# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1214 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1215 --- ## [Scrollbar not present in timelion legend](https://discuss.elastic.co/t/scrollbar-not-present-in-timelion-legend/284051)
**Author:** [@vikramdayma](https://discuss.elastic.co/u/vikramdayma)\ **Replies:** 2\ **Last updated:** [October 5, 2021, 7:23am UTC](https://discuss.elastic.co/t/scrollbar-not-present-in-timelion-legend/284051 "2021-10-05T07:23:44Z")
Hi, I am facing an issue in timelion legend scrollbar. I create a timelion visualization with some trend lines. I create 70 legend dynamically but scroll bar is not displaying to scroll all legend. So all legends ar… --- ## [Logstash did not show any log/message](https://discuss.elastic.co/t/logstash-did-not-show-any-log-message/285888)
**Author:** [@vikramdayma](https://discuss.elastic.co/u/vikramdayma)\ **Replies:** 0\ **Last updated:** [October 5, 2021, 7:22am UTC](https://discuss.elastic.co/t/logstash-did-not-show-any-log-message/285888 "2021-10-05T07:22:13Z")
Hi, I am making a logstash connection to mariadb. Earlier it was working pefectly. But now when I run a .conf file manually, is start and nothing happen after it, neither close nor execute. And also did not give any … --- ## [Why Elasticsearch send more data between the cluster nodes](https://discuss.elastic.co/t/why-elasticsearch-send-more-data-between-the-cluster-nodes/285046)
**Author:** [@ravindrababua](https://discuss.elastic.co/u/ravindrababua)\ **Replies:** 6\ **Last updated:** [October 5, 2021, 6:36am UTC](https://discuss.elastic.co/t/why-elasticsearch-send-more-data-between-the-cluster-nodes/285046 "2021-10-05T06:36:01Z")
We have observed ELK sending the data with in the cluster nodes, we are not sending large data as a input to Elasticsearch. when the data is tool large it throws circuit break exception and cluster goes to YELLOW, but i… --- ## [Does watcher input uses script](https://discuss.elastic.co/t/does-watcher-input-uses-script/285868)
**Author:** [@Munavir\_Chavody](https://discuss.elastic.co/u/Munavir_Chavody)\ **Replies:** 0\ **Last updated:** [October 5, 2021, 3:11am UTC](https://discuss.elastic.co/t/does-watcher-input-uses-script/285868 "2021-10-05T03:11:06Z")
I'm getting dynamic execution circuit breaking error for many watchers in our environment saying that the input search query failed to compile. What is the reason for the same. How can we avoid such errors at all? Erro… --- ## [Split a json array and then split on each object](https://discuss.elastic.co/t/split-a-json-array-and-then-split-on-each-object/285846)
**Author:** [@devtough](https://discuss.elastic.co/u/devtough)\ **Replies:** 7\ **Last updated:** [October 4, 2021, 10:20pm UTC](https://discuss.elastic.co/t/split-a-json-array-and-then-split-on-each-object/285846 "2021-10-04T22:20:21Z")
I would like to configure Logstash so that given a JSON input of \[ { "record": "a", "actions": \[ { "id": 1 }, { "id": 2 } \] }, { "record": "b", "actions": \[ { "id": 3 }, { "id": 4 } \] } \] it outputs {record: "a"… --- ## [Contains an unknown parameter \[\_routing\]](https://discuss.elastic.co/t/contains-an-unknown-parameter-routing/285856)
**Author:** [@manjurgani](https://discuss.elastic.co/u/manjurgani)\ **Replies:** 0\ **Last updated:** [October 4, 2021, 9:49pm UTC](https://discuss.elastic.co/t/contains-an-unknown-parameter-routing/285856 "2021-10-04T21:49:56Z")
Here is my config file for logstash to connect aws Elasticsearch. It works correctly without "routing" input { file { path =\> "C:/Users/manjur.gani/Desktop/ES/test45.csv" start\_position=\>"beginning" } } filte… --- ## [Document Scoring](https://discuss.elastic.co/t/document-scoring/285850)
**Author:** [@leemase004](https://discuss.elastic.co/u/leemase004)\ **Replies:** 0\ **Last updated:** [October 4, 2021, 8:41pm UTC](https://discuss.elastic.co/t/document-scoring/285850 "2021-10-04T20:41:19Z")
I know you can boost a fields score when running query (with the ^ symbol), but I am wondering if you can boost a fields score on/during ingestion when the data is initially coming into Elastic (via ingest pipelines or p… --- ## [Alert on logs error](https://discuss.elastic.co/t/alert-on-logs-error/285772)
**Author:** [@alfredo.deluca](https://discuss.elastic.co/u/alfredo.deluca)\ **Replies:** 6\ **Last updated:** [October 4, 2021, 7:44pm UTC](https://discuss.elastic.co/t/alert-on-logs-error/285772 "2021-10-04T19:44:32Z")
Hi all. I have scripts that run every night to back up gitlab and and at the end it logs a file with the result of that backup. The logs are sent to our Elastic cloud account and from there I want to create an alert wh… --- ## [Improving log ingestion speed and faster elasticsearch indexing](https://discuss.elastic.co/t/improving-log-ingestion-speed-and-faster-elasticsearch-indexing/285841)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 5\ **Last updated:** [October 4, 2021, 7:23pm UTC](https://discuss.elastic.co/t/improving-log-ingestion-speed-and-faster-elasticsearch-indexing/285841 "2021-10-04T19:23:37Z")
Hello, I currently have a single node set up (a single machine where E-L-K is installed ) where a couple of gzip files are being ingested , each of these files would be of ~600MB and has several thousand lines of logs… --- ## [How to sort percentage bar by date?](https://discuss.elastic.co/t/how-to-sort-percentage-bar-by-date/285764)
**Author:** [@ShayWeizman](https://discuss.elastic.co/u/ShayWeizman)\ **Replies:** 3\ **Last updated:** [October 4, 2021, 6:34pm UTC](https://discuss.elastic.co/t/how-to-sort-percentage-bar-by-date/285764 "2021-10-04T18:34:10Z")
Hi All, I'm using v 7.11.1 I have this data structure in elastic: { "\_index" : "testcases", "\_type" : "\_doc", "\_id" : "ub0ll3sB2oqJ9931yhZw", "\_score" : 1.0, "\_source" : { "buildVersion" : "1.1.1.1", "testcase"… --- ## [How to replace logstash read time with log timing?](https://discuss.elastic.co/t/how-to-replace-logstash-read-time-with-log-timing/285834)
**Author:** [@Pradeep\_Kumar2](https://discuss.elastic.co/u/Pradeep_Kumar2)\ **Replies:** 9\ **Last updated:** [October 4, 2021, 6:25pm UTC](https://discuss.elastic.co/t/how-to-replace-logstash-read-time-with-log-timing/285834 "2021-10-04T18:25:56Z")
Hi, I am trying to configure logstash file which will replace the logstash read timestamp or system time with actual log time. In the kibana discover dashboard logs are displayed with logstash read time. How to replace … --- ## [How best to visually represent attempted (and not-attempted) combinations?](https://discuss.elastic.co/t/how-best-to-visually-represent-attempted-and-not-attempted-combinations/285692)
**Author:** [@cgmelastic](https://discuss.elastic.co/u/cgmelastic)\ **Replies:** 4\ **Last updated:** [October 4, 2021, 5:27pm UTC](https://discuss.elastic.co/t/how-best-to-visually-represent-attempted-and-not-attempted-combinations/285692 "2021-10-04T17:27:20Z")
In a game I'm playing, there is a recipe book type thing. The ingredients for a recipe are known but not the specific quantity of each ingredient required to create the recipe, only a minimum and maximum value for each. … --- ## [How to generate Rules for anomaly detection ML?](https://discuss.elastic.co/t/how-to-generate-rules-for-anomaly-detection-ml/285707)
**Author:** [@MLsuper](https://discuss.elastic.co/u/MLsuper)\ **Replies:** 4\ **Last updated:** [October 4, 2021, 3:49pm UTC](https://discuss.elastic.co/t/how-to-generate-rules-for-anomaly-detection-ml/285707 "2021-10-04T15:49:11Z")
When I go to Kibana-\>Alerts and Actions I only see Alerts and Connectors and not Rules, I want to create a rule/generate alerts for anomaly detection(ML job) but I do not see Rules or anomaly detection alert, how do I en… --- ## [FileBeat: decode\_json\_fields processor max\_depth option not working](https://discuss.elastic.co/t/filebeat-decode-json-fields-processor-max-depth-option-not-working/285836)
**Author:** [@Denis\_Baryshev](https://discuss.elastic.co/u/Denis_Baryshev)\ **Replies:** 0\ **Last updated:** [October 4, 2021, 3:40pm UTC](https://discuss.elastic.co/t/filebeat-decode-json-fields-processor-max-depth-option-not-working/285836 "2021-10-04T15:40:37Z")
Plz review --- ## [Parsing data from multiple application servers through logstash](https://discuss.elastic.co/t/parsing-data-from-multiple-application-servers-through-logstash/285069)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 10\ **Last updated:** [October 4, 2021, 3:27pm UTC](https://discuss.elastic.co/t/parsing-data-from-multiple-application-servers-through-logstash/285069 "2021-10-04T15:27:56Z")
Hi Team, I have application running on 2 servers and application logs are getting logged on both the servers, so i want to parse logs from both servers. filebeat is installed on two application servers, logstash is in… --- ## [Need help in understanding query search of elastic search with sub string search](https://discuss.elastic.co/t/need-help-in-understanding-query-search-of-elastic-search-with-sub-string-search/285833)
**Author:** [@S\_basu](https://discuss.elastic.co/u/S_basu)\ **Replies:** 0\ **Last updated:** [October 4, 2021, 2:52pm UTC](https://discuss.elastic.co/t/need-help-in-understanding-query-search-of-elastic-search-with-sub-string-search/285833 "2021-10-04T14:52:32Z")
Hi All, We have created an index with analyzer which uses "keyword" as tokenizer. We have values such in a field as role\_number which may or may not contain any special character such as - or \_, for examplecontains data… --- ## [Is it possible to change the repo backing a searchable snapshot without interruption?](https://discuss.elastic.co/t/is-it-possible-to-change-the-repo-backing-a-searchable-snapshot-without-interruption/285832)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 0\ **Last updated:** [October 4, 2021, 2:49pm UTC](https://discuss.elastic.co/t/is-it-possible-to-change-the-repo-backing-a-searchable-snapshot-without-interruption/285832 "2021-10-04T14:49:46Z")
Hi All, I'm trying to find out if it is possible to change the backing repository of a searchable snapshot? Looking at the docs, it doesn't appear to mention this. Example of what I'm trying to do: Have an index, ind… --- ## [API Bug? Error enabling rule: could not create API key - Unsupported scheme \\"ApiKey\\" for granting API Key](https://discuss.elastic.co/t/api-bug-error-enabling-rule-could-not-create-api-key-unsupported-scheme-apikey-for-granting-api-key/285407)
**Author:** [@jrykowski-huron](https://discuss.elastic.co/u/jrykowski-huron)\ **Replies:** 2\ **Last updated:** [October 4, 2021, 2:48pm UTC](https://discuss.elastic.co/t/api-bug-error-enabling-rule-could-not-create-api-key-unsupported-scheme-apikey-for-granting-api-key/285407 "2021-10-04T14:48:08Z")
Authentication type is ApiKey. Version: 7.14.1 When rule is already Enabled, there is no trouble calling the API endpoint for \_enable. Returns Status Code 204. But if rule is actually Disabled (and therefore need to … --- ## [Work with nested fields in logstash elasticsearch filter](https://discuss.elastic.co/t/work-with-nested-fields-in-logstash-elasticsearch-filter/285828)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 1\ **Last updated:** [October 4, 2021, 2:35pm UTC](https://discuss.elastic.co/t/work-with-nested-fields-in-logstash-elasticsearch-filter/285828 "2021-10-04T14:35:42Z")
hello! i want to enrich my data with the elastic filter . i tried to keep de host.hostname fields of metricbeat without success with this: elasticsearch { hosts =\> "https://xxxx:9200" index =\> "metricbeat" … --- ## [Logstash does not send few log events generally the last ones](https://discuss.elastic.co/t/logstash-does-not-send-few-log-events-generally-the-last-ones/285802)
**Author:** [@Pratyush\_Rath](https://discuss.elastic.co/u/Pratyush_Rath)\ **Replies:** 6\ **Last updated:** [October 4, 2021, 1:44pm UTC](https://discuss.elastic.co/t/logstash-does-not-send-few-log-events-generally-the-last-ones/285802 "2021-10-04T13:44:28Z")
I am using an ELK stack in my local machine . I have tested sending log events from variety of inputs like file, stdin, filebeat and outputs like Elasticsearch, stdout and tried variety of combinations but the Outputs al… --- ## [Send custom metric via MetricBeat](https://discuss.elastic.co/t/send-custom-metric-via-metricbeat/284887)
**Author:** [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\ **Replies:** 1\ **Last updated:** [October 4, 2021, 12:45pm UTC](https://discuss.elastic.co/t/send-custom-metric-via-metricbeat/284887 "2021-10-04T12:45:28Z")
We wish to send custom metrics via metricbeat. Specifically we have an integer, which we can get via a command line argument, from a custom program, which we want to send to elastic via Metricbeat. We want to do this, … --- ## [Sinding date field to elastic search through logstash](https://discuss.elastic.co/t/sinding-date-field-to-elastic-search-through-logstash/285811)
**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\ **Replies:** 5\ **Last updated:** [October 4, 2021, 12:40pm UTC](https://discuss.elastic.co/t/sinding-date-field-to-elastic-search-through-logstash/285811 "2021-10-04T12:40:00Z")
I have log format as 2021-10-04 14:20:27,552 --- and I want field in Elasticsearch as date type but i am getting string type my logstash config file is input { file{ path =\> "D:/Project/ogs/\*\*/\*.log" #path =\> … --- ## [Multiple pipelines mixing records in indexes](https://discuss.elastic.co/t/multiple-pipelines-mixing-records-in-indexes/285705)
**Author:** [@Danny\_Dumenigo](https://discuss.elastic.co/u/Danny_Dumenigo)\ **Replies:** 2\ **Last updated:** [October 4, 2021, 12:35pm UTC](https://discuss.elastic.co/t/multiple-pipelines-mixing-records-in-indexes/285705 "2021-10-04T12:35:13Z")
Hello Community: Im a new user at ELK. I have deployed an ELK stack and everything works fine except for my Logstash pipelines. I explain myself: I have a Logstash server with 3 pipelines defined: Pipeline 1: Manage a… --- ## [My Indices are getting deleted automatically](https://discuss.elastic.co/t/my-indices-are-getting-deleted-automatically/285805)
**Author:** [@nnice](https://discuss.elastic.co/u/nnice)\ **Replies:** 2\ **Last updated:** [October 4, 2021, 11:58am UTC](https://discuss.elastic.co/t/my-indices-are-getting-deleted-automatically/285805 "2021-10-04T11:58:28Z")
Dear Community, I'm new to ELK. Need you assistance why my indices are getting deleted. if you could let me know what is the issue. I'll be highly obliged for that. Thank you soooo muchhhhh # ======================== E… --- ## [Warm data tier nodes are being queried in recent data queries](https://discuss.elastic.co/t/warm-data-tier-nodes-are-being-queried-in-recent-data-queries/285798)
**Author:** [@dordadush](https://discuss.elastic.co/u/dordadush)\ **Replies:** 1\ **Last updated:** [October 4, 2021, 11:28am UTC](https://discuss.elastic.co/t/warm-data-tier-nodes-are-being-queried-in-recent-data-queries/285798 "2021-10-04T11:28:44Z")
Hello everyone! :slight\_smile: I have added a warm data node in my Elastic Cloud deployment. I have also configured the relevant ILM policies to use the Warm phase accordingly. The problem is that the warm nodes are b… --- ## [Elasticsearch - Change nodes to data only](https://discuss.elastic.co/t/elasticsearch-change-nodes-to-data-only/285007)
**Author:** [@voom](https://discuss.elastic.co/u/voom)\ **Replies:** 1\ **Last updated:** [October 4, 2021, 11:02am UTC](https://discuss.elastic.co/t/elasticsearch-change-nodes-to-data-only/285007 "2021-10-04T11:02:25Z")
Hi All, I have an 8 node cluster which is made up of the following roles: 3 master-only nodes 5 master + data nodes I am planning on having the 5 master + data nodes converted to data only and was planning on followi… --- ## [Logstash output to elasic with a pretty print JSON field, but as string (not scattered to fields)](https://discuss.elastic.co/t/logstash-output-to-elasic-with-a-pretty-print-json-field-but-as-string-not-scattered-to-fields/285804)
**Author:** [@dotaneli](https://discuss.elastic.co/u/dotaneli)\ **Replies:** 0\ **Last updated:** [October 4, 2021, 10:28am UTC](https://discuss.elastic.co/t/logstash-output-to-elasic-with-a-pretty-print-json-field-but-as-string-not-scattered-to-fields/285804 "2021-10-04T10:28:30Z")
Hi all. I have a pipline that take a JSON from filebeat. That json has fields that hold json themselvers. Escaped. I want to see in discover the json field as a pretty printed json, but think that I first need to send… --- ## [Logstash Rabbitmq connection refused?](https://discuss.elastic.co/t/logstash-rabbitmq-connection-refused/285801)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 0\ **Last updated:** [October 4, 2021, 10:15am UTC](https://discuss.elastic.co/t/logstash-rabbitmq-connection-refused/285801 "2021-10-04T10:15:56Z")
I am using multiple instances using logstash, First I get an error multiple instance error when I resolved that error. Now I am getting a new error. \[ERROR\]\[logstash.inputs.rabbitmq \] RabbitMQ connection error, will ret… --- ## [Filebeat 7.12 output.file not working](https://discuss.elastic.co/t/filebeat-7-12-output-file-not-working/285797)
**Author:** [@grazia0912](https://discuss.elastic.co/u/grazia0912)\ **Replies:** 1\ **Last updated:** [October 4, 2021, 9:48am UTC](https://discuss.elastic.co/t/filebeat-7-12-output-file-not-working/285797 "2021-10-04T09:48:29Z")
Hi, Please advise why this output.file isn't working. I'm on windows and trying to get the events filebeat is sending to my logstash. I don't have access much on the logstash logs and stuff so i'm trying to output the e… --- ## [Reindex API - Need to improve performance](https://discuss.elastic.co/t/reindex-api-need-to-improve-performance/285453)
**Author:** [@Seba](https://discuss.elastic.co/u/Seba)\ **Replies:** 2\ **Last updated:** [October 4, 2021, 9:40am UTC](https://discuss.elastic.co/t/reindex-api-need-to-improve-performance/285453 "2021-10-04T09:40:07Z")
Hello, The goal is to accelerate the reindex of indexes from an ELK cluster (version 7.6.2) composed of 3 nodes each with all the roles to a datastream in an ELK cluster (version 7.11) installed in a container system w… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1213) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1215)