# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1640 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1641 --- ## [String field in Discover is not sortable, and .keyword field and alias field are both empty](https://discuss.elastic.co/t/string-field-in-discover-is-not-sortable-and-keyword-field-and-alias-field-are-both-empty/258892)
**Author:** [@qub123](https://discuss.elastic.co/u/qub123)\ **Replies:** 3\ **Last updated:** [December 16, 2020, 7:31pm UTC](https://discuss.elastic.co/t/string-field-in-discover-is-not-sortable-and-keyword-field-and-alias-field-are-both-empty/258892 "2020-12-16T19:31:58Z")
We noticed that only keyword and date field are sort-able in "Discover" , not string and numeric field. I found a post that mentioned we need to use .keyword field in order to make it sortable, to enable it, we need to d… --- ## [Dynamic\_templates are not working as expected](https://discuss.elastic.co/t/dynamic-templates-are-not-working-as-expected/258193)
**Author:** [@Liat](https://discuss.elastic.co/u/Liat)\ **Replies:** 2\ **Last updated:** [December 16, 2020, 6:54pm UTC](https://discuss.elastic.co/t/dynamic-templates-are-not-working-as-expected/258193 "2020-12-16T18:54:01Z")
I am trying ot have dynamic mapping for these objects: { participant\_1{ "role" : "role1" }, participant\_2{ "role" : "role2" }. participant\_3{ "role" : "role3" } } My mapping looks like that: "mappings": { … --- ## [Elastic Cluster restart with one master node](https://discuss.elastic.co/t/elastic-cluster-restart-with-one-master-node/258278)
**Author:** [@hiruni.insyncit.net](https://discuss.elastic.co/u/hiruni.insyncit.net)\ **Replies:** 9\ **Last updated:** [December 16, 2020, 6:47pm UTC](https://discuss.elastic.co/t/elastic-cluster-restart-with-one-master-node/258278 "2020-12-16T18:47:46Z")
I have 6 nodes elastic cluster. node1 - master node2 - master node3 - data node4 - data node5 - data node6 - master, data node1,2,3,4 and node5 are primary nodes node6 is DR node I want to all primary nodes and … --- ## [Date/Timestamp showing wrong in Discover](https://discuss.elastic.co/t/date-timestamp-showing-wrong-in-discover/258897)
**Author:** [@fastxl](https://discuss.elastic.co/u/fastxl)\ **Replies:** 1\ **Last updated:** [December 16, 2020, 6:05pm UTC](https://discuss.elastic.co/t/date-timestamp-showing-wrong-in-discover/258897 "2020-12-16T18:05:26Z")
New to Elasticsearch and trying to learn how things work. When I input the following in Dev Tools PUT /ptest-1/\_doc/1 { "timestamp": "2020-12-16T10:53:01.358062", "computer\_name": "HP-8740W", "UserName": "Eric", "Active… --- ## [Metricbeat Process information](https://discuss.elastic.co/t/metricbeat-process-information/258778)
**Author:** [@jchaves506](https://discuss.elastic.co/u/jchaves506)\ **Replies:** 5\ **Last updated:** [December 16, 2020, 5:52pm UTC](https://discuss.elastic.co/t/metricbeat-process-information/258778 "2020-12-16T17:52:58Z")
is there a way to get the version of the processes that metricbeat gathers with the system's module? or do I need to use a different module?, I'm trying to get all the information about the executable file running at an … --- ## [Three-node Elasticsearch Cluster with docker-compose failing with stacktrace--\["org.elasticsearch.bootstrap.StartupException: ElasticsearchException\[failed to bind service\]; nested: AccessDeniedException\[/usr/share/elasticsearch/data/nodes](https://discuss.elastic.co/t/three-node-elasticsearch-cluster-with-docker-compose-failing-with-stacktrace-org-elasticsearch-bootstrap-startupexception-elasticsearchexception-failed-to-bind-service-nested-accessdeniedexception-usr-share-elasticsearch-data-nodes/258619)
**Author:** [@kommineni24](https://discuss.elastic.co/u/kommineni24)\ **Replies:** 6\ **Last updated:** [December 16, 2020, 5:34pm UTC](https://discuss.elastic.co/t/three-node-elasticsearch-cluster-with-docker-compose-failing-with-stacktrace-org-elasticsearch-bootstrap-startupexception-elasticsearchexception-failed-to-bind-service-nested-accessdeniedexception-usr-share-elasticsearch-data-nodes/258619 "2020-12-16T17:34:35Z")
Hi, I am trying to spin up a three node Elasticsearch cluster with a docker-compose file. While spinning up the cluster only one Elasticsearch container is coming up whereas other two containers on different nodes are f… --- ## [Longer search queue when we have low search thread utilization](https://discuss.elastic.co/t/longer-search-queue-when-we-have-low-search-thread-utilization/258857)
**Author:** [@amishar](https://discuss.elastic.co/u/amishar)\ **Replies:** 2\ **Last updated:** [December 16, 2020, 5:22pm UTC](https://discuss.elastic.co/t/longer-search-queue-when-we-have-low-search-thread-utilization/258857 "2020-12-16T17:22:03Z")
We are seeing slow query performance on elastic-search. This coincide with increase in search queue size but at the same time active search threads as a percentage of search thread pool size is pretty low. This indicate … --- ## [Logstash is periodically hanging (unresponsive) and not sending anything to ES. How to recognize and fix?](https://discuss.elastic.co/t/logstash-is-periodically-hanging-unresponsive-and-not-sending-anything-to-es-how-to-recognize-and-fix/258896)
**Author:** [@user2416](https://discuss.elastic.co/u/user2416)\ **Replies:** 0\ **Last updated:** [December 16, 2020, 5:10pm UTC](https://discuss.elastic.co/t/logstash-is-periodically-hanging-unresponsive-and-not-sending-anything-to-es-how-to-recognize-and-fix/258896 "2020-12-16T17:10:06Z")
We are running logstash on Kubernetes. And some logstash Pods stops inserting data into ES for some unknown reason periodically (once in 2-7 days) And logstash does not indicate there's something wrong with it. I mean t… --- ## [Canvas workpads white screen](https://discuss.elastic.co/t/canvas-workpads-white-screen/258880)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 5\ **Last updated:** [December 16, 2020, 5:07pm UTC](https://discuss.elastic.co/t/canvas-workpads-white-screen/258880 "2020-12-16T17:07:15Z")
Hi, I have not used the canvas workpads for some time but trying to open them now the workpad opens briefly then disappears, no errors. I am on 7.10.1 I migrated them from on prem to the cloud, believe we were on 7.9 w… --- ## [Not able to connect to DB2 using JDBC\_Static Pluginwith securityMechanism=13](https://discuss.elastic.co/t/not-able-to-connect-to-db2-using-jdbc-static-pluginwith-securitymechanism-13/258807)
**Author:** [@tgkumarmca](https://discuss.elastic.co/u/tgkumarmca)\ **Replies:** 1\ **Last updated:** [December 16, 2020, 4:27pm UTC](https://discuss.elastic.co/t/not-able-to-connect-to-db2-using-jdbc-static-pluginwith-securitymechanism-13/258807 "2020-12-16T16:27:11Z")
Hi All, I'm trying to connect to the DB2 database where the security mechanism was configured as 13 using the JDBC\_Static plugin. I have tried passing the JDBC Connection as following ways. However, I don't have any luc… --- ## [Positive lookahead not working](https://discuss.elastic.co/t/positive-lookahead-not-working/258752)
**Author:** [@Muhammad\_Faisal](https://discuss.elastic.co/u/Muhammad_Faisal)\ **Replies:** 3\ **Last updated:** [December 16, 2020, 4:10pm UTC](https://discuss.elastic.co/t/positive-lookahead-not-working/258752 "2020-12-16T16:10:15Z")
hi guys, i want to return or get output 40:123 , whereas input is 40$:123 ---- want to use lookahead , but it always return in output if i use below...any idea, need to used lookahead $ is must in named capture. inpu… --- ## [Runing 2 different logstash config at the same time](https://discuss.elastic.co/t/runing-2-different-logstash-config-at-the-same-time/258889)
**Author:** [@Arezki76](https://discuss.elastic.co/u/Arezki76)\ **Replies:** 0\ **Last updated:** [December 16, 2020, 3:50pm UTC](https://discuss.elastic.co/t/runing-2-different-logstash-config-at-the-same-time/258889 "2020-12-16T15:50:26Z")
Hi, I have 2 different config files, one to track logs files, and another to interact with DB to build a dashboard. I want to start logstash for these 2 config files, to generates 2 differents indices. Can someone tel… --- ## [Split visualizations on Dynamic properties](https://discuss.elastic.co/t/split-visualizations-on-dynamic-properties/258812)
**Author:** [@Mohammed\_Farhan\_Ejaz](https://discuss.elastic.co/u/Mohammed_Farhan_Ejaz)\ **Replies:** 1\ **Last updated:** [December 16, 2020, 3:50pm UTC](https://discuss.elastic.co/t/split-visualizations-on-dynamic-properties/258812 "2020-12-16T15:50:21Z")
How can we split a visualization example, a vertical bar graph based on the properties of the document? I have multiple documents each with some dynamic properties example Document 1 { ... "requ… --- ## [Elasticsearch.service problem](https://discuss.elastic.co/t/elasticsearch-service-problem/258831)
**Author:** [@salva12](https://discuss.elastic.co/u/salva12)\ **Replies:** 3\ **Last updated:** [December 16, 2020, 3:44pm UTC](https://discuss.elastic.co/t/elasticsearch-service-problem/258831 "2020-12-16T15:44:43Z")
Dec 16 08:49:58 104-45-22-197.cprapid.com systemd-entrypoint\[18969\]: at org.elasticsearch.core.internal.io.IOUtils.close(IOUtils.java:99) Dec 16 08:49:58 104-45-22-197.cprapid.com systemd-entrypoint\[18969\]: at org.elasti… --- ## [Aggregation over a paginated query](https://discuss.elastic.co/t/aggregation-over-a-paginated-query/258792)
**Author:** [@solenom85](https://discuss.elastic.co/u/solenom85)\ **Replies:** 2\ **Last updated:** [December 16, 2020, 3:41pm UTC](https://discuss.elastic.co/t/aggregation-over-a-paginated-query/258792 "2020-12-16T15:41:47Z")
Hi. I have a question regarding to running an aggregation on a paginated query. For example, this query: { "size": 0, "from": 100, "query": { "match\_all": {} }, … --- ## [Index lifecycle error, security\_exception: Adding an alias is not allowed when the alias has more permissions than any of the indices](https://discuss.elastic.co/t/index-lifecycle-error-security-exception-adding-an-alias-is-not-allowed-when-the-alias-has-more-permissions-than-any-of-the-indices/258275)
**Author:** [@SergiiZagrunnyi](https://discuss.elastic.co/u/SergiiZagrunnyi)\ **Replies:** 1\ **Last updated:** [December 16, 2020, 3:22pm UTC](https://discuss.elastic.co/t/index-lifecycle-error-security-exception-adding-an-alias-is-not-allowed-when-the-alias-has-more-permissions-than-any-of-the-indices/258275 "2020-12-16T15:22:00Z")
Hi here We have elastic cloud deployment and configured ILM for the APM indexes The policy fails on shrink action, failed step - aliases Its not clear why that happens and what can we do with that? ILM policy "apm… --- ## [Aggregates on collapse](https://discuss.elastic.co/t/aggregates-on-collapse/258883)
**Author:** [@Philh-gbg](https://discuss.elastic.co/u/Philh-gbg)\ **Replies:** 0\ **Last updated:** [December 16, 2020, 3:17pm UTC](https://discuss.elastic.co/t/aggregates-on-collapse/258883 "2020-12-16T15:17:33Z")
New user looking for help, I know that aggregates don't work on the collapse results but I can't seem to find a way to achieve the same affect directly. We have a relatively simple dataset that contains multiple entries … --- ## [Unable to create url using generated API Key](https://discuss.elastic.co/t/unable-to-create-url-using-generated-api-key/258844)
**Author:** [@Kfir\_Stri](https://discuss.elastic.co/u/Kfir_Stri)\ **Replies:** 3\ **Last updated:** [December 16, 2020, 3:00pm UTC](https://discuss.elastic.co/t/unable-to-create-url-using-generated-api-key/258844 "2020-12-16T15:00:43Z")
Hello :slight\_smile: I'm trying to generate a short url using the REST api, and trying to authenticate using an API key i've generated before, no matter which cluster roles or indices priviliges I specify in the API key… --- ## [Request for new output format on time duration field](https://discuss.elastic.co/t/request-for-new-output-format-on-time-duration-field/258870)
**Author:** [@gaz1](https://discuss.elastic.co/u/gaz1)\ **Replies:** 2\ **Last updated:** [December 16, 2020, 2:44pm UTC](https://discuss.elastic.co/t/request-for-new-output-format-on-time-duration-field/258870 "2020-12-16T14:44:56Z")
Hi there! I'm not sure where to post this so if someone knows a better place for this topic please let me know. I need to do some basic calculation and visualization on Kibana with this number format field (e.g. Avera… --- ## [Watcher Schedule](https://discuss.elastic.co/t/watcher-schedule/258874)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 1\ **Last updated:** [December 16, 2020, 2:36pm UTC](https://discuss.elastic.co/t/watcher-schedule/258874 "2020-12-16T14:36:07Z")
Hi I wrote a watcher with this trigger: "trigger": { "schedule": { "daily": { "at": \[ "06:35" \] } } }, I just want this watcher run at 06:35 everyday morning. But whe… --- ## [Kibana reverse proxy](https://discuss.elastic.co/t/kibana-reverse-proxy/258856)
**Author:** [@vikram\_singh](https://discuss.elastic.co/u/vikram_singh)\ **Replies:** 4\ **Last updated:** [December 16, 2020, 2:26pm UTC](https://discuss.elastic.co/t/kibana-reverse-proxy/258856 "2020-12-16T14:26:30Z")
Hi, I am implementing apache reverse proxy on kibana. I want to make url http:url:5601/app/kibana to http:url/app/kibana. Thanks --- ## [How to parse the mod security log.. plz help](https://discuss.elastic.co/t/how-to-parse-the-mod-security-log-plz-help/258869)
**Author:** [@sujeetjha](https://discuss.elastic.co/u/sujeetjha)\ **Replies:** 0\ **Last updated:** [December 16, 2020, 1:58pm UTC](https://discuss.elastic.co/t/how-to-parse-the-mod-security-log-plz-help/258869 "2020-12-16T13:58:38Z")
hey i want to parse mod\_security log using logstash. when i have checked the logstash it is working fine. logstash.service - logstash Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: en… --- ## [How to search Kibana for abc="def" in message string](https://discuss.elastic.co/t/how-to-search-kibana-for-abc-def-in-message-string/258744)
**Author:** [@dbaddorf](https://discuss.elastic.co/u/dbaddorf)\ **Replies:** 2\ **Last updated:** [December 16, 2020, 1:32pm UTC](https://discuss.elastic.co/t/how-to-search-kibana-for-abc-def-in-message-string/258744 "2020-12-16T13:32:58Z")
I'm sure that this is a simple question, but I'm certainly a newbie. I can't seem to get the right syntax. I have syslog data in Elastic Search which looks like the following: message: \<190\>date=2020-12-15 time=12:17… --- ## [ELK 791 Docker compose and security](https://discuss.elastic.co/t/elk-791-docker-compose-and-security/258821)
**Author:** [@vincent2mots](https://discuss.elastic.co/u/vincent2mots)\ **Replies:** 1\ **Last updated:** [December 16, 2020, 12:57pm UTC](https://discuss.elastic.co/t/elk-791-docker-compose-and-security/258821 "2020-12-16T12:57:37Z")
Hi there! I would like to test the security functionnalities within a docker-compose stack. Here is my stack : version: '2' services: # Noeud nodeB1 nodeToutSeul: image: docker.elastic.co/elasticsearch/elastics… --- ## [ServiceNow Ticket data to ElasticSearch](https://discuss.elastic.co/t/servicenow-ticket-data-to-elasticsearch/258817)
**Author:** [@nottyheadedboss](https://discuss.elastic.co/u/nottyheadedboss)\ **Replies:** 4\ **Last updated:** [December 16, 2020, 10:59am UTC](https://discuss.elastic.co/t/servicenow-ticket-data-to-elasticsearch/258817 "2020-12-16T10:59:15Z")
Hi All I am a ElasticSearch noob... I am trying to upload data from ServiceNow to ElasticSearch... I am facing some issues with the data and the conf file I tried to take assistance from @Gauti who assisted me with the… --- ## [Matching a Dollar Sign with a Wildcard using KQL](https://discuss.elastic.co/t/matching-a-dollar-sign-with-a-wildcard-using-kql/258819)
**Author:** [@hpicass0](https://discuss.elastic.co/u/hpicass0)\ **Replies:** 1\ **Last updated:** [December 16, 2020, 12:43pm UTC](https://discuss.elastic.co/t/matching-a-dollar-sign-with-a-wildcard-using-kql/258819 "2020-12-16T12:43:18Z")
Hi, Hoping you guys are safe and well I'm trying to exclude any username that has $ at the end of it using Kibnana Query Language I've done a lot of testing with the following, but it doesn't seem to work and not us… --- ## [Source.keyboard in Kibana](https://discuss.elastic.co/t/source-keyboard-in-kibana/258850)
**Author:** [@DeerOnKeyboard](https://discuss.elastic.co/u/DeerOnKeyboard)\ **Replies:** 1\ **Last updated:** [December 16, 2020, 12:35pm UTC](https://discuss.elastic.co/t/source-keyboard-in-kibana/258850 "2020-12-16T12:35:00Z")
Hello everyone! Is the first time I use Kibana so I'm a bit lost. I'm trying to complete an assignment for university. I have to specify which sources are the tweets coming from. In logstash I configurated full\_tweet an… --- ## [Machine learning "actual" value doesn't match values displayed in a vizualization](https://discuss.elastic.co/t/machine-learning-actual-value-doesnt-match-values-displayed-in-a-vizualization/258658)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 7\ **Last updated:** [December 16, 2020, 12:27pm UTC](https://discuss.elastic.co/t/machine-learning-actual-value-doesnt-match-values-displayed-in-a-vizualization/258658 "2020-12-16T12:27:09Z")
In amonaly detection I get an actual value of "75.0" when I go to a visualization of the raw data I cant find that actual value, I was thinking that maybe the agregation was blurring the value, but I choose a smaller int… --- ## [Unable to convert string/text fields to integer](https://discuss.elastic.co/t/unable-to-convert-string-text-fields-to-integer/258788)
**Author:** [@Mauro\_Tridici](https://discuss.elastic.co/u/Mauro_Tridici)\ **Replies:** 0\ **Last updated:** [December 15, 2020, 10:25pm UTC](https://discuss.elastic.co/t/unable-to-convert-string-text-fields-to-integer/258788 "2020-12-15T22:25:17Z")
Dear All, two days ago I started using "Logstash exec plugin" to launch a bash script and save provided information in elasticsearch. At this moment, it seems working as expected, but I'm not able to convert "quota" an… --- ## [Is possible to get zabbix data to kibana dashboard](https://discuss.elastic.co/t/is-possible-to-get-zabbix-data-to-kibana-dashboard/258799)
**Author:** [@psganeshk](https://discuss.elastic.co/u/psganeshk)\ **Replies:** 3\ **Last updated:** [December 16, 2020, 12:05pm UTC](https://discuss.elastic.co/t/is-possible-to-get-zabbix-data-to-kibana-dashboard/258799 "2020-12-16T12:05:36Z")
Can you advise is possible to send data from zabbix agent to kibana dashboard [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1639) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1641)