# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1452

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1453

---

## [Kibana conflict type field](https://discuss.elastic.co/t/kibana-conflict-type-field/270667)

<div class="topic-metadata">

**Author:** [@Nazakat](https://discuss.elastic.co/u/Nazakat)\
**Replies:** 3\
**Last updated:** [April 21, 2021, 2:22pm UTC](https://discuss.elastic.co/t/kibana-conflict-type-field/270667 "2021-04-21T14:22:52Z")

</div>

How i can resolve this issues. Kibana field type conflict

---

## [( Kibana visualize ) A value greater than "Max axis extents" is not displayed with on Line chart](https://discuss.elastic.co/t/kibana-visualize-a-value-greater-than-max-axis-extents-is-not-displayed-with-on-line-chart/269202)

<div class="topic-metadata">

**Author:** [@kash203](https://discuss.elastic.co/u/kash203)\
**Replies:** 5\
**Last updated:** [April 21, 2021, 2:18pm UTC](https://discuss.elastic.co/t/kibana-visualize-a-value-greater-than-max-axis-extents-is-not-displayed-with-on-line-chart/269202 "2021-04-21T14:18:16Z")

</div>

When we update version of kibana from 7.11 to 7.12, a value greater than "Max axis extents(Y-axes)" is not displayed on Line chart of visualize. On prior to 7.11, When the value of the data exceeded "Max axis extents"…

---

## [Logstash json parsing](https://discuss.elastic.co/t/logstash-json-parsing/270851)

<div class="topic-metadata">

**Author:** [@Andrey\_RF](https://discuss.elastic.co/u/Andrey_RF)\
**Replies:** 1\
**Last updated:** [April 21, 2021, 2:01pm UTC](https://discuss.elastic.co/t/logstash-json-parsing/270851 "2021-04-21T14:01:52Z")

</div>

Hello. I have incoming JSON log. It has nested JSON. I want to parse main JSON and nested. Example: { "value": "123", "nested": { "value-two": "555" } } . I have a filter like this json { source =\> "messag…

---

## [Kibana Shards](https://discuss.elastic.co/t/kibana-shards/270835)

<div class="topic-metadata">

**Author:** [@sanketj1112](https://discuss.elastic.co/u/sanketj1112)\
**Replies:** 3\
**Last updated:** [April 21, 2021, 2:01pm UTC](https://discuss.elastic.co/t/kibana-shards/270835 "2021-04-21T14:01:09Z")

</div>

Currently I am using Kibana in AWS-Elasticsearch. Is there any chance while creating index I can change the default number of shards? Thanks.

---

## [Uploading csv file: Failed to parse date field dd/MM/yyyy HH:mm](https://discuss.elastic.co/t/uploading-csv-file-failed-to-parse-date-field-dd-mm-yyyy-hh-mm/270813)

<div class="topic-metadata">

**Author:** [@MARCO\_RAMBALDI](https://discuss.elastic.co/u/MARCO_RAMBALDI)\
**Replies:** 23\
**Last updated:** [April 21, 2021, 1:46pm UTC](https://discuss.elastic.co/t/uploading-csv-file-failed-to-parse-date-field-dd-mm-yyyy-hh-mm/270813 "2021-04-21T13:46:16Z")

</div>

Hi, I'm uploading a csv file (; as separator). I identified one of the columns as Machine Time. The format on excel is "customized" as seen in the image below: To parse the date as a date type on Elastic I used the …

---

## [Input controls don't work in embed or iframe mode](https://discuss.elastic.co/t/input-controls-dont-work-in-embed-or-iframe-mode/270848)

<div class="topic-metadata">

**Author:** [@BitBucketUser\_user](https://discuss.elastic.co/u/BitBucketUser_user)\
**Replies:** 1\
**Last updated:** [April 21, 2021, 1:36pm UTC](https://discuss.elastic.co/t/input-controls-dont-work-in-embed-or-iframe-mode/270848 "2021-04-21T13:36:02Z")

</div>

Hello, I recently upgraded Kibana from 7.8.1 to 7.12.0 version. I'm seeing this issue in the 7.12.0 version. When I try to use input controls on embedded dashboard, the controls don't work as expected.. Steps I follow…

---

## [Metricbeat unable to connect to MongoDB using SCRAM-SHA-256](https://discuss.elastic.co/t/metricbeat-unable-to-connect-to-mongodb-using-scram-sha-256/270849)

<div class="topic-metadata">

**Author:** [@lchdev](https://discuss.elastic.co/u/lchdev)\
**Replies:** 0\
**Last updated:** [April 21, 2021, 1:34pm UTC](https://discuss.elastic.co/t/metricbeat-unable-to-connect-to-mongodb-using-scram-sha-256/270849 "2021-04-21T13:34:14Z")

</div>

Hello ! Metricbeat relies on the community GO driver to connect to a MongoDB cluster. This driver is quite old and has been replaced by an official driver. Since it is now unmaintained, it has not received any updates …

---

## [Why does filebeat create dashboards for disabled modules?](https://discuss.elastic.co/t/why-does-filebeat-create-dashboards-for-disabled-modules/270840)

<div class="topic-metadata">

**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\
**Replies:** 2\
**Last updated:** [April 21, 2021, 12:55pm UTC](https://discuss.elastic.co/t/why-does-filebeat-create-dashboards-for-disabled-modules/270840 "2021-04-21T12:55:08Z")

</div>

I recently installed filebeat to monitor and ship my nginx logs. I followed the setup instructions, and included the setup.kibana config details because I wanted the nginx dashboards. However, when running setup filebe…

---

## [File paths must be absolute, relative path specified error while running logstash on docker](https://discuss.elastic.co/t/file-paths-must-be-absolute-relative-path-specified-error-while-running-logstash-on-docker/270704)

<div class="topic-metadata">

**Author:** [@pradeep\_gadkari](https://discuss.elastic.co/u/pradeep_gadkari)\
**Replies:** 2\
**Last updated:** [April 21, 2021, 12:40pm UTC](https://discuss.elastic.co/t/file-paths-must-be-absolute-relative-path-specified-error-while-running-logstash-on-docker/270704 "2021-04-21T12:40:59Z")

</div>

I am running ELK stack on docker using deviantony/docker-elk from Github. When I try reading log files from my local machine, logstash stops with error \[2021-04-20T12:36:43,101\]\[ERROR\]\[logstash.javapipeline \]\[main\] Pipe…

---

## [How to triggered mail in watcher if two alphanumeric key difference is more than 2 sec](https://discuss.elastic.co/t/how-to-triggered-mail-in-watcher-if-two-alphanumeric-key-difference-is-more-than-2-sec/270838)

<div class="topic-metadata">

**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\
**Replies:** 0\
**Last updated:** [April 21, 2021, 12:34pm UTC](https://discuss.elastic.co/t/how-to-triggered-mail-in-watcher-if-two-alphanumeric-key-difference-is-more-than-2-sec/270838 "2021-04-21T12:34:31Z")

</div>

Hello all, PFB two log lines: \[0915adf2-ff62-421e-97a8-0a00cbb7df7f\] \[07:53:43 Information\] SpotQuote Response "ResponseId":"5679ty678" \[0915adf2-ff62-421e-97a8-0a00cbb7df7f\] \[07:53:41 Information\] SpotQuote Request "R…

---

## [Create instance of elasticsearch](https://discuss.elastic.co/t/create-instance-of-elasticsearch/270831)

<div class="topic-metadata">

**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\
**Replies:** 6\
**Last updated:** [April 21, 2021, 12:14pm UTC](https://discuss.elastic.co/t/create-instance-of-elasticsearch/270831 "2021-04-21T12:14:49Z")

</div>

Hi I have a cluster with 4 nodes of Elasticsearch. 2 of them are in datacenter A and the other 2 are in datacenter B Here is my concern: I want to run an instance of each node in another datacenter. For example node1 …

---

## [Data too large circuit breaking exception after migrating to 7.12](https://discuss.elastic.co/t/data-too-large-circuit-breaking-exception-after-migrating-to-7-12/269029)

<div class="topic-metadata">

**Author:** [@voharunado](https://discuss.elastic.co/u/voharunado)\
**Replies:** 3\
**Last updated:** [April 21, 2021, 12:10pm UTC](https://discuss.elastic.co/t/data-too-large-circuit-breaking-exception-after-migrating-to-7-12/269029 "2021-04-21T12:10:45Z")

</div>

Hello, We have just migrated our cluster from 6.8 to 7.12 and just noticed some recurring errors during intensive parallel indexations. Here is the kind of error we have: \[parent\] Data too large, data for \[\<http\_reque…

---

## [Elasticsearch Visualization Search error with empty response](https://discuss.elastic.co/t/elasticsearch-visualization-search-error-with-empty-response/270706)

<div class="topic-metadata">

**Author:** [@Kuo\_Hugo](https://discuss.elastic.co/u/Kuo_Hugo)\
**Replies:** 4\
**Last updated:** [April 21, 2021, 11:38am UTC](https://discuss.elastic.co/t/elasticsearch-visualization-search-error-with-empty-response/270706 "2021-04-21T11:38:03Z")

</div>

The batch query for rendering a visualization from the search programname:"proxy-server" AND status\_int:\[200 TO 299\] and request\_method:GET . The search works fine even with 7days period. But the visualization as below a…

---

## [Collapse with multi value](https://discuss.elastic.co/t/collapse-with-multi-value/270437)

<div class="topic-metadata">

**Author:** [@arcturuscom](https://discuss.elastic.co/u/arcturuscom)\
**Replies:** 13\
**Last updated:** [April 21, 2021, 11:15am UTC](https://discuss.elastic.co/t/collapse-with-multi-value/270437 "2021-04-21T11:15:16Z")

</div>

Hello, i tried to collapse multivalued field and its doesnt work e.g: "field": \[id1, id2, id3\] i'm asking if there's a workaround to solve this issue. any suggestions please !!

---

## [Cluster Monitoring Error 7.12.0](https://discuss.elastic.co/t/cluster-monitoring-error-7-12-0/270822)

<div class="topic-metadata">

**Author:** [@spike83](https://discuss.elastic.co/u/spike83)\
**Replies:** 1\
**Last updated:** [April 21, 2021, 11:02am UTC](https://discuss.elastic.co/t/cluster-monitoring-error-7-12-0/270822 "2021-04-21T11:02:52Z")

</div>

Hi, I'm in the process of a rolling upgrade from 7.10.0 to 7.12.0 my process is to drop an ELS server from the cluster, and bring up a new blank one on the latest version and let it reassign the shards. During this pro…

---

## ["reason"=\>"object mapping for \[host\] tried to parse field \[host\] as object, but found a concrete value"](https://discuss.elastic.co/t/reason-object-mapping-for-host-tried-to-parse-field-host-as-object-but-found-a-concrete-value/270790)

<div class="topic-metadata">

**Author:** [@BlackCat](https://discuss.elastic.co/u/BlackCat)\
**Replies:** 5\
**Last updated:** [April 21, 2021, 10:09am UTC](https://discuss.elastic.co/t/reason-object-mapping-for-host-tried-to-parse-field-host-as-object-but-found-a-concrete-value/270790 "2021-04-21T10:09:36Z")

</div>

Please how to do resolve. Logstash outputs below error log. \[2021-04-21T15:31:47,803\]\[WARN \]\[logstash.outputs.elasticsearch\]\[＜pipeline.id＞\]\[b0981f4f69ba05c595e4bfce70b5e813c0b082207400c67bd72b366d2d36ba65\] Could not in…

---

## [Logstash installed on Windows based container using zip download. Not running using bin/logstash -f logstash.conf](https://discuss.elastic.co/t/logstash-installed-on-windows-based-container-using-zip-download-not-running-using-bin-logstash-f-logstash-conf/270816)

<div class="topic-metadata">

**Author:** [@omkarg81](https://discuss.elastic.co/u/omkarg81)\
**Replies:** 0\
**Last updated:** [April 21, 2021, 9:46am UTC](https://discuss.elastic.co/t/logstash-installed-on-windows-based-container-using-zip-download-not-running-using-bin-logstash-f-logstash-conf/270816 "2021-04-21T09:46:55Z")

</div>

Looking at the Logstash docker images, I went ahead and created a custom image, including base .net framework and adding the logstash installation folder to it, by virtue of downloading the zip file, extracting it and cu…

---

## [Logstash fails with not an SSL/TLS record](https://discuss.elastic.co/t/logstash-fails-with-not-an-ssl-tls-record/270812)

<div class="topic-metadata">

**Author:** [@Enrique\_Pedroza](https://discuss.elastic.co/u/Enrique_Pedroza)\
**Replies:** 0\
**Last updated:** [April 21, 2021, 9:20am UTC](https://discuss.elastic.co/t/logstash-fails-with-not-an-ssl-tls-record/270812 "2021-04-21T09:20:49Z")

</div>

I'm running Logstash with Elasticsearch and Kibana, and all configuration setted up. The problem is that the services is giving the following error \[2021-04-21T10:08:56,344\]\[INFO \]\[org.logstash.beats.BeatsHandler\]\[main\]…

---

## [Kibana field is not show on Visualization](https://discuss.elastic.co/t/kibana-field-is-not-show-on-visualization/270789)

<div class="topic-metadata">

**Author:** [@Nazakat](https://discuss.elastic.co/u/Nazakat)\
**Replies:** 7\
**Last updated:** [April 21, 2021, 9:07am UTC](https://discuss.elastic.co/t/kibana-field-is-not-show-on-visualization/270789 "2021-04-21T09:07:03Z")

</div>

Kibana field is show on discover. But It not show create visualization This is my discover page This i create visualization

---

## [Stop the search request once it finds first 10 hits](https://discuss.elastic.co/t/stop-the-search-request-once-it-finds-first-10-hits/270783)

<div class="topic-metadata">

**Author:** [@DEEPTHI\_SONA\_G](https://discuss.elastic.co/u/DEEPTHI_SONA_G)\
**Replies:** 8\
**Last updated:** [April 21, 2021, 9:02am UTC](https://discuss.elastic.co/t/stop-the-search-request-once-it-finds-first-10-hits/270783 "2021-04-21T09:02:35Z")

</div>

I am doing some performance testing on Elasticsearch. So I am comparing Oracle db with Elasticsearch. The Oracle query is able to stop it's search once it finds the first 10matches by using the code select \* from mtd\_s…

---

## [Metricbeat - no counter paths were found](https://discuss.elastic.co/t/metricbeat-no-counter-paths-were-found/270166)

<div class="topic-metadata">

**Author:** [@Inammathe\_Inna](https://discuss.elastic.co/u/Inammathe_Inna)\
**Replies:** 1\
**Last updated:** [April 21, 2021, 8:42am UTC](https://discuss.elastic.co/t/metricbeat-no-counter-paths-were-found/270166 "2021-04-21T08:42:59Z")

</div>

Hi, Periodically, we are finding our Windows servers stop sending perfmon metrics (other metrics e.g. cpu from the system module) continue just fine. The current workaround that gets them going again is restarting the …

---

## [Logstash throws out 'Host name does not match the certificate subject provided by the peer' error](https://discuss.elastic.co/t/logstash-throws-out-host-name-does-not-match-the-certificate-subject-provided-by-the-peer-error/270622)

<div class="topic-metadata">

**Author:** [@arunhk3](https://discuss.elastic.co/u/arunhk3)\
**Replies:** 2\
**Last updated:** [April 21, 2021, 8:11am UTC](https://discuss.elastic.co/t/logstash-throws-out-host-name-does-not-match-the-certificate-subject-provided-by-the-peer-error/270622 "2021-04-21T08:11:25Z")

</div>

Hi All, I recently installed a three-node cluster in a vagrant box to test out the security features of Elasticsearch: I followed the guides in the below order: Set up basic security for the Elastic Stack | Elasticse…

---

## [Kibana transform latest continously not updating](https://discuss.elastic.co/t/kibana-transform-latest-continously-not-updating/268739)

<div class="topic-metadata">

**Author:** [@charles97](https://discuss.elastic.co/u/charles97)\
**Replies:** 2\
**Last updated:** [April 21, 2021, 7:50am UTC](https://discuss.elastic.co/t/kibana-transform-latest-continously-not-updating/268739 "2021-04-21T07:50:07Z")

</div>

Hi everyone, so I'm trying on the latest transform. I have 3 files. Those are: name, status, tgl. I will ingest data1 and data2 at the same time to index transformtest then I will create transformation index transfor…

---

## [Elastic Slack Configuration for 6.5.4 version on Kubernetes](https://discuss.elastic.co/t/elastic-slack-configuration-for-6-5-4-version-on-kubernetes/270198)

<div class="topic-metadata">

**Author:** [@SukeshGupta](https://discuss.elastic.co/u/SukeshGupta)\
**Replies:** 2\
**Last updated:** [April 21, 2021, 7:37am UTC](https://discuss.elastic.co/t/elastic-slack-configuration-for-6-5-4-version-on-kubernetes/270198 "2021-04-21T07:37:48Z")

</div>

Hello Team, We are trying to configure slack for sending alerts. But its throwing errors. Elastic Version - 6.5.4 Our Elastic Service is deployed via Kubernetes. Please find the slack configuration below : xpack.not…

---

## [Change date format in timepicker from 24 hr to 12 hour](https://discuss.elastic.co/t/change-date-format-in-timepicker-from-24-hr-to-12-hour/270108)

<div class="topic-metadata">

**Author:** [@fidsamurai](https://discuss.elastic.co/u/fidsamurai)\
**Replies:** 5\
**Last updated:** [April 21, 2021, 6:41am UTC](https://discuss.elastic.co/t/change-date-format-in-timepicker-from-24-hr-to-12-hour/270108 "2021-04-21T06:41:53Z")

</div>

Hi, I would like to change the time format in the date-picker in Discover, Visualizations and Dashboards from 24 hours to 12 hours eg. currently it's 15:30 16:00.... I would like it to show as 3:30 pm 4:00pm. Could som…

---

## [Clickeable element and filter accordingly](https://discuss.elastic.co/t/clickeable-element-and-filter-accordingly/270775)

<div class="topic-metadata">

**Author:** [@glitz](https://discuss.elastic.co/u/glitz)\
**Replies:** 1\
**Last updated:** [April 21, 2021, 4:56am UTC](https://discuss.elastic.co/t/clickeable-element-and-filter-accordingly/270775 "2021-04-21T04:56:30Z")

</div>

Hello, I have tried without success to make a canvas that in first page have some data, let's say a pie with 3 subnet ranges, and if a click any of them it brings me to a second page with the details of every ip within c…

---

## [Kibana 7.12 nginx reverse proxy, docker compose](https://discuss.elastic.co/t/kibana-7-12-nginx-reverse-proxy-docker-compose/270776)

<div class="topic-metadata">

**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\
**Replies:** 1\
**Last updated:** [April 21, 2021, 4:36am UTC](https://discuss.elastic.co/t/kibana-7-12-nginx-reverse-proxy-docker-compose/270776 "2021-04-21T04:36:46Z")

</div>

Hi Im trying to use nginx as a reverse proxy for kibana but I can make it work, this is my kibana.yml server.name: kibana server.host: "localhost" elasticsearch.hosts: \[ "https://elasticsearch:9200" \] elasticsearch.user…

---

## [The issue of tcp connection of logstash](https://discuss.elastic.co/t/the-issue-of-tcp-connection-of-logstash/270780)

<div class="topic-metadata">

**Author:** [@iammanmale](https://discuss.elastic.co/u/iammanmale)\
**Replies:** 0\
**Last updated:** [April 21, 2021, 3:27am UTC](https://discuss.elastic.co/t/the-issue-of-tcp-connection-of-logstash/270780 "2021-04-21T03:27:49Z")

</div>

It seems to me that the limit of the no of tcp connection of logstash is about 110. If the no of connection is more than 110, filebeat will show something like handshake.....ERROR...i/o timeout when running test output c…

---

## [Hot-warm search question](https://discuss.elastic.co/t/hot-warm-search-question/270778)

<div class="topic-metadata">

**Author:** [@abhishekc92](https://discuss.elastic.co/u/abhishekc92)\
**Replies:** 2\
**Last updated:** [April 21, 2021, 2:26am UTC](https://discuss.elastic.co/t/hot-warm-search-question/270778 "2021-04-21T02:26:53Z")

</div>

Hi, I have a pretty basic question around how search functions under the hood. I am evaluating a hot-warm architecture on aws (SSD, S3 backed respectively). Our use case is such that some searches may have to be issued a…

---

## [Group records by geo-location on Maps](https://discuss.elastic.co/t/group-records-by-geo-location-on-maps/270759)

<div class="topic-metadata">

**Author:** [@tshayan](https://discuss.elastic.co/u/tshayan)\
**Replies:** 1\
**Last updated:** [April 21, 2021, 2:05am UTC](https://discuss.elastic.co/t/group-records-by-geo-location-on-maps/270759 "2021-04-21T02:05:11Z")

</div>

I'm wondering if it is possible to group all records that have the same geo-location on the map? For instance I have 10 records with geo\_location { "lon": "-75.9247", "lat": "44.5299" } but they show up as 10 separate do…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1451)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1453)
