# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1566 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1567 --- ## [Dynamic index name in DSL](https://discuss.elastic.co/t/dynamic-index-name-in-dsl/263580)
**Author:** [@Ninja\_Ninja](https://discuss.elastic.co/u/Ninja_Ninja)\ **Replies:** 1\ **Last updated:** [February 8, 2021, 10:42pm UTC](https://discuss.elastic.co/t/dynamic-index-name-in-dsl/263580 "2021-02-08T22:42:17Z")
I have created indexes based on year and month. For ex: idx202001, idx202002,... In the dashboard, based on the time filter selected, I would like to query particular indices only. Like { "query": { "match": { "\_… --- ## [Custom rate limit per user](https://discuss.elastic.co/t/custom-rate-limit-per-user/263592)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 2\ **Last updated:** [February 8, 2021, 10:41pm UTC](https://discuss.elastic.co/t/custom-rate-limit-per-user/263592 "2021-02-08T22:41:06Z")
can we define custom rate limit for each user of elastic? for example kibana user rate limit: 10 request every minute! can do this? --- ## [Audit logs are not getting generated in elasticsearch 7.3](https://discuss.elastic.co/t/audit-logs-are-not-getting-generated-in-elasticsearch-7-3/263648)
**Author:** [@Ayush\_Verma](https://discuss.elastic.co/u/Ayush_Verma)\ **Replies:** 1\ **Last updated:** [February 8, 2021, 9:53pm UTC](https://discuss.elastic.co/t/audit-logs-are-not-getting-generated-in-elasticsearch-7-3/263648 "2021-02-08T21:53:47Z")
elasticversion- 7.3 I have 8 nodes of elasticsearch masternodes- 3 clientnode-2 datanode-3 I want to generate audit logs in the elasticsearch so I added this parameter in all the 8 nodes xpack.security.audit.enabled … --- ## [Filebeat modules via Logstash](https://discuss.elastic.co/t/filebeat-modules-via-logstash/263612)
**Author:** [@st1988](https://discuss.elastic.co/u/st1988)\ **Replies:** 6\ **Last updated:** [February 8, 2021, 9:19pm UTC](https://discuss.elastic.co/t/filebeat-modules-via-logstash/263612 "2021-02-08T21:19:01Z")
Hi everyone, I have an issue where when I try and integrate Filebeat PANOS module with Elasticsearch via Logstash it fails to bring across the pre-built dashboards that is does when integrating Filebeat directly with El… --- ## [ArubaOS](https://discuss.elastic.co/t/arubaos/263655)
**Author:** [@javig12](https://discuss.elastic.co/u/javig12)\ **Replies:** 0\ **Last updated:** [February 8, 2021, 9:00pm UTC](https://discuss.elastic.co/t/arubaos/263655 "2021-02-08T21:00:32Z")
Hello community? Has anyone could ship logs to Logstash from Aruba Networks? any .conf file example? hope your comments. Regards --- ## [Swapping alias workflow](https://discuss.elastic.co/t/swapping-alias-workflow/263531)
**Author:** [@Jonathan\_Tan](https://discuss.elastic.co/u/Jonathan_Tan)\ **Replies:** 2\ **Last updated:** [February 8, 2021, 8:58pm UTC](https://discuss.elastic.co/t/swapping-alias-workflow/263531 "2021-02-08T20:58:33Z")
Hi, I'm looking for some advice about swapping what an alias is pointing at. We're using logstash to index events into ES, in the good ole format of logstash-metrics-YYYY-MM-dd. Now, we've discovered that we need to r… --- ## [Updated geoip](https://discuss.elastic.co/t/updated-geoip/263043)
**Author:** [@Falikou1](https://discuss.elastic.co/u/Falikou1)\ **Replies:** 11\ **Last updated:** [February 8, 2021, 8:53pm UTC](https://discuss.elastic.co/t/updated-geoip/263043 "2021-02-08T20:53:24Z")
I configured the geoip in logstash. I have it updated. Can you help me with a sample configuration? --- ## [Persistent Kibana shard failure error for oldest shown data](https://discuss.elastic.co/t/persistent-kibana-shard-failure-error-for-oldest-shown-data/262910)
**Author:** [@cealliance](https://discuss.elastic.co/u/cealliance)\ **Replies:** 3\ **Last updated:** [February 8, 2021, 8:41pm UTC](https://discuss.elastic.co/t/persistent-kibana-shard-failure-error-for-oldest-shown-data/262910 "2021-02-08T20:41:32Z")
When opening any visualization, dashboard, or the discover tab, an error appears explaining that ~%80 of shards failed. Unless the time span is set to very small increments, e.g. 15 minutes, the oldest %80 of data never … --- ## [Indices not being deleted in ILM policy](https://discuss.elastic.co/t/indices-not-being-deleted-in-ilm-policy/263492)
**Author:** [@KevSex](https://discuss.elastic.co/u/KevSex)\ **Replies:** 3\ **Last updated:** [February 8, 2021, 7:55pm UTC](https://discuss.elastic.co/t/indices-not-being-deleted-in-ilm-policy/263492 "2021-02-08T19:55:49Z")
For some reason, my indices are not being deleted after the delete phase is triggered. I have a policy as below: { "unifi" : { "version" : 1, "modified\_date" : "2021-01-28T14:21:47.860Z", "policy" : { … --- ## [React Axios Elasticsearch](https://discuss.elastic.co/t/react-axios-elasticsearch/263645)
**Author:** [@ahmedch](https://discuss.elastic.co/u/ahmedch)\ **Replies:** 0\ **Last updated:** [February 8, 2021, 6:25pm UTC](https://discuss.elastic.co/t/react-axios-elasticsearch/263645 "2021-02-08T18:25:05Z")
Hello, I am working on a react app using elasticsearch , I have a problem for making post request with axios , the app is mainly based on react and Elasticsearch . This is the code working on node.js const axios = re… --- ## [Need some help configuring an ACK handler for a custom beat](https://discuss.elastic.co/t/need-some-help-configuring-an-ack-handler-for-a-custom-beat/263639)
**Author:** [@luado](https://discuss.elastic.co/u/luado)\ **Replies:** 0\ **Last updated:** [February 8, 2021, 5:12pm UTC](https://discuss.elastic.co/t/need-some-help-configuring-an-ack-handler-for-a-custom-beat/263639 "2021-02-08T17:12:00Z")
First of, I tried finding on the tags options a "custom beat" tag, but there is not one there, could I suggest adding such a tag? I have created a custom beat based on libbeat v7. I have defined a struct that implement… --- ## [Kibana isn't being displayed in web browser](https://discuss.elastic.co/t/kibana-isnt-being-displayed-in-web-browser/263553)
**Author:** [@ROPA8](https://discuss.elastic.co/u/ROPA8)\ **Replies:** 1\ **Last updated:** [February 8, 2021, 5:06pm UTC](https://discuss.elastic.co/t/kibana-isnt-being-displayed-in-web-browser/263553 "2021-02-08T17:06:22Z")
Hi all, I have a problem with my Kibana. Elastic Search and Kibana run well but kibana isn't loaded in web browser and it just shows white page at localhost:5602. kibana console last messages: before starting saved o… --- ## [Metricbeat|Failed to parse api response: invalid ch aracter '#' looking for beginning of value"](https://discuss.elastic.co/t/metricbeat-failed-to-parse-api-response-invalid-ch-aracter-looking-for-beginning-of-value/263436)
**Author:** [@sandeepsingh2103](https://discuss.elastic.co/u/sandeepsingh2103)\ **Replies:** 2\ **Last updated:** [February 8, 2021, 5:04pm UTC](https://discuss.elastic.co/t/metricbeat-failed-to-parse-api-response-invalid-ch-aracter-looking-for-beginning-of-value/263436 "2021-02-08T17:04:18Z")
Metricbeat: "version": "7.10.0" I am trying to use query metricbeat of 'prometheus' module using following config: - module: prometheus period: 10s hosts: \["fluentd:24231"\] metricsets: \["query"\] queries: - n… --- ## [Logstash won't run, openJDK 64-bit Server](https://discuss.elastic.co/t/logstash-wont-run-openjdk-64-bit-server/263072)
**Author:** [@Minx](https://discuss.elastic.co/u/Minx)\ **Replies:** 3\ **Last updated:** [February 8, 2021, 5:04pm UTC](https://discuss.elastic.co/t/logstash-wont-run-openjdk-64-bit-server/263072 "2021-02-08T17:04:07Z")
I try to run log stash and this happens, does anyone know what is wrong please? PS C:\\logstash-7.10.1\\bin\> .\\logstash.bat -f .\\config\\logstash.conf "Using bundled JDK: "" OpenJDK 64-Bit Server VM warning: Option UseCo… --- ## [Using SearchType "count" alternatives](https://discuss.elastic.co/t/using-searchtype-count-alternatives/263530)
**Author:** [@nara1](https://discuss.elastic.co/u/nara1)\ **Replies:** 1\ **Last updated:** [February 8, 2021, 4:28pm UTC](https://discuss.elastic.co/t/using-searchtype-count-alternatives/263530 "2021-02-08T16:28:54Z")
I have a use case where I need to use the "size" parameter in my query. I have seen the recommendation to perform two queries-- one to retrieve the count, and a second query using that count as the "size" parameter, to e… --- ## [Limiting fields created by Filebeat for Netflow](https://discuss.elastic.co/t/limiting-fields-created-by-filebeat-for-netflow/263371)
**Author:** [@Attila\_Kelenyi](https://discuss.elastic.co/u/Attila_Kelenyi)\ **Replies:** 1\ **Last updated:** [February 8, 2021, 4:13pm UTC](https://discuss.elastic.co/t/limiting-fields-created-by-filebeat-for-netflow/263371 "2021-02-08T16:13:27Z")
Dear All, I hope you can give me some advice on the best way to reduce the number of fields created. Let me begin with the overview of the design: VMware ESXI hosts are sending Neflow v10 (IPFX) to Filebeat forwardin… --- ## [How to convert this update script to PHP?](https://discuss.elastic.co/t/how-to-convert-this-update-script-to-php/263628)
**Author:** [@OB1290](https://discuss.elastic.co/u/OB1290)\ **Replies:** 0\ **Last updated:** [February 8, 2021, 3:48pm UTC](https://discuss.elastic.co/t/how-to-convert-this-update-script-to-php/263628 "2021-02-08T15:48:15Z")
I'm having trouble converting this request to php : POST candidates/\_update/a23OcncBXBMGOH6pwXge { "script": { "source": """ if (ctx.\_source.containsKey('file')) { ctx.\_source.file.add(\['filename':par… --- ## [Nested object aggregation performance issues](https://discuss.elastic.co/t/nested-object-aggregation-performance-issues/263625)
**Author:** [@brusko](https://discuss.elastic.co/u/brusko)\ **Replies:** 0\ **Last updated:** [February 8, 2021, 3:45pm UTC](https://discuss.elastic.co/t/nested-object-aggregation-performance-issues/263625 "2021-02-08T15:45:04Z")
Hi everyone, I'm challenged with a problem where I use nested objects. Given I have a document structure that looks like the following { "mappings": { "properties": { "id": { "type": "integ… --- ## [Docs.deleted docs are missing after reindexing](https://discuss.elastic.co/t/docs-deleted-docs-are-missing-after-reindexing/263619)
**Author:** [@mouli\_v](https://discuss.elastic.co/u/mouli_v)\ **Replies:** 1\ **Last updated:** [February 8, 2021, 3:44pm UTC](https://discuss.elastic.co/t/docs-deleted-docs-are-missing-after-reindexing/263619 "2021-02-08T15:44:40Z")
We are in the process of reindexing data from one cluster another cluster. We are observing docs.deleted is 0 which is different from the old cluster. We tried curl -X POST "localhost:9200/\_refresh?pretty" , but no use. … --- ## [Elasticsearch.Net - ECCN](https://discuss.elastic.co/t/elasticsearch-net-eccn/263342)
**Author:** [@Joanna](https://discuss.elastic.co/u/Joanna)\ **Replies:** 3\ **Last updated:** [February 8, 2021, 3:44pm UTC](https://discuss.elastic.co/t/elasticsearch-net-eccn/263342 "2021-02-08T15:44:07Z")
Can you provide me ECCN for Elasticsearch.Net? Any info? --- ## [Rollup Job Visualisation - Top Ranking Items](https://discuss.elastic.co/t/rollup-job-visualisation-top-ranking-items/263099)
**Author:** [@michaelpietzsch](https://discuss.elastic.co/u/michaelpietzsch)\ **Replies:** 5\ **Last updated:** [February 8, 2021, 3:43pm UTC](https://discuss.elastic.co/t/rollup-job-visualisation-top-ranking-items/263099 "2021-02-08T15:43:23Z")
Hi dear Elastic and Kibana Users, i am having issues running a visualisation for the top tiers when going against a rollup dataset. This issue happens in a pie diagramm aswell as a top list. The results vary when chang… --- ## [Crating visualization with two arrays in a table](https://discuss.elastic.co/t/crating-visualization-with-two-arrays-in-a-table/263054)
**Author:** [@leinad](https://discuss.elastic.co/u/leinad)\ **Replies:** 4\ **Last updated:** [February 8, 2021, 3:22pm UTC](https://discuss.elastic.co/t/crating-visualization-with-two-arrays-in-a-table/263054 "2021-02-08T15:22:28Z")
Hi , I am trying to create a table with values from two arrays arr1\[str1,str2,str30 arr2\[val1,val2,val3\] desired table should be as str1 - val1 str2 - val2 str3 - val3 and i have multiple such arrays in the json … --- ## [Not able to start elastic Service](https://discuss.elastic.co/t/not-able-to-start-elastic-service/263347)
**Author:** [@pnrao.83](https://discuss.elastic.co/u/pnrao.83)\ **Replies:** 5\ **Last updated:** [February 8, 2021, 2:40pm UTC](https://discuss.elastic.co/t/not-able-to-start-elastic-service/263347 "2021-02-08T14:40:35Z")
Hi Team, i am trying to configure and use elastic search and Kibana. But i was stuck at starting the elastic service in my Oracle Linux Machine. Please find the below logs and yaml file and help: cat /var/log/elasticse… --- ## [About filebeat upgrade 7.6.2 to 7.10.2](https://discuss.elastic.co/t/about-filebeat-upgrade-7-6-2-to-7-10-2/263196)
**Author:** [@ZPerling](https://discuss.elastic.co/u/ZPerling)\ **Replies:** 3\ **Last updated:** [February 8, 2021, 2:38pm UTC](https://discuss.elastic.co/t/about-filebeat-upgrade-7-6-2-to-7-10-2/263196 "2021-02-08T14:38:14Z")
I want to fix bug with filebeat kubernetes auto discover, so upgrade filbeat from 7.6.2 to 7.10.2, but I found some problem, the log events output to kafka speed is very slower at the new version, I do not know how to fi… --- ## [Packetbeat - Cannot add kubernetes metadata](https://discuss.elastic.co/t/packetbeat-cannot-add-kubernetes-metadata/263615)
**Author:** [@Francisco\_Peralta\_Gu](https://discuss.elastic.co/u/Francisco_Peralta_Gu)\ **Replies:** 0\ **Last updated:** [February 8, 2021, 2:36pm UTC](https://discuss.elastic.co/t/packetbeat-cannot-add-kubernetes-metadata/263615 "2021-02-08T14:36:36Z")
Hi. I am trying to configure packetbeat 1.10.1 in order to get kubernetes metadata in a kubernetes cluster v. 1.18.3 but I am not able to get it. This is the configuration that I have applied: - add\_cloud\_meta… --- ## [Logstash Events forward](https://discuss.elastic.co/t/logstash-events-forward/263614)
**Author:** [@suraj.ghorp](https://discuss.elastic.co/u/suraj.ghorp)\ **Replies:** 0\ **Last updated:** [February 8, 2021, 2:30pm UTC](https://discuss.elastic.co/t/logstash-events-forward/263614 "2021-02-08T14:30:46Z")
Hi Team, Logastash pulling logs from cloud based WAF on windows system and we wanted to forward the logs towards Linux based SIEM forwarder. please hep to configure the config file. --- ## [Compare wildcard string to cell value and replace in canvas expression](https://discuss.elastic.co/t/compare-wildcard-string-to-cell-value-and-replace-in-canvas-expression/263234)
**Author:** [@fuzzyWedgie](https://discuss.elastic.co/u/fuzzyWedgie)\ **Replies:** 3\ **Last updated:** [February 8, 2021, 2:07pm UTC](https://discuss.elastic.co/t/compare-wildcard-string-to-cell-value-and-replace-in-canvas-expression/263234 "2021-02-08T14:07:37Z")
How can I replace all cell values in a table in canvas if it matches a wildcard string ? I want to normalize some values in the table in a way that if a table cell contains "test abc" I want the cell value to be repla… --- ## [How much storage for persistent volume for dedicated master nodes in Kubernetes?](https://discuss.elastic.co/t/how-much-storage-for-persistent-volume-for-dedicated-master-nodes-in-kubernetes/263590)
**Author:** [@Pikabanga](https://discuss.elastic.co/u/Pikabanga)\ **Replies:** 3\ **Last updated:** [February 8, 2021, 1:16pm UTC](https://discuss.elastic.co/t/how-much-storage-for-persistent-volume-for-dedicated-master-nodes-in-kubernetes/263590 "2021-02-08T13:16:58Z")
Hi! I'm wondering how much persistent storage is required for master nodes if we have a cluster with dedicated master nodes and data nodes? I am assuming the master nodes don't require as much data as the data nodes? --- ## [Add\_resource\_metadata.namespace.include\_annotations doesn't work anymore in 7.10.x?](https://discuss.elastic.co/t/add-resource-metadata-namespace-include-annotations-doesnt-work-anymore-in-7-10-x/261878)
**Author:** [@lobachpavel](https://discuss.elastic.co/u/lobachpavel)\ **Replies:** 1\ **Last updated:** [February 8, 2021, 11:59am UTC](https://discuss.elastic.co/t/add-resource-metadata-namespace-include-annotations-doesnt-work-anymore-in-7-10-x/261878 "2021-02-08T11:59:14Z")
While migrating from filebeat 7.6.0 to 7.10.x we discovered that we can not pull kubernetes namespace annotations into events anymore , here is the minimal example config: filebeat.yml: | filebeat.autodisc… --- ## [\[Logstash\] Aggregate Filter Plugin with Nested Fields](https://discuss.elastic.co/t/logstash-aggregate-filter-plugin-with-nested-fields/263591)
**Author:** [@jeduguim](https://discuss.elastic.co/u/jeduguim)\ **Replies:** 0\ **Last updated:** [February 8, 2021, 11:45am UTC](https://discuss.elastic.co/t/logstash-aggregate-filter-plugin-with-nested-fields/263591 "2021-02-08T11:45:48Z")
Hi, I'm trying to use aggregate filter plugin with nested fields on a logstash config file. But I have a nested field inside other nested field. Is it possible to do in logstash? Maybe with multiple aggregate filters? My… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1565) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1567)