# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1184 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1185 --- ## [Date range values of urltemplate throws rison error](https://discuss.elastic.co/t/date-range-values-of-urltemplate-throws-rison-error/286573)
**Author:** [@Prathibha\_Y](https://discuss.elastic.co/u/Prathibha_Y)\ **Replies:** 1\ **Last updated:** [October 27, 2021, 5:47pm UTC](https://discuss.elastic.co/t/date-range-values-of-urltemplate-throws-rison-error/286573 "2021-10-27T17:47:16Z")
Hi trying to use urltemplate variables for date range but getting rison decode error, am I doing it right ? This is the error rison decoder error: missing ':' version Kibana 7.10.0 - oss This is the url app/dashboa… --- ## [Highlights not generated for certain Fuzzy & Wildcard Phrase match queries using Span](https://discuss.elastic.co/t/highlights-not-generated-for-certain-fuzzy-wildcard-phrase-match-queries-using-span/287815)
**Author:** [@maurice](https://discuss.elastic.co/u/maurice)\ **Replies:** 1\ **Last updated:** [October 27, 2021, 5:46pm UTC](https://discuss.elastic.co/t/highlights-not-generated-for-certain-fuzzy-wildcard-phrase-match-queries-using-span/287815 "2021-10-27T17:46:39Z")
Hey everybody, I'm running into an issue with highlights not being generated for certain phrase match queries using wildcards or fuzzy matching with spans. Included below are steps for test replication from Kibana. Ela… --- ## [Ship logs from AWS Cloudwatch log group to Opendistro Elasticsearch 7.10.2](https://discuss.elastic.co/t/ship-logs-from-aws-cloudwatch-log-group-to-opendistro-elasticsearch-7-10-2/287464)
**Author:** [@Jijo\_Johny](https://discuss.elastic.co/u/Jijo_Johny)\ **Replies:** 2\ **Last updated:** [October 27, 2021, 5:30pm UTC](https://discuss.elastic.co/t/ship-logs-from-aws-cloudwatch-log-group-to-opendistro-elasticsearch-7-10-2/287464 "2021-10-27T17:30:45Z")
Is there a way to ship logs from AWS Cloudwatch log group to Opendistro EFK? I am using opendistro which has the Elasticsearch version 7.10.2, that has been provisioned using helm in an EKS cluster. I tried with function… --- ## [Completion suggester returning non-deterministic results?](https://discuss.elastic.co/t/completion-suggester-returning-non-deterministic-results/287834)
**Author:** [@tallison](https://discuss.elastic.co/u/tallison)\ **Replies:** 0\ **Last updated:** [October 27, 2021, 5:02pm UTC](https://discuss.elastic.co/t/completion-suggester-returning-non-deterministic-results/287834 "2021-10-27T17:02:20Z")
When I run a completion suggester I'm getting different results each time I send the same query over the same static data. I realize that this may be an optimization for search...because users don't always need all the … --- ## [Kibana : Unable to authenticate user \[\] for REST request after deleting logs](https://discuss.elastic.co/t/kibana-unable-to-authenticate-user-for-rest-request-after-deleting-logs/287781)
**Author:** [@Leviath](https://discuss.elastic.co/u/Leviath)\ **Replies:** 1\ **Last updated:** [October 27, 2021, 4:37pm UTC](https://discuss.elastic.co/t/kibana-unable-to-authenticate-user-for-rest-request-after-deleting-logs/287781 "2021-10-27T16:37:42Z")
Hello everyone, I'm new to elastic and I can't connect Kibana to Elasticsearch anymore. Whenever I try to connect, i get "kibana is not ready yet" and : {"type":"log","@timestamp":"2021-10-27T11:06:16+02:00","tags":\["… --- ## [Postfix Dashboards visualization](https://discuss.elastic.co/t/postfix-dashboards-visualization/287731)
**Author:** [@pi314](https://discuss.elastic.co/u/pi314)\ **Replies:** 1\ **Last updated:** [October 27, 2021, 4:36pm UTC](https://discuss.elastic.co/t/postfix-dashboards-visualization/287731 "2021-10-27T16:36:03Z")
Hello everyone! i'm newie with ELK, my question is from a dummy person and I need some compassion :sweat\_smile: I install in a virtual machine with Ubuntu 20.04, Postfix, Logstash, Kibana and Elastic. I follow the next… --- ## [Aggregation: unique count grouped by combination of field value](https://discuss.elastic.co/t/aggregation-unique-count-grouped-by-combination-of-field-value/287431)
**Author:** [@ismarslomic](https://discuss.elastic.co/u/ismarslomic)\ **Replies:** 2\ **Last updated:** [October 27, 2021, 4:30pm UTC](https://discuss.elastic.co/t/aggregation-unique-count-grouped-by-combination-of-field-value/287431 "2021-10-27T16:30:32Z")
Given following documents (simplified) in an index: { "vehicle": "A", "source": "foo" } { "vehicle": "A", "source": "bar" } { "vehicle": "A", "source": "foo" } { "vehicle": "B", "source": "foo" } { "ve… --- ## [Logstash pipeline stalling without any error](https://discuss.elastic.co/t/logstash-pipeline-stalling-without-any-error/287274)
**Author:** [@Stephy](https://discuss.elastic.co/u/Stephy)\ **Replies:** 8\ **Last updated:** [October 27, 2021, 4:27pm UTC](https://discuss.elastic.co/t/logstash-pipeline-stalling-without-any-error/287274 "2021-10-27T16:27:47Z")
Hello, We have a Logstash pipeline (using the official elastic.co Docker Image v7.9.3) running with a JDBC input plugin and Elasticsearch output. Pipeline is set to run with a schedule every 1 minute (\* \* \* \* \*). The in… --- ## [What are the differences between \`xpack.security.http.ssl.enabled\` and \`xpack.security.transport.ssl.enabled\`](https://discuss.elastic.co/t/what-are-the-differences-between-xpack-security-http-ssl-enabled-and-xpack-security-transport-ssl-enabled/287757)
**Author:** [@QiaolingTang](https://discuss.elastic.co/u/QiaolingTang)\ **Replies:** 3\ **Last updated:** [October 27, 2021, 4:24pm UTC](https://discuss.elastic.co/t/what-are-the-differences-between-xpack-security-http-ssl-enabled-and-xpack-security-transport-ssl-enabled/287757 "2021-10-27T16:24:04Z")
I'm trying to configure xpack on my ES cluster, when I read the document, for the xpack.security.http.ssl.enabled and xpack.security.transport.ssl.enabled, both of them are Used to enable or disable TLS/SSL., but I can't… --- ## [Problem with word wrapping in Expanded document](https://discuss.elastic.co/t/problem-with-word-wrapping-in-expanded-document/287648)
**Author:** [@mirekchk](https://discuss.elastic.co/u/mirekchk)\ **Replies:** 1\ **Last updated:** [October 27, 2021, 4:21pm UTC](https://discuss.elastic.co/t/problem-with-word-wrapping-in-expanded-document/287648 "2021-10-27T16:21:44Z")
I have problem with word wrapping in Expanded document (viz image) in Kibana v 7.15.0 (in 7.14.1 it is OK). Field name is wrapping and user have problems in investigation. Is any solution for this pls? --- ## [No config files found in path {:path=\>"C:/logstash-7.15.1/bin/logstash.conf"}](https://discuss.elastic.co/t/no-config-files-found-in-path-path-c-logstash-7-15-1-bin-logstash-conf/287770)
**Author:** [@lalatenduswain](https://discuss.elastic.co/u/lalatenduswain)\ **Replies:** 2\ **Last updated:** [October 27, 2021, 4:15pm UTC](https://discuss.elastic.co/t/no-config-files-found-in-path-path-c-logstash-7-15-1-bin-logstash-conf/287770 "2021-10-27T16:15:35Z")
\[2021-10-27T11:13:19,509\]\[INFO \]\[logstash.config.source.local.configpathloader\] No config files found in path {:path=\>"C:/logstash-7.15.1/bin/logstash.conf"} \[2021-10-27T11:13:19,521\]\[DEBUG\]\[logstash.api.service \] \[… --- ## [Logstash to Splunk](https://discuss.elastic.co/t/logstash-to-splunk/287825)
**Author:** [@pbernard](https://discuss.elastic.co/u/pbernard)\ **Replies:** 0\ **Last updated:** [October 27, 2021, 4:10pm UTC](https://discuss.elastic.co/t/logstash-to-splunk/287825 "2021-10-27T16:10:06Z")
I'm seeing the following error when using "output http" plugin with Logstash V 7.9.1 \[ERROR\]\[logstash.outputs.http \]\[main\]\[fd6763aa601b7a0319bbdad4f501b0901a4f4da752d9fcbf8f841e9fbf9e676c\] \[HTTP Output Failure\] Could… --- ## [How to target City Name as GEOIP Location?](https://discuss.elastic.co/t/how-to-target-city-name-as-geoip-location/287752)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 1\ **Last updated:** [October 27, 2021, 4:09pm UTC](https://discuss.elastic.co/t/how-to-target-city-name-as-geoip-location/287752 "2021-10-27T16:09:51Z")
I have a city name field and I want to visualize it on the map. I am wondering How I can achieve this because the GEOIP filter takes IP but I don't have an IP address. geoip{ source =\> "\[NotifyEventAdvanceRequestMo… --- ## [How elasticsearch nested query work?](https://discuss.elastic.co/t/how-elasticsearch-nested-query-work/287821)
**Author:** [@tanvu](https://discuss.elastic.co/u/tanvu)\ **Replies:** 0\ **Last updated:** [October 27, 2021, 4:02pm UTC](https://discuss.elastic.co/t/how-elasticsearch-nested-query-work/287821 "2021-10-27T16:02:41Z")
I have a document: { "recipes": \[ { "name": "prepare", "ingredients": \["pork","beef"\], "steps": \[ { "ingredients": \["pork","beef"\] … --- ## [Alert - Rules query\_string not working](https://discuss.elastic.co/t/alert-rules-query-string-not-working/287360)
**Author:** [@fredrick.bb](https://discuss.elastic.co/u/fredrick.bb)\ **Replies:** 1\ **Last updated:** [October 27, 2021, 3:43pm UTC](https://discuss.elastic.co/t/alert-rules-query-string-not-working/287360 "2021-10-27T15:43:23Z")
Hello, I have a log as json string like below and that has been parsed as jsonparsor and stored in Elasticsearch { "\_index": "some index", "fields": { "many keys" : " values", "class.keyword": \[ "org.ap… --- ## [Is it possible to create an Elasticsearch Cluster with different OS?](https://discuss.elastic.co/t/is-it-possible-to-create-an-elasticsearch-cluster-with-different-os/287811)
**Author:** [@marti1](https://discuss.elastic.co/u/marti1)\ **Replies:** 1\ **Last updated:** [October 27, 2021, 3:18pm UTC](https://discuss.elastic.co/t/is-it-possible-to-create-an-elasticsearch-cluster-with-different-os/287811 "2021-10-27T15:18:13Z")
Hi, I have three servers, two are running Red Hat 8 and one Windows 10. Is it possible to set up a cluster (three nodes) with this configuration? Has any inconvenient or possible risks? Thanks in advance … --- ## [/var/lib/elasticsearch/nodes/0/indices/](https://discuss.elastic.co/t/var-lib-elasticsearch-nodes-0-indices/287462)
**Author:** [@marcio\_lima](https://discuss.elastic.co/u/marcio_lima)\ **Replies:** 4\ **Last updated:** [October 27, 2021, 1:25pm UTC](https://discuss.elastic.co/t/var-lib-elasticsearch-nodes-0-indices/287462 "2021-10-27T13:25:32Z")
I have the need to free up disk space by consuming elastic, the files are being generated in / var / lib / Elasticsearch / nodes / 0 / indices / how can i delete the indices? --- ## [Need help to create loglevel field](https://discuss.elastic.co/t/need-help-to-create-loglevel-field/287665)
**Author:** [@sushant12](https://discuss.elastic.co/u/sushant12)\ **Replies:** 3\ **Last updated:** [October 27, 2021, 2:51pm UTC](https://discuss.elastic.co/t/need-help-to-create-loglevel-field/287665 "2021-10-27T14:51:35Z")
filter{ if "ERROR" in \[LEVEl\]{ grok{ match =\> {· "message" =\> "%{TIME:timestamp} %{LOGLEVEL:LEVEL} %{GREEDYDATA:errormsg}"· } } } if "DEBUG" in \[LEVEl\]{ grok{····· match =\>… --- ## [Bulk Upgrading Elastic Agents](https://discuss.elastic.co/t/bulk-upgrading-elastic-agents/287663)
**Author:** [@geekzy](https://discuss.elastic.co/u/geekzy)\ **Replies:** 2\ **Last updated:** [October 27, 2021, 2:48pm UTC](https://discuss.elastic.co/t/bulk-upgrading-elastic-agents/287663 "2021-10-27T14:48:35Z")
We have been in the process of upgrading our elastic agents from 7.13.0 to 7.15.1. Currently we have been able to upgrade the agents individually via the GUI however we are not able to perform a bulk upgrade of all the a… --- ## [How to use the aggregation buckets to update the documents](https://discuss.elastic.co/t/how-to-use-the-aggregation-buckets-to-update-the-documents/287809)
**Author:** [@Rui\_Goncalves](https://discuss.elastic.co/u/Rui_Goncalves)\ **Replies:** 0\ **Last updated:** [October 27, 2021, 2:38pm UTC](https://discuss.elastic.co/t/how-to-use-the-aggregation-buckets-to-update-the-documents/287809 "2021-10-27T14:38:37Z")
Hi, I'm new to painless and needed some assistance. Having this query : GET index1/\_search/ { "size": 0, "aggs": { "attrs\_root": { "nested": { "path": "business\_index\_jd\_list\_agg" }, "… --- ## [SNMP timeout when run from a docker container](https://discuss.elastic.co/t/snmp-timeout-when-run-from-a-docker-container/287805)
**Author:** [@davegreen](https://discuss.elastic.co/u/davegreen)\ **Replies:** 2\ **Last updated:** [October 27, 2021, 2:06pm UTC](https://discuss.elastic.co/t/snmp-timeout-when-run-from-a-docker-container/287805 "2021-10-27T14:06:58Z")
I'm using Logstash 7.15.1 on both Centos 7.7 and a docker container with the same configuration (below). When running from Centos, everything works as expected, but on a docker container (in Kubernetes), the SNMP plugin… --- ## [Trying to setup multi-node Elasticsearch cluster environment](https://discuss.elastic.co/t/trying-to-setup-multi-node-elasticsearch-cluster-environment/287111)
**Author:** [@milindyedge](https://discuss.elastic.co/u/milindyedge)\ **Replies:** 2\ **Last updated:** [October 27, 2021, 1:59pm UTC](https://discuss.elastic.co/t/trying-to-setup-multi-node-elasticsearch-cluster-environment/287111 "2021-10-27T13:59:07Z")
I am new to Elasticsearch and currently trying to setup a multi-node Elasticsearch cluster environment using docker in my local machine. When cluster comes up, it status is green (checked using "/\_cluster/health" api, ho… --- ## [Elasticsearch fails to start 'unexpected character'](https://discuss.elastic.co/t/elasticsearch-fails-to-start-unexpected-character/287790)
**Author:** [@fribse](https://discuss.elastic.co/u/fribse)\ **Replies:** 1\ **Last updated:** [October 27, 2021, 1:57pm UTC](https://discuss.elastic.co/t/elasticsearch-fails-to-start-unexpected-character/287790 "2021-10-27T13:57:11Z")
Hi All We have an elderly Elasticsearch 6.5.1 that we've never had the time to update. It's running as docker container. I was about to look into updating this, and shut it down to fix a few things to get it ready, bu… --- ## [Attempted to send a bulk request to Elasticsearch failed ClientProtocolException](https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch-failed-clientprotocolexception/287720)
**Author:** [@makinda](https://discuss.elastic.co/u/makinda)\ **Replies:** 3\ **Last updated:** [October 27, 2021, 1:43pm UTC](https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch-failed-clientprotocolexception/287720 "2021-10-27T13:43:05Z")
I am using Elasticsearch-2.3.1 and logstash-2.3.4 since quite long. Today I found a following warning in Elastic Search. I was trying to copy the logs but I think I press Ctrl+C and then an option appear to stop a job, I… --- ## [Filebeat: How to convert data from bytes to mb in a Kibana panel?](https://discuss.elastic.co/t/filebeat-how-to-convert-data-from-bytes-to-mb-in-a-kibana-panel/287798)
**Author:** [@elasticfran](https://discuss.elastic.co/u/elasticfran)\ **Replies:** 1\ **Last updated:** [October 27, 2021, 1:17pm UTC](https://discuss.elastic.co/t/filebeat-how-to-convert-data-from-bytes-to-mb-in-a-kibana-panel/287798 "2021-10-27T13:17:47Z")
Hey there! I am building a panel in Kibana. My source is a field in Filebeat called network.bytes. Does anyone know how to convert it ( and visualize it ) from bytes to mb or even gb? Thanks --- ## [Install and configure winlogbeat in syslog server](https://discuss.elastic.co/t/install-and-configure-winlogbeat-in-syslog-server/287793)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 0\ **Last updated:** [October 27, 2021, 12:21pm UTC](https://discuss.elastic.co/t/install-and-configure-winlogbeat-in-syslog-server/287793 "2021-10-27T12:21:05Z")
Hello, Is it possible to centralize the logs of the windows servers at the level of a SYSLOG server and to install the winlogbeat agent at the level of the latter to parse and send the logs to Elasticsearch? Thank you. … --- ## [Elasticsearch WARN log : "component": "o.e.c.s.ClusterApplierService" "message": "cluster state applier task \[Publication{term=17, version=7278}\] took \[41.2s\] which is above the warn threshold of \[30s\]](https://discuss.elastic.co/t/elasticsearch-warn-log-component-o-e-c-s-clusterapplierservice-message-cluster-state-applier-task-publication-term-17-version-7278-took-41-2s-which-is-above-the-warn-threshold-of-30s/287780)
**Author:** [@Farzad\_Ebrahimi](https://discuss.elastic.co/u/Farzad_Ebrahimi)\ **Replies:** 1\ **Last updated:** [October 27, 2021, 12:14pm UTC](https://discuss.elastic.co/t/elasticsearch-warn-log-component-o-e-c-s-clusterapplierservice-message-cluster-state-applier-task-publication-term-17-version-7278-took-41-2s-which-is-above-the-warn-threshold-of-30s/287780 "2021-10-27T12:14:22Z")
Hi everyone, today we faced to this log with level WARN: {"type": "server", "timestamp": "2021-10-26T14:25:59,820Z", "level": "WARN", "component": "o.e.c.s.ClusterApplierService", "cluster.name": "elasticsearch\_cluster… --- ## [Values of type: VALUE\_NULL](https://discuss.elastic.co/t/values-of-type-value-null/286492)
**Author:** [@ebosdev](https://discuss.elastic.co/u/ebosdev)\ **Replies:** 3\ **Last updated:** [October 27, 2021, 12:12pm UTC](https://discuss.elastic.co/t/values-of-type-value-null/286492 "2021-10-27T12:12:34Z")
Hello everyone, I am trying to visualize a timelion and this is the query i am using: .es(index=investigation\_master\_index,timefield=uco-observable:sentTime.@value,split=uco-observable:messageText.keyword:1000) the me… --- ## [Need help to write fast query](https://discuss.elastic.co/t/need-help-to-write-fast-query/287791)
**Author:** [@itsmerajesh](https://discuss.elastic.co/u/itsmerajesh)\ **Replies:** 0\ **Last updated:** [October 27, 2021, 11:45am UTC](https://discuss.elastic.co/t/need-help-to-write-fast-query/287791 "2021-10-27T11:45:00Z")
Hi all, Consider, I have 1000phrases(Example of phrases can be: 1. "Hello",2. "What are you doing", 3. "automatically debit",...etc) as a1, a2, a3.......a1000. now I need to write a query in java for the ES database, th… --- ## [\_source is stored in elasticsearch?](https://discuss.elastic.co/t/source-is-stored-in-elasticsearch/287789)
**Author:** [@Francisco\_Gomez1](https://discuss.elastic.co/u/Francisco_Gomez1)\ **Replies:** 0\ **Last updated:** [October 27, 2021, 11:21am UTC](https://discuss.elastic.co/t/source-is-stored-in-elasticsearch/287789 "2021-10-27T11:21:27Z")
Hi. We are currently checking the capabilities of our cluster, and we noticed that when consult the information in Kibana discover, a json document contains both a "\_source" with all the fields and a separate field call… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1183) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1185)