# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1578 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1579 --- ## [How to collect \`dmesg\` outputs - or those logs are useless?](https://discuss.elastic.co/t/how-to-collect-dmesg-outputs-or-those-logs-are-useless/262714)
**Author:** [@fzyzcjy](https://discuss.elastic.co/u/fzyzcjy)\ **Replies:** 2\ **Last updated:** [February 1, 2021, 2:08pm UTC](https://discuss.elastic.co/t/how-to-collect-dmesg-outputs-or-those-logs-are-useless/262714 "2021-02-01T14:08:54Z")
Hi thanks for the lib! I wonder (1) whether I should collect dmesg outputs? Are they useful or useless? In addition, I wonder how can I collect them using Filebeat? Thanks! --- ## [Accessing .watcher-history index in Canvas?](https://discuss.elastic.co/t/accessing-watcher-history-index-in-canvas/262823)
**Author:** [@VishalBhalla](https://discuss.elastic.co/u/VishalBhalla)\ **Replies:** 2\ **Last updated:** [February 1, 2021, 1:56pm UTC](https://discuss.elastic.co/t/accessing-watcher-history-index-in-canvas/262823 "2021-02-01T13:56:01Z")
Hello, I can't seem to access the .watcher-history index from within Canvas. Trying to use an ESSQL query such as: SELECT "result.input.payload.alert.hits.hits" FROM ".watcher-history" LIMIT 99 Just results in the err… --- ## [Can you have a data table visualization using computed metric?](https://discuss.elastic.co/t/can-you-have-a-data-table-visualization-using-computed-metric/262267)
**Author:** [@RandomTruffle](https://discuss.elastic.co/u/RandomTruffle)\ **Replies:** 1\ **Last updated:** [February 1, 2021, 12:28pm UTC](https://discuss.elastic.co/t/can-you-have-a-data-table-visualization-using-computed-metric/262267 "2021-02-01T12:28:19Z")
I have a bunch of data representing individual runs of jobs in a cluster. There are a couple thousand unique kinds of jobs, and so one of the fields in each entry is the job's name. Other fields include duration, succe… --- ## [How to use grok to match filenames as indexes in logstash](https://discuss.elastic.co/t/how-to-use-grok-to-match-filenames-as-indexes-in-logstash/262840)
**Author:** [@ThePreMan](https://discuss.elastic.co/u/ThePreMan)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 1:14pm UTC](https://discuss.elastic.co/t/how-to-use-grok-to-match-filenames-as-indexes-in-logstash/262840 "2021-02-01T13:14:55Z")
We try to use developer names as indexes in logstash. Therefore our filenames are something like: developer1.log We have tried to use grok to match a certain part of the path as our filename. Nothing seems to be workin… --- ## [Logstash multilevel aggregation #logstash](https://discuss.elastic.co/t/logstash-multilevel-aggregation-logstash/262329)
**Author:** [@onkarborade](https://discuss.elastic.co/u/onkarborade)\ **Replies:** 1\ **Last updated:** [February 1, 2021, 1:13pm UTC](https://discuss.elastic.co/t/logstash-multilevel-aggregation-logstash/262329 "2021-02-01T13:13:59Z")
Hi, I am trying do a aggregation using plugins logstash-filter-aggregate (2.8.0). I extract data from relation database using plugin-jdbc. Where a teachers has and multiple contact\_details. I would like this result: … --- ## [How to let Functionbeat write to multiple indices](https://discuss.elastic.co/t/how-to-let-functionbeat-write-to-multiple-indices/262614)
**Author:** [@yahya92](https://discuss.elastic.co/u/yahya92)\ **Replies:** 2\ **Last updated:** [February 1, 2021, 1:11pm UTC](https://discuss.elastic.co/t/how-to-let-functionbeat-write-to-multiple-indices/262614 "2021-02-01T13:11:43Z")
Hello Is there a way to let Functionbeat write to multiple indices? I have seen that it can write to only one of many indices according to defined rules. Example: output.elasticsearch: indices: - index: "index-firs… --- ## [How much heap memory need for elasticsearch data nodes](https://discuss.elastic.co/t/how-much-heap-memory-need-for-elasticsearch-data-nodes/262773)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 4\ **Last updated:** [February 1, 2021, 1:07pm UTC](https://discuss.elastic.co/t/how-much-heap-memory-need-for-elasticsearch-data-nodes/262773 "2021-02-01T13:07:40Z")
I am runnig 8 node cluster (3 Master+3 data+2 coordinate) data\_node 1 contains 714 shards and heap memory is 10gb data\_node 2 contains 715 shards and heap memory is 10gb data\_node 3 contains 715 shards and heap memory … --- ## [How ElasticSearch compare with GeoMesa](https://discuss.elastic.co/t/how-elasticsearch-compare-with-geomesa/262569)
**Author:** [@nico44000](https://discuss.elastic.co/u/nico44000)\ **Replies:** 2\ **Last updated:** [February 1, 2021, 12:52pm UTC](https://discuss.elastic.co/t/how-elasticsearch-compare-with-geomesa/262569 "2021-02-01T12:52:37Z")
It's unclear for me how ElasticSearch 8 compare with GeoMesa, for geo-spatial queries. With ElasticSearch, I can index and query Point/Line/Polygon/MultiPolygon with very high performance. Since few years, ElasticSearc… --- ## [Kibana is slow](https://discuss.elastic.co/t/kibana-is-slow/262811)
**Author:** [@stk1](https://discuss.elastic.co/u/stk1)\ **Replies:** 2\ **Last updated:** [February 1, 2021, 12:48pm UTC](https://discuss.elastic.co/t/kibana-is-slow/262811 "2021-02-01T12:48:01Z")
Hi, my problem is that Kibana (v7.10, but also in previous versions) is very slow when a section is changed or reloaded. For example loading the log-in screen, changing to APM etc. takes each 5-10 seconds (changing insi… --- ## [Create arrays in Logstash](https://discuss.elastic.co/t/create-arrays-in-logstash/262260)
**Author:** [@gneves](https://discuss.elastic.co/u/gneves)\ **Replies:** 4\ **Last updated:** [February 1, 2021, 12:43pm UTC](https://discuss.elastic.co/t/create-arrays-in-logstash/262260 "2021-02-01T12:43:27Z")
Hello guys. Dont know if it is possible, but i would like to create an array in my logstash to use in an if statement. ill give an example for you to understand me. Giving a random "log to be processed" as example: ra… --- ## [Watcher email output ,access nested aggregations fields](https://discuss.elastic.co/t/watcher-email-output-access-nested-aggregations-fields/262345)
**Author:** [@Muhammad\_Faisal](https://discuss.elastic.co/u/Muhammad_Faisal)\ **Replies:** 1\ **Last updated:** [February 1, 2021, 12:38pm UTC](https://discuss.elastic.co/t/watcher-email-output-access-nested-aggregations-fields/262345 "2021-02-01T12:38:22Z")
hi guys, i have below watcher simulation output ... how do i access and iterate over below fields and send them in email action i am trying using {{ctx.payload.aggregations.2.buckets.3.buckets.4.buckets.1.value}} but … --- ## [Snapshot Kibana 6.8 under Windows](https://discuss.elastic.co/t/snapshot-kibana-6-8-under-windows/261537)
**Author:** [@dumitrao](https://discuss.elastic.co/u/dumitrao)\ **Replies:** 13\ **Last updated:** [February 1, 2021, 12:25pm UTC](https://discuss.elastic.co/t/snapshot-kibana-6-8-under-windows/261537 "2021-02-01T12:25:21Z")
Hello, I am trying to setup Kibana to create a snapshot but I am missing the setting - Register a repository - in Kibana 6.8 I add already in the elasticsearch.yml - path.repo: E:\\Program Files\\Elastic\\\\Elasticsearch … --- ## [JMX Input Plugin Config metrics on sub path (host:port/jmx)](https://discuss.elastic.co/t/jmx-input-plugin-config-metrics-on-sub-path-host-port-jmx/262830)
**Author:** [@Andy\_Barber1](https://discuss.elastic.co/u/Andy_Barber1)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 12:24pm UTC](https://discuss.elastic.co/t/jmx-input-plugin-config-metrics-on-sub-path-host-port-jmx/262830 "2021-02-01T12:24:19Z")
Hi I am looking to do some basic JMX connection using logstash and the JMX-input plugin. basic platform stuff (elastic kibana and logstash) are working ok. the Input plugin configuration had parameters for host and port… --- ## [7.9 ILM Policy - Rollover never happens](https://discuss.elastic.co/t/7-9-ilm-policy-rollover-never-happens/262050)
**Author:** [@Mitchell](https://discuss.elastic.co/u/Mitchell)\ **Replies:** 1\ **Last updated:** [February 1, 2021, 12:11pm UTC](https://discuss.elastic.co/t/7-9-ilm-policy-rollover-never-happens/262050 "2021-02-01T12:11:36Z")
Hello, If I have an index named config and a corresponding index pattern config\*, it is unclear to me, after several attempts, how to follow the steps in this tutorial https://www.elastic.co/guide/en/elasticsearch/refe… --- ## [Metric background colour based on query](https://discuss.elastic.co/t/metric-background-colour-based-on-query/262636)
**Author:** [@ian\_k](https://discuss.elastic.co/u/ian_k)\ **Replies:** 4\ **Last updated:** [February 1, 2021, 11:29am UTC](https://discuss.elastic.co/t/metric-background-colour-based-on-query/262636 "2021-02-01T11:29:54Z")
Hello, I've been reading some similar posts and solutions here, but I can't get them to work. I'd like to change the colour of the background of a metric based upon the number of items returned by a query, but I'm very … --- ## [Payload score for block-max WAND](https://discuss.elastic.co/t/payload-score-for-block-max-wand/262790)
**Author:** [@robert-007](https://discuss.elastic.co/u/robert-007)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 6:34am UTC](https://discuss.elastic.co/t/payload-score-for-block-max-wand/262790 "2021-02-01T06:34:07Z")
As I read the papper "\[Optimizing Top-k Document Retrieval Strategies for Block-Max Indexes\](http://engineering.nyu.edu/~suel/papers/bmm.pdf)", i see that each block of posting list stores one max score using to skip th… --- ## [Kibana 7.10 : handling cookie on server side custom plugin](https://discuss.elastic.co/t/kibana-7-10-handling-cookie-on-server-side-custom-plugin/262770)
**Author:** [@Prathibha\_Y](https://discuss.elastic.co/u/Prathibha_Y)\ **Replies:** 2\ **Last updated:** [February 1, 2021, 11:08am UTC](https://discuss.elastic.co/t/kibana-7-10-handling-cookie-on-server-side-custom-plugin/262770 "2021-02-01T11:08:07Z")
Hi , I am trying to add server side cookie for my custom plugin, this is the code but I am not able to get the server object from http\_server, I get this module not found error when i try to import HttpServiceSetup im… --- ## [Find all documents with a missing field (“index”: false, “store”: true)](https://discuss.elastic.co/t/find-all-documents-with-a-missing-field-index-false-store-true/262626)
**Author:** [@tworogue](https://discuss.elastic.co/u/tworogue)\ **Replies:** 1\ **Last updated:** [February 1, 2021, 11:04am UTC](https://discuss.elastic.co/t/find-all-documents-with-a-missing-field-index-false-store-true/262626 "2021-02-01T11:04:33Z")
ElasticSearch version: 6.8.2 Index metadata fragment: { "my\_index": { "mappings": { "type": { "properties": { "my\_field": { "typ… --- ## [Most Recent Trend, Most Searchable keyword with ElasticSearch API](https://discuss.elastic.co/t/most-recent-trend-most-searchable-keyword-with-elasticsearch-api/262783)
**Author:** [@het](https://discuss.elastic.co/u/het)\ **Replies:** 3\ **Last updated:** [February 1, 2021, 10:41am UTC](https://discuss.elastic.co/t/most-recent-trend-most-searchable-keyword-with-elasticsearch-api/262783 "2021-02-01T10:41:16Z")
Hi Team, Does Elasticsearch provide an API that gives the Most searched words, new search words, and so on? For example like google, top 10 recently searched items, top 10 most searched items? Can we achieve something… --- ## [Elasticsearch security warning when i connect to cluster from outside](https://discuss.elastic.co/t/elasticsearch-security-warning-when-i-connect-to-cluster-from-outside/262768)
**Author:** [@first100](https://discuss.elastic.co/u/first100)\ **Replies:** 2\ **Last updated:** [February 1, 2021, 10:32am UTC](https://discuss.elastic.co/t/elasticsearch-security-warning-when-i-connect-to-cluster-from-outside/262768 "2021-02-01T10:32:50Z")
Hello, i was able to secure my elastic cluster with certificates generated from elasticsearch-certutil command, but i f try to open my node : https://elk-001:9200 from outside , receive warning from browser, about the c… --- ## [If-in statement does not work if array has one object \[SOLVED\]](https://discuss.elastic.co/t/if-in-statement-does-not-work-if-array-has-one-object-solved/262818)
**Author:** [@dorinand](https://discuss.elastic.co/u/dorinand)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 10:30am UTC](https://discuss.elastic.co/t/if-in-statement-does-not-work-if-array-has-one-object-solved/262818 "2021-02-01T10:30:16Z")
Hi, I prepare this question and also find solution after few hours, so I decide to upload question and answer, maybe it will help somebody: QUESTION: I have Filebeat in k8s that sends logs to Logstash. I have namespace… --- ## [Logstash not reading log file but reads text file](https://discuss.elastic.co/t/logstash-not-reading-log-file-but-reads-text-file/262817)
**Author:** [@vighnesh\_mahadik](https://discuss.elastic.co/u/vighnesh_mahadik)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 10:11am UTC](https://discuss.elastic.co/t/logstash-not-reading-log-file-but-reads-text-file/262817 "2021-02-01T10:11:22Z")
The contents of my log file is same but it does not read the file in .log extension but is able to read it in .txt extension. reads .txt file and shows on console as well as kibana Config for reading .txt file :- input… --- ## [Node crash is happening ES 6.8](https://discuss.elastic.co/t/node-crash-is-happening-es-6-8/262791)
**Author:** [@nk1506](https://discuss.elastic.co/u/nk1506)\ **Replies:** 2\ **Last updated:** [February 1, 2021, 9:51am UTC](https://discuss.elastic.co/t/node-crash-is-happening-es-6-8/262791 "2021-02-01T09:51:41Z")
Because of some bad query GC clean up is happening more frequently and node is getting crashed after sometime. Is there any way to know which query is causing the issues? Or how to prevent node is going down? I read ab… --- ## [Logstash file output plugin writing to the same file from multiple Logstash processes?!](https://discuss.elastic.co/t/logstash-file-output-plugin-writing-to-the-same-file-from-multiple-logstash-processes/261750)
**Author:** [@bjosve](https://discuss.elastic.co/u/bjosve)\ **Replies:** 2\ **Last updated:** [February 1, 2021, 9:18am UTC](https://discuss.elastic.co/t/logstash-file-output-plugin-writing-to-the-same-file-from-multiple-logstash-processes/261750 "2021-02-01T09:18:27Z")
Hi, In the following post, https://discuss.elastic.co/t/multiple-logstash-nodes-use-file-output-plugin-to-output-messages-to-one-file-in-a-shared-file-system/94275/9 @magnusbaeck writes, If Logstash is opening the o… --- ## [Recover shards from different version](https://discuss.elastic.co/t/recover-shards-from-different-version/262766)
**Author:** [@carmine.fabrizio](https://discuss.elastic.co/u/carmine.fabrizio)\ **Replies:** 2\ **Last updated:** [February 1, 2021, 9:16am UTC](https://discuss.elastic.co/t/recover-shards-from-different-version/262766 "2021-02-01T09:16:55Z")
Hi there, I have a cluster of 25 nodes with HOT/WARM/COLD phases in place, the cluster is running on version 7.5.1 and by mistake one of the hot nodes was running on a different version 7.8.1, and ingesting data, I not… --- ## [Best infrastructure for elasticsearch](https://discuss.elastic.co/t/best-infrastructure-for-elasticsearch/262737)
**Author:** [@iammanmale](https://discuss.elastic.co/u/iammanmale)\ **Replies:** 3\ **Last updated:** [February 1, 2021, 9:01am UTC](https://discuss.elastic.co/t/best-infrastructure-for-elasticsearch/262737 "2021-02-01T09:01:11Z")
We have 7 ES node + 2 logstash server to collect log from AWS machines around the world by filebeat. Those ES and logstash nodes are just desktop PC at the moment. We want to put them into a more reliable infrastructure. … --- ## [Java Scroll Api with aggregation](https://discuss.elastic.co/t/java-scroll-api-with-aggregation/262798)
**Author:** [@vands](https://discuss.elastic.co/u/vands)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 8:27am UTC](https://discuss.elastic.co/t/java-scroll-api-with-aggregation/262798 "2021-02-01T08:27:46Z")
Hi All , I am using Java scroll API to fetch data from an index . Is it possible to use CompositeAggregationBuilder along with scroll api and get aggregation resultset in batches of 10000 from elastic . If so , please h… --- ## [Mapping fields as date when index already exists](https://discuss.elastic.co/t/mapping-fields-as-date-when-index-already-exists/262745)
**Author:** [@Giovanni\_Di\_Lembo](https://discuss.elastic.co/u/Giovanni_Di_Lembo)\ **Replies:** 2\ **Last updated:** [February 1, 2021, 8:19am UTC](https://discuss.elastic.co/t/mapping-fields-as-date-when-index-already-exists/262745 "2021-02-01T08:19:02Z")
Hi all and sorry for my poor english. I've successfully mapped a field as date (for kibana purpose) before ingestioning one document ,using this: PUT my-index { "mappings": { "properties": { "currentDate": { "t… --- ## [Elasticsearch master and client service/pod not coming up](https://discuss.elastic.co/t/elasticsearch-master-and-client-service-pod-not-coming-up/262788)
**Author:** [@Munieswaran](https://discuss.elastic.co/u/Munieswaran)\ **Replies:** 1\ **Last updated:** [February 1, 2021, 8:07am UTC](https://discuss.elastic.co/t/elasticsearch-master-and-client-service-pod-not-coming-up/262788 "2021-02-01T08:07:00Z")
I'm running Elasticsearch cluster in openshift environment, where i recently patched and rebooted the underlaying nodes, after reboot master and client pods are not coming up and error seems to be related to mount, but d… --- ## [Calculating Average Daily Count over 30 Days](https://discuss.elastic.co/t/calculating-average-daily-count-over-30-days/262758)
**Author:** [@Clay\_Curtis](https://discuss.elastic.co/u/Clay_Curtis)\ **Replies:** 1\ **Last updated:** [February 1, 2021, 7:42am UTC](https://discuss.elastic.co/t/calculating-average-daily-count-over-30-days/262758 "2021-02-01T07:42:38Z")
I am trying to make a table visualization that shows the 30-day averages of the daily averages of log volume (count) per per log source split by type. For example, If I have 10 log sources, half are firewalls, and hal… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1577) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1579)