# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1521 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1522 --- ## [Indexes are not going to Warm Tier](https://discuss.elastic.co/t/indexes-are-not-going-to-warm-tier/266389)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 0\ **Last updated:** [March 5, 2021, 3:55pm UTC](https://discuss.elastic.co/t/indexes-are-not-going-to-warm-tier/266389 "2021-03-05T15:55:14Z")
Trying to get indexes to go into warm for 30 days. Am I doing something incorrect? --- ## [Highlight. Different tags for different words in one highlight request. For one field](https://discuss.elastic.co/t/highlight-different-tags-for-different-words-in-one-highlight-request-for-one-field/266388)
**Author:** [@boralex](https://discuss.elastic.co/u/boralex)\ **Replies:** 0\ **Last updated:** [March 5, 2021, 3:43pm UTC](https://discuss.elastic.co/t/highlight-different-tags-for-different-words-in-one-highlight-request-for-one-field/266388 "2021-03-05T15:43:59Z")
Good day I have a question: Can I use several different tags for different words in one highlight request? Is it possible? For example (Let I have one text field): I have a request with phrases that should definitely… --- ## [KQL syntax for serial difference/delta filter](https://discuss.elastic.co/t/kql-syntax-for-serial-difference-delta-filter/266100)
**Author:** [@Muhammad\_Faisal](https://discuss.elastic.co/u/Muhammad_Faisal)\ **Replies:** 6\ **Last updated:** [March 5, 2021, 3:39pm UTC](https://discuss.elastic.co/t/kql-syntax-for-serial-difference-delta-filter/266100 "2021-03-05T15:39:55Z")
hi guys, my numeric data is coming aggregating , so i am using aggregation "sum of serial difference of values" to take delta...how do i put this delta in KQL filter in search box... example value1 : 20 value 2: 50 … --- ## [Filter to query](https://discuss.elastic.co/t/filter-to-query/266264)
**Author:** [@paasi6666](https://discuss.elastic.co/u/paasi6666)\ **Replies:** 4\ **Last updated:** [March 5, 2021, 3:37pm UTC](https://discuss.elastic.co/t/filter-to-query/266264 "2021-03-05T15:37:13Z")
Hello I've got following Filter option (as an example): source.ip : "10.10.10.10" and from.domain : "domain.com" or source.ip: "40.40.40.40" and from.domain : "otherdomain.com" How do I "translate" this filter to an… --- ## [Monitors can only support up to 10 triggers](https://discuss.elastic.co/t/monitors-can-only-support-up-to-10-triggers/266163)
**Author:** [@larrya](https://discuss.elastic.co/u/larrya)\ **Replies:** 6\ **Last updated:** [March 5, 2021, 3:23pm UTC](https://discuss.elastic.co/t/monitors-can-only-support-up-to-10-triggers/266163 "2021-03-05T15:23:03Z")
I have a monitor with 10 triggers. When I attempt to create another trigger, I see this error message: Failed to create the trigger \[illegal\_argument\_exception\] Monitors can only support up to 10 triggers. How … --- ## [How to Create New User in Kibana](https://discuss.elastic.co/t/how-to-create-new-user-in-kibana/265826)
**Author:** [@muthug](https://discuss.elastic.co/u/muthug)\ **Replies:** 4\ **Last updated:** [March 5, 2021, 2:37pm UTC](https://discuss.elastic.co/t/how-to-create-new-user-in-kibana/265826 "2021-03-05T14:37:35Z")
Hi, I have created the new user in Kibana via kibana UI. But i am unable to login with that id. Getting Error as:- {"statusCode":403,"error":"Forbidden","message":"Forbidden"} Note:- I am able to login with System use… --- ## [Auditd events created while Auditbeat is down](https://discuss.elastic.co/t/auditd-events-created-while-auditbeat-is-down/266369)
**Author:** [@alanoe](https://discuss.elastic.co/u/alanoe)\ **Replies:** 0\ **Last updated:** [March 5, 2021, 12:47pm UTC](https://discuss.elastic.co/t/auditd-events-created-while-auditbeat-is-down/266369 "2021-03-05T12:47:55Z")
I'm designing a filesystem operations (file creation, file deletion, file open, permissions change, etc) and process executions tracking application using Auditbeat. This tracking app should not lose events in any case, … --- ## [Kibana Data Table visualization - advanced filter](https://discuss.elastic.co/t/kibana-data-table-visualization-advanced-filter/266358)
**Author:** [@MMH](https://discuss.elastic.co/u/MMH)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 1:39pm UTC](https://discuss.elastic.co/t/kibana-data-table-visualization-advanced-filter/266358 "2021-03-05T13:39:02Z")
I am creating Kibana Dashboard based on log data. I want to create Data Table for the most common warnings, with some stacktrace info (if exists). Each entry can contain multiple stacktrace messages, but the first one … --- ## [How does the "version" tag works in the Json export of a visualization in Kibana?](https://discuss.elastic.co/t/how-does-the-version-tag-works-in-the-json-export-of-a-visualization-in-kibana/265954)
**Author:** [@Harpreet\_Singh](https://discuss.elastic.co/u/Harpreet_Singh)\ **Replies:** 5\ **Last updated:** [March 5, 2021, 1:35pm UTC](https://discuss.elastic.co/t/how-does-the-version-tag-works-in-the-json-export-of-a-visualization-in-kibana/265954 "2021-03-05T13:35:37Z")
Hi Team, This is regarding version control of the kibana visualizations, we are planning to export the Json files and then put them into git. Now when i am exporting the files as Json, there is a version Tag there(PFA … --- ## [Beats dahsboards error \[ esaggs\] JSON parse: Unexpected chararter at line 1 column 1 of the JSON data](https://discuss.elastic.co/t/beats-dahsboards-error-esaggs-json-parse-unexpected-chararter-at-line-1-column-1-of-the-json-data/266343)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 2\ **Last updated:** [March 5, 2021, 1:25pm UTC](https://discuss.elastic.co/t/beats-dahsboards-error-esaggs-json-parse-unexpected-chararter-at-line-1-column-1-of-the-json-data/266343 "2021-03-05T13:25:09Z")
Hello, I am trying ELK 8.0.0 from code source as dev cluster, and used the same configuration of my prod cluster (Version 7.10.1) but when I installed beats (version 7.11.1) I am getting errors in the dashboards as you … --- ## [Cannot access kibana dashobards through iframe code after configuring TLS/SSL encryption in ELK stack](https://discuss.elastic.co/t/cannot-access-kibana-dashobards-through-iframe-code-after-configuring-tls-ssl-encryption-in-elk-stack/266346)
**Author:** [@Husnain](https://discuss.elastic.co/u/Husnain)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 1:14pm UTC](https://discuss.elastic.co/t/cannot-access-kibana-dashobards-through-iframe-code-after-configuring-tls-ssl-encryption-in-elk-stack/266346 "2021-03-05T13:14:01Z")
Hii.I want to share my kibana dashboards through iframe code with my colleague.When I run kibana on http everything works fine.But when I share dashboards after configuring TLS/SSL on my elk stack my colleague cannot acc… --- ## [How to fix a rule on x axis using time](https://discuss.elastic.co/t/how-to-fix-a-rule-on-x-axis-using-time/266285)
**Author:** [@bab](https://discuss.elastic.co/u/bab)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 1:13pm UTC](https://discuss.elastic.co/t/how-to-fix-a-rule-on-x-axis-using-time/266285 "2021-03-05T13:13:15Z")
hello all, I am trying to fix a fixed line to the x acse where time = 15:30 so that I can notice the bars that took longer than 15:30. what have i done wrong? tha is my Code: { "$schema": "https://vega.github.io/… --- ## [Share Kibana Dashboard](https://discuss.elastic.co/t/share-kibana-dashboard/266316)
**Author:** [@deeksha39](https://discuss.elastic.co/u/deeksha39)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 12:56pm UTC](https://discuss.elastic.co/t/share-kibana-dashboard/266316 "2021-03-05T12:56:17Z")
Hi All, I want to share my dashboard with the client without the 'Edit' button but the 'save query' button should be enabled. --- ## [Pull fields in the kibana watcher](https://discuss.elastic.co/t/pull-fields-in-the-kibana-watcher/265779)
**Author:** [@richis](https://discuss.elastic.co/u/richis)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 12:51pm UTC](https://discuss.elastic.co/t/pull-fields-in-the-kibana-watcher/265779 "2021-03-05T12:51:20Z")
Hi all, I have created a watcher. I am new to this concept so finding it difficult to achieve. The watcher is created successfully but, i am trying to get the fields that i have in my log. With the help of google search … --- ## [.monitoring-es-7-\* with Data fields conflicts](https://discuss.elastic.co/t/monitoring-es-7-with-data-fields-conflicts/265882)
**Author:** [@valleram](https://discuss.elastic.co/u/valleram)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 12:49pm UTC](https://discuss.elastic.co/t/monitoring-es-7-with-data-fields-conflicts/265882 "2021-03-05T12:49:59Z")
Hi, I've just setup up Metricbeat to start monitoring my ES cluster. I started receiving data from my Metricbeat instance, but on Kibana while trying to see that monitoring data I'm receiving bunch of data types confli… --- ## [Error in scripted field, working with arrays of objects](https://discuss.elastic.co/t/error-in-scripted-field-working-with-arrays-of-objects/265944)
**Author:** [@Casper\_Thrane](https://discuss.elastic.co/u/Casper_Thrane)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 12:48pm UTC](https://discuss.elastic.co/t/error-in-scripted-field-working-with-arrays-of-objects/265944 "2021-03-05T12:48:07Z")
Hi I think I have found an error, in the way Kibana/Scripted Fields handles arrays of objects. My example is this. My ES Data: {"@timestamp":"2021-02-28T22:59:38.786Z", "message":"ExclusionsDeparturesArrivalsExeption:… --- ## [Data Table with Document Status Counts by Month](https://discuss.elastic.co/t/data-table-with-document-status-counts-by-month/265849)
**Author:** [@Darwin](https://discuss.elastic.co/u/Darwin)\ **Replies:** 2\ **Last updated:** [March 5, 2021, 12:05pm UTC](https://discuss.elastic.co/t/data-table-with-document-status-counts-by-month/265849 "2021-03-05T12:05:58Z")
Hi all, I am new to Kibana and am having trouble creating a desired data table. In short, I have an index comprising documents representing order lifecycle, similar to the image shown below: The order documents incl… --- ## [Helm logstash last\_run\_metadata\_path](https://discuss.elastic.co/t/helm-logstash-last-run-metadata-path/266362)
**Author:** [@josemiguelq](https://discuss.elastic.co/u/josemiguelq)\ **Replies:** 0\ **Last updated:** [March 5, 2021, 12:01pm UTC](https://discuss.elastic.co/t/helm-logstash-last-run-metadata-path/266362 "2021-03-05T12:01:46Z")
How can I define volumes bind for files used by last\_run\_metadata? In logstash.conf file a defined last\_run\_metadata\_path: "{$HOME}/states/.last\_run\_config" and I want this file persistent for any deploy. --- ## [How to use the search after after getting the result using the geolocation sort](https://discuss.elastic.co/t/how-to-use-the-search-after-after-getting-the-result-using-the-geolocation-sort/266359)
**Author:** [@kushal\_sharma](https://discuss.elastic.co/u/kushal_sharma)\ **Replies:** 0\ **Last updated:** [March 5, 2021, 11:41am UTC](https://discuss.elastic.co/t/how-to-use-the-search-after-after-getting-the-result-using-the-geolocation-sort/266359 "2021-03-05T11:41:07Z")
Hi, I have an index in which I have a point field that holds the geolocation of the place, and I have a user interface on the frontend where the user can move the map and he will get the top 10 nearest location, everyth… --- ## [Setting a Time Zone for a Dashboard](https://discuss.elastic.co/t/setting-a-time-zone-for-a-dashboard/265941)
**Author:** [@Rakesh\_Rayabarapu](https://discuss.elastic.co/u/Rakesh_Rayabarapu)\ **Replies:** 2\ **Last updated:** [March 5, 2021, 11:39am UTC](https://discuss.elastic.co/t/setting-a-time-zone-for-a-dashboard/265941 "2021-03-05T11:39:26Z")
Hello Team, Greetings for the Day ! I am looking if it is possible to set a time zone when creating a specific visualization/dashboard/canvas Work pad by using advanced json / css in canvas. The purpose for this is so … --- ## [\[0\] "\_dateparsefailure"](https://discuss.elastic.co/t/0-dateparsefailure/266226)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 4\ **Last updated:** [March 5, 2021, 11:38am UTC](https://discuss.elastic.co/t/0-dateparsefailure/266226 "2021-03-05T11:38:09Z")
I want to replace timestamp with my field timestamp. I have tried but getting error so kindly share solution for this problem. "message" =\> "8/12/2020 0:00,jack,jazz,your recent attemt failed.,"9000.00 have been Debited… --- ## [Alerting elastic cloud kibana: Filter tresholds in alerts](https://discuss.elastic.co/t/alerting-elastic-cloud-kibana-filter-tresholds-in-alerts/266250)
**Author:** [@avanlieshout](https://discuss.elastic.co/u/avanlieshout)\ **Replies:** 3\ **Last updated:** [March 5, 2021, 11:33am UTC](https://discuss.elastic.co/t/alerting-elastic-cloud-kibana-filter-tresholds-in-alerts/266250 "2021-03-05T11:33:01Z")
Hi all, Is there a way to add a filter to alerting? As een example we we don’t want group per “action\_name” with one condition as below, but uphold different conditions for different “action\_name”’s (action\_1 \> 100, ac… --- ## [Watcher webhook url has no port](https://discuss.elastic.co/t/watcher-webhook-url-has-no-port/266279)
**Author:** [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\ **Replies:** 2\ **Last updated:** [March 5, 2021, 11:07am UTC](https://discuss.elastic.co/t/watcher-webhook-url-has-no-port/266279 "2021-03-05T11:07:16Z")
I have an api endpoint that does not have a port. I can hit the endpoint with java but the webhook requires a port. Is there a work around for this issue? --- ## [Elastic does not reindex all indicies while using a wildcard](https://discuss.elastic.co/t/elastic-does-not-reindex-all-indicies-while-using-a-wildcard/266336)
**Author:** [@konart](https://discuss.elastic.co/u/konart)\ **Replies:** 4\ **Last updated:** [March 5, 2021, 10:30am UTC](https://discuss.elastic.co/t/elastic-does-not-reindex-all-indicies-while-using-a-wildcard/266336 "2021-03-05T10:30:34Z")
Hi! I'm trying to reindex our indicies for them to use updated mappings. Here is the query: { "source": { "index": "cards\_\*" }, "dest": { "index": "cards\_temp" … --- ## [Filebeat 7.3.1 - Exiting: setup.template.name and setup.template.pattern have to be set if index name is modified](https://discuss.elastic.co/t/filebeat-7-3-1-exiting-setup-template-name-and-setup-template-pattern-have-to-be-set-if-index-name-is-modified/266204)
**Author:** [@dcenaculo](https://discuss.elastic.co/u/dcenaculo)\ **Replies:** 2\ **Last updated:** [March 5, 2021, 9:52am UTC](https://discuss.elastic.co/t/filebeat-7-3-1-exiting-setup-template-name-and-setup-template-pattern-have-to-be-set-if-index-name-is-modified/266204 "2021-03-05T09:52:50Z")
Hi, I'm using Elastic Stack 7.3.1 and Filebeat 7.3.1. Now, when I try to start the filebeat, the following message appears: PS C:\\filebeat-7.3.1-windows-x86\_64\> .\\filebeat.exe Exiting: setup.template.name and setup.tem… --- ## [Mapping all Bools as String](https://discuss.elastic.co/t/mapping-all-bools-as-string/265583)
**Author:** [@scott\_stash](https://discuss.elastic.co/u/scott_stash)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 9:35am UTC](https://discuss.elastic.co/t/mapping-all-bools-as-string/265583 "2021-03-05T09:35:22Z")
When my logstash starts it sends a template to ES where I set the mappings for various fields. I'm getting a lot of conflicts on a lot of fields(150+) that I do not have individual mappings for. These are dynamic as th… --- ## [How to add field to every element from an array with logstash ruby](https://discuss.elastic.co/t/how-to-add-field-to-every-element-from-an-array-with-logstash-ruby/266257)
**Author:** [@syrine\_chelly](https://discuss.elastic.co/u/syrine_chelly)\ **Replies:** 4\ **Last updated:** [March 5, 2021, 9:33am UTC](https://discuss.elastic.co/t/how-to-add-field-to-every-element-from-an-array-with-logstash-ruby/266257 "2021-03-05T09:33:35Z")
Hi I have an array such like this: "step": \[ "\> MESSAGE AUTOMATE 03/08/2020 18:39:01 : POUR LA JOURNEE DU 20200731 L'ETAPE UNIP A PRIS 00H00", "\> MESSAGE AUTOMATE 03/08/2020 18:39:01 : POUR LA JOURNEE DU 20… --- ## [Docker limits and JVM heap setting](https://discuss.elastic.co/t/docker-limits-and-jvm-heap-setting/266339)
**Author:** [@Waxman](https://discuss.elastic.co/u/Waxman)\ **Replies:** 0\ **Last updated:** [March 5, 2021, 9:07am UTC](https://discuss.elastic.co/t/docker-limits-and-jvm-heap-setting/266339 "2021-03-05T09:07:10Z")
Hello People, quick question (confirmation). I've got a server with 32 GB ram and 4vcpcu for one elk node (v7.11.1). If I set this in docker-compose (v.2.4): mem\_limit: 24G mem\_reservation: 4G cpus: 4 And … --- ## [Filebeat 7.9.1 can't ship message to Logstash 7.9.1](https://discuss.elastic.co/t/filebeat-7-9-1-cant-ship-message-to-logstash-7-9-1/266338)
**Author:** [@grazia0912](https://discuss.elastic.co/u/grazia0912)\ **Replies:** 0\ **Last updated:** [March 5, 2021, 9:04am UTC](https://discuss.elastic.co/t/filebeat-7-9-1-cant-ship-message-to-logstash-7-9-1/266338 "2021-03-05T09:04:11Z")
Hi, i have installed Filebeat v7.9.1 on my Windows server and the logstash i am shipping the message is in 7.9.1 as well. However, when i ran the filebeat it seems to not get successful connection to the logstash. Previo… --- ## [Enquiry about sampling in elasticsearch](https://discuss.elastic.co/t/enquiry-about-sampling-in-elasticsearch/266092)
**Author:** [@iammanmale](https://discuss.elastic.co/u/iammanmale)\ **Replies:** 0\ **Last updated:** [March 3, 2021, 11:10am UTC](https://discuss.elastic.co/t/enquiry-about-sampling-in-elasticsearch/266092 "2021-03-03T11:10:49Z")
As we want to reduce the amount log indexing into ES nodes, i would like to know if filebeat or logstash has filters to do sampling? For example, can the filebeat push only 1 of every 5 lines from the log files to logsta… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1520) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1522)