# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1577 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1578 --- ## [Are users and roles functionality available in the free version?](https://discuss.elastic.co/t/are-users-and-roles-functionality-available-in-the-free-version/262905)
**Author:** [@paul0](https://discuss.elastic.co/u/paul0)\ **Replies:** 1\ **Last updated:** [February 1, 2021, 9:39pm UTC](https://discuss.elastic.co/t/are-users-and-roles-functionality-available-in-the-free-version/262905 "2021-02-01T21:39:32Z")
We're currently running an instance of Kibana internally (v7.8.0). Previously, I know the user/roles features were only available via XPack and the paid license. Is this still the case? If it isn't, is there any docs abo… --- ## [Group buckets by another fields keyword](https://discuss.elastic.co/t/group-buckets-by-another-fields-keyword/261940)
**Author:** [@grra](https://discuss.elastic.co/u/grra)\ **Replies:** 4\ **Last updated:** [February 1, 2021, 9:34pm UTC](https://discuss.elastic.co/t/group-buckets-by-another-fields-keyword/261940 "2021-02-01T21:34:24Z")
Hi, I want to visualize a Bar Chart with Vega. I have Houses and Rooms. (Rooms can have different colors) Each house(1, 2, 3, ...) has several rooms (1, 2, 3, ...). The house and room fields are from type number. … --- ## [Bool OR term quey does not match any document](https://discuss.elastic.co/t/bool-or-term-quey-does-not-match-any-document/262908)
**Author:** [@JackMaarek](https://discuss.elastic.co/u/JackMaarek)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 9:18pm UTC](https://discuss.elastic.co/t/bool-or-term-quey-does-not-match-any-document/262908 "2021-02-01T21:18:58Z")
Hello guys, I am trying to dive into DDD architecture by implement CQRS and event sourcing pattern into my app. The app is a simple blog api with article management and user authentication. I'm using elastic to store my… --- ## [Api Key](https://discuss.elastic.co/t/api-key/262907)
**Author:** [@ukuleleplayer](https://discuss.elastic.co/u/ukuleleplayer)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 9:03pm UTC](https://discuss.elastic.co/t/api-key/262907 "2021-02-01T21:03:19Z")
I'm trying to see if there's a way to replace the cloud.auth variable in the auditbeat.yml file with an api-key. Is there any way to do this? --- ## [Filter in ids query](https://discuss.elastic.co/t/filter-in-ids-query/262902)
**Author:** [@yish-yish](https://discuss.elastic.co/u/yish-yish)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 8:40pm UTC](https://discuss.elastic.co/t/filter-in-ids-query/262902 "2021-02-01T20:40:29Z")
Hi elastic wizards. I have in my code base an ids query, and I need to add filtering capabilities to the query i.e. in addition to the ids filter, I need to be able to add additional term based filters. Is there a way … --- ## [ES Cannot Index Monitoring Indices](https://discuss.elastic.co/t/es-cannot-index-monitoring-indices/262695)
**Author:** [@lnorman](https://discuss.elastic.co/u/lnorman)\ **Replies:** 4\ **Last updated:** [February 1, 2021, 8:57pm UTC](https://discuss.elastic.co/t/es-cannot-index-monitoring-indices/262695 "2021-02-01T20:57:48Z")
I am trying to turn on stack monitoring, however, metricbeat keeps logging something that starts like this: WARN \[elasticsearch\] elasticsearch/client.go:408 Cannot index event publisher.Event and in… --- ## [Elastic SIEM alerts + auditbeats - only few are working fine](https://discuss.elastic.co/t/elastic-siem-alerts-auditbeats-only-few-are-working-fine/262810)
**Author:** [@Orion](https://discuss.elastic.co/u/Orion)\ **Replies:** 2\ **Last updated:** [February 1, 2021, 8:16pm UTC](https://discuss.elastic.co/t/elastic-siem-alerts-auditbeats-only-few-are-working-fine/262810 "2021-02-01T20:16:21Z")
Hello, first post in the forum, since using free Elastic licence, would like to seek for some support in the discussion board. Currently I'm experimenting on SIEM \> Detections module, have Elastic stack installed on one… --- ## [Allowing multiple mappings in Elastic Search 6](https://discuss.elastic.co/t/allowing-multiple-mappings-in-elastic-search-6/262864)
**Author:** [@Jack4](https://discuss.elastic.co/u/Jack4)\ **Replies:** 5\ **Last updated:** [February 1, 2021, 8:14pm UTC](https://discuss.elastic.co/t/allowing-multiple-mappings-in-elastic-search-6/262864 "2021-02-01T20:14:44Z")
Hi All, I am upgrading from Elastic 5.6.16 to 6.8.13 and it's complaining about "Rejecting mapping update to...as the final mapping would have more than 1 type" Without switching to single mapping, is there a workarou… --- ## [Adding A New Field in Elasticsearch Ingest Pipeline](https://discuss.elastic.co/t/adding-a-new-field-in-elasticsearch-ingest-pipeline/262891)
**Author:** [@PRODIPTO](https://discuss.elastic.co/u/PRODIPTO)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 7:55pm UTC](https://discuss.elastic.co/t/adding-a-new-field-in-elasticsearch-ingest-pipeline/262891 "2021-02-01T19:55:39Z")
Hi I am working on a migration activity where we are moving from a OSS version of Elastic Stack to Platinum version. We were using Logstash in the OSS cluster to parse the logs but in the Platinum cluster we are going t… --- ## [Snapshots are failing](https://discuss.elastic.co/t/snapshots-are-failing/262769)
**Author:** [@SteveHodges](https://discuss.elastic.co/u/SteveHodges)\ **Replies:** 4\ **Last updated:** [February 1, 2021, 7:52pm UTC](https://discuss.elastic.co/t/snapshots-are-failing/262769 "2021-02-01T19:52:46Z")
After a network outage, the elasticsearch snapshot is failing. After I restored the connection to the NAS I am getting errors when I try to take a snapshot. The error is access\_denied\_exception Here is the command I r… --- ## [Elastic search( 7.10.0 ) stops working after we query from kibana](https://discuss.elastic.co/t/elastic-search-7-10-0-stops-working-after-we-query-from-kibana/262736)
**Author:** [@Subhom\_Dutta](https://discuss.elastic.co/u/Subhom_Dutta)\ **Replies:** 3\ **Last updated:** [February 1, 2021, 7:52pm UTC](https://discuss.elastic.co/t/elastic-search-7-10-0-stops-working-after-we-query-from-kibana/262736 "2021-02-01T19:52:30Z")
Hi, Below are the logs of the single node cluster of elastic search before it stops \[2021-01-30T15:34:36,160\]\[INFO \]\[o.e.x.m.p.NativeController\] \[ELK-NODE\] Native controller process has stopped - no new native processe… --- ## [No index pattern for logstash](https://discuss.elastic.co/t/no-index-pattern-for-logstash/262297)
**Author:** [@mof\_cmsmith](https://discuss.elastic.co/u/mof_cmsmith)\ **Replies:** 26\ **Last updated:** [February 1, 2021, 7:41pm UTC](https://discuss.elastic.co/t/no-index-pattern-for-logstash/262297 "2021-02-01T19:41:55Z")
I am struggling a bit with this. Windows 2019 running ELK 7.10.2. I have it ingesting filebeat, metricbeat, etc. Proper indices and patterns are present, except... Logstash has an index, so I know its ingesting. How… --- ## [How to custom the fetch metrics by docker containers?](https://discuss.elastic.co/t/how-to-custom-the-fetch-metrics-by-docker-containers/262836)
**Author:** [@MatteoM](https://discuss.elastic.co/u/MatteoM)\ **Replies:** 1\ **Last updated:** [February 1, 2021, 7:31pm UTC](https://discuss.elastic.co/t/how-to-custom-the-fetch-metrics-by-docker-containers/262836 "2021-02-01T19:31:14Z")
Hi to everyone! I'm new to kibana and elasticsearch. I've seen that in kibana is possible to fetch metrics by docker containers. How can i custum this metric to fetch the consumption disk space of a container ? And i… --- ## [How to calculate minimum and maximun of Session duration](https://discuss.elastic.co/t/how-to-calculate-minimum-and-maximun-of-session-duration/262852)
**Author:** [@ITchandj](https://discuss.elastic.co/u/ITchandj)\ **Replies:** 7\ **Last updated:** [February 1, 2021, 6:03pm UTC](https://discuss.elastic.co/t/how-to-calculate-minimum-and-maximun-of-session-duration/262852 "2021-02-01T18:03:37Z")
Hello everyone!! i am new to Kibana and i lik to know how to calculate the minimum and maximum of a session. Thanks for your help. --- ## [Instrument elasticsearch search with Jaeger (or elastic APM)](https://discuss.elastic.co/t/instrument-elasticsearch-search-with-jaeger-or-elastic-apm/262869)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 5:12pm UTC](https://discuss.elastic.co/t/instrument-elasticsearch-search-with-jaeger-or-elastic-apm/262869 "2021-02-01T17:12:23Z")
In order to tune our cluster, we want to understand what elasticsearch do when a query arrive. Usually we use jaeger for that , (I am a big fan of elasticAPM too), is it possible to profile elasticsearch like that? So … --- ## [Mysql query speed slow, cause offset](https://discuss.elastic.co/t/mysql-query-speed-slow-cause-offset/262868)
**Author:** [@star\_gold](https://discuss.elastic.co/u/star_gold)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 4:58pm UTC](https://discuss.elastic.co/t/mysql-query-speed-slow-cause-offset/262868 "2021-02-01T16:58:58Z")
this is my config file: \` input { jdbc { jdbc\_driver\_library =\> "/tmp/logstash/logstash-7.9.3/mysql/mysql-connector-java-8.0.16.jar" jdbc\_driver\_class =\> "com.mysql.cj.jdbc.Driver" jdbc\_page\_size =\> 3 tracking\_col… --- ## [Logstash error](https://discuss.elastic.co/t/logstash-error/262558)
**Author:** [@suraj.ghorp](https://discuss.elastic.co/u/suraj.ghorp)\ **Replies:** 2\ **Last updated:** [February 1, 2021, 4:57pm UTC](https://discuss.elastic.co/t/logstash-error/262558 "2021-02-01T16:57:49Z")
Hi Masters, I am pulling logs from cloud based WAF through logstash. i am getting an below error. WARNING: An illegal reflective access operation has occurred WARNING: Illegal reflective access by org.jruby.ext.openss… --- ## [Latest value in a gauge](https://discuss.elastic.co/t/latest-value-in-a-gauge/262659)
**Author:** [@luc.c](https://discuss.elastic.co/u/luc.c)\ **Replies:** 3\ **Last updated:** [February 1, 2021, 4:42pm UTC](https://discuss.elastic.co/t/latest-value-in-a-gauge/262659 "2021-02-01T16:42:03Z")
Hi, I'm having trouble building a gauge based on two relevant fields: requestID and Status. My goal is to show the number of requestID for each status; it is not a cumulative count though, as the same requestID can ass… --- ## [Scripted Fields + Filtering](https://discuss.elastic.co/t/scripted-fields-filtering/262047)
**Author:** [@Rob\_wylde](https://discuss.elastic.co/u/Rob_wylde)\ **Replies:** 7\ **Last updated:** [February 1, 2021, 4:40pm UTC](https://discuss.elastic.co/t/scripted-fields-filtering/262047 "2021-02-01T16:40:13Z")
I am trying to use painless to calculate the duration of 2 ISO8601 timestamps The field is correctly populated with the returned string i have defined. However the field can't not be filtered upon / with. This is my firs… --- ## [Filebeat to GCP PubSub](https://discuss.elastic.co/t/filebeat-to-gcp-pubsub/262859)
**Author:** [@MMH](https://discuss.elastic.co/u/MMH)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 4:08pm UTC](https://discuss.elastic.co/t/filebeat-to-gcp-pubsub/262859 "2021-02-01T16:08:20Z")
I want to setup the environment similar to this: but to use GCP PubSub instead of Kafka. I know, that Filebeat does not have a PubSub output. What is the easiest way to achieve this? I know, that Logstash can be use… --- ## [Grok filters are not getting applied](https://discuss.elastic.co/t/grok-filters-are-not-getting-applied/262851)
**Author:** [@ranjini](https://discuss.elastic.co/u/ranjini)\ **Replies:** 4\ **Last updated:** [February 1, 2021, 4:07pm UTC](https://discuss.elastic.co/t/grok-filters-are-not-getting-applied/262851 "2021-02-01T16:07:16Z")
grok patterns are not getting applied. Please apply. grok debugger shows no issue. please find the filebeat.yml filebeat.inputs: - type: log paths: - C:/Program Files (x86)/dox/onion.log fields: tags: appl… --- ## [Watcher or Alerting?](https://discuss.elastic.co/t/watcher-or-alerting/262827)
**Author:** [@alfredo.deluca](https://discuss.elastic.co/u/alfredo.deluca)\ **Replies:** 2\ **Last updated:** [February 1, 2021, 3:58pm UTC](https://discuss.elastic.co/t/watcher-or-alerting/262827 "2021-02-01T15:58:21Z")
Hi all. I heard that Watcher will be discontinued in the future. Is that right? Watcher at the moment is the only way (and not easy I must say) to integrate Atlassian OPSGenie alerting management with Elastic but it is … --- ## [Scaling\_factor is missing in generated template using ECS Tooling 1.7.0](https://discuss.elastic.co/t/scaling-factor-is-missing-in-generated-template-using-ecs-tooling-1-7-0/262511)
**Author:** [@mxu](https://discuss.elastic.co/u/mxu)\ **Replies:** 3\ **Last updated:** [February 1, 2021, 3:37pm UTC](https://discuss.elastic.co/t/scaling-factor-is-missing-in-generated-template-using-ecs-tooling-1-7-0/262511 "2021-02-01T15:37:58Z")
Hi, I am adding a custom schema for CPU Usage, configured as following. The ECS Tooling 1.7.0 generated template without "scaling\_factor" field. - name: 1MinAvg.Pct level: custom type: scaled\_float s… --- ## [Convert Map Shape to layer or Region](https://discuss.elastic.co/t/convert-map-shape-to-layer-or-region/262828)
**Author:** [@stexxen](https://discuss.elastic.co/u/stexxen)\ **Replies:** 1\ **Last updated:** [February 1, 2021, 3:31pm UTC](https://discuss.elastic.co/t/convert-map-shape-to-layer-or-region/262828 "2021-02-01T15:31:55Z")
Kibana maps is great! however I'd like to know if this is possible I am able to import layers with the various Layer tools i.e. Administrative Regions via EMS is one possibility. I'm also able to create shapes via the… --- ## [How to sum bucket aggregations in ranges](https://discuss.elastic.co/t/how-to-sum-bucket-aggregations-in-ranges/262602)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 2\ **Last updated:** [February 1, 2021, 3:23pm UTC](https://discuss.elastic.co/t/how-to-sum-bucket-aggregations-in-ranges/262602 "2021-02-01T15:23:07Z")
Hi, I have a ELK setup of 7.10.0v. I have created one data-table with sum of brokerage, Unique count of Client\_id and so on, now in the bucket I want to do the ranges on sum of brokerage. How can I take sum of brokerag… --- ## [Terms Aggregation not returning keys](https://discuss.elastic.co/t/terms-aggregation-not-returning-keys/262634)
**Author:** [@gabe.ks11](https://discuss.elastic.co/u/gabe.ks11)\ **Replies:** 15\ **Last updated:** [February 1, 2021, 2:59pm UTC](https://discuss.elastic.co/t/terms-aggregation-not-returning-keys/262634 "2021-02-01T14:59:06Z")
Hi everyone, So recently we ran into a problem using elastic, we are attempting to detect records which have a duplicate value (hash) and to patch them with a flag so that we iterate all records as we go. (27 million re… --- ## [Auto create DataStream by writing to it](https://discuss.elastic.co/t/auto-create-datastream-by-writing-to-it/262848)
**Author:** [@gkman](https://discuss.elastic.co/u/gkman)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 2:29pm UTC](https://discuss.elastic.co/t/auto-create-datastream-by-writing-to-it/262848 "2021-02-01T14:29:28Z")
Hi. Is it possible to create a DataStream by attempting to writing to it? (similarly to the way index can be created by attempting to write to it.) --- ## [Question about line color for a Vega scatter chart](https://discuss.elastic.co/t/question-about-line-color-for-a-vega-scatter-chart/262679)
**Author:** [@dandcp](https://discuss.elastic.co/u/dandcp)\ **Replies:** 1\ **Last updated:** [February 1, 2021, 2:20pm UTC](https://discuss.elastic.co/t/question-about-line-color-for-a-vega-scatter-chart/262679 "2021-02-01T14:20:54Z")
I have, what I assume is, an easy question. I have a scatter chart (code below) and I want to make the vertical and horizontal line black. Right now it's white. I have tried a handful of different things but nothing h… --- ## [Updating non-file synonyms](https://discuss.elastic.co/t/updating-non-file-synonyms/262364)
**Author:** [@Henr1k](https://discuss.elastic.co/u/Henr1k)\ **Replies:** 6\ **Last updated:** [February 1, 2021, 2:17pm UTC](https://discuss.elastic.co/t/updating-non-file-synonyms/262364 "2021-02-01T14:17:52Z")
Hi, I was trying to do updates on non-file synonyms, but it fails. Do I have to use a file or am I doing it wrong? Files isn't that well supported in Elasticsearch Cloud. It is only via Cloud UI or have I missed an AP… --- ## [Disabled object fields appearing on fields list and being parsed on document detail](https://discuss.elastic.co/t/disabled-object-fields-appearing-on-fields-list-and-being-parsed-on-document-detail/262526)
**Author:** [@mxandeco](https://discuss.elastic.co/u/mxandeco)\ **Replies:** 2\ **Last updated:** [February 1, 2021, 2:10pm UTC](https://discuss.elastic.co/t/disabled-object-fields-appearing-on-fields-list-and-being-parsed-on-document-detail/262526 "2021-02-01T14:10:11Z")
I have a template like: { "index\_patterns": \["events-\*"\], "mappings": { "properties": { "id": { "type": "keyword" }, "topic": { "type": "keyword" }, "name": { "type": "keyword" }, "timestam… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1576) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1578)