# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1263 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1264 --- ## [FileBeat loses 10 seconds of logs on rotation](https://discuss.elastic.co/t/filebeat-loses-10-seconds-of-logs-on-rotation/282227)
**Author:** [@jj12341](https://discuss.elastic.co/u/jj12341)\ **Replies:** 9\ **Last updated:** [August 27, 2021, 1:56pm UTC](https://discuss.elastic.co/t/filebeat-loses-10-seconds-of-logs-on-rotation/282227 "2021-08-27T13:56:52Z")
Hi! My FileBeat is losing 10 seconds of approximately logs. Obviously the problem is in the rotation of the files, but I can not find the correct option so that these logs are not lost. The Rotation of Logs performs Lo… --- ## [Stop words if present in query\_string query behaving different in elastic 6.2 and 7.5](https://discuss.elastic.co/t/stop-words-if-present-in-query-string-query-behaving-different-in-elastic-6-2-and-7-5/282675)
**Author:** [@nishant.saini](https://discuss.elastic.co/u/nishant.saini)\ **Replies:** 0\ **Last updated:** [August 27, 2021, 1:39pm UTC](https://discuss.elastic.co/t/stop-words-if-present-in-query-string-query-behaving-different-in-elastic-6-2-and-7-5/282675 "2021-08-27T13:39:57Z")
I'm unable to understand why the below query is behaving differently in the two versions. { "query": { "bool": { "must": \[ { "query\_string": { "query": "(field1:\\"best\\"^300 AND… --- ## [Using Kibana Console API does not show more than 10 Entries](https://discuss.elastic.co/t/using-kibana-console-api-does-not-show-more-than-10-entries/282672)
**Author:** [@aeimbeck](https://discuss.elastic.co/u/aeimbeck)\ **Replies:** 0\ **Last updated:** [August 27, 2021, 1:29pm UTC](https://discuss.elastic.co/t/using-kibana-console-api-does-not-show-more-than-10-entries/282672 "2021-08-27T13:29:55Z")
Hello, I am trying to figure out how to increase the amount of entries the Kibana API returns when I am querying Elasticsearch via the API (I cannot access the Elastic from outside, so I need to use the Kibana API). I … --- ## [Term aggregation on all document](https://discuss.elastic.co/t/term-aggregation-on-all-document/282665)
**Author:** [@glefloch](https://discuss.elastic.co/u/glefloch)\ **Replies:** 0\ **Last updated:** [August 27, 2021, 12:23pm UTC](https://discuss.elastic.co/t/term-aggregation-on-all-document/282665 "2021-08-27T12:23:52Z")
Hi, I'm working with Elasticsearch and I would like to be able to do something like: Grouping documents into a bucket depending on a field Computing on an other field Using a percentile\_bucket aggregation to get the r… --- ## [Kibana vega lite concat views](https://discuss.elastic.co/t/kibana-vega-lite-concat-views/280282)
**Author:** [@MTV](https://discuss.elastic.co/u/MTV)\ **Replies:** 2\ **Last updated:** [August 24, 2021, 9:18am UTC](https://discuss.elastic.co/t/kibana-vega-lite-concat-views/280282 "2021-08-24T09:18:03Z")
Hi, I am starting to learn vega lite for building visualizations in kibana, and I need to use hconcat for displaying plots horizontally, however I am having issues with the autosize. If i set the autosize to 'none', the… --- ## [Logstash output http add param](https://discuss.elastic.co/t/logstash-output-http-add-param/282660)
**Author:** [@zhyp](https://discuss.elastic.co/u/zhyp)\ **Replies:** 0\ **Last updated:** [August 27, 2021, 10:36am UTC](https://discuss.elastic.co/t/logstash-output-http-add-param/282660 "2021-08-27T10:36:36Z")
Hi The following is my configuration. I want to add parameters, but there will be errors. output { stdout { codec =\> json } if(\[@metadata\]\[\_index\] == "need\_before\_load\_forecast") { http { url =\> "http://localhost… --- ## [Grok pattern - string parsed as original log format](https://discuss.elastic.co/t/grok-pattern-string-parsed-as-original-log-format/282656)
**Author:** [@Paintras](https://discuss.elastic.co/u/Paintras)\ **Replies:** 0\ **Last updated:** [August 27, 2021, 9:56am UTC](https://discuss.elastic.co/t/grok-pattern-string-parsed-as-original-log-format/282656 "2021-08-27T09:56:42Z")
Good day, So I have my log message field parsed as separe fields via ingest pipeline and grok processor, but only one of these field is parsed in log logstash format. Better explain it with specific example. This is my… --- ## [Trouble setting up kibana basic authentication](https://discuss.elastic.co/t/trouble-setting-up-kibana-basic-authentication/282578)
**Author:** [@PeterH32](https://discuss.elastic.co/u/PeterH32)\ **Replies:** 4\ **Last updated:** [August 27, 2021, 9:45am UTC](https://discuss.elastic.co/t/trouble-setting-up-kibana-basic-authentication/282578 "2021-08-27T09:45:01Z")
I'm trying to setup a simple elastic stack. I have kibana running and two elasticsearch nodes, which seems to be working fine. The elasticsearch nodes are setup with basic auth, however, I can't get the kibana part of i… --- ## [Logstash Monitoring](https://discuss.elastic.co/t/logstash-monitoring/282641)
**Author:** [@bpandit](https://discuss.elastic.co/u/bpandit)\ **Replies:** 0\ **Last updated:** [August 27, 2021, 8:32am UTC](https://discuss.elastic.co/t/logstash-monitoring/282641 "2021-08-27T08:32:40Z")
There are no index formed for while trying to monitor logstash using legacy settings, please help, below are the logs of logstash. \[2021-08-27T15:04:57,444\]\[INFO \]\[logstash.runner \] Log4j configuration path use… --- ## [Daisy chained logstash not recieving using TCP](https://discuss.elastic.co/t/daisy-chained-logstash-not-recieving-using-tcp/282599)
**Author:** [@Spencer\_Hazell](https://discuss.elastic.co/u/Spencer_Hazell)\ **Replies:** 3\ **Last updated:** [August 27, 2021, 7:29am UTC](https://discuss.elastic.co/t/daisy-chained-logstash-not-recieving-using-tcp/282599 "2021-08-27T07:29:53Z")
Hi there I have 3 logstash servers, daisy chained. First one has 2 outputs, 1 for ES and the other for 2nd Logstash. A tcpdump shows the 2nd Logstash is receiving data. The 2nd Logstash connects to the 3rd Logstash o… --- ## [Error in using EXEC filter for curl](https://discuss.elastic.co/t/error-in-using-exec-filter-for-curl/282459)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 5\ **Last updated:** [August 27, 2021, 7:27am UTC](https://discuss.elastic.co/t/error-in-using-exec-filter-for-curl/282459 "2021-08-27T07:27:35Z")
Hi All, We have a scenario where through curl we are getting some output, when tried the curl command directly we are getting the output. curl --location --request POST 'https://demo.cloud.ie/api/v2/analytics/conversat… --- ## [The rebalance tasks keeps going and not stop](https://discuss.elastic.co/t/the-rebalance-tasks-keeps-going-and-not-stop/282619)
**Author:** [@casterQ](https://discuss.elastic.co/u/casterQ)\ **Replies:** 8\ **Last updated:** [August 27, 2021, 6:56am UTC](https://discuss.elastic.co/t/the-rebalance-tasks-keeps-going-and-not-stop/282619 "2021-08-27T06:56:20Z")
version ：7.10.2 i add a dataNode to cluster，and then the rebalance tasks started... but a week has passed，rebalance keeps going now and not only for new dataNode。 i found this situation exists for GET \_cat/recovery?v … --- ## [Add a user to role-mapping](https://discuss.elastic.co/t/add-a-user-to-role-mapping/282552)
**Author:** [@lokeshv1989](https://discuss.elastic.co/u/lokeshv1989)\ **Replies:** 2\ **Last updated:** [August 27, 2021, 5:16am UTC](https://discuss.elastic.co/t/add-a-user-to-role-mapping/282552 "2021-08-27T05:16:53Z")
Hi All, We are trying to create user-role mapping using the open-distro api's. PATCH \_opendistro/\_security/api/rolesmapping/\ \[ { "op": "add", "path": "/users", "value": \["myuser"\] } \] But we are getting … --- ## [Logstash keystore value not detected in configuration processing](https://discuss.elastic.co/t/logstash-keystore-value-not-detected-in-configuration-processing/281904)
**Author:** [@ramilbermejo](https://discuss.elastic.co/u/ramilbermejo)\ **Replies:** 5\ **Last updated:** [August 27, 2021, 3:47am UTC](https://discuss.elastic.co/t/logstash-keystore-value-not-detected-in-configuration-processing/281904 "2021-08-27T03:47:29Z")
Hello Everyone, I'm trying keystore to store the password for elasticsearch but for some reason I've encountered this error during configuration test. # /usr/share/logstash/bin/logstash --path.settings /etc/logstash -t… --- ## [How to start with API's](https://discuss.elastic.co/t/how-to-start-with-apis/282511)
**Author:** [@uk642](https://discuss.elastic.co/u/uk642)\ **Replies:** 3\ **Last updated:** [August 27, 2021, 1:16am UTC](https://discuss.elastic.co/t/how-to-start-with-apis/282511 "2021-08-27T01:16:24Z")
I have installed Elastic search, logstash and kibana on localhost. I have uploaded sample data using logstash using a configuration file and I can view the data in Kibana dashboard. I want to create a search engine. How… --- ## [CSV Export for Kibana failing in case of non indexed fields](https://discuss.elastic.co/t/csv-export-for-kibana-failing-in-case-of-non-indexed-fields/281800)
**Author:** [@MitParekh](https://discuss.elastic.co/u/MitParekh)\ **Replies:** 3\ **Last updated:** [August 26, 2021, 6:20pm UTC](https://discuss.elastic.co/t/csv-export-for-kibana-failing-in-case-of-non-indexed-fields/281800 "2021-08-26T18:20:14Z")
Hi, I am trying to export a csv from kibana discover. It successfully gives me all the data in the csv when the fields selected are indexed. For the fields which are not indexed (i.e. enabled: false), it fails to genera… --- ## [Unable to login via anonymous](https://discuss.elastic.co/t/unable-to-login-via-anonymous/282587)
**Author:** [@selin](https://discuss.elastic.co/u/selin)\ **Replies:** 1\ **Last updated:** [August 26, 2021, 5:52pm UTC](https://discuss.elastic.co/t/unable-to-login-via-anonymous/282587 "2021-08-26T17:52:18Z")
I unable to login via anonymous. I am expecting to able view dashboard without login but admin should able to login. How can it be done? xpack.security.authc.providers: anonymous.anonymous1: order: 0 credentia… --- ## [Is it possible to have a visualization show up/populate only after a parameter in the controls panel is selected?](https://discuss.elastic.co/t/is-it-possible-to-have-a-visualization-show-up-populate-only-after-a-parameter-in-the-controls-panel-is-selected/282600)
**Author:** [@Surya\_Raviraj](https://discuss.elastic.co/u/Surya_Raviraj)\ **Replies:** 1\ **Last updated:** [August 26, 2021, 5:41pm UTC](https://discuss.elastic.co/t/is-it-possible-to-have-a-visualization-show-up-populate-only-after-a-parameter-in-the-controls-panel-is-selected/282600 "2021-08-26T17:41:03Z")
Is it possible to have a visualization show up/populate only after a parameter in the controls panel is selected? Can we make that parameter a required parameter? Thank you! --- ## [Kibana maps geo "Point to Point" lines arrow not show on maps](https://discuss.elastic.co/t/kibana-maps-geo-point-to-point-lines-arrow-not-show-on-maps/282514)
**Author:** [@Bo\_Pham\_Nguyen](https://discuss.elastic.co/u/Bo_Pham_Nguyen)\ **Replies:** 2\ **Last updated:** [August 26, 2021, 4:44pm UTC](https://discuss.elastic.co/t/kibana-maps-geo-point-to-point-lines-arrow-not-show-on-maps/282514 "2021-08-26T16:44:44Z")
Hi team, I have an index having source and destination IP fields as geo\_point. I can use Maps on Kibana with Document, but Point to Point line/arrows not show on Maps. I can see the response and geo\_point field works wel… --- ## [Index Boost along with sort not working](https://discuss.elastic.co/t/index-boost-along-with-sort-not-working/282582)
**Author:** [@nileshsoor](https://discuss.elastic.co/u/nileshsoor)\ **Replies:** 1\ **Last updated:** [August 26, 2021, 3:32pm UTC](https://discuss.elastic.co/t/index-boost-along-with-sort-not-working/282582 "2021-08-26T15:32:29Z")
I have a query, which will fired against 2 indices A & B. Results from index A is more important than B. ES version : 7.8.0 Query:: { "query": { "terms": { "id": \["a5af38bf-63ac-4e26-af25-68044ffea298","a5… --- ## [Mtericbeat - error - Failed to connect to elasticsearch](https://discuss.elastic.co/t/mtericbeat-error-failed-to-connect-to-elasticsearch/282323)
**Author:** [@nehasinha1807](https://discuss.elastic.co/u/nehasinha1807)\ **Replies:** 2\ **Last updated:** [August 26, 2021, 4:09pm UTC](https://discuss.elastic.co/t/mtericbeat-error-failed-to-connect-to-elasticsearch/282323 "2021-08-26T16:09:09Z")
I'm new to ELK. here is my doubt - we had installed ELK lite on a linux server(A) and trying to install metricbeat on a different server(B) but my metricbeat is failed to connect to elasticsearch(A). metricbeat i insta… --- ## [Disable Warnings about TLSv1.0, TLSv1.1 and SSLv3](https://discuss.elastic.co/t/disable-warnings-about-tlsv1-0-tlsv1-1-and-sslv3/282375)
**Author:** [@shaheer.siddiqui](https://discuss.elastic.co/u/shaheer.siddiqui)\ **Replies:** 3\ **Last updated:** [August 26, 2021, 3:53pm UTC](https://discuss.elastic.co/t/disable-warnings-about-tlsv1-0-tlsv1-1-and-sslv3/282375 "2021-08-26T15:53:15Z")
I am currently running a ES7.10.2 with XPACK enabled on Linux servers. I was able to configure and run ES with no issues however I keep getting the following warns "Client requested protocol TLSv1 is not enabled or suppo… --- ## [Manual Snapshot restore failed](https://discuss.elastic.co/t/manual-snapshot-restore-failed/282590)
**Author:** [@hassan\_elferga](https://discuss.elastic.co/u/hassan_elferga)\ **Replies:** 1\ **Last updated:** [August 26, 2021, 3:40pm UTC](https://discuss.elastic.co/t/manual-snapshot-restore-failed/282590 "2021-08-26T15:40:54Z")
We are trying a scenario for migrating one ES domain to a new one. We have followed the steps as per the following article https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-managedomains-snapshot… --- ## [Logstash filter for a log record from filebeats](https://discuss.elastic.co/t/logstash-filter-for-a-log-record-from-filebeats/282228)
**Author:** [@Rabin\_Bhattacharya](https://discuss.elastic.co/u/Rabin_Bhattacharya)\ **Replies:** 5\ **Last updated:** [August 26, 2021, 3:35pm UTC](https://discuss.elastic.co/t/logstash-filter-for-a-log-record-from-filebeats/282228 "2021-08-26T15:35:57Z")
Hi, I am using ELK stack+filebeats in our project and the application log is integration with filebeats. Filebeat is reading the application log. The log is successfully read by logstash. My question is how to parse the… --- ## [Does it make sense to separate rarely used documents for faster performance?](https://discuss.elastic.co/t/does-it-make-sense-to-separate-rarely-used-documents-for-faster-performance/282550)
**Author:** [@Yoan\_Arnaudov](https://discuss.elastic.co/u/Yoan_Arnaudov)\ **Replies:** 1\ **Last updated:** [August 26, 2021, 3:34pm UTC](https://discuss.elastic.co/t/does-it-make-sense-to-separate-rarely-used-documents-for-faster-performance/282550 "2021-08-26T15:34:38Z")
I'm designing a system which will have ~2M documents and 95% percent of the queries will be targeted against 40-50k documents. Documents in the system have two states bool fields active and inactive. I have ~50k in the… --- ## [Remove duplicate / multiple data records in Elastic](https://discuss.elastic.co/t/remove-duplicate-multiple-data-records-in-elastic/282569)
**Author:** [@cf4455](https://discuss.elastic.co/u/cf4455)\ **Replies:** 1\ **Last updated:** [August 26, 2021, 3:33pm UTC](https://discuss.elastic.co/t/remove-duplicate-multiple-data-records-in-elastic/282569 "2021-08-26T15:33:08Z")
Hi, due to an error in the program that writes data records to the Elastic, there are now a lot of entries in our Elastic, all with exactly the same value in the "time" attribute. For example, there are 50 data records i… --- ## [Metric count aggregation difference](https://discuss.elastic.co/t/metric-count-aggregation-difference/282575)
**Author:** [@gijo](https://discuss.elastic.co/u/gijo)\ **Replies:** 1\ **Last updated:** [August 26, 2021, 3:27pm UTC](https://discuss.elastic.co/t/metric-count-aggregation-difference/282575 "2021-08-26T15:27:53Z")
I have a index with source field. It can have two values. For ex: "sourceA" & "sourceB". I am trying to create to metric aggregation panels with source filter. It is possible to create metric aggregation with single f… --- ## [Logstash filter check value without fields](https://discuss.elastic.co/t/logstash-filter-check-value-without-fields/282598)
**Author:** [@dfoot](https://discuss.elastic.co/u/dfoot)\ **Replies:** 0\ **Last updated:** [August 26, 2021, 3:27pm UTC](https://discuss.elastic.co/t/logstash-filter-check-value-without-fields/282598 "2021-08-26T15:27:24Z")
Below document there are 3 values without fields I need add logstash configuration to pick up 3 values, can you help please? maybe start with loglevel as DEBUG and error N13 to confirm before pick up 3 values below. 70-… --- ## [Double split series possible?](https://discuss.elastic.co/t/double-split-series-possible/282494)
**Author:** [@Surya\_Raviraj](https://discuss.elastic.co/u/Surya_Raviraj)\ **Replies:** 2\ **Last updated:** [August 26, 2021, 3:16pm UTC](https://discuss.elastic.co/t/double-split-series-possible/282494 "2021-08-26T15:16:58Z")
Hello all, Please take a look at my above screenshot. The X-Axis has the week (time component). Y-Axis is count of occurrences. I am currently splitting this with a field called 'Responsible Party'. I want to break up… --- ## [Module elasticsearch issue with filed limit](https://discuss.elastic.co/t/module-elasticsearch-issue-with-filed-limit/282592)
**Author:** [@Messias\_2](https://discuss.elastic.co/u/Messias_2)\ **Replies:** 0\ **Last updated:** [August 26, 2021, 2:55pm UTC](https://discuss.elastic.co/t/module-elasticsearch-issue-with-filed-limit/282592 "2021-08-26T14:55:49Z")
Hi, I use metric beat to monitor elasticsearch per docker. metricbeat.config: modules: path: ${path.config}/modules.d/\*.yml # Reload module configs as they change: reload.enabled: false processors: - a… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1262) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1264)