# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1385 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1386 --- ## [How Sliced Scan Works in the background?](https://discuss.elastic.co/t/how-sliced-scan-works-in-the-background/274832)
**Author:** [@arkash20](https://discuss.elastic.co/u/arkash20)\ **Replies:** 0\ **Last updated:** [June 3, 2021, 8:23am UTC](https://discuss.elastic.co/t/how-sliced-scan-works-in-the-background/274832 "2021-06-03T08:23:08Z")
Hi, I used scan method to retrieve data from a huge indice we have (200M records), using multiprocessing. For that I used sliced scan and set it to 6 slices, as the number of my shards. Now here comes the theory questi… --- ## [Canvas refresh rate permanent](https://discuss.elastic.co/t/canvas-refresh-rate-permanent/274174)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 3\ **Last updated:** [June 3, 2021, 7:40am UTC](https://discuss.elastic.co/t/canvas-refresh-rate-permanent/274174 "2021-06-03T07:40:56Z")
Hello, I saw that it is possible to set the canvas refresh rate. Unfortunately, however, I have to set it in every canvas and every time I open it in a new browser. Is it possible to set the refresh rate permanently, … --- ## [Combining URL and field value/values](https://discuss.elastic.co/t/combining-url-and-field-value-values/274710)
**Author:** [@marija.timovska](https://discuss.elastic.co/u/marija.timovska)\ **Replies:** 25\ **Last updated:** [June 3, 2021, 8:08am UTC](https://discuss.elastic.co/t/combining-url-and-field-value-values/274710 "2021-06-03T08:08:14Z")
I would like some assistance with creating custom fields in Kibana. I am not sure why the filed I want is shown correctly in Discovery but when I want to Visualize it it changes back to how it is by default. … --- ## [Can we use index pattern if we allow only alias in roles](https://discuss.elastic.co/t/can-we-use-index-pattern-if-we-allow-only-alias-in-roles/274725)
**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Replies:** 4\ **Last updated:** [June 3, 2021, 7:11am UTC](https://discuss.elastic.co/t/can-we-use-index-pattern-if-we-allow-only-alias-in-roles/274725 "2021-06-03T07:11:27Z")
unable to query the data by using index patterns. just assume the index name is test-20210602-00001 and the alias is testing. role is GET /\_xpack/security/role/test?pretty { "cluster": \[\], "indices": \[ … --- ## [BUG: Elasticsearch ignoring node.roles after upgrade from 7.6.1](https://discuss.elastic.co/t/bug-elasticsearch-ignoring-node-roles-after-upgrade-from-7-6-1/274465)
**Author:** [@mverbeek](https://discuss.elastic.co/u/mverbeek)\ **Replies:** 14\ **Last updated:** [June 3, 2021, 7:08am UTC](https://discuss.elastic.co/t/bug-elasticsearch-ignoring-node-roles-after-upgrade-from-7-6-1/274465 "2021-06-03T07:08:03Z")
Hello everyone, When upgrading from 7.6.1 to 7.10.2, I replaced the old node.master and node.data setting to the new node.roles setting. I changed 2 of the 5 data nodes to data\_cold only. But if the node has already bee… --- ## [Hdfs repository analysis check failed](https://discuss.elastic.co/t/hdfs-repository-analysis-check-failed/274815)
**Author:** [@zhoutiekui](https://discuss.elastic.co/u/zhoutiekui)\ **Replies:** 1\ **Last updated:** [June 3, 2021, 7:07am UTC](https://discuss.elastic.co/t/hdfs-repository-analysis-check-failed/274815 "2021-06-03T07:07:35Z")
dear all, I tried to use the opensource hdfs as a snapshot repository, and when I excute the analysis API, there is an error below: POST /\_snapshot/06031016/\_analyze?blob\_count=10&max\_blob\_size=1mb&timeout=120s&concurr… --- ## [Installing Elasticsearch on a VM outside of the Internet](https://discuss.elastic.co/t/installing-elasticsearch-on-a-vm-outside-of-the-internet/274756)
**Author:** [@jyde](https://discuss.elastic.co/u/jyde)\ **Replies:** 2\ **Last updated:** [June 3, 2021, 7:04am UTC](https://discuss.elastic.co/t/installing-elasticsearch-on-a-vm-outside-of-the-internet/274756 "2021-06-03T07:04:23Z")
Hi, I am tring to install ELK on a VM (let's name it foomachine) which is not connected to the Internet. With MobaXTerm, I have put the tar.gz file of the lastest version of Elasticsearch on foomachine, more precisely … --- ## [Unable to see nginx response time field on kibana](https://discuss.elastic.co/t/unable-to-see-nginx-response-time-field-on-kibana/274563)
**Author:** [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\ **Replies:** 4\ **Last updated:** [June 3, 2021, 6:32am UTC](https://discuss.elastic.co/t/unable-to-see-nginx-response-time-field-on-kibana/274563 "2021-06-03T06:32:50Z")
Hello Team, Our architecture is Beats--\>Logstash--\>Elasticsaerch--\>Kibana and version is 7.10.2 for whole ELK stack. We are sending the nginx access logs on logstash using Filebeat nginx module and at logstash we are u… --- ## [CSRF Protection in kibana 7.10.2](https://discuss.elastic.co/t/csrf-protection-in-kibana-7-10-2/274824)
**Author:** [@ravi\_yadav2](https://discuss.elastic.co/u/ravi_yadav2)\ **Replies:** 1\ **Last updated:** [June 3, 2021, 5:51am UTC](https://discuss.elastic.co/t/csrf-protection-in-kibana-7-10-2/274824 "2021-06-03T05:51:15Z")
Continuing the discussion from CSRF Protection in kibana 7.10.2: --- ## [Error in autodiscover provider settings: error setting up docker autodiscover provider](https://discuss.elastic.co/t/error-in-autodiscover-provider-settings-error-setting-up-docker-autodiscover-provider/274822)
**Author:** [@justindn](https://discuss.elastic.co/u/justindn)\ **Replies:** 0\ **Last updated:** [June 3, 2021, 4:33am UTC](https://discuss.elastic.co/t/error-in-autodiscover-provider-settings-error-setting-up-docker-autodiscover-provider/274822 "2021-06-03T04:33:31Z")
When I try to setup filebeat I get this error: filebeat | Exiting: error in autodiscover provider settings: error setting up docker autodiscover provider: Cannot connect to the Docker daemon at unix:///var/run/docker… --- ## [Config roles in Kibana](https://discuss.elastic.co/t/config-roles-in-kibana/274360)
**Author:** [@N1k-3l](https://discuss.elastic.co/u/N1k-3l)\ **Replies:** 4\ **Last updated:** [June 3, 2021, 4:24am UTC](https://discuss.elastic.co/t/config-roles-in-kibana/274360 "2021-06-03T04:24:56Z")
Hello! I need to create a role only for viewing(read-only) Index Management. In Cluster privileges only one option(manage) enables able to see Index Management. Does option exist to read-only access to it? Thanks for… --- ## [Some logs missing in Kibana](https://discuss.elastic.co/t/some-logs-missing-in-kibana/274819)
**Author:** [@fsiu](https://discuss.elastic.co/u/fsiu)\ **Replies:** 1\ **Last updated:** [June 3, 2021, 3:39am UTC](https://discuss.elastic.co/t/some-logs-missing-in-kibana/274819 "2021-06-03T03:39:55Z")
I have an api application that uses Logstash to send logs to Kibana, all logs are successfully sent. However some logs are missing when viewing the index using Discovery - Kibana. Can you help me to identify the issue … --- ## [Elasticsearch appears to be unreachable or down](https://discuss.elastic.co/t/elasticsearch-appears-to-be-unreachable-or-down/274814)
**Author:** [@abdallah](https://discuss.elastic.co/u/abdallah)\ **Replies:** 0\ **Last updated:** [June 3, 2021, 2:53am UTC](https://discuss.elastic.co/t/elasticsearch-appears-to-be-unreachable-or-down/274814 "2021-06-03T02:53:32Z")
Hi, we suddenly lost the connection between our two logstash servers and the Elasticsearch nodes. The odd thing is that from logstash you can curl, telnet and ping the ElasticSearch nodes, but there is no sending logsta… --- ## [Logstash read file in what order?](https://discuss.elastic.co/t/logstash-read-file-in-what-order/274549)
**Author:** [@theirfan](https://discuss.elastic.co/u/theirfan)\ **Replies:** 21\ **Last updated:** [June 3, 2021, 2:52am UTC](https://discuss.elastic.co/t/logstash-read-file-in-what-order/274549 "2021-06-03T02:52:37Z")
Hi All, Would like to know how logstash "input" reads files from a directory. I have files which are created based on size limit and each new log creation is appended with the creation date in it's name. Ex: file-010… --- ## [\[o.e.b.Bootstrap \] \[node1\] node validation exception](https://discuss.elastic.co/t/o-e-b-bootstrap-node1-node-validation-exception/274740)
**Author:** [@mohamed\_el\_mannouti](https://discuss.elastic.co/u/mohamed_el_mannouti)\ **Replies:** 1\ **Last updated:** [June 3, 2021, 12:08am UTC](https://discuss.elastic.co/t/o-e-b-bootstrap-node1-node-validation-exception/274740 "2021-06-03T00:08:48Z")
right after restarting my server --- ## [Elastic license - security menu not showing up in kibana](https://discuss.elastic.co/t/elastic-license-security-menu-not-showing-up-in-kibana/274738)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 2\ **Last updated:** [June 3, 2021, 12:08am UTC](https://discuss.elastic.co/t/elastic-license-security-menu-not-showing-up-in-kibana/274738 "2021-06-03T00:08:37Z")
Hi there, if have a valid commercial (not basic) license for elasticsearch. Nevertheless I have no security menu in kibana under stack management as I know it. This is an unexpected behaviour. Detail: 1-node-monitorin… --- ## [Error : circuit\_breaking\_exception](https://discuss.elastic.co/t/error-circuit-breaking-exception/274741)
**Author:** [@jvidin](https://discuss.elastic.co/u/jvidin)\ **Replies:** 1\ **Last updated:** [June 3, 2021, 12:07am UTC](https://discuss.elastic.co/t/error-circuit-breaking-exception/274741 "2021-06-03T00:07:55Z")
Hi all , Im new to elastic , im recently receiving this error with some frequency. I have a cluster of 3 and all indices set to shards=2 and replicas=2 Should i look into some special setting to overpass such error ? … --- ## [How to control/limit ELK disk usage](https://discuss.elastic.co/t/how-to-control-limit-elk-disk-usage/274755)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 0\ **Last updated:** [June 2, 2021, 1:20pm UTC](https://discuss.elastic.co/t/how-to-control-limit-elk-disk-usage/274755 "2021-06-02T13:20:05Z")
Hi, Running ELK 7.11.2 Standalone on Debian 10 My ELK machine has 500 GB of disk space. This is the second time the machine runs out of disk space (100% usage). When this happens, I am not able to log into Kibana, as E… --- ## [Search not adhering to time limits - searching many indexes](https://discuss.elastic.co/t/search-not-adhering-to-time-limits-searching-many-indexes/274665)
**Author:** [@P\_Larsen](https://discuss.elastic.co/u/P_Larsen)\ **Replies:** 3\ **Last updated:** [June 2, 2021, 11:14pm UTC](https://discuss.elastic.co/t/search-not-adhering-to-time-limits-searching-many-indexes/274665 "2021-06-02T23:14:53Z")
We have a search that we see running that has a time limit what appears to be 4 mins set but it is accessing indexes from way back in the past. What could be the issue? Grabbed from listing running tasks indices:data/… --- ## [Logstash, syslog, ECS and Kibana Logs / SIEM](https://discuss.elastic.co/t/logstash-syslog-ecs-and-kibana-logs-siem/274789)
**Author:** [@egli](https://discuss.elastic.co/u/egli)\ **Replies:** 4\ **Last updated:** [June 2, 2021, 11:08pm UTC](https://discuss.elastic.co/t/logstash-syslog-ecs-and-kibana-logs-siem/274789 "2021-06-02T23:08:42Z")
Hi, I have logstash working as a central syslog server using syslog\_pri plugin and sending the events to elasticsearch. I would like to ingest those syslog events and adhere to ECS so it is possible to use Kibana Logs o… --- ## [Dateparsefailure error logstash](https://discuss.elastic.co/t/dateparsefailure-error-logstash/274806)
**Author:** [@byakko1234](https://discuss.elastic.co/u/byakko1234)\ **Replies:** 0\ **Last updated:** [June 2, 2021, 10:57pm UTC](https://discuss.elastic.co/t/dateparsefailure-error-logstash/274806 "2021-06-02T22:57:30Z")
Hi everyone. I´m trying to use the date filter without any luck. I want to create a new field that is the combination of the %{date} and %{time} in my grok and have this new field to have a date type value. Any help is… --- ## [Drop events if regex does not match in ElasticSearch](https://discuss.elastic.co/t/drop-events-if-regex-does-not-match-in-elasticsearch/274803)
**Author:** [@pbreda](https://discuss.elastic.co/u/pbreda)\ **Replies:** 0\ **Last updated:** [June 2, 2021, 10:31pm UTC](https://discuss.elastic.co/t/drop-events-if-regex-does-not-match-in-elasticsearch/274803 "2021-06-02T22:31:49Z")
I'm getting events from Filebeat directly to ElasticSearch for metrics live viewing in the Observability menu, however I can't drop out the events I'm not interested like I would be able to using Logstash. I'm receiving … --- ## [Big amount of search operations for use in percolator](https://discuss.elastic.co/t/big-amount-of-search-operations-for-use-in-percolator/274786)
**Author:** [@sanoj85](https://discuss.elastic.co/u/sanoj85)\ **Replies:** 0\ **Last updated:** [June 2, 2021, 5:23pm UTC](https://discuss.elastic.co/t/big-amount-of-search-operations-for-use-in-percolator/274786 "2021-06-02T17:23:41Z")
Hi, We are running an index with a field type percolator, which will take a big amount of incoming searches containing documents. I have seen the example (rally-tracks/default.json at master · elastic/rally-tracks · Git… --- ## [Sql\_last\_value and implicit time zoned data](https://discuss.elastic.co/t/sql-last-value-and-implicit-time-zoned-data/274797)
**Author:** [@etva](https://discuss.elastic.co/u/etva)\ **Replies:** 0\ **Last updated:** [June 2, 2021, 7:23pm UTC](https://discuss.elastic.co/t/sql-last-value-and-implicit-time-zoned-data/274797 "2021-06-02T19:23:43Z")
Hi all, MySql server is UTC : now() give UTC date . sql\_last\_value is stored in UTC in file ( from MySQL ? ) But data I have to compare to sql\_last \_value are locale date as string. I can't use CONVERT\_TZ with named … --- ## [NEED TO READ ONLY THE NEWEST FILE IN EACH FOLDER](https://discuss.elastic.co/t/need-to-read-only-the-newest-file-in-each-folder/274714)
**Author:** [@Daniel\_Lopez](https://discuss.elastic.co/u/Daniel_Lopez)\ **Replies:** 3\ **Last updated:** [June 2, 2021, 5:51pm UTC](https://discuss.elastic.co/t/need-to-read-only-the-newest-file-in-each-folder/274714 "2021-06-02T17:51:47Z")
Hi guys!! I need to configure logstash to read only the newest file in folders, when I restart always read all files, and I couldn't understand why, files are in NAS, and I mount folders before start reading. This is m… --- ## [Kibana debian package not starting (chroot error)](https://discuss.elastic.co/t/kibana-debian-package-not-starting-chroot-error/266437)
**Author:** [@ea1987](https://discuss.elastic.co/u/ea1987)\ **Replies:** 13\ **Last updated:** [June 2, 2021, 5:19pm UTC](https://discuss.elastic.co/t/kibana-debian-package-not-starting-chroot-error/266437 "2021-06-02T17:19:48Z")
Kibana version: 7.11 (current) Installation on: ubuntu (WSL2) Error on: start Kibana.log: chroot: cannot change root directory to '': No such file or directory NB: Elasticsearch is running fine. Can you please help … --- ## [Kibana is not ready yet in 7.12.0 Error in description](https://discuss.elastic.co/t/kibana-is-not-ready-yet-in-7-12-0-error-in-description/274402)
**Author:** [@LombardoAndrea195](https://discuss.elastic.co/u/LombardoAndrea195)\ **Replies:** 8\ **Last updated:** [June 2, 2021, 4:26pm UTC](https://discuss.elastic.co/t/kibana-is-not-ready-yet-in-7-12-0-error-in-description/274402 "2021-06-02T16:26:13Z")
I've obtained this error after creating the visualization element according the following link How to bring Jupyter Notebook visualizations to Kibana dashboards for data science | Elastic Blog . I've installed kibana thr… --- ## [Available Fields - Kibana - Parse data for dashboard built](https://discuss.elastic.co/t/available-fields-kibana-parse-data-for-dashboard-built/274674)
**Author:** [@momo1104](https://discuss.elastic.co/u/momo1104)\ **Replies:** 3\ **Last updated:** [June 2, 2021, 3:27pm UTC](https://discuss.elastic.co/t/available-fields-kibana-parse-data-for-dashboard-built/274674 "2021-06-02T15:27:34Z")
I've ingested ddos dataset from kaggle.com into kibana and it seems like not all the metadata available is useful for me to create a dashboard visualizing the ddos attacks. What am I missing? The config file as follows … --- ## [Using KV and Grok to parse complex data](https://discuss.elastic.co/t/using-kv-and-grok-to-parse-complex-data/274769)
**Author:** [@blackberrySherbet](https://discuss.elastic.co/u/blackberrySherbet)\ **Replies:** 1\ **Last updated:** [June 2, 2021, 3:07pm UTC](https://discuss.elastic.co/t/using-kv-and-grok-to-parse-complex-data/274769 "2021-06-02T15:07:37Z")
Hi, My data is structured like this- INFO {"datetime": "2021-06-1 22:13:29.469000", data:{"val1":3.14, "val2": 2.17}} INFO {"datetime": "2021-06-1 21:14:00.469000", data:{"val3":9}} I want to use logstash to process … --- ## [Pipeline not communicate](https://discuss.elastic.co/t/pipeline-not-communicate/274766)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 0\ **Last updated:** [June 2, 2021, 2:27pm UTC](https://discuss.elastic.co/t/pipeline-not-communicate/274766 "2021-06-02T14:27:46Z")
Hello expert, In order to parse openbsd events I chosed to use pipeline to pipleline communications, I have three pipelines named input which point to openbsd\_2\_ecs pipleline and this last point to output pipeline. Ple… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1384) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1386)