# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1220 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1221 --- ## [Elasticsearch DSL query, exists and not exists fields](https://discuss.elastic.co/t/elasticsearch-dsl-query-exists-and-not-exists-fields/285489)
**Author:** [@antonisnyc94](https://discuss.elastic.co/u/antonisnyc94)\ **Replies:** 0\ **Last updated:** [September 29, 2021, 2:46pm UTC](https://discuss.elastic.co/t/elasticsearch-dsl-query-exists-and-not-exists-fields/285489 "2021-09-29T14:46:16Z")
Hello, I am trying to achieve the following with DSL querying ( not\_exists: "data.aws.userIdentity.sessionContext.attributes.mfaAuthenticated" AND data.aws.eventName: ConsoleLogin AND data.aws.additionalEventData.MFAUse… --- ## [Filebeat stops shipping events under load](https://discuss.elastic.co/t/filebeat-stops-shipping-events-under-load/285409)
**Author:** [@mirzmaster](https://discuss.elastic.co/u/mirzmaster)\ **Replies:** 2\ **Last updated:** [September 29, 2021, 2:27pm UTC](https://discuss.elastic.co/t/filebeat-stops-shipping-events-under-load/285409 "2021-09-29T14:27:01Z")
I have observed that when Filebeat is shipping container logs which are rapidly growing in size, it reaches some threshold and then just stops shipping events from that logfile. This behaviour was initially suspected to… --- ## [Kibana filter for thousands of IPs](https://discuss.elastic.co/t/kibana-filter-for-thousands-of-ips/285379)
**Author:** [@MasonNorris](https://discuss.elastic.co/u/MasonNorris)\ **Replies:** 8\ **Last updated:** [September 29, 2021, 2:26pm UTC](https://discuss.elastic.co/t/kibana-filter-for-thousands-of-ips/285379 "2021-09-29T14:26:07Z")
Kibana Version: 7.12.1 Is there a way to filter for thousands of IPs in one visualization. Currently I have enabled state:storeinseesion and am using a DSL filter but am limited to 1024 clauses within the DSL filter. I … --- ## [Filebeat stop sending the logs bulk index operations: 400 Bad Request](https://discuss.elastic.co/t/filebeat-stop-sending-the-logs-bulk-index-operations-400-bad-request/285479)
**Author:** [@abhi.logs](https://discuss.elastic.co/u/abhi.logs)\ **Replies:** 0\ **Last updated:** [September 29, 2021, 1:17pm UTC](https://discuss.elastic.co/t/filebeat-stop-sending-the-logs-bulk-index-operations-400-bad-request/285479 "2021-09-29T13:17:19Z")
Filebeat is not sending logs to elastic host. showing some error ERROR \[publisher\_pipeline\_output\] pipeline/output.go:180 failed to publish events: 400 Bad Request: Collected errors: \*\* Error 0: failed to encode bundle… --- ## [Name or service not known](https://discuss.elastic.co/t/name-or-service-not-known/284831)
**Author:** [@mahalanobis](https://discuss.elastic.co/u/mahalanobis)\ **Replies:** 6\ **Last updated:** [September 29, 2021, 12:29pm UTC](https://discuss.elastic.co/t/name-or-service-not-known/284831 "2021-09-29T12:29:50Z")
I'm trying to setup an Elasticsearch cluster but I'm getting "Name or service not known" Below you can find configuration and logs first node logs: https://gist.github.com/sintonag/d6ee4e4c68084a0941c28afcf251b519 sec… --- ## [How to concatenate two fields in logstash?](https://discuss.elastic.co/t/how-to-concatenate-two-fields-in-logstash/285455)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 2\ **Last updated:** [September 29, 2021, 12:13pm UTC](https://discuss.elastic.co/t/how-to-concatenate-two-fields-in-logstash/285455 "2021-09-29T12:13:35Z")
I have json format data. I want to concatenate firstName and LastName. I have tried by using mutate filter filter{ mutate { add\_field =\> { "Full Name" =\> "%{FirstName}%{LastName}" } … --- ## [Want to exclude lines in file having "etluser" keyword](https://discuss.elastic.co/t/want-to-exclude-lines-in-file-having-etluser-keyword/284850)
**Author:** [@Amit\_Johari](https://discuss.elastic.co/u/Amit_Johari)\ **Replies:** 9\ **Last updated:** [September 29, 2021, 11:55am UTC](https://discuss.elastic.co/t/want-to-exclude-lines-in-file-having-etluser-keyword/284850 "2021-09-29T11:55:49Z")
hello team, we want to exclude lines in file having "etluser" keyword. we added this in yml file . Is this correct way to achieve the goal or any other way ? exclude\_lines: \['etluser'\] we have multiple filepath added … --- ## [Is Fleet server able to run synthetic monitoring?](https://discuss.elastic.co/t/is-fleet-server-able-to-run-synthetic-monitoring/285268)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 3\ **Last updated:** [September 29, 2021, 11:40am UTC](https://discuss.elastic.co/t/is-fleet-server-able-to-run-synthetic-monitoring/285268 "2021-09-29T11:40:39Z")
Hey there, I am trying to use the Fleet server to test the synthetic monitoring feature. Using a Docker-compose I am running a single instance for Elasticsearch Kibana Fleet server I would like to know what is the m… --- ## [How many people visit my dashboard?](https://discuss.elastic.co/t/how-many-people-visit-my-dashboard/285466)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 1\ **Last updated:** [September 29, 2021, 11:33am UTC](https://discuss.elastic.co/t/how-many-people-visit-my-dashboard/285466 "2021-09-29T11:33:02Z")
Hello! i want to create a visualization with the number of visit to my dashboard. how can i know how many people visit my dashboard? thanks in advanced! --- ## [Drop event by field type](https://discuss.elastic.co/t/drop-event-by-field-type/285327)
**Author:** [@Vijayakumar\_Kannan](https://discuss.elastic.co/u/Vijayakumar_Kannan)\ **Replies:** 1\ **Last updated:** [September 29, 2021, 11:26am UTC](https://discuss.elastic.co/t/drop-event-by-field-type/285327 "2021-09-29T11:26:18Z")
How to drop the indexing event if the field is not integer ? in the below example i had used 123 it works . if i use abc that event should drop. POST \_ingest/pipeline/\_simulate { "docs": \[ { "\_source": { … --- ## [Logstash Pipeline events emits and received](https://discuss.elastic.co/t/logstash-pipeline-events-emits-and-received/285465)
**Author:** [@vikramdayma](https://discuss.elastic.co/u/vikramdayma)\ **Replies:** 0\ **Last updated:** [September 29, 2021, 11:20am UTC](https://discuss.elastic.co/t/logstash-pipeline-events-emits-and-received/285465 "2021-09-29T11:20:43Z")
Hi, I am setting up a logstash pipeline to get data from sql db. I executed it and monitored it after pipeline completion on kibana server. I saw Events Received and Events Emitted. Both values are different. I did… --- ## [Logstash dropping a lot of logs](https://discuss.elastic.co/t/logstash-dropping-a-lot-of-logs/285429)
**Author:** [@Parthib\_Dutta](https://discuss.elastic.co/u/Parthib_Dutta)\ **Replies:** 2\ **Last updated:** [September 29, 2021, 11:12am UTC](https://discuss.elastic.co/t/logstash-dropping-a-lot-of-logs/285429 "2021-09-29T11:12:44Z")
I have this current setup where Filebeat is reading Lumen logs and forwarding them to Logstash . And Logstash is parsing one of those field in log lines as JSON . I am only seeing partial outputs in my Kibana dashboard a… --- ## [Inconsistency in parsing timestamps for search\_after](https://discuss.elastic.co/t/inconsistency-in-parsing-timestamps-for-search-after/285463)
**Author:** [@muchawiec](https://discuss.elastic.co/u/muchawiec)\ **Replies:** 0\ **Last updated:** [September 29, 2021, 10:33am UTC](https://discuss.elastic.co/t/inconsistency-in-parsing-timestamps-for-search-after/285463 "2021-09-29T10:33:00Z")
Hello, I've been fighting with pagination using search\_after for dates that might be undefined. When I sort in ascending order and the date is undefined I receive in sort property value 9223372036854775807, which I can… --- ## [Set Kibana bar chart bucket order according a metric field](https://discuss.elastic.co/t/set-kibana-bar-chart-bucket-order-according-a-metric-field/285440)
**Author:** [@vikramdayma](https://discuss.elastic.co/u/vikramdayma)\ **Replies:** 1\ **Last updated:** [September 29, 2021, 10:17am UTC](https://discuss.elastic.co/t/set-kibana-bar-chart-bucket-order-according-a-metric-field/285440 "2021-09-29T10:17:47Z")
Hi, I created Bucket bar chart with multiple metric fields. Now I want to sort order descending to a metric field. But I only want to filter this bucket basis of one field. Here is an image I want to descending or… --- ## [Limit the number of pages on kibana datatable visualization](https://discuss.elastic.co/t/limit-the-number-of-pages-on-kibana-datatable-visualization/285031)
**Author:** [@Srikanth\_V](https://discuss.elastic.co/u/Srikanth_V)\ **Replies:** 7\ **Last updated:** [September 29, 2021, 10:11am UTC](https://discuss.elastic.co/t/limit-the-number-of-pages-on-kibana-datatable-visualization/285031 "2021-09-29T10:11:49Z")
Hello people, I'm currently using the kibana dashboard and showing them in my application using iframe. Currently the data table has 100 pages with 10 rows being displayed on each page. Is there is a way to limit the nu… --- ## [Filebeat does not send container logs to elastic cloud](https://discuss.elastic.co/t/filebeat-does-not-send-container-logs-to-elastic-cloud/285461)
**Author:** [@Sharadha\_Krishna](https://discuss.elastic.co/u/Sharadha_Krishna)\ **Replies:** 0\ **Last updated:** [September 29, 2021, 10:10am UTC](https://discuss.elastic.co/t/filebeat-does-not-send-container-logs-to-elastic-cloud/285461 "2021-09-29T10:10:45Z")
Hi, I have set up log collection from docker containers running on EC2 machines to elastic cloud using file beat. But I don't find the logs on kibana. Note: I have setup my own indexes and ILM and templates. I also fin… --- ## [Discover is not showing any data when used date field other than @timestamps](https://discuss.elastic.co/t/discover-is-not-showing-any-data-when-used-date-field-other-than-timestamps/285270)
**Author:** [@Indigo\_Star](https://discuss.elastic.co/u/Indigo_Star)\ **Replies:** 1\ **Last updated:** [September 29, 2021, 9:46am UTC](https://discuss.elastic.co/t/discover-is-not-showing-any-data-when-used-date-field-other-than-timestamps/285270 "2021-09-29T09:46:57Z")
Hi, I am loading offline logs into ELK and I am using my logDate field instead of the @timestamp field while creating the index pattern in Kibana. My field appears in the list of fields with the @timestamp but when i u… --- ## [Where Condition in \_SQL](https://discuss.elastic.co/t/where-condition-in-sql/285427)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 4\ **Last updated:** [September 29, 2021, 9:10am UTC](https://discuss.elastic.co/t/where-condition-in-sql/285427 "2021-09-29T09:10:40Z")
Hello Team I am using Elasticsearch version 7.8.0 I am in need of \_SQL ... curl -X POST "localhost:9200/\_sql?format=txt&pretty" -H 'Content-Type: application/json' -d' { "query": "SELECT count(\*) FROM \\"my-index-000… --- ## [Authentication of \[kibana\_system\] was terminated by realm \[reserved\] - failed to authenticate user \[kibana\_system\]](https://discuss.elastic.co/t/authentication-of-kibana-system-was-terminated-by-realm-reserved-failed-to-authenticate-user-kibana-system/285399)
**Author:** [@dominique.bejean](https://discuss.elastic.co/u/dominique.bejean)\ **Replies:** 1\ **Last updated:** [September 29, 2021, 9:03am UTC](https://discuss.elastic.co/t/authentication-of-kibana-system-was-terminated-by-realm-reserved-failed-to-authenticate-user-kibana-system/285399 "2021-09-29T09:03:16Z")
Hi, I am testing elsatistack 7.14.1 security in a docker-compose stack by following this documentation From the Kibana server, the following resquest works perfectly # curl --user kibana\_system:xxxxxxxxxxxxxxxxxxxxx … --- ## [Can I create a query with multiple filter?](https://discuss.elastic.co/t/can-i-create-a-query-with-multiple-filter/285452)
**Author:** [@psyapathy](https://discuss.elastic.co/u/psyapathy)\ **Replies:** 0\ **Last updated:** [September 29, 2021, 9:02am UTC](https://discuss.elastic.co/t/can-i-create-a-query-with-multiple-filter/285452 "2021-09-29T09:02:44Z")
Hi all! Can I create a query with multiple filter? In my documents i have 2 fields: switch-host and port I want get result with multiple filter. Like: switch-host = host1 and ports = port1,port2,port3 switch-host = … --- ## [About Elastic Cluster status erro](https://discuss.elastic.co/t/about-elastic-cluster-status-erro/285450)
**Author:** [@zekaifeng](https://discuss.elastic.co/u/zekaifeng)\ **Replies:** 1\ **Last updated:** [September 29, 2021, 8:50am UTC](https://discuss.elastic.co/t/about-elastic-cluster-status-erro/285450 "2021-09-29T08:50:39Z")
Elasticsearch version is 7.3.1. Due to the frequent data cleaning of the index in the early morning, memory fusions occur frequently in multiple nodes. At this time, another index is performing a bulk operation, and the… --- ## [TSVB hide empty time intervals](https://discuss.elastic.co/t/tsvb-hide-empty-time-intervals/284721)
**Author:** [@Janujc](https://discuss.elastic.co/u/Janujc)\ **Replies:** 3\ **Last updated:** [September 29, 2021, 8:40am UTC](https://discuss.elastic.co/t/tsvb-hide-empty-time-intervals/284721 "2021-09-29T08:40:55Z")
Hello, I'm wondering if it is possible to hide days (time interval units) when no event was happened in TSVB. I am interested in showing daily events, but when this extends to a longer time period it is very easy to get … --- ## [Does Azure metricbeat module use Consumption API version 2019-10-01](https://discuss.elastic.co/t/does-azure-metricbeat-module-use-consumption-api-version-2019-10-01/285371)
**Author:** [@adhiraj-g](https://discuss.elastic.co/u/adhiraj-g)\ **Replies:** 1\ **Last updated:** [September 29, 2021, 8:40am UTC](https://discuss.elastic.co/t/does-azure-metricbeat-module-use-consumption-api-version-2019-10-01/285371 "2021-09-29T08:40:44Z")
Hi @MarianaD / @Kaiyan\_Sheng You had mentioned regarding raising an issue for Azure SDK with 2019-10-01 consumption API version. This was the link shared: Provide 2019-10-01 version of consumption APIs · Issue #12452 ·… --- ## [JVM automatic heap sizing set too low (version 7.14.1)](https://discuss.elastic.co/t/jvm-automatic-heap-sizing-set-too-low-version-7-14-1/285447)
**Author:** [@simone-smith](https://discuss.elastic.co/u/simone-smith)\ **Replies:** 0\ **Last updated:** [September 29, 2021, 8:07am UTC](https://discuss.elastic.co/t/jvm-automatic-heap-sizing-set-too-low-version-7-14-1/285447 "2021-09-29T08:07:37Z")
I'm running a cluster on version 7.14.1 with the bundled JDK: ubuntu@JaneMisme:/$ /usr/share/elasticsearch/jdk/bin/java -version openjdk version "16.0.2" 2021-07-20 OpenJDK Runtime Environment Temurin-16.0.2+7 (build 16… --- ## [Convert single node to Clustered Nodes](https://discuss.elastic.co/t/convert-single-node-to-clustered-nodes/285432)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 5\ **Last updated:** [September 29, 2021, 7:48am UTC](https://discuss.elastic.co/t/convert-single-node-to-clustered-nodes/285432 "2021-09-29T07:48:23Z")
I have a single node Elasticsearch instance. It had default Elasticsearch yml configuration as below. It has one index with some data. # ======================== Elasticsearch Configuration ========================= # #… --- ## [ELK security 401](https://discuss.elastic.co/t/elk-security-401/285424)
**Author:** [@gmhafiz](https://discuss.elastic.co/u/gmhafiz)\ **Replies:** 2\ **Last updated:** [September 29, 2021, 6:04am UTC](https://discuss.elastic.co/t/elk-security-401/285424 "2021-09-29T06:04:36Z")
I wanted to try out Alerting in Kibana so security needs to be enabled. However, both logstash and kibana isn't able to log into Elasticsearch ELK version: 7.10.1 docker-compose.log.yml version: '3.4' services: el… --- ## [Kibana rules de-duplication behavior](https://discuss.elastic.co/t/kibana-rules-de-duplication-behavior/285168)
**Author:** [@Tkachleo](https://discuss.elastic.co/u/Tkachleo)\ **Replies:** 2\ **Last updated:** [September 29, 2021, 4:53am UTC](https://discuss.elastic.co/t/kibana-rules-de-duplication-behavior/285168 "2021-09-29T04:53:44Z")
Hi, I'm experiencing an issue with the behavior of Kibana Rules. I have Metricbeat writing different metrics to Elasticsearch every 10 seconds. I want to create rules using Elasticsearch Query over the values that are… --- ## [Installing elasticsearch 7.12 , facing java.security.cert.CertificateException error while setting password/installation](https://discuss.elastic.co/t/installing-elasticsearch-7-12-facing-java-security-cert-certificateexception-error-while-setting-password-installation/285062)
**Author:** [@Neha\_goswami](https://discuss.elastic.co/u/Neha_goswami)\ **Replies:** 1\ **Last updated:** [September 29, 2021, 1:24am UTC](https://discuss.elastic.co/t/installing-elasticsearch-7-12-facing-java-security-cert-certificateexception-error-while-setting-password-installation/285062 "2021-09-29T01:24:00Z")
I am setting Elasticsearch 7.12 cluster for the first time and i see below errors: There seems to be some xpack setup issue: \`$ bin/Elasticsearch-setup-passwords interactive warning: usage of JAVA\_HOME is deprecated, … --- ## [Trouble dissecting characters from a word in a string](https://discuss.elastic.co/t/trouble-dissecting-characters-from-a-word-in-a-string/284924)
**Author:** [@elasticperson](https://discuss.elastic.co/u/elasticperson)\ **Replies:** 3\ **Last updated:** [September 29, 2021, 1:06am UTC](https://discuss.elastic.co/t/trouble-dissecting-characters-from-a-word-in-a-string/284924 "2021-09-29T01:06:45Z")
Example strings: thing: xabc123def.testing thing: xghi456jkl.testing Given: String will always begin with x there will be 3 alpha characters there will be 3 numeric characters it may or may not have additional chara… --- ## [How can I disable authentication in Elasticsearch](https://discuss.elastic.co/t/how-can-i-disable-authentication-in-elasticsearch/285418)
**Author:** [@zhaoyi0113](https://discuss.elastic.co/u/zhaoyi0113)\ **Replies:** 2\ **Last updated:** [September 28, 2021, 11:04pm UTC](https://discuss.elastic.co/t/how-can-i-disable-authentication-in-elasticsearch/285418 "2021-09-28T23:04:50Z")
I am running Elasticsearch 7.14.0 and want to disable authentication completely. I set this settings: xpack.security.http.ssl.enabled: false xpack.security.transport.ssl.enabled: false xpack.security.enabled… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1219) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1221)