# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1480 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1481 --- ## [How can you enrich and add fields to the correlation event upon rule trigger?](https://discuss.elastic.co/t/how-can-you-enrich-and-add-fields-to-the-correlation-event-upon-rule-trigger/268314)
**Author:** [@fuzzyWedgie](https://discuss.elastic.co/u/fuzzyWedgie)\ **Replies:** 3\ **Last updated:** [April 2, 2021, 7:43am UTC](https://discuss.elastic.co/t/how-can-you-enrich-and-add-fields-to-the-correlation-event-upon-rule-trigger/268314 "2021-04-02T07:43:03Z")
Hi, When correlating events I want to do enrichment lookups and add extra fields to the correlation event (signal). Also we would like to be able to add fields to the correlation event from the source events that cause… --- ## [I want to insert elasticsearch with multi time with range](https://discuss.elastic.co/t/i-want-to-insert-elasticsearch-with-multi-time-with-range/269088)
**Author:** [@gmcom2011](https://discuss.elastic.co/u/gmcom2011)\ **Replies:** 0\ **Last updated:** [April 2, 2021, 7:05am UTC](https://discuss.elastic.co/t/i-want-to-insert-elasticsearch-with-multi-time-with-range/269088 "2021-04-02T07:05:52Z")
If I have database table 100,000++ record and I want to insert to elasticsearch multi time. How to use logstash insert to elasticserch 1,000 records per request? example round 1 input record 1 - 1000 round 2 input … --- ## [Aggregation size](https://discuss.elastic.co/t/aggregation-size/269067)
**Author:** [@Giovanni\_Di\_Lembo](https://discuss.elastic.co/u/Giovanni_Di_Lembo)\ **Replies:** 3\ **Last updated:** [April 2, 2021, 7:01am UTC](https://discuss.elastic.co/t/aggregation-size/269067 "2021-04-02T07:01:11Z")
Hi all and sorry for my poor english I have tons of data with different field value 'fastCategory', but whe i do an aggragation on fastCategory, I found just 10 aggregation? Why that? POST statistic/\_search { "aggs"… --- ## [How to get a specific cluster setting?](https://discuss.elastic.co/t/how-to-get-a-specific-cluster-setting/269081)
**Author:** [@smlbiobot](https://discuss.elastic.co/u/smlbiobot)\ **Replies:** 2\ **Last updated:** [April 2, 2021, 6:40am UTC](https://discuss.elastic.co/t/how-to-get-a-specific-cluster-setting/269081 "2021-04-02T06:40:27Z")
I know that I can get the cluster settings with this: GET \_cluster/settings What I don’t know is how I can get a specific setting, especially when it‘s at the default and so it doesn’t show up on the GET. For example,… --- ## [Can’t filter Rollup index results](https://discuss.elastic.co/t/can-t-filter-rollup-index-results/268775)
**Author:** [@rokcarl](https://discuss.elastic.co/u/rokcarl)\ **Replies:** 8\ **Last updated:** [April 2, 2021, 5:41am UTC](https://discuss.elastic.co/t/can-t-filter-rollup-index-results/268775 "2021-04-02T05:41:57Z")
I have a rollup index with some values, e.g. customer. I've created a Kibana dashboard from it. When I try to filter the dashboard with customer : some-customer, I get an error. When I do a custom query, I can filter by … --- ## [Is the multiline codec supposed to work with the JDBC input plugin?](https://discuss.elastic.co/t/is-the-multiline-codec-supposed-to-work-with-the-jdbc-input-plugin/268852)
**Author:** [@ehanft](https://discuss.elastic.co/u/ehanft)\ **Replies:** 5\ **Last updated:** [April 1, 2021, 10:06pm UTC](https://discuss.elastic.co/t/is-the-multiline-codec-supposed-to-work-with-the-jdbc-input-plugin/268852 "2021-04-01T22:06:08Z")
I been having a hard time processing log files stored in an Oracle database table. The logs are stored as CLOB, but converted to VARCHAR2 using a pipelined table function. This works great with the JDBC input plugin in L… --- ## [Kibana Dashboard - Did this ever get fixed?](https://discuss.elastic.co/t/kibana-dashboard-did-this-ever-get-fixed/268282)
**Author:** [@johnwood](https://discuss.elastic.co/u/johnwood)\ **Replies:** 4\ **Last updated:** [April 1, 2021, 9:47pm UTC](https://discuss.elastic.co/t/kibana-dashboard-did-this-ever-get-fixed/268282 "2021-04-01T21:47:39Z")
Hi - I am trying to find out if this ever got fixed. I just tried under 7.12 and I get the same result but perhaps there is a switch or option I need to add? Thanks John --- ## [Elasticsearch & elasticflow](https://discuss.elastic.co/t/elasticsearch-elasticflow/269062)
**Author:** [@atamc3rb3r](https://discuss.elastic.co/u/atamc3rb3r)\ **Replies:** 1\ **Last updated:** [April 1, 2021, 9:12pm UTC](https://discuss.elastic.co/t/elasticsearch-elasticflow/269062 "2021-04-01T21:12:41Z")
Dear community, I have decided to install the Elasticflow version 5.0.1 on my ubuntu server 20.04 LTS and integrate it with the current installed Elasticsearch 7.10. I did it step by step based on below documentation. … --- ## [Filter elements based on array constant or array environment variable](https://discuss.elastic.co/t/filter-elements-based-on-array-constant-or-array-environment-variable/269074)
**Author:** [@Automation\_Scripts](https://discuss.elastic.co/u/Automation_Scripts)\ **Replies:** 1\ **Last updated:** [April 1, 2021, 7:41pm UTC](https://discuss.elastic.co/t/filter-elements-based-on-array-constant-or-array-environment-variable/269074 "2021-04-01T19:41:53Z")
Hi guys, How can I use an array constant in Logstash's filter? In my .env file I have a constant BLACKLIST=192.168.3.131, 10.0.0.1 if \[id.orig\_h\] in \[${BLACKLIST}\] { drop {} } How can we declare… --- ## [Kibana Alerts - Action on Recovered contains no context.group](https://discuss.elastic.co/t/kibana-alerts-action-on-recovered-contains-no-context-group/268946)
**Author:** [@JMisset88](https://discuss.elastic.co/u/JMisset88)\ **Replies:** 3\ **Last updated:** [April 1, 2021, 7:20pm UTC](https://discuss.elastic.co/t/kibana-alerts-action-on-recovered-contains-no-context-group/268946 "2021-04-01T19:20:19Z")
Hi, We recently upgraded from Elastic 7.10.0 to 7.12.0. Mainly because I saw the new Alerting/Action functionality to only send an Alert on a Status Change (instead of on an interval). This is a very nice feature, howev… --- ## [A custom role which contains all privileges is not updated after changing to read only role](https://discuss.elastic.co/t/a-custom-role-which-contains-all-privileges-is-not-updated-after-changing-to-read-only-role/268147)
**Author:** [@thiton](https://discuss.elastic.co/u/thiton)\ **Replies:** 13\ **Last updated:** [April 1, 2021, 7:12pm UTC](https://discuss.elastic.co/t/a-custom-role-which-contains-all-privileges-is-not-updated-after-changing-to-read-only-role/268147 "2021-04-01T19:12:54Z")
Please help to configure how a custom role which contains all privileges is not updated after changing to read only role. Steps to reproduce: First, create a custom role which contains all privileges curl -XPUT http:… --- ## [Kibana query filter by result of another saved search object field data](https://discuss.elastic.co/t/kibana-query-filter-by-result-of-another-saved-search-object-field-data/266656)
**Author:** [@singyim817](https://discuss.elastic.co/u/singyim817)\ **Replies:** 1\ **Last updated:** [April 1, 2021, 6:27pm UTC](https://discuss.elastic.co/t/kibana-query-filter-by-result-of-another-saved-search-object-field-data/266656 "2021-04-01T18:27:20Z")
Hi, I am migrating the log reports from direct search with oracle SQL to Kibana, and I am creating the dashboard to show the existing log reports. May I know is it possible to get the result like the following query a… --- ## [Watcher, hits array empty](https://discuss.elastic.co/t/watcher-hits-array-empty/268909)
**Author:** [@dvyu](https://discuss.elastic.co/u/dvyu)\ **Replies:** 2\ **Last updated:** [April 1, 2021, 5:31pm UTC](https://discuss.elastic.co/t/watcher-hits-array-empty/268909 "2021-04-01T17:31:28Z")
Hello, I am trying to use ctx fields in watcher action but some of them is empty My watcher is: { "trigger": { "schedule": { "interval": "1m" } }, "input": { "search": { "request": { … --- ## [S3 input getting stuck and not deleting SQS messages](https://discuss.elastic.co/t/s3-input-getting-stuck-and-not-deleting-sqs-messages/267090)
**Author:** [@buzzdeee](https://discuss.elastic.co/u/buzzdeee)\ **Replies:** 5\ **Last updated:** [April 1, 2021, 5:28pm UTC](https://discuss.elastic.co/t/s3-input-getting-stuck-and-not-deleting-sqs-messages/267090 "2021-04-01T17:28:50Z")
Hi, I'm with filebeat 7.10.0 on Ubuntu. I've configured filebeat to retrieve files from S3 bucket alike: filebeat.inputs: - type: s3 enabled: true queue\_url: "https://sqs.us-west-2.amazonaws.com/… --- ## [Logstash listening](https://discuss.elastic.co/t/logstash-listening/269063)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 3\ **Last updated:** [April 1, 2021, 5:28pm UTC](https://discuss.elastic.co/t/logstash-listening/269063 "2021-04-01T17:28:06Z")
Hi! Assuming filebeat -\> ELK are on different machines. On the filebeat output i have to specify the IP address of the Logstash host. However I can´t see any option to bind my server IP address to Logstash. All the tut… --- ## [Watcher add field to payload](https://discuss.elastic.co/t/watcher-add-field-to-payload/269008)
**Author:** [@tomaszgorka](https://discuss.elastic.co/u/tomaszgorka)\ **Replies:** 1\ **Last updated:** [April 1, 2021, 5:16pm UTC](https://discuss.elastic.co/t/watcher-add-field-to-payload/269008 "2021-04-01T17:16:20Z")
Hi, I have a watcher that takes people's data as input. If someone is below 21 yo it triggers the watcher and fires an index action. However I now need to add an additional field to the payload, which is "watchername" an… --- ## [Post URL does not appear to be portable across environments](https://discuss.elastic.co/t/post-url-does-not-appear-to-be-portable-across-environments/269052)
**Author:** [@eeijlar](https://discuss.elastic.co/u/eeijlar)\ **Replies:** 1\ **Last updated:** [April 1, 2021, 4:52pm UTC](https://discuss.elastic.co/t/post-url-does-not-appear-to-be-portable-across-environments/269052 "2021-04-01T16:52:13Z")
I am using the following snippet to download CSV reports in Kibana: for filename in ${KIBANA\_QUERIES}/\*.rison; do echo "Processing query file: $filename" … --- ## [Logstash SQS input to accept sqs url](https://discuss.elastic.co/t/logstash-sqs-input-to-accept-sqs-url/269059)
**Author:** [@rachel.takeuchi](https://discuss.elastic.co/u/rachel.takeuchi)\ **Replies:** 0\ **Last updated:** [April 1, 2021, 4:45pm UTC](https://discuss.elastic.co/t/logstash-sqs-input-to-accept-sqs-url/269059 "2021-04-01T16:45:51Z")
I'm using a third party that generates AWS credentials, a bucket and a queue for me to read logs from. I don't have the ability to change the permissions they've supplied to these credentials and unfortunately these cred… --- ## [How to create time series bar with site names in y-axis](https://discuss.elastic.co/t/how-to-create-time-series-bar-with-site-names-in-y-axis/267700)
**Author:** [@Dvir\_Alony](https://discuss.elastic.co/u/Dvir_Alony)\ **Replies:** 12\ **Last updated:** [April 1, 2021, 4:24pm UTC](https://discuss.elastic.co/t/how-to-create-time-series-bar-with-site-names-in-y-axis/267700 "2021-04-01T16:24:41Z")
Hi, I would like to create time series bar with site names in y-axis. For each site there will be a horizontal line representing the validity of the site with colors (green, yellow, red) according to the relevant time. … --- ## [Watcher email and slack failing](https://discuss.elastic.co/t/watcher-email-and-slack-failing/268854)
**Author:** [@twilight](https://discuss.elastic.co/u/twilight)\ **Replies:** 14\ **Last updated:** [April 1, 2021, 3:33pm UTC](https://discuss.elastic.co/t/watcher-email-and-slack-failing/268854 "2021-04-01T15:33:19Z")
Hello, I am trying to configure slack and email action in watcher on my ES and Kibana 7.12 installed on Amazon Linux AMI. below are my slack settings (plus webhook url in keystore): xpack.notification.slack: default… --- ## [Pipeline stopped due to database recovery](https://discuss.elastic.co/t/pipeline-stopped-due-to-database-recovery/268983)
**Author:** [@Dhruv\_Rank](https://discuss.elastic.co/u/Dhruv_Rank)\ **Replies:** 1\ **Last updated:** [April 1, 2021, 3:05pm UTC](https://discuss.elastic.co/t/pipeline-stopped-due-to-database-recovery/268983 "2021-04-01T15:05:52Z")
Hello,I am new to this and everyday I got same issue \[2021-03-31T19:28:00,364\]\[ERROR\]\[logstash.inputs.jdbc \]\[add-jobs\] Unable to connect to database. Tried 1 times {:error\_message=\>"Java::OrgPostgresqlUtil::PSQLExcepti… --- ## [Dynamic input for logstash](https://discuss.elastic.co/t/dynamic-input-for-logstash/269004)
**Author:** [@igorid70](https://discuss.elastic.co/u/igorid70)\ **Replies:** 1\ **Last updated:** [April 1, 2021, 2:55pm UTC](https://discuss.elastic.co/t/dynamic-input-for-logstash/269004 "2021-04-01T14:55:09Z")
Hi I have a use case when my logstash pipeline generates output based on which I want to initiate another logstash pipeline with input based on that output. In more details: the current pipeline uses a command input th… --- ## [Changing logstash jdbc statement](https://discuss.elastic.co/t/changing-logstash-jdbc-statement/269037)
**Author:** [@Gregorkosmina](https://discuss.elastic.co/u/Gregorkosmina)\ **Replies:** 1\ **Last updated:** [April 1, 2021, 2:53pm UTC](https://discuss.elastic.co/t/changing-logstash-jdbc-statement/269037 "2021-04-01T14:53:13Z")
I want to change SQL statement in my logstash, so I would fill index with newely queried data. I re-run logstash with new statement but my index still contains old data. Am I missing something? --- ## [Geoip cache\_size # relates to + flush frequency?](https://discuss.elastic.co/t/geoip-cache-size-relates-to-flush-frequency/269007)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 2\ **Last updated:** [April 1, 2021, 2:52pm UTC](https://discuss.elastic.co/t/geoip-cache-size-relates-to-flush-frequency/269007 "2021-04-01T14:52:05Z")
Hi, The default is cache\_size for geoip is documented at 1000. Is that 1000 IPs, bytes/kb? Also with pereodic\_flush:false (default), when does this flush? Tracing down a mismatch IP where going back a month up until … --- ## [Does Elasticsearch 7.11 not supported by ECK operator](https://discuss.elastic.co/t/does-elasticsearch-7-11-not-supported-by-eck-operator/268984)
**Author:** [@NK2812](https://discuss.elastic.co/u/NK2812)\ **Replies:** 3\ **Last updated:** [April 1, 2021, 2:44pm UTC](https://discuss.elastic.co/t/does-elasticsearch-7-11-not-supported-by-eck-operator/268984 "2021-04-01T14:44:07Z")
Hi, I trying to deploy the Elasticsearch 7.11.0 version cluster using eck operator 1.3 version, it fails in init container elastic-internal-init-filesystem . It says unsupported\_distribution Is 7.11 version not suppor… --- ## [Need to get the list of hosts not sending the logs to kibana](https://discuss.elastic.co/t/need-to-get-the-list-of-hosts-not-sending-the-logs-to-kibana/266922)
**Author:** [@mbm\_wfm](https://discuss.elastic.co/u/mbm_wfm)\ **Replies:** 1\ **Last updated:** [April 1, 2021, 2:41pm UTC](https://discuss.elastic.co/t/need-to-get-the-list-of-hosts-not-sending-the-logs-to-kibana/266922 "2021-04-01T14:41:50Z")
Hi, I need to get list of hosts not sending logs over two days for example, a query with kibana would be awesome! --- ## [How to filter logs coming from filebeat and apply a filter on message](https://discuss.elastic.co/t/how-to-filter-logs-coming-from-filebeat-and-apply-a-filter-on-message/267694)
**Author:** [@muralikrishna](https://discuss.elastic.co/u/muralikrishna)\ **Replies:** 3\ **Last updated:** [April 1, 2021, 2:32pm UTC](https://discuss.elastic.co/t/how-to-filter-logs-coming-from-filebeat-and-apply-a-filter-on-message/267694 "2021-04-01T14:32:49Z")
Hi Folks, I am using Logstash 7.8 version and i will be getting logs from multiple data sources as part of my requirement. I wanted to apply a filter on my log message coming from filebeat and containing the string "pa… --- ## [Help needed on winlogbeat](https://discuss.elastic.co/t/help-needed-on-winlogbeat/269041)
**Author:** [@Ashish\_Lal](https://discuss.elastic.co/u/Ashish_Lal)\ **Replies:** 0\ **Last updated:** [April 1, 2021, 2:18pm UTC](https://discuss.elastic.co/t/help-needed-on-winlogbeat/269041 "2021-04-01T14:18:45Z")
Hello there, I am new to winlogbeat and elastic stack. I have installed winlogbeat 7.11.0 to monitor windows event logs of a proprietary application (eXX). The windows event log contains entries from 10th March upto 26t… --- ## [Stopwords are not working in custom tokenizer](https://discuss.elastic.co/t/stopwords-are-not-working-in-custom-tokenizer/269033)
**Author:** [@tusharl](https://discuss.elastic.co/u/tusharl)\ **Replies:** 2\ **Last updated:** [April 1, 2021, 2:23pm UTC](https://discuss.elastic.co/t/stopwords-are-not-working-in-custom-tokenizer/269033 "2021-04-01T14:23:47Z")
Consider below example GET \_analyze { "tokenizer": { "pattern" : ",", "type" : "pattern" }, "filter": \[ { "type": "edge\_ngram", "min\_gram": 2, "max\_g… --- ## [Is it bad to disable mmapfs when running elasticsearch in fargate](https://discuss.elastic.co/t/is-it-bad-to-disable-mmapfs-when-running-elasticsearch-in-fargate/269044)
**Author:** [@Heshan\_Anupama](https://discuss.elastic.co/u/Heshan_Anupama)\ **Replies:** 0\ **Last updated:** [April 1, 2021, 2:28pm UTC](https://discuss.elastic.co/t/is-it-bad-to-disable-mmapfs-when-running-elasticsearch-in-fargate/269044 "2021-04-01T14:28:19Z")
Hello, I am trying to get elasticsearch with fargate and I am getting the error of \[2\]: max virtual memory areas vm.max\_map\_count \[65530\] is too low, increase to at least \[262144\]. I understand that we could not change … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1479) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1481)