# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1323 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1324 --- ## [Ignore filter i fnot in index is not working for the TSVB visualisation uniquely in the version 7.13.1](https://discuss.elastic.co/t/ignore-filter-i-fnot-in-index-is-not-working-for-the-tsvb-visualisation-uniquely-in-the-version-7-13-1/278641)
**Author:** [@Marouane\_K](https://discuss.elastic.co/u/Marouane_K)\ **Replies:** 4\ **Last updated:** [July 14, 2021, 12:03pm UTC](https://discuss.elastic.co/t/ignore-filter-i-fnot-in-index-is-not-working-for-the-tsvb-visualisation-uniquely-in-the-version-7-13-1/278641 "2021-07-14T12:03:54Z")
I filtred on a field that is not present in a tsvb visualisation (Metric) All visualisations in the dashboard responded appropriately (kept showing data even they don't have the filtered field ) but the tsvb visualisat… --- ## [Filebeat fails to process kibana json logs “failed to format message from \*json-.log “in a docker enviroment with logstash](https://discuss.elastic.co/t/filebeat-fails-to-process-kibana-json-logs-failed-to-format-message-from-json-log-in-a-docker-enviroment-with-logstash/278295)
**Author:** [@Annette1](https://discuss.elastic.co/u/Annette1)\ **Replies:** 7\ **Last updated:** [July 14, 2021, 11:40am UTC](https://discuss.elastic.co/t/filebeat-fails-to-process-kibana-json-logs-failed-to-format-message-from-json-log-in-a-docker-enviroment-with-logstash/278295 "2021-07-14T11:40:32Z")
Problem description - since I have installed logstash I am seeing the following in kibana logs - failed to format message from /var/lib/docker/.containers/xxx-json.log If I remove logstash and send directly through ela… --- ## [Reconciliation between two index data in Kibana visualisation in realtime](https://discuss.elastic.co/t/reconciliation-between-two-index-data-in-kibana-visualisation-in-realtime/277775)
**Author:** [@amar.molaka](https://discuss.elastic.co/u/amar.molaka)\ **Replies:** 2\ **Last updated:** [July 14, 2021, 11:18am UTC](https://discuss.elastic.co/t/reconciliation-between-two-index-data-in-kibana-visualisation-in-realtime/277775 "2021-07-14T11:18:43Z")
I have a requirement to perform reconciliation / join between 2 indexes. Say, Person A ( index A ) has Cars AAA, BBB, CCC, DDD Person B ( index B ) has Cars BBB, EEE We wanted to build a widget ( pie chart / table ) … --- ## [From parameter in delete by query API](https://discuss.elastic.co/t/from-parameter-in-delete-by-query-api/278636)
**Author:** [@Sourav\_Patra](https://discuss.elastic.co/u/Sourav_Patra)\ **Replies:** 0\ **Last updated:** [July 14, 2021, 10:02am UTC](https://discuss.elastic.co/t/from-parameter-in-delete-by-query-api/278636 "2021-07-14T10:02:19Z")
I am trying to use the \[delete\_by\_query\](https://www.elastic.co/guide/en/elasticsearch/reference/7.x/docs-delete-by-query.html) API to keep a maximum of 5 documents for a user that are most recent. I am using the sort pa… --- ## [Elasticsearch not starting problem](https://discuss.elastic.co/t/elasticsearch-not-starting-problem/278496)
**Author:** [@SRIGURU\_VEL](https://discuss.elastic.co/u/SRIGURU_VEL)\ **Replies:** 2\ **Last updated:** [July 14, 2021, 9:26am UTC](https://discuss.elastic.co/t/elasticsearch-not-starting-problem/278496 "2021-07-14T09:26:56Z")
Hello experts, I am using elk 7.12.0 in my local machine. I enabled Xpack and generated some certificates for securing purpose. But when I start my Elasticsearch i got an error. the error is: \[2021-07-13T12:48:08,92… --- ## [ElasticSearch not collect System metrics by metricBeat agent](https://discuss.elastic.co/t/elasticsearch-not-collect-system-metrics-by-metricbeat-agent/278043)
**Author:** [@bhamidpour](https://discuss.elastic.co/u/bhamidpour)\ **Replies:** 3\ **Last updated:** [July 14, 2021, 9:24am UTC](https://discuss.elastic.co/t/elasticsearch-not-collect-system-metrics-by-metricbeat-agent/278043 "2021-07-14T09:24:47Z")
Hi, I used this document to run metricbeat agent. kibana path: https://elastic.mydomain.com:5601 elastic path: http://elastic.mydomain.com:9200 (without TLS) after set configurations in "/etc/metricbeat/metricbeat.ym… --- ## [Can Elasticsearch share plugin directory](https://discuss.elastic.co/t/can-elasticsearch-share-plugin-directory/278523)
**Author:** [@dorinand](https://discuss.elastic.co/u/dorinand)\ **Replies:** 2\ **Last updated:** [July 14, 2021, 9:23am UTC](https://discuss.elastic.co/t/can-elasticsearch-share-plugin-directory/278523 "2021-07-14T09:23:34Z")
I have docker swarm of 3 nodes. I run ES with 5 nodes (3 data/master nodes and 2 coordinating nodes). I would like to use S3 bucket plugin to backup ES cluster. Plugin must be installed on all nodes, that means, plugin d… --- ## [Elasticsearch consistently showing data as now - 24h](https://discuss.elastic.co/t/elasticsearch-consistently-showing-data-as-now-24h/278561)
**Author:** [@mkorayem](https://discuss.elastic.co/u/mkorayem)\ **Replies:** 2\ **Last updated:** [July 14, 2021, 9:02am UTC](https://discuss.elastic.co/t/elasticsearch-consistently-showing-data-as-now-24h/278561 "2021-07-14T09:02:21Z")
Hi, Elasticsearch only showing data as now-24h, either by using curl or kibana. I am sure data is moved from logstash to elasticsearch as number of documents keep increasing and size too. This is happening with all in… --- ## [Setup replication servers with basic security](https://discuss.elastic.co/t/setup-replication-servers-with-basic-security/278541)
**Author:** [@Mamol27](https://discuss.elastic.co/u/Mamol27)\ **Replies:** 4\ **Last updated:** [July 14, 2021, 8:28am UTC](https://discuss.elastic.co/t/setup-replication-servers-with-basic-security/278541 "2021-07-14T08:28:09Z")
Hello i have two cluster with basic security. And i want to setup bi-directional replication. All nodes 7.13 version. Bi-directional replication with Elasticsearch cross-cluster replication (CCR) | Elastic Blog 1t clus… --- ## [Multiple OR and AND conditions with Elasticsearch php](https://discuss.elastic.co/t/multiple-or-and-and-conditions-with-elasticsearch-php/278286)
**Author:** [@hmastery](https://discuss.elastic.co/u/hmastery)\ **Replies:** 7\ **Last updated:** [July 14, 2021, 8:42am UTC](https://discuss.elastic.co/t/multiple-or-and-and-conditions-with-elasticsearch-php/278286 "2021-07-14T08:42:28Z")
I would like to achieve the following query with ElasticSearch : product\_shipper = 1 AND ((product\_type = product and price\>0) OR (product\_type = product\_variation and price=0)) I've built the following query but it do… --- ## [Java driver - Filter queries migration](https://discuss.elastic.co/t/java-driver-filter-queries-migration/278499)
**Author:** [@Leuteris](https://discuss.elastic.co/u/Leuteris)\ **Replies:** 3\ **Last updated:** [July 14, 2021, 8:30am UTC](https://discuss.elastic.co/t/java-driver-filter-queries-migration/278499 "2021-07-14T08:30:29Z")
I need to translate my filter / query syntax (Elasticsearch 1.4) to Elasticsearch 7.x syntax. For FilterBuilders.andFilter I found that I should use boolquery() with filter clause and it works. But what about FilterBuild… --- ## [Method code too large error in Elasticsearch logs](https://discuss.elastic.co/t/method-code-too-large-error-in-elasticsearch-logs/278540)
**Author:** [@Nikolaj\_K](https://discuss.elastic.co/u/Nikolaj_K)\ **Replies:** 5\ **Last updated:** [July 14, 2021, 8:29am UTC](https://discuss.elastic.co/t/method-code-too-large-error-in-elasticsearch-logs/278540 "2021-07-14T08:29:59Z")
Hello, I am investigation performance issues of Elasticsearch cluster and in the logs of the cluster I keep finding the following error: nested: NotSerializableExceptionWrapper\[runtime\_exception: Method code too large!… --- ## [Error start elasticsearch in centos7](https://discuss.elastic.co/t/error-start-elasticsearch-in-centos7/278391)
**Author:** [@Rizky\_Hudha](https://discuss.elastic.co/u/Rizky_Hudha)\ **Replies:** 9\ **Last updated:** [July 14, 2021, 8:29am UTC](https://discuss.elastic.co/t/error-start-elasticsearch-in-centos7/278391 "2021-07-14T08:29:24Z")
hello i found a problem when starting elasticsearch, and an error like this : Jul 12 05:05:34 bigdata systemd-entrypoint\[22275\]: Likely root cause: java.nio.file.AccessDeniedException: /etc/elasticsearch/elasticsearch.k… --- ## [Kubernetes Metadata from Filebeat doesn't apply](https://discuss.elastic.co/t/kubernetes-metadata-from-filebeat-doesnt-apply/278627)
**Author:** [@Leonadius](https://discuss.elastic.co/u/Leonadius)\ **Replies:** 0\ **Last updated:** [July 14, 2021, 8:24am UTC](https://discuss.elastic.co/t/kubernetes-metadata-from-filebeat-doesnt-apply/278627 "2021-07-14T08:24:56Z")
Dear Team, I'm currently deploying filebeat 7.12 on kubernetes as Daemonset, and sending the logs to elasticsearch on kubernetes also. The problem is, kubernetes metadata doesn't apply on my elasticsearch although i'm … --- ## [Force! Logstash keeps restarting](https://discuss.elastic.co/t/force-logstash-keeps-restarting/278624)
**Author:** [@rojin](https://discuss.elastic.co/u/rojin)\ **Replies:** 0\ **Last updated:** [July 14, 2021, 7:37am UTC](https://discuss.elastic.co/t/force-logstash-keeps-restarting/278624 "2021-07-14T07:37:24Z")
Hi! Two of the logstash instances keep restarting giving this error in the log. The other is OK and does not. Can someone help me? \[2021-07-14T11:58:40,333\]\[FATAL\]\[logstash.runner \] An unexpected error occurred… --- ## [Kibana Reporting -csv download fails frequently with error 'Unable to generate report Max attempts reached (3)'](https://discuss.elastic.co/t/kibana-reporting-csv-download-fails-frequently-with-error-unable-to-generate-report-max-attempts-reached-3/278405)
**Author:** [@prathibha](https://discuss.elastic.co/u/prathibha)\ **Replies:** 3\ **Last updated:** [July 14, 2021, 7:36am UTC](https://discuss.elastic.co/t/kibana-reporting-csv-download-fails-frequently-with-error-unable-to-generate-report-max-attempts-reached-3/278405 "2021-07-14T07:36:03Z")
Hello, I have tried to generate csv files using saved search on Kibana dashboard. This is downloading proper file for few cases and failing in some cases. This failure does not looks due to the size issue. I could see … --- ## [Logstash S3 plugin cannot assume a across-account role with external\_id](https://discuss.elastic.co/t/logstash-s3-plugin-cannot-assume-a-across-account-role-with-external-id/278623)
**Author:** [@wilsonwang](https://discuss.elastic.co/u/wilsonwang)\ **Replies:** 0\ **Last updated:** [July 14, 2021, 7:33am UTC](https://discuss.elastic.co/t/logstash-s3-plugin-cannot-assume-a-across-account-role-with-external-id/278623 "2021-07-14T07:33:03Z")
I am using logstash S3 plugin which installed on an EC2 to ingest log from S3 in another account B. It runs well we I configure the role\_arn in conf of S3 plugin, but when a external\_ID is added to the role, the problem… --- ## [How to connect keyclock with elasticsearch and kibana](https://discuss.elastic.co/t/how-to-connect-keyclock-with-elasticsearch-and-kibana/278622)
**Author:** [@SRIGURU\_VEL](https://discuss.elastic.co/u/SRIGURU_VEL)\ **Replies:** 0\ **Last updated:** [July 14, 2021, 7:32am UTC](https://discuss.elastic.co/t/how-to-connect-keyclock-with-elasticsearch-and-kibana/278622 "2021-07-14T07:32:37Z")
Hi team, I am ELK in my local mahine. OS: windows 10 I enabled HTTS service in ELK with Xpack. Now I need to integrate Keyclock service with Elasticsearch and kibana. please help me to integrate keyclock and ELK. t… --- ## [How can I see which line of the csv file I am on?](https://discuss.elastic.co/t/how-can-i-see-which-line-of-the-csv-file-i-am-on/278613)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 4\ **Last updated:** [July 14, 2021, 6:39am UTC](https://discuss.elastic.co/t/how-can-i-see-which-line-of-the-csv-file-i-am-on/278613 "2021-07-14T06:39:43Z")
Hello friends, I have a question. When transferring data to elasticsearch with Logstash, can I see which line of the csv file it is in? For example, the field named path shows me which csv file I am in. So, is there a fi… --- ## [Error with Lifecycle Policy](https://discuss.elastic.co/t/error-with-lifecycle-policy/278614)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 0\ **Last updated:** [July 14, 2021, 6:22am UTC](https://discuss.elastic.co/t/error-with-lifecycle-policy/278614 "2021-07-14T06:22:18Z")
Hi I will be appreciated if someone do me a favor, what is this error means? I defined an alias and also the first index which follows my lifecycle policy is working...!!! But the new index generated(like the index … --- ## [Anonymous authentication - docker configuration](https://discuss.elastic.co/t/anonymous-authentication-docker-configuration/278489)
**Author:** [@yannjor](https://discuss.elastic.co/u/yannjor)\ **Replies:** 1\ **Last updated:** [July 14, 2021, 6:07am UTC](https://discuss.elastic.co/t/anonymous-authentication-docker-configuration/278489 "2021-07-14T06:07:18Z")
Hello, I am trying to enable anonymous authentication in Kibana to make my embedded dashboards viewable without login. I have enabled anonymous access to elastic with: - xpack.security.authc.anonymous.roles=kibana\_syst… --- ## [Adding Elasticsearch Data Node To Cluster](https://discuss.elastic.co/t/adding-elasticsearch-data-node-to-cluster/278466)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 2\ **Last updated:** [July 14, 2021, 5:30am UTC](https://discuss.elastic.co/t/adding-elasticsearch-data-node-to-cluster/278466 "2021-07-14T05:30:32Z")
I was using a single node Elastic stack cluster and now adding a data node to my cluster. However, somehow the second node is not reflecting in the Kibana stack monitoring page, even if both elastic nodes are working wit… --- ## [Unable to login to elasticsearch,asking password of old installation](https://discuss.elastic.co/t/unable-to-login-to-elasticsearch-asking-password-of-old-installation/278550)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [July 14, 2021, 12:13am UTC](https://discuss.elastic.co/t/unable-to-login-to-elasticsearch-asking-password-of-old-installation/278550 "2021-07-14T00:13:35Z")
Hi all, I'm trying to install a new version of elasticsearch and kibana. However, when i install, some old cache of previous installation is asking me elastic login and password. I have forgotten old installation elas… --- ## [Treatments by filebeat files](https://discuss.elastic.co/t/treatments-by-filebeat-files/278539)
**Author:** [@boubou](https://discuss.elastic.co/u/boubou)\ **Replies:** 1\ **Last updated:** [July 13, 2021, 11:56pm UTC](https://discuss.elastic.co/t/treatments-by-filebeat-files/278539 "2021-07-13T23:56:17Z")
Hello everybody :smiley: I need you to configure my filebeat. In fact, I have two logfiles ( /var/log/alpha.log and /var/log/beta.log ) Now, i want create a pipeline with two different treatments... something like th… --- ## [Canvas issue](https://discuss.elastic.co/t/canvas-issue/278423)
**Author:** [@AlexM566](https://discuss.elastic.co/u/AlexM566)\ **Replies:** 1\ **Last updated:** [July 13, 2021, 9:46pm UTC](https://discuss.elastic.co/t/canvas-issue/278423 "2021-07-13T21:46:29Z")
Hello everyone, I know from the start that this is related with Difficulties / Bugs with Canvas but i have a new version of kibana ( 7.11.1) and I still encounter this issue with canvas: The server gave a response th… --- ## [How to update the css and rebuild kibana](https://discuss.elastic.co/t/how-to-update-the-css-and-rebuild-kibana/278476)
**Author:** [@invinciblezz](https://discuss.elastic.co/u/invinciblezz)\ **Replies:** 1\ **Last updated:** [July 13, 2021, 9:40pm UTC](https://discuss.elastic.co/t/how-to-update-the-css-and-rebuild-kibana/278476 "2021-07-13T21:40:34Z")
I want to update the style of dark mode. I updated the css in ./node\_modules/@elastic/eui/dist/eui\_theme\_dark.css but it is not working. What should I do? Thanks! --- ## [Kibana - API to get status of report generation?](https://discuss.elastic.co/t/kibana-api-to-get-status-of-report-generation/278482)
**Author:** [@peteryann](https://discuss.elastic.co/u/peteryann)\ **Replies:** 1\ **Last updated:** [July 13, 2021, 9:34pm UTC](https://discuss.elastic.co/t/kibana-api-to-get-status-of-report-generation/278482 "2021-07-13T21:34:26Z")
How do I get the status of a report generation job after I've issued the POST request to generate said report? I have the job ID, but there doesn't seem to be any API that allows me to query for my job and check its stat… --- ## [Override default umask](https://discuss.elastic.co/t/override-default-umask/278437)
**Author:** [@prandelicious](https://discuss.elastic.co/u/prandelicious)\ **Replies:** 2\ **Last updated:** [July 13, 2021, 9:00pm UTC](https://discuss.elastic.co/t/override-default-umask/278437 "2021-07-13T21:00:32Z")
I understand the dev team has hardcoded the umask to 0027 in libbeats so this applies to all beats apps. Is there a way to override this in the configuration file or CLI parameter? --- ## [ECK - all the nodes leaving the cluster often](https://discuss.elastic.co/t/eck-all-the-nodes-leaving-the-cluster-often/277738)
**Author:** [@Kannappan\_Somu](https://discuss.elastic.co/u/Kannappan_Somu)\ **Replies:** 2\ **Last updated:** [July 13, 2021, 8:35pm UTC](https://discuss.elastic.co/t/eck-all-the-nodes-leaving-the-cluster-often/277738 "2021-07-13T20:35:27Z")
in our eck cluster , all data node and master nodes leaving often with node left messages and follower retry count exceeded. from metrics we could see there is no evidence of system overload or cpu overloaded or heap mem… --- ## [How to use nested JSON fields to search for content and drop it](https://discuss.elastic.co/t/how-to-use-nested-json-fields-to-search-for-content-and-drop-it/278576)
**Author:** [@Alex\_Pilon](https://discuss.elastic.co/u/Alex_Pilon)\ **Replies:** 11\ **Last updated:** [July 13, 2021, 7:13pm UTC](https://discuss.elastic.co/t/how-to-use-nested-json-fields-to-search-for-content-and-drop-it/278576 "2021-07-13T19:13:28Z")
Hi all, Been stuck on this since yesterday, and now I'm at a loss. Basically: Using the Azure EventHub input plugin, I'm ingesting Azure logs from various sources, one of the being Azure SQL Audit logs, which are all i… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1322) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1324)