# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1477 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1478 --- ## [ILM using custom Logstash indices](https://discuss.elastic.co/t/ilm-using-custom-logstash-indices/269239)
**Author:** [@Danilo\_PC](https://discuss.elastic.co/u/Danilo_PC)\ **Replies:** 1\ **Last updated:** [April 6, 2021, 1:06am UTC](https://discuss.elastic.co/t/ilm-using-custom-logstash-indices/269239 "2021-04-06T01:06:23Z")
Hi, I’m using logstash to ingest data into my elasticloud ES. I’m using custom index names, such as “client\_name-winlogbeat-2021.03.05” and “client\_name-o365-2021.03.05” for windows and office 365 logs respectively. B… --- ## [Catch 22 with creating passwords](https://discuss.elastic.co/t/catch-22-with-creating-passwords/268416)
**Author:** [@ricwhitney](https://discuss.elastic.co/u/ricwhitney)\ **Replies:** 22\ **Last updated:** [April 6, 2021, 12:34am UTC](https://discuss.elastic.co/t/catch-22-with-creating-passwords/268416 "2021-04-06T00:34:44Z")
Running Elastic 7.12 Basic (I assume) I'm stuck in a Catch 22 - when I enable x-pack security I cannot connect to elastic for setting passwords. When I disable x-pack security, and go to set passwords, it tells me secu… --- ## [Can someone helps me with this Json input!](https://discuss.elastic.co/t/can-someone-helps-me-with-this-json-input/269122)
**Author:** [@Skander\_Harrabi](https://discuss.elastic.co/u/Skander_Harrabi)\ **Replies:** 4\ **Last updated:** [April 5, 2021, 11:15pm UTC](https://discuss.elastic.co/t/can-someone-helps-me-with-this-json-input/269122 "2021-04-05T23:15:28Z")
Hello there, So i created an alias based on two indexes, and am creating a visualization with that alias that have a metric (count), what i want do is to make that metric works with documents from only one of indexes … --- ## [Winlogbeat inop filter with more than 2 lines](https://discuss.elastic.co/t/winlogbeat-inop-filter-with-more-than-2-lines/268271)
**Author:** [@KStJ](https://discuss.elastic.co/u/KStJ)\ **Replies:** 3\ **Last updated:** [April 5, 2021, 9:35pm UTC](https://discuss.elastic.co/t/winlogbeat-inop-filter-with-more-than-2-lines/268271 "2021-04-05T21:35:20Z")
Trying to get Winlogbeat to drop logs matching machine account with impersonation level "%%1833" and logon types 3/4. Winlogbeat will run, but ignore the processor if I have more than 2 conditions. We are running versio… --- ## [TypeError: Cannot read property 'error' of undefined](https://discuss.elastic.co/t/typeerror-cannot-read-property-error-of-undefined/268971)
**Author:** [@satyabrat\_majhi](https://discuss.elastic.co/u/satyabrat_majhi)\ **Replies:** 3\ **Last updated:** [April 5, 2021, 9:28pm UTC](https://discuss.elastic.co/t/typeerror-cannot-read-property-error-of-undefined/268971 "2021-04-05T21:28:36Z")
log \[07:40:32.609\] \[warning\]\[config\]\[deprecation\] Config key \[monitoring.cluster\_alerts.email\_notifications.email\_address\] will be required for email notifications to work in 8.0." log \[07:40:33.237\] \[info\]\[plugi… --- ## [How to access emsfile for USA States](https://discuss.elastic.co/t/how-to-access-emsfile-for-usa-states/269110)
**Author:** [@kavorka](https://discuss.elastic.co/u/kavorka)\ **Replies:** 4\ **Last updated:** [April 5, 2021, 8:10pm UTC](https://discuss.elastic.co/t/how-to-access-emsfile-for-usa-states/269110 "2021-04-05T20:10:43Z")
Trying to get a basic map of USA States to show up via vega. With the following code, I am getting the error "emsfile "USA States" does not exist" Any idea what the emsfile should be, or what could be wrong: { … --- ## [Float value accepted as date during initial document indexing, but fails on update/re-index](https://discuss.elastic.co/t/float-value-accepted-as-date-during-initial-document-indexing-but-fails-on-update-re-index/268417)
**Author:** [@Brooke\_Babcock](https://discuss.elastic.co/u/Brooke_Babcock)\ **Replies:** 3\ **Last updated:** [April 5, 2021, 8:06pm UTC](https://discuss.elastic.co/t/float-value-accepted-as-date-during-initial-document-indexing-but-fails-on-update-re-index/268417 "2021-04-05T20:06:22Z")
I encountered what appears to be a "gotcha" with dates. Wondering if this is expected behavior, or potentially room for improvement. If you index a float value into a date field, by default Elasticsearch allows it. And… --- ## [All primary shards of some indices keep getting assigned to 1 of 14 data nodes](https://discuss.elastic.co/t/all-primary-shards-of-some-indices-keep-getting-assigned-to-1-of-14-data-nodes/267726)
**Author:** [@danksim](https://discuss.elastic.co/u/danksim)\ **Replies:** 2\ **Last updated:** [April 5, 2021, 7:58pm UTC](https://discuss.elastic.co/t/all-primary-shards-of-some-indices-keep-getting-assigned-to-1-of-14-data-nodes/267726 "2021-04-05T19:58:20Z")
ES: 7.6.x 3 coordinator, 3 master, 14 data 6 shards, 1 replica All primary shards of some indices keep getting assigned to only 1 of 14 data nodes. So data node 12 has 6 primary shards of index x, y, z, etc. The other… --- ## [Add new field with value from grok filter](https://discuss.elastic.co/t/add-new-field-with-value-from-grok-filter/269253)
**Author:** [@Automation\_Scripts](https://discuss.elastic.co/u/Automation_Scripts)\ **Replies:** 2\ **Last updated:** [April 5, 2021, 7:51pm UTC](https://discuss.elastic.co/t/add-new-field-with-value-from-grok-filter/269253 "2021-04-05T19:51:13Z")
Hi all, I need to add a value to a field from a variable within a grok filter. filter { grok { match =\> \[ "message", "(?\(.\*?))\\t(?\(.\*?))" \] } mutate { add\_field =\> { "container\_id" =\> "%{u… --- ## [How to use elastic-agent docker image?](https://discuss.elastic.co/t/how-to-use-elastic-agent-docker-image/269183)
**Author:** [@klausagnoletti](https://discuss.elastic.co/u/klausagnoletti)\ **Replies:** 3\ **Last updated:** [April 5, 2021, 6:29pm UTC](https://discuss.elastic.co/t/how-to-use-elastic-agent-docker-image/269183 "2021-04-05T18:29:53Z")
Hi I've been wanting to run elastic-agent as a docker container for quite some time. So I was quite ecstatic when I found out it was available for download at beats/elastic-agent | Docker @ Elastic. However there's no d… --- ## [How to compare two fields of two or more documents](https://discuss.elastic.co/t/how-to-compare-two-fields-of-two-or-more-documents/269190)
**Author:** [@Dinesh\_Sharma](https://discuss.elastic.co/u/Dinesh_Sharma)\ **Replies:** 3\ **Last updated:** [April 5, 2021, 5:53pm UTC](https://discuss.elastic.co/t/how-to-compare-two-fields-of-two-or-more-documents/269190 "2021-04-05T17:53:07Z")
Hi, I have 500 documents and half of them contains "IP.keyword" and half contains "Pim\_IP".keyword. Now I want to filter to get all the document which will have Pim\_IP(from one docuement) == IP.keyword( from other docum… --- ## [Find Trending topics without background set](https://discuss.elastic.co/t/find-trending-topics-without-background-set/269207)
**Author:** [@sj12345](https://discuss.elastic.co/u/sj12345)\ **Replies:** 5\ **Last updated:** [April 5, 2021, 5:34pm UTC](https://discuss.elastic.co/t/find-trending-topics-without-background-set/269207 "2021-04-05T17:34:25Z")
i have read this article Find trending article Referring to Mark Harwood's comment on that page : " maybe it’s failing to find anything statistically significant in the sample of 100 headlines that differs materially fr… --- ## [Kibana table using data histogram aggregation resulting in counts with decimals](https://discuss.elastic.co/t/kibana-table-using-data-histogram-aggregation-resulting-in-counts-with-decimals/269249)
**Author:** [@Amphagory](https://discuss.elastic.co/u/Amphagory)\ **Replies:** 1\ **Last updated:** [April 5, 2021, 5:08pm UTC](https://discuss.elastic.co/t/kibana-table-using-data-histogram-aggregation-resulting-in-counts-with-decimals/269249 "2021-04-05T17:08:41Z")
Hello, I'm using Kibana 7.3.2 where I'm create a simple count table using data histogram aggregation to split the rows into buckets. I am using the timestamp for each event and set the interval to 60 minutes and the in… --- ## [How to secure the default elastic username and password in elasticsearch.yml, logstash.yml and kibana.yml files?](https://discuss.elastic.co/t/how-to-secure-the-default-elastic-username-and-password-in-elasticsearch-yml-logstash-yml-and-kibana-yml-files/269133)
**Author:** [@Patr123](https://discuss.elastic.co/u/Patr123)\ **Replies:** 4\ **Last updated:** [April 5, 2021, 4:24pm UTC](https://discuss.elastic.co/t/how-to-secure-the-default-elastic-username-and-password-in-elasticsearch-yml-logstash-yml-and-kibana-yml-files/269133 "2021-04-05T16:24:29Z")
I want to secure the username and password which are in plaintext in my elasticsearch.yml, logstash.yml and kibana.yml files. How can I do it? My ELK stack version is 7.10.2. --- ## [7.4 Embedded Kibana in Iframe Login Page Keeps Reloading and Redirecting to Same Page](https://discuss.elastic.co/t/7-4-embedded-kibana-in-iframe-login-page-keeps-reloading-and-redirecting-to-same-page/269132)
**Author:** [@Ben\_Chen](https://discuss.elastic.co/u/Ben_Chen)\ **Replies:** 1\ **Last updated:** [April 5, 2021, 4:23pm UTC](https://discuss.elastic.co/t/7-4-embedded-kibana-in-iframe-login-page-keeps-reloading-and-redirecting-to-same-page/269132 "2021-04-05T16:23:17Z")
Possible same issue: Cookies issue while embedding kibana dashboard with iFrame On an embedded, iframed Kibana, the user cannot login on Safari nor Chrome. Opening up the fullscreen dashboard in a separate tab, where … --- ## [Kibana filtering based on some search term](https://discuss.elastic.co/t/kibana-filtering-based-on-some-search-term/268732)
**Author:** [@Darshan\_Kamat](https://discuss.elastic.co/u/Darshan_Kamat)\ **Replies:** 2\ **Last updated:** [April 5, 2021, 3:05pm UTC](https://discuss.elastic.co/t/kibana-filtering-based-on-some-search-term/268732 "2021-04-05T15:05:16Z")
I am new to Elastic . I have setup like Filebeat-\>ES\<-Kibana Data is unformatted with single lines and multiple lines of logs and inserted into ES from Filebeat. Based on multi line expression new line is inserted int… --- ## [Burndown forecast trendline in Kibana Timelion chart](https://discuss.elastic.co/t/burndown-forecast-trendline-in-kibana-timelion-chart/269245)
**Author:** [@nguggilla](https://discuss.elastic.co/u/nguggilla)\ **Replies:** 0\ **Last updated:** [April 5, 2021, 3:00pm UTC](https://discuss.elastic.co/t/burndown-forecast-trendline-in-kibana-timelion-chart/269245 "2021-04-05T15:00:20Z")
I am looking to create a forecast trendline based on previous data in timelion chart Here is an example: Things I tried so far, with no luck: mvavg() trend() - close to what we want but not quite correct. Please … --- ## [The content length is bigger than the maximum allowed string](https://discuss.elastic.co/t/the-content-length-is-bigger-than-the-maximum-allowed-string/269223)
**Author:** [@Ivan44785372](https://discuss.elastic.co/u/Ivan44785372)\ **Replies:** 1\ **Last updated:** [April 5, 2021, 2:38pm UTC](https://discuss.elastic.co/t/the-content-length-is-bigger-than-the-maximum-allowed-string/269223 "2021-04-05T14:38:18Z")
I'm not sure if this error related to Kibana or Elasticsearch . When Try to search in "discovery" I'm getting "The content length (771413825) is bigger than the maximum allowed string (536870888)" How can I fix it ? --- ## [Timeout executing grok](https://discuss.elastic.co/t/timeout-executing-grok/269184)
**Author:** [@Andrey\_RF](https://discuss.elastic.co/u/Andrey_RF)\ **Replies:** 8\ **Last updated:** [April 5, 2021, 2:27pm UTC](https://discuss.elastic.co/t/timeout-executing-grok/269184 "2021-04-05T14:27:19Z")
I have a quite long regex to pars my log message. But it drops with Timeout executing grok . Does have any mechanisms to speed up regex work? Also I have a multiple regexs and if one is failed does it other works ? --- ## [Esrally bulk testing error with missing type](https://discuss.elastic.co/t/esrally-bulk-testing-error-with-missing-type/269091)
**Author:** [@Ellie\_Bird](https://discuss.elastic.co/u/Ellie_Bird)\ **Replies:** 1\ **Last updated:** [April 5, 2021, 1:48pm UTC](https://discuss.elastic.co/t/esrally-bulk-testing-error-with-missing-type/269091 "2021-04-05T13:48:41Z")
I created the track from existing cluster and want to race with rally at my local host. But Running bulk, it failed with missing type error. During creating track, did I miss out any parameter to generate correct mappi… --- ## [Fleet without internet access](https://discuss.elastic.co/t/fleet-without-internet-access/268042)
**Author:** [@PD98](https://discuss.elastic.co/u/PD98)\ **Replies:** 1\ **Last updated:** [April 5, 2021, 12:55pm UTC](https://discuss.elastic.co/t/fleet-without-internet-access/268042 "2021-04-05T12:55:08Z")
Hi, I am currently trying out elastic-agent and fleet. I enabled internet access on the server so that kibana could download packages from EPR for fleet. However upon stopping internet access, I get the "unable to conne… --- ## [Data path already locked by another beat. Unable to start Harvester](https://discuss.elastic.co/t/data-path-already-locked-by-another-beat-unable-to-start-harvester/269197)
**Author:** [@Shaan](https://discuss.elastic.co/u/Shaan)\ **Replies:** 1\ **Last updated:** [April 5, 2021, 12:46pm UTC](https://discuss.elastic.co/t/data-path-already-locked-by-another-beat-unable-to-start-harvester/269197 "2021-04-05T12:46:41Z")
Hi ! i am getting following error when i used "filebeat -e" and unable to start the harvester. I don't have any other beat running. And I have filebeat.lock in /usr/share/filebeat/data. I removed it and redeployed it a… --- ## [Parsing quoted and escaped json events](https://discuss.elastic.co/t/parsing-quoted-and-escaped-json-events/269233)
**Author:** [@LeonT123](https://discuss.elastic.co/u/LeonT123)\ **Replies:** 0\ **Last updated:** [April 5, 2021, 12:38pm UTC](https://discuss.elastic.co/t/parsing-quoted-and-escaped-json-events/269233 "2021-04-05T12:38:23Z")
Hi I'm trying to find a way to parse a JSON encoded message like this. I do not know if filebeat is a good choice here or logstash is better one. the events are look like this and I'm looking for a way to extract the "… --- ## [Maven Packages](https://discuss.elastic.co/t/maven-packages/268748)
**Author:** [@nmalocic](https://discuss.elastic.co/u/nmalocic)\ **Replies:** 5\ **Last updated:** [April 5, 2021, 11:50am UTC](https://discuss.elastic.co/t/maven-packages/268748 "2021-04-05T11:50:16Z")
Hi everyone, Is it possible to load maven package to use Json Processor from code? I am writing plugin, and I need to use Json Processor to parse data. Thanks, Nemanja --- ## [GROK query generating .keyword fields in Elasticsearch](https://discuss.elastic.co/t/grok-query-generating-keyword-fields-in-elasticsearch/269152)
**Author:** [@finbarr996](https://discuss.elastic.co/u/finbarr996)\ **Replies:** 2\ **Last updated:** [April 5, 2021, 10:24am UTC](https://discuss.elastic.co/t/grok-query-generating-keyword-fields-in-elasticsearch/269152 "2021-04-05T10:24:57Z")
Hi there, I'm happily parsing a bunch of syslog files in Logstash, but notice that an entry like %{DATA:Something} creates a Something field and additionally a Something.keyword field in Elasticsearch. Is there a way t… --- ## [Return specific search results](https://discuss.elastic.co/t/return-specific-search-results/269220)
**Author:** [@Jay\_Timbadia](https://discuss.elastic.co/u/Jay_Timbadia)\ **Replies:** 0\ **Last updated:** [April 5, 2021, 10:01am UTC](https://discuss.elastic.co/t/return-specific-search-results/269220 "2021-04-05T10:01:53Z")
I have these structures of my index. { "\_index" : "sentences", "\_type" : "\_doc", "\_id" : "PHhYoXgBJv8cgfRDHSag", "\_score" : 11.336952, "\_source" : { "word" : "acacia", … --- ## [Encountered a retryable error. will retry with exponential backoff (code:503)](https://discuss.elastic.co/t/encountered-a-retryable-error-will-retry-with-exponential-backoff-code-503/269217)
**Author:** [@lilyyy](https://discuss.elastic.co/u/lilyyy)\ **Replies:** 0\ **Last updated:** [April 5, 2021, 9:09am UTC](https://discuss.elastic.co/t/encountered-a-retryable-error-will-retry-with-exponential-backoff-code-503/269217 "2021-04-05T09:09:41Z")
Hello. I have a problem when i use logstash. My ELK version is 6.8 and when i start logstash, it was going well at first but a few times later i got this error. I've searched about this error on google but i was not abl… --- ## [New Elasticsearch node does not sync with existing cluster](https://discuss.elastic.co/t/new-elasticsearch-node-does-not-sync-with-existing-cluster/268994)
**Author:** [@runchranda](https://discuss.elastic.co/u/runchranda)\ **Replies:** 7\ **Last updated:** [April 5, 2021, 7:37am UTC](https://discuss.elastic.co/t/new-elasticsearch-node-does-not-sync-with-existing-cluster/268994 "2021-04-05T07:37:59Z")
Hi, I previously had 3 elasticsearch nodes consisting of node 1, node 2 and node 3, but my node 2 encountered some OS related issues so it had to be formatted. So I reinstalled and reconfigured node 2 as before it is fo… --- ## [Elasticsearch-certutil](https://discuss.elastic.co/t/elasticsearch-certutil/268988)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 8\ **Last updated:** [April 5, 2021, 7:34am UTC](https://discuss.elastic.co/t/elasticsearch-certutil/268988 "2021-04-05T07:34:48Z")
why i dont have elasticsearch-certutil in my /bin ? is it because my elastic is basic -free and open? --- ## [Filebeat doesn't start any harvesters](https://discuss.elastic.co/t/filebeat-doesnt-start-any-harvesters/269099)
**Author:** [@Misha\_Diordienko](https://discuss.elastic.co/u/Misha_Diordienko)\ **Replies:** 2\ **Last updated:** [April 5, 2021, 7:28am UTC](https://discuss.elastic.co/t/filebeat-doesnt-start-any-harvesters/269099 "2021-04-05T07:28:47Z")
hi, all Debian 10, Filebeat 7.12, filebeat.yml logging.level: info logging.to\_files: true logging.files: path: /var/log/filebeat name: filebeat keepfiles: 2 permissions: 0644 filebeat.inputs: - type: log … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1476) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1478)