# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1438 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1439 --- ## [Need help for getting antivirus data on dashboard from a linux instance](https://discuss.elastic.co/t/need-help-for-getting-antivirus-data-on-dashboard-from-a-linux-instance/271648)
**Author:** [@Hemant\_Dhillan](https://discuss.elastic.co/u/Hemant_Dhillan)\ **Replies:** 0\ **Last updated:** [April 29, 2021, 1:24pm UTC](https://discuss.elastic.co/t/need-help-for-getting-antivirus-data-on-dashboard-from-a-linux-instance/271648 "2021-04-29T13:24:50Z")
need help in getting the antivirus data from a Linux machine which is currently running metricbeat and showing statistics on the dashboard of kibana .i 've written a small python script which is taking appropirate inform… --- ## [Provided Grok expressions do not match field value: Fortinet 7.12.1](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value-fortinet-7-12-1/271523)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 8\ **Last updated:** [April 29, 2021, 1:24pm UTC](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value-fortinet-7-12-1/271523 "2021-04-29T13:24:23Z")
Hello, recently I started a module for logs from fortigate firewalls. - module: fortinet firewall: enabled: true # Set which input to use between tcp, udp (default) or file. #var.input: udp # The in… --- ## [Dashboard Controls Filter vs VEGA](https://discuss.elastic.co/t/dashboard-controls-filter-vs-vega/271556)
**Author:** [@Alexandre.Bernier](https://discuss.elastic.co/u/Alexandre.Bernier)\ **Replies:** 2\ **Last updated:** [April 29, 2021, 1:11pm UTC](https://discuss.elastic.co/t/dashboard-controls-filter-vs-vega/271556 "2021-04-29T13:11:11Z")
Hello there! I don't really know how to ask my question, but, I will try this way... is this possible to filter a specific VEGA visualization with a specific control filter? Let me explain. First of all, I have 2 inde… --- ## [X axis range wrong](https://discuss.elastic.co/t/x-axis-range-wrong/271642)
**Author:** [@David\_Mohamad](https://discuss.elastic.co/u/David_Mohamad)\ **Replies:** 0\ **Last updated:** [April 29, 2021, 12:47pm UTC](https://discuss.elastic.co/t/x-axis-range-wrong/271642 "2021-04-29T12:47:51Z")
What is the right way to set the range of the X axis to the minimum and maximum value of the selected time range. This is what I have at the moment. If I select 2 days ago in the timefilter, it should show me the da… --- ## [New line character in painless](https://discuss.elastic.co/t/new-line-character-in-painless/271604)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 1\ **Last updated:** [April 29, 2021, 11:48am UTC](https://discuss.elastic.co/t/new-line-character-in-painless/271604 "2021-04-29T11:48:38Z")
i want to send new line char to api using watcher "actions": { "sms": { "webhook": { "scheme": "https", "host": "127.0.0.1", "port": 80, "method": "post", "path": "/api/… --- ## [ElasticsearchException got in indexing function: TransportError](https://discuss.elastic.co/t/elasticsearchexception-got-in-indexing-function-transporterror/271195)
**Author:** [@sanjay\_sheel](https://discuss.elastic.co/u/sanjay_sheel)\ **Replies:** 3\ **Last updated:** [April 29, 2021, 11:47am UTC](https://discuss.elastic.co/t/elasticsearchexception-got-in-indexing-function-transporterror/271195 "2021-04-29T11:47:25Z")
\[17:15:47\]{completed\_searching2.py:346}ERROR- Error Occured: Exception in indexing function: ElasticsearchException got in indexing function: TransportError(429, 'circuit\_breaking\_exception', '\[parent\] Data too large, da… --- ## [Update a single field vs Inserting the whole document again](https://discuss.elastic.co/t/update-a-single-field-vs-inserting-the-whole-document-again/271607)
**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Replies:** 1\ **Last updated:** [April 29, 2021, 11:33am UTC](https://discuss.elastic.co/t/update-a-single-field-vs-inserting-the-whole-document-again/271607 "2021-04-29T11:33:44Z")
Which one is more costly operation? Suppose I have 50 fields per document in an index. Updating a single field in a document Or, Re-inserting the complete whole document with that changed field. Basically \_update vs … --- ## [Can't we get total number of matches in \_search api?](https://discuss.elastic.co/t/cant-we-get-total-number-of-matches-in-search-api/271612)
**Author:** [@raja\_augstin](https://discuss.elastic.co/u/raja_augstin)\ **Replies:** 3\ **Last updated:** [April 29, 2021, 11:29am UTC](https://discuss.elastic.co/t/cant-we-get-total-number-of-matches-in-search-api/271612 "2021-04-29T11:29:48Z")
can't we get total number of matches in \_search api? i'm using following search api to get total matched document and to find number of match for the given query. in this we don't receive the actual total match for th… --- ## [Indexing with deprecated \_type field](https://discuss.elastic.co/t/indexing-with-deprecated-type-field/271478)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 16\ **Last updated:** [April 29, 2021, 11:11am UTC](https://discuss.elastic.co/t/indexing-with-deprecated-type-field/271478 "2021-04-29T11:11:52Z")
Hello community. I have a question. What happens in elasticsearch 7.10 if a write attempt occurs with deprecated \_type field (we use apache metron, that tries to write to elastic), something like this "{"index":{"\_ind… --- ## [Setting up admin user credentials for Kibana](https://discuss.elastic.co/t/setting-up-admin-user-credentials-for-kibana/271617)
**Author:** [@usman1](https://discuss.elastic.co/u/usman1)\ **Replies:** 1\ **Last updated:** [April 29, 2021, 10:33am UTC](https://discuss.elastic.co/t/setting-up-admin-user-credentials-for-kibana/271617 "2021-04-29T10:33:55Z")
I am trying to impose basic security on my Elasticstack specifically user authentication for Kibana. I enabled xpack security by adding the following configurations in elasticsearch.yml file: xpack.security.enabled: tru… --- ## [Reindex remote: not authorized](https://discuss.elastic.co/t/reindex-remote-not-authorized/271621)
**Author:** [@Davide\_Barbato](https://discuss.elastic.co/u/Davide_Barbato)\ **Replies:** 0\ **Last updated:** [April 29, 2021, 10:31am UTC](https://discuss.elastic.co/t/reindex-remote-not-authorized/271621 "2021-04-29T10:31:27Z")
Hello there :wave: I'm trying to configure reindex from remote on an ECK instance with ES version 6.8.15 I feel I've configured everything correctly but still get the infamous "not authorized". This is the configurati… --- ## [Please add count for selected indices](https://discuss.elastic.co/t/please-add-count-for-selected-indices/271610)
**Author:** [@Nurlan199206](https://discuss.elastic.co/u/Nurlan199206)\ **Replies:** 1\ **Last updated:** [April 29, 2021, 10:07am UTC](https://discuss.elastic.co/t/please-add-count-for-selected-indices/271610 "2021-04-29T10:07:52Z")
I have a suggestion, if possible you can add items count for selected indices? it is difficult to count manually. --- ## [Remote node cluster join](https://discuss.elastic.co/t/remote-node-cluster-join/271488)
**Author:** [@Makss39](https://discuss.elastic.co/u/Makss39)\ **Replies:** 12\ **Last updated:** [April 29, 2021, 9:31am UTC](https://discuss.elastic.co/t/remote-node-cluster-join/271488 "2021-04-29T09:31:40Z")
Hi, I've a 3 node cluster on my local network, it works like a charm. I just want to add a 4th node, but on another nework. But i'm not able to perform the discovery, my local master is well discovered by the remote no… --- ## [Search - keyword vs text and ngram](https://discuss.elastic.co/t/search-keyword-vs-text-and-ngram/271606)
**Author:** [@lele15](https://discuss.elastic.co/u/lele15)\ **Replies:** 0\ **Last updated:** [April 29, 2021, 9:21am UTC](https://discuss.elastic.co/t/search-keyword-vs-text-and-ngram/271606 "2021-04-29T09:21:36Z")
Hi, I have an index like: "name": { "type": "keyword" }, "address": { "type": "keyword" }, "addressText": { "type": "text", "analyzer": "autocomplete", "search\_analyzer": "autocomplete\_search" }, "nameText":… --- ## [Mapping Explosion for Kubernetes/Openshift Index](https://discuss.elastic.co/t/mapping-explosion-for-kubernetes-openshift-index/271418)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 5\ **Last updated:** [April 29, 2021, 8:54am UTC](https://discuss.elastic.co/t/mapping-explosion-for-kubernetes-openshift-index/271418 "2021-04-29T08:54:21Z")
Hi folks, I am shipping application logs using filebeat daemonset (7.9.0) from openshift to elasticsearch (7.6.2) Right now I am running into following warnings: "Limit of total fields \[10000\] in index \[filebeat-opens… --- ## [HELP! Exiting: Error in initing input: No paths were defined for input accessing 'filebeat.prospectors.1'](https://discuss.elastic.co/t/help-exiting-error-in-initing-input-no-paths-were-defined-for-input-accessing-filebeat-prospectors-1/271528)
**Author:** [@vv007b](https://discuss.elastic.co/u/vv007b)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 2:55pm UTC](https://discuss.elastic.co/t/help-exiting-error-in-initing-input-no-paths-were-defined-for-input-accessing-filebeat-prospectors-1/271528 "2021-04-28T14:55:37Z")
PS C:\\Program Files\\Filebeat\> .\\filebeat.exe -e -v 2021-04-28T17:40:17.071+0300 INFO instance/beat.go:592 Home path: \[C:\\Program Files\\Filebeat\] Config path: \[C: Program Files\\Filebeat\] Data path: \[C:\\Program … --- ## [Redindex, version\_type external](https://discuss.elastic.co/t/redindex-version-type-external/271587)
**Author:** [@Kalpa](https://discuss.elastic.co/u/Kalpa)\ **Replies:** 4\ **Last updated:** [April 29, 2021, 8:42am UTC](https://discuss.elastic.co/t/redindex-version-type-external/271587 "2021-04-29T08:42:56Z")
HI All, Reindex can be done multiple times as per the documentation, during this phase, for example. reindexed at time 1. deleted some docs from the source added some docs to the source. reindex with version\_type ext… --- ## [Elasticsearch Disk indices storage greater than the indices used space](https://discuss.elastic.co/t/elasticsearch-disk-indices-storage-greater-than-the-indices-used-space/271328)
**Author:** [@Ahmed\_Abdulaleem](https://discuss.elastic.co/u/Ahmed_Abdulaleem)\ **Replies:** 4\ **Last updated:** [April 29, 2021, 8:07am UTC](https://discuss.elastic.co/t/elasticsearch-disk-indices-storage-greater-than-the-indices-used-space/271328 "2021-04-29T08:07:54Z")
I have an issue with disk space as the disk indices greater than size of index as shown in the attached file. can anyone help me to understand why the data much greater than actual index size as sum of storage o… --- ## [Filebeat Azure module not supporting geoip map visualisation](https://discuss.elastic.co/t/filebeat-azure-module-not-supporting-geoip-map-visualisation/271593)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 0\ **Last updated:** [April 29, 2021, 7:27am UTC](https://discuss.elastic.co/t/filebeat-azure-module-not-supporting-geoip-map-visualisation/271593 "2021-04-29T07:27:40Z")
I am working with custom index, I copied Filbeat ingest pipeline and just modified name to use for my custom index. When data loaded, I can see geoip lookup data but when I go to create map visualisation it doesn't suppo… --- ## [\[processors\] required property is missing](https://discuss.elastic.co/t/processors-required-property-is-missing/271554)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 6\ **Last updated:** [April 29, 2021, 7:17am UTC](https://discuss.elastic.co/t/processors-required-property-is-missing/271554 "2021-04-29T07:17:26Z")
I am creating a ingest pipeline for custom index for Azure activity log with same configurations it has for Filebeat index. I copied pipeline content from \_ingest/pipeline. Due to character limit, I am unable to paste th… --- ## [\[packetbeat\]The response time collected by packetbeat and the database table information collected by MySQL is incorrect](https://discuss.elastic.co/t/packetbeat-the-response-time-collected-by-packetbeat-and-the-database-table-information-collected-by-mysql-is-incorrect/271585)
**Author:** [@q729007453](https://discuss.elastic.co/u/q729007453)\ **Replies:** 2\ **Last updated:** [April 29, 2021, 7:10am UTC](https://discuss.elastic.co/t/packetbeat-the-response-time-collected-by-packetbeat-and-the-database-table-information-collected-by-mysql-is-incorrect/271585 "2021-04-29T07:10:09Z")
As the title， Among them, the end time is earlier than the start time, and event.duration cannot be captured. and path fetches incorrectly Publish event is as follows 2021-04-28T14:53:43.296+0800 DEBUG \[processors\] pr… --- ## [Sankey Chart](https://discuss.elastic.co/t/sankey-chart/270335)
**Author:** [@Ashvin\_Bhutekar](https://discuss.elastic.co/u/Ashvin_Bhutekar)\ **Replies:** 9\ **Last updated:** [April 29, 2021, 6:58am UTC](https://discuss.elastic.co/t/sankey-chart/270335 "2021-04-29T06:58:03Z")
Is it possible to create 4 level (or more ) sankey chart? --- ## [Index sorting causes illegal\_state\_exception](https://discuss.elastic.co/t/index-sorting-causes-illegal-state-exception/271592)
**Author:** [@buinauskas\_evaldas](https://discuss.elastic.co/u/buinauskas_evaldas)\ **Replies:** 0\ **Last updated:** [April 29, 2021, 6:23am UTC](https://discuss.elastic.co/t/index-sorting-causes-illegal-state-exception/271592 "2021-04-29T06:23:52Z")
Heavily inspired by the Introducing Index Sorting in Elasticsearch 6.0 | Elastic Blog article I went to try index sorting out for faster AND conjunctions. This is my index structure: { "index\_name": { "mappings":… --- ## [Elasticsearch SSL Configuration with existing certificate](https://discuss.elastic.co/t/elasticsearch-ssl-configuration-with-existing-certificate/271589)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 0\ **Last updated:** [April 29, 2021, 5:56am UTC](https://discuss.elastic.co/t/elasticsearch-ssl-configuration-with-existing-certificate/271589 "2021-04-29T05:56:35Z")
I'm trying to use my own company.cer file for elasticsearch's ssl configuration. However, I've failed with some cases. The first case, I use cer extension of the certificate file in below configuration xpack.security.… --- ## [Kibana 4 to 7 update](https://discuss.elastic.co/t/kibana-4-to-7-update/271072)
**Author:** [@cesar.hernandez.a3se](https://discuss.elastic.co/u/cesar.hernandez.a3se)\ **Replies:** 6\ **Last updated:** [April 29, 2021, 6:14am UTC](https://discuss.elastic.co/t/kibana-4-to-7-update/271072 "2021-04-29T06:14:29Z")
Hi I have a kibana 4.1.2 and I'm wondering if it's possible to update it right to the last kibana 7 version, or maybe I have to update first to an intermediate version (5, 6?) Thanks --- ## [Individual Tokens are not searched when a synonym rule is matched](https://discuss.elastic.co/t/individual-tokens-are-not-searched-when-a-synonym-rule-is-matched/270933)
**Author:** [@jacksumit](https://discuss.elastic.co/u/jacksumit)\ **Replies:** 4\ **Last updated:** [April 29, 2021, 4:50am UTC](https://discuss.elastic.co/t/individual-tokens-are-not-searched-when-a-synonym-rule-is-matched/270933 "2021-04-29T04:50:08Z")
Elasticsearch 7.10.2 Description: When using synonym\_graph filter, and if a synonym rule is matched, Elastic is not searching for individual tokens. I have defined below synonym rule. "synonyms": \[ … --- ## [How to List Indices based on their settings](https://discuss.elastic.co/t/how-to-list-indices-based-on-their-settings/271345)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 6\ **Last updated:** [April 29, 2021, 4:47am UTC](https://discuss.elastic.co/t/how-to-list-indices-based-on-their-settings/271345 "2021-04-29T04:47:01Z")
Hello Team I am using Elasticsearch 5.6.3 version. I know its old , we are in process of upgrading the cluster. I have a question , How to list Indexes which are having particular settings like : The ones which are ma… --- ## [Password policy configuration](https://discuss.elastic.co/t/password-policy-configuration/271531)
**Author:** [@nadia.a](https://discuss.elastic.co/u/nadia.a)\ **Replies:** 1\ **Last updated:** [April 29, 2021, 4:18am UTC](https://discuss.elastic.co/t/password-policy-configuration/271531 "2021-04-29T04:18:58Z")
Hello is there any advancement with the new release regarding password policy configuration? how is it possible today to enforce the password choice through kibana? Thank you for your answers --- ## [Sorting logevent datetime in asc order](https://discuss.elastic.co/t/sorting-logevent-datetime-in-asc-order/271532)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 1\ **Last updated:** [April 29, 2021, 3:57am UTC](https://discuss.elastic.co/t/sorting-logevent-datetime-in-asc-order/271532 "2021-04-29T03:57:27Z")
Hello Team, We have multiple logline for requestID & responseID. we need to identify which requestID & responseID come first and calculate difference between theses requestID time & responseID time. Request Log: OUT 2… --- ## [ELK 7.12 - ILM Rollover - After rollover data keeps being writing old index 000001](https://discuss.elastic.co/t/elk-7-12-ilm-rollover-after-rollover-data-keeps-being-writing-old-index-000001/271417)
**Author:** [@albertosoares](https://discuss.elastic.co/u/albertosoares)\ **Replies:** 5\ **Last updated:** [April 29, 2021, 3:27am UTC](https://discuss.elastic.co/t/elk-7-12-ilm-rollover-after-rollover-data-keeps-being-writing-old-index-000001/271417 "2021-04-29T03:27:49Z")
I am using logstash to centralize all logs from beats then send them to Elastisearch. I create all ILM policies, index templates, bootstrap each index, and everything goes perfect until rollover, the second index packetb… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1437) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1439)