# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1547 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1548 --- ## [Possible to have KQL in Elastic?](https://discuss.elastic.co/t/possible-to-have-kql-in-elastic/264842)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 1\ **Last updated:** [February 19, 2021, 11:21am UTC](https://discuss.elastic.co/t/possible-to-have-kql-in-elastic/264842 "2021-02-19T11:21:05Z")
Dear all =) Is it possible to "execute" KQL in Elasticsearch? If not, does there exist a script/translator, so KQL can be converted to Lucene? Hugs, Sandra =) --- ## [Delete old rollover index](https://discuss.elastic.co/t/delete-old-rollover-index/263365)
**Author:** [@graimato](https://discuss.elastic.co/u/graimato)\ **Replies:** 1\ **Last updated:** [February 19, 2021, 10:54am UTC](https://discuss.elastic.co/t/delete-old-rollover-index/263365 "2021-02-19T10:54:55Z")
Dear all I implemented a ILM policy { "metricbeat-7.10.2" : { "version" : 1, "modified\_date" : "2021-02-04T15:52:42.289Z", "policy" : { "phases" : { "hot" : { "min\_age" : "0ms", … --- ## [Exiting: error loading config file: yaml: line 29: did not find expected key](https://discuss.elastic.co/t/exiting-error-loading-config-file-yaml-line-29-did-not-find-expected-key/264816)
**Author:** [@Clyton](https://discuss.elastic.co/u/Clyton)\ **Replies:** 1\ **Last updated:** [February 19, 2021, 10:54am UTC](https://discuss.elastic.co/t/exiting-error-loading-config-file-yaml-line-29-did-not-find-expected-key/264816 "2021-02-19T10:54:46Z")
Hi All, I'm trying to configure kafka output based on two input location conditions, wherein I'm encountering the below error. Please advise !! # ============================== Filebeat inputs =========================… --- ## [Should we need SSl to enable Alerts in kibana(watcher)? and please share query for alerts](https://discuss.elastic.co/t/should-we-need-ssl-to-enable-alerts-in-kibana-watcher-and-please-share-query-for-alerts/262593)
**Author:** [@Srikanth\_Kesireddy](https://discuss.elastic.co/u/Srikanth_Kesireddy)\ **Replies:** 1\ **Last updated:** [February 1, 2021, 12:49am UTC](https://discuss.elastic.co/t/should-we-need-ssl-to-enable-alerts-in-kibana-watcher-and-please-share-query-for-alerts/262593 "2021-02-01T00:49:54Z")
for enabling Xpack security and alerts should we need ssl ? --- ## [Multiline kernel panic log parsing by filebeat](https://discuss.elastic.co/t/multiline-kernel-panic-log-parsing-by-filebeat/264824)
**Author:** [@Kuo\_Hugo](https://discuss.elastic.co/u/Kuo_Hugo)\ **Replies:** 0\ **Last updated:** [February 19, 2021, 9:21am UTC](https://discuss.elastic.co/t/multiline-kernel-panic-log-parsing-by-filebeat/264824 "2021-02-19T09:21:51Z")
I have hard time to index the kernel panic logs by filebeat as below example. Do you have suggestion about the best option to index Linux kernel logs? I don't see an option to handle the multiline logs as the kernel pa… --- ## [How to create multiple indexs with multiple input in logstash](https://discuss.elastic.co/t/how-to-create-multiple-indexs-with-multiple-input-in-logstash/264416)
**Author:** [@Falikou1](https://discuss.elastic.co/u/Falikou1)\ **Replies:** 7\ **Last updated:** [February 19, 2021, 9:06am UTC](https://discuss.elastic.co/t/how-to-create-multiple-indexs-with-multiple-input-in-logstash/264416 "2021-02-19T09:06:02Z")
I would like to have some help to configure multiple indexes from multiple entries with logstash. Is my configuration below correct? input { tcp { port =\> "5140" codec =\> json type =\> "syslog" } tcp { port =\> "5… --- ## [Enlarge Cluster with new nodes](https://discuss.elastic.co/t/enlarge-cluster-with-new-nodes/263974)
**Author:** [@cadirol](https://discuss.elastic.co/u/cadirol)\ **Replies:** 9\ **Last updated:** [February 19, 2021, 8:57am UTC](https://discuss.elastic.co/t/enlarge-cluster-with-new-nodes/263974 "2021-02-19T08:57:32Z")
Hi all We are planing to enlarge our cluster with 16 nodes in the end. the first 16 nodes are 4 years old, but still healthy and good enough! But as you can imagine, 4 years ago, we added 4TB Disk space in each node. … --- ## [Send logs from filebeat to 2 graylog instances](https://discuss.elastic.co/t/send-logs-from-filebeat-to-2-graylog-instances/264701)
**Author:** [@shresthomniit](https://discuss.elastic.co/u/shresthomniit)\ **Replies:** 2\ **Last updated:** [February 19, 2021, 8:45am UTC](https://discuss.elastic.co/t/send-logs-from-filebeat-to-2-graylog-instances/264701 "2021-02-19T08:45:34Z")
Hello Everyone, I want to send logs from server-1 to server-2 and server-3. Server-1 has filebeat configured. Server-2 has 1 graylog instance running. (let say it has IP-1) Server-3 has another graylog instance runni… --- ## [Query issue, dot in field value returning 0 hits](https://discuss.elastic.co/t/query-issue-dot-in-field-value-returning-0-hits/264819)
**Author:** [@Sampson\_Light](https://discuss.elastic.co/u/Sampson_Light)\ **Replies:** 0\ **Last updated:** [February 19, 2021, 8:43am UTC](https://discuss.elastic.co/t/query-issue-dot-in-field-value-returning-0-hits/264819 "2021-02-19T08:43:38Z")
Hello, There's an issue with the use of . in my field value. The sample below is a 'valid' query that returns some hits { "query": { "bool": { "must": \[ { "wildcard": { "Addre… --- ## [Why term query, keyword is faster than number](https://discuss.elastic.co/t/why-term-query-keyword-is-faster-than-number/264812)
**Author:** [@asasas234](https://discuss.elastic.co/u/asasas234)\ **Replies:** 1\ **Last updated:** [February 19, 2021, 8:26am UTC](https://discuss.elastic.co/t/why-term-query-keyword-is-faster-than-number/264812 "2021-02-19T08:26:00Z")
I saw in https://www.elastic.co/guide/en/elasticsearch/reference/current/tune-for-search-speed.html#map-ids-as-keyword, in term query, keyword query The speed is faster than the digital type, but I am not sure what the r… --- ## [Kibana: export pre-configured dashboard as pdf/png](https://discuss.elastic.co/t/kibana-export-pre-configured-dashboard-as-pdf-png/264391)
**Author:** [@eeijlar](https://discuss.elastic.co/u/eeijlar)\ **Replies:** 5\ **Last updated:** [February 19, 2021, 8:08am UTC](https://discuss.elastic.co/t/kibana-export-pre-configured-dashboard-as-pdf-png/264391 "2021-02-19T08:08:19Z")
We have the following use cases for working with Kibana: Use Case 1 We run automated performance tests using a Jenkins pipeline. We would like to be able to import a pre-configured dashboard at the start of the test, r… --- ## [All shards failed](https://discuss.elastic.co/t/all-shards-failed/264777)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 1\ **Last updated:** [February 19, 2021, 8:08am UTC](https://discuss.elastic.co/t/all-shards-failed/264777 "2021-02-19T08:08:00Z")
I have been having a series of issues since the backup filled up the disks and ES ground to a halt. Cluster is now yellow and most indexes appear to be fine others have missing shards which I am working on. Searches ar… --- ## [Can we search from multiple indexs and assemble their？](https://discuss.elastic.co/t/can-we-search-from-multiple-indexs-and-assemble-their/264804)
**Author:** [@Anyzm](https://discuss.elastic.co/u/Anyzm)\ **Replies:** 1\ **Last updated:** [February 19, 2021, 7:55am UTC](https://discuss.elastic.co/t/can-we-search-from-multiple-indexs-and-assemble-their/264804 "2021-02-19T07:55:31Z")
can we search from multiple indexs and assemble their？ eg: there are two index person and car， there are a field called sex in index person and a field called color in index car，we want to search the women who own bla… --- ## [How to delete .monitoring\*mb\* indices automatically after period of time?](https://discuss.elastic.co/t/how-to-delete-monitoring-mb-indices-automatically-after-period-of-time/264647)
**Author:** [@dabo](https://discuss.elastic.co/u/dabo)\ **Replies:** 7\ **Last updated:** [February 19, 2021, 6:41am UTC](https://discuss.elastic.co/t/how-to-delete-monitoring-mb-indices-automatically-after-period-of-time/264647 "2021-02-19T06:41:33Z")
Hi, We are using Cloud Platinum subscription. We enabled Metricbeat monitoring on 21st of January. Seems like .monitoring indices (old and new) are deleted only after 1 month or not deleted at all. Can we control ret… --- ## [Comparisons with empty strings](https://discuss.elastic.co/t/comparisons-with-empty-strings/264808)
**Author:** [@sultanao](https://discuss.elastic.co/u/sultanao)\ **Replies:** 0\ **Last updated:** [February 19, 2021, 7:41am UTC](https://discuss.elastic.co/t/comparisons-with-empty-strings/264808 "2021-02-19T07:41:56Z")
Hi, I am using Elasticsearch 6.6.0 and I noticed that this query: { "query": { "range": { "my\_alphanumeric\_field": { "from": "", "to": null, "include\_lower… --- ## [Power BI ODFE ODBC SQL Driver](https://discuss.elastic.co/t/power-bi-odfe-odbc-sql-driver/264427)
**Author:** [@shharukh](https://discuss.elastic.co/u/shharukh)\ **Replies:** 1\ **Last updated:** [February 19, 2021, 7:15am UTC](https://discuss.elastic.co/t/power-bi-odfe-odbc-sql-driver/264427 "2021-02-19T07:15:09Z")
hello i have downloaded and configured ODFE ODBC driver but only a small chunk of data is being fetched which is 200 row form any index if you can help me i would be very grateful --- ## [Cannot create Index Patterns of remote clusters - Kibana 7.10.0](https://discuss.elastic.co/t/cannot-create-index-patterns-of-remote-clusters-kibana-7-10-0/262206)
**Author:** [@Phandora](https://discuss.elastic.co/u/Phandora)\ **Replies:** 5\ **Last updated:** [February 19, 2021, 6:48am UTC](https://discuss.elastic.co/t/cannot-create-index-patterns-of-remote-clusters-kibana-7-10-0/262206 "2021-02-19T06:48:35Z")
Hi, we are facing some problems creating index patterns in the 7.10.0 version. When trying to create the index pattern of a remote cluster we got the error No matching indices found. However, the indexes do exist (the i… --- ## [Kibana machine learning reporting (Version 7.9.3)](https://discuss.elastic.co/t/kibana-machine-learning-reporting-version-7-9-3/264523)
**Author:** [@Ingram\_Gultom](https://discuss.elastic.co/u/Ingram_Gultom)\ **Replies:** 2\ **Last updated:** [February 19, 2021, 6:21am UTC](https://discuss.elastic.co/t/kibana-machine-learning-reporting-version-7-9-3/264523 "2021-02-19T06:21:02Z")
Hi, Can we export machine learning visualization or add machine learning visualization to dashboard ? Thank you --- ## [Logstash adding unwanted "" & \\\\n to json input](https://discuss.elastic.co/t/logstash-adding-unwanted-n-to-json-input/264786)
**Author:** [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Replies:** 0\ **Last updated:** [February 19, 2021, 4:48am UTC](https://discuss.elastic.co/t/logstash-adding-unwanted-n-to-json-input/264786 "2021-02-19T04:48:39Z")
Hi, I have a log that I converted from plain text to json with JQ. I want to ingest this file into Elasticsearch as is. If I copy the text below add send it to Elasticsearch manually it shows up properly formatted etc. … --- ## [An assigned shards -- max retries exceeded](https://discuss.elastic.co/t/an-assigned-shards-max-retries-exceeded/264779)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 1\ **Last updated:** [February 19, 2021, 3:10am UTC](https://discuss.elastic.co/t/an-assigned-shards-max-retries-exceeded/264779 "2021-02-19T03:10:40Z")
Running on 7.10 I have several indexes which have unassigned replica shards (although) the primaries are OK. For example: { "index" : "authm-000005", "shard" : 1, "primary" : false, "current\_state" : "unassign… --- ## [Logstash error on Raspberry Pi 4 running Ubuntu Server 20.04.2](https://discuss.elastic.co/t/logstash-error-on-raspberry-pi-4-running-ubuntu-server-20-04-2/264202)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 2\ **Last updated:** [February 19, 2021, 2:46am UTC](https://discuss.elastic.co/t/logstash-error-on-raspberry-pi-4-running-ubuntu-server-20-04-2/264202 "2021-02-19T02:46:40Z")
Hello, I'm running 64-bit version of Ubuntu Server 20.04.2 on a Raspberry Pi 4 (4 GB RAM, hardware revision 1.1) I've installed logstash using apt. Configuration being used on this Raspberry Pi work on a different boar… --- ## [TVSB add 12 month line to existing visualisation](https://discuss.elastic.co/t/tvsb-add-12-month-line-to-existing-visualisation/264776)
**Author:** [@johnwood](https://discuss.elastic.co/u/johnwood)\ **Replies:** 1\ **Last updated:** [February 19, 2021, 1:44am UTC](https://discuss.elastic.co/t/tvsb-add-12-month-line-to-existing-visualisation/264776 "2021-02-19T01:44:56Z")
Hi All I have an existing suite of visualizations (TSVB) that show metrics over the past week. I would like to add a line to this TSVB visualization showing the same metric over the last 12 months so current weekly ups… --- ## [Map runtime field](https://discuss.elastic.co/t/map-runtime-field/263902)
**Author:** [@paasi6666](https://discuss.elastic.co/u/paasi6666)\ **Replies:** 1\ **Last updated:** [February 19, 2021, 12:50am UTC](https://discuss.elastic.co/t/map-runtime-field/263902 "2021-02-19T00:50:47Z")
I got following query which should create a new field: PUT filebeat\* { "mappings": { "runtime": { "sophos.utm.to.domain": { "type": "keyword", "script": { "source": "emit(def m = /@… --- ## [How to create a pipeline on a field that contains dots](https://discuss.elastic.co/t/how-to-create-a-pipeline-on-a-field-that-contains-dots/264666)
**Author:** [@aeroxy](https://discuss.elastic.co/u/aeroxy)\ **Replies:** 1\ **Last updated:** [February 19, 2021, 12:13am UTC](https://discuss.elastic.co/t/how-to-create-a-pipeline-on-a-field-that-contains-dots/264666 "2021-02-19T00:13:02Z")
When I use /\_ingest/pipeline/user\_agent to create a pipeline as such: { "description": "Add user agent information", "processors": \[ { "user\_agent": { "field": "meta.http.head… --- ## [Scripted field cut values in return statement](https://discuss.elastic.co/t/scripted-field-cut-values-in-return-statement/264649)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 3\ **Last updated:** [February 18, 2021, 11:09pm UTC](https://discuss.elastic.co/t/scripted-field-cut-values-in-return-statement/264649 "2021-02-18T23:09:00Z")
Hello This is my script if(!doc\['field1'\].empty) { return doc\['filed1'\].value; } else if(!doc\['field2'\].empty) { return doc\['field2'\].value; } else return "N/A"; I see that the field in the second condition is cut. F… --- ## [Guidance setting up Kibana alarms on other cluster's metrics](https://discuss.elastic.co/t/guidance-setting-up-kibana-alarms-on-other-clusters-metrics/264498)
**Author:** [@omora\_ando](https://discuss.elastic.co/u/omora_ando)\ **Replies:** 3\ **Last updated:** [February 18, 2021, 10:53pm UTC](https://discuss.elastic.co/t/guidance-setting-up-kibana-alarms-on-other-clusters-metrics/264498 "2021-02-18T22:53:11Z")
Hello, We are an Elastic Service Premium subscriber. I have two Deployments setup, for non-prod and prod workloads. Both clusters are using ES 7.9.3. I followed this documentation to setup a monitoring cluster with ES … --- ## [Collapse is not working Discover-Kibana](https://discuss.elastic.co/t/collapse-is-not-working-discover-kibana/264747)
**Author:** [@ssarnava](https://discuss.elastic.co/u/ssarnava)\ **Replies:** 2\ **Last updated:** [February 18, 2021, 10:21pm UTC](https://discuss.elastic.co/t/collapse-is-not-working-discover-kibana/264747 "2021-02-18T22:21:19Z")
My Requirement : Display latest entry (createdAt field) corresponding to a "trade.execID" in Kibana Discover. When I trigger this query from dev tools, getting expected result (single record) but when trying to use same … --- ## [Powershell alternative command for curl](https://discuss.elastic.co/t/powershell-alternative-command-for-curl/264679)
**Author:** [@Usman](https://discuss.elastic.co/u/Usman)\ **Replies:** 0\ **Last updated:** [February 18, 2021, 10:01am UTC](https://discuss.elastic.co/t/powershell-alternative-command-for-curl/264679 "2021-02-18T10:01:38Z")
Hi, I need the alternative for below command in windows power shell or .bat. curl --insecure -u user:password -X POST "https://hostname:443/\_reindex?pretty" -H 'Content-Type: application/json' -d' { "source": { "ind… --- ## [Cannot import template in elasticsearch](https://discuss.elastic.co/t/cannot-import-template-in-elasticsearch/264655)
**Author:** [@Voula\_Mikr](https://discuss.elastic.co/u/Voula_Mikr)\ **Replies:** 4\ **Last updated:** [February 18, 2021, 10:05pm UTC](https://discuss.elastic.co/t/cannot-import-template-in-elasticsearch/264655 "2021-02-18T22:05:03Z")
Hi I have an Elasticsearch with SearchGuard mechanism on. In searchguard configuration there is pmadmin role with the below permissions in sg\_roles.yml : sgs\_pmadmin\_role: cluster\_permissions: - SGS\_CLUSTER\_MONITOR … --- ## [Authentication of elastic was terminated by realm reserved - failed to authenticate user elastic](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/264711)
**Author:** [@testsemd\_email](https://discuss.elastic.co/u/testsemd_email)\ **Replies:** 1\ **Last updated:** [February 18, 2021, 10:02pm UTC](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/264711 "2021-02-18T22:02:13Z")
Got error: Authentication of elastic was terminated by realm reserved - failed to authenticate user elastic. Also can not start logstash. I'm using the elastic 7.10.1 version. Thank You! [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1546) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1548)