# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1135 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1136 --- ## [How to removes master-eligible nodes from elasticsearch cluster when master is not discovered](https://discuss.elastic.co/t/how-to-removes-master-eligible-nodes-from-elasticsearch-cluster-when-master-is-not-discovered/291210)
**Author:** [@Zeeshan\_Alam](https://discuss.elastic.co/u/Zeeshan_Alam)\ **Replies:** 1\ **Last updated:** [December 8, 2021, 11:34am UTC](https://discuss.elastic.co/t/how-to-removes-master-eligible-nodes-from-elasticsearch-cluster-when-master-is-not-discovered/291210 "2021-12-08T11:34:46Z")
I have an Elasticsearch cluster with three master nodes. Two of my master nodes VM's got corrupted so I am trying to remove them so that I can add newly created master node but I am unable to do so using the Voting confi… --- ## [Question about permission for file input \[Linux\]](https://discuss.elastic.co/t/question-about-permission-for-file-input-linux/291108)
**Author:** [@Fosco](https://discuss.elastic.co/u/Fosco)\ **Replies:** 4\ **Last updated:** [December 8, 2021, 11:20am UTC](https://discuss.elastic.co/t/question-about-permission-for-file-input-linux/291108 "2021-12-08T11:20:04Z")
Hi, I have some scripts which download files and need to be read and deleted by logstash afterwards Regarding the permission, the files must be logstash:logstash or only the folder containing the files? Thanks ! --- ## [Elasticsearch Watcher scheduler](https://discuss.elastic.co/t/elasticsearch-watcher-scheduler/291135)
**Author:** [@Bigbad](https://discuss.elastic.co/u/Bigbad)\ **Replies:** 2\ **Last updated:** [December 8, 2021, 11:13am UTC](https://discuss.elastic.co/t/elasticsearch-watcher-scheduler/291135 "2021-12-08T11:13:17Z")
Hello, Is it possible to configure watcher for business days and hours I have have watcher and I want it to run every 30mn from monday to friday and from 7h to 19h. The next expression don't work "cron":"\*/30 7-19 \* … --- ## [Multiple inputs to multiple indices](https://discuss.elastic.co/t/multiple-inputs-to-multiple-indices/290171)
**Author:** [@Katgust](https://discuss.elastic.co/u/Katgust)\ **Replies:** 3\ **Last updated:** [December 8, 2021, 10:37am UTC](https://discuss.elastic.co/t/multiple-inputs-to-multiple-indices/290171 "2021-12-08T10:37:17Z")
Hi! I'm new to the Elastic stack but have tried to learn to use it the last couple of weeks. I have Elasticsearch and Kibana running (I can at least use the DevTools) and I'm using Logstash to retrieve data from an MSSQ… --- ## [User session duration calculation](https://discuss.elastic.co/t/user-session-duration-calculation/290993)
**Author:** [@ramous-tun](https://discuss.elastic.co/u/ramous-tun)\ **Replies:** 2\ **Last updated:** [December 8, 2021, 10:20am UTC](https://discuss.elastic.co/t/user-session-duration-calculation/290993 "2021-12-08T10:20:46Z")
Hi, I'm trying to get user session duration by day for the last 30 days from windows logs, so I used Transform but something wrong in my script, I always get duration for all period recorded: from the first login to the… --- ## [Click on metric visualisation to filter](https://discuss.elastic.co/t/click-on-metric-visualisation-to-filter/291142)
**Author:** [@lisajb](https://discuss.elastic.co/u/lisajb)\ **Replies:** 2\ **Last updated:** [December 8, 2021, 10:19am UTC](https://discuss.elastic.co/t/click-on-metric-visualisation-to-filter/291142 "2021-12-08T10:19:58Z")
Hi all, very basic question but want to check I'm not going mad here - When using a dashboard to monitor logs, most types of visualisation can be clicked to set up a filter, filtering to just the part of the visualisati… --- ## [Defying synonyms for roman numbers doesn't seem to work](https://discuss.elastic.co/t/defying-synonyms-for-roman-numbers-doesnt-seem-to-work/291126)
**Author:** [@eliezra236](https://discuss.elastic.co/u/eliezra236)\ **Replies:** 2\ **Last updated:** [December 8, 2021, 10:18am UTC](https://discuss.elastic.co/t/defying-synonyms-for-roman-numbers-doesnt-seem-to-work/291126 "2021-12-08T10:18:09Z")
Hi, I've been trying to set up roman numbers synonyms the following way: PUT testing\_index { "settings": { "analysis": { "analyzer": { "my\_custome\_analyzer": { "type": "custom", … --- ## [Problem with Elastic Docker login](https://discuss.elastic.co/t/problem-with-elastic-docker-login/291208)
**Author:** [@Pascal\_Paulis](https://discuss.elastic.co/u/Pascal_Paulis)\ **Replies:** 0\ **Last updated:** [December 8, 2021, 10:12am UTC](https://discuss.elastic.co/t/problem-with-elastic-docker-login/291208 "2021-12-08T10:12:36Z")
Hi, I'm trying to upgrade from 7.12 to 7.15. It seems that 7.14 was the last release available on hub.docker.com and that all newer images are only available on the Elastic Docker repository. Can anyboby tell me how t… --- ## [Need to include an external privacy notice in OIDC](https://discuss.elastic.co/t/need-to-include-an-external-privacy-notice-in-oidc/291204)
**Author:** [@Ali\_Muhammad](https://discuss.elastic.co/u/Ali_Muhammad)\ **Replies:** 0\ **Last updated:** [December 8, 2021, 9:43am UTC](https://discuss.elastic.co/t/need-to-include-an-external-privacy-notice-in-oidc/291204 "2021-12-08T09:43:45Z")
Hello community. Is there a way to include an external redirect to privacy notice. This strategy will follow the usual oidc authentication flow and will act as a consent form after the user has authenticated. Does Elast… --- ## [How to get positions of the matched string?](https://discuss.elastic.co/t/how-to-get-positions-of-the-matched-string/291199)
**Author:** [@wildansupernova](https://discuss.elastic.co/u/wildansupernova)\ **Replies:** 0\ **Last updated:** [December 8, 2021, 9:34am UTC](https://discuss.elastic.co/t/how-to-get-positions-of-the-matched-string/291199 "2021-12-08T09:34:20Z")
Sorry I am new to Elasticsearch I have already searched through internet, some technique I found useful is around highlighting. But I want to ask is there any way to fulfill this scenario other than using highlighting. … --- ## [EQL Query for User account creation and deletion](https://discuss.elastic.co/t/eql-query-for-user-account-creation-and-deletion/291200)
**Author:** [@anaghadeoreofficial](https://discuss.elastic.co/u/anaghadeoreofficial)\ **Replies:** 0\ **Last updated:** [December 8, 2021, 9:35am UTC](https://discuss.elastic.co/t/eql-query-for-user-account-creation-and-deletion/291200 "2021-12-08T09:35:40Z")
I am currently working on one use case for winlogbeat data. Usecase is as follows: Use Case: Trigger alert if the user account is deleted within one hour after creation. Trying to understand the EQL syntax for the abov… --- ## [Closing filebeat due to inactivity of log input file](https://discuss.elastic.co/t/closing-filebeat-due-to-inactivity-of-log-input-file/291198)
**Author:** [@mangesh\_shinde](https://discuss.elastic.co/u/mangesh_shinde)\ **Replies:** 0\ **Last updated:** [December 8, 2021, 9:31am UTC](https://discuss.elastic.co/t/closing-filebeat-due-to-inactivity-of-log-input-file/291198 "2021-12-08T09:31:39Z")
filebeat is keep stopped due to inactive of input file is there requirement of activity of file. because my logs are there in file and it is active. --- ## [Geoshape query with pre-indexed shape and other fields?](https://discuss.elastic.co/t/geoshape-query-with-pre-indexed-shape-and-other-fields/291192)
**Author:** [@GavinBeattie](https://discuss.elastic.co/u/GavinBeattie)\ **Replies:** 0\ **Last updated:** [December 8, 2021, 8:32am UTC](https://discuss.elastic.co/t/geoshape-query-with-pre-indexed-shape-and-other-fields/291192 "2021-12-08T08:32:07Z")
From the reference guide, it is possible to search geopoints by shapes contained in another index. This has a certain appeal for some analysis that I am trying to do akin to geofencing. I would like to know if it is po… --- ## [Logstash process taking more memory than configured](https://discuss.elastic.co/t/logstash-process-taking-more-memory-than-configured/291064)
**Author:** [@alaine](https://discuss.elastic.co/u/alaine)\ **Replies:** 6\ **Last updated:** [December 8, 2021, 8:23am UTC](https://discuss.elastic.co/t/logstash-process-taking-more-memory-than-configured/291064 "2021-12-08T08:23:45Z")
Hi there. Question in regards to some weird behavior I am noticing on all of our logstash servers. We are running 7.13.4 currently. The problem is related to logstash seemingly taking more memory than I have configured i… --- ## [Nested Vs. Parent/Child](https://discuss.elastic.co/t/nested-vs-parent-child/291189)
**Author:** [@dev\_test](https://discuss.elastic.co/u/dev_test)\ **Replies:** 0\ **Last updated:** [December 8, 2021, 7:39am UTC](https://discuss.elastic.co/t/nested-vs-parent-child/291189 "2021-12-08T07:39:12Z")
Hi, i am assigned to work on a people-to-follow suggestion list in a social media app. The list will be based on user contacts, facebook friends, people the user is interacting with, and nearby people according to geo-l… --- ## [Remove \_id, \_index, \_score, \_type fields from index by logstash](https://discuss.elastic.co/t/remove-id-index-score-type-fields-from-index-by-logstash/290283)
**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\ **Replies:** 3\ **Last updated:** [December 8, 2021, 7:05am UTC](https://discuss.elastic.co/t/remove-id-index-score-type-fields-from-index-by-logstash/290283 "2021-12-08T07:05:11Z")
I want to delete above fields from event in Elasticsearch from logstash config --- ## [Canvas dropdown](https://discuss.elastic.co/t/canvas-dropdown/291061)
**Author:** [@MTV](https://discuss.elastic.co/u/MTV)\ **Replies:** 2\ **Last updated:** [December 8, 2021, 6:51am UTC](https://discuss.elastic.co/t/canvas-dropdown/291061 "2021-12-08T06:51:01Z")
Hi, I have a dropdown in canvas, which is used to filter some visualizations. Is it possible to select multiple values, or we can only select a single value from the dropdown? Thank you! --- ## [Elasticsearch keystore file regenerate](https://discuss.elastic.co/t/elasticsearch-keystore-file-regenerate/291185)
**Author:** [@suvro](https://discuss.elastic.co/u/suvro)\ **Replies:** 2\ **Last updated:** [December 8, 2021, 6:44am UTC](https://discuss.elastic.co/t/elasticsearch-keystore-file-regenerate/291185 "2021-12-08T06:44:55Z")
is there any way to regenerate Elasticsearch.keystore file? I have deleted it by mistake. --- ## [Editing a Visualization - Application Not Found Error](https://discuss.elastic.co/t/editing-a-visualization-application-not-found-error/291178)
**Author:** [@blissweb](https://discuss.elastic.co/u/blissweb)\ **Replies:** 1\ **Last updated:** [December 8, 2021, 5:56am UTC](https://discuss.elastic.co/t/editing-a-visualization-application-not-found-error/291178 "2021-12-08T05:56:55Z")
Hello. I've imported some dashboards using the metricbeat import dashboards feature from the yml file. I see the dashboards, they work ok, but when I try to edit a particular visualization to make changes it says "Appl… --- ## [How to add custom index using ingest node pipeline?](https://discuss.elastic.co/t/how-to-add-custom-index-using-ingest-node-pipeline/291176)
**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\ **Replies:** 0\ **Last updated:** [December 8, 2021, 3:25am UTC](https://discuss.elastic.co/t/how-to-add-custom-index-using-ingest-node-pipeline/291176 "2021-12-08T03:25:38Z")
Is it possible to create conditional indexing by using ingest node pipelines? I feel this could be done by the script processor but can someone tell if this is possible? I am in a scenario where I should decide which is… --- ## [Aggregate fields to an array fields](https://discuss.elastic.co/t/aggregate-fields-to-an-array-fields/291024)
**Author:** [@RichYaNa](https://discuss.elastic.co/u/RichYaNa)\ **Replies:** 7\ **Last updated:** [December 8, 2021, 3:18am UTC](https://discuss.elastic.co/t/aggregate-fields-to-an-array-fields/291024 "2021-12-08T03:18:45Z")
Hi, I have some output here from my logstash filter: { "taskid" =\> "123", "host" =\> "ubuntu" }, { "taskid" =\> "123", "host" =\> "centos" } is it possible to aggregate that field to be like this: { "taskid"… --- ## [Service Not Available - License Not Available](https://discuss.elastic.co/t/service-not-available-license-not-available/291169)
**Author:** [@blissweb](https://discuss.elastic.co/u/blissweb)\ **Replies:** 7\ **Last updated:** [December 8, 2021, 2:31am UTC](https://discuss.elastic.co/t/service-not-available-license-not-available/291169 "2021-12-08T02:31:12Z")
Hi, Been using the docker version of filebeat, metricbeat, Elasticsearch and kibana. Has been working fine, but after about 24 hours up, it starts showing the message about no license. I'm not using Authentication of … --- ## [How to access filebeat HAProxy total response time?](https://discuss.elastic.co/t/how-to-access-filebeat-haproxy-total-response-time/289622)
**Author:** [@mmcnl](https://discuss.elastic.co/u/mmcnl)\ **Replies:** 3\ **Last updated:** [December 8, 2021, 1:46am UTC](https://discuss.elastic.co/t/how-to-access-filebeat-haproxy-total-response-time/289622 "2021-12-08T01:46:10Z")
I have the exact same question as was asked in this topic, which was closed due to no responses. Namely: Where do I find default HAProxy Timers Tr or Ta (which I assume include data/body) in Elastic Filebeat HAProxy fi… --- ## [Upgrade to ES 7.15.2 and Kibana not working](https://discuss.elastic.co/t/upgrade-to-es-7-15-2-and-kibana-not-working/291098)
**Author:** [@Frank\_Kuo](https://discuss.elastic.co/u/Frank_Kuo)\ **Replies:** 8\ **Last updated:** [December 8, 2021, 1:39am UTC](https://discuss.elastic.co/t/upgrade-to-es-7-15-2-and-kibana-not-working/291098 "2021-12-08T01:39:02Z")
I have upgraded ES/Kibana/Logstash from v7.62. to v7.15.2. All installations are success but KIBANA services started with error. Can someone help me with the below error? I have no idea how to resolved it. Kibana log … --- ## [Kibana - Calculate range of time like hours](https://discuss.elastic.co/t/kibana-calculate-range-of-time-like-hours/290986)
**Author:** [@redsegsolucoes](https://discuss.elastic.co/u/redsegsolucoes)\ **Replies:** 1\ **Last updated:** [December 7, 2021, 9:25pm UTC](https://discuss.elastic.co/t/kibana-calculate-range-of-time-like-hours/290986 "2021-12-07T21:25:47Z")
I would like to know how to calculate dates inside Kibana, for example, (end\_date - start\_date), How long does it take for a driver to get from city A to city B? is possible to do this calculation inside Query DSL and … --- ## [Pipelines running {:count=\>1, :running\_pipelines=\>\[:main\], :non\_running\_pipelines=\>\[\]}](https://discuss.elastic.co/t/pipelines-running-count-1-running-pipelines-main-non-running-pipelines/290811)
**Author:** [@Emanuel\_Fernandez](https://discuss.elastic.co/u/Emanuel_Fernandez)\ **Replies:** 3\ **Last updated:** [December 7, 2021, 8:34pm UTC](https://discuss.elastic.co/t/pipelines-running-count-1-running-pipelines-main-non-running-pipelines/290811 "2021-12-07T20:34:17Z")
Cuando ejecuto el comando; \\bin\>logstash -f pipeline.config me sale ese error. He realizado muchas modificaciones guiandome en los blogs pero no he dado con el resultado. Muestro como tengo configurado mi pipeline.confi… --- ## [Supported compression algorithms?](https://discuss.elastic.co/t/supported-compression-algorithms/291157)
**Author:** [@tofubeats](https://discuss.elastic.co/u/tofubeats)\ **Replies:** 1\ **Last updated:** [December 7, 2021, 8:16pm UTC](https://discuss.elastic.co/t/supported-compression-algorithms/291157 "2021-12-07T20:16:21Z")
Hello, I would like to know what compression algorithms logstash pipelines can work with? For example, if i have a pipeline polling a webserver that sends compressed data, will the logstash pipeline only automatically d… --- ## [Accessing the start and end times in a filter group](https://discuss.elastic.co/t/accessing-the-start-and-end-times-in-a-filter-group/290935)
**Author:** [@ckes](https://discuss.elastic.co/u/ckes)\ **Replies:** 1\ **Last updated:** [December 7, 2021, 8:15pm UTC](https://discuss.elastic.co/t/accessing-the-start-and-end-times-in-a-filter-group/290935 "2021-12-07T20:15:16Z")
Hello, I'd like to display the month and day of a drop-down filter on a different page of my report, using it as a sub-heading of all subsequent pages. I've verified that essql queries work using the range I've selecte… --- ## [Unable to get list /load any plugin in logstash](https://discuss.elastic.co/t/unable-to-get-list-load-any-plugin-in-logstash/291155)
**Author:** [@Vipin\_Johar](https://discuss.elastic.co/u/Vipin_Johar)\ **Replies:** 1\ **Last updated:** [December 7, 2021, 8:07pm UTC](https://discuss.elastic.co/t/unable-to-get-list-load-any-plugin-in-logstash/291155 "2021-12-07T20:07:28Z")
Hi , i am trying to load plugin in logstash but getting the message "Using bundled JDK: "", could you please help here. --- ## [Rename process of logstash in linux](https://discuss.elastic.co/t/rename-process-of-logstash-in-linux/291156)
**Author:** [@Thuy\_Le1](https://discuss.elastic.co/u/Thuy_Le1)\ **Replies:** 1\ **Last updated:** [December 7, 2021, 8:02pm UTC](https://discuss.elastic.co/t/rename-process-of-logstash-in-linux/291156 "2021-12-07T20:02:18Z")
at the moment when we run logstash from ./bin/logstash -f logstash\_file.conf the process name is java, how we change to logstash?? [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1134) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1136)