# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1556 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1557 --- ## [Be Careful With 7.11.0 Update If You Use LDAP With Realms](https://discuss.elastic.co/t/be-careful-with-7-11-0-update-if-you-use-ldap-with-realms/264253)
**Author:** [@patrickmm](https://discuss.elastic.co/u/patrickmm)\ **Replies:** 1\ **Last updated:** [February 14, 2021, 5:07pm UTC](https://discuss.elastic.co/t/be-careful-with-7-11-0-update-if-you-use-ldap-with-realms/264253 "2021-02-14T17:07:13Z")
About an hour ago, I tried updating my on prem 7.10.2 dev cluster (RHEL 8, 15 nodes) to 7.11.0. On the first node I ran yum update on, when I restarted Elasticsearch, it failed. I looked at journalctl and saw errors rel… --- ## [How to show retrieve all data fields of 2 indexes in same data table visualization](https://discuss.elastic.co/t/how-to-show-retrieve-all-data-fields-of-2-indexes-in-same-data-table-visualization/264223)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 4\ **Last updated:** [February 14, 2021, 4:02pm UTC](https://discuss.elastic.co/t/how-to-show-retrieve-all-data-fields-of-2-indexes-in-same-data-table-visualization/264223 "2021-02-14T16:02:16Z")
Hi all, In kibana, i have 2 indexes with a common field . I want to retrieve all data fields of 2 indexes in same data table visualization based on 1 common field something like vlookup in excel. For Example, i have 2… --- ## [Kibana: can't open kibana in my web browser](https://discuss.elastic.co/t/kibana-cant-open-kibana-in-my-web-browser/263893)
**Author:** [@Liora](https://discuss.elastic.co/u/Liora)\ **Replies:** 16\ **Last updated:** [February 14, 2021, 3:35pm UTC](https://discuss.elastic.co/t/kibana-cant-open-kibana-in-my-web-browser/263893 "2021-02-14T15:35:18Z")
Hi team, I am not able to open Kibana page in my web browser. Earlier i was able to open Kibana page in my browser. Later i have uninstalled my Ubuntu server on virtualbox and reinstalled again. Then i reinstalled elas… --- ## [Elasticsearch reindex parsing error](https://discuss.elastic.co/t/elasticsearch-reindex-parsing-error/264251)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 2\ **Last updated:** [February 14, 2021, 3:27pm UTC](https://discuss.elastic.co/t/elasticsearch-reindex-parsing-error/264251 "2021-02-14T15:27:33Z")
Hi all, i'm trying to copy data of specified fields from one index to another using reindex. curl -XPOST --header 'Content-Type: application/json' http://localhost:9200/\_reindex -d '{ "source": { "index1": "sunny\_1" … --- ## ["diff date" and "if"](https://discuss.elastic.co/t/diff-date-and-if/264236)
**Author:** [@Sharissa](https://discuss.elastic.co/u/Sharissa)\ **Replies:** 1\ **Last updated:** [February 14, 2021, 1:22pm UTC](https://discuss.elastic.co/t/diff-date-and-if/264236 "2021-02-14T13:22:58Z")
Hello! I am trying to make a classifier where I need to see the difference of dates and determine if they are on time. I am trying to do this script but it shows error in the index, any recommendations? def diff = doc\['… --- ## [I have about 500,000 children for each parent](https://discuss.elastic.co/t/i-have-about-500-000-children-for-each-parent/264215)
**Author:** [@mbawazir](https://discuss.elastic.co/u/mbawazir)\ **Replies:** 4\ **Last updated:** [February 13, 2021, 6:44pm UTC](https://discuss.elastic.co/t/i-have-about-500-000-children-for-each-parent/264215 "2021-02-13T18:44:13Z")
Can I use "Inner Objects" for Managing Relations Inside Elasticsearch when I have about 500,000 children for each parent? or what is the best way to deal with it --- ## [Elastic search won't start after upgrade to 7.11](https://discuss.elastic.co/t/elastic-search-wont-start-after-upgrade-to-7-11/264170)
**Author:** [@glifhits](https://discuss.elastic.co/u/glifhits)\ **Replies:** 2\ **Last updated:** [February 14, 2021, 3:27am UTC](https://discuss.elastic.co/t/elastic-search-wont-start-after-upgrade-to-7-11/264170 "2021-02-14T03:27:16Z")
I'm getting the following error. I've looked thru it but nothing stands out. \` Starting Elasticsearch Server … --- ## [Filebeat processrs revers dns only for private network](https://discuss.elastic.co/t/filebeat-processrs-revers-dns-only-for-private-network/264232)
**Author:** [@tellus83](https://discuss.elastic.co/u/tellus83)\ **Replies:** 0\ **Last updated:** [February 14, 2021, 1:24am UTC](https://discuss.elastic.co/t/filebeat-processrs-revers-dns-only-for-private-network/264232 "2021-02-14T01:24:07Z")
I'm using filbeate to resolve reverse DNS lookup - dns: type: reverse fields: source.ip: source.hostname destination.ip: destination.hostname success\_cache: capacity.initial:… --- ## [Kibana (wazuh) not working right](https://discuss.elastic.co/t/kibana-wazuh-not-working-right/264227)
**Author:** [@zitstif](https://discuss.elastic.co/u/zitstif)\ **Replies:** 1\ **Last updated:** [February 14, 2021, 1:23am UTC](https://discuss.elastic.co/t/kibana-wazuh-not-working-right/264227 "2021-02-14T01:23:16Z")
Greetings all. I've ran into a problem with my Wazuh/Kibana setup. I can't quite pin point to when the issue occurred but it wouldn't surprise me if it was some update that caused it. I run Kibana on a VM that is centos … --- ## [Issue with document-level security expression and date range](https://discuss.elastic.co/t/issue-with-document-level-security-expression-and-date-range/264197)
**Author:** [@mattvl](https://discuss.elastic.co/u/mattvl)\ **Replies:** 3\ **Last updated:** [February 13, 2021, 10:37pm UTC](https://discuss.elastic.co/t/issue-with-document-level-security-expression-and-date-range/264197 "2021-02-13T22:37:48Z")
I am having the same issue as https://discuss.elastic.co/t/granted-documents-query-with-filter-by-timestamp/201834 and https://discuss.elastic.co/t/document-level-security-combining-queries-together/136143 { "bool… --- ## [Filter context without bool](https://discuss.elastic.co/t/filter-context-without-bool/264218)
**Author:** [@AndreKR](https://discuss.elastic.co/u/AndreKR)\ **Replies:** 2\ **Last updated:** [February 13, 2021, 7:03pm UTC](https://discuss.elastic.co/t/filter-context-without-bool/264218 "2021-02-13T19:03:53Z")
It seems that the minimum code I need for a filter context match is: { "query": { "bool": { "filter": { ... } } } } That looks quite verbose and involves a bool query, even though no act… --- ## [Can't display tooltip at all in Vega Pie Chart](https://discuss.elastic.co/t/cant-display-tooltip-at-all-in-vega-pie-chart/264056)
**Author:** [@Webtrend\_Inc](https://discuss.elastic.co/u/Webtrend_Inc)\ **Replies:** 5\ **Last updated:** [February 13, 2021, 6:44pm UTC](https://discuss.elastic.co/t/cant-display-tooltip-at-all-in-vega-pie-chart/264056 "2021-02-13T18:44:11Z")
My following vega code correctly displays the actual chart and legend. However, I have been trying to get tooltip to display some data but the tooltips are not showing at all. Here is my latest code { "$schema": "http… --- ## [Restrict cold nodes queries](https://discuss.elastic.co/t/restrict-cold-nodes-queries/264217)
**Author:** [@Yenii\_Ceri](https://discuss.elastic.co/u/Yenii_Ceri)\ **Replies:** 2\ **Last updated:** [February 13, 2021, 4:15pm UTC](https://discuss.elastic.co/t/restrict-cold-nodes-queries/264217 "2021-02-13T16:15:39Z")
Hi, If for example, I configure an ILM to send an index to a cold Elasticsearch node. How to ensure that search queries on Elasticsearch only process hot nodes and not cold ones because researching cold nodes will be co… --- ## [Save metricbeat data locally preferably in csv](https://discuss.elastic.co/t/save-metricbeat-data-locally-preferably-in-csv/264206)
**Author:** [@rsgupta0110](https://discuss.elastic.co/u/rsgupta0110)\ **Replies:** 2\ **Last updated:** [February 13, 2021, 3:22pm UTC](https://discuss.elastic.co/t/save-metricbeat-data-locally-preferably-in-csv/264206 "2021-02-13T15:22:34Z")
Is it possible to save the metricbeat data locally preferably in csv format ? We are experiencing intermittent connectivity problems between metricbeat and logstash and loosing the data when this happens so we would like… --- ## [Firebase cloud functions where to find the elasticsearch credentials (username, password, url)](https://discuss.elastic.co/t/firebase-cloud-functions-where-to-find-the-elasticsearch-credentials-username-password-url/264124)
**Author:** [@Jonatan](https://discuss.elastic.co/u/Jonatan)\ **Replies:** 1\ **Last updated:** [February 13, 2021, 2:31pm UTC](https://discuss.elastic.co/t/firebase-cloud-functions-where-to-find-the-elasticsearch-credentials-username-password-url/264124 "2021-02-13T14:31:06Z")
I'm trying to setup a firebase cloud function that will index to elastic search anytime an update to my firebase RTDB happen. Every tutorial I've seen is using "Elasticsearch Certified by Bitnami" for the integration (f… --- ## [BackPressure (?) while using Kafka](https://discuss.elastic.co/t/backpressure-while-using-kafka/264209)
**Author:** [@janoonan](https://discuss.elastic.co/u/janoonan)\ **Replies:** 0\ **Last updated:** [February 13, 2021, 10:57am UTC](https://discuss.elastic.co/t/backpressure-while-using-kafka/264209 "2021-02-13T10:57:12Z")
We have a busy production set-up generating many 1000's of logs, which are forwarded by beats to kafka before hitting logstash and elastic. Our server paged us last week at the end of the business day (when load subside… --- ## [Windows could not start the filebeat service on Local Computer. Error 1053: The service did not respond to the start or control request in a timely fashion](https://discuss.elastic.co/t/windows-could-not-start-the-filebeat-service-on-local-computer-error-1053-the-service-did-not-respond-to-the-start-or-control-request-in-a-timely-fashion/264191)
**Author:** [@Grativol](https://discuss.elastic.co/u/Grativol)\ **Replies:** 1\ **Last updated:** [February 13, 2021, 2:50am UTC](https://discuss.elastic.co/t/windows-could-not-start-the-filebeat-service-on-local-computer-error-1053-the-service-did-not-respond-to-the-start-or-control-request-in-a-timely-fashion/264191 "2021-02-13T02:50:07Z")
Fala galera blz? Estou tentando startar o servico do Filebeat em services.msc do server 2016, porem da erro: Windows could not start the filebeat service on Local Computer. Error 1053: The service did not respond to the… --- ## [\_grokparsefailure with kv](https://discuss.elastic.co/t/grokparsefailure-with-kv/264195)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 1\ **Last updated:** [February 13, 2021, 12:12am UTC](https://discuss.elastic.co/t/grokparsefailure-with-kv/264195 "2021-02-13T00:12:29Z")
Hi, I am using kv { } filter but output in Kibana have tag \_grokparsefailure, why? Output looks like is fine, without errors however still have this tag, when I even don't have grok (only input udp, filter kv and mutat… --- ## [Logstash condition to check if a field value starts with another field's value](https://discuss.elastic.co/t/logstash-condition-to-check-if-a-field-value-starts-with-another-fields-value/264168)
**Author:** [@mattinVS](https://discuss.elastic.co/u/mattinVS)\ **Replies:** 2\ **Last updated:** [February 12, 2021, 10:49pm UTC](https://discuss.elastic.co/t/logstash-condition-to-check-if-a-field-value-starts-with-another-fields-value/264168 "2021-02-12T22:49:28Z")
Hi, I'd like to know how I can check in an if-condition in Logstash, is a field's value (in the example below the field is named "complete") starts with the value of another field (in the example below the field is name… --- ## [Elasticsearch Alerting Watcher](https://discuss.elastic.co/t/elasticsearch-alerting-watcher/261477)
**Author:** [@linfordwoode](https://discuss.elastic.co/u/linfordwoode)\ **Replies:** 3\ **Last updated:** [February 12, 2021, 10:05pm UTC](https://discuss.elastic.co/t/elasticsearch-alerting-watcher/261477 "2021-02-12T22:05:09Z")
Hello, I have a watcher sending email notifications with a log file attachment. I was hoping to add a url to the notification alert which will direct the email recipient to the errors received. When the url is clicked, … --- ## [Push Index to Cloud](https://discuss.elastic.co/t/push-index-to-cloud/264178)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 2\ **Last updated:** [February 12, 2021, 9:54pm UTC](https://discuss.elastic.co/t/push-index-to-cloud/264178 "2021-02-12T21:54:19Z")
I am doing a proof-of-concept using my first instance of cloud. I have signed up for the trial but am having difficulty figuring out the best way to move my test index from my local server to the cloud instance. I unde… --- ## [Aggregate filter, error when same task\_id in two separate aggregate filters](https://discuss.elastic.co/t/aggregate-filter-error-when-same-task-id-in-two-separate-aggregate-filters/264151)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 3\ **Last updated:** [February 12, 2021, 9:10pm UTC](https://discuss.elastic.co/t/aggregate-filter-error-when-same-task-id-in-two-separate-aggregate-filters/264151 "2021-02-12T21:10:06Z")
Hi, I'm running a Logstash 7.9.2 Docker container inside a Kubernetes cluster and I'm seeing the following error message in Logstash when I attempt to use the same task\_id in two separate aggregate filters: \[ERROR\] 20… --- ## [Getting documents from an index with more than 10,000 records](https://discuss.elastic.co/t/getting-documents-from-an-index-with-more-than-10-000-records/264069)
**Author:** [@vastevenson](https://discuss.elastic.co/u/vastevenson)\ **Replies:** 4\ **Last updated:** [February 12, 2021, 8:59pm UTC](https://discuss.elastic.co/t/getting-documents-from-an-index-with-more-than-10-000-records/264069 "2021-02-12T20:59:39Z")
I am trying to get a list of the ids of all document in my index. The index has about 50k documents in it, however I cannot use the from parameter to see any ids once "from" + "size" \> 10,000. I know there's the scroll a… --- ## [Logstash aggregate syslog entries](https://discuss.elastic.co/t/logstash-aggregate-syslog-entries/263783)
**Author:** [@Pablo\_Marques](https://discuss.elastic.co/u/Pablo_Marques)\ **Replies:** 12\ **Last updated:** [February 12, 2021, 8:08pm UTC](https://discuss.elastic.co/t/logstash-aggregate-syslog-entries/263783 "2021-02-12T20:08:25Z")
Hello I am getting syslogs from Clearpass servers and using logstash to ingest them into elasticsearch. Some of these messages are received on multiple syslog packets, but they are really the same (big) message. I am … --- ## [MalformedCSVError: Illegal quoting in line 1](https://discuss.elastic.co/t/malformedcsverror-illegal-quoting-in-line-1/264048)
**Author:** [@checknew](https://discuss.elastic.co/u/checknew)\ **Replies:** 5\ **Last updated:** [February 12, 2021, 8:07pm UTC](https://discuss.elastic.co/t/malformedcsverror-illegal-quoting-in-line-1/264048 "2021-02-12T20:07:27Z")
Hi all, I am seeing WARNING messages when csv is pushed to logstash, I want to eliminate the WARNING messages, any help appreciated: Sample csv: 20185656,2021-02-01 17:52:47,2021-02-01 18:23:15,"Hi Test2, this is ch… --- ## [Filebeat warn issue depend to the pipeline (Index not found in kibana)](https://discuss.elastic.co/t/filebeat-warn-issue-depend-to-the-pipeline-index-not-found-in-kibana/264172)
**Author:** [@marouane](https://discuss.elastic.co/u/marouane)\ **Replies:** 0\ **Last updated:** [February 12, 2021, 6:41pm UTC](https://discuss.elastic.co/t/filebeat-warn-issue-depend-to-the-pipeline-index-not-found-in-kibana/264172 "2021-02-12T18:41:24Z")
Hello, Trying to start filebeat service I'm getting this war that prevent to get the index showing in kibana. 2021-02-04T15:50:40.400+0100 WARN \[elasticsearch\] elasticsearch/client.go:407 Cannot index event publishe… --- ## [Search not returning the intended results](https://discuss.elastic.co/t/search-not-returning-the-intended-results/264169)
**Author:** [@RicPeres](https://discuss.elastic.co/u/RicPeres)\ **Replies:** 0\ **Last updated:** [February 12, 2021, 6:35pm UTC](https://discuss.elastic.co/t/search-not-returning-the-intended-results/264169 "2021-02-12T18:35:09Z")
Hello all, Wondering if anyone can help me, I'm having problems in a search performed on elastic, the search itself is very simple however for some specific words, although, they exist in the intended doc, the hit is no… --- ## [Configure filebeat to ship elasticsearch logs to monitoring cluster in kubernetes](https://discuss.elastic.co/t/configure-filebeat-to-ship-elasticsearch-logs-to-monitoring-cluster-in-kubernetes/264161)
**Author:** [@itsron](https://discuss.elastic.co/u/itsron)\ **Replies:** 0\ **Last updated:** [February 12, 2021, 5:54pm UTC](https://discuss.elastic.co/t/configure-filebeat-to-ship-elasticsearch-logs-to-monitoring-cluster-in-kubernetes/264161 "2021-02-12T17:54:04Z")
I've 2 clusters (7.10) running on Kubernetes - 1 prod and 1 monitoring. I've successfully set up metricbeat to ship elasticsearch metrics to my monitoring cluster. Now I want to ship elasticsearch logs using filebeat to … --- ## [How do I find which event is generating this error](https://discuss.elastic.co/t/how-do-i-find-which-event-is-generating-this-error/264166)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 0\ **Last updated:** [February 12, 2021, 6:07pm UTC](https://discuss.elastic.co/t/how-do-i-find-which-event-is-generating-this-error/264166 "2021-02-12T18:07:29Z")
I have thousands of event coming from metricbeat to logstash. then I do some parsing. but every on/off I getting following errors. is there a easy way to find out which event is it? An exceptionCaught() event was fire… --- ## [Query string cross\_fields synonyms](https://discuss.elastic.co/t/query-string-cross-fields-synonyms/264059)
**Author:** [@wboult](https://discuss.elastic.co/u/wboult)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 10:24pm UTC](https://discuss.elastic.co/t/query-string-cross-fields-synonyms/264059 "2021-02-11T22:24:06Z")
I am using the query string cross\_fields query type to provide a simple search UI that queries many different fields as though they are one big field. I want to make it possible to have different analyzers for some of t… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1555) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1557)