# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1302 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1303 --- ## [Esrally ingesting to two indices parallelly](https://discuss.elastic.co/t/esrally-ingesting-to-two-indices-parallelly/279933)
**Author:** [@Sameera\_De\_Silva](https://discuss.elastic.co/u/Sameera_De_Silva)\ **Replies:** 5\ **Last updated:** [July 29, 2021, 1:44pm UTC](https://discuss.elastic.co/t/esrally-ingesting-to-two-indices-parallelly/279933 "2021-07-29T13:44:57Z")
I want to add documents to two indices simultaneously. For that, I tried with parallel option . But it stills run sequentially and add data to firstly mentioned index and later to the second one . Is this supported is … --- ## [Journalbeat - getting kubernetes metadata](https://discuss.elastic.co/t/journalbeat-getting-kubernetes-metadata/279456)
**Author:** [@DetlefG](https://discuss.elastic.co/u/DetlefG)\ **Replies:** 1\ **Last updated:** [July 29, 2021, 1:35pm UTC](https://discuss.elastic.co/t/journalbeat-getting-kubernetes-metadata/279456 "2021-07-29T13:35:45Z")
Hi, I'm trying to run Journalbeat with processor 'add\_kubernetes\_metadata' to get the metadata of the kubernetes cluster. Journalbeat is running on the kubernetes nodes started by a daemonset with the following configu… --- ## [Query on kibana space.id](https://discuss.elastic.co/t/query-on-kibana-space-id/279255)
**Author:** [@hsdevaraja](https://discuss.elastic.co/u/hsdevaraja)\ **Replies:** 2\ **Last updated:** [July 29, 2021, 1:33pm UTC](https://discuss.elastic.co/t/query-on-kibana-space-id/279255 "2021-07-29T13:33:42Z")
Hi, I was rereferring below link for setting up of Kibana spaces for logs isolation based on environment domain. We have single instance of Elastic search & Kibana(7.10.2) & Our requirement is create different Kibana … --- ## [Synonym filter and preserve originals](https://discuss.elastic.co/t/synonym-filter-and-preserve-originals/279989)
**Author:** [@JoeSouthpaw](https://discuss.elastic.co/u/JoeSouthpaw)\ **Replies:** 0\ **Last updated:** [July 29, 2021, 1:32pm UTC](https://discuss.elastic.co/t/synonym-filter-and-preserve-originals/279989 "2021-07-29T13:32:42Z")
Hi there! I'm using elasticsearch for full-text front end search and have set up a custom search analyser with a large solr-format synonym filter attached. Unfortunately, some of these synonyms address business cases wh… --- ## [Escaping field names in queries](https://discuss.elastic.co/t/escaping-field-names-in-queries/279861)
**Author:** [@stexxen](https://discuss.elastic.co/u/stexxen)\ **Replies:** 7\ **Last updated:** [July 29, 2021, 1:29pm UTC](https://discuss.elastic.co/t/escaping-field-names-in-queries/279861 "2021-07-29T13:29:11Z")
We have discovered that some documents in our index contain a source that resembles the following { "a": { "b" : \["test1"\] }, "a.b" : \["test2"\] } I'm aware of how to perform queries with "exists", but how do… --- ## [CentOS 7 unable to start elastic search searcive](https://discuss.elastic.co/t/centos-7-unable-to-start-elastic-search-searcive/278770)
**Author:** [@rdewan](https://discuss.elastic.co/u/rdewan)\ **Replies:** 2\ **Last updated:** [July 29, 2021, 1:25pm UTC](https://discuss.elastic.co/t/centos-7-unable-to-start-elastic-search-searcive/278770 "2021-07-29T13:25:39Z")
● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since Thu 2021-07-15 10:57:58 UTC; 13min a… --- ## [Text color of values on chart (bar-chart)](https://discuss.elastic.co/t/text-color-of-values-on-chart-bar-chart/274319)
**Author:** [@Rachitha](https://discuss.elastic.co/u/Rachitha)\ **Replies:** 2\ **Last updated:** [June 2, 2021, 8:39am UTC](https://discuss.elastic.co/t/text-color-of-values-on-chart-bar-chart/274319 "2021-06-02T08:39:50Z")
Can we change the text color of values displayed on charts like bar graph? Can I remove the shadow displayed around the text? I am using the kibana version(7.12.1). --- ## [Keeping same search rate on one index spikes CPU in data nodes vs distributing the same load in two indices](https://discuss.elastic.co/t/keeping-same-search-rate-on-one-index-spikes-cpu-in-data-nodes-vs-distributing-the-same-load-in-two-indices/279985)
**Author:** [@Anurag\_Prajapat](https://discuss.elastic.co/u/Anurag_Prajapat)\ **Replies:** 0\ **Last updated:** [July 29, 2021, 12:56pm UTC](https://discuss.elastic.co/t/keeping-same-search-rate-on-one-index-spikes-cpu-in-data-nodes-vs-distributing-the-same-load-in-two-indices/279985 "2021-07-29T12:56:35Z")
We tested out two scenarios: 100 TPS search traffic was pointed to one index 20% CPU usage in data nodes and Threadpool search queue spikes observed. Application side there was increase in TP90 by 3x 80-20 TPS sea… --- ## [\_refresh is throwing error \[post /indexname/\_refresh\] does not support having a body](https://discuss.elastic.co/t/refresh-is-throwing-error-post-indexname-refresh-does-not-support-having-a-body/279940)
**Author:** [@Sumit\_Gaud](https://discuss.elastic.co/u/Sumit_Gaud)\ **Replies:** 6\ **Last updated:** [July 29, 2021, 12:50pm UTC](https://discuss.elastic.co/t/refresh-is-throwing-error-post-indexname-refresh-does-not-support-having-a-body/279940 "2021-07-29T12:50:05Z")
Hi, I deployed a elasticsearch on Azure using Elasticsearch (Self-Managed) I am using NEST nuget package to communicate to elasticsearch api in a .net application. This my application works fine with elastic search ho… --- ## [Plot TP90 percentile](https://discuss.elastic.co/t/plot-tp90-percentile/279975)
**Author:** [@User8](https://discuss.elastic.co/u/User8)\ **Replies:** 1\ **Last updated:** [July 29, 2021, 12:48pm UTC](https://discuss.elastic.co/t/plot-tp90-percentile/279975 "2021-07-29T12:48:10Z")
Hello everyone! I have data that have fields like API endpoints and response times. I want to show TP90 for these different endpoints, how can I do so in Kibana? --- ## [Logstash cycle in ruby filter](https://discuss.elastic.co/t/logstash-cycle-in-ruby-filter/279974)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 0\ **Last updated:** [July 29, 2021, 11:34am UTC](https://discuss.elastic.co/t/logstash-cycle-in-ruby-filter/279974 "2021-07-29T11:34:55Z")
Hi, community. I have message in CEF format, that may have cs1...csn and cs1Label...csnLabel fields. I can't use CEF codec, because I want to keep my original message too. So I decided to use "for" loop in ruby filter an… --- ## [Grok match regex](https://discuss.elastic.co/t/grok-match-regex/279957)
**Author:** [@Soren\_vdc](https://discuss.elastic.co/u/Soren_vdc)\ **Replies:** 2\ **Last updated:** [July 29, 2021, 11:11am UTC](https://discuss.elastic.co/t/grok-match-regex/279957 "2021-07-29T11:11:18Z")
Hi, I want to create grok match and have the 2 first words and the last part of the message. For example: ERROR;AuthenticationController ;processMessage ;THR=11107194 R=760a52d97983874 T=6031a0711ec3 U=Unauthenticated… --- ## ["Cannot invoke "java.util.List.get(int)" because "nestedParsedSource" is null" when using nested properties + has\_parent + inner\_hits](https://discuss.elastic.co/t/cannot-invoke-java-util-list-get-int-because-nestedparsedsource-is-null-when-using-nested-properties-has-parent-inner-hits/279967)
**Author:** [@pavelfry](https://discuss.elastic.co/u/pavelfry)\ **Replies:** 0\ **Last updated:** [July 29, 2021, 10:38am UTC](https://discuss.elastic.co/t/cannot-invoke-java-util-list-get-int-because-nestedparsedsource-is-null-when-using-nested-properties-has-parent-inner-hits/279967 "2021-07-29T10:38:19Z")
Hello everyone, I've been banging my head against this for a while and it seems I've reached a dead end. I've tried to simplify the code as much as possible. Problem: I'm using the child/parent relationships and neste… --- ## [Global Search Query](https://discuss.elastic.co/t/global-search-query/279835)
**Author:** [@Ravi\_Chhatwani](https://discuss.elastic.co/u/Ravi_Chhatwani)\ **Replies:** 2\ **Last updated:** [July 29, 2021, 10:12am UTC](https://discuss.elastic.co/t/global-search-query/279835 "2021-07-29T10:12:52Z")
I am working on the Global Search functionality which include mathematical comparision operation like (=,\>,\<) , I am looking for the solution how to infer the field and then search the text or value meaning I can give us… --- ## [Winlogbeat Dashboard](https://discuss.elastic.co/t/winlogbeat-dashboard/279814)
**Author:** [@insurin](https://discuss.elastic.co/u/insurin)\ **Replies:** 1\ **Last updated:** [July 29, 2021, 10:08am UTC](https://discuss.elastic.co/t/winlogbeat-dashboard/279814 "2021-07-29T10:08:32Z")
Can anyone help me get my dashboard working again. I deleted an index ( winlog 7.1.12.0) and a new one got made (winlog 7.1.12.1) but now I get loads of errors when using the built-in dashboard I'm not sure where to sta… --- ## [Filter on script hit result](https://discuss.elastic.co/t/filter-on-script-hit-result/279960)
**Author:** [@Giovanni\_Di\_Lembo](https://discuss.elastic.co/u/Giovanni_Di_Lembo)\ **Replies:** 0\ **Last updated:** [July 29, 2021, 9:59am UTC](https://discuss.elastic.co/t/filter-on-script-hit-result/279960 "2021-07-29T09:59:55Z")
Hi all and sorry for my poor english. I'm filtering my index cpes using script (painless). As a a result , I have hits with null values and I need to exclude those hits. I've done this query, but I cannot find a way t… --- ## [Elastic server](https://discuss.elastic.co/t/elastic-server/279831)
**Author:** [@111479](https://discuss.elastic.co/u/111479)\ **Replies:** 5\ **Last updated:** [July 29, 2021, 8:54am UTC](https://discuss.elastic.co/t/elastic-server/279831 "2021-07-29T08:54:39Z")
Hi, i am want to install an elastic server what are the requirement i need to do it? for exmpale : ram, cpu, operation system? thank you. --- ## [Metricbeat errors due to missing manage permission](https://discuss.elastic.co/t/metricbeat-errors-due-to-missing-manage-permission/279867)
**Author:** [@MaximK](https://discuss.elastic.co/u/MaximK)\ **Replies:** 2\ **Last updated:** [July 29, 2021, 8:49am UTC](https://discuss.elastic.co/t/metricbeat-errors-due-to-missing-manage-permission/279867 "2021-07-29T08:49:13Z")
Metricbeat configured with user elastic I have error org.elasticsearch.ElasticsearchSecurityException: action \[indices:admin/rollover\] is unauthorized for user \[remote\_monitoring\_user\] with roles \[remote\_monitoring\_col… --- ## [Migration of kibana plugin](https://discuss.elastic.co/t/migration-of-kibana-plugin/279803)
**Author:** [@prashant1](https://discuss.elastic.co/u/prashant1)\ **Replies:** 1\ **Last updated:** [July 29, 2021, 8:25am UTC](https://discuss.elastic.co/t/migration-of-kibana-plugin/279803 "2021-07-29T08:25:18Z")
We have a kibana plugin generated in version 7.0.1 we want to migrate it to 7.10.2 version . We have some doubts:- Will it possible to directly migrate that plugin to version 7.10.2 or we need to take intermediate step… --- ## [Filebeat autodiscover for Kubernetes uses inconsistent log files path by default](https://discuss.elastic.co/t/filebeat-autodiscover-for-kubernetes-uses-inconsistent-log-files-path-by-default/279834)
**Author:** [@NicolasCa](https://discuss.elastic.co/u/NicolasCa)\ **Replies:** 1\ **Last updated:** [July 29, 2021, 8:10am UTC](https://discuss.elastic.co/t/filebeat-autodiscover-for-kubernetes-uses-inconsistent-log-files-path-by-default/279834 "2021-07-29T08:10:32Z")
Hi, I have trouble when deploying Filebeat in my Kubernetes cluster (v1.21.1) using ECK. The deployment spec is the following: apiVersion: beat.k8s.elastic.co/v1beta1 kind: Beat metadata: name: filebeat spec: type:… --- ## [Filebeat running on Kubernetes connected to Elasticsearch using SSL](https://discuss.elastic.co/t/filebeat-running-on-kubernetes-connected-to-elasticsearch-using-ssl/279946)
**Author:** [@jllorente](https://discuss.elastic.co/u/jllorente)\ **Replies:** 0\ **Last updated:** [July 29, 2021, 7:30am UTC](https://discuss.elastic.co/t/filebeat-running-on-kubernetes-connected-to-elasticsearch-using-ssl/279946 "2021-07-29T07:30:54Z")
I would like to use filebeat on Kubernetes and connect it to a secured Elasticsearch server, using certificates. I did a search to find how to do this but only found an un-answered related question. After some test I go… --- ## [How to output a specific fields of JSON data in logstash](https://discuss.elastic.co/t/how-to-output-a-specific-fields-of-json-data-in-logstash/279944)
**Author:** [@Takky](https://discuss.elastic.co/u/Takky)\ **Replies:** 0\ **Last updated:** [July 29, 2021, 7:28am UTC](https://discuss.elastic.co/t/how-to-output-a-specific-fields-of-json-data-in-logstash/279944 "2021-07-29T07:28:45Z")
I want to know how to select and output some fields from JSON data with many fields. For example, there is the following input JSON data. \[input\] { "layers1": { "field01": { "sample01": "5", "… --- ## [Logstash-paloalto loss of data](https://discuss.elastic.co/t/logstash-paloalto-loss-of-data/279504)
**Author:** [@Betorov](https://discuss.elastic.co/u/Betorov)\ **Replies:** 2\ **Last updated:** [July 29, 2021, 7:17am UTC](https://discuss.elastic.co/t/logstash-paloalto-loss-of-data/279504 "2021-07-29T07:17:17Z")
Hi evreyone, I'm not sure if I had to post this here or in a paloalto forum. Problem: My logstash take the logs that are coming from paloalto, this type of log have a precise structure explained here : Threat Log Fie… --- ## [Elasticsearch service enabled, vendor disabled issue](https://discuss.elastic.co/t/elasticsearch-service-enabled-vendor-disabled-issue/279934)
**Author:** [@ritesh.aduri45](https://discuss.elastic.co/u/ritesh.aduri45)\ **Replies:** 3\ **Last updated:** [July 29, 2021, 6:58am UTC](https://discuss.elastic.co/t/elasticsearch-service-enabled-vendor-disabled-issue/279934 "2021-07-29T06:58:52Z")
\[root@hib-vm-siemlog elasticsearch\]# systemctl status elasticsearch ● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: disabled) Active: fail… --- ## [Is there any way of restricting access to Kibana based on IP address/subnets?](https://discuss.elastic.co/t/is-there-any-way-of-restricting-access-to-kibana-based-on-ip-address-subnets/279810)
**Author:** [@neil6323](https://discuss.elastic.co/u/neil6323)\ **Replies:** 4\ **Last updated:** [July 29, 2021, 4:45am UTC](https://discuss.elastic.co/t/is-there-any-way-of-restricting-access-to-kibana-based-on-ip-address-subnets/279810 "2021-07-29T04:45:34Z")
Hi all, I know you can restrict access to Elasticsearch nodes using IP filtering. But I believe this does not restrict access to Kibana. Is there a similar mechanism to IP filters for Kibana? The end result we are look… --- ## [Dissect filter sometimes not working](https://discuss.elastic.co/t/dissect-filter-sometimes-not-working/279927)
**Author:** [@jeffrey008](https://discuss.elastic.co/u/jeffrey008)\ **Replies:** 1\ **Last updated:** [July 29, 2021, 4:43am UTC](https://discuss.elastic.co/t/dissect-filter-sometimes-not-working/279927 "2021-07-29T04:43:32Z")
Logstash cannot find the pattern in my log. It sometimes can dissect successfully but sometimes not. \[2021-07-29T04:18:35,253\]\[WARN \]\[org.logstash.dissect.Dissector\]\[main\]\[0b28d6955374719d4eec09ce396e5505f458a3d25e49b40… --- ## [Logstash - Error parsing csv :exception=\>java.lang.ArrayIndexOutOfBoundsException](https://discuss.elastic.co/t/logstash-error-parsing-csv-exception-java-lang-arrayindexoutofboundsexception/279884)
**Author:** [@deadloss](https://discuss.elastic.co/u/deadloss)\ **Replies:** 2\ **Last updated:** [July 29, 2021, 4:41am UTC](https://discuss.elastic.co/t/logstash-error-parsing-csv-exception-java-lang-arrayindexoutofboundsexception/279884 "2021-07-29T04:41:50Z")
I am trying to sync logs from csv, sometimes I get this error \[2021-07-28T14:49:03,857\]\[WARN \]\[logstash.filters.csv \] Error parsing csv {:field=\>"message", :source=\>"M5804240304", :exception=\>java.lang.ArrayIndexOut… --- ## [Invalid zlib data](https://discuss.elastic.co/t/invalid-zlib-data/279823)
**Author:** [@fidsamurai](https://discuss.elastic.co/u/fidsamurai)\ **Replies:** 1\ **Last updated:** [July 29, 2021, 4:26am UTC](https://discuss.elastic.co/t/invalid-zlib-data/279823 "2021-07-29T04:26:26Z")
Hi Team, Getting the following error in Discover in Kibana 7.13.4 - Error: invalid zlib data at search\_interceptor\_EnhancedSearchInterceptor.handleSearchError (https://new-kibana.viapplogs.net/41022/bundles/plu… --- ## [Logstash does not create index in Elasticsearch (Windows 10)](https://discuss.elastic.co/t/logstash-does-not-create-index-in-elasticsearch-windows-10/279796)
**Author:** [@Lucas\_Yoshioka](https://discuss.elastic.co/u/Lucas_Yoshioka)\ **Replies:** 2\ **Last updated:** [July 29, 2021, 12:35am UTC](https://discuss.elastic.co/t/logstash-does-not-create-index-in-elasticsearch-windows-10/279796 "2021-07-29T00:35:13Z")
Hi guys, I am trying run ELK, but for some reason Logstash does not create my indexes in Elasticsearch. I installed both and added their /bin path to my environment variables. Here is the conf file I am using: input { … --- ## [Config check, filtering out users](https://discuss.elastic.co/t/config-check-filtering-out-users/279915)
**Author:** [@sancla](https://discuss.elastic.co/u/sancla)\ **Replies:** 1\ **Last updated:** [July 29, 2021, 12:12am UTC](https://discuss.elastic.co/t/config-check-filtering-out-users/279915 "2021-07-29T00:12:05Z")
Hey guys, I'm a bit new to elastic so I can hope a 'specialist' can help me out here. I am trying to filter out some security log records from our Exchange servers and it does not seem to be working. The config is test… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1301) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1303)