# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1194 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1195 --- ## [Logstash GELF input Json ParserError](https://discuss.elastic.co/t/logstash-gelf-input-json-parsererror/287159)
**Author:** [@Stian\_Vale](https://discuss.elastic.co/u/Stian_Vale)\ **Replies:** 2\ **Last updated:** [October 20, 2021, 1:33pm UTC](https://discuss.elastic.co/t/logstash-gelf-input-json-parsererror/287159 "2021-10-20T13:33:51Z")
Hi! I'm experiencing an issue with the Logstash GELF input related to JSON parsing. It seems that there's some messages from Graylog that causes these errors: \[2021-10-20T05:21:59,443\]\[ERROR\]\[logstash.inputs.gelf \]… --- ## [Issues configuring Kibana Watcher SMTP Server](https://discuss.elastic.co/t/issues-configuring-kibana-watcher-smtp-server/286772)
**Author:** [@Fran\_mindlbs](https://discuss.elastic.co/u/Fran_mindlbs)\ **Replies:** 2\ **Last updated:** [October 20, 2021, 1:31pm UTC](https://discuss.elastic.co/t/issues-configuring-kibana-watcher-smtp-server/286772 "2021-10-20T13:31:28Z")
Like the ones before me, I've been running in circles for the last few days haha. When I modify the user settings with my SMTP server (SendGrid) in the elastic.yml file, I get a "this changes are not allowed". I don't … --- ## [Error in creating a PDF report for a canvas workpad](https://discuss.elastic.co/t/error-in-creating-a-pdf-report-for-a-canvas-workpad/286976)
**Author:** [@hNiven](https://discuss.elastic.co/u/hNiven)\ **Replies:** 1\ **Last updated:** [October 20, 2021, 12:53pm UTC](https://discuss.elastic.co/t/error-in-creating-a-pdf-report-for-a-canvas-workpad/286976 "2021-10-20T12:53:34Z")
Hi, I am trying to use the share feature to generate a PDF report of a canvas workpad I have created. However, when I try to generate the report I am met with 2 errors when trying multiple times: Error: Error spawnin… --- ## [Phrase Suggester return whole field](https://discuss.elastic.co/t/phrase-suggester-return-whole-field/287196)
**Author:** [@gabriel21](https://discuss.elastic.co/u/gabriel21)\ **Replies:** 0\ **Last updated:** [October 20, 2021, 12:37pm UTC](https://discuss.elastic.co/t/phrase-suggester-return-whole-field/287196 "2021-10-20T12:37:08Z")
Hi, I'm trying out the Phrase Suggester and wondering if there is a way to make it always return whole fields? For example, when I search noble I want the suggestion to be nobel prize rather than just the term nobel. My… --- ## [Filebeat trouble with separate indexes per namespace](https://discuss.elastic.co/t/filebeat-trouble-with-separate-indexes-per-namespace/287193)
**Author:** [@WookWook](https://discuss.elastic.co/u/WookWook)\ **Replies:** 0\ **Last updated:** [October 20, 2021, 12:14pm UTC](https://discuss.elastic.co/t/filebeat-trouble-with-separate-indexes-per-namespace/287193 "2021-10-20T12:14:24Z")
Hello, I currently try to split data into multiple indexes to simplify managing user access only for data from specific namespaces. I know this can be a problem to have too many small indexes. So normally I want to grou… --- ## [Kibana Metric Visualisation - Controlling Margins / White Space](https://discuss.elastic.co/t/kibana-metric-visualisation-controlling-margins-white-space/285558)
**Author:** [@AndyH](https://discuss.elastic.co/u/AndyH)\ **Replies:** 2\ **Last updated:** [October 20, 2021, 11:56am UTC](https://discuss.elastic.co/t/kibana-metric-visualisation-controlling-margins-white-space/285558 "2021-10-20T11:56:02Z")
I have a simple Metric Visualisation in Kibana It uses the space very inefficiently: here the metric font size is 18pt and this is the minimum panel size to avoid vertical scroll bars. In fact if I shrink the metric f… --- ## [HeartBeat Dashboard Customization](https://discuss.elastic.co/t/heartbeat-dashboard-customization/285757)
**Author:** [@John\_kasich](https://discuss.elastic.co/u/John_kasich)\ **Replies:** 1\ **Last updated:** [October 20, 2021, 11:42am UTC](https://discuss.elastic.co/t/heartbeat-dashboard-customization/285757 "2021-10-20T11:42:38Z")
I would love to build such a dashboard. If anyone can help me, please let me know. --- ## [New table in Discover has the sorting labels incorrect for date fields](https://discuss.elastic.co/t/new-table-in-discover-has-the-sorting-labels-incorrect-for-date-fields/286244)
**Author:** [@Harsha\_Mudundi](https://discuss.elastic.co/u/Harsha_Mudundi)\ **Replies:** 2\ **Last updated:** [October 20, 2021, 11:29am UTC](https://discuss.elastic.co/t/new-table-in-discover-has-the-sorting-labels-incorrect-for-date-fields/286244 "2021-10-20T11:29:05Z")
The labels when sorting date fields should be Old- New for ascending order and New- Old for descending order. Instead its implemented the reverse way in New table of Discover. Im using kibana 7.13.0. --- ## [Warning: 299 Elasticsearch-7.15.1 .... setup minimal security](https://discuss.elastic.co/t/warning-299-elasticsearch-7-15-1-setup-minimal-security/287179)
**Author:** [@6NMgfDwZ3](https://discuss.elastic.co/u/6NMgfDwZ3)\ **Replies:** 2\ **Last updated:** [October 20, 2021, 11:16am UTC](https://discuss.elastic.co/t/warning-299-elasticsearch-7-15-1-setup-minimal-security/287179 "2021-10-20T11:16:34Z")
Hi all, I'm using Elasticsearch-Kibana-Filebeat (all v7.15.1) (Ubuntu 21.04) and I get this message at every Discover refreshing, or query Warning: 299 Elasticsearch-7.15.1-83c34f456ae29d60e94d886e455e6a3409bba9ed "Ela… --- ## [Multiple Time-ranges for Y-axis data in Visualization](https://discuss.elastic.co/t/multiple-time-ranges-for-y-axis-data-in-visualization/286648)
**Author:** [@Troy\_S](https://discuss.elastic.co/u/Troy_S)\ **Replies:** 1\ **Last updated:** [October 20, 2021, 11:14am UTC](https://discuss.elastic.co/t/multiple-time-ranges-for-y-axis-data-in-visualization/286648 "2021-10-20T11:14:45Z")
I'm trying to create a single chart to show how data for a single week compares to the monthly average of that same data. I know I can use a Dashboard to create side-by-side visualizations, but I'd like to have one chart… --- ## [Kibana search events where value of a field matches another fields value in the same event?](https://discuss.elastic.co/t/kibana-search-events-where-value-of-a-field-matches-another-fields-value-in-the-same-event/287074)
**Author:** [@buzzdeee](https://discuss.elastic.co/u/buzzdeee)\ **Replies:** 2\ **Last updated:** [October 20, 2021, 11:13am UTC](https://discuss.elastic.co/t/kibana-search-events-where-value-of-a-field-matches-another-fields-value-in-the-same-event/287074 "2021-10-20T11:13:16Z")
Hi, is it somehow possible to search in kibana either via KQL or Lucene syntax for a field that has the same value as another field in the same event? i.e. assume I've a user.name and user.target.name where some events… --- ## [Match with or without thousands separator](https://discuss.elastic.co/t/match-with-or-without-thousands-separator/287183)
**Author:** [@Morten\_Sjogren](https://discuss.elastic.co/u/Morten_Sjogren)\ **Replies:** 2\ **Last updated:** [October 20, 2021, 10:53am UTC](https://discuss.elastic.co/t/match-with-or-without-thousands-separator/287183 "2021-10-20T10:53:23Z")
How do we match numbers in text-fields with and without thousands separators? Use-case: The user searches for titles with one of "15000", "15,000" or "15.000" They expect to find items with titles like these: "Histor… --- ## [Cannot start docker image (elasticsearch 6.8](https://discuss.elastic.co/t/cannot-start-docker-image-elasticsearch-6-8/287161)
**Author:** [@ggiovinazzo](https://discuss.elastic.co/u/ggiovinazzo)\ **Replies:** 0\ **Last updated:** [October 20, 2021, 7:53am UTC](https://discuss.elastic.co/t/cannot-start-docker-image-elasticsearch-6-8/287161 "2021-10-20T07:53:05Z")
Hi all, This morning I updated my Ubuntu (20.4) dev machine kernel to version 5.4.0-89.100. When restarted my dev instance of Elasticsearch (6.8.2) was crashing with the following exception: \[2021-10-20T07:09:58,338\]\[… --- ## [Detected an unhandled Promise rejection.\\nResponseError: \[parent\] Data too large, data for](https://discuss.elastic.co/t/detected-an-unhandled-promise-rejection-nresponseerror-parent-data-too-large-data-for/287172)
**Author:** [@Mesut\_Yilmaz](https://discuss.elastic.co/u/Mesut_Yilmaz)\ **Replies:** 3\ **Last updated:** [October 20, 2021, 10:08am UTC](https://discuss.elastic.co/t/detected-an-unhandled-promise-rejection-nresponseerror-parent-data-too-large-data-for/287172 "2021-10-20T10:08:18Z")
Hi there, I am suffering with this issue on kibana.log elastic cluster is up but kibana doesnt come up. JVM heapsize is set 32GB and VMs have 64GB Memories. What could be reason for this error? \` Management,enterpriseS… --- ## [Kibana Data Table returns "missing" for existing values](https://discuss.elastic.co/t/kibana-data-table-returns-missing-for-existing-values/287093)
**Author:** [@Svetilnicheg](https://discuss.elastic.co/u/Svetilnicheg)\ **Replies:** 1\ **Last updated:** [October 20, 2021, 9:53am UTC](https://discuss.elastic.co/t/kibana-data-table-returns-missing-for-existing-values/287093 "2021-10-20T09:53:16Z")
Hi! I created Data Table viz and noticed that some of my records are missing. all records exist in Discover but when I try to find them in data table they are not there. I suspect that \\n is the problem (it's present i… --- ## [Remove buckets from being returned in Aggregation](https://discuss.elastic.co/t/remove-buckets-from-being-returned-in-aggregation/287107)
**Author:** [@EricPSU](https://discuss.elastic.co/u/EricPSU)\ **Replies:** 4\ **Last updated:** [October 19, 2021, 3:44pm UTC](https://discuss.elastic.co/t/remove-buckets-from-being-returned-in-aggregation/287107 "2021-10-19T15:44:58Z")
Is there a way to prevent the buckets array from being returned as a part of the aggregation result? I am using a sum\_bucket to total all of the buckets and I don't need all of the buckets to be returned. I'm just usin… --- ## [Lock lens from filters](https://discuss.elastic.co/t/lock-lens-from-filters/287168)
**Author:** [@Greninja\_San](https://discuss.elastic.co/u/Greninja_San)\ **Replies:** 4\ **Last updated:** [October 20, 2021, 9:33am UTC](https://discuss.elastic.co/t/lock-lens-from-filters/287168 "2021-10-20T09:33:49Z")
Hello! I am currently trying to create a filter selector that is not a dropdown. Since there are no checkboxes, I'm trying to use a pie chart as the selector. Is it possible to create a checkbox list, and if not, to pr… --- ## [Find source of events causing Logstash errors](https://discuss.elastic.co/t/find-source-of-events-causing-logstash-errors/287173)
**Author:** [@Napsty](https://discuss.elastic.co/u/Napsty)\ **Replies:** 0\ **Last updated:** [October 20, 2021, 9:24am UTC](https://discuss.elastic.co/t/find-source-of-events-causing-logstash-errors/287173 "2021-10-20T09:24:23Z")
A central Logstash receives events from many clients, all using Filebeat as "sender" application. Since a couple of weeks, Logstash loggs a lot of JSON parsing errors, for example: Oct 20 11:17:46 inf-elkloge01-p logsta… --- ## [Visualization for status field](https://discuss.elastic.co/t/visualization-for-status-field/287140)
**Author:** [@vishal\_bisa](https://discuss.elastic.co/u/vishal_bisa)\ **Replies:** 3\ **Last updated:** [October 20, 2021, 8:52am UTC](https://discuss.elastic.co/t/visualization-for-status-field/287140 "2021-10-20T08:52:28Z")
Hi Team, I have a below requirement to show the status visualization for below data let's say that for the last 24 hours i have a field for incidents and the latest value shows whether that service is down incidents.s… --- ## [Grok parsing timestamp with 2 fields](https://discuss.elastic.co/t/grok-parsing-timestamp-with-2-fields/286312)
**Author:** [@alon\_carmelly](https://discuss.elastic.co/u/alon_carmelly)\ **Replies:** 8\ **Last updated:** [October 20, 2021, 8:36am UTC](https://discuss.elastic.co/t/grok-parsing-timestamp-with-2-fields/286312 "2021-10-20T08:36:11Z")
Hi, I got this log which has 2 fields of time stamp. How would I go about parsing it, couldn't find any examples online ! {"type": "GreatLog", \*\*"date": "10/3/2021", "time": "6:21:35 AM"\*\*, "message": "Take a Measureme… --- ## [Add sample data but can't see any log](https://discuss.elastic.co/t/add-sample-data-but-cant-see-any-log/287157)
**Author:** [@saraaa](https://discuss.elastic.co/u/saraaa)\ **Replies:** 2\ **Last updated:** [October 20, 2021, 7:42am UTC](https://discuss.elastic.co/t/add-sample-data-but-cant-see-any-log/287157 "2021-10-20T07:42:33Z")
hi there, I added sample data and can see it in dashboard and discover but I have no log I'm newbie in kibana and search for it to known how can see my log can't find any solution --- ## [\[7.14.1\] Linearly increasing latency in task manager index searches](https://discuss.elastic.co/t/7-14-1-linearly-increasing-latency-in-task-manager-index-searches/286010)
**Author:** [@spiqueras](https://discuss.elastic.co/u/spiqueras)\ **Replies:** 5\ **Last updated:** [October 20, 2021, 7:27am UTC](https://discuss.elastic.co/t/7-14-1-linearly-increasing-latency-in-task-manager-index-searches/286010 "2021-10-20T07:27:57Z")
We're migrating from a 6.8 cluster to a 7.14 cluster and we're seeing some abnormal behavior with Kibana's task manager index. Sorry if this is the wrong forum. For context, this is a 3-node ES v7.14.1 cluster that as o… --- ## [Problem with filebeat upgrade](https://discuss.elastic.co/t/problem-with-filebeat-upgrade/286693)
**Author:** [@David\_Oceans](https://discuss.elastic.co/u/David_Oceans)\ **Replies:** 2\ **Last updated:** [October 20, 2021, 6:50am UTC](https://discuss.elastic.co/t/problem-with-filebeat-upgrade/286693 "2021-10-20T06:50:41Z")
I was using filebeat 7.10 and all ok, now was trying upgrading to 7.15 and I found two problem I have tried to download the version of the link curl -L -O https://raw.githubusercontent.com/elastic/beats/7.15/deploy/kub… --- ## [Problem with useRelayStateDeepLink in Kibana's SAML configuration](https://discuss.elastic.co/t/problem-with-userelaystatedeeplink-in-kibanas-saml-configuration/286273)
**Author:** [@medina](https://discuss.elastic.co/u/medina)\ **Replies:** 13\ **Last updated:** [October 20, 2021, 6:45am UTC](https://discuss.elastic.co/t/problem-with-userelaystatedeeplink-in-kibanas-saml-configuration/286273 "2021-10-20T06:45:44Z")
Hello, I managed to make the SAML SSO work with a custom IdP (a Laravel app with this package, with both IdP and SP initiated flows. However, I want to redirect the user to specific dashboards on Kibana, from my Laravel… --- ## [Kibana - Use Laravel Passport as OpenID Connect Provider to SSO with Elastic and Kibana](https://discuss.elastic.co/t/kibana-use-laravel-passport-as-openid-connect-provider-to-sso-with-elastic-and-kibana/285283)
**Author:** [@medina](https://discuss.elastic.co/u/medina)\ **Replies:** 3\ **Last updated:** [October 20, 2021, 6:37am UTC](https://discuss.elastic.co/t/kibana-use-laravel-passport-as-openid-connect-provider-to-sso-with-elastic-and-kibana/285283 "2021-10-20T06:37:51Z")
Hello, I'm trying to use my Laravel app that uses Passport for authentication, to create an OpenID Connect Provider to single sign on with Elastic and Kibana. But I get the following error: { "statusCode":401, "error":"… --- ## [Logstash GeoIP filter plugin not working after update to 7.15.1](https://discuss.elastic.co/t/logstash-geoip-filter-plugin-not-working-after-update-to-7-15-1/286989)
**Author:** [@Dheeraj\_Gupta](https://discuss.elastic.co/u/Dheeraj_Gupta)\ **Replies:** 2\ **Last updated:** [October 20, 2021, 5:23am UTC](https://discuss.elastic.co/t/logstash-geoip-filter-plugin-not-working-after-update-to-7-15-1/286989 "2021-10-20T05:23:13Z")
Hi, I am running a logstash server with 7.14.0 and one of my pipelines uses the geoip filter plugin. After upgrade to 7.15.1, the pipeline refuses to start with an error like \[2021-10-18T17:22:08,987\]\[ERROR\]\[logstash.j… --- ## [Kibana service is getting down frequently](https://discuss.elastic.co/t/kibana-service-is-getting-down-frequently/286610)
**Author:** [@Suresh\_Babu\_Ragunath](https://discuss.elastic.co/u/Suresh_Babu_Ragunath)\ **Replies:** 3\ **Last updated:** [October 20, 2021, 4:50am UTC](https://discuss.elastic.co/t/kibana-service-is-getting-down-frequently/286610 "2021-10-20T04:50:30Z")
Hi All, I installed kibana-7.2.0-linux-x86\_64 and the service is getting down at least weekly once. Got the following error message in kibana.log at the time of service down. --- log snip -- {"type":"error","@timestam… --- ## [Lag is there from filebeat to Elasticsearch](https://discuss.elastic.co/t/lag-is-there-from-filebeat-to-elasticsearch/287101)
**Author:** [@Ayush\_Agrahari](https://discuss.elastic.co/u/Ayush_Agrahari)\ **Replies:** 2\ **Last updated:** [October 20, 2021, 4:46am UTC](https://discuss.elastic.co/t/lag-is-there-from-filebeat-to-elasticsearch/287101 "2021-10-20T04:46:11Z")
Hi , I am using Filebeat in Kubernetes env. Data flow is like below Filebeat -\> Logstash -\> Elasticsearch -\> Kibana I am using 7.9.0 version of filebeat I am finding lag in FIlebeat to Kibana. ES & Logstash & Filebea… --- ## [How do I implement the synonym dictionary - step-by-step?](https://discuss.elastic.co/t/how-do-i-implement-the-synonym-dictionary-step-by-step/287094)
**Author:** [@Nick\_N](https://discuss.elastic.co/u/Nick_N)\ **Replies:** 1\ **Last updated:** [October 20, 2021, 2:43am UTC](https://discuss.elastic.co/t/how-do-i-implement-the-synonym-dictionary-step-by-step/287094 "2021-10-20T02:43:58Z")
I want to look for all the jackets that are blue (in the "name" and "tags" fields). But the color blue has many shades. How do I implement the dictionary of synonyms? (I tried many things, without conclusive results w… --- ## [Last value of each interface in the match phrase query](https://discuss.elastic.co/t/last-value-of-each-interface-in-the-match-phrase-query/287135)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 2\ **Last updated:** [October 20, 2021, 1:49am UTC](https://discuss.elastic.co/t/last-value-of-each-interface-in-the-match-phrase-query/287135 "2021-10-20T01:49:18Z")
Hi, How can I get the last value of each interface in the match phrase query? I have tried with max timestamp, but I get a time out error GET /metrics-inf-\*/\_search { "query": { "bool": { "filter": \[ … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1193) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1195)