# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1172 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1173 --- ## [Text not stemmed after inserted in the index with language specific analyzer](https://discuss.elastic.co/t/text-not-stemmed-after-inserted-in-the-index-with-language-specific-analyzer/288645)
**Author:** [@makons](https://discuss.elastic.co/u/makons)\ **Replies:** 0\ **Last updated:** [November 8, 2021, 2:52pm UTC](https://discuss.elastic.co/t/text-not-stemmed-after-inserted-in-the-index-with-language-specific-analyzer/288645 "2021-11-08T14:52:12Z")
I have 2 fields in my index, one containing the standardly analyzed content, while the other one uses a german analyzer. However, when I insert documents, they don't seem to be stemmed at all, even though they should be … --- ## [How to run heartbeat in detached (non-interactive) mode](https://discuss.elastic.co/t/how-to-run-heartbeat-in-detached-non-interactive-mode/287601)
**Author:** [@SUMANT\_MISHRA](https://discuss.elastic.co/u/SUMANT_MISHRA)\ **Replies:** 3\ **Last updated:** [November 8, 2021, 2:47pm UTC](https://discuss.elastic.co/t/how-to-run-heartbeat-in-detached-non-interactive-mode/287601 "2021-11-08T14:47:19Z")
Hi, I have installed heartbeat in a virtual machine in Azure Portal. I am trying to start the heartbeat from my system terminal using SSH. But if I close my terminal it stops the heartbeat that's running in my remote vi… --- ## [Aggregate bucket values with SUM](https://discuss.elastic.co/t/aggregate-bucket-values-with-sum/288146)
**Author:** [@tds21](https://discuss.elastic.co/u/tds21)\ **Replies:** 1\ **Last updated:** [November 8, 2021, 1:42pm UTC](https://discuss.elastic.co/t/aggregate-bucket-values-with-sum/288146 "2021-11-08T13:42:34Z")
HI :slight\_smile: I'm new to elastic, and based on a reqeust constructed by a visualization on Kibana along with few tips, built query aggregates a 'policy' key \> 'device' (or devices) it's on - and groups the values b… --- ## [Character filter analyzer not working](https://discuss.elastic.co/t/character-filter-analyzer-not-working/288531)
**Author:** [@Kevin\_Juliano](https://discuss.elastic.co/u/Kevin_Juliano)\ **Replies:** 1\ **Last updated:** [November 8, 2021, 1:28pm UTC](https://discuss.elastic.co/t/character-filter-analyzer-not-working/288531 "2021-11-08T13:28:52Z")
Hi! I have a special character analyzer, but for some reason, I am not getting the result I want. Here are my configurations: ANALYZER: { index: "my\_idx", body: { settings: { … --- ## [Defined ILM policy not working](https://discuss.elastic.co/t/defined-ilm-policy-not-working/288302)
**Author:** [@Psyhil](https://discuss.elastic.co/u/Psyhil)\ **Replies:** 4\ **Last updated:** [November 8, 2021, 12:20pm UTC](https://discuss.elastic.co/t/defined-ilm-policy-not-working/288302 "2021-11-08T12:20:45Z")
Hi All, I hope are doing well! We are running Elastic 7.15 version with a single node. Currently the data in our winlogbeat index is all dated from back February 2021 hence we defined an ILM policy as below though ple… --- ## [Kibana server not ready after update to 7.15](https://discuss.elastic.co/t/kibana-server-not-ready-after-update-to-7-15/286509)
**Author:** [@someone83](https://discuss.elastic.co/u/someone83)\ **Replies:** 5\ **Last updated:** [November 8, 2021, 12:13pm UTC](https://discuss.elastic.co/t/kibana-server-not-ready-after-update-to-7-15/286509 "2021-11-08T12:13:55Z")
I upgraded my ELK-Stack from 7.14 to 7.15. There are two Elasticsearch nodes (1 hot / 1 warm) and a kibana server. From the kibana server on the web-interface i get just the message "Kibana server is not ready yet" and… --- ## [TSVB Metric from the difference between avg value from two time intervals](https://discuss.elastic.co/t/tsvb-metric-from-the-difference-between-avg-value-from-two-time-intervals/288570)
**Author:** [@alejandrosl](https://discuss.elastic.co/u/alejandrosl)\ **Replies:** 3\ **Last updated:** [November 8, 2021, 10:46am UTC](https://discuss.elastic.co/t/tsvb-metric-from-the-difference-between-avg-value-from-two-time-intervals/288570 "2021-11-08T10:46:54Z")
Hi there !!! I'm currently trying to make a "metric" TSVB that show the difference between of average of same field in two diferentes time intervals... For example, we have a numeric field called "value\_before", we get… --- ## [UseConcMarkSweepGC error - cannot start ElasticSearch](https://discuss.elastic.co/t/useconcmarksweepgc-error-cannot-start-elasticsearch/288616)
**Author:** [@TVRV8S](https://discuss.elastic.co/u/TVRV8S)\ **Replies:** 0\ **Last updated:** [November 8, 2021, 10:42am UTC](https://discuss.elastic.co/t/useconcmarksweepgc-error-cannot-start-elasticsearch/288616 "2021-11-08T10:42:00Z")
I posted a question on Stack Overflow but perhaps it's better here. https://stackoverflow.com/questions/69875937/elasticsearch-windows-2016-hosted-server-useconcmarksweepgc-error I downloaded the Elasticsearch ZIP and … --- ## [Updating old 6.x index pattern to use newer mapping requirments](https://discuss.elastic.co/t/updating-old-6-x-index-pattern-to-use-newer-mapping-requirments/286776)
**Author:** [@hueyg](https://discuss.elastic.co/u/hueyg)\ **Replies:** 5\ **Last updated:** [November 8, 2021, 10:10am UTC](https://discuss.elastic.co/t/updating-old-6-x-index-pattern-to-use-newer-mapping-requirments/286776 "2021-11-08T10:10:56Z")
I have an ELK cluster which I have upgraded over time from early 6.x days. Focused on resolving other issues, but somewhere along the 7.x releases my old mapping broke. This was for a host that was pushing via filebeat… --- ## [Webhook watcher action timeout](https://discuss.elastic.co/t/webhook-watcher-action-timeout/288613)
**Author:** [@gissavem](https://discuss.elastic.co/u/gissavem)\ **Replies:** 0\ **Last updated:** [November 8, 2021, 10:02am UTC](https://discuss.elastic.co/t/webhook-watcher-action-timeout/288613 "2021-11-08T10:02:49Z")
Hi! I am trying to set up a Watcher to create incidents when our applications throw errors. The watcher I've set up looks through our logs for errors and when we hit any I send a webhook request to BetterUptime to crea… --- ## [User with manage\_own\_api\_key - Best Practices (Security)](https://discuss.elastic.co/t/user-with-manage-own-api-key-best-practices-security/288559)
**Author:** [@inf](https://discuss.elastic.co/u/inf)\ **Replies:** 4\ **Last updated:** [November 8, 2021, 9:05am UTC](https://discuss.elastic.co/t/user-with-manage-own-api-key-best-practices-security/288559 "2021-11-08T09:05:09Z")
Hi, I have been using the default elastic user to create API keys. However, I do not think that this is a good security practice (please correct me if I'm wrong). Hence, I'm not sure how do others normally create API … --- ## [Logstash TCP Input with SSL failing with non descript error](https://discuss.elastic.co/t/logstash-tcp-input-with-ssl-failing-with-non-descript-error/288312)
**Author:** [@AlanMark](https://discuss.elastic.co/u/AlanMark)\ **Replies:** 14\ **Last updated:** [November 8, 2021, 8:23am UTC](https://discuss.elastic.co/t/logstash-tcp-input-with-ssl-failing-with-non-descript-error/288312 "2021-11-08T08:23:20Z")
I'm trying to set up a TCP Input with an SSL certificate, but no matter how I configure it, i keep getting a non descript error. This is running on Logstash 7.9.1 OSS. My config is the following: input { tcp {… --- ## [Dynamic field type in template](https://discuss.elastic.co/t/dynamic-field-type-in-template/288568)
**Author:** [@anna.kuranda](https://discuss.elastic.co/u/anna.kuranda)\ **Replies:** 3\ **Last updated:** [November 8, 2021, 6:17am UTC](https://discuss.elastic.co/t/dynamic-field-type-in-template/288568 "2021-11-08T06:17:04Z")
I use template and alias to manage my insert data The issue : I have field that have different types , so I failed on field type inconsistency the field can be of String type or Nested JSON Object For example : St… --- ## [Install Logstash 7.13](https://discuss.elastic.co/t/install-logstash-7-13/288358)
**Author:** [@Nikparab](https://discuss.elastic.co/u/Nikparab)\ **Replies:** 4\ **Last updated:** [November 8, 2021, 6:14am UTC](https://discuss.elastic.co/t/install-logstash-7-13/288358 "2021-11-08T06:14:15Z")
I have aws opensearch cluster of version 1.0 I want to send the logs to this cluster using logstash. But when we install the logstash it install the latest version of logstash and which is not supported by opensearch … --- ## [Will Elasticsearch optimize dsl query?](https://discuss.elastic.co/t/will-elasticsearch-optimize-dsl-query/288588)
**Author:** [@CHU\_XU](https://discuss.elastic.co/u/CHU_XU)\ **Replies:** 0\ **Last updated:** [November 8, 2021, 6:07am UTC](https://discuss.elastic.co/t/will-elasticsearch-optimize-dsl-query/288588 "2021-11-08T06:07:06Z")
Hi there, I have a program to convert some text into Elasticsearch dsl query. For some reasons it generates complex bool query which somethimes is actually can be simplified, for example: { "query":{ "bool"… --- ## [Kibana Import Objects API](https://discuss.elastic.co/t/kibana-import-objects-api/288383)
**Author:** [@Ryan\_Clark](https://discuss.elastic.co/u/Ryan_Clark)\ **Replies:** 2\ **Last updated:** [November 8, 2021, 5:40am UTC](https://discuss.elastic.co/t/kibana-import-objects-api/288383 "2021-11-08T05:40:15Z")
Hi, I'm trying to write a powershell script to import some saved objects I have created and exported from Kibana. I can get this to work just fine on linux using curl: curl -X POST "http://myserver:5601/api/saved\_obje… --- ## [How do I use fileBeat filter to filter network logs that receive Rsyslog](https://discuss.elastic.co/t/how-do-i-use-filebeat-filter-to-filter-network-logs-that-receive-rsyslog/288582)
**Author:** [@shuijinglan](https://discuss.elastic.co/u/shuijinglan)\ **Replies:** 0\ **Last updated:** [November 8, 2021, 4:05am UTC](https://discuss.elastic.co/t/how-do-i-use-filebeat-filter-to-filter-network-logs-that-receive-rsyslog/288582 "2021-11-08T04:05:01Z")
My network device logs point to Rsyslog, fileBeat to Rsyslog pull logs output to Elasticsearch, in Kibana display, I now want to use fileBeat filter to filter log files output to Elasticsearch.I haven't filtered it be… --- ## [Need to filter metrics from clusters which its being sent from](https://discuss.elastic.co/t/need-to-filter-metrics-from-clusters-which-its-being-sent-from/287260)
**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\ **Replies:** 3\ **Last updated:** [November 8, 2021, 1:36am UTC](https://discuss.elastic.co/t/need-to-filter-metrics-from-clusters-which-its-being-sent-from/287260 "2021-11-08T01:36:20Z")
Hi, Current situation is all logs from different cluster are mixed in the same index. We are using metric beats which is running as daemon sets in a cluster. We need same dashboards where we could list out the clusters… --- ## [Should I store user id or name in logging?](https://discuss.elastic.co/t/should-i-store-user-id-or-name-in-logging/288460)
**Author:** [@buaaytt](https://discuss.elastic.co/u/buaaytt)\ **Replies:** 2\ **Last updated:** [November 8, 2021, 12:23am UTC](https://discuss.elastic.co/t/should-i-store-user-id-or-name-in-logging/288460 "2021-11-08T00:23:10Z")
A common scenario in logging is the need to store the backend user performing the logging action. So using ES should I store the user id or its username in the document? After all, when retrieving logs, I need to return … --- ## [Kibana 7.1 No Lens / Canvas](https://discuss.elastic.co/t/kibana-7-1-no-lens-canvas/288576)
**Author:** [@Glenn\_Pauling](https://discuss.elastic.co/u/Glenn_Pauling)\ **Replies:** 3\ **Last updated:** [November 8, 2021, 12:22am UTC](https://discuss.elastic.co/t/kibana-7-1-no-lens-canvas/288576 "2021-11-08T00:22:12Z")
Hello, We recently upgraded to Kibana 7.1 by downloading install file provided by Oracle (for Peoplesoft). Peoplesoft now is integrated with Kibana, so many new companies are starting to use this product. I've done … --- ## [Talk to server... ERROR 401 Unauthorized: Unauthorized](https://discuss.elastic.co/t/talk-to-server-error-401-unauthorized-unauthorized/288469)
**Author:** [@nasirnjs](https://discuss.elastic.co/u/nasirnjs)\ **Replies:** 1\ **Last updated:** [November 8, 2021, 12:03am UTC](https://discuss.elastic.co/t/talk-to-server-error-401-unauthorized-unauthorized/288469 "2021-11-08T00:03:07Z")
Hi Experts assist me please .... after install Wazuh I have added agent, when I click agent there is no log showing. Elasticsearch: https://127.0.0.1:9200... parse url... OK connection... parse host... OK dns lookup… --- ## [X of y shards failed](https://discuss.elastic.co/t/x-of-y-shards-failed/285559)
**Author:** [@Noursh](https://discuss.elastic.co/u/Noursh)\ **Replies:** 6\ **Last updated:** [November 7, 2021, 11:55pm UTC](https://discuss.elastic.co/t/x-of-y-shards-failed/285559 "2021-11-07T23:55:45Z")
Type: es\_rejected\_execution\_exception Reason: rejected execution of org.Elasticsearch.common.util.concurrent.TimedRunnable@5ec3e8 on QueueResizingEsThreadPoolExecutor I had monitored the CPU and RAM and all the metrics… --- ## [Logging into Elasticsearch](https://discuss.elastic.co/t/logging-into-elasticsearch/288535)
**Author:** [@SteveP](https://discuss.elastic.co/u/SteveP)\ **Replies:** 5\ **Last updated:** [November 7, 2021, 8:35pm UTC](https://discuss.elastic.co/t/logging-into-elasticsearch/288535 "2021-11-07T20:35:19Z")
Hello all, I have created a single node ES system, as a way to ingest security data from my firewall. As part of this I need to configure the security plugin on my firewall to login to ES and setup it’s data indices. I… --- ## [Filebeat failed to publish events: temporary bulk send failure](https://discuss.elastic.co/t/filebeat-failed-to-publish-events-temporary-bulk-send-failure/288566)
**Author:** [@cdalexndr](https://discuss.elastic.co/u/cdalexndr)\ **Replies:** 1\ **Last updated:** [November 7, 2021, 4:34pm UTC](https://discuss.elastic.co/t/filebeat-failed-to-publish-events-temporary-bulk-send-failure/288566 "2021-11-07T16:34:56Z")
Filebeat 7.14.1 is stuck in a log loop with failed to publish events: temporary bulk send failure. Turning debug log, it shows: filebeat | 2021-11-07T15:57:49.938Z INFO \[publisher\_pipeline\_output\] pipeline/o… --- ## [No "PDF Reports" and "PNG Reports" options](https://discuss.elastic.co/t/no-pdf-reports-and-png-reports-options/288564)
**Author:** [@victor.you](https://discuss.elastic.co/u/victor.you)\ **Replies:** 1\ **Last updated:** [November 7, 2021, 3:58pm UTC](https://discuss.elastic.co/t/no-pdf-reports-and-png-reports-options/288564 "2021-11-07T15:58:35Z")
Hi, all I wanna to report my dashboard in PDF format, but there's no "PDF Reports" and "PNG Reports" options in share menu. My kibana instance is in docker container using image : "docker.elastic.co/elasticsearch/elas… --- ## [Filebeat vs Kinesis agent](https://discuss.elastic.co/t/filebeat-vs-kinesis-agent/288550)
**Author:** [@Nehray](https://discuss.elastic.co/u/Nehray)\ **Replies:** 2\ **Last updated:** [November 6, 2021, 10:35pm UTC](https://discuss.elastic.co/t/filebeat-vs-kinesis-agent/288550 "2021-11-06T22:35:38Z")
Hi all, I am very new to Elasticsearch. I am looking ways to ingest logs into ES. I am looking for answers why should I choose between filebeat vs Kinesis agent. --- ## [Bug on logstash input for gz files](https://discuss.elastic.co/t/bug-on-logstash-input-for-gz-files/288547)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 0\ **Last updated:** [November 6, 2021, 7:05pm UTC](https://discuss.elastic.co/t/bug-on-logstash-input-for-gz-files/288547 "2021-11-06T19:05:42Z")
Hi I've observed that logstash with input plugin doesn't proceed in the correct way gz files in sincedb. I saw that logstash doesn't put all logs info to sincedb but only the header without names. If I have restarted lo… --- ## [Is timestamp field also indexed while storing time siries data like logs into an index?](https://discuss.elastic.co/t/is-timestamp-field-also-indexed-while-storing-time-siries-data-like-logs-into-an-index/288438)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 2\ **Last updated:** [November 6, 2021, 7:52pm UTC](https://discuss.elastic.co/t/is-timestamp-field-also-indexed-while-storing-time-siries-data-like-logs-into-an-index/288438 "2021-11-06T19:52:41Z")
Is timestamp field in a logentry of logfile also indexed (ie, made searchable by means of inverted index data structure) while storing time series data like logs into an index/data stream, provided we are not explicitly… --- ## [If the intended value itself contains the 'field split', can we use kv processor?](https://discuss.elastic.co/t/if-the-intended-value-itself-contains-the-field-split-can-we-use-kv-processor/288540)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 6\ **Last updated:** [November 6, 2021, 7:51pm UTC](https://discuss.elastic.co/t/if-the-intended-value-itself-contains-the-field-split-can-we-use-kv-processor/288540 "2021-11-06T19:51:29Z")
The following sample log entry , is in the form of key=value pairs action="blocked" direction="outgoing" msg="from ip is in blocklist" proto=6 I have tried the following kv processor in ingest pipeline for the log e… --- ## [How to make logstash to automatically detect new pipleines configuration and execute them?](https://discuss.elastic.co/t/how-to-make-logstash-to-automatically-detect-new-pipleines-configuration-and-execute-them/288541)
**Author:** [@Husnain](https://discuss.elastic.co/u/Husnain)\ **Replies:** 4\ **Last updated:** [November 6, 2021, 7:06pm UTC](https://discuss.elastic.co/t/how-to-make-logstash-to-automatically-detect-new-pipleines-configuration-and-execute-them/288541 "2021-11-06T19:06:47Z")
Hii.I am using logstash to ingest data from four different data sources from i.e Elasticsearch,mongodb,textfile and mysql.My requirement is,that I will specify a directory path and logstash will read pipeline configurati… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1171) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1173)