# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1671

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1672

---

## [Strict search in Kibana](https://discuss.elastic.co/t/strict-search-in-kibana/256695)

<div class="topic-metadata">

**Author:** [@artobstrel](https://discuss.elastic.co/u/artobstrel)\
**Replies:** 3\
**Last updated:** [November 30, 2020, 10:25am UTC](https://discuss.elastic.co/t/strict-search-in-kibana/256695 "2020-11-30T10:25:02Z")

</div>

I'm looking for messages with 'mydomain.tld' homepage address only. Now i get this result: where "path" is random uri How to get below result without photoshop?

---

## [Index pattern routing](https://discuss.elastic.co/t/index-pattern-routing/256897)

<div class="topic-metadata">

**Author:** [@mats.ahlbom](https://discuss.elastic.co/u/mats.ahlbom)\
**Replies:** 3\
**Last updated:** [November 30, 2020, 10:19am UTC](https://discuss.elastic.co/t/index-pattern-routing/256897 "2020-11-30T10:19:10Z")

</div>

Hi, We have setup our cluster and we have some logs and metrics flowing in to Elastic. Now we have tried to add Gerrit logs and metrics. The problem I have is the metrics-data is in both of the Kibana patterns. I hav…

---

## [ES datanode can't join the cluster since disconnected from master](https://discuss.elastic.co/t/es-datanode-cant-join-the-cluster-since-disconnected-from-master/257023)

<div class="topic-metadata">

**Author:** [@AngryCookie](https://discuss.elastic.co/u/AngryCookie)\
**Replies:** 6\
**Last updated:** [November 30, 2020, 10:16am UTC](https://discuss.elastic.co/t/es-datanode-cant-join-the-cluster-since-disconnected-from-master/257023 "2020-11-30T10:16:20Z")

</div>

​ Hi, we are faced with a huge problem that is random nodes started disconnecting from the master and can't join to the cluster again util i restart it. First, the messages from master node.The master detects that a nod…

---

## [Logging into Cloud Kibana using React](https://discuss.elastic.co/t/logging-into-cloud-kibana-using-react/256963)

<div class="topic-metadata">

**Author:** [@Marek\_Kubiak](https://discuss.elastic.co/u/Marek_Kubiak)\
**Replies:** 1\
**Last updated:** [November 30, 2020, 10:00am UTC](https://discuss.elastic.co/t/logging-into-cloud-kibana-using-react/256963 "2020-11-30T10:00:07Z")

</div>

Hello Elastic maniacs, this is my first post, so just a quick introduction - my name is Marek and I work as a developer for a construction related company that analyses and visualised construction data using Elasticsear…

---

## [Bulk indexing requests are mostly queued on one node in the cluster](https://discuss.elastic.co/t/bulk-indexing-requests-are-mostly-queued-on-one-node-in-the-cluster/256652)

<div class="topic-metadata">

**Author:** [@swafa](https://discuss.elastic.co/u/swafa)\
**Replies:** 2\
**Last updated:** [November 30, 2020, 9:53am UTC](https://discuss.elastic.co/t/bulk-indexing-requests-are-mostly-queued-on-one-node-in-the-cluster/256652 "2020-11-30T09:53:07Z")

</div>

Hi, I'm noticing something peculiar when running our bulk indexing job against our Elasticsearch cluster (version 7.6.1). Our client uses 48 cores in total to bulk index into Elasticsearch. Each request contains a batc…

---

## [Result data duplicate](https://discuss.elastic.co/t/result-data-duplicate/256944)

<div class="topic-metadata">

**Author:** [@salma\_widiarti](https://discuss.elastic.co/u/salma_widiarti)\
**Replies:** 1\
**Last updated:** [November 30, 2020, 9:49am UTC](https://discuss.elastic.co/t/result-data-duplicate/256944 "2020-11-30T09:49:02Z")

</div>

Hi all, when I create a visualization with the count metric. the result is duplicated. what can i do so that the data is not duplicated?

---

## [EQL implementation within Kibana or Roadmap](https://discuss.elastic.co/t/eql-implementation-within-kibana-or-roadmap/256943)

<div class="topic-metadata">

**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\
**Replies:** 1\
**Last updated:** [November 30, 2020, 9:47am UTC](https://discuss.elastic.co/t/eql-implementation-within-kibana-or-roadmap/256943 "2020-11-30T09:47:51Z")

</div>

The normal EQL language: https://eql.readthedocs.io/en/latest/query-guide/pipes.html have quite lot of functionalities, but in current Kibana only head and tail functionalities are enabled. Any idea if Kibana will get t…

---

## [KIbana get killed automatically after csv export](https://discuss.elastic.co/t/kibana-get-killed-automatically-after-csv-export/256873)

<div class="topic-metadata">

**Author:** [@Ayadi](https://discuss.elastic.co/u/Ayadi)\
**Replies:** 2\
**Last updated:** [November 30, 2020, 9:20am UTC](https://discuss.elastic.co/t/kibana-get-killed-automatically-after-csv-export/256873 "2020-11-30T09:20:49Z")

</div>

Hi Guys I'm struggling with this problem since 2 weeks now everytime when I download a csv file with 1GB the kibana get killed I don't know why this the error that I get log \[12:18:40.381\] \[debug\]\[csv\]\[execute-job\]…

---

## [Downtime visualization in Kibana from logs](https://discuss.elastic.co/t/downtime-visualization-in-kibana-from-logs/256804)

<div class="topic-metadata">

**Author:** [@thirty2](https://discuss.elastic.co/u/thirty2)\
**Replies:** 1\
**Last updated:** [November 30, 2020, 9:18am UTC](https://discuss.elastic.co/t/downtime-visualization-in-kibana-from-logs/256804 "2020-11-30T09:18:13Z")

</div>

Hi, is it possible to create visualizatoin in Kibana from log messages for downtime? Example: at 18:01 i recieve syslog that server is down at 18:05 i recieve syslog that server is up. Would it be possible in Visual…

---

## [Embed Kibana dashboards/canvas into my website](https://discuss.elastic.co/t/embed-kibana-dashboards-canvas-into-my-website/256748)

<div class="topic-metadata">

**Author:** [@alex92360](https://discuss.elastic.co/u/alex92360)\
**Replies:** 1\
**Last updated:** [November 30, 2020, 9:14am UTC](https://discuss.elastic.co/t/embed-kibana-dashboards-canvas-into-my-website/256748 "2020-11-30T09:14:10Z")

</div>

Hello everyone, I have a question about Kibana dashboard/canvas use case. I have a website where my customers log in and where they can see their private data (tables mostly) regarding the machines they bought from me. …

---

## [Getting fatal: Not a git repository (or any of the parent directories): .git in logstash 7.4](https://discuss.elastic.co/t/getting-fatal-not-a-git-repository-or-any-of-the-parent-directories-git-in-logstash-7-4/257039)

<div class="topic-metadata">

**Author:** [@talbehat](https://discuss.elastic.co/u/talbehat)\
**Replies:** 0\
**Last updated:** [November 30, 2020, 9:08am UTC](https://discuss.elastic.co/t/getting-fatal-not-a-git-repository-or-any-of-the-parent-directories-git-in-logstash-7-4/257039 "2020-11-30T09:08:43Z")

</div>

any idea why this comes fatal: Not a git repository (or any of the parent directories): .git sh: git: command not found Thread.exclusive is deprecated, use Thread::Mutex

---

## [Building visualization in kibana by removing and grouping part of the value](https://discuss.elastic.co/t/building-visualization-in-kibana-by-removing-and-grouping-part-of-the-value/256502)

<div class="topic-metadata">

**Author:** [@Sivajanani](https://discuss.elastic.co/u/Sivajanani)\
**Replies:** 1\
**Last updated:** [November 30, 2020, 8:56am UTC](https://discuss.elastic.co/t/building-visualization-in-kibana-by-removing-and-grouping-part-of-the-value/256502 "2020-11-30T08:56:54Z")

</div>

Hello All, I have a field tag in which I have two kinds of values as below, tags: targetgeo:china,targetgeo:iran,geolocation:australia,geolocation:china I wanted to group and visualize using geo field values i.e china…

---

## [How to setup Kibana alerts Node, merticBeat and others?](https://discuss.elastic.co/t/how-to-setup-kibana-alerts-node-merticbeat-and-others/256445)

<div class="topic-metadata">

**Author:** [@Smit108](https://discuss.elastic.co/u/Smit108)\
**Replies:** 1\
**Last updated:** [November 30, 2020, 8:48am UTC](https://discuss.elastic.co/t/how-to-setup-kibana-alerts-node-merticbeat-and-others/256445 "2020-11-30T08:48:38Z")

</div>

how to setup alerts in kibana based on below needs? if node is down ? - can get the list of node by /\_cat/nodes?v&s how to check if beats is down ? (MerticBeat ,Filebeat, heartBeat, Auditbeat)? can we set alert …

---

## [Index template not match for logs](https://discuss.elastic.co/t/index-template-not-match-for-logs/257008)

<div class="topic-metadata">

**Author:** [@zakabluk](https://discuss.elastic.co/u/zakabluk)\
**Replies:** 2\
**Last updated:** [November 30, 2020, 8:39am UTC](https://discuss.elastic.co/t/index-template-not-match-for-logs/257008 "2020-11-30T08:39:55Z")

</div>

I tride create index template with ilm policy. My logsatsh output has index =\> "logstash-logs-lb-%{+YYYY.MM.dd}" Index template with config PUT \_template/logstash-logs-lb { "order": 0, "index\_patterns": \[ "lo…

---

## [Monitoring Logstash with metricbeat: Error connection refused](https://discuss.elastic.co/t/monitoring-logstash-with-metricbeat-error-connection-refused/256760)

<div class="topic-metadata">

**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\
**Replies:** 2\
**Last updated:** [November 30, 2020, 8:28am UTC](https://discuss.elastic.co/t/monitoring-logstash-with-metricbeat-error-connection-refused/256760 "2020-11-30T08:28:28Z")

</div>

Hello, I am trying to monitor my Logstash node using metricbeat, but I am getting these errors: Error fetching data for metricset logstash.node: error making http request: Get "https://X.X.X.X:9600/\_node": dial tcp X.X.…

---

## [Logstash Error after updating form 7.8.0 to 7.10.0, Pipeline error {:pipeline\_id=\>"main", :exception=\> javax.net.ssl.SSLException: failed to initialize the server-side SSL context](https://discuss.elastic.co/t/logstash-error-after-updating-form-7-8-0-to-7-10-0-pipeline-error-pipeline-id-main-exception-javax-net-ssl-sslexception-failed-to-initialize-the-server-side-ssl-context/255212)

<div class="topic-metadata">

**Author:** [@weeam\_Haj\_Ali](https://discuss.elastic.co/u/weeam_Haj_Ali)\
**Replies:** 15\
**Last updated:** [November 30, 2020, 8:13am UTC](https://discuss.elastic.co/t/logstash-error-after-updating-form-7-8-0-to-7-10-0-pipeline-error-pipeline-id-main-exception-javax-net-ssl-sslexception-failed-to-initialize-the-server-side-ssl-context/255212 "2020-11-30T08:13:15Z")

</div>

I update ELK stack from 7.8.0 to 7.10.0. I am facing this Error in logstash: \[ERROR\]\[logstash.javapipeline \]\[main\] Pipeline error {:pipeline\_id=\>"main", :exception=\> javax.net.ssl.SSLException: failed to initialize …

---

## [Clone plugin clone - how to use?](https://discuss.elastic.co/t/clone-plugin-clone-how-to-use/257027)

<div class="topic-metadata">

**Author:** [@vaclav1](https://discuss.elastic.co/u/vaclav1)\
**Replies:** 0\
**Last updated:** [November 30, 2020, 7:44am UTC](https://discuss.elastic.co/t/clone-plugin-clone-how-to-use/257027 "2020-11-30T07:44:35Z")

</div>

Hello, I tried to use clone plugin to get a single copy of the event. However, it did not work. Version of our elastic stack - 7.9.2. I have ids which are stored in one field - I use split on them and then I drop this…

---

## [New Elastic search cluster is not detecting other seed nodes](https://discuss.elastic.co/t/new-elastic-search-cluster-is-not-detecting-other-seed-nodes/255902)

<div class="topic-metadata">

**Author:** [@hello5346](https://discuss.elastic.co/u/hello5346)\
**Replies:** 4\
**Last updated:** [November 30, 2020, 7:05am UTC](https://discuss.elastic.co/t/new-elastic-search-cluster-is-not-detecting-other-seed-nodes/255902 "2020-11-30T07:05:10Z")

</div>

Hello All, I'm setting up a new Elasticsearch cluster with 3 nodes out of which 3 are master nodes and data nodes as well. The following is the config of the ES # ======================== Elasticsearch Configuration …

---

## [Getting Module not found error after installing plugin](https://discuss.elastic.co/t/getting-module-not-found-error-after-installing-plugin/256786)

<div class="topic-metadata">

**Author:** [@praveer](https://discuss.elastic.co/u/praveer)\
**Replies:** 2\
**Last updated:** [November 30, 2020, 6:25am UTC](https://discuss.elastic.co/t/getting-module-not-found-error-after-installing-plugin/256786 "2020-11-30T06:25:28Z")

</div>

Hi Team, I am working on 7.10.0 kibana. I have created a custom plugin and after deploying it was getting ssl certificate error. To solve that i had installed "ssl-root-cas" using this package I am adding required certi…

---

## [Help parse xml from logs file](https://discuss.elastic.co/t/help-parse-xml-from-logs-file/256989)

<div class="topic-metadata">

**Author:** [@Nurlan199206](https://discuss.elastic.co/u/Nurlan199206)\
**Replies:** 2\
**Last updated:** [November 30, 2020, 5:27am UTC](https://discuss.elastic.co/t/help-parse-xml-from-logs-file/256989 "2020-11-30T05:27:45Z")

</div>

Help pls parse xml data from log files. i'm trying use xml filter plugin my conf file filter { if "xml" in \[tags\] { xml { namespaces =\> { "soapenv" =\> "http://schemas.xmlsoap.org/soap/envelope/" …

---

## [Is ElasticSearch supports CephRBD or CephRBD-fast with RWO access?](https://discuss.elastic.co/t/is-elasticsearch-supports-cephrbd-or-cephrbd-fast-with-rwo-access/256759)

<div class="topic-metadata">

**Author:** [@sarthaksahu](https://discuss.elastic.co/u/sarthaksahu)\
**Replies:** 3\
**Last updated:** [November 30, 2020, 4:59am UTC](https://discuss.elastic.co/t/is-elasticsearch-supports-cephrbd-or-cephrbd-fast-with-rwo-access/256759 "2020-11-30T04:59:18Z")

</div>

Is ElasticSearch supports CephRBD or CephRBD-fast with RWO access ?

---

## [Error after setting up xpack security , elasticsearch is not starting after anbaling xpack](https://discuss.elastic.co/t/error-after-setting-up-xpack-security-elasticsearch-is-not-starting-after-anbaling-xpack/256699)

<div class="topic-metadata">

**Author:** [@siddesh\_patke](https://discuss.elastic.co/u/siddesh_patke)\
**Replies:** 1\
**Last updated:** [November 30, 2020, 4:50am UTC](https://discuss.elastic.co/t/error-after-setting-up-xpack-security-elasticsearch-is-not-starting-after-anbaling-xpack/256699 "2020-11-30T04:50:57Z")

</div>

tail -30 /var/log/elasticsearch/elkstack.log ---- LOg Error at org.elasticsearch.bootstrap.Bootstrap$5.\<init\>(Bootstrap.java:227) ~\[ …

---

## [Can't start elasticsearch systemctl](https://discuss.elastic.co/t/cant-start-elasticsearch-systemctl/256725)

<div class="topic-metadata">

**Author:** [@yowies\_lintar](https://discuss.elastic.co/u/yowies_lintar)\
**Replies:** 1\
**Last updated:** [November 30, 2020, 4:49am UTC](https://discuss.elastic.co/t/cant-start-elasticsearch-systemctl/256725 "2020-11-30T04:49:33Z")

</div>

elasticsearch\]# systemctl start elasticsearch Job for elasticsearch.service failed because the control process exited with error code. See "systemctl status elasticsearch.service" and "journalctl -xe" for details. elas…

---

## [Elasticsearch auto delete my data](https://discuss.elastic.co/t/elasticsearch-auto-delete-my-data/256980)

<div class="topic-metadata">

**Author:** [@Quang\_Quy](https://discuss.elastic.co/u/Quang_Quy)\
**Replies:** 6\
**Last updated:** [November 30, 2020, 4:39am UTC](https://discuss.elastic.co/t/elasticsearch-auto-delete-my-data/256980 "2020-11-30T04:39:52Z")

</div>

Hi everyone! I'm having a problem that after a while, the elastic automatically deletes all the data even though I didn't configure anything to automatically delete, this is the log. Is there a way to disable the elasti…

---

## [Parse Exception NoMethodDefined](https://discuss.elastic.co/t/parse-exception-nomethoddefined/256997)

<div class="topic-metadata">

**Author:** [@shani](https://discuss.elastic.co/u/shani)\
**Replies:** 0\
**Last updated:** [November 29, 2020, 5:41pm UTC](https://discuss.elastic.co/t/parse-exception-nomethoddefined/256997 "2020-11-29T17:41:51Z")

</div>

What should we do if raw xml log contains nil value, logstash throws exception like \> \[\[main\]\>worker0\] xml - Error parsing xml with XmlSimple {:source=\>"message", :value=\>"\<Event xmlns='http://schemas.microsoft.com/win/…

---

## [Logstash and frozen index](https://discuss.elastic.co/t/logstash-and-frozen-index/256593)

<div class="topic-metadata">

**Author:** [@mcantin](https://discuss.elastic.co/u/mcantin)\
**Replies:** 4\
**Last updated:** [November 30, 2020, 4:23am UTC](https://discuss.elastic.co/t/logstash-and-frozen-index/256593 "2020-11-30T04:23:19Z")

</div>

Hi, Last week, I froze old indexes (over a month). Everything worked and elasticsearch was faster. But since monday we have this error in loop in Logstash: \[2020-11-24T15:29:42,146\]\[INFO \]\[logstash.outputs.elasticsear…

---

## [Errors reindexing documents from version 6 to version 7](https://discuss.elastic.co/t/errors-reindexing-documents-from-version-6-to-version-7/256970)

<div class="topic-metadata">

**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\
**Replies:** 7\
**Last updated:** [November 30, 2020, 3:12am UTC](https://discuss.elastic.co/t/errors-reindexing-documents-from-version-6-to-version-7/256970 "2020-11-30T03:12:25Z")

</div>

I have a several hundred daily indexes indexed under versions 5 and 6. I have recently upgraded to 7.10 and now want to clean up and standardise my index mappings. I am attempting to reindex using a ruby program and th…

---

## [Export ingest pipeline in Beats \[7.x\]](https://discuss.elastic.co/t/export-ingest-pipeline-in-beats-7-x/256757)

<div class="topic-metadata">

**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\
**Replies:** 1\
**Last updated:** [November 30, 2020, 3:15am UTC](https://discuss.elastic.co/t/export-ingest-pipeline-in-beats-7-x/256757 "2020-11-30T03:15:59Z")

</div>

Hi, everyone I would like to know if there is a method like export template but for ingest pipelines, that is: filebeat export ingest module system \> system-ingest-pipeline.json The purpose of this is because sometime…

---

## [How can FileBeat access Kibana over SSL?](https://discuss.elastic.co/t/how-can-filebeat-access-kibana-over-ssl/256420)

<div class="topic-metadata">

**Author:** [@houmie](https://discuss.elastic.co/u/houmie)\
**Replies:** 6\
**Last updated:** [November 30, 2020, 3:03am UTC](https://discuss.elastic.co/t/how-can-filebeat-access-kibana-over-ssl/256420 "2020-11-30T03:03:06Z")

</div>

Hello, filebeat.inputs: - type: log paths: - /var/log/app-uwsgi/app.json json.keys\_under\_root: true json.add\_error\_key: true filebeat.config.modules: path: ${path.config}/modules.d/\*.yml reload.enabled: tr…

---

## [Delete Elasticsearch logs](https://discuss.elastic.co/t/delete-elasticsearch-logs/256639)

<div class="topic-metadata">

**Author:** [@hzarrabi](https://discuss.elastic.co/u/hzarrabi)\
**Replies:** 3\
**Last updated:** [November 30, 2020, 12:55am UTC](https://discuss.elastic.co/t/delete-elasticsearch-logs/256639 "2020-11-30T00:55:51Z")

</div>

Hi guys, I would like to delete elasticsearch logs placed in /var/log/elasticsearch older then 7 days. I can not find any parameter in log4j2.properties from ELastic official site. Do you have any idea about it or sho…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1670)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1672)
