# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1229

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1230

---

## [Slow performance on big unstructured file](https://discuss.elastic.co/t/slow-performance-on-big-unstructured-file/284567)

<div class="topic-metadata">

**Author:** [@nestor1](https://discuss.elastic.co/u/nestor1)\
**Replies:** 9\
**Last updated:** [September 22, 2021, 5:31pm UTC](https://discuss.elastic.co/t/slow-performance-on-big-unstructured-file/284567 "2021-09-22T17:31:39Z")

</div>

I have couple of millions small files, but few of them are extremely big (comparing to small ones), around 200-400 GB. Pipeline is set to fetch data from each file (1 file -\> 1 event in Elasticsearch). It's working ok, b…

---

## [Default Name Inferrer not working?](https://discuss.elastic.co/t/default-name-inferrer-not-working/284910)

<div class="topic-metadata">

**Author:** [@bensalerno](https://discuss.elastic.co/u/bensalerno)\
**Replies:** 0\
**Last updated:** [September 22, 2021, 5:08pm UTC](https://discuss.elastic.co/t/default-name-inferrer-not-working/284910 "2021-09-22T17:08:42Z")

</div>

I believe that I'm having trouble with field capitalization in my Nest queries on this topic. ElasticSearch Nest query returning Null values for every field? I was told to try adding .DefaultFieldNameInferrer(p =\> p) t…

---

## [Array index out of bound exception](https://discuss.elastic.co/t/array-index-out-of-bound-exception/283451)

<div class="topic-metadata">

**Author:** [@auto\_reply\_007](https://discuss.elastic.co/u/auto_reply_007)\
**Replies:** 14\
**Last updated:** [September 22, 2021, 4:44pm UTC](https://discuss.elastic.co/t/array-index-out-of-bound-exception/283451 "2021-09-22T16:44:42Z")

</div>

Hello! i have snapshot repository which is located on NFS share, and i'm try to register repo from my local ES instance and got strange error curl -X PUT "192.168.2.11:9200/\_snapshot/delete\_after\_read?pretty" -H 'Conte…

---

## [Old .kibana indexes](https://discuss.elastic.co/t/old-kibana-indexes/284674)

<div class="topic-metadata">

**Author:** [@dabo](https://discuss.elastic.co/u/dabo)\
**Replies:** 2\
**Last updated:** [September 22, 2021, 4:43pm UTC](https://discuss.elastic.co/t/old-kibana-indexes/284674 "2021-09-22T16:43:22Z")

</div>

Hello, I've noticed we have kibana indexes: .kibana-event-log-7.10.2-\* .kibana\_\* .kibana\_task\_manager\_\* And then since we upgraded to 7.13.1 we also have: .kibana-event-log-7.13.1-\* .kibana\_7.13.1\_\* .kibana\_task\_…

---

## [How can I install a specific kibana version in homebrew?](https://discuss.elastic.co/t/how-can-i-install-a-specific-kibana-version-in-homebrew/284785)

<div class="topic-metadata">

**Author:** [@PatrickZhang](https://discuss.elastic.co/u/PatrickZhang)\
**Replies:** 2\
**Last updated:** [September 22, 2021, 4:34pm UTC](https://discuss.elastic.co/t/how-can-i-install-a-specific-kibana-version-in-homebrew/284785 "2021-09-22T16:34:28Z")

</div>

I installed a specific Elasticsearch version (7.9.3) in homebrew. That's the pinned version we run. As a result I have to install a matching kibana version. Doing homebrew search kibana, I only got kibana-full(7.14), ki…

---

## [Is it possible to change document id?](https://discuss.elastic.co/t/is-it-possible-to-change-document-id/284842)

<div class="topic-metadata">

**Author:** [@vovakor1](https://discuss.elastic.co/u/vovakor1)\
**Replies:** 2\
**Last updated:** [September 22, 2021, 4:23pm UTC](https://discuss.elastic.co/t/is-it-possible-to-change-document-id/284842 "2021-09-22T16:23:50Z")

</div>

Could someone help, please? How can I change document id which is used in URL: \<index\_name\>/\_doc/\<id\>

---

## [\[Vega Map\] Zoom levels limited to \[0-10\] when using base map layer](https://discuss.elastic.co/t/vega-map-zoom-levels-limited-to-0-10-when-using-base-map-layer/284691)

<div class="topic-metadata">

**Author:** [@Kayak007](https://discuss.elastic.co/u/Kayak007)\
**Replies:** 3\
**Last updated:** [September 22, 2021, 3:43pm UTC](https://discuss.elastic.co/t/vega-map-zoom-levels-limited-to-0-10-when-using-base-map-layer/284691 "2021-09-22T15:43:32Z")

</div>

Hi, We just updated from Kibana v7.10 to v7.13.2 and there seems to be some changes on the Vega Map visualisations. When using base map layer (mapStyle: false), zoom levels seem to be limited to the range between 1 and…

---

## [Rate aggregation in Java client](https://discuss.elastic.co/t/rate-aggregation-in-java-client/284897)

<div class="topic-metadata">

**Author:** [@gaczm](https://discuss.elastic.co/u/gaczm)\
**Replies:** 0\
**Last updated:** [September 22, 2021, 3:28pm UTC](https://discuss.elastic.co/t/rate-aggregation-in-java-client/284897 "2021-09-22T15:28:50Z")

</div>

Hi, I'm looking for a way to use rate aggregation in Java High Level Client. I haven't found anything about this in docs. I've also looked through source code, but without a luck.

---

## [Filters Aggregation performance](https://discuss.elastic.co/t/filters-aggregation-performance/284894)

<div class="topic-metadata">

**Author:** [@Cristiana\_Tiugan](https://discuss.elastic.co/u/Cristiana_Tiugan)\
**Replies:** 0\
**Last updated:** [September 22, 2021, 3:06pm UTC](https://discuss.elastic.co/t/filters-aggregation-performance/284894 "2021-09-22T15:06:57Z")

</div>

Hello, I have a performance issue regarding the next query. For some context i have a products index on which I have to perform several queries and aggregations based on a configurable set of filters. Now, my index ha…

---

## [All values but not only "other" in values / 0% when a possible value not in log](https://discuss.elastic.co/t/all-values-but-not-only-other-in-values-0-when-a-possible-value-not-in-log/283291)

<div class="topic-metadata">

**Author:** [@Emilaye](https://discuss.elastic.co/u/Emilaye)\
**Replies:** 5\
**Last updated:** [September 22, 2021, 3:05pm UTC](https://discuss.elastic.co/t/all-values-but-not-only-other-in-values-0-when-a-possible-value-not-in-log/283291 "2021-09-22T15:05:53Z")

</div>

Hi there, 1- I got a table in dashboard with value "Others".In fact i'd like to have all values listed at first, how can i have this result ? 2- In a column i can have many values for example A,B,C, i'd like to have 0…

---

## [401 (Unauthorized) loop for kibana](https://discuss.elastic.co/t/401-unauthorized-loop-for-kibana/284881)

<div class="topic-metadata">

**Author:** [@sam3546](https://discuss.elastic.co/u/sam3546)\
**Replies:** 3\
**Last updated:** [September 22, 2021, 2:51pm UTC](https://discuss.elastic.co/t/401-unauthorized-loop-for-kibana/284881 "2021-09-22T14:51:48Z")

</div>

I'll start with i dont know if this is an issue with kibana, browser or my UI but someone might have a suggestion. So i check if kibana is up by hitting https://kibana-instance:5601/api/status which returns either 200 i…

---

## [How to add fields with special characters using painless scripting(Java ES SDK)](https://discuss.elastic.co/t/how-to-add-fields-with-special-characters-using-painless-scripting-java-es-sdk/284888)

<div class="topic-metadata">

**Author:** [@Rahul\_Balaji](https://discuss.elastic.co/u/Rahul_Balaji)\
**Replies:** 0\
**Last updated:** [September 22, 2021, 2:39pm UTC](https://discuss.elastic.co/t/how-to-add-fields-with-special-characters-using-painless-scripting-java-es-sdk/284888 "2021-09-22T14:39:06Z")

</div>

Hi All, I am using ES Java SDK for my insert/update operation. I am using "update by query" with painless scripting. Everything works well but I am facing issues while indexing data with special characters. Please find …

---

## [Custom log collection](https://discuss.elastic.co/t/custom-log-collection/284403)

<div class="topic-metadata">

**Author:** [@Naveen\_Kumar\_Reddy\_S](https://discuss.elastic.co/u/Naveen_Kumar_Reddy_S)\
**Replies:** 2\
**Last updated:** [September 22, 2021, 2:12pm UTC](https://discuss.elastic.co/t/custom-log-collection/284403 "2021-09-22T14:12:10Z")

</div>

How to collect the following information (process, network, metric and Sysmon ) using single agent OR any beat that can collect these information and main thing the output has to be sent to Logstash or ingest pipeline n…

---

## [ES Indices created by component/index template has mismatch in specified data type](https://discuss.elastic.co/t/es-indices-created-by-component-index-template-has-mismatch-in-specified-data-type/284878)

<div class="topic-metadata">

**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\
**Replies:** 0\
**Last updated:** [September 22, 2021, 1:58pm UTC](https://discuss.elastic.co/t/es-indices-created-by-component-index-template-has-mismatch-in-specified-data-type/284878 "2021-09-22T13:58:24Z")

</div>

Hello, I'm using component templates to define mapping and data types (such as long/integer/IP) and have the index templates which inherit these properties . However when the indices are created , the data types are al…

---

## [Failed to write shard level snapshot](https://discuss.elastic.co/t/failed-to-write-shard-level-snapshot/284751)

<div class="topic-metadata">

**Author:** [@francescoo](https://discuss.elastic.co/u/francescoo)\
**Replies:** 2\
**Last updated:** [September 22, 2021, 1:50pm UTC](https://discuss.elastic.co/t/failed-to-write-shard-level-snapshot/284751 "2021-09-22T13:50:34Z")

</div>

Dear all, I hope you can help me to understand the issue we are having performing a snapshot. We have a cluster (Elasticsearch version 7.10.1) of 4 nodes (1 ingest and 3 data/master) running as services on Windows serve…

---

## [Using results from diffierent canvas components to derive new values](https://discuss.elastic.co/t/using-results-from-diffierent-canvas-components-to-derive-new-values/284354)

<div class="topic-metadata">

**Author:** [@CalvinHobbes](https://discuss.elastic.co/u/CalvinHobbes)\
**Replies:** 1\
**Last updated:** [September 22, 2021, 1:21pm UTC](https://discuss.elastic.co/t/using-results-from-diffierent-canvas-components-to-derive-new-values/284354 "2021-09-22T13:21:48Z")

</div>

I’m new to canvas and would like to know if one can create several different elements - say guages to measure error rate, and then have another guage that uses the output of those to generate say, an average health? I h…

---

## [Upgrade Elastic from 7.12.0 to 7.12.1 in docker environment](https://discuss.elastic.co/t/upgrade-elastic-from-7-12-0-to-7-12-1-in-docker-environment/284869)

<div class="topic-metadata">

**Author:** [@palomasun](https://discuss.elastic.co/u/palomasun)\
**Replies:** 1\
**Last updated:** [September 22, 2021, 1:17pm UTC](https://discuss.elastic.co/t/upgrade-elastic-from-7-12-0-to-7-12-1-in-docker-environment/284869 "2021-09-22T13:17:11Z")

</div>

Hello, I need to upgrade my Elasticsearch + kibana , from 7.12.0 to 7.12.1. I have it all in docker environment (with a docker composer file), and I am wondering what is the best way to do it? Can I just update the ve…

---

## [Migrating Beats to Fleet and Elastic Agent via Puppet](https://discuss.elastic.co/t/migrating-beats-to-fleet-and-elastic-agent-via-puppet/284732)

<div class="topic-metadata">

**Author:** [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\
**Replies:** 2\
**Last updated:** [September 22, 2021, 12:42pm UTC](https://discuss.elastic.co/t/migrating-beats-to-fleet-and-elastic-agent-via-puppet/284732 "2021-09-22T12:42:49Z")

</div>

Hello We manage everything Elastic via Puppet. That means Beats, Kibana, etc. How do we migrate from Beats to Fleet, with Puppet? Is there even a way to Configure Fleet via Puppet yet? All I can find, are guides that…

---

## [While reindexing a index, I have empty date fields, date parse error?](https://discuss.elastic.co/t/while-reindexing-a-index-i-have-empty-date-fields-date-parse-error/284868)

<div class="topic-metadata">

**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\
**Replies:** 0\
**Last updated:** [September 22, 2021, 12:42pm UTC](https://discuss.elastic.co/t/while-reindexing-a-index-i-have-empty-date-fields-date-parse-error/284868 "2021-09-22T12:42:11Z")

</div>

Hello Everyone, While reindexing the index from one server to another, I have three date fields except timestamps. Some fields are empty. Due to empty fields I am getting a date parser exception I want it ignore empty d…

---

## [Failed to discover Elasticsearch cluster](https://discuss.elastic.co/t/failed-to-discover-elasticsearch-cluster/284865)

<div class="topic-metadata">

**Author:** [@zhaoyi0113](https://discuss.elastic.co/u/zhaoyi0113)\
**Replies:** 0\
**Last updated:** [September 22, 2021, 12:33pm UTC](https://discuss.elastic.co/t/failed-to-discover-elasticsearch-cluster/284865 "2021-09-22T12:33:50Z")

</div>

I tried to deploy two nodes Elasticsearch cluster but failed on discover master node. One node yml file: cluster.name: elk-cluster network.host: "0.0.0.0" bootstrap.memory\_lock: false node.name: master …

---

## [How do I see how many shards a index is using?](https://discuss.elastic.co/t/how-do-i-see-how-many-shards-a-index-is-using/284606)

<div class="topic-metadata">

**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\
**Replies:** 5\
**Last updated:** [September 22, 2021, 12:27pm UTC](https://discuss.elastic.co/t/how-do-i-see-how-many-shards-a-index-is-using/284606 "2021-09-22T12:27:42Z")

</div>

Hello To check if something is working correctly, I want to see how many shards a index is using. How can I check this thru the dev console? Thank you.

---

## [How to logstash if field equals value assign other field value?](https://discuss.elastic.co/t/how-to-logstash-if-field-equals-value-assign-other-field-value/284857)

<div class="topic-metadata">

**Author:** [@Max\_Wang](https://discuss.elastic.co/u/Max_Wang)\
**Replies:** 2\
**Last updated:** [September 22, 2021, 12:05pm UTC](https://discuss.elastic.co/t/how-to-logstash-if-field-equals-value-assign-other-field-value/284857 "2021-09-22T12:05:07Z")

</div>

I have a logstash conf field A : Value A field B : Value B ——————————————————————————— I would like to become The value of field A is equal to N/A, i will use the value of field B, as follows: field A : N/A -\> …

---

## [How to make multiline to work when deploy filebeat to openshift 3.11](https://discuss.elastic.co/t/how-to-make-multiline-to-work-when-deploy-filebeat-to-openshift-3-11/284858)

<div class="topic-metadata">

**Author:** [@lsy1990](https://discuss.elastic.co/u/lsy1990)\
**Replies:** 0\
**Last updated:** [September 22, 2021, 11:30am UTC](https://discuss.elastic.co/t/how-to-make-multiline-to-work-when-deploy-filebeat-to-openshift-3-11/284858 "2021-09-22T11:30:46Z")

</div>

I deploy filebeat to openshift 3.11. the log is json format like this : {"log":"W0922 10:48:03.257983 1 reflector.go:341\] github.com/kubernetes-incubator/external-storage/lib/controller/controller.go:668: watch of \*v1.…

---

## [Use ILM to reduce the size of an existing index](https://discuss.elastic.co/t/use-ilm-to-reduce-the-size-of-an-existing-index/284709)

<div class="topic-metadata">

**Author:** [@goncalobsantos](https://discuss.elastic.co/u/goncalobsantos)\
**Replies:** 2\
**Last updated:** [September 22, 2021, 10:57am UTC](https://discuss.elastic.co/t/use-ilm-to-reduce-the-size-of-an-existing-index/284709 "2021-09-22T10:57:37Z")

</div>

I have an index that has grown too much and am trying to understand if the index lifecycle management can help me with this problem. The index is approaching the size of 50 GB. From what I have read, I could use ilm to …

---

## [Need to gather the host logs , filebeat running as a container](https://discuss.elastic.co/t/need-to-gather-the-host-logs-filebeat-running-as-a-container/284000)

<div class="topic-metadata">

**Author:** [@mohammed.sabil](https://discuss.elastic.co/u/mohammed.sabil)\
**Replies:** 12\
**Last updated:** [September 22, 2021, 10:44am UTC](https://discuss.elastic.co/t/need-to-gather-the-host-logs-filebeat-running-as-a-container/284000 "2021-09-22T10:44:40Z")

</div>

Hello Team, I am new to ELK and Filebeat. I have ELK stack running on one server using docker-compose. I have Filebeat running on another server as docker container 7.14.1. I have configured filebeat-docker.yml and I…

---

## [Kibana embeded](https://discuss.elastic.co/t/kibana-embeded/282853)

<div class="topic-metadata">

**Author:** [@sam3546](https://discuss.elastic.co/u/sam3546)\
**Replies:** 3\
**Last updated:** [September 22, 2021, 10:36am UTC](https://discuss.elastic.co/t/kibana-embeded/282853 "2021-09-22T10:36:57Z")

</div>

I have a kibana instance embedded in an iframe for ease of use in an secondary application but everytime my users log in they get a popup saying "Unable to update the UI setting" "the server requires a client certificate…

---

## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/284752)

<div class="topic-metadata">

**Author:** [@Olal](https://discuss.elastic.co/u/Olal)\
**Replies:** 7\
**Last updated:** [September 22, 2021, 10:32am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/284752 "2021-09-22T10:32:19Z")

</div>

Hello there , I need help I am getting Error : Kibana server is not ready yet . When I check my Kibana.yml logs . I get this: {"type":"log","@timestamp":"2021-09-21T19:59:32+03:00","tags":\["error","savedobjects-servic…

---

## [Searching in Logs using wildcards does not work](https://discuss.elastic.co/t/searching-in-logs-using-wildcards-does-not-work/284846)

<div class="topic-metadata">

**Author:** [@Glenn\_Glashagen](https://discuss.elastic.co/u/Glenn_Glashagen)\
**Replies:** 0\
**Last updated:** [September 22, 2021, 10:21am UTC](https://discuss.elastic.co/t/searching-in-logs-using-wildcards-does-not-work/284846 "2021-09-22T10:21:57Z")

</div>

Hey all, I'm trying to search for a logline within the Logtailing tab(part of the Observer features): read 24FPS, detection 24FPS, track 24FPS (0) I can find this logline by using the query: message: track however, if…

---

## [Unable to discard hostfs/etc/sv/monit/.kube/ path on my PKS environment](https://discuss.elastic.co/t/unable-to-discard-hostfs-etc-sv-monit-kube-path-on-my-pks-environment/284843)

<div class="topic-metadata">

**Author:** [@oguz\_y](https://discuss.elastic.co/u/oguz_y)\
**Replies:** 0\
**Last updated:** [September 22, 2021, 10:07am UTC](https://discuss.elastic.co/t/unable-to-discard-hostfs-etc-sv-monit-kube-path-on-my-pks-environment/284843 "2021-09-22T10:07:04Z")

</div>

I am using Pivotal Kubernetes clusters on vmware and collecting logs on Splunk. I installed auditbeat and tried to exclude hostfs/etc/sv/monit/.kube/ path but never managed to discard it at file\_integrity module. I tried…

---

## [What is the difference b/w Reindexing and Split index](https://discuss.elastic.co/t/what-is-the-difference-b-w-reindexing-and-split-index/284687)

<div class="topic-metadata">

**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Replies:** 2\
**Last updated:** [September 22, 2021, 10:00am UTC](https://discuss.elastic.co/t/what-is-the-difference-b-w-reindexing-and-split-index/284687 "2021-09-22T10:00:13Z")

</div>

Just reading something about elasticsearch how it route documents,i saw a term called Split API.What is the use Split API,we have reindex api we have clone api.Want to know the difference between in all this could not un…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1228)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1230)
