# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1139

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1140

---

## [Generation new ssl keys for a new node](https://discuss.elastic.co/t/generation-new-ssl-keys-for-a-new-node/289312)

<div class="topic-metadata">

**Author:** [@hinoryo](https://discuss.elastic.co/u/hinoryo)\
**Replies:** 4\
**Last updated:** [November 18, 2021, 11:27pm UTC](https://discuss.elastic.co/t/generation-new-ssl-keys-for-a-new-node/289312 "2021-11-18T23:27:21Z")

</div>

hello , i have a cluster of 3 nodes and i want to add a new node to the cluster, for that i need to regenerate a new certificate for this new node; i generate the first certs using this command: /usr/share/elasticsearc…

---

## [Search multiple indices](https://discuss.elastic.co/t/search-multiple-indices/290972)

<div class="topic-metadata">

**Author:** [@Alireza\_Niary](https://discuss.elastic.co/u/Alireza_Niary)\
**Replies:** 3\
**Last updated:** [December 5, 2021, 8:50am UTC](https://discuss.elastic.co/t/search-multiple-indices/290972 "2021-12-05T08:50:22Z")

</div>

Is search on multiple indices asynchronous from each other? if I use "GET /my-index-1,my-index-2/\_search" dose Elasticsearch, search both indices simultaneous or in turn? I'm assuming that there is one node and single…

---

## [Is there a way to filter by date and not by date time in Kibana Lens?](https://discuss.elastic.co/t/is-there-a-way-to-filter-by-date-and-not-by-date-time-in-kibana-lens/289387)

<div class="topic-metadata">

**Author:** [@Arrick](https://discuss.elastic.co/u/Arrick)\
**Replies:** 8\
**Last updated:** [December 5, 2021, 7:08am UTC](https://discuss.elastic.co/t/is-there-a-way-to-filter-by-date-and-not-by-date-time-in-kibana-lens/289387 "2021-12-05T07:08:03Z")

</div>

I've recently tried to use kibana lens and realised that my time filter in control is filtering by date time. Is there a way to make it filter by date instead? what I plan to obtain is something similar to this:

---

## [Would having multiple ports/connections improve performance in a cluster](https://discuss.elastic.co/t/would-having-multiple-ports-connections-improve-performance-in-a-cluster/290959)

<div class="topic-metadata">

**Author:** [@soundof](https://discuss.elastic.co/u/soundof)\
**Replies:** 2\
**Last updated:** [December 4, 2021, 8:28pm UTC](https://discuss.elastic.co/t/would-having-multiple-ports-connections-improve-performance-in-a-cluster/290959 "2021-12-04T20:28:35Z")

</div>

Hi Im new to Elasticsearch and setting up a cluster with 3 nodes. Each server/node has multiple ethernet ports on the networking adapter. Would configuring the Elasticsearch node to have 2 IPs/ports increase performanc…

---

## [Scatter plot which uses data source from Enhanced table on Dashboard](https://discuss.elastic.co/t/scatter-plot-which-uses-data-source-from-enhanced-table-on-dashboard/290871)

<div class="topic-metadata">

**Author:** [@Michael\_Ubry](https://discuss.elastic.co/u/Michael_Ubry)\
**Replies:** 1\
**Last updated:** [December 4, 2021, 6:04pm UTC](https://discuss.elastic.co/t/scatter-plot-which-uses-data-source-from-enhanced-table-on-dashboard/290871 "2021-12-04T18:04:37Z")

</div>

Hi, I have Enhanced table plugin installed and I created pivot table which is visible on Dashboard. Underneath, I would like to have scatter plot which would be using data source not from index but from this pivot table…

---

## [FATAL Error: Unknown configuration key(s): "action.auto\_create\_index"](https://discuss.elastic.co/t/fatal-error-unknown-configuration-key-s-action-auto-create-index/290850)

<div class="topic-metadata">

**Author:** [@Glardz](https://discuss.elastic.co/u/Glardz)\
**Replies:** 2\
**Last updated:** [December 4, 2021, 6:01pm UTC](https://discuss.elastic.co/t/fatal-error-unknown-configuration-key-s-action-auto-create-index/290850 "2021-12-04T18:01:32Z")

</div>

Hi, i have this message when i start the service kibana: my kibana.yml file: # Kibana is served by a back end server. This setting specifies the port to use. #server.port: 5601 elasticsearch.hosts: - https://elk0…

---

## [Debugger works for everything but plugin](https://discuss.elastic.co/t/debugger-works-for-everything-but-plugin/290962)

<div class="topic-metadata">

**Author:** [@devin244](https://discuss.elastic.co/u/devin244)\
**Replies:** 0\
**Last updated:** [December 4, 2021, 5:57pm UTC](https://discuss.elastic.co/t/debugger-works-for-everything-but-plugin/290962 "2021-12-04T17:57:45Z")

</div>

I have set up debugging in all Kibana source code so that breakpoints work. I cannot get breakpoints working for my plugin code though. Here's what I've done so far. Cloned Kibana Got debugging working after huge effor…

---

## [Kibana and REST API output](https://discuss.elastic.co/t/kibana-and-rest-api-output/290950)

<div class="topic-metadata">

**Author:** [@rimvydukas](https://discuss.elastic.co/u/rimvydukas)\
**Replies:** 1\
**Last updated:** [December 4, 2021, 3:21pm UTC](https://discuss.elastic.co/t/kibana-and-rest-api-output/290950 "2021-12-04T15:21:25Z")

</div>

Hi, I'm complete newbie with Elasticsearch, so sorry for maybe simple questions:) My problem. I'm trying to retrieve index patterns via Kibana's REST API. I'm trying to use the following command: curl -X GET "localhost…

---

## [How to add country name field based on mobile number using Mobile\_Number using logstash](https://discuss.elastic.co/t/how-to-add-country-name-field-based-on-mobile-number-using-mobile-number-using-logstash/289588)

<div class="topic-metadata">

**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\
**Replies:** 2\
**Last updated:** [December 4, 2021, 3:08pm UTC](https://discuss.elastic.co/t/how-to-add-country-name-field-based-on-mobile-number-using-mobile-number-using-logstash/289588 "2021-12-04T15:08:51Z")

</div>

Hi, I am having logs in txt file contains fields below. I want to extract country code from mobile number and create (translate) into new field called country. I checked with translate filter but not getting how to ext…

---

## [Building Pie chart in kibana](https://discuss.elastic.co/t/building-pie-chart-in-kibana/290150)

<div class="topic-metadata">

**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\
**Replies:** 6\
**Last updated:** [December 4, 2021, 2:26pm UTC](https://discuss.elastic.co/t/building-pie-chart-in-kibana/290150 "2021-12-04T14:26:21Z")

</div>

Hi, I have tried build pie chart on field such as "STAT" and "Sender\_", but some logs contain only the "STAT" field and some logs contain "Sender\_id". I tried building viz on two parameters but it's not working through …

---

## [Elascicsearch was running in mbp m1 pro much slower than intel platform](https://discuss.elastic.co/t/elascicsearch-was-running-in-mbp-m1-pro-much-slower-than-intel-platform/290952)

<div class="topic-metadata">

**Author:** [@wangxueyuan](https://discuss.elastic.co/u/wangxueyuan)\
**Replies:** 2\
**Last updated:** [December 4, 2021, 1:05pm UTC](https://discuss.elastic.co/t/elascicsearch-was-running-in-mbp-m1-pro-much-slower-than-intel-platform/290952 "2021-12-04T13:05:50Z")

</div>

I just got a mbp m1 pro .And I found that using es 7.15.2 , in my think pad I just can complete my procedure in just 3 minuts . The contents of procedure is just writing index data to es.But I installed es 7.15.2 and run…

---

## [Logstash bytes plugin behaving weirdly](https://discuss.elastic.co/t/logstash-bytes-plugin-behaving-weirdly/290947)

<div class="topic-metadata">

**Author:** [@tkauffmann](https://discuss.elastic.co/u/tkauffmann)\
**Replies:** 0\
**Last updated:** [December 4, 2021, 9:39am UTC](https://discuss.elastic.co/t/logstash-bytes-plugin-behaving-weirdly/290947 "2021-12-04T09:39:44Z")

</div>

Hi, I am trying to use the "Bytes" plugin (Bytes filter plugin | Logstash Reference \[8.0\] | Elastic) to transform fields in the form "1 GB" to their bytes value. I use the following syntax : bytes { sour…

---

## [Upgrading java with elasticsearch](https://discuss.elastic.co/t/upgrading-java-with-elasticsearch/290946)

<div class="topic-metadata">

**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\
**Replies:** 2\
**Last updated:** [December 4, 2021, 9:36am UTC](https://discuss.elastic.co/t/upgrading-java-with-elasticsearch/290946 "2021-12-04T09:36:54Z")

</div>

Hi, I've upgraded Elasticsearch from 7.13 to 7.15 successfully using: sudo apt-get update && sudo apt-get install elasticsearch But in the upgrade steps listed in elastic documentation, number 4 ( Java High Level REST…

---

## [Queries on keyword field are extremely slow](https://discuss.elastic.co/t/queries-on-keyword-field-are-extremely-slow/290833)

<div class="topic-metadata">

**Author:** [@Mujo](https://discuss.elastic.co/u/Mujo)\
**Replies:** 4\
**Last updated:** [December 4, 2021, 8:52am UTC](https://discuss.elastic.co/t/queries-on-keyword-field-are-extremely-slow/290833 "2021-12-04T08:52:25Z")

</div>

I use Elasticsearch for text search. Sentences used for indexing are first split into words and then each word is attached with its corresponding POS tag as below: Raw sentence: word1 word2 word3 word4. Sentence for i…

---

## [Can't run Kibana after installing on Archlinux (Failed to fetch)](https://discuss.elastic.co/t/cant-run-kibana-after-installing-on-archlinux-failed-to-fetch/290240)

<div class="topic-metadata">

**Author:** [@gachistyakov](https://discuss.elastic.co/u/gachistyakov)\
**Replies:** 2\
**Last updated:** [December 4, 2021, 8:03am UTC](https://discuss.elastic.co/t/cant-run-kibana-after-installing-on-archlinux-failed-to-fetch/290240 "2021-12-04T08:03:33Z")

</div>

I have installed Elasticsearch as stated in the resource https://wiki.archlinux.org/title/Elasticsearch. After that I had the store "/usr/share/Elasticsearch/config/Elasticsearch.keystore" created, so I didn’t recreate i…

---

## [How to use x-pack with python to enable wildcard](https://discuss.elastic.co/t/how-to-use-x-pack-with-python-to-enable-wildcard/290941)

<div class="topic-metadata">

**Author:** [@Mujo](https://discuss.elastic.co/u/Mujo)\
**Replies:** 1\
**Last updated:** [December 4, 2021, 7:29am UTC](https://discuss.elastic.co/t/how-to-use-x-pack-with-python-to-enable-wildcard/290941 "2021-12-04T07:29:29Z")

</div>

I need to set "type" : "wildcard" in mappings. I have learnt that wildcard is added as a new feature to Elasticsearch 7.9. However, I need to use x-pack in order to use this feature. There are limited documents for le…

---

## [Troubleshooting Metricbeat StatsD Module and Custom Metrics](https://discuss.elastic.co/t/troubleshooting-metricbeat-statsd-module-and-custom-metrics/290938)

<div class="topic-metadata">

**Author:** [@Jeremy\_Gillick](https://discuss.elastic.co/u/Jeremy_Gillick)\
**Replies:** 0\
**Last updated:** [December 4, 2021, 1:28am UTC](https://discuss.elastic.co/t/troubleshooting-metricbeat-statsd-module-and-custom-metrics/290938 "2021-12-04T01:28:57Z")

</div>

I installed the Metricbeat StatsD module a few days ago and it's reporting data on the machine it's installed on, but not reporting any custom metrics I send to it. For example: echo "test.metric:1|c" | nc -u -w0 \<IP A…

---

## [Can I apply fleet-managed processors after elasticsearch ingest node pipelines?](https://discuss.elastic.co/t/can-i-apply-fleet-managed-processors-after-elasticsearch-ingest-node-pipelines/290939)

<div class="topic-metadata">

**Author:** [@icious](https://discuss.elastic.co/u/icious)\
**Replies:** 0\
**Last updated:** [December 4, 2021, 1:44am UTC](https://discuss.elastic.co/t/can-i-apply-fleet-managed-processors-after-elasticsearch-ingest-node-pipelines/290939 "2021-12-04T01:44:10Z")

</div>

Hi all, I'm trying to apply reverse DNS lookup to the logs received from my Sophos firewall using the "DNS" processor of filebeat, but so far I didn't have any luck with that using the Sophos fleet-managed integration. …

---

## [Kibana 7.5.1 Web Error: Private is not a function in bundles/commons.bundle.js](https://discuss.elastic.co/t/kibana-7-5-1-web-error-private-is-not-a-function-in-bundles-commons-bundle-js/289712)

<div class="topic-metadata">

**Author:** [@thanhlam](https://discuss.elastic.co/u/thanhlam)\
**Replies:** 4\
**Last updated:** [December 3, 2021, 9:42pm UTC](https://discuss.elastic.co/t/kibana-7-5-1-web-error-private-is-not-a-function-in-bundles-commons-bundle-js/289712 "2021-12-03T21:42:32Z")

</div>

Hello, I just wonder if anyone here have seen following problem after installing a plugin to kibana, version 7.5.1. If I removed the plugin then everything worked fine. After installing the plugin, kibana started fine …

---

## [Best way to use Ingest Attachment Plugin](https://discuss.elastic.co/t/best-way-to-use-ingest-attachment-plugin/290884)

<div class="topic-metadata">

**Author:** [@sp7980](https://discuss.elastic.co/u/sp7980)\
**Replies:** 3\
**Last updated:** [December 3, 2021, 9:31pm UTC](https://discuss.elastic.co/t/best-way-to-use-ingest-attachment-plugin/290884 "2021-12-03T21:31:39Z")

</div>

I am trying to setup ES for indexing document content for full text search. The document types that will be indexed are .docx and pdf. Looks like ingest attachment plugin is to be used for this purpose and I've had a re…

---

## [Push logstash aggregate map as fields in final event](https://discuss.elastic.co/t/push-logstash-aggregate-map-as-fields-in-final-event/290929)

<div class="topic-metadata">

**Author:** [@Joe\_Martin](https://discuss.elastic.co/u/Joe_Martin)\
**Replies:** 3\
**Last updated:** [December 3, 2021, 8:39pm UTC](https://discuss.elastic.co/t/push-logstash-aggregate-map-as-fields-in-final-event/290929 "2021-12-03T20:39:54Z")

</div>

I am trying to use an aggregate filter to pull fields from several different but related logs into one "summary" log. There is a clear end\_of\_task event and I would like to "push"/add all of the fields in the map into t…

---

## [Updated "hardware" recommendations?](https://discuss.elastic.co/t/updated-hardware-recommendations/290930)

<div class="topic-metadata">

**Author:** [@Jamshid](https://discuss.elastic.co/u/Jamshid)\
**Replies:** 0\
**Last updated:** [December 3, 2021, 8:34pm UTC](https://discuss.elastic.co/t/updated-hardware-recommendations/290930 "2021-12-03T20:34:51Z")

</div>

Just wondering if there is an updated doc similar to the very helpful 2.3 guide It summarized memory, disk, and network configuration information and is probably still relevant but I can't find a modern version of the …

---

## [Watcher daily trigger](https://discuss.elastic.co/t/watcher-daily-trigger/290927)

<div class="topic-metadata">

**Author:** [@shreya\_Das](https://discuss.elastic.co/u/shreya_Das)\
**Replies:** 0\
**Last updated:** [December 3, 2021, 6:44pm UTC](https://discuss.elastic.co/t/watcher-daily-trigger/290927 "2021-12-03T18:44:02Z")

</div>

I have created a advanced watcher alert to check a particular log message that excecutes daily. It triggers everyday at 8PM. I want to know when the watcher is triggered is it gonna consider only that days log or previou…

---

## [Suggested pipline for rsyslog](https://discuss.elastic.co/t/suggested-pipline-for-rsyslog/290919)

<div class="topic-metadata">

**Author:** [@aqwserf](https://discuss.elastic.co/u/aqwserf)\
**Replies:** 0\
**Last updated:** [December 3, 2021, 5:03pm UTC](https://discuss.elastic.co/t/suggested-pipline-for-rsyslog/290919 "2021-12-03T17:03:40Z")

</div>

Hi everyone ! Quite new user to the ELK stack, and after reading a lot of docs/threads, I'd like some suggestions about my current situation. I have a couple of SOHO router running Openwrt, a Proxmox server and a VPS. …

---

## [Logstash CSV output generation](https://discuss.elastic.co/t/logstash-csv-output-generation/290285)

<div class="topic-metadata">

**Author:** [@elk\_chaser](https://discuss.elastic.co/u/elk_chaser)\
**Replies:** 1\
**Last updated:** [December 3, 2021, 5:03pm UTC](https://discuss.elastic.co/t/logstash-csv-output-generation/290285 "2021-12-03T17:03:03Z")

</div>

I have a logstash csv output report generation config, that I run as a separate logstash instance as and when it is required. I have many csv report to be generated and for each, I have one config file. Everytime I run t…

---

## [Google Cloud Kubernetes Elastic Interal LoadBalancer](https://discuss.elastic.co/t/google-cloud-kubernetes-elastic-interal-loadbalancer/290787)

<div class="topic-metadata">

**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\
**Replies:** 3\
**Last updated:** [December 3, 2021, 4:53pm UTC](https://discuss.elastic.co/t/google-cloud-kubernetes-elastic-interal-loadbalancer/290787 "2021-12-03T16:53:53Z")

</div>

Hello, I have a GCP project with /28 VPC(nodes network) the main network peered with another Shared VPC project that maintains connectivity with all other resources. So far I have deployed elasticserach and kibana using…

---

## [Partial substring search that contains whitespaces or special chars like file contains "1 - document" doesnt work](https://discuss.elastic.co/t/partial-substring-search-that-contains-whitespaces-or-special-chars-like-file-contains-1-document-doesnt-work/290883)

<div class="topic-metadata">

**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\
**Replies:** 1\
**Last updated:** [December 3, 2021, 4:49pm UTC](https://discuss.elastic.co/t/partial-substring-search-that-contains-whitespaces-or-special-chars-like-file-contains-1-document-doesnt-work/290883 "2021-12-03T16:49:06Z")

</div>

We have an application that store and query data in Elasticsearch. We have a problem when searching for partial substrings that contains a word with special chats like "notepad++.exe" or "/folder1/file1.txt" or "new text…

---

## [Point in time snapshot (PIT id), original query required when paging?](https://discuss.elastic.co/t/point-in-time-snapshot-pit-id-original-query-required-when-paging/290097)

<div class="topic-metadata">

**Author:** [@tamis-laan](https://discuss.elastic.co/u/tamis-laan)\
**Replies:** 5\
**Last updated:** [December 3, 2021, 4:45pm UTC](https://discuss.elastic.co/t/point-in-time-snapshot-pit-id-original-query-required-when-paging/290097 "2021-12-03T16:45:53Z")

</div>

I implemented pagination inside an API using point in time snapshots for efficiency. In the first request a PIT is generated and in subsequent requests the PIT is being supplied with the request. What I would like to do…

---

## [Need to build visualization like how much time user stay on web page](https://discuss.elastic.co/t/need-to-build-visualization-like-how-much-time-user-stay-on-web-page/290759)

<div class="topic-metadata">

**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\
**Replies:** 3\
**Last updated:** [December 3, 2021, 4:25pm UTC](https://discuss.elastic.co/t/need-to-build-visualization-like-how-much-time-user-stay-on-web-page/290759 "2021-12-03T16:25:06Z")

</div>

Hello All, We have apache logs. We need to build visualization like how much time user stay on web page? Is this possible to determine above information by using below logs? How? 222.105.82.235 - - \[16/Nov/2021:10:04:…

---

## [LogStash with distributor pattern, relay pipelines problem](https://discuss.elastic.co/t/logstash-with-distributor-pattern-relay-pipelines-problem/290880)

<div class="topic-metadata">

**Author:** [@djehuty](https://discuss.elastic.co/u/djehuty)\
**Replies:** 7\
**Last updated:** [December 3, 2021, 4:12pm UTC](https://discuss.elastic.co/t/logstash-with-distributor-pattern-relay-pipelines-problem/290880 "2021-12-03T16:12:49Z")

</div>

Hi everyone, i recently changed my LogStash configuration from multiple pipelines input to 3 pipelines, relaying on another local pipelines with distributor. Now, i've tried to send and udp json to the udp pipeline, wi…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1138)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1140)
