# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1539 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1540 --- ## [Suggestions for a better text based query - using match\_phrase but it's too precise](https://discuss.elastic.co/t/suggestions-for-a-better-text-based-query-using-match-phrase-but-its-too-precise/265138)
**Author:** [@M\_Gibbs](https://discuss.elastic.co/u/M_Gibbs)\ **Replies:** 1\ **Last updated:** [February 24, 2021, 5:36am UTC](https://discuss.elastic.co/t/suggestions-for-a-better-text-based-query-using-match-phrase-but-its-too-precise/265138 "2021-02-24T05:36:24Z")
Hi there, My title probably doesn't elaborate that well. We have a significant dataset, where our end-users can search base don a job\_title. Currently I'm using: bool should match\_phrase We also include "minimum\_s… --- ## [Unable to index with below error](https://discuss.elastic.co/t/unable-to-index-with-below-error/265277)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 0\ **Last updated:** [February 24, 2021, 5:21am UTC](https://discuss.elastic.co/t/unable-to-index-with-below-error/265277 "2021-02-24T05:21:42Z")
Hi Team, I am facing an error while ingesting logs in elasticsearch. \[2021-02-24T10:44:15,640\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main\]\[69d9e547a776f45c4f2e9d8533dceb1247bd41e30f7abf5602145295741669ba\] Could not in… --- ## [Zstd support](https://discuss.elastic.co/t/zstd-support/264947)
**Author:** [@Andrii](https://discuss.elastic.co/u/Andrii)\ **Replies:** 1\ **Last updated:** [February 24, 2021, 5:11am UTC](https://discuss.elastic.co/t/zstd-support/264947 "2021-02-24T05:11:36Z")
Hello, Are there any plans to support zstd compression for kafka output? zstd support was fixed in sarama 1.26.0 --- ## [Elastic Search - how to interpret this exception](https://discuss.elastic.co/t/elastic-search-how-to-interpret-this-exception/265273)
**Author:** [@nages](https://discuss.elastic.co/u/nages)\ **Replies:** 0\ **Last updated:** [February 24, 2021, 4:00am UTC](https://discuss.elastic.co/t/elastic-search-how-to-interpret-this-exception/265273 "2021-02-24T04:00:24Z")
This is the code I am running and it is missing custom analyzer name . And I got the following error { "error": { "root\_cause": \[ { "type": "settings\_exception", "reason": "Failed to get sett… --- ## [Alias-Dashboard/Visualizations-Cold indicies-Errors](https://discuss.elastic.co/t/alias-dashboard-visualizations-cold-indicies-errors/265251)
**Author:** [@leemase004](https://discuss.elastic.co/u/leemase004)\ **Replies:** 1\ **Last updated:** [February 23, 2021, 8:41pm UTC](https://discuss.elastic.co/t/alias-dashboard-visualizations-cold-indicies-errors/265251 "2021-02-23T20:41:44Z")
We have an index pattern: search-ids. That index pattern is mapped for: ids-alert-\* We recently closed and froze indices that were not being searched. Since our index pattern encompasses every single index- it keeps l… --- ## [Is it possible to configure dynamic indices with ILM?](https://discuss.elastic.co/t/is-it-possible-to-configure-dynamic-indices-with-ilm/264497)
**Author:** [@sarahw](https://discuss.elastic.co/u/sarahw)\ **Replies:** 2\ **Last updated:** [February 24, 2021, 1:02am UTC](https://discuss.elastic.co/t/is-it-possible-to-configure-dynamic-indices-with-ilm/264497 "2021-02-24T01:02:21Z")
We currently use a single filebeat config with ILM disabled to ingest logs from an IIS web application and IIS access/error logs using the IIS module. We have been using filebeat to generate daily indices, but now we wou… --- ## [How to connect Winlogbeat to Elasticsearch dockrized Cluster using SSL?](https://discuss.elastic.co/t/how-to-connect-winlogbeat-to-elasticsearch-dockrized-cluster-using-ssl/265013)
**Author:** [@Cyber](https://discuss.elastic.co/u/Cyber)\ **Replies:** 1\ **Last updated:** [February 23, 2021, 10:51pm UTC](https://discuss.elastic.co/t/how-to-connect-winlogbeat-to-elasticsearch-dockrized-cluster-using-ssl/265013 "2021-02-23T22:51:38Z")
For the past week I am trying to connect a Winlogbeat(Which is on my host machine) To an elasticsearch Cluster that I set up on an Ubuntu VM using dockers. Following this tutorial. (In the tutorial they don't explain ho… --- ## [Converting Duration Field From Text To Number](https://discuss.elastic.co/t/converting-duration-field-from-text-to-number/265255)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 3\ **Last updated:** [February 23, 2021, 10:35pm UTC](https://discuss.elastic.co/t/converting-duration-field-from-text-to-number/265255 "2021-02-23T22:35:49Z")
I have a field that displays connection duration as a string that looks like 3h:49m:57s. Any ideas on how to convert this to an aggregateable format such as epoch time or something? --- ## [Filebeat errors on setup - Apache ingest pipelines failing to load](https://discuss.elastic.co/t/filebeat-errors-on-setup-apache-ingest-pipelines-failing-to-load/265134)
**Author:** [@QueenAmidala](https://discuss.elastic.co/u/QueenAmidala)\ **Replies:** 7\ **Last updated:** [February 23, 2021, 10:24pm UTC](https://discuss.elastic.co/t/filebeat-errors-on-setup-apache-ingest-pipelines-failing-to-load/265134 "2021-02-23T22:24:50Z")
So here is my problem it seems filbeats setup is failing for me. I get a bunch of empty error messages \*\*"Exiting: 1 error: Error setting up ML for apache\_ecs: 17 errors: ; ; ; ; ; ; ; ; ; ; error while".\*\* I'm thinkin… --- ## [Cluster business usage](https://discuss.elastic.co/t/cluster-business-usage/265005)
**Author:** [@fha\_1](https://discuss.elastic.co/u/fha_1)\ **Replies:** 3\ **Last updated:** [February 23, 2021, 9:22pm UTC](https://discuss.elastic.co/t/cluster-business-usage/265005 "2021-02-23T21:22:52Z")
Hello, Is there a built-in way to retrieve the most requested documents and the most frequent queries and aggregations (for a cluster and for an index)? If not, what is the best approach to fill this need? Regards F --- ## [Is it possible to retrieve the api\_key value after initial creation?](https://discuss.elastic.co/t/is-it-possible-to-retrieve-the-api-key-value-after-initial-creation/265233)
**Author:** [@dvo](https://discuss.elastic.co/u/dvo)\ **Replies:** 2\ **Last updated:** [February 23, 2021, 7:18pm UTC](https://discuss.elastic.co/t/is-it-possible-to-retrieve-the-api-key-value-after-initial-creation/265233 "2021-02-23T19:18:52Z")
I'm relatively new to Elastic and can't seem to find information about this with a search... I understand that anyone creating an API key should secure the api\_key value returned at creation. Is there any way for a supe… --- ## [Grok Timestamp](https://discuss.elastic.co/t/grok-timestamp/265236)
**Author:** [@Alex\_Leong](https://discuss.elastic.co/u/Alex_Leong)\ **Replies:** 1\ **Last updated:** [February 23, 2021, 7:13pm UTC](https://discuss.elastic.co/t/grok-timestamp/265236 "2021-02-23T19:13:17Z")
I have sample log as follows, and trying to grok it so that the timestamp is in the format YYYY-MM-DD HH:MI:SS.ssssss. Hence the timestamp "0204 14:29:42.248281" becomes "2021-02-04 14:29:42.24828" Sample log : E0204… --- ## [JSON Parsing Issue](https://discuss.elastic.co/t/json-parsing-issue/265219)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 4\ **Last updated:** [February 23, 2021, 6:54pm UTC](https://discuss.elastic.co/t/json-parsing-issue/265219 "2021-02-23T18:54:13Z")
Running Logstash 7.10 and having an issue with parsing a JSON-ish field. Here's my filter config: if \[vpn\]\[tunnel\_type\] { mutate { gsub =\> \[ "\[vpn\]\[tunnel\_type\]", '\\=\\\>', ':' \] … --- ## [Sum bucket of filters no longer works in kibana 7.11](https://discuss.elastic.co/t/sum-bucket-of-filters-no-longer-works-in-kibana-7-11/265207)
**Author:** [@Matthew\_Field](https://discuss.elastic.co/u/Matthew_Field)\ **Replies:** 5\ **Last updated:** [February 23, 2021, 6:28pm UTC](https://discuss.elastic.co/t/sum-bucket-of-filters-no-longer-works-in-kibana-7-11/265207 "2021-02-23T18:28:40Z")
Since upgrading to kibana 7.11 my sibling sum bucket aggregations no longer work. Following upgrade the visualisations that were previously working were all blank. I am trying now to recreate the same visualisations as… --- ## [Few questions about Elastic Agent 7.10.2](https://discuss.elastic.co/t/few-questions-about-elastic-agent-7-10-2/264641)
**Author:** [@dvo](https://discuss.elastic.co/u/dvo)\ **Replies:** 5\ **Last updated:** [February 23, 2021, 6:25pm UTC](https://discuss.elastic.co/t/few-questions-about-elastic-agent-7-10-2/264641 "2021-02-23T18:25:42Z")
The Windows agent installation is a little confusing. You download the zip and extract it to Program Files\\elastic-agent. When you run the command to install the agent service and get it talking with Fleet, a new but n… --- ## [Basic Authentication with https and native realm](https://discuss.elastic.co/t/basic-authentication-with-https-and-native-realm/265148)
**Author:** [@shivkumar.chelwa](https://discuss.elastic.co/u/shivkumar.chelwa)\ **Replies:** 5\ **Last updated:** [February 23, 2021, 5:26pm UTC](https://discuss.elastic.co/t/basic-authentication-with-https-and-native-realm/265148 "2021-02-23T17:26:07Z")
I am trying to use Basic Authentication when HTTPS is enabled. I am using default "native" realm. Is Basic Authentication not supported when HTTPS is enabled and realm is "native"? I successfully used API Key and but co… --- ## [Logstash output to Elasticsearch name index based on field?](https://discuss.elastic.co/t/logstash-output-to-elasticsearch-name-index-based-on-field/264584)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 11\ **Last updated:** [February 23, 2021, 4:18pm UTC](https://discuss.elastic.co/t/logstash-output-to-elasticsearch-name-index-based-on-field/264584 "2021-02-23T16:18:24Z")
Hello. Im trying to name a index based on a field but it doesnt seem to work: output { elasticsearch { hosts =\> \["localhost"\] user =\> \["elastic"\] password =\> \["pass"\] index =\> "winlogbeat-server-winapplication-%{… --- ## [Wildfly grok date not extracted](https://discuss.elastic.co/t/wildfly-grok-date-not-extracted/264441)
**Author:** [@jsec](https://discuss.elastic.co/u/jsec)\ **Replies:** 4\ **Last updated:** [February 23, 2021, 4:17pm UTC](https://discuss.elastic.co/t/wildfly-grok-date-not-extracted/264441 "2021-02-23T16:17:25Z")
Hello, I'm trying to parse the following wildfly log format: 2021-02-16 00:01:34,505 ERROR \[org.springframework.boot.cttt.web.ErrorPageFilter\] (default task-48) Forwarding to error page from request \[/user/history\] due… --- ## [Get data from Kibana using Elasticsearch API](https://discuss.elastic.co/t/get-data-from-kibana-using-elasticsearch-api/264672)
**Author:** [@Carlos\_Patricio](https://discuss.elastic.co/u/Carlos_Patricio)\ **Replies:** 5\ **Last updated:** [February 23, 2021, 4:11pm UTC](https://discuss.elastic.co/t/get-data-from-kibana-using-elasticsearch-api/264672 "2021-02-23T16:11:38Z")
Hi, I'm trying to retrieve data from one Kibana view using the API request. The request from the view: The response with the expected result: And then I tried to paste the request to Kibana \> Dev Tools \> Console,… --- ## [How to combine multilines to a single entry in kibana for a log](https://discuss.elastic.co/t/how-to-combine-multilines-to-a-single-entry-in-kibana-for-a-log/265165)
**Author:** [@nikhilesh](https://discuss.elastic.co/u/nikhilesh)\ **Replies:** 2\ **Last updated:** [February 23, 2021, 4:05pm UTC](https://discuss.elastic.co/t/how-to-combine-multilines-to-a-single-entry-in-kibana-for-a-log/265165 "2021-02-23T16:05:43Z")
Hi Team, Below is the log file , I need to achieve the below scenario's please help me on this. Scenario 1: Right now, I was getting the logs in the Kibana dashboard as below. I want all the multiline in the logs shou… --- ## [Regarding Metric Filter](https://discuss.elastic.co/t/regarding-metric-filter/265211)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 1\ **Last updated:** [February 23, 2021, 3:50pm UTC](https://discuss.elastic.co/t/regarding-metric-filter/265211 "2021-02-23T15:50:44Z")
Hi, I'm trying to dynamically add fields to a metric filter. Can you tell me why this is failing interpolation? metrics { meter =\> \[ "events" \] add\_field =\> { "agent" =\> "%{\[agen… --- ## [Visualize the sum of differences of timestamps](https://discuss.elastic.co/t/visualize-the-sum-of-differences-of-timestamps/264708)
**Author:** [@darefilz](https://discuss.elastic.co/u/darefilz)\ **Replies:** 2\ **Last updated:** [February 23, 2021, 3:22pm UTC](https://discuss.elastic.co/t/visualize-the-sum-of-differences-of-timestamps/264708 "2021-02-23T15:22:27Z")
We want to visualize the amount of time a user spend on our websites. Let's say each user action on such a website has a timestamp (@timestamp) and the name of the site (page) and the users name (user). So we term-aggre… --- ## [Alert query for kubernetes](https://discuss.elastic.co/t/alert-query-for-kubernetes/265003)
**Author:** [@alfredo.deluca](https://discuss.elastic.co/u/alfredo.deluca)\ **Replies:** 6\ **Last updated:** [February 23, 2021, 3:21pm UTC](https://discuss.elastic.co/t/alert-query-for-kubernetes/265003 "2021-02-23T15:21:43Z")
Hi all. I use elastic cloud 7.11.0 and we have filebeat and metricbeat running on a k8s cluster. I also have an alert on watcher to send and aletr when a POD in the kubernetes cluster goes down. Now the query it's fine… --- ## [Syslog Preserve host](https://discuss.elastic.co/t/syslog-preserve-host/265216)
**Author:** [@petegriggs](https://discuss.elastic.co/u/petegriggs)\ **Replies:** 0\ **Last updated:** [February 23, 2021, 3:10pm UTC](https://discuss.elastic.co/t/syslog-preserve-host/265216 "2021-02-23T15:10:55Z")
Hey! I have some devices pointing at logstash and in turn this is forwarding on to a SIEM via syslog - however when we output to syslog the messages appear to come from logstash - is there a way to preserve the sysloggi… --- ## [Kibana Watcher and Reporting](https://discuss.elastic.co/t/kibana-watcher-and-reporting/264752)
**Author:** [@vishakh](https://discuss.elastic.co/u/vishakh)\ **Replies:** 1\ **Last updated:** [February 23, 2021, 2:37pm UTC](https://discuss.elastic.co/t/kibana-watcher-and-reporting/264752 "2021-02-23T14:37:59Z")
Currently, I'm running 7.10 stack I did create a visualization with tabular data having two columns. Now, I'm looking to create an alert/watcher for every 30mins that would run and send-out report in tabular format (sa… --- ## [How to combine (logical "and") membership of 2 LDAP groups in role\_mapping file](https://discuss.elastic.co/t/how-to-combine-logical-and-membership-of-2-ldap-groups-in-role-mapping-file/265133)
**Author:** [@Javad\_Alipanah](https://discuss.elastic.co/u/Javad_Alipanah)\ **Replies:** 2\ **Last updated:** [February 23, 2021, 2:33pm UTC](https://discuss.elastic.co/t/how-to-combine-logical-and-membership-of-2-ldap-groups-in-role-mapping-file/265133 "2021-02-23T14:33:30Z")
Hello everybody, I have trouble writing LDAP role\_mapping.yml. I want to map users who are members of both 'elk-users' and 'team-core' groups to an elastic role. I did it through API and Lucene language using the 'all'… --- ## [String range queries, non-identical lengths](https://discuss.elastic.co/t/string-range-queries-non-identical-lengths/265210)
**Author:** [@Andrew\_Riley](https://discuss.elastic.co/u/Andrew_Riley)\ **Replies:** 0\ **Last updated:** [February 23, 2021, 2:15pm UTC](https://discuss.elastic.co/t/string-range-queries-non-identical-lengths/265210 "2021-02-23T14:15:03Z")
I've been trying to develop some range queries of business applied document IDs. These are mixed alphanumeric values like "1a" and "47b" I've had a look at previous questions such as; https://discuss.elastic.co/t/elasti… --- ## [Filebeat not starting log aggregation on some kubernetes worker nodes](https://discuss.elastic.co/t/filebeat-not-starting-log-aggregation-on-some-kubernetes-worker-nodes/265204)
**Author:** [@lbenton](https://discuss.elastic.co/u/lbenton)\ **Replies:** 0\ **Last updated:** [February 23, 2021, 1:26pm UTC](https://discuss.elastic.co/t/filebeat-not-starting-log-aggregation-on-some-kubernetes-worker-nodes/265204 "2021-02-23T13:26:55Z")
Hi All, I've run into an issue with filebeat in kubernetes, but only on some worker nodes. If useful, here's a bit of background -Deployed using helm, via terraform -currently 16 worker nodes, 7 of which filebeat ref… --- ## [How to check if a master node auto-election is enabled?](https://discuss.elastic.co/t/how-to-check-if-a-master-node-auto-election-is-enabled/265197)
**Author:** [@Manikandan\_Kbk](https://discuss.elastic.co/u/Manikandan_Kbk)\ **Replies:** 5\ **Last updated:** [February 23, 2021, 12:48pm UTC](https://discuss.elastic.co/t/how-to-check-if-a-master-node-auto-election-is-enabled/265197 "2021-02-23T12:48:27Z")
We have installed ES 6.2.4 and have 3 master node setup. Is there a way to check if auto-election of master node is enabled in case active master goes down? do elastic search always do auto-election (or) disabling auto… --- ## [Ingest Pipeline, set field derived from another](https://discuss.elastic.co/t/ingest-pipeline-set-field-derived-from-another/265195)
**Author:** [@nberens](https://discuss.elastic.co/u/nberens)\ **Replies:** 2\ **Last updated:** [February 23, 2021, 12:25pm UTC](https://discuss.elastic.co/t/ingest-pipeline-set-field-derived-from-another/265195 "2021-02-23T12:25:14Z")
Hello, i am currently building a new pipeline for filebeat where we ingest a lot of different logfiles, e.g. /log/appname1.log /log/appname2.log etc now i want a field in every document that says: app: appname1 So… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1538) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1540)