# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1462 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1463 --- ## [Kibana 7.12 Discover: Document JSON view displays nested values separately and unsorted](https://discuss.elastic.co/t/kibana-7-12-discover-document-json-view-displays-nested-values-separately-and-unsorted/270110)
**Author:** [@sandbender](https://discuss.elastic.co/u/sandbender)\ **Replies:** 4\ **Last updated:** [April 14, 2021, 6:25pm UTC](https://discuss.elastic.co/t/kibana-7-12-discover-document-json-view-displays-nested-values-separately-and-unsorted/270110 "2021-04-14T18:25:25Z")
Hello, After upgrading to Kibana v7.12.0, in Discover, fields of documents displayed in JSON view are unsorted and not visibly collected in the objects they are stored in. That's a pain in the ass when trying to grasp t… --- ## [Events Per Second Visualization](https://discuss.elastic.co/t/events-per-second-visualization/270129)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 5:59pm UTC](https://discuss.elastic.co/t/events-per-second-visualization/270129 "2021-04-14T17:59:10Z")
I'm trying to create a metric for events per second, but not really sure how to do it. I saw one example that seems to get close, but when I manually do the math, it's a little off. The visualization configuration belo… --- ## [Full logstash queue](https://discuss.elastic.co/t/full-logstash-queue/270136)
**Author:** [@d4nnyx](https://discuss.elastic.co/u/d4nnyx)\ **Replies:** 0\ **Last updated:** [April 14, 2021, 5:38pm UTC](https://discuss.elastic.co/t/full-logstash-queue/270136 "2021-04-14T17:38:48Z")
Hello there, since Im running our Elastic Stack, I have a problem with persistent queues, which time to time gets full from unknown reason. Elasticsearch setup: 3 master nodes 12 data nodes 32CPU 32GB RAM avg index … --- ## [Terms Lookup on Ip fields and the too\_many\_clauses: maxClauseCount issue](https://discuss.elastic.co/t/terms-lookup-on-ip-fields-and-the-too-many-clauses-maxclausecount-issue/270130)
**Author:** [@Giovanni\_Bismondo](https://discuss.elastic.co/u/Giovanni_Bismondo)\ **Replies:** 0\ **Last updated:** [April 14, 2021, 4:17pm UTC](https://discuss.elastic.co/t/terms-lookup-on-ip-fields-and-the-too-many-clauses-maxclausecount-issue/270130 "2021-04-14T16:17:31Z")
Hi, I'm trying to make a query with Terms Lookup to filter an index by ip addresses included in an array (of another document in another index). I get the too\_many\_clauses: maxClauseCount issue, but I found in question… --- ## [Merge message with aggregate filter](https://discuss.elastic.co/t/merge-message-with-aggregate-filter/269115)
**Author:** [@MalfuncEddie](https://discuss.elastic.co/u/MalfuncEddie)\ **Replies:** 9\ **Last updated:** [April 14, 2021, 3:14pm UTC](https://discuss.elastic.co/t/merge-message-with-aggregate-filter/269115 "2021-04-14T15:14:14Z")
Hi, I am trying to merge 2 log lines with the aggregate filter and after a week browsing the internet and this forum I still cannot get this working. Below you have 2 loglines with an identifier ExchangeId. What I wan… --- ## [Unable to load more than 30000 fields into index pattern](https://discuss.elastic.co/t/unable-to-load-more-than-30000-fields-into-index-pattern/270088)
**Author:** [@TomasK](https://discuss.elastic.co/u/TomasK)\ **Replies:** 2\ **Last updated:** [April 14, 2021, 3:02pm UTC](https://discuss.elastic.co/t/unable-to-load-more-than-30000-fields-into-index-pattern/270088 "2021-04-14T15:02:48Z")
Hi everybody! I have index pattern let's say myindex\_\* which includes many other indexes like: myindex\_client1\_\* myindex\_client2\_\* myindex\_client3\_\* myindex\_client4\_\* etc... the indexes like myindex\_clientN\_\* have ab… --- ## [Usage of Winlogbeat on Linux / Parse plaintext windows events files](https://discuss.elastic.co/t/usage-of-winlogbeat-on-linux-parse-plaintext-windows-events-files/270113)
**Author:** [@GeorgeGkinis](https://discuss.elastic.co/u/GeorgeGkinis)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 2:52pm UTC](https://discuss.elastic.co/t/usage-of-winlogbeat-on-linux-parse-plaintext-windows-events-files/270113 "2021-04-14T14:52:13Z")
We have the need to run winlogbeat on Linux. I see that there are no precompiled binaries for Linux which is somewhat understandable. In our usecase winlog events are transported via syslog to a linux VM. There parsin… --- ## [Logstash Event Size](https://discuss.elastic.co/t/logstash-event-size/269972)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 4\ **Last updated:** [April 14, 2021, 2:43pm UTC](https://discuss.elastic.co/t/logstash-event-size/269972 "2021-04-14T14:43:58Z")
Hi, Can anyone tell me how I can get the size of an entire event using the ruby filter please? Thx D --- ## [ElastiCloud Index lifecycle policy error](https://discuss.elastic.co/t/elasticloud-index-lifecycle-policy-error/270121)
**Author:** [@mfa](https://discuss.elastic.co/u/mfa)\ **Replies:** 2\ **Last updated:** [April 14, 2021, 2:19pm UTC](https://discuss.elastic.co/t/elasticloud-index-lifecycle-policy-error/270121 "2021-04-14T14:19:09Z")
I have set up a lifecycle policy in order to delete index data when it is older that 50 gb Here is how it looks like below: PUT \_ilm/policy/deleting\_policy { "policy": { "phases": { "hot… --- ## [Keyword Field Generation](https://discuss.elastic.co/t/keyword-field-generation/269724)
**Author:** [@LED](https://discuss.elastic.co/u/LED)\ **Replies:** 3\ **Last updated:** [April 14, 2021, 2:04pm UTC](https://discuss.elastic.co/t/keyword-field-generation/269724 "2021-04-14T14:04:31Z")
Hi All, I have setup two identical ELK Stacks (in theory) for Dev and Test. We have Metricbeat shipping data into their respective clusters. In our Test environment I've noticed that ".keyword" is being added to the maj… --- ## [Change the labels on Pie in Canvas](https://discuss.elastic.co/t/change-the-labels-on-pie-in-canvas/269458)
**Author:** [@EduardoM](https://discuss.elastic.co/u/EduardoM)\ **Replies:** 5\ **Last updated:** [April 14, 2021, 1:52pm UTC](https://discuss.elastic.co/t/change-the-labels-on-pie-in-canvas/269458 "2021-04-14T13:52:05Z")
How can I change the labels on Pie in Cavas. and I want to have "car" and "bus" instead of 1 and 2. I should change this's : filters | essql query="SELECT SUM(Produced) AS Production,typ FROM \\"data\*\\" WHERE QUE… --- ## [Cannot create index in elastic search kibana](https://discuss.elastic.co/t/cannot-create-index-in-elastic-search-kibana/270017)
**Author:** [@Shoto\_Todoroki](https://discuss.elastic.co/u/Shoto_Todoroki)\ **Replies:** 3\ **Last updated:** [April 14, 2021, 1:33pm UTC](https://discuss.elastic.co/t/cannot-create-index-in-elastic-search-kibana/270017 "2021-04-14T13:33:17Z")
Hello, i am new to elastic search. I followed this below link to get started with elastic search https://www.elastic.co/blog/aftershock-therapy-with-elasticsearch-and-csv-data-import But while creating the index, i am … --- ## [Logstash](https://discuss.elastic.co/t/logstash/270107)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 1:30pm UTC](https://discuss.elastic.co/t/logstash/270107 "2021-04-14T13:30:13Z")
can somebody help me when i excute the logstash this error appear Using bundled JDK: /usr/share/logstash/jdk OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be… --- ## [Canvas Time Filter When Adding Kibana Objects](https://discuss.elastic.co/t/canvas-time-filter-when-adding-kibana-objects/269971)
**Author:** [@azulgrana](https://discuss.elastic.co/u/azulgrana)\ **Replies:** 6\ **Last updated:** [April 14, 2021, 1:29pm UTC](https://discuss.elastic.co/t/canvas-time-filter-when-adding-kibana-objects/269971 "2021-04-14T13:29:03Z")
Hi there, I have a Canvas with a time filter and I'm looking into adding some existing Kibana objects into my new Canvas. I see that each of the Kibana objects I add into my Canvas has line similar to this ... savedVis… --- ## [Filter last result in Kibana table](https://discuss.elastic.co/t/filter-last-result-in-kibana-table/269995)
**Author:** [@artobstrel](https://discuss.elastic.co/u/artobstrel)\ **Replies:** 2\ **Last updated:** [April 14, 2021, 1:16pm UTC](https://discuss.elastic.co/t/filter-last-result-in-kibana-table/269995 "2021-04-14T13:16:06Z")
I have the following data: With "Top Hit" aggregations I can get the latest result of each event: How can I filter Data Table results to get events with the last result is "failed"? Samples under the spoilerThis i… --- ## [Elasticsearch Certificates and Elasticsearch.Net (Could not create SSL/TLS secure channel...)](https://discuss.elastic.co/t/elasticsearch-certificates-and-elasticsearch-net-could-not-create-ssl-tls-secure-channel/270024)
**Author:** [@christopher.farmer](https://discuss.elastic.co/u/christopher.farmer)\ **Replies:** 0\ **Last updated:** [April 13, 2021, 3:03pm UTC](https://discuss.elastic.co/t/elasticsearch-certificates-and-elasticsearch-net-could-not-create-ssl-tls-secure-channel/270024 "2021-04-13T15:03:26Z")
I would think this would be a common and a straight-forward situation as I am using certificates generated by the elasticsearch-certutil tool for setting up transport and client SSL/TLS communication. The problem I am h… --- ## [Ingestion have been stoped at 70%, would my ingested data will get lost when I reingest?](https://discuss.elastic.co/t/ingestion-have-been-stoped-at-70-would-my-ingested-data-will-get-lost-when-i-reingest/270099)
**Author:** [@sanjaysh](https://discuss.elastic.co/u/sanjaysh)\ **Replies:** 14\ **Last updated:** [April 14, 2021, 12:49pm UTC](https://discuss.elastic.co/t/ingestion-have-been-stoped-at-70-would-my-ingested-data-will-get-lost-when-i-reingest/270099 "2021-04-14T12:49:21Z")
I am ingesting data on EC and I have almost ingested my 70% of data but the ingestion process have suddenly got stopped, and now I have to ingest again with the remaining data so would the remaining data will lost or wou… --- ## [Apikeys and elastic cloud](https://discuss.elastic.co/t/apikeys-and-elastic-cloud/269856)
**Author:** [@alfredo.deluca](https://discuss.elastic.co/u/alfredo.deluca)\ **Replies:** 6\ **Last updated:** [April 14, 2021, 12:30pm UTC](https://discuss.elastic.co/t/apikeys-and-elastic-cloud/269856 "2021-04-14T12:30:42Z")
Hi all. We use elastic cloud 7.12. We have also metricbeat and filebeat running on node and k8s cluster and for their configurations I use cloud.id and cloud.auth has ta user (beats\_setup) with those privileges. Now I'… --- ## [Header transform concern need help](https://discuss.elastic.co/t/header-transform-concern-need-help/269064)
**Author:** [@jkaufmanlr](https://discuss.elastic.co/u/jkaufmanlr)\ **Replies:** 22\ **Last updated:** [April 14, 2021, 12:00pm UTC](https://discuss.elastic.co/t/header-transform-concern-need-help/269064 "2021-04-14T12:00:51Z")
I have an API POST that I want filebeat to contact. This API calls for having in the header the value: x-api-key : apiToken I have attempted the following \> request.transforms: - set: target: header … --- ## [Issues trying to search with ngram tokenizer](https://discuss.elastic.co/t/issues-trying-to-search-with-ngram-tokenizer/269946)
**Author:** [@nealdan0](https://discuss.elastic.co/u/nealdan0)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 12:00pm UTC](https://discuss.elastic.co/t/issues-trying-to-search-with-ngram-tokenizer/269946 "2021-04-14T12:00:43Z")
Hi, Recently we upgraded our version of elastic search to 7.10. Since then I've had issues querying with an ngram tokenizer from the java api. Specifically, searching for a text value only returns results if using a… --- ## [Is there any way to redo the input of beats?](https://discuss.elastic.co/t/is-there-any-way-to-redo-the-input-of-beats/268863)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 2\ **Last updated:** [April 14, 2021, 10:50am UTC](https://discuss.elastic.co/t/is-there-any-way-to-redo-the-input-of-beats/268863 "2021-04-14T10:50:23Z")
I am sending logs from filebeat to logstash. However, when I added filebeat to a new server and restarted logstash, some kind of failure caused most of the logs to be thrown away. I would like to start logging again fr… --- ## [How to use filebeat to collect only the day's logs](https://discuss.elastic.co/t/how-to-use-filebeat-to-collect-only-the-days-logs/269409)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 16\ **Last updated:** [April 14, 2021, 10:37am UTC](https://discuss.elastic.co/t/how-to-use-filebeat-to-collect-only-the-days-logs/269409 "2021-04-14T10:37:21Z")
I'm using filebeat to collect logs. The name of the target log is "api-yyyy-mm-dd.log". If you set the paths setting of filebeat as follows, all files will be collected. - type: log paths: - /var/log/api/api-\*.l… --- ## [Ingestion doc to index template](https://discuss.elastic.co/t/ingestion-doc-to-index-template/270093)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 2\ **Last updated:** [April 14, 2021, 10:21am UTC](https://discuss.elastic.co/t/ingestion-doc-to-index-template/270093 "2021-04-14T10:21:50Z")
Hi, I've created a index template in Kibana: { "properties": { "date": { "type": "date" }, "formatDate": { "type": "text" }, "temp": { "type":… --- ## [Hot/Warm/Cold storage architecture 1 node](https://discuss.elastic.co/t/hot-warm-cold-storage-architecture-1-node/270102)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 3\ **Last updated:** [April 14, 2021, 10:21am UTC](https://discuss.elastic.co/t/hot-warm-cold-storage-architecture-1-node/270102 "2021-04-14T10:21:02Z")
I am pretty sure it is not possible but still would like to know this for sure. It's possible to use 3 types(Martix,SSD,HDD) of storage for one elasticserach node and configure which index should be stored on which stora… --- ## [Filter on array of object](https://discuss.elastic.co/t/filter-on-array-of-object/270004)
**Author:** [@My-project-repositor](https://discuss.elastic.co/u/My-project-repositor)\ **Replies:** 3\ **Last updated:** [April 14, 2021, 10:16am UTC](https://discuss.elastic.co/t/filter-on-array-of-object/270004 "2021-04-14T10:16:39Z")
I have a documents with many nested fields and array of objects inside them. So when I perform search, how can I get only the matching object inside the array of object, not the entire document? { "name": "Olivia", … --- ## [Create visualizations based on Kibana saved objects, including tags?](https://discuss.elastic.co/t/create-visualizations-based-on-kibana-saved-objects-including-tags/270073)
**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\ **Replies:** 2\ **Last updated:** [April 14, 2021, 10:14am UTC](https://discuss.elastic.co/t/create-visualizations-based-on-kibana-saved-objects-including-tags/270073 "2021-04-14T10:14:13Z")
I'm creating dashboards in Kibana 7.11.2 for multiple types of event from a single application. In the data I'm working with, the event types are characterized by different values of a field named tableName. While there … --- ## [Kibana-comments-app-plugin](https://discuss.elastic.co/t/kibana-comments-app-plugin/269049)
**Author:** [@uusername](https://discuss.elastic.co/u/uusername)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 10:06am UTC](https://discuss.elastic.co/t/kibana-comments-app-plugin/269049 "2021-04-14T10:06:49Z")
@gwintzer hello, Very thanks for developed the plugin. I wondering whether I able to install this plugin in Kibana, kibana-7.11.2-windows-x86\_64? I keep getting the installation failure (when install locally ) with th… --- ## [Issue with loading 4-5 kibana dashboards on the page using Iframe](https://discuss.elastic.co/t/issue-with-loading-4-5-kibana-dashboards-on-the-page-using-iframe/269685)
**Author:** [@Srikanth\_V](https://discuss.elastic.co/u/Srikanth_V)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 9:56am UTC](https://discuss.elastic.co/t/issue-with-loading-4-5-kibana-dashboards-on-the-page-using-iframe/269685 "2021-04-14T09:56:26Z")
Hi There. I am having an issue with the loading of kibana dashboards using an iframe on my application. I have 5 dashboards and it seems to be making multiple requests and multiple plugins for each dashboard to be shown… --- ## [Flood storage Disk Watermark exceeded error](https://discuss.elastic.co/t/flood-storage-disk-watermark-exceeded-error/269411)
**Author:** [@Daud\_Ahmed1](https://discuss.elastic.co/u/Daud_Ahmed1)\ **Replies:** 6\ **Last updated:** [April 14, 2021, 9:50am UTC](https://discuss.elastic.co/t/flood-storage-disk-watermark-exceeded-error/269411 "2021-04-14T09:50:54Z")
I am getting the following error Elasticsearch error: cluster\_block\_exception \[FORBIDDEN/12/index read-only / allow delete (api)\], flood stage disk watermark exceeded Even though I have three data nodes each with 1TB s… --- ## [External UAA Authentication for session management and Kibana Authentication](https://discuss.elastic.co/t/external-uaa-authentication-for-session-management-and-kibana-authentication/269700)
**Author:** [@Srinivas\_Alapati](https://discuss.elastic.co/u/Srinivas_Alapati)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 9:50am UTC](https://discuss.elastic.co/t/external-uaa-authentication-for-session-management-and-kibana-authentication/269700 "2021-04-14T09:50:53Z")
Hi! I have been using the iframe to load the kibana dasboard in our angular application. I have external UAA authentication in our web application for security. How can I use external UAA to be used in Kibana and communi… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1461) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1463)