# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1046 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1047 --- ## [Filebeat - issue after enable elasticsearch module](https://discuss.elastic.co/t/filebeat-issue-after-enable-elasticsearch-module/297553)
**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Replies:** 4\ **Last updated:** [February 20, 2022, 8:03pm UTC](https://discuss.elastic.co/t/filebeat-issue-after-enable-elasticsearch-module/297553 "2022-02-20T20:03:16Z")
Hello, I would like to filebeat process my Elasticsearch audit logs. When I enable Elasticsearch module (filebeat modules enable Elasticsearch) module is enabled and under modules.d file Elasticsearch.yml.disabled chan… --- ## [Get a OR on controls](https://discuss.elastic.co/t/get-a-or-on-controls/297498)
**Author:** [@Greninja\_San](https://discuss.elastic.co/u/Greninja_San)\ **Replies:** 8\ **Last updated:** [February 20, 2022, 7:36pm UTC](https://discuss.elastic.co/t/get-a-or-on-controls/297498 "2022-02-20T19:36:16Z")
Hello! I'm currently working with Kibana and setting the Controls Now, if I fill both fields Expéditeur and Destinataire, the comparison between the 2 will be an AND, meaning a document will need to have both. Would… --- ## [TSVB aggregate timestamp interval backward, not forward](https://discuss.elastic.co/t/tsvb-aggregate-timestamp-interval-backward-not-forward/297547)
**Author:** [@pjago](https://discuss.elastic.co/u/pjago)\ **Replies:** 5\ **Last updated:** [February 20, 2022, 5:50pm UTC](https://discuss.elastic.co/t/tsvb-aggregate-timestamp-interval-backward-not-forward/297547 "2022-02-20T17:50:05Z")
Hello! Is it possible to aggregate documents through TSVB, or Kibana by all means, where instead of grouping the timestamp forward, we do it backwads? And as such, instead of dropping the last bucket we would drop the … --- ## [How to bucket aggregate on document without any numeric field](https://discuss.elastic.co/t/how-to-bucket-aggregate-on-document-without-any-numeric-field/297375)
**Author:** [@pandu](https://discuss.elastic.co/u/pandu)\ **Replies:** 15\ **Last updated:** [February 20, 2022, 5:11pm UTC](https://discuss.elastic.co/t/how-to-bucket-aggregate-on-document-without-any-numeric-field/297375 "2022-02-20T17:11:47Z")
I have an index that has documents representing calls. Every document is a call. I want to report average calls per day from every customer. The information needs to be bucketed by week. How do I do that? There is no num… --- ## [Metricbeat installed windows client, but the client system details is not populated in Elasticsearch/ kibana](https://discuss.elastic.co/t/metricbeat-installed-windows-client-but-the-client-system-details-is-not-populated-in-elasticsearch-kibana/296710)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 1\ **Last updated:** [February 20, 2022, 4:25pm UTC](https://discuss.elastic.co/t/metricbeat-installed-windows-client-but-the-client-system-details-is-not-populated-in-elasticsearch-kibana/296710 "2022-02-20T16:25:13Z")
\############### Metricbeat Configured on client as follows ####################### # This file is an example configuration file highlighting only the most common # options. The metricbeat.reference.yml file from the sam… --- ## [Is \_reindex api an online aciton or not](https://discuss.elastic.co/t/is-reindex-api-an-online-aciton-or-not/297676)
**Author:** [@raulk89](https://discuss.elastic.co/u/raulk89)\ **Replies:** 5\ **Last updated:** [February 20, 2022, 4:09pm UTC](https://discuss.elastic.co/t/is-reindex-api-an-online-aciton-or-not/297676 "2022-02-20T16:09:22Z")
Hi Elastic 7.16.3 I was curious, is \_reindex api an online action or not..? Like, does it take any read or write locks on source index or not. Regards Raul --- ## [Complex graphing](https://discuss.elastic.co/t/complex-graphing/297604)
**Author:** [@ilcylic](https://discuss.elastic.co/u/ilcylic)\ **Replies:** 1\ **Last updated:** [February 20, 2022, 3:37pm UTC](https://discuss.elastic.co/t/complex-graphing/297604 "2022-02-20T15:37:56Z")
Hello all, I'm not sure ... heh, well, I'm in the unfortunate position of not knowing what I don't know. I'm fairly new to all of this, and I don't know if I'm trying to ask the system to do too much, or if I'm not thin… --- ## [Pipelines YAML file is empty](https://discuss.elastic.co/t/pipelines-yaml-file-is-empty/297560)
**Author:** [@Naba01](https://discuss.elastic.co/u/Naba01)\ **Replies:** 1\ **Last updated:** [February 20, 2022, 3:17pm UTC](https://discuss.elastic.co/t/pipelines-yaml-file-is-empty/297560 "2022-02-20T15:17:45Z")
I am new to ELK.Just tried installing and starting logstash on local windows PC, getting the below error after run the logstash.bat command. Could you please help resolve the issue. ERROR: Pipelines YAML file is empty… --- ## [Time Filter Quick Range Help](https://discuss.elastic.co/t/time-filter-quick-range-help/297641)
**Author:** [@bsmith](https://discuss.elastic.co/u/bsmith)\ **Replies:** 2\ **Last updated:** [February 20, 2022, 2:57pm UTC](https://discuss.elastic.co/t/time-filter-quick-range-help/297641 "2022-02-20T14:57:38Z")
Trying to get from the 1st of the month last year to the last day of the prior month. For example if loading that time range now I would want Feb 1st 2021 to Jan 31st 2022. The From is easy, but having a hard time gettin… --- ## [Creating Index pattern](https://discuss.elastic.co/t/creating-index-pattern/297679)
**Author:** [@Hamdi\_Hassan](https://discuss.elastic.co/u/Hamdi_Hassan)\ **Replies:** 3\ **Last updated:** [February 20, 2022, 2:25pm UTC](https://discuss.elastic.co/t/creating-index-pattern/297679 "2022-02-20T14:25:15Z")
Problems to create an index pattern I have a problem when I'm trying to create an index pattern in Kibana. I have a system configured in the Elasticsearch cloud for my company, and I access it with a user with superuse… --- ## [Using ILM for data that can be updated or deleted at any phase](https://discuss.elastic.co/t/using-ilm-for-data-that-can-be-updated-or-deleted-at-any-phase/297659)
**Author:** [@Afsaneh\_Habibi](https://discuss.elastic.co/u/Afsaneh_Habibi)\ **Replies:** 2\ **Last updated:** [February 20, 2022, 1:59pm UTC](https://discuss.elastic.co/t/using-ilm-for-data-that-can-be-updated-or-deleted-at-any-phase/297659 "2022-02-20T13:59:31Z")
Hi I read about ILM and as I understood the main usage is for the data that is read only. In my scenario the latest data is much more important than old data, and as data gets old is much less likely to get accessed, b… --- ## [Cert error for intial setup of fileBeat](https://discuss.elastic.co/t/cert-error-for-intial-setup-of-filebeat/297614)
**Author:** [@ledufakademy](https://discuss.elastic.co/u/ledufakademy)\ **Replies:** 3\ **Last updated:** [February 20, 2022, 1:17pm UTC](https://discuss.elastic.co/t/cert-error-for-intial-setup-of-filebeat/297614 "2022-02-20T13:17:50Z")
i follow exactly the documentaion , but we stuck on :slight\_smile: filebeat setup. filebeat setup Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: \[error connecting to Elasticsearch at ht… --- ## [Is there a way to restrict only the author of the kibana dashboard can make the change?](https://discuss.elastic.co/t/is-there-a-way-to-restrict-only-the-author-of-the-kibana-dashboard-can-make-the-change/297548)
**Author:** [@kommineni24](https://discuss.elastic.co/u/kommineni24)\ **Replies:** 1\ **Last updated:** [February 20, 2022, 12:49pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-restrict-only-the-author-of-the-kibana-dashboard-can-make-the-change/297548 "2022-02-20T12:49:27Z")
Is there a way to restrict only the author of the dashboard can make the change? --- ## [Logstash.filters.elasticsearch "Read timed out"](https://discuss.elastic.co/t/logstash-filters-elasticsearch-read-timed-out/297537)
**Author:** [@gregorys](https://discuss.elastic.co/u/gregorys)\ **Replies:** 1\ **Last updated:** [February 20, 2022, 12:45pm UTC](https://discuss.elastic.co/t/logstash-filters-elasticsearch-read-timed-out/297537 "2022-02-20T12:45:37Z")
Hi, I'm using Logstash 7.17 against Elasticsearch 7.16 cluster. The filter is working for about 9/10 events, but sometimes it fails with this error: "Failed to query Elasticsearch for previous event", "Read timed out" … --- ## [How to organise Elasticsearch indexes with too many dynamic fields](https://discuss.elastic.co/t/how-to-organise-elasticsearch-indexes-with-too-many-dynamic-fields/297531)
**Author:** [@sushilprj](https://discuss.elastic.co/u/sushilprj)\ **Replies:** 1\ **Last updated:** [February 20, 2022, 12:15pm UTC](https://discuss.elastic.co/t/how-to-organise-elasticsearch-indexes-with-too-many-dynamic-fields/297531 "2022-02-20T12:15:15Z")
I have a scenario where there are too many groups, and each group has numerous documents with few standard fields and few dynamic fields. So I have created an alias for every group for an index. Now, as these groups grow… --- ## [Dev Tools: How to create a new index on existing index](https://discuss.elastic.co/t/dev-tools-how-to-create-a-new-index-on-existing-index/297504)
**Author:** [@pandu](https://discuss.elastic.co/u/pandu)\ **Replies:** 1\ **Last updated:** [February 20, 2022, 11:30am UTC](https://discuss.elastic.co/t/dev-tools-how-to-create-a-new-index-on-existing-index/297504 "2022-02-20T11:30:00Z")
I have an index. I am creating a bucket aggregation using Dev Tools (GET method). How do I use this bucket aggregation in visualization? Do I need to create a new index for the GET.. and then visualize? Or, I could use t… --- ## [Array of object using ruby](https://discuss.elastic.co/t/array-of-object-using-ruby/297693)
**Author:** [@royalE](https://discuss.elastic.co/u/royalE)\ **Replies:** 0\ **Last updated:** [February 20, 2022, 11:21am UTC](https://discuss.elastic.co/t/array-of-object-using-ruby/297693 "2022-02-20T11:21:30Z")
I have an array of object and I want to sparte the value of array to new field . this my array of object . I tried to use ruby but no luck unfortunately . students = \[ {id:"id1",name:"name1",age:"age1"},… --- ## [Dynamic mapping with .keyword field](https://discuss.elastic.co/t/dynamic-mapping-with-keyword-field/297449)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [February 20, 2022, 11:12am UTC](https://discuss.elastic.co/t/dynamic-mapping-with-keyword-field/297449 "2022-02-20T11:12:26Z")
Hi all, i'm trying to push data with dynamically mapping to indices. The problem is everytime every string field is taken as text instead of keyword and it later throws an error. I cannot define mappings as they are p… --- ## [Randomly missing events](https://discuss.elastic.co/t/randomly-missing-events/297377)
**Author:** [@Nasser](https://discuss.elastic.co/u/Nasser)\ **Replies:** 5\ **Last updated:** [February 20, 2022, 11:07am UTC](https://discuss.elastic.co/t/randomly-missing-events/297377 "2022-02-20T11:07:04Z")
Hi i have one pipeline processing 16 .conf file in each file i have 2 jdbc the issue is sometimes randomly i see logstash miss some jdbc ! i check the logstash-plain.log but nothing abnormal ! i tired to update logs… --- ## [I wonder why docvalues are fast for sorting](https://discuss.elastic.co/t/i-wonder-why-docvalues-are-fast-for-sorting/297039)
**Author:** [@slowup](https://discuss.elastic.co/u/slowup)\ **Replies:** 2\ **Last updated:** [February 20, 2022, 10:42am UTC](https://discuss.elastic.co/t/i-wonder-why-docvalues-are-fast-for-sorting/297039 "2022-02-20T10:42:36Z")
docvalues ​​are sorted by docid, so they are not values, but why can they be fast for sorting? I want to know deeply about the internal structure, please help! --- ## [How to log JDBC connection activity?](https://discuss.elastic.co/t/how-to-log-jdbc-connection-activity/297690)
**Author:** [@Nasser](https://discuss.elastic.co/u/Nasser)\ **Replies:** 0\ **Last updated:** [February 20, 2022, 9:20am UTC](https://discuss.elastic.co/t/how-to-log-jdbc-connection-activity/297690 "2022-02-20T09:20:06Z")
Hi How to log JDBC connection activity? what should i add to log4j.properties ? thanks --- ## [Elasticsearch - major design flaw with node ID](https://discuss.elastic.co/t/elasticsearch-major-design-flaw-with-node-id/297665)
**Author:** [@Bieniek](https://discuss.elastic.co/u/Bieniek)\ **Replies:** 6\ **Last updated:** [February 20, 2022, 9:10am UTC](https://discuss.elastic.co/t/elasticsearch-major-design-flaw-with-node-id/297665 "2022-02-20T09:10:40Z")
Elasticsearch seems to have a major design flaw when it comes to being deployed in a docker swarm (clustered). Each Elasticsearch node is identified by a randomly generated node ID. This node ID is stored in the databa… --- ## [How can I use the Elastic-Agent container to collect service logs from another container?](https://discuss.elastic.co/t/how-can-i-use-the-elastic-agent-container-to-collect-service-logs-from-another-container/297683)
**Author:** [@Gibz](https://discuss.elastic.co/u/Gibz)\ **Replies:** 0\ **Last updated:** [February 20, 2022, 5:40am UTC](https://discuss.elastic.co/t/how-can-i-use-the-elastic-agent-container-to-collect-service-logs-from-another-container/297683 "2022-02-20T05:40:19Z")
My target container contains NGINX logs which I wanted to collect from Elastic Fleet's NGINX Integration. I followed every step, even successfully hosting the fleet server and the agent in two separate containers, what … --- ## [Date processor - Pipeline](https://discuss.elastic.co/t/date-processor-pipeline/297566)
**Author:** [@p2w2](https://discuss.elastic.co/u/p2w2)\ **Replies:** 3\ **Last updated:** [February 19, 2022, 9:46pm UTC](https://discuss.elastic.co/t/date-processor-pipeline/297566 "2022-02-19T21:46:46Z")
Hi guys. I'm trying to add the date processor to my index and at first it seemed to be working but then I noticed very strange result that I don't understand and can't find anywhere explanation for this behavior. I hav… --- ## [Fixnum is deprecated](https://discuss.elastic.co/t/fixnum-is-deprecated/297669)
**Author:** [@Nasser](https://discuss.elastic.co/u/Nasser)\ **Replies:** 1\ **Last updated:** [February 19, 2022, 6:49pm UTC](https://discuss.elastic.co/t/fixnum-is-deprecated/297669 "2022-02-19T18:49:22Z")
Hi i got this error when i run logstash \[2022-02-17T16:37:37,651\]\[INFO \]\[logstash.javapipeline \]\[main\] Pipeline started {"pipeline.id"=\>"main"} \[2022-02-17T16:37:37,728\]\[INFO \]\[logstash.agent \] Pipelines r… --- ## [Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch](https://discuss.elastic.co/t/failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/297651)
**Author:** [@Adityadgr8](https://discuss.elastic.co/u/Adityadgr8)\ **Replies:** 3\ **Last updated:** [February 19, 2022, 3:31pm UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/297651 "2022-02-19T15:31:55Z")
Hello Everyone I am unable to start filebeat service, getting below error: filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch. Loaded: loaded (/usr/lib/systemd/system/filebeat.serv… --- ## [Support Diagnostic Tool failing](https://discuss.elastic.co/t/support-diagnostic-tool-failing/293999)
**Author:** [@Ayush\_Mathur](https://discuss.elastic.co/u/Ayush_Mathur)\ **Replies:** 3\ **Last updated:** [February 19, 2022, 9:11am UTC](https://discuss.elastic.co/t/support-diagnostic-tool-failing/293999 "2022-02-19T09:11:34Z")
I'm trying to run diagnostics-8.2.6 on my ES node running on Openshift 4.6 with Elastic Stack version 7.16.2. The command being used is: ./diagnostics.sh --host logging-es --port 9200 --type local -u ayush.mathur --ssl… --- ## [Elastic Cloud hardware profiles do not line up with documenation](https://discuss.elastic.co/t/elastic-cloud-hardware-profiles-do-not-line-up-with-documenation/297564)
**Author:** [@JJK](https://discuss.elastic.co/u/JJK)\ **Replies:** 4\ **Last updated:** [February 19, 2022, 1:37am UTC](https://discuss.elastic.co/t/elastic-cloud-hardware-profiles-do-not-line-up-with-documenation/297564 "2022-02-19T01:37:11Z")
I'm trying to create a new deployment. The linked help documentation mentions 3 options for hardware profiles: I/O Optimized Computed Optimized Memory Optimized Actual options given in Elastic cloud: Storage Optimiz… --- ## [Kibana session issues](https://discuss.elastic.co/t/kibana-session-issues/289299)
**Author:** [@alaine](https://discuss.elastic.co/u/alaine)\ **Replies:** 8\ **Last updated:** [February 19, 2022, 12:59am UTC](https://discuss.elastic.co/t/kibana-session-issues/289299 "2022-02-19T00:59:50Z")
Question relating to session timeout issues. We have been having this issue since 7.11 and are currently on 7.13.4. I have been making changes to the following. I got tired of it, and went over board with the following c… --- ## [PHP client not working](https://discuss.elastic.co/t/php-client-not-working/297645)
**Author:** [@iosif](https://discuss.elastic.co/u/iosif)\ **Replies:** 3\ **Last updated:** [February 19, 2022, 12:15am UTC](https://discuss.elastic.co/t/php-client-not-working/297645 "2022-02-19T00:15:35Z")
Hello, I want to use the php client. E installed it using Composer, like shown in the tutorial here: Installation | Elasticsearch PHP Client \[7.16\] | Elastic Composer creates the composer.lock file and install the depe… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1045) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1047)