# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1226 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1227 --- ## [How to create a segment/line chart visualization with well-defined time intervals in a dashboard?](https://discuss.elastic.co/t/how-to-create-a-segment-line-chart-visualization-with-well-defined-time-intervals-in-a-dashboard/283881)
**Author:** [@Mario\_Sabetta](https://discuss.elastic.co/u/Mario_Sabetta)\ **Replies:** 2\ **Last updated:** [September 24, 2021, 8:49am UTC](https://discuss.elastic.co/t/how-to-create-a-segment-line-chart-visualization-with-well-defined-time-intervals-in-a-dashboard/283881 "2021-09-24T08:49:10Z")
Hello everyone, I have to make a segment chart with the time intervals as shown in the figure (first picture below). I started doing something similar by doing a simple trapezoidal function with integers on the abscissa… --- ## [Exiting: Failed to create Beat meta file: open /usr/share/heartbeat/data/meta.json.new: permission denied](https://discuss.elastic.co/t/exiting-failed-to-create-beat-meta-file-open-usr-share-heartbeat-data-meta-json-new-permission-denied/284717)
**Author:** [@WookWook](https://discuss.elastic.co/u/WookWook)\ **Replies:** 3\ **Last updated:** [September 24, 2021, 7:57am UTC](https://discuss.elastic.co/t/exiting-failed-to-create-beat-meta-file-open-usr-share-heartbeat-data-meta-json-new-permission-denied/284717 "2021-09-24T07:57:15Z")
I setup Elastic Cloud on Kubernetes on Openshift 4.6. Right now with the following services (Elasticsearch/Kibana/Filebeat) I am now failing to get Heartbeat running. I had it running on another Testcluster without any … --- ## [How to run elasticsearch when installed from source?](https://discuss.elastic.co/t/how-to-run-elasticsearch-when-installed-from-source/285047)
**Author:** [@Rahmat\_Agung\_W](https://discuss.elastic.co/u/Rahmat_Agung_W)\ **Replies:** 3\ **Last updated:** [September 24, 2021, 7:19am UTC](https://discuss.elastic.co/t/how-to-run-elasticsearch-when-installed-from-source/285047 "2021-09-24T07:19:04Z")
Hi, so I want to install Elasticsearch from archieve (Install Elasticsearch from archive on Linux or MacOS | Elasticsearch Guide \[7.15\] | Elastic). Why? Because I need to install them on custom path (by default Elasticse… --- ## [Unable to retrieve more 10k records from elastic search using rest api](https://discuss.elastic.co/t/unable-to-retrieve-more-10k-records-from-elastic-search-using-rest-api/285051)
**Author:** [@Magesh\_02](https://discuss.elastic.co/u/Magesh_02)\ **Replies:** 3\ **Last updated:** [September 24, 2021, 7:11am UTC](https://discuss.elastic.co/t/unable-to-retrieve-more-10k-records-from-elastic-search-using-rest-api/285051 "2021-09-24T07:11:50Z")
I'm trying to get more than 10k records from an Elasticsearch using the Rest api (http://localhost:9200/json-metrics/\_search), but all I have is the rest api link, which is the input to my BI tool. I need those records i… --- ## [Unable to parse multiline json data into logstash](https://discuss.elastic.co/t/unable-to-parse-multiline-json-data-into-logstash/284114)
**Author:** [@Magesh\_02](https://discuss.elastic.co/u/Magesh_02)\ **Replies:** 11\ **Last updated:** [September 24, 2021, 6:17am UTC](https://discuss.elastic.co/t/unable-to-parse-multiline-json-data-into-logstash/284114 "2021-09-24T06:17:09Z")
I have tried to parse my json data into logstash data with separate fields. But unable to parse my data, logstash console struck on pipeline starts line input : { "id": 1, "first\_name": "Frank", "las… --- ## [Slow response times query first couple of times](https://discuss.elastic.co/t/slow-response-times-query-first-couple-of-times/285018)
**Author:** [@Mark\_Schenk](https://discuss.elastic.co/u/Mark_Schenk)\ **Replies:** 2\ **Last updated:** [September 24, 2021, 4:37am UTC](https://discuss.elastic.co/t/slow-response-times-query-first-couple-of-times/285018 "2021-09-24T04:37:59Z")
We have a service which is using ES sporadically, (once every few hours). We noted that the first couple of times we query ES takes a lot longer than subsequent calls. For example if we perform the following query: { … --- ## [Metricbeat not getting the Logstash Containers](https://discuss.elastic.co/t/metricbeat-not-getting-the-logstash-containers/285045)
**Author:** [@ajcb](https://discuss.elastic.co/u/ajcb)\ **Replies:** 0\ **Last updated:** [September 24, 2021, 3:44am UTC](https://discuss.elastic.co/t/metricbeat-not-getting-the-logstash-containers/285045 "2021-09-24T03:44:14Z")
So I deployed metricbeat on an ECS cluster, in the "Number of Containers" visualization in the default Docker dashboard, it says 15 running. but in the "Docker Containers" visualization, the containers aren't 15, when I … --- ## [How to get ctx.payload from Visualize Data Table ( nested aggregations )](https://discuss.elastic.co/t/how-to-get-ctx-payload-from-visualize-data-table-nested-aggregations/283836)
**Author:** [@hanase](https://discuss.elastic.co/u/hanase)\ **Replies:** 5\ **Last updated:** [September 24, 2021, 3:41am UTC](https://discuss.elastic.co/t/how-to-get-ctx-payload-from-visualize-data-table-nested-aggregations/283836 "2021-09-24T03:41:36Z")
Hi elastic community, I create a Visualize Data Table to filter some data, and got response what I expect. then I try to use watcher send alert message when buckets doc\_count greater then a value. what is the correc… --- ## [Packetbeat tls capture does not have server.bytes and source.bytes?](https://discuss.elastic.co/t/packetbeat-tls-capture-does-not-have-server-bytes-and-source-bytes/285044)
**Author:** [@michaelv](https://discuss.elastic.co/u/michaelv)\ **Replies:** 0\ **Last updated:** [September 24, 2021, 3:13am UTC](https://discuss.elastic.co/t/packetbeat-tls-capture-does-not-have-server-bytes-and-source-bytes/285044 "2021-09-24T03:13:07Z")
Hi All, packetbeat when capturing http, there are source.bytes and server.bytes Is there a way to get that for https as well? Regards, Michael --- ## [Failed to connect to backoff](https://discuss.elastic.co/t/failed-to-connect-to-backoff/284922)
**Author:** [@rachelyang](https://discuss.elastic.co/u/rachelyang)\ **Replies:** 4\ **Last updated:** [September 24, 2021, 2:20am UTC](https://discuss.elastic.co/t/failed-to-connect-to-backoff/284922 "2021-09-24T02:20:02Z")
I set up minimum and basic TLS security for the Elasticsearch cluster. The metricbeat cannot push data to the Elasticsearch node. Here is the error in log file. metricbeat\[26335\]: 2021-09-22T18:08:39.471Z ERROR \[publish… --- ## [No processor type exists with name \[attachment\]](https://discuss.elastic.co/t/no-processor-type-exists-with-name-attachment/285013)
**Author:** [@Jihad\_Abdulrazaq](https://discuss.elastic.co/u/Jihad_Abdulrazaq)\ **Replies:** 9\ **Last updated:** [September 24, 2021, 1:45am UTC](https://discuss.elastic.co/t/no-processor-type-exists-with-name-attachment/285013 "2021-09-24T01:45:31Z")
Hello Dears, I am getting below error, while trying to ingest pdf file: “No processor type exists with name \[attachment\]" $params = \[ 'id' =\> 'attachment', 'body' =\> \[ … --- ## [Completion suggester index - What's loaded in heap?](https://discuss.elastic.co/t/completion-suggester-index-whats-loaded-in-heap/285041)
**Author:** [@mattkallo](https://discuss.elastic.co/u/mattkallo)\ **Replies:** 0\ **Last updated:** [September 24, 2021, 12:52am UTC](https://discuss.elastic.co/t/completion-suggester-index-whats-loaded-in-heap/285041 "2021-09-24T00:52:39Z")
I have an index with 20+ fields and the same index has one suggester/completion field. As I understand, completion suggester is loaded into heap for faster response times. My question is - does all the fields in the in… --- ## [Connect to elasticsearch using logstash](https://discuss.elastic.co/t/connect-to-elasticsearch-using-logstash/285021)
**Author:** [@Nikparab](https://discuss.elastic.co/u/Nikparab)\ **Replies:** 2\ **Last updated:** [September 24, 2021, 12:40am UTC](https://discuss.elastic.co/t/connect-to-elasticsearch-using-logstash/285021 "2021-09-24T00:40:06Z")
I have opensearch cluster in aws us-east region and I have logstash installed on aws ubuntu server i us-west region. Both vpc are peered. Still I am not able to load logs to Elasticsearch using logstash Below is the err… --- ## [Elastic Agent on Ubuntu 14.04 constantly updating, never makes a connection](https://discuss.elastic.co/t/elastic-agent-on-ubuntu-14-04-constantly-updating-never-makes-a-connection/285036)
**Author:** [@robrien](https://discuss.elastic.co/u/robrien)\ **Replies:** 1\ **Last updated:** [September 23, 2021, 11:50pm UTC](https://discuss.elastic.co/t/elastic-agent-on-ubuntu-14-04-constantly-updating-never-makes-a-connection/285036 "2021-09-23T23:50:40Z")
I have a server I am unable to get the elastic agent to run on. When running the elastic-agent commands I am not finding much relevant in my searches. Error: failed to communicate with Elastic Agent daemon: rpc error: … --- ## [No Release Notes for Fleet or Elastic Agent for 7.14.2 or 7.15](https://discuss.elastic.co/t/no-release-notes-for-fleet-or-elastic-agent-for-7-14-2-or-7-15/285008)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 4\ **Last updated:** [September 23, 2021, 11:30pm UTC](https://discuss.elastic.co/t/no-release-notes-for-fleet-or-elastic-agent-for-7-14-2-or-7-15/285008 "2021-09-23T23:30:57Z")
Hi All, I noticed there are only release notes for 7.14.0 and 7.14.1 under the release notes section. Am I missing an area where I can find release notes for the newer versions of Fleet and Elastic Agent? --- ## [Kibana monitoring blank page because cluster\_uuid mapping change](https://discuss.elastic.co/t/kibana-monitoring-blank-page-because-cluster-uuid-mapping-change/284710)
**Author:** [@adrian-arapiles](https://discuss.elastic.co/u/adrian-arapiles)\ **Replies:** 2\ **Last updated:** [September 23, 2021, 9:51pm UTC](https://discuss.elastic.co/t/kibana-monitoring-blank-page-because-cluster-uuid-mapping-change/284710 "2021-09-23T21:51:32Z")
Hi all, Yesterday I upgraded my elasticsearch and kibana from 7.12.0 to 7.12.1. I upgraded metricbeat and filebeat too that I used to monitoring and parse logs from elasticsearch. Today when I enter on monitoring page … --- ## [Getting Errors while installing Kibana](https://discuss.elastic.co/t/getting-errors-while-installing-kibana/284837)
**Author:** [@Attyus921](https://discuss.elastic.co/u/Attyus921)\ **Replies:** 1\ **Last updated:** [September 23, 2021, 9:48pm UTC](https://discuss.elastic.co/t/getting-errors-while-installing-kibana/284837 "2021-09-23T21:48:07Z")
Hi team, 2021-09-21T18:30:00Z (UTC) I am trying to Install kibana as developer mode from the link given below. Getting started | Kibana Guide \[master\] | Elastic I have followed each and every step. But while runni… --- ## [Can't find Logstash containers in my Docker Dashboards](https://discuss.elastic.co/t/cant-find-logstash-containers-in-my-docker-dashboards/284860)
**Author:** [@ajcb](https://discuss.elastic.co/u/ajcb)\ **Replies:** 1\ **Last updated:** [September 23, 2021, 9:44pm UTC](https://discuss.elastic.co/t/cant-find-logstash-containers-in-my-docker-dashboards/284860 "2021-09-23T21:44:04Z")
I can't find the metrics for the logstash containers only. I'm checking for Top 20 in that dashboard. Is this a kibana problem or a metricbeat issue? --- ## [PDF report text content not searchable](https://discuss.elastic.co/t/pdf-report-text-content-not-searchable/284963)
**Author:** [@heikis](https://discuss.elastic.co/u/heikis)\ **Replies:** 1\ **Last updated:** [September 23, 2021, 9:34pm UTC](https://discuss.elastic.co/t/pdf-report-text-content-not-searchable/284963 "2021-09-23T21:34:00Z")
Good day! Should I be able to search for text in PDF reports from Kibana? My PDF reports include large tables with text but it seems that text is not searchable in the PDF viewer because the content of the report is just… --- ## [What does this exception mean?](https://discuss.elastic.co/t/what-does-this-exception-mean/285024)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 1\ **Last updated:** [September 23, 2021, 9:16pm UTC](https://discuss.elastic.co/t/what-does-this-exception-mean/285024 "2021-09-23T21:16:35Z")
at java.lang.Thread.run(Thread.java:835) ~\[?:?\] at org.elasticsearch.transport.InboundHandler$1.doRun(InboundHandler.java:224) ~\[elasticsearch-7.3.1.jar:7.3.1\] at org.elasticsearch.common.util.concurrent… --- ## [Disallow memory-mapping](https://discuss.elastic.co/t/disallow-memory-mapping/284770)
**Author:** [@Gotze\_des\_Pobels](https://discuss.elastic.co/u/Gotze_des_Pobels)\ **Replies:** 1\ **Last updated:** [September 23, 2021, 9:00pm UTC](https://discuss.elastic.co/t/disallow-memory-mapping/284770 "2021-09-23T21:00:16Z")
Are there any disadvantages of setting node.store.allow\_mmap=false ? I'm trying to run 3 nodes via docker-compose on a openVZ machine and cant increase max\_map\_count from 65536 to 262144. What is the worst that could… --- ## [Substring with grokPattern](https://discuss.elastic.co/t/substring-with-grokpattern/285026)
**Author:** [@mvasqueznr](https://discuss.elastic.co/u/mvasqueznr)\ **Replies:** 1\ **Last updated:** [September 23, 2021, 8:48pm UTC](https://discuss.elastic.co/t/substring-with-grokpattern/285026 "2021-09-23T20:48:31Z")
Hi. With this example data GigabitEthernet102/0/0/28 = TLU-46356\_CAR\_ONE\_RIVERO\_AUTO\_CENTER\_PRINCIPAL Traffic (SNMP Traffic) Down (The interface is disconnected: ifOperStatus=down (2) (code: PE058)) Im try to get a s… --- ## [Kibana Lens Table Date Format](https://discuss.elastic.co/t/kibana-lens-table-date-format/284746)
**Author:** [@fefontana](https://discuss.elastic.co/u/fefontana)\ **Replies:** 6\ **Last updated:** [September 23, 2021, 8:52pm UTC](https://discuss.elastic.co/t/kibana-lens-table-date-format/284746 "2021-09-23T20:52:26Z")
Hi, using a table in Kibana Lens I can't get a formatted date at the "Log Date" column. The date format changes according to the time period. Below is the JSON I've been using and the screenshots with the issue { "too… --- ## [ES 7.8 often giving errors "Data too large for http\_request", but some evidence makes no sense](https://discuss.elastic.co/t/es-7-8-often-giving-errors-data-too-large-for-http-request-but-some-evidence-makes-no-sense/285016)
**Author:** [@spdoes](https://discuss.elastic.co/u/spdoes)\ **Replies:** 8\ **Last updated:** [September 23, 2021, 8:51pm UTC](https://discuss.elastic.co/t/es-7-8-often-giving-errors-data-too-large-for-http-request-but-some-evidence-makes-no-sense/285016 "2021-09-23T20:51:53Z")
summary of error message: \[parent\] Data too large, data for \[\\] would be \[31095660714/28.9gb\], which is larger than the limit of \[30601641984/28.5gb\], real usage: \[31095659536/28.9gb\], new bytes reserved: … --- ## [Sharing index templates](https://discuss.elastic.co/t/sharing-index-templates/285023)
**Author:** [@Elitlogik](https://discuss.elastic.co/u/Elitlogik)\ **Replies:** 2\ **Last updated:** [September 23, 2021, 8:49pm UTC](https://discuss.elastic.co/t/sharing-index-templates/285023 "2021-09-23T20:49:59Z")
I have set up Index Templates and Kibana objects that I think many people out there would like to copy. Sharing Saved Objects as exported ndjson files is easy. How can I share Index Templates configuration for other to… --- ## [How to round to 2 digits after comma scripted field parameter value](https://discuss.elastic.co/t/how-to-round-to-2-digits-after-comma-scripted-field-parameter-value/282032)
**Author:** [@arisxf](https://discuss.elastic.co/u/arisxf)\ **Replies:** 9\ **Last updated:** [September 23, 2021, 6:32pm UTC](https://discuss.elastic.co/t/how-to-round-to-2-digits-after-comma-scripted-field-parameter-value/282032 "2021-09-23T18:32:00Z")
Management/Index Patterns/{indexing}/scripted field Visualize Visualize please all help --- ## [Multiple query and aggregation filter](https://discuss.elastic.co/t/multiple-query-and-aggregation-filter/285020)
**Author:** [@Roberto\_B](https://discuss.elastic.co/u/Roberto_B)\ **Replies:** 0\ **Last updated:** [September 23, 2021, 5:42pm UTC](https://discuss.elastic.co/t/multiple-query-and-aggregation-filter/285020 "2021-09-23T17:42:07Z")
Let's assume that i have in input 3 different query that fetch data from 3 different tables. from the first i take for example 4 fields one of them is "id\_test" and it is common and present in the other 2 input query r… --- ## [Filebeat modules config: failed to publish events: temporary bulk send failure](https://discuss.elastic.co/t/filebeat-modules-config-failed-to-publish-events-temporary-bulk-send-failure/284948)
**Author:** [@cdalexndr](https://discuss.elastic.co/u/cdalexndr)\ **Replies:** 3\ **Last updated:** [September 23, 2021, 4:06pm UTC](https://discuss.elastic.co/t/filebeat-modules-config-failed-to-publish-events-temporary-bulk-send-failure/284948 "2021-09-23T16:06:07Z")
Just upgraded elastic stack from 7.10.1 to 7.14.1, and now filebeat doesn't work! Filebeat logs repeats the following lines: filebeat | 2021-09-22T21:57:46.145Z INFO \[esclientleg\] eslegclient/connecti… --- ## [Logstash tags entries as\_grokparsefailures but multiple online debuggers says otherwise](https://discuss.elastic.co/t/logstash-tags-entries-as-grokparsefailures-but-multiple-online-debuggers-says-otherwise/283753)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 11\ **Last updated:** [September 23, 2021, 2:56pm UTC](https://discuss.elastic.co/t/logstash-tags-entries-as-grokparsefailures-but-multiple-online-debuggers-says-otherwise/283753 "2021-09-23T14:56:19Z")
Hi All, I've a very strange question that I hope to explain eloquently. I'm dealing with FW logs. Already wrote a grok parser that works like a charm (prefer not to provided it here, let me know if it's going to be need… --- ## [How can I parse nested JSON object with arrays and dict into Elasticsearch using Logstash](https://discuss.elastic.co/t/how-can-i-parse-nested-json-object-with-arrays-and-dict-into-elasticsearch-using-logstash/284971)
**Author:** [@shaikadil95](https://discuss.elastic.co/u/shaikadil95)\ **Replies:** 1\ **Last updated:** [September 23, 2021, 2:43pm UTC](https://discuss.elastic.co/t/how-can-i-parse-nested-json-object-with-arrays-and-dict-into-elasticsearch-using-logstash/284971 "2021-09-23T14:43:14Z")
I have a nested JSON object below. { "data": { "testChannels": \[ { "name": "TC1", "Time": "2021-08-31 12:02:51.103188", "info": { "user": "johan", "epic": "Epic" … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1225) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1227)