# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1453 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1454 --- ## [Filebeat Netflow Module || Kibana Dashboard Extremly Slow](https://discuss.elastic.co/t/filebeat-netflow-module-kibana-dashboard-extremly-slow/269926)
**Author:** [@albertosoares](https://discuss.elastic.co/u/albertosoares)\ **Replies:** 6\ **Last updated:** [April 21, 2021, 1:18am UTC](https://discuss.elastic.co/t/filebeat-netflow-module-kibana-dashboard-extremly-slow/269926 "2021-04-21T01:18:16Z")
I've deployed the Netflow module and when I go to the Filebeat Netflow Dashboards and I query for 24 hours, today or 4 hours the query is extremely slow. Environment ELK 7.12 3 data nodes (12 vCPU, 10 RAM -Xms5g m / -… --- ## [Supporting very high number of query terms a good idea?](https://discuss.elastic.co/t/supporting-very-high-number-of-query-terms-a-good-idea/270771)
**Author:** [@elastic\_yogi](https://discuss.elastic.co/u/elastic_yogi)\ **Replies:** 1\ **Last updated:** [April 20, 2021, 11:07pm UTC](https://discuss.elastic.co/t/supporting-very-high-number-of-query-terms-a-good-idea/270771 "2021-04-20T23:07:24Z")
We have a postgres table with nearly a million rows that we index into elasticsearch. We want to support a specific use case of allowing a user to copy and paste nearly 10k unique identifiers to filter for specific entri… --- ## [Elasticsearch using more RAM](https://discuss.elastic.co/t/elasticsearch-using-more-ram/270669)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 1\ **Last updated:** [April 20, 2021, 10:56pm UTC](https://discuss.elastic.co/t/elasticsearch-using-more-ram/270669 "2021-04-20T22:56:49Z")
my /etc/elasticsearch/jvm.options is : ## JVM configuration ################################################################ ## IMPORTANT: JVM heap size ################################################################ … --- ## [ServiceNow connector - alerts and actions, missing fields](https://discuss.elastic.co/t/servicenow-connector-alerts-and-actions-missing-fields/270576)
**Author:** [@nekirc](https://discuss.elastic.co/u/nekirc)\ **Replies:** 1\ **Last updated:** [April 20, 2021, 10:55pm UTC](https://discuss.elastic.co/t/servicenow-connector-alerts-and-actions-missing-fields/270576 "2021-04-20T22:55:58Z")
Hi, is there any chance to add some additional fields to ServiceNow connector in Alerts and Actions tab in the next Elastic version ? Would be good to have possibility to put information to below fields: Company Serv… --- ## [Logviewing - Filebeat](https://discuss.elastic.co/t/logviewing-filebeat/270758)
**Author:** [@Akhil2610](https://discuss.elastic.co/u/Akhil2610)\ **Replies:** 0\ **Last updated:** [April 20, 2021, 7:50pm UTC](https://discuss.elastic.co/t/logviewing-filebeat/270758 "2021-04-20T19:50:06Z")
Hello everyone, Hope you are doing well! I am exploring the possibilities of log viewing through Kibana. I am new to ELK so pardon me for asking dumb questions. I am using version 7.9.2 for ELK and filebeat as well. so… --- ## [Putting mass archived log files to Elasticsearch using Filebeat](https://discuss.elastic.co/t/putting-mass-archived-log-files-to-elasticsearch-using-filebeat/270441)
**Author:** [@h8h](https://discuss.elastic.co/u/h8h)\ **Replies:** 2\ **Last updated:** [April 20, 2021, 7:29pm UTC](https://discuss.elastic.co/t/putting-mass-archived-log-files-to-elasticsearch-using-filebeat/270441 "2021-04-20T19:29:51Z")
Hello, I am working in forensics and have a lot of log files, each 100MB in size. I feel very uncomfortable using filebeat because it throws a lot of "too many open files" errors. I am not sure if every file is being p… --- ## [Autodiscover on ECK not harvesting logs](https://discuss.elastic.co/t/autodiscover-on-eck-not-harvesting-logs/270750)
**Author:** [@twiggy](https://discuss.elastic.co/u/twiggy)\ **Replies:** 0\ **Last updated:** [April 20, 2021, 6:30pm UTC](https://discuss.elastic.co/t/autodiscover-on-eck-not-harvesting-logs/270750 "2021-04-20T18:30:28Z")
Hello everyone, I'm trying to implement autodiscover with filebeat using ECK. Basic feature at the moment, using : config: filebeat.autodiscover: providers: - type: kubernetes … --- ## [Multiple group\_search.base\_dn for one LDAP/AD](https://discuss.elastic.co/t/multiple-group-search-base-dn-for-one-ldap-ad/270746)
**Author:** [@ctan](https://discuss.elastic.co/u/ctan)\ **Replies:** 1\ **Last updated:** [April 20, 2021, 6:07pm UTC](https://discuss.elastic.co/t/multiple-group-search-base-dn-for-one-ldap-ad/270746 "2021-04-20T18:07:44Z")
We have two spots for groups to reside inside of AD, which are not children of the same folders (but in the same domain). I am looking for a way to have ES search them both to get the group membership, while not travers… --- ## [Hive overwhelming Elasticsearch](https://discuss.elastic.co/t/hive-overwhelming-elasticsearch/269930)
**Author:** [@albertkohl](https://discuss.elastic.co/u/albertkohl)\ **Replies:** 23\ **Last updated:** [April 20, 2021, 5:57pm UTC](https://discuss.elastic.co/t/hive-overwhelming-elasticsearch/269930 "2021-04-20T17:57:46Z")
i'm new to ES so bare with me :slight\_smile: i have a hadoop cluster running hive, and i have a table of about 441 million rows, 10 columns wide (string and bigint) i setup an external table in hive, created an index i… --- ## [Reindex API from remote server](https://discuss.elastic.co/t/reindex-api-from-remote-server/270743)
**Author:** [@cool\_aarti2](https://discuss.elastic.co/u/cool_aarti2)\ **Replies:** 0\ **Last updated:** [April 20, 2021, 4:43pm UTC](https://discuss.elastic.co/t/reindex-api-from-remote-server/270743 "2021-04-20T16:43:31Z")
Hi, We have a remote server which have some elastic indices. I would like to reindex the data from this server onto another. But I am getting the error: "type": "s\_s\_l\_handshake\_exception", "reason": "PKIX path build… --- ## [Formatdate markdown content](https://discuss.elastic.co/t/formatdate-markdown-content/270585)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 5\ **Last updated:** [April 20, 2021, 4:06pm UTC](https://discuss.elastic.co/t/formatdate-markdown-content/270585 "2021-04-20T16:06:23Z")
Hi, I have a markdown content in Canvas like this: {{#each rows}} ### {{date}} ### {{/each}} where date is, for example: 2021-04-19T13:25:00+02:00 how can i format this date (d/m/y hh:mm) and set the local timezone? … --- ## [Custom index filter](https://discuss.elastic.co/t/custom-index-filter/270714)
**Author:** [@ARDiver86](https://discuss.elastic.co/u/ARDiver86)\ **Replies:** 1\ **Last updated:** [April 20, 2021, 3:39pm UTC](https://discuss.elastic.co/t/custom-index-filter/270714 "2021-04-20T15:39:49Z")
I am attempting to put specific messages from sysmon into their own index so I can apply a separate lifecycle policy to them. I thought I had this policy correct but it does not seem to be working properly. The query I … --- ## [Exception : No alive nodes found in your cluster](https://discuss.elastic.co/t/exception-no-alive-nodes-found-in-your-cluster/270739)
**Author:** [@Erik\_Gevorgyan](https://discuss.elastic.co/u/Erik_Gevorgyan)\ **Replies:** 0\ **Last updated:** [April 20, 2021, 3:20pm UTC](https://discuss.elastic.co/t/exception-no-alive-nodes-found-in-your-cluster/270739 "2021-04-20T15:20:30Z")
Hi everyone, i have an issue according to elasticsearch , i am running this code php artisan index:ambassadors and it gives me Exception : No alive nodes found in your cluster here is my output Exception : No ali… --- ## [Cluster doesn't respect routing.allocation.require.data\_type](https://discuss.elastic.co/t/cluster-doesnt-respect-routing-allocation-require-data-type/270700)
**Author:** [@gorek](https://discuss.elastic.co/u/gorek)\ **Replies:** 1\ **Last updated:** [April 20, 2021, 3:11pm UTC](https://discuss.elastic.co/t/cluster-doesnt-respect-routing-allocation-require-data-type/270700 "2021-04-20T15:11:59Z")
Hi, we have cluster with 2 nodes. Every node has set data\_type attribute. One node has low disk watermark exceed. We prepared ILM policy to keep indices on one node for some time and after move it to another. Rarely … --- ## [Reverse proxy - Webseal](https://discuss.elastic.co/t/reverse-proxy-webseal/270737)
**Author:** [@kvmuralidhar](https://discuss.elastic.co/u/kvmuralidhar)\ **Replies:** 0\ **Last updated:** [April 20, 2021, 3:11pm UTC](https://discuss.elastic.co/t/reverse-proxy-webseal/270737 "2021-04-20T15:11:45Z")
Hi there, Has anyone integrated webseal (IBM Tivoli Access Manager) as reverse proxy to log into Kibana ? Thanks Murali --- ## [Prometheus Federation Metricbeat - No index and document in ES](https://discuss.elastic.co/t/prometheus-federation-metricbeat-no-index-and-document-in-es/270726)
**Author:** [@dekim](https://discuss.elastic.co/u/dekim)\ **Replies:** 0\ **Last updated:** [April 20, 2021, 2:11pm UTC](https://discuss.elastic.co/t/prometheus-federation-metricbeat-no-index-and-document-in-es/270726 "2021-04-20T14:11:14Z")
Hello, We currently have a Kubernetes cluster that has a Prometheus Installation. I'm looking to export the Prometheus gathered metrics to Elastic so we can create Kibana dashboard; using the Federation approach (so we… --- ## [Diagnosing slow dashboard/Viz performance in elastic cloud](https://discuss.elastic.co/t/diagnosing-slow-dashboard-viz-performance-in-elastic-cloud/270158)
**Author:** [@johnwood](https://discuss.elastic.co/u/johnwood)\ **Replies:** 8\ **Last updated:** [April 20, 2021, 2:41pm UTC](https://discuss.elastic.co/t/diagnosing-slow-dashboard-viz-performance-in-elastic-cloud/270158 "2021-04-20T14:41:43Z")
Hi - I am looking for some pointers or starting places to diagnose our slow dashboards. If I look at a visualization (they are all 'slow' to render in kibana) by going to inspect\>request\>statistics I see two timing numb… --- ## [Surprised by deprecation of common\_terms query. What about its relevance features?](https://discuss.elastic.co/t/surprised-by-deprecation-of-common-terms-query-what-about-its-relevance-features/270416)
**Author:** [@softwaredoug](https://discuss.elastic.co/u/softwaredoug)\ **Replies:** 4\ **Last updated:** [April 20, 2021, 2:21pm UTC](https://discuss.elastic.co/t/surprised-by-deprecation-of-common-terms-query-what-about-its-relevance-features/270416 "2021-04-20T14:21:00Z")
Hi all, I was actually excited to dig into an experiment at work using the common terms query. I see however, it's been deprecated as the performance benefits are seen now in the match query, as mentioned in this issue. … --- ## [Secure access to data via NEST](https://discuss.elastic.co/t/secure-access-to-data-via-nest/270724)
**Author:** [@joaoantao](https://discuss.elastic.co/u/joaoantao)\ **Replies:** 0\ **Last updated:** [April 20, 2021, 2:06pm UTC](https://discuss.elastic.co/t/secure-access-to-data-via-nest/270724 "2021-04-20T14:06:14Z")
Currently, I am working with large indexes that contain hierarchical documents. I am trying to restrict read access to some documents (document level security) and certain fields (field level security) of those documents… --- ## [Sorting in KQL](https://discuss.elastic.co/t/sorting-in-kql/270711)
**Author:** [@mortenb123](https://discuss.elastic.co/u/mortenb123)\ **Replies:** 2\ **Last updated:** [April 20, 2021, 2:08pm UTC](https://discuss.elastic.co/t/sorting-in-kql/270711 "2021-04-20T14:08:00Z")
Hi, I know I can sort in Elastic api and in kibana, but now I have to use an api which only have KQL input which it encodes in base64 and send to elasticsearch. (external service) I've tried all instances of id: desc\`\`s… --- ## [One elastic node fills up prior to the others?](https://discuss.elastic.co/t/one-elastic-node-fills-up-prior-to-the-others/269276)
**Author:** [@Jcroy](https://discuss.elastic.co/u/Jcroy)\ **Replies:** 13\ **Last updated:** [April 20, 2021, 1:48pm UTC](https://discuss.elastic.co/t/one-elastic-node-fills-up-prior-to-the-others/269276 "2021-04-20T13:48:39Z")
Am I missing a policy or something? I have a 8 node cluster. 3k Winlogbeat agents reporting in. I ran winlogbeat setup -e to get the template installed. I've reviewed logs and nothing related to allocation seems to be in… --- ## [Multiple sheets in Kibana Table](https://discuss.elastic.co/t/multiple-sheets-in-kibana-table/270702)
**Author:** [@Vivekks](https://discuss.elastic.co/u/Vivekks)\ **Replies:** 1\ **Last updated:** [April 20, 2021, 1:48pm UTC](https://discuss.elastic.co/t/multiple-sheets-in-kibana-table/270702 "2021-04-20T13:48:22Z")
Hi, I'm new to Kibana I want to create multiple sheets in Kibana table just like in excel sheet. Is it possible in Kibana ? --- ## [Keep active index while deleting old indices with ILM](https://discuss.elastic.co/t/keep-active-index-while-deleting-old-indices-with-ilm/270119)
**Author:** [@Nexonus](https://discuss.elastic.co/u/Nexonus)\ **Replies:** 5\ **Last updated:** [April 20, 2021, 1:46pm UTC](https://discuss.elastic.co/t/keep-active-index-while-deleting-old-indices-with-ilm/270119 "2021-04-20T13:46:04Z")
We rebuild the same index regularly (multiple times per day) to keep our data up to date. This way we quickly generate a lot of old indices. So we thought about removing them with a policy (ILM) which deletes old indice… --- ## [Ignore a specific or drop a field when using another Grok Pattern](https://discuss.elastic.co/t/ignore-a-specific-or-drop-a-field-when-using-another-grok-pattern/270522)
**Author:** [@Wilks](https://discuss.elastic.co/u/Wilks)\ **Replies:** 3\ **Last updated:** [April 20, 2021, 1:35pm UTC](https://discuss.elastic.co/t/ignore-a-specific-or-drop-a-field-when-using-another-grok-pattern/270522 "2021-04-20T13:35:14Z")
HI, I have a filter that works except for when the log doesn't contains different data for a field that I am using an extra grok pattern on. I am extracting the username from DN (Distinguished Name) from the main log a… --- ## [Add new field in existing index and template](https://discuss.elastic.co/t/add-new-field-in-existing-index-and-template/270679)
**Author:** [@niraj\_pandey](https://discuss.elastic.co/u/niraj_pandey)\ **Replies:** 6\ **Last updated:** [April 20, 2021, 1:10pm UTC](https://discuss.elastic.co/t/add-new-field-in-existing-index-and-template/270679 "2021-04-20T13:10:59Z")
Hi, I want to add an new field in exiting index and corresponding to it's template. Could you pls help me on this ? This is current template: curl -XPUT 'vl-dev01:9200/\_template/latesttmpl-farm-qusage-mon?pretty' -H … --- ## [Logstash jdbc\_streaming filter pipeline reload and database access](https://discuss.elastic.co/t/logstash-jdbc-streaming-filter-pipeline-reload-and-database-access/270619)
**Author:** [@rverchere](https://discuss.elastic.co/u/rverchere)\ **Replies:** 2\ **Last updated:** [April 20, 2021, 11:56am UTC](https://discuss.elastic.co/t/logstash-jdbc-streaming-filter-pipeline-reload-and-database-access/270619 "2021-04-20T11:56:05Z")
Hello, I'm using logstash with the jdbc\_streaming filter, that connects to an external MariaDB database. When I stop and restart the database, the pipeline using the jdbc\_streaming filter fails, and there is no automat… --- ## [S3SNSSQS Plugin input](https://discuss.elastic.co/t/s3snssqs-plugin-input/270696)
**Author:** [@mjuras](https://discuss.elastic.co/u/mjuras)\ **Replies:** 0\ **Last updated:** [April 20, 2021, 11:38am UTC](https://discuss.elastic.co/t/s3snssqs-plugin-input/270696 "2021-04-20T11:38:31Z")
Hi I've switched the input for my logs to use the logstash-input-s3-sns-sqs plugin instead of the S3 plugin, but seem to be having an issue with the input with one of the logs. Input: input { s3snssqs { reg… --- ## [Processor for windows logs](https://discuss.elastic.co/t/processor-for-windows-logs/270695)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 0\ **Last updated:** [April 20, 2021, 11:37am UTC](https://discuss.elastic.co/t/processor-for-windows-logs/270695 "2021-04-20T11:37:38Z")
hi there if somebody can help me to find a filter for windows logs with ECS 1.7.0 thanks --- ## [Pluggin securyti java](https://discuss.elastic.co/t/pluggin-securyti-java/269030)
**Author:** [@Alder](https://discuss.elastic.co/u/Alder)\ **Replies:** 5\ **Last updated:** [April 20, 2021, 11:07am UTC](https://discuss.elastic.co/t/pluggin-securyti-java/269030 "2021-04-20T11:07:12Z")
Hello everyone from elastic I have difficulties in java security to connect to the MSSQLServer database I have already edited the plugin-security.policy \[1\] and performed the installation \[2\], but the error \[3\] occurs … --- ## [Metricbeat dashboard strange behaviour](https://discuss.elastic.co/t/metricbeat-dashboard-strange-behaviour/267401)
**Author:** [@alfredo.deluca](https://discuss.elastic.co/u/alfredo.deluca)\ **Replies:** 8\ **Last updated:** [April 20, 2021, 11:01am UTC](https://discuss.elastic.co/t/metricbeat-dashboard-strange-behaviour/267401 "2021-04-20T11:01:11Z")
Hi all. I am using elastic.co cloud 7.11.1 and I have 2 different metricbeat sitting in 2 different k8s clusters sending all the metrics to ELK. The first one works fine and I can see all the metrics in kibana but when… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1452) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1454)