# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1108 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1109 --- ## [Cisco IOS Fleet integration unable to properly grok generated messages](https://discuss.elastic.co/t/cisco-ios-fleet-integration-unable-to-properly-grok-generated-messages/293375)
**Author:** [@rsaeks](https://discuss.elastic.co/u/rsaeks)\ **Replies:** 0\ **Last updated:** [January 3, 2022, 5:20pm UTC](https://discuss.elastic.co/t/cisco-ios-fleet-integration-unable-to-properly-grok-generated-messages/293375 "2022-01-03T17:20:14Z")
I've just begun working with some of the fleet integrations, specifically v1.2 of the Cisco\_IOS version and have some of our switches sending data properly and being received. However, every entry is unable to properly p… --- ## [Sort on object part that exist](https://discuss.elastic.co/t/sort-on-object-part-that-exist/293354)
**Author:** [@MrDeliK](https://discuss.elastic.co/u/MrDeliK)\ **Replies:** 3\ **Last updated:** [January 3, 2022, 5:18pm UTC](https://discuss.elastic.co/t/sort-on-object-part-that-exist/293354 "2022-01-03T17:18:39Z")
Hi guys, sorry i have another question but this time concerning the sorting of a request. Considering this mapping { "sample\_data": { "mappings": { "properties": { "title": { … --- ## [Unable to add custom analyzer](https://discuss.elastic.co/t/unable-to-add-custom-analyzer/293373)
**Author:** [@maviles](https://discuss.elastic.co/u/maviles)\ **Replies:** 0\ **Last updated:** [January 3, 2022, 4:37pm UTC](https://discuss.elastic.co/t/unable-to-add-custom-analyzer/293373 "2022-01-03T16:37:38Z")
Greetings, I'm unable to add a custom analyzer "tokenizer" to an existing, up and running index. I'm able to add the same custom analyzer creating a new index and reindexing an old one to a recently created one. However… --- ## [Completion Suggester not showing results if value is already in previous field](https://discuss.elastic.co/t/completion-suggester-not-showing-results-if-value-is-already-in-previous-field/293370)
**Author:** [@javaman](https://discuss.elastic.co/u/javaman)\ **Replies:** 0\ **Last updated:** [January 3, 2022, 4:12pm UTC](https://discuss.elastic.co/t/completion-suggester-not-showing-results-if-value-is-already-in-previous-field/293370 "2022-01-03T16:12:13Z")
I experience a problem with the completion suggester in Elasticsearch 7.9.1 (also present in 6.7) If I have more than one suggest input with the same value for different contexts it will only find a completion for the f… --- ## [Is it worse to have very large documents/indices with a ton of data, or split that data into smaller documents/indices using a relational paradigm?](https://discuss.elastic.co/t/is-it-worse-to-have-very-large-documents-indices-with-a-ton-of-data-or-split-that-data-into-smaller-documents-indices-using-a-relational-paradigm/293284)
**Author:** [@annmarie-switzer](https://discuss.elastic.co/u/annmarie-switzer)\ **Replies:** 1\ **Last updated:** [January 3, 2022, 3:59pm UTC](https://discuss.elastic.co/t/is-it-worse-to-have-very-large-documents-indices-with-a-ton-of-data-or-split-that-data-into-smaller-documents-indices-using-a-relational-paradigm/293284 "2022-01-03T15:59:23Z")
Say I have a store and each product I sell has a document in Elasticsearch: { id: "abc", name: "mittens", price: "$10.00" }, { id: "def", name: "hat", price: "$13.00" } My store's website allows… --- ## [Search text part in object](https://discuss.elastic.co/t/search-text-part-in-object/293332)
**Author:** [@MrDeliK](https://discuss.elastic.co/u/MrDeliK)\ **Replies:** 3\ **Last updated:** [January 3, 2022, 3:19pm UTC](https://discuss.elastic.co/t/search-text-part-in-object/293332 "2022-01-03T15:19:42Z")
Hi guys, new here and had some trouble for this basic search. In the database, we have objects containing strings like this. {fr: "french string", en: "english string", nl: "nl string"} for generic purpose (defined in… --- ## [Monitoring Logstash using Metricbeat](https://discuss.elastic.co/t/monitoring-logstash-using-metricbeat/293344)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 7\ **Last updated:** [January 3, 2022, 2:44pm UTC](https://discuss.elastic.co/t/monitoring-logstash-using-metricbeat/293344 "2022-01-03T14:44:04Z")
Hi, I have 3 instances of Logstash and want to monitor them in Kibana This is my /etc/metricbeat/modules.d/logstash-xpack.yml configuration: # Module: logstash # Docs: https://www.elastic.co/guide/en/beats/metricbeat/… --- ## [Canvas Table subtotals](https://discuss.elastic.co/t/canvas-table-subtotals/293359)
**Author:** [@MTV](https://discuss.elastic.co/u/MTV)\ **Replies:** 0\ **Last updated:** [January 3, 2022, 2:36pm UTC](https://discuss.elastic.co/t/canvas-table-subtotals/293359 "2022-01-03T14:36:51Z")
Hi! I am trying to calculate subtotals in a table in canvas. Something like this (using the demodata): Using the code: demodata | mapColumn name="year" expression={getCell "time" | formatdate "YYYY"} | ply by="ye… --- ## [How to set kibana\_system credentials to elasticsearch](https://discuss.elastic.co/t/how-to-set-kibana-system-credentials-to-elasticsearch/293316)
**Author:** [@raka](https://discuss.elastic.co/u/raka)\ **Replies:** 1\ **Last updated:** [January 3, 2022, 2:26pm UTC](https://discuss.elastic.co/t/how-to-set-kibana-system-credentials-to-elasticsearch/293316 "2022-01-03T14:26:09Z")
Hi, We have one EFK stack running on 7.14.X version with X-pack security enabled and we defined elastic user for kibana application and everything works so far. But, we noticed a few warning messages in kibana pod. It s… --- ## [Java API requires GPL code](https://discuss.elastic.co/t/java-api-requires-gpl-code/292936)
**Author:** [@Alain\_Desilets](https://discuss.elastic.co/u/Alain_Desilets)\ **Replies:** 3\ **Last updated:** [January 3, 2022, 2:11pm UTC](https://discuss.elastic.co/t/java-api-requires-gpl-code/292936 "2022-01-03T14:11:28Z")
I would like to use the new Java API described here: But when I include it in my pom and try to generate a JAR with all dependencies included, licensescan-maven-plugin tells me that there are two GPL dependencies: \[W… --- ## [Ingest pipeline to copy data from one field to another based on condition](https://discuss.elastic.co/t/ingest-pipeline-to-copy-data-from-one-field-to-another-based-on-condition/293352)
**Author:** [@Sugand](https://discuss.elastic.co/u/Sugand)\ **Replies:** 0\ **Last updated:** [January 3, 2022, 1:50pm UTC](https://discuss.elastic.co/t/ingest-pipeline-to-copy-data-from-one-field-to-another-based-on-condition/293352 "2022-01-03T13:50:05Z")
Hi, I'm looking to copy data from one field to another, if initially the destination field is blank assign a value, if non blank don't overwrite to another but upon re-indexing from another source the doc pipeline doesn… --- ## [Kibana authentication when sharing the dashboard in web application](https://discuss.elastic.co/t/kibana-authentication-when-sharing-the-dashboard-in-web-application/44987)
**Author:** [@sriram](https://discuss.elastic.co/u/sriram)\ **Replies:** 28\ **Last updated:** [January 3, 2022, 1:34pm UTC](https://discuss.elastic.co/t/kibana-authentication-when-sharing-the-dashboard-in-web-application/44987 "2022-01-03T13:34:53Z")
Hi, cluster ID : cd59e4 want to show kibana dashboard in my webapplication. on opening kibana it is asking for authentication . I dont want my user to enter credentials again . and anonymous user is not secure ... c… --- ## [FileBeat How to control the ports used](https://discuss.elastic.co/t/filebeat-how-to-control-the-ports-used/293296)
**Author:** [@gaogao110](https://discuss.elastic.co/u/gaogao110)\ **Replies:** 5\ **Last updated:** [January 3, 2022, 1:23pm UTC](https://discuss.elastic.co/t/filebeat-how-to-control-the-ports-used/293296 "2022-01-03T13:23:30Z")
During use, the program will randomly start the port, is there any way to control ? --- ## [Some puzzle about filebeat version7.x rpm installation](https://discuss.elastic.co/t/some-puzzle-about-filebeat-version7-x-rpm-installation/293312)
**Author:** [@mmgithub123](https://discuss.elastic.co/u/mmgithub123)\ **Replies:** 2\ **Last updated:** [January 3, 2022, 12:59pm UTC](https://discuss.elastic.co/t/some-puzzle-about-filebeat-version7-x-rpm-installation/293312 "2022-01-03T12:59:47Z")
about this topic，there are some discuss before，for example： and but，the basic question is ，when we install filebeat use rpm follow this page ：Filebeat quick start: installation and configuration | Filebeat Reference… --- ## [Exiting: data path already locked by another beat. Please make sure that multiple beats are not sharing the same data path (path.data)](https://discuss.elastic.co/t/exiting-data-path-already-locked-by-another-beat-please-make-sure-that-multiple-beats-are-not-sharing-the-same-data-path-path-data/293158)
**Author:** [@sujitk72](https://discuss.elastic.co/u/sujitk72)\ **Replies:** 1\ **Last updated:** [January 3, 2022, 12:35pm UTC](https://discuss.elastic.co/t/exiting-data-path-already-locked-by-another-beat-please-make-sure-that-multiple-beats-are-not-sharing-the-same-data-path-path-data/293158 "2022-01-03T12:35:53Z")
I have removed 5x and installed 7x that is not working. ./filebeat -e -d "\*" 2021-12-30T02:52:25.982+0530 INFO instance/beat.go:686 Home path: \[/app/filebeat-7.16.2-linux-x86\_64\] Config path: \[/app/filebeat-7.16.2-linu… --- ## [Load index template through logstash](https://discuss.elastic.co/t/load-index-template-through-logstash/293328)
**Author:** [@okopnik](https://discuss.elastic.co/u/okopnik)\ **Replies:** 1\ **Last updated:** [January 3, 2022, 12:17pm UTC](https://discuss.elastic.co/t/load-index-template-through-logstash/293328 "2022-01-03T12:17:19Z")
For a while, I've been shipping events from winlogbeat to logstash and then to elastic. I used my own, very basic template. I cannot figure out how to load the winlogbeat template to elastic. Is it possible to do this wh… --- ## [\_dateparsefailure in ISO8601 date strings](https://discuss.elastic.co/t/dateparsefailure-in-iso8601-date-strings/292799)
**Author:** [@bitnapper](https://discuss.elastic.co/u/bitnapper)\ **Replies:** 7\ **Last updated:** [January 3, 2022, 11:40am UTC](https://discuss.elastic.co/t/dateparsefailure-in-iso8601-date-strings/292799 "2022-01-03T11:40:01Z")
I want to pull logs from an mssql server and parse their date strings. unfortunately I can not figure out why it can not parse the date. My filter looks like this: filter { date { match =\> \[ "evtime", "ISO8601" \] tim… --- ## [Export Canvas Embed snapshot](https://discuss.elastic.co/t/export-canvas-embed-snapshot/291231)
**Author:** [@Miki1](https://discuss.elastic.co/u/Miki1)\ **Replies:** 3\ **Last updated:** [January 3, 2022, 10:35am UTC](https://discuss.elastic.co/t/export-canvas-embed-snapshot/291231 "2022-01-03T10:35:33Z")
Hello, how can i update automatically the Canvas Embed Snapshot (canvas-embed-workpad) for the Share on a Website feature? I just can get the canvas-workpad with the export objects API and not the canvas-embed-workpad. … --- ## [Making doc \_version searchable](https://discuss.elastic.co/t/making-doc-version-searchable/293198)
**Author:** [@Metalmacher](https://discuss.elastic.co/u/Metalmacher)\ **Replies:** 1\ **Last updated:** [January 3, 2022, 10:34am UTC](https://discuss.elastic.co/t/making-doc-version-searchable/293198 "2022-01-03T10:34:37Z")
Hello. I would like to query my documents in my index based on their \_version. I have tried a couple of solutions but none of them worked, hopefully you might be able to assist me with this. My attempts are: Executin… --- ## [How to send process Data from Logstash to RabbitMQ?](https://discuss.elastic.co/t/how-to-send-process-data-from-logstash-to-rabbitmq/293336)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 2\ **Last updated:** [January 3, 2022, 10:31am UTC](https://discuss.elastic.co/t/how-to-send-process-data-from-logstash-to-rabbitmq/293336 "2022-01-03T10:31:13Z")
How to send json format data from logstash to Rabbitmq. I have tried but getting error. Currently I am using local Rabbitmq My config output file, if "\_grokparsefailure" in \[tags\]{ rabbitmq{ host =\> … --- ## ["Sub-iterators of ConjunctionDISI are not on the same document!" error](https://discuss.elastic.co/t/sub-iterators-of-conjunctiondisi-are-not-on-the-same-document-error/292743)
**Author:** [@bperalta](https://discuss.elastic.co/u/bperalta)\ **Replies:** 1\ **Last updated:** [January 3, 2022, 10:04am UTC](https://discuss.elastic.co/t/sub-iterators-of-conjunctiondisi-are-not-on-the-same-document-error/292743 "2022-01-03T10:04:57Z")
Using an index containing a nested field, we get the "Sub-iterators of ConjunctionDISI are not on the same document!" error if the search use intervals query and the searched value is empty (after filtering for example). … --- ## [Kibana: Error during migration from 7.10.0 to 7.16.1](https://discuss.elastic.co/t/kibana-error-during-migration-from-7-10-0-to-7-16-1/292303)
**Author:** [@obi134](https://discuss.elastic.co/u/obi134)\ **Replies:** 5\ **Last updated:** [January 3, 2022, 10:04am UTC](https://discuss.elastic.co/t/kibana-error-during-migration-from-7-10-0-to-7-16-1/292303 "2022-01-03T10:04:33Z")
Hi there, We ran an update of ELK via yum. Previously we had 7.10.0 and now updated to 7.16.1. Now we have problems starting kibana. we got the following error message: FATAL Error: Unable to complete saved object m… --- ## [Metricbeat doesn't monitor all instances](https://discuss.elastic.co/t/metricbeat-doesnt-monitor-all-instances/293321)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 2\ **Last updated:** [January 3, 2022, 8:52am UTC](https://discuss.elastic.co/t/metricbeat-doesnt-monitor-all-instances/293321 "2022-01-03T08:52:37Z")
Hi dears I have 3 instances of Logstash, and a Metricbeat (on another server) The problem is Metricbeat just shows one of the Logstash instances in "Stack Monitoring" The relative config of logstash.yml node 1: # --… --- ## [Logstash wont work after upgrading](https://discuss.elastic.co/t/logstash-wont-work-after-upgrading/293273)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 1\ **Last updated:** [January 3, 2022, 7:48am UTC](https://discuss.elastic.co/t/logstash-wont-work-after-upgrading/293273 "2022-01-03T07:48:32Z")
Hi dears I have 3 instances of Logstash in my cluster. (version 7.6.2) I upgraded to 7.16.2 one by one But one of the Logstash instance wont work after upgrading: \[FATAL\] 2022-01-01 10:36:04.983 \[main\] Logstash - Log… --- ## [Cannot send logs from Logstash to Elastic Search](https://discuss.elastic.co/t/cannot-send-logs-from-logstash-to-elastic-search/291188)
**Author:** [@nevincansel](https://discuss.elastic.co/u/nevincansel)\ **Replies:** 12\ **Last updated:** [January 3, 2022, 6:28am UTC](https://discuss.elastic.co/t/cannot-send-logs-from-logstash-to-elastic-search/291188 "2022-01-03T06:28:07Z")
Hello, I deployed ELK Stack to k8s by using helm. In the cluster, Elasticsearch, Kibana and Filebeat are running. I also configured Logstash to send Filebeat logs and logs from external resource. My external resource i… --- ## [Can't make text field aggregatable](https://discuss.elastic.co/t/cant-make-text-field-aggregatable/293178)
**Author:** [@titan\_tm](https://discuss.elastic.co/u/titan_tm)\ **Replies:** 3\ **Last updated:** [January 3, 2022, 6:20am UTC](https://discuss.elastic.co/t/cant-make-text-field-aggregatable/293178 "2022-01-03T06:20:38Z")
Hello guys, I'm currently facing with issue related to visualization and need help. ELK gets syslogs from cisco routers via filebeat, it parses the logs fine, which is great and It also works great in discovery. Howeve… --- ## [Sending data from Logstash to Elasticsearch running on two different server](https://discuss.elastic.co/t/sending-data-from-logstash-to-elasticsearch-running-on-two-different-server/293311)
**Author:** [@mangesh\_shinde](https://discuss.elastic.co/u/mangesh_shinde)\ **Replies:** 1\ **Last updated:** [January 3, 2022, 5:59am UTC](https://discuss.elastic.co/t/sending-data-from-logstash-to-elasticsearch-running-on-two-different-server/293311 "2022-01-03T05:59:40Z")
I have log files on one server and elastic on different. I want to use Logstash only not any beat for that. so mentioning elastic ip:port output in logstash. Is it possible to have logstash and Elasticsearch on differ… --- ## [Embedded Kibana dashboard login page keeps reloading back to the same page](https://discuss.elastic.co/t/embedded-kibana-dashboard-login-page-keeps-reloading-back-to-the-same-page/293028)
**Author:** [@Arrick](https://discuss.elastic.co/u/Arrick)\ **Replies:** 4\ **Last updated:** [January 3, 2022, 3:52am UTC](https://discuss.elastic.co/t/embedded-kibana-dashboard-login-page-keeps-reloading-back-to-the-same-page/293028 "2022-01-03T03:52:02Z")
I'm still new to Kibana and when I try to embed my Kibana dashboard by giving it anonymous access, it keeps refreshing itself without me doing anything. Gif below for illustration. This is the code I used in my kibana… --- ## [Ideal blocksize for elasticsearch](https://discuss.elastic.co/t/ideal-blocksize-for-elasticsearch/292588)
**Author:** [@pedromgsanches](https://discuss.elastic.co/u/pedromgsanches)\ **Replies:** 2\ **Last updated:** [January 2, 2022, 10:08pm UTC](https://discuss.elastic.co/t/ideal-blocksize-for-elasticsearch/292588 "2022-01-02T22:08:01Z")
Hi, When configuring storage for Elasticsearch (7.16.2): Do we have any recommended disk Block Size or way to do the math around it? I can't find anything related in documentation. What should I consider? Thanks, B… --- ## [How to visualize this query in kibana?](https://discuss.elastic.co/t/how-to-visualize-this-query-in-kibana/292943)
**Author:** [@cva](https://discuss.elastic.co/u/cva)\ **Replies:** 2\ **Last updated:** [January 2, 2022, 8:03pm UTC](https://discuss.elastic.co/t/how-to-visualize-this-query-in-kibana/292943 "2022-01-02T20:03:02Z")
How to visualize this query in kibana? POST /teletrain/\_search { "size": 0, "aggs": { "orders\_per\_hour\_of\_day": { "terms": { "script": { "lang": "painless", "source": "doc\['ctim… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1107) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1109)