# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1461 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1462 --- ## [Docker container to build plugins](https://discuss.elastic.co/t/docker-container-to-build-plugins/270159)
**Author:** [@padakwaak](https://discuss.elastic.co/u/padakwaak)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 11:37am UTC](https://discuss.elastic.co/t/docker-container-to-build-plugins/270159 "2021-04-15T11:37:41Z")
Hi, I'm not a Ruby/JRuby programmer and I find it quite difficult to get all the necessary build tools in place to build and test my modifications that I'm doing to some of the existing Logstash plugins. Another user c… --- ## [Rename field name in saved search](https://discuss.elastic.co/t/rename-field-name-in-saved-search/270205)
**Author:** [@thenoobert](https://discuss.elastic.co/u/thenoobert)\ **Replies:** 3\ **Last updated:** [April 15, 2021, 11:37am UTC](https://discuss.elastic.co/t/rename-field-name-in-saved-search/270205 "2021-04-15T11:37:20Z")
Hi, I am currently trying to visualize a result based on saved search. However, the result field name is too distracting/displeasing so would like to rename it to something simple. I know this can be achieved through da… --- ## [Logstash Avro Codec non-base64 support](https://discuss.elastic.co/t/logstash-avro-codec-non-base64-support/270225)
**Author:** [@th0ger](https://discuss.elastic.co/u/th0ger)\ **Replies:** 0\ **Last updated:** [April 15, 2021, 11:36am UTC](https://discuss.elastic.co/t/logstash-avro-codec-non-base64-support/270225 "2021-04-15T11:36:30Z")
We would like to input non-base64 encoded avro data with the avro codec. Similar to output syntax Optional base64 encoding by johanvanderkuijl · Pull Request #29 · logstash-plugins/logstash-codec-avro · GitHub code… --- ## [Multi-tenant design](https://discuss.elastic.co/t/multi-tenant-design/268278)
**Author:** [@abhishekc92](https://discuss.elastic.co/u/abhishekc92)\ **Replies:** 7\ **Last updated:** [March 25, 2021, 5:07am UTC](https://discuss.elastic.co/t/multi-tenant-design/268278 "2021-03-25T05:07:20Z")
Hi, I'm currently in the process of designing a multi-tenant indexing strategy for my system. I'm generally aware of the approaches commonly used in such cases - Index per tenant Shared index across tenants Some variat… --- ## [Negative Kafka partition bug](https://discuss.elastic.co/t/negative-kafka-partition-bug/270046)
**Author:** [@cbrown184](https://discuss.elastic.co/u/cbrown184)\ **Replies:** 1\ **Last updated:** [April 13, 2021, 11:38pm UTC](https://discuss.elastic.co/t/negative-kafka-partition-bug/270046 "2021-04-13T23:38:01Z")
Hi - we use Filebeat to output our logs to Kafka. We got hit by a nasty bug in prod where Filebeat gets stuck in an endless loop. It was previously documented on this thread Filebeat kafka output hash.hash get negative … --- ## [Better define Kibana Watchers for unavailable Pod](https://discuss.elastic.co/t/better-define-kibana-watchers-for-unavailable-pod/270213)
**Author:** [@es-gabriele](https://discuss.elastic.co/u/es-gabriele)\ **Replies:** 0\ **Last updated:** [April 15, 2021, 10:16am UTC](https://discuss.elastic.co/t/better-define-kibana-watchers-for-unavailable-pod/270213 "2021-04-15T10:16:30Z")
(topic withdrawn by author, will be automatically deleted in 24 hours unless flagged) --- ## [Is it possible to do a write operation on indices which are on warm nodes in elastic search](https://discuss.elastic.co/t/is-it-possible-to-do-a-write-operation-on-indices-which-are-on-warm-nodes-in-elastic-search/270212)
**Author:** [@sagar7645](https://discuss.elastic.co/u/sagar7645)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 10:24am UTC](https://discuss.elastic.co/t/is-it-possible-to-do-a-write-operation-on-indices-which-are-on-warm-nodes-in-elastic-search/270212 "2021-04-15T10:24:16Z")
is it possible to do a write operation on indices which are on warm nodes in elastic search --- ## [Session expiration](https://discuss.elastic.co/t/session-expiration/270131)
**Author:** [@alaine](https://discuss.elastic.co/u/alaine)\ **Replies:** 4\ **Last updated:** [April 15, 2021, 10:21am UTC](https://discuss.elastic.co/t/session-expiration/270131 "2021-04-15T10:21:59Z")
Hi there, my team is responsible for a few clusters and the users are running into two different errors fairly frequently. At the moment we are focusing on two issues that seem to have similar causes. The first log entr… --- ## [Activate x-pack](https://discuss.elastic.co/t/activate-x-pack/269829)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 26\ **Last updated:** [April 15, 2021, 10:15am UTC](https://discuss.elastic.co/t/activate-x-pack/269829 "2021-04-15T10:15:39Z")
how to activate the x-pack? and where i should access to activate the x-pack? --- ## [Query terms search miss content depending on what is searched](https://discuss.elastic.co/t/query-terms-search-miss-content-depending-on-what-is-searched/270193)
**Author:** [@pyrovoice](https://discuss.elastic.co/u/pyrovoice)\ **Replies:** 3\ **Last updated:** [April 15, 2021, 9:18am UTC](https://discuss.elastic.co/t/query-terms-search-miss-content-depending-on-what-is-searched/270193 "2021-04-15T09:18:27Z")
Hello, I have a strange issue with the ES query search: When searching for an array of ID, some of them will be skipped, but looking for those IDs individually of in a different array will return the skipped IDs correctl… --- ## [Winlogbeats path based on date](https://discuss.elastic.co/t/winlogbeats-path-based-on-date/270161)
**Author:** [@witkacy](https://discuss.elastic.co/u/witkacy)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 8:35am UTC](https://discuss.elastic.co/t/winlogbeats-path-based-on-date/270161 "2021-04-15T08:35:04Z")
Hello, Is it possible put result logs to file/folder with name based on actual time? So that for each day I would have separate folder with logs like c:/tmp/20210415/logFile1... c:/tmp/20210416/logFile1... c:/tmp/20… --- ## [Timeouts on shard relocations and overhead on garbage collection](https://discuss.elastic.co/t/timeouts-on-shard-relocations-and-overhead-on-garbage-collection/269996)
**Author:** [@Tony79](https://discuss.elastic.co/u/Tony79)\ **Replies:** 3\ **Last updated:** [April 15, 2021, 8:16am UTC](https://discuss.elastic.co/t/timeouts-on-shard-relocations-and-overhead-on-garbage-collection/269996 "2021-04-15T08:16:26Z")
Hi, In my setup of Elasticsearch cluster version 6.8 i've had big problems with handling the huge amount of indices and shards related to this. We use a frontend application from a third-party vendor so we have very li… --- ## [How to keep \`selected fields\` fixed](https://discuss.elastic.co/t/how-to-keep-selected-fields-fixed/269853)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 5\ **Last updated:** [April 15, 2021, 8:15am UTC](https://discuss.elastic.co/t/how-to-keep-selected-fields-fixed/269853 "2021-04-15T08:15:50Z")
When you check log items from Kibana, you can fix the items with selected fields. This setting is very useful, but it gets lost when you close your browser. Is there a way to keep this? --- ## [FILEBEAT module Fortinet : Provided Grok expressions do not match field value](https://discuss.elastic.co/t/filebeat-module-fortinet-provided-grok-expressions-do-not-match-field-value/269986)
**Author:** [@Alex\_Lum](https://discuss.elastic.co/u/Alex_Lum)\ **Replies:** 9\ **Last updated:** [April 15, 2021, 8:12am UTC](https://discuss.elastic.co/t/filebeat-module-fortinet-provided-grok-expressions-do-not-match-field-value/269986 "2021-04-15T08:12:37Z")
Hello, I send fortigate logs via rsylog on /var/log/fortigate\* files. I 've configured filebeat with fortinet module. On kibana, i get this : Provided Grok expressions do not match field value It was working with udp… --- ## [Prevent dashboard from displaying data until value is specified in control?](https://discuss.elastic.co/t/prevent-dashboard-from-displaying-data-until-value-is-specified-in-control/270195)
**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 7:44am UTC](https://discuss.elastic.co/t/prevent-dashboard-from-displaying-data-until-value-is-specified-in-control/270195 "2021-04-15T07:44:05Z")
I have a control that selects "job name". I'd prefer for the dashboard to "wait" until the user has selected a value from that control. Is that possible in Kibana? --- ## [Top hits does not work with significant text aggregation](https://discuss.elastic.co/t/top-hits-does-not-work-with-significant-text-aggregation/270188)
**Author:** [@sj12345](https://discuss.elastic.co/u/sj12345)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 7:33am UTC](https://discuss.elastic.co/t/top-hits-does-not-work-with-significant-text-aggregation/270188 "2021-04-15T07:33:20Z")
Is there any workaround for getting the original documents based on the buckets for a significant text aggregation ? The solution outlined here does not work for "significant text" How to get documents from the buckets… --- ## [Must\_not is not excluding results when used in query](https://discuss.elastic.co/t/must-not-is-not-excluding-results-when-used-in-query/270194)
**Author:** [@M\_Gibbs](https://discuss.elastic.co/u/M_Gibbs)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 7:24am UTC](https://discuss.elastic.co/t/must-not-is-not-excluding-results-when-used-in-query/270194 "2021-04-15T07:24:27Z")
Hi all, Having some issues, this is my query below. I'm returning results, but the must\_not section is not succesfully removing results. It's narrowing, to include the word developer. So I'm getting results with web des… --- ## [Query\_string with wildcard](https://discuss.elastic.co/t/query-string-with-wildcard/270061)
**Author:** [@Akaren](https://discuss.elastic.co/u/Akaren)\ **Replies:** 4\ **Last updated:** [April 15, 2021, 6:57am UTC](https://discuss.elastic.co/t/query-string-with-wildcard/270061 "2021-04-15T06:57:53Z")
I am having latest ES and set a field in mapping to keyword and index: true. I need to use wildcard so this example from your web is perfect match: { "query": { "query\_string" : { "query" : … --- ## [Restart elasticseach master overriding some index template](https://discuss.elastic.co/t/restart-elasticseach-master-overriding-some-index-template/270187)
**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 6:47am UTC](https://discuss.elastic.co/t/restart-elasticseach-master-overriding-some-index-template/270187 "2021-04-15T06:47:00Z")
We have faced some weird issue. restarting master node overriding alias name in index template. we have an three master and couple of data nodes index\_template before restart master node. "aliases" : { "pmetrics-mobi… --- ## [Metricbeat 7.12 cpu usage always zero](https://discuss.elastic.co/t/metricbeat-7-12-cpu-usage-always-zero/270192)
**Author:** [@Chandler-Bin](https://discuss.elastic.co/u/Chandler-Bin)\ **Replies:** 0\ **Last updated:** [April 15, 2021, 6:43am UTC](https://discuss.elastic.co/t/metricbeat-7-12-cpu-usage-always-zero/270192 "2021-04-15T06:43:01Z")
Testing metricbeat 7.12, I got cpu usage always 0. (memory usage is correct). The metricbeat is running on Windows 2019 and CentOS 7.9 . (both are hyper-v VM) Any idea? --- ## [Filebeat error](https://discuss.elastic.co/t/filebeat-error/270189)
**Author:** [@keerthi\_s](https://discuss.elastic.co/u/keerthi_s)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 6:38am UTC](https://discuss.elastic.co/t/filebeat-error/270189 "2021-04-15T06:38:07Z")
filebeat\[18723\]: 2021-04-15T02:02:54.874-0400 ERROR \[publisher\_pipeline\_output\] pipeline/output.go:154 Failed to connect to backoff(elasticsearch(https://xx.xx.xx.xx:9200)): Get "https://xx.xx… --- ## [Generate custom reports for each customer in Kibana Canvas](https://discuss.elastic.co/t/generate-custom-reports-for-each-customer-in-kibana-canvas/270148)
**Author:** [@Eivind\_Vinsand](https://discuss.elastic.co/u/Eivind_Vinsand)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 4:27am UTC](https://discuss.elastic.co/t/generate-custom-reports-for-each-customer-in-kibana-canvas/270148 "2021-04-15T04:27:07Z")
Hi! I have made a report in Kibana Canvas where I have calculated four metrics. Now I want to generate 100 versions of this report, one for each customer. This means I have to recalculate the metrics for each customer i… --- ## [Customized Data Table in Kibana](https://discuss.elastic.co/t/customized-data-table-in-kibana/270122)
**Author:** [@priya\_singh](https://discuss.elastic.co/u/priya_singh)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 4:20am UTC](https://discuss.elastic.co/t/customized-data-table-in-kibana/270122 "2021-04-15T04:20:49Z")
HI Team , This is Priya here i am new to ELK , Please help me to create the cusomized data table as per my requirement . I have created the data table with lens via visualize library and tried to add the some code as … --- ## [Multi PFsense - howto configure this](https://discuss.elastic.co/t/multi-pfsense-howto-configure-this/270172)
**Author:** [@Peque](https://discuss.elastic.co/u/Peque)\ **Replies:** 0\ **Last updated:** [April 15, 2021, 3:55am UTC](https://discuss.elastic.co/t/multi-pfsense-howto-configure-this/270172 "2021-04-15T03:55:35Z")
Hi Forum I'm quite new to the ELK solution, but learns every day :slight\_smile: We have a setup with several PF-Sense Routers that I would like get overview over. I have followed this guide : GitHub - patrickjennings/… --- ## [Packetbeat data is reverse](https://discuss.elastic.co/t/packetbeat-data-is-reverse/270171)
**Author:** [@ARDiver86](https://discuss.elastic.co/u/ARDiver86)\ **Replies:** 0\ **Last updated:** [April 15, 2021, 3:16am UTC](https://discuss.elastic.co/t/packetbeat-data-is-reverse/270171 "2021-04-15T03:16:22Z")
I'm noticing that a lot of data coming in from Packetbeat (if not all) is in reverse as far as traffic direction. For example we have a web server nat through a Fortigate firewall for port 443. Packetbeat is reporting th… --- ## [Multiple pipelines](https://discuss.elastic.co/t/multiple-pipelines/270120)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 11:23pm UTC](https://discuss.elastic.co/t/multiple-pipelines/270120 "2021-04-14T23:23:41Z")
here only the first pipelines that logstash execute and the second is not, here both pipelines listen on the same port so can somebody helps me for running the 2 pipelines regards --- ## [How to create a single document with fields from multi documents](https://discuss.elastic.co/t/how-to-create-a-single-document-with-fields-from-multi-documents/270141)
**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 11:29pm UTC](https://discuss.elastic.co/t/how-to-create-a-single-document-with-fields-from-multi-documents/270141 "2021-04-14T23:29:48Z")
Hi, I have 4 documents with the below fields {sessionid :1, callid:0001, service: 001} {sessionid :1, state:login, city: hyderabad} {sessionid :1, state:login, service:002} {sessionid :1, state:logout, handset: mobi… --- ## [Multiple roots and Ambiguous error in vega tree layout](https://discuss.elastic.co/t/multiple-roots-and-ambiguous-error-in-vega-tree-layout/270132)
**Author:** [@Ashvin\_Bhutekar](https://discuss.elastic.co/u/Ashvin_Bhutekar)\ **Replies:** 0\ **Last updated:** [April 14, 2021, 4:51pm UTC](https://discuss.elastic.co/t/multiple-roots-and-ambiguous-error-in-vega-tree-layout/270132 "2021-04-14T16:51:45Z")
I am creating vega tree flow using dynamic data from the index pattern. As I am using 'URL' and 'nexturl' field in the index pattern which gets repeated many times (One child referring to many parents). Tree layout is c… --- ## [Logstash jdbc - unnable to connect to database - plugin restart](https://discuss.elastic.co/t/logstash-jdbc-unnable-to-connect-to-database-plugin-restart/269959)
**Author:** [@g34ncarlo](https://discuss.elastic.co/u/g34ncarlo)\ **Replies:** 3\ **Last updated:** [April 14, 2021, 10:26pm UTC](https://discuss.elastic.co/t/logstash-jdbc-unnable-to-connect-to-database-plugin-restart/269959 "2021-04-14T22:26:24Z")
We're running Logstash with jdbc plugin as a Kubernetes cron job. Due to some network problem, eventually it cannot connect to database: \[ERROR\]\[logstash.inputs.jdbc \] Unable to connect to database. Tried 1 times {:… --- ## [Dynamic mapping strict to true](https://discuss.elastic.co/t/dynamic-mapping-strict-to-true/269912)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 10\ **Last updated:** [April 14, 2021, 9:41pm UTC](https://discuss.elastic.co/t/dynamic-mapping-strict-to-true/269912 "2021-04-14T21:41:30Z")
I have a index template that I define with strict dynamic mapping. Now I would like to add a field I have remove template, recreated with dynamic=true but it still gives me error on adding field 'error': {'type': 'stri… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1460) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1462)