# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1064 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1065 --- ## [Bizarre Error: bash: ./filebeat: No such file or directory](https://discuss.elastic.co/t/bizarre-error-bash-filebeat-no-such-file-or-directory/296407)
**Author:** [@Jarbird](https://discuss.elastic.co/u/Jarbird)\ **Replies:** 2\ **Last updated:** [February 7, 2022, 3:39pm UTC](https://discuss.elastic.co/t/bizarre-error-bash-filebeat-no-such-file-or-directory/296407 "2022-02-07T15:39:03Z")
So this is a surreal one... I am having issues with modules not working, and I suspect an unnamed distribution is packaging and/or installing it wrong. At my wits end I decided to manually download the precompiled binari… --- ## [Data Node Roles](https://discuss.elastic.co/t/data-node-roles/296482)
**Author:** [@Enis\_Kollugil](https://discuss.elastic.co/u/Enis_Kollugil)\ **Replies:** 1\ **Last updated:** [February 7, 2022, 3:16pm UTC](https://discuss.elastic.co/t/data-node-roles/296482 "2022-02-07T15:16:52Z")
Hello everyone, We need some hints for a situation. We have an Elasticsearch cluster with version 7.10 and we configure it for data nodes as follows. node.master: false node.data: true node.ingest: true However, when… --- ## [Wildcard search based on a field like Splunk?](https://discuss.elastic.co/t/wildcard-search-based-on-a-field-like-splunk/295250)
**Author:** [@jlrMantu](https://discuss.elastic.co/u/jlrMantu)\ **Replies:** 2\ **Last updated:** [February 7, 2022, 3:04pm UTC](https://discuss.elastic.co/t/wildcard-search-based-on-a-field-like-splunk/295250 "2022-02-07T15:04:13Z")
Hello, Sorry if this has been posted before, I couldn't find. We are currently using Splunk but moving to Elastic / Kibana. On Splunk, we have some Fields in the dashboard, and when we search for a value, the search su… --- ## [Roll Up for \_size field / Archive \_size field for statistics](https://discuss.elastic.co/t/roll-up-for-size-field-archive-size-field-for-statistics/296485)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 0\ **Last updated:** [February 7, 2022, 2:48pm UTC](https://discuss.elastic.co/t/roll-up-for-size-field-archive-size-field-for-statistics/296485 "2022-02-07T14:48:54Z")
Hi folks, I want to archive the \_size field (along with some other fields such as kubernetes.namespace) in a dedicated archive index. From here I have learned that this could be done using Roll Ups. However I am not su… --- ## [Osquery Live queries: windows endpoints not responding 'action undefined'](https://discuss.elastic.co/t/osquery-live-queries-windows-endpoints-not-responding-action-undefined/296087)
**Author:** [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)\ **Replies:** 7\ **Last updated:** [February 7, 2022, 2:40pm UTC](https://discuss.elastic.co/t/osquery-live-queries-windows-endpoints-not-responding-action-undefined/296087 "2022-02-07T14:40:39Z")
Hello, I installed Osquery manager integration on my endpoints, for linux it worked like magic, while on the windows I get the following results With no errors reported on log files (elastic-agent, osquerybeat, o… --- ## [Role account permissions](https://discuss.elastic.co/t/role-account-permissions/296471)
**Author:** [@stuwee](https://discuss.elastic.co/u/stuwee)\ **Replies:** 2\ **Last updated:** [February 7, 2022, 2:23pm UTC](https://discuss.elastic.co/t/role-account-permissions/296471 "2022-02-07T14:23:36Z")
Hi, is it possible to allow a role account to create new user accounts? I don't see it in the permissions. Right now I can only create new accounts from the built in elastic user. --- ## [Filebeat -\> elastic: onConnect callback failed: error loading template](https://discuss.elastic.co/t/filebeat-elastic-onconnect-callback-failed-error-loading-template/296121)
**Author:** [@mevan](https://discuss.elastic.co/u/mevan)\ **Replies:** 2\ **Last updated:** [February 7, 2022, 2:10pm UTC](https://discuss.elastic.co/t/filebeat-elastic-onconnect-callback-failed-error-loading-template/296121 "2022-02-07T14:10:52Z")
I have followed the instructions here: Grant privileges and roles needed for publishing | Filebeat Reference \[7.17\] | Elastic I have setup.ilm.check\_exists: false set in /etc/filebeat/filebeat.yml See screenshot of my … --- ## [Logstash is Stopping automatically](https://discuss.elastic.co/t/logstash-is-stopping-automatically/296455)
**Author:** [@David\_Samm](https://discuss.elastic.co/u/David_Samm)\ **Replies:** 1\ **Last updated:** [February 7, 2022, 2:04pm UTC](https://discuss.elastic.co/t/logstash-is-stopping-automatically/296455 "2022-02-07T14:04:46Z")
Hi logstash is stopping automatically after some time I have increased xms and xmx to 4 GB in config in JVM.Options file even though Facing same issue --- ## [Convert string field to json](https://discuss.elastic.co/t/convert-string-field-to-json/296478)
**Author:** [@rcts](https://discuss.elastic.co/u/rcts)\ **Replies:** 1\ **Last updated:** [February 7, 2022, 2:04pm UTC](https://discuss.elastic.co/t/convert-string-field-to-json/296478 "2022-02-07T14:04:01Z")
Hi! I need to convert this "message" field to json, how? --- ## [Required to avoid below search patterns from the search results in Elastic Search](https://discuss.elastic.co/t/required-to-avoid-below-search-patterns-from-the-search-results-in-elastic-search/296469)
**Author:** [@sangasur](https://discuss.elastic.co/u/sangasur)\ **Replies:** 0\ **Last updated:** [February 7, 2022, 12:50pm UTC](https://discuss.elastic.co/t/required-to-avoid-below-search-patterns-from-the-search-results-in-elastic-search/296469 "2022-02-07T12:50:41Z")
We have a requirement to search the availability of any sensitive data without masking (like firstName, lastName, eMail etc..) from the kibana/Elasticsearch logs from the field full\_message . Usually these details will b… --- ## [Stalled in creating a new beat](https://discuss.elastic.co/t/stalled-in-creating-a-new-beat/296301)
**Author:** [@YUAN\_YE](https://discuss.elastic.co/u/YUAN_YE)\ **Replies:** 1\ **Last updated:** [February 7, 2022, 1:26pm UTC](https://discuss.elastic.co/t/stalled-in-creating-a-new-beat/296301 "2022-02-07T13:26:38Z")
I pushed the Beat version back to 7.15 to try to create a new beat, but it stalled while executing the Mage GenerateCustomBeat as per the tutorial I've tried again many times, but each time I get stuck in the same pl… --- ## [Force field processing as "double" instead of "long"](https://discuss.elastic.co/t/force-field-processing-as-double-instead-of-long/296220)
**Author:** [@Dror\_Tirosh](https://discuss.elastic.co/u/Dror_Tirosh)\ **Replies:** 2\ **Last updated:** [February 7, 2022, 1:23pm UTC](https://discuss.elastic.co/t/force-field-processing-as-double-instead-of-long/296220 "2022-02-07T13:23:49Z")
I try to load json-structured logs using filebeat into kibana. it parses OK, but some values are numeric with very large numbers. filebeat complains that Value \[40000000000000000000\] is out of range for a long"}}, dro… --- ## [WARN: o.e.t.ThreadPool - absolute clock went backwards…](https://discuss.elastic.co/t/warn-o-e-t-threadpool-absolute-clock-went-backwards/296320)
**Author:** [@MSN](https://discuss.elastic.co/u/MSN)\ **Replies:** 3\ **Last updated:** [February 7, 2022, 12:46pm UTC](https://discuss.elastic.co/t/warn-o-e-t-threadpool-absolute-clock-went-backwards/296320 "2022-02-07T12:46:16Z")
Hi, after a fresh installation this log entry shows up on every node once a minute. absolute clock went backwards by \[300ms/300ms\] while timer thread was sleeping I already searched the forum and the Elasticsearch doc… --- ## [Can it replace Prometheus?](https://discuss.elastic.co/t/can-it-replace-prometheus/296417)
**Author:** [@xodn0812](https://discuss.elastic.co/u/xodn0812)\ **Replies:** 1\ **Last updated:** [February 7, 2022, 12:40pm UTC](https://discuss.elastic.co/t/can-it-replace-prometheus/296417 "2022-02-07T12:40:53Z")
I use Prometheus to gather k8s' resources. The resource data pipeline is as follows. k8s -\> Prometheus -\> Java app -\> Elasticsearch -\> (search) Java app Here I have a question. Why use Prometheus? Wouldn't Prometheus no… --- ## [Question about strange behaviour with Fuzzy query in elasticsearch](https://discuss.elastic.co/t/question-about-strange-behaviour-with-fuzzy-query-in-elasticsearch/296362)
**Author:** [@psydow](https://discuss.elastic.co/u/psydow)\ **Replies:** 4\ **Last updated:** [February 7, 2022, 12:30pm UTC](https://discuss.elastic.co/t/question-about-strange-behaviour-with-fuzzy-query-in-elasticsearch/296362 "2022-02-07T12:30:07Z")
Hello everyone, I am new to the elastic stack and fulltext search for this reason there came up a question regarding some fuzzy queries I was working with the last Weeks. For context I want to realise a system where th… --- ## [Kibana Dashboard display no content without filtering](https://discuss.elastic.co/t/kibana-dashboard-display-no-content-without-filtering/296256)
**Author:** [@fionachan](https://discuss.elastic.co/u/fionachan)\ **Replies:** 17\ **Last updated:** [February 7, 2022, 11:28am UTC](https://discuss.elastic.co/t/kibana-dashboard-display-no-content-without-filtering/296256 "2022-02-07T11:28:46Z")
Hi, is there a way to make the table in the dashboard shows a sentence like "please select", after filtering show the data? --- ## [Index houskeeping (ILM)](https://discuss.elastic.co/t/index-houskeeping-ilm/296270)
**Author:** [@humartinez](https://discuss.elastic.co/u/humartinez)\ **Replies:** 5\ **Last updated:** [February 7, 2022, 11:11am UTC](https://discuss.elastic.co/t/index-houskeeping-ilm/296270 "2022-02-07T11:11:56Z")
Hi, I have this question on my mind for a long time. I have many indexes on a Elastic cluster, this cluster is used for application logging so I have plenty of indices separated by application because of they use case. … --- ## [How to prevent duplicates in filebeat](https://discuss.elastic.co/t/how-to-prevent-duplicates-in-filebeat/296391)
**Author:** [@Dror\_Tirosh](https://discuss.elastic.co/u/Dror_Tirosh)\ **Replies:** 2\ **Last updated:** [February 7, 2022, 10:46am UTC](https://discuss.elastic.co/t/how-to-prevent-duplicates-in-filebeat/296391 "2022-02-07T10:46:42Z")
My input data (which is json-formatted) as a unique field. According to the documentation, this should use it as a unique identifier, and thus pervent duplicates: processor: - fingerprint: fields: \["tx"\] target… --- ## [Elasticsearch Python](https://discuss.elastic.co/t/elasticsearch-python/296356)
**Author:** [@harsh19](https://discuss.elastic.co/u/harsh19)\ **Replies:** 2\ **Last updated:** [February 7, 2022, 10:39am UTC](https://discuss.elastic.co/t/elasticsearch-python/296356 "2022-02-07T10:39:36Z")
Here is my code, from datetime import datetime from elasticsearch import Elasticsearch, helpers from pprint import pprint import json import time es = Elasticsearch(\['http://localhost:9200'\], http\_auth=('elastic', … --- ## [Nested queries (or secondary query)](https://discuss.elastic.co/t/nested-queries-or-secondary-query/296452)
**Author:** [@eladf](https://discuss.elastic.co/u/eladf)\ **Replies:** 0\ **Last updated:** [February 7, 2022, 10:21am UTC](https://discuss.elastic.co/t/nested-queries-or-secondary-query/296452 "2022-02-07T10:21:17Z")
Hi all, I encountered an issue and will appreciate your help with it. I have a huge index (~0.5B documents) with a mapping that includes numeric fields (enum values), one keyword field and a nested field. The nested f… --- ## [How to set a custom logo in kibana 7.16](https://discuss.elastic.co/t/how-to-set-a-custom-logo-in-kibana-7-16/296422)
**Author:** [@Sunil\_Bhakar](https://discuss.elastic.co/u/Sunil_Bhakar)\ **Replies:** 1\ **Last updated:** [February 7, 2022, 9:34am UTC](https://discuss.elastic.co/t/how-to-set-a-custom-logo-in-kibana-7-16/296422 "2022-02-07T09:34:21Z")
Hello, I want to set a custom logo in kibana 7.16. Thanks in Advance for the help. --- ## [Customize chart fields](https://discuss.elastic.co/t/customize-chart-fields/296071)
**Author:** [@meyer1](https://discuss.elastic.co/u/meyer1)\ **Replies:** 5\ **Last updated:** [February 7, 2022, 9:18am UTC](https://discuss.elastic.co/t/customize-chart-fields/296071 "2022-02-07T09:18:56Z")
Hello everybody I have a small problem that I encounter on most of my graphs. I would like to display the field name + its value in the captions. There is currently only the value and it is not too telling. Is it pos… --- ## [Translog of index size is huge](https://discuss.elastic.co/t/translog-of-index-size-is-huge/296385)
**Author:** [@Ariel\_Benichou](https://discuss.elastic.co/u/Ariel_Benichou)\ **Replies:** 2\ **Last updated:** [February 7, 2022, 9:14am UTC](https://discuss.elastic.co/t/translog-of-index-size-is-huge/296385 "2022-02-07T09:14:41Z")
TL;DR one of my index in one of my data node got out of end and took all the disk available space making the node crash. The Problem On one of my data nodes, one of my biggest index (~10G) had suddenly a translog the w… --- ## [Indexing latency slowly increases until it's taking hours](https://discuss.elastic.co/t/indexing-latency-slowly-increases-until-its-taking-hours/296324)
**Author:** [@mikehardenize](https://discuss.elastic.co/u/mikehardenize)\ **Replies:** 2\ **Last updated:** [February 7, 2022, 9:10am UTC](https://discuss.elastic.co/t/indexing-latency-slowly-increases-until-its-taking-hours/296324 "2022-02-07T09:10:59Z")
I have a 3 node cluster. Once a day I create a new index and bulk insert some data. Then throughout the day singular docs are slowly added to that same index. Once a new index has been created and fulfilled the previous … --- ## [Percolation with document containing huge geo\_shape](https://discuss.elastic.co/t/percolation-with-document-containing-huge-geo-shape/294557)
**Author:** [@Pingouin](https://discuss.elastic.co/u/Pingouin)\ **Replies:** 3\ **Last updated:** [February 7, 2022, 8:58am UTC](https://discuss.elastic.co/t/percolation-with-document-containing-huge-geo-shape/294557 "2022-02-07T08:58:21Z")
Hello, i have strange error when using percolation with a document containing a huge geo\_shape property. I have an index containing documents (dt\_prior\_lake\_database\_continent\_basin). These documents have a mapped geo\_s… --- ## [I got "Limited to 500 results. Refine your search. 256 documents" in save search displayed in dashboard](https://discuss.elastic.co/t/i-got-limited-to-500-results-refine-your-search-256-documents-in-save-search-displayed-in-dashboard/296420)
**Author:** [@ShayWeizman](https://discuss.elastic.co/u/ShayWeizman)\ **Replies:** 1\ **Last updated:** [February 7, 2022, 6:57am UTC](https://discuss.elastic.co/t/i-got-limited-to-500-results-refine-your-search-256-documents-in-save-search-displayed-in-dashboard/296420 "2022-02-07T06:57:25Z")
Hi All, I'm using 7.16.2 version. I have a saved search that I'm displaying in dashboard. When I add a filter for a text field which contains certain text I get: "Limited to 500 results. Refine your search. 256 documen… --- ## [Can a field like "name.last" be the target field of "enrich" in the ingest pipeline gui?](https://discuss.elastic.co/t/can-a-field-like-name-last-be-the-target-field-of-enrich-in-the-ingest-pipeline-gui/296418)
**Author:** [@Aloha](https://discuss.elastic.co/u/Aloha)\ **Replies:** 1\ **Last updated:** [February 7, 2022, 6:30am UTC](https://discuss.elastic.co/t/can-a-field-like-name-last-be-the-target-field-of-enrich-in-the-ingest-pipeline-gui/296418 "2022-02-07T06:30:07Z")
Trying to setup an ingest pipeline via the gui after setting up an enrich policy similar to this example. The target field is name.last and testing the pipeline with documents via the GUI works fine but trying to ingest… --- ## [No data for query "exists": { "field": "event.original" }](https://discuss.elastic.co/t/no-data-for-query-exists-field-event-original/296355)
**Author:** [@Slavik\_Fursov](https://discuss.elastic.co/u/Slavik_Fursov)\ **Replies:** 6\ **Last updated:** [February 7, 2022, 4:13am UTC](https://discuss.elastic.co/t/no-data-for-query-exists-field-event-original/296355 "2022-02-07T04:13:46Z")
I'm sending web access logs from Nginx server to Elastic. Everything works. I can see all data in Kibana correctly: However, when I try to add "exists": { "field": "event.original" } I'm getting no data: What … --- ## [Some questions](https://discuss.elastic.co/t/some-questions/296304)
**Author:** [@sandeepmuthathi](https://discuss.elastic.co/u/sandeepmuthathi)\ **Replies:** 4\ **Last updated:** [February 7, 2022, 5:35am UTC](https://discuss.elastic.co/t/some-questions/296304 "2022-02-07T05:35:24Z")
Is it a good idea to use Elasticsearch master nodes IPs(3 nodes) in the logstash or filebeat Or do we need to tell beat to use datanodes directly? Please note that master nodes has lots of resources but master nodes min… --- ## [Scripted field using painless - creating new field based on multiple fields](https://discuss.elastic.co/t/scripted-field-using-painless-creating-new-field-based-on-multiple-fields/296402)
**Author:** [@iraidalavrovaa](https://discuss.elastic.co/u/iraidalavrovaa)\ **Replies:** 3\ **Last updated:** [February 7, 2022, 5:19am UTC](https://discuss.elastic.co/t/scripted-field-using-painless-creating-new-field-based-on-multiple-fields/296402 "2022-02-07T05:19:30Z")
Hi all, I have multiple fields containing the values of the same type (strings). The underlying structure of the division into these fields has changed. So I want to reorganize these fields for better filtering and vis… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1063) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1065)