# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1645 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1646 --- ## [How to deal with non-auto generated ids while index](https://discuss.elastic.co/t/how-to-deal-with-non-auto-generated-ids-while-index/258626)
**Author:** [@arash\_rahimi](https://discuss.elastic.co/u/arash_rahimi)\ **Replies:** 3\ **Last updated:** [December 14, 2020, 6:56pm UTC](https://discuss.elastic.co/t/how-to-deal-with-non-auto-generated-ids-while-index/258626 "2020-12-14T18:56:55Z")
Hi, I read the elastic documents and saw there I should use auto-generated ids to speed up the search index but because of my data model & query model I cant use auto-generated ids and so after indexing a million documen… --- ## [Push\_previous\_map\_as\_event if fields exist](https://discuss.elastic.co/t/push-previous-map-as-event-if-fields-exist/250566)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 39\ **Last updated:** [December 14, 2020, 6:31pm UTC](https://discuss.elastic.co/t/push-previous-map-as-event-if-fields-exist/250566 "2020-12-14T18:31:00Z")
Hi, I need help figuring out a way for Logstash to check if a specific filed exists for a specific task\_id and then aggregate those fields using push\_previous\_map\_as\_event. For example, my current aggregate filter looks… --- ## [Failed to find geo\_point field \[destination.geo.location\]](https://discuss.elastic.co/t/failed-to-find-geo-point-field-destination-geo-location/256966)
**Author:** [@secopsgeek](https://discuss.elastic.co/u/secopsgeek)\ **Replies:** 8\ **Last updated:** [December 14, 2020, 5:17pm UTC](https://discuss.elastic.co/t/failed-to-find-geo-point-field-destination-geo-location/256966 "2020-12-14T17:17:02Z")
Hello everyone, I am having some problems with geo.location showing up on that maps with errors. This is my errors" query\_shard\_exception at \`shard\` 0 \`index\` .ds-logs-windows.security-default-000001 \`node\` stUuKb8ZR4… --- ## [Field have the same value](https://discuss.elastic.co/t/field-have-the-same-value/258604)
**Author:** [@Dea\_Agra](https://discuss.elastic.co/u/Dea_Agra)\ **Replies:** 5\ **Last updated:** [December 14, 2020, 5:08pm UTC](https://discuss.elastic.co/t/field-have-the-same-value/258604 "2020-12-14T17:08:05Z")
I don't know why logstash keep parsing the same value for the different field. Here I attach my logstash configuration input { file { start\_position =\> "beginning" sincedb\_path =\> "/dev/null" path =\> \[ "/home/elasticse… --- ## [Elasticsearch Audit not supported, but still got entries](https://discuss.elastic.co/t/elasticsearch-audit-not-supported-but-still-got-entries/258337)
**Author:** [@djordan66](https://discuss.elastic.co/u/djordan66)\ **Replies:** 3\ **Last updated:** [December 14, 2020, 4:53pm UTC](https://discuss.elastic.co/t/elasticsearch-audit-not-supported-but-still-got-entries/258337 "2020-12-14T16:53:53Z")
We're running a cluster on Elasticsearch 7.9.3-1 We have 3 head/master nodes, 14 data nodes, and a kibana index node in the cluster. I was asked to get audit logging running on our cluster to keep an eye on users, but … --- ## [Best practices for docker container application log shipping with Filebeat to Logstash](https://discuss.elastic.co/t/best-practices-for-docker-container-application-log-shipping-with-filebeat-to-logstash/258613)
**Author:** [@duckasylum](https://discuss.elastic.co/u/duckasylum)\ **Replies:** 1\ **Last updated:** [December 14, 2020, 4:52pm UTC](https://discuss.elastic.co/t/best-practices-for-docker-container-application-log-shipping-with-filebeat-to-logstash/258613 "2020-12-14T16:52:25Z")
Hi, I have a docker service of two containers. They both have a web server component which produces access, error and debug logs and one container has special module attached to the web server component, which produces … --- ## [Problem when setting Kibana server as a proxy for Tiles Maps Download and Maps Visualizations](https://discuss.elastic.co/t/problem-when-setting-kibana-server-as-a-proxy-for-tiles-maps-download-and-maps-visualizations/258594)
**Author:** [@Manuel\_Wong](https://discuss.elastic.co/u/Manuel_Wong)\ **Replies:** 1\ **Last updated:** [December 14, 2020, 4:16pm UTC](https://discuss.elastic.co/t/problem-when-setting-kibana-server-as-a-proxy-for-tiles-maps-download-and-maps-visualizations/258594 "2020-12-14T16:16:21Z")
Hello All, We have a KIbana/Elasticsearch environment where the servers have access to the internet through a proxy. The web browser clients from which the users access to Kibana are also running from an environment tha… --- ## [Is there a way to configure Elasticsearch for languages with 4 letters like DNA?](https://discuss.elastic.co/t/is-there-a-way-to-configure-elasticsearch-for-languages-with-4-letters-like-dna/258586)
**Author:** [@Popop\_Lldas](https://discuss.elastic.co/u/Popop_Lldas)\ **Replies:** 0\ **Last updated:** [December 14, 2020, 2:17pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-configure-elasticsearch-for-languages-with-4-letters-like-dna/258586 "2020-12-14T14:17:13Z")
There was a question on this subject in 2018, but it hasn't been fully addressed yet. https://discuss.elastic.co/t/elasticsearch-for-dna-sequence-analysis The DNA is a two-bit system so I assume regualr full-text searc… --- ## [Analyzers at search/query time vs at index time](https://discuss.elastic.co/t/analyzers-at-search-query-time-vs-at-index-time/258175)
**Author:** [@John\_McAfee1](https://discuss.elastic.co/u/John_McAfee1)\ **Replies:** 3\ **Last updated:** [December 14, 2020, 3:24pm UTC](https://discuss.elastic.co/t/analyzers-at-search-query-time-vs-at-index-time/258175 "2020-12-14T15:24:50Z")
Hello! My team and I are using analyzers both at search/query and when data is indexed. After revewing the Elastic documentation and a few web searches, I have not found a conclusive answerto my questions. I have two q… --- ## [Elastic webhook output](https://discuss.elastic.co/t/elastic-webhook-output/258546)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 2\ **Last updated:** [December 14, 2020, 3:15pm UTC](https://discuss.elastic.co/t/elastic-webhook-output/258546 "2020-12-14T15:15:53Z")
Hello, I wanna know please if the webhook in the watcher send output in a JSON format ? cause I am getting some errors in my webhook and I don't know if it's because the output is not in JSON format, or cause I didn't k… --- ## [Showing saved dashboards in other plugins](https://discuss.elastic.co/t/showing-saved-dashboards-in-other-plugins/258501)
**Author:** [@houshmand1996](https://discuss.elastic.co/u/houshmand1996)\ **Replies:** 1\ **Last updated:** [December 14, 2020, 3:10pm UTC](https://discuss.elastic.co/t/showing-saved-dashboards-in-other-plugins/258501 "2020-12-14T15:10:27Z")
hi how we can use of saved dashboards in other plugins besides of dashboard plugin and apply filters to that dynamically --- ## [Grok filter TIMESTAMP\_ISO8601 appears in Kibana as String](https://discuss.elastic.co/t/grok-filter-timestamp-iso8601-appears-in-kibana-as-string/258240)
**Author:** [@SecretSquizza](https://discuss.elastic.co/u/SecretSquizza)\ **Replies:** 3\ **Last updated:** [December 14, 2020, 2:48pm UTC](https://discuss.elastic.co/t/grok-filter-timestamp-iso8601-appears-in-kibana-as-string/258240 "2020-12-14T14:48:14Z")
Hi all, I done a bit of rooting around google but can't find any definitive answers, so i decided to humble myself and request help directly. The problem i have is that, like many incoming messages, my log entry contai… --- ## [How to create a drilldown on dashboard for Vega-lite vis](https://discuss.elastic.co/t/how-to-create-a-drilldown-on-dashboard-for-vega-lite-vis/257632)
**Author:** [@Melok](https://discuss.elastic.co/u/Melok)\ **Replies:** 3\ **Last updated:** [December 14, 2020, 2:14pm UTC](https://discuss.elastic.co/t/how-to-create-a-drilldown-on-dashboard-for-vega-lite-vis/257632 "2020-12-14T14:14:37Z")
I am trying to create drilldown from vega vis to dashboard but it doesn't work. For example, for tables, this works correctly, by clicking on the magnifying glass icon, you can select the drilldown created. Kibana v… --- ## [Ideas to Normalize and join](https://discuss.elastic.co/t/ideas-to-normalize-and-join/258543)
**Author:** [@surphix](https://discuss.elastic.co/u/surphix)\ **Replies:** 2\ **Last updated:** [December 14, 2020, 2:08pm UTC](https://discuss.elastic.co/t/ideas-to-normalize-and-join/258543 "2020-12-14T14:08:43Z")
Hello everyone, I am working on a project to integrate two existing indexes (30-50M records each) into one by joining across a common field. Unfortunately as I understand Elasticsearch does not support joins like SQL. I… --- ## [MS SQL+ ELASTICSEARCH](https://discuss.elastic.co/t/ms-sql-elasticsearch/258563)
**Author:** [@pmate](https://discuss.elastic.co/u/pmate)\ **Replies:** 6\ **Last updated:** [December 14, 2020, 1:02pm UTC](https://discuss.elastic.co/t/ms-sql-elasticsearch/258563 "2020-12-14T13:02:21Z")
Hy everybody! I am new in elasticsearch and beginner in docker also. I need to know what is the best way to connect an ms sql data base to an elastichsearch docker instance? Thanks for Help! --- ## [Filebeat Cisco Umbrella module](https://discuss.elastic.co/t/filebeat-cisco-umbrella-module/256811)
**Author:** [@Massimo\_Brogioni](https://discuss.elastic.co/u/Massimo_Brogioni)\ **Replies:** 1\ **Last updated:** [December 14, 2020, 12:30pm UTC](https://discuss.elastic.co/t/filebeat-cisco-umbrella-module/256811 "2020-12-14T12:30:31Z")
Hi, I am trying to configure filebeat to get logs from Cisco Umbrella but something don't work. The logs are in a bucket Cisco managed. If I try to list the bucket I am successful, with: /usr/local/bin/aws s3 ls s3://… --- ## [Elastic cluster "Received ban for the parent \[channel closed\]", Apache Metron "listener timeout after waiting for"](https://discuss.elastic.co/t/elastic-cluster-received-ban-for-the-parent-channel-closed-apache-metron-listener-timeout-after-waiting-for/258535)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 13\ **Last updated:** [December 14, 2020, 12:16pm UTC](https://discuss.elastic.co/t/elastic-cluster-received-ban-for-the-parent-channel-closed-apache-metron-listener-timeout-after-waiting-for/258535 "2020-12-14T12:16:32Z")
Hello, we using ES cluster with 3 nodes, each datanode. We faced with problem that sometimes we can't write into our cluster using Apache Metron : java.io.IOException: listener timeout after waiting for \[60000\] ms at or… --- ## [Appeared \_grokparsefailure, unable to parse specific lines from log file](https://discuss.elastic.co/t/appeared-grokparsefailure-unable-to-parse-specific-lines-from-log-file/258566)
**Author:** [@Polak](https://discuss.elastic.co/u/Polak)\ **Replies:** 0\ **Last updated:** [December 14, 2020, 10:50am UTC](https://discuss.elastic.co/t/appeared-grokparsefailure-unable-to-parse-specific-lines-from-log-file/258566 "2020-12-14T10:50:57Z")
I have this kind of log: https://pastebin.com/ztXijyNV I would like to drop all events except the lines with "INFO -- :". Logs are gathered by filebeat and then they are send to logstash. Important data are in log insid… --- ## [Elasticsearch Saved Search with Group By](https://discuss.elastic.co/t/elasticsearch-saved-search-with-group-by/257823)
**Author:** [@Kapila](https://discuss.elastic.co/u/Kapila)\ **Replies:** 15\ **Last updated:** [December 14, 2020, 11:47am UTC](https://discuss.elastic.co/t/elasticsearch-saved-search-with-group-by/257823 "2020-12-14T11:47:36Z")
index\_name: my\_data-2020-12-01 ticket\_number: T123 ticket\_status: OPEN ticket\_updated\_time: 2020-12-01 12:22:12 index\_name: my\_data-2020-12-01 ticket\_number: T124 ticket\_status: OPEN ticket\_updated\_time: 2020-12… --- ## [Client requested protocol tlsv1 is not enabled or supported in server context](https://discuss.elastic.co/t/client-requested-protocol-tlsv1-is-not-enabled-or-supported-in-server-context/258114)
**Author:** [@Usman](https://discuss.elastic.co/u/Usman)\ **Replies:** 2\ **Last updated:** [December 14, 2020, 11:45am UTC](https://discuss.elastic.co/t/client-requested-protocol-tlsv1-is-not-enabled-or-supported-in-server-context/258114 "2020-12-14T11:45:24Z")
Hi, we are using ELK stack version 7.9.0 , when we try to connect logstash with elastic it give us error . 'client requested protocol tlsv1 is not enabled or supported in server context' when we specify following para… --- ## [Index name based on docker-compose service name](https://discuss.elastic.co/t/index-name-based-on-docker-compose-service-name/258468)
**Author:** [@fulkon](https://discuss.elastic.co/u/fulkon)\ **Replies:** 3\ **Last updated:** [December 14, 2020, 11:45am UTC](https://discuss.elastic.co/t/index-name-based-on-docker-compose-service-name/258468 "2020-12-14T11:45:24Z")
Is there any way to set index name based on docker-compose service name? Corresponding name is in container.labels.com\_docker\_compose\_service field. Tried this in input: - type: container paths: - '/… --- ## [Cannot read property 'split' of undefined \[Winlogbeat\]](https://discuss.elastic.co/t/cannot-read-property-split-of-undefined-winlogbeat/258365)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 2\ **Last updated:** [December 14, 2020, 11:03am UTC](https://discuss.elastic.co/t/cannot-read-property-split-of-undefined-winlogbeat/258365 "2020-12-14T11:03:23Z")
Hello, everyone! We have troubles with our winlogbeat agent. Sometimes it writes error message "TypeError: Cannot read property 'split' of undefined at C:\\Program Files\\Winlogbeat/module/security/config/winlogbeat-secur… --- ## [Kubernetes metadata not showing (add\_kubernetes\_metadata)](https://discuss.elastic.co/t/kubernetes-metadata-not-showing-add-kubernetes-metadata/255538)
**Author:** [@humartinez](https://discuss.elastic.co/u/humartinez)\ **Replies:** 5\ **Last updated:** [December 14, 2020, 10:24am UTC](https://discuss.elastic.co/t/kubernetes-metadata-not-showing-add-kubernetes-metadata/255538 "2020-12-14T10:24:00Z")
Hi, Im currently having issues with the add\_kubernetes\_metadata processor. Im adding a simple config and I've configured a service account to have permissions to query the cluster, but I cant get any metadata entry with… --- ## [ILM Delete Phase not working](https://discuss.elastic.co/t/ilm-delete-phase-not-working/258559)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 4\ **Last updated:** [December 14, 2020, 10:21am UTC](https://discuss.elastic.co/t/ilm-delete-phase-not-working/258559 "2020-12-14T10:21:47Z")
Hi All, I have defined an ILM policy with hot, warm and delete phase. Hot are warm phase are working as expected, but in spite of the delete phase says "complete", the index is still there... Am I misunderstanding som… --- ## [Tag Cloud to only show current value](https://discuss.elastic.co/t/tag-cloud-to-only-show-current-value/258165)
**Author:** [@fastxl](https://discuss.elastic.co/u/fastxl)\ **Replies:** 7\ **Last updated:** [December 14, 2020, 9:52am UTC](https://discuss.elastic.co/t/tag-cloud-to-only-show-current-value/258165 "2020-12-14T09:52:53Z")
I am reading data in from a machine tool and I would like to visualize the current status. My document looks like this @timestamp Dec 9, 2020 @ 10:44:00.867 @version 1 Events.Execution.@@data INTERRUPTED Events.Execut… --- ## [ElasticsearchException: Concurrent modification of alias \[datastream\] during rollover](https://discuss.elastic.co/t/elasticsearchexception-concurrent-modification-of-alias-datastream-during-rollover/258547)
**Author:** [@altuhovsu](https://discuss.elastic.co/u/altuhovsu)\ **Replies:** 0\ **Last updated:** [December 14, 2020, 8:15am UTC](https://discuss.elastic.co/t/elasticsearchexception-concurrent-modification-of-alias-datastream-during-rollover/258547 "2020-12-14T08:15:20Z")
Hello. We have a datastream with ILM policy (50gb or 30 days). It works, but when rollover occurs we see some errors in a logs and some indices created! This problem occurs only with datastreams and not with simple ind… --- ## [Replace Old Data From Logstash](https://discuss.elastic.co/t/replace-old-data-from-logstash/258538)
**Author:** [@rehannali](https://discuss.elastic.co/u/rehannali)\ **Replies:** 1\ **Last updated:** [December 14, 2020, 8:36am UTC](https://discuss.elastic.co/t/replace-old-data-from-logstash/258538 "2020-12-14T08:36:30Z")
Hi, I using MySql to dumb data into elasticsearch. It runs every 5 mins and got duplicate results. I want to replace data so there will be no duplicate entries in it. How can i achieve this? P.S. I need to replace who… --- ## [Scan Snapshot Repository](https://discuss.elastic.co/t/scan-snapshot-repository/257511)
**Author:** [@EnriqueM](https://discuss.elastic.co/u/EnriqueM)\ **Replies:** 5\ **Last updated:** [December 14, 2020, 7:59am UTC](https://discuss.elastic.co/t/scan-snapshot-repository/257511 "2020-12-14T07:59:45Z")
Good morning. After a data corruption in a server we have the path of the Snapshots repository. When adding the repository on a new cluster, the Snapshots it contains do not appear. Is there any way to recover the inf… --- ## [How to enable SO\_KEEPALIVE with the Java HighLevel Rest client](https://discuss.elastic.co/t/how-to-enable-so-keepalive-with-the-java-highlevel-rest-client/188979)
**Author:** [@menardorama](https://discuss.elastic.co/u/menardorama)\ **Replies:** 1\ **Last updated:** [December 14, 2020, 7:05am UTC](https://discuss.elastic.co/t/how-to-enable-so-keepalive-with-the-java-highlevel-rest-client/188979 "2020-12-14T07:05:02Z")
Hi, First of all I am not a Java developper but a Sysadmin. We are hosting an java microservice application that is using Elasticsearch on a Kubernetes platform. We are facing some « Connection Reset » on the client s… --- ## [Hive connection and data ingestion](https://discuss.elastic.co/t/hive-connection-and-data-ingestion/256797)
**Author:** [@irfangk1](https://discuss.elastic.co/u/irfangk1)\ **Replies:** 1\ **Last updated:** [December 14, 2020, 6:37am UTC](https://discuss.elastic.co/t/hive-connection-and-data-ingestion/256797 "2020-12-14T06:37:14Z")
Hi, I want to connect Hive with Elastic and then ingest data into it. Please share the steps/process [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1644) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1646)