# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1362 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1363 --- ## [Kibana Vega : Right Aligned Five Digit Padding](https://discuss.elastic.co/t/kibana-vega-right-aligned-five-digit-padding/276148)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 2\ **Last updated:** [June 17, 2021, 4:48am UTC](https://discuss.elastic.co/t/kibana-vega-right-aligned-five-digit-padding/276148 "2021-06-17T04:48:47Z")
I am using Kibana vega visualization to show metrics. I would like to achieve the right align five-digit padding. What can be the property name to achieve the same? My vega code : marks: \[ { type: text … --- ## [Vega visualization issue](https://discuss.elastic.co/t/vega-visualization-issue/275929)
**Author:** [@Nisha2297](https://discuss.elastic.co/u/Nisha2297)\ **Replies:** 7\ **Last updated:** [June 17, 2021, 4:41am UTC](https://discuss.elastic.co/t/vega-visualization-issue/275929 "2021-06-17T04:41:25Z")
My Vega visual is throwing below errors. Can anyone help me on what these errors signify. --- ## [Search both parent and child , but not duplicate result of chil](https://discuss.elastic.co/t/search-both-parent-and-child-but-not-duplicate-result-of-chil/276214)
**Author:** [@DuyNguyen](https://discuss.elastic.co/u/DuyNguyen)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 4:11am UTC](https://discuss.elastic.co/t/search-both-parent-and-child-but-not-duplicate-result-of-chil/276214 "2021-06-17T04:11:05Z")
Hi everyone, I'm new with ELK and developing social app. I using ELK to query post and comment all of group social. Desired result: If match text of post just show post. If match text of comment show that comment an… --- ## [Can I use beat input in filebeat.yml and modules with different tag?](https://discuss.elastic.co/t/can-i-use-beat-input-in-filebeat-yml-and-modules-with-different-tag/276114)
**Author:** [@venkatesh\_prasanth](https://discuss.elastic.co/u/venkatesh_prasanth)\ **Replies:** 2\ **Last updated:** [June 17, 2021, 4:10am UTC](https://discuss.elastic.co/t/can-i-use-beat-input-in-filebeat-yml-and-modules-with-different-tag/276114 "2021-06-17T04:10:22Z")
Hi, I am using filebeat. i use apache module to collect log from apache. but want to collect the log from tomcat and index it in another index. can i use filebeat input in filebeat.yml and module in same time? but i wa… --- ## [Master not discovered yet, this node has not previously joined a bootstrapped (v7+) cluster version 7.13.2](https://discuss.elastic.co/t/master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster-version-7-13-2/276211)
**Author:** [@Senshuken\_GG](https://discuss.elastic.co/u/Senshuken_GG)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 3:00am UTC](https://discuss.elastic.co/t/master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster-version-7-13-2/276211 "2021-06-17T03:00:49Z")
Node 1 172.24.10.103 Node 1 172.24.10.101 Description: 1.Elasticsearch version 7.13 Elasticsearch cluster 2 Node issue is master\_not\_discovered\_exception Node 1 Config elasticsearch.yml cluster.name: POWER-CLUS… --- ## [Have to create multiple rollover\_alias for multiple inputs with ILM](https://discuss.elastic.co/t/have-to-create-multiple-rollover-alias-for-multiple-inputs-with-ilm/276212)
**Author:** [@ELK\_sanjay](https://discuss.elastic.co/u/ELK_sanjay)\ **Replies:** 1\ **Last updated:** [June 17, 2021, 3:33am UTC](https://discuss.elastic.co/t/have-to-create-multiple-rollover-alias-for-multiple-inputs-with-ilm/276212 "2021-06-17T03:33:18Z")
I have an issue creating multiple rollover\_alias for multiple inputs with ILM. But not getting an exact answer. Thanks in Advance..!! --- ## [Elasticsearch ILM Deleting an index is just a logical drop, but the index can still be used. Will it eventually be physically deleted](https://discuss.elastic.co/t/elasticsearch-ilm-deleting-an-index-is-just-a-logical-drop-but-the-index-can-still-be-used-will-it-eventually-be-physically-deleted/276071)
**Author:** [@liuliugang](https://discuss.elastic.co/u/liuliugang)\ **Replies:** 16\ **Last updated:** [June 17, 2021, 3:16am UTC](https://discuss.elastic.co/t/elasticsearch-ilm-deleting-an-index-is-just-a-logical-drop-but-the-index-can-still-be-used-will-it-eventually-be-physically-deleted/276071 "2021-06-17T03:16:23Z")
View index lifecycle management in Kibana The current phase is Delete and the current action is Complete thanks --- ## [High CPU usage because lucene merge thread](https://discuss.elastic.co/t/high-cpu-usage-because-lucene-merge-thread/276209)
**Author:** [@yeziblo](https://discuss.elastic.co/u/yeziblo)\ **Replies:** 5\ **Last updated:** [June 17, 2021, 3:01am UTC](https://discuss.elastic.co/t/high-cpu-usage-because-lucene-merge-thread/276209 "2021-06-17T03:01:36Z")
My operation process is as follows: At 3 am everyday, program try to index data to ES, that usually takes 3 hours. During the indexing process, I will set the number\_of\_replicas parameter to 0, and when data indexing is… --- ## [Filebeat - Unable to change indice name & disable ILM](https://discuss.elastic.co/t/filebeat-unable-to-change-indice-name-disable-ilm/276107)
**Author:** [@shlomia](https://discuss.elastic.co/u/shlomia)\ **Replies:** 2\ **Last updated:** [June 17, 2021, 2:09am UTC](https://discuss.elastic.co/t/filebeat-unable-to-change-indice-name-disable-ilm/276107 "2021-06-17T02:09:09Z")
Hi, I recently started to use ELK with Filebeat version 7.13.0. I'm trying to change the default indice name that Filebeat is creating: "filebeat-%{\[agent.version\]}-%{+yyyy.MM.dd}" and also disabling the ILM policy … --- ## [Can Elastic send the api to jp1 customer the alert and recovery like servicenow?](https://discuss.elastic.co/t/can-elastic-send-the-api-to-jp1-customer-the-alert-and-recovery-like-servicenow/276102)
**Author:** [@T1330](https://discuss.elastic.co/u/T1330)\ **Replies:** 3\ **Last updated:** [June 17, 2021, 2:02am UTC](https://discuss.elastic.co/t/can-elastic-send-the-api-to-jp1-customer-the-alert-and-recovery-like-servicenow/276102 "2021-06-17T02:02:38Z")
Elastic obtain the alert and updated alert by ServiceNow api. Is it also available to have jp1 customer updated alert like ServiceNow in elastic. Please let's us know if you have any customer jp1 using elastic. I ap… --- ## [Split field in elastic](https://discuss.elastic.co/t/split-field-in-elastic/276069)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 6\ **Last updated:** [June 17, 2021, 1:46am UTC](https://discuss.elastic.co/t/split-field-in-elastic/276069 "2021-06-17T01:46:50Z")
Hi all, I have a little problems that needed solving. I have a field dns domain dns.question.name has value like this: a.b.c.d Now i want to split this domain into many other domain like tld, sld ..... dynamically wit… --- ## [Enabling http & https connections to elastic](https://discuss.elastic.co/t/enabling-http-https-connections-to-elastic/276141)
**Author:** [@jdswifty](https://discuss.elastic.co/u/jdswifty)\ **Replies:** 2\ **Last updated:** [June 17, 2021, 1:17am UTC](https://discuss.elastic.co/t/enabling-http-https-connections-to-elastic/276141 "2021-06-17T01:17:36Z")
Running Elasticsearch 7.11 & getting towards the end of a piece of work to enable TLS across the platform I'm now at the point i need to enable tls on the http connections for the ingest nodes but I need to be able to s… --- ## [Confused about filebeat privileges / ILM](https://discuss.elastic.co/t/confused-about-filebeat-privileges-ilm/276112)
**Author:** [@Balu](https://discuss.elastic.co/u/Balu)\ **Replies:** 0\ **Last updated:** [June 16, 2021, 9:47am UTC](https://discuss.elastic.co/t/confused-about-filebeat-privileges-ilm/276112 "2021-06-16T09:47:07Z")
Hey folks, I am just starting to work with the ELK stack and I am quite often confused by the documentation. For example while setting up filebeat, Grant privileges and roles needed for publishing tells me When using… --- ## [How can send large json file (62.5 GO) to elasticsearch using Api?](https://discuss.elastic.co/t/how-can-send-large-json-file-62-5-go-to-elasticsearch-using-api/276111)
**Author:** [@hana\_sk](https://discuss.elastic.co/u/hana_sk)\ **Replies:** 3\ **Last updated:** [June 17, 2021, 1:15am UTC](https://discuss.elastic.co/t/how-can-send-large-json-file-62-5-go-to-elasticsearch-using-api/276111 "2021-06-17T01:15:09Z")
i'm stuck. how can send large json file (62.5 GO) to elasticsearch using Api? --- ## [Threadpool.bulk.size key ignored](https://discuss.elastic.co/t/threadpool-bulk-size-key-ignored/276124)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 1\ **Last updated:** [June 17, 2021, 1:14am UTC](https://discuss.elastic.co/t/threadpool-bulk-size-key-ignored/276124 "2021-06-17T01:14:34Z")
Hey there, using an old ES version (2.x) I was trying to use a custom configuration regarding threadpool. currently, nodes have 8 processors. This value is correctly recognized by ES but when I try to increase it, noth… --- ## [Elasticsearch upgrade from 7.6 to 7.13](https://discuss.elastic.co/t/elasticsearch-upgrade-from-7-6-to-7-13/276146)
**Author:** [@thewasta](https://discuss.elastic.co/u/thewasta)\ **Replies:** 2\ **Last updated:** [June 17, 2021, 1:09am UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-from-7-6-to-7-13/276146 "2021-06-17T01:09:24Z")
S.O: Ubuntu 18.04 ES: 7.6.1 (Before upgrade) I tried to upgrade my ElasticStack with 3 nodes (1 master, 2 slave). Following the Guide. And all of those steps are only on master. here my steps: curl -XPUT -u elastic:… --- ## [Improvement of Average Response time](https://discuss.elastic.co/t/improvement-of-average-response-time/276163)
**Author:** [@purushothamkdr143](https://discuss.elastic.co/u/purushothamkdr143)\ **Replies:** 1\ **Last updated:** [June 17, 2021, 1:08am UTC](https://discuss.elastic.co/t/improvement-of-average-response-time/276163 "2021-06-17T01:08:25Z")
Hi All, I have setup elasticsearch on k8s using eck operator. Throughput is fine but response time(average response time) is little high. How can I improve it? by allocating more cpu/ram to data nodes will improve it? K… --- ## [Searchable Snapshot ILM ERROR](https://discuss.elastic.co/t/searchable-snapshot-ilm-error/276166)
**Author:** [@egalpin](https://discuss.elastic.co/u/egalpin)\ **Replies:** 0\ **Last updated:** [June 16, 2021, 4:17pm UTC](https://discuss.elastic.co/t/searchable-snapshot-ilm-error/276166 "2021-06-16T16:17:52Z")
Hi there, I'm attempting to make use of the newly GA Frozen phase with searchable\_snapshot enabled. I'm consistently getting the following error at the step mount-snapshot of the frozen phase: index \[restored-my-index\]… --- ## [AWS Managed Kibana not sending alerts to Zenoss (Custom webhook )](https://discuss.elastic.co/t/aws-managed-kibana-not-sending-alerts-to-zenoss-custom-webhook/276106)
**Author:** [@Shaiju\_Sam](https://discuss.elastic.co/u/Shaiju_Sam)\ **Replies:** 1\ **Last updated:** [June 17, 2021, 1:01am UTC](https://discuss.elastic.co/t/aws-managed-kibana-not-sending-alerts-to-zenoss-custom-webhook/276106 "2021-06-17T01:01:37Z")
Hi Team, We are trying to configure alerting from AWS Kibana to the 3rd party URL i.e., to Zenoss to generate alerts. I have selected the "Custom webhook" option and have provided the 3rd party URL - "https://\*\*\*\*\*\*.com… --- ## [Isolate parallel requests to Elasticsearch](https://discuss.elastic.co/t/isolate-parallel-requests-to-elasticsearch/275996)
**Author:** [@daksh0225](https://discuss.elastic.co/u/daksh0225)\ **Replies:** 3\ **Last updated:** [June 17, 2021, 12:51am UTC](https://discuss.elastic.co/t/isolate-parallel-requests-to-elasticsearch/275996 "2021-06-17T00:51:38Z")
Hi all, I want to run a set of test classes for my application in parallel. Inside each of the test class, the functions make calls to elasticsearch. Currently the problem I am facing in running the tests in parallel is… --- ## [Large cluster on vm vs bare metal](https://discuss.elastic.co/t/large-cluster-on-vm-vs-bare-metal/276017)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 3\ **Last updated:** [June 17, 2021, 12:50am UTC](https://discuss.elastic.co/t/large-cluster-on-vm-vs-bare-metal/276017 "2021-06-17T00:50:44Z")
What would be better run on vm or on bare metal? metricbeat getting large set of data, about billion document a day, 100+ gig data, data will be feed by three logstash spec I was making was 8 data node, three master a… --- ## [Words with some special character arenot displayed well after elasticsearch injection](https://discuss.elastic.co/t/words-with-some-special-character-arenot-displayed-well-after-elasticsearch-injection/276025)
**Author:** [@F\_Abde](https://discuss.elastic.co/u/F_Abde)\ **Replies:** 8\ **Last updated:** [June 16, 2021, 11:49pm UTC](https://discuss.elastic.co/t/words-with-some-special-character-arenot-displayed-well-after-elasticsearch-injection/276025 "2021-06-16T23:49:52Z")
Hello, I need you help, My data looks like this (My json files) {"index": {"\_id":2530}} {"visitor\_id": "4395667", "timestamp": "2020-08-07T10:24:00Z", "station\_id": "Place A"} {"index": {"\_id":2531}} {"visitor\_id": "43… --- ## [Elastic-agent and postfix logs](https://discuss.elastic.co/t/elastic-agent-and-postfix-logs/275872)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 2\ **Last updated:** [June 16, 2021, 10:19pm UTC](https://discuss.elastic.co/t/elastic-agent-and-postfix-logs/275872 "2021-06-16T22:19:02Z")
Has anyone integrated elastic-agent and postfix in a really good way? As in made the agent split the log messages up into useful fields. I've successfully configured the Custom Logs integration to pull in my postfix log… --- ## [Using pre registered search template is not working](https://discuss.elastic.co/t/using-pre-registered-search-template-is-not-working/276063)
**Author:** [@amarga83](https://discuss.elastic.co/u/amarga83)\ **Replies:** 1\ **Last updated:** [June 16, 2021, 10:11pm UTC](https://discuss.elastic.co/t/using-pre-registered-search-template-is-not-working/276063 "2021-06-16T22:11:28Z")
Hi everyone, I created a search template using kibana as follows: Post \_scripts/mytemplateid3 { "script": { "lang": "mustache", "source": { "query": { "match": { "author": "{{query\_s… --- ## [Cannot get Kubernetes Metadata after migrating to Containerd](https://discuss.elastic.co/t/cannot-get-kubernetes-metadata-after-migrating-to-containerd/276203)
**Author:** [@lel\_war](https://discuss.elastic.co/u/lel_war)\ **Replies:** 0\ **Last updated:** [June 16, 2021, 9:56pm UTC](https://discuss.elastic.co/t/cannot-get-kubernetes-metadata-after-migrating-to-containerd/276203 "2021-06-16T21:56:36Z")
Hello, After I migrated my cluster to containerd, logs are no longer on /var/lib/docker but rather in /var/log/pods///.log and symlinks in /var/log/containers/.log. I configured filebeat with the following and although… --- ## [JDBC Input last value overlap](https://discuss.elastic.co/t/jdbc-input-last-value-overlap/276188)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 4\ **Last updated:** [June 16, 2021, 9:23pm UTC](https://discuss.elastic.co/t/jdbc-input-last-value-overlap/276188 "2021-06-16T21:23:24Z")
Is it possible to set the sql\_last\_value parameter to go back a set amount of time. So something like :sql\_last\_value(-10s) or something like that. I'm querying a db and getting anything that's been updated since the l… --- ## [Top Hit doesnt work in TSVB table](https://discuss.elastic.co/t/top-hit-doesnt-work-in-tsvb-table/275169)
**Author:** [@Harsha\_Mudundi](https://discuss.elastic.co/u/Harsha_Mudundi)\ **Replies:** 3\ **Last updated:** [June 16, 2021, 9:20pm UTC](https://discuss.elastic.co/t/top-hit-doesnt-work-in-tsvb-table/275169 "2021-06-16T21:20:40Z")
Hi, In TSVB table im not able to display any string type data using top hit. In the image below I have 1 user for every job id. --- ## [Cannot download csv file from kibana dashboard](https://discuss.elastic.co/t/cannot-download-csv-file-from-kibana-dashboard/275336)
**Author:** [@Moni\_Kherajani](https://discuss.elastic.co/u/Moni_Kherajani)\ **Replies:** 11\ **Last updated:** [June 16, 2021, 9:17pm UTC](https://discuss.elastic.co/t/cannot-download-csv-file-from-kibana-dashboard/275336 "2021-06-16T21:17:58Z")
I use 7.8.0 version and while downloading csv report from kibana dashboard it says cannot download your report at this moment. I have the proper user and user roles. Any reason!!? --- ## [Scroll or sliced scroll with sorted results](https://discuss.elastic.co/t/scroll-or-sliced-scroll-with-sorted-results/276199)
**Author:** [@jratliff](https://discuss.elastic.co/u/jratliff)\ **Replies:** 0\ **Last updated:** [June 16, 2021, 9:04pm UTC](https://discuss.elastic.co/t/scroll-or-sliced-scroll-with-sorted-results/276199 "2021-06-16T21:04:26Z")
I'm trying to pull results from elasticsearch with a sort. There are millions of records within each time period I'm looking at. It's taking a very long time to fetch all of the results. I'm looking for ways to improve t… --- ## [Curator Configuration / Errors](https://discuss.elastic.co/t/curator-configuration-errors/276051)
**Author:** [@bgreen](https://discuss.elastic.co/u/bgreen)\ **Replies:** 1\ **Last updated:** [June 16, 2021, 8:52pm UTC](https://discuss.elastic.co/t/curator-configuration-errors/276051 "2021-06-16T20:52:30Z")
Hi, Like many folks, my Elasticsearch indices are taking up quite a bit of disk space and I'm trying to use curator to delete/reduce disk usage. However, when I execute the command I get the following error and I'm a b… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1361) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1363)