with a repository link I found in the blog "Text similarity search with vector fields." It's Python starter code. I'm having problems from the start. A lot of … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1033) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1035)