# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1371 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1372 --- ## [Aggregration Filter doesnt seem to work](https://discuss.elastic.co/t/aggregration-filter-doesnt-seem-to-work/275182)
**Author:** [@kapso](https://discuss.elastic.co/u/kapso)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 8:58pm UTC](https://discuss.elastic.co/t/aggregration-filter-doesnt-seem-to-work/275182 "2021-06-11T20:58:30Z")
I have document of type blog posts, here's what an example looks like Input: \[ { "id": 1, "post\_title": "Title 1", "published\_on": "2021-06-07", "tag\_ids": \[1, 2\], "authors": \[ { "id… --- ## [Bucket selector Kibana Data table visualization](https://discuss.elastic.co/t/bucket-selector-kibana-data-table-visualization/275573)
**Author:** [@theDor](https://discuss.elastic.co/u/theDor)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 8:53pm UTC](https://discuss.elastic.co/t/bucket-selector-kibana-data-table-visualization/275573 "2021-06-11T20:53:05Z")
Hello to every one, I have a simple data table visualization that using the sum metric on a field and displaying the results in a data table. Now my goal is to display only results that the sum is greater than X value.… --- ## [Possible bug in completion context suggester (6.8 and 7.10)](https://discuss.elastic.co/t/possible-bug-in-completion-context-suggester-6-8-and-7-10/275718)
**Author:** [@bklippel](https://discuss.elastic.co/u/bklippel)\ **Replies:** 0\ **Last updated:** [June 11, 2021, 8:10pm UTC](https://discuss.elastic.co/t/possible-bug-in-completion-context-suggester-6-8-and-7-10/275718 "2021-06-11T20:10:22Z")
Hi, I've come across some strange behavior using the completion suggest. In my scenario it seems that inputs over ~34 characters are ignored. I have steps to reproduce. Create this index, post this doc then try the qu… --- ## [Cannot start elastic search server](https://discuss.elastic.co/t/cannot-start-elastic-search-server/275700)
**Author:** [@elastic0](https://discuss.elastic.co/u/elastic0)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 8:08pm UTC](https://discuss.elastic.co/t/cannot-start-elastic-search-server/275700 "2021-06-11T20:08:02Z")
I downloaded elasticsearch-7.13.1-windows-x86\_64.zip, but when I run elasticsearch-service-x64.exe it immediately crashes briefly flashing a blank window. If I run elasticsearch.bat, it gets the following exception. un… --- ## [Can watchers write to an elasticsearch index?](https://discuss.elastic.co/t/can-watchers-write-to-an-elasticsearch-index/275597)
**Author:** [@Matt\_McGovern](https://discuss.elastic.co/u/Matt_McGovern)\ **Replies:** 2\ **Last updated:** [June 11, 2021, 7:55pm UTC](https://discuss.elastic.co/t/can-watchers-write-to-an-elasticsearch-index/275597 "2021-06-11T19:55:21Z")
Is there any possibility in any of the new versions of kibana/elasticsearch, for a watcher to write to an elasticsearch index in an action? --- ## [Kibana uses the kbn-version and kbn-name headers to prevent XSRF attacks](https://discuss.elastic.co/t/kibana-uses-the-kbn-version-and-kbn-name-headers-to-prevent-xsrf-attacks/275665)
**Author:** [@ravi\_yadav2](https://discuss.elastic.co/u/ravi_yadav2)\ **Replies:** 2\ **Last updated:** [June 11, 2021, 7:36pm UTC](https://discuss.elastic.co/t/kibana-uses-the-kbn-version-and-kbn-name-headers-to-prevent-xsrf-attacks/275665 "2021-06-11T19:36:58Z")
Could anyone please explain how Kibana uses the kbn-version and kbn-name headers to prevent XSRF attacks. --- ## [How do I read data from influxdb](https://discuss.elastic.co/t/how-do-i-read-data-from-influxdb/275711)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 7:22pm UTC](https://discuss.elastic.co/t/how-do-i-read-data-from-influxdb/275711 "2021-06-11T19:22:52Z")
I have a need to read data from influxdb. anyone has done this before can you give me example of input plugin for that? --- ## [How to replace @timestamp field in logstash aggregate filter map](https://discuss.elastic.co/t/how-to-replace-timestamp-field-in-logstash-aggregate-filter-map/275708)
**Author:** [@jratliff](https://discuss.elastic.co/u/jratliff)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 7:13pm UTC](https://discuss.elastic.co/t/how-to-replace-timestamp-field-in-logstash-aggregate-filter-map/275708 "2021-06-11T19:13:49Z")
I'm using the logstash aggregate filter. When the map is pushed upon timeout, I want to set the @timestamp field to be a specific valu. I've tried using timeout\_code =\> event.set('@timestamp', "2021-06-10T19:00:00.000Z"… --- ## [Ingest Pipeline for routing data into 2 different indexes](https://discuss.elastic.co/t/ingest-pipeline-for-routing-data-into-2-different-indexes/228189)
**Author:** [@Mack\_rogers](https://discuss.elastic.co/u/Mack_rogers)\ **Replies:** 3\ **Last updated:** [June 11, 2021, 7:13pm UTC](https://discuss.elastic.co/t/ingest-pipeline-for-routing-data-into-2-different-indexes/228189 "2021-06-11T19:13:38Z")
How can you write into 2 different indexes using a ingest pipeline? Example. a single doc with fields a , b, c, and d ? index A will receive fields A & B index B will receive fields C & D How can I accomplish this wi… --- ## [Filebeat 7.6.1 - persistence of logs](https://discuss.elastic.co/t/filebeat-7-6-1-persistence-of-logs/274702)
**Author:** [@ramachandranmr88](https://discuss.elastic.co/u/ramachandranmr88)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 7:10pm UTC](https://discuss.elastic.co/t/filebeat-7-6-1-persistence-of-logs/274702 "2021-06-11T19:10:02Z")
I am new to using ELK. I have the following configuration: Filebeat—\>Logstash—\>Elasticsearch—\>Kibana. I have the following questions When filebeat service is stopped while Logstash is still running and later when f… --- ## [Shards](https://discuss.elastic.co/t/shards/275554)
**Author:** [@Abhishek\_Shinde](https://discuss.elastic.co/u/Abhishek_Shinde)\ **Replies:** 3\ **Last updated:** [June 11, 2021, 6:14pm UTC](https://discuss.elastic.co/t/shards/275554 "2021-06-11T18:14:23Z")
I was referring to following for sizing the shards, I referred the following sections in the article, #Aim for shard sizes between 10GB and 50GB #Aim for 20 shards or fewer per GB of heap memory I wanted to understa… --- ## [Kv filter has no support for this type of data {:type=\>Hash, :value=\>{"METHODNAME"=\>](https://discuss.elastic.co/t/kv-filter-has-no-support-for-this-type-of-data-type-hash-value-methodname/275659)
**Author:** [@Chandana](https://discuss.elastic.co/u/Chandana)\ **Replies:** 2\ **Last updated:** [June 11, 2021, 5:56pm UTC](https://discuss.elastic.co/t/kv-filter-has-no-support-for-this-type-of-data-type-hash-value-methodname/275659 "2021-06-11T17:56:38Z")
Can some please help me to parse the below log, I need the key-value pairs in DEBUGMESSAGE as my fields. Here is my sample logs snippet: {"thread":"default task-131","TimeStamp":"06/08/2021:00:58:02,848-08:00","level":… --- ## [Force logstash to recreate/ update the same index](https://discuss.elastic.co/t/force-logstash-to-recreate-update-the-same-index/275705)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 0\ **Last updated:** [June 11, 2021, 5:23pm UTC](https://discuss.elastic.co/t/force-logstash-to-recreate-update-the-same-index/275705 "2021-06-11T17:23:50Z")
Hello. I need to force logstash to recreate (re-read) the "same" index and update it. Is there an option for that? Please guide for ELK stack 7.6.2 Thanks --- ## [How to pass user credential to REST api?](https://discuss.elastic.co/t/how-to-pass-user-credential-to-rest-api/275562)
**Author:** [@Ashwin\_Srivastav](https://discuss.elastic.co/u/Ashwin_Srivastav)\ **Replies:** 5\ **Last updated:** [June 11, 2021, 4:44pm UTC](https://discuss.elastic.co/t/how-to-pass-user-credential-to-rest-api/275562 "2021-06-11T16:44:56Z")
I have coded a REST api which basically inserts, gets and updates the data from Elasticsearch. After implementing the basic security when I pass a curl command to the api providing credentials along with it (using -u), I… --- ## [Filtering Index or custom rules for Elastic ML anomaly detection](https://discuss.elastic.co/t/filtering-index-or-custom-rules-for-elastic-ml-anomaly-detection/275326)
**Author:** [@elizobee](https://discuss.elastic.co/u/elizobee)\ **Replies:** 5\ **Last updated:** [June 11, 2021, 4:22pm UTC](https://discuss.elastic.co/t/filtering-index-or-custom-rules-for-elastic-ml-anomaly-detection/275326 "2021-06-11T16:22:32Z")
I would like to run anomaly detection on a subset of an index. It looks like I am supposed to set up a filter list containing the values I wish to select, and then create a custom rule to associate a field with a filter… --- ## [Cannot merge \[properties\] mappings error](https://discuss.elastic.co/t/cannot-merge-properties-mappings-error/275506)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 10:26pm UTC](https://discuss.elastic.co/t/cannot-merge-properties-mappings-error/275506 "2021-06-09T22:26:37Z")
Hello, I'm having a hard time with my running my ML Job due to my fields. Can I correct this by modifying my mappings? I've pasted my error below: "statusCode": 400, "error": "Bad Request", "message": "\[status\_exce… --- ## [Whats the meaning of "gt" and "lte" in the field called "monitor.timespan"?](https://discuss.elastic.co/t/whats-the-meaning-of-gt-and-lte-in-the-field-called-monitor-timespan/275667)
**Author:** [@mar-ro](https://discuss.elastic.co/u/mar-ro)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 2:43pm UTC](https://discuss.elastic.co/t/whats-the-meaning-of-gt-and-lte-in-the-field-called-monitor-timespan/275667 "2021-06-11T14:43:18Z")
Hello! I just see in "heartbeat" index a field called "monitor.timespan" which contains the following: { "lt": "2021-06-11T09:58:59.034Z", "gte": "2021-06-11T09:58:54.034Z" } What's the meaning of "lt" and "gte"? … --- ## [Logstash Key store](https://discuss.elastic.co/t/logstash-key-store/275633)
**Author:** [@farciarz121](https://discuss.elastic.co/u/farciarz121)\ **Replies:** 7\ **Last updated:** [June 11, 2021, 12:42pm UTC](https://discuss.elastic.co/t/logstash-key-store/275633 "2021-06-11T12:42:24Z")
I am trying to improve my ELK security with logstash keystore. I am following instruction from this article: https://www.elastic.co/guide/en/logstash/current/keystore.html All instructions seems to be straight forward… --- ## [FTP repository](https://discuss.elastic.co/t/ftp-repository/274508)
**Author:** [@Chinedum\_Nwuzor](https://discuss.elastic.co/u/Chinedum_Nwuzor)\ **Replies:** 4\ **Last updated:** [June 11, 2021, 11:53am UTC](https://discuss.elastic.co/t/ftp-repository/274508 "2021-06-11T11:53:36Z")
Hello, I am trying to setup an FTP repository for my snapshots. However, it fails with an access denied error message. Please the ftp url I used ftp://username:password@host/ Kindly assist. --- ## [Elastic pipeline](https://discuss.elastic.co/t/elastic-pipeline/275679)
**Author:** [@stefanskv](https://discuss.elastic.co/u/stefanskv)\ **Replies:** 2\ **Last updated:** [June 11, 2021, 11:11am UTC](https://discuss.elastic.co/t/elastic-pipeline/275679 "2021-06-11T11:11:19Z")
Why after upgrade to 7.13 version, Elastic started using new Ingest Node Pipelines (for example filebeat-7.13.1-cisco-asa-asa-ftd-pipeline ). The thing is i have problem with parsing source ip field. Can I configure tha… --- ## [Is there a way of preventing all primary shards of an idex to be placed on the same ES node](https://discuss.elastic.co/t/is-there-a-way-of-preventing-all-primary-shards-of-an-idex-to-be-placed-on-the-same-es-node/275555)
**Author:** [@A\_B](https://discuss.elastic.co/u/A_B)\ **Replies:** 2\ **Last updated:** [June 11, 2021, 10:52am UTC](https://discuss.elastic.co/t/is-there-a-way-of-preventing-all-primary-shards-of-an-idex-to-be-placed-on-the-same-es-node/275555 "2021-06-11T10:52:06Z")
Hello, I have a 49 node ES cluster with roughly the same size storage on each node (900GB). Most indices have 3-5 primary shards. Indices and shards can be of very variable size. Every so often, all primary shards of o… --- ## [Getting \_split\_type\_failure and \_jsonparsefailure in my logstash pipeline using only 1 filter (elasticsearch)](https://discuss.elastic.co/t/getting-split-type-failure-and-jsonparsefailure-in-my-logstash-pipeline-using-only-1-filter-elasticsearch/275671)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 10:35am UTC](https://discuss.elastic.co/t/getting-split-type-failure-and-jsonparsefailure-in-my-logstash-pipeline-using-only-1-filter-elasticsearch/275671 "2021-06-11T10:35:59Z")
Hi, i have 2 pipelines Pipeline 1: input { elasticsearch {}} filter { split {} json {} } output { pipeline {} } Pipeline 2: input { pipeline {}} filter { elasticsearch {} } output { stdout {} } Pipelin 1 where … --- ## [Watchguard Firebox to Logstash](https://discuss.elastic.co/t/watchguard-firebox-to-logstash/275672)
**Author:** [@gygrill](https://discuss.elastic.co/u/gygrill)\ **Replies:** 0\ **Last updated:** [June 11, 2021, 10:24am UTC](https://discuss.elastic.co/t/watchguard-firebox-to-logstash/275672 "2021-06-11T10:24:08Z")
Hi, total newbie here. How do I send Firebox logs to logstash? Do a specific beat exists or is it another method required? thanks for any help --- ## [Rook ceph for Elastic Search](https://discuss.elastic.co/t/rook-ceph-for-elastic-search/275647)
**Author:** [@Sangamesh\_Patil](https://discuss.elastic.co/u/Sangamesh_Patil)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 9:50am UTC](https://discuss.elastic.co/t/rook-ceph-for-elastic-search/275647 "2021-06-11T09:50:19Z")
Hello, We are deploying elastic search on kubernetes farm and we have rook ceph as our distributed storage. I was going through earlier topic and there was enough reason than with ES being heavy used for File system. Bu… --- ## [How to use the visualization plugin in a react component?](https://discuss.elastic.co/t/how-to-use-the-visualization-plugin-in-a-react-component/275484)
**Author:** [@Manuel\_Pedro\_Gomez\_C](https://discuss.elastic.co/u/Manuel_Pedro_Gomez_C)\ **Replies:** 2\ **Last updated:** [June 11, 2021, 8:47am UTC](https://discuss.elastic.co/t/how-to-use-the-visualization-plugin-in-a-react-component/275484 "2021-06-11T08:47:29Z")
Hello! I recently joined a project which is developing a plugin for Kibana, in this project, we use the Visualizations plugin to generate some presentations using data stored in ES indices. I'm trying to understand bett… --- ## [Avoid too many useless field on elastic search - kibana](https://discuss.elastic.co/t/avoid-too-many-useless-field-on-elastic-search-kibana/274357)
**Author:** [@rebug](https://discuss.elastic.co/u/rebug)\ **Replies:** 9\ **Last updated:** [June 11, 2021, 7:30am UTC](https://discuss.elastic.co/t/avoid-too-many-useless-field-on-elastic-search-kibana/274357 "2021-06-11T07:30:03Z")
Hi, I am pretty new to this but, I have setup a elastic stack for starting a log centralization. I have just tested with Nginx log and syslog. My problem is the number of fields created (and many of them are useless a… --- ## [Top-hits on aggregations](https://discuss.elastic.co/t/top-hits-on-aggregations/274959)
**Author:** [@romathonat](https://discuss.elastic.co/u/romathonat)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 7:25am UTC](https://discuss.elastic.co/t/top-hits-on-aggregations/274959 "2021-06-11T07:25:19Z")
Hello, I need to get the top-hits over an aggregation. In my use case I store SQL queries as documents (with different statistics like the time it tooks). Each querie is hashed, so that I can make an aggregation term o… --- ## [What is the price of Elasticsearch licence](https://discuss.elastic.co/t/what-is-the-price-of-elasticsearch-licence/275636)
**Author:** [@sudo-ranjith](https://discuss.elastic.co/u/sudo-ranjith)\ **Replies:** 5\ **Last updated:** [June 11, 2021, 7:01am UTC](https://discuss.elastic.co/t/what-is-the-price-of-elasticsearch-licence/275636 "2021-06-11T07:01:51Z")
Hello Folks, I have planned to setup ELK stack on-premise, I checked Subscriptions | Elastic Stack Products & Support | Elastic, they have mentioned Basic - free and open 2. I would like to know is really Elasticsearc… --- ## [Facing issue on kibana](https://discuss.elastic.co/t/facing-issue-on-kibana/275652)
**Author:** [@SHRIANSH\_RASEKAR](https://discuss.elastic.co/u/SHRIANSH_RASEKAR)\ **Replies:** 0\ **Last updated:** [June 11, 2021, 7:02am UTC](https://discuss.elastic.co/t/facing-issue-on-kibana/275652 "2021-06-11T07:02:32Z")
HI, I am facing issue on kibana dashboard, charts are blank , also from 1 week data is not coming, can anyone help to get cause. Error: Too Many Requests at Fetch.\_callee3$ (http://1\*\*.\*\*\*.\*\*.\*\*:5601/31997/bundles/commo… --- ## [Can i use modules and input at same time with different tag?](https://discuss.elastic.co/t/can-i-use-modules-and-input-at-same-time-with-different-tag/275651)
**Author:** [@venkatesh\_prasanth](https://discuss.elastic.co/u/venkatesh_prasanth)\ **Replies:** 0\ **Last updated:** [June 11, 2021, 6:17am UTC](https://discuss.elastic.co/t/can-i-use-modules-and-input-at-same-time-with-different-tag/275651 "2021-06-11T06:17:58Z")
Hi, I am using filebeat. i use apache module to collect log from apache. but want to collect the log from tomcat and index it in another index. can i use filebeat input in filebeat.yml and module in same time? but i wa… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1370) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1372)