# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1601 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1602 --- ## [Errors in Logstash after \`bundle install \` in plugin](https://discuss.elastic.co/t/errors-in-logstash-after-bundle-install-in-plugin/261286)
**Author:** [@a\_sharafan](https://discuss.elastic.co/u/a_sharafan)\ **Replies:** 0\ **Last updated:** [January 15, 2021, 5:26pm UTC](https://discuss.elastic.co/t/errors-in-logstash-after-bundle-install-in-plugin/261286 "2021-01-15T17:26:31Z")
I created my own filter plugin and did bundle install under directory of plugin. Also created .gem file, but after this bin/logstash doesn't work because of that problem: "No such file to load -- bundler " in ruby-kernel… --- ## [Output Event Rates are showing gaps in APM Stack Monitoring page](https://discuss.elastic.co/t/output-event-rates-are-showing-gaps-in-apm-stack-monitoring-page/259572)
**Author:** [@vamsikrishna\_medeti](https://discuss.elastic.co/u/vamsikrishna_medeti)\ **Replies:** 1\ **Last updated:** [January 15, 2021, 5:15pm UTC](https://discuss.elastic.co/t/output-event-rates-are-showing-gaps-in-apm-stack-monitoring-page/259572 "2021-01-15T17:15:14Z")
Hi, I am using On premise elastic stack 7.9.0. And recently we are facing outofmemory issue on one of the java agents. The APM CallTrace objects are taking more than 2GB which is causing the issue. Also, we are seeing … --- ## [Cluster nodes didn't recognize each others (ES-7.7.1)](https://discuss.elastic.co/t/cluster-nodes-didnt-recognize-each-others-es-7-7-1/260839)
**Author:** [@Guillaume\_Tiberi](https://discuss.elastic.co/u/Guillaume_Tiberi)\ **Replies:** 6\ **Last updated:** [January 15, 2021, 5:05pm UTC](https://discuss.elastic.co/t/cluster-nodes-didnt-recognize-each-others-es-7-7-1/260839 "2021-01-15T17:05:25Z")
Hi I want to build a 5 nodes ES cluster but nodes didn't recognized each others. Could you help me to well config this cluster ? It's like node didn't recognize themself to be the master-node (node-3 looking for master… --- ## [Puting multiple if conditionals into loop](https://discuss.elastic.co/t/puting-multiple-if-conditionals-into-loop/261226)
**Author:** [@woolfik](https://discuss.elastic.co/u/woolfik)\ **Replies:** 1\ **Last updated:** [January 15, 2021, 4:33pm UTC](https://discuss.elastic.co/t/puting-multiple-if-conditionals-into-loop/261226 "2021-01-15T16:33:24Z")
Good morning. So I'm into logstash filters code which contains tens of similar if conditionals like following: if ("123456" == \[ID\]) { mutate { add\_field =\> { "\[fields\]\[key1\]" =\> "value1" "\[fields\]\[ke… --- ## [Installing new version of custom plugin Kibana 7.10](https://discuss.elastic.co/t/installing-new-version-of-custom-plugin-kibana-7-10/260565)
**Author:** [@ssimmons](https://discuss.elastic.co/u/ssimmons)\ **Replies:** 5\ **Last updated:** [January 15, 2021, 3:51pm UTC](https://discuss.elastic.co/t/installing-new-version-of-custom-plugin-kibana-7-10/260565 "2021-01-15T15:51:34Z")
I'm writing a custom plugin in Kiabana 7.10. I've got it running on my local copy of Kibana. I then do a yarn build command and copy the zip file to our dev server. I then install the plugin using the kibana/bin/kibana-p… --- ## [Date math rounding error](https://discuss.elastic.co/t/date-math-rounding-error/261116)
**Author:** [@bbailey](https://discuss.elastic.co/u/bbailey)\ **Replies:** 3\ **Last updated:** [January 15, 2021, 3:38pm UTC](https://discuss.elastic.co/t/date-math-rounding-error/261116 "2021-01-15T15:38:44Z")
I've come across a strange issue which I think is a bug in the date math I create a daily snapshot of data once it is 10 days old using curator and the name of the snapshot is set to "name: \<{now/d-10d{YYYY-MM-dd}}\>" T… --- ## [No way to link back to original indexed file?](https://discuss.elastic.co/t/no-way-to-link-back-to-original-indexed-file/261042)
**Author:** [@bebbd](https://discuss.elastic.co/u/bebbd)\ **Replies:** 4\ **Last updated:** [January 15, 2021, 3:08pm UTC](https://discuss.elastic.co/t/no-way-to-link-back-to-original-indexed-file/261042 "2021-01-15T15:08:28Z")
Hi I am wondering if I have chosen the wrong tool for my needs. My original goal was to index a folder of 20 GB of files, around 65,000 files. In the search results I would like to link to the found fie, so the user ca… --- ## [Kibana Discover & Dashboards showing 15 minutes delay](https://discuss.elastic.co/t/kibana-discover-dashboards-showing-15-minutes-delay/256899)
**Author:** [@PraveenKT](https://discuss.elastic.co/u/PraveenKT)\ **Replies:** 8\ **Last updated:** [January 15, 2021, 3:00pm UTC](https://discuss.elastic.co/t/kibana-discover-dashboards-showing-15-minutes-delay/256899 "2021-01-15T15:00:49Z")
I have 2 kibana spaces. One is working fine. But in another space data in Discovery and Dashboards showing delay 15 minutes. But data is continuously updating. What will be the issue ? --- ## [Not enough master nodes/failed to retrieve user](https://discuss.elastic.co/t/not-enough-master-nodes-failed-to-retrieve-user/261165)
**Author:** [@pan\_e](https://discuss.elastic.co/u/pan_e)\ **Replies:** 3\ **Last updated:** [January 15, 2021, 2:55pm UTC](https://discuss.elastic.co/t/not-enough-master-nodes-failed-to-retrieve-user/261165 "2021-01-15T14:55:46Z")
I'm using ElasticSearch 6.8 with 3 Nodes. I have set discovery.zen.minimum\_master\_nodes: 2 I'm trying to test what happens when there is only 1 node online. I've shut down 2 nodes and I can see the 3rd node goes into: … --- ## [Create Visualization - Get Data for last month](https://discuss.elastic.co/t/create-visualization-get-data-for-last-month/261111)
**Author:** [@shubham184](https://discuss.elastic.co/u/shubham184)\ **Replies:** 3\ **Last updated:** [January 15, 2021, 2:37pm UTC](https://discuss.elastic.co/t/create-visualization-get-data-for-last-month/261111 "2021-01-15T14:37:49Z")
Dear, The purpose is to create a visualization Lets assume the following table. The Input table contains the user name and user login timestamp. The generated output should be only those users who have NOT logged i… --- ## [Created a rollup job with a space in the ID and now i cannot stop it](https://discuss.elastic.co/t/created-a-rollup-job-with-a-space-in-the-id-and-now-i-cannot-stop-it/261187)
**Author:** [@Andrew22](https://discuss.elastic.co/u/Andrew22)\ **Replies:** 2\ **Last updated:** [January 15, 2021, 2:02pm UTC](https://discuss.elastic.co/t/created-a-rollup-job-with-a-space-in-the-id-and-now-i-cannot-stop-it/261187 "2021-01-15T14:02:07Z")
Hello, fairly new to rollup jobs here and i have created one called "new rollup" to play around with now i want to delete it but i have to stop it first and when i try to stop it i get this error POST \_rollup/job/new r… --- ## [Check-rollover-ready explain](https://discuss.elastic.co/t/check-rollover-ready-explain/261260)
**Author:** [@d4nnyx](https://discuss.elastic.co/u/d4nnyx)\ **Replies:** 2\ **Last updated:** [January 15, 2021, 1:40pm UTC](https://discuss.elastic.co/t/check-rollover-ready-explain/261260 "2021-01-15T13:40:20Z")
Hello guys, I have set up ILM policy on data stream and when I manually perform rollover trough rollover api, it's just a blink of an eye and new index is created. BUT, if I use ILM, there is some step called check-rol… --- ## [Filebeat not sending logs in real time](https://discuss.elastic.co/t/filebeat-not-sending-logs-in-real-time/260305)
**Author:** [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\ **Replies:** 4\ **Last updated:** [January 15, 2021, 1:02pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-logs-in-real-time/260305 "2021-01-15T13:02:20Z")
Hello Team, We have upgraded our ELK stack from 6.4 to 6.8 but we are using beats 6.4. Before upgradation all the logs were reaching on kiabna in real time. But we upgraded our ELK from 6.4 to 6.8 and now filebeat is n… --- ## [Java RestHighLevelClient: Offset stripped from query for Datehistogram in Composite aggregation](https://discuss.elastic.co/t/java-resthighlevelclient-offset-stripped-from-query-for-datehistogram-in-composite-aggregation/261259)
**Author:** [@jselberg](https://discuss.elastic.co/u/jselberg)\ **Replies:** 0\ **Last updated:** [January 15, 2021, 12:51pm UTC](https://discuss.elastic.co/t/java-resthighlevelclient-offset-stripped-from-query-for-datehistogram-in-composite-aggregation/261259 "2021-01-15T12:51:25Z")
Hi, We're trying to aggregate some data on a weekly basis, but we would like to adjust the calculation of weeks so that the weeks starts on Sundays instead. We've tried using the offset() operation from the DateHistogr… --- ## [How to create a watcher script to match one field with other field in same document](https://discuss.elastic.co/t/how-to-create-a-watcher-script-to-match-one-field-with-other-field-in-same-document/260424)
**Author:** [@sangatamilan](https://discuss.elastic.co/u/sangatamilan)\ **Replies:** 0\ **Last updated:** [January 7, 2021, 9:13am UTC](https://discuss.elastic.co/t/how-to-create-a-watcher-script-to-match-one-field-with-other-field-in-same-document/260424 "2021-01-07T09:13:48Z")
Hi , Can anyone please help me on this scenario to create an alert I am having a log events like the following \<#\> 20200806 17:04:23.261 280018000 EV.WRN \[ MVINB-LSL2.T1G1\_WEBSVR1 main.main TSP1.T1G1\_WEB… --- ## [Java Rest API does not allow ForceMergeAction for hot phase in LifeCyclePolicy](https://discuss.elastic.co/t/java-rest-api-does-not-allow-forcemergeaction-for-hot-phase-in-lifecyclepolicy/261258)
**Author:** [@ismarslomic](https://discuss.elastic.co/u/ismarslomic)\ **Replies:** 0\ **Last updated:** [January 15, 2021, 12:41pm UTC](https://discuss.elastic.co/t/java-rest-api-does-not-allow-forcemergeaction-for-hot-phase-in-lifecyclepolicy/261258 "2021-01-15T12:41:55Z")
While Elasticsearch REST API allows defining forcemerge action for hot phase, Java Rest API (v7.10.2) does not. This is allowed: PUT \_ilm/policy/custom-ilm-policy { "policy": { "phases": { "hot": { … --- ## [Getting error while fetching Array field using elasticsearch-sql-cli](https://discuss.elastic.co/t/getting-error-while-fetching-array-field-using-elasticsearch-sql-cli/260943)
**Author:** [@MaheshMali](https://discuss.elastic.co/u/MaheshMali)\ **Replies:** 2\ **Last updated:** [January 15, 2021, 11:42am UTC](https://discuss.elastic.co/t/getting-error-while-fetching-array-field-using-elasticsearch-sql-cli/260943 "2021-01-15T11:42:18Z")
Hi Team, I am using elasticsearch-sql-cli to fetch host.ip field value from an index called "filebeattest". The value of host.ip is shown as "10.1.10.24, 2603:301b:1080:e000:250:56ff:fe87:4, fe80::250:56ff:fe87:4" in K… --- ## [There are no external requests known to support wildcards that don't support replacing their indices](https://discuss.elastic.co/t/there-are-no-external-requests-known-to-support-wildcards-that-dont-support-replacing-their-indices/261207)
**Author:** [@tianhao](https://discuss.elastic.co/u/tianhao)\ **Replies:** 3\ **Last updated:** [January 15, 2021, 11:31am UTC](https://discuss.elastic.co/t/there-are-no-external-requests-known-to-support-wildcards-that-dont-support-replacing-their-indices/261207 "2021-01-15T11:31:10Z")
Hello, I perform the following operations, and prompt There are no external requests known to support wildcards that don't support replacing their indices elasticsearch version: 7.8.1 POST /\*:.monitoring-es-7-\*,.monit… --- ## [Elastic-agent (manual mode) + beats specific configurations](https://discuss.elastic.co/t/elastic-agent-manual-mode-beats-specific-configurations/261253)
**Author:** [@mscc](https://discuss.elastic.co/u/mscc)\ **Replies:** 0\ **Last updated:** [January 15, 2021, 11:12am UTC](https://discuss.elastic.co/t/elastic-agent-manual-mode-beats-specific-configurations/261253 "2021-01-15T11:12:32Z")
I'm using elastic-agent (dockerized) in manual mode. Earlier I used the same setup, just a dockerized filebeat instead of dockerized elastic-agent. To avoid shipping duplicate logs after container restart, we persistet … --- ## [Filter for entry which begins wich specific term](https://discuss.elastic.co/t/filter-for-entry-which-begins-wich-specific-term/261247)
**Author:** [@grra](https://discuss.elastic.co/u/grra)\ **Replies:** 3\ **Last updated:** [January 15, 2021, 11:07am UTC](https://discuss.elastic.co/t/filter-for-entry-which-begins-wich-specific-term/261247 "2021-01-15T11:07:09Z")
Hi, I have a field case. The entries of that field are for example "test/dev/bla1", "test/smth/bla", "dev/smth/..." . Is it possible in Explore Tab to query for the entries which begin with "test/..." or "dev/..." ? I… --- ## [Kibana 8.0.0 can't render visualization for Percentile query results](https://discuss.elastic.co/t/kibana-8-0-0-cant-render-visualization-for-percentile-query-results/261212)
**Author:** [@Kuo\_Hugo](https://discuss.elastic.co/u/Kuo_Hugo)\ **Replies:** 2\ **Last updated:** [January 15, 2021, 11:02am UTC](https://discuss.elastic.co/t/kibana-8-0-0-cant-render-visualization-for-percentile-query-results/261212 "2021-01-15T11:02:44Z")
The search works and the results are visible from the inspect window. But the visualization complains no data as the screenshot. --- ## [Taking a snapshot](https://discuss.elastic.co/t/taking-a-snapshot/261237)
**Author:** [@Jambo80](https://discuss.elastic.co/u/Jambo80)\ **Replies:** 1\ **Last updated:** [January 15, 2021, 10:39am UTC](https://discuss.elastic.co/t/taking-a-snapshot/261237 "2021-01-15T10:39:52Z")
Hi I'm trying to take a snapshot of my 7 node 6.8.13 cluster. Is it the case that I must have some sort of network share such as NFS to achieve this, or is there a method which does not require a network share? Thanks --- ## [Aggregate 7 fields and get the sum of another field](https://discuss.elastic.co/t/aggregate-7-fields-and-get-the-sum-of-another-field/261211)
**Author:** [@vands](https://discuss.elastic.co/u/vands)\ **Replies:** 4\ **Last updated:** [January 15, 2021, 10:14am UTC](https://discuss.elastic.co/t/aggregate-7-fields-and-get-the-sum-of-another-field/261211 "2021-01-15T10:14:25Z")
Hi All, I have a scenario , where I would need to aggregate 7 fields and get the sum of other field with each unique set . Any suggestions which would solve my issue. --- ## [Time filter not getting persisted across dashboard navigation](https://discuss.elastic.co/t/time-filter-not-getting-persisted-across-dashboard-navigation/261220)
**Author:** [@Bhavya\_Bansal](https://discuss.elastic.co/u/Bhavya_Bansal)\ **Replies:** 7\ **Last updated:** [January 15, 2021, 9:49am UTC](https://discuss.elastic.co/t/time-filter-not-getting-persisted-across-dashboard-navigation/261220 "2021-01-15T09:49:01Z")
Hi, I am using markdown viz in Kibana to link my dashboards. I would expect that the time range selected in the first dashboard will get passed down to the next one. But this isn't happening. Everytime I click on a link… --- ## [ILM is not working as per parameter](https://discuss.elastic.co/t/ilm-is-not-working-as-per-parameter/261077)
**Author:** [@shoaib\_akram](https://discuss.elastic.co/u/shoaib_akram)\ **Replies:** 4\ **Last updated:** [January 15, 2021, 9:22am UTC](https://discuss.elastic.co/t/ilm-is-not-working-as-per-parameter/261077 "2021-01-15T09:22:08Z")
HI, here is my policy and template and attached conf file, 4100+ documents ingested successfully but it is not rolled over on 1000 doc check please help me out why it is not rolling over Here is my conf content input { … --- ## [Date histogram does not work properly with unique count value](https://discuss.elastic.co/t/date-histogram-does-not-work-properly-with-unique-count-value/261223)
**Author:** [@Abdul\_Rahman](https://discuss.elastic.co/u/Abdul_Rahman)\ **Replies:** 4\ **Last updated:** [January 15, 2021, 8:29am UTC](https://discuss.elastic.co/t/date-histogram-does-not-work-properly-with-unique-count-value/261223 "2021-01-15T08:29:28Z")
Hello, I am using ELK 7.3 bar chart in kibana and did create unique count chart of value with date histogram but the when I use interval of monthly basis it skips one record in few months , Any idea guys how to resolv… --- ## [Unable to Upload File](https://discuss.elastic.co/t/unable-to-upload-file/261162)
**Author:** [@xenon-xenon](https://discuss.elastic.co/u/xenon-xenon)\ **Replies:** 4\ **Last updated:** [January 15, 2021, 8:16am UTC](https://discuss.elastic.co/t/unable-to-upload-file/261162 "2021-01-15T08:16:03Z")
I run kibana 7.10.1 on windows and have ES 7.10.1 on my linux machine , I configured ES IP on kibana.yml to connect and when i run the kibana there are some errors but I can open kibana on my browser and see sample data … --- ## [Logstash exporter installed for multiple services](https://discuss.elastic.co/t/logstash-exporter-installed-for-multiple-services/261219)
**Author:** [@Robin\_Antony](https://discuss.elastic.co/u/Robin_Antony)\ **Replies:** 0\ **Last updated:** [January 15, 2021, 7:44am UTC](https://discuss.elastic.co/t/logstash-exporter-installed-for-multiple-services/261219 "2021-01-15T07:44:40Z")
I have logstash exporter used for multiple service pipelines. Some pipelines are working and some suddenly stopped giving below error which: no java in (/sbin:/bin:/usr/sbin:/usr/bin) could not find java; set JAVA\_HOME… --- ## [Need help ELK Gurus?](https://discuss.elastic.co/t/need-help-elk-gurus/260716)
**Author:** [@Ganesh\_Sharma](https://discuss.elastic.co/u/Ganesh_Sharma)\ **Replies:** 3\ **Last updated:** [January 15, 2021, 7:41am UTC](https://discuss.elastic.co/t/need-help-elk-gurus/260716 "2021-01-15T07:41:19Z")
How do we design the size of elastic database? Is there a way to control the data being stored by elastic database? How to see the types of logs (stdout, stderr) being stored in elastic database? How to control the lo… --- ## [While taking snapshot of elastic index it takes data of which shards like primary or replica?](https://discuss.elastic.co/t/while-taking-snapshot-of-elastic-index-it-takes-data-of-which-shards-like-primary-or-replica/260953)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 7\ **Last updated:** [January 15, 2021, 7:18am UTC](https://discuss.elastic.co/t/while-taking-snapshot-of-elastic-index-it-takes-data-of-which-shards-like-primary-or-replica/260953 "2021-01-15T07:18:19Z")
Hi, I have a setup of ELK 7.10.0v. I am taking backup of elasticsearch index using snapshot API. I have a doubt while taking backup with sanpshot which shards backup does it takes like primary or replica or it takes ba… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1600) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1602)