# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1143 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1144 --- ## [Clearing index pattern fields](https://discuss.elastic.co/t/clearing-index-pattern-fields/290716)
**Author:** [@hamzahda](https://discuss.elastic.co/u/hamzahda)\ **Replies:** 1\ **Last updated:** [December 2, 2021, 1:18am UTC](https://discuss.elastic.co/t/clearing-index-pattern-fields/290716 "2021-12-02T01:18:53Z")
I want to clear around 2000 unused fields in a kibana index pattern and I was wondering wich of the following two approaches should I take: deleting all of the fields and then only the used fields will be recreated by… --- ## [Elastic agent tries to download beats from Elastic artifacts directly without passing by fleet server](https://discuss.elastic.co/t/elastic-agent-tries-to-download-beats-from-elastic-artifacts-directly-without-passing-by-fleet-server/290676)
**Author:** [@djamel.lahouazi](https://discuss.elastic.co/u/djamel.lahouazi)\ **Replies:** 5\ **Last updated:** [December 2, 2021, 12:24am UTC](https://discuss.elastic.co/t/elastic-agent-tries-to-download-beats-from-elastic-artifacts-directly-without-passing-by-fleet-server/290676 "2021-12-02T00:24:09Z")
I installed fleet server & kibana in a machine that has access to internet and installed elasticagent in Windows server that does not have access to internet. But when I try to add integration (osquerybeat) i find in the… --- ## [How to delete multiple fields with the same name when Reindexing](https://discuss.elastic.co/t/how-to-delete-multiple-fields-with-the-same-name-when-reindexing/290691)
**Author:** [@hNiven](https://discuss.elastic.co/u/hNiven)\ **Replies:** 1\ **Last updated:** [December 2, 2021, 12:02am UTC](https://discuss.elastic.co/t/how-to-delete-multiple-fields-with-the-same-name-when-reindexing/290691 "2021-12-02T00:02:37Z")
Hi, We have reached the maximum fields limit on an index and after doing some research it looks like the best way to get rid of the unneeded fields we need to reindex. Specifically we have many fields called activity.i… --- ## [Advanced Watcher Alternative input](https://discuss.elastic.co/t/advanced-watcher-alternative-input/290455)
**Author:** [@zangero98](https://discuss.elastic.co/u/zangero98)\ **Replies:** 1\ **Last updated:** [December 1, 2021, 11:43pm UTC](https://discuss.elastic.co/t/advanced-watcher-alternative-input/290455 "2021-12-01T23:43:57Z")
Hi, I want to specify an advanced watch with an alternative input. Right now I am matching all logs in the syntax, but i just want to match fileset.name = firewall I'm an elastic beginner and so I'm not very familiar w… --- ## [GET /\_security/api\_key?name=any\_key returns 200 when no key present](https://discuss.elastic.co/t/get-security-api-key-name-any-key-returns-200-when-no-key-present/290682)
**Author:** [@JGreene](https://discuss.elastic.co/u/JGreene)\ **Replies:** 0\ **Last updated:** [December 1, 2021, 2:48pm UTC](https://discuss.elastic.co/t/get-security-api-key-name-any-key-returns-200-when-no-key-present/290682 "2021-12-01T14:48:19Z")
ES Version: 7.15.2 and prior The /\_security/api\_key api returns a 200 response code even when the requested key does not exists. Example: curl -X GET "https://172.19.18.17:9200/\_security/api\_key?name=bobs\_key" -u elas… --- ## [Custom event parsing](https://discuss.elastic.co/t/custom-event-parsing/290568)
**Author:** [@ohliuw](https://discuss.elastic.co/u/ohliuw)\ **Replies:** 7\ **Last updated:** [December 1, 2021, 9:52pm UTC](https://discuss.elastic.co/t/custom-event-parsing/290568 "2021-12-01T21:52:04Z")
I am relatively new to SO. I am trying to understand how to ingest and parse customs logs in ELS. I currently use the NXLog agent to send json formatted data (coming from the SYSMON windows eventlog) from a host to the … --- ## [Kibana watcher rule Elasticsearch query bug](https://discuss.elastic.co/t/kibana-watcher-rule-elasticsearch-query-bug/290664)
**Author:** [@can.ozdemir](https://discuss.elastic.co/u/can.ozdemir)\ **Replies:** 1\ **Last updated:** [December 1, 2021, 9:44pm UTC](https://discuss.elastic.co/t/kibana-watcher-rule-elasticsearch-query-bug/290664 "2021-12-01T21:44:45Z")
Hello there, On our cluster we are indexing logs from machine pairs i.e. machine01 and machine02 is a pair, thus I have created an Elasticsearch query Alert when my query which returns log amount containing hostname mac… --- ## [DSL query for indices not receiving any documents for the past 5 mins](https://discuss.elastic.co/t/dsl-query-for-indices-not-receiving-any-documents-for-the-past-5-mins/290710)
**Author:** [@antonisnyc94](https://discuss.elastic.co/u/antonisnyc94)\ **Replies:** 0\ **Last updated:** [December 1, 2021, 8:55pm UTC](https://discuss.elastic.co/t/dsl-query-for-indices-not-receiving-any-documents-for-the-past-5-mins/290710 "2021-12-01T20:55:10Z")
Hello, We want to set up an alert using opendistro for indices not receiving any docs for the past 5 mins. I used the must\_not exist field "@timestamp" since it always exists in all documents but i get no results.. Does… --- ## [Logstash beats: 69/71 error](https://discuss.elastic.co/t/logstash-beats-69-71-error/290708)
**Author:** [@userR](https://discuss.elastic.co/u/userR)\ **Replies:** 3\ **Last updated:** [December 1, 2021, 8:55pm UTC](https://discuss.elastic.co/t/logstash-beats-69-71-error/290708 "2021-12-01T20:55:04Z")
Logstash configuration: input { beats { port =\> 9443 host =\> "0.0.0.0" ssl =\> false } } filter { ... } output { ... } stdout{} } It looks like logstash is having an issue with the beats tag as I… --- ## [IAM role issue in s3 output plugin](https://discuss.elastic.co/t/iam-role-issue-in-s3-output-plugin/290702)
**Author:** [@John\_snow](https://discuss.elastic.co/u/John_snow)\ **Replies:** 0\ **Last updated:** [December 1, 2021, 5:56pm UTC](https://discuss.elastic.co/t/iam-role-issue-in-s3-output-plugin/290702 "2021-12-01T17:56:51Z")
Trying to use iam role for cross account S3 Bucket but getting following error Pipeline error {:pipeline\_id=\>"main", :exception=\>#\ … --- ## [Is it possible to enable HTTPs only between the browser and kibana?](https://discuss.elastic.co/t/is-it-possible-to-enable-https-only-between-the-browser-and-kibana/290421)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 5\ **Last updated:** [December 1, 2021, 8:29pm UTC](https://discuss.elastic.co/t/is-it-possible-to-enable-https-only-between-the-browser-and-kibana/290421 "2021-12-01T20:29:29Z")
hello, I have a set up where an app developed via flask places the logs onto a Elasticsearch server the ingests and visualizes the logs . I want to know if i could enable HTTP only between the browser and kibana and no… --- ## [Elasticsearch Node Running on docker only shows Disk Available 50 GB](https://discuss.elastic.co/t/elasticsearch-node-running-on-docker-only-shows-disk-available-50-gb/290704)
**Author:** [@Mmatos](https://discuss.elastic.co/u/Mmatos)\ **Replies:** 2\ **Last updated:** [December 1, 2021, 8:22pm UTC](https://discuss.elastic.co/t/elasticsearch-node-running-on-docker-only-shows-disk-available-50-gb/290704 "2021-12-01T20:22:25Z")
Hi, I am running the Docker-Elk Stack 7.14.1 and noticed that in the Stack Monitoring Tab Elastic reports it only has a 50 GB disk. The host running the container has 700 GB free. How can I expand this container so it … --- ## [Is it possible to embed Kibana Visualizations on Google Slides or Docs?](https://discuss.elastic.co/t/is-it-possible-to-embed-kibana-visualizations-on-google-slides-or-docs/290427)
**Author:** [@Urbano\_Freitas](https://discuss.elastic.co/u/Urbano_Freitas)\ **Replies:** 4\ **Last updated:** [December 1, 2021, 8:13pm UTC](https://discuss.elastic.co/t/is-it-possible-to-embed-kibana-visualizations-on-google-slides-or-docs/290427 "2021-12-01T20:13:51Z")
Hi everyone, I do Load Tests frequently and I generally in the end share a report with Load Test results and with observations. I generally do this by creating some visualizations with Kibana and then snap(1) the visua… --- ## [Make a loop to read values in logstash](https://discuss.elastic.co/t/make-a-loop-to-read-values-in-logstash/290692)
**Author:** [@elpazo](https://discuss.elastic.co/u/elpazo)\ **Replies:** 1\ **Last updated:** [December 1, 2021, 8:04pm UTC](https://discuss.elastic.co/t/make-a-loop-to-read-values-in-logstash/290692 "2021-12-01T20:04:28Z")
Hello, I have a result like this ' values \[ \[0\] { X = 1 Y = 2 Z = 3 V = 4 } \[1\] { X = 5 Y = 6 Z = 7 V= 8 } ' How can i read this result and put every value in variable (example Var\_X = Values\[0\]\[0\] = 1… --- ## [Schedule csv](https://discuss.elastic.co/t/schedule-csv/290575)
**Author:** [@lnunez](https://discuss.elastic.co/u/lnunez)\ **Replies:** 1\ **Last updated:** [December 1, 2021, 7:43pm UTC](https://discuss.elastic.co/t/schedule-csv/290575 "2021-12-01T19:43:39Z")
It is not possible to schedule the csv using file as input, I've tried also the approach mentioned here: Cron job for CSV filter, which is using exec. But as is mentioned in the documentation: (Cron job for CSV filter) … --- ## [Multiple output sequence](https://discuss.elastic.co/t/multiple-output-sequence/290640)
**Author:** [@zhanggengengen](https://discuss.elastic.co/u/zhanggengengen)\ **Replies:** 1\ **Last updated:** [December 1, 2021, 7:25pm UTC](https://discuss.elastic.co/t/multiple-output-sequence/290640 "2021-12-01T19:25:01Z")
I have two output,the first is http-output,and the second is elasticsearch-output. What i want to do is execute http-output before elasticsearch-output. How can i do that? The problem I have is this I need delete it be… --- ## [Unicode whitespace in configuration files](https://discuss.elastic.co/t/unicode-whitespace-in-configuration-files/290651)
**Author:** [@jmb](https://discuss.elastic.co/u/jmb)\ **Replies:** 2\ **Last updated:** [December 1, 2021, 7:21pm UTC](https://discuss.elastic.co/t/unicode-whitespace-in-configuration-files/290651 "2021-12-01T19:21:28Z")
Is Logstash expected to handle Unicode (UTF-8) in its configuration files? I found an issue today where a pipeline (actually, an Elasticsearch mapping template file) which looks perfectly good fails to load because some… --- ## [How to remove the fields](https://discuss.elastic.co/t/how-to-remove-the-fields/290663)
**Author:** [@rahul\_sirugudi](https://discuss.elastic.co/u/rahul_sirugudi)\ **Replies:** 3\ **Last updated:** [December 1, 2021, 7:19pm UTC](https://discuss.elastic.co/t/how-to-remove-the-fields/290663 "2021-12-01T19:19:28Z")
Hi, I am using filebeat to ship logs to logstash, and creating index. Now while visualising logs from kibana there are many unwanted fields i am seeing like agent.id, cloud.account.id. I want to remove all the fields. I… --- ## [How do i fix Unassigned Replicas on cluster?](https://discuss.elastic.co/t/how-do-i-fix-unassigned-replicas-on-cluster/290699)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 5\ **Last updated:** [December 1, 2021, 6:12pm UTC](https://discuss.elastic.co/t/how-do-i-fix-unassigned-replicas-on-cluster/290699 "2021-12-01T18:12:45Z")
Hello, we recently created a cluster on 2 VMs , 1 with Elasticsearch as MASTER node and another with Elasticsearch as DATA node . How do i allocate the replicas ? it seems the primary is allocated but the replicas … --- ## [Metricbeat data not fully visible in elasticsearch](https://discuss.elastic.co/t/metricbeat-data-not-fully-visible-in-elasticsearch/290340)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 6\ **Last updated:** [December 1, 2021, 5:55pm UTC](https://discuss.elastic.co/t/metricbeat-data-not-fully-visible-in-elasticsearch/290340 "2021-12-01T17:55:43Z")
I am trying to use metricbeat v 7.10.2 ( ELS on same version ) and not able to see all the data for Elasticsearch module. I understand the data is dependent on master node for few metrics so i have configured it individu… --- ## [Create visualization with Lens Error](https://discuss.elastic.co/t/create-visualization-with-lens-error/290687)
**Author:** [@kbujold\_wr](https://discuss.elastic.co/u/kbujold_wr)\ **Replies:** 2\ **Last updated:** [December 1, 2021, 5:04pm UTC](https://discuss.elastic.co/t/create-visualization-with-lens-error/290687 "2021-12-01T17:04:29Z")
Hi, we are using elastic 7.9.3 After a fresh installation, if we navigate to the Visualize panel and select Create visualization / Lens we get can error saying "Unexpected token u in JSON at position 0" on the UI. If w… --- ## [Zoom in/out on custom picture](https://discuss.elastic.co/t/zoom-in-out-on-custom-picture/290536)
**Author:** [@Testeur](https://discuss.elastic.co/u/Testeur)\ **Replies:** 3\ **Last updated:** [December 1, 2021, 4:45pm UTC](https://discuss.elastic.co/t/zoom-in-out-on-custom-picture/290536 "2021-12-01T16:45:03Z")
Hello, I would like to know if with Kibana it is possible to create our own picture and be able to zoom in/out and put a circle when something has been found. The same as Map functionnalities but on a custom "map". This… --- ## [ES-SQL UNION alternative \[Was: Sql query canvas\]](https://discuss.elastic.co/t/es-sql-union-alternative-was-sql-query-canvas/290637)
**Author:** [@asmaalqasem4](https://discuss.elastic.co/u/asmaalqasem4)\ **Replies:** 7\ **Last updated:** [December 1, 2021, 4:44pm UTC](https://discuss.elastic.co/t/es-sql-union-alternative-was-sql-query-canvas/290637 "2021-12-01T16:44:04Z")
Hello,, I need to implement this query in the canvas but it is not working. is there another way to get the same result? SELECT SUM(amount) \*\* \*FROM (SELECT AMOUNT as amount FROM "payment-index "\* UNION \*\* \*SELECT P… --- ## [Logstash is not taking in account whitespaces at the end of lines ? (grok filter)](https://discuss.elastic.co/t/logstash-is-not-taking-in-account-whitespaces-at-the-end-of-lines-grok-filter/290449)
**Author:** [@duanra22](https://discuss.elastic.co/u/duanra22)\ **Replies:** 2\ **Last updated:** [December 1, 2021, 4:42pm UTC](https://discuss.elastic.co/t/logstash-is-not-taking-in-account-whitespaces-at-the-end-of-lines-grok-filter/290449 "2021-12-01T16:42:41Z")
Hello Elastic community, Sorry if this question has already been asked but I didn't find something that was close to what I'm looking for. I'm new to logstash and I'm trying to use Grok filter. I have a string of conc… --- ## [Dynamically passing to query](https://discuss.elastic.co/t/dynamically-passing-to-query/290471)
**Author:** [@cool999](https://discuss.elastic.co/u/cool999)\ **Replies:** 3\ **Last updated:** [December 1, 2021, 4:29pm UTC](https://discuss.elastic.co/t/dynamically-passing-to-query/290471 "2021-12-01T16:29:52Z")
Hi Team, I have below similar logs. I have created dummy index and created mapping like below, PUT new { "mappings": { "properties": { "@timestamp": { "type": "date", "format": "yyyy-MM-d… --- ## [How to confine geopoint aggregation bucket count](https://discuss.elastic.co/t/how-to-confine-geopoint-aggregation-bucket-count/290681)
**Author:** [@FURKAN\_KURT](https://discuss.elastic.co/u/FURKAN_KURT)\ **Replies:** 0\ **Last updated:** [December 1, 2021, 2:45pm UTC](https://discuss.elastic.co/t/how-to-confine-geopoint-aggregation-bucket-count/290681 "2021-12-01T14:45:57Z")
Hello. I could not find how to confine coming aggregated bucket size. I want them to split into smaller pieces if they surpass 100 elements each. Thank you --- ## [Progression wheel value at the end of the wheel](https://discuss.elastic.co/t/progression-wheel-value-at-the-end-of-the-wheel/288475)
**Author:** [@MTV](https://discuss.elastic.co/u/MTV)\ **Replies:** 6\ **Last updated:** [December 1, 2021, 2:37pm UTC](https://discuss.elastic.co/t/progression-wheel-value-at-the-end-of-the-wheel/288475 "2021-12-01T14:37:42Z")
Hi, I am working with canvas and was trying to find a way to show the value in a progression wheel at the end of the wheel instead of in the center. I tried some approaches using css that I used for bar plots and scatte… --- ## [When do delete policies in ILM actually get applied?](https://discuss.elastic.co/t/when-do-delete-policies-in-ilm-actually-get-applied/290563)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 5\ **Last updated:** [December 1, 2021, 1:56pm UTC](https://discuss.elastic.co/t/when-do-delete-policies-in-ilm-actually-get-applied/290563 "2021-12-01T13:56:27Z")
Hello We have a ILM policy that deletes logs older than 240 days. We also have a monitoring system that watches the mount point where the logs get stored for space. Every 1-2 months, we get a alert that it gets near i… --- ## [Filebeat messages missing under high load](https://discuss.elastic.co/t/filebeat-messages-missing-under-high-load/290194)
**Author:** [@hajeve](https://discuss.elastic.co/u/hajeve)\ **Replies:** 1\ **Last updated:** [December 1, 2021, 1:44pm UTC](https://discuss.elastic.co/t/filebeat-messages-missing-under-high-load/290194 "2021-12-01T13:44:07Z")
We need help with the following problem: We are receiving BIG IP F5 request-logs via F5 High Speed Logging in dedicated filebeat pods (8) in our production environment in Azure cloud. These filebeat pods are connected … --- ## [Filebeat on kubernetes: cant make it work without cluster roles](https://discuss.elastic.co/t/filebeat-on-kubernetes-cant-make-it-work-without-cluster-roles/290586)
**Author:** [@Guillaume84](https://discuss.elastic.co/u/Guillaume84)\ **Replies:** 5\ **Last updated:** [December 1, 2021, 1:39pm UTC](https://discuss.elastic.co/t/filebeat-on-kubernetes-cant-make-it-work-without-cluster-roles/290586 "2021-12-01T13:39:36Z")
Hello, I am trying to deploy a filebeat container (not daemonset) on a k8s cluster (kub 1.21) Used image: elastic/filebeat:7.8.1 Image starts correctly but i can't have the filebeat working correctly : E1130 15:47:41… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1142) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1144)