# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1061 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1062 --- ## [Action message variable](https://discuss.elastic.co/t/action-message-variable/294908)
**Author:** [@eddieyee](https://discuss.elastic.co/u/eddieyee)\ **Replies:** 4\ **Last updated:** [February 9, 2022, 8:44am UTC](https://discuss.elastic.co/t/action-message-variable/294908 "2022-02-09T08:44:44Z")
In my Alert using Elasticsearch query, I'm building a URL pointing to Elastic Discover link in the action message and I'm able to include a time filter as seen below: time:(from:now-{{params.timeWindowSize}}{{params.tim… --- ## [How to disable saving Kibana logs to /var/log/kibana](https://discuss.elastic.co/t/how-to-disable-saving-kibana-logs-to-var-log-kibana/296447)
**Author:** [@vladislav](https://discuss.elastic.co/u/vladislav)\ **Replies:** 1\ **Last updated:** [February 9, 2022, 8:33am UTC](https://discuss.elastic.co/t/how-to-disable-saving-kibana-logs-to-var-log-kibana/296447 "2022-02-09T08:33:06Z")
Hello! How to totally disable saving Kibana logs to /var/log/kibana/kibana.log ? I'm using elastic stack version 7.16 and already trying to set in kibana.yml: logging.dest: "u01/data/logs/kibana.log" and logging: … --- ## [Migrating Watcher alerts for redeploy](https://discuss.elastic.co/t/migrating-watcher-alerts-for-redeploy/296677)
**Author:** [@Stud21](https://discuss.elastic.co/u/Stud21)\ **Replies:** 1\ **Last updated:** [February 9, 2022, 8:25am UTC](https://discuss.elastic.co/t/migrating-watcher-alerts-for-redeploy/296677 "2022-02-09T08:25:38Z")
I have created a watcher alert in Kibana on a test environment which I need to transfer using Ansible as a new build to another environment. I have looked at the link below which is doesn't provide information to do so. … --- ## [Multi line support to view full log message in kibana](https://discuss.elastic.co/t/multi-line-support-to-view-full-log-message-in-kibana/296586)
**Author:** [@thujitha\_p](https://discuss.elastic.co/u/thujitha_p)\ **Replies:** 3\ **Last updated:** [February 9, 2022, 7:33am UTC](https://discuss.elastic.co/t/multi-line-support-to-view-full-log-message-in-kibana/296586 "2022-02-09T07:33:53Z")
Hi there, I am new to this ELK stack. I have a problem with previewing log message in kibana. If a log message has too much characters, it is unable to view full message without expanding it. If it is large it is ended … --- ## [Some Error in nori tokenizer](https://discuss.elastic.co/t/some-error-in-nori-tokenizer/296686)
**Author:** [@jug1215](https://discuss.elastic.co/u/jug1215)\ **Replies:** 0\ **Last updated:** [February 9, 2022, 7:08am UTC](https://discuss.elastic.co/t/some-error-in-nori-tokenizer/296686 "2022-02-09T07:08:52Z")
Hi I'm using Nori tokenizer in Elasticsearch(7.16.1) for analyzing korean comments and i think i found some errors in nori tokenizer. input : GET \_analyze { "tokenizer": "nori\_tokenizer", "explain": "true", "text"… --- ## [Is there a queue between filter and output in logstash?](https://discuss.elastic.co/t/is-there-a-queue-between-filter-and-output-in-logstash/296682)
**Author:** [@JohnPhilip](https://discuss.elastic.co/u/JohnPhilip)\ **Replies:** 0\ **Last updated:** [February 9, 2022, 6:58am UTC](https://discuss.elastic.co/t/is-there-a-queue-between-filter-and-output-in-logstash/296682 "2022-02-09T06:58:09Z")
As the Execution Model mentioned, By default, Logstash uses in-memory bounded queues between pipeline stages (input → filter and filter → output) to buffer events. but there is another saying in Memory queue, By defau… --- ## [Understanding elasticsearch filter context](https://discuss.elastic.co/t/understanding-elasticsearch-filter-context/296250)
**Author:** [@Dheeraj\_Gupta](https://discuss.elastic.co/u/Dheeraj_Gupta)\ **Replies:** 4\ **Last updated:** [February 9, 2022, 6:52am UTC](https://discuss.elastic.co/t/understanding-elasticsearch-filter-context/296250 "2022-02-09T06:52:04Z")
I have some doubts about how the filter context works in Elasticsearch/Lucene ecosystem which I would be grateful if someone can clear up. This is related to another problem which I have been recently facing. I have an … --- ## [Get Collect Smart data from disks](https://discuss.elastic.co/t/get-collect-smart-data-from-disks/296681)
**Author:** [@vovan13111](https://discuss.elastic.co/u/vovan13111)\ **Replies:** 0\ **Last updated:** [February 9, 2022, 6:44am UTC](https://discuss.elastic.co/t/get-collect-smart-data-from-disks/296681 "2022-02-09T06:44:08Z")
Good afternoon. I saw in one of the old requests, the question of whether it is possible to collect smart data from disks. Is there such a possibility already or not yet? --- ## [Kibana can't connect to elasticsearch using self signed certificates](https://discuss.elastic.co/t/kibana-cant-connect-to-elasticsearch-using-self-signed-certificates/294255)
**Author:** [@proxymoxy](https://discuss.elastic.co/u/proxymoxy)\ **Replies:** 1\ **Last updated:** [February 9, 2022, 6:31am UTC](https://discuss.elastic.co/t/kibana-cant-connect-to-elasticsearch-using-self-signed-certificates/294255 "2022-02-09T06:31:40Z")
Hi, I have enabled TLS certificates for connection between Kibana and Elasticsearch as described here: Set up basic security for the Elastic Stack plus secured HTTPS traffic | Elasticsearch Guide \[7.16\] | Elastic I use … --- ## [How to embed existing dashboard in custom kibana plugin](https://discuss.elastic.co/t/how-to-embed-existing-dashboard-in-custom-kibana-plugin/296030)
**Author:** [@Shreeya\_Rajguru](https://discuss.elastic.co/u/Shreeya_Rajguru)\ **Replies:** 6\ **Last updated:** [February 9, 2022, 6:34am UTC](https://discuss.elastic.co/t/how-to-embed-existing-dashboard-in-custom-kibana-plugin/296030 "2022-02-09T06:34:07Z")
Hi, Is there a way to embed the existing kibana dashboards in custom plugin? I have referred the dashboard embeddable example plugin code - Embeddables plugin | Kibana Guide \[master\] | Elastic but this doesn't seem to… --- ## [Mapping field values](https://discuss.elastic.co/t/mapping-field-values/296646)
**Author:** [@Dror\_Tirosh](https://discuss.elastic.co/u/Dror_Tirosh)\ **Replies:** 3\ **Last updated:** [February 9, 2022, 6:29am UTC](https://discuss.elastic.co/t/mapping-field-values/296646 "2022-02-09T06:29:31Z")
I have input events that have multiple "keyword" fields. These are IDs (or "guids") of entities that I later collect statistics for. However, the resulting graph "legend" shows those "GUID" values, and I'd like to map t… --- ## [How to print matches in Elasticsearch and Kibana or Elasticsearch-py?](https://discuss.elastic.co/t/how-to-print-matches-in-elasticsearch-and-kibana-or-elasticsearch-py/296329)
**Author:** [@Travel\_Time](https://discuss.elastic.co/u/Travel_Time)\ **Replies:** 2\ **Last updated:** [February 9, 2022, 5:43am UTC](https://discuss.elastic.co/t/how-to-print-matches-in-elasticsearch-and-kibana-or-elasticsearch-py/296329 "2022-02-09T05:43:54Z")
I have 2 example patterns, with the same column names. pattern1\* (index-1,index-2,index-3) col1 col2 col3 col4 pattern2\* (index-5, index-6, index-7, index-8) col1 col2 col5 I want to automatically compare pattern1\* an… --- ## [Ingest Pipeline ID not working for UDP Integration](https://discuss.elastic.co/t/ingest-pipeline-id-not-working-for-udp-integration/296668)
**Author:** [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Replies:** 2\ **Last updated:** [February 9, 2022, 4:48am UTC](https://discuss.elastic.co/t/ingest-pipeline-id-not-working-for-udp-integration/296668 "2022-02-09T04:48:00Z")
Hello, We are using the Custom UDP integration in Fleet to ingest logs from Untangle firewalls. I've created an ingest pipeline, called Untangle, that should parse the message field sent over from the integration. Whe… --- ## [How filebeat read the content of the file](https://discuss.elastic.co/t/how-filebeat-read-the-content-of-the-file/295674)
**Author:** [@sixsenseninja](https://discuss.elastic.co/u/sixsenseninja)\ **Replies:** 3\ **Last updated:** [February 9, 2022, 2:53am UTC](https://discuss.elastic.co/t/how-filebeat-read-the-content-of-the-file/295674 "2022-02-09T02:53:14Z")
Hi all, We are exporting a csv using cronjob and put it inside a a folder. A filebeat will process and read the file before for visualization in Kibana. (Filebeat and the folder are in the same host) The csv is a very … --- ## [Date Histogram - Date Format Change](https://discuss.elastic.co/t/date-histogram-date-format-change/296228)
**Author:** [@Surya\_Raviraj](https://discuss.elastic.co/u/Surya_Raviraj)\ **Replies:** 2\ **Last updated:** [February 9, 2022, 1:06am UTC](https://discuss.elastic.co/t/date-histogram-date-format-change/296228 "2022-02-09T01:06:00Z")
I am currently using a date histogram for my visualization. Unfortunately, the date format seems to default to "yyyy-MM-dd". I would like to Modify it to "MMM-yyyy". I've applied that change on the field but I think whil… --- ## [Do term vectors accelerate phrase queries?](https://discuss.elastic.co/t/do-term-vectors-accelerate-phrase-queries/296674)
**Author:** [@conwaytext](https://discuss.elastic.co/u/conwaytext)\ **Replies:** 0\ **Last updated:** [February 9, 2022, 12:53am UTC](https://discuss.elastic.co/t/do-term-vectors-accelerate-phrase-queries/296674 "2022-02-09T00:53:23Z")
If a field's term vectors are stored, will phrase queries against it be faster? For example, if a field has "term\_vector": "with\_positions", will "match\_phrase" queries take advantage of those, and execute faster than i… --- ## [Unable to change the INTERVAL part of the monitor using update monitor API](https://discuss.elastic.co/t/unable-to-change-the-interval-part-of-the-monitor-using-update-monitor-api/296665)
**Author:** [@N\_Pusapati](https://discuss.elastic.co/u/N_Pusapati)\ **Replies:** 2\ **Last updated:** [February 8, 2022, 11:13pm UTC](https://discuss.elastic.co/t/unable-to-change-the-interval-part-of-the-monitor-using-update-monitor-api/296665 "2022-02-08T23:13:23Z")
Hi I am pretty new to Elasticsearch, trying to setup monitors on certain indexes based on the Extraction Query response. I am trying to achieve this using Create/Update monitor APIs. Everything works as expected except o… --- ## [How to export an entire Elastic Search index to a csv file](https://discuss.elastic.co/t/how-to-export-an-entire-elastic-search-index-to-a-csv-file/296655)
**Author:** [@mwalk](https://discuss.elastic.co/u/mwalk)\ **Replies:** 3\ **Last updated:** [February 8, 2022, 10:51pm UTC](https://discuss.elastic.co/t/how-to-export-an-entire-elastic-search-index-to-a-csv-file/296655 "2022-02-08T22:51:22Z")
Hello, We have an Elasticsearch index that has approximately 1 million records in it. We'd like to export only two fields from it, and ID (int) and a Value (string) for auditing purposes. We've tried using es2csv, but… --- ## [Unable to locate data ingestion logs to debug GCP Dataflow errors](https://discuss.elastic.co/t/unable-to-locate-data-ingestion-logs-to-debug-gcp-dataflow-errors/296667)
**Author:** [@reza1](https://discuss.elastic.co/u/reza1)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 10:36pm UTC](https://discuss.elastic.co/t/unable-to-locate-data-ingestion-logs-to-debug-gcp-dataflow-errors/296667 "2022-02-08T22:36:28Z")
Hello, I'm trying to debug an issue with a GCP Dataflow job which inserts documents into an index. I get the following errors from GCP Dataflow: java.io.IOException: Error writing to Elasticsearch, some elements could … --- ## [Metricbeat and Elastic Security](https://discuss.elastic.co/t/metricbeat-and-elastic-security/296637)
**Author:** [@holobolo0815](https://discuss.elastic.co/u/holobolo0815)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 4:38pm UTC](https://discuss.elastic.co/t/metricbeat-and-elastic-security/296637 "2022-02-08T16:38:28Z")
Hello, So I have setup Elasticsearch security. Usual logging works fine using a logstash\_internal user using the appropriate role recommended by the docs. I'm having a hard time however finding out how to configure Met… --- ## [Max\_bytes\_length\_exceeded\_exception Reason](https://discuss.elastic.co/t/max-bytes-length-exceeded-exception-reason/296640)
**Author:** [@Ahmed\_El\_bendary](https://discuss.elastic.co/u/Ahmed_El_bendary)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 5:03pm UTC](https://discuss.elastic.co/t/max-bytes-length-exceeded-exception-reason/296640 "2022-02-08T17:03:36Z")
error =\> index returned 400 \_index: \_doc \_id: 20142 \_version: 0 error: Type: illegal\_argument\_exception Reason: "Document contains at least one immense term in field="form" (whose UTF8 encoding is longer than the max l… --- ## [JAVA\_HOME and ES\_JAVA\_HOME](https://discuss.elastic.co/t/java-home-and-es-java-home/296651)
**Author:** [@holobolo0815](https://discuss.elastic.co/u/holobolo0815)\ **Replies:** 1\ **Last updated:** [February 8, 2022, 9:46pm UTC](https://discuss.elastic.co/t/java-home-and-es-java-home/296651 "2022-02-08T21:46:08Z")
Hello, As I understand JAVA\_HOME should not be set, and ES\_JAVA\_HOME should only be set if I want to use another JDK than the bundled one. Alright, so my system just sets JAVA\_HOME for generic use and I don't care, and… --- ## [Kibana Anonymous access - how do you prevent listing all dashboards?](https://discuss.elastic.co/t/kibana-anonymous-access-how-do-you-prevent-listing-all-dashboards/296214)
**Author:** [@maverick1](https://discuss.elastic.co/u/maverick1)\ **Replies:** 5\ **Last updated:** [February 8, 2022, 9:23pm UTC](https://discuss.elastic.co/t/kibana-anonymous-access-how-do-you-prevent-listing-all-dashboards/296214 "2022-02-08T21:23:13Z")
We are using Elastic cloud, and have setup Kibana for Anonymous access so that users can share dashboard links publicly. The anonymous role is configured to only allow Kibana -\> Dashboard Read permissions. This set… --- ## [Is it possible to enrich windows integration logs ?!](https://discuss.elastic.co/t/is-it-possible-to-enrich-windows-integration-logs/295143)
**Author:** [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)\ **Replies:** 6\ **Last updated:** [February 8, 2022, 8:58pm UTC](https://discuss.elastic.co/t/is-it-possible-to-enrich-windows-integration-logs/295143 "2022-02-08T20:58:42Z")
Hi, I'm using windows integration to collect windows event logs, the integration settings offer a field to specify processor, but when try to use enrich processor I stop receiving new logs and i got the following error … --- ## [How to tell the state of an IIS app pool via the IIS metrics from Metricbeat](https://discuss.elastic.co/t/how-to-tell-the-state-of-an-iis-app-pool-via-the-iis-metrics-from-metricbeat/294171)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 6\ **Last updated:** [February 8, 2022, 8:15pm UTC](https://discuss.elastic.co/t/how-to-tell-the-state-of-an-iis-app-pool-via-the-iis-metrics-from-metricbeat/294171 "2022-02-08T20:15:19Z")
Hi All, I'm trying to determine the state of an IIS app pool (running/stopped/disabled/etc...) that is monitor by Metricbeat. However, it doesn't appear that Metricbeat includes the state of the app pool in its metric … --- ## [Union two fields within Vega](https://discuss.elastic.co/t/union-two-fields-within-vega/296613)
**Author:** [@TUKTUK](https://discuss.elastic.co/u/TUKTUK)\ **Replies:** 3\ **Last updated:** [February 8, 2022, 8:00pm UTC](https://discuss.elastic.co/t/union-two-fields-within-vega/296613 "2022-02-08T20:00:44Z")
Hello together, I am looking for a way to union the elements of two different fields into one (new) array in Vega (If this is already possible in an Elastic Query that's also fine). It should be similar to a SQL-Statem… --- ## [Split message logstash elasticsearch](https://discuss.elastic.co/t/split-message-logstash-elasticsearch/296291)
**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\ **Replies:** 2\ **Last updated:** [February 8, 2022, 7:28pm UTC](https://discuss.elastic.co/t/split-message-logstash-elasticsearch/296291 "2022-02-08T19:28:33Z")
Hi, my message it looks like : i want to add field when found the "|" it means to split it with "|" i did it but it looks with a wrong method : imagine that we have a lot of data in one message and in the same f… --- ## [Logstash holding deleted output file](https://discuss.elastic.co/t/logstash-holding-deleted-output-file/296113)
**Author:** [@Xiaochi\_Weng](https://discuss.elastic.co/u/Xiaochi_Weng)\ **Replies:** 7\ **Last updated:** [February 8, 2022, 7:06pm UTC](https://discuss.elastic.co/t/logstash-holding-deleted-output-file/296113 "2022-02-08T19:06:26Z")
I am currently using logstash with version 7.17 in the docker. Here is my output code: output{ file{ path=\>"/tmp/data/output.log" } } Meanwhile, I also have logrotate to keep it rotating: /tmp/data/output.log { si… --- ## [Logstash Ruby error when trying to rename a field the has a hyphen "-" in the value](https://discuss.elastic.co/t/logstash-ruby-error-when-trying-to-rename-a-field-the-has-a-hyphen-in-the-value/296618)
**Author:** [@Bryan\_Hamilton](https://discuss.elastic.co/u/Bryan_Hamilton)\ **Replies:** 4\ **Last updated:** [February 8, 2022, 6:51pm UTC](https://discuss.elastic.co/t/logstash-ruby-error-when-trying-to-rename-a-field-the-has-a-hyphen-in-the-value/296618 "2022-02-08T18:51:14Z")
I have events with nested fields and am trying and am trying the reduce the depth of some nested fields to match ecs and discarding the fields I don't need. Renaning of all other fields word except for one which causes a… --- ## [Removing non-numeric characters from a field not working in logstash](https://discuss.elastic.co/t/removing-non-numeric-characters-from-a-field-not-working-in-logstash/296648)
**Author:** [@curiousmind](https://discuss.elastic.co/u/curiousmind)\ **Replies:** 1\ **Last updated:** [February 8, 2022, 6:49pm UTC](https://discuss.elastic.co/t/removing-non-numeric-characters-from-a-field-not-working-in-logstash/296648 "2022-02-08T18:49:42Z")
need an urgent help.I am getting this error \[2022-02-08T18:25:01,995\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main\] Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>"xjmdwt2/wbqlYsoFmJO31K… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1060) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1062)