# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1643 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1644 --- ## [Unable to visualise long text field in Kibana](https://discuss.elastic.co/t/unable-to-visualise-long-text-field-in-kibana/258597)
**Author:** [@tarund](https://discuss.elastic.co/u/tarund)\ **Replies:** 3\ **Last updated:** [December 15, 2020, 2:43pm UTC](https://discuss.elastic.co/t/unable-to-visualise-long-text-field-in-kibana/258597 "2020-12-15T14:43:15Z")
Hi , I have an index in Elasticsearch in which one of the text fields(qtext) has values like below - { delete: "UsDetails", ordered: true, txnNumber: 381, $db: "apt", $clusterTime: { clusterTime: Timestamp(1607955967, … --- ## [Kibana functions missing in X-axis configurations of visualization](https://discuss.elastic.co/t/kibana-functions-missing-in-x-axis-configurations-of-visualization/258536)
**Author:** [@zhirong\_tong](https://discuss.elastic.co/u/zhirong_tong)\ **Replies:** 3\ **Last updated:** [December 15, 2020, 2:43pm UTC](https://discuss.elastic.co/t/kibana-functions-missing-in-x-axis-configurations-of-visualization/258536 "2020-12-15T14:43:02Z")
When creating Lens in visualization, I expect to see "Top Values", Interval" and "Filter" three functions in X-axis configuration, however, there are "Top values"," Date Histogram" now, is it because of miss cofigurati… --- ## [Logstash is still using old code](https://discuss.elastic.co/t/logstash-is-still-using-old-code/258494)
**Author:** [@Ferdous\_Khan](https://discuss.elastic.co/u/Ferdous_Khan)\ **Replies:** 5\ **Last updated:** [December 15, 2020, 2:27pm UTC](https://discuss.elastic.co/t/logstash-is-still-using-old-code/258494 "2020-12-15T14:27:05Z")
Hello, I was previously using elapsed filter in my logstash config to calculate time difference of start and end event. Recently I have replaced elapsed filter's code with elasticsearch output filter and painless script… --- ## [Error with filebeat on kubernetes 1.20 using add\_kubernetes\_metadata](https://discuss.elastic.co/t/error-with-filebeat-on-kubernetes-1-20-using-add-kubernetes-metadata/258722)
**Author:** [@yoannma](https://discuss.elastic.co/u/yoannma)\ **Replies:** 0\ **Last updated:** [December 15, 2020, 2:20pm UTC](https://discuss.elastic.co/t/error-with-filebeat-on-kubernetes-1-20-using-add-kubernetes-metadata/258722 "2020-12-15T14:20:39Z")
Hello, I installed filebeat 7.10.1 on a kubernetes cluster 1.20 using the DaemonSet from https://github.com/elastic/beats/blob/master/deploy/kubernetes/filebeat/filebeat-configmap.yaml Using the hints based autodiscov… --- ## [TimeLion, problem in displaying numbers](https://discuss.elastic.co/t/timelion-problem-in-displaying-numbers/258721)
**Author:** [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)\ **Replies:** 0\ **Last updated:** [December 15, 2020, 2:20pm UTC](https://discuss.elastic.co/t/timelion-problem-in-displaying-numbers/258721 "2020-12-15T14:20:21Z")
Hi Team, I have a timelion chart to compare the Latency of today and previous week, when the latency is too less (example 0.00068) values are not shown properly in labels and the expression is as follows : .es(ind… --- ## [Elastic Search service is stopped and disabled in services.msc](https://discuss.elastic.co/t/elastic-search-service-is-stopped-and-disabled-in-services-msc/257672)
**Author:** [@Bhavrendra](https://discuss.elastic.co/u/Bhavrendra)\ **Replies:** 4\ **Last updated:** [December 15, 2020, 2:05pm UTC](https://discuss.elastic.co/t/elastic-search-service-is-stopped-and-disabled-in-services-msc/257672 "2020-12-15T14:05:09Z")
Hi, i have a machine with 1 node, 16gb RAM and 500gb HDD. I'm using filebeats to read data for around 15 applications and each days index is reading and storing around 53gb of logs data per day. Recently when i see that … --- ## [On x Axis show biggest 20 Values, but in Ascending Order](https://discuss.elastic.co/t/on-x-axis-show-biggest-20-values-but-in-ascending-order/258616)
**Author:** [@grra](https://discuss.elastic.co/u/grra)\ **Replies:** 3\ **Last updated:** [December 15, 2020, 1:33pm UTC](https://discuss.elastic.co/t/on-x-axis-show-biggest-20-values-but-in-ascending-order/258616 "2020-12-15T13:33:00Z")
Hi, I want to visualize the RAM usage of some builds. As fields I have: "metrics": { "ram": ram\_value } // on the y - Axis, and "buildnumber": num // on the x - Axis. The maximum y - Value is the … --- ## [Validation Failed: 1: this action would add \[2\] total shards, but this cluster currently has \[2000\]/\[2000\] maximum shards open](https://discuss.elastic.co/t/validation-failed-1-this-action-would-add-2-total-shards-but-this-cluster-currently-has-2000-2000-maximum-shards-open/257064)
**Author:** [@rneema1](https://discuss.elastic.co/u/rneema1)\ **Replies:** 5\ **Last updated:** [December 15, 2020, 1:21pm UTC](https://discuss.elastic.co/t/validation-failed-1-this-action-would-add-2-total-shards-but-this-cluster-currently-has-2000-2000-maximum-shards-open/257064 "2020-12-15T13:21:02Z")
I'm using Elastic 7.6.2 I'm creating an index using a pipeline, Reading and sending text file through the filebeat and sending to a pipeline. I'm getting this error : Validation Failed: 1: this action would add \[2\] … --- ## [How to link/stitch-together events in an efficient way?](https://discuss.elastic.co/t/how-to-link-stitch-together-events-in-an-efficient-way/258611)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 2\ **Last updated:** [December 15, 2020, 1:07pm UTC](https://discuss.elastic.co/t/how-to-link-stitch-together-events-in-an-efficient-way/258611 "2020-12-15T13:07:41Z")
We have following data from auditD type=SYSCALL msg=audit(1607953823.861:1184699): arch=c000003e syscall=263 success=yes exit=0 a0=ffffffffffffff9c a1=17780c0 a2=0 a3=7ffe280a6ae0 items=2 ppid=45207 pid=45248 auid=1002 … --- ## [Field Name length more than 255](https://discuss.elastic.co/t/field-name-length-more-than-255/258592)
**Author:** [@srikanthkadem](https://discuss.elastic.co/u/srikanthkadem)\ **Replies:** 2\ **Last updated:** [December 15, 2020, 1:03pm UTC](https://discuss.elastic.co/t/field-name-length-more-than-255/258592 "2020-12-15T13:03:11Z")
Hi Team, I am facing issue in Syncing data into Elastic , upon investigatation I found that few of my fields name is more than 255. I trimmed it 250 to see if Sync working fine, it worked. Can you please help me in incr… --- ## [Filebeat Pod restarting continuously due to OOM](https://discuss.elastic.co/t/filebeat-pod-restarting-continuously-due-to-oom/258704)
**Author:** [@pavank](https://discuss.elastic.co/u/pavank)\ **Replies:** 1\ **Last updated:** [December 15, 2020, 12:44pm UTC](https://discuss.elastic.co/t/filebeat-pod-restarting-continuously-due-to-oom/258704 "2020-12-15T12:44:45Z")
Hi All, We have deployed Filebeat as a pod in our environment. We have set memory limit of 2GB in the deployment resources. We still see the pods getting restarted almost every day. Attaching the configmap and deploym… --- ## [Two specific nodes with 100% CPU](https://discuss.elastic.co/t/two-specific-nodes-with-100-cpu/258591)
**Author:** [@Lior\_Yakobov](https://discuss.elastic.co/u/Lior_Yakobov)\ **Replies:** 3\ **Last updated:** [December 15, 2020, 11:49am UTC](https://discuss.elastic.co/t/two-specific-nodes-with-100-cpu/258591 "2020-12-15T11:49:25Z")
Hello, We are experiencing for a few days now a scenario which 2 nodes are at 100% CPU usage. I can tell that these are searches as the search pool and search queue are filled, but I cannot figure out from where they a… --- ## [Integrate cisco devices](https://discuss.elastic.co/t/integrate-cisco-devices/258707)
**Author:** [@sbathla](https://discuss.elastic.co/u/sbathla)\ **Replies:** 1\ **Last updated:** [December 15, 2020, 11:41am UTC](https://discuss.elastic.co/t/integrate-cisco-devices/258707 "2020-12-15T11:41:18Z")
Hi All, I am new to elasticstack. I want to integrate Cisco devices with elasticsearch and kibana for which cisco module under filebeat is available for integration. But filebeat is installed on the host which has to be… --- ## [Mapping conflict](https://discuss.elastic.co/t/mapping-conflict/258352)
**Author:** [@Ines77](https://discuss.elastic.co/u/Ines77)\ **Replies:** 1\ **Last updated:** [December 15, 2020, 11:36am UTC](https://discuss.elastic.co/t/mapping-conflict/258352 "2020-12-15T11:36:54Z")
Hello! When I create a ML index in Kibana I get the following message " 3 fields are defined as several types (string, integer, etc) across the indices that match this pattern. You may still be able to use these conflict… --- ## [Failed to create elasticsearch client](https://discuss.elastic.co/t/failed-to-create-elasticsearch-client/256243)
**Author:** [@Deviad](https://discuss.elastic.co/u/Deviad)\ **Replies:** 1\ **Last updated:** [December 15, 2020, 10:45am UTC](https://discuss.elastic.co/t/failed-to-create-elasticsearch-client/256243 "2020-12-15T10:45:50Z")
Hello everyone, I pasted all the files in here: I am running elasticsearch in a container and fscrawler throws: 19:06:59.272 \[main\] FATAL fr.pilato.elasticsearch.crawler.fs.cli.FsCrawlerCli - We can not start Elas… --- ## [/var/log/upstart/logstash.log is too large](https://discuss.elastic.co/t/var-log-upstart-logstash-log-is-too-large/258690)
**Author:** [@jinsu](https://discuss.elastic.co/u/jinsu)\ **Replies:** 2\ **Last updated:** [December 15, 2020, 10:38am UTC](https://discuss.elastic.co/t/var-log-upstart-logstash-log-is-too-large/258690 "2020-12-15T10:38:31Z")
logstash version 7.9.3 Ubuntu when I start logstash service, the log file in /var/log/upstart/logstash.log will become too large in feu minutes, still I hava change the /path/logs to /data/logstash/. How to change t… --- ## [I can not run elasticsearch command](https://discuss.elastic.co/t/i-can-not-run-elasticsearch-command/258652)
**Author:** [@Vlad\_Dumitru](https://discuss.elastic.co/u/Vlad_Dumitru)\ **Replies:** 3\ **Last updated:** [December 15, 2020, 10:36am UTC](https://discuss.elastic.co/t/i-can-not-run-elasticsearch-command/258652 "2020-12-15T10:36:08Z")
OS: Manjaro STEPS: I was following this tutorial in order to install elasticsearch If I'm trying to run elasticsearch I will get this error: /usr/bin/elasticsearch-env: line 128: cd: /usr/share/elasticsearch/conf… --- ## [Select distinct value from multiple indexes](https://discuss.elastic.co/t/select-distinct-value-from-multiple-indexes/258696)
**Author:** [@ahmedbrandver](https://discuss.elastic.co/u/ahmedbrandver)\ **Replies:** 0\ **Last updated:** [December 15, 2020, 10:17am UTC](https://discuss.elastic.co/t/select-distinct-value-from-multiple-indexes/258696 "2020-12-15T10:17:59Z")
Hello, how can I add a aggregation to get data based on unique field of multiple indexes. Let's say I have three different indexes in which they have a unique code but one unique code can be exists in different field of … --- ## [\[esaggs\] \> Too Many Requests 7.8.1](https://discuss.elastic.co/t/esaggs-too-many-requests-7-8-1/258694)
**Author:** [@raja.yerrabothula](https://discuss.elastic.co/u/raja.yerrabothula)\ **Replies:** 0\ **Last updated:** [December 15, 2020, 10:09am UTC](https://discuss.elastic.co/t/esaggs-too-many-requests-7-8-1/258694 "2020-12-15T10:09:26Z")
i have a production elasticsearch and kibana installed, when generating a report cannot add more three columns and limit to 5 rows only, my requirement is around 63K rows when generating this report i am getting \[esaggs\]… --- ## [Elastic thinks that it uses all RAM](https://discuss.elastic.co/t/elastic-thinks-that-it-uses-all-ram/258688)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 0\ **Last updated:** [December 15, 2020, 9:37am UTC](https://discuss.elastic.co/t/elastic-thinks-that-it-uses-all-ram/258688 "2020-12-15T09:37:22Z")
Hello, I noticed one thing about our cluster. When I made curl request (curl -XGET 'http://h1-es01:9200/\_nodes/stats/os?pretty') I saw this: h1-es01 "mem" : { "total\_in\_bytes" : 134885113856, … --- ## [How to set java path for elasticsearch](https://discuss.elastic.co/t/how-to-set-java-path-for-elasticsearch/258686)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [December 15, 2020, 9:36am UTC](https://discuss.elastic.co/t/how-to-set-java-path-for-elasticsearch/258686 "2020-12-15T09:36:14Z")
I have java-11 i want to add JAVA\_HOME path in elasticsearch how can i do this i edit this in /etc/default/elasticsearch but when do GET /\_cluster/stats/ it give me output "jvm" : { "max\_uptime\_in\_millis" : 105897… --- ## [How force to move to Warm phase](https://discuss.elastic.co/t/how-force-to-move-to-warm-phase/258685)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 2\ **Last updated:** [December 15, 2020, 9:21am UTC](https://discuss.elastic.co/t/how-force-to-move-to-warm-phase/258685 "2020-12-15T09:21:56Z")
Hi, I have an index in a hot phase, which was completed After n days from roll over the index will enter the warm phase and it will be relocated to the warm node. Is it possible to force the index to move to the warm … --- ## [Metricbeat only run system module instead of running both system and apache module](https://discuss.elastic.co/t/metricbeat-only-run-system-module-instead-of-running-both-system-and-apache-module/258098)
**Author:** [@Minh\_Ti\_n\_Tr\_n](https://discuss.elastic.co/u/Minh_Ti_n_Tr_n)\ **Replies:** 16\ **Last updated:** [December 15, 2020, 9:05am UTC](https://discuss.elastic.co/t/metricbeat-only-run-system-module-instead-of-running-both-system-and-apache-module/258098 "2020-12-15T09:05:20Z")
Hi all, I configured metricbeat on my server for collecting both system & apache data with default module but only system data from host showed on kibana. The apache dashboard is empty data and don't know the reason. h… --- ## [UDP Message from Filebeat to ElasticSearch to Grafana - How to filter for my value?](https://discuss.elastic.co/t/udp-message-from-filebeat-to-elasticsearch-to-grafana-how-to-filter-for-my-value/258302)
**Author:** [@dewell](https://discuss.elastic.co/u/dewell)\ **Replies:** 1\ **Last updated:** [December 15, 2020, 8:52am UTC](https://discuss.elastic.co/t/udp-message-from-filebeat-to-elasticsearch-to-grafana-how-to-filter-for-my-value/258302 "2020-12-15T08:52:06Z")
Hello, with the help of several guides I tried to show a constant UDP stream of double values (10 8byte double values each second) in a line chart in Grafana but I'm not sure how to get the value from elasticsearch into… --- ## [How to put filters for 700+ users to know their count of logins daily basis](https://discuss.elastic.co/t/how-to-put-filters-for-700-users-to-know-their-count-of-logins-daily-basis/258483)
**Author:** [@kirankrish](https://discuss.elastic.co/u/kirankrish)\ **Replies:** 4\ **Last updated:** [December 15, 2020, 8:23am UTC](https://discuss.elastic.co/t/how-to-put-filters-for-700-users-to-know-their-count-of-logins-daily-basis/258483 "2020-12-15T08:23:43Z")
We have logs which captures users logged in and these users can be upto 700+. We need to know the count of each user logged in on a daily basis. What is the optimum way to handle this? --- ## [Error registering Kibana Privileges with Elasticsearch for kibana-.kibana: \[exception\] Trying to create too many scroll contexts](https://discuss.elastic.co/t/error-registering-kibana-privileges-with-elasticsearch-for-kibana-kibana-exception-trying-to-create-too-many-scroll-contexts/257117)
**Author:** [@libbkmz](https://discuss.elastic.co/u/libbkmz)\ **Replies:** 4\ **Last updated:** [December 15, 2020, 8:31am UTC](https://discuss.elastic.co/t/error-registering-kibana-privileges-with-elasticsearch-for-kibana-kibana-exception-trying-to-create-too-many-scroll-contexts/257117 "2020-12-15T08:31:32Z")
Hello, I'm running many clusters of ElasticSearch with Kibana, we have version 7.6.2, this is version info: { "name" : "CLUSTER\_NAME...", "cluster\_name" : "CLUSTER\_NAME", "cluster\_uuid" : "4zR...", "version" : … --- ## [Tophits on transform group by a field not all field](https://discuss.elastic.co/t/tophits-on-transform-group-by-a-field-not-all-field/258373)
**Author:** [@charles97](https://discuss.elastic.co/u/charles97)\ **Replies:** 15\ **Last updated:** [December 15, 2020, 7:59am UTC](https://discuss.elastic.co/t/tophits-on-transform-group-by-a-field-not-all-field/258373 "2020-12-15T07:59:00Z")
So I have this case where I need to use top hits on transformation I want to show data based on I have this data email col2 col3 col4 col5 Time a.com a a a a 11:00 a.com a … --- ## [Snapshots - guarantee of correctness?](https://discuss.elastic.co/t/snapshots-guarantee-of-correctness/258025)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 5\ **Last updated:** [December 15, 2020, 7:35am UTC](https://discuss.elastic.co/t/snapshots-guarantee-of-correctness/258025 "2020-12-15T07:35:35Z")
Are the snapshots made by elasticsearch surely not to have any errors? Is there any additional option to quickly check the correctness of generated snapshots? --- ## [Save a "discover" configuration](https://discuss.elastic.co/t/save-a-discover-configuration/258513)
**Author:** [@Francisco\_Navarro](https://discuss.elastic.co/u/Francisco_Navarro)\ **Replies:** 4\ **Last updated:** [December 15, 2020, 7:28am UTC](https://discuss.elastic.co/t/save-a-discover-configuration/258513 "2020-12-15T07:28:14Z")
Hello there! When I use Kibana discover with an index it generates something like this by default: It is not useful for me to visualize this in that way. So I configure the shown fields to have this: I would like … --- ## [Logstash only reads files at startup](https://discuss.elastic.co/t/logstash-only-reads-files-at-startup/258224)
**Author:** [@BoKu](https://discuss.elastic.co/u/BoKu)\ **Replies:** 10\ **Last updated:** [December 15, 2020, 7:22am UTC](https://discuss.elastic.co/t/logstash-only-reads-files-at-startup/258224 "2020-12-15T07:22:54Z")
Hello there, if got a problem with logstash reading files. In generall my input, filter and output is working. The files are generated and copied to the correct path, every hour but logstash doesn't read them, only on (… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1642) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1644)