# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1621 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1622 --- ## [Time Filter in Kibana](https://discuss.elastic.co/t/time-filter-in-kibana/260050)
**Author:** [@Amrita\_Mahule](https://discuss.elastic.co/u/Amrita_Mahule)\ **Replies:** 4\ **Last updated:** [January 4, 2021, 9:11am UTC](https://discuss.elastic.co/t/time-filter-in-kibana/260050 "2021-01-04T09:11:58Z")
Hi Team, We have a requirement where we want to customize the time filter on Kibana. We want that a user can only view data of last 2 days and not older than that. Is there any way to achieve that without deleting the … --- ## [Grokk Patterning output to respective indexes based on \[agent.type\] (or any conditionals) not working](https://discuss.elastic.co/t/grokk-patterning-output-to-respective-indexes-based-on-agent-type-or-any-conditionals-not-working/259602)
**Author:** [@Rohan-boogeyman](https://discuss.elastic.co/u/Rohan-boogeyman)\ **Replies:** 1\ **Last updated:** [January 4, 2021, 8:40am UTC](https://discuss.elastic.co/t/grokk-patterning-output-to-respective-indexes-based-on-agent-type-or-any-conditionals-not-working/259602 "2021-01-04T08:40:32Z")
Hello, Sorry but i've got a question as I have searched alot for an answer but could not find anything. My winlogbeat and filebeat are all sent to logstash on 5044. I want logstash to filter using Grokk and output them… --- ## [Group by function is not working in sql query in kibana\>dev tools](https://discuss.elastic.co/t/group-by-function-is-not-working-in-sql-query-in-kibana-dev-tools/259452)
**Author:** [@anjali28](https://discuss.elastic.co/u/anjali28)\ **Replies:** 8\ **Last updated:** [January 4, 2021, 7:43am UTC](https://discuss.elastic.co/t/group-by-function-is-not-working-in-sql-query-in-kibana-dev-tools/259452 "2021-01-04T07:43:17Z")
I am creating a query in kibana\>dev tools. Some how my SQL query is not working due to group by function in console. The SQL query is working fine in MSSQL management studio. Query: POST /\_sql?format=txt&pretty { … --- ## [What is the release date of Beats 7.11?](https://discuss.elastic.co/t/what-is-the-release-date-of-beats-7-11/260062)
**Author:** [@cy-zheng](https://discuss.elastic.co/u/cy-zheng)\ **Replies:** 1\ **Last updated:** [January 4, 2021, 7:20am UTC](https://discuss.elastic.co/t/what-is-the-release-date-of-beats-7-11/260062 "2021-01-04T07:20:45Z")
I found it has some exciting new features and can’t wait to use it. --- ## [Elasticsearch shows Circuit Breaking Exception](https://discuss.elastic.co/t/elasticsearch-shows-circuit-breaking-exception/259872)
**Author:** [@pavank](https://discuss.elastic.co/u/pavank)\ **Replies:** 5\ **Last updated:** [January 4, 2021, 7:19am UTC](https://discuss.elastic.co/t/elasticsearch-shows-circuit-breaking-exception/259872 "2021-01-04T07:19:28Z")
We have Elasticsearch deployed in a Kubernetes cluster as a 3 node (all 3 are Master and Data). Recently we are facing issue with Elasticsearch Circuit breaking excpetion and only 2 nodes are reporting to the Cluster. A… --- ## [Logstash Filter - Grok pattern not working as expected](https://discuss.elastic.co/t/logstash-filter-grok-pattern-not-working-as-expected/259271)
**Author:** [@pavank](https://discuss.elastic.co/u/pavank)\ **Replies:** 2\ **Last updated:** [January 4, 2021, 7:15am UTC](https://discuss.elastic.co/t/logstash-filter-grok-pattern-not-working-as-expected/259271 "2021-01-04T07:15:11Z")
Hi All, We are trying to apply Grok filter patterns for our application logs. The logs are applied successfully on the grok debugger online as well as Kibana Dev Tool debugger, but is not getting applied properly in the… --- ## [Getting TransportError: TransportError(500, 'exception', 'java.io.OptionalDataException' while posting to AWS managed elastic stack](https://discuss.elastic.co/t/getting-transporterror-transporterror-500-exception-java-io-optionaldataexception-while-posting-to-aws-managed-elastic-stack/257713)
**Author:** [@yackoa](https://discuss.elastic.co/u/yackoa)\ **Replies:** 12\ **Last updated:** [January 4, 2021, 6:41am UTC](https://discuss.elastic.co/t/getting-transporterror-transporterror-500-exception-java-io-optionaldataexception-while-posting-to-aws-managed-elastic-stack/257713 "2021-01-04T06:41:46Z")
I am getting 'occasional' 500 Transport errors on AWS managed ES stack when posting JSONS from our python based lambdas. This was working flawlessly until today's upgrade to ES 7.9. We have tried increasing the cluster … --- ## [Search elements inside nested fields](https://discuss.elastic.co/t/search-elements-inside-nested-fields/260056)
**Author:** [@Asheesh\_Bhuria](https://discuss.elastic.co/u/Asheesh_Bhuria)\ **Replies:** 0\ **Last updated:** [January 4, 2021, 6:28am UTC](https://discuss.elastic.co/t/search-elements-inside-nested-fields/260056 "2021-01-04T06:28:16Z")
Hi, I have field which stores an array of objects. Each object contains a key on the basis of which we need to perform search operation and get the list of the matched terms only. We have achieved this using a combinati… --- ## [Unable to connect via token through the API](https://discuss.elastic.co/t/unable-to-connect-via-token-through-the-api/259597)
**Author:** [@JSmithOner](https://discuss.elastic.co/u/JSmithOner)\ **Replies:** 1\ **Last updated:** [January 4, 2021, 5:56am UTC](https://discuss.elastic.co/t/unable-to-connect-via-token-through-the-api/259597 "2021-01-04T05:56:41Z")
Hello Elasticsearch community, I'm using google cloud functions as backend and using a simple angular HttpClient to connect via the API to my google cloud elasticsearch endpoint. At first when I tried to connect I got … --- ## [Auditbeat-\* No results match your search criteria](https://discuss.elastic.co/t/auditbeat-no-results-match-your-search-criteria/259980)
**Author:** [@Vigilox](https://discuss.elastic.co/u/Vigilox)\ **Replies:** 3\ **Last updated:** [January 4, 2021, 2:37am UTC](https://discuss.elastic.co/t/auditbeat-no-results-match-your-search-criteria/259980 "2021-01-04T02:37:29Z")
Fresh ElasticStack 7.10 deployment on Azure. Elastic Agents have been deployed. The indices for packetbeat-\* and auditbeat-\* are not found. Date range expanded to a YEAR. Here are the installed Integrations. N… --- ## [How to speed up the segment merging](https://discuss.elastic.co/t/how-to-speed-up-the-segment-merging/260044)
**Author:** [@chemboking](https://discuss.elastic.co/u/chemboking)\ **Replies:** 0\ **Last updated:** [January 4, 2021, 1:44am UTC](https://discuss.elastic.co/t/how-to-speed-up-the-segment-merging/260044 "2021-01-04T01:44:57Z")
I don't understand why merging a 8GB(total) shard into one 3GB segment shard should take about 6 minutes, while all the indicators(io/cpu/memory/gc) of the machine(ssd/32 cores/30GB jvm/64GB total/swap disabled) are very… --- ## [Can't parse Unix timestamp with logstash. Getting \_dateparsefailure](https://discuss.elastic.co/t/cant-parse-unix-timestamp-with-logstash-getting-dateparsefailure/259718)
**Author:** [@Webtrend\_Inc](https://discuss.elastic.co/u/Webtrend_Inc)\ **Replies:** 4\ **Last updated:** [January 4, 2021, 2:05am UTC](https://discuss.elastic.co/t/cant-parse-unix-timestamp-with-logstash-getting-dateparsefailure/259718 "2021-01-04T02:05:09Z")
Hi, Our log files are in json format. Here is a small snippet of the file { "timestamp": 1608191939682, "formatVersion": 1, "webaclId": "69c2a78d-d849-4dca-bccd-xxx", "terminatingRuleId": "Default\_Action", "te… --- ## [Parsing json array with logstash](https://discuss.elastic.co/t/parsing-json-array-with-logstash/259852)
**Author:** [@Webtrend\_Inc](https://discuss.elastic.co/u/Webtrend_Inc)\ **Replies:** 3\ **Last updated:** [January 4, 2021, 2:04am UTC](https://discuss.elastic.co/t/parsing-json-array-with-logstash/259852 "2021-01-04T02:04:01Z")
Our logs have http headers as a json array as shown below "httpRequest": { "httpVersion": "HTTP/1.1", "args": "", "country": "US", "requestId": "1-5fec0c53-78cbd10c4248df7666a62d78", "clien… --- ## [Filebeat harvester started but not sending logs to logstash / kibana](https://discuss.elastic.co/t/filebeat-harvester-started-but-not-sending-logs-to-logstash-kibana/260030)
**Author:** [@Eden\_Corbin](https://discuss.elastic.co/u/Eden_Corbin)\ **Replies:** 7\ **Last updated:** [January 4, 2021, 12:04am UTC](https://discuss.elastic.co/t/filebeat-harvester-started-but-not-sending-logs-to-logstash-kibana/260030 "2021-01-04T00:04:13Z")
I'm certainly missing something in my configuration. I'm running a full docker setup, and can access Kibana and view indexes, including some logs I manually sent to logstash, I'm working on adding filebeat, docker logs s… --- ## [Enable auto login on kibana graph](https://discuss.elastic.co/t/enable-auto-login-on-kibana-graph/259986)
**Author:** [@Ritika\_Joshi](https://discuss.elastic.co/u/Ritika_Joshi)\ **Replies:** 1\ **Last updated:** [January 3, 2021, 11:29pm UTC](https://discuss.elastic.co/t/enable-auto-login-on-kibana-graph/259986 "2021-01-03T23:29:23Z")
Hello, I am trying to skip login page of kibana graph which are embedded in my web console through iframe. I Am trying to login through XMLHttpRequest but getting following error Access to XMLHttpRequest at '\*\*\*\*\*\*\*' … --- ## [Saved search columns reset when filtering?](https://discuss.elastic.co/t/saved-search-columns-reset-when-filtering/259902)
**Author:** [@tallavi](https://discuss.elastic.co/u/tallavi)\ **Replies:** 7\ **Last updated:** [January 3, 2021, 8:05pm UTC](https://discuss.elastic.co/t/saved-search-columns-reset-when-filtering/259902 "2021-01-03T20:05:04Z")
Hi, We're on version 7.8.1 of the stack. I noticed an annoyance. I have a dashboard with a saved search at the bottom. I add/remove columns, change the order, etc, and when I filter by a value, the columns reset! It wa… --- ## [Problem with executing path to Logstash.bat](https://discuss.elastic.co/t/problem-with-executing-path-to-logstash-bat/259731)
**Author:** [@keyofstarrysky973](https://discuss.elastic.co/u/keyofstarrysky973)\ **Replies:** 2\ **Last updated:** [January 3, 2021, 7:19pm UTC](https://discuss.elastic.co/t/problem-with-executing-path-to-logstash-bat/259731 "2021-01-03T19:19:33Z")
Hello Everyone, Pls I need some help on this problem I'm having executing Logstash on Windows 10. I have an ELK Stack with both Elasticsearch and Kibana working without any problems. I have a directory, named elk\_stack … --- ## [Issue installing Logstash no such file to load -- bundler](https://discuss.elastic.co/t/issue-installing-logstash-no-such-file-to-load-bundler/260041)
**Author:** [@Grant1999](https://discuss.elastic.co/u/Grant1999)\ **Replies:** 5\ **Last updated:** [January 3, 2021, 6:15pm UTC](https://discuss.elastic.co/t/issue-installing-logstash-no-such-file-to-load-bundler/260041 "2021-01-03T18:15:29Z")
I have downloaded kibana and elastic search on windows 10 64 bit and now trying to install logstash. But I get this error when I type in the command any ideas? C:\\Elasticstack\\logstash-7.10.1\>logstash -f logstash.conf U… --- ## [Aggregation](https://discuss.elastic.co/t/aggregation/260038)
**Author:** [@Uri\_Parush](https://discuss.elastic.co/u/Uri_Parush)\ **Replies:** 1\ **Last updated:** [January 3, 2021, 6:06pm UTC](https://discuss.elastic.co/t/aggregation/260038 "2021-01-03T18:06:18Z")
Hi, I'm trying to understand how to create an aggregation query for tag distribution. Record example: { @timestamp: {iso time} , record\_type: {string}, record\_data: {string}, tags: \[ {key: {string}, value: {string… --- ## [Two series linechart with time offset](https://discuss.elastic.co/t/two-series-linechart-with-time-offset/260035)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 1\ **Last updated:** [January 3, 2021, 4:26pm UTC](https://discuss.elastic.co/t/two-series-linechart-with-time-offset/260035 "2021-01-03T16:26:21Z")
I have 2 data source first one's data is for from: now-1w / to: now second one is from: now-2w / to: now-1 I want to visualize both of them in one line chart. y axis is ratio and it's clear. but how can i define x a… --- ## [Office365 Signin Logs event.outcome seems incorrect sometimes](https://discuss.elastic.co/t/office365-signin-logs-event-outcome-seems-incorrect-sometimes/258832)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [January 3, 2021, 11:22am UTC](https://discuss.elastic.co/t/office365-signin-logs-event-outcome-seems-incorrect-sometimes/258832 "2021-01-03T11:22:59Z")
Hello, (Elastic 7.9.2) We noticed something weird in the Office365 Signin logs. This a screenshot from the Azure Portal itself: As you can see the user had 1 failed login followed by a successful login. In the o365 … --- ## [Apply filter from custom plugin onto dashboard is not working in 7.9.3](https://discuss.elastic.co/t/apply-filter-from-custom-plugin-onto-dashboard-is-not-working-in-7-9-3/257979)
**Author:** [@nrt.krishna](https://discuss.elastic.co/u/nrt.krishna)\ **Replies:** 2\ **Last updated:** [January 3, 2021, 8:10am UTC](https://discuss.elastic.co/t/apply-filter-from-custom-plugin-onto-dashboard-is-not-working-in-7-9-3/257979 "2021-01-03T08:10:27Z")
Hi, I am trying to apply filter from custom plugin on to dashboard. It used to work with belowcode snippet with old version. Now I am migrating my plugin to 7.9.3. As soon as I apply filter using below code the filter i… --- ## [New Community Beat to Apache Pulsar](https://discuss.elastic.co/t/new-community-beat-to-apache-pulsar/259968)
**Author:** [@Pinar\_Zaimoglu](https://discuss.elastic.co/u/Pinar_Zaimoglu)\ **Replies:** 2\ **Last updated:** [January 2, 2021, 9:17pm UTC](https://discuss.elastic.co/t/new-community-beat-to-apache-pulsar/259968 "2021-01-02T21:17:04Z")
Hi everyone! I wanted to share with you that I'm creating a new community beat based on Metricbeat called "pulsar beat". If you have any advice, please let me know. Thank you in advance. --- ## [Problem while using shrink api](https://discuss.elastic.co/t/problem-while-using-shrink-api/260025)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 0\ **Last updated:** [January 2, 2021, 7:47pm UTC](https://discuss.elastic.co/t/problem-while-using-shrink-api/260025 "2021-01-02T19:47:11Z")
I was following this doc for decreasing shards but GET /\_cluster/allocation/explain shows "explanation" : """node does not match index setting \[index.routing.allocation.require\] filters \[\_name:"ed1"\]""" I want to shrin… --- ## [Get last document string value in each bucket](https://discuss.elastic.co/t/get-last-document-string-value-in-each-bucket/260013)
**Author:** [@Metheny](https://discuss.elastic.co/u/Metheny)\ **Replies:** 1\ **Last updated:** [January 2, 2021, 4:43pm UTC](https://discuss.elastic.co/t/get-last-document-string-value-in-each-bucket/260013 "2021-01-02T16:43:27Z")
I have a reports index and I need to count the number of reports per-user that have a specific string (keyword) field value in their last document (sorted by time) in some time range. I tried bucketing by user -\> top (1… --- ## [Wildcard filter on a Windows path](https://discuss.elastic.co/t/wildcard-filter-on-a-windows-path/258035)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [January 2, 2021, 3:48pm UTC](https://discuss.elastic.co/t/wildcard-filter-on-a-windows-path/258035 "2021-01-02T15:48:17Z")
Hello, I'm trying to create a wildcard filter that filters on paths starting with c:\\git\* But: { "query": { "wildcard": { "process.working\_directory": { "value": "c:\\\\git\\\\\*" } } } } i… --- ## [Snapshots: State: Partial failure (?)](https://discuss.elastic.co/t/snapshots-state-partial-failure/260018)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 1\ **Last updated:** [January 2, 2021, 12:59pm UTC](https://discuss.elastic.co/t/snapshots-state-partial-failure/260018 "2021-01-02T12:59:12Z")
Hello, Example of a snapshot error in Elasticsearch: Global cluster state was stored, but at least one shard wasn't stored successfully... Shards: 10 Failed Shards: 2 From what I understand, the system in this cas… --- ## [Kibana API Result format](https://discuss.elastic.co/t/kibana-api-result-format/259989)
**Author:** [@shiv97](https://discuss.elastic.co/u/shiv97)\ **Replies:** 1\ **Last updated:** [January 1, 2021, 11:06pm UTC](https://discuss.elastic.co/t/kibana-api-result-format/259989 "2021-01-01T23:06:35Z")
Hi Everyone, I write one query in the Kibana console that provides me some JSON result I want to know about some insight into the Json result { "took" : 11, "timed\_out" : false, "\_shards" : { "total" : 10, "succes… --- ## [How to test logstash .conf file easily without logstash shutting down everytime?](https://discuss.elastic.co/t/how-to-test-logstash-conf-file-easily-without-logstash-shutting-down-everytime/260004)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 3\ **Last updated:** [January 1, 2021, 10:10pm UTC](https://discuss.elastic.co/t/how-to-test-logstash-conf-file-easily-without-logstash-shutting-down-everytime/260004 "2021-01-01T22:10:29Z")
I'm currently testing the logstash in below manner. /opt/logstash/bin/logstash -f /tmp/simpleInputs.conf This works perfectly, but the issue is, it takes some time to execute it.. just for the starting of java process … --- ## [Delete unsued dynamic mapping Fields](https://discuss.elastic.co/t/delete-unsued-dynamic-mapping-fields/260000)
**Author:** [@hzarrabi](https://discuss.elastic.co/u/hzarrabi)\ **Replies:** 1\ **Last updated:** [January 1, 2021, 9:04pm UTC](https://discuss.elastic.co/t/delete-unsued-dynamic-mapping-fields/260000 "2021-01-01T21:04:49Z")
Hi all, First of all I wish you a Happy New Year. I have some unused fields which were created by dynamic mapping. Is there any way to remove them from Index-mapping ? Best Regards [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1620) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1622)