# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1146 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1147 --- ## [How add prefix to the fields using kv filter](https://discuss.elastic.co/t/how-add-prefix-to-the-fields-using-kv-filter/238150)
**Author:** [@Ramalakshmi](https://discuss.elastic.co/u/Ramalakshmi)\ **Replies:** 7\ **Last updated:** [November 30, 2021, 9:00am UTC](https://discuss.elastic.co/t/how-add-prefix-to-the-fields-using-kv-filter/238150 "2021-11-30T09:00:20Z")
Hi I am adding prefix to the fields using kv filter, It's working to the some of the fields in the json message. Example: Filed name is resource.network.imageid while adding prefix as aws.datasource using kv filter I … --- ## [Time Difference with "took" and python timer](https://discuss.elastic.co/t/time-difference-with-took-and-python-timer/290445)
**Author:** [@icgncl](https://discuss.elastic.co/u/icgncl)\ **Replies:** 5\ **Last updated:** [November 30, 2021, 8:07am UTC](https://discuss.elastic.co/t/time-difference-with-took-and-python-timer/290445 "2021-11-30T08:07:10Z")
Hello everyone, I am very new in Elasticsearch and also in forum. I have created an index, then I have created some queries. When I checked the "took" time from kibana for my queries, it is between 7 and 10ms. However, w… --- ## [Kibana Alerts](https://discuss.elastic.co/t/kibana-alerts/290462)
**Author:** [@paddy3267](https://discuss.elastic.co/u/paddy3267)\ **Replies:** 2\ **Last updated:** [November 30, 2021, 7:49am UTC](https://discuss.elastic.co/t/kibana-alerts/290462 "2021-11-30T07:49:04Z")
Hi, is it possible to create Kibana alerts via a config file (preferably YAML), or Kibana GUI is the only way to do so? Thanks! --- ## [Watcher Transform - Replace newline character on specific field in multiple documents](https://discuss.elastic.co/t/watcher-transform-replace-newline-character-on-specific-field-in-multiple-documents/290479)
**Author:** [@Kambing](https://discuss.elastic.co/u/Kambing)\ **Replies:** 1\ **Last updated:** [November 30, 2021, 7:46am UTC](https://discuss.elastic.co/t/watcher-transform-replace-newline-character-on-specific-field-in-multiple-documents/290479 "2021-11-30T07:46:59Z")
Hi, I'm currently building a watcher script to send data to 3rd party API, however the 3rd party API can't process the newline character ("\\n") input. Some of my documents have newline character in specific field. there … --- ## [No data after CSV Export - Kibana](https://discuss.elastic.co/t/no-data-after-csv-export-kibana/289910)
**Author:** [@njain213](https://discuss.elastic.co/u/njain213)\ **Replies:** 19\ **Last updated:** [November 30, 2021, 7:45am UTC](https://discuss.elastic.co/t/no-data-after-csv-export-kibana/289910 "2021-11-30T07:45:54Z")
Hello Team, In reference to No data after CSV Export - Kibana I am also facing exact same issue. Could you please help me in fixing it? Note:- I am using kibana 7.9.3. --- ## [Indices recovering after a red - yellow state leads to writes stucked?](https://discuss.elastic.co/t/indices-recovering-after-a-red-yellow-state-leads-to-writes-stucked/290522)
**Author:** [@sebastienf](https://discuss.elastic.co/u/sebastienf)\ **Replies:** 1\ **Last updated:** [November 30, 2021, 7:40am UTC](https://discuss.elastic.co/t/indices-recovering-after-a-red-yellow-state-leads-to-writes-stucked/290522 "2021-11-30T07:40:15Z")
Hi, There is something I don't understand, and I don't know if it is something peculiar. When my cluster ES (42 nodes with 32GB, 20000 shards in a old 5.6 version = we aim to go to a 7.x at the end of Q1 2022, we must … --- ## [How could I reserve message filed with json.keys\_under\_root is set](https://discuss.elastic.co/t/how-could-i-reserve-message-filed-with-json-keys-under-root-is-set/290275)
**Author:** [@xxdoor](https://discuss.elastic.co/u/xxdoor)\ **Replies:** 1\ **Last updated:** [November 30, 2021, 7:35am UTC](https://discuss.elastic.co/t/how-could-i-reserve-message-filed-with-json-keys-under-root-is-set/290275 "2021-11-30T07:35:22Z")
Hi, I'm using filebeat to collect my logs from servers. I'm confused whether it's possible to reserve message filed when I set json.keys\_under\_root true. The fields I hava set: - type: docker containers: path: "… --- ## [Issue with visualizing a field in Kibana even when elasticsearch has its mapping](https://discuss.elastic.co/t/issue-with-visualizing-a-field-in-kibana-even-when-elasticsearch-has-its-mapping/290521)
**Author:** [@sanba06c](https://discuss.elastic.co/u/sanba06c)\ **Replies:** 1\ **Last updated:** [November 30, 2021, 7:20am UTC](https://discuss.elastic.co/t/issue-with-visualizing-a-field-in-kibana-even-when-elasticsearch-has-its-mapping/290521 "2021-11-30T07:20:01Z")
Hello, I'm using Kibana and can filter for some specific values, but failed to filter some other fields. The following screenshots illustrate the current issue: I can successfully filter the value "http.Request.uri". O… --- ## [Action \[indices:admin/rollover\] is unauthorized for user \[remote\_monitoring\_user\] with roles](https://discuss.elastic.co/t/action-indices-admin-rollover-is-unauthorized-for-user-remote-monitoring-user-with-roles/288481)
**Author:** [@raulk89](https://discuss.elastic.co/u/raulk89)\ **Replies:** 1\ **Last updated:** [November 30, 2021, 7:16am UTC](https://discuss.elastic.co/t/action-indices-admin-rollover-is-unauthorized-for-user-remote-monitoring-user-with-roles/288481 "2021-11-30T07:16:09Z")
Hi Elastic 7.15.1 After configuring metricbeat module elasticsearc-xpack, I am getting the following error in elasticsearch log files: \[2021-11-04T18:04:32,698\]\[ERROR\]\[o.e.x.i.IndexLifecycleRunner\] \[XXXXXXXXXXXXX\] po… --- ## [Will Kibana Basic License Expire?](https://discuss.elastic.co/t/will-kibana-basic-license-expire/290415)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 2\ **Last updated:** [November 30, 2021, 6:57am UTC](https://discuss.elastic.co/t/will-kibana-basic-license-expire/290415 "2021-11-30T06:57:01Z")
Hi Im building Kibana from GitHub - elastic/kibana at v7.4.2. Will that basic license expire anytime? Regards Ram --- ## [Filebeat: Time different between ingest time and Message log time](https://discuss.elastic.co/t/filebeat-time-different-between-ingest-time-and-message-log-time/290394)
**Author:** [@Elie\_Sbat1](https://discuss.elastic.co/u/Elie_Sbat1)\ **Replies:** 4\ **Last updated:** [November 30, 2021, 6:31am UTC](https://discuss.elastic.co/t/filebeat-time-different-between-ingest-time-and-message-log-time/290394 "2021-11-30T06:31:06Z")
Hello, Currently, I am using Elasticsearch v7.11 and filebeat v7.15 And I am retrieving owa logs from a directory on exchange. I noticed that the "@timestamp" and log message was way different. After further troubleshoo… --- ## [Configuration of beats that come with elastic-agent and fleet](https://discuss.elastic.co/t/configuration-of-beats-that-come-with-elastic-agent-and-fleet/290489)
**Author:** [@poulaone](https://discuss.elastic.co/u/poulaone)\ **Replies:** 2\ **Last updated:** [November 30, 2021, 6:23am UTC](https://discuss.elastic.co/t/configuration-of-beats-that-come-with-elastic-agent-and-fleet/290489 "2021-11-30T06:23:27Z")
Hello, I search information about the beats configurations through elastic-agent and fleet. For exemple, for the filebeat agent installed with elastic-agent, how can i disable metrics or enable a path monitoring ? Tha… --- ## [How to check for key exist script query parameters?](https://discuss.elastic.co/t/how-to-check-for-key-exist-script-query-parameters/290514)
**Author:** [@hyun](https://discuss.elastic.co/u/hyun)\ **Replies:** 0\ **Last updated:** [November 30, 2021, 6:12am UTC](https://discuss.elastic.co/t/how-to-check-for-key-exist-script-query-parameters/290514 "2021-11-30T06:12:12Z")
Is there any way to return null if there is no corresponding value? example) Since params do not have a field4 value, I want the null value to be returned to the syn variable. "aggs": { "countries": { "terms"… --- ## [The index shard is lost, and the cluster status is green](https://discuss.elastic.co/t/the-index-shard-is-lost-and-the-cluster-status-is-green/290332)
**Author:** [@zekaifeng](https://discuss.elastic.co/u/zekaifeng)\ **Replies:** 4\ **Last updated:** [November 30, 2021, 1:57am UTC](https://discuss.elastic.co/t/the-index-shard-is-lost-and-the-cluster-status-is-green/290332 "2021-11-30T01:57:05Z")
Elasticsearchversion (bin/Elasticsearch --version): Version: 7.3.1 Plugins installed: JVM version (java -version): jdk 8 OS version : Linux Description of the problem including expected versus actual behavior: The … --- ## [How to link current filter user used in controls with markdown?](https://discuss.elastic.co/t/how-to-link-current-filter-user-used-in-controls-with-markdown/290385)
**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\ **Replies:** 2\ **Last updated:** [November 30, 2021, 1:46am UTC](https://discuss.elastic.co/t/how-to-link-current-filter-user-used-in-controls-with-markdown/290385 "2021-11-30T01:46:37Z")
Hi folks, I am using controls in kibana so that user could get a drop-down and select filter he/she wants. What I am trying to achieve is to create the main dashboard and have markdowns to sub dashboards. But the issue … --- ## [Filebeat: create new module fails consistently on a Windows machine](https://discuss.elastic.co/t/filebeat-create-new-module-fails-consistently-on-a-windows-machine/290496)
**Author:** [@Zee\_Grinch](https://discuss.elastic.co/u/Zee_Grinch)\ **Replies:** 0\ **Last updated:** [November 29, 2021, 10:57pm UTC](https://discuss.elastic.co/t/filebeat-create-new-module-fails-consistently-on-a-windows-machine/290496 "2021-11-29T22:57:30Z")
$make create-module MODULE=mytestmodule keeps failing abruptly with the dreaded : Unknown target specified: "create-module", no matter what tweaks I have been tried to my environment. this is a Windows 10 64b followe… --- ## [Query string with default\_operator as AND works differently in v2.4 and v6.8](https://discuss.elastic.co/t/query-string-with-default-operator-as-and-works-differently-in-v2-4-and-v6-8/290476)
**Author:** [@Syed\_Souban](https://discuss.elastic.co/u/Syed_Souban)\ **Replies:** 2\ **Last updated:** [November 29, 2021, 8:49pm UTC](https://discuss.elastic.co/t/query-string-with-default-operator-as-and-works-differently-in-v2-4-and-v6-8/290476 "2021-11-29T20:49:00Z")
The query\_string query seems to be returning the documents that match all the terms across fields specified in the fields parameter in ES 2.4 whereas in ES 6.8 documents that match all the terms per field are returned. S… --- ## [Self hosted elasticsearch on AWS ec2 server](https://discuss.elastic.co/t/self-hosted-elasticsearch-on-aws-ec2-server/290483)
**Author:** [@bbangerter](https://discuss.elastic.co/u/bbangerter)\ **Replies:** 4\ **Last updated:** [November 29, 2021, 8:39pm UTC](https://discuss.elastic.co/t/self-hosted-elasticsearch-on-aws-ec2-server/290483 "2021-11-29T20:39:46Z")
I'm new to Elasticsearch, and I'm trying to install and run Elasticsearch on a CentOS 8 server in AWS. Currently it is a small server (1GB memory, 15GB SSD, 1 CPU) I have installed the software, but when trying to run t… --- ## [Using ElasticSearch as a Microservice](https://discuss.elastic.co/t/using-elasticsearch-as-a-microservice/290354)
**Author:** [@Mohan\_Radhakrishnan](https://discuss.elastic.co/u/Mohan_Radhakrishnan)\ **Replies:** 3\ **Last updated:** [November 29, 2021, 8:18pm UTC](https://discuss.elastic.co/t/using-elasticsearch-as-a-microservice/290354 "2021-11-29T20:18:23Z")
Hello, This is a design question. We have messages pushed to Kafka and Kafka can pipe it to Elastic using Kafka connect. This is what I am considering for message search. Kafka can send these messages but it also forwa… --- ## [Query MultMatch with fuzzines in 7.6](https://discuss.elastic.co/t/query-multmatch-with-fuzzines-in-7-6/290486)
**Author:** [@RafaelPeggau](https://discuss.elastic.co/u/RafaelPeggau)\ **Replies:** 0\ **Last updated:** [November 29, 2021, 7:43pm UTC](https://discuss.elastic.co/t/query-multmatch-with-fuzzines-in-7-6/290486 "2021-11-29T19:43:32Z")
Estou tentando construir uma consulta, onde pesquiso sobre vários campos (fields), usando minimun should match, e fuzzines, como no exemplo. "size": 10000, "query": { "bool": { … --- ## [Trying to extract Lucene from Kibana](https://discuss.elastic.co/t/trying-to-extract-lucene-from-kibana/290382)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 5\ **Last updated:** [November 29, 2021, 7:42pm UTC](https://discuss.elastic.co/t/trying-to-extract-lucene-from-kibana/290382 "2021-11-29T19:42:17Z")
Dear all =) When I write KQL in the search bar, while having Google Chrome debugging open, I see a request to bsearch is made with a cryptic response such as eJxEjl1rgzAUhv9Lrr2oijdCb8Za2MB0pnGFj ... == I suppose the… --- ## [Plans for KQL support in Kibana Stack Alert "Elasticsearch query"?](https://discuss.elastic.co/t/plans-for-kql-support-in-kibana-stack-alert-elasticsearch-query/290381)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 2\ **Last updated:** [November 29, 2021, 7:35pm UTC](https://discuss.elastic.co/t/plans-for-kql-support-in-kibana-stack-alert-elasticsearch-query/290381 "2021-11-29T19:35:59Z")
Dear all =) When using Kibana Stack Alert "Elasticsearch query", it is only possible to provide Lucene. Are there any plans to support KQL, so it would just convert it to Lucene? It would be very useful since there is … --- ## [Up-Sizing Resources with Helm Chart / Kubernetes](https://discuss.elastic.co/t/up-sizing-resources-with-helm-chart-kubernetes/290481)
**Author:** [@jamiejackson](https://discuss.elastic.co/u/jamiejackson)\ **Replies:** 0\ **Last updated:** [November 29, 2021, 7:04pm UTC](https://discuss.elastic.co/t/up-sizing-resources-with-helm-chart-kubernetes/290481 "2021-11-29T19:04:15Z")
I have a 3-node ES cluster which was spun up with the Elasticsearch Helm chart ( helm-charts/README.md at main · elastic/helm-charts · GitHub ). I want to bump up the heap/CPU/memory allocations, so I've created a new, … --- ## [How to secure Elastic cluster with Docker + Traefik + SSL](https://discuss.elastic.co/t/how-to-secure-elastic-cluster-with-docker-traefik-ssl/289933)
**Author:** [@live2learn](https://discuss.elastic.co/u/live2learn)\ **Replies:** 2\ **Last updated:** [November 29, 2021, 6:31pm UTC](https://discuss.elastic.co/t/how-to-secure-elastic-cluster-with-docker-traefik-ssl/289933 "2021-11-29T18:31:53Z")
Hi there, What I want to do Set up an Elastic cluster (with Kibana) with Docker (via docker-compose). The cluster is secured (either username/password or API-Key) and lives behind a traefik reverse proxy which has Lets… --- ## [Tracking number of value changes of boolean field in time series](https://discuss.elastic.co/t/tracking-number-of-value-changes-of-boolean-field-in-time-series/290425)
**Author:** [@DennisKlopfer](https://discuss.elastic.co/u/DennisKlopfer)\ **Replies:** 1\ **Last updated:** [November 29, 2021, 6:31pm UTC](https://discuss.elastic.co/t/tracking-number-of-value-changes-of-boolean-field-in-time-series/290425 "2021-11-29T18:31:05Z")
My time series data contains a boolean field, which changes frequently. I want to count the number of changes of said field. Optimally I would like to create a field containing this number while ingesting, but showing t… --- ## [Kibana 6.1.1 : Add include\_type\_name=true in calls to elasticsearch](https://discuss.elastic.co/t/kibana-6-1-1-add-include-type-name-true-in-calls-to-elasticsearch/290277)
**Author:** [@Ranjan\_prabhu](https://discuss.elastic.co/u/Ranjan_prabhu)\ **Replies:** 3\ **Last updated:** [November 29, 2021, 6:13pm UTC](https://discuss.elastic.co/t/kibana-6-1-1-add-include-type-name-true-in-calls-to-elasticsearch/290277 "2021-11-29T18:13:25Z")
I started with Elasticsearch 6.1.x with kibana 6.1.x. I am planning to use kibana 6.1.x with Elasticsearch 7.x. I have gone through this to understand what has changed in es 7.x: Breaking changes in 7.0 | Elasticsearch G… --- ## [Elasticsearch is running but not showing in ElasticHead](https://discuss.elastic.co/t/elasticsearch-is-running-but-not-showing-in-elastichead/290377)
**Author:** [@userR](https://discuss.elastic.co/u/userR)\ **Replies:** 5\ **Last updated:** [November 29, 2021, 5:46pm UTC](https://discuss.elastic.co/t/elasticsearch-is-running-but-not-showing-in-elastichead/290377 "2021-11-29T17:46:40Z")
Hi, I checked the status of Elasticsearch and everything indicates that it is running. However, when I try to connect to elastichead or even look up the ip:port, it does not connect. Is this some sort of port issue? My E… --- ## [Clastic cluster unstable](https://discuss.elastic.co/t/clastic-cluster-unstable/290475)
**Author:** [@rp346](https://discuss.elastic.co/u/rp346)\ **Replies:** 0\ **Last updated:** [November 29, 2021, 5:45pm UTC](https://discuss.elastic.co/t/clastic-cluster-unstable/290475 "2021-11-29T17:45:58Z")
I have ELB stack running in kubernetes. But noticed issue with two out of 3 nodes with following error {"type": "server", "timestamp": "2021-11-29T17:42:37,326Z", "level": "WARN", "component": "o.e.c.c.ClusterFormationF… --- ## [Different size\_in\_bytes for the same index](https://discuss.elastic.co/t/different-size-in-bytes-for-the-same-index/290474)
**Author:** [@Saliinger](https://discuss.elastic.co/u/Saliinger)\ **Replies:** 0\ **Last updated:** [November 29, 2021, 5:40pm UTC](https://discuss.elastic.co/t/different-size-in-bytes-for-the-same-index/290474 "2021-11-29T17:40:50Z")
Hello! :slight\_smile: I'm trying to get the size in bytes of an individual document for each index I have. I'm using Index stats to get that information dividing the size\_of bytes with docs (total docs count). For exa… --- ## [Deploy an auto-scaling cluster in AWS Elastic Beanstalk](https://discuss.elastic.co/t/deploy-an-auto-scaling-cluster-in-aws-elastic-beanstalk/290467)
**Author:** [@gpribi](https://discuss.elastic.co/u/gpribi)\ **Replies:** 1\ **Last updated:** [November 29, 2021, 5:27pm UTC](https://discuss.elastic.co/t/deploy-an-auto-scaling-cluster-in-aws-elastic-beanstalk/290467 "2021-11-29T17:27:54Z")
Hi, I currently have a single-node production environment in AWS EC2 and having scaling issues, so I wanted to make the transition into a cluster. Since my user demand changes a lot during the day, I thought that a good … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1145) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1147)