# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1321 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1322 --- ## [Save NodeClient variable to disk](https://discuss.elastic.co/t/save-nodeclient-variable-to-disk/278773)
**Author:** [@daksh0225](https://discuss.elastic.co/u/daksh0225)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 11:33am UTC](https://discuss.elastic.co/t/save-nodeclient-variable-to-disk/278773 "2021-07-15T11:33:30Z")
Hi all, I have been modifying the source code to accomodate some custom features that I would like to have. In doing so, I have added some new class variables to NodeClient. Currently, these variables do not persist ove… --- ## [Weird index shard allocation behaviour](https://discuss.elastic.co/t/weird-index-shard-allocation-behaviour/278734)
**Author:** [@Lefty](https://discuss.elastic.co/u/Lefty)\ **Replies:** 6\ **Last updated:** [July 15, 2021, 11:30am UTC](https://discuss.elastic.co/t/weird-index-shard-allocation-behaviour/278734 "2021-07-15T11:30:10Z")
Hello everyone, I wonder if you can help me - I have a very weird problem I am running the ELK stack version 7.12.0 I have a 5 data node Elastic cluster - 8 TB of disk each 32GB RAM, 8 CPUs Utilization of disk on the… --- ## [Winlogbeat Original Field remove](https://discuss.elastic.co/t/winlogbeat-original-field-remove/278768)
**Author:** [@Frack](https://discuss.elastic.co/u/Frack)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 11:07am UTC](https://discuss.elastic.co/t/winlogbeat-original-field-remove/278768 "2021-07-15T11:07:23Z")
Hi, Why some field are remove when convert to ECS ? For exemple DestinationIsIpv6 from sysmon: 'winlog.event\_data.SourceIsIpv6' is remove after create 'network.type'. As I have to work with beat agent and industrial… --- ## [Get group by and distinct count of values using other field in Elasticsearch](https://discuss.elastic.co/t/get-group-by-and-distinct-count-of-values-using-other-field-in-elasticsearch/278762)
**Author:** [@Vinay\_Ranjan](https://discuss.elastic.co/u/Vinay_Ranjan)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 10:06am UTC](https://discuss.elastic.co/t/get-group-by-and-distinct-count-of-values-using-other-field-in-elasticsearch/278762 "2021-07-15T10:06:16Z")
I have an index having document structure as below - { "key": \["10", "20"\], "keywords": \[ { 'case': 1, 'word': 'abc' }, { 'case': 2, 'word': 'def' }, { 'case': 1 … --- ## [Delete all indices exept some based on the index name](https://discuss.elastic.co/t/delete-all-indices-exept-some-based-on-the-index-name/277536)
**Author:** [@rizvaughan](https://discuss.elastic.co/u/rizvaughan)\ **Replies:** 5\ **Last updated:** [July 15, 2021, 8:47am UTC](https://discuss.elastic.co/t/delete-all-indices-exept-some-based-on-the-index-name/277536 "2021-07-15T08:47:00Z")
Hello all, We are using curator to delete indices after a certain amount of time in our environments. I am facing an issue with understanding how to make it work for deleting indices based on time but leaving some indic… --- ## [Unable to embed Kibana dashboard on a reverse proxy server using Nginx](https://discuss.elastic.co/t/unable-to-embed-kibana-dashboard-on-a-reverse-proxy-server-using-nginx/278521)
**Author:** [@Fabian\_Matesa](https://discuss.elastic.co/u/Fabian_Matesa)\ **Replies:** 2\ **Last updated:** [July 15, 2021, 8:46am UTC](https://discuss.elastic.co/t/unable-to-embed-kibana-dashboard-on-a-reverse-proxy-server-using-nginx/278521 "2021-07-15T08:46:51Z")
I am trying to embed a Kibana dashboard using Nginx, but keep getting a blank screen. No errors are thrown (except for the expected "inline script" error), but nothing gets loaded. Kibana is deployed on an Azure cloud, a… --- ## [Exporting detection rules and its exceptions](https://discuss.elastic.co/t/exporting-detection-rules-and-its-exceptions/278753)
**Author:** [@realtech2338](https://discuss.elastic.co/u/realtech2338)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 8:43am UTC](https://discuss.elastic.co/t/exporting-detection-rules-and-its-exceptions/278753 "2021-07-15T08:43:16Z")
how to export all detection rules along with its query into csv format from elasticsearch portal? how to export exceptions under each detection rule into csv format from elasticsearch portal? --- ## [Error in jvmgcmonitorservice (gc overhead)](https://discuss.elastic.co/t/error-in-jvmgcmonitorservice-gc-overhead/278241)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 9\ **Last updated:** [July 15, 2021, 8:13am UTC](https://discuss.elastic.co/t/error-in-jvmgcmonitorservice-gc-overhead/278241 "2021-07-15T08:13:39Z")
I am having the following problem. $ cat /var/log/elasticsearch/elasticsearch.log | grep WARN \[2021-07-09T00:04:51,795\]\[WARN \]\[o.e.m.j.JvmGcMonitorService\] \[ITS-ELST-01\] \[gc\]\[young\]\[214003\]\[2290\] duration \[1.7s\], collec… --- ## [How to process logs from certain period of time? (I use elasticsearch input plugin)](https://discuss.elastic.co/t/how-to-process-logs-from-certain-period-of-time-i-use-elasticsearch-input-plugin/278702)
**Author:** [@John\_Smith1](https://discuss.elastic.co/u/John_Smith1)\ **Replies:** 4\ **Last updated:** [July 15, 2021, 7:28am UTC](https://discuss.elastic.co/t/how-to-process-logs-from-certain-period-of-time-i-use-elasticsearch-input-plugin/278702 "2021-07-15T07:28:32Z")
In pipeline I receive logs from server with elasticsearch input plugin and I want to process not all logs, but for example only last 2 months, or, preferably from certain date to certain date. When I receive logs there… --- ## [Need Clarification Regarding Size Parameter in ES Query](https://discuss.elastic.co/t/need-clarification-regarding-size-parameter-in-es-query/278735)
**Author:** [@sayamiasis](https://discuss.elastic.co/u/sayamiasis)\ **Replies:** 3\ **Last updated:** [July 15, 2021, 7:23am UTC](https://discuss.elastic.co/t/need-clarification-regarding-size-parameter-in-es-query/278735 "2021-07-15T07:23:27Z")
I wanted to know if there is a difference in executing these two queries when the result response is consisting of only 3 documents. query1: { "size":10, "query": { "bool":{ "must":\[ { "term":{ "t… --- ## [Communication issue between beats and logstash](https://discuss.elastic.co/t/communication-issue-between-beats-and-logstash/278748)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 7:03am UTC](https://discuss.elastic.co/t/communication-issue-between-beats-and-logstash/278748 "2021-07-15T07:03:52Z")
We had deployed ECK:1.3.0 and deployed elasticsearch, kibana (7.9.0) and filebeat (7.9.2) . we had given file beat configuration as below: Note: here we are deploying filebeat as a daemon set. # Filebeat apiVersion: be… --- ## [Kibana array of objects visibility after \_source field deprecation](https://discuss.elastic.co/t/kibana-array-of-objects-visibility-after-source-field-deprecation/278143)
**Author:** [@israelst](https://discuss.elastic.co/u/israelst)\ **Replies:** 1\ **Last updated:** [July 15, 2021, 6:43am UTC](https://discuss.elastic.co/t/kibana-array-of-objects-visibility-after-source-field-deprecation/278143 "2021-07-15T06:43:16Z")
Since Kibana 7.12 - the "\_source" field is no longer used by default in favor of the new field API. This totally broke our ability to view array of objects in Discover. What used to be shown as JSON, is now being flatte… --- ## [High Search Rejected](https://discuss.elastic.co/t/high-search-rejected/278700)
**Author:** [@Vishnu\_Singhal](https://discuss.elastic.co/u/Vishnu_Singhal)\ **Replies:** 4\ **Last updated:** [July 15, 2021, 6:09am UTC](https://discuss.elastic.co/t/high-search-rejected/278700 "2021-07-15T06:09:00Z")
Hi, My ELasticsearch thread pool search has very high rejected ration. I have sufficient 72 CPU nodes. node\_name name active queue rejected ES10 search 7 0 22703 ES07 search 0 0 0 … --- ## [Kibana Reporting - How to Get POST URL of a Dashboard Programatically?](https://discuss.elastic.co/t/kibana-reporting-how-to-get-post-url-of-a-dashboard-programatically/278625)
**Author:** [@peteryann](https://discuss.elastic.co/u/peteryann)\ **Replies:** 1\ **Last updated:** [July 15, 2021, 6:12am UTC](https://discuss.elastic.co/t/kibana-reporting-how-to-get-post-url-of-a-dashboard-programatically/278625 "2021-07-15T06:12:00Z")
Is there a way to programmatically retrieve the POST URL of dashboards? I could not find any reference on Automating Report Generation. My scenario: Retrieve all my dashboards via the REST API using /api/saved\_object… --- ## [How to login screen change in kibana 7.13.0?](https://discuss.elastic.co/t/how-to-login-screen-change-in-kibana-7-13-0/274950)
**Author:** [@111480](https://discuss.elastic.co/u/111480)\ **Replies:** 4\ **Last updated:** [July 15, 2021, 6:03am UTC](https://discuss.elastic.co/t/how-to-login-screen-change-in-kibana-7-13-0/274950 "2021-07-15T06:03:01Z")
how to login screen change in kibana 7.13.0? I tried following the above link 7.10.0 guide, but I couldn't change the elastic logo on the login page. How can I change the login page screen logo? I would appreciate i… --- ## [Unable to load kibana dash board](https://discuss.elastic.co/t/unable-to-load-kibana-dash-board/278737)
**Author:** [@Sachin\_05](https://discuss.elastic.co/u/Sachin_05)\ **Replies:** 1\ **Last updated:** [July 15, 2021, 5:58am UTC](https://discuss.elastic.co/t/unable-to-load-kibana-dash-board/278737 "2021-07-15T05:58:39Z")
Hi I am getting the below error while loading the kibana dashboard could someone please help me resolve this. Loading index pattern filebeat-: {"\_index":".kibana\_7.13.3\_001","\_type":"index-pattern","\_id":"filebeat-","f… --- ## [Kibana cannot connect to ES cluster - Unable to retrieve version information from Elasticsearch nodes](https://discuss.elastic.co/t/kibana-cannot-connect-to-es-cluster-unable-to-retrieve-version-information-from-elasticsearch-nodes/278185)
**Author:** [@dorinand](https://discuss.elastic.co/u/dorinand)\ **Replies:** 4\ **Last updated:** [July 15, 2021, 5:50am UTC](https://discuss.elastic.co/t/kibana-cannot-connect-to-es-cluster-unable-to-retrieve-version-information-from-elasticsearch-nodes/278185 "2021-07-15T05:50:36Z")
Kibana and ES version: 7.13.2 I am running cluster of 5 nodes (3 ES data & master nodes and 2 coordinating nodes) and one Kibana. Whole cluster is running in docker swarm on the same network. My ES cluster works fine, I… --- ## [org.elasticsearch.action.search.SearchPhaseExecutionException: all shards failed](https://discuss.elastic.co/t/org-elasticsearch-action-search-searchphaseexecutionexception-all-shards-failed/278411)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 1\ **Last updated:** [July 15, 2021, 5:10am UTC](https://discuss.elastic.co/t/org-elasticsearch-action-search-searchphaseexecutionexception-all-shards-failed/278411 "2021-07-15T05:10:21Z")
org.elasticsearch.action.search.SearchPhaseExecutionException: all shards failed It is said that all shards fail, what is happening? The index in question shows that the health was green. What do I need to do to avoid… --- ## [Logstash restarts with "ConcurrentModificationException"](https://discuss.elastic.co/t/logstash-restarts-with-concurrentmodificationexception/278738)
**Author:** [@rojin](https://discuss.elastic.co/u/rojin)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 5:03am UTC](https://discuss.elastic.co/t/logstash-restarts-with-concurrentmodificationexception/278738 "2021-07-15T05:03:20Z")
Hi, I have an issue with logstash restarting itself showing “ConcurrentModificationException“ error before stoping and starting again, does anyone have any idea what it might be about? --- ## [413 Request Entity Too Large - metricbeat error on elected MASTER node](https://discuss.elastic.co/t/413-request-entity-too-large-metricbeat-error-on-elected-master-node/278732)
**Author:** [@anon17386273](https://discuss.elastic.co/u/anon17386273)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 3:46am UTC](https://discuss.elastic.co/t/413-request-entity-too-large-metricbeat-error-on-elected-master-node/278732 "2021-07-15T03:46:27Z")
Is there a limitation that metricbeat can collect from the elected MASTER node? I have 300 data nodes with metricbeats having no issue running but when it comes to the collecting metrics from the elected MASTER, i encou… --- ## [Display log.level](https://discuss.elastic.co/t/display-log-level/278501)
**Author:** [@yango](https://discuss.elastic.co/u/yango)\ **Replies:** 4\ **Last updated:** [July 15, 2021, 3:34am UTC](https://discuss.elastic.co/t/display-log-level/278501 "2021-07-15T03:34:10Z")
Is there any way to display log.level field in kibana while using filebeat/auditbeat? --- ## [Error when restart logstash LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError](https://discuss.elastic.co/t/error-when-restart-logstash-logstash-hostunreachableerror/278687)
**Author:** [@quyennguyen](https://discuss.elastic.co/u/quyennguyen)\ **Replies:** 4\ **Last updated:** [July 15, 2021, 2:36am UTC](https://discuss.elastic.co/t/error-when-restart-logstash-logstash-hostunreachableerror/278687 "2021-07-15T02:36:45Z")
Hello I install Logstash in Ubuntu 18. After changed ip from 192.168.186.147 to 192.168.186.157 I also fixed the .yml and conf.d but it's cant restart with error. /var/log/logstash/logstash-plain.log \[2021-07-14T22:18… --- ## [Attempted to send a bulk request to elasticsearch, but no there are no living connections in the connection pool](https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch-but-no-there-are-no-living-connections-in-the-connection-pool/277307)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 2\ **Last updated:** [July 15, 2021, 1:50am UTC](https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch-but-no-there-are-no-living-connections-in-the-connection-pool/277307 "2021-07-15T01:50:43Z")
I am getting the following error in the log of logstash. $ tail /var/log/logstash/logstash-plain.log \[2021-06-29T01:17:53,584\]\[ERROR\]\[logstash.outputs.elasticsearch\]\[main\]\[9acc851acb29a066b989c90cdd9ba461ce676a2f7643e20… --- ## [Kibana Scatter Plot Graph - Lines in the middle](https://discuss.elastic.co/t/kibana-scatter-plot-graph-lines-in-the-middle/277887)
**Author:** [@momo1104](https://discuss.elastic.co/u/momo1104)\ **Replies:** 2\ **Last updated:** [July 14, 2021, 10:58pm UTC](https://discuss.elastic.co/t/kibana-scatter-plot-graph-lines-in-the-middle/277887 "2021-07-14T22:58:19Z")
Hi All, I'm trying to draw 2 black lines in a cross manner right in the middle of the graph. Any suggestions? I'll post a snap and the code below. { "$schema": "https://vega.github.io/schema/vega-lite/v5.json", … --- ## [Must\_not with an exception](https://discuss.elastic.co/t/must-not-with-an-exception/278301)
**Author:** [@bcam135](https://discuss.elastic.co/u/bcam135)\ **Replies:** 3\ **Last updated:** [July 14, 2021, 9:05pm UTC](https://discuss.elastic.co/t/must-not-with-an-exception/278301 "2021-07-14T21:05:55Z")
In basic terms, I have a current kibana alert and the query is set up to exclude all systems that have 800-999 in the hostname with the extraction query code below. That works fine. However, I would I would like to exc… --- ## ["name" field](https://discuss.elastic.co/t/name-field/278713)
**Author:** [@rojin](https://discuss.elastic.co/u/rojin)\ **Replies:** 0\ **Last updated:** [July 14, 2021, 8:30pm UTC](https://discuss.elastic.co/t/name-field/278713 "2021-07-14T20:30:41Z")
Hey, just wondering if I can use the "name" field in grok patterns. when I use it, the error appears to be like this: \["Error"\], "id"=\>"692aaaf9cd6aedfa9e73788106ef94fc1d968d10a1586c197812a6e14d84010a"}\]=\>\[{"thread\_id"=\>… --- ## [Environment setup for modifying logstash plugin](https://discuss.elastic.co/t/environment-setup-for-modifying-logstash-plugin/278712)
**Author:** [@pjohnson](https://discuss.elastic.co/u/pjohnson)\ **Replies:** 0\ **Last updated:** [July 14, 2021, 7:52pm UTC](https://discuss.elastic.co/t/environment-setup-for-modifying-logstash-plugin/278712 "2021-07-14T19:52:47Z")
Is there a tutorial for setting up your environment for modifying an existing logstash ruby plugin i.e. what version of java to use, jruby to use, how to install jars etc. How to write a Logstash output plugin | Logstash… --- ## [Filter Visualizations on a Dashboard using the default time range (dashboard upper right corner) on filter conditions using fields other than index pattern primary time field](https://discuss.elastic.co/t/filter-visualizations-on-a-dashboard-using-the-default-time-range-dashboard-upper-right-corner-on-filter-conditions-using-fields-other-than-index-pattern-primary-time-field/278209)
**Author:** [@fefontana](https://discuss.elastic.co/u/fefontana)\ **Replies:** 4\ **Last updated:** [July 14, 2021, 7:48pm UTC](https://discuss.elastic.co/t/filter-visualizations-on-a-dashboard-using-the-default-time-range-dashboard-upper-right-corner-on-filter-conditions-using-fields-other-than-index-pattern-primary-time-field/278209 "2021-07-14T19:48:24Z")
Hi, is it possible to have a multiple "Time Field" index pattern ?. I would like to use the default time filter in a dashboard to filter dynamically 3 visualizations this way: Index pattern time field = field1\* Dashbo… --- ## [Elasticsearch Query DSL help need to sort on timestamp](https://discuss.elastic.co/t/elasticsearch-query-dsl-help-need-to-sort-on-timestamp/278634)
**Author:** [@bab](https://discuss.elastic.co/u/bab)\ **Replies:** 1\ **Last updated:** [July 14, 2021, 7:02pm UTC](https://discuss.elastic.co/t/elasticsearch-query-dsl-help-need-to-sort-on-timestamp/278634 "2021-07-14T19:02:07Z")
i need your Help Expertes, i need to update this query to be able to get the result filtered on Prim\_id alphabetic and timestamp ascending, each Prim\_id is present in a log-event sorted on timestamp (log time). i mean ,… --- ## [Creating external case from Elastic to XSOAR](https://discuss.elastic.co/t/creating-external-case-from-elastic-to-xsoar/278354)
**Author:** [@randomguyneedhelp](https://discuss.elastic.co/u/randomguyneedhelp)\ **Replies:** 3\ **Last updated:** [July 14, 2021, 6:53pm UTC](https://discuss.elastic.co/t/creating-external-case-from-elastic-to-xsoar/278354 "2021-07-14T18:53:21Z")
Hi, I will like to know if there are such integration between Elastic and XSOAR. Understand there are integrations for such functions with ServiceNow, JIRA and IBM Resilient, however I am trying to make use Cortex XSOAR… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1320) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1322)