# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1427 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1428 --- ## [Pie chart with percentage](https://discuss.elastic.co/t/pie-chart-with-percentage/272168)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 11:08am UTC](https://discuss.elastic.co/t/pie-chart-with-percentage/272168 "2021-05-06T11:08:31Z")
Hi, I've written this query: SELECT idMaxNet,COUNT(tagId) as num FROM "itt\_data\_bridgenuzoo" WHERE date \>= CURRENT\_DATE - INTERVAL '7' DAY AND idMaxNet!=0 AND (idMaxNet=128 OR idMaxNet=129 OR idMaxNet=130 OR idMaxNet=1… --- ## [Java plugin - Irrelevant JARs are loaded and cause conflicts](https://discuss.elastic.co/t/java-plugin-irrelevant-jars-are-loaded-and-cause-conflicts/272276)
**Author:** [@MosheElisha](https://discuss.elastic.co/u/MosheElisha)\ **Replies:** 0\ **Last updated:** [May 6, 2021, 10:20am UTC](https://discuss.elastic.co/t/java-plugin-irrelevant-jars-are-loaded-and-cause-conflicts/272276 "2021-05-06T10:20:55Z")
Hi, I am creating a Java input plugin that uses 'software.amazon.awssdk:s3:2.16.26' and libraries from manticore-0.7.0-java are loaded into my plugin and cause conflicts. After successful installation, when I try to us… --- ## [Colouring text result from query](https://discuss.elastic.co/t/colouring-text-result-from-query/272149)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 11:05am UTC](https://discuss.elastic.co/t/colouring-text-result-from-query/272149 "2021-05-06T11:05:00Z")
Hi, I'm trying to color text that is result from a query: filters | essql query="SELECT date + interval '2' hour as dateNew, DATEDIFF('minute',date, CURRENT\_TIMESTAMP()) as diff FROM device\_data\_eggy ORDER BY date D… --- ## [No alive nodes found in your cluster](https://discuss.elastic.co/t/no-alive-nodes-found-in-your-cluster/272216)
**Author:** [@chrisan](https://discuss.elastic.co/u/chrisan)\ **Replies:** 2\ **Last updated:** [May 6, 2021, 10:49am UTC](https://discuss.elastic.co/t/no-alive-nodes-found-in-your-cluster/272216 "2021-05-06T10:49:32Z")
I'm on Ubuntu 20.04 with Elasticsearch 7.10.2 (though this has happened in previous minor versions too) We have a PHP script that runs every night using 7.12.0 of the PHP SDK where it re-indexes live documents and delet… --- ## [Are nested docs efficiently skipped?](https://discuss.elastic.co/t/are-nested-docs-efficiently-skipped/271847)
**Author:** [@egalpin](https://discuss.elastic.co/u/egalpin)\ **Replies:** 4\ **Last updated:** [May 6, 2021, 10:44am UTC](https://discuss.elastic.co/t/are-nested-docs-efficiently-skipped/271847 "2021-05-06T10:44:35Z")
Hi all, I’m curious if anyone is able to comment on the handling of nested documents at query time. Are nested documents skipped over in the advance or nextDoc step, or must they also be considered if, for example, nest… --- ## [Control visualization](https://discuss.elastic.co/t/control-visualization/272158)
**Author:** [@graimato](https://discuss.elastic.co/u/graimato)\ **Replies:** 9\ **Last updated:** [May 6, 2021, 10:37am UTC](https://discuss.elastic.co/t/control-visualization/272158 "2021-05-06T10:37:59Z")
Dear all, it is possible to use Control visualization to filter on group of parameters? Suppose that there are: Test ServerTest-1 ServerTest-2 Prod ServerProd-1 ServerProd-2 It is possible to have Control … --- ## [Kibana refuse connection on docker-compose config](https://discuss.elastic.co/t/kibana-refuse-connection-on-docker-compose-config/272272)
**Author:** [@danyxs](https://discuss.elastic.co/u/danyxs)\ **Replies:** 0\ **Last updated:** [May 6, 2021, 10:03am UTC](https://discuss.elastic.co/t/kibana-refuse-connection-on-docker-compose-config/272272 "2021-05-06T10:03:33Z")
Hi, I have a problem with the following docker-compose.yaml file. I used a default file, but when i want to run the containers the kibana refuse connection. I attached the docker-compose config version: '3' services:… --- ## [Spark scala "saveToEs" got the wrong ip](https://discuss.elastic.co/t/spark-scala-savetoes-got-the-wrong-ip/272269)
**Author:** [@nameisnotimportant](https://discuss.elastic.co/u/nameisnotimportant)\ **Replies:** 0\ **Last updated:** [May 6, 2021, 9:40am UTC](https://discuss.elastic.co/t/spark-scala-savetoes-got-the-wrong-ip/272269 "2021-05-06T09:40:40Z")
Hi, I am trying spark and elasticsearch. setting: windows 10 pro spark version: 2.4.0 scala version: 2.11.12 ELK version: 7.10 start like so: .\\spark-shell --jars C:\\spark\\jars\\elasticsearch-spark-20\_2.11-7.10.0… --- ## [Data stream index Rollover exception "..names need to be unique.."](https://discuss.elastic.co/t/data-stream-index-rollover-exception-names-need-to-be-unique/272239)
**Author:** [@dabo](https://discuss.elastic.co/u/dabo)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 9:38am UTC](https://discuss.elastic.co/t/data-stream-index-rollover-exception-names-need-to-be-unique/272239 "2021-05-06T09:38:57Z")
Hi, We have an index .ds-logs-network.azure-default-000001 that is returning: illegal\_state\_exception: index, alias, and data stream names need to be unique, but the following duplicates were found \[logs-network.azure-… --- ## [Try to convert UTC timestamp to IST in logstash](https://discuss.elastic.co/t/try-to-convert-utc-timestamp-to-ist-in-logstash/272268)
**Author:** [@sudheendra](https://discuss.elastic.co/u/sudheendra)\ **Replies:** 0\ **Last updated:** [May 6, 2021, 9:36am UTC](https://discuss.elastic.co/t/try-to-convert-utc-timestamp-to-ist-in-logstash/272268 "2021-05-06T09:36:21Z")
Hi , I need to convert the log UTC to my local time in IST . Used ruby Filter to convert to local time . My filter in logstash.yaml file filter { ruby { code =\> "event.set('new\_date', event.get('\[@timestamp\]').time… --- ## [Can't parse after optionnal field has been set](https://discuss.elastic.co/t/cant-parse-after-optionnal-field-has-been-set/272253)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 2\ **Last updated:** [May 6, 2021, 8:40am UTC](https://discuss.elastic.co/t/cant-parse-after-optionnal-field-has-been-set/272253 "2021-05-06T08:40:42Z")
Hello ! I'm working on Cisco WSA logs. Some fields are optionnal. In particular, the filed which contains username infomation: sometimes we have "DOMAIN\\smith@AD" and sometimes we have just - When username is present, … --- ## [Log Segregation](https://discuss.elastic.co/t/log-segregation/272254)
**Author:** [@Mukund\_Anand](https://discuss.elastic.co/u/Mukund_Anand)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 8:34am UTC](https://discuss.elastic.co/t/log-segregation/272254 "2021-05-06T08:34:51Z")
Hi, I have requirement to segregate the logs what different users can see. I have a log file as a source with all the logs. But, half of those logs has to be seen by one user and other half has to be seen by the other u… --- ## [Log-rotation with Beats](https://discuss.elastic.co/t/log-rotation-with-beats/272165)
**Author:** [@Keerthana\_Manoharan](https://discuss.elastic.co/u/Keerthana_Manoharan)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 8:27am UTC](https://discuss.elastic.co/t/log-rotation-with-beats/272165 "2021-05-06T08:27:10Z")
I am trying to figure out the best possible method for enabling log rotation. The beats is deployed in Kubernetes as daemon set, its input file is stored in a shared location accessed by multiple pods, writing to it. A… --- ## [Events are lost when elasticsearch output is temporary unavailable](https://discuss.elastic.co/t/events-are-lost-when-elasticsearch-output-is-temporary-unavailable/272176)
**Author:** [@mabato](https://discuss.elastic.co/u/mabato)\ **Replies:** 3\ **Last updated:** [May 6, 2021, 8:23am UTC](https://discuss.elastic.co/t/events-are-lost-when-elasticsearch-output-is-temporary-unavailable/272176 "2021-05-06T08:23:44Z")
Hi all, Newbie here. I have kubernetes cluster in a location with patchy internet connection. I have metric beats on the cluster and I want to send metrics to ES which runs in cloud. I thought that when I put logstash … --- ## [Elasticsearch is built with known username & password and need to access with java api](https://discuss.elastic.co/t/elasticsearch-is-built-with-known-username-password-and-need-to-access-with-java-api/272247)
**Author:** [@KK\_LL](https://discuss.elastic.co/u/KK_LL)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 8:11am UTC](https://discuss.elastic.co/t/elasticsearch-is-built-with-known-username-password-and-need-to-access-with-java-api/272247 "2021-05-06T08:11:18Z")
I have built and up an elasticsearch on my computer. And set the xpack.security.enabled: true xpack.security.authc.api\_key.enabled: true to enable basic security. The elastic username password is also generated automa… --- ## [Logstash/kibana timezone issue](https://discuss.elastic.co/t/logstash-kibana-timezone-issue/272139)
**Author:** [@edvrfn](https://discuss.elastic.co/u/edvrfn)\ **Replies:** 3\ **Last updated:** [May 6, 2021, 8:07am UTC](https://discuss.elastic.co/t/logstash-kibana-timezone-issue/272139 "2021-05-06T08:07:52Z")
Below is the sample log message \<12\>May 5 00:10:28 UDM,50c9676c6d24,udm-1.9.3.3438 kernel: \[522844.682013\] IN=br30 OUT=eth4 MAC=76:ac:b9:1e:f2:fc:dc:a6:32:eb:22:ac:08:00 SRC=192.168.3.53 DST=132.145.110.200 LEN=61 TOS=… --- ## [Multiple index search. One with routing](https://discuss.elastic.co/t/multiple-index-search-one-with-routing/272204)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 5\ **Last updated:** [May 6, 2021, 7:20am UTC](https://discuss.elastic.co/t/multiple-index-search-one-with-routing/272204 "2021-05-06T07:20:06Z")
Hello, Is it possible to query multiple indices at the same time, where one of them requires routing? For example if index1 requires routing but index 2 doesn't. Get index1,index2/\_search?routing=..? Thanks --- ## [Low log rate per agent.hostname](https://discuss.elastic.co/t/low-log-rate-per-agent-hostname/272162)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 6\ **Last updated:** [May 6, 2021, 7:34am UTC](https://discuss.elastic.co/t/low-log-rate-per-agent-hostname/272162 "2021-05-06T07:34:56Z")
Hello everybody, I have created a machine learning job to be able to detect when beats stop sending logs to my cluster. Job Type: Multi-metric Metric: Low count(Event rate) split field: agent.hostname an example of … --- ## [Metricbeat on elasticserach 7.10](https://discuss.elastic.co/t/metricbeat-on-elasticserach-7-10/272147)
**Author:** [@SafiaSo](https://discuss.elastic.co/u/SafiaSo)\ **Replies:** 4\ **Last updated:** [May 6, 2021, 7:27am UTC](https://discuss.elastic.co/t/metricbeat-on-elasticserach-7-10/272147 "2021-05-06T07:27:19Z")
Hi Should we install metricbeat on elasticsearch 7.10 ? --- ## [I want to further split messages into json and message after splitting them with grok](https://discuss.elastic.co/t/i-want-to-further-split-messages-into-json-and-message-after-splitting-them-with-grok/272243)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 4\ **Last updated:** [May 6, 2021, 7:23am UTC](https://discuss.elastic.co/t/i-want-to-further-split-messages-into-json-and-message-after-splitting-them-with-grok/272243 "2021-05-06T07:23:10Z")
I want to further split messages into json and message after splitting them with grok. I am using grok to split messages. I'm getting a log in json format in a field, and I found a case where the field contains both js… --- ## [Slow search process in kibana Discover](https://discuss.elastic.co/t/slow-search-process-in-kibana-discover/272188)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 4\ **Last updated:** [May 6, 2021, 6:23am UTC](https://discuss.elastic.co/t/slow-search-process-in-kibana-discover/272188 "2021-05-06T06:23:54Z")
I am using elk 7.11..i am searching an index size of 100gb but it taking long time more than 5 minutes or i can say it is not showing me the data it can show me only 7 days data although it contain last 30 days data but… --- ## [Can Heartbeat use basic auth to log into a website](https://discuss.elastic.co/t/can-heartbeat-use-basic-auth-to-log-into-a-website/270208)
**Author:** [@Simon\_Becker](https://discuss.elastic.co/u/Simon_Becker)\ **Replies:** 3\ **Last updated:** [May 6, 2021, 5:34am UTC](https://discuss.elastic.co/t/can-heartbeat-use-basic-auth-to-log-into-a-website/270208 "2021-05-06T05:34:34Z")
Hello Elasticians, I am trying out the new Synthetics Module in Heartbeat. The webserver I am trying to check has a basic auth feature implemented. So before I can access the webpage I need to use user and password to … --- ## [Basic security Setup multi Node Cluster Query](https://discuss.elastic.co/t/basic-security-setup-multi-node-cluster-query/271232)
**Author:** [@Boris\_Joseph](https://discuss.elastic.co/u/Boris_Joseph)\ **Replies:** 3\ **Last updated:** [May 6, 2021, 5:09am UTC](https://discuss.elastic.co/t/basic-security-setup-multi-node-cluster-query/271232 "2021-05-06T05:09:32Z")
Hi Elastic team, Below reference indicates, that before proceeding with basic security, the minimal security steps must be completed for every node in the cluster. Does that mean we must bring down all ES nodes in s… --- ## [Add custom field and its value needs to be derived from one of the source field](https://discuss.elastic.co/t/add-custom-field-and-its-value-needs-to-be-derived-from-one-of-the-source-field/272229)
**Author:** [@AnamikaN](https://discuss.elastic.co/u/AnamikaN)\ **Replies:** 2\ **Last updated:** [May 6, 2021, 4:47am UTC](https://discuss.elastic.co/t/add-custom-field-and-its-value-needs-to-be-derived-from-one-of-the-source-field/272229 "2021-05-06T04:47:15Z")
I need to add one custom field 'log.level' into filebeat.yml. ITs value needs to be derived from one of source field 'message'. I need to extract log level (INFO or DEBUG or ERROR etc.) from message. Message field looks … --- ## [Add custom field and its value needs to be derived from one of the source field](https://discuss.elastic.co/t/add-custom-field-and-its-value-needs-to-be-derived-from-one-of-the-source-field/272119)
**Author:** [@AnamikaN](https://discuss.elastic.co/u/AnamikaN)\ **Replies:** 5\ **Last updated:** [May 6, 2021, 4:48am UTC](https://discuss.elastic.co/t/add-custom-field-and-its-value-needs-to-be-derived-from-one-of-the-source-field/272119 "2021-05-06T04:48:03Z")
I need to add one custom field 'log.level' into filebeat.yml. ITs value needs to be derived from one of source field 'message'. I need to extract log level (INFO or DEBUG or ERROR etc.) from message. Message field looks … --- ## [Moustache script syntax for aggregated buckets](https://discuss.elastic.co/t/moustache-script-syntax-for-aggregated-buckets/272145)
**Author:** [@michaelv](https://discuss.elastic.co/u/michaelv)\ **Replies:** 2\ **Last updated:** [May 6, 2021, 4:32am UTC](https://discuss.elastic.co/t/moustache-script-syntax-for-aggregated-buckets/272145 "2021-05-06T04:32:16Z")
Hi All, I'm sure this is a no brainer question. I have a search followed by this aggregation: "aggs": { "destination\_ip": { "significant\_terms": { … --- ## [Authentication of \[elastic\] was terminated by realm \[reserved\] - failed to authenticate user \[elastic\]](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/272235)
**Author:** [@Pablo\_Andres\_Santama](https://discuss.elastic.co/u/Pablo_Andres_Santama)\ **Replies:** 0\ **Last updated:** [May 6, 2021, 3:43am UTC](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/272235 "2021-05-06T03:43:01Z")
Hello All I have a cluster which was running in 7.7.0 version without issues and I just update it to 7.12.1 version and when I scale out the cluster the new instance is able to join the cluster but after a minute shows … --- ## [How to connect beats to elasticsearch, when elasticsearch using ssl/tls](https://discuss.elastic.co/t/how-to-connect-beats-to-elasticsearch-when-elasticsearch-using-ssl-tls/271735)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 19\ **Last updated:** [May 6, 2021, 2:36am UTC](https://discuss.elastic.co/t/how-to-connect-beats-to-elasticsearch-when-elasticsearch-using-ssl-tls/271735 "2021-05-06T02:36:27Z")
what should i do to make all of my beat can send log to my elasticsearch since i setting ssl/tls to my elasticsearch. this my configuration and the log ##################### Filebeat Configuration Example ##############… --- ## [Process never end when I run a single pipeline inside a docker container](https://discuss.elastic.co/t/process-never-end-when-i-run-a-single-pipeline-inside-a-docker-container/272231)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 1:41am UTC](https://discuss.elastic.co/t/process-never-end-when-i-run-a-single-pipeline-inside-a-docker-container/272231 "2021-05-06T01:41:39Z")
with a python script Im running logstash via command inside a docker container, the normal behavior (with logstash installed in the server) is that after the pipeline get the data that pipeline shuts down, but the proces… --- ## [Sync Clusters](https://discuss.elastic.co/t/sync-clusters/272169)
**Author:** [@Chen\_Levi](https://discuss.elastic.co/u/Chen_Levi)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 12:28am UTC](https://discuss.elastic.co/t/sync-clusters/272169 "2021-05-06T00:28:48Z")
Hi i have a Prod ES Cluster (elastic.co) and a Staging one. i want to create a nightly process that sync the Prod cluster into Staging cluster so we will have updated data from prod. the way i want to do that is the f… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1426) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1428)