# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1155

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1156

---

## [How can I turn off the security warning popup in kibana Discover UI](https://discuss.elastic.co/t/how-can-i-turn-off-the-security-warning-popup-in-kibana-discover-ui/289560)

<div class="topic-metadata">

**Author:** [@wabrit](https://discuss.elastic.co/u/wabrit)\
**Replies:** 2\
**Last updated:** [November 22, 2021, 11:44am UTC](https://discuss.elastic.co/t/how-can-i-turn-off-the-security-warning-popup-in-kibana-discover-ui/289560 "2021-11-22T11:44:14Z")

</div>

I'm running es/kibana 7.15.1 with security disabled in es, but the kibana discovery screen is unusable because of the constant appearance of these popups: Is there any way to turn them off?

---

## [Installation of metricbeat (any Beat)](https://discuss.elastic.co/t/installation-of-metricbeat-any-beat/289583)

<div class="topic-metadata">

**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\
**Replies:** 2\
**Last updated:** [November 22, 2021, 11:22am UTC](https://discuss.elastic.co/t/installation-of-metricbeat-any-beat/289583 "2021-11-22T11:22:44Z")

</div>

I have just installed 7.15 metric beat, but I do not like any of the defaults. Typically when running an msi you can choose all the configurables. How can I achieve the same for the beat installations. I am on windows…

---

## [Tuning search results for Kibana](https://discuss.elastic.co/t/tuning-search-results-for-kibana/288623)

<div class="topic-metadata">

**Author:** [@amcgrawRVA](https://discuss.elastic.co/u/amcgrawRVA)\
**Replies:** 1\
**Last updated:** [November 22, 2021, 11:14am UTC](https://discuss.elastic.co/t/tuning-search-results-for-kibana/288623 "2021-11-22T11:14:50Z")

</div>

I am a non-coder musicologist using Elastic to search and visualize a large music-related dataset. I would like to tune search on my full text fields. Tuning search is straightforward in app search and in the dev tools c…

---

## [Filebeat -\> logstash -\> elastic](https://discuss.elastic.co/t/filebeat-logstash-elastic/289469)

<div class="topic-metadata">

**Author:** [@alaine](https://discuss.elastic.co/u/alaine)\
**Replies:** 5\
**Last updated:** [November 22, 2021, 10:47am UTC](https://discuss.elastic.co/t/filebeat-logstash-elastic/289469 "2021-11-22T10:47:27Z")

</div>

I was using logstash to forward filebeat info (zeek and suricata) to the elastic cluster I manage. Filebeat is 7.12.0 and logstash and elastic are version 7.13.4. It was working without a problem until yesterday. I am n…

---

## [Order by dynamically by a field in bar chart](https://discuss.elastic.co/t/order-by-dynamically-by-a-field-in-bar-chart/289579)

<div class="topic-metadata">

**Author:** [@vikramdayma](https://discuss.elastic.co/u/vikramdayma)\
**Replies:** 3\
**Last updated:** [November 22, 2021, 10:42am UTC](https://discuss.elastic.co/t/order-by-dynamically-by-a-field-in-bar-chart/289579 "2021-11-22T10:42:22Z")

</div>

Hi, I Plot a bar chart in kibana visualization and I am showing multiple bar for multiple fields value in x-axis. I want to add filter and set order on chart based on any filed. Chat image is below. Any filter opti…

---

## [Filebeat 7.12 to output to multiple kafka topics](https://discuss.elastic.co/t/filebeat-7-12-to-output-to-multiple-kafka-topics/288056)

<div class="topic-metadata">

**Author:** [@itsec](https://discuss.elastic.co/u/itsec)\
**Replies:** 11\
**Last updated:** [November 22, 2021, 10:23am UTC](https://discuss.elastic.co/t/filebeat-7-12-to-output-to-multiple-kafka-topics/288056 "2021-11-22T10:23:15Z")

</div>

Hi, I'm on filebeat 7.12 (Centos7). How do i output to multiple topics Pls advise. filebeat: prospectors: - type: log enabled: true paths: -/opt/xssssss/log/xxx.txt close\_rename: true fields: document\_type: "x…

---

## [Kibana 7.15.2 Security Update](https://discuss.elastic.co/t/kibana-7-15-2-security-update/289788)

<div class="topic-metadata">

**Author:** [@Ilya\_Moskalev](https://discuss.elastic.co/u/Ilya_Moskalev)\
**Replies:** 4\
**Last updated:** [November 22, 2021, 9:24am UTC](https://discuss.elastic.co/t/kibana-7-15-2-security-update/289788 "2021-11-22T09:24:52Z")

</div>

Hello everyone! Tell me plz my kibana is affected by this vulnerability if it works on HTTPS and hosted on Linux security engineers want me to update kibana, but I do not want to recklessly update.

---

## [JDBC logging duplicate row](https://discuss.elastic.co/t/jdbc-logging-duplicate-row/289297)

<div class="topic-metadata">

**Author:** [@LinhNT1](https://discuss.elastic.co/u/LinhNT1)\
**Replies:** 3\
**Last updated:** [November 22, 2021, 8:46am UTC](https://discuss.elastic.co/t/jdbc-logging-duplicate-row/289297 "2021-11-22T08:46:02Z")

</div>

Hi there, I have a logtash with JDBC input like below jdbc { jdbc\_driver\_library =\> "${LOGSTASH\_JDBC\_DRIVER\_JAR\_LOCATION}" jdbc\_driver\_class =\> "${LOGSTASH\_JDBC\_DRIVER}" jdbc\_connection\_string =\>…

---

## [How to point out kibana to multiple elasticsearch cluster](https://discuss.elastic.co/t/how-to-point-out-kibana-to-multiple-elasticsearch-cluster/289780)

<div class="topic-metadata">

**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\
**Replies:** 1\
**Last updated:** [November 22, 2021, 8:31am UTC](https://discuss.elastic.co/t/how-to-point-out-kibana-to-multiple-elasticsearch-cluster/289780 "2021-11-22T08:31:57Z")

</div>

Hello team, We have 5 different kibana cluster with 5 different URL. We need one kibana URL like http://kibana.com/ and we need to change kibana URL like http://kibana.com/cluster1 http://kibana.com/cluster2 http://…

---

## [How to install custom plugin from s3 locations in Kubernetes Elasticsearch(ECK)?](https://discuss.elastic.co/t/how-to-install-custom-plugin-from-s3-locations-in-kubernetes-elasticsearch-eck/289781)

<div class="topic-metadata">

**Author:** [@manu\_john](https://discuss.elastic.co/u/manu_john)\
**Replies:** 0\
**Last updated:** [November 22, 2021, 8:11am UTC](https://discuss.elastic.co/t/how-to-install-custom-plugin-from-s3-locations-in-kubernetes-elasticsearch-eck/289781 "2021-11-22T08:11:52Z")

</div>

How to install a custom plugin from s3 locations in Kubernetes Elasticsearch(ECK)?

---

## [Logstsash is running pipelines in parallel](https://discuss.elastic.co/t/logstsash-is-running-pipelines-in-parallel/289614)

<div class="topic-metadata">

**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\
**Replies:** 4\
**Last updated:** [November 22, 2021, 8:15am UTC](https://discuss.elastic.co/t/logstsash-is-running-pipelines-in-parallel/289614 "2021-11-22T08:15:38Z")

</div>

Hello! I have a divided pipeline that generates 2 indices that enrich each other. I would like to know how I can make it do one etl first and when it finishes the other. my logstash filter wich enrichs has this filter…

---

## [Why we can not edit transform after creating](https://discuss.elastic.co/t/why-we-can-not-edit-transform-after-creating/289764)

<div class="topic-metadata">

**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\
**Replies:** 1\
**Last updated:** [November 22, 2021, 7:12am UTC](https://discuss.elastic.co/t/why-we-can-not-edit-transform-after-creating/289764 "2021-11-22T07:12:27Z")

</div>

Hi every body! I want to edit transform jobs after creation, but according to the Elasticsearch documents, we can edit only some restricted fields. is there a way to edit trasnform scripts? like group by section? or a…

---

## [Delete file in ruby filter logstash](https://discuss.elastic.co/t/delete-file-in-ruby-filter-logstash/289671)

<div class="topic-metadata">

**Author:** [@Hertz\_Drive](https://discuss.elastic.co/u/Hertz_Drive)\
**Replies:** 6\
**Last updated:** [November 22, 2021, 4:28am UTC](https://discuss.elastic.co/t/delete-file-in-ruby-filter-logstash/289671 "2021-11-22T04:28:53Z")

</div>

my code in ruby filter def register(params) print "heello ruby come in" end def filter(event) Dir.glob('/home/hz/COM.txt').each { |file| File.chmod(0777, file) File.delete(file) print(file) } #return…

---

## [Ignore\_malformed broken for geo\_shape](https://discuss.elastic.co/t/ignore-malformed-broken-for-geo-shape/289771)

<div class="topic-metadata">

**Author:** [@corndog](https://discuss.elastic.co/u/corndog)\
**Replies:** 4\
**Last updated:** [November 22, 2021, 3:48am UTC](https://discuss.elastic.co/t/ignore-malformed-broken-for-geo-shape/289771 "2021-11-22T03:48:49Z")

</div>

I have set mappings for my index as such: "geometry": { "type": "geo\_shape", "ignore\_malformed": true } When I Bulk POST documents, 1 fails due to malformed geometry. I have set the "ignore\_malformed" parameter…

---

## [Fetch 1M records using aggregation in a single call](https://discuss.elastic.co/t/fetch-1m-records-using-aggregation-in-a-single-call/289399)

<div class="topic-metadata">

**Author:** [@Sreejith\_Ms](https://discuss.elastic.co/u/Sreejith_Ms)\
**Replies:** 1\
**Last updated:** [November 22, 2021, 12:20am UTC](https://discuss.elastic.co/t/fetch-1m-records-using-aggregation-in-a-single-call/289399 "2021-11-22T00:20:57Z")

</div>

We have to create some reports based on nearly 100M data and its requires aggregation and the result will be nearly 5M records. So, Can I use Elasticsearch for this report generation and fetch up to 5M records in a sing…

---

## [Lifecycle error](https://discuss.elastic.co/t/lifecycle-error/289533)

<div class="topic-metadata">

**Author:** [@mrchile](https://discuss.elastic.co/u/mrchile)\
**Replies:** 0\
**Last updated:** [November 18, 2021, 6:48am UTC](https://discuss.elastic.co/t/lifecycle-error/289533 "2021-11-18T06:48:33Z")

</div>

No rollover info found for \[name\_index-%{+YYYY.MM.dd}-000001\] with rollover target \[index-alias\], the index has not yet rolled over with that target. The next day I get this error. On the first day of operation, no error…

---

## [Changing Unique Key of Elastic Search Index (Id column)](https://discuss.elastic.co/t/changing-unique-key-of-elastic-search-index-id-column/289582)

<div class="topic-metadata">

**Author:** [@amey\_kulkarni](https://discuss.elastic.co/u/amey_kulkarni)\
**Replies:** 1\
**Last updated:** [November 22, 2021, 12:12am UTC](https://discuss.elastic.co/t/changing-unique-key-of-elastic-search-index-id-column/289582 "2021-11-22T00:12:05Z")

</div>

We have a requirement to set value of id column (unique key) of an index to values coming from data (values of couple of columns from data). Id column value is set for each document by default. We want to override it wi…

---

## [ERROR: policy for index failed on step \[{"phase":"hot","action":"rollover","name":"check-rollover-ready"}\]](https://discuss.elastic.co/t/error-policy-for-index-failed-on-step-phase-hot-action-rollover-name-check-rollover-ready/289676)

<div class="topic-metadata">

**Author:** [@marti1](https://discuss.elastic.co/u/marti1)\
**Replies:** 0\
**Last updated:** [November 19, 2021, 10:49am UTC](https://discuss.elastic.co/t/error-policy-for-index-failed-on-step-phase-hot-action-rollover-name-check-rollover-ready/289676 "2021-11-19T10:49:35Z")

</div>

Hi, I just set up a new cluster, and I'm getting this error. Timestamp Level Type Message Component November 19, 2021 10:32:57 AM INFO Server policy \[metricbeat\] for index \[metricbeat-7.15.2-2021.11.18-000001\] …

---

## [Kibana space port based](https://discuss.elastic.co/t/kibana-space-port-based/289690)

<div class="topic-metadata">

**Author:** [@franckfct](https://discuss.elastic.co/u/franckfct)\
**Replies:** 1\
**Last updated:** [November 22, 2021, 12:06am UTC](https://discuss.elastic.co/t/kibana-space-port-based/289690 "2021-11-22T00:06:33Z")

</div>

Hi, Is it possible to specify a port per space For example: http://url:5601/ =\> Default space http://url:5602/ =\> IT space http://url:5603/ =\> HR space etc ... In Kibana or maybe in the web server Thanks

---

## [Kibana a new nodes does not get listed but the total number of nodes is correct](https://discuss.elastic.co/t/kibana-a-new-nodes-does-not-get-listed-but-the-total-number-of-nodes-is-correct/289736)

<div class="topic-metadata">

**Author:** [@luigius](https://discuss.elastic.co/u/luigius)\
**Replies:** 0\
**Last updated:** [November 20, 2021, 5:55am UTC](https://discuss.elastic.co/t/kibana-a-new-nodes-does-not-get-listed-but-the-total-number-of-nodes-is-correct/289736 "2021-11-20T05:55:16Z")

</div>

Hi, I added a new node to an elastic cluster with a master node (hot) and a warm node. The cluster status is green and shows 3 nodes. Elastic is on all machine 7.15.2 the nodes are monitor (master hot), monitor-1 (wa…

---

## [Persisting latest state in separated index](https://discuss.elastic.co/t/persisting-latest-state-in-separated-index/289628)

<div class="topic-metadata">

**Author:** [@nestor1](https://discuss.elastic.co/u/nestor1)\
**Replies:** 1\
**Last updated:** [November 21, 2021, 11:39pm UTC](https://discuss.elastic.co/t/persisting-latest-state-in-separated-index/289628 "2021-11-21T23:39:30Z")

</div>

I have stream of data like this: userid: 1, taskid: 1, start\_time: 01:00:00, completed: 10 userid: 1, taskid: 1, start\_time: 02:00:00, completed: 30 userid: 1, taskid: 1, start\_time: 03:00:00, completed: 70 userid: 1, t…

---

## [Metric beats and WMI](https://discuss.elastic.co/t/metric-beats-and-wmi/289063)

<div class="topic-metadata">

**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\
**Replies:** 5\
**Last updated:** [November 21, 2021, 10:09pm UTC](https://discuss.elastic.co/t/metric-beats-and-wmi/289063 "2021-11-21T22:09:12Z")

</div>

It has been suggested that it is possible to configure beats to collect data based on a WMI query. Is this true, and if so is there any useful documentation that you might be able to point me towards? thanks

---

## [Configuring SSL with Letsencrypt and sym links](https://discuss.elastic.co/t/configuring-ssl-with-letsencrypt-and-sym-links/289241)

<div class="topic-metadata">

**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\
**Replies:** 8\
**Last updated:** [November 21, 2021, 8:30pm UTC](https://discuss.elastic.co/t/configuring-ssl-with-letsencrypt-and-sym-links/289241 "2021-11-21T20:30:47Z")

</div>

I am setting up and Elasticsearch server on a system that uses letsencrypt certificates. The certificates and keys live under /etc/letsencrypt. There are several applications that need to access those key and rather th…

---

## [Changed layout of coordinates (geopoint) after upgrade 7.10 to 7.15](https://discuss.elastic.co/t/changed-layout-of-coordinates-geopoint-after-upgrade-7-10-to-7-15/287365)

<div class="topic-metadata">

**Author:** [@tjswe](https://discuss.elastic.co/u/tjswe)\
**Replies:** 5\
**Last updated:** [November 21, 2021, 5:57pm UTC](https://discuss.elastic.co/t/changed-layout-of-coordinates-geopoint-after-upgrade-7-10-to-7-15/287365 "2021-11-21T17:57:11Z")

</div>

Hi! Did an upgrade of the ELK-stack from 7.10 to 7.15 and in that jump the format of coordinates in Kibana changed Previously it was just like any other field in the discovery view location : 11.111 , 22.222 now it…

---

## [Not able to upload file in elastic cloud](https://discuss.elastic.co/t/not-able-to-upload-file-in-elastic-cloud/289759)

<div class="topic-metadata">

**Author:** [@anju\_rawat](https://discuss.elastic.co/u/anju_rawat)\
**Replies:** 2\
**Last updated:** [November 21, 2021, 4:25pm UTC](https://discuss.elastic.co/t/not-able-to-upload-file-in-elastic-cloud/289759 "2021-11-21T16:25:09Z")

</div>

I was trying to upload csv & json file in kibana but in both case getting same error. Please refere below attached picture for reference.

---

## [MONGODB | Error checking \<IP\>:\<PORT\>: Mongo::Error::MaxMessageSize: Message exceeds allowed max message size. The max is 50331648](https://discuss.elastic.co/t/mongodb-error-checking-ip-port-mongo-message-exceeds-allowed-max-message-size-the-max-is-50331648/289750)

<div class="topic-metadata">

**Author:** [@Bugsbee](https://discuss.elastic.co/u/Bugsbee)\
**Replies:** 2\
**Last updated:** [November 21, 2021, 2:18am UTC](https://discuss.elastic.co/t/mongodb-error-checking-ip-port-mongo-message-exceeds-allowed-max-message-size-the-max-is-50331648/289750 "2021-11-21T02:18:54Z")

</div>

hello, any idea as to why i get the error below? my ELK has been working on. its just today i chnaged he password.. and nothing else. however this time when i start elk , i get the error below anything else i need t…

---

## [Questions about using must, should words together and Turkish char problem](https://discuss.elastic.co/t/questions-about-using-must-should-words-together-and-turkish-char-problem/289755)

<div class="topic-metadata">

**Author:** [@aox](https://discuss.elastic.co/u/aox)\
**Replies:** 1\
**Last updated:** [November 20, 2021, 9:06pm UTC](https://discuss.elastic.co/t/questions-about-using-must-should-words-together-and-turkish-char-problem/289755 "2021-11-20T21:06:05Z")

</div>

Hello I am using Elasticsearch-oss-7.10.2-1.x86\_64. I have 2 questions: Question 1) I want to combine this query results: GET /turkish\_example/\_search { "query": { "bool": { "should": \[ { "simple\_q…

---

## [How much clusters must I use in elastic stack?](https://discuss.elastic.co/t/how-much-clusters-must-i-use-in-elastic-stack/289735)

<div class="topic-metadata">

**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\
**Replies:** 1\
**Last updated:** [November 20, 2021, 7:10pm UTC](https://discuss.elastic.co/t/how-much-clusters-must-i-use-in-elastic-stack/289735 "2021-11-20T19:10:27Z")

</div>

I am confused which approach would be better having single cluster with 12 nodes or having 3 cluster with 4 nodes each in elastic stack. What are the advantages and disadvantages of single cluster? Does elastic charge me…

---

## [Documents are getting duplicated in mongodb](https://discuss.elastic.co/t/documents-are-getting-duplicated-in-mongodb/289745)

<div class="topic-metadata">

**Author:** [@Husnain](https://discuss.elastic.co/u/Husnain)\
**Replies:** 0\
**Last updated:** [November 20, 2021, 3:37pm UTC](https://discuss.elastic.co/t/documents-are-getting-duplicated-in-mongodb/289745 "2021-11-20T15:37:26Z")

</div>

Hi, I am trying to fetch data from mysql using logstash and storing them into Elasticsearch and mongodb.Document is getting stored in Elasticsearch properly and no duplicate documents are inserted,but in mongodb same do…

---

## [FIleBeat not pushing few lines to Logstash](https://discuss.elastic.co/t/filebeat-not-pushing-few-lines-to-logstash/289011)

<div class="topic-metadata">

**Author:** [@nandatibco](https://discuss.elastic.co/u/nandatibco)\
**Replies:** 3\
**Last updated:** [November 20, 2021, 3:30pm UTC](https://discuss.elastic.co/t/filebeat-not-pushing-few-lines-to-logstash/289011 "2021-11-20T15:30:05Z")

</div>

File beat is not pushing all lines in a file to Logstash, and it is not consistent, it skips 3 lines in between. Im new to File Beat, please suggest if I missed any configuration. For example, my log file looks like thi…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1154)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1156)
