# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1240 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1241 --- ## [Is it possible to make the custom dashboard links use current dashboard time along with the applied filters?](https://discuss.elastic.co/t/is-it-possible-to-make-the-custom-dashboard-links-use-current-dashboard-time-along-with-the-applied-filters/283203)
**Author:** [@BitBucketUser\_user](https://discuss.elastic.co/u/BitBucketUser_user)\ **Replies:** 2\ **Last updated:** [September 14, 2021, 12:40pm UTC](https://discuss.elastic.co/t/is-it-possible-to-make-the-custom-dashboard-links-use-current-dashboard-time-along-with-the-applied-filters/283203 "2021-09-14T12:40:25Z")
Hello, I used URL formatting option on some of my index pattern fields. These URLs basically redirect me to a different dedicated dashboard when clicked. The dashboard redirection is working very well where the clicked… --- ## [Setting xpack.enabled via Metricbeat Docker hints](https://discuss.elastic.co/t/setting-xpack-enabled-via-metricbeat-docker-hints/284161)
**Author:** [@thilog](https://discuss.elastic.co/u/thilog)\ **Replies:** 1\ **Last updated:** [September 14, 2021, 11:40am UTC](https://discuss.elastic.co/t/setting-xpack-enabled-via-metricbeat-docker-hints/284161 "2021-09-14T11:40:11Z")
Hi there, is there a way to set the xpack.enabled flag for via Metricbeat Docker hints? I tried using the co.elastic.metrics/xpack.enabled label (on the monitored container), but it does not seem to have an effect. Alt… --- ## [Winlogbeat parse CAPI2 Log](https://discuss.elastic.co/t/winlogbeat-parse-capi2-log/282637)
**Author:** [@Marcel\_Palme](https://discuss.elastic.co/u/Marcel_Palme)\ **Replies:** 2\ **Last updated:** [September 14, 2021, 11:20am UTC](https://discuss.elastic.co/t/winlogbeat-parse-capi2-log/282637 "2021-09-14T11:20:27Z")
I check the capi2 log in windows. The transmission to Elastic also works partially. Only that not all fields are transferred. Specifically, I need the field under Userdata | certverifyCertificateChainPolicy | certificat… --- ## [How to calculate the time a request remains in the queue](https://discuss.elastic.co/t/how-to-calculate-the-time-a-request-remains-in-the-queue/284128)
**Author:** [@Higor](https://discuss.elastic.co/u/Higor)\ **Replies:** 2\ **Last updated:** [September 14, 2021, 11:18am UTC](https://discuss.elastic.co/t/how-to-calculate-the-time-a-request-remains-in-the-queue/284128 "2021-09-14T11:18:51Z")
I need to find some way to calculate how long a request remains in the queue. --- ## [Logstash kafka input plugin mutate problem](https://discuss.elastic.co/t/logstash-kafka-input-plugin-mutate-problem/284156)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 1\ **Last updated:** [September 14, 2021, 10:15am UTC](https://discuss.elastic.co/t/logstash-kafka-input-plugin-mutate-problem/284156 "2021-09-14T10:15:16Z")
Dears, I'm trying to load data from kafka topic but have some problem with if statement in filter. This part of the setup doesn't work and I don't know why: replace =\> { "\[@metadata\]\[index\_prefix\]" =\> "kafka-%{+YYYY.M… --- ## [Kibana Lens Visualization showing data as "other" where as I have values for that fields](https://discuss.elastic.co/t/kibana-lens-visualization-showing-data-as-other-where-as-i-have-values-for-that-fields/282659)
**Author:** [@sagar.pattnayak](https://discuss.elastic.co/u/sagar.pattnayak)\ **Replies:** 3\ **Last updated:** [September 14, 2021, 10:05am UTC](https://discuss.elastic.co/t/kibana-lens-visualization-showing-data-as-other-where-as-i-have-values-for-that-fields/282659 "2021-09-14T10:05:15Z")
Hi There, I have created a Kibana Lens visualization (Datatable) where I am showing some tabular data from my index. The problem I have is even if I have some values in one my field (documenttitle), it is showing as "ot… --- ## [Keyword seem to have disappeared](https://discuss.elastic.co/t/keyword-seem-to-have-disappeared/283685)
**Author:** [@Bibas](https://discuss.elastic.co/u/Bibas)\ **Replies:** 5\ **Last updated:** [September 14, 2021, 9:44am UTC](https://discuss.elastic.co/t/keyword-seem-to-have-disappeared/283685 "2021-09-14T09:44:04Z")
Hello I have logs coming from my application, in those logs, there is a "coType" field that used to be a text that contains a keyword subfield. For a reason that I ignore (I don't think I changed the conf file in month… --- ## [Getting errors in web console log after loading Kibana dashboard](https://discuss.elastic.co/t/getting-errors-in-web-console-log-after-loading-kibana-dashboard/284154)
**Author:** [@pranay\_jain](https://discuss.elastic.co/u/pranay_jain)\ **Replies:** 1\ **Last updated:** [September 14, 2021, 9:42am UTC](https://discuss.elastic.co/t/getting-errors-in-web-console-log-after-loading-kibana-dashboard/284154 "2021-09-14T09:42:19Z")
I have Kibana version 7.14.1 installed. After loading the dashboard I noticed that few errors displayed are being on the web console. Refused to execute inline script because it violates the following Content Security P… --- ## [Not exists query](https://discuss.elastic.co/t/not-exists-query/284052)
**Author:** [@ilgrosso](https://discuss.elastic.co/u/ilgrosso)\ **Replies:** 3\ **Last updated:** [September 14, 2021, 9:40am UTC](https://discuss.elastic.co/t/not-exists-query/284052 "2021-09-14T09:40:50Z")
Negating the exists query as suggested by docs does not seem to work as I would intend it, at least with Elasticsearch 7.14. When I send GET to /master\_user/\_search with payload { "query": { "bool": { "must… --- ## [How to design schema for boosting/ranking logic?](https://discuss.elastic.co/t/how-to-design-schema-for-boosting-ranking-logic/284149)
**Author:** [@abhinavkulkarni](https://discuss.elastic.co/u/abhinavkulkarni)\ **Replies:** 3\ **Last updated:** [September 14, 2021, 9:39am UTC](https://discuss.elastic.co/t/how-to-design-schema-for-boosting-ranking-logic/284149 "2021-09-14T09:39:51Z")
Hi, Let us say, I am indexing a bunch of podcasts in my Elasticsearch cluster: Podcast: - \_id (keyword) - email (keyword) - webLink (keyword) - rssLink (keyword) - shortDescription (te… --- ## [Lens page showing blank](https://discuss.elastic.co/t/lens-page-showing-blank/284007)
**Author:** [@savan820](https://discuss.elastic.co/u/savan820)\ **Replies:** 4\ **Last updated:** [September 14, 2021, 9:15am UTC](https://discuss.elastic.co/t/lens-page-showing-blank/284007 "2021-09-14T09:15:35Z")
Lens page showing blank the request pass: "http://localhost:5601/app/lens#/?\_g=(filters:!(),refreshInterval:(pause:!t,value:0),time:(from:now-15m,to:now))" --- ## [Windows filebeat is not shipping logs](https://discuss.elastic.co/t/windows-filebeat-is-not-shipping-logs/281966)
**Author:** [@hellotty](https://discuss.elastic.co/u/hellotty)\ **Replies:** 1\ **Last updated:** [September 14, 2021, 8:58am UTC](https://discuss.elastic.co/t/windows-filebeat-is-not-shipping-logs/281966 "2021-09-14T08:58:07Z")
Hello, I have elk stack installed on my ubuntu and everything works fine. I installed filebeat on windows 8.1 to transfer the log file to elasticsearch (found on ubuntu) and faced with a problem. When starting the fil… --- ## [Logstash s3 output plugin not working properly](https://discuss.elastic.co/t/logstash-s3-output-plugin-not-working-properly/284159)
**Author:** [@vishakha.tyagi.blaze](https://discuss.elastic.co/u/vishakha.tyagi.blaze)\ **Replies:** 0\ **Last updated:** [September 14, 2021, 8:53am UTC](https://discuss.elastic.co/t/logstash-s3-output-plugin-not-working-properly/284159 "2021-09-14T08:53:24Z")
So we are trying to use Logstash to send out some logs to s3 and its not working for some reason. This is the code we are using. output { amazon\_es { hosts =\> \["xxxx"\] … --- ## [Failed to put mappings on indices \[\[\[account\_address\_01112020/M\_Yx-7TTTOeBgtJ-ckrHbw\]\]\], type \[\_doc\] java.lang.IllegalArgumentException: mapper \[quater\] of different type, current\_type \[keyword\], merged\_type \[text\]](https://discuss.elastic.co/t/failed-to-put-mappings-on-indices-account-address-01112020-m-yx-7tttoebgtj-ckrhbw-type-doc-java-lang-illegalargumentexception-mapper-quater-of-different-type-current-type-keyword-merged-type-text/284116)
**Author:** [@Mesut\_Yilmaz](https://discuss.elastic.co/u/Mesut_Yilmaz)\ **Replies:** 4\ **Last updated:** [September 14, 2021, 8:37am UTC](https://discuss.elastic.co/t/failed-to-put-mappings-on-indices-account-address-01112020-m-yx-7tttoebgtj-ckrhbw-type-doc-java-lang-illegalargumentexception-mapper-quater-of-different-type-current-type-keyword-merged-type-text/284116 "2021-09-14T08:37:54Z")
Hi, I am having a problem as below. What could be the reason of this specific problem which was occured only two hours during the day first time and do not know how to repeat the same problem. It occured and does not r… --- ## [Problem installing ruby gem active\_support](https://discuss.elastic.co/t/problem-installing-ruby-gem-active-support/283466)
**Author:** [@chris\_ts24](https://discuss.elastic.co/u/chris_ts24)\ **Replies:** 1\ **Last updated:** [September 14, 2021, 8:33am UTC](https://discuss.elastic.co/t/problem-installing-ruby-gem-active-support/283466 "2021-09-14T08:33:57Z")
Hi all, Some specs: Logstash 7.13.1 Ruby 2.5.0 activesupport 6.1.4.1 I'd like to use some active\_support functionality in my ruby filters that I list in my logstash config files. I'm having a problem however with my… --- ## [How I can use the highlighter in react app](https://discuss.elastic.co/t/how-i-can-use-the-highlighter-in-react-app/283494)
**Author:** [@Drsaud](https://discuss.elastic.co/u/Drsaud)\ **Replies:** 4\ **Last updated:** [September 14, 2021, 8:04am UTC](https://discuss.elastic.co/t/how-i-can-use-the-highlighter-in-react-app/283494 "2021-09-14T08:04:16Z")
Hi, I want to ask how to apply the highlighter in my react app because when I tried it says its not parameter, I try it on my get req axios .get( \`http://localhost:9200/ncar\_index/ncar/\_search?q=${e… --- ## [User Prioritization | Indexing workload Prioritization](https://discuss.elastic.co/t/user-prioritization-indexing-workload-prioritization/284061)
**Author:** [@Chinnu](https://discuss.elastic.co/u/Chinnu)\ **Replies:** 3\ **Last updated:** [September 14, 2021, 7:52am UTC](https://discuss.elastic.co/t/user-prioritization-indexing-workload-prioritization/284061 "2021-09-14T07:52:51Z")
Hello, I am also looking for some documentation on prioritization among Users and Tokens in Cluster. Also, is there some kind of priority that we can set between indexing-load and querying-load ? Reason for asking thi… --- ## [Which Mappings settings can help improve indexing speed?](https://discuss.elastic.co/t/which-mappings-settings-can-help-improve-indexing-speed/283981)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 3\ **Last updated:** [September 14, 2021, 7:50am UTC](https://discuss.elastic.co/t/which-mappings-settings-can-help-improve-indexing-speed/283981 "2021-09-14T07:50:18Z")
Hello, I'm trying to improve the indexing performance on my cluster and everything listed in the tune for indexing speed document was already checked. Currently the indexing is done using Logstash with the elasticsearc… --- ## [What is the right way to query nested fields](https://discuss.elastic.co/t/what-is-the-right-way-to-query-nested-fields/283949)
**Author:** [@eylon\_koren](https://discuss.elastic.co/u/eylon_koren)\ **Replies:** 3\ **Last updated:** [September 14, 2021, 7:36am UTC](https://discuss.elastic.co/t/what-is-the-right-way-to-query-nested-fields/283949 "2021-09-14T07:36:48Z")
Hi ! I am providing accessibility to search on ES using my own UI which uses query string. Selecting query string is essential, beacuse the users might not be familier with advance quering in ES, And I would like to ke… --- ## [Logstash persistent queue settings](https://discuss.elastic.co/t/logstash-persistent-queue-settings/284144)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 6\ **Last updated:** [September 14, 2021, 6:35am UTC](https://discuss.elastic.co/t/logstash-persistent-queue-settings/284144 "2021-09-14T06:35:32Z")
Using logstash 7.13 We are running logstash on linux server which has 4 cpu(s) 15gb of ram of 100gb of ssd. We are using persistent queue settings in logstash but we actually can't sure is this right configuration or c… --- ## [Reindexing is slow process](https://discuss.elastic.co/t/reindexing-is-slow-process/281766)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 6\ **Last updated:** [September 14, 2021, 6:33am UTC](https://discuss.elastic.co/t/reindexing-is-slow-process/281766 "2021-09-14T06:33:43Z")
Running ELK stack 7.13.2 Reindexing is a slow process it takes one day or more than one day. we have 10 indices of 101.4gb reindexing this size of data is costlier even though we close the logstash but nothing happened… --- ## [How to restore backup of linux in windows?](https://discuss.elastic.co/t/how-to-restore-backup-of-linux-in-windows/283874)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 3\ **Last updated:** [September 14, 2021, 6:06am UTC](https://discuss.elastic.co/t/how-to-restore-backup-of-linux-in-windows/283874 "2021-09-14T06:06:19Z")
I have a backup of the Linux index and the ELK stack version is 7.2.0 and I want to restore that backup on Windows. Windows ELK stack version is 7.11.0. I don't know how to backup on different OS. Any way to backup on Wi… --- ## [How to monitor/discover modification of documents?](https://discuss.elastic.co/t/how-to-monitor-discover-modification-of-documents/283629)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 2\ **Last updated:** [September 14, 2021, 4:58am UTC](https://discuss.elastic.co/t/how-to-monitor-discover-modification-of-documents/283629 "2021-09-14T04:58:43Z")
Dears, ELK version: 7.7.0 Is there any way to monitor/discover modification of documents in the ELK? Any idea? Best Regards, Dan --- ## [Logstash api endpoints are not accessible outside the logstash container](https://discuss.elastic.co/t/logstash-api-endpoints-are-not-accessible-outside-the-logstash-container/284135)
**Author:** [@vijayebpzr](https://discuss.elastic.co/u/vijayebpzr)\ **Replies:** 3\ **Last updated:** [September 14, 2021, 4:49am UTC](https://discuss.elastic.co/t/logstash-api-endpoints-are-not-accessible-outside-the-logstash-container/284135 "2021-09-14T04:49:49Z")
We deployed the ELK stack in kubernetes cluster and everything is working fine. Now we are trying to monitor logstash from kibana stack monitoring using metricbeat. We could see that logstash section is not visible in st… --- ## [How to prevent automatic deletion of indices](https://discuss.elastic.co/t/how-to-prevent-automatic-deletion-of-indices/283965)
**Author:** [@asan](https://discuss.elastic.co/u/asan)\ **Replies:** 4\ **Last updated:** [September 14, 2021, 4:45am UTC](https://discuss.elastic.co/t/how-to-prevent-automatic-deletion-of-indices/283965 "2021-09-14T04:45:32Z")
hi After checking history of my logs in Discovery i found out that my logs just stored for 2 weeks and after that history of my logs is deleted. i didn't set up any policy in Index Lifecycle Policies. how can i fix thi… --- ## [How to know the node is unable to work by master node](https://discuss.elastic.co/t/how-to-know-the-node-is-unable-to-work-by-master-node/284134)
**Author:** [@Hungming\_Chiu](https://discuss.elastic.co/u/Hungming_Chiu)\ **Replies:** 1\ **Last updated:** [September 14, 2021, 3:31am UTC](https://discuss.elastic.co/t/how-to-know-the-node-is-unable-to-work-by-master-node/284134 "2021-09-14T03:31:08Z")
Hi there , I would like to know whether the master node enable to find out the node only breath (with ping response), actually it cannot work anymore. Thank you. B.rgds --- ## [Parsing SQL queries using ruby; any recommended gem package?](https://discuss.elastic.co/t/parsing-sql-queries-using-ruby-any-recommended-gem-package/284132)
**Author:** [@SHINRA](https://discuss.elastic.co/u/SHINRA)\ **Replies:** 0\ **Last updated:** [September 14, 2021, 2:44am UTC](https://discuss.elastic.co/t/parsing-sql-queries-using-ruby-any-recommended-gem-package/284132 "2021-09-14T02:44:08Z")
Hi, I'm new to Ruby language and I thought I could still do a simple task of normalizing + parsing SQL query using some third party library; but I had no luck finding any that works to my intention. Here's what I'm try… --- ## [Invalid interval specified, must be non-null and non-empty](https://discuss.elastic.co/t/invalid-interval-specified-must-be-non-null-and-non-empty/283878)
**Author:** [@jcalonso](https://discuss.elastic.co/u/jcalonso)\ **Replies:** 2\ **Last updated:** [September 14, 2021, 1:03am UTC](https://discuss.elastic.co/t/invalid-interval-specified-must-be-non-null-and-non-empty/283878 "2021-09-14T01:03:43Z")
Hi there, I been trying to run the following query on a rollup index, but cant get around the interval error. This is my query: GET /rollup-24hours/\_search { "size": 0, "aggs": { "by\_period": { "aggs": … --- ## [Issues with ILM rollover](https://discuss.elastic.co/t/issues-with-ilm-rollover/284120)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 5\ **Last updated:** [September 13, 2021, 11:59pm UTC](https://discuss.elastic.co/t/issues-with-ilm-rollover/284120 "2021-09-13T23:59:43Z")
version 7.14 I have some indexes that are not rolling over when I expect them to: policy says: \` "max\_primary\_shard\_size": "1gb", and the stats show Storage Size 1.2gb and Primaries 1. Perhaps significantly there … --- ## [Append-Only Index for Life](https://discuss.elastic.co/t/append-only-index-for-life/284054)
**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 11:46pm UTC](https://discuss.elastic.co/t/append-only-index-for-life/284054 "2021-09-13T23:46:57Z")
We currently write audit logs and metrics to an elasticsearch index. I'm trying to find a way to prevent a VM admin user from logging into the VM that runs elasticsearch and being able to delete or update audit log docu… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1239) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1241)