# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1249 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1250 --- ## [If condtion not working in ingest pipeline](https://discuss.elastic.co/t/if-condtion-not-working-in-ingest-pipeline/283589)
**Author:** [@venkat\_swaminathan](https://discuss.elastic.co/u/venkat_swaminathan)\ **Replies:** 0\ **Last updated:** [September 7, 2021, 11:12pm UTC](https://discuss.elastic.co/t/if-condtion-not-working-in-ingest-pipeline/283589 "2021-09-07T23:12:11Z")
I am trying to set up a ingest pipelines for my Kubernetes cluster logs, but when I try to evaluate a field in the pipeline processor, fields with no dot works ( "if": "ctx.tags == 'audit'") & field with dot characters … --- ## [Filebeat logs not displaying to Kibana](https://discuss.elastic.co/t/filebeat-logs-not-displaying-to-kibana/283385)
**Author:** [@Codedestiny1](https://discuss.elastic.co/u/Codedestiny1)\ **Replies:** 6\ **Last updated:** [September 7, 2021, 10:27pm UTC](https://discuss.elastic.co/t/filebeat-logs-not-displaying-to-kibana/283385 "2021-09-07T22:27:22Z")
Filebeat YAML configuration files automated by Ansible playbook have been installed on two virtual machines (Web1 & Web2). I can SSH into them and find filebeat systemctl service is running (active). But no log data is d… --- ## [How to filter data while migrating from SQL to Elasticsearch using Logstash to obtain a nested strings array in a JSON object](https://discuss.elastic.co/t/how-to-filter-data-while-migrating-from-sql-to-elasticsearch-using-logstash-to-obtain-a-nested-strings-array-in-a-json-object/283585)
**Author:** [@maklil](https://discuss.elastic.co/u/maklil)\ **Replies:** 0\ **Last updated:** [September 7, 2021, 10:25pm UTC](https://discuss.elastic.co/t/how-to-filter-data-while-migrating-from-sql-to-elasticsearch-using-logstash-to-obtain-a-nested-strings-array-in-a-json-object/283585 "2021-09-07T22:25:59Z")
Hi, I'm trying to migrate data from SQL Server to Elasticsearch using Logstash into a certain format. My data is normalized and essentially involves a central table which is linked to other tables by a foreign key, and m… --- ## [Kibana External Search Link](https://discuss.elastic.co/t/kibana-external-search-link/283579)
**Author:** [@mikemitchell](https://discuss.elastic.co/u/mikemitchell)\ **Replies:** 1\ **Last updated:** [September 7, 2021, 9:58pm UTC](https://discuss.elastic.co/t/kibana-external-search-link/283579 "2021-09-07T21:58:46Z")
We would like to manually create a get request to Kibana. All we need from the user currently is the root URL, something like https://elastic.cyborglab.local/, and we're able to create the link that would take them direc… --- ## [Elasticsearch query](https://discuss.elastic.co/t/elasticsearch-query/283575)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 0\ **Last updated:** [September 7, 2021, 7:24pm UTC](https://discuss.elastic.co/t/elasticsearch-query/283575 "2021-09-07T19:24:19Z")
My siem only allows any querys inside query{} I need to do a sort by date like this but the sort needs to be inside the query , any ideas GET /index-\*/\_search { "sort" : \[ { "@timestamp" : {"order": "desc"}} \]… --- ## [How to get percentage of failed tests from all results](https://discuss.elastic.co/t/how-to-get-percentage-of-failed-tests-from-all-results/282818)
**Author:** [@ShayWeizman](https://discuss.elastic.co/u/ShayWeizman)\ **Replies:** 5\ **Last updated:** [September 7, 2021, 6:59pm UTC](https://discuss.elastic.co/t/how-to-get-percentage-of-failed-tests-from-all-results/282818 "2021-09-07T18:59:21Z")
Hi All, I'm using v 7.11.1 I have this data structure in elastic: { "\_index" : "stamshay", "\_type" : "\_doc", "\_id" : "ub0ll3sB2oqJ9931yhZw", "\_score" : 1.0, "\_source" : { "buildVersion" : "1.1.1.1", "testcase" … --- ## [Logastash Exec plugin Cannot allocate memory](https://discuss.elastic.co/t/logastash-exec-plugin-cannot-allocate-memory/283561)
**Author:** [@vikasgurlinka](https://discuss.elastic.co/u/vikasgurlinka)\ **Replies:** 2\ **Last updated:** [September 7, 2021, 6:28pm UTC](https://discuss.elastic.co/t/logastash-exec-plugin-cannot-allocate-memory/283561 "2021-09-07T18:28:31Z")
I am running Logstash 7.9.1 with 24 GB of maximum heap size configured in a Linux machine with 30 GB Memory and configured a pipeline to run a python program with Logstash exec plugin I see the below error message in log… --- ## [How to delete a task in Elasticsearch v7.14](https://discuss.elastic.co/t/how-to-delete-a-task-in-elasticsearch-v7-14/283321)
**Author:** [@Tim\_Estes](https://discuss.elastic.co/u/Tim_Estes)\ **Replies:** 7\ **Last updated:** [September 7, 2021, 5:49pm UTC](https://discuss.elastic.co/t/how-to-delete-a-task-in-elasticsearch-v7-14/283321 "2021-09-07T17:49:45Z")
I'm currently running a delete\_by\_query job and setting the wait\_for\_completion argument to false. In the documentation, it says: Running delete by query asynchronously If the request contains wait\_for\_completion=fals… --- ## [AWS Integrations Mapping Error](https://discuss.elastic.co/t/aws-integrations-mapping-error/283502)
**Author:** [@PhilA](https://discuss.elastic.co/u/PhilA)\ **Replies:** 4\ **Last updated:** [September 7, 2021, 5:17pm UTC](https://discuss.elastic.co/t/aws-integrations-mapping-error/283502 "2021-09-07T17:17:08Z")
Hi I'm hoping this is posted in the correct place. I believe the AWS mappings in the Fleet Integration are missing a mapping for event.created. I am ingesting Cloudtrail logs via Fleet and I'm getting errors stating t… --- ## [Use an Analyzer within a painless script and access the produced terms](https://discuss.elastic.co/t/use-an-analyzer-within-a-painless-script-and-access-the-produced-terms/283474)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 4\ **Last updated:** [September 7, 2021, 5:04pm UTC](https://discuss.elastic.co/t/use-an-analyzer-within-a-painless-script-and-access-the-produced-terms/283474 "2021-09-07T17:04:50Z")
Hi All, I'm trying to find out if something is possible or not within Painless. I'd like to use the English analyzer within a Painless script. I'd then like to use the same painless script to iterate over the created t… --- ## [Search DSL Query value with '(single quote) and space in elastic 6.8](https://discuss.elastic.co/t/search-dsl-query-value-with-single-quote-and-space-in-elastic-6-8/281091)
**Author:** [@joseph-l.amalraj](https://discuss.elastic.co/u/joseph-l.amalraj)\ **Replies:** 6\ **Last updated:** [September 7, 2021, 5:02pm UTC](https://discuss.elastic.co/t/search-dsl-query-value-with-single-quote-and-space-in-elastic-6-8/281091 "2021-09-07T17:02:10Z")
Hi, Actually, i am trying to do Search DSL Query value with '(single quote) like below query (1) and some times with single space Query (2) below, i am not getting expected results, Could you please suggest me for that.… --- ## [How to copy from one nested field to another in elasticsearch?](https://discuss.elastic.co/t/how-to-copy-from-one-nested-field-to-another-in-elasticsearch/283549)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [September 7, 2021, 3:56pm UTC](https://discuss.elastic.co/t/how-to-copy-from-one-nested-field-to-another-in-elasticsearch/283549 "2021-09-07T15:56:57Z")
Hi all, I'm trying to copy from one field to another. I want to copy data from fanLocation.lng to fanLocation.lon in an index. I have already mapped both geo fields with geo\_point i'm unable to use when using nested … --- ## [Logstash pipelines failing as Logstash failed to create queue](https://discuss.elastic.co/t/logstash-pipelines-failing-as-logstash-failed-to-create-queue/283461)
**Author:** [@Rahul\_Dey](https://discuss.elastic.co/u/Rahul_Dey)\ **Replies:** 0\ **Last updated:** [September 6, 2021, 3:21pm UTC](https://discuss.elastic.co/t/logstash-pipelines-failing-as-logstash-failed-to-create-queue/283461 "2021-09-06T15:21:16Z")
I am running logstash in a docker container. There are 7-8 logstash pipelines defined under pipelines.yml file. Queue type for every pipeline is "persisted". Everything was working fine but recently whenever I am startin… --- ## [Cluster stops workning when shutting down master marked with a star? \[7.11.2\]](https://discuss.elastic.co/t/cluster-stops-workning-when-shutting-down-master-marked-with-a-star-7-11-2/283545)
**Author:** [@mbooh](https://discuss.elastic.co/u/mbooh)\ **Replies:** 9\ **Last updated:** [September 7, 2021, 3:40pm UTC](https://discuss.elastic.co/t/cluster-stops-workning-when-shutting-down-master-marked-with-a-star-7-11-2/283545 "2021-09-07T15:40:17Z")
Hi! I have a three node cluster where all nodes are maste nodes and I'm using Kibana for checking status and running queries. Running the command: GET \_cat/nodes Gives me: ip heap.percent ram.percent cpu lo… --- ## [Else if condition is not working?](https://discuss.elastic.co/t/else-if-condition-is-not-working/283544)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 4\ **Last updated:** [September 7, 2021, 2:46pm UTC](https://discuss.elastic.co/t/else-if-condition-is-not-working/283544 "2021-09-07T14:46:14Z")
I want if SubmittedOn is null then add New field with value 1 mutate{ add\_field=\>{"Queue"=\>1} } if \[SubmittedOn\]{ if \[null\] not in \[SubmittedOn\]{ date { m… --- ## [Is there documentation regarding the field names in the logs?](https://discuss.elastic.co/t/is-there-documentation-regarding-the-field-names-in-the-logs/283320)
**Author:** [@a24](https://discuss.elastic.co/u/a24)\ **Replies:** 3\ **Last updated:** [September 7, 2021, 2:44pm UTC](https://discuss.elastic.co/t/is-there-documentation-regarding-the-field-names-in-the-logs/283320 "2021-09-07T14:44:18Z")
I am brand new to kibana. I am looking at my logs and there are some field names I am not familiar with. Is there documentation that will explain the field names to me? thank you --- ## [7.14.0 Kibana discover table layout: message field as raw xml](https://discuss.elastic.co/t/7-14-0-kibana-discover-table-layout-message-field-as-raw-xml/282819)
**Author:** [@jsteenkamp](https://discuss.elastic.co/u/jsteenkamp)\ **Replies:** 2\ **Last updated:** [September 7, 2021, 2:42pm UTC](https://discuss.elastic.co/t/7-14-0-kibana-discover-table-layout-message-field-as-raw-xml/282819 "2021-09-07T14:42:34Z")
In both the classic and new table layout, message xml content is being parsed as html. Is there a way to get a table view that shows the message field content as raw xml. It is possible to see the raw xml content one by… --- ## [Rally \_bulk error 400 "type is missing"](https://discuss.elastic.co/t/rally-bulk-error-400-type-is-missing/283073)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 6\ **Last updated:** [September 2, 2021, 12:39pm UTC](https://discuss.elastic.co/t/rally-bulk-error-400-type-is-missing/283073 "2021-09-02T12:39:31Z")
Hey there, I'm trying to import a custom track exported from an old ES version (still using 'type' field) into another ES cluster (same version). This is the error I faced: \[ERROR\] Cannot race. Error in load generato… --- ## [Logstash unable to connect to elasticsearch](https://discuss.elastic.co/t/logstash-unable-to-connect-to-elasticsearch/283548)
**Author:** [@geetika\_gopi](https://discuss.elastic.co/u/geetika_gopi)\ **Replies:** 0\ **Last updated:** [September 7, 2021, 2:39pm UTC](https://discuss.elastic.co/t/logstash-unable-to-connect-to-elasticsearch/283548 "2021-09-07T14:39:14Z")
I have SSL enabled on all my elastic nodes, using a self signed certificate. However logstash is unable to connect to elasticsearch. Gives the following error \[2021-09-07T10:34:50,283\]\[WARN \]\[logstash.outputs.elasticsea… --- ## [Does logstash support having a list/array in root (top level) of the event](https://discuss.elastic.co/t/does-logstash-support-having-a-list-array-in-root-top-level-of-the-event/283524)
**Author:** [@Renjith\_PK](https://discuss.elastic.co/u/Renjith_PK)\ **Replies:** 4\ **Last updated:** [September 7, 2021, 2:35pm UTC](https://discuss.elastic.co/t/does-logstash-support-having-a-list-array-in-root-top-level-of-the-event/283524 "2021-09-07T14:35:29Z")
We have input data like this message:\[{key1:value1},{key2:value2}\] and we need value of message, which is a list, directly on root of event (to use as zipkin storage) without any additional field. I tried using json fi… --- ## [ElasticSearch script query incorrect values](https://discuss.elastic.co/t/elasticsearch-script-query-incorrect-values/283547)
**Author:** [@me.mohammed](https://discuss.elastic.co/u/me.mohammed)\ **Replies:** 0\ **Last updated:** [September 7, 2021, 2:32pm UTC](https://discuss.elastic.co/t/elasticsearch-script-query-incorrect-values/283547 "2021-09-07T14:32:01Z")
Hello everyone, I'm trying to apply this query GET rdbms\_sync\_idx/\_search { "query":{ "nested":{ "path":"bogoDeals", "query":{ "bool":{ "filter":\[ … --- ## [How to read Different field names with same field value - Elasticsearch](https://discuss.elastic.co/t/how-to-read-different-field-names-with-same-field-value-elasticsearch/283314)
**Author:** [@woal\_idal](https://discuss.elastic.co/u/woal_idal)\ **Replies:** 2\ **Last updated:** [September 7, 2021, 2:08pm UTC](https://discuss.elastic.co/t/how-to-read-different-field-names-with-same-field-value-elasticsearch/283314 "2021-09-07T14:08:32Z")
I have to separate index patterns that will have their own unique fields. For instance in index1 it will contain a field property CorrelationId index2 it will contain a field property UniqueCorrelationId these two fie… --- ## [Kibana embed dashboard: Error authentification](https://discuss.elastic.co/t/kibana-embed-dashboard-error-authentification/283436)
**Author:** [@Abdoul\_Kande](https://discuss.elastic.co/u/Abdoul_Kande)\ **Replies:** 1\ **Last updated:** [September 7, 2021, 2:24pm UTC](https://discuss.elastic.co/t/kibana-embed-dashboard-error-authentification/283436 "2021-09-07T14:24:14Z")
Hello, I have a problem in my kibana authentification. I use an embed dashboard for sharing to some others peoples. But the problem is they cant authenticate when they use chrome. the brower reload and redirect to th… --- ## [How do I get past the 500 record limitation?](https://discuss.elastic.co/t/how-do-i-get-past-the-500-record-limitation/283319)
**Author:** [@a24](https://discuss.elastic.co/u/a24)\ **Replies:** 3\ **Last updated:** [September 7, 2021, 2:18pm UTC](https://discuss.elastic.co/t/how-do-i-get-past-the-500-record-limitation/283319 "2021-09-07T14:18:45Z")
I am brand new to kibana, how do I load more than the 500 record limit? I read somewhere in a post to go to settings. I have no clue where settings even is. I think I am on version 7.8.1. --- ## [Filebeat : how to exclude lines](https://discuss.elastic.co/t/filebeat-how-to-exclude-lines/282306)
**Author:** [@thomas7467](https://discuss.elastic.co/u/thomas7467)\ **Replies:** 6\ **Last updated:** [September 7, 2021, 2:17pm UTC](https://discuss.elastic.co/t/filebeat-how-to-exclude-lines/282306 "2021-09-07T14:17:55Z")
Hi, Using ELK 7.14.0 release. I'm trying to excludes lines from IIS access log files. I've tried several methods but It still will not work. I've done that previously with logstash, but I prefer use a simplified archi… --- ## [Preset time ranges for dashboard or canvas](https://discuss.elastic.co/t/preset-time-ranges-for-dashboard-or-canvas/283057)
**Author:** [@Janujc](https://discuss.elastic.co/u/Janujc)\ **Replies:** 3\ **Last updated:** [September 7, 2021, 1:59pm UTC](https://discuss.elastic.co/t/preset-time-ranges-for-dashboard-or-canvas/283057 "2021-09-07T13:59:14Z")
Hello, I've managed to create a very useful dashboard and canvas but I'm having problems with the time selection. I know the time selection in Kibana has a high degree of flexibility, but I'm creating a dashboard for us… --- ## [How to get the completness of each column by group](https://discuss.elastic.co/t/how-to-get-the-completness-of-each-column-by-group/283542)
**Author:** [@MichaelG](https://discuss.elastic.co/u/MichaelG)\ **Replies:** 0\ **Last updated:** [September 7, 2021, 1:51pm UTC](https://discuss.elastic.co/t/how-to-get-the-completness-of-each-column-by-group/283542 "2021-09-07T13:51:49Z")
I'm trying to get the completeness of every column grouped by a categorical field that know to be 100% complete. Currently I'm able to get the completeness for any given column, grouped by the grouping field like this: … --- ## [Skip\_newline no effect in filestream parsers.multiline](https://discuss.elastic.co/t/skip-newline-no-effect-in-filestream-parsers-multiline/282913)
**Author:** [@kenix](https://discuss.elastic.co/u/kenix)\ **Replies:** 2\ **Last updated:** [September 7, 2021, 1:48pm UTC](https://discuss.elastic.co/t/skip-newline-no-effect-in-filestream-parsers-multiline/282913 "2021-09-07T13:48:28Z")
Context: docker.elastic.co/beats/filebeat-oss:7.14.0 image mac os latest Filebeat settings: filebeat.inputs: - type: filestream enabled: true paths: - /usr/var/log/foo.log parsers: - multiline: type… --- ## [FSCrawler not able to connect to elastic search](https://discuss.elastic.co/t/fscrawler-not-able-to-connect-to-elastic-search/283530)
**Author:** [@Reghu\_Shanker](https://discuss.elastic.co/u/Reghu_Shanker)\ **Replies:** 6\ **Last updated:** [September 7, 2021, 1:38pm UTC](https://discuss.elastic.co/t/fscrawler-not-able-to-connect-to-elastic-search/283530 "2021-09-07T13:38:05Z")
Hi, I have an AWS Elastic Search Instance. I am trying to us FSCrawler along with it. My elastic search version is 7.10 and FSCrawler is fscrawler-es7-2.7.zip I am getting the following error: 17:51:21,439 e\[33mWARN e… --- ## [Doesn't match any of the locations specified by path.repo because this setting is empty"](https://discuss.elastic.co/t/doesnt-match-any-of-the-locations-specified-by-path-repo-because-this-setting-is-empty/283527)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 4\ **Last updated:** [September 7, 2021, 1:06pm UTC](https://discuss.elastic.co/t/doesnt-match-any-of-the-locations-specified-by-path-repo-because-this-setting-is-empty/283527 "2021-09-07T13:06:03Z")
Hello friends i have a problem. I can't backup indices. my elasticsearch.yml file: # ----------------------------------- Paths ------------------------------------ # # Path to directory where to store the data (separat… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1248) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1250)