# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1190

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1191

---

## [Snaphsot repository Read Only URL via FTP](https://discuss.elastic.co/t/snaphsot-repository-read-only-url-via-ftp/287497)

<div class="topic-metadata">

**Author:** [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Replies:** 4\
**Last updated:** [October 23, 2021, 6:04pm UTC](https://discuss.elastic.co/t/snaphsot-repository-read-only-url-via-ftp/287497 "2021-10-23T18:04:44Z")

</div>

I have an Elasticsearch cluster of 3 nodes with version 7.15.0. I want to add a read-only URL repository soi can fetch a snapshot for restore. PUT /\_snapshot/ftp\_snaphoot { "type": "url", "settings": { "url": "…

---

## [Kibana is not able to visit with error code 503 and 000](https://discuss.elastic.co/t/kibana-is-not-able-to-visit-with-error-code-503-and-000/287434)

<div class="topic-metadata">

**Author:** [@KypMon](https://discuss.elastic.co/u/KypMon)\
**Replies:** 1\
**Last updated:** [October 23, 2021, 5:29pm UTC](https://discuss.elastic.co/t/kibana-is-not-able-to-visit-with-error-code-503-and-000/287434 "2021-10-23T17:29:29Z")

</div>

I just follow along the tutorial helm-charts/elasticsearch/examples/security at main · elastic/helm-charts · GitHub and helm-charts/kibana/examples/security at main · elastic/helm-charts · GitHub Elasticsearch all works…

---

## [Elastic agent not sending data stream](https://discuss.elastic.co/t/elastic-agent-not-sending-data-stream/286893)

<div class="topic-metadata">

**Author:** [@AdE\_GoD](https://discuss.elastic.co/u/AdE_GoD)\
**Replies:** 2\
**Last updated:** [October 23, 2021, 2:58pm UTC](https://discuss.elastic.co/t/elastic-agent-not-sending-data-stream/286893 "2021-10-23T14:58:31Z")

</div>

Hi everyone, I've been wanting to try elastic-agent for quite some time now so I booted up a machine and tried to configure everything, but I've encountered an error that for the love of me I simply cannot fix. I have …

---

## [Do we require licence to enable xpack.security feature](https://discuss.elastic.co/t/do-we-require-licence-to-enable-xpack-security-feature/287427)

<div class="topic-metadata">

**Author:** [@mohammed.sabil](https://discuss.elastic.co/u/mohammed.sabil)\
**Replies:** 4\
**Last updated:** [October 23, 2021, 2:17pm UTC](https://discuss.elastic.co/t/do-we-require-licence-to-enable-xpack-security-feature/287427 "2021-10-23T14:17:24Z")

</div>

Hello Team, I just wanted to know, If I wanted to use the alerting, monitoring and user administration RBAC feature in ELK stack. Do I require a license for the same? I also wanted to know, if I would like to do integr…

---

## [Error shows "Kibana server is not ready yet" after TLS configuration](https://discuss.elastic.co/t/error-shows-kibana-server-is-not-ready-yet-after-tls-configuration/287484)

<div class="topic-metadata">

**Author:** [@Shoaib\_Hasan](https://discuss.elastic.co/u/Shoaib_Hasan)\
**Replies:** 1\
**Last updated:** [October 23, 2021, 2:24pm UTC](https://discuss.elastic.co/t/error-shows-kibana-server-is-not-ready-yet-after-tls-configuration/287484 "2021-10-23T14:24:32Z")

</div>

I did not facing any issue when configured below code: xpack.license.self\_generated.type: basic xpack.monitoring.collection.enabled: true xpack.security.enabled: true xpack.security.transport.ssl.enabled: true xpack.mon…

---

## [Canvas - Timefilter issue](https://discuss.elastic.co/t/canvas-timefilter-issue/287425)

<div class="topic-metadata">

**Author:** [@r.pollak](https://discuss.elastic.co/u/r.pollak)\
**Replies:** 11\
**Last updated:** [October 23, 2021, 2:15pm UTC](https://discuss.elastic.co/t/canvas-timefilter-issue/287425 "2021-10-23T14:15:01Z")

</div>

Hi together, without using a time filter, the graph shows several data. All date have a timestamp of 23. September 2021 After adding a time filer with a time range "last year" the graphs shows no more data. Can…

---

## [Packetbeat parsing MongoDB 5.0](https://discuss.elastic.co/t/packetbeat-parsing-mongodb-5-0/287490)

<div class="topic-metadata">

**Author:** [@chinaxushi](https://discuss.elastic.co/u/chinaxushi)\
**Replies:** 0\
**Last updated:** [October 23, 2021, 1:47pm UTC](https://discuss.elastic.co/t/packetbeat-parsing-mongodb-5-0/287490 "2021-10-23T13:47:55Z")

</div>

In version 5.0, MongoDB deprecates the following opcodes: OP\_REPLY OP\_UPDATE OP\_INSERT OP\_QUERY \[1\] OP\_GET\_MORE OP\_DELETE OP\_KILL\_CURSORS Instead of these opcodes, use OP\_MSG. Now op\_ MSG information cannot be pars…

---

## [New pfSense integration added to Github, is there's any planned support for Elastic Agent FreeBSD OS?](https://discuss.elastic.co/t/new-pfsense-integration-added-to-github-is-theres-any-planned-support-for-elastic-agent-freebsd-os/286970)

<div class="topic-metadata">

**Author:** [@eldadpuzach](https://discuss.elastic.co/u/eldadpuzach)\
**Replies:** 6\
**Last updated:** [October 23, 2021, 2:08pm UTC](https://discuss.elastic.co/t/new-pfsense-integration-added-to-github-is-theres-any-planned-support-for-elastic-agent-freebsd-os/286970 "2021-10-23T14:08:09Z")

</div>

Hello Elastic team:) is it possible to utilize the new pfSense integration to ship logs from PfSense to Elastic Cloud? AFAIK there's no Elastic Agent available for FreeBSD OS.. tnx🙏

---

## [Finding unique dates](https://discuss.elastic.co/t/finding-unique-dates/287489)

<div class="topic-metadata">

**Author:** [@cassebas](https://discuss.elastic.co/u/cassebas)\
**Replies:** 0\
**Last updated:** [October 23, 2021, 12:54pm UTC](https://discuss.elastic.co/t/finding-unique-dates/287489 "2021-10-23T12:54:10Z")

</div>

I have a dataset about deliveries, with a datetime in the format yyyy-mm-dd hh:mm:ss (for example: "29-2-2020 13:31:00"). Now I wan't to count the number of unique days in the set. I tried using cardinality in combinati…

---

## [Logstash pass through Index Templates](https://discuss.elastic.co/t/logstash-pass-through-index-templates/287487)

<div class="topic-metadata">

**Author:** [@gose](https://discuss.elastic.co/u/gose)\
**Replies:** 0\
**Last updated:** [October 23, 2021, 12:21pm UTC](https://discuss.elastic.co/t/logstash-pass-through-index-templates/287487 "2021-10-23T12:21:08Z")

</div>

I send all my data through Logstash. Each time there's a new Elastic release, I have to export the Index Templates for each Beat I'm using (Filebeat, Metricbeat, Heartbeat, & APM Server) and then hand-load them into Ela…

---

## [How good is to clear the field data cache on a regular basis](https://discuss.elastic.co/t/how-good-is-to-clear-the-field-data-cache-on-a-regular-basis/287400)

<div class="topic-metadata">

**Author:** [@curiousmind](https://discuss.elastic.co/u/curiousmind)\
**Replies:** 1\
**Last updated:** [October 23, 2021, 10:41am UTC](https://discuss.elastic.co/t/how-good-is-to-clear-the-field-data-cache-on-a-regular-basis/287400 "2021-10-23T10:41:11Z")

</div>

I have big daily indices and sometimes the indexing get stopped or delayed. When i clear the cache, everything goes back to normal. So I was thinking of clearing the cache , especially field cache in every 20-30 minutes …

---

## [Permission error for custom log integration on Fleet-managed Agent](https://discuss.elastic.co/t/permission-error-for-custom-log-integration-on-fleet-managed-agent/287486)

<div class="topic-metadata">

**Author:** [@Panagiota\_Mitsopoulo](https://discuss.elastic.co/u/Panagiota_Mitsopoulo)\
**Replies:** 0\
**Last updated:** [October 23, 2021, 9:36am UTC](https://discuss.elastic.co/t/permission-error-for-custom-log-integration-on-fleet-managed-agent/287486 "2021-10-23T09:36:22Z")

</div>

Hello! I have a Nodejs app that ingests logs into Elasticsearch Service deployment 7.15.1 using Filebeat. More of less this is the example I've been doing adapted to my needs Ingest logs from a Node.js web application u…

---

## [Importing prebuilt kibana dashboards: "0 objects imported"](https://discuss.elastic.co/t/importing-prebuilt-kibana-dashboards-0-objects-imported/287008)

<div class="topic-metadata">

**Author:** [@elasticfran](https://discuss.elastic.co/u/elasticfran)\
**Replies:** 4\
**Last updated:** [October 23, 2021, 7:35am UTC](https://discuss.elastic.co/t/importing-prebuilt-kibana-dashboards-0-objects-imported/287008 "2021-10-23T07:35:04Z")

</div>

Hey there :slight\_smile: I am experiencing issues importing prebuilt dashboards in kibana from https://elastic-content-share.eu/ , i follow the installation procedure but i dont get new dashboards available in "saved ob…

---

## [Multiline logs are not working using filebeat](https://discuss.elastic.co/t/multiline-logs-are-not-working-using-filebeat/287466)

<div class="topic-metadata">

**Author:** [@kemisetti\_pavan\_kuma](https://discuss.elastic.co/u/kemisetti_pavan_kuma)\
**Replies:** 0\
**Last updated:** [October 22, 2021, 8:33pm UTC](https://discuss.elastic.co/t/multiline-logs-are-not-working-using-filebeat/287466 "2021-10-22T20:33:38Z")

</div>

Hi, I have been trying to parse multiline logs by using the sample provided in the filebeat documentation. Not sure of the reason why the logs are not being parse as a single event. Below is my filebeat.yaml file confi…

---

## [Dealing with changes in field datatype](https://discuss.elastic.co/t/dealing-with-changes-in-field-datatype/286952)

<div class="topic-metadata">

**Author:** [@raonic](https://discuss.elastic.co/u/raonic)\
**Replies:** 2\
**Last updated:** [October 18, 2021, 6:41pm UTC](https://discuss.elastic.co/t/dealing-with-changes-in-field-datatype/286952 "2021-10-18T18:41:08Z")

</div>

Hello, I have an Elasticsearch index where fields are configured by clients (indirectly) i.e., the clients configure the datatype for these fields through an interface and then I have a workflow which creates the actual…

---

## [Get Current Top 5 Over Time with Date Histogram](https://discuss.elastic.co/t/get-current-top-5-over-time-with-date-histogram/287473)

<div class="topic-metadata">

**Author:** [@dmer](https://discuss.elastic.co/u/dmer)\
**Replies:** 0\
**Last updated:** [October 22, 2021, 10:47pm UTC](https://discuss.elastic.co/t/get-current-top-5-over-time-with-date-histogram/287473 "2021-10-22T22:47:57Z")

</div>

Suppose I have an index filled with Person records, and I want to get the doc counts for the top 5 names (based on today) over the past week. To clarify, I don't want the top 5 names each day, instead I want to show the …

---

## [Accessing search API using api key and acces token-based authentication](https://discuss.elastic.co/t/accessing-search-api-using-api-key-and-acces-token-based-authentication/287468)

<div class="topic-metadata">

**Author:** [@parkerjgit](https://discuss.elastic.co/u/parkerjgit)\
**Replies:** 0\
**Last updated:** [October 22, 2021, 9:04pm UTC](https://discuss.elastic.co/t/accessing-search-api-using-api-key-and-acces-token-based-authentication/287468 "2021-10-22T21:04:50Z")

</div>

Hi, I need some help accessing the Search API. I Have elastic cloud setup as azure managed service. I can access the cloud Service API using API key-based authentication: curl -X GET -H "Authorization: ApiKey \<api\_key\>"…

---

## [Jvm.options with 7.15.0](https://discuss.elastic.co/t/jvm-options-with-7-15-0/287254)

<div class="topic-metadata">

**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\
**Replies:** 9\
**Last updated:** [October 22, 2021, 7:29pm UTC](https://discuss.elastic.co/t/jvm-options-with-7-15-0/287254 "2021-10-22T19:29:33Z")

</div>

I know the newer version handles ram automatically and that's great. But I'm seeing the java option sets Xms and Xmx both to 1024m even though I have 96GB of ram on my machine. Should I just ignore this? 51108 ? SLsl …

---

## [How do I export the Composable Templates from beats?](https://discuss.elastic.co/t/how-do-i-export-the-composable-templates-from-beats/287453)

<div class="topic-metadata">

**Author:** [@Micah\_Hunsberger](https://discuss.elastic.co/u/Micah_Hunsberger)\
**Replies:** 0\
**Last updated:** [October 22, 2021, 6:09pm UTC](https://discuss.elastic.co/t/how-do-i-export-the-composable-templates-from-beats/287453 "2021-10-22T18:09:43Z")

</div>

How can I manually add the beats composable index templates? The instructions here: Load the Elasticsearch index template | Winlogbeat Reference \[7.15\] | Elastic only export the legacy template. I prefer to review the …

---

## [Possibility to use single index template for all application indices](https://discuss.elastic.co/t/possibility-to-use-single-index-template-for-all-application-indices/285741)

<div class="topic-metadata">

**Author:** [@prat](https://discuss.elastic.co/u/prat)\
**Replies:** 14\
**Last updated:** [October 22, 2021, 5:19pm UTC](https://discuss.elastic.co/t/possibility-to-use-single-index-template-for-all-application-indices/285741 "2021-10-22T17:19:16Z")

</div>

Hi Team, I have multiple applications running and each has their application logs captured by filebeat and it sends to logstash. Below is the logstash configuration /etc/logstash/conf.d/logstash.conf file. ( showing o…

---

## [Elasticsearch cluster performance](https://discuss.elastic.co/t/elasticsearch-cluster-performance/287214)

<div class="topic-metadata">

**Author:** [@Phandora](https://discuss.elastic.co/u/Phandora)\
**Replies:** 3\
**Last updated:** [October 22, 2021, 5:13pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-performance/287214 "2021-10-22T17:13:36Z")

</div>

Hi everyone, I am using Elasticsearch 7.10.2 version on EKS and I have some questions about the Elasticsearch cluster performance. Assuming that the total amount of cluster resources is the same in both cases, which is…

---

## [Should I use Simple Query or Match Query?](https://discuss.elastic.co/t/should-i-use-simple-query-or-match-query/287438)

<div class="topic-metadata">

**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\
**Replies:** 7\
**Last updated:** [October 22, 2021, 4:48pm UTC](https://discuss.elastic.co/t/should-i-use-simple-query-or-match-query/287438 "2021-10-22T16:48:15Z")

</div>

Dear all =) If I want to search for the following host:"10.250.11.11" and custom4:"errors occurred" then match-query and simple-query-string both looks like possible candidates. I will end up creating Kibana Rules, a…

---

## [How get 1million documents from elasticsearch?](https://discuss.elastic.co/t/how-get-1million-documents-from-elasticsearch/287446)

<div class="topic-metadata">

**Author:** [@psyapathy](https://discuss.elastic.co/u/psyapathy)\
**Replies:** 1\
**Last updated:** [October 22, 2021, 3:54pm UTC](https://discuss.elastic.co/t/how-get-1million-documents-from-elasticsearch/287446 "2021-10-22T15:54:56Z")

</div>

Hi all! Help me please. I have index and i want by api get all documents (~1million) from index for my report. I've seen the scroll, but I don't understand how to apply it to my case... How i can do? Thank for advanc…

---

## [Uri is not valid, Host is not specified](https://discuss.elastic.co/t/uri-is-not-valid-host-is-not-specified/287385)

<div class="topic-metadata">

**Author:** [@DeepakStile](https://discuss.elastic.co/u/DeepakStile)\
**Replies:** 1\
**Last updated:** [October 22, 2021, 3:44pm UTC](https://discuss.elastic.co/t/uri-is-not-valid-host-is-not-specified/287385 "2021-10-22T15:44:46Z")

</div>

Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:XXXXX, :exception=\>"Java::JavaLang::IllegalStateException", :message=\>"Unable to configure plugins: (ArgumentError) URI is not valid - host …

---

## [Geoip filter in logstash with Index Template not creating geo\_point object as expected](https://discuss.elastic.co/t/geoip-filter-in-logstash-with-index-template-not-creating-geo-point-object-as-expected/286768)

<div class="topic-metadata">

**Author:** [@ehfdub](https://discuss.elastic.co/u/ehfdub)\
**Replies:** 5\
**Last updated:** [October 22, 2021, 3:34pm UTC](https://discuss.elastic.co/t/geoip-filter-in-logstash-with-index-template-not-creating-geo-point-object-as-expected/286768 "2021-10-22T15:34:40Z")

</div>

Hello, I have a geoip in my logstash filter: geoip { source =\> "src\_ip" } and I created an index template via the Kibana DevTools for ALL new indexes: PUT /\_template/my\_template { "order": 0, "template": "\*", …

---

## [Unable to install elastic-logging-plugin (docker plugin) \>= 7.13.0 (beatSocket.sock: connect: no such file or directory)](https://discuss.elastic.co/t/unable-to-install-elastic-logging-plugin-docker-plugin-7-13-0-beatsocket-sock-connect-no-such-file-or-directory/287027)

<div class="topic-metadata">

**Author:** [@goldsky](https://discuss.elastic.co/u/goldsky)\
**Replies:** 1\
**Last updated:** [October 22, 2021, 2:56pm UTC](https://discuss.elastic.co/t/unable-to-install-elastic-logging-plugin-docker-plugin-7-13-0-beatsocket-sock-connect-no-such-file-or-directory/287027 "2021-10-22T14:56:50Z")

</div>

Hello, recently I decided to upgrade my stack to 7.15, during upgrade I discover that I can't install latest elastic-logging-plugin (docker plugin), future investigation shows that only following versions works in my ca…

---

## [Elastic Cloud and Filebeat setup](https://discuss.elastic.co/t/elastic-cloud-and-filebeat-setup/285927)

<div class="topic-metadata">

**Author:** [@Sakshee](https://discuss.elastic.co/u/Sakshee)\
**Replies:** 7\
**Last updated:** [October 22, 2021, 2:51pm UTC](https://discuss.elastic.co/t/elastic-cloud-and-filebeat-setup/285927 "2021-10-22T14:51:44Z")

</div>

Hello All, I am trying to send cloud Watch logs from a filebeat server to Elastic Cloud. I am getting following warnings. And not able to see any logs on Elastic cloud Kibana. Logs from Filebeat: 2021-10-05T12:56:…

---

## [Creating a filebeat module](https://discuss.elastic.co/t/creating-a-filebeat-module/287413)

<div class="topic-metadata">

**Author:** [@elasticfran](https://discuss.elastic.co/u/elasticfran)\
**Replies:** 6\
**Last updated:** [October 22, 2021, 2:14pm UTC](https://discuss.elastic.co/t/creating-a-filebeat-module/287413 "2021-10-22T14:14:25Z")

</div>

Hey there! I am trying to write a custom filebeat module, which are the proper guidelines to follow ? Found Creating a New Beat | Beats Developer Guide \[7.12\] | Elastic which i find pretty comprehensive but i wonder wh…

---

## [Pass access token received from http\_poller call to http filter](https://discuss.elastic.co/t/pass-access-token-received-from-http-poller-call-to-http-filter/287225)

<div class="topic-metadata">

**Author:** [@byoungman](https://discuss.elastic.co/u/byoungman)\
**Replies:** 2\
**Last updated:** [October 22, 2021, 1:25pm UTC](https://discuss.elastic.co/t/pass-access-token-received-from-http-poller-call-to-http-filter/287225 "2021-10-22T13:25:48Z")

</div>

I am able to successfully get an access token from the http\_poller plugin but now I need to pass that token on to the http filter in order to make my REST call. I'm assuming that I need to do this through the headers fi…

---

## [Cardinality, adding missing documents to a different bucket](https://discuss.elastic.co/t/cardinality-adding-missing-documents-to-a-different-bucket/287439)

<div class="topic-metadata">

**Author:** [@ibulut](https://discuss.elastic.co/u/ibulut)\
**Replies:** 0\
**Last updated:** [October 22, 2021, 12:41pm UTC](https://discuss.elastic.co/t/cardinality-adding-missing-documents-to-a-different-bucket/287439 "2021-10-22T12:41:18Z")

</div>

Hello everyone. I'm beginner with little experience and currently trying to gain experience with experiments. I have a problem with cardinality aggregation. When cardinality is used, it ignores docs with missing values …

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1189)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1191)
