# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1296 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1297 --- ## [Http input plugin, url with param from field](https://discuss.elastic.co/t/http-input-plugin-url-with-param-from-field/280365)
**Author:** [@cibernicola](https://discuss.elastic.co/u/cibernicola)\ **Replies:** 6\ **Last updated:** [August 3, 2021, 10:32pm UTC](https://discuss.elastic.co/t/http-input-plugin-url-with-param-from-field/280365 "2021-08-03T22:32:25Z")
I have a standard logstash config, where I store several fields form a log. With one field I need to "ask something" to an external API with an specific url pattern, which is: staticString+variableField+staticString S… --- ## [Resolve one of the index in cluster is with Yellow status](https://discuss.elastic.co/t/resolve-one-of-the-index-in-cluster-is-with-yellow-status/280274)
**Author:** [@SabirPiludiya](https://discuss.elastic.co/u/SabirPiludiya)\ **Replies:** 3\ **Last updated:** [August 3, 2021, 9:24pm UTC](https://discuss.elastic.co/t/resolve-one-of-the-index-in-cluster-is-with-yellow-status/280274 "2021-08-03T21:24:15Z")
We are running HA Elasticsearch in k8s. Recently we found one of the indexes in the Yellow status due to Unassigned shards which leads the whole cluster state to yellow. Shard of that index status in NODE-A is STARTED a… --- ## [Put the x bar at the top](https://discuss.elastic.co/t/put-the-x-bar-at-the-top/279700)
**Author:** [@Lisouu\_13](https://discuss.elastic.co/u/Lisouu_13)\ **Replies:** 5\ **Last updated:** [August 3, 2021, 9:06pm UTC](https://discuss.elastic.co/t/put-the-x-bar-at-the-top/279700 "2021-08-03T21:06:20Z")
Hello hello, is it possible to do something like that in kibana 7.13, and if so, how to do please ? --- ## [Multiple Sql Server DB mapping with Elasticsearch Index for data transfer using Logstash](https://discuss.elastic.co/t/multiple-sql-server-db-mapping-with-elasticsearch-index-for-data-transfer-using-logstash/280364)
**Author:** [@vikashmarwal](https://discuss.elastic.co/u/vikashmarwal)\ **Replies:** 0\ **Last updated:** [August 3, 2021, 7:52pm UTC](https://discuss.elastic.co/t/multiple-sql-server-db-mapping-with-elasticsearch-index-for-data-transfer-using-logstash/280364 "2021-08-03T19:52:30Z")
We are having multiple databases in SQL Server, those are created dynamically for specific workspace. In these databases we have a DocumentDetail table. If there is one DB then I am able to map it in config to transfer t… --- ## [Restore from snapshot fails with no recovery information](https://discuss.elastic.co/t/restore-from-snapshot-fails-with-no-recovery-information/280355)
**Author:** [@bill\_d](https://discuss.elastic.co/u/bill_d)\ **Replies:** 2\ **Last updated:** [August 3, 2021, 7:43pm UTC](https://discuss.elastic.co/t/restore-from-snapshot-fails-with-no-recovery-information/280355 "2021-08-03T19:43:25Z")
I have 2 similarly configured 3 node elasticsearch clusters. Both run 7.10.2, but one is bigger than the other. I'm trying to restore an index from a snapshot. In the small cluster, the restore takes about 3 minutes, … --- ## [Logstash write to json no comma separator](https://discuss.elastic.co/t/logstash-write-to-json-no-comma-separator/280302)
**Author:** [@Hamza\_El\_Aouane](https://discuss.elastic.co/u/Hamza_El_Aouane)\ **Replies:** 3\ **Last updated:** [August 3, 2021, 7:18pm UTC](https://discuss.elastic.co/t/logstash-write-to-json-no-comma-separator/280302 "2021-08-03T19:18:57Z")
Hello everyone. I am saving my logstash events to a json file as follow: file { path =\> "path\\event-%{+yyyy.MM.dd}.json" codec =\> json everything is fine, until today that I realised that the file is not form… --- ## [Fetching listing failed](https://discuss.elastic.co/t/fetching-listing-failed/280283)
**Author:** [@Prasanth\_V](https://discuss.elastic.co/u/Prasanth_V)\ **Replies:** 2\ **Last updated:** [August 3, 2021, 7:08pm UTC](https://discuss.elastic.co/t/fetching-listing-failed/280283 "2021-08-03T19:08:52Z")
Could you pls suggest on below error?.. --- ## [Unable to see file system metrics in kibana even the data present](https://discuss.elastic.co/t/unable-to-see-file-system-metrics-in-kibana-even-the-data-present/280253)
**Author:** [@shan1](https://discuss.elastic.co/u/shan1)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 7:06pm UTC](https://discuss.elastic.co/t/unable-to-see-file-system-metrics-in-kibana-even-the-data-present/280253 "2021-08-03T19:06:24Z")
There is file system data present in indexes but not showing up in dashboard when we query. Except filesystem metrics it's fetching all metrics like cpu, memory and IOps. Please provide some suggestion --- ## [How can I avoid alerts for an instance of a rule in advance?](https://discuss.elastic.co/t/how-can-i-avoid-alerts-for-an-instance-of-a-rule-in-advance/280231)
**Author:** [@norgro2601](https://discuss.elastic.co/u/norgro2601)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 7:02pm UTC](https://discuss.elastic.co/t/how-can-i-avoid-alerts-for-an-instance-of-a-rule-in-advance/280231 "2021-08-03T19:02:57Z")
Hi, I have rules that run and create an alert for several hosts. When there is a planned maintenance window, I cannot mute the rule for one alert/instance, because the alert instance for that host is only visible when t… --- ## [Alerts - Kibana vs Watcher - Elasticsearch](https://discuss.elastic.co/t/alerts-kibana-vs-watcher-elasticsearch/280311)
**Author:** [@GavinBeattie](https://discuss.elastic.co/u/GavinBeattie)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 7:02pm UTC](https://discuss.elastic.co/t/alerts-kibana-vs-watcher-elasticsearch/280311 "2021-08-03T19:02:21Z")
In the Alerts connector options for email, is there a way to use the same inbuilt email account options e.g. noreply@watcheralert.found.io? We are using the hosted Elasticsearch environment. --- ## [Vega - show Gantt](https://discuss.elastic.co/t/vega-show-gantt/280212)
**Author:** [@Guy\_Levinhr](https://discuss.elastic.co/u/Guy_Levinhr)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 6:55pm UTC](https://discuss.elastic.co/t/vega-show-gantt/280212 "2021-08-03T18:55:59Z")
Hii, I have index with data and I want to show the data as Gantt. The data contains : session\_id - Unique Id for the session date\_created/time - When the session start (same for all the rows of the session) … --- ## [How to pass data to custom plugin in Kibana](https://discuss.elastic.co/t/how-to-pass-data-to-custom-plugin-in-kibana/280139)
**Author:** [@aza-zil](https://discuss.elastic.co/u/aza-zil)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 6:50pm UTC](https://discuss.elastic.co/t/how-to-pass-data-to-custom-plugin-in-kibana/280139 "2021-08-03T18:50:13Z")
I created a new plugin. on a button click, I want to redirect to the plugin page, I did that by doing the following: const urlToplugin= "/app/myScheduler"; window.location.href = urlToplugin , but I want to pass some d… --- ## [Extend Wazuh OVA storage](https://discuss.elastic.co/t/extend-wazuh-ova-storage/280085)
**Author:** [@Barry\_Dupont](https://discuss.elastic.co/u/Barry_Dupont)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 6:42pm UTC](https://discuss.elastic.co/t/extend-wazuh-ova-storage/280085 "2021-08-03T18:42:26Z")
I was wondering what is the proper way to extend VM storage(40Gb): I already have a root partition under "/". can i extend this partition or should i add a new partition and mount than just change log file path in elast… --- ## [Index templates](https://discuss.elastic.co/t/index-templates/279952)
**Author:** [@ailengcon](https://discuss.elastic.co/u/ailengcon)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 6:35pm UTC](https://discuss.elastic.co/t/index-templates/279952 "2021-08-03T18:35:25Z")
When I ingest my index from MongoDb via monstache, the indexing is causing some of the documents not being indexed because it can't map the fields right. I have being trying (for days) to figure out the index template o… --- ## [Watcher - CSV URL](https://discuss.elastic.co/t/watcher-csv-url/279890)
**Author:** [@Soren\_vdc](https://discuss.elastic.co/u/Soren_vdc)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 6:31pm UTC](https://discuss.elastic.co/t/watcher-csv-url/279890 "2021-08-03T18:31:02Z")
Hi, I want to add an attachment to email with watcher. When I used the "saved object" in discover and then "share" =\> "copy POST URL" .. this URL is not working. I receive parsing exception. Any idea what may cause thi… --- ## [Issue with Automatic CSV Report Generation from Kibana 7.13.4](https://discuss.elastic.co/t/issue-with-automatic-csv-report-generation-from-kibana-7-13-4/279827)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 6:28pm UTC](https://discuss.elastic.co/t/issue-with-automatic-csv-report-generation-from-kibana-7-13-4/279827 "2021-08-03T18:28:53Z")
Hi, In earlier version of kibana I used to decode and encode the post url from Kibana discover tab to change the timestamp to gte: "now-24h" lte: "now" in the url to fetch last 24 hours of data while auto generating the… --- ## [Metadata to be displayed on graph and show all x-axis values](https://discuss.elastic.co/t/metadata-to-be-displayed-on-graph-and-show-all-x-axis-values/279750)
**Author:** [@parinitha.nagaraja](https://discuss.elastic.co/u/parinitha.nagaraja)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 6:24pm UTC](https://discuss.elastic.co/t/metadata-to-be-displayed-on-graph-and-show-all-x-axis-values/279750 "2021-08-03T18:24:32Z")
Hello, How do I add metadata so that it can be seen to the user just by looking at the chart. For example, I want to be able to show version number associated with each build number. (see graph) Also, how can I adj… --- ## [Checking runner ip connectivity... FAILED Can't connect $RUNNER\_HOST\_IP \[172.xx.x.xx:22000\]: ConnectionError](https://discuss.elastic.co/t/checking-runner-ip-connectivity-failed-cant-connect-runner-host-ip-172-xx-x-xx-22000-connectionerror/278940)
**Author:** [@vjam](https://discuss.elastic.co/u/vjam)\ **Replies:** 21\ **Last updated:** [August 3, 2021, 5:31pm UTC](https://discuss.elastic.co/t/checking-runner-ip-connectivity-failed-cant-connect-runner-host-ip-172-xx-x-xx-22000-connectionerror/278940 "2021-08-03T17:31:26Z")
Hello All - We are trying to install Elastic (cloud-enterprise-version 2.8.1) in the following environment. AWS, RHEL-8 Docker (docker-ce-19.03.15) but seem to be constantly getting the error below Checking runner ip… --- ## [\_grokparsefailure is occurring even after the grok pattern is success](https://discuss.elastic.co/t/grokparsefailure-is-occurring-even-after-the-grok-pattern-is-success/280352)
**Author:** [@vaseemQA](https://discuss.elastic.co/u/vaseemQA)\ **Replies:** 0\ **Last updated:** [August 3, 2021, 4:51pm UTC](https://discuss.elastic.co/t/grokparsefailure-is-occurring-even-after-the-grok-pattern-is-success/280352 "2021-08-03T16:51:02Z")
Hi Team, I'm using logstash 6.8.3, and I'm trying to parse ES slow logs and my sample field is a ES source\_query which looks like {"from":0,"size":0,"post\_filter":{"bool":{"must":\[{"term":{"someId":{"value":1234,"boost… --- ## [Rally create-track limit document count](https://discuss.elastic.co/t/rally-create-track-limit-document-count/279916)
**Author:** [@mots](https://discuss.elastic.co/u/mots)\ **Replies:** 4\ **Last updated:** [August 3, 2021, 4:10pm UTC](https://discuss.elastic.co/t/rally-create-track-limit-document-count/279916 "2021-08-03T16:10:59Z")
I am able to create a custom track following these instructions. But the target index I am using has over 5 mil documents. It's taking too long to create the custom track and I don't even need that many documents to run… --- ## [Aggregate destination ip addresses and destination ports](https://discuss.elastic.co/t/aggregate-destination-ip-addresses-and-destination-ports/280342)
**Author:** [@Marco\_Lazzarotto](https://discuss.elastic.co/u/Marco_Lazzarotto)\ **Replies:** 0\ **Last updated:** [August 3, 2021, 3:38pm UTC](https://discuss.elastic.co/t/aggregate-destination-ip-addresses-and-destination-ports/280342 "2021-08-03T15:38:23Z")
I'm collecting hundreds of thousands of logs from a firewall (Cisco ASA). On every log record, among other details, I have destination ip addresses and destination ports. Now, I need to have an aggregated list of all d… --- ## [Af\_ Packet mode, local loopback data problem](https://discuss.elastic.co/t/af-packet-mode-local-loopback-data-problem/280335)
**Author:** [@chinaxushi](https://discuss.elastic.co/u/chinaxushi)\ **Replies:** 0\ **Last updated:** [August 3, 2021, 3:12pm UTC](https://discuss.elastic.co/t/af-packet-mode-local-loopback-data-problem/280335 "2021-08-03T15:12:26Z")
Turn on af\_packet, a large number of reconnections occur in the traffic sniffed by the local loop. If pcap is turned on, there is no problem. The following figure is a screenshot of the file with the command dump ./pack… --- ## [ILM policy doesn't work for jaeger](https://discuss.elastic.co/t/ilm-policy-doesnt-work-for-jaeger/280333)
**Author:** [@heruv1m](https://discuss.elastic.co/u/heruv1m)\ **Replies:** 0\ **Last updated:** [August 3, 2021, 2:59pm UTC](https://discuss.elastic.co/t/ilm-policy-doesnt-work-for-jaeger/280333 "2021-08-03T14:59:59Z")
I'm using elasticsearch as storage backend for jaeger. I initialized ilm, then created index. It worked well until 4-th index. On 4-th index ilm not applied anymore. Steps to reproduce Create ilm policy \_ilm/policy/… --- ## [Kibana alerts are not saved after modify them](https://discuss.elastic.co/t/kibana-alerts-are-not-saved-after-modify-them/278296)
**Author:** [@Felipe\_Illanes](https://discuss.elastic.co/u/Felipe_Illanes)\ **Replies:** 3\ **Last updated:** [August 3, 2021, 3:09pm UTC](https://discuss.elastic.co/t/kibana-alerts-are-not-saved-after-modify-them/278296 "2021-08-03T15:09:19Z")
Hi there, first of all thank you for the help. Second, i have an issue when i try to save a new query in the section of Alerts and Actions in KIbana. I'll explain with images... After i updated the query, and add and… --- ## [Performance issue while viewing the dashboard](https://discuss.elastic.co/t/performance-issue-while-viewing-the-dashboard/278988)
**Author:** [@Noursh](https://discuss.elastic.co/u/Noursh)\ **Replies:** 9\ **Last updated:** [August 3, 2021, 2:48pm UTC](https://discuss.elastic.co/t/performance-issue-while-viewing-the-dashboard/278988 "2021-08-03T14:48:56Z")
we have a performance issue with the 7.13.2 version, some time it tooks a lot of time to load the dashboards, and even some of them wont load at all and returning me "no results found", these things didn't happened wi… --- ## [I can rename job machine learning?](https://discuss.elastic.co/t/i-can-rename-job-machine-learning/279201)
**Author:** [@fcarrasco](https://discuss.elastic.co/u/fcarrasco)\ **Replies:** 3\ **Last updated:** [August 3, 2021, 2:35pm UTC](https://discuss.elastic.co/t/i-can-rename-job-machine-learning/279201 "2021-08-03T14:35:03Z")
Hi, i can rename job? I created job nifi\_collect, i need change to nifi\_collect\_others I've elastic 7.6.2 I see this index. \< green open .apm-agent-configuration xxxx 1 1 0 0 566b 283b … --- ## [Possible collision with user-defined field 'parameter' and built-in fields](https://discuss.elastic.co/t/possible-collision-with-user-defined-field-parameter-and-built-in-fields/280330)
**Author:** [@macs](https://discuss.elastic.co/u/macs)\ **Replies:** 0\ **Last updated:** [August 3, 2021, 2:25pm UTC](https://discuss.elastic.co/t/possible-collision-with-user-defined-field-parameter-and-built-in-fields/280330 "2021-08-03T14:25:42Z")
Hey, I am working on an app where we tried to append a Logstash Marker with the custom key "parameter", containing a string with some information about where in the application the log event occured. Unfortunately, sinc… --- ## [ElasticSerach API - update by query script params null\_pointer\_exception](https://discuss.elastic.co/t/elasticserach-api-update-by-query-script-params-null-pointer-exception/280325)
**Author:** [@Savas12.01](https://discuss.elastic.co/u/Savas12.01)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 2:18pm UTC](https://discuss.elastic.co/t/elasticserach-api-update-by-query-script-params-null-pointer-exception/280325 "2021-08-03T14:18:41Z")
I am new to the ElasticSearch and am i trying to make use of the \_update\_by\_query route. I am sending this body: { "query": { "match": { "id": "fdfsfsfs-058f-437d-bc52-473808ba61c2" } }, "script": { … --- ## [Static lookup](https://discuss.elastic.co/t/static-lookup/280182)
**Author:** [@IsAa](https://discuss.elastic.co/u/IsAa)\ **Replies:** 4\ **Last updated:** [August 3, 2021, 1:06pm UTC](https://discuss.elastic.co/t/static-lookup/280182 "2021-08-03T13:06:04Z")
Hi ELK Users, I was working on static look up table on index pattern. As you can observe that, I have two keys which I am mapping to the same value I can see in the Discover section, that these values are getting re… --- ## [Can't divide two fields when querying an index](https://discuss.elastic.co/t/cant-divide-two-fields-when-querying-an-index/280264)
**Author:** [@Luis\_P](https://discuss.elastic.co/u/Luis_P)\ **Replies:** 9\ **Last updated:** [August 3, 2021, 11:59am UTC](https://discuss.elastic.co/t/cant-divide-two-fields-when-querying-an-index/280264 "2021-08-03T11:59:17Z")
Hello, I'm new to Elasticsearch and Kibana and I've been trying to create a watcher that alerts me when the free disk space ratio is lower than a defined value. I believe I've managed to build a working watcher however, … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1295) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1297)