# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1627 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1628 --- ## [Cookies issue while embedding kibana dashboard with iFrame](https://discuss.elastic.co/t/cookies-issue-while-embedding-kibana-dashboard-with-iframe/256777)
**Author:** [@Gokul6](https://discuss.elastic.co/u/Gokul6)\ **Replies:** 8\ **Last updated:** [December 28, 2020, 6:29am UTC](https://discuss.elastic.co/t/cookies-issue-while-embedding-kibana-dashboard-with-iframe/256777 "2020-12-28T06:29:14Z")
recently i read this in github. Currently, Kibana does not set the SameSite attribute on its session cookie. Up until recently, this was tolerable, but Chrome recently (version 80 ) updated its default configuration to … --- ## [Average bucket in histogram change when time filter change](https://discuss.elastic.co/t/average-bucket-in-histogram-change-when-time-filter-change/258285)
**Author:** [@vbarai](https://discuss.elastic.co/u/vbarai)\ **Replies:** 7\ **Last updated:** [December 28, 2020, 5:15am UTC](https://discuss.elastic.co/t/average-bucket-in-histogram-change-when-time-filter-change/258285 "2020-12-28T05:15:09Z")
Hi All, I am using latest ELK 7.10. I am facing weired issue with the Lens and Average Bucket Histogram. STEP 1 : Created 4 Index for Dec-2020 Days as below idx\_agg\_test\_20201201 idx\_agg\_test\_20201207 idx\_agg\_test\_2… --- ## [How to save only one data into mongodb by logstash-output-mongodb plugin?](https://discuss.elastic.co/t/how-to-save-only-one-data-into-mongodb-by-logstash-output-mongodb-plugin/259702)
**Author:** [@iooi](https://discuss.elastic.co/u/iooi)\ **Replies:** 0\ **Last updated:** [December 28, 2020, 3:58am UTC](https://discuss.elastic.co/t/how-to-save-only-one-data-into-mongodb-by-logstash-output-mongodb-plugin/259702 "2020-12-28T03:58:22Z")
Like this output configuration, just want to send id to mongodb output { mongodb { uri =\> 'mongodb://localhost' database =\> "testDB" collection =\> 'testCollection' codec =\> line { format =\> "%{id}"} … --- ## [Logstash 6.8 template gives 400 HTTP response code](https://discuss.elastic.co/t/logstash-6-8-template-gives-400-http-response-code/259699)
**Author:** [@mlpn](https://discuss.elastic.co/u/mlpn)\ **Replies:** 0\ **Last updated:** [December 27, 2020, 11:04pm UTC](https://discuss.elastic.co/t/logstash-6-8-template-gives-400-http-response-code/259699 "2020-12-27T23:04:36Z")
Hello, I'm in the middle of process of migrating ELK Stack from 5.4 to 7.1. I'm currently on 6.8 and my Logstash gives me HTTP response code 400 after start when I'm trying to import my template. I've renamed string valu… --- ## [Error: Your CLT does not support macOS 11](https://discuss.elastic.co/t/error-your-clt-does-not-support-macos-11/259680)
**Author:** [@yhoiseth](https://discuss.elastic.co/u/yhoiseth)\ **Replies:** 1\ **Last updated:** [December 27, 2020, 10:17pm UTC](https://discuss.elastic.co/t/error-your-clt-does-not-support-macos-11/259680 "2020-12-27T22:17:22Z")
After upgrading to macOS Big Sur 11.1 (20C69), I can’t upgrade Elasticsearch to 7.10.1. For background, I previously installed Elasticsearch using these instructions. I have since upgraded the Elasticsearch version many… --- ## [Can we use datastreams with Filebeat?659+](https://discuss.elastic.co/t/can-we-use-datastreams-with-filebeat-659/259693)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 0\ **Last updated:** [December 27, 2020, 6:26pm UTC](https://discuss.elastic.co/t/can-we-use-datastreams-with-filebeat-659/259693 "2020-12-27T18:26:12Z")
Hello, So "Can we use datastreams with Filebeat?" And more importantly, can we mix multiple inputs, where some use legacy ilm and some use datastreams? This is in a test 7.10.1 setup without Logstash. For example until… --- ## [Parse PostgreSQL CSV log](https://discuss.elastic.co/t/parse-postgresql-csv-log/259688)
**Author:** [@azlev](https://discuss.elastic.co/u/azlev)\ **Replies:** 3\ **Last updated:** [December 27, 2020, 5:52pm UTC](https://discuss.elastic.co/t/parse-postgresql-csv-log/259688 "2020-12-27T17:52:33Z")
Hello. At work we are consuming the PostgreSQL CSV log instead of plain log. This poses some advantages, like a better formatted input file, stable format, and easy to turn it on. To achieve it, we are using the filebe… --- ## [ES - Spark tuning for bulk writes](https://discuss.elastic.co/t/es-spark-tuning-for-bulk-writes/259167)
**Author:** [@Vishnu\_Singhal](https://discuss.elastic.co/u/Vishnu_Singhal)\ **Replies:** 16\ **Last updated:** [December 27, 2020, 3:32pm UTC](https://discuss.elastic.co/t/es-spark-tuning-for-bulk-writes/259167 "2020-12-27T15:32:05Z")
I;m using Spark 3 with ES 7.10 , ECK 1.3 I have following settings |es.batch.size.bytes|6000000| |es.batch.size.entries|10000| |es.batch.write.refresh|false| |es.batch.write.retry.count|6| Would like to know how can … --- ## [True/False Visualization](https://discuss.elastic.co/t/true-false-visualization/259665)
**Author:** [@rdesanno](https://discuss.elastic.co/u/rdesanno)\ **Replies:** 2\ **Last updated:** [December 27, 2020, 3:40pm UTC](https://discuss.elastic.co/t/true-false-visualization/259665 "2020-12-27T15:40:39Z")
Hi all! I'm perplexed on how to do something that should be easy and hoping that someone can point me in the right direction. I'm building a dashboard and want to have a box on it that pulls the last text value and dis… --- ## [Grok an Elasticsearch problem](https://discuss.elastic.co/t/grok-an-elasticsearch-problem/259675)
**Author:** [@mesutalf](https://discuss.elastic.co/u/mesutalf)\ **Replies:** 1\ **Last updated:** [December 27, 2020, 2:14pm UTC](https://discuss.elastic.co/t/grok-an-elasticsearch-problem/259675 "2020-12-27T14:14:19Z")
Hi, I use ELK (7.2.x) my localhost and I have problem. I have log file like this; 2020-11-30 05:52:33,018 \[9344\] INFO Zdk.ServiceProvider.ServiceThread \[\] - Thread \[Core\[8047e7a3-c403-4fe4-ab87-9bea0c0ab449\]:0\]: idle … --- ## [Logstash kafka input plugin not retrieving data](https://discuss.elastic.co/t/logstash-kafka-input-plugin-not-retrieving-data/259686)
**Author:** [@LogstashDeveloper](https://discuss.elastic.co/u/LogstashDeveloper)\ **Replies:** 0\ **Last updated:** [December 27, 2020, 1:39pm UTC](https://discuss.elastic.co/t/logstash-kafka-input-plugin-not-retrieving-data/259686 "2020-12-27T13:39:21Z")
Im using logstash kafka input plugin, but it does not retrieve data from kafka topic. Logstash log shows the following messages: Adding newly assigned partitions Setting offset for partition to the committed offset Fet… --- ## [Search for docs that are parents](https://discuss.elastic.co/t/search-for-docs-that-are-parents/259684)
**Author:** [@Luca\_Frost](https://discuss.elastic.co/u/Luca_Frost)\ **Replies:** 0\ **Last updated:** [December 27, 2020, 1:03pm UTC](https://discuss.elastic.co/t/search-for-docs-that-are-parents/259684 "2020-12-27T13:03:19Z")
Hi There, I'm looking for a way to search for documents where the join field specifies that they are a parent, that way I can still search for parents without children? Here's my very crude attempt which fails... POST… --- ## [Logstash kv field split problem](https://discuss.elastic.co/t/logstash-kv-field-split-problem/259552)
**Author:** [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)\ **Replies:** 7\ **Last updated:** [December 27, 2020, 10:00am UTC](https://discuss.elastic.co/t/logstash-kv-field-split-problem/259552 "2020-12-27T10:00:10Z")
Logs like this: topic = abc, partition = 2, offset = 4386, serialized key size = -1, serialized value size = 1139, key = null, value = {"Name":"pc-1","test":false,"message":"elk test - Your pc-1 better. Thank you.","Cou… --- ## [Time filtered aggregations with very high cardinality](https://discuss.elastic.co/t/time-filtered-aggregations-with-very-high-cardinality/259673)
**Author:** [@Metheny](https://discuss.elastic.co/u/Metheny)\ **Replies:** 0\ **Last updated:** [December 27, 2020, 6:49am UTC](https://discuss.elastic.co/t/time-filtered-aggregations-with-very-high-cardinality/259673 "2020-12-27T06:49:29Z")
We have an index with a large amount of user reports (millions / 10s of millions). Assuming most users have reports, we need to calculate some statistics per-user with an input time range. For example, how many users ha… --- ## [Elasticsearch 7.10.1 new test cluster - cannot bring up - state not recovered](https://discuss.elastic.co/t/elasticsearch-7-10-1-new-test-cluster-cannot-bring-up-state-not-recovered/259520)
**Author:** [@lakshmi-github](https://discuss.elastic.co/u/lakshmi-github)\ **Replies:** 1\ **Last updated:** [December 26, 2020, 11:36pm UTC](https://discuss.elastic.co/t/elasticsearch-7-10-1-new-test-cluster-cannot-bring-up-state-not-recovered/259520 "2020-12-26T23:36:53Z")
Hello, I am trying to bring up a new ES 7.10.1 cluster for testing as follows: node1 - master (node.roles: \[ 'master'\]) node2 - master (node.roles: \[ 'master'\]) node3 - master (node.roles: \[ 'master'\]) node4 - data (n… --- ## [Aggregate filter dilemma](https://discuss.elastic.co/t/aggregate-filter-dilemma/259657)
**Author:** [@tommys](https://discuss.elastic.co/u/tommys)\ **Replies:** 4\ **Last updated:** [December 26, 2020, 10:58pm UTC](https://discuss.elastic.co/t/aggregate-filter-dilemma/259657 "2020-12-26T22:58:43Z")
Hi all, hoping to get some feedback on this as it took me 3 days to resolve which I think is potentially a knowledge gap on my side or a BUG. In summary: Two logs, I want to aggregate using the aggregate filter. One… --- ## [How can i do a Month over Month change in my graph?](https://discuss.elastic.co/t/how-can-i-do-a-month-over-month-change-in-my-graph/259322)
**Author:** [@marcosvrrs](https://discuss.elastic.co/u/marcosvrrs)\ **Replies:** 2\ **Last updated:** [December 26, 2020, 10:03pm UTC](https://discuss.elastic.co/t/how-can-i-do-a-month-over-month-change-in-my-graph/259322 "2020-12-26T22:03:42Z")
I have this graph that is a sum of transactions per month. How can I draw a line with the percentage change each month in this graph? I can't do this in TSVB, and didn't try in Timelion cause I'am bit of a newbie. Thank… --- ## [Return node to cluster](https://discuss.elastic.co/t/return-node-to-cluster/259663)
**Author:** [@KA3AXCTAH](https://discuss.elastic.co/u/KA3AXCTAH)\ **Replies:** 1\ **Last updated:** [December 26, 2020, 7:48pm UTC](https://discuss.elastic.co/t/return-node-to-cluster/259663 "2020-12-26T19:48:22Z")
I have 3 node elasticsearch cluster 192.168.2.11 - node-01 192.168.2.12 - node-02 192.168.2.13 - node-03 and i deleted node-02 from cluster using this command curl -XPUT 192.168.2.12:9200/\_cluster/settings -H 'Content… --- ## [How to specify timezone on elasticsearch?](https://discuss.elastic.co/t/how-to-specify-timezone-on-elasticsearch/259614)
**Author:** [@gabriel.goncalves](https://discuss.elastic.co/u/gabriel.goncalves)\ **Replies:** 6\ **Last updated:** [December 26, 2020, 6:19pm UTC](https://discuss.elastic.co/t/how-to-specify-timezone-on-elasticsearch/259614 "2020-12-26T18:19:38Z")
It says: "Internally, dates are converted to UTC (if the time-zone is specified) and stored as a long number representing milliseconds-since-the-epoch." What are all possible ways to specify the timezone? --- ## [Pipeline with id \[\] does not exist](https://discuss.elastic.co/t/pipeline-with-id-does-not-exist/259476)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 12\ **Last updated:** [December 26, 2020, 12:53pm UTC](https://discuss.elastic.co/t/pipeline-with-id-does-not-exist/259476 "2020-12-26T12:53:05Z")
There are few references to this problem already here but none provide resolution, I am getting the below error on 7.6.2 and i do see the pipeline when i run the GET API call { "index" : "xxxxxxxxxx-2020.45-reind… --- ## [How to search multiple fields and aggregate scores?](https://discuss.elastic.co/t/how-to-search-multiple-fields-and-aggregate-scores/259659)
**Author:** [@Shuri](https://discuss.elastic.co/u/Shuri)\ **Replies:** 0\ **Last updated:** [December 26, 2020, 11:34am UTC](https://discuss.elastic.co/t/how-to-search-multiple-fields-and-aggregate-scores/259659 "2020-12-26T11:34:28Z")
Hi all, I'm trying to figure out a solution to how I should structure my queries for finding answers to people's questions. For example, based off the dataset I will paste at the end of this post, I would like to query "… --- ## [Fail to parse HTTP parameters: parse "response\\"}}\\nPOST /\_bulk": net/url: invalid control character in](https://discuss.elastic.co/t/fail-to-parse-http-parameters-parse-response-npost-bulk-net-url-invalid-control-character-in/259652)
**Author:** [@Alir3z4](https://discuss.elastic.co/u/Alir3z4)\ **Replies:** 0\ **Last updated:** [December 25, 2020, 11:18pm UTC](https://discuss.elastic.co/t/fail-to-parse-http-parameters-parse-response-npost-bulk-net-url-invalid-control-character-in/259652 "2020-12-25T23:18:40Z")
I'm running packetbeat version 7.10.1; Looking at its logs I see 2020-12-25T23:08:29.956Z WARN http/http.go:545 Fail to parse HTTP parameters: parse "response\\"}}\\nPOST /\_bulk": net/url: invalid contro… --- ## [Using aggregation in Elasticsearch to find duplicate data in the same index](https://discuss.elastic.co/t/using-aggregation-in-elasticsearch-to-find-duplicate-data-in-the-same-index/259637)
**Author:** [@Amraneze](https://discuss.elastic.co/u/Amraneze)\ **Replies:** 5\ **Last updated:** [December 25, 2020, 5:41pm UTC](https://discuss.elastic.co/t/using-aggregation-in-elasticsearch-to-find-duplicate-data-in-the-same-index/259637 "2020-12-25T17:41:47Z")
Hi everyone, I'm trying to find duplicates within the same index. I tried to use aggregation like this : { "aggs": { "duplicates": { "terms": { "script": { "source": "if (doc\['username.sort-field'\].size(… --- ## [Can I get only one data in logstash's output?](https://discuss.elastic.co/t/can-i-get-only-one-data-in-logstashs-output/259626)
**Author:** [@iooi](https://discuss.elastic.co/u/iooi)\ **Replies:** 1\ **Last updated:** [December 25, 2020, 4:09pm UTC](https://discuss.elastic.co/t/can-i-get-only-one-data-in-logstashs-output/259626 "2020-12-25T16:09:15Z")
Can I get only one data in logstash's output? If the data after filter like: "a" =\> 1, "b" =\> 2, "c" =\> 3, in the output, send it to elasticsearch. output { elasticsearch { protocol =\> http host =\>… --- ## [Logsource On-boarding](https://discuss.elastic.co/t/logsource-on-boarding/259590)
**Author:** [@ameermane](https://discuss.elastic.co/u/ameermane)\ **Replies:** 2\ **Last updated:** [December 25, 2020, 2:49pm UTC](https://discuss.elastic.co/t/logsource-on-boarding/259590 "2020-12-25T14:49:13Z")
Hello All, Hope you are doing good!!! ELK is new for me. I have deployed ELK in my lab and wondering how to onboard different logs source like paloalto , checkpoint , cisco firewalls. Please share any leadings that wi… --- ## [Journalbeat no connection event](https://discuss.elastic.co/t/journalbeat-no-connection-event/259633)
**Author:** [@Catherine](https://discuss.elastic.co/u/Catherine)\ **Replies:** 0\ **Last updated:** [December 25, 2020, 12:46pm UTC](https://discuss.elastic.co/t/journalbeat-no-connection-event/259633 "2020-12-25T12:46:17Z")
Hello I have a problem with no attempt to connect from journalbeat to logstash, even no errors (nothing at all). How to troubleshoot this problem? 2020-12-25T12:38:28.195Z INFO instance/beat.go:299 Setup … --- ## [How can I use elasticsearch java aip to agg from the Query Builders？](https://discuss.elastic.co/t/how-can-i-use-elasticsearch-java-aip-to-agg-from-the-query-builders/259624)
**Author:** [@Vastzhang](https://discuss.elastic.co/u/Vastzhang)\ **Replies:** 2\ **Last updated:** [December 25, 2020, 10:18am UTC](https://discuss.elastic.co/t/how-can-i-use-elasticsearch-java-aip-to-agg-from-the-query-builders/259624 "2020-12-25T10:18:19Z")
Hi!I use elasticsearch java api like as follw: how can i convert json as follow to java api？ Thanks！！！ --- ## [Can logstash's JDBC input plugin do multiple sql tasks?](https://discuss.elastic.co/t/can-logstashs-jdbc-input-plugin-do-multiple-sql-tasks/259573)
**Author:** [@iooi](https://discuss.elastic.co/u/iooi)\ **Replies:** 6\ **Last updated:** [December 25, 2020, 9:17am UTC](https://discuss.elastic.co/t/can-logstashs-jdbc-input-plugin-do-multiple-sql-tasks/259573 "2020-12-25T09:17:12Z")
Now there is a JDBC task read from db as input { jdbc { jdbc\_connection\_string =\> "jdbc:mysql://${MYSQL\_MAIN\_HOST}/${MYSQL\_DATABASE}" jdbc\_driver\_class =\> "com.mysql.cj.jdbc.Driver" jdbc\_page\_size =\> 10000… --- ## [Elasticsearch query that returns latest document for each group of criteria in the query](https://discuss.elastic.co/t/elasticsearch-query-that-returns-latest-document-for-each-group-of-criteria-in-the-query/259625)
**Author:** [@n0rman](https://discuss.elastic.co/u/n0rman)\ **Replies:** 0\ **Last updated:** [December 25, 2020, 9:07am UTC](https://discuss.elastic.co/t/elasticsearch-query-that-returns-latest-document-for-each-group-of-criteria-in-the-query/259625 "2020-12-25T09:07:30Z")
Newbie here. Trying to figure out how to query to find grandparent processes of child processes by using parent process info in windows logs. I have a list of child processes with host info (hostname) and parent proces… --- ## [Indexer Mongodb dans ES en temps réel](https://discuss.elastic.co/t/indexer-mongodb-dans-es-en-temps-reel/259190)
**Author:** [@Jalil](https://discuss.elastic.co/u/Jalil)\ **Replies:** 23\ **Last updated:** [December 25, 2020, 9:03am UTC](https://discuss.elastic.co/t/indexer-mongodb-dans-es-en-temps-reel/259190 "2020-12-25T09:03:53Z")
Bonjour à tous, Mon besoin est d'indexer en temps réel une base mongodb (plusieurs collections) dans Elasticsearch (en leur appliquant qlq transformation au passage : formatage des geo\_point par exemple). J'ai essayé a… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1626) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1628)