# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1265

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1266

---

## [Problem downloading results that contain the # character](https://discuss.elastic.co/t/problem-downloading-results-that-contain-the-character/282520)

<div class="topic-metadata">

**Author:** [@Vince\_D](https://discuss.elastic.co/u/Vince_D)\
**Replies:** 5\
**Last updated:** [August 26, 2021, 1:03am UTC](https://discuss.elastic.co/t/problem-downloading-results-that-contain-the-character/282520 "2021-08-26T01:03:30Z")

</div>

I am having a problem downloading results obtained using the Kibana SQL Workbench. It appears that the downloaded file is truncated when a "#" character appears in the text. For example, here is the last record in the …

---

## [Blacklisting with Ruby Filter](https://discuss.elastic.co/t/blacklisting-with-ruby-filter/282517)

<div class="topic-metadata">

**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\
**Replies:** 2\
**Last updated:** [August 26, 2021, 12:28am UTC](https://discuss.elastic.co/t/blacklisting-with-ruby-filter/282517 "2021-08-26T00:28:47Z")

</div>

Hi, I'm looking to blacklist 1000+ nested fields. I've read in another forum that it's not possible to use the prune filter for nested filters, but I can with a ruby filter. I wanted to know is there a way to blacklist …

---

## [Cannot deploy functionbeat 7.14.0](https://discuss.elastic.co/t/cannot-deploy-functionbeat-7-14-0/282217)

<div class="topic-metadata">

**Author:** [@sproctor](https://discuss.elastic.co/u/sproctor)\
**Replies:** 4\
**Last updated:** [August 25, 2021, 10:52pm UTC](https://discuss.elastic.co/t/cannot-deploy-functionbeat-7-14-0/282217 "2021-08-25T22:52:16Z")

</div>

Did something change in the process needed to deploy functionbeat 7.14.0? I can deploy 7.13.4 fine. If I try to deploy 7.14.0, I get the following error: Function: st-cw-logs, could not deploy, error: bucket 'st-fb-dep…

---

## [Is there a guideline or any tips on linking Kibana to Power BI?](https://discuss.elastic.co/t/is-there-a-guideline-or-any-tips-on-linking-kibana-to-power-bi/282522)

<div class="topic-metadata">

**Author:** [@bailarch](https://discuss.elastic.co/u/bailarch)\
**Replies:** 1\
**Last updated:** [August 25, 2021, 10:37pm UTC](https://discuss.elastic.co/t/is-there-a-guideline-or-any-tips-on-linking-kibana-to-power-bi/282522 "2021-08-25T22:37:05Z")

</div>

Hello, I'm trying to connect Kibana with Power BI. I've looked into tutorials / guidelines that are I related to this matter but still couldn't figure out entirely. Can anyone please let me know any tips or guide me to…

---

## [Configure proxy for Elasticsearch](https://discuss.elastic.co/t/configure-proxy-for-elasticsearch/282479)

<div class="topic-metadata">

**Author:** [@etrpchevska](https://discuss.elastic.co/u/etrpchevska)\
**Replies:** 0\
**Last updated:** [August 25, 2021, 11:01am UTC](https://discuss.elastic.co/t/configure-proxy-for-elasticsearch/282479 "2021-08-25T11:01:22Z")

</div>

Hello! We have an Elasticsearch setup running in on-prem data center as a Kubernetes application. I would like to configure SAML realm for SSO login to the cluster and Kibana, but in order to get authenticated to the Id…

---

## [ILM Index Lifecycle Rolleover](https://discuss.elastic.co/t/ilm-index-lifecycle-rolleover/282493)

<div class="topic-metadata">

**Author:** [@selin](https://discuss.elastic.co/u/selin)\
**Replies:** 1\
**Last updated:** [August 25, 2021, 10:10pm UTC](https://discuss.elastic.co/t/ilm-index-lifecycle-rolleover/282493 "2021-08-25T22:10:26Z")

</div>

Hi friend i using index template. Please refer below myindex \<- alias myindex-20210825 \<- index My question is when it perofrm rolleover after few x gv what will be the name. will it be as belo…

---

## [Approx sizing for indexes and shard counts per data node](https://discuss.elastic.co/t/approx-sizing-for-indexes-and-shard-counts-per-data-node/282524)

<div class="topic-metadata">

**Author:** [@cis4life](https://discuss.elastic.co/u/cis4life)\
**Replies:** 1\
**Last updated:** [August 25, 2021, 10:08pm UTC](https://discuss.elastic.co/t/approx-sizing-for-indexes-and-shard-counts-per-data-node/282524 "2021-08-25T22:08:45Z")

</div>

I know what I'm asking can be subjective but I'm wondering if I have say 5 data nodes with access to 29gb Ram in the JVM (64gb of physical ram), with 5 data nodes, what is the best way to estimate when I need to add a ne…

---

## [Impact of default indices refresh time on Bulk Indexing](https://discuss.elastic.co/t/impact-of-default-indices-refresh-time-on-bulk-indexing/282441)

<div class="topic-metadata">

**Author:** [@Pathak18](https://discuss.elastic.co/u/Pathak18)\
**Replies:** 8\
**Last updated:** [August 25, 2021, 10:05pm UTC](https://discuss.elastic.co/t/impact-of-default-indices-refresh-time-on-bulk-indexing/282441 "2021-08-25T22:05:21Z")

</div>

Hi Group, During Bulk Indexing, when the index.refresh\_interval defaults to 1sec and RefreshPolicy set to NONE. Query: In my case - Save Bulk Request runs in batches with 1k records in each batch. Out of 1k records, su…

---

## [How can I create a table with fields from different index patterns?](https://discuss.elastic.co/t/how-can-i-create-a-table-with-fields-from-different-index-patterns/282424)

<div class="topic-metadata">

**Author:** [@Marcos\_K\_Minkoves](https://discuss.elastic.co/u/Marcos_K_Minkoves)\
**Replies:** 3\
**Last updated:** [August 25, 2021, 9:36pm UTC](https://discuss.elastic.co/t/how-can-i-create-a-table-with-fields-from-different-index-patterns/282424 "2021-08-25T21:36:13Z")

</div>

Hi, I'm trying to create a table that contains data from fields that are allocated in different index patterns. Whenever I try to drag and drop a field that belongs to a different index, the table resets and only show t…

---

## [Snapshot and restore](https://discuss.elastic.co/t/snapshot-and-restore/282516)

<div class="topic-metadata">

**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\
**Replies:** 2\
**Last updated:** [August 25, 2021, 9:15pm UTC](https://discuss.elastic.co/t/snapshot-and-restore/282516 "2021-08-25T21:15:10Z")

</div>

Hello all, As per the documentation about registering a snapshot repository, first, I am supposed to add following to elasticsearch.yml file. i understand that I can store backup on my network drive which would be th…

---

## [Upgrading Elastic from 7.13.1 to 7.14](https://discuss.elastic.co/t/upgrading-elastic-from-7-13-1-to-7-14/282478)

<div class="topic-metadata">

**Author:** [@Ashwin\_Patil1](https://discuss.elastic.co/u/Ashwin_Patil1)\
**Replies:** 2\
**Last updated:** [August 25, 2021, 7:57pm UTC](https://discuss.elastic.co/t/upgrading-elastic-from-7-13-1-to-7-14/282478 "2021-08-25T19:57:45Z")

</div>

I am trying to upgrade elastic from 7.13.1 to 7.14.0 by following the steps in Rolling upgrades | Elasticsearch Guide \[7.14\] | Elastic I am getting the conflict error as follows localhost:~ # sudo rpm --install elastic…

---

## [Fingerprint & record drop not working as expected](https://discuss.elastic.co/t/fingerprint-record-drop-not-working-as-expected/282513)

<div class="topic-metadata">

**Author:** [@GitSpree23](https://discuss.elastic.co/u/GitSpree23)\
**Replies:** 4\
**Last updated:** [August 25, 2021, 6:35pm UTC](https://discuss.elastic.co/t/fingerprint-record-drop-not-working-as-expected/282513 "2021-08-25T18:35:05Z")

</div>

I'm reading lines from a log that, after converting to JSON need to be split based on a field & then I want to generate fingerprint using some fields & drop the event if the fields are not found. But I'm facing issues: …

---

## [Embedded kibana authentication](https://discuss.elastic.co/t/embedded-kibana-authentication/282396)

<div class="topic-metadata">

**Author:** [@sam3546](https://discuss.elastic.co/u/sam3546)\
**Replies:** 1\
**Last updated:** [August 25, 2021, 5:39pm UTC](https://discuss.elastic.co/t/embedded-kibana-authentication/282396 "2021-08-25T17:39:09Z")

</div>

I'm trying to embed kibana to an intranet site our users have access to, I want to do it as close as possible to a seamless no user input authentication. We are using 7.8 and cannot upgrade, we have authentication setup …

---

## [Elasticsearch/Kibana "authentication\_failed"](https://discuss.elastic.co/t/elasticsearch-kibana-authentication-failed/282355)

<div class="topic-metadata">

**Author:** [@IlyaZ](https://discuss.elastic.co/u/IlyaZ)\
**Replies:** 4\
**Last updated:** [August 25, 2021, 5:33pm UTC](https://discuss.elastic.co/t/elasticsearch-kibana-authentication-failed/282355 "2021-08-25T17:33:38Z")

</div>

I am configuring an Elasticsearch/Kibana running under Docker-compose. And I am have some problems with authentication. When running docker-compose build: version: '3.7' services: create\_cert: image: docker.ela…

---

## [Pipeline aggs with more than one level depth](https://discuss.elastic.co/t/pipeline-aggs-with-more-than-one-level-depth/282502)

<div class="topic-metadata">

**Author:** [@caraboy](https://discuss.elastic.co/u/caraboy)\
**Replies:** 0\
**Last updated:** [August 25, 2021, 3:02pm UTC](https://discuss.elastic.co/t/pipeline-aggs-with-more-than-one-level-depth/282502 "2021-08-25T15:02:20Z")

</div>

Hi everyone, I'm trying to make an avg\_bucket agg that goes more than one level deep like this ... "aggs": { "group\_by\_implementation\_waiting": { "terms": { "field": "implementation.keyword", …

---

## [Yii2 and nested objects](https://discuss.elastic.co/t/yii2-and-nested-objects/282268)

<div class="topic-metadata">

**Author:** [@Web\_Hildus](https://discuss.elastic.co/u/Web_Hildus)\
**Replies:** 1\
**Last updated:** [August 25, 2021, 4:58pm UTC](https://discuss.elastic.co/t/yii2-and-nested-objects/282268 "2021-08-25T16:58:10Z")

</div>

Hi. I'm totally new in ElasticSearch. I'm using "Yii2 Framework" and stalked on. Elastic not works with nested field. Is here specialist in Yii2 & Elasticsearch? Or where I can find the answer? Documents in index are lik…

---

## [Nanoseconds with Logstash and Elasticsearch](https://discuss.elastic.co/t/nanoseconds-with-logstash-and-elasticsearch/282492)

<div class="topic-metadata">

**Author:** [@Nico\_Pampaloni](https://discuss.elastic.co/u/Nico_Pampaloni)\
**Replies:** 7\
**Last updated:** [August 25, 2021, 4:21pm UTC](https://discuss.elastic.co/t/nanoseconds-with-logstash-and-elasticsearch/282492 "2021-08-25T16:21:43Z")

</div>

Good Morning! I am a little stuck figuring out how to handle custom time formats with nanosecond precision. The data that I am currently trying to ingest has two different time formats: 1629480840.652062565 and 2021:08:2…

---

## [Aggregate plugin does not add all results](https://discuss.elastic.co/t/aggregate-plugin-does-not-add-all-results/282503)

<div class="topic-metadata">

**Author:** [@josedelrio](https://discuss.elastic.co/u/josedelrio)\
**Replies:** 2\
**Last updated:** [August 25, 2021, 4:20pm UTC](https://discuss.elastic.co/t/aggregate-plugin-does-not-add-all-results/282503 "2021-08-25T16:20:16Z")

</div>

Aggreation plugin overwrites data I am trying to implement an aggregation using a MySQL 5.7 database as source. select u.id as user\_id, u.first\_name as first\_name, u.last\_name as last\_name,t.id as 'tag\_id', t.name as 't…

---

## [LoadBalancer in Kibana](https://discuss.elastic.co/t/loadbalancer-in-kibana/282310)

<div class="topic-metadata">

**Author:** [@Dhamodharan](https://discuss.elastic.co/u/Dhamodharan)\
**Replies:** 1\
**Last updated:** [August 25, 2021, 4:07pm UTC](https://discuss.elastic.co/t/loadbalancer-in-kibana/282310 "2021-08-25T16:07:42Z")

</div>

I have 2 es nodes cluster and have 2kibana nodes and wanted to maintain HA in kibana. What is the best approach inorder to maintain the HA. Do i need go with external loadbalancer for kibana or any settings can be done …

---

## [Elastic cluster sizing estimator : why I am not having 2 data nodes](https://discuss.elastic.co/t/elastic-cluster-sizing-estimator-why-i-am-not-having-2-data-nodes/282378)

<div class="topic-metadata">

**Author:** [@marone](https://discuss.elastic.co/u/marone)\
**Replies:** 3\
**Last updated:** [August 25, 2021, 3:39pm UTC](https://discuss.elastic.co/t/elastic-cluster-sizing-estimator-why-i-am-not-having-2-data-nodes/282378 "2021-08-25T15:39:14Z")

</div>

I am trying to estimate my cluster size based on an excel sheet provided by elastic.co in a webinar in 20/05/2021 about "elastic sizing", I filled the daily volume data but I see that it gives me only 1 data not for "Ho…

---

## [Data tier problem - New Indices not allocating in data\_hot](https://discuss.elastic.co/t/data-tier-problem-new-indices-not-allocating-in-data-hot/282498)

<div class="topic-metadata">

**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\
**Replies:** 3\
**Last updated:** [August 25, 2021, 3:37pm UTC](https://discuss.elastic.co/t/data-tier-problem-new-indices-not-allocating-in-data-hot/282498 "2021-08-25T15:37:30Z")

</div>

Hi, I'm (trying) to implement a hot/warm architecture using the concept of data tiers. I have several clusters with a hot/warm/cold architecture working perfectly but the implementation was done based on node.attr. No…

---

## [Need to setup mail alert on Mertricbeat data using ML (Prediction Alert)](https://discuss.elastic.co/t/need-to-setup-mail-alert-on-mertricbeat-data-using-ml-prediction-alert/282442)

<div class="topic-metadata">

**Author:** [@aniket.sonavane](https://discuss.elastic.co/u/aniket.sonavane)\
**Replies:** 3\
**Last updated:** [August 25, 2021, 3:12pm UTC](https://discuss.elastic.co/t/need-to-setup-mail-alert-on-mertricbeat-data-using-ml-prediction-alert/282442 "2021-08-25T15:12:28Z")

</div>

Objective:- Need prediction alert from kibana on metricbeat data? Hi, I've setup metricbeat 100+ servers and data is reporting, also I've created some anomaly jobs to identify anomalies and alert critical anomalies. no…

---

## [Stack Monitoring access](https://discuss.elastic.co/t/stack-monitoring-access/282369)

<div class="topic-metadata">

**Author:** [@Francisco\_Gomez1](https://discuss.elastic.co/u/Francisco_Gomez1)\
**Replies:** 2\
**Last updated:** [August 25, 2021, 3:10pm UTC](https://discuss.elastic.co/t/stack-monitoring-access/282369 "2021-08-25T15:10:50Z")

</div>

Hi im trying to set up an user with ABAC for my monitoring cluster, but when i add the role monitoring-user role to my user it just go over my ABAC configuration. Is there any way to give access to stack monitoring with…

---

## [All of a sudden Elastic Search, 100% CPU usage and high memory usage](https://discuss.elastic.co/t/all-of-a-sudden-elastic-search-100-cpu-usage-and-high-memory-usage/281915)

<div class="topic-metadata">

**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\
**Replies:** 2\
**Last updated:** [August 25, 2021, 2:59pm UTC](https://discuss.elastic.co/t/all-of-a-sudden-elastic-search-100-cpu-usage-and-high-memory-usage/281915 "2021-08-25T14:59:38Z")

</div>

Hello I havent touched any configuration on the Elastic Stack in about a month and all of a sudden, we are seeing the CPU at 100% and the memory usage very high. Im surprised that this has been going on for about 8 hou…

---

## [Logstash jdbc\_static types doesn't work (longtext, tinyint...)](https://discuss.elastic.co/t/logstash-jdbc-static-types-doesnt-work-longtext-tinyint/282497)

<div class="topic-metadata">

**Author:** [@Atesrin](https://discuss.elastic.co/u/Atesrin)\
**Replies:** 2\
**Last updated:** [August 25, 2021, 2:58pm UTC](https://discuss.elastic.co/t/logstash-jdbc-static-types-doesnt-work-longtext-tinyint/282497 "2021-08-25T14:58:33Z")

</div>

Hi, I would like to know if there is some place where I can find some information about the accepted types for jdbc\_static ? From what I see on websites only "varchar" seems accepted, but I have some longtext, tinyint …

---

## [Date field being ignored in new index pattern](https://discuss.elastic.co/t/date-field-being-ignored-in-new-index-pattern/282360)

<div class="topic-metadata">

**Author:** [@bacony0atmeal](https://discuss.elastic.co/u/bacony0atmeal)\
**Replies:** 1\
**Last updated:** [August 25, 2021, 2:39pm UTC](https://discuss.elastic.co/t/date-field-being-ignored-in-new-index-pattern/282360 "2021-08-25T14:39:33Z")

</div>

i have an index called "bobGoblin" ... "bobGoblin" has a field called bobTimestamp which shows as a date "type" in the "mapping" ... when i go to make a new index pattern for the bobGoblin index ... The indices which mat…

---

## [Mappings restore errors](https://discuss.elastic.co/t/mappings-restore-errors/282417)

<div class="topic-metadata">

**Author:** [@Leonardo\_De\_Oliveira](https://discuss.elastic.co/u/Leonardo_De_Oliveira)\
**Replies:** 3\
**Last updated:** [August 25, 2021, 2:37pm UTC](https://discuss.elastic.co/t/mappings-restore-errors/282417 "2021-08-25T14:37:35Z")

</div>

Hello Folks! I am currently running Elasticsearch v5.5.2 in production, and I am setting up a downsized version in our Staging environment. I used elasticdump v6.67.1 to dump our mappings and a subset of our data which…

---

## [Token input in Logstash](https://discuss.elastic.co/t/token-input-in-logstash/282460)

<div class="topic-metadata">

**Author:** [@sama.sowjanya](https://discuss.elastic.co/u/sama.sowjanya)\
**Replies:** 1\
**Last updated:** [August 25, 2021, 2:22pm UTC](https://discuss.elastic.co/t/token-input-in-logstash/282460 "2021-08-25T14:22:05Z")

</div>

We have an API from Genesys to integrate with Elasticsearch through logstash, but the authorization to that api is token system. Is there a way to fetch the token in Logstash. What would be the best approach to integrat…

---

## [Filebeat sidecar with Sonarqube in Kubernetes](https://discuss.elastic.co/t/filebeat-sidecar-with-sonarqube-in-kubernetes/282315)

<div class="topic-metadata">

**Author:** [@Vincent3](https://discuss.elastic.co/u/Vincent3)\
**Replies:** 3\
**Last updated:** [August 25, 2021, 2:14pm UTC](https://discuss.elastic.co/t/filebeat-sidecar-with-sonarqube-in-kubernetes/282315 "2021-08-25T14:14:09Z")

</div>

Hello, I have a configMap : apiVersion: v1 kind: ConfigMap metadata: name: filebeat-configmap namespace: k8s-mxt-sonarqube data: filebeat.yml: |- filebeat.inputs: - type: container enabled: …

---

## [Understanding ILM policy](https://discuss.elastic.co/t/understanding-ilm-policy/282303)

<div class="topic-metadata">

**Author:** [@selin](https://discuss.elastic.co/u/selin)\
**Replies:** 4\
**Last updated:** [August 25, 2021, 3:24am UTC](https://discuss.elastic.co/t/understanding-ilm-policy/282303 "2021-08-25T03:24:40Z")

</div>

Hi friends,, It is noted i can set ILM policy in logstash attach to index output { elasticsearch { ilm\_rollover\_alias =\> "custom" ilm\_pattern =\> "000001" ilm\_policy =\> "custom\_policy" …

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1264)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1266)
