# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1144 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1145 --- ## [Elasticsearch write performance](https://discuss.elastic.co/t/elasticsearch-write-performance/290646)
**Author:** [@qixian](https://discuss.elastic.co/u/qixian)\ **Replies:** 4\ **Last updated:** [December 1, 2021, 1:20pm UTC](https://discuss.elastic.co/t/elasticsearch-write-performance/290646 "2021-12-01T13:20:56Z")
helllo,when i write data to Elasticsearch using the bulk api,which process is flink consume the data of kafka then write to Elasticsearch.sometimes the write performance has Large fluctuations，I want to kown when the ela… --- ## [Disapearing fields during kv parsing](https://discuss.elastic.co/t/disapearing-fields-during-kv-parsing/290652)
**Author:** [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Replies:** 1\ **Last updated:** [December 1, 2021, 1:20pm UTC](https://discuss.elastic.co/t/disapearing-fields-during-kv-parsing/290652 "2021-12-01T13:20:03Z")
Hi! I'm trying to parse the following log record \_\_policy\_id\_tag:"product=APP1 & APP2\[db\_tag={ABCDEF}; mgmt=abcd; date=123456789; policy\_name=foo\]"; product:"APP1 & APP2"; mgmt:"abcd"; event:"Canceled" and when I use … --- ## [Can't turn on monitoring](https://discuss.elastic.co/t/cant-turn-on-monitoring/290356)
**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\ **Replies:** 4\ **Last updated:** [December 1, 2021, 11:42am UTC](https://discuss.elastic.co/t/cant-turn-on-monitoring/290356 "2021-12-01T11:42:01Z")
Hi, I have installed Kibana for the new cluster. When going to Stack Monitoring. It shows “We couldn't activate monitoring” In addition log prints “Unable to bulk upload the stats payload to the local cluster” Dev to… --- ## [ElasticSearch does not allow IPv6-mapped IPv4 address in field of type ip\_range](https://discuss.elastic.co/t/elasticsearch-does-not-allow-ipv6-mapped-ipv4-address-in-field-of-type-ip-range/290656)
**Author:** [@swapnil\_vaidya](https://discuss.elastic.co/u/swapnil_vaidya)\ **Replies:** 0\ **Last updated:** [December 1, 2021, 11:17am UTC](https://discuss.elastic.co/t/elasticsearch-does-not-allow-ipv6-mapped-ipv4-address-in-field-of-type-ip-range/290656 "2021-12-01T11:17:08Z")
Hi All, I am trying to index the document with field having value as IPV6 mapped IPV4 address in the field with type as ip\_range. However ES throws following error: CIDR notation is not allowed with IPv6-mapped IPv4 a… --- ## [How to fetch environment varibles in kibana plugin](https://discuss.elastic.co/t/how-to-fetch-environment-varibles-in-kibana-plugin/290431)
**Author:** [@prashant1](https://discuss.elastic.co/u/prashant1)\ **Replies:** 3\ **Last updated:** [December 1, 2021, 10:51am UTC](https://discuss.elastic.co/t/how-to-fetch-environment-varibles-in-kibana-plugin/290431 "2021-12-01T10:51:12Z")
Hi We are testing kibana plugin in 7.10.2. When we tried to used process.env.TEST\_VALUE in our code and run yarn build on kibana plugin and after unzip when we search for the TEST\_VALUE we get it in the below format in… --- ## [Fast vector highlighter (fvh) making searches slower](https://discuss.elastic.co/t/fast-vector-highlighter-fvh-making-searches-slower/290634)
**Author:** [@Pyppe](https://discuss.elastic.co/u/Pyppe)\ **Replies:** 6\ **Last updated:** [December 1, 2021, 10:45am UTC](https://discuss.elastic.co/t/fast-vector-highlighter-fvh-making-searches-slower/290634 "2021-12-01T10:45:04Z")
Hi! We recently improved our hit highlighting by utilizing fvh (Lucene Fast Vector Highlighter). The highlighting is done as follows: { "query": {...}, "highlight": { "fields": { "searchableName": { … --- ## [Kibana Reports Hammering CPU](https://discuss.elastic.co/t/kibana-reports-hammering-cpu/290546)
**Author:** [@Evesy](https://discuss.elastic.co/u/Evesy)\ **Replies:** 2\ **Last updated:** [December 1, 2021, 10:20am UTC](https://discuss.elastic.co/t/kibana-reports-hammering-cpu/290546 "2021-12-01T10:20:37Z")
Hi, We recently upgraded our Elastic stack from 6.8 to 7.15 and one thing we've noticed is a pretty noticeable degradation in the performance of CSV reporting in Kibana; reports we were usually generating successfully i… --- ## [Does kibana generate report of sonarqube analysis?](https://discuss.elastic.co/t/does-kibana-generate-report-of-sonarqube-analysis/289256)
**Author:** [@mehmood1](https://discuss.elastic.co/u/mehmood1)\ **Replies:** 2\ **Last updated:** [December 1, 2021, 10:15am UTC](https://discuss.elastic.co/t/does-kibana-generate-report-of-sonarqube-analysis/289256 "2021-12-01T10:15:04Z")
if i configure sonarqube with Elasticsearch. --- ## [How can i find document where the value of a field It is not repeated](https://discuss.elastic.co/t/how-can-i-find-document-where-the-value-of-a-field-it-is-not-repeated/290426)
**Author:** [@Alejandro\_Chaves](https://discuss.elastic.co/u/Alejandro_Chaves)\ **Replies:** 2\ **Last updated:** [December 1, 2021, 8:36am UTC](https://discuss.elastic.co/t/how-can-i-find-document-where-the-value-of-a-field-it-is-not-repeated/290426 "2021-12-01T08:36:18Z")
Hello, im new in ELK and dont know how to find only the documents where the value of serviceName It is not repeated, just show me the document with the serviceName SLA\_D\_CARGA\_MODELO\_ACTIVO\_SSII\_testemail with the devtoo… --- ## [Visualize the last value](https://discuss.elastic.co/t/visualize-the-last-value/290641)
**Author:** [@carlos\_gomez\_gomez](https://discuss.elastic.co/u/carlos_gomez_gomez)\ **Replies:** 1\ **Last updated:** [December 1, 2021, 9:57am UTC](https://discuss.elastic.co/t/visualize-the-last-value/290641 "2021-12-01T09:57:09Z")
Hi. I'm trying to make a visualitzacion of an scripted field. The value of the scripted field only can be 1 or 0 is like a boolean. I want to visualice a line graph. I have two questions about that. It its possible t… --- ## [Problem to create a TermsQuery using list of integers](https://discuss.elastic.co/t/problem-to-create-a-termsquery-using-list-of-integers/290644)
**Author:** [@Kirtash](https://discuss.elastic.co/u/Kirtash)\ **Replies:** 0\ **Last updated:** [December 1, 2021, 9:40am UTC](https://discuss.elastic.co/t/problem-to-create-a-termsquery-using-list-of-integers/290644 "2021-12-01T09:40:02Z")
Good morning, I'm using the library nest in C# to write bool queries but I would like create a termsquery with a list of integers, like when I use strings: List\ hiValues = new List\(); … --- ## [\`kubernetes.volume.fs.used.pct\` has incorrect type in index template](https://discuss.elastic.co/t/kubernetes-volume-fs-used-pct-has-incorrect-type-in-index-template/290440)
**Author:** [@lepouletsuisse](https://discuss.elastic.co/u/lepouletsuisse)\ **Replies:** 2\ **Last updated:** [December 1, 2021, 9:26am UTC](https://discuss.elastic.co/t/kubernetes-volume-fs-used-pct-has-incorrect-type-in-index-template/290440 "2021-12-01T09:26:28Z")
It seems that field kubernetes.volume.fs.used.pct has an incorrect type in the index template metrics-kubernetes.volume (automatically generated by metricbeat or fleet). The type specified by the template's mapping is l… --- ## [Filebeat incompatibility when upgrading elasticsearch](https://discuss.elastic.co/t/filebeat-incompatibility-when-upgrading-elasticsearch/290607)
**Author:** [@bruce289](https://discuss.elastic.co/u/bruce289)\ **Replies:** 2\ **Last updated:** [December 1, 2021, 8:28am UTC](https://discuss.elastic.co/t/filebeat-incompatibility-when-upgrading-elasticsearch/290607 "2021-12-01T08:28:38Z")
Hi. We're currently testing an upgrade from Elasticsearch 6.8 to 7.15 and we noticed that when we upgrade the cluster, the Filebeat agents on some of our hosts can no longer write to the indices and we see the errors li… --- ## [Gpg: no valid OpenPGP data found](https://discuss.elastic.co/t/gpg-no-valid-openpgp-data-found/290633)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 0\ **Last updated:** [December 1, 2021, 7:23am UTC](https://discuss.elastic.co/t/gpg-no-valid-openpgp-data-found/290633 "2021-12-01T07:23:00Z")
Hi, I already have an ELK environment running at version 7.13, I'm trying to update to 7.15. But when trying to use the below command: wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add - … --- ## [What is a good number of fields to have in an index?](https://discuss.elastic.co/t/what-is-a-good-number-of-fields-to-have-in-an-index/290618)
**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\ **Replies:** 3\ **Last updated:** [December 1, 2021, 7:53am UTC](https://discuss.elastic.co/t/what-is-a-good-number-of-fields-to-have-in-an-index/290618 "2021-12-01T07:53:19Z")
I am trying to manage the index and I would like to know how many fields must be present inside an index for it to have good performance. Currently, I have 6000 fields in my index but not all documents have 6000 fields i… --- ## [Cannot get Cisco Filebeat module to work](https://discuss.elastic.co/t/cannot-get-cisco-filebeat-module-to-work/289903)
**Author:** [@titan\_tm](https://discuss.elastic.co/u/titan_tm)\ **Replies:** 13\ **Last updated:** [December 1, 2021, 6:56am UTC](https://discuss.elastic.co/t/cannot-get-cisco-filebeat-module-to-work/289903 "2021-12-01T06:56:46Z")
Hello Team, I'm running on ELK 7.14.0 and I'm facing an issue with kibana dashboard and need your help. I have an ELK stack which gets logs from filebeat (cisco module) and sends them directly to Elasticsearch. It work… --- ## [Winlogbeat 7.15.1 with sysmon missing fields task and message on Windows Server 2022](https://discuss.elastic.co/t/winlogbeat-7-15-1-with-sysmon-missing-fields-task-and-message-on-windows-server-2022/289675)
**Author:** [@sytser](https://discuss.elastic.co/u/sytser)\ **Replies:** 9\ **Last updated:** [December 1, 2021, 6:55am UTC](https://discuss.elastic.co/t/winlogbeat-7-15-1-with-sysmon-missing-fields-task-and-message-on-windows-server-2022/289675 "2021-12-01T06:55:39Z")
The issue is that on a Windows Server 2022 version with Winlogbeat v7.15.1 and Sysmon v13.24. Some how on Windows Server 2022 Winlogbeat doesn't send the fields task and message to Logstash v7.15.2. If we use the same … --- ## [How to parse xml log inside of the json format in Logstash](https://discuss.elastic.co/t/how-to-parse-xml-log-inside-of-the-json-format-in-logstash/290006)
**Author:** [@Bigboy0706](https://discuss.elastic.co/u/Bigboy0706)\ **Replies:** 15\ **Last updated:** [December 1, 2021, 6:28am UTC](https://discuss.elastic.co/t/how-to-parse-xml-log-inside-of-the-json-format-in-logstash/290006 "2021-12-01T06:28:09Z")
I will receive a log that contained JSON and XML format I configurated the Logstash to receive TCP in JSON and used the filter when shown dateparsefailure in tags. The JSON part is able to extract, but the xml part can… --- ## [Elasticsearch wont run](https://discuss.elastic.co/t/elasticsearch-wont-run/290395)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 7\ **Last updated:** [December 1, 2021, 6:20am UTC](https://discuss.elastic.co/t/elasticsearch-wont-run/290395 "2021-12-01T06:20:27Z")
Hi dears I have upgraded the Elasticsearch and removed old version and copy all the new Elasticsearch parts in the same directory (upgrading ES 7.6.2 to 7.15.2) Unfortunately when I want to start the service with sysV … --- ## [Kibana Dashboard PDF and PNG reporting options missing](https://discuss.elastic.co/t/kibana-dashboard-pdf-and-png-reporting-options-missing/290407)
**Author:** [@Petteri](https://discuss.elastic.co/u/Petteri)\ **Replies:** 4\ **Last updated:** [December 1, 2021, 6:15am UTC](https://discuss.elastic.co/t/kibana-dashboard-pdf-and-png-reporting-options-missing/290407 "2021-12-01T06:15:17Z")
Hi! We just updated our Elastic to 7.14 version and enabled reporting for users by this guide: Configure reporting in Kibana | Kibana Guide \[7.14\] | Elastic After update the PDF and PNG reporting options are not availa… --- ## ["environment: - xpack.security.enabled=true" does not work with docker-compose](https://discuss.elastic.co/t/environment-xpack-security-enabled-true-does-not-work-with-docker-compose/290389)
**Author:** [@tadashi.oya](https://discuss.elastic.co/u/tadashi.oya)\ **Replies:** 2\ **Last updated:** [December 1, 2021, 5:20am UTC](https://discuss.elastic.co/t/environment-xpack-security-enabled-true-does-not-work-with-docker-compose/290389 "2021-12-01T05:20:49Z")
Hi, I'm trying to specify xpack.security.enabled as an environment variable for the Elasticsearch container in the docker-compose configuration of T-Pot, a honeypot framework. However, the following statement does not w… --- ## [Filebeat.yml can not convert String into Object](https://discuss.elastic.co/t/filebeat-yml-can-not-convert-string-into-object/290622)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 2\ **Last updated:** [December 1, 2021, 4:29am UTC](https://discuss.elastic.co/t/filebeat-yml-can-not-convert-string-into-object/290622 "2021-12-01T04:29:40Z")
Hello team, I am getting below error in filebeat.yml. I have commented all other lines and just added output.Elasticsearch Can anyone please help me here. output.elasticsearch: hosts =\> \["10.115.6.288:9200"\] --- ## [Errors/Problems with logstash in docker-compose](https://discuss.elastic.co/t/errors-problems-with-logstash-in-docker-compose/290616)
**Author:** [@Leandro\_Valim](https://discuss.elastic.co/u/Leandro_Valim)\ **Replies:** 0\ **Last updated:** [December 1, 2021, 12:14am UTC](https://discuss.elastic.co/t/errors-problems-with-logstash-in-docker-compose/290616 "2021-12-01T00:14:22Z")
Hello, I have problems to up my docker-compose enviroment with logstash docker-compose.yml # cat docker-compose.yml version: '2' services: logstash: image: docker.elastic.co/logstash/logstash:7.10.2 containe… --- ## [Trying to use snapshot and restore for pushing index data from one cluster to another](https://discuss.elastic.co/t/trying-to-use-snapshot-and-restore-for-pushing-index-data-from-one-cluster-to-another/290612)
**Author:** [@milindyedge](https://discuss.elastic.co/u/milindyedge)\ **Replies:** 1\ **Last updated:** [November 30, 2021, 11:49pm UTC](https://discuss.elastic.co/t/trying-to-use-snapshot-and-restore-for-pushing-index-data-from-one-cluster-to-another/290612 "2021-11-30T23:49:19Z")
I am working on to try and use Snapshot and Restore feature to push index data from one running/live cluster to another live cluster without needing to have any downtime in destination cluster. I have spun up 2 multi-nod… --- ## [Analyzers at Index time and search time are not matching](https://discuss.elastic.co/t/analyzers-at-index-time-and-search-time-are-not-matching/290614)
**Author:** [@Nikesh](https://discuss.elastic.co/u/Nikesh)\ **Replies:** 0\ **Last updated:** [November 30, 2021, 11:48pm UTC](https://discuss.elastic.co/t/analyzers-at-index-time-and-search-time-are-not-matching/290614 "2021-11-30T23:48:15Z")
Hi, I am trying to use synsets in Elasticsearch to build a pseudo QA System. My mapping file looks something as below: { "settings": { "analysis": { "analyzer": { "synset": { "tokenizer… --- ## [Does Elasticsearch provide highlighting on "copy\_to" field in their newer versions?](https://discuss.elastic.co/t/does-elasticsearch-provide-highlighting-on-copy-to-field-in-their-newer-versions/290611)
**Author:** [@Nikesh](https://discuss.elastic.co/u/Nikesh)\ **Replies:** 0\ **Last updated:** [November 30, 2021, 11:24pm UTC](https://discuss.elastic.co/t/does-elasticsearch-provide-highlighting-on-copy-to-field-in-their-newer-versions/290611 "2021-11-30T23:24:10Z")
I had used Elasticsearch few years ago(version 6.4.0) and they had no provision to provide highlight the "copy\_to" field. I would like to know if they have this provision now? If yes, how do I avoid the highlighting of … --- ## [AccessDeniedException when taking a snapshot of ES index in local machine](https://discuss.elastic.co/t/accessdeniedexception-when-taking-a-snapshot-of-es-index-in-local-machine/289848)
**Author:** [@milindyedge](https://discuss.elastic.co/u/milindyedge)\ **Replies:** 2\ **Last updated:** [November 30, 2021, 11:15pm UTC](https://discuss.elastic.co/t/accessdeniedexception-when-taking-a-snapshot-of-es-index-in-local-machine/289848 "2021-11-30T23:15:00Z")
Getting below error when taking snapshot of the index. ----------------------- Error ----------------------- java.lang.IllegalStateException: Unable to access 'path.repo' (/Users/mlyedge/gitrepos/search-query-service/c… --- ## [Disable doc\_values and index for nested type fields](https://discuss.elastic.co/t/disable-doc-values-and-index-for-nested-type-fields/290609)
**Author:** [@NLSVTN](https://discuss.elastic.co/u/NLSVTN)\ **Replies:** 0\ **Last updated:** [November 30, 2021, 10:42pm UTC](https://discuss.elastic.co/t/disable-doc-values-and-index-for-nested-type-fields/290609 "2021-11-30T22:42:40Z")
I set 'doc\_values' to 'False' on nested fields but it does not work in index creation got stuck. I wonder how to correctly disable 'doc\_values' and 'index' on 'nested' fields? Should I disable it just on the level of the… --- ## [Shipping Postfix logs to ELK stack](https://discuss.elastic.co/t/shipping-postfix-logs-to-elk-stack/290603)
**Author:** [@DoDuyen162000](https://discuss.elastic.co/u/DoDuyen162000)\ **Replies:** 2\ **Last updated:** [November 30, 2021, 9:54pm UTC](https://discuss.elastic.co/t/shipping-postfix-logs-to-elk-stack/290603 "2021-11-30T21:54:36Z")
Hello, Well this is not actually an issue rather query. I have been playing with ELK stack for a few days. I have a working ELK stack running on Ubuntu 20.4. Now, I want to ship mail logs (postfix logs) to my ELK stack… --- ## [Elasticsearch for Two Services](https://discuss.elastic.co/t/elasticsearch-for-two-services/290344)
**Author:** [@Klaus\_Salazar](https://discuss.elastic.co/u/Klaus_Salazar)\ **Replies:** 2\ **Last updated:** [November 30, 2021, 9:44pm UTC](https://discuss.elastic.co/t/elasticsearch-for-two-services/290344 "2021-11-30T21:44:09Z")
Hi, is possible that Elasticsearch can support two services on the same server, for example i have a wazuh server and this use Elasticsearch but i need install in this same sserver thehive that also use Elasticsearch, is… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1143) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1145)