# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1066 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1067 --- ## [APIKey retains the cluster privileges at the time is was created](https://discuss.elastic.co/t/apikey-retains-the-cluster-privileges-at-the-time-is-was-created/296359)
**Author:** [@Roger\_Clark](https://discuss.elastic.co/u/Roger_Clark)\ **Replies:** 2\ **Last updated:** [February 5, 2022, 5:39pm UTC](https://discuss.elastic.co/t/apikey-retains-the-cluster-privileges-at-the-time-is-was-created/296359 "2022-02-05T17:39:20Z")
We were testing out migration to APIKeys for application-level API access and I noticed something strange I can't find documented anywhere, this is under a ELK stack running 7.15.1 I created a new user and role, and for… --- ## [Logstash Listening on port 8080 got struck](https://discuss.elastic.co/t/logstash-listening-on-port-8080-got-struck/296130)
**Author:** [@naveen\_g](https://discuss.elastic.co/u/naveen_g)\ **Replies:** 5\ **Last updated:** [February 5, 2022, 4:32pm UTC](https://discuss.elastic.co/t/logstash-listening-on-port-8080-got-struck/296130 "2022-02-05T16:32:59Z")
Hi Everyone, I'm new to ELK and go-through handful of articles & videos , I setup ELK for our projects. When I do POC on setup ELK & Filebeat in same machine, it was working fine but when we planned to separate ELK to se… --- ## [What to do with query inside filter query](https://discuss.elastic.co/t/what-to-do-with-query-inside-filter-query/296246)
**Author:** [@JunyaT](https://discuss.elastic.co/u/JunyaT)\ **Replies:** 3\ **Last updated:** [February 5, 2022, 4:26am UTC](https://discuss.elastic.co/t/what-to-do-with-query-inside-filter-query/296246 "2022-02-05T04:26:24Z")
Hi, people from Elasticsearch. I have struggles trying to migrate to Elasticsearch 7.11.1 from very old Elasticsearch 1.3. "The original query" below is used in our codebase to be executed against Elasticsearch 1.3 and… --- ## [Remove Kibana message about overlapping Snapshots](https://discuss.elastic.co/t/remove-kibana-message-about-overlapping-snapshots/296350)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 0\ **Last updated:** [February 5, 2022, 12:07am UTC](https://discuss.elastic.co/t/remove-kibana-message-about-overlapping-snapshots/296350 "2022-02-05T00:07:42Z")
Hello, While elasticsearch can now take multiple snapshots at the same time, If you configure a snapshot policy with the same time in Kibana, it will show the following message: Two or more policies have the same sche… --- ## [Runtime field error](https://discuss.elastic.co/t/runtime-field-error/296234)
**Author:** [@gentle\_ghost](https://discuss.elastic.co/u/gentle_ghost)\ **Replies:** 3\ **Last updated:** [February 4, 2022, 10:45pm UTC](https://discuss.elastic.co/t/runtime-field-error/296234 "2022-02-04T22:45:36Z")
Hello, I'm attempting to create a runtime field that parses values from a field based on a regex. I have a field event\_trigger that contains some various strings. I'm looking to find all values which contain giy2 and … --- ## [How to dynamically recognize points via HTTPS ingestion?](https://discuss.elastic.co/t/how-to-dynamically-recognize-points-via-https-ingestion/296346)
**Author:** [@HC\_LW](https://discuss.elastic.co/u/HC_LW)\ **Replies:** 1\ **Last updated:** [February 4, 2022, 10:03pm UTC](https://discuss.elastic.co/t/how-to-dynamically-recognize-points-via-https-ingestion/296346 "2022-02-04T22:03:46Z")
We are sending https requests to ingest data. How can the request be formatted so that Elastic dynamically maps the 'geo\_point' field as type:point and not text or number? Thank you! curl -X POST "https://in-https.URL" … --- ## [Elasticsearch Ability to write to Memory](https://discuss.elastic.co/t/elasticsearch-ability-to-write-to-memory/295586)
**Author:** [@Mohammad\_Etemad](https://discuss.elastic.co/u/Mohammad_Etemad)\ **Replies:** 2\ **Last updated:** [February 4, 2022, 9:07pm UTC](https://discuss.elastic.co/t/elasticsearch-ability-to-write-to-memory/295586 "2022-02-04T21:07:00Z")
Hello I was wondering if its possible to have Elasticsearch write docs to memory and have them roll. The use case is that we have a lot of data on a specific index being written and the writes to disk are using lots of … --- ## [Kibana service account not working for v8 upgrade deprecation note](https://discuss.elastic.co/t/kibana-service-account-not-working-for-v8-upgrade-deprecation-note/296125)
**Author:** [@rsaeks](https://discuss.elastic.co/u/rsaeks)\ **Replies:** 4\ **Last updated:** [February 4, 2022, 9:05pm UTC](https://discuss.elastic.co/t/kibana-service-account-not-working-for-v8-upgrade-deprecation-note/296125 "2022-02-04T21:05:19Z")
We recently moved our stack to 7.17 and are working through some of the warnings in the 8.0 upgrade assistant to be ready for the new version in the future. When changing Kibana to use Elasticsearch.serviceAccountToken i… --- ## [Namespace Option in Slack Connector](https://discuss.elastic.co/t/namespace-option-in-slack-connector/295292)
**Author:** [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Replies:** 5\ **Last updated:** [February 4, 2022, 7:59pm UTC](https://discuss.elastic.co/t/namespace-option-in-slack-connector/295292 "2022-02-04T19:59:25Z")
Is it possible to add the namespace information in the slack connector? i.e Rule {{context.rule.name}} with severity {{context.rule.severity}} generated {{state.signals\_count}} alerts in the {{context.data\_stream.names… --- ## [Detecting anomalies on drop of throughput](https://discuss.elastic.co/t/detecting-anomalies-on-drop-of-throughput/296307)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [February 4, 2022, 7:39pm UTC](https://discuss.elastic.co/t/detecting-anomalies-on-drop-of-throughput/296307 "2022-02-04T19:39:11Z")
Hi have data of throughput for multiple interfaces in a job, and I want to detect when the throughput drops abruptly, Im using the low\_mean function in the detector to do this, but sometimes there is an abrupt drop of t… --- ## [Infoblox module parsing](https://discuss.elastic.co/t/infoblox-module-parsing/296336)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 0\ **Last updated:** [February 4, 2022, 6:42pm UTC](https://discuss.elastic.co/t/infoblox-module-parsing/296336 "2022-02-04T18:42:28Z")
Hello, The Infoblox rsa module has 'a lot of room for improvement'.. Multiple fields are very badly parsed. For example a small extract of the network.interface.name field : As you can see there are multiple issues… --- ## [Issue with a conditional statement](https://discuss.elastic.co/t/issue-with-a-conditional-statement/296327)
**Author:** [@JeremyP](https://discuss.elastic.co/u/JeremyP)\ **Replies:** 11\ **Last updated:** [February 4, 2022, 6:19pm UTC](https://discuss.elastic.co/t/issue-with-a-conditional-statement/296327 "2022-02-04T18:19:35Z")
Hello, I'm debugging my configuration and I'm having an issue comparing two fields, both are date fields and one eventually will become a multi-valued field. All my data is static and once a record is updated, a time st… --- ## [Kibana errors](https://discuss.elastic.co/t/kibana-errors/296229)
**Author:** [@sukhsehaj](https://discuss.elastic.co/u/sukhsehaj)\ **Replies:** 5\ **Last updated:** [February 4, 2022, 5:21pm UTC](https://discuss.elastic.co/t/kibana-errors/296229 "2022-02-04T17:21:01Z")
Hello, can you plz help me troubleshoot these Kibana errors: Feb 03 19:49:32 prozokiba01.pinpointtech.com systemd\[1\]: Started Kibana. Feb 03 19:49:42 prozokiba01.pinpointtech.com kibana\[562\]: {"type":"log","@timestamp"… --- ## [Do I need a nested query or foreach or a create a new index?](https://discuss.elastic.co/t/do-i-need-a-nested-query-or-foreach-or-a-create-a-new-index/295968)
**Author:** [@clearbluelou](https://discuss.elastic.co/u/clearbluelou)\ **Replies:** 5\ **Last updated:** [February 3, 2022, 8:52pm UTC](https://discuss.elastic.co/t/do-i-need-a-nested-query-or-foreach-or-a-create-a-new-index/295968 "2022-02-03T20:52:06Z")
I'm new to Elasticsearch and Kibana. I haven't really gotten to a point of understanding of the JSON-like syntax. I've just been using the filters and some Lucene queries. Please be gentle. :blush: This is hard to e… --- ## [How to decide on number of Master and data nodes between two data centers](https://discuss.elastic.co/t/how-to-decide-on-number-of-master-and-data-nodes-between-two-data-centers/295097)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 8\ **Last updated:** [February 4, 2022, 2:32pm UTC](https://discuss.elastic.co/t/how-to-decide-on-number-of-master-and-data-nodes-between-two-data-centers/295097 "2022-02-04T14:32:51Z")
Hi All, We have a total of 8 servers (4 in each data center), running ELK 7.6.2 stack. How can we decide on the number of Master (or Master-eligible) nodes and data nodes? Please help --- ## [More\_like\_this not using nested fields?](https://discuss.elastic.co/t/more-like-this-not-using-nested-fields/296311)
**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Replies:** 0\ **Last updated:** [February 4, 2022, 2:27pm UTC](https://discuss.elastic.co/t/more-like-this-not-using-nested-fields/296311 "2022-02-04T14:27:47Z")
I want to use the more like this query type to find similar documents without having to construct a bool. I like the minimum\_should\_match as a percent to identify %-similar documents. My document has lots of nested fiel… --- ## [No results with larger time range](https://discuss.elastic.co/t/no-results-with-larger-time-range/296035)
**Author:** [@jukow](https://discuss.elastic.co/u/jukow)\ **Replies:** 1\ **Last updated:** [February 4, 2022, 2:22pm UTC](https://discuss.elastic.co/t/no-results-with-larger-time-range/296035 "2022-02-04T14:22:28Z")
When i do a terms aggregation with a count metric Kibana shows "No results found" for a time range of e.g. 3 days. When i lower the range to e.g. 1 day results are showing up. What kind of strange behavior is this? --- ## [Elasticsearch - monitoring query response times](https://discuss.elastic.co/t/elasticsearch-monitoring-query-response-times/296306)
**Author:** [@MSaneme](https://discuss.elastic.co/u/MSaneme)\ **Replies:** 0\ **Last updated:** [February 4, 2022, 2:00pm UTC](https://discuss.elastic.co/t/elasticsearch-monitoring-query-response-times/296306 "2022-02-04T14:00:57Z")
I would like to perform a study of the response time provided by Elasticsearch for different spatio-temporal queries. Is there any way to know the response times for each query executed on a given index? I am working w… --- ## [Configure Proxy Settings in Kibana to access Webhook](https://discuss.elastic.co/t/configure-proxy-settings-in-kibana-to-access-webhook/294604)
**Author:** [@mralladin](https://discuss.elastic.co/u/mralladin)\ **Replies:** 7\ **Last updated:** [February 4, 2022, 1:56pm UTC](https://discuss.elastic.co/t/configure-proxy-settings-in-kibana-to-access-webhook/294604 "2022-02-04T13:56:24Z")
Hello I want to send Alerts via Webhook to the Webex Api but the Kibana/Elastic Application ist behind our Company Proxy. I tried already with xpack.actions.proxyUrl: "http://TechnicalUser:Password@Proxy:Port" But it… --- ## [Elasticsearch authentication in Docker Swarm mode](https://discuss.elastic.co/t/elasticsearch-authentication-in-docker-swarm-mode/296293)
**Author:** [@FleaLes](https://discuss.elastic.co/u/FleaLes)\ **Replies:** 7\ **Last updated:** [February 4, 2022, 1:55pm UTC](https://discuss.elastic.co/t/elasticsearch-authentication-in-docker-swarm-mode/296293 "2022-02-04T13:55:28Z")
I have upgraded my Dev environment ELK stack to v 7.10.2 and I have authentication issues with connecting Kibana to Elasticsearch. Scenario The ELK stack is in Docker containers deployed in Swarm mode via a docker-comp… --- ## [Elastic migration](https://discuss.elastic.co/t/elastic-migration/296298)
**Author:** [@Petr\_Bucek](https://discuss.elastic.co/u/Petr_Bucek)\ **Replies:** 0\ **Last updated:** [February 4, 2022, 1:21pm UTC](https://discuss.elastic.co/t/elastic-migration/296298 "2022-02-04T13:21:47Z")
Hello, I have general question. I have elastic on-prem solution in old DC. (that DC will be decommissioned and we cannot move the physical servers) I need to migrate from one DC (on-prem solution) to another DC (virtu… --- ## [Unable to set "defaultRoute" in kibana configuration file in kibana 7.10.2](https://discuss.elastic.co/t/unable-to-set-defaultroute-in-kibana-configuration-file-in-kibana-7-10-2/296231)
**Author:** [@Usman18](https://discuss.elastic.co/u/Usman18)\ **Replies:** 1\ **Last updated:** [February 4, 2022, 1:15pm UTC](https://discuss.elastic.co/t/unable-to-set-defaultroute-in-kibana-configuration-file-in-kibana-7-10-2/296231 "2022-02-04T13:15:43Z")
I want to remove all deprecation warnings from the kibana. In the logs, I have seen that kibana.defaultAppId has been deprecated and it has been suggested that defaultRoute should be used. But when i set this option in k… --- ## [Input tcp codec fluent: invalid byte sequence in UTF-8 in regex](https://discuss.elastic.co/t/input-tcp-codec-fluent-invalid-byte-sequence-in-utf-8-in-regex/296290)
**Author:** [@Samuel\_Lima1](https://discuss.elastic.co/u/Samuel_Lima1)\ **Replies:** 0\ **Last updated:** [February 4, 2022, 12:45pm UTC](https://discuss.elastic.co/t/input-tcp-codec-fluent-invalid-byte-sequence-in-utf-8-in-regex/296290 "2022-02-04T12:45:40Z")
Hi folks, I'm using input tcp codec fluent and getting error " invalid byte sequence in UTF-8" when doing regex. It seems there is an invalid character in the message. Any idea how to solve it? Is there a way to simpl… --- ## [Filebeat as sidecar best practices](https://discuss.elastic.co/t/filebeat-as-sidecar-best-practices/296289)
**Author:** [@rpetre](https://discuss.elastic.co/u/rpetre)\ **Replies:** 0\ **Last updated:** [February 4, 2022, 12:04pm UTC](https://discuss.elastic.co/t/filebeat-as-sidecar-best-practices/296289 "2022-02-04T12:04:06Z")
I'm using filebeat inside of kubernetes both as daemonset (to capture stdout of all containers), but also as sidecar in specific pods, to ship application logs that are written to shared volumes. The documentation is som… --- ## [Local Storage Full](https://discuss.elastic.co/t/local-storage-full/296078)
**Author:** [@eprop-marc](https://discuss.elastic.co/u/eprop-marc)\ **Replies:** 6\ **Last updated:** [February 4, 2022, 11:43am UTC](https://discuss.elastic.co/t/local-storage-full/296078 "2022-02-04T11:43:18Z")
Hi, the local storage on my ELK stack is 95% full and I can no longer see logs in Elastic. I just wanted some advice on how best to reduce the storage on the local disk please and start using Elastic again. I don't reall… --- ## [Date Histogram Visualization](https://discuss.elastic.co/t/date-histogram-visualization/296199)
**Author:** [@kibanauser4](https://discuss.elastic.co/u/kibanauser4)\ **Replies:** 3\ **Last updated:** [February 4, 2022, 11:40am UTC](https://discuss.elastic.co/t/date-histogram-visualization/296199 "2022-02-04T11:40:41Z")
I have a Datetime field in my index and I want to show a visualization where I will be able to see in which hours my records are the most frequent. But when I use the Date Histogram and choose to show "per 2 hours" for e… --- ## [Unable see document fields in "Add Field" selector in Kibana / Graph](https://discuss.elastic.co/t/unable-see-document-fields-in-add-field-selector-in-kibana-graph/295601)
**Author:** [@blackge](https://discuss.elastic.co/u/blackge)\ **Replies:** 2\ **Last updated:** [February 4, 2022, 10:48am UTC](https://discuss.elastic.co/t/unable-see-document-fields-in-add-field-selector-in-kibana-graph/295601 "2022-02-04T10:48:55Z")
Hi, I've just started experimenting with Graphs in Kibana and I'm only seeing a subset of the fields in my documents available to select for the graph. When I click on the add fields, I see 9 fields in the "Add Fields"… --- ## [Converting Null values to Zero](https://discuss.elastic.co/t/converting-null-values-to-zero/295707)
**Author:** [@AmyMCollins](https://discuss.elastic.co/u/AmyMCollins)\ **Replies:** 1\ **Last updated:** [February 4, 2022, 10:30am UTC](https://discuss.elastic.co/t/converting-null-values-to-zero/295707 "2022-02-04T10:30:49Z")
Hi, I am trying to get the cumulative sum of the columns 'Loaded' and 'Worked' in Canvas. I can do it with the below query but when I remove the limit statement it fails. I believe this is because the pivot creates null… --- ## [Lens visualisation doesn't sort on formula result](https://discuss.elastic.co/t/lens-visualisation-doesnt-sort-on-formula-result/296258)
**Author:** [@Dominik11](https://discuss.elastic.co/u/Dominik11)\ **Replies:** 3\ **Last updated:** [February 4, 2022, 10:25am UTC](https://discuss.elastic.co/t/lens-visualisation-doesnt-sort-on-formula-result/296258 "2022-02-04T10:25:19Z")
Hi all, I have been recreating some of my dashboards using Lens visualisations but I stumbled on a seemingly illogical limitation. The concept of one visualisation is like this : I have 50+ API's running and I want to … --- ## [Query on Elasticsearch license updates](https://discuss.elastic.co/t/query-on-elasticsearch-license-updates/294900)
**Author:** [@mohammed.sabil](https://discuss.elastic.co/u/mohammed.sabil)\ **Replies:** 4\ **Last updated:** [February 4, 2022, 10:13am UTC](https://discuss.elastic.co/t/query-on-elasticsearch-license-updates/294900 "2022-02-04T10:13:16Z")
Hello Team, I would like to know about the licencing changes in Elasticsearch. Currently I am using Elasticsearch 7.16.2 along with Filebeat. I heard that there some changes in lincencing of Elasticsearch. We are comp… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1065) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1067)