# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1255 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1256 --- ## [JDBC Logstash Plugin issue](https://discuss.elastic.co/t/jdbc-logstash-plugin-issue/283224)
**Author:** [@valleram](https://discuss.elastic.co/u/valleram)\ **Replies:** 1\ **Last updated:** [September 2, 2021, 11:19pm UTC](https://discuss.elastic.co/t/jdbc-logstash-plugin-issue/283224 "2021-09-02T23:19:23Z")
Hi All, I'm trying to impletement a Logstash pipeline using the JDBC plugin to fetch events from an Oracle database, but I'm receiving following errors. Java::JavaSql::SQLSyntaxErrorException: ORA-00936: missing expres… --- ## [org.elasticsearch.client.indices.IndexTemplateMetaData missing in elasticsearch-rest-high-level-client-7.10.0.jar](https://discuss.elastic.co/t/org-elasticsearch-client-indices-indextemplatemetadata-missing-in-elasticsearch-rest-high-level-client-7-10-0-jar/282700)
**Author:** [@plm](https://discuss.elastic.co/u/plm)\ **Replies:** 6\ **Last updated:** [September 2, 2021, 11:41pm UTC](https://discuss.elastic.co/t/org-elasticsearch-client-indices-indextemplatemetadata-missing-in-elasticsearch-rest-high-level-client-7-10-0-jar/282700 "2021-09-02T23:41:56Z")
Hi, org.elasticsearch.client.indices.IndexTemplateMetaData is present in elasticsearch-rest-high-level-client-7.7.0.jar: ThinkPad-X1-Carbon-6th:~/.m2/repository$ jar tvf org/elasticsearch/client/elasticsearch-rest-high… --- ## [Nested and/or statements](https://discuss.elastic.co/t/nested-and-or-statements/283223)
**Author:** [@d-ring](https://discuss.elastic.co/u/d-ring)\ **Replies:** 0\ **Last updated:** [September 2, 2021, 11:00pm UTC](https://discuss.elastic.co/t/nested-and-or-statements/283223 "2021-09-02T23:00:50Z")
I am working on using some nested and/or statements in my winlogbeat to filter out some noisy logs and I am running into an issue where things are not being dropped as expected. I am curious what I have wrong in this sec… --- ## [Using variables inside of API](https://discuss.elastic.co/t/using-variables-inside-of-api/283219)
**Author:** [@lcarr](https://discuss.elastic.co/u/lcarr)\ **Replies:** 0\ **Last updated:** [September 2, 2021, 9:48pm UTC](https://discuss.elastic.co/t/using-variables-inside-of-api/283219 "2021-09-02T21:48:27Z")
OK - am losing my hair over this - I have a query that I am pulling data from the sample data index - I want to put the value of that query into the Put\_role api via python script - I am getting errors as I am sure tha… --- ## [Develop ELK Cluster](https://discuss.elastic.co/t/develop-elk-cluster/283004)
**Author:** [@psanggabuana](https://discuss.elastic.co/u/psanggabuana)\ **Replies:** 9\ **Last updated:** [September 2, 2021, 10:21pm UTC](https://discuss.elastic.co/t/develop-elk-cluster/283004 "2021-09-02T22:21:05Z")
Hi All, I have plan to create Elastic Cluster. I have prepared 3 elastic servers and SAN Storage. I will create cluster which the three nodes. I need insight to join SAN Storage to the cluster. How to join the SAN S… --- ## [Label template for a link in a script field](https://discuss.elastic.co/t/label-template-for-a-link-in-a-script-field/282649)
**Author:** [@ippo](https://discuss.elastic.co/u/ippo)\ **Replies:** 4\ **Last updated:** [September 2, 2021, 8:04pm UTC](https://discuss.elastic.co/t/label-template-for-a-link-in-a-script-field/282649 "2021-09-02T20:04:07Z")
Hello guys , Since i use multiple fields to create my url my script field return the value of the link . is there any way to put a in label template an emoji :grinning: instead of just some text. ? Also when i click on… --- ## [Heartbeat data transfer](https://discuss.elastic.co/t/heartbeat-data-transfer/283191)
**Author:** [@selin](https://discuss.elastic.co/u/selin)\ **Replies:** 1\ **Last updated:** [September 2, 2021, 5:36pm UTC](https://discuss.elastic.co/t/heartbeat-data-transfer/283191 "2021-09-02T17:36:32Z")
Hi friends, can i know i set heartbeat schedule every 5m (5 minutes). Why it is sending data every 2 minutes? timeout is 16 secodns --- ## [Do ingest pipeline slow down the performance of a cluster?](https://discuss.elastic.co/t/do-ingest-pipeline-slow-down-the-performance-of-a-cluster/283197)
**Author:** [@marone](https://discuss.elastic.co/u/marone)\ **Replies:** 1\ **Last updated:** [September 2, 2021, 4:51pm UTC](https://discuss.elastic.co/t/do-ingest-pipeline-slow-down-the-performance-of-a-cluster/283197 "2021-09-02T16:51:31Z")
Hi I am wondering if transformations (with ingest pipeline) affect the performance of a given cluster. I had some transformations executed outside of ELK cluster, then decided to implement them with processors, the amou… --- ## [Query\_string DSL fails when just one search term word changes - reliably](https://discuss.elastic.co/t/query-string-dsl-fails-when-just-one-search-term-word-changes-reliably/282602)
**Author:** [@steveh](https://discuss.elastic.co/u/steveh)\ **Replies:** 6\ **Last updated:** [September 2, 2021, 4:05pm UTC](https://discuss.elastic.co/t/query-string-dsl-fails-when-just-one-search-term-word-changes-reliably/282602 "2021-09-02T16:05:14Z")
Weird problem I cannot explain or solve! On my production server queries can fail if one word changes. This is reliable. Its just the word change that triggers the error, not a fluke of unfortunate timing (i.e. the se… --- ## [Reverse the autocompleteTerminateAfter parameter?](https://discuss.elastic.co/t/reverse-the-autocompleteterminateafter-parameter/283045)
**Author:** [@gael17](https://discuss.elastic.co/u/gael17)\ **Replies:** 1\ **Last updated:** [September 2, 2021, 4:03pm UTC](https://discuss.elastic.co/t/reverse-the-autocompleteterminateafter-parameter/283045 "2021-09-02T16:03:34Z")
Hey there, I've been using controls in my kibana 7.14 setup. The autocompleteTerminateAfter is not really what I'm looking for. Let me explain: My documents look like: { type: "a" } I've been adding documents of … --- ## [Multiple field value in URL (scripted field)](https://discuss.elastic.co/t/multiple-field-value-in-url-scripted-field/283051)
**Author:** [@Loulou](https://discuss.elastic.co/u/Loulou)\ **Replies:** 1\ **Last updated:** [September 2, 2021, 4:02pm UTC](https://discuss.elastic.co/t/multiple-field-value-in-url-scripted-field/283051 "2021-09-02T16:02:07Z")
Hi, What I want to do is exactly what this user wanted to do as well: How to pass multiple field values of a table to URL So basically the possibility to pass multiple values in a field URL. I tried using the Scripted … --- ## [Fleet managed Elastic Agent environment/deployment name? custom field?](https://discuss.elastic.co/t/fleet-managed-elastic-agent-environment-deployment-name-custom-field/282565)
**Author:** [@mohsen0](https://discuss.elastic.co/u/mohsen0)\ **Replies:** 11\ **Last updated:** [September 2, 2021, 3:59pm UTC](https://discuss.elastic.co/t/fleet-managed-elastic-agent-environment-deployment-name-custom-field/282565 "2021-09-02T15:59:26Z")
Hi I was wondering if there is a way to pass parameters to elastic agents when enrolling happens, to differentiate logs pushed from different environments. On the other hand they are some configuration that can be set … --- ## [Match date field on day in the month](https://discuss.elastic.co/t/match-date-field-on-day-in-the-month/283069)
**Author:** [@orly\_spivak](https://discuss.elastic.co/u/orly_spivak)\ **Replies:** 1\ **Last updated:** [September 2, 2021, 3:58pm UTC](https://discuss.elastic.co/t/match-date-field-on-day-in-the-month/283069 "2021-09-02T15:58:47Z")
Hey, I have a date type field that I wont to match by, and get all documents that the date field in them is the first day of the month. I tried regex but it does not work because it's not a string field. I will be happ… --- ## [Slow query with aggregations](https://discuss.elastic.co/t/slow-query-with-aggregations/283143)
**Author:** [@Drept](https://discuss.elastic.co/u/Drept)\ **Replies:** 7\ **Last updated:** [September 2, 2021, 3:47pm UTC](https://discuss.elastic.co/t/slow-query-with-aggregations/283143 "2021-09-02T15:47:17Z")
I have implemented a system of aggregations for search filters and am enduring speed problems with a bit longer queries: there are no problems when a query contains up to 4 words but extremely slow queries onward. I hav… --- ## [Reduce number of shards to the same index?](https://discuss.elastic.co/t/reduce-number-of-shards-to-the-same-index/283186)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 2\ **Last updated:** [September 2, 2021, 3:27pm UTC](https://discuss.elastic.co/t/reduce-number-of-shards-to-the-same-index/283186 "2021-09-02T15:27:07Z")
Hello I know of the reindex and shrink API calls BUT Im trying to see how to do it without creating a new index (or better yet, without touching the creation date of each index) How can I do this? --- ## [No connection could be made because the target machine actively refused it](https://discuss.elastic.co/t/no-connection-could-be-made-because-the-target-machine-actively-refused-it/283179)
**Author:** [@sarac1](https://discuss.elastic.co/u/sarac1)\ **Replies:** 2\ **Last updated:** [September 2, 2021, 2:54pm UTC](https://discuss.elastic.co/t/no-connection-could-be-made-because-the-target-machine-actively-refused-it/283179 "2021-09-02T14:54:50Z")
Hi, I see this issue comes up often. However the answers in the posts I've looked at have no fixed my issue, I've gotten closer, but not all the way. I have a single ELK system from the latest bitnami 7.14 image. I am… --- ## [Logstash: how to concatenate static field with dynamic field?](https://discuss.elastic.co/t/logstash-how-to-concatenate-static-field-with-dynamic-field/283183)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 1\ **Last updated:** [September 2, 2021, 2:47pm UTC](https://discuss.elastic.co/t/logstash-how-to-concatenate-static-field-with-dynamic-field/283183 "2021-09-02T14:47:37Z")
I'm trying to prepend a static variable to identify certain hosts mutate { add\_field =\> { "\[host\]\[hostname\]" =\> "UK\_\_\[app\]\[host\]" } } I need to preprend "UK\_\_" to all fields of app.host field. But the a… --- ## [Update "Living" values using update by query](https://discuss.elastic.co/t/update-living-values-using-update-by-query/281996)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 2\ **Last updated:** [September 2, 2021, 2:22pm UTC](https://discuss.elastic.co/t/update-living-values-using-update-by-query/281996 "2021-09-02T14:22:08Z")
Hi, I'm attempting to create a "score" field that will hold a value that will change whenever the sum of other fields change, but I'm not sure if this is feasible with update-by-query. For example, if I wanted to create… --- ## [Metricbeats Dashboard showing some data only for 10 seconds](https://discuss.elastic.co/t/metricbeats-dashboard-showing-some-data-only-for-10-seconds/283177)
**Author:** [@oicfar](https://discuss.elastic.co/u/oicfar)\ **Replies:** 0\ **Last updated:** [September 2, 2021, 2:09pm UTC](https://discuss.elastic.co/t/metricbeats-dashboard-showing-some-data-only-for-10-seconds/283177 "2021-09-02T14:09:39Z")
I installed ELK Stack 7.14.x on new server. It works, but the metric dashboard show this only for 10 seconds. For the next 20 seconds it looks so metricbeat is getting this data every 10 seconds # Module: system… --- ## [Create Multiple Indexes from filebeat](https://discuss.elastic.co/t/create-multiple-indexes-from-filebeat/283163)
**Author:** [@rahul\_sirugudi](https://discuss.elastic.co/u/rahul_sirugudi)\ **Replies:** 2\ **Last updated:** [September 2, 2021, 1:54pm UTC](https://discuss.elastic.co/t/create-multiple-indexes-from-filebeat/283163 "2021-09-02T13:54:57Z")
Hi, I am new to ELK stack. I am trying to set up logs for applications. In total we have 29 applications (deb). running in both (autoscaling and spot-fleet in aws). My idea is to use one filebeat configuration on all the… --- ## [Elasticsearch and Kibana network.host CIDR?](https://discuss.elastic.co/t/elasticsearch-and-kibana-network-host-cidr/282612)
**Author:** [@Tydorius](https://discuss.elastic.co/u/Tydorius)\ **Replies:** 3\ **Last updated:** [September 2, 2021, 1:51pm UTC](https://discuss.elastic.co/t/elasticsearch-and-kibana-network-host-cidr/282612 "2021-09-02T13:51:50Z")
Good afternoon (At least, for EST) - Do the various hosts field in the elasticsearch.yml and kibana.yml file support CIDR for restricting access to specific subnets? I attempted to set network.host: 10.0.0.0/24 And E… --- ## [Multiple workers fail to process CSV files when auto detect column names is set](https://discuss.elastic.co/t/multiple-workers-fail-to-process-csv-files-when-auto-detect-column-names-is-set/283121)
**Author:** [@ylmp](https://discuss.elastic.co/u/ylmp)\ **Replies:** 2\ **Last updated:** [September 2, 2021, 1:37pm UTC](https://discuss.elastic.co/t/multiple-workers-fail-to-process-csv-files-when-auto-detect-column-names-is-set/283121 "2021-09-02T13:37:10Z")
The issue described here is related to CSV filter plugin with autodetect\_column\_names set. I experience inconsistent behavior when processing CSV files with multiple workers. Seems that the first line in the file is re… --- ## [Service will not start (RHE7)](https://discuss.elastic.co/t/service-will-not-start-rhe7/282591)
**Author:** [@stacey](https://discuss.elastic.co/u/stacey)\ **Replies:** 7\ **Last updated:** [September 2, 2021, 1:09pm UTC](https://discuss.elastic.co/t/service-will-not-start-rhe7/282591 "2021-09-02T13:09:22Z")
Hi I have installed elasticsearch via the rpm as per the documentation. But I am unable to start the elasticsearch service, but running directly works (with warnings). ES 7.14.0 JDK (bundled): openjdk version "16.0.… --- ## [Parse nested JSON data into logstash](https://discuss.elastic.co/t/parse-nested-json-data-into-logstash/283039)
**Author:** [@Magesh\_02](https://discuss.elastic.co/u/Magesh_02)\ **Replies:** 3\ **Last updated:** [September 2, 2021, 1:05pm UTC](https://discuss.elastic.co/t/parse-nested-json-data-into-logstash/283039 "2021-09-02T13:05:31Z")
New to ELK stack, trying to import my JSON data into elastic serach, but its fails, since my json input is nested types. I have tried many solution but still i could not able to get. here is my input { "Folders": \[ … --- ## [Additional Payload in Watcher](https://discuss.elastic.co/t/additional-payload-in-watcher/282959)
**Author:** [@6igwig](https://discuss.elastic.co/u/6igwig)\ **Replies:** 2\ **Last updated:** [September 2, 2021, 12:27pm UTC](https://discuss.elastic.co/t/additional-payload-in-watcher/282959 "2021-09-02T12:27:29Z")
On this post @spinscale mentioned adding the results of the script transform to an "additional payload" How is that done? (As opposed to replacing the current payload with the results of a transform) --- ## [Difference of min and max aggregation for missing values](https://discuss.elastic.co/t/difference-of-min-and-max-aggregation-for-missing-values/283158)
**Author:** [@str8y](https://discuss.elastic.co/u/str8y)\ **Replies:** 0\ **Last updated:** [September 2, 2021, 10:53am UTC](https://discuss.elastic.co/t/difference-of-min-and-max-aggregation-for-missing-values/283158 "2021-09-02T10:53:18Z")
Hi, I'm trying to understand the difference of the min and max aggregation for documents where all field values are missing. Let's imagine the following simple document: PUT /test/\_doc/1 { "name": "A", "number": n… --- ## [Send openshift metricbeat to remote elasticsearch's custom index](https://discuss.elastic.co/t/send-openshift-metricbeat-to-remote-elasticsearchs-custom-index/283155)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 0\ **Last updated:** [September 2, 2021, 10:18am UTC](https://discuss.elastic.co/t/send-openshift-metricbeat-to-remote-elasticsearchs-custom-index/283155 "2021-09-02T10:18:27Z")
Can anyone tell me how to send the metricbeat data from from openshift to remote elasticsearch custom index? In regular metricbeat yaml file, we have these config: setup.template.enabled: true setup.template.name: "me… --- ## [Kibana KQL issue, Greater than does not work for event.duration field](https://discuss.elastic.co/t/kibana-kql-issue-greater-than-does-not-work-for-event-duration-field/282943)
**Author:** [@geekzy](https://discuss.elastic.co/u/geekzy)\ **Replies:** 3\ **Last updated:** [September 2, 2021, 10:01am UTC](https://discuss.elastic.co/t/kibana-kql-issue-greater-than-does-not-work-for-event-duration-field/282943 "2021-09-02T10:01:32Z")
I am currently on using Kibana v7.13.3. I am ingesting zeek logs into my elastic stack and trying to filter by event duration that exceeds a specific time frame. I have tried using the following basic KQL to filter by: e… --- ## [Wrap text in dashboard table](https://discuss.elastic.co/t/wrap-text-in-dashboard-table/283107)
**Author:** [@elastic9](https://discuss.elastic.co/u/elastic9)\ **Replies:** 1\ **Last updated:** [September 2, 2021, 9:27am UTC](https://discuss.elastic.co/t/wrap-text-in-dashboard-table/283107 "2021-09-02T09:27:48Z")
I'm currently on Kibana 7.13.3, and was wondering if it was possible to wrap text in tables made in the dashboard. I've got long text entries, and when visualising them in the dashboard tables, they seem to just truncate… --- ## [Fleet of agents healthy but not sending data](https://discuss.elastic.co/t/fleet-of-agents-healthy-but-not-sending-data/282440)
**Author:** [@yzpls](https://discuss.elastic.co/u/yzpls)\ **Replies:** 3\ **Last updated:** [September 2, 2021, 9:23am UTC](https://discuss.elastic.co/t/fleet-of-agents-healthy-but-not-sending-data/282440 "2021-09-02T09:23:10Z")
I have a Fleet of Elastic Agents running on a fresh k8s cluster (running latest ECK). I added a couple integrations via Kibana, like the Kubernetes metrics. But the Kubernetes Dashboards are all empty, and nothing shows … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1254) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1256)