# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1312

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1313

---

## ["add panel" in dashboard edit view never loads](https://discuss.elastic.co/t/add-panel-in-dashboard-edit-view-never-loads/277976)

<div class="topic-metadata">

**Author:** [@bacony0atmeal](https://discuss.elastic.co/u/bacony0atmeal)\
**Replies:** 27\
**Last updated:** [July 22, 2021, 3:46am UTC](https://discuss.elastic.co/t/add-panel-in-dashboard-edit-view-never-loads/277976 "2021-07-22T03:46:45Z")

</div>

kibana version 7.9.1. recently migrated from 6.8.x. steps taken to recreate: kibana home -\> dashboards -\> open up existing dashboard -\> click "Add" -\> "Add panels" pane never populates with any saved visualizations. …

---

## [\[Logstash\] Aggregate filter - no timeout](https://discuss.elastic.co/t/logstash-aggregate-filter-no-timeout/279318)

<div class="topic-metadata">

**Author:** [@wedkarz014](https://discuss.elastic.co/u/wedkarz014)\
**Replies:** 6\
**Last updated:** [July 22, 2021, 2:24am UTC](https://discuss.elastic.co/t/logstash-aggregate-filter-no-timeout/279318 "2021-07-22T02:24:48Z")

</div>

Hi, In my logstash 7.9.3 I would like to create filter similar to that example https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html#plugins-filters-aggregate-example3 I want to create index w…

---

## [Packetbeat7.13.3 default BPF](https://discuss.elastic.co/t/packetbeat7-13-3-default-bpf/279009)

<div class="topic-metadata">

**Author:** [@chinaxushi](https://discuss.elastic.co/u/chinaxushi)\
**Replies:** 1\
**Last updated:** [July 22, 2021, 2:07am UTC](https://discuss.elastic.co/t/packetbeat7-13-3-default-bpf/279009 "2021-07-22T02:07:59Z")

</div>

packetbeat7.13.3 default BPF Doesn't seem to work. Officially, my understanding is that when I set up a protocol for monitoring, packetbeat will create a default BPF, Contains only ports for this protocol.but however, …

---

## [SIEM Signals Index and Component Templates](https://discuss.elastic.co/t/siem-signals-index-and-component-templates/279313)

<div class="topic-metadata">

**Author:** [@MakoWish](https://discuss.elastic.co/u/MakoWish)\
**Replies:** 1\
**Last updated:** [July 21, 2021, 10:35pm UTC](https://discuss.elastic.co/t/siem-signals-index-and-component-templates/279313 "2021-07-21T22:35:55Z")

</div>

I have started translating and migrating all my legacy Index Templates over to the new Component Templates, but when I got to the .siem-signals-\<space\> template, I am now getting an error: An error occurred during rule …

---

## [JDBC input is not working when added with Kafka input](https://discuss.elastic.co/t/jdbc-input-is-not-working-when-added-with-kafka-input/279221)

<div class="topic-metadata">

**Author:** [@adityaPsl](https://discuss.elastic.co/u/adityaPsl)\
**Replies:** 3\
**Last updated:** [July 21, 2021, 9:08pm UTC](https://discuss.elastic.co/t/jdbc-input-is-not-working-when-added-with-kafka-input/279221 "2021-07-21T21:08:23Z")

</div>

Hello Team, I am trying to configure multiple inputs in a pipeline input { jdbc { } kafka { } kafka { } } but when i run the pipeline only kafka messages i am getting and jdbc input is not working. Could …

---

## [Multiple nodes of ElasticSearch](https://discuss.elastic.co/t/multiple-nodes-of-elasticsearch/279219)

<div class="topic-metadata">

**Author:** [@DwiAnugrahHendrawan](https://discuss.elastic.co/u/DwiAnugrahHendrawan)\
**Replies:** 1\
**Last updated:** [July 21, 2021, 8:42pm UTC](https://discuss.elastic.co/t/multiple-nodes-of-elasticsearch/279219 "2021-07-21T20:42:38Z")

</div>

Hi there, I am trying to find out, what license I need to implement multiple nodes of elasticsearch and example I have 3 nodes those that means I have 1 primary nodes and 2 secondary nodes, and the secondary nodes sta…

---

## [Displaying time series in Canvas](https://discuss.elastic.co/t/displaying-time-series-in-canvas/279208)

<div class="topic-metadata">

**Author:** [@gabor](https://discuss.elastic.co/u/gabor)\
**Replies:** 3\
**Last updated:** [July 21, 2021, 8:04pm UTC](https://discuss.elastic.co/t/displaying-time-series-in-canvas/279208 "2021-07-21T20:04:28Z")

</div>

Hi, I have a data set based on some server logs containing sent- and received amount of data and client IPs. The dataset is a collection of these documents: { .. server\_ip: IP1, client\_ip: IP2, read: 2232323234, write:…

---

## [Combining two data sources into one or making a parent and child relation with two different sources](https://discuss.elastic.co/t/combining-two-data-sources-into-one-or-making-a-parent-and-child-relation-with-two-different-sources/279089)

<div class="topic-metadata">

**Author:** [@edster](https://discuss.elastic.co/u/edster)\
**Replies:** 2\
**Last updated:** [July 21, 2021, 7:05pm UTC](https://discuss.elastic.co/t/combining-two-data-sources-into-one-or-making-a-parent-and-child-relation-with-two-different-sources/279089 "2021-07-21T19:05:54Z")

</div>

Hello, So just to set some context around this. We are trying to work around the limitation of returning only at most 10k results during a search and with filters due to having an immense amount of data and it also comi…

---

## [Having hard time matching queries with forward slash & ampersand](https://discuss.elastic.co/t/having-hard-time-matching-queries-with-forward-slash-ampersand/279303)

<div class="topic-metadata">

**Author:** [@Webtrend\_Inc](https://discuss.elastic.co/u/Webtrend_Inc)\
**Replies:** 1\
**Last updated:** [July 21, 2021, 7:05pm UTC](https://discuss.elastic.co/t/having-hard-time-matching-queries-with-forward-slash-ampersand/279303 "2021-07-21T19:05:10Z")

</div>

I want to identify urls like this from our elastic index http://example.com/?a=1&c=1&s1=1 where the domain name can change. So, I have to rely on matching using the query pattern. In a nutshell, something like this \*/?…

---

## [Elastic Transform Error](https://discuss.elastic.co/t/elastic-transform-error/279199)

<div class="topic-metadata">

**Author:** [@IWannaDance](https://discuss.elastic.co/u/IWannaDance)\
**Replies:** 1\
**Last updated:** [July 21, 2021, 6:35pm UTC](https://discuss.elastic.co/t/elastic-transform-error/279199 "2021-07-21T18:35:38Z")

</div>

\[ERROR\]\[o.e.x.t.t.TransformPersistentTasksExecutor\] \[node-1\] Failed to start task \[endpoint.metadata\_current-default-0.19.1\] in node operation org.elasticsearch.ElasticsearchStatusException: Unable to start transform \[en…

---

## [Filebeat memory overuse](https://discuss.elastic.co/t/filebeat-memory-overuse/279304)

<div class="topic-metadata">

**Author:** [@YvorL](https://discuss.elastic.co/u/YvorL)\
**Replies:** 0\
**Last updated:** [July 21, 2021, 6:27pm UTC](https://discuss.elastic.co/t/filebeat-memory-overuse/279304 "2021-07-21T18:27:26Z")

</div>

Hi, I spotted that some of the Filebeat processes are using a lot of memory without any good reason. I have about 8 files read by FB and this specific environment is mostly stale. However, even after restart, it hogs up…

---

## [Query two separate indices, perform calculations on the results, graph result of calculation](https://discuss.elastic.co/t/query-two-separate-indices-perform-calculations-on-the-results-graph-result-of-calculation/279292)

<div class="topic-metadata">

**Author:** [@eeijlar](https://discuss.elastic.co/u/eeijlar)\
**Replies:** 3\
**Last updated:** [July 21, 2021, 5:47pm UTC](https://discuss.elastic.co/t/query-two-separate-indices-perform-calculations-on-the-results-graph-result-of-calculation/279292 "2021-07-21T17:47:59Z")

</div>

I would like to query two separate indices. I would like to do the following: Query 1: Query metricbeat which returns a figure say for arguments sake 2,500,000. I would like to divide this by 1,000,000 which gives me a…

---

## [Getting 400 "request does not support \[aggs\]" Error](https://discuss.elastic.co/t/getting-400-request-does-not-support-aggs-error/279253)

<div class="topic-metadata">

**Author:** [@thejusjose-mindcurv](https://discuss.elastic.co/u/thejusjose-mindcurv)\
**Replies:** 2\
**Last updated:** [July 21, 2021, 5:47pm UTC](https://discuss.elastic.co/t/getting-400-request-does-not-support-aggs-error/279253 "2021-07-21T17:47:25Z")

</div>

Hi all, Getting a 400 Error while trying to fetch the total count of IP connecting to our system and then sort the IP list based on the top 5. We have Kibana version 7.8 installed. Requirement :: Get the list of top …

---

## [Logstash Filter incoming data](https://discuss.elastic.co/t/logstash-filter-incoming-data/279248)

<div class="topic-metadata">

**Author:** [@Hamza\_El\_Aouane](https://discuss.elastic.co/u/Hamza_El_Aouane)\
**Replies:** 7\
**Last updated:** [July 21, 2021, 5:21pm UTC](https://discuss.elastic.co/t/logstash-filter-incoming-data/279248 "2021-07-21T17:21:27Z")

</div>

Hello Everyone, I hope you are all doing well. I am sorry to come here with this question but I could really use some experts help to solve an issue I am facing with Logstash. I will explain my situation as in detail a…

---

## [Elasticsearch Query Error : Unknown key for a START\_OBJECT in \[range\]](https://discuss.elastic.co/t/elasticsearch-query-error-unknown-key-for-a-start-object-in-range/279290)

<div class="topic-metadata">

**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\
**Replies:** 0\
**Last updated:** [July 21, 2021, 5:15pm UTC](https://discuss.elastic.co/t/elasticsearch-query-error-unknown-key-for-a-start-object-in-range/279290 "2021-07-21T17:15:05Z")

</div>

I am trying to fetch the last 24 hour data by the following query. while running this queries individually, it works perfect, but when combined it gives the following error : Query: { "size": 0, "aggs": { "perc…

---

## [Geogip data problem](https://discuss.elastic.co/t/geogip-data-problem/279280)

<div class="topic-metadata">

**Author:** [@Betorov](https://discuss.elastic.co/u/Betorov)\
**Replies:** 2\
**Last updated:** [July 21, 2021, 4:56pm UTC](https://discuss.elastic.co/t/geogip-data-problem/279280 "2021-07-21T16:56:15Z")

</div>

Hi evreyone, I'am using the geoip filter to get the map value of an ip geoip {source =\> "NATDestinationIP" } It works, it create all type geoip (latitude and longitude.....) but when I look these value on kibana the…

---

## [\[FS-Repository\] Path is not accessible on master node](https://discuss.elastic.co/t/fs-repository-path-is-not-accessible-on-master-node/278219)

<div class="topic-metadata">

**Author:** [@Jonatha](https://discuss.elastic.co/u/Jonatha)\
**Replies:** 1\
**Last updated:** [July 9, 2021, 1:16am UTC](https://discuss.elastic.co/t/fs-repository-path-is-not-accessible-on-master-node/278219 "2021-07-09T01:16:26Z")

</div>

I tried to config a repository to save snapshot, but show this error: PUT \_snapshot/bkp-test { "type": "fs", "settings": { "location": "/media/test" } } { "error" : { "root\_cause" : \[ { "type" : "…

---

## [Import CSV data to Elastic search but \_source missing](https://discuss.elastic.co/t/import-csv-data-to-elastic-search-but-source-missing/279233)

<div class="topic-metadata">

**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\
**Replies:** 10\
**Last updated:** [July 21, 2021, 4:53pm UTC](https://discuss.elastic.co/t/import-csv-data-to-elastic-search-but-source-missing/279233 "2021-07-21T16:53:35Z")

</div>

Kibana version : 7.13 Elasticsearch version : 7.13 APM Server version : 7.13 APM Agent language and version : java 1.8 Fresh install or upgraded from other version? fresh install Is there anything special in your se…

---

## [Logstash for finding combination of numbers](https://discuss.elastic.co/t/logstash-for-finding-combination-of-numbers/279207)

<div class="topic-metadata">

**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\
**Replies:** 3\
**Last updated:** [July 21, 2021, 4:50pm UTC](https://discuss.elastic.co/t/logstash-for-finding-combination-of-numbers/279207 "2021-07-21T16:50:53Z")

</div>

Hello, I'm looking for a way to write logstash code for a combination of numbers for a project , example if the input is 5 , the output needs to say 1 + 4 , where 1 means "service stopped" and 4 says "inactive" . I …

---

## [Shards per node, Heap, 100% CPU....help please](https://discuss.elastic.co/t/shards-per-node-heap-100-cpu-help-please/279109)

<div class="topic-metadata">

**Author:** [@kk123](https://discuss.elastic.co/u/kk123)\
**Replies:** 4\
**Last updated:** [July 21, 2021, 4:24pm UTC](https://discuss.elastic.co/t/shards-per-node-heap-100-cpu-help-please/279109 "2021-07-21T16:24:06Z")

</div>

Hi, I have a 2 node cluster with 1500 indices. Indices persist over time. This was set up by a third party... but now I am having the problem that the master node becomes unresponsive (100% CPU) and the only way to reco…

---

## [Where to see all the executed queries ran against my ES](https://discuss.elastic.co/t/where-to-see-all-the-executed-queries-ran-against-my-es/279235)

<div class="topic-metadata">

**Author:** [@hello5346](https://discuss.elastic.co/u/hello5346)\
**Replies:** 3\
**Last updated:** [July 21, 2021, 3:58pm UTC](https://discuss.elastic.co/t/where-to-see-all-the-executed-queries-ran-against-my-es/279235 "2021-07-21T15:58:01Z")

</div>

Hello all, Where can I see all the queries ran against my elastic search cluster. Thanks

---

## [No Uptime Monitors found](https://discuss.elastic.co/t/no-uptime-monitors-found/279046)

<div class="topic-metadata">

**Author:** [@Sam\_Sak1](https://discuss.elastic.co/u/Sam_Sak1)\
**Replies:** 8\
**Last updated:** [July 21, 2021, 3:44pm UTC](https://discuss.elastic.co/t/no-uptime-monitors-found/279046 "2021-07-21T15:44:14Z")

</div>

Hello! After installing a heartbeat-elastic, I'm not able to see endpoints under "Monitors" in Uptime page. The everything what it show is "No Uptime Monitors found", even though it shows data in "Pings over time" and i…

---

## [Import CSV with json data](https://discuss.elastic.co/t/import-csv-with-json-data/279226)

<div class="topic-metadata">

**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\
**Replies:** 3\
**Last updated:** [July 21, 2021, 3:13pm UTC](https://discuss.elastic.co/t/import-csv-with-json-data/279226 "2021-07-21T15:13:37Z")

</div>

Kibana version : 7.13 Elasticsearch version : 7.13 APM Server version : 7.13 APM Agent language and version : java 1.8 Fresh install or upgraded from other version? fresh install Is there anything special in your se…

---

## [Issues creating Index patterns in Kibana](https://discuss.elastic.co/t/issues-creating-index-patterns-in-kibana/278725)

<div class="topic-metadata">

**Author:** [@mikeg123](https://discuss.elastic.co/u/mikeg123)\
**Replies:** 11\
**Last updated:** [July 21, 2021, 3:13pm UTC](https://discuss.elastic.co/t/issues-creating-index-patterns-in-kibana/278725 "2021-07-21T15:13:29Z")

</div>

Hello, I've created a new index and index pattern in filebeat.yml file and send data to Elastic search running in aws container. when I go to Kibana I can see the new index getting created under 'Index Management', but…

---

## [Fail to enroll: fail to execute request to Kibana: Status code: 404, Kibana returned an error: Not Found, message: Not Found](https://discuss.elastic.co/t/fail-to-enroll-fail-to-execute-request-to-kibana-status-code-404-kibana-returned-an-error-not-found-message-not-found/278720)

<div class="topic-metadata">

**Author:** [@RaonyO](https://discuss.elastic.co/u/RaonyO)\
**Replies:** 4\
**Last updated:** [July 21, 2021, 3:05pm UTC](https://discuss.elastic.co/t/fail-to-enroll-fail-to-execute-request-to-kibana-status-code-404-kibana-returned-an-error-not-found-message-not-found/278720 "2021-07-21T15:05:51Z")

</div>

when i execute " .\\elastic-agent.exe install -f --url=https://xx.xx.xxx.xxx:5601 --enrollment-token=Q0REZW9Ib...== --insecure" this message appears 2021-07-14T18:47:12.757-0300 DEBUG kibana/client.go:170 Re…

---

## [Connecting UiPath to Elastic](https://discuss.elastic.co/t/connecting-uipath-to-elastic/278288)

<div class="topic-metadata">

**Author:** [@Dzious](https://discuss.elastic.co/u/Dzious)\
**Replies:** 1\
**Last updated:** [July 21, 2021, 3:03pm UTC](https://discuss.elastic.co/t/connecting-uipath-to-elastic/278288 "2021-07-21T15:03:22Z")

</div>

Hi, I've been struggling for a while now trying to connect UiPath/Orchestrator to Elastic. On their documentation they explicitly say that it's possible to output logs to Elastic. Unfortunately i still did not managed …

---

## [Compile Errors - Using Painless](https://discuss.elastic.co/t/compile-errors-using-painless/279265)

<div class="topic-metadata">

**Author:** [@dshonubi](https://discuss.elastic.co/u/dshonubi)\
**Replies:** 2\
**Last updated:** [July 21, 2021, 3:03pm UTC](https://discuss.elastic.co/t/compile-errors-using-painless/279265 "2021-07-21T15:03:18Z")

</div>

I keep getting this error of a script exception, but I'm not sure what the root cause is. \[script\_exception\] compile error, with { script\_stack={ 0="... tx.payload.aggregations.4XXerror.buckets.size(); i ..." & 1=" ^---…

---

## [Lock certain dashboard and saved searches](https://discuss.elastic.co/t/lock-certain-dashboard-and-saved-searches/279276)

<div class="topic-metadata">

**Author:** [@Saeed\_Ektesabi1](https://discuss.elastic.co/u/Saeed_Ektesabi1)\
**Replies:** 1\
**Last updated:** [July 21, 2021, 2:40pm UTC](https://discuss.elastic.co/t/lock-certain-dashboard-and-saved-searches/279276 "2021-07-21T14:40:54Z")

</div>

Hello, I have a Kibana environment in which I have created several dashboards and saved searches. My Kibana also has several users which they can create their own dashboards or saved search. Is there a way for me to "…

---

## [Filebeat exclude\_lines](https://discuss.elastic.co/t/filebeat-exclude-lines/276892)

<div class="topic-metadata">

**Author:** [@Betorov](https://discuss.elastic.co/u/Betorov)\
**Replies:** 3\
**Last updated:** [July 21, 2021, 2:37pm UTC](https://discuss.elastic.co/t/filebeat-exclude-lines/276892 "2021-07-21T14:37:45Z")

</div>

Hi evreyone, I wanted to use exclude\_lines to exlude all line of a file exept the first one. (I want only the name of the file and his path i don't need his message). filebeat.inputs: - type: log enabled: true #clo…

---

## [Forcing an index to rolleout to warm phase](https://discuss.elastic.co/t/forcing-an-index-to-rolleout-to-warm-phase/279258)

<div class="topic-metadata">

**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\
**Replies:** 4\
**Last updated:** [July 21, 2021, 2:23pm UTC](https://discuss.elastic.co/t/forcing-an-index-to-rolleout-to-warm-phase/279258 "2021-07-21T14:23:21Z")

</div>

Hello, I have an index which is 4.2GB large and at the moment I have upgraded the filebeat a new index was created. Now the ILM rolleout settings is for 10G therefore this index will never meet the threshold required for…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1311)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1313)
