# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1269 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1270 --- ## [Is my delete phase correctly configured in ILM?](https://discuss.elastic.co/t/is-my-delete-phase-correctly-configured-in-ilm/282209)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 6\ **Last updated:** [August 24, 2021, 8:49am UTC](https://discuss.elastic.co/t/is-my-delete-phase-correctly-configured-in-ilm/282209 "2021-08-24T08:49:48Z")
Just in case, I wanted to confirm that my delete phase was correctly configured: \[root@server log\]# curl -u user:password -X GET 'http://localhost:9200/\_ilm/policy/ilp-for-logs' {"ilp-for-logs":{"version":2,"modified\_da… --- ## [X-opaque-id not displayed in search slow log](https://discuss.elastic.co/t/x-opaque-id-not-displayed-in-search-slow-log/282067)
**Author:** [@asgs](https://discuss.elastic.co/u/asgs)\ **Replies:** 6\ **Last updated:** [August 24, 2021, 8:19am UTC](https://discuss.elastic.co/t/x-opaque-id-not-displayed-in-search-slow-log/282067 "2021-08-24T08:19:19Z")
Hello. First of all, I want to mention that I have read the similar posts Cannot see user "id" in slowlogs (X-Opaque-ID) and Elasticsearch X-Opaque-Id Not in application.log Exception but there are no responses there, so… --- ## [Kibana password protected?](https://discuss.elastic.co/t/kibana-password-protected/282214)
**Author:** [@selin](https://discuss.elastic.co/u/selin)\ **Replies:** 6\ **Last updated:** [August 24, 2021, 6:48am UTC](https://discuss.elastic.co/t/kibana-password-protected/282214 "2021-08-24T06:48:10Z")
Hi friend can i know is the password of user login to kibana protected? Can anyone view the psssword? What is xpack.security.encryptionKey --- ## [Synesis Lite Suricata + ELK](https://discuss.elastic.co/t/synesis-lite-suricata-elk/282300)
**Author:** [@Yves\_Silvere\_Randria](https://discuss.elastic.co/u/Yves_Silvere_Randria)\ **Replies:** 0\ **Last updated:** [August 24, 2021, 6:17am UTC](https://discuss.elastic.co/t/synesis-lite-suricata-elk/282300 "2021-08-24T06:17:48Z")
I am following this tutorial GitHub - robcowart/synesis\_lite\_suricata: Suricata IDS/IPS log analytics using the Elastic Stack. And I have this problem , please help me --- ## [Kibana: Minimum Permissions for saving the queries for a dashboard](https://discuss.elastic.co/t/kibana-minimum-permissions-for-saving-the-queries-for-a-dashboard/282259)
**Author:** [@Kunal\_Sharma](https://discuss.elastic.co/u/Kunal_Sharma)\ **Replies:** 2\ **Last updated:** [August 24, 2021, 5:50am UTC](https://discuss.elastic.co/t/kibana-minimum-permissions-for-saving-the-queries-for-a-dashboard/282259 "2021-08-24T05:50:27Z")
Dear Team, We have a role in Kibana that provides the read only access to a dashboard under a tenant (with tenant permission for the Role as Read Only). With this current role, users are not able to save the search que… --- ## [Combining results from 2 elastic queries](https://discuss.elastic.co/t/combining-results-from-2-elastic-queries/282252)
**Author:** [@blackberrySherbet](https://discuss.elastic.co/u/blackberrySherbet)\ **Replies:** 1\ **Last updated:** [August 24, 2021, 5:22am UTC](https://discuss.elastic.co/t/combining-results-from-2-elastic-queries/282252 "2021-08-24T05:22:05Z")
In one index I have {city: \_\_\_\_, serial\_no: 999}. In another index, I have {language: \_\_\_\_ serial\_no:999} I need to write an elasticsearch query to print {city, language}. How do I do that? Any help is appreciated, th… --- ## [Synchronize index with sql table](https://discuss.elastic.co/t/synchronize-index-with-sql-table/282239)
**Author:** [@franckfct](https://discuss.elastic.co/u/franckfct)\ **Replies:** 1\ **Last updated:** [August 24, 2021, 5:17am UTC](https://discuss.elastic.co/t/synchronize-index-with-sql-table/282239 "2021-08-24T05:17:02Z")
Hello, I have a table on a database (SAP HANA), I can request it with sql without any problems. This table can be modified at any time by drop/update or insert. Is there a way to keep the index up to date natively, wit… --- ## [Why the number of closed index affects write performance?](https://discuss.elastic.co/t/why-the-number-of-closed-index-affects-write-performance/282219)
**Author:** [@wulixuan](https://discuss.elastic.co/u/wulixuan)\ **Replies:** 10\ **Last updated:** [August 24, 2021, 4:21am UTC](https://discuss.elastic.co/t/why-the-number-of-closed-index-affects-write-performance/282219 "2021-08-24T04:21:48Z")
Hello: I am now testing the write performance of ES(v7.13.4), the number of shards written is constant, I added many empty indexes(shard number is 3). Then I find that the write performance is degraded even if the index… --- ## [Kibana integration with remedy](https://discuss.elastic.co/t/kibana-integration-with-remedy/282192)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 2\ **Last updated:** [August 24, 2021, 3:52am UTC](https://discuss.elastic.co/t/kibana-integration-with-remedy/282192 "2021-08-24T03:52:01Z")
Hello! I am doing some tests and I have a question. Can kibana alert or create tickets in a Remedy? Thanks in advance! --- ## [Does Elastic Search support Mobile Number variation (ex: US Format that has special character)](https://discuss.elastic.co/t/does-elastic-search-support-mobile-number-variation-ex-us-format-that-has-special-character/282245)
**Author:** [@Pathak18](https://discuss.elastic.co/u/Pathak18)\ **Replies:** 2\ **Last updated:** [August 24, 2021, 3:43am UTC](https://discuss.elastic.co/t/does-elastic-search-support-mobile-number-variation-ex-us-format-that-has-special-character/282245 "2021-08-24T03:43:39Z")
Hi, US mobile phone number data can be saved in multiple formats like (XXX) XXX-XXXX OR +1 (XXX) XXX-XXXX OR XXX-XXX-XXXX OR +1 XXX-XXX-XXXX OR XXXXXXXXXX. How to ensure which DataType(OOB) would be ideal to be used o… --- ## [Potential Elasticsearch bug: Index yellow but one or more primary shards unassigned](https://discuss.elastic.co/t/potential-elasticsearch-bug-index-yellow-but-one-or-more-primary-shards-unassigned/282231)
**Author:** [@elastic-learner](https://discuss.elastic.co/u/elastic-learner)\ **Replies:** 3\ **Last updated:** [August 24, 2021, 3:41am UTC](https://discuss.elastic.co/t/potential-elasticsearch-bug-index-yellow-but-one-or-more-primary-shards-unassigned/282231 "2021-08-24T03:41:48Z")
I'm testing es snapshot restoration on opendistro 7.1.1. Immediately after snapshot restore api call(POST /\_snapshot/my\_backup/snapshot\_1/\_restore) returns, all the indices are in yellow state. In most of them there are … --- ## [Deprecation warning re. granting alias permissions to a role](https://discuss.elastic.co/t/deprecation-warning-re-granting-alias-permissions-to-a-role/281896)
**Author:** [@ceekay](https://discuss.elastic.co/u/ceekay)\ **Replies:** 3\ **Last updated:** [August 24, 2021, 1:45am UTC](https://discuss.elastic.co/t/deprecation-warning-re-granting-alias-permissions-to-a-role/281896 "2021-08-24T01:45:11Z")
Hi there. I've noticed a bunch of messages in my deprecation logs that go like this: Role \[some-dept\] contains index privileges covering the \[some-dept-alias\] alias but which do not cover some of the indices that it po… --- ## [Kibana cluster with nginx not working](https://discuss.elastic.co/t/kibana-cluster-with-nginx-not-working/282232)
**Author:** [@selin](https://discuss.elastic.co/u/selin)\ **Replies:** 2\ **Last updated:** [August 24, 2021, 1:20am UTC](https://discuss.elastic.co/t/kibana-cluster-with-nginx-not-working/282232 "2021-08-24T01:20:45Z")
Hi bro and sis, I would need to set kibana cluster. Is there any idea how can it be done. A single kibana no issue. But cluster after login i hitting 401 error. I not sure why exactly. I point both kibana to same yaml f… --- ## [Logstash http\_poller body escape double and single quotation marks](https://discuss.elastic.co/t/logstash-http-poller-body-escape-double-and-single-quotation-marks/282039)
**Author:** [@zhyp](https://discuss.elastic.co/u/zhyp)\ **Replies:** 2\ **Last updated:** [August 24, 2021, 1:38am UTC](https://discuss.elastic.co/t/logstash-http-poller-body-escape-double-and-single-quotation-marks/282039 "2021-08-24T01:38:21Z")
Hi I used logstash http\_ poller calls the SQL API of elasticsearch. There are double quotation marks and single quotation marks in the body. Here is the body I tested. body =\> '{"query": "SELECT \* FROM test WHERE name… --- ## [How do I create a boolean "OR" filter?](https://discuss.elastic.co/t/how-do-i-create-a-boolean-or-filter/282281)
**Author:** [@elastic\_yogi](https://discuss.elastic.co/u/elastic_yogi)\ **Replies:** 6\ **Last updated:** [August 24, 2021, 1:16am UTC](https://discuss.elastic.co/t/how-do-i-create-a-boolean-or-filter/282281 "2021-08-24T01:16:40Z")
I'd like to filter for EITHER (OR) of two values, but a filter appears to require (AND) a document to contain EACH value. I'm using a bool query currently, and should appears to be the only way to do an OR expression. Ho… --- ## [Kibana selective loading of visualizations](https://discuss.elastic.co/t/kibana-selective-loading-of-visualizations/282208)
**Author:** [@katja1](https://discuss.elastic.co/u/katja1)\ **Replies:** 1\ **Last updated:** [August 23, 2021, 10:57pm UTC](https://discuss.elastic.co/t/kibana-selective-loading-of-visualizations/282208 "2021-08-23T22:57:00Z")
Hi, Is selective loading of visualizations possible in Kibana - meaning for example, if I select a filter and there are some visualizations on dashboard that do not have any data after filtering, then this visualization… --- ## [Magento 2 Connection Failure](https://discuss.elastic.co/t/magento-2-connection-failure/282250)
**Author:** [@steved1982](https://discuss.elastic.co/u/steved1982)\ **Replies:** 1\ **Last updated:** [August 23, 2021, 10:51pm UTC](https://discuss.elastic.co/t/magento-2-connection-failure/282250 "2021-08-23T22:51:37Z")
Trying to connect from Magento 2 to the https://\*\*\*\*\*.elastic-cloud.com deployment of ElasticSearch but I get the No nodes alive message. I am running Magento 2.4.2 and I have checked the username and password are correc… --- ## [ESSingleNodeTestCase - Java 11 - Does not start Elastic](https://discuss.elastic.co/t/essinglenodetestcase-java-11-does-not-start-elastic/282279)
**Author:** [@Liyaqat\_M](https://discuss.elastic.co/u/Liyaqat_M)\ **Replies:** 0\ **Last updated:** [August 23, 2021, 10:09pm UTC](https://discuss.elastic.co/t/essinglenodetestcase-java-11-does-not-start-elastic/282279 "2021-08-23T22:09:53Z")
Hi, I am trying to test the messages that I would post to our Elastic Search server and decided to use: ESSingleNodeTestCase. After sorting out the dependencies I was able to compile and start the test. As far as I un… --- ## [Data ingestion from MS SQL to Elastic search using logstash(on cloud deployement)](https://discuss.elastic.co/t/data-ingestion-from-ms-sql-to-elastic-search-using-logstash-on-cloud-deployement/282230)
**Author:** [@tushar6065](https://discuss.elastic.co/u/tushar6065)\ **Replies:** 1\ **Last updated:** [August 23, 2021, 10:02pm UTC](https://discuss.elastic.co/t/data-ingestion-from-ms-sql-to-elastic-search-using-logstash-on-cloud-deployement/282230 "2021-08-23T22:02:50Z")
I want to ingest data into Elastic search from MS SQL using Logstash and I was able to achieve this by setting up MS SQL JDBC plugin on my machine locally. But for upper environments, we will be going with Elastic Cloud … --- ## [Kibana: Get delta t in a visualization](https://discuss.elastic.co/t/kibana-get-delta-t-in-a-visualization/282277)
**Author:** [@Saliinger](https://discuss.elastic.co/u/Saliinger)\ **Replies:** 0\ **Last updated:** [August 23, 2021, 10:02pm UTC](https://discuss.elastic.co/t/kibana-get-delta-t-in-a-visualization/282277 "2021-08-23T22:02:33Z")
Hello. I have this visualization using TSVB Is possible to get the time when metrics are equal to 0 and put it in a TSVB table? I mean: Get the time when metric turns to 0 for X time and show in a TSVB table how ma… --- ## [Curl command to logstash](https://discuss.elastic.co/t/curl-command-to-logstash/282266)
**Author:** [@bamsom](https://discuss.elastic.co/u/bamsom)\ **Replies:** 1\ **Last updated:** [August 23, 2021, 9:35pm UTC](https://discuss.elastic.co/t/curl-command-to-logstash/282266 "2021-08-23T21:35:38Z")
I am running a curl command which gives me a numeric output. I have the input setup as exec \> command \> curl. I am outputting that data into Elastic search. I see the message as the numeric output. When I try to visualiz… --- ## [S3 Output Plugin: Correct Way to manage codec](https://discuss.elastic.co/t/s3-output-plugin-correct-way-to-manage-codec/282103)
**Author:** [@Hammond95](https://discuss.elastic.co/u/Hammond95)\ **Replies:** 1\ **Last updated:** [August 23, 2021, 5:21pm UTC](https://discuss.elastic.co/t/s3-output-plugin-correct-way-to-manage-codec/282103 "2021-08-23T17:21:01Z")
Hi everyone, I have the following problem: We have in place a pipeline which consist of: \[PrestoDB Clusters\] ==auditing==\> \[Kafka\] \<== \[Logstash\] ==\> Elastic + S3 The auditing messages on kafka are basically json mes… --- ## [Elasticsearch6 on MAC - Bootstrap failed: 5: Input/output error](https://discuss.elastic.co/t/elasticsearch6-on-mac-bootstrap-failed-5-input-output-error/282263)
**Author:** [@Mike\_Fritzsche](https://discuss.elastic.co/u/Mike_Fritzsche)\ **Replies:** 1\ **Last updated:** [August 23, 2021, 5:20pm UTC](https://discuss.elastic.co/t/elasticsearch6-on-mac-bootstrap-failed-5-input-output-error/282263 "2021-08-23T17:20:00Z")
Hi all, I can not get run Elasticsearch 6 on my MAC Big Sure. I installed with Brew and all the time when brew services start elasticsearch@6 I get the following error: Bootstrap failed: 5: Input/output error Error:… --- ## [Kibana List API Questions](https://discuss.elastic.co/t/kibana-list-api-questions/280530)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [August 23, 2021, 5:16pm UTC](https://discuss.elastic.co/t/kibana-list-api-questions/280530 "2021-08-23T17:16:01Z")
Hello all, We really like the Kibana List API. it enables us to make black and whitelists we can use in Elastic detection rules. For example a list of developers, compromised accounts, vpn users, etc. We also really lik… --- ## [Configure Kibana with default fields](https://discuss.elastic.co/t/configure-kibana-with-default-fields/282253)
**Author:** [@gba8912](https://discuss.elastic.co/u/gba8912)\ **Replies:** 3\ **Last updated:** [August 23, 2021, 5:14pm UTC](https://discuss.elastic.co/t/configure-kibana-with-default-fields/282253 "2021-08-23T17:14:30Z")
Hi all, I made a grok filter to for logstash that created fields in kinbana. This is great but in discover, I am having to add the fields manually every time i load in. Is there a way to make kibana load in the fields a… --- ## [Search\_as\_you\_type not working, help](https://discuss.elastic.co/t/search-as-you-type-not-working-help/282111)
**Author:** [@michel.st-louis](https://discuss.elastic.co/u/michel.st-louis)\ **Replies:** 3\ **Last updated:** [August 23, 2021, 5:06pm UTC](https://discuss.elastic.co/t/search-as-you-type-not-working-help/282111 "2021-08-23T17:06:02Z")
I was trying the new feature Search\_as\_you\_type but I don't know if if it my lack of knowledge but it is not working. I installed the verion 7.14. this is my kibana queries. this query yeld nothing no hits. DELETE test … --- ## [ERROR: this cluster currently has \[x\]/\[x\] maximum normal shards open](https://discuss.elastic.co/t/error-this-cluster-currently-has-x-x-maximum-normal-shards-open/282254)
**Author:** [@Stef\_Nestor](https://discuss.elastic.co/u/Stef_Nestor)\ **Replies:** 1\ **Last updated:** [August 23, 2021, 4:01pm UTC](https://discuss.elastic.co/t/error-this-cluster-currently-has-x-x-maximum-normal-shards-open/282254 "2021-08-23T16:01:14Z")
This example error may return from Elasticsearch to any ingestor (e.g. Logstash, Bulk, API, Beats, etc): \[{TIMESTAMP}\]\[WARN\]\[logstash.outputs.elasticsearch\]\[x\]\[y\] Could not index event to Elasticsearch. { :status=\> 400… --- ## [Custom grok filter](https://discuss.elastic.co/t/custom-grok-filter/281105)
**Author:** [@gba8912](https://discuss.elastic.co/u/gba8912)\ **Replies:** 3\ **Last updated:** [August 23, 2021, 3:59pm UTC](https://discuss.elastic.co/t/custom-grok-filter/281105 "2021-08-23T15:59:51Z")
Hello, I'm new to all this so bear with me. My company has asked me to figure out elk stack and how to make it work for their logs. I have everything set up and working but I need to be able to parse the logs in kibana a… --- ## [One alert for all unique event.action from all events in last 30mins](https://discuss.elastic.co/t/one-alert-for-all-unique-event-action-from-all-events-in-last-30mins/280313)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 1\ **Last updated:** [August 23, 2021, 3:49pm UTC](https://discuss.elastic.co/t/one-alert-for-all-unique-event-action-from-all-events-in-last-30mins/280313 "2021-08-23T15:49:43Z")
Hi, Version: ELK 7.13 Need to generate a single alert for all events with unique event.action feild values in last 30minute. Can someone please let me know which rule type I can use here? Also please share if you have… --- ## [Elasticsearch and kibana not accessible on the web browser](https://discuss.elastic.co/t/elasticsearch-and-kibana-not-accessible-on-the-web-browser/282169)
**Author:** [@123451](https://discuss.elastic.co/u/123451)\ **Replies:** 5\ **Last updated:** [August 23, 2021, 3:40pm UTC](https://discuss.elastic.co/t/elasticsearch-and-kibana-not-accessible-on-the-web-browser/282169 "2021-08-23T15:40:12Z")
Hi, I can not access Elasticsearch and kibana from the web browser. When I type in the Url: https://192.168.0.1:9200 on the web browser, I get this error. { "name" : "node-1", "cluster\_name" : "elasticsearch", "clus… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1268) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1270)