# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1199 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1200 --- ## [Named multi match query](https://discuss.elastic.co/t/named-multi-match-query/286904)
**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\ **Replies:** 0\ **Last updated:** [October 17, 2021, 3:35am UTC](https://discuss.elastic.co/t/named-multi-match-query/286904 "2021-10-17T03:35:59Z")
Hello everyone , I need a hand here. I have a cross\_fields multi\_match query and I need to use named queries for each field. I can rewrite it into a bool/should match but then I dont know how to reproduce the cross\_field… --- ## [Cannot setup cluster of ES with Docker of 2 EC2 machines on 3 nodes](https://discuss.elastic.co/t/cannot-setup-cluster-of-es-with-docker-of-2-ec2-machines-on-3-nodes/286890)
**Author:** [@vitaly1233](https://discuss.elastic.co/u/vitaly1233)\ **Replies:** 4\ **Last updated:** [October 16, 2021, 6:29pm UTC](https://discuss.elastic.co/t/cannot-setup-cluster-of-es-with-docker-of-2-ec2-machines-on-3-nodes/286890 "2021-10-16T18:29:53Z")
Im trying to setup 3 nodes on 2 machines as the following configuration. following the doc - Install Elasticsearch with Docker | Elasticsearch Guide \[7.15\] | Elastic (run this script on each machine) services: es01:… --- ## [Can not upload synonyms file in the elastic cloud](https://discuss.elastic.co/t/can-not-upload-synonyms-file-in-the-elastic-cloud/286888)
**Author:** [@aninda\_halder](https://discuss.elastic.co/u/aninda_halder)\ **Replies:** 5\ **Last updated:** [October 16, 2021, 6:27pm UTC](https://discuss.elastic.co/t/can-not-upload-synonyms-file-in-the-elastic-cloud/286888 "2021-10-16T18:27:43Z")
Can you help me to upload synonyms and stop word files in cloud ? After doing some googling i found this this link, and successfully add a custom extension but i can not enable them for existing Elasticsearch deployments… --- ## [JSON Parse error: Illegal unquoted character](https://discuss.elastic.co/t/json-parse-error-illegal-unquoted-character/286894)
**Author:** [@geetika\_gopi](https://discuss.elastic.co/u/geetika_gopi)\ **Replies:** 1\ **Last updated:** [October 16, 2021, 4:08pm UTC](https://discuss.elastic.co/t/json-parse-error-illegal-unquoted-character/286894 "2021-10-16T16:08:31Z")
Hello, I am using rsyslog to send my auditd logs to logstash. Before reaching logstash, an rsyslog template is applied for better formatting. I run into an error here jsonlines - JSON parse error, original data now in… --- ## [O365.audit to message field](https://discuss.elastic.co/t/o365-audit-to-message-field/286396)
**Author:** [@geetika\_gopi](https://discuss.elastic.co/u/geetika_gopi)\ **Replies:** 2\ **Last updated:** [October 16, 2021, 2:43pm UTC](https://discuss.elastic.co/t/o365-audit-to-message-field/286396 "2021-10-16T14:43:34Z")
Hello, I have O365 logs coming in to my logstash via the O365 filebeat module. I am trying to create two outputs : Elasticsearch output S3 bucket output The S3 bucket output requires a "message" field to be present. … --- ## [Timed out while retrying \[indices:admin/exists\] after failure](https://discuss.elastic.co/t/timed-out-while-retrying-indices-admin-exists-after-failure/286870)
**Author:** [@akshay\_dindure1994](https://discuss.elastic.co/u/akshay_dindure1994)\ **Replies:** 0\ **Last updated:** [October 15, 2021, 7:22pm UTC](https://discuss.elastic.co/t/timed-out-while-retrying-indices-admin-exists-after-failure/286870 "2021-10-15T19:22:45Z")
Hello Team, I have single node setup in my environment. I am facing issue after an server reboot. Elastic is take 8 time more time then usual to start. And soon getting abnormal. Please find the the Error which I am g… --- ## [Elasticsearch configuration](https://discuss.elastic.co/t/elasticsearch-configuration/286480)
**Author:** [@niraj\_pandey](https://discuss.elastic.co/u/niraj_pandey)\ **Replies:** 29\ **Last updated:** [October 16, 2021, 4:31am UTC](https://discuss.elastic.co/t/elasticsearch-configuration/286480 "2021-10-16T04:31:14Z")
Hi , I am trying to configure Elasticsearch 7.0.0 with 2 master and 1 data nodes (will add more data nodes later). Below are the configuration details for each node. But when I ran the API (curl -X GET "rw-elkm2-vm:9200… --- ## [PARSE Logs having pip saperator](https://discuss.elastic.co/t/parse-logs-having-pip-saperator/286881)
**Author:** [@Nikparab](https://discuss.elastic.co/u/Nikparab)\ **Replies:** 7\ **Last updated:** [October 16, 2021, 3:33am UTC](https://discuss.elastic.co/t/parse-logs-having-pip-saperator/286881 "2021-10-16T03:33:50Z")
Hi I am having the log format as below. 2021-10-16 00:14:14|http-nio-2222-exec-1|DEBUG|c.v.a.ultimatevault.web.TraceFilter|01AD08F98FB24AB7A639383F44613AE4|Processing request:- id: 01AD08F98FB24AB7A639383F44613AE4 metho… --- ## [Fetch additional info for each Elasticsearch](https://discuss.elastic.co/t/fetch-additional-info-for-each-elasticsearch/286880)
**Author:** [@pedrorabbi](https://discuss.elastic.co/u/pedrorabbi)\ **Replies:** 2\ **Last updated:** [October 16, 2021, 3:31am UTC](https://discuss.elastic.co/t/fetch-additional-info-for-each-elasticsearch/286880 "2021-10-16T03:31:12Z")
So, I have 2 indexes in my Elasticsearch server. I need to gather the results from the first index, and for each result I need to gather info from the second index. How to do that? Tried the foreach processor, but no lu… --- ## [Help with window sort in vega](https://discuss.elastic.co/t/help-with-window-sort-in-vega/286783)
**Author:** [@nsimi](https://discuss.elastic.co/u/nsimi)\ **Replies:** 3\ **Last updated:** [October 15, 2021, 10:04pm UTC](https://discuss.elastic.co/t/help-with-window-sort-in-vega/286783 "2021-10-15T22:04:43Z")
Hello All, I am trying to get a window transform to sort data, and am having some issues, either my expectations are wrong or I am just doing something wrong: { "$schema": "https://vega.github.io/schema/vega/v5.json"… --- ## [Enable .keyword fields for specific fields only](https://discuss.elastic.co/t/enable-keyword-fields-for-specific-fields-only/286866)
**Author:** [@Rakesh\_B](https://discuss.elastic.co/u/Rakesh_B)\ **Replies:** 3\ **Last updated:** [October 15, 2021, 8:26pm UTC](https://discuss.elastic.co/t/enable-keyword-fields-for-specific-fields-only/286866 "2021-10-15T20:26:16Z")
Hi, Elasticsearch Version: 7.15.0 Logstash Version: 7.15.0 We have a ton of fields for our index and we get new fields frequently so, we cannot disable dynamic mapping. Dynamic mapping creates .keyword fields for a ma… --- ## [How to get the value of an array using ctx.payload](https://discuss.elastic.co/t/how-to-get-the-value-of-an-array-using-ctx-payload/286864)
**Author:** [@StephaneRodier](https://discuss.elastic.co/u/StephaneRodier)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 8:19pm UTC](https://discuss.elastic.co/t/how-to-get-the-value-of-an-array-using-ctx-payload/286864 "2021-10-15T20:19:27Z")
Hello, Let's say I have the results below in an array of 2: "hits": { "hits": \[ { "\_index": "blah-2021.10.01-000003", "\_type": "\_doc", "\_source": … --- ## [S3 - setting and verifying repo issue](https://discuss.elastic.co/t/s3-setting-and-verifying-repo-issue/286661)
**Author:** [@vee](https://discuss.elastic.co/u/vee)\ **Replies:** 30\ **Last updated:** [October 15, 2021, 7:42pm UTC](https://discuss.elastic.co/t/s3-setting-and-verifying-repo-issue/286661 "2021-10-15T19:42:27Z")
Trying our in-house S3 compatible storage device as frozen tier, but seeing errors when verifying the repository. Got a confirmation from elastic support that the one we have is fully supported by S3 protocol. Here are … --- ## [Filter computer object password changes](https://discuss.elastic.co/t/filter-computer-object-password-changes/284651)
**Author:** [@WilGG](https://discuss.elastic.co/u/WilGG)\ **Replies:** 8\ **Last updated:** [October 15, 2021, 6:37pm UTC](https://discuss.elastic.co/t/filter-computer-object-password-changes/284651 "2021-10-15T18:37:13Z")
Good Afternoon Everyone, We are been overwhelmed by computer objects password changes. Does anyone know how to filter this events so we do not skip actual user object password change events ? Thank you! --- ## [Logstash open file descriptors only increases](https://discuss.elastic.co/t/logstash-open-file-descriptors-only-increases/285571)
**Author:** [@N1k-3l](https://discuss.elastic.co/u/N1k-3l)\ **Replies:** 2\ **Last updated:** [October 15, 2021, 5:58pm UTC](https://discuss.elastic.co/t/logstash-open-file-descriptors-only-increases/285571 "2021-10-15T17:58:09Z")
Hello. I have a problem with logstash (logstash 7.12.1) file descriptors only increases. I set limits to 50000, but on another host, with the same config i have: may be somebody knows about this? :blush: --- ## [Certificate error on database update](https://discuss.elastic.co/t/certificate-error-on-database-update/286550)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 5\ **Last updated:** [October 15, 2021, 5:51pm UTC](https://discuss.elastic.co/t/certificate-error-on-database-update/286550 "2021-10-15T17:51:04Z")
After upgrading to logstash 7.14.1, I'm getting this error daily in the logstash-plain.log: \[ERROR\]\[logstash.filters.geoip.databasemanager\] certificate verify failed {:cause=\>#\ **Author:** [@Catalina\_Boteanu](https://discuss.elastic.co/u/Catalina_Boteanu)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 5:34pm UTC](https://discuss.elastic.co/t/parse-xml-log-with-xml-filter-and-grok-fiter/286712 "2021-10-15T17:34:46Z") Hello. I am currently trying to apply some filters to different logs in Logstash. I have a log that has a string in the beginning and then it is in xml format. I was able to take out the xml from the log with a regex. No… --- ## [Logstash pipeline multiple if statements](https://discuss.elastic.co/t/logstash-pipeline-multiple-if-statements/286737)
**Author:** [@Robin020](https://discuss.elastic.co/u/Robin020)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 5:02pm UTC](https://discuss.elastic.co/t/logstash-pipeline-multiple-if-statements/286737 "2021-10-15T17:02:58Z")
Hello, I am trying create multiple if statements in the filter section in my pipeline config but I have no success with that. This works (with one if statement) filter { json { source =\> "message" } split … --- ## [Can you reference a dynamic variable in the grok filter?](https://discuss.elastic.co/t/can-you-reference-a-dynamic-variable-in-the-grok-filter/286838)
**Author:** [@Cibot](https://discuss.elastic.co/u/Cibot)\ **Replies:** 2\ **Last updated:** [October 15, 2021, 4:57pm UTC](https://discuss.elastic.co/t/can-you-reference-a-dynamic-variable-in-the-grok-filter/286838 "2021-10-15T16:57:52Z")
I have been trying to split up the input of a script from execbeat. So far everything has been going smooth. I have input of similar fashion. rpm-2109130090009900.x86-64 Thu 2019 ... and so on. So basically an inform… --- ## [Parsing nested json to flat structure](https://discuss.elastic.co/t/parsing-nested-json-to-flat-structure/286790)
**Author:** [@IsAa](https://discuss.elastic.co/u/IsAa)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 4:50pm UTC](https://discuss.elastic.co/t/parsing-nested-json-to-flat-structure/286790 "2021-10-15T16:50:36Z")
Hi Team, I was looking to parse my nested json structure using json filter. I have looked at some of the posts and tried their solution. My question, is it possible to make this structure completely flat, So if my log… --- ## [How can I filter a Vega data table to unique values of a field?](https://discuss.elastic.co/t/how-can-i-filter-a-vega-data-table-to-unique-values-of-a-field/286761)
**Author:** [@nsimi](https://discuss.elastic.co/u/nsimi)\ **Replies:** 2\ **Last updated:** [October 15, 2021, 4:26pm UTC](https://discuss.elastic.co/t/how-can-i-filter-a-vega-data-table-to-unique-values-of-a-field/286761 "2021-10-15T16:26:17Z")
Hello All, I have data that I am querying, and I want to be able to filter to unique values of a field on the data in the table, can I do that? If so can someone explain to me how? Thank you! --- ## [401 Unauthorised error heartbeat](https://discuss.elastic.co/t/401-unauthorised-error-heartbeat/286056)
**Author:** [@Spoo](https://discuss.elastic.co/u/Spoo)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 3:22pm UTC](https://discuss.elastic.co/t/401-unauthorised-error-heartbeat/286056 "2021-10-15T15:22:14Z")
Hi I have a question about Elasticsearch and kibana setup on my work account So I have setup elk stack on an AWS EC2 instance and an other ubuntu web server. I am working on self managed not cloud based. I have insta… --- ## [Watcher - how to set the doc\_values condition for a query with a filter terms aggregation. (Detect lack of logs per hostname - use case)](https://discuss.elastic.co/t/watcher-how-to-set-the-doc-values-condition-for-a-query-with-a-filter-terms-aggregation-detect-lack-of-logs-per-hostname-use-case/286225)
**Author:** [@Manu\_BS](https://discuss.elastic.co/u/Manu_BS)\ **Replies:** 2\ **Last updated:** [October 15, 2021, 3:19pm UTC](https://discuss.elastic.co/t/watcher-how-to-set-the-doc-values-condition-for-a-query-with-a-filter-terms-aggregation-detect-lack-of-logs-per-hostname-use-case/286225 "2021-10-15T15:19:44Z")
Hello friends, I wanted to create a few watchers that help us to detect when we are not receiving specific logs that are crucial for the monitoring chain. It means, to not be receiving logs from specific servers. For … --- ## [Assigning Multiple Roles to one Kibana Space](https://discuss.elastic.co/t/assigning-multiple-roles-to-one-kibana-space/285812)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 3:14pm UTC](https://discuss.elastic.co/t/assigning-multiple-roles-to-one-kibana-space/285812 "2021-10-15T15:14:18Z")
Hello, I want to assign multiple roles to one space, but I also want one role to be able to view specific dashboards or even if they have access to the dashboard to only see data that I give them access to. For example,… --- ## [Trying to Compare two timestamps to calculate ingestion speed](https://discuss.elastic.co/t/trying-to-compare-two-timestamps-to-calculate-ingestion-speed/286823)
**Author:** [@jamesm1](https://discuss.elastic.co/u/jamesm1)\ **Replies:** 2\ **Last updated:** [October 15, 2021, 2:58pm UTC](https://discuss.elastic.co/t/trying-to-compare-two-timestamps-to-calculate-ingestion-speed/286823 "2021-10-15T14:58:52Z")
Hello! I am in the process of attempting to create a column which tells me the difference between the time the log was created in elastic (so the ingestion time stamp) and the timestamp against my IIS log(so the iis.acc… --- ## [Customize Lens's graphs](https://discuss.elastic.co/t/customize-lenss-graphs/286702)
**Author:** [@Kadhem](https://discuss.elastic.co/u/Kadhem)\ **Replies:** 9\ **Last updated:** [October 15, 2021, 2:36pm UTC](https://discuss.elastic.co/t/customize-lenss-graphs/286702 "2021-10-15T14:36:12Z")
Hi, i'm using Lens charts in Kibana. i want to display a graph where Y axis is the timestamp and X axis is the values of My field . But Lens enable me to use a simple Function "Value" is there any solution? I don't want… --- ## [How to filter out a specific data in a panel?](https://discuss.elastic.co/t/how-to-filter-out-a-specific-data-in-a-panel/286799)
**Author:** [@elasticfran](https://discuss.elastic.co/u/elasticfran)\ **Replies:** 3\ **Last updated:** [October 15, 2021, 2:26pm UTC](https://discuss.elastic.co/t/how-to-filter-out-a-specific-data-in-a-panel/286799 "2021-10-15T14:26:55Z")
Hey there! Have a question about kibana / dashboard / panel. How can i exclude a given information in a panel? Say i have a graph reporting cities my customers are from, how can i exclude one of the cities? Best! --- ## [Very slow aggregate query](https://discuss.elastic.co/t/very-slow-aggregate-query/286371)
**Author:** [@Giovanni\_Di\_Lembo](https://discuss.elastic.co/u/Giovanni_Di_Lembo)\ **Replies:** 15\ **Last updated:** [October 15, 2021, 2:13pm UTC](https://discuss.elastic.co/t/very-slow-aggregate-query/286371 "2021-10-15T14:13:15Z")
Hi all I have 200 Gb data in Elasticsearch and when I excecute an aggregate query it takes 8 seconds. My client goes in timeout. Actually my query is like that: { "aggs": { "filtered": { "filter": { … --- ## [Logstash creates a 'page.xxx' file, 0KB in size, stopping all log ingestion](https://discuss.elastic.co/t/logstash-creates-a-page-xxx-file-0kb-in-size-stopping-all-log-ingestion/286849)
**Author:** [@jtocher](https://discuss.elastic.co/u/jtocher)\ **Replies:** 0\ **Last updated:** [October 15, 2021, 2:09pm UTC](https://discuss.elastic.co/t/logstash-creates-a-page-xxx-file-0kb-in-size-stopping-all-log-ingestion/286849 "2021-10-15T14:09:26Z")
We're using the Elastic Stack to centralize logs across multiple systems. We're using Windows, and are currently on version 7.10. (Upgrading to 7.15 in the near future.) Occasionally all of our log ingestion halts comp… --- ## [Test Suite error - time.Local vs time.UTC?](https://discuss.elastic.co/t/test-suite-error-time-local-vs-time-utc/286735)
**Author:** [@hinchliff](https://discuss.elastic.co/u/hinchliff)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 2:04pm UTC](https://discuss.elastic.co/t/test-suite-error-time-local-vs-time-utc/286735 "2021-10-15T14:04:11Z")
Seeing some failures for make testsuite for libbeat, that seem to be Timezone related. (My computer is in US Eastern.) command \[go test -cover -coverprofile /tmp/gotestcover-1560318489 github.com/elastic/beats/v7/libbe… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1198) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1200)