# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1245 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1246 --- ## [Multilevel aggregation does not show correct results as compare to total hits](https://discuss.elastic.co/t/multilevel-aggregation-does-not-show-correct-results-as-compare-to-total-hits/283760)
**Author:** [@Khurram\_Fraz](https://discuss.elastic.co/u/Khurram_Fraz)\ **Replies:** 7\ **Last updated:** [September 10, 2021, 9:27am UTC](https://discuss.elastic.co/t/multilevel-aggregation-does-not-show-correct-results-as-compare-to-total-hits/283760 "2021-09-10T09:27:56Z")
Hi I am facing issue in aggregation withing aggregation as results count does not match with total hits, but when I search aggregation on single record without second level aggregation then shows correct counts. I have… --- ## [Metricbeat - filesystem How does metricbeat decide what filesystems to monitor?](https://discuss.elastic.co/t/metricbeat-filesystem-how-does-metricbeat-decide-what-filesystems-to-monitor/283828)
**Author:** [@Newbie2019](https://discuss.elastic.co/u/Newbie2019)\ **Replies:** 1\ **Last updated:** [September 10, 2021, 9:27am UTC](https://discuss.elastic.co/t/metricbeat-filesystem-how-does-metricbeat-decide-what-filesystems-to-monitor/283828 "2021-09-10T09:27:53Z")
I have a question, how does metricbeat decide what filesystems it will monitor? I configured the system module, made sure that metricsets filesystem was added, made sure no FS were being ignored, but I still could not s… --- ## [Generate CSV log file automatically from kibana -\> discover -\>share](https://discuss.elastic.co/t/generate-csv-log-file-automatically-from-kibana-discover-share/283160)
**Author:** [@suresh123](https://discuss.elastic.co/u/suresh123)\ **Replies:** 1\ **Last updated:** [September 10, 2021, 8:16am UTC](https://discuss.elastic.co/t/generate-csv-log-file-automatically-from-kibana-discover-share/283160 "2021-09-10T08:16:00Z")
Hello Team, How to automatically download CSV report from Kibana -\> discover -\> share -\> CSV reports -\> Geerate csv (either shell script or any automation script) Regards, Suresh --- ## [Kibana filter window](https://discuss.elastic.co/t/kibana-filter-window/283522)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 12\ **Last updated:** [September 10, 2021, 7:48am UTC](https://discuss.elastic.co/t/kibana-filter-window/283522 "2021-09-10T07:48:32Z")
Hi, In kibana (currently 7.14.1) we often use the filter window when working on the 'discover' pages. One chooses the concerning field, the operator and then in the past in the past the value field had a dropdown whi… --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/283826)
**Author:** [@LombardoAndrea195](https://discuss.elastic.co/u/LombardoAndrea195)\ **Replies:** 4\ **Last updated:** [September 10, 2021, 7:34am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/283826 "2021-09-10T07:34:44Z")
I use this script for generating kibana and elastic with docker version: "2" services: zookeeper: image: wurstmeister/zookeeper:3.4.6 ports: - "2181:2181" kafka: image: wurstmeister/kafka … --- ## [Action \[indices:admin/auto\_create\] is unauthorized for API key id \[####\] of user \[elastic/fleet-server\] on indices \[metricbeat-7.14.1-2021.09.08\], this action is granted by the index privileges \[auto\_configure,create\_index,manage,all\]](https://discuss.elastic.co/t/action-indices-admin-auto-create-is-unauthorized-for-api-key-id-of-user-elastic-fleet-server-on-indices-metricbeat-7-14-1-2021-09-08-this-action-is-granted-by-the-index-privileges-auto-configure-create-index-manage-all/283608)
**Author:** [@hamiland](https://discuss.elastic.co/u/hamiland)\ **Replies:** 29\ **Last updated:** [September 10, 2021, 7:16am UTC](https://discuss.elastic.co/t/action-indices-admin-auto-create-is-unauthorized-for-api-key-id-of-user-elastic-fleet-server-on-indices-metricbeat-7-14-1-2021-09-08-this-action-is-granted-by-the-index-privileges-auto-configure-create-index-manage-all/283608 "2021-09-10T07:16:16Z")
Hi All, I'm a bit green in the Elastic world so please bear with me. I have Fleet agents deployed to our Windows hosts, however I am having issues when Either "Collect Windows perfmon and service metrics" in the Window… --- ## [Logstash 7.11 ruby filter error](https://discuss.elastic.co/t/logstash-7-11-ruby-filter-error/283844)
**Author:** [@shharukh](https://discuss.elastic.co/u/shharukh)\ **Replies:** 0\ **Last updated:** [September 10, 2021, 7:09am UTC](https://discuss.elastic.co/t/logstash-7-11-ruby-filter-error/283844 "2021-09-10T07:09:51Z")
Hello World, I wanted to add 5 hours in my datetime through logstash. have found a way in logstash 6.4. ruby { code =\> 'event.set("@timestamp", LogStash::Timestamp.new(Time.at(event.get("@timestamp").to\_f+86400)))' … --- ## [Running up Cluster in Docker with TLS on a Mac - Issues](https://discuss.elastic.co/t/running-up-cluster-in-docker-with-tls-on-a-mac-issues/283748)
**Author:** [@neil6323](https://discuss.elastic.co/u/neil6323)\ **Replies:** 1\ **Last updated:** [September 10, 2021, 6:27am UTC](https://discuss.elastic.co/t/running-up-cluster-in-docker-with-tls-on-a-mac-issues/283748 "2021-09-10T06:27:03Z")
I'm trying to run up an ES cluster which has TLS using Docker on a Mac. I'm using the instructions given in https://www.elastic.co/guide/en/elasticsearch/reference/current/docker.html Versions are all latest available. … --- ## [Kibana showing "invalid Zlib data" after upgrading to 7.14](https://discuss.elastic.co/t/kibana-showing-invalid-zlib-data-after-upgrading-to-7-14/282699)
**Author:** [@lorax](https://discuss.elastic.co/u/lorax)\ **Replies:** 3\ **Last updated:** [September 10, 2021, 5:46am UTC](https://discuss.elastic.co/t/kibana-showing-invalid-zlib-data-after-upgrading-to-7-14/282699 "2021-09-10T05:46:12Z")
I have an elastic server as. an "all-in-one" with filebeat-\>Logstash-\>Elastic flow. I use Cerebro to check status. The data was visible and working well prior to upgrading to 7.14, but afterward I see Elastic is working… --- ## [Kibana slowness and random errors](https://discuss.elastic.co/t/kibana-slowness-and-random-errors/283444)
**Author:** [@mitesh.gangaramani](https://discuss.elastic.co/u/mitesh.gangaramani)\ **Replies:** 5\ **Last updated:** [September 10, 2021, 5:15am UTC](https://discuss.elastic.co/t/kibana-slowness-and-random-errors/283444 "2021-09-10T05:15:01Z")
Hello Experts, Kibana becomes too slow sometimes and keep loading. Also, I want to know if the current elasticsearch setup is correct or not as sometimes it shows spikes in CPU and RAM and stop logs from some nodes. Se… --- ## [Warm data nodes receiving documents without warm data ILM](https://discuss.elastic.co/t/warm-data-nodes-receiving-documents-without-warm-data-ilm/283486)
**Author:** [@Derick\_Jansen](https://discuss.elastic.co/u/Derick_Jansen)\ **Replies:** 9\ **Last updated:** [September 10, 2021, 4:38am UTC](https://discuss.elastic.co/t/warm-data-nodes-receiving-documents-without-warm-data-ilm/283486 "2021-09-10T04:38:58Z")
Today I added 2 warm data nodes to our 3 node cluster. This is the first time we are using anything besides hot nodes so I have some observations and questions. The 3 hot data nodes have roles as below "roles" : \[… --- ## [Unable to install composable template from the logstash.outputs.elasticsearch plugin](https://discuss.elastic.co/t/unable-to-install-composable-template-from-the-logstash-outputs-elasticsearch-plugin/283835)
**Author:** [@Usman18](https://discuss.elastic.co/u/Usman18)\ **Replies:** 0\ **Last updated:** [September 10, 2021, 1:39am UTC](https://discuss.elastic.co/t/unable-to-install-composable-template-from-the-logstash-outputs-elasticsearch-plugin/283835 "2021-09-10T01:39:45Z")
When I try to load a composable template from the logstash into the elasticsearch using the logstash output elasticsearch plugin, I get the error Failed to install template. {:message=\>"Got response code '400' contactin… --- ## [Working with key:value arrays](https://discuss.elastic.co/t/working-with-key-value-arrays/283772)
**Author:** [@awer1967](https://discuss.elastic.co/u/awer1967)\ **Replies:** 4\ **Last updated:** [September 10, 2021, 1:06am UTC](https://discuss.elastic.co/t/working-with-key-value-arrays/283772 "2021-09-10T01:06:04Z")
Good day ! Accordingly to my logstash configuration I get a message with an array consists of key:value pairs. I have to mutate it on a very special way adding two fields and put there the key and the value . For examp… --- ## [Miscellaneous Questions on the back of Ricardo's all you want too know about filebeat](https://discuss.elastic.co/t/miscellaneous-questions-on-the-back-of-ricardos-all-you-want-too-know-about-filebeat/283528)
**Author:** [@George\_Leonard](https://discuss.elastic.co/u/George_Leonard)\ **Replies:** 7\ **Last updated:** [September 10, 2021, 12:44am UTC](https://discuss.elastic.co/t/miscellaneous-questions-on-the-back-of-ricardos-all-you-want-too-know-about-filebeat/283528 "2021-09-10T00:44:15Z")
As I was working through Ricardo's Youtube video I ended with the below below question, I posted them in the Video comment section but thinking might get more traction reposting here. I'm a total noob wrt EK still, and … --- ## [Kibana installation: why does it try to connect to dynatrace on start up?](https://discuss.elastic.co/t/kibana-installation-why-does-it-try-to-connect-to-dynatrace-on-start-up/283782)
**Author:** [@mrproper](https://discuss.elastic.co/u/mrproper)\ **Replies:** 2\ **Last updated:** [September 10, 2021, 12:09am UTC](https://discuss.elastic.co/t/kibana-installation-why-does-it-try-to-connect-to-dynatrace-on-start-up/283782 "2021-09-10T00:09:37Z")
Hi! Trying to install Kibana 7.14.1 as yum package or from zip onto CentOS 7. Getting error while starting: \[XXX@YYYY kibana-7.14.1-linux-x86\_64\]$ ./bin/kibana /home/XXX/kibana-7.14.1-linux-x86\_64/src/cli/dist.js:10 … --- ## [The need of gpgkey](https://discuss.elastic.co/t/the-need-of-gpgkey/283774)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 1\ **Last updated:** [September 9, 2021, 11:37pm UTC](https://discuss.elastic.co/t/the-need-of-gpgkey/283774 "2021-09-09T23:37:03Z")
I am performing my installation of Kibana (full ELK stack) in my production environment now. As I am going through the documentation I see that when installing it indicates the need to add the lines : baseurl=https://… --- ## [Trial license expired](https://discuss.elastic.co/t/trial-license-expired/283705)
**Author:** [@eh2021-elastic](https://discuss.elastic.co/u/eh2021-elastic)\ **Replies:** 9\ **Last updated:** [September 9, 2021, 11:26pm UTC](https://discuss.elastic.co/t/trial-license-expired/283705 "2021-09-09T23:26:48Z")
I am running elastic 7.11 and had the enterprise trial license installed. We have xpack security enabled via the elastic configs and I noticed it says when reverting to basic the security will be disabled. Does changing … --- ## [Install ES stack in a k8s cluster composed of multiple machines](https://discuss.elastic.co/t/install-es-stack-in-a-k8s-cluster-composed-of-multiple-machines/283373)
**Author:** [@bigESFan](https://discuss.elastic.co/u/bigESFan)\ **Replies:** 3\ **Last updated:** [September 9, 2021, 11:25pm UTC](https://discuss.elastic.co/t/install-es-stack-in-a-k8s-cluster-composed-of-multiple-machines/283373 "2021-09-09T23:25:00Z")
I want to install ES stack in a K8s cluster composed of multiple machines which runs vanilla K8s. These machines are all on-prem machines running Ubuntu, hence I need to install ES stack on in-house servers, not on any … --- ## [Elsticsearch-py doubt create and index](https://discuss.elastic.co/t/elsticsearch-py-doubt-create-and-index/283695)
**Author:** [@LombardoAndrea195](https://discuss.elastic.co/u/LombardoAndrea195)\ **Replies:** 6\ **Last updated:** [September 9, 2021, 11:12pm UTC](https://discuss.elastic.co/t/elsticsearch-py-doubt-create-and-index/283695 "2021-09-09T23:12:54Z")
Hi all I've a doubt about the difference between create and index. link Can someone explain to me when I can use one or the other one? I expose the problem. I read from a queue data and in loop a document at times need t… --- ## [System Integration Filters](https://discuss.elastic.co/t/system-integration-filters/283588)
**Author:** [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Replies:** 3\ **Last updated:** [September 9, 2021, 10:54pm UTC](https://discuss.elastic.co/t/system-integration-filters/283588 "2021-09-09T22:54:09Z")
Hello, For the System integration for elastic-agent, I was curious if we could filter by log level, or eliminate various Event ID's that we may not want to collect due to noise. Collection of all informational logs at s… --- ## [Removing \_source increases size of index](https://discuss.elastic.co/t/removing-source-increases-size-of-index/283699)
**Author:** [@Dan\_Christensen](https://discuss.elastic.co/u/Dan_Christensen)\ **Replies:** 3\ **Last updated:** [September 9, 2021, 10:06pm UTC](https://discuss.elastic.co/t/removing-source-increases-size-of-index/283699 "2021-09-09T22:06:00Z")
I've been trying to find ways to optimize my index size in Elasticsearch. In order to understand the size impact of the \_source field, I dumped an index and re-indexed into another index with \_source {enabled:false}. The… --- ## [Logstash - Difference between date into new field](https://discuss.elastic.co/t/logstash-difference-between-date-into-new-field/283818)
**Author:** [@stemons](https://discuss.elastic.co/u/stemons)\ **Replies:** 6\ **Last updated:** [September 9, 2021, 10:02pm UTC](https://discuss.elastic.co/t/logstash-difference-between-date-into-new-field/283818 "2021-09-09T22:02:17Z")
Hello team, I'm trying to add a new field to metricbeat data collection through logstash. The idea is to create a field from the difference between two dates (@timestamp and system.process.cpu.start\_date). I've made so… --- ## [Questions regarding auto-reload and encryption](https://discuss.elastic.co/t/questions-regarding-auto-reload-and-encryption/283758)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 6\ **Last updated:** [September 9, 2021, 7:40pm UTC](https://discuss.elastic.co/t/questions-regarding-auto-reload-and-encryption/283758 "2021-09-09T19:40:23Z")
Apologies beforehand for the dilettante question. I have an up and running Logstash configuration. Now and then I edit my grok parser and then I always have to type systemctl restart logstash so that the latest config i… --- ## [How do I delete all the graph vertices for a particular field?](https://discuss.elastic.co/t/how-do-i-delete-all-the-graph-vertices-for-a-particular-field/283706)
**Author:** [@elizobee](https://discuss.elastic.co/u/elizobee)\ **Replies:** 2\ **Last updated:** [September 9, 2021, 7:42pm UTC](https://discuss.elastic.co/t/how-do-i-delete-all-the-graph-vertices-for-a-particular-field/283706 "2021-09-09T19:42:42Z")
I can deselect or disable a field from appearing in my graph. But this only applies to new vertices. The old ones remain and can be deleted one by one. I have a lot of vertices and do not want to delete them one by on… --- ## [Infinite extent for field "field": \[Infinity, -Infinity\]](https://discuss.elastic.co/t/infinite-extent-for-field-field-infinity-infinity/282387)
**Author:** [@LombardoAndrea195](https://discuss.elastic.co/u/LombardoAndrea195)\ **Replies:** 1\ **Last updated:** [September 9, 2021, 5:19pm UTC](https://discuss.elastic.co/t/infinite-extent-for-field-field-infinity-infinity/282387 "2021-09-09T17:19:23Z")
Hi all! I decided to use the suggestion on this link that suggest to create panel of vega with altair. Everything works fine except for the warning. I've tried to remove warnings on setting advance but I dindn't mange to… --- ## [Kibana Visualizations imported into Canvas cannot inherit global time range](https://discuss.elastic.co/t/kibana-visualizations-imported-into-canvas-cannot-inherit-global-time-range/283333)
**Author:** [@Robert\_Gates](https://discuss.elastic.co/u/Robert_Gates)\ **Replies:** 3\ **Last updated:** [September 9, 2021, 4:49pm UTC](https://discuss.elastic.co/t/kibana-visualizations-imported-into-canvas-cannot-inherit-global-time-range/283333 "2021-09-09T16:49:25Z")
When importing an existing visualisation into a canvas ('Add Element' \> 'Add from Kibana') I expected the global time range to apply to all elements. As it is, it seems to hardcode to last 15 minutes, and I'm unable… --- ## [Logstash Ruby Tmp Folders - Temporary Solution](https://discuss.elastic.co/t/logstash-ruby-tmp-folders-temporary-solution/283793)
**Author:** [@Tydorius](https://discuss.elastic.co/u/Tydorius)\ **Replies:** 0\ **Last updated:** [September 9, 2021, 2:38pm UTC](https://discuss.elastic.co/t/logstash-ruby-tmp-folders-temporary-solution/283793 "2021-09-09T14:38:55Z")
I am currently experiencing the known issue where JRuby files are not cleaned up in /tmp on CentOS 7. My temporary resolution has been to set up a cron job to remove these folders. To save others trouble, here is my set… --- ## [Can 'scripted field' in index patterns be used to calculate a value using two existing fields?](https://discuss.elastic.co/t/can-scripted-field-in-index-patterns-be-used-to-calculate-a-value-using-two-existing-fields/283778)
**Author:** [@lchen](https://discuss.elastic.co/u/lchen)\ **Replies:** 3\ **Last updated:** [September 9, 2021, 3:36pm UTC](https://discuss.elastic.co/t/can-scripted-field-in-index-patterns-be-used-to-calculate-a-value-using-two-existing-fields/283778 "2021-09-09T15:36:59Z")
I have two timestamp fields in my index and I want to calculate the time difference between two fields using scripted fields, and after that, I want to use fields in the visualization. is this possible? --- ## [Disable swap on Linux?](https://discuss.elastic.co/t/disable-swap-on-linux/283266)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 5\ **Last updated:** [September 9, 2021, 3:04pm UTC](https://discuss.elastic.co/t/disable-swap-on-linux/283266 "2021-09-09T15:04:22Z")
Hello Reading this Disable swapping | Elasticsearch Guide \[master\] | Elastic it seems the general advice is to disable swap completely....That being said, I have Elastic, Logstash and Kibana all installed on the same se… --- ## [Lookup fields / index](https://discuss.elastic.co/t/lookup-fields-index/283680)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 1\ **Last updated:** [September 8, 2021, 4:48pm UTC](https://discuss.elastic.co/t/lookup-fields-index/283680 "2021-09-08T16:48:51Z")
Hi, Consider an index with a field with error-codes in it (version 7.14.1) . Is it possible to (for example) have another index (or another way to store a list of key:value data) with the errorcode as key and a descrip… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1244) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1246)