# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1088 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1089 --- ## [Canvas - Variable in essql](https://discuss.elastic.co/t/canvas-variable-in-essql/294857)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 5:03pm UTC](https://discuss.elastic.co/t/canvas-variable-in-essql/294857 "2022-01-19T17:03:57Z")
Im trying to use the canvas variables, i have managed to get it working via text/markdown, i am trying to use it within an essql statement, heres my example WHERE \\"@timestamp\\" \> TODAY() - INTERVAL 30 DAY AND organizat… --- ## [Create Different "Index Management" and "Index Pattern" For Different Firewall Devices](https://discuss.elastic.co/t/create-different-index-management-and-index-pattern-for-different-firewall-devices/294678)
**Author:** [@Xenial](https://discuss.elastic.co/u/Xenial)\ **Replies:** 1\ **Last updated:** [January 19, 2022, 5:31pm UTC](https://discuss.elastic.co/t/create-different-index-management-and-index-pattern-for-different-firewall-devices/294678 "2022-01-19T17:31:10Z")
Hello Team, I want to create Dashboarding system (SIEM) For two different firewall device (Panorama Palo Alto, Fortianalyzer Fortinet). I want to use Filebeat Modules PANW and FORTINET. How i create 2 Index Management a… --- ## [Metricbeat-7.16.2 HTTP error 401 in : 401 Unauthorized](https://discuss.elastic.co/t/metricbeat-7-16-2-http-error-401-in-401-unauthorized/294816)
**Author:** [@mwoods269](https://discuss.elastic.co/u/mwoods269)\ **Replies:** 1\ **Last updated:** [January 19, 2022, 5:07pm UTC](https://discuss.elastic.co/t/metricbeat-7-16-2-http-error-401-in-401-unauthorized/294816 "2022-01-19T17:07:43Z")
Hello, Environment: singlenode sandbox running 7.16.2 Security enabled (TLS inter node comms) No Https Issue: Installed metricbeat and enabled Elasticsearch however node still reporting as self monitored Gett… --- ## [Combined\_fields + dfs\_query\_then\_fetch causes error](https://discuss.elastic.co/t/combined-fields-dfs-query-then-fetch-causes-error/294410)
**Author:** [@cyradin](https://discuss.elastic.co/u/cyradin)\ **Replies:** 2\ **Last updated:** [January 19, 2022, 5:04pm UTC](https://discuss.elastic.co/t/combined-fields-dfs-query-then-fetch-causes-error/294410 "2022-01-19T17:04:46Z")
Using combined\_fields query with dfs\_query\_then\_fetch causes "docCount must not exceed maxDoc" error if the request goes to multiple shards. Quick example to reproduce the issue (Elasticsearch v7.13.4, v7.15.0) PUT /my… --- ## [Cannot read property 'aliases' of undefined](https://discuss.elastic.co/t/cannot-read-property-aliases-of-undefined/293079)
**Author:** [@andrerca12](https://discuss.elastic.co/u/andrerca12)\ **Replies:** 10\ **Last updated:** [January 19, 2022, 4:43pm UTC](https://discuss.elastic.co/t/cannot-read-property-aliases-of-undefined/293079 "2022-01-19T16:43:35Z")
Hello, After i updated my Elasticsearch to version 7.16, Kibana can’t load Index Management page, with error Cannot read property ‘aliases’ of undefined. Everything else is working fine, my applications are streaming … --- ## [Winlogbeat Manual EVTX Upload - Performance](https://discuss.elastic.co/t/winlogbeat-manual-evtx-upload-performance/294840)
**Author:** [@rusty\_cole](https://discuss.elastic.co/u/rusty_cole)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 3:16pm UTC](https://discuss.elastic.co/t/winlogbeat-manual-evtx-upload-performance/294840 "2022-01-19T15:16:35Z")
Hi Guys, I am using winlogbeat on a regular basis to upload multiple evtx files to elastic(with powershell). The problem is that sometimes it takes a very long time for the upload to complete(hours). Is there a way to… --- ## [How to decrypt data who are encrypted in postgres and pass them to elastic before indexing them](https://discuss.elastic.co/t/how-to-decrypt-data-who-are-encrypted-in-postgres-and-pass-them-to-elastic-before-indexing-them/294852)
**Author:** [@Albi\_Zeqollari](https://discuss.elastic.co/u/Albi_Zeqollari)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 4:19pm UTC](https://discuss.elastic.co/t/how-to-decrypt-data-who-are-encrypted-in-postgres-and-pass-them-to-elastic-before-indexing-them/294852 "2022-01-19T16:19:16Z")
Some examples pls! --- ## [Automate Logstash Pipelines, Parsing](https://discuss.elastic.co/t/automate-logstash-pipelines-parsing/294845)
**Author:** [@harry\_cook](https://discuss.elastic.co/u/harry_cook)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 3:50pm UTC](https://discuss.elastic.co/t/automate-logstash-pipelines-parsing/294845 "2022-01-19T15:50:57Z")
Hi Folks, Is there a way to automatically generate logstash pipelines based on certain inputs ? Has anyone worked on such use cases ? --- ## [Vega in Kibana - how to make the chart responsive to resizing](https://discuss.elastic.co/t/vega-in-kibana-how-to-make-the-chart-responsive-to-resizing/294841)
**Author:** [@katja1](https://discuss.elastic.co/u/katja1)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 3:22pm UTC](https://discuss.elastic.co/t/vega-in-kibana-how-to-make-the-chart-responsive-to-resizing/294841 "2022-01-19T15:22:12Z")
Hello all, I created a dashboard in Kibana and included also some Vega visualizations. My problem is that I cannot make the Vega bar chart responsive in sense of dynamically adjusting the size when the window size chang… --- ## [Is there any way to get more than one field from an aggregation?](https://discuss.elastic.co/t/is-there-any-way-to-get-more-than-one-field-from-an-aggregation/294741)
**Author:** [@Maxi\_Donadio](https://discuss.elastic.co/u/Maxi_Donadio)\ **Replies:** 4\ **Last updated:** [January 19, 2022, 2:56pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-get-more-than-one-field-from-an-aggregation/294741 "2022-01-19T14:56:01Z")
Hi! I need to know if it's possible to get more than one value from an aggregation. If I were to write my desired query as SQL it'd be something like: SELECT value1, value2, value3 FROM table WHERE condition. I'd like t… --- ## [Deleted logstash-plain.log - it's not coming back!](https://discuss.elastic.co/t/deleted-logstash-plain-log-its-not-coming-back/294821)
**Author:** [@PSFletchTheTek](https://discuss.elastic.co/u/PSFletchTheTek)\ **Replies:** 6\ **Last updated:** [January 19, 2022, 2:12pm UTC](https://discuss.elastic.co/t/deleted-logstash-plain-log-its-not-coming-back/294821 "2022-01-19T14:12:31Z")
Hi All, Help, in a process of trying to debug i deleted logstash-plain.log from /var/log/logstash. but its not come back! Any ideas how i get it back please? --- ## [One index/index template per module](https://discuss.elastic.co/t/one-index-index-template-per-module/294823)
**Author:** [@emmanuel\_t](https://discuss.elastic.co/u/emmanuel_t)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 1:48pm UTC](https://discuss.elastic.co/t/one-index-index-template-per-module/294823 "2022-01-19T13:48:26Z")
Hello, I'd like to enable just a few filebeat modules (let's say nginx, postgresql). And I'd like to have on Elasticsearch one index per module (per month). So... filebeat-nginx-2022-01 and filebeat-postgresql-2022-01. … --- ## [Could not find or load main class org.elasticsearch.bootstrap.Elasticsearch Caused by: java.lang.ClassNotFoundException: org.elasticsearch.bootstrap.Elasticsearch](https://discuss.elastic.co/t/could-not-find-or-load-main-class-org-elasticsearch-bootstrap-elasticsearch-caused-by-java-lang-classnotfoundexception-org-elasticsearch-bootstrap-elasticsearch/293451)
**Author:** [@Vivek\_Paralikar](https://discuss.elastic.co/u/Vivek_Paralikar)\ **Replies:** 2\ **Last updated:** [January 19, 2022, 1:44pm UTC](https://discuss.elastic.co/t/could-not-find-or-load-main-class-org-elasticsearch-bootstrap-elasticsearch-caused-by-java-lang-classnotfoundexception-org-elasticsearch-bootstrap-elasticsearch/293451 "2022-01-19T13:44:57Z")
Starting Elasticsearch Server Error: Could not find or load main class org.… --- ## [Preserve logs original creation sequence when timestamp is identical](https://discuss.elastic.co/t/preserve-logs-original-creation-sequence-when-timestamp-is-identical/294818)
**Author:** [@alon\_carmelly](https://discuss.elastic.co/u/alon_carmelly)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 1:30pm UTC](https://discuss.elastic.co/t/preserve-logs-original-creation-sequence-when-timestamp-is-identical/294818 "2022-01-19T13:30:20Z")
Hi, I have logs with similar timestamp out of order: I understand logstash does not preserve creation order. I read that using dissect filter together with grok could solve the issue but can't find any examples. This i… --- ## [Troubles starting elasticsearch.service after the upgrade from 6.8.22 to 7.14.2](https://discuss.elastic.co/t/troubles-starting-elasticsearch-service-after-the-upgrade-from-6-8-22-to-7-14-2/294664)
**Author:** [@Penchev](https://discuss.elastic.co/u/Penchev)\ **Replies:** 4\ **Last updated:** [January 19, 2022, 12:35pm UTC](https://discuss.elastic.co/t/troubles-starting-elasticsearch-service-after-the-upgrade-from-6-8-22-to-7-14-2/294664 "2022-01-19T12:35:26Z")
Hi Folks, I have troubles starting Elasticsearch.service after the upgrade from 6.8.22 to 7.14.2. The errors are related to: failed to load plugin class \[org.Elasticsearch.xpack.security.Security\] Realm settings have… --- ## [Elasticsearch CCR, former follower (leader) index is not writable](https://discuss.elastic.co/t/elasticsearch-ccr-former-follower-leader-index-is-not-writable/292962)
**Author:** [@Armen\_Petrosyan](https://discuss.elastic.co/u/Armen_Petrosyan)\ **Replies:** 1\ **Last updated:** [January 19, 2022, 12:29pm UTC](https://discuss.elastic.co/t/elasticsearch-ccr-former-follower-leader-index-is-not-writable/292962 "2022-01-19T12:29:58Z")
I use ES 7.7.1 Below UC that I am trying to test: I have two clusters leader and follower. On leader I have created index, and alias. Starting follow process, I see that index replicated to the follower as well as ali… --- ## [Logstash not running any query except select version()](https://discuss.elastic.co/t/logstash-not-running-any-query-except-select-version/294809)
**Author:** [@Mizo10](https://discuss.elastic.co/u/Mizo10)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 12:19pm UTC](https://discuss.elastic.co/t/logstash-not-running-any-query-except-select-version/294809 "2022-01-19T12:19:00Z")
Hello, I'm new to logstash, I'm running a logstash pipeline configuration in an aws instance with the following configuration : input { jdbc { jdbc\_connection\_string =\> "jdbc:mysql://my.domain:3306/db\_name" … --- ## [How to update query on multiple indexes](https://discuss.elastic.co/t/how-to-update-query-on-multiple-indexes/294724)
**Author:** [@pk5859](https://discuss.elastic.co/u/pk5859)\ **Replies:** 3\ **Last updated:** [January 19, 2022, 12:08pm UTC](https://discuss.elastic.co/t/how-to-update-query-on-multiple-indexes/294724 "2022-01-19T12:08:49Z")
I have 3 indexes A, B & C i want to update on all three indexes. However python client.update() syntax won't allow it. \_index="A","B","C" query = {"doc": {"cluster":"1" }} client.update(index=\_index, id=id, body=quer… --- ## [Newbie in Painless](https://discuss.elastic.co/t/newbie-in-painless/294700)
**Author:** [@Juliana\_Sabino](https://discuss.elastic.co/u/Juliana_Sabino)\ **Replies:** 13\ **Last updated:** [January 19, 2022, 12:08pm UTC](https://discuss.elastic.co/t/newbie-in-painless/294700 "2022-01-19T12:08:13Z")
Hi Team, I'm struggling so bad to find good examples on how to use painless. I need a script that sums a count of 4 weeks and does the mean of it. Please, can someone share something that could help me do it? A course… --- ## [Elasticsearch log parser](https://discuss.elastic.co/t/elasticsearch-log-parser/294807)
**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 11:55am UTC](https://discuss.elastic.co/t/elasticsearch-log-parser/294807 "2022-01-19T11:55:56Z")
Hello, I'm using latest ubuntu Linux, and I would to ask You which is the best log reader for logs from for example Elasticsearch logs - I'm using Atom as log editor but don't cover my expectations. I would like to ask… --- ## [Unable to retrieve version information from Elasticsearch nodes. Request timed out](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes-request-timed-out/294805)
**Author:** [@nandhini\_r](https://discuss.elastic.co/u/nandhini_r)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 11:50am UTC](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes-request-timed-out/294805 "2022-01-19T11:50:51Z")
Hi All, Elasticsearch is running, but accessing Elasticsearch from the browser it shouldn’t working, the chrome tab should return JSON what I have seen using curl command. I’ll be sharing the JSON that should be display… --- ## [Elasticsearch behind NAT](https://discuss.elastic.co/t/elasticsearch-behind-nat/294773)
**Author:** [@rudyawall](https://discuss.elastic.co/u/rudyawall)\ **Replies:** 1\ **Last updated:** [January 19, 2022, 11:37am UTC](https://discuss.elastic.co/t/elasticsearch-behind-nat/294773 "2022-01-19T11:37:44Z")
Hi Everybody, I already installed the elasticserach but behind the NAT, i'm using google cloud I wanna configuration elasticserach can access from external network, using 0.0.0.0 but always failed to connect when Iam … --- ## [My Filebeat isn't working when pushing Sophos XG firewall logs](https://discuss.elastic.co/t/my-filebeat-isnt-working-when-pushing-sophos-xg-firewall-logs/294799)
**Author:** [@Siyabonga](https://discuss.elastic.co/u/Siyabonga)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 11:15am UTC](https://discuss.elastic.co/t/my-filebeat-isnt-working-when-pushing-sophos-xg-firewall-logs/294799 "2022-01-19T11:15:39Z")
Hi Guys I am getting the following error when configuring Filebeat can any one please assist? Overwriting ILM policy is disabled. Set setup.ilm.overwrite: true for enabling. Index setup finished. Loading dashboards (K… --- ## [Creating a simple "traffic light" indicator using timestamp for one of the revealed images](https://discuss.elastic.co/t/creating-a-simple-traffic-light-indicator-using-timestamp-for-one-of-the-revealed-images/294798)
**Author:** [@hbay1](https://discuss.elastic.co/u/hbay1)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 11:10am UTC](https://discuss.elastic.co/t/creating-a-simple-traffic-light-indicator-using-timestamp-for-one-of-the-revealed-images/294798 "2022-01-19T11:10:40Z")
Hi, I'm trying to create a standard traffic light in kibana canvas based on uptime of some applications. I've been using the following query for showing a green and red square, but now I want to add a yellow square as … --- ## [Elasticsearch modules' releases and repositories](https://discuss.elastic.co/t/elasticsearch-modules-releases-and-repositories/294601)
**Author:** [@bamthomas](https://discuss.elastic.co/u/bamthomas)\ **Replies:** 7\ **Last updated:** [January 19, 2022, 10:57am UTC](https://discuss.elastic.co/t/elasticsearch-modules-releases-and-repositories/294601 "2022-01-19T10:57:54Z")
Hello, We have an embedded node in our java app and 5 modules that are loaded : Netty4 ParentJoin CommonAnalysis Painless Reindex Lately we wanted to upgrade the ES libraries from 7.10 to 7.16. We found the main Elas… --- ## [Error: Invalid string. Length must be a multiple of 4](https://discuss.elastic.co/t/error-invalid-string-length-must-be-a-multiple-of-4/293201)
**Author:** [@mohantychandra](https://discuss.elastic.co/u/mohantychandra)\ **Replies:** 13\ **Last updated:** [January 19, 2022, 10:56am UTC](https://discuss.elastic.co/t/error-invalid-string-length-must-be-a-multiple-of-4/293201 "2022-01-19T10:56:11Z")
Hi Can anyone help to resolve the issue, Any comment is much appreciated. The issue and log is given below. Invalid string. Length must be a multiple of 4 Error: Invalid string. Length must be a multiple of 4 --- ## [Old Kibana indices](https://discuss.elastic.co/t/old-kibana-indices/294785)
**Author:** [@alexs1](https://discuss.elastic.co/u/alexs1)\ **Replies:** 1\ **Last updated:** [January 19, 2022, 10:56am UTC](https://discuss.elastic.co/t/old-kibana-indices/294785 "2022-01-19T10:56:01Z")
Is that safe to delete old Kibana indices? there are lots of them. (They should probably cleaned up during an upgrade) --- ## [Elasticsearchkeystore](https://discuss.elastic.co/t/elasticsearchkeystore/294797)
**Author:** [@harsh19](https://discuss.elastic.co/u/harsh19)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 10:49am UTC](https://discuss.elastic.co/t/elasticsearchkeystore/294797 "2022-01-19T10:49:09Z")
whenever i type ./Elasticsearch-setup-passwords auto then it gives me an error like this Enter password for the elasticsearch keystore : Failed to authenticate user 'elastic' against http://127.0.0.1:9200/\_security/\_… --- ## [Nested time ranges and term in one filter](https://discuss.elastic.co/t/nested-time-ranges-and-term-in-one-filter/294392)
**Author:** [@D1sturbance](https://discuss.elastic.co/u/D1sturbance)\ **Replies:** 9\ **Last updated:** [January 19, 2022, 9:42am UTC](https://discuss.elastic.co/t/nested-time-ranges-and-term-in-one-filter/294392 "2022-01-19T09:42:20Z")
Hello :slight\_smile: My data: shops working hours shops with each of their working hours I have a query which returns shops from first day of the month to last day of the month including working hours. For example: … --- ## [Filebeat.inputs journald: Multiline not working](https://discuss.elastic.co/t/filebeat-inputs-journald-multiline-not-working/294422)
**Author:** [@agallardo](https://discuss.elastic.co/u/agallardo)\ **Replies:** 3\ **Last updated:** [January 19, 2022, 9:22am UTC](https://discuss.elastic.co/t/filebeat-inputs-journald-multiline-not-working/294422 "2022-01-19T09:22:06Z")
According to \[Journalbeat\] Still no multiline support after 3 years · Issue #27578 · elastic/beats · GitHub, because filebeat can now read the journal and it should support multiline. In the documentation Journald input … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1087) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1089)