# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1285 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1286 --- ## [\[Canvas\] How to pass variable as timerange to savedVisualization](https://discuss.elastic.co/t/canvas-how-to-pass-variable-as-timerange-to-savedvisualization/279602)
**Author:** [@Salman\_Ahmed](https://discuss.elastic.co/u/Salman_Ahmed)\ **Replies:** 2\ **Last updated:** [August 12, 2021, 1:52am UTC](https://discuss.elastic.co/t/canvas-how-to-pass-variable-as-timerange-to-savedvisualization/279602 "2021-08-12T01:52:42Z")
I have created a canvas with multiple Kibana visualization and need to dynamically (from url parameter" pass the "from" argument of the visualization. It works until I save/run the expression at which point it changes th… --- ## [Update fileds in \_source by ES update api , when success, all data of stored\_fields are missing](https://discuss.elastic.co/t/update-fileds-in-source-by-es-update-api-when-success-all-data-of-stored-fields-are-missing/280896)
**Author:** [@jiangnanxue21](https://discuss.elastic.co/u/jiangnanxue21)\ **Replies:** 1\ **Last updated:** [August 12, 2021, 1:48am UTC](https://discuss.elastic.co/t/update-fileds-in-source-by-es-update-api-when-success-all-data-of-stored-fields-are-missing/280896 "2021-08-12T01:48:21Z")
Update fileds in \_source by ES update api , when success, all data of stored\_fields are missing, and I am confused about that....What is the internal mechanism？ --- ## [Too\_many\_clauses but only with ip field type and ip\_range search values?](https://discuss.elastic.co/t/too-many-clauses-but-only-with-ip-field-type-and-ip-range-search-values/281133)
**Author:** [@philosobyte](https://discuss.elastic.co/u/philosobyte)\ **Replies:** 0\ **Last updated:** [August 12, 2021, 1:05am UTC](https://discuss.elastic.co/t/too-many-clauses-but-only-with-ip-field-type-and-ip-range-search-values/281133 "2021-08-12T01:05:35Z")
Hello, We are running into a too\_many\_clauses failure when using a terms query inside a filter context, but only when the target field has type ip and when the search values are CIDRs. Here's an example: PUT /test-ind… --- ## [Parse lvmeng WAF log](https://discuss.elastic.co/t/parse-lvmeng-waf-log/281073)
**Author:** [@star\_cool](https://discuss.elastic.co/u/star_cool)\ **Replies:** 2\ **Last updated:** [August 11, 2021, 11:55pm UTC](https://discuss.elastic.co/t/parse-lvmeng-waf-log/281073 "2021-08-11T23:55:16Z")
hi \<11\>Aug 11 19:14:55 localhost waf: tag:waf\_log\_websec site\_id:1521041933 protect\_id:2623109843 dst\_ip:x.x.x.x dst\_port:80 src\_ip:183.209.173.69 src\_port:17506 method:GET domain:www.domain.com uri:/%5fupload/t… --- ## [Heartbeat setup failing because of incorrect user](https://discuss.elastic.co/t/heartbeat-setup-failing-because-of-incorrect-user/280870)
**Author:** [@Heroj04](https://discuss.elastic.co/u/Heroj04)\ **Replies:** 3\ **Last updated:** [August 11, 2021, 11:53pm UTC](https://discuss.elastic.co/t/heartbeat-setup-failing-because-of-incorrect-user/280870 "2021-08-11T23:53:58Z")
I'm trying to setup heartbeat on my new elastic stack server but it is failing because the user doesn't have permission to create indices. It seems to be using the writer user instead of the setup user that has the corr… --- ## [Does Http\_poller use something simillar to "sincedb" as File input does?](https://discuss.elastic.co/t/does-http-poller-use-something-simillar-to-sincedb-as-file-input-does/281044)
**Author:** [@panagiss](https://discuss.elastic.co/u/panagiss)\ **Replies:** 2\ **Last updated:** [August 11, 2021, 8:00pm UTC](https://discuss.elastic.co/t/does-http-poller-use-something-simillar-to-sincedb-as-file-input-does/281044 "2021-08-11T20:00:29Z")
I know that File input plugin uses sincedb to "remember" the state of the file and the index position. But what about other input plugins and specifically http\_poller? Because i have noticed that if i make the same req… --- ## [Configuration of Kibana running in Docker](https://discuss.elastic.co/t/configuration-of-kibana-running-in-docker/278181)
**Author:** [@ppuschmann](https://discuss.elastic.co/u/ppuschmann)\ **Replies:** 4\ **Last updated:** [August 11, 2021, 3:43pm UTC](https://discuss.elastic.co/t/configuration-of-kibana-running-in-docker/278181 "2021-08-11T15:43:55Z")
Hi, we're running Kibana as a Docker-container and can configure some options with environment-variables, but not all. These see to work just fine: "ELASTICSEARCH\_HOSTS": "http://xxxxxxx:9200", "ELASTICSEARCH\_PASSWORD… --- ## [Why do N-gram Tokenizers don't treat + (plus) characters as part of a token?](https://discuss.elastic.co/t/why-do-n-gram-tokenizers-dont-treat-plus-characters-as-part-of-a-token/281096)
**Author:** [@ssephillip](https://discuss.elastic.co/u/ssephillip)\ **Replies:** 1\ **Last updated:** [August 11, 2021, 4:38pm UTC](https://discuss.elastic.co/t/why-do-n-gram-tokenizers-dont-treat-plus-characters-as-part-of-a-token/281096 "2021-08-11T16:38:11Z")
Hello everyone, I have a few questions about the behavior of the N-Gram Tokenizer. I am relatively new to this forum, so please forgive me if I'm asking this question in a wrong way. I created my own custom tokenizer … --- ## [Aggregate error](https://discuss.elastic.co/t/aggregate-error/281080)
**Author:** [@Divya\_Bansal](https://discuss.elastic.co/u/Divya_Bansal)\ **Replies:** 1\ **Last updated:** [August 11, 2021, 4:31pm UTC](https://discuss.elastic.co/t/aggregate-error/281080 "2021-08-11T16:31:34Z")
Hi, I am using the below filter to parse my log file. if \[mesg\] == "ERROR" { #This is prod tomcat log format grok { match =\> { "mesg" =\> \[ "^\\s?\[%{DATA:loglevel}\] %{TIMESTAMP\_ISO8601:logts} \[%{DATA:threadname}\] %{DA… --- ## [Communications link failure consistently after one hour with MySQL](https://discuss.elastic.co/t/communications-link-failure-consistently-after-one-hour-with-mysql/281031)
**Author:** [@Justin\_Morgan](https://discuss.elastic.co/u/Justin_Morgan)\ **Replies:** 1\ **Last updated:** [August 11, 2021, 4:25pm UTC](https://discuss.elastic.co/t/communications-link-failure-consistently-after-one-hour-with-mysql/281031 "2021-08-11T16:25:56Z")
I am using logstash with JDBC to import data from MySQL into Elasticsearch. This has worked before but now it is consistently failing after 1 hour with this exception: \`Exception when executing JDBC query {:exception=\>"… --- ## [Sql query return is empty](https://discuss.elastic.co/t/sql-query-return-is-empty/281092)
**Author:** [@Christophe\_Dumont](https://discuss.elastic.co/u/Christophe_Dumont)\ **Replies:** 1\ **Last updated:** [August 11, 2021, 4:24pm UTC](https://discuss.elastic.co/t/sql-query-return-is-empty/281092 "2021-08-11T16:24:50Z")
I would like to make a query to retrieve the records of the 'layers' column (index name = ids) When i run this command : GET /\_sql?format=txt { "query": "DESCRIBE ids" } it's ok column | type … --- ## [Logstash is getting reset after 40 sec ,low uptime](https://discuss.elastic.co/t/logstash-is-getting-reset-after-40-sec-low-uptime/281029)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 2\ **Last updated:** [August 11, 2021, 4:15pm UTC](https://discuss.elastic.co/t/logstash-is-getting-reset-after-40-sec-low-uptime/281029 "2021-08-11T16:15:21Z")
Hi, I checked the logstash status, after every 40-sec logstash is getting started, Getting error message-How to solve this? Aug 11 09:38:38 learning-1 logstash\[4057\]: ERROR: Failed to parse YAML file "/etc/logstash/lo… --- ## [Other space's reports are visible](https://discuss.elastic.co/t/other-spaces-reports-are-visible/281099)
**Author:** [@Simone\_Scarduzio](https://discuss.elastic.co/u/Simone_Scarduzio)\ **Replies:** 0\ **Last updated:** [August 11, 2021, 4:08pm UTC](https://discuss.elastic.co/t/other-spaces-reports-are-visible/281099 "2021-08-11T16:08:43Z")
I really like Kibana's Spaces feature. It sorts of containerises all Kibana settings and objects. I can even set the dark theme for a space, and the light theme for the other. however, it was a surprise for me seeing al… --- ## [SOLVED - Logstash http output to Kafka REST Proxy](https://discuss.elastic.co/t/solved-logstash-http-output-to-kafka-rest-proxy/281098)
**Author:** [@stevetu21](https://discuss.elastic.co/u/stevetu21)\ **Replies:** 0\ **Last updated:** [August 11, 2021, 4:02pm UTC](https://discuss.elastic.co/t/solved-logstash-http-output-to-kafka-rest-proxy/281098 "2021-08-11T16:02:44Z")
Wanted to share a solution that I found to Logstash http output to Kafka-REST-Proxy and Logstash to Confluent kafka rest proxy. Was running into the same issue trying to use the http output to write a confluent Kafka RES… --- ## [Indicator Match Detection Rule Error - indicators.map is not a function](https://discuss.elastic.co/t/indicator-match-detection-rule-error-indicators-map-is-not-a-function/280941)
**Author:** [@MakoWish](https://discuss.elastic.co/u/MakoWish)\ **Replies:** 8\ **Last updated:** [August 11, 2021, 3:27pm UTC](https://discuss.elastic.co/t/indicator-match-detection-rule-error-indicators-map-is-not-a-function/280941 "2021-08-11T15:27:48Z")
I have not had any issues with this rule until just this morning, but when I click into an Indicator Match Detection Rule we have, the page seems to start loading just fine, but then it gives an error: Error: indicators… --- ## [Filebeat modules](https://discuss.elastic.co/t/filebeat-modules/280852)
**Author:** [@leemase004](https://discuss.elastic.co/u/leemase004)\ **Replies:** 13\ **Last updated:** [August 11, 2021, 3:18pm UTC](https://discuss.elastic.co/t/filebeat-modules/280852 "2021-08-11T15:18:57Z")
I have, hopefully, a very simple question: We have filebeat (zeek module) running on SERVER A. Filebeat takes it to kafka where it is then pulled down by logstash. The zeek.conf file in logstash is completely barren. It… --- ## [\[heartbeat\]how to get performace test on heartbeat](https://discuss.elastic.co/t/heartbeat-how-to-get-performace-test-on-heartbeat/274304)
**Author:** [@lowry](https://discuss.elastic.co/u/lowry)\ **Replies:** 8\ **Last updated:** [August 11, 2021, 3:02pm UTC](https://discuss.elastic.co/t/heartbeat-how-to-get-performace-test-on-heartbeat/274304 "2021-08-11T15:02:25Z")
Hi Elastic friends, Have a question for the performance of heartbeat. Assuming there’re 90K targets need to be monitored via heartbeat, in some case, like there’re 30% to 50% targets, maybe even worse, there’re 60%~80%… --- ## [Filebeat on Ubuntu hosts getting sporadic error: "Error decoding JSON:"](https://discuss.elastic.co/t/filebeat-on-ubuntu-hosts-getting-sporadic-error-error-decoding-json/258783)
**Author:** [@humbeGar](https://discuss.elastic.co/u/humbeGar)\ **Replies:** 9\ **Last updated:** [August 11, 2021, 2:40pm UTC](https://discuss.elastic.co/t/filebeat-on-ubuntu-hosts-getting-sporadic-error-error-decoding-json/258783 "2021-08-11T14:40:03Z")
Description We are using Filebeat to collect data from multiple systems (~300 different hosts) and OSes ( Windows, Ubuntu, Mac OS). We are collecting around 125Million events coming from .ndjson files per week using Fil… --- ## [Date range filter not returning match if doc\_values is false](https://discuss.elastic.co/t/date-range-filter-not-returning-match-if-doc-values-is-false/281089)
**Author:** [@AMAirfree](https://discuss.elastic.co/u/AMAirfree)\ **Replies:** 0\ **Last updated:** [August 11, 2021, 2:30pm UTC](https://discuss.elastic.co/t/date-range-filter-not-returning-match-if-doc-values-is-false/281089 "2021-08-11T14:30:49Z")
Hello ! I've been confronted to a problem with one of my queries since upgrading my ElasticSearch version to 7.14. I'm filtering nested objects containing a date property, it used to work correctly but ever since the u… --- ## [Searches with two or more words?](https://discuss.elastic.co/t/searches-with-two-or-more-words/281088)
**Author:** [@Sebastian\_Marroquin](https://discuss.elastic.co/u/Sebastian_Marroquin)\ **Replies:** 0\ **Last updated:** [August 11, 2021, 2:28pm UTC](https://discuss.elastic.co/t/searches-with-two-or-more-words/281088 "2021-08-11T14:28:14Z")
Hi Devs, I need help with something about elasticsearch. I have a database full of products related to electronics and computers. I'm using elasticsearch but when I want to do a search like "Dell Laptop" it doesn't ret… --- ## [Query to find if a field exists in last 7 hours](https://discuss.elastic.co/t/query-to-find-if-a-field-exists-in-last-7-hours/281056)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 8\ **Last updated:** [August 11, 2021, 2:20pm UTC](https://discuss.elastic.co/t/query-to-find-if-a-field-exists-in-last-7-hours/281056 "2021-08-11T14:20:44Z")
I am trying to find documents containing opsgenieAction:create in the last 7 hours. I constructed the following query but somehow the result is not as expected. can someone help to find what is wrong here? Query : GET… --- ## [Gcp-pubsub error creating input](https://discuss.elastic.co/t/gcp-pubsub-error-creating-input/281084)
**Author:** [@raiz](https://discuss.elastic.co/u/raiz)\ **Replies:** 0\ **Last updated:** [August 11, 2021, 2:20pm UTC](https://discuss.elastic.co/t/gcp-pubsub-error-creating-input/281084 "2021-08-11T14:20:38Z")
Hello, I'm trying to run filebeat -e and getting this error: 2021-08-11T14:14:24.729Z INFO \[monitoring\] log/log.go:130 Stopping metrics logging. 2021-08-11T14:14:24.729Z INFO instance/beat.go:412 filebeat stopped. 2021… --- ## [Discovered bug/security issue? Elastic built-in user authentication](https://discuss.elastic.co/t/discovered-bug-security-issue-elastic-built-in-user-authentication/280842)
**Author:** [@hodops](https://discuss.elastic.co/u/hodops)\ **Replies:** 3\ **Last updated:** [August 11, 2021, 2:18pm UTC](https://discuss.elastic.co/t/discovered-bug-security-issue-elastic-built-in-user-authentication/280842 "2021-08-11T14:18:37Z")
Hello, First time poster here. I've discovered something rather interesting that I'd like someone who understands the underlying authentication a bit better than myself to take a look at. When using ECE We all know th… --- ## [Requesting help with synonym's combined with a query string](https://discuss.elastic.co/t/requesting-help-with-synonyms-combined-with-a-query-string/281066)
**Author:** [@BramFr](https://discuss.elastic.co/u/BramFr)\ **Replies:** 4\ **Last updated:** [August 11, 2021, 1:57pm UTC](https://discuss.elastic.co/t/requesting-help-with-synonyms-combined-with-a-query-string/281066 "2021-08-11T13:57:19Z")
Hi everybody, Just stepping in to the world of ES so I'm sorry if I am a bit of a newbie. Currently I'm stuck at a point in ES and I can't seem to find an awser online, perhaps one of you could be of assistance. What … --- ## [How to select or return specific part from Split ingest pipeline](https://discuss.elastic.co/t/how-to-select-or-return-specific-part-from-split-ingest-pipeline/280146)
**Author:** [@Mojahid\_Ahmad](https://discuss.elastic.co/u/Mojahid_Ahmad)\ **Replies:** 7\ **Last updated:** [August 11, 2021, 1:52pm UTC](https://discuss.elastic.co/t/how-to-select-or-return-specific-part-from-split-ingest-pipeline/280146 "2021-08-11T13:52:19Z")
I have created one split ingest pipeline, it is working fine. But I want to return only the first part of the text. GET \_ingest/pipeline/\_simulate { "pipeline":{ "processors":\[ { "split":{ "fi… --- ## ["Should" is not working in DSL](https://discuss.elastic.co/t/should-is-not-working-in-dsl/281063)
**Author:** [@tarekilani](https://discuss.elastic.co/u/tarekilani)\ **Replies:** 7\ **Last updated:** [August 11, 2021, 1:46pm UTC](https://discuss.elastic.co/t/should-is-not-working-in-dsl/281063 "2021-08-11T13:46:16Z")
Hello, I'm querying elasticsearch using DSL in "dev tools". I have the following code : "query": { "bool" : { "must": \[ {"range": { "@timestamp": { "gte": "now-10m/… --- ## [Unable to configure security in Stack 7.14.0](https://discuss.elastic.co/t/unable-to-configure-security-in-stack-7-14-0/281074)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 0\ **Last updated:** [August 11, 2021, 1:26pm UTC](https://discuss.elastic.co/t/unable-to-configure-security-in-stack-7-14-0/281074 "2021-08-11T13:26:02Z")
I have been able to get 7.14.0 installed and running in my test environment. I have ElasticSearch, Kibana and Logstash installed. If I do not make any changes to the yml files I can start and access Kibana, although I … --- ## [Vulnerability - HTTP DELETE Method Enabled](https://discuss.elastic.co/t/vulnerability-http-delete-method-enabled/281057)
**Author:** [@sujivisva](https://discuss.elastic.co/u/sujivisva)\ **Replies:** 1\ **Last updated:** [August 11, 2021, 1:21pm UTC](https://discuss.elastic.co/t/vulnerability-http-delete-method-enabled/281057 "2021-08-11T13:21:41Z")
We are using ElasticSearch software for our application in our Project. But we are getting the following vulnerabilities from the security team HTTP DELETE Method Enabled The Web server contains a flaw that may allow a… --- ## [Elastic-agent in a docker container](https://discuss.elastic.co/t/elastic-agent-in-a-docker-container/281068)
**Author:** [@NatSav](https://discuss.elastic.co/u/NatSav)\ **Replies:** 1\ **Last updated:** [August 11, 2021, 1:20pm UTC](https://discuss.elastic.co/t/elastic-agent-in-a-docker-container/281068 "2021-08-11T13:20:49Z")
Hi all. Im trying to run an elastic-agent inside a docker container and im encountering a few issues. I know that docker isnt technically supported however I think im nearly there and im going to persevere with it. I h… --- ## [Minimal snapshots](https://discuss.elastic.co/t/minimal-snapshots/280962)
**Author:** [@6igwig](https://discuss.elastic.co/u/6igwig)\ **Replies:** 2\ **Last updated:** [August 11, 2021, 12:28pm UTC](https://discuss.elastic.co/t/minimal-snapshots/280962 "2021-08-11T12:28:31Z")
Under the Data management section on the elastic.co/subscriptions page I see an entry for "Minimal snapshots". What is that referring to? I can not find any information in the documentation. [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1284) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1286)