# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1076 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1077 --- ## [Configure highlighted part](https://discuss.elastic.co/t/configure-highlighted-part/295164)
**Author:** [@Pavel\_Maltsev](https://discuss.elastic.co/u/Pavel_Maltsev)\ **Replies:** 1\ **Last updated:** [January 27, 2022, 10:14pm UTC](https://discuss.elastic.co/t/configure-highlighted-part/295164 "2022-01-27T22:14:01Z")
Main question The user is looking for a name and enters the part of it, let's say au, and the document with the text paul is found. I would like to have the doc highlighted like p\au\l. How can I achieve it if … --- ## [Elastic Security inside Kibana periodically stops responding and requires a Kibana restart](https://discuss.elastic.co/t/elastic-security-inside-kibana-periodically-stops-responding-and-requires-a-kibana-restart/295273)
**Author:** [@kossde](https://discuss.elastic.co/u/kossde)\ **Replies:** 2\ **Last updated:** [January 27, 2022, 9:31pm UTC](https://discuss.elastic.co/t/elastic-security-inside-kibana-periodically-stops-responding-and-requires-a-kibana-restart/295273 "2022-01-27T21:31:35Z")
We are on 7.13.2. At least once a day, access to Elastic Security breaks down. Other areas of Kibana continue to work (Dashboard, Dev tools, etc.) but the Security area loads to a blank screen. When I bring up Kibana… --- ## [Sequence numbers & indexing bottleneck](https://discuss.elastic.co/t/sequence-numbers-indexing-bottleneck/295614)
**Author:** [@fhalde](https://discuss.elastic.co/u/fhalde)\ **Replies:** 1\ **Last updated:** [January 27, 2022, 9:07pm UTC](https://discuss.elastic.co/t/sequence-numbers-indexing-bottleneck/295614 "2022-01-27T21:07:48Z")
Hello, We are trying to debug a problem where indexing a document halts the ingestion pipeline on that particular shard Taking into account the way sequence numbers are implemented, do documents get processed sequentia… --- ## [Vega Visualization and custom data source](https://discuss.elastic.co/t/vega-visualization-and-custom-data-source/295502)
**Author:** [@tstadler](https://discuss.elastic.co/u/tstadler)\ **Replies:** 2\ **Last updated:** [January 27, 2022, 6:57pm UTC](https://discuss.elastic.co/t/vega-visualization-and-custom-data-source/295502 "2022-01-27T18:57:48Z")
Is there way to parse the selected time range or query to the data url in a Vega visualization if the data source is not Elasticsearch? e.g. { "$schema": "https://vega.github.io/schema/vega-lite/v5.json", "data… --- ## [Deletion of old output files](https://discuss.elastic.co/t/deletion-of-old-output-files/295622)
**Author:** [@smzd](https://discuss.elastic.co/u/smzd)\ **Replies:** 0\ **Last updated:** [January 27, 2022, 6:45pm UTC](https://discuss.elastic.co/t/deletion-of-old-output-files/295622 "2022-01-27T18:45:15Z")
Hello, my logstash is outputing logs in files to then be ingested by elastic agent. In order to not have huge amount of disk being consumed by logs, I would like to rotate logs and then delete the old ones (after 3 day… --- ## [Index can not assign to a default ilm policy](https://discuss.elastic.co/t/index-can-not-assign-to-a-default-ilm-policy/295607)
**Author:** [@baalchina](https://discuss.elastic.co/u/baalchina)\ **Replies:** 1\ **Last updated:** [January 27, 2022, 6:27pm UTC](https://discuss.elastic.co/t/index-can-not-assign-to-a-default-ilm-policy/295607 "2022-01-27T18:27:29Z")
Hi, I am using logstash to collect my switch's syslog. Here is the logstash config like: input{ syslog{ type =\> "syslog-sw-hw-128" host =\> "1.2.3.4" port =\> 580 } } output{ if \[type\]… --- ## [Logstash configuration](https://discuss.elastic.co/t/logstash-configuration/295423)
**Author:** [@puneet\_makhija](https://discuss.elastic.co/u/puneet_makhija)\ **Replies:** 12\ **Last updated:** [January 27, 2022, 4:26pm UTC](https://discuss.elastic.co/t/logstash-configuration/295423 "2022-01-27T16:26:22Z")
Hello everyone, I am stuck in log stash configuration here below is my configuration please let me know what is wrong in this configuration # Sample Logstash configuration for creating a simple # Beats -\> Logstash -\> … --- ## [Issue with index - set fielddata=true](https://discuss.elastic.co/t/issue-with-index-set-fielddata-true/295594)
**Author:** [@Penchev](https://discuss.elastic.co/u/Penchev)\ **Replies:** 1\ **Last updated:** [January 27, 2022, 4:05pm UTC](https://discuss.elastic.co/t/issue-with-index-set-fielddata-true/295594 "2022-01-27T16:05:40Z")
Hello, When working with my dashboards I got this error message: "Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by de… --- ## [Elasticsearch-users tool with](https://discuss.elastic.co/t/elasticsearch-users-tool-with/295600)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 0\ **Last updated:** [January 27, 2022, 3:44pm UTC](https://discuss.elastic.co/t/elasticsearch-users-tool-with/295600 "2022-01-27T15:44:13Z")
Hey there, in order to create from scratch a cluster using also file realm, I would like to know if is it possible to integrate the elasticsearch-users tool usage with a pipeline executed via Jenkins/Ansible or Terrafor… --- ## [Log json in an array](https://discuss.elastic.co/t/log-json-in-an-array/295561)
**Author:** [@adouren](https://discuss.elastic.co/u/adouren)\ **Replies:** 6\ **Last updated:** [January 27, 2022, 3:20pm UTC](https://discuss.elastic.co/t/log-json-in-an-array/295561 "2022-01-27T15:20:47Z")
Hello, I am being asked to have the data as a table in kibana. I don't see what to do? My input json logs: {"indexName":"aaa-bbb","ip":"XXX.XXX.XXX.XXX","ipServer":"XXX.XXX.XXX.XXX","userAgent":"Mozilla/5.0 (Windows N… --- ## [Osquery manger integration won't work on Windows](https://discuss.elastic.co/t/osquery-manger-integration-wont-work-on-windows/295529)
**Author:** [@Bryan\_Hamilton](https://discuss.elastic.co/u/Bryan_Hamilton)\ **Replies:** 3\ **Last updated:** [January 27, 2022, 3:03pm UTC](https://discuss.elastic.co/t/osquery-manger-integration-wont-work-on-windows/295529 "2022-01-27T15:03:44Z")
Hi, I have unsuccessfully been trying to integrate Osquery to elastic-agent on windows but every time I enroll an agent, its status changes to unhealthy a few seconds after enrolling. The log file is ful… --- ## [Will short URLs expire and be deleted?](https://discuss.elastic.co/t/will-short-urls-expire-and-be-deleted/295180)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 4\ **Last updated:** [January 27, 2022, 2:53pm UTC](https://discuss.elastic.co/t/will-short-urls-expire-and-be-deleted/295180 "2022-01-27T14:53:36Z")
I have a python code that generates a report periodically and creates a lot of short URLs using the short URL API, but I found that kibana or es keep them all the time and won't delete them, and now I just discovered k… --- ## [Kibana lost all configuration](https://discuss.elastic.co/t/kibana-lost-all-configuration/295578)
**Author:** [@peoh](https://discuss.elastic.co/u/peoh)\ **Replies:** 5\ **Last updated:** [January 27, 2022, 2:50pm UTC](https://discuss.elastic.co/t/kibana-lost-all-configuration/295578 "2022-01-27T14:50:30Z")
I upgraded Kibana to the lastest version about a month ago and it has been working fine. Today however, when I tried to access Kibana I got this error in my browser: {"statusCode":500,"error":"Internal Server Error","me… --- ## [Filters not getting applied on destination dashboard while clicking on drilldown go to dashboard](https://discuss.elastic.co/t/filters-not-getting-applied-on-destination-dashboard-while-clicking-on-drilldown-go-to-dashboard/294439)
**Author:** [@shibli](https://discuss.elastic.co/u/shibli)\ **Replies:** 1\ **Last updated:** [January 27, 2022, 2:46pm UTC](https://discuss.elastic.co/t/filters-not-getting-applied-on-destination-dashboard-while-clicking-on-drilldown-go-to-dashboard/294439 "2022-01-27T14:46:45Z")
Hi Team, While i click on Go to Dashboard from one of my visualization, the filter does not get applied to the destination dashboard. It was working before, but stopped working after i upgraded the kibana and Elasticsea… --- ## ['yarn kbn bootstrap' failing with Kibana 7.16.3](https://discuss.elastic.co/t/yarn-kbn-bootstrap-failing-with-kibana-7-16-3/295497)
**Author:** [@kbujold\_wr](https://discuss.elastic.co/u/kbujold_wr)\ **Replies:** 1\ **Last updated:** [January 27, 2022, 1:48pm UTC](https://discuss.elastic.co/t/yarn-kbn-bootstrap-failing-with-kibana-7-16-3/295497 "2022-01-27T13:48:33Z")
Hi I am running 'yarn kbn bootstrap --no-cache --skip-kibana-plugins --oss --debug --verbose' and I am getting this error. info \[bazel\] INFO: 765 processes: 222 internal, 543 processwrapper-sandbox. info \[bazel\] succ… --- ## ["url.full" field not viewing in Packetbeat 7.16.3](https://discuss.elastic.co/t/url-full-field-not-viewing-in-packetbeat-7-16-3/294954)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 3\ **Last updated:** [January 27, 2022, 1:18pm UTC](https://discuss.elastic.co/t/url-full-field-not-viewing-in-packetbeat-7-16-3/294954 "2022-01-27T13:18:38Z")
Hi, I've upgraded Packetbeat version from 7.16.0 to 7.16.3 but since then I've never seen the url.full: field in the packetbeats logs although: 1- I'm visiting urls to have some traffic which should log the url.full: f… --- ## [Kibana KQL search saved with time range](https://discuss.elastic.co/t/kibana-kql-search-saved-with-time-range/295510)
**Author:** [@JonathanCabral](https://discuss.elastic.co/u/JonathanCabral)\ **Replies:** 1\ **Last updated:** [January 27, 2022, 12:59pm UTC](https://discuss.elastic.co/t/kibana-kql-search-saved-with-time-range/295510 "2022-01-27T12:59:34Z")
Hi guys, my team are trying to do some search in kibana using KQL, but we are facing some problems. I hope you could help us. This question was Asked by my teammate on the SO quite a long, but had no answer. I'm creati… --- ## [If then else not working in FileBeat processor](https://discuss.elastic.co/t/if-then-else-not-working-in-filebeat-processor/295560)
**Author:** [@ziv1](https://discuss.elastic.co/u/ziv1)\ **Replies:** 1\ **Last updated:** [January 27, 2022, 12:28pm UTC](https://discuss.elastic.co/t/if-then-else-not-working-in-filebeat-processor/295560 "2022-01-27T12:28:00Z")
I'm trying to setup some processors in a filebeat.yml to process some logs before sending to ELK. An important part of the processing is determining the "level" of the event, which is not always included in the line in … --- ## [Hi all, I am trying to create logstash pipeline to ingest data into elasticsearch but getting this error](https://discuss.elastic.co/t/hi-all-i-am-trying-to-create-logstash-pipeline-to-ingest-data-into-elasticsearch-but-getting-this-error/295576)
**Author:** [@Chinmay\_Bhusate](https://discuss.elastic.co/u/Chinmay_Bhusate)\ **Replies:** 4\ **Last updated:** [January 27, 2022, 12:25pm UTC](https://discuss.elastic.co/t/hi-all-i-am-trying-to-create-logstash-pipeline-to-ingest-data-into-elasticsearch-but-getting-this-error/295576 "2022-01-27T12:25:22Z")
\[2022-01-27T17:02:19,895\]\[ERROR\]\[logstash.agent \] An exception happened when converging configuration {:exception=\>LogStash::Error, :message=\>"Don't know how to handle Java::JavaLang::IllegalStateException for P… --- ## [After a ELK upgrade , index patterns are retained in kibana UI where the filters are disappeared](https://discuss.elastic.co/t/after-a-elk-upgrade-index-patterns-are-retained-in-kibana-ui-where-the-filters-are-disappeared/295579)
**Author:** [@subha1](https://discuss.elastic.co/u/subha1)\ **Replies:** 1\ **Last updated:** [January 27, 2022, 12:23pm UTC](https://discuss.elastic.co/t/after-a-elk-upgrade-index-patterns-are-retained-in-kibana-ui-where-the-filters-are-disappeared/295579 "2022-01-27T12:23:04Z")
Hi, I am trying a elk upgrade from elk - 7.8.0 to same version of elk 7.10.2 . after a successful upgrade , I could see the index patterns are available which were created in elk - 7.8.0 . But the filters which were cre… --- ## [What is wrong with my logstash conf?](https://discuss.elastic.co/t/what-is-wrong-with-my-logstash-conf/295577)
**Author:** [@smam](https://discuss.elastic.co/u/smam)\ **Replies:** 2\ **Last updated:** [January 27, 2022, 12:10pm UTC](https://discuss.elastic.co/t/what-is-wrong-with-my-logstash-conf/295577 "2022-01-27T12:10:34Z")
Hello, I installed a new Windows instance that is running parrallel to my Linux Cluster. The Problem: The following .conf file works perfectly on Linux, but not on Windows: input { file { path =\> \[ "C:\\Elas… --- ## [Logstash Cisco ASA logs "grokparsefailure" in logs tag](https://discuss.elastic.co/t/logstash-cisco-asa-logs-grokparsefailure-in-logs-tag/295571)
**Author:** [@zahid4](https://discuss.elastic.co/u/zahid4)\ **Replies:** 0\ **Last updated:** [January 27, 2022, 11:14am UTC](https://discuss.elastic.co/t/logstash-cisco-asa-logs-grokparsefailure-in-logs-tag/295571 "2022-01-27T11:14:36Z")
Im using the following configuration in the logstash to parse cisco logs and send to ELK: Im getting "grokparsefailure" in logs tag of cisco ASA logs although the format is correct. --- ## [DateFormat in ingest pipeline](https://discuss.elastic.co/t/dateformat-in-ingest-pipeline/295567)
**Author:** [@Mukesh\_Rawat](https://discuss.elastic.co/u/Mukesh_Rawat)\ **Replies:** 1\ **Last updated:** [January 27, 2022, 11:04am UTC](https://discuss.elastic.co/t/dateformat-in-ingest-pipeline/295567 "2022-01-27T11:04:58Z")
Hi i have created ingest pipeline to fetch custom logs, my pipeline with processor looks like below \[ { "grok": { "field": "message", "patterns": \[ "\\\\\[%{TIMESTAMP\_ISO8601:timestamp}\\\\\] %{DATA:… --- ## [Forcing Specific Mapping](https://discuss.elastic.co/t/forcing-specific-mapping/295177)
**Author:** [@Morphus1](https://discuss.elastic.co/u/Morphus1)\ **Replies:** 2\ **Last updated:** [January 27, 2022, 9:48am UTC](https://discuss.elastic.co/t/forcing-specific-mapping/295177 "2022-01-27T09:48:29Z")
I'm trying to link my elastic index to a piece of text annotation software called INCEpTION. It asks for some specific mapping. In order to set up a connection to an Elasticsearch repository, the following informatio… --- ## [Plugin development: custom distribution for yamlRestTest ? (7.16)](https://discuss.elastic.co/t/plugin-development-custom-distribution-for-yamlresttest-7-16/295368)
**Author:** [@mhugo](https://discuss.elastic.co/u/mhugo)\ **Replies:** 3\ **Last updated:** [January 27, 2022, 9:43am UTC](https://discuss.elastic.co/t/plugin-development-custom-distribution-for-yamlresttest-7-16/295368 "2022-01-27T09:43:44Z")
Hi, I'm migrating a plugin to the last 7.16.3 version and have trouble figuring out how to make yaml REST tests pass. The ES distribution that is used to run these tests does not seem to include everything needed to run… --- ## [We are trying to move Elasticsearch Data from Docker Container to Kubernetes Pod , the default Data path for ES pod is /usr/share/elasticsearch/data/nodes/0/](https://discuss.elastic.co/t/we-are-trying-to-move-elasticsearch-data-from-docker-container-to-kubernetes-pod-the-default-data-path-for-es-pod-is-usr-share-elasticsearch-data-nodes-0/295553)
**Author:** [@AnushaK](https://discuss.elastic.co/u/AnushaK)\ **Replies:** 3\ **Last updated:** [January 27, 2022, 9:36am UTC](https://discuss.elastic.co/t/we-are-trying-to-move-elasticsearch-data-from-docker-container-to-kubernetes-pod-the-default-data-path-for-es-pod-is-usr-share-elasticsearch-data-nodes-0/295553 "2022-01-27T09:36:30Z")
Hi , I am trying to copy the indices from the source Elasticsearch to the target Elasticsearch under /usr/share/Elasticsearch/data/nodes/0/indices/. Source and target path is same /usr/share/Elasticsearch/data/nodes/0/i… --- ## [Shards failed on a specific index after reducing number of primary shards](https://discuss.elastic.co/t/shards-failed-on-a-specific-index-after-reducing-number-of-primary-shards/295207)
**Author:** [@Michou\_Robert](https://discuss.elastic.co/u/Michou_Robert)\ **Replies:** 6\ **Last updated:** [January 27, 2022, 9:23am UTC](https://discuss.elastic.co/t/shards-failed-on-a-specific-index-after-reducing-number-of-primary-shards/295207 "2022-01-27T09:23:59Z")
I have a 4 nodes ES cluster running on Elasticsearch 6.8.4. We recently had some issues with ELK restarting and having too many shards on them resulting in our nodes going crazy everytime it restarted. (Which happen pret… --- ## [Elastic search show more than one snippet of a document](https://discuss.elastic.co/t/elastic-search-show-more-than-one-snippet-of-a-document/295411)
**Author:** [@bountyhat](https://discuss.elastic.co/u/bountyhat)\ **Replies:** 1\ **Last updated:** [January 27, 2022, 9:04am UTC](https://discuss.elastic.co/t/elastic-search-show-more-than-one-snippet-of-a-document/295411 "2022-01-27T09:04:39Z")
Hi, the default setting is one snippet per document. Can I show more than one snippets of a document? --- ## [Can't enroll an agent to create Fleet Server (no error shown in log)](https://discuss.elastic.co/t/cant-enroll-an-agent-to-create-fleet-server-no-error-shown-in-log/295375)
**Author:** [@David\_Canos](https://discuss.elastic.co/u/David_Canos)\ **Replies:** 4\ **Last updated:** [January 27, 2022, 8:03am UTC](https://discuss.elastic.co/t/cant-enroll-an-agent-to-create-fleet-server-no-error-shown-in-log/295375 "2022-01-27T08:03:50Z")
Im following all the steps in the process to create a fleet server in my own cluster. Logstash, elastic and kibana are working fine in https mode. But im not able to install a fleet. Im trying to enroll the agent in t… --- ## [Troubles starting kibana.service after the upgrade from 6.8.22 to 7.14.2](https://discuss.elastic.co/t/troubles-starting-kibana-service-after-the-upgrade-from-6-8-22-to-7-14-2/294919)
**Author:** [@Penchev](https://discuss.elastic.co/u/Penchev)\ **Replies:** 3\ **Last updated:** [January 27, 2022, 7:52am UTC](https://discuss.elastic.co/t/troubles-starting-kibana-service-after-the-upgrade-from-6-8-22-to-7-14-2/294919 "2022-01-27T07:52:32Z")
Hi, I have the following errors when starting Kibana: Jan 20 03:22:59 myserver kibana\[30701\]: Cannot update parameter \[index\] from \[true\] to \[false\], Jan 20 03:22:59 myserver kibana\[30701\]: FATAL Error: Unable to comp… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1075) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1077)