# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1504 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1505 --- ## [Clean and split email address into two new fields](https://discuss.elastic.co/t/clean-and-split-email-address-into-two-new-fields/267489)
**Author:** [@cibernicola](https://discuss.elastic.co/u/cibernicola)\ **Replies:** 3\ **Last updated:** [March 17, 2021, 6:16pm UTC](https://discuss.elastic.co/t/clean-and-split-email-address-into-two-new-fields/267489 "2021-03-17T18:16:17Z")
Hello I have a field from a csv file called email, this field contains a string like this: mailtio:user@domain.tld I'm trying to remove "mailto:" as first step, then, copying field to a temp. one split the result into … --- ## [Filebeat Logs rotating filename with data pattern](https://discuss.elastic.co/t/filebeat-logs-rotating-filename-with-data-pattern/267534)
**Author:** [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Replies:** 2\ **Last updated:** [March 17, 2021, 5:48pm UTC](https://discuss.elastic.co/t/filebeat-logs-rotating-filename-with-data-pattern/267534 "2021-03-17T17:48:28Z")
Hello, Is there anyway to append a date pattern to Filebeat (or beat in general) to log file That help sometimes for logs rotating Something like this may be ? Thank You logging.files.name: "filebeat-{now/d{yyyy-MM-… --- ## [Is it possible to have some visualizations can be viewed with login and some visualizations no need login to view them?](https://discuss.elastic.co/t/is-it-possible-to-have-some-visualizations-can-be-viewed-with-login-and-some-visualizations-no-need-login-to-view-them/267538)
**Author:** [@qub123](https://discuss.elastic.co/u/qub123)\ **Replies:** 2\ **Last updated:** [March 17, 2021, 5:43pm UTC](https://discuss.elastic.co/t/is-it-possible-to-have-some-visualizations-can-be-viewed-with-login-and-some-visualizations-no-need-login-to-view-them/267538 "2021-03-17T17:43:02Z")
We have authentication setup on Kibana, which means we need to have username and password in order to access visualizations. I am wondering if it is possible to have the option to let users access some graphs without log… --- ## [Is positive lookbehind supported in Logstash at all?](https://discuss.elastic.co/t/is-positive-lookbehind-supported-in-logstash-at-all/267388)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 4\ **Last updated:** [March 17, 2021, 5:39pm UTC](https://discuss.elastic.co/t/is-positive-lookbehind-supported-in-logstash-at-all/267388 "2021-03-17T17:39:54Z")
Hi there all, i started with Logstash the other day and currently getting to know the tool. I have a situation here. Consider the below Baraccuda FW log entry 2018 01 30 13:12:21 Security +01:00 Block: type=FWD|proto=… --- ## [Adding new nodes to the cluster](https://discuss.elastic.co/t/adding-new-nodes-to-the-cluster/267312)
**Author:** [@adityak248](https://discuss.elastic.co/u/adityak248)\ **Replies:** 2\ **Last updated:** [March 17, 2021, 5:25pm UTC](https://discuss.elastic.co/t/adding-new-nodes-to-the-cluster/267312 "2021-03-17T17:25:56Z")
Hello team, I got a cluster running on SSL and now I want to add couple of more nodes and load balance kibana. How should I proceed. For ssl certs I have used the elasticsearch cert tool. --- ## [Automatic Dashboards](https://discuss.elastic.co/t/automatic-dashboards/267525)
**Author:** [@prakash1243](https://discuss.elastic.co/u/prakash1243)\ **Replies:** 1\ **Last updated:** [March 17, 2021, 5:01pm UTC](https://discuss.elastic.co/t/automatic-dashboards/267525 "2021-03-17T17:01:37Z")
Is there a way to automatically create the visualization/dashboards? We just trying to create same dassboards for each index? and wanted to automatically do it when we keep adding the new index. Can some one throw light… --- ## [How to change visualization color in kibana 7.11.1](https://discuss.elastic.co/t/how-to-change-visualization-color-in-kibana-7-11-1/267514)
**Author:** [@Husnain](https://discuss.elastic.co/u/Husnain)\ **Replies:** 1\ **Last updated:** [March 17, 2021, 4:48pm UTC](https://discuss.elastic.co/t/how-to-change-visualization-color-in-kibana-7-11-1/267514 "2021-03-17T16:48:50Z")
Hii.How can I change visualization color in kibana version(7.11.1)? --- ## [Data Loss/Unavailability in Elastic Search for querying after the ilm policy execution](https://discuss.elastic.co/t/data-loss-unavailability-in-elastic-search-for-querying-after-the-ilm-policy-execution/267548)
**Author:** [@manofjoy](https://discuss.elastic.co/u/manofjoy)\ **Replies:** 0\ **Last updated:** [March 17, 2021, 4:36pm UTC](https://discuss.elastic.co/t/data-loss-unavailability-in-elastic-search-for-querying-after-the-ilm-policy-execution/267548 "2021-03-17T16:36:57Z")
I see there are documents in the index and writes are happening, yet I can't query. (attached image). ilm policy: attached to indices. PUT \_ilm/policy/livestream\_delete\_policy { "policy": { "phases": { "hot": { "min… --- ## [Stack monitoring does not show the cluster information and has some errors](https://discuss.elastic.co/t/stack-monitoring-does-not-show-the-cluster-information-and-has-some-errors/266960)
**Author:** [@dedi27](https://discuss.elastic.co/u/dedi27)\ **Replies:** 1\ **Last updated:** [March 17, 2021, 4:34pm UTC](https://discuss.elastic.co/t/stack-monitoring-does-not-show-the-cluster-information-and-has-some-errors/266960 "2021-03-17T16:34:39Z")
Hi, My Elasticsearch cluster has not shown monitoring information for some time. I tried to solve the problem by enabling metricbeat metrics, but when I activate kibana some errors appear as described below. I can't f… --- ## [LDAP Lookup](https://discuss.elastic.co/t/ldap-lookup/267530)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 2\ **Last updated:** [March 17, 2021, 4:33pm UTC](https://discuss.elastic.co/t/ldap-lookup/267530 "2021-03-17T16:33:52Z")
Is there a plugin out there that can perform LDAP lookups? --- ## [Geo type not working with es 7](https://discuss.elastic.co/t/geo-type-not-working-with-es-7/267518)
**Author:** [@cwei](https://discuss.elastic.co/u/cwei)\ **Replies:** 1\ **Last updated:** [March 17, 2021, 4:06pm UTC](https://discuss.elastic.co/t/geo-type-not-working-with-es-7/267518 "2021-03-17T16:06:50Z")
We have an open source elasticsearch (7.10.1) deployed along with some custom plugs-ins and modules. And the geo type is not working with it. curl.sh -X PUT "https://\:9200/example?pretty" -H 'C… --- ## [Apache Docker containers autodiscovery ends up with grok error for error messages](https://discuss.elastic.co/t/apache-docker-containers-autodiscovery-ends-up-with-grok-error-for-error-messages/265746)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 3\ **Last updated:** [March 17, 2021, 3:55pm UTC](https://discuss.elastic.co/t/apache-docker-containers-autodiscovery-ends-up-with-grok-error-for-error-messages/265746 "2021-03-17T15:55:10Z")
I set up a new instance of Elasticsearch, Kibana, and various beats today. Since my sites are all in containers, I eventually found my way to the autodiscovery settings. I've been able to configure access logs so that F… --- ## [Logstash shutdown stalled while retrying rabbitmq input connection](https://discuss.elastic.co/t/logstash-shutdown-stalled-while-retrying-rabbitmq-input-connection/267474)
**Author:** [@samyascha](https://discuss.elastic.co/u/samyascha)\ **Replies:** 1\ **Last updated:** [March 17, 2021, 3:49pm UTC](https://discuss.elastic.co/t/logstash-shutdown-stalled-while-retrying-rabbitmq-input-connection/267474 "2021-03-17T15:49:12Z")
Hi, Im trying to find a solution for a Logstash (6.8.14) stalled shutdown when a RabbitMQ input is unavailable. Starting Logstash works fine, and it starts retrying connection to the RabbitMQ endpoint. That's fine. I … --- ## [Elasticsearch/Lucene Segment Count and Merge Settings](https://discuss.elastic.co/t/elasticsearch-lucene-segment-count-and-merge-settings/267540)
**Author:** [@Bikas\_Chhetri](https://discuss.elastic.co/u/Bikas_Chhetri)\ **Replies:** 0\ **Last updated:** [March 17, 2021, 3:36pm UTC](https://discuss.elastic.co/t/elasticsearch-lucene-segment-count-and-merge-settings/267540 "2021-03-17T15:36:38Z")
I have a couple of questions on elastic search segment size, count, and disk flush/write. Scheduled Merge policy Settings We have about 16 GB of data in a single shard and a total of 1458014 documents across 3 shards. … --- ## [Apply ILM Policy to existing DataStream Index](https://discuss.elastic.co/t/apply-ilm-policy-to-existing-datastream-index/267422)
**Author:** [@Karl\_Falconer](https://discuss.elastic.co/u/Karl_Falconer)\ **Replies:** 4\ **Last updated:** [March 17, 2021, 3:26pm UTC](https://discuss.elastic.co/t/apply-ilm-policy-to-existing-datastream-index/267422 "2021-03-17T15:26:27Z")
We have an exiting datastream foo-stream and two backing indices .foo-stream-000001 and .foo-stream-000002. Our application is writing/reading to the index foo-stream and the overall expectation is that ILM would automa… --- ## [Kibana and Azure SSO](https://discuss.elastic.co/t/kibana-and-azure-sso/267336)
**Author:** [@Gerrard](https://discuss.elastic.co/u/Gerrard)\ **Replies:** 2\ **Last updated:** [March 17, 2021, 2:09pm UTC](https://discuss.elastic.co/t/kibana-and-azure-sso/267336 "2021-03-17T14:09:43Z")
I'm trying to get Kibana (on elastic.co) working with Azure SSO. I've followed numerous "guides" on this, and ADFS and setting up SSO in general, and just can't figure it out. We're using elasticsearch 7.11.1, and getti… --- ## [Failed to obtain in-memory shard lock](https://discuss.elastic.co/t/failed-to-obtain-in-memory-shard-lock/267477)
**Author:** [@nishant\_jain](https://discuss.elastic.co/u/nishant_jain)\ **Replies:** 4\ **Last updated:** [March 17, 2021, 12:36pm UTC](https://discuss.elastic.co/t/failed-to-obtain-in-memory-shard-lock/267477 "2021-03-17T12:36:48Z")
I am using elastic search 7.10.2 in kubernetes but I get ShardLockObtainFailedException at random moments but mostly when there are some search or index operation is going on. the log is following: Data node {"type":… --- ## [Global Temporary Tables](https://discuss.elastic.co/t/global-temporary-tables/267228)
**Author:** [@onkark](https://discuss.elastic.co/u/onkark)\ **Replies:** 3\ **Last updated:** [March 17, 2021, 1:03pm UTC](https://discuss.elastic.co/t/global-temporary-tables/267228 "2021-03-17T13:03:31Z")
Is there something like global temporary tables/session tables we can use in elasticsearch ? The info about global temp tables can be looked here https://oracle-base.com/articles/misc/temporary-tables. Thanks in advan… --- ## [Painless script regex](https://discuss.elastic.co/t/painless-script-regex/267419)
**Author:** [@Boris\_Boris](https://discuss.elastic.co/u/Boris_Boris)\ **Replies:** 1\ **Last updated:** [March 17, 2021, 12:32pm UTC](https://discuss.elastic.co/t/painless-script-regex/267419 "2021-03-17T12:32:14Z")
I have a event.original field -\> type String. "2021-03-15T16:11:12.333659+00:00 10.10.252.2 id=firewall sn=xx time=2021-03-15 16:11:12 UTC fw=8.8.8.8 pri=5 c=256 m=38 msg=ICMP packet dropped due to Policy proto=icmp… --- ## [SSL connection between Kibana and Elasticsearch](https://discuss.elastic.co/t/ssl-connection-between-kibana-and-elasticsearch/266978)
**Author:** [@sk1f](https://discuss.elastic.co/u/sk1f)\ **Replies:** 10\ **Last updated:** [March 17, 2021, 9:52am UTC](https://discuss.elastic.co/t/ssl-connection-between-kibana-and-elasticsearch/266978 "2021-03-17T09:52:22Z")
Hello, would like to ask for help in configuring SSL connection. When using https: i get this error: Error code: SSL\_ERROR\_RX\_RECORD\_TOO\_LONG. If I try curl --cacert /etc/kibana/elasticsearch-ca.pem https://localhost:… --- ## [Theoretical limit on number of boolean queries](https://discuss.elastic.co/t/theoretical-limit-on-number-of-boolean-queries/267487)
**Author:** [@sarthi2395](https://discuss.elastic.co/u/sarthi2395)\ **Replies:** 0\ **Last updated:** [March 17, 2021, 11:24am UTC](https://discuss.elastic.co/t/theoretical-limit-on-number-of-boolean-queries/267487 "2021-03-17T11:24:15Z")
Is there a upper limit on how many boolean 'should' queries that I can run on an single API call? Say I have my query as { "query": { "bool": { "should": \[{ "prefix": { "key1": \ } }, … --- ## [Beats for legacy OS](https://discuss.elastic.co/t/beats-for-legacy-os/266918)
**Author:** [@kunal\_patil](https://discuss.elastic.co/u/kunal_patil)\ **Replies:** 3\ **Last updated:** [March 17, 2021, 11:11am UTC](https://discuss.elastic.co/t/beats-for-legacy-os/266918 "2021-03-17T11:11:39Z")
Looking for a way to have beats essentially metricbeat, filebeat to work on older operating systems SLES 9, 10 etc to monitor the servers which are hosting legacy applications. I am getting "panic" errors like below for … --- ## [How to resolve elasticsearch status red](https://discuss.elastic.co/t/how-to-resolve-elasticsearch-status-red/267266)
**Author:** [@asan](https://discuss.elastic.co/u/asan)\ **Replies:** 3\ **Last updated:** [March 17, 2021, 11:01am UTC](https://discuss.elastic.co/t/how-to-resolve-elasticsearch-status-red/267266 "2021-03-17T11:01:08Z")
hi I've got problem with elasticasearch which get in red status as you can see in bellow : curl -XGET localhost:9200/\_cluster/allocation/explain {"index":".async-search","shard":0,"primary":true,"current\_state":"unass… --- ## [License expired](https://discuss.elastic.co/t/license-expired/267400)
**Author:** [@DENMODSupport](https://discuss.elastic.co/u/DENMODSupport)\ **Replies:** 4\ **Last updated:** [March 17, 2021, 10:45am UTC](https://discuss.elastic.co/t/license-expired/267400 "2021-03-17T10:45:23Z")
We are getting below License expired error from Elastic search logs. We are using the version 5.3.1. Please let us know what we should do to resolve this error? Error: \[2021-03-16T12:24:04,454\]\[WARN \]\[o.e.l.LicenseServi… --- ## [Logstash doesn't take changes from log4j2.properties after restart service](https://discuss.elastic.co/t/logstash-doesnt-take-changes-from-log4j2-properties-after-restart-service/266751)
**Author:** [@krato](https://discuss.elastic.co/u/krato)\ **Replies:** 2\ **Last updated:** [March 17, 2021, 10:37am UTC](https://discuss.elastic.co/t/logstash-doesnt-take-changes-from-log4j2-properties-after-restart-service/266751 "2021-03-17T10:37:10Z")
I've noticed that after service restart logstash doesn't apply rules modified in log4j2.properties i.e appender.rolling.policies.size.size = 10MB (I've checked and the file has 12MB so it should work) Generally speaking… --- ## [ElasticSearch Watcher Webhook and SSL trust issue](https://discuss.elastic.co/t/elasticsearch-watcher-webhook-and-ssl-trust-issue/267303)
**Author:** [@rubans](https://discuss.elastic.co/u/rubans)\ **Replies:** 3\ **Last updated:** [March 17, 2021, 9:30am UTC](https://discuss.elastic.co/t/elasticsearch-watcher-webhook-and-ssl-trust-issue/267303 "2021-03-17T09:30:28Z")
I'm running v7.8.1 ELK stack on GKE. I have setup a watcher alert which on action is supposed to POST to a URL externally using webhook to https://alertapi-uat.systems.uk.foo/api/do However, when it tries to fire the w… --- ## [Question regarding the timeout option in search query](https://discuss.elastic.co/t/question-regarding-the-timeout-option-in-search-query/267460)
**Author:** [@iverson1407](https://discuss.elastic.co/u/iverson1407)\ **Replies:** 0\ **Last updated:** [March 17, 2021, 9:17am UTC](https://discuss.elastic.co/t/question-regarding-the-timeout-option-in-search-query/267460 "2021-03-17T09:17:19Z")
When we set up the timeout in a search query, it will timeout if it goes beyond the threshold. ( I know it is kinda best effort value). My question about this is that, once the search query gets timeout, will the execut… --- ## [Discovery.seed\_hosts](https://discuss.elastic.co/t/discovery-seed-hosts/267454)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 1\ **Last updated:** [March 17, 2021, 8:47am UTC](https://discuss.elastic.co/t/discovery-seed-hosts/267454 "2021-03-17T08:47:45Z")
Hi there, just a quick one: In discovery.seed\_hosts do I only mnetion / list the master nodes? coming from the old zen right now in production I do have listed all the nodes where an elasticsearch deamon is runnig. So … --- ## [Is it possible to count tokens which matched documents?](https://discuss.elastic.co/t/is-it-possible-to-count-tokens-which-matched-documents/267338)
**Author:** [@kwang\_hee\_Han](https://discuss.elastic.co/u/kwang_hee_Han)\ **Replies:** 3\ **Last updated:** [March 17, 2021, 8:18am UTC](https://discuss.elastic.co/t/is-it-possible-to-count-tokens-which-matched-documents/267338 "2021-03-17T08:18:34Z")
Hello, I want to find which term matched on documents that results of query. I tried to using "highlight" but it does responsed with poor results.(I need more digging time to with them) I want to know alternative way t… --- ## [Cross referencing from multiple indexes](https://discuss.elastic.co/t/cross-referencing-from-multiple-indexes/267164)
**Author:** [@kevvvlar](https://discuss.elastic.co/u/kevvvlar)\ **Replies:** 1\ **Last updated:** [March 17, 2021, 8:18am UTC](https://discuss.elastic.co/t/cross-referencing-from-multiple-indexes/267164 "2021-03-17T08:18:22Z")
I am building an app where I need to match users based on several parameters. I have two elastic search indexes, one with the user's likes and dislikes, one with some metadata about the user. /user\_profile/abc12345 { "… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1503) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1505)