# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1133 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1134 --- ## [Flood-stage watermark?](https://discuss.elastic.co/t/flood-stage-watermark/291217)
**Author:** [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\ **Replies:** 3\ **Last updated:** [December 9, 2021, 1:50pm UTC](https://discuss.elastic.co/t/flood-stage-watermark/291217 "2021-12-09T13:50:19Z")
Hello. English isn't my first language. How do I troubleshoot this error-message? What does it mean? What is the solution? We never got this error when we used the old daily indices. Now we get them after transitionin… --- ## [Apply ingest node pipeline to an index/data stream](https://discuss.elastic.co/t/apply-ingest-node-pipeline-to-an-index-data-stream/291328)
**Author:** [@girija](https://discuss.elastic.co/u/girija)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 1:07pm UTC](https://discuss.elastic.co/t/apply-ingest-node-pipeline-to-an-index-data-stream/291328 "2021-12-09T13:07:40Z")
Hello, I have created a ingest node pipeline to transform data received via elastic. Now I need to apply this pipeline to my index so that I can see the transformed fields under discover, and also create charts usin… --- ## [Nested mapping or comparing fields from different indices \[SQL\]](https://discuss.elastic.co/t/nested-mapping-or-comparing-fields-from-different-indices-sql/291327)
**Author:** [@Katgust](https://discuss.elastic.co/u/Katgust)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 12:44pm UTC](https://discuss.elastic.co/t/nested-mapping-or-comparing-fields-from-different-indices-sql/291327 "2021-12-09T12:44:36Z")
I'm aiming to replace our existing search functionality with Elasticsearch and I'm taking small steps towards that goal. Right now I'm trying to update a specific method but I would like some guidance. We have in our sy… --- ## [Bucket aggregation - calculate my own metric inside bucket](https://discuss.elastic.co/t/bucket-aggregation-calculate-my-own-metric-inside-bucket/291326)
**Author:** [@Detlic\_Detlicko](https://discuss.elastic.co/u/Detlic_Detlicko)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 12:42pm UTC](https://discuss.elastic.co/t/bucket-aggregation-calculate-my-own-metric-inside-bucket/291326 "2021-12-09T12:42:42Z")
Hello, i collect data from my router and store into Elasticsearch. My data mappings are in this form : \< {"interface\_name":"keyword", "value":"double", "timestamp":"integer"}. \> I need to measure flow for each inter… --- ## [How to find a large text from documents](https://discuss.elastic.co/t/how-to-find-a-large-text-from-documents/291324)
**Author:** [@RamyaE](https://discuss.elastic.co/u/RamyaE)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 12:27pm UTC](https://discuss.elastic.co/t/how-to-find-a-large-text-from-documents/291324 "2021-12-09T12:27:45Z")
Hi All, I have a textfield with name textContent, where we insert all the contents. I wanted to find the large text from all the textContents. How can I find the large text from those documents, or anyway to know the w… --- ## [Parse json in Log field to get individual fields for visualization](https://discuss.elastic.co/t/parse-json-in-log-field-to-get-individual-fields-for-visualization/291244)
**Author:** [@girija](https://discuss.elastic.co/u/girija)\ **Replies:** 7\ **Last updated:** [December 9, 2021, 12:24pm UTC](https://discuss.elastic.co/t/parse-json-in-log-field-to-get-individual-fields-for-visualization/291244 "2021-12-09T12:24:05Z")
Hello I am new to Kibana and have difficulty reading the logs for visualization. I have pasted a sample of how my log field looks. I need to read the values inside the log for creating visualizations in Kibana, like w… --- ## [Logstash issues with certificate](https://discuss.elastic.co/t/logstash-issues-with-certificate/291124)
**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Replies:** 4\ **Last updated:** [December 9, 2021, 12:11pm UTC](https://discuss.elastic.co/t/logstash-issues-with-certificate/291124 "2021-12-09T12:11:10Z")
Hello, From a couple of days I'm fighting with certificates for logstash. Certificate was generated for logstash and filebeat clients but after couple of minutes I'm receiving below errors: in attach I don't know if t… --- ## [Elastic Agent Consuming allot of resources on the Endpoint](https://discuss.elastic.co/t/elastic-agent-consuming-allot-of-resources-on-the-endpoint/290791)
**Author:** [@geekzy](https://discuss.elastic.co/u/geekzy)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 11:42am UTC](https://discuss.elastic.co/t/elastic-agent-consuming-allot-of-resources-on-the-endpoint/290791 "2021-12-09T11:42:24Z")
Hi All, We have been testing the elastic-agent for a while across multiple endpoints on our environment and started noticing a few issues. Initially we noticed on several of our higher spec laptops that Endpoint securit… --- ## [Possible to have Kibana rules check at fixed times?](https://discuss.elastic.co/t/possible-to-have-kibana-rules-check-at-fixed-times/291316)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 11:31am UTC](https://discuss.elastic.co/t/possible-to-have-kibana-rules-check-at-fixed-times/291316 "2021-12-09T11:31:53Z")
Dear all =) When creating a Elasticsearch query to check every 24 hours, it will check every day at the same time it was created. Is it possible to have it check at a specific time? E.g. I create it at 14:00, but it sh… --- ## [How can we restrict to show data on kibana from different users?](https://discuss.elastic.co/t/how-can-we-restrict-to-show-data-on-kibana-from-different-users/291214)
**Author:** [@sajesh\_sb](https://discuss.elastic.co/u/sajesh_sb)\ **Replies:** 5\ **Last updated:** [December 9, 2021, 11:19am UTC](https://discuss.elastic.co/t/how-can-we-restrict-to-show-data-on-kibana-from-different-users/291214 "2021-12-09T11:19:52Z")
There are two dashboards created which are having independent data. I need to create three users - Admin, user-1, and user-2. Admin can see both the dashboards, user-1 should be able to see dashboard-1 and user-2 should … --- ## [Añadir valor mediante scripted field a otro campo](https://discuss.elastic.co/t/anadir-valor-mediante-scripted-field-a-otro-campo/291312)
**Author:** [@Javier\_Garcia\_Alvare](https://discuss.elastic.co/u/Javier_Garcia_Alvare)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 10:47am UTC](https://discuss.elastic.co/t/anadir-valor-mediante-scripted-field-a-otro-campo/291312 "2021-12-09T10:47:44Z")
Hola, alguien me puede ayudar. Necesito mediante scripted fields copiar una dato de un campo a otro campo existente. Es decir: el nombre del scripted filed es: vMEDIO if (doc\['CANAL'\].value.toString().length() \>= 5 &&… --- ## [ELK stack setup](https://discuss.elastic.co/t/elk-stack-setup/291292)
**Author:** [@girija](https://discuss.elastic.co/u/girija)\ **Replies:** 2\ **Last updated:** [December 9, 2021, 9:20am UTC](https://discuss.elastic.co/t/elk-stack-setup/291292 "2021-12-09T09:20:29Z")
Hello I am new to the ELK world and find myself confused. Although my stack is working fine and I am able to get the logs I want, I am not sure about what all is really required for correct setup and if I have anything … --- ## [Is this a right filter?](https://discuss.elastic.co/t/is-this-a-right-filter/291118)
**Author:** [@smam](https://discuss.elastic.co/u/smam)\ **Replies:** 4\ **Last updated:** [December 9, 2021, 9:18am UTC](https://discuss.elastic.co/t/is-this-a-right-filter/291118 "2021-12-09T09:18:03Z")
filter { if "warning" in "message" { mutate { add\_field =\> { "error-field" =\> "An error occured" } } } } Is this right? Because it seems to not be working. If I open Elasticsearch and… --- ## [Winlogbeat not reading event id](https://discuss.elastic.co/t/winlogbeat-not-reading-event-id/291308)
**Author:** [@aditi\_salunke](https://discuss.elastic.co/u/aditi_salunke)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 9:15am UTC](https://discuss.elastic.co/t/winlogbeat-not-reading-event-id/291308 "2021-12-09T09:15:18Z")
Hello, Will winlogbeat forward the log to Elasticsearch if it is installed on AD and when someone lockout from the system and if the account lockout log is dropping on AD? eg.: if 10 users are getting locked out on the… --- ## [Ignore\_throttled parameter is deprecated](https://discuss.elastic.co/t/ignore-throttled-parameter-is-deprecated/291224)
**Author:** [@SirConius](https://discuss.elastic.co/u/SirConius)\ **Replies:** 2\ **Last updated:** [December 9, 2021, 9:00am UTC](https://discuss.elastic.co/t/ignore-throttled-parameter-is-deprecated/291224 "2021-12-09T09:00:43Z")
I've updated my Elasticsearch installation from 7.15.2 to 7.16, but when I open a dashboard I'm greeted with the following Warning: I looked in the deprecated log file before updating and this wasn't in there and I ha… --- ## [Unable to send email with watcher](https://discuss.elastic.co/t/unable-to-send-email-with-watcher/290661)
**Author:** [@Alejandro\_Chaves](https://discuss.elastic.co/u/Alejandro_Chaves)\ **Replies:** 2\ **Last updated:** [December 9, 2021, 8:24am UTC](https://discuss.elastic.co/t/unable-to-send-email-with-watcher/290661 "2021-12-09T08:24:11Z")
{ "id" : "send\_email", "type" : "email", "status" : "failure", "error" : { "root\_cause" : \[ { "type" : "messaging\_exception", "reason" : "failed to send email with subject \[Watcher Notification\] via account \[gmai… --- ## [Is posible to set a text as optional in RegularExpresions?](https://discuss.elastic.co/t/is-posible-to-set-a-text-as-optional-in-regularexpresions/291114)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 2\ **Last updated:** [December 9, 2021, 8:22am UTC](https://discuss.elastic.co/t/is-posible-to-set-a-text-as-optional-in-regularexpresions/291114 "2021-12-09T08:22:43Z")
Hola! Se puede poner textos como opcionales en regex? these days im reciving some logs with this format: \[07/12/2021 09:59:33 \[Id XXXXXXXXXXXXXXXX\] Parameters send to YYYYYY: action1: AAAAAAAAAAAA action2: BBBBBBBBB… --- ## [Is posible to have iptional field with regex as grok optionals fields?](https://discuss.elastic.co/t/is-posible-to-have-iptional-field-with-regex-as-grok-optionals-fields/290645)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 5\ **Last updated:** [December 9, 2021, 8:18am UTC](https://discuss.elastic.co/t/is-posible-to-have-iptional-field-with-regex-as-grok-optionals-fields/290645 "2021-12-09T08:18:25Z")
Hello! i want to know if a could set a field as optional in regular expresions as i do with grok for example: (%{DATA:Message})? Thank you! --- ## [Elasticsearch nlpcn sql client getting eroor](https://discuss.elastic.co/t/elasticsearch-nlpcn-sql-client-getting-eroor/291299)
**Author:** [@SRIGURU\_VEL](https://discuss.elastic.co/u/SRIGURU_VEL)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 7:56am UTC](https://discuss.elastic.co/t/elasticsearch-nlpcn-sql-client-getting-eroor/291299 "2021-12-09T07:56:09Z")
Hi Experts, I am Using ES 7.9.3 with NLPCN Sql client. SO I am getting Error when i try to GET index. {"error":{"root\_cause":\[{"type":"x\_content\_parse\_exception","reason":"\[1:1\] \[sql/query\] failed to parse object"}\],"… --- ## [Merging two fields in a visualization](https://discuss.elastic.co/t/merging-two-fields-in-a-visualization/291139)
**Author:** [@elasticfran](https://discuss.elastic.co/u/elasticfran)\ **Replies:** 4\ **Last updated:** [December 9, 2021, 7:53am UTC](https://discuss.elastic.co/t/merging-two-fields-in-a-visualization/291139 "2021-12-09T07:53:43Z")
Team! I need to merge two fields into one in a Kibana visualization. Does anyone know how to do that? Have a good one :slight\_smile: --- ## [Unable to create index on elasticsearch](https://discuss.elastic.co/t/unable-to-create-index-on-elasticsearch/290657)
**Author:** [@Somesh\_ng](https://discuss.elastic.co/u/Somesh_ng)\ **Replies:** 5\ **Last updated:** [December 9, 2021, 7:27am UTC](https://discuss.elastic.co/t/unable-to-create-index-on-elasticsearch/290657 "2021-12-09T07:27:47Z")
I'm trying to ingest the data into Elasticsearch using logstash http\_poller but the index is not getting created in Elasticsearch. Can someone help me on this input { http\_poller { urls =\> { "te… --- ## [Increase Kibana data table bucket size](https://discuss.elastic.co/t/increase-kibana-data-table-bucket-size/291284)
**Author:** [@cps598](https://discuss.elastic.co/u/cps598)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 7:40am UTC](https://discuss.elastic.co/t/increase-kibana-data-table-bucket-size/291284 "2021-12-09T07:40:21Z")
Kibana v 7.15.1 I want to show some items in the Kibana data table. And I found that the size of the bucket restricts the showing results. For example, if I set the size to 20, some log data will not be displayed on the… --- ## [How to fix cluster is red, reason: no\_valid\_shard\_copy after stopping data nodes?](https://discuss.elastic.co/t/how-to-fix-cluster-is-red-reason-no-valid-shard-copy-after-stopping-data-nodes/291206)
**Author:** [@bugb](https://discuss.elastic.co/u/bugb)\ **Replies:** 6\ **Last updated:** [December 9, 2021, 7:39am UTC](https://discuss.elastic.co/t/how-to-fix-cluster-is-red-reason-no-valid-shard-copy-after-stopping-data-nodes/291206 "2021-12-09T07:39:33Z")
After stopping some data nodes, my cluster becomes red and the reason is: no\_valid\_shard\_copy after stopping data nodes? How can I fix this? Update: should I use reroute? POST \_cluster/reroute?retry\_failed --- ## [Hyphenation token filter seems to ignore minimum subword size](https://discuss.elastic.co/t/hyphenation-token-filter-seems-to-ignore-minimum-subword-size/291295)
**Author:** [@mariskaas](https://discuss.elastic.co/u/mariskaas)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 7:28am UTC](https://discuss.elastic.co/t/hyphenation-token-filter-seems-to-ignore-minimum-subword-size/291295 "2021-12-09T07:28:45Z")
Hello, I was looking to use the hyphenation decompounder filter. However during testing I found out it seems to be ignoring the minimum subword size option. Here is an example analyze I tried (normally I use a text fil… --- ## [Filebeat push event in very slow rate](https://discuss.elastic.co/t/filebeat-push-event-in-very-slow-rate/291013)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 5\ **Last updated:** [December 9, 2021, 7:01am UTC](https://discuss.elastic.co/t/filebeat-push-event-in-very-slow-rate/291013 "2021-12-09T07:01:51Z")
Hi all I have a problems with one of my filebeat installed server. That server is config to get f5 log. then i install filebeat to get log from that server to Elasticsearch. But back before that setup working fine and… --- ## [How to list out all \*\*hidden\*\* indices in a cluster](https://discuss.elastic.co/t/how-to-list-out-all-hidden-indices-in-a-cluster/291291)
**Author:** [@Bruce\_Liu](https://discuss.elastic.co/u/Bruce_Liu)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 5:59am UTC](https://discuss.elastic.co/t/how-to-list-out-all-hidden-indices-in-a-cluster/291291 "2021-12-09T05:59:15Z")
I'm trying to list out all hidden indices in a cluster. I tried GET \_cat/indices?expand\_wildcards=hidden,open&v, but even the status of the hidden index(index.hidden=true) is open, and the request lists out all open indi… --- ## [How to increase writing speed to an index using Spark ES](https://discuss.elastic.co/t/how-to-increase-writing-speed-to-an-index-using-spark-es/291165)
**Author:** [@ElasticQuestion\_1234](https://discuss.elastic.co/u/ElasticQuestion_1234)\ **Replies:** 11\ **Last updated:** [December 9, 2021, 5:43am UTC](https://discuss.elastic.co/t/how-to-increase-writing-speed-to-an-index-using-spark-es/291165 "2021-12-09T05:43:16Z")
Hi, I am trying to write a DataFrame with 10k rows and 31 columns into an Elasticsearch index using spark. I am using "JavaEsSparkSQL.saveToEs" function. There are 12 concurrent tasks. I used the default "es.batch.size.b… --- ## [Shards management in ElasticSearch](https://discuss.elastic.co/t/shards-management-in-elasticsearch/291252)
**Author:** [@Akanksha\_Pandey](https://discuss.elastic.co/u/Akanksha_Pandey)\ **Replies:** 5\ **Last updated:** [December 9, 2021, 4:49am UTC](https://discuss.elastic.co/t/shards-management-in-elasticsearch/291252 "2021-12-09T04:49:41Z")
I'm using Elasticsearch version 7.9.2 as a single node docker cluster for my production as well as development environment. Every once in a while I'm getting these two errors frequently. Error1: ElasticsearchError erro… --- ## [Elastic stack can monitor app metric](https://discuss.elastic.co/t/elastic-stack-can-monitor-app-metric/291283)
**Author:** [@wanfenjia](https://discuss.elastic.co/u/wanfenjia)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 4:37am UTC](https://discuss.elastic.co/t/elastic-stack-can-monitor-app-metric/291283 "2021-12-09T04:37:14Z")
Hi Elastic stack team, I need monitor server app(for example, http access number, http reposend time,etc), Could u pls help me to fix it, and have u some doucment to share for me ? many thanks! --- ## [Filebeat is not sending data to Elasticsearch](https://discuss.elastic.co/t/filebeat-is-not-sending-data-to-elasticsearch/291000)
**Author:** [@Akanksha\_Pandey](https://discuss.elastic.co/u/Akanksha_Pandey)\ **Replies:** 9\ **Last updated:** [December 9, 2021, 4:06am UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-data-to-elasticsearch/291000 "2021-12-09T04:06:05Z")
I'm using running Filebeat version 7.10.0 as container version to ship docker container logs as well as system logs directly to Elasticsearch. Docker logs are shipped fine but system logs are not getting shipped. When I … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1132) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1134)