# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1408 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1409 --- ## [Elasticsearch common data model](https://discuss.elastic.co/t/elasticsearch-common-data-model/273283)
**Author:** [@daya.ems](https://discuss.elastic.co/u/daya.ems)\ **Replies:** 3\ **Last updated:** [May 19, 2021, 10:11pm UTC](https://discuss.elastic.co/t/elasticsearch-common-data-model/273283 "2021-05-19T22:11:57Z")
Hi All, Hope you are doing great and safe..!!! I am new into Elasticsearch stack and want implement elasticsearch common data model for our project . I am not sure where to start this topic.and how to Implement this i… --- ## [Sort by a field containing array of strings with sort mode min](https://discuss.elastic.co/t/sort-by-a-field-containing-array-of-strings-with-sort-mode-min/273215)
**Author:** [@curlyheads](https://discuss.elastic.co/u/curlyheads)\ **Replies:** 1\ **Last updated:** [May 19, 2021, 9:57pm UTC](https://discuss.elastic.co/t/sort-by-a-field-containing-array-of-strings-with-sort-mode-min/273215 "2021-05-19T21:57:54Z")
Hi everybody, I want to sort the following example documents by the first array value of the field "name": curl -X PUT "localhost:9200/my-index-000001/\_doc/1?refresh&pretty" -H 'Content-Type: application/json' -d' { … --- ## [\_grokparsefailure](https://discuss.elastic.co/t/grokparsefailure/273447)
**Author:** [@legolas\_bilbao](https://discuss.elastic.co/u/legolas_bilbao)\ **Replies:** 0\ **Last updated:** [May 19, 2021, 9:11pm UTC](https://discuss.elastic.co/t/grokparsefailure/273447 "2021-05-19T21:11:47Z")
Good night, I've use the dev tools for deploy the grook rule for squid logs The config file is the following input { file { path =\> "/var/elastik/access.log" start\_position =\> "beginning" } } filter { grok { … --- ## [This interval creates too many buckets to show in the selected time rage](https://discuss.elastic.co/t/this-interval-creates-too-many-buckets-to-show-in-the-selected-time-rage/273001)
**Author:** [@Hamza\_El\_Aouane](https://discuss.elastic.co/u/Hamza_El_Aouane)\ **Replies:** 27\ **Last updated:** [May 19, 2021, 8:29pm UTC](https://discuss.elastic.co/t/this-interval-creates-too-many-buckets-to-show-in-the-selected-time-rage/273001 "2021-05-19T20:29:17Z")
Hello guys. I have set a elastic search and kibana to receive some syslogs from our OnPrem server. When I go to the discover section and set the time range to refresh every second. I got the warning This interval crea… --- ## [Logstash Http Input Plugin - Encrypted Private Key File is not Valid](https://discuss.elastic.co/t/logstash-http-input-plugin-encrypted-private-key-file-is-not-valid/273438)
**Author:** [@dickysum](https://discuss.elastic.co/u/dickysum)\ **Replies:** 0\ **Last updated:** [May 19, 2021, 6:21pm UTC](https://discuss.elastic.co/t/logstash-http-input-plugin-encrypted-private-key-file-is-not-valid/273438 "2021-05-19T18:21:24Z")
Hi, I am trying to use an encrypted private key for a Logstash HTTP Input where both the private key and certificate are stored locally on the server. However, if I encrypt the private key and configure the ssl\_key\_passp… --- ## [Prettified json is not parsed by logstash s3 input plugin](https://discuss.elastic.co/t/prettified-json-is-not-parsed-by-logstash-s3-input-plugin/273398)
**Author:** [@Anubha](https://discuss.elastic.co/u/Anubha)\ **Replies:** 4\ **Last updated:** [May 19, 2021, 6:01pm UTC](https://discuss.elastic.co/t/prettified-json-is-not-parsed-by-logstash-s3-input-plugin/273398 "2021-05-19T18:01:03Z")
We're trying to parse multiline json file from an s3 bucket which results in "\_jsonparsefailure". It reads the file line by line. The codec we're using is json\_lines. Our logstash config looks like this: input { … --- ## [Configuring network.host and network.publish\_host in dual stack environment](https://discuss.elastic.co/t/configuring-network-host-and-network-publish-host-in-dual-stack-environment/273342)
**Author:** [@mahudees](https://discuss.elastic.co/u/mahudees)\ **Replies:** 2\ **Last updated:** [May 19, 2021, 5:08pm UTC](https://discuss.elastic.co/t/configuring-network-host-and-network-publish-host-in-dual-stack-environment/273342 "2021-05-19T17:08:08Z")
Need to create a elasticsearch cluster where the environment is dual stack. From the document came to know that we can configure network.host: 0.0.0.0 to make it bind on all the available interfaces, in this case it can… --- ## [Remove first few lines of csv in logstash](https://discuss.elastic.co/t/remove-first-few-lines-of-csv-in-logstash/273359)
**Author:** [@Osiris](https://discuss.elastic.co/u/Osiris)\ **Replies:** 1\ **Last updated:** [May 19, 2021, 4:42pm UTC](https://discuss.elastic.co/t/remove-first-few-lines-of-csv-in-logstash/273359 "2021-05-19T16:42:16Z")
This is the input I am using for logstash. ItemId AssetId ItemName Comment 11111 07 ABCDa XYZa 11112 07 ABCDb XYZb 11113 07 ABCDc XYZc 11114 07 ABCDd XYZd 11115 07 ABCD… --- ## [How far to push the CPU on logstash](https://discuss.elastic.co/t/how-far-to-push-the-cpu-on-logstash/273363)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 1\ **Last updated:** [May 19, 2021, 4:26pm UTC](https://discuss.elastic.co/t/how-far-to-push-the-cpu-on-logstash/273363 "2021-05-19T16:26:47Z")
Hi, I have a 8 Core CPU with 16GB of RAM. 8 GB has been allocated to Logstash. Nothing else is running on the machine. The logstash is running a single pipeline only. I have seen that even when I configure the number… --- ## [Load data from SQL server to Elasticsearch on local](https://discuss.elastic.co/t/load-data-from-sql-server-to-elasticsearch-on-local/273196)
**Author:** [@Dai\_Thai\_Hoa\_Vo](https://discuss.elastic.co/u/Dai_Thai_Hoa_Vo)\ **Replies:** 9\ **Last updated:** [May 19, 2021, 4:15pm UTC](https://discuss.elastic.co/t/load-data-from-sql-server-to-elasticsearch-on-local/273196 "2021-05-19T16:15:24Z")
I have local sql server and local ELK . I configed logstash.conf connect to SQL Server. The logstash have read data from SQL but when write data to Elasticsearch only 1 row. Please any one explain to me about this. inp… --- ## [Different values when trying to use scripted field](https://discuss.elastic.co/t/different-values-when-trying-to-use-scripted-field/273344)
**Author:** [@Francisco\_Gomez1](https://discuss.elastic.co/u/Francisco_Gomez1)\ **Replies:** 4\ **Last updated:** [May 19, 2021, 3:52pm UTC](https://discuss.elastic.co/t/different-values-when-trying-to-use-scripted-field/273344 "2021-05-19T15:52:38Z")
Hi, im trying to create a scripted field wich is the result of 2 different values. Thanks in advance This is the value i got stored in my document i access it usen the get "index"/\_doc/"id" If i manually add this 2… --- ## [Ingest CSV file with Logstash fails](https://discuss.elastic.co/t/ingest-csv-file-with-logstash-fails/273431)
**Author:** [@Oscar\_Lopez](https://discuss.elastic.co/u/Oscar_Lopez)\ **Replies:** 1\ **Last updated:** [May 19, 2021, 3:36pm UTC](https://discuss.elastic.co/t/ingest-csv-file-with-logstash-fails/273431 "2021-05-19T15:36:28Z")
I am trying to ingest a CSV file but I get an error when parsing the fields with the following configuration: input { file { path =\> "/etc/logstash/conf.d/taconería.conf" start\_position =\> "beginning" #s… --- ## [The difference between "check every", index size, and number of matches](https://discuss.elastic.co/t/the-difference-between-check-every-index-size-and-number-of-matches/273411)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 1\ **Last updated:** [May 19, 2021, 3:21pm UTC](https://discuss.elastic.co/t/the-difference-between-check-every-index-size-and-number-of-matches/273411 "2021-05-19T15:21:39Z")
Dear all =) When creating an Alert with a webhook action, I have to fill out Check every Select an index and size When number of matches See screenshot below. Question 1 =) If check every is 1 day, and index size i… --- ## [Source IP Geoip](https://discuss.elastic.co/t/source-ip-geoip/273339)
**Author:** [@Pacous](https://discuss.elastic.co/u/Pacous)\ **Replies:** 1\ **Last updated:** [May 19, 2021, 3:07pm UTC](https://discuss.elastic.co/t/source-ip-geoip/273339 "2021-05-19T15:07:51Z")
Hello, I collect the fortigate events. I configured the geoip plugin in logstash. The visualization of sources before configuring the plugin is different after configuring the plugin. Please find the difference below… --- ## [How to limit rows for one single saved search panel](https://discuss.elastic.co/t/how-to-limit-rows-for-one-single-saved-search-panel/273357)
**Author:** [@Long\_Nguyen](https://discuss.elastic.co/u/Long_Nguyen)\ **Replies:** 1\ **Last updated:** [May 19, 2021, 3:03pm UTC](https://discuss.elastic.co/t/how-to-limit-rows-for-one-single-saved-search-panel/273357 "2021-05-19T15:03:47Z")
Hello everyone, I wonder if there is a way to limit the displayed rows for one single saved search panel in the dashboard? (Top 10 for example) I have looked at this thread Kibana search limit rows (top 20) - #4 by Bra… --- ## [Dashboard usage monitoring and node.js http access logs](https://discuss.elastic.co/t/dashboard-usage-monitoring-and-node-js-http-access-logs/273401)
**Author:** [@capitalism.exe](https://discuss.elastic.co/u/capitalism.exe)\ **Replies:** 1\ **Last updated:** [May 19, 2021, 2:56pm UTC](https://discuss.elastic.co/t/dashboard-usage-monitoring-and-node-js-http-access-logs/273401 "2021-05-19T14:56:20Z")
Hello folks, we are currently developing a monitoring platform for a large transportation company. This platform monitors environments like development, integration, testing. You get the idea. We maintain a large num… --- ## [Refresh Index not visible](https://discuss.elastic.co/t/refresh-index-not-visible/273421)
**Author:** [@wickerman](https://discuss.elastic.co/u/wickerman)\ **Replies:** 3\ **Last updated:** [May 19, 2021, 2:47pm UTC](https://discuss.elastic.co/t/refresh-index-not-visible/273421 "2021-05-19T14:47:50Z")
Hello, I've been using ELK for almost a year now. Great Journey! Currently, I can't seem to see the refresh option in Kibana after opening the index. Only the delete icon is visible. Any ideas, on what caused this or… --- ## [Manual inject columns in table view](https://discuss.elastic.co/t/manual-inject-columns-in-table-view/272991)
**Author:** [@debrt](https://discuss.elastic.co/u/debrt)\ **Replies:** 8\ **Last updated:** [May 19, 2021, 2:45pm UTC](https://discuss.elastic.co/t/manual-inject-columns-in-table-view/272991 "2021-05-19T14:45:10Z")
Dear community I'm using a data table to show the top count of event\_id's found in my Winlogbeat index and I am searching for a way to have a column in the table with the description of the event\_id as specified on the s… --- ## [Restore line rendering in point series vis using percentile agg #35649](https://discuss.elastic.co/t/restore-line-rendering-in-point-series-vis-using-percentile-agg-35649/273238)
**Author:** [@Aman\_Gupta1](https://discuss.elastic.co/u/Aman_Gupta1)\ **Replies:** 4\ **Last updated:** [May 19, 2021, 2:37pm UTC](https://discuss.elastic.co/t/restore-line-rendering-in-point-series-vis-using-percentile-agg-35649/273238 "2021-05-19T14:37:40Z")
Hi Team, I'm using elasticsearch: 7.0.1 logstash: 7.0.1 kibana: 7.0.1 but kibana graph can't restore line in %tile graphs. tried upgrading kibana to few version: like 7.2.x, 7.4.x, 7.12.x none of them is compatibl… --- ## [How to handle error mapping](https://discuss.elastic.co/t/how-to-handle-error-mapping/273399)
**Author:** [@Rizky\_Hudha](https://discuss.elastic.co/u/Rizky_Hudha)\ **Replies:** 2\ **Last updated:** [May 19, 2021, 2:34pm UTC](https://discuss.elastic.co/t/how-to-handle-error-mapping/273399 "2021-05-19T14:34:30Z")
hallo I tried to make a mapping for my needs, but an error appeared, can you help with my error, and this my mappping PUT /badilums { "mappings":{ "properties":{ "badilum\_perkara":{ … --- ## [Trying to setup Filebeat with ILM - enabling ILM seems to prevent index from appearing in Elastic](https://discuss.elastic.co/t/trying-to-setup-filebeat-with-ilm-enabling-ilm-seems-to-prevent-index-from-appearing-in-elastic/273211)
**Author:** [@aidenosi](https://discuss.elastic.co/u/aidenosi)\ **Replies:** 2\ **Last updated:** [May 19, 2021, 2:32pm UTC](https://discuss.elastic.co/t/trying-to-setup-filebeat-with-ilm-enabling-ilm-seems-to-prevent-index-from-appearing-in-elastic/273211 "2021-05-19T14:32:51Z")
Hello all, Been trying to set up ILM for our existing Logstash/filebeat deployments. I've successfully set it up for Logstash, but am having issues with Filebeat. Whenever I add the ILM settings to filebeat.yml, the ind… --- ## [Parsing json array](https://discuss.elastic.co/t/parsing-json-array/273218)
**Author:** [@Amy007](https://discuss.elastic.co/u/Amy007)\ **Replies:** 5\ **Last updated:** [May 19, 2021, 2:07pm UTC](https://discuss.elastic.co/t/parsing-json-array/273218 "2021-05-19T14:07:33Z")
Hi , I have json having same structure as the below . How should I parse it?I tried split filter but its not working . \[ { "accounting": \[ { "firstName": "a35aa", "lastName": "Doe", "age": 23 }, { "firstName": … --- ## [@timestamp field problem while reading data from elasticsearch using spark-sql](https://discuss.elastic.co/t/timestamp-field-problem-while-reading-data-from-elasticsearch-using-spark-sql/273382)
**Author:** [@Gokul6](https://discuss.elastic.co/u/Gokul6)\ **Replies:** 1\ **Last updated:** [May 19, 2021, 1:49pm UTC](https://discuss.elastic.co/t/timestamp-field-problem-while-reading-data-from-elasticsearch-using-spark-sql/273382 "2021-05-19T13:49:16Z")
i am trying to read data from elasticsearch using spark-sql, my index contains @timestamp field. below is my query the field name contains a special character so i am escaping it. the problem here is i am not getting… --- ## [Access payload from payload\_delimiter in scoring script](https://discuss.elastic.co/t/access-payload-from-payload-delimiter-in-scoring-script/273407)
**Author:** [@JF2018](https://discuss.elastic.co/u/JF2018)\ **Replies:** 0\ **Last updated:** [May 19, 2021, 1:02pm UTC](https://discuss.elastic.co/t/access-payload-from-payload-delimiter-in-scoring-script/273407 "2021-05-19T13:02:15Z")
Hi I have trouble doing something like this, in es7. Can anyone help me, on how to access the payloads, from payload\_delimiter, from my script\_score? score=0; for (term: my\_terms) { termInfo = \_index\['text'\].get… --- ## [Extract specific line from java stack trace](https://discuss.elastic.co/t/extract-specific-line-from-java-stack-trace/273180)
**Author:** [@gerry1](https://discuss.elastic.co/u/gerry1)\ **Replies:** 2\ **Last updated:** [May 19, 2021, 1:45pm UTC](https://discuss.elastic.co/t/extract-specific-line-from-java-stack-trace/273180 "2021-05-19T13:45:31Z")
hi everyone, what i need to do is to extract from a java stack trace a specific line using the elk stack. What i have, as example, is the exception below and in kibana I want to have only the line starting with com.hos… --- ## [SQL Views in Elastic](https://discuss.elastic.co/t/sql-views-in-elastic/273408)
**Author:** [@6igwig](https://discuss.elastic.co/u/6igwig)\ **Replies:** 3\ **Last updated:** [May 19, 2021, 1:40pm UTC](https://discuss.elastic.co/t/sql-views-in-elastic/273408 "2021-05-19T13:40:22Z")
Is there functionality in Elasticsearch that would be comparable to that of a view in SQL? What I would like to do is use a query (a complex aggregation) as the "definition" of a new index. Lets say I have index-A that… --- ## [Plugin installation was unsuccessful due to error No valid url specified 7.10.2](https://discuss.elastic.co/t/plugin-installation-was-unsuccessful-due-to-error-no-valid-url-specified-7-10-2/273406)
**Author:** [@masterThomas](https://discuss.elastic.co/u/masterThomas)\ **Replies:** 1\ **Last updated:** [May 19, 2021, 1:30pm UTC](https://discuss.elastic.co/t/plugin-installation-was-unsuccessful-due-to-error-no-valid-url-specified-7-10-2/273406 "2021-05-19T13:30:54Z")
hi team, can you help with issue? My command is like below \`\[admin@kibana-server1 bin\]$ ./kibana-plugin install file:///usr/share/kibana/plugins/navMenu-7.10.2.zip\` and my result is that: \`Found previous install atte… --- ## [Open kibana port to internet](https://discuss.elastic.co/t/open-kibana-port-to-internet/273239)
**Author:** [@Mik\_a](https://discuss.elastic.co/u/Mik_a)\ **Replies:** 3\ **Last updated:** [May 19, 2021, 1:04pm UTC](https://discuss.elastic.co/t/open-kibana-port-to-internet/273239 "2021-05-19T13:04:05Z")
I have restricted access by IP. Now I want to open Kibana to the internet. But only that port, not elasticsearch etc. There seem not to be an option for thst in the security section, nor did I find any discussion on thi… --- ## [Update mappings on index](https://discuss.elastic.co/t/update-mappings-on-index/273299)
**Author:** [@Cesidio\_DiBenedetto](https://discuss.elastic.co/u/Cesidio_DiBenedetto)\ **Replies:** 2\ **Last updated:** [May 19, 2021, 1:03pm UTC](https://discuss.elastic.co/t/update-mappings-on-index/273299 "2021-05-19T13:03:09Z")
If I add a few new fields in my index but are not currently being populated because our caching job hasn't been updated to match, will that break current inserts/updates on that index? Edit: Basically added a few new "f… --- ## [Filebeat not able to send all logs](https://discuss.elastic.co/t/filebeat-not-able-to-send-all-logs/273405)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 0\ **Last updated:** [May 19, 2021, 12:50pm UTC](https://discuss.elastic.co/t/filebeat-not-able-to-send-all-logs/273405 "2021-05-19T12:50:05Z")
Hello all, I am using filebeat 7.9.3. Recently we did load testing on our server almost 4 hours. During load testing almost 1 and GB files created every hour. File rotation policy is after every 1 hour. Before load tes… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1407) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1409)