# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1570 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1571 --- ## [How to filter records that have no related record](https://discuss.elastic.co/t/how-to-filter-records-that-have-no-related-record/263240)
**Author:** [@Henk21](https://discuss.elastic.co/u/Henk21)\ **Replies:** 2\ **Last updated:** [February 5, 2021, 7:49am UTC](https://discuss.elastic.co/t/how-to-filter-records-that-have-no-related-record/263240 "2021-02-05T07:49:34Z")
I am loading a feed (ISE syslog events) in a given index. There are two types of events: Authentication events and Start events. The two are related through some unique session\_id. It may happen that for some Authenti… --- ## [Geoip conflict when splitting the index by day](https://discuss.elastic.co/t/geoip-conflict-when-splitting-the-index-by-day/263226)
**Author:** [@testsoft](https://discuss.elastic.co/u/testsoft)\ **Replies:** 2\ **Last updated:** [February 5, 2021, 7:27am UTC](https://discuss.elastic.co/t/geoip-conflict-when-splitting-the-index-by-day/263226 "2021-02-05T07:27:20Z")
Good afternoon. Please help with the following question. I use the following standard output config: elasticsearch { hosts =\> \["localhost:9200"\] manage\_template =\> false index =\> "… --- ## [ES HADOOP(7.9.0) , ELASTICSEARCH(7.9.0), HIVE(3.1.2)](https://discuss.elastic.co/t/es-hadoop-7-9-0-elasticsearch-7-9-0-hive-3-1-2/263338)
**Author:** [@ycseol](https://discuss.elastic.co/u/ycseol)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 7:27am UTC](https://discuss.elastic.co/t/es-hadoop-7-9-0-elasticsearch-7-9-0-hive-3-1-2/263338 "2021-02-05T07:27:18Z")
hi~ i'm setting HADOOP cluster , ES cluster. so i need to transfer data 'HDFS' to 'ES' HDFS(hive) --\> ES(static index) hive table CREATE EXTERNAL TABLE es\_test(breed string, sex string) STORED BY 'org.elasticsearc… --- ## [How to customize the name of the s3 part file](https://discuss.elastic.co/t/how-to-customize-the-name-of-the-s3-part-file/263334)
**Author:** [@kaushik.vankayala](https://discuss.elastic.co/u/kaushik.vankayala)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 7:00am UTC](https://discuss.elastic.co/t/how-to-customize-the-name-of-the-s3-part-file/263334 "2021-02-05T07:00:33Z")
Hi There, I use the S3 output plugin for persisting the raw data of our Mulesoft applicaiton. I have following configuration is my s3 output plugin; output { s3 { id =\> "experience\_rt4\_s3\_backup" codec =\> line {… --- ## [Got error in logstash. help me!](https://discuss.elastic.co/t/got-error-in-logstash-help-me/262587)
**Author:** [@Farmer\_J](https://discuss.elastic.co/u/Farmer_J)\ **Replies:** 2\ **Last updated:** [February 5, 2021, 6:39am UTC](https://discuss.elastic.co/t/got-error-in-logstash-help-me/262587 "2021-02-05T06:39:37Z")
hi guys . i got some error code in AMI when i excute logstash config file for indexing these is error codes=\> Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash… --- ## [Delete doc.delete](https://discuss.elastic.co/t/delete-doc-delete/263333)
**Author:** [@Farmer\_J](https://discuss.elastic.co/u/Farmer_J)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 6:38am UTC](https://discuss.elastic.co/t/delete-doc-delete/263333 "2021-02-05T06:38:08Z")
good after noon mates. im using logstash on AMI i have question about doc.delete data Im trying to delete doc.delete datas is it properly command shell mate? curl -X POST "https://search-everon-jkgsx53bmgr3lhvcwpgyl… --- ## [Aggregate similar documents](https://discuss.elastic.co/t/aggregate-similar-documents/263332)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 6:30am UTC](https://discuss.elastic.co/t/aggregate-similar-documents/263332 "2021-02-05T06:30:09Z")
I have a documents see example "message":"Syslog connection established; fd='15', server='AF\_INET(111.103.111.65:1514)', local='AF\_INET(0.0.0.0:0)'" "message":"Syslog connection established; fd='14', server='AF\_INET(222… --- ## [Why I got so many entries \*.createdAt and \*.updatedAt inside "fields"?](https://discuss.elastic.co/t/why-i-got-so-many-entries-createdat-and-updatedat-inside-fields/263326)
**Author:** [@thesn](https://discuss.elastic.co/u/thesn)\ **Replies:** 1\ **Last updated:** [February 5, 2021, 4:33am UTC](https://discuss.elastic.co/t/why-i-got-so-many-entries-createdat-and-updatedat-inside-fields/263326 "2021-02-05T04:33:02Z")
Hi, I am new to ELK. I have filebeat 7.8.1, Logstash 7.8.0 (in docker), Elasticsearch 7.8.0. I have log like this in my .log file: {"@timestamp":"2021-02-03T09:43:44.439+07:00","@version":"1","message":"channelAct… --- ## [Routing key for multi index query](https://discuss.elastic.co/t/routing-key-for-multi-index-query/263322)
**Author:** [@prosens](https://discuss.elastic.co/u/prosens)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 3:16am UTC](https://discuss.elastic.co/t/routing-key-for-multi-index-query/263322 "2021-02-05T03:16:13Z")
For a multi-index query, is it possible to specify a separate routing key for each index? --- ## [Security roles not working for ML issue](https://discuss.elastic.co/t/security-roles-not-working-for-ml-issue/263320)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 1:41am UTC](https://discuss.elastic.co/t/security-roles-not-working-for-ml-issue/263320 "2021-02-05T01:41:24Z")
I'm currently frustrated at the ML permissions. I've given one user access to the ML page on kibana, but I'd like the user only to be able to access the .ml index that I created for that user. I followed the directions … --- ## [Field reference with a split event](https://discuss.elastic.co/t/field-reference-with-a-split-event/263315)
**Author:** [@jiacob](https://discuss.elastic.co/u/jiacob)\ **Replies:** 1\ **Last updated:** [February 5, 2021, 12:20am UTC](https://discuss.elastic.co/t/field-reference-with-a-split-event/263315 "2021-02-05T00:20:25Z")
Hello, I'm looking into trying to split a nested field that uses a field reference and I'm not sure which is the right way of doing it. split { field =\> "\[field1\]\[field2\]\['%{\[field3\]}'\]" } This gives me a field refere… --- ## [Date format error from elasticsearch](https://discuss.elastic.co/t/date-format-error-from-elasticsearch/263307)
**Author:** [@earlsanchez](https://discuss.elastic.co/u/earlsanchez)\ **Replies:** 2\ **Last updated:** [February 4, 2021, 11:32pm UTC](https://discuss.elastic.co/t/date-format-error-from-elasticsearch/263307 "2021-02-04T23:32:11Z")
Hello, I originally posted this in the Logstash forum but it was suggested that I should post in Elasticsearch instead. I'm getting a date format error from elasticsearch but the format seems to match the posted date o… --- ## [Date format error from logstash](https://discuss.elastic.co/t/date-format-error-from-logstash/263299)
**Author:** [@earlsanchez](https://discuss.elastic.co/u/earlsanchez)\ **Replies:** 4\ **Last updated:** [February 4, 2021, 11:26pm UTC](https://discuss.elastic.co/t/date-format-error-from-logstash/263299 "2021-02-04T23:26:33Z")
Hello, I'm getting a date format error from logstash but the format seems to match the posted date object. Can some one see specifically what it is complaining about? Logstash error: {"error":{"root\_cause":\[{"type":"m… --- ## [Dropdown in Kibana](https://discuss.elastic.co/t/dropdown-in-kibana/263217)
**Author:** [@ITchandj](https://discuss.elastic.co/u/ITchandj)\ **Replies:** 2\ **Last updated:** [February 4, 2021, 11:13pm UTC](https://discuss.elastic.co/t/dropdown-in-kibana/263217 "2021-02-04T23:13:00Z")
How to make a drop-down in Kibana. In reality i want to get realised a drop-down list with the information as in the following photo. Thank you all --- ## [Filebeat IIS module - only good for the first part of a second](https://discuss.elastic.co/t/filebeat-iis-module-only-good-for-the-first-part-of-a-second/263311)
**Author:** [@Gary\_Griffith](https://discuss.elastic.co/u/Gary_Griffith)\ **Replies:** 0\ **Last updated:** [February 4, 2021, 11:06pm UTC](https://discuss.elastic.co/t/filebeat-iis-module-only-good-for-the-first-part-of-a-second/263311 "2021-02-04T23:06:05Z")
So, we installed filebeat v7.10.1 and enables the IIS System module in a pretty standard way. Under heavy load, we get a batch of IIS access logs nicely parsed into the IIS fields: method, user\_agents, geolocation, etc.… --- ## [Can ES host a form that posts to an API?](https://discuss.elastic.co/t/can-es-host-a-form-that-posts-to-an-api/263070)
**Author:** [@irwazr](https://discuss.elastic.co/u/irwazr)\ **Replies:** 2\ **Last updated:** [February 4, 2021, 10:58pm UTC](https://discuss.elastic.co/t/can-es-host-a-form-that-posts-to-an-api/263070 "2021-02-04T22:58:14Z")
We want to be able to create a form in ES/Kibana that allows users to select an option from a dropdown list, and then click a button to make a POST to an API. Is this possible in ES or Kibana? If so, how? Thanks heaps… --- ## [Filebeat's Data not showing in Kibana Dashboard](https://discuss.elastic.co/t/filebeats-data-not-showing-in-kibana-dashboard/263115)
**Author:** [@huzaifa224](https://discuss.elastic.co/u/huzaifa224)\ **Replies:** 3\ **Last updated:** [February 4, 2021, 10:47pm UTC](https://discuss.elastic.co/t/filebeats-data-not-showing-in-kibana-dashboard/263115 "2021-02-04T22:47:54Z")
I have install ELK on ubuntu18.04 for monitoring remote server logs. On remote server i have installed Filebeat to send data to logstash. Remote server's logs are showing in Kibana--\>observability--\>logs. But in dashboad… --- ## [Elasticsearch rollup question](https://discuss.elastic.co/t/elasticsearch-rollup-question/263095)
**Author:** [@jamesp220291](https://discuss.elastic.co/u/jamesp220291)\ **Replies:** 1\ **Last updated:** [February 4, 2021, 10:46pm UTC](https://discuss.elastic.co/t/elasticsearch-rollup-question/263095 "2021-02-04T22:46:08Z")
hI I Just have a question re the rollup feature. if i have a index, attached to a ILM which deletes the index after 30 days. if i roll this up daily, does the rollup job also delete the index once it has completed, or… --- ## [Simple Query String Search - Wildcard (\*) inside a phrase (" ")](https://discuss.elastic.co/t/simple-query-string-search-wildcard-inside-a-phrase/263190)
**Author:** [@russellmenezes](https://discuss.elastic.co/u/russellmenezes)\ **Replies:** 1\ **Last updated:** [February 4, 2021, 10:40pm UTC](https://discuss.elastic.co/t/simple-query-string-search-wildcard-inside-a-phrase/263190 "2021-02-04T22:40:36Z")
Hi every one, I've been looking all over the web on how to preform a wildcard query inside a phrase search. I have used the English Analyzer to index a text field. I have also modified the analyzer with a custom mappi… --- ## [Create Field for Control Visualization](https://discuss.elastic.co/t/create-field-for-control-visualization/261025)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 2\ **Last updated:** [February 4, 2021, 10:10pm UTC](https://discuss.elastic.co/t/create-field-for-control-visualization/261025 "2021-02-04T22:10:55Z")
I am looking at creating a friendly ID for use in the Controls Visualization to aid in filtering dashboard results. For some reason, I can't seem to create a field which is available in the Field selector of that visual… --- ## [High CPU and Harvester Errors with 20000 log files](https://discuss.elastic.co/t/high-cpu-and-harvester-errors-with-20000-log-files/263290)
**Author:** [@jbudin](https://discuss.elastic.co/u/jbudin)\ **Replies:** 2\ **Last updated:** [February 4, 2021, 10:06pm UTC](https://discuss.elastic.co/t/high-cpu-and-harvester-errors-with-20000-log-files/263290 "2021-02-04T22:06:16Z")
Hi Elastic Community, We have a bottleneck on CPU using filebeat. The service takes anywhere from 10-80% of CPU at all times. After excluding certain paths, the CPU no longer spikes. In each of the path subdirectories … --- ## [Kibana plugin standalone build](https://discuss.elastic.co/t/kibana-plugin-standalone-build/263282)
**Author:** [@zixon89](https://discuss.elastic.co/u/zixon89)\ **Replies:** 2\ **Last updated:** [February 4, 2021, 8:56pm UTC](https://discuss.elastic.co/t/kibana-plugin-standalone-build/263282 "2021-02-04T20:56:52Z")
Hi there, I'm still fresh with Kibana plugin development, so currently I'm doing building by using this (Getting started | Kibana Guide \[7.10\] | Elastic) guide: Clone Kibana repo Set my plugin inside kibana's plugin f… --- ## [Metricbeat showing values as 1000% in dashboard](https://discuss.elastic.co/t/metricbeat-showing-values-as-1000-in-dashboard/263216)
**Author:** [@vinod\_kumar](https://discuss.elastic.co/u/vinod_kumar)\ **Replies:** 1\ **Last updated:** [February 4, 2021, 7:00pm UTC](https://discuss.elastic.co/t/metricbeat-showing-values-as-1000-in-dashboard/263216 "2021-02-04T19:00:07Z")
I have configured Metricbeat but showing values as 1000% instead of 100%. How this can be resolved --- ## [Add Date and Time on TSVB Graph](https://discuss.elastic.co/t/add-date-and-time-on-tsvb-graph/263239)
**Author:** [@pavansh](https://discuss.elastic.co/u/pavansh)\ **Replies:** 1\ **Last updated:** [February 4, 2021, 7:00pm UTC](https://discuss.elastic.co/t/add-date-and-time-on-tsvb-graph/263239 "2021-02-04T19:00:04Z")
Check this Screenshot, Is there any way to add Date and Time on TSVB Graph? --- ## [Error 404 on \[server\]/\_search (works fine on my other instance!)](https://discuss.elastic.co/t/error-404-on-server-search-works-fine-on-my-other-instance/263288)
**Author:** [@thiago.preihs](https://discuss.elastic.co/u/thiago.preihs)\ **Replies:** 0\ **Last updated:** [February 4, 2021, 6:51pm UTC](https://discuss.elastic.co/t/error-404-on-server-search-works-fine-on-my-other-instance/263288 "2021-02-04T18:51:57Z")
Hello guys! I am scratching my head to understand why the same very simple query works fine on one instance (v. 7.6.0) but does not work on my other instance (v. 7.9.3) - I get 404. curl --location --request GET 'https… --- ## [Values near to 0 are not visible in histogram](https://discuss.elastic.co/t/values-near-to-0-are-not-visible-in-histogram/263229)
**Author:** [@Voula\_Mikr](https://discuss.elastic.co/u/Voula_Mikr)\ **Replies:** 1\ **Last updated:** [February 4, 2021, 6:30pm UTC](https://discuss.elastic.co/t/values-near-to-0-are-not-visible-in-histogram/263229 "2021-02-04T18:30:23Z")
Hi, In an histogram visualization, when the values of the field of the Metrics are near to 0, you can hardly see them. Is there any way to zoom also in x-axis except of the zoom in y-axis you can now do? Or other way to… --- ## [Parsing Windows DHCP Logs with Filebeat Microsoft Module](https://discuss.elastic.co/t/parsing-windows-dhcp-logs-with-filebeat-microsoft-module/260849)
**Author:** [@MakoWish](https://discuss.elastic.co/u/MakoWish)\ **Replies:** 3\ **Last updated:** [February 4, 2021, 5:17pm UTC](https://discuss.elastic.co/t/parsing-windows-dhcp-logs-with-filebeat-microsoft-module/260849 "2021-02-04T17:17:22Z")
I somehow lost track of the previous thread regarding this issue, and it ended up closing due to inactivity. I am still seeing this same problem now on 7.10.1. Related thread: Has this been looked into any more? --- ## [Unable to add cross-cluster index pattern](https://discuss.elastic.co/t/unable-to-add-cross-cluster-index-pattern/263014)
**Author:** [@jim1](https://discuss.elastic.co/u/jim1)\ **Replies:** 2\ **Last updated:** [February 4, 2021, 5:16pm UTC](https://discuss.elastic.co/t/unable-to-add-cross-cluster-index-pattern/263014 "2021-02-04T17:16:17Z")
Hello, I set up two Elasticsearch clusters (cluster\_a, cluster\_b) and I was able to set cluster\_a as a remote cluster on cluster\_b and vice versa. Using the dev CLI feature, I am also able to query indexes of cluster\_a… --- ## [Drop documents when similar to previous processed ones](https://discuss.elastic.co/t/drop-documents-when-similar-to-previous-processed-ones/262484)
**Author:** [@Ernesto\_Guerra](https://discuss.elastic.co/u/Ernesto_Guerra)\ **Replies:** 2\ **Last updated:** [February 4, 2021, 5:01pm UTC](https://discuss.elastic.co/t/drop-documents-when-similar-to-previous-processed-ones/262484 "2021-02-04T17:01:15Z")
Hello, I'm pretty new to this but I would like to know if there is the possibility to drop one document in a logstash configuration file if the timestamp is similar to a previous one processed. For example, I would like… --- ## [Logstash JVM Heap Errors (Not Allocating to Xms)](https://discuss.elastic.co/t/logstash-jvm-heap-errors-not-allocating-to-xms/263270)
**Author:** [@randyitguy](https://discuss.elastic.co/u/randyitguy)\ **Replies:** 0\ **Last updated:** [February 4, 2021, 4:57pm UTC](https://discuss.elastic.co/t/logstash-jvm-heap-errors-not-allocating-to-xms/263270 "2021-02-04T16:57:00Z")
I'm using logstash 7.10. I have 3 pipelines with 3 different input sources. Two out of the three stop producing output after a short number of documents. One of them runs fine. If I try to run logstash with all 3 specifi… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1569) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1571)