# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1669 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1670 --- ## [Kibana plugin. Is it possible to use joi validation in router?](https://discuss.elastic.co/t/kibana-plugin-is-it-possible-to-use-joi-validation-in-router/255438)
**Author:** [@16318a22907f3cbfa04b](https://discuss.elastic.co/u/16318a22907f3cbfa04b)\ **Replies:** 4\ **Last updated:** [December 1, 2020, 7:20am UTC](https://discuss.elastic.co/t/kibana-plugin-is-it-possible-to-use-joi-validation-in-router/255438 "2020-12-01T07:20:18Z")
the schema from @kibana/config-schema has too few features --- ## [Problem with ILM](https://discuss.elastic.co/t/problem-with-ilm/255946)
**Author:** [@BoKu](https://discuss.elastic.co/u/BoKu)\ **Replies:** 4\ **Last updated:** [December 1, 2020, 7:10am UTC](https://discuss.elastic.co/t/problem-with-ilm/255946 "2020-12-01T07:10:48Z")
Hello, i have a problem understanding ILM with index alias on an custom created index. I have an custom index oracle-logs, which is feeded by logstash (which gets the documents from filebeat), it then sends the document… --- ## [Data node constantly dropping out of the cluster](https://discuss.elastic.co/t/data-node-constantly-dropping-out-of-the-cluster/257163)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 7:05am UTC](https://discuss.elastic.co/t/data-node-constantly-dropping-out-of-the-cluster/257163 "2020-12-01T07:05:04Z")
The data node is constantly falling from the cluster, I don't understand why.Can you please help me? I'm too new to find out why myself. I shared it all here --- ## [Metricbeat using more than expected memory](https://discuss.elastic.co/t/metricbeat-using-more-than-expected-memory/257144)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 6\ **Last updated:** [December 1, 2020, 6:47am UTC](https://discuss.elastic.co/t/metricbeat-using-more-than-expected-memory/257144 "2020-12-01T06:47:39Z")
I want to use metricbeat to track logstash and have followed the instructions here:https://www.elastic.co/guide/en/logstash/current/monitoring-with-metricbeat.html. Everything worked but metricbeat is using 1.3gb of ram … --- ## [How to build Elasticsearch from source without xpack](https://discuss.elastic.co/t/how-to-build-elasticsearch-from-source-without-xpack/256299)
**Author:** [@kayshu](https://discuss.elastic.co/u/kayshu)\ **Replies:** 6\ **Last updated:** [December 1, 2020, 6:13am UTC](https://discuss.elastic.co/t/how-to-build-elasticsearch-from-source-without-xpack/256299 "2020-12-01T06:13:04Z")
Hi, i am trying to build a non-snapshot build of elasticsearch from source using gradle assemble -Dbuild.snapshot=false But I am getting the following exception Property license.key must be set for release build I th… --- ## [How to add a field if the string matches a word in message](https://discuss.elastic.co/t/how-to-add-a-field-if-the-string-matches-a-word-in-message/255804)
**Author:** [@Guhan\_S](https://discuss.elastic.co/u/Guhan_S)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 6:10am UTC](https://discuss.elastic.co/t/how-to-add-a-field-if-the-string-matches-a-word-in-message/255804 "2020-12-01T06:10:40Z")
{"level":30,"time":1605686969640,"pid":1,"hostname":"ip-100-91-70-500","name":"ZA-dev", this is my sample logs, here i am trying to achieve, if level:30 in message it has to create info log-level, i tired filter { … --- ## [How to collect the network information (data) through metricbeat from windows OS](https://discuss.elastic.co/t/how-to-collect-the-network-information-data-through-metricbeat-from-windows-os/256754)
**Author:** [@naveen\_reddy](https://discuss.elastic.co/u/naveen_reddy)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 6:00am UTC](https://discuss.elastic.co/t/how-to-collect-the-network-information-data-through-metricbeat-from-windows-os/256754 "2020-12-01T06:00:09Z")
i am not able to collect the process and network related information from metric beats can one help me please... --- ## [Mapping field as geo\_point](https://discuss.elastic.co/t/mapping-field-as-geo-point/257108)
**Author:** [@blitzcrg](https://discuss.elastic.co/u/blitzcrg)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 5:26am UTC](https://discuss.elastic.co/t/mapping-field-as-geo-point/257108 "2020-12-01T05:26:23Z")
I am having some issues with the logstash geoip plugin that I think stem from a lack of understanding with respect to how the elasticsearch output plugin and index mappings interact. Specifically, I need to ensure that s… --- ## [Cannot allocate because a previous copy of the primary shard existed but can no longer be found on the nodes in the cluster](https://discuss.elastic.co/t/cannot-allocate-because-a-previous-copy-of-the-primary-shard-existed-but-can-no-longer-be-found-on-the-nodes-in-the-cluster/257148)
**Author:** [@wfeng888](https://discuss.elastic.co/u/wfeng888)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 4:03am UTC](https://discuss.elastic.co/t/cannot-allocate-because-a-previous-copy-of-the-primary-shard-existed-but-can-no-longer-be-found-on-the-nodes-in-the-cluster/257148 "2020-12-01T04:03:07Z")
I have a cluster with two nodes , version es5.4.3. About 26 shards unassigned after machine down. I get these message GET /\_cluster/allocation/explain { "index": "dcvs\_nonmotorvehicle", "shard": 3, "primary":… --- ## [Use of URL template](https://discuss.elastic.co/t/use-of-url-template/256641)
**Author:** [@Atul\_Gunjal](https://discuss.elastic.co/u/Atul_Gunjal)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 5:12am UTC](https://discuss.elastic.co/t/use-of-url-template/256641 "2020-12-01T05:12:20Z")
How can I use context.panel.filters to open another dashboard in Kibana using URL drill-down in a new tab as new tab support is not available for dashboard drill down in kibana 7.10. Thanks in Advance. --- ## [How to rename some fields by using regex statement](https://discuss.elastic.co/t/how-to-rename-some-fields-by-using-regex-statement/257031)
**Author:** [@xrubick](https://discuss.elastic.co/u/xrubick)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 2:45am UTC](https://discuss.elastic.co/t/how-to-rename-some-fields-by-using-regex-statement/257031 "2020-12-01T02:45:04Z")
this's my logstash output: "prometheus" =\> { "metrics" =\> { "container\_cpu\_load\_average\_10s" =\> 0, "container\_cpu\_user\_seconds\_total" =\> 18.15, "container\_cpu\_syst… --- ## [Reindex from a remote cluster](https://discuss.elastic.co/t/reindex-from-a-remote-cluster/256922)
**Author:** [@twang](https://discuss.elastic.co/u/twang)\ **Replies:** 4\ **Last updated:** [December 1, 2020, 1:44am UTC](https://discuss.elastic.co/t/reindex-from-a-remote-cluster/256922 "2020-12-01T01:44:44Z")
Hi, I am trying to copy my index from one source to another source from a remote cluster. to follow this link I got an error: my cluster is not on reindex.remote.whitelist. I were using - Elasticsearch (Self-Manage… --- ## [Looking for suggestions about mapping](https://discuss.elastic.co/t/looking-for-suggestions-about-mapping/257140)
**Author:** [@MassimoIvaldi](https://discuss.elastic.co/u/MassimoIvaldi)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 12:54am UTC](https://discuss.elastic.co/t/looking-for-suggestions-about-mapping/257140 "2020-12-01T00:54:27Z")
Hello, I am an Italian developer, newbye of Elasticsearch, actually in training. I would experiment as exercice a parser of articles in some French newspaper in order to analyze the text usin Natural Language Processin… --- ## [Grok filter does not work pipeline creation error, while its parsing with no issue on grok parser](https://discuss.elastic.co/t/grok-filter-does-not-work-pipeline-creation-error-while-its-parsing-with-no-issue-on-grok-parser/257037)
**Author:** [@amitnirmal01](https://discuss.elastic.co/u/amitnirmal01)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 11:48pm UTC](https://discuss.elastic.co/t/grok-filter-does-not-work-pipeline-creation-error-while-its-parsing-with-no-issue-on-grok-parser/257037 "2020-11-30T23:48:52Z")
\`\`\`%{TIMESTAMP\_ISO8601:timestamp} %{LOGLEVEL:loglevel}.\*\\\[%{THREADNAME:thread}.\*IdamAuthHandler.\*\\\].\* - \\\[carrier:%{GREEDYDATA:carrier}\\\]. \*\\\[product:%{ANYDATA:product}\\\].\*\\\[version:%{ANYDATA:version}\].\*\\\[call:%{ANYDATA:… --- ## [Kibana dashboard not showing 'message' field](https://discuss.elastic.co/t/kibana-dashboard-not-showing-message-field/257127)
**Author:** [@renansph](https://discuss.elastic.co/u/renansph)\ **Replies:** 4\ **Last updated:** [November 30, 2020, 11:07pm UTC](https://discuss.elastic.co/t/kibana-dashboard-not-showing-message-field/257127 "2020-11-30T23:07:00Z")
Hi. I'm trying to add the 'message' field to a 'Data Table' in Kibana but i can't see the field. In the built-in dashboard from Postgresql filebeat i can see the field without problem: But when i try to build a new… --- ## [Parse KV:s beginning with a \key=value](https://discuss.elastic.co/t/parse-kv-s-beginning-with-a-xxx-key-value/257055)
**Author:** [@Elitlogik](https://discuss.elastic.co/u/Elitlogik)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 10:14pm UTC](https://discuss.elastic.co/t/parse-kv-s-beginning-with-a-xxx-key-value/257055 "2020-11-30T22:14:52Z")
Is there a way to easily remove the leading in a key-value sequence? \key1=value1 key2=value2 key3=value3 Filter looks like this now: filter { kv {} } Thank you for your support! --- ## [Filebeat: Ingest logs to Datastream](https://discuss.elastic.co/t/filebeat-ingest-logs-to-datastream/256164)
**Author:** [@vishakh](https://discuss.elastic.co/u/vishakh)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 10:06pm UTC](https://discuss.elastic.co/t/filebeat-ingest-logs-to-datastream/256164 "2020-11-30T22:06:56Z")
ELK-stack: 7.10 Currently, I'm using filebeat to ingest logs to elasticsearch directly to an index (example: useract-\*) Since 7.9.1, I see a new feature called data-stream. Question: How can we specify and make filebe… --- ## [ELK stack set up - Filebeat setup failing](https://discuss.elastic.co/t/elk-stack-set-up-filebeat-setup-failing/257122)
**Author:** [@Guy\_Goodrick](https://discuss.elastic.co/u/Guy_Goodrick)\ **Replies:** 5\ **Last updated:** [November 30, 2020, 9:54pm UTC](https://discuss.elastic.co/t/elk-stack-set-up-filebeat-setup-failing/257122 "2020-11-30T21:54:51Z")
Hello - I'm new to this, just getting started installing the ELK stack on Ubuntu 20.04. Everything is running on that one server for now (though eventually we will want to look at a production version with a cluster, but… --- ## [Filebeat httpjson with content type plus beat block](https://discuss.elastic.co/t/filebeat-httpjson-with-content-type-plus-beat-block/257131)
**Author:** [@jkaufmanlr](https://discuss.elastic.co/u/jkaufmanlr)\ **Replies:** 0\ **Last updated:** [November 30, 2020, 9:48pm UTC](https://discuss.elastic.co/t/filebeat-httpjson-with-content-type-plus-beat-block/257131 "2020-11-30T21:48:30Z")
okay I am at a loss, I have a POST api call that has a body and absolutely requires content-type: "application/json" without the content-type I can get the api to make the call but the json response isn't what I was exp… --- ## [New installation - Unable to connect to kibana 7.9.2](https://discuss.elastic.co/t/new-installation-unable-to-connect-to-kibana-7-9-2/256579)
**Author:** [@drivera](https://discuss.elastic.co/u/drivera)\ **Replies:** 4\ **Last updated:** [November 30, 2020, 8:05pm UTC](https://discuss.elastic.co/t/new-installation-unable-to-connect-to-kibana-7-9-2/256579 "2020-11-30T20:05:27Z")
Unable to connect to my kibana server. When connecting through my browser I get the message "refused to connect". This is a new installation. No visible errors in the kibana.log file. Not sure where to go from here. I'm … --- ## [Best Possible way to implement two words search](https://discuss.elastic.co/t/best-possible-way-to-implement-two-words-search/256837)
**Author:** [@Vipul\_Sharma](https://discuss.elastic.co/u/Vipul_Sharma)\ **Replies:** 0\ **Last updated:** [November 27, 2020, 5:37am UTC](https://discuss.elastic.co/t/best-possible-way-to-implement-two-words-search/256837 "2020-11-27T05:37:39Z")
Hi, I was wondering what would be the best possible way to write a ES query to fetch the documents in a way that if the search query is like: 'elastic search' Then on the top it will show all the documents with 'elast… --- ## [How to use the result of two buckets count divison in alerts?](https://discuss.elastic.co/t/how-to-use-the-result-of-two-buckets-count-divison-in-alerts/257109)
**Author:** [@I\_Hathout](https://discuss.elastic.co/u/I_Hathout)\ **Replies:** 0\ **Last updated:** [November 30, 2020, 6:03pm UTC](https://discuss.elastic.co/t/how-to-use-the-result-of-two-buckets-count-divison-in-alerts/257109 "2020-11-30T18:03:18Z")
I 've a filter that contains data from two indices payment\_transfer and payment\_transfer\_failure. I want to set an alert of the number of transfer\_failure\_count in a month/ number of transfers whiten the same month is ab… --- ## [Change section type?](https://discuss.elastic.co/t/change-section-type/256570)
**Author:** [@Matias\_Gerstner](https://discuss.elastic.co/u/Matias_Gerstner)\ **Replies:** 5\ **Last updated:** [November 30, 2020, 7:37pm UTC](https://discuss.elastic.co/t/change-section-type/256570 "2020-11-30T19:37:45Z")
Hello, my English is not very good, but I want to ask you a question, to see if it is possible what I am trying to do or not. I need to change the NAME of the "type" section, in several indices already created and wit… --- ## [Filter individual json fields using json filters](https://discuss.elastic.co/t/filter-individual-json-fields-using-json-filters/257028)
**Author:** [@naveenrt23](https://discuss.elastic.co/u/naveenrt23)\ **Replies:** 16\ **Last updated:** [November 30, 2020, 7:34pm UTC](https://discuss.elastic.co/t/filter-individual-json-fields-using-json-filters/257028 "2020-11-30T19:34:20Z")
I'm trying to parse my message into json fields using Json filters but running into issues Error: Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::Configurati… --- ## [Can we override the way data gets stored in elasticsearch](https://discuss.elastic.co/t/can-we-override-the-way-data-gets-stored-in-elasticsearch/257106)
**Author:** [@Vivek\_Sagar](https://discuss.elastic.co/u/Vivek_Sagar)\ **Replies:** 4\ **Last updated:** [November 30, 2020, 7:27pm UTC](https://discuss.elastic.co/t/can-we-override-the-way-data-gets-stored-in-elasticsearch/257106 "2020-11-30T19:27:20Z")
Is there a way to override how the data is stored in elasticsearch? I want to encrypt the data just before elasticsearch writes it to file system and just before sending the search query to file-system send the encrypted… --- ## [Close Index Api warning in ES version 6.8](https://discuss.elastic.co/t/close-index-api-warning-in-es-version-6-8/256662)
**Author:** [@mrudrego](https://discuss.elastic.co/u/mrudrego)\ **Replies:** 5\ **Last updated:** [November 30, 2020, 7:24pm UTC](https://discuss.elastic.co/t/close-index-api-warning-in-es-version-6-8/256662 "2020-11-30T19:24:29Z")
Hi, There is a warning in Elasticsearch 6.8 version document about Close index api which states To reduce the risk of data loss, avoid keeping closed indices in your cluster for long periods of time. When a node leave… --- ## [Is there a SIMILAR TO in Elasticsearch SQL?](https://discuss.elastic.co/t/is-there-a-similar-to-in-elasticsearch-sql/256595)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 7:10pm UTC](https://discuss.elastic.co/t/is-there-a-similar-to-in-elasticsearch-sql/256595 "2020-11-30T19:10:42Z")
Hi, I want to match several values in a Elasticsearch SQL query, is there something like "SIMILAR TO" to do this? WHERE items SIMILAR TO 'CPU Porcentual|CPU Utilization' --- ## [Ensuring uniqueness of IDs across indices during insertion](https://discuss.elastic.co/t/ensuring-uniqueness-of-ids-across-indices-during-insertion/257113)
**Author:** [@jmaharjan](https://discuss.elastic.co/u/jmaharjan)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 6:44pm UTC](https://discuss.elastic.co/t/ensuring-uniqueness-of-ids-across-indices-during-insertion/257113 "2020-11-30T18:44:01Z")
From what I understand, if we assign explicit ids to documents we might end up with multiple documents with the same id in different indices. Is there a way to ensure, when using explicit document ids, that a document id… --- ## [Searching terms in Inverted index](https://discuss.elastic.co/t/searching-terms-in-inverted-index/257111)
**Author:** [@prasad.deshpande](https://discuss.elastic.co/u/prasad.deshpande)\ **Replies:** 0\ **Last updated:** [November 30, 2020, 6:16pm UTC](https://discuss.elastic.co/t/searching-terms-in-inverted-index/257111 "2020-11-30T18:16:06Z")
Is there a way in Elasticsearch in which I can search all the terms in the inverted index? So say, if I want to find all the terms (Not the documents..) starting with au and ending with o. I know that there is a \_termve… --- ## [Strange behavior with date histogram aggregation in a field that is inside a nested object (Elasticsearch 7.10.0)](https://discuss.elastic.co/t/strange-behavior-with-date-histogram-aggregation-in-a-field-that-is-inside-a-nested-object-elasticsearch-7-10-0/256823)
**Author:** [@tberne](https://discuss.elastic.co/u/tberne)\ **Replies:** 7\ **Last updated:** [November 30, 2020, 6:11pm UTC](https://discuss.elastic.co/t/strange-behavior-with-date-histogram-aggregation-in-a-field-that-is-inside-a-nested-object-elasticsearch-7-10-0/256823 "2020-11-30T18:11:54Z")
Hi! I'm in the middle of an upgrade process to the 7.10.0 Elasticsearch (changing the client from TransportClient to JavaRestHighLevelClient also) and I've noticed a strange behavior of Date Histogram Aggregation when i… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1668) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1670)