# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1319 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1320 --- ## [How to install Analysis Plugins in Azure Kubernetes version 1.91 in 3 Elasticsearch pods ver. 7.13.3 with ECK 1.6 or any other method](https://discuss.elastic.co/t/how-to-install-analysis-plugins-in-azure-kubernetes-version-1-91-in-3-elasticsearch-pods-ver-7-13-3-with-eck-1-6-or-any-other-method/278915)
**Author:** [@MarkB8](https://discuss.elastic.co/u/MarkB8)\ **Replies:** 0\ **Last updated:** [July 16, 2021, 2:44pm UTC](https://discuss.elastic.co/t/how-to-install-analysis-plugins-in-azure-kubernetes-version-1-91-in-3-elasticsearch-pods-ver-7-13-3-with-eck-1-6-or-any-other-method/278915 "2021-07-16T14:44:29Z")
Need to install plugins for APAC languages and environment is in Azure Kubernetes ver. 1.91 with Elasticsearch ver. 7.13.3 with 3 pods. (master/ingest/client). Instructions seen so far are for VMs in Azure. Analysis Pl… --- ## [Logstash log4j2.properties configuration for logs rotation](https://discuss.elastic.co/t/logstash-log4j2-properties-configuration-for-logs-rotation/278616)
**Author:** [@Kshema](https://discuss.elastic.co/u/Kshema)\ **Replies:** 3\ **Last updated:** [July 16, 2021, 2:37pm UTC](https://discuss.elastic.co/t/logstash-log4j2-properties-configuration-for-logs-rotation/278616 "2021-07-16T14:37:54Z")
In our application, Logstash plain log file - logstas-plain.log is getting converted to a zip file logstash-plain-\.log.gz each day. The zip files are getting piled up and causing a memory issue. Any help on config… --- ## [Multi Search Query SQL API](https://discuss.elastic.co/t/multi-search-query-sql-api/277651)
**Author:** [@Eric\_Barreto](https://discuss.elastic.co/u/Eric_Barreto)\ **Replies:** 2\ **Last updated:** [July 16, 2021, 2:36pm UTC](https://discuss.elastic.co/t/multi-search-query-sql-api/277651 "2021-07-16T14:36:47Z")
Hi, I'm trying to send more than one sql query in the same request, but I'm having problems. I'm testing this request in Dev Tools: POST \_xpack/sql?format=csv {"query":"SELECT sourceIp, count(log\_message) AS Derrota F… --- ## [Aggregate filter](https://discuss.elastic.co/t/aggregate-filter/278817)
**Author:** [@sergio\_junior](https://discuss.elastic.co/u/sergio_junior)\ **Replies:** 7\ **Last updated:** [July 16, 2021, 1:27pm UTC](https://discuss.elastic.co/t/aggregate-filter/278817 "2021-07-16T13:27:18Z")
hello guys, i need help with the aggregate filter. I'm trying to merge these logs' lines into a single event. 2021-07-08 00:00:00,181 INFO \[stdout\] (default task-1876) ###HawbPesquisaInteligenteConverter | Iniciando p… --- ## [How to insert only newly added rows in csv in logstash in old index](https://discuss.elastic.co/t/how-to-insert-only-newly-added-rows-in-csv-in-logstash-in-old-index/278866)
**Author:** [@Sarthak\_Mishra](https://discuss.elastic.co/u/Sarthak_Mishra)\ **Replies:** 4\ **Last updated:** [July 16, 2021, 1:23pm UTC](https://discuss.elastic.co/t/how-to-insert-only-newly-added-rows-in-csv-in-logstash-in-old-index/278866 "2021-07-16T13:23:04Z")
Hi community, If I have a csv with 5 rows and I have shipped it in logstash. In future, the csv gets updated with 5(old) + 2(new) =7 rows. I want to ship the updated csv in the same index. Can I ship only the updated 2(… --- ## [Logstash works but put a lot of 403 errors in log](https://discuss.elastic.co/t/logstash-works-but-put-a-lot-of-403-errors-in-log/278892)
**Author:** [@SzymonZy](https://discuss.elastic.co/u/SzymonZy)\ **Replies:** 1\ **Last updated:** [July 16, 2021, 1:16pm UTC](https://discuss.elastic.co/t/logstash-works-but-put-a-lot-of-403-errors-in-log/278892 "2021-07-16T13:16:01Z")
Hello I have setup els and it seems to work beside many errors: "Got response code '403' contacting Elasticsearch at URL 'https://localhost:9200/logstash'", : exception=\>LogStash::Outputs::ElasticSearch::HttpClient::Po… --- ## [Functionbeat 1.11 cannot process more than one message on cloud function](https://discuss.elastic.co/t/functionbeat-1-11-cannot-process-more-than-one-message-on-cloud-function/278905)
**Author:** [@yerome](https://discuss.elastic.co/u/yerome)\ **Replies:** 0\ **Last updated:** [July 16, 2021, 1:10pm UTC](https://discuss.elastic.co/t/functionbeat-1-11-cannot-process-more-than-one-message-on-cloud-function/278905 "2021-07-16T13:10:35Z")
Hello, When I deploy functionbeat 1.11 on a GCP Cloud function, functionbeat always crashes after having to deal with the second event coming from pub/sub. Error message shows a panic crash like this : WARN\\t\[cfgwarn\]… --- ## [Rollover for an existing index](https://discuss.elastic.co/t/rollover-for-an-existing-index/278904)
**Author:** [@Anirudhan](https://discuss.elastic.co/u/Anirudhan)\ **Replies:** 0\ **Last updated:** [July 16, 2021, 1:10pm UTC](https://discuss.elastic.co/t/rollover-for-an-existing-index/278904 "2021-07-16T13:10:06Z")
Hi I already have an index with the size 89GB. Forgot to add all the rollups in the initial stages. How do i proceed with the rollups. Now want to create an index for each date.Is it possible to do rollups for an existi… --- ## [Query with conditional logic](https://discuss.elastic.co/t/query-with-conditional-logic/278902)
**Author:** [@Sascha\_Gerloff](https://discuss.elastic.co/u/Sascha_Gerloff)\ **Replies:** 0\ **Last updated:** [July 16, 2021, 1:00pm UTC](https://discuss.elastic.co/t/query-with-conditional-logic/278902 "2021-07-16T13:00:59Z")
Hello, I would like to build a query, whose logic depends on a specific field. For example, I have data like this: username: Name1 description: desc1 username: Name2 info: info1 I would like to build a query that m… --- ## [Functionbeat 1.12 and 1.13 cannot deploy on GCP Cloud function](https://discuss.elastic.co/t/functionbeat-1-12-and-1-13-cannot-deploy-on-gcp-cloud-function/278901)
**Author:** [@yerome](https://discuss.elastic.co/u/yerome)\ **Replies:** 0\ **Last updated:** [July 16, 2021, 12:58pm UTC](https://discuss.elastic.co/t/functionbeat-1-12-and-1-13-cannot-deploy-on-gcp-cloud-function/278901 "2021-07-16T12:58:09Z")
Because cloud function uses goland 1.13 and since 1.12 version of functionbeat is using goland 1.15 the deployment doesn't work. At the end of the deployment those errors appear : DEBUG \[gcp\] gcp/cli\_manager.go:47 Depl… --- ## [Elasticsearch 7.13 crash - can not start again](https://discuss.elastic.co/t/elasticsearch-7-13-crash-can-not-start-again/277427)
**Author:** [@Vladimir](https://discuss.elastic.co/u/Vladimir)\ **Replies:** 6\ **Last updated:** [July 16, 2021, 11:26am UTC](https://discuss.elastic.co/t/elasticsearch-7-13-crash-can-not-start-again/277427 "2021-07-16T11:26:33Z")
Hi there, I have Elastic + Kiabana + Logstash + Filebeat installed on Ubuntu 20.04 server. Yesterday everything worked fine together. I happily wrote requests in Kibana console. Today morning I tried to open Kibana but… --- ## [Found in Full-text search scenario，ES 7 slow than ES 5](https://discuss.elastic.co/t/found-in-full-text-search-scenario-es-7-slow-than-es-5/278065)
**Author:** [@zfaster](https://discuss.elastic.co/u/zfaster)\ **Replies:** 4\ **Last updated:** [July 16, 2021, 11:00am UTC](https://discuss.elastic.co/t/found-in-full-text-search-scenario-es-7-slow-than-es-5/278065 "2021-07-16T11:00:53Z")
Planning to upgrade from ES 5.6.7 to ES7.X,； During the test, the index data in ES5 was migrated to ES7, and performance comparison was performed in a specific scenario. It was found that the search time of ES7 decrease… --- ## [What can I do with Kibana Alerts with BASIC - FREE AND OPEN 2 subscription?](https://discuss.elastic.co/t/what-can-i-do-with-kibana-alerts-with-basic-free-and-open-2-subscription/278785)
**Author:** [@nachoenjuto](https://discuss.elastic.co/u/nachoenjuto)\ **Replies:** 8\ **Last updated:** [July 16, 2021, 10:38am UTC](https://discuss.elastic.co/t/what-can-i-do-with-kibana-alerts-with-basic-free-and-open-2-subscription/278785 "2021-07-16T10:38:54Z")
Hi all, I am designing a solution for a customer and one of the requirements is to have alerts, but I am no sure how far I can go with the BASIC - FREE AND OPEN 2 subscription. Does anyone has experience with this? or … --- ## [How to display and play multiple audio file urls in a document field](https://discuss.elastic.co/t/how-to-display-and-play-multiple-audio-file-urls-in-a-document-field/278587)
**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\ **Replies:** 4\ **Last updated:** [July 16, 2021, 10:30am UTC](https://discuss.elastic.co/t/how-to-display-and-play-multiple-audio-file-urls-in-a-document-field/278587 "2021-07-16T10:30:58Z")
Hi Elastic Team, The url of the audio file for each call is storing in elastic and defined the format as url type as audio. We have a scenario like each call can have multiple audio files and the filenames will be in a… --- ## [Filebeat autodiscover for local log Docker driver](https://discuss.elastic.co/t/filebeat-autodiscover-for-local-log-docker-driver/278878)
**Author:** [@llsousa](https://discuss.elastic.co/u/llsousa)\ **Replies:** 0\ **Last updated:** [July 16, 2021, 10:21am UTC](https://discuss.elastic.co/t/filebeat-autodiscover-for-local-log-docker-driver/278878 "2021-07-16T10:21:01Z")
Hi, there, first post here. Suppose this Filebeat autodiscover configuration for Docker containers: filebeat.autodiscover: providers: - type: docker hints.enabled: true hints.default\_config.enabled: f… --- ## [Not getting proper result while searching special characters in query string](https://discuss.elastic.co/t/not-getting-proper-result-while-searching-special-characters-in-query-string/278875)
**Author:** [@Madhavi](https://discuss.elastic.co/u/Madhavi)\ **Replies:** 0\ **Last updated:** [July 16, 2021, 9:55am UTC](https://discuss.elastic.co/t/not-getting-proper-result-while-searching-special-characters-in-query-string/278875 "2021-07-16T09:55:49Z")
This is my query GET /momsarchival1/\_search { "track\_total\_hits": true, "query": { "bool": { "must": \[ { "bool": { "must": \[ { "query\_string": { … --- ## [Boolean query always returns boosted score](https://discuss.elastic.co/t/boolean-query-always-returns-boosted-score/276290)
**Author:** [@stefAnger](https://discuss.elastic.co/u/stefAnger)\ **Replies:** 2\ **Last updated:** [July 16, 2021, 9:19am UTC](https://discuss.elastic.co/t/boolean-query-always-returns-boosted-score/276290 "2021-07-16T09:19:45Z")
Hi, I am trying to replace a MySQL "product search" with an elastic search. The MySQL Search is querying a single table, containing any information for both: Presenting the search results, and containing the source dat… --- ## [Updating role privileges is not effective](https://discuss.elastic.co/t/updating-role-privileges-is-not-effective/278799)
**Author:** [@kpe](https://discuss.elastic.co/u/kpe)\ **Replies:** 2\ **Last updated:** [July 16, 2021, 8:52am UTC](https://discuss.elastic.co/t/updating-role-privileges-is-not-effective/278799 "2021-07-16T08:52:30Z")
Hello, I've set an api\_key to manage an index but I'm getting this error : Error: \[403\] {"error":{"root\_cause":\[{"type":"security\_exception","reason":"action \[indices:data/read/search\] is unauthorized for API key id \[\*… --- ## [Multiple search term on multiple field using wild card](https://discuss.elastic.co/t/multiple-search-term-on-multiple-field-using-wild-card/278790)
**Author:** [@kurbhatt](https://discuss.elastic.co/u/kurbhatt)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 1:11pm UTC](https://discuss.elastic.co/t/multiple-search-term-on-multiple-field-using-wild-card/278790 "2021-07-15T13:11:32Z")
I have working search for single search on multiple fields and wildcard(using ngram). Index creation(s-search index): { "settings": { "number\_of\_shards": 2, "number\_of\_replicas": 1, "index.mapping.coerce"… --- ## [How can I append an object in elastic array?](https://discuss.elastic.co/t/how-can-i-append-an-object-in-elastic-array/278845)
**Author:** [@Duong\_Phan](https://discuss.elastic.co/u/Duong_Phan)\ **Replies:** 1\ **Last updated:** [July 16, 2021, 8:41am UTC](https://discuss.elastic.co/t/how-can-i-append-an-object-in-elastic-array/278845 "2021-07-16T08:41:40Z")
Assume I have an index is defined like this: { "settings":{ "number\_of\_shards":1, "number\_of\_replicas":1 }, "mappings":{ "properties":{ "name":{ "type":"te… --- ## [SQL translates to wrong DSL query](https://discuss.elastic.co/t/sql-translates-to-wrong-dsl-query/278211)
**Author:** [@shivmgs](https://discuss.elastic.co/u/shivmgs)\ **Replies:** 4\ **Last updated:** [July 16, 2021, 8:39am UTC](https://discuss.elastic.co/t/sql-translates-to-wrong-dsl-query/278211 "2021-07-16T08:39:57Z")
We have a field company\_name of type text. For the same field, we have additional .raw field - company\_name.raw which is a keyword field. For the following SQL query, search on company\_name { "query": "SELECT \\"com… --- ## [Index Pattern to see multiple indices (named differently)](https://discuss.elastic.co/t/index-pattern-to-see-multiple-indices-named-differently/278685)
**Author:** [@Matt\_McGovern](https://discuss.elastic.co/u/Matt_McGovern)\ **Replies:** 3\ **Last updated:** [July 16, 2021, 8:39am UTC](https://discuss.elastic.co/t/index-pattern-to-see-multiple-indices-named-differently/278685 "2021-07-16T08:39:03Z")
We have 3 indices that are not named consistently, and we'd like a new index pattern that will allow queries to all three indices. Without renaming the existing indices, is there a good way to allow 3 index patterns insi… --- ## [Query hints - make some records more important than others](https://discuss.elastic.co/t/query-hints-make-some-records-more-important-than-others/278869)
**Author:** [@prze\_gee](https://discuss.elastic.co/u/prze_gee)\ **Replies:** 0\ **Last updated:** [July 16, 2021, 8:31am UTC](https://discuss.elastic.co/t/query-hints-make-some-records-more-important-than-others/278869 "2021-07-16T08:31:39Z")
Let say I have an index of cities: cities\_ind. I'm querying this data with search\_at\_you\_type to get the best recommendation while typing. Then, I want to make a few of them more important than others. The biggest cities… --- ## [Template not applied](https://discuss.elastic.co/t/template-not-applied/278757)
**Author:** [@anthonyrichir](https://discuss.elastic.co/u/anthonyrichir)\ **Replies:** 2\ **Last updated:** [July 16, 2021, 8:07am UTC](https://discuss.elastic.co/t/template-not-applied/278757 "2021-07-16T08:07:12Z")
Hello, I have several pipelines running in a Logstash, they read messages from queues on a RabbitMQ and output those messages in rolling indices in an Elasticsearch. For those indices, I have templates matching my inde… --- ## [How do I configure line codec to output plain events?](https://discuss.elastic.co/t/how-do-i-configure-line-codec-to-output-plain-events/278791)
**Author:** [@albgus](https://discuss.elastic.co/u/albgus)\ **Replies:** 2\ **Last updated:** [July 16, 2021, 7:08am UTC](https://discuss.elastic.co/t/how-do-i-configure-line-codec-to-output-plain-events/278791 "2021-07-16T07:08:45Z")
Hello, I assumed that the plain and line plugins would output the event message unmodified, but this does not appear to be the case, as a bunch of "garbage" data I don't care about is prepended to the event. 2021-07-15… --- ## [No legend for METRIC color range in Kibana7.10](https://discuss.elastic.co/t/no-legend-for-metric-color-range-in-kibana7-10/278758)
**Author:** [@AneskaFrisbib](https://discuss.elastic.co/u/AneskaFrisbib)\ **Replies:** 2\ **Last updated:** [July 16, 2021, 7:01am UTC](https://discuss.elastic.co/t/no-legend-for-metric-color-range-in-kibana7-10/278758 "2021-07-16T07:01:07Z")
Hello, I noticed that I can't display a legend for color range in Metric in Kibana7.10. I had this possibility in Kibana 5.6. I attached screenshots in order to see better in which part of the METRIC configuration… --- ## [Script-src 'unsafe-eval' 'self' Error](https://discuss.elastic.co/t/script-src-unsafe-eval-self-error/278857)
**Author:** [@iraviguggilam](https://discuss.elastic.co/u/iraviguggilam)\ **Replies:** 0\ **Last updated:** [July 16, 2021, 5:27am UTC](https://discuss.elastic.co/t/script-src-unsafe-eval-self-error/278857 "2021-07-16T05:27:42Z")
I'm using elastic search URL in angular application through iframe and getting below error. "Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval… --- ## [How to write while loops inside Logstash Elasticsearch](https://discuss.elastic.co/t/how-to-write-while-loops-inside-logstash-elasticsearch/278805)
**Author:** [@Hieu\_Luong](https://discuss.elastic.co/u/Hieu_Luong)\ **Replies:** 1\ **Last updated:** [July 15, 2021, 3:59pm UTC](https://discuss.elastic.co/t/how-to-write-while-loops-inside-logstash-elasticsearch/278805 "2021-07-15T15:59:18Z")
Is there any way to write loops inside output of Logstash For a certain message "total:100 name:product 1" I can parse total from this message and want to send 100 times to elasticsearch My code is just pseudocode, … --- ## [Elasticsearch fails to start on Ubuntu nodes, other issues](https://discuss.elastic.co/t/elasticsearch-fails-to-start-on-ubuntu-nodes-other-issues/278599)
**Author:** [@bigheadred](https://discuss.elastic.co/u/bigheadred)\ **Replies:** 3\ **Last updated:** [July 16, 2021, 1:45am UTC](https://discuss.elastic.co/t/elasticsearch-fails-to-start-on-ubuntu-nodes-other-issues/278599 "2021-07-16T01:45:33Z")
Hi, I've got a 3 node Elastic stack (each VM runs Elasticsearch and Logstash, one runs Elasticsearch, Logstash, and Kibana) set up on Microsoft Azure VM's, using Ubuntu 20.04. Recently, my elasticsearch cluster has bee… --- ## [Kibana not using defined colors in legacy visualizations](https://discuss.elastic.co/t/kibana-not-using-defined-colors-in-legacy-visualizations/278559)
**Author:** [@Mrizzi](https://discuss.elastic.co/u/Mrizzi)\ **Replies:** 6\ **Last updated:** [July 16, 2021, 12:26am UTC](https://discuss.elastic.co/t/kibana-not-using-defined-colors-in-legacy-visualizations/278559 "2021-07-16T00:26:15Z")
Hi everyone, I'm having an issue where Kibana continues to use random colors from the assigned palettes in some visualizations despite the fact that I designed specific colors per label on each one of them. I want to be… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1318) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1320)