# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1674 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1675 --- ## [Mixing proximity with exact an not exact](https://discuss.elastic.co/t/mixing-proximity-with-exact-an-not-exact/256824)
**Author:** [@Sucaz](https://discuss.elastic.co/u/Sucaz)\ **Replies:** 0\ **Last updated:** [November 26, 2020, 8:22pm UTC](https://discuss.elastic.co/t/mixing-proximity-with-exact-an-not-exact/256824 "2020-11-26T20:22:41Z")
Hi, Is there a way to mix search of words in distance, where one word is exact and the other one isn't, with query\_string? something like: (Exact("Fox") quick)~2 Is it a combination of quote\_field\_suffix (as in http… --- ## [Adding a basic user/pass authentication for ElasticSearch](https://discuss.elastic.co/t/adding-a-basic-user-pass-authentication-for-elasticsearch/256822)
**Author:** [@yattaes](https://discuss.elastic.co/u/yattaes)\ **Replies:** 0\ **Last updated:** [November 26, 2020, 8:17pm UTC](https://discuss.elastic.co/t/adding-a-basic-user-pass-authentication-for-elasticsearch/256822 "2020-11-26T20:17:14Z")
Hi, I deployed Elasticsearch with the following the page below to my Azure Kubernetes environment. Deploy an Elasticsearch cluster | Elastic Cloud on Kubernetes \[master\] | Elastic It works fine. But I want to add a… --- ## [OOM on Elasticsearch client](https://discuss.elastic.co/t/oom-on-elasticsearch-client/256821)
**Author:** [@vikramc](https://discuss.elastic.co/u/vikramc)\ **Replies:** 0\ **Last updated:** [November 26, 2020, 8:03pm UTC](https://discuss.elastic.co/t/oom-on-elasticsearch-client/256821 "2020-11-26T20:03:52Z")
Hi All, We are using ES 6.8.0 and we see that our applicaiton is going out of memory after certain crossing certain threshold of data processing. We see that there are lots of “io.netty.channel.ChannelOutboundBuffer$Ent… --- ## [CONVERT GSM COORDINATE TO GD COORDINATE](https://discuss.elastic.co/t/convert-gsm-coordinate-to-gd-coordinate/256664)
**Author:** [@Daniel\_Lopez](https://discuss.elastic.co/u/Daniel_Lopez)\ **Replies:** 3\ **Last updated:** [November 26, 2020, 7:57pm UTC](https://discuss.elastic.co/t/convert-gsm-coordinate-to-gd-coordinate/256664 "2020-11-26T19:57:25Z")
Hi to all I'm just trying to convert GSM to GD For example GMS N 39° 56' 41.673'' O 3° 43' 47.872'' to GET GD 39.94490923478156 and -3.729964618217764 I have this config csv { columns =\> \["MCC","MNC","LAC","CI"… --- ## [How to delete all documents that a field have specific length?](https://discuss.elastic.co/t/how-to-delete-all-documents-that-a-field-have-specific-length/256813)
**Author:** [@Ehsan\_sarshar](https://discuss.elastic.co/u/Ehsan_sarshar)\ **Replies:** 1\ **Last updated:** [November 26, 2020, 7:13pm UTC](https://discuss.elastic.co/t/how-to-delete-all-documents-that-a-field-have-specific-length/256813 "2020-11-26T19:13:43Z")
for example I have following documents { term: "bo" }, { term: "book" } I want to delete all documents that "term" field length is less than 3 --- ## [Does Kibana supports a big csv exports?](https://discuss.elastic.co/t/does-kibana-supports-a-big-csv-exports/256714)
**Author:** [@Ayadi](https://discuss.elastic.co/u/Ayadi)\ **Replies:** 3\ **Last updated:** [November 26, 2020, 6:37pm UTC](https://discuss.elastic.co/t/does-kibana-supports-a-big-csv-exports/256714 "2020-11-26T18:37:02Z")
Hi Guys I'm facing a problem with the exports in Kibana since a week now and I will be happy, if I can get some help here. I want to generate big csv reports from kibana that could reach 3 Gb And I was surprised that e… --- ## [Does Kibana supports a big csv exports?](https://discuss.elastic.co/t/does-kibana-supports-a-big-csv-exports/256395)
**Author:** [@Ayadi](https://discuss.elastic.co/u/Ayadi)\ **Replies:** 3\ **Last updated:** [November 26, 2020, 6:35pm UTC](https://discuss.elastic.co/t/does-kibana-supports-a-big-csv-exports/256395 "2020-11-26T18:35:56Z")
Hi Guys I'm facing a problem with the exports in Kibana since a week now and I will be happy, if I can get some help here. I want to generate big csv reports from kibana that could reach 3 Gb And I was surprised that e… --- ## [Getting 502, when TSVB is disabled](https://discuss.elastic.co/t/getting-502-when-tsvb-is-disabled/255501)
**Author:** [@rwgron](https://discuss.elastic.co/u/rwgron)\ **Replies:** 1\ **Last updated:** [November 26, 2020, 5:59pm UTC](https://discuss.elastic.co/t/getting-502-when-tsvb-is-disabled/255501 "2020-11-26T17:59:14Z")
Does Kibana version 5.6.15 support disabling TSVB? To cover our vulnerability which described in CVE-2020-7013, we should disable TSVB. for that, I set metrics.enabled: false in kibana.yml, but after applying I'm gettin… --- ## [Specify Module Pipeline in Kubernetes Annotation](https://discuss.elastic.co/t/specify-module-pipeline-in-kubernetes-annotation/256802)
**Author:** [@Paul\_B](https://discuss.elastic.co/u/Paul_B)\ **Replies:** 0\ **Last updated:** [November 26, 2020, 5:13pm UTC](https://discuss.elastic.co/t/specify-module-pipeline-in-kubernetes-annotation/256802 "2020-11-26T17:13:35Z")
Is it possible to specify a custom pipeline for a module using hints-based autodiscover? An Elastic team member pointed me to the documentation here - https://www.elastic.co/guide/en/beats/filebeat/master/advanced-setti… --- ## [Saved "field" parameter is now invalid. Please select a new field](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/256413)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 15\ **Last updated:** [November 26, 2020, 5:00pm UTC](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/256413 "2020-11-26T17:00:55Z")
Hi, Currently using ELK 7.9.2. I have been using Winlogbeat for a while now. I created some custom visualizations and dashboards that read from winlogbeat-\* indexes. Everything was working fine just a few days ago, unt… --- ## [Request for Filebeat AWS CloudTrail Documentation/Configuration Options for s3prefix, etc](https://discuss.elastic.co/t/request-for-filebeat-aws-cloudtrail-documentation-configuration-options-for-s3prefix-etc/256801)
**Author:** [@Adam\_Krieger](https://discuss.elastic.co/u/Adam_Krieger)\ **Replies:** 0\ **Last updated:** [November 26, 2020, 4:49pm UTC](https://discuss.elastic.co/t/request-for-filebeat-aws-cloudtrail-documentation-configuration-options-for-s3prefix-etc/256801 "2020-11-26T16:49:52Z")
Regarding CloudTrail setup in filebeat for delivery via SQS Message and S3 Object Get: Current setup only allows read if the CloudTrail is pointed to the root of the S3 bucket. Could a 'var.s3prefix' option be added t… --- ## [Logstash conditional elasticsearch output plugin depends on success of S3 output plugin](https://discuss.elastic.co/t/logstash-conditional-elasticsearch-output-plugin-depends-on-success-of-s3-output-plugin/256800)
**Author:** [@Abolurah](https://discuss.elastic.co/u/Abolurah)\ **Replies:** 0\ **Last updated:** [November 26, 2020, 4:49pm UTC](https://discuss.elastic.co/t/logstash-conditional-elasticsearch-output-plugin-depends-on-success-of-s3-output-plugin/256800 "2020-11-26T16:49:19Z")
Hi All, In my Logstash configuration, I have 2 output plugins, one is S3 and another is Elasticsearch. My goal is to send logs to S3 and update the same logs with "uploadStatus = finished", everything works fine until … --- ## [Can timelion's title be a result of a query?](https://discuss.elastic.co/t/can-timelions-title-be-a-result-of-a-query/255285)
**Author:** [@Wang\_Hay\_Ng](https://discuss.elastic.co/u/Wang_Hay_Ng)\ **Replies:** 1\ **Last updated:** [November 26, 2020, 4:41pm UTC](https://discuss.elastic.co/t/can-timelions-title-be-a-result-of-a-query/255285 "2020-11-26T16:41:04Z")
i have a timelion graph displaying an on off switch's status, which returns a 1/0 value, i also have a scripted field that returns on/off string base on the value, i know i can showit with a plain text visualization, but… --- ## [Filter for content of specific field of second index](https://discuss.elastic.co/t/filter-for-content-of-specific-field-of-second-index/256796)
**Author:** [@elk51211](https://discuss.elastic.co/u/elk51211)\ **Replies:** 0\ **Last updated:** [November 26, 2020, 4:35pm UTC](https://discuss.elastic.co/t/filter-for-content-of-specific-field-of-second-index/256796 "2020-11-26T16:35:19Z")
Hello, I'm trying to setup a filter that creates unique fingerprints if username does not already exists in index identities. Otherwise look up the value of the created pseudoId and put this in the event index. How do a… --- ## [Elastic APIs versioning and usage without breaking the integrated services](https://discuss.elastic.co/t/elastic-apis-versioning-and-usage-without-breaking-the-integrated-services/256483)
**Author:** [@es\_user2](https://discuss.elastic.co/u/es_user2)\ **Replies:** 7\ **Last updated:** [November 26, 2020, 4:30pm UTC](https://discuss.elastic.co/t/elastic-apis-versioning-and-usage-without-breaking-the-integrated-services/256483 "2020-11-26T16:30:15Z")
hi Team, we have few queries on Elasticserach APIs: Suppose we have used an API in our code and there is a version upgrade. How to handle the version change ? Will it not break our code integration with this API ? (If … --- ## [Kibana @ docker no logfiles](https://discuss.elastic.co/t/kibana-docker-no-logfiles/256766)
**Author:** [@Waxman](https://discuss.elastic.co/u/Waxman)\ **Replies:** 4\ **Last updated:** [November 26, 2020, 4:09pm UTC](https://discuss.elastic.co/t/kibana-docker-no-logfiles/256766 "2020-11-26T16:09:46Z")
Hi There, I run kibana on docker-compose, but I cannot see the logfiles. Here is the part of the docker compose file with volumes mapped: indent preformatted text by 4 spaces volumes: - /srv/Docker/config:/usr/… --- ## [Canvas - Line Chart Element with Date for X Axis - Sometimes displays timestamp, sometimes doesn't](https://discuss.elastic.co/t/canvas-line-chart-element-with-date-for-x-axis-sometimes-displays-timestamp-sometimes-doesnt/255249)
**Author:** [@devbot](https://discuss.elastic.co/u/devbot)\ **Replies:** 1\ **Last updated:** [November 26, 2020, 4:05pm UTC](https://discuss.elastic.co/t/canvas-line-chart-element-with-date-for-x-axis-sometimes-displays-timestamp-sometimes-doesnt/255249 "2020-11-26T16:05:37Z")
I have a line chart element in Kibana canvas with a timestamp being used as the X axis. Depending on the results of the query behind this element, sometimes the X axis will show date and time (ex: "Nov 11 00:00") and so… --- ## [Query DSL causes SearchPhaseExecutionException](https://discuss.elastic.co/t/query-dsl-causes-searchphaseexecutionexception/256118)
**Author:** [@andrewKode](https://discuss.elastic.co/u/andrewKode)\ **Replies:** 4\ **Last updated:** [November 26, 2020, 3:57pm UTC](https://discuss.elastic.co/t/query-dsl-causes-searchphaseexecutionexception/256118 "2020-11-26T15:57:21Z")
Hey! I'm trying to visualize data for multiple documents. Since I'm not being able to import a file with the ids of the documents in Kibana, I'm building a Query DSL using a Python script. The query works just fine in … --- ## [ElasticSearch aggregation for recommendation engine](https://discuss.elastic.co/t/elasticsearch-aggregation-for-recommendation-engine/256789)
**Author:** [@martsuga](https://discuss.elastic.co/u/martsuga)\ **Replies:** 1\ **Last updated:** [November 26, 2020, 3:52pm UTC](https://discuss.elastic.co/t/elasticsearch-aggregation-for-recommendation-engine/256789 "2020-11-26T15:52:36Z")
I need some advice for aggregations. I am trying to build a recommendation engine based on existing ElasticSearch data but i am out of ideas how to build this query with aggregations. The easiest way would be to use "s… --- ## [Metricbeat view on syn\_recv tcp\_connections](https://discuss.elastic.co/t/metricbeat-view-on-syn-recv-tcp-connections/256781)
**Author:** [@Jo\_De\_Troy](https://discuss.elastic.co/u/Jo_De_Troy)\ **Replies:** 0\ **Last updated:** [November 26, 2020, 2:30pm UTC](https://discuss.elastic.co/t/metricbeat-view-on-syn-recv-tcp-connections/256781 "2020-11-26T14:30:38Z")
Hello, I have metricbeat collecting the socket\_summary metricset of the system module. I see on github \[socket\_summary\](https://github.com/elastic/beats/blob/master/metricbeat/module/system/socket\_summary/socket\_summa… --- ## [Running another logstash instance incase one logstash fails](https://discuss.elastic.co/t/running-another-logstash-instance-incase-one-logstash-fails/256656)
**Author:** [@mahi2](https://discuss.elastic.co/u/mahi2)\ **Replies:** 3\ **Last updated:** [November 26, 2020, 2:54pm UTC](https://discuss.elastic.co/t/running-another-logstash-instance-incase-one-logstash-fails/256656 "2020-11-26T14:54:35Z")
Hi, I have a scenario where one logstash is already running, and for some reason the machine fails. I want the process to keep going and not wait for the machine to be restarted.It must automatically start taking data f… --- ## [Persistent queue, drop?](https://discuss.elastic.co/t/persistent-queue-drop/256785)
**Author:** [@diecode](https://discuss.elastic.co/u/diecode)\ **Replies:** 0\ **Last updated:** [November 26, 2020, 2:42pm UTC](https://discuss.elastic.co/t/persistent-queue-drop/256785 "2020-11-26T14:42:59Z")
Hey, I am using persistent queue in my logstash with aggregate filter. I would like drop few incoming syslog message in filter, but when I use drop, then it will not removed from queue, thus my queue reach the maximum l… --- ## [Create copy of visualization that uses a different index as data source?](https://discuss.elastic.co/t/create-copy-of-visualization-that-uses-a-different-index-as-data-source/256382)
**Author:** [@smlbiobot](https://discuss.elastic.co/u/smlbiobot)\ **Replies:** 2\ **Last updated:** [November 26, 2020, 2:23pm UTC](https://discuss.elastic.co/t/create-copy-of-visualization-that-uses-a-different-index-as-data-source/256382 "2020-11-26T14:23:58Z")
I have found that the visualizations (line charts, tables) are tied to its data source, and no easy way to edit it. Often, I have built a complex visualization that I can use for another index as a starting point, but I … --- ## [How to create dynamic tree view](https://discuss.elastic.co/t/how-to-create-dynamic-tree-view/253392)
**Author:** [@praveer](https://discuss.elastic.co/u/praveer)\ **Replies:** 10\ **Last updated:** [November 26, 2020, 2:02pm UTC](https://discuss.elastic.co/t/how-to-create-dynamic-tree-view/253392 "2020-11-26T14:02:47Z")
Hi Team, I have created custom plugin in Kibana. In my plugin I have a requirement in which I have to create a dynamic tree view. Which would enable user to add/remove nodes from tree view at runtime. It would also be h… --- ## [No event collected from Sysmon (winlogbeat)](https://discuss.elastic.co/t/no-event-collected-from-sysmon-winlogbeat/256775)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 0\ **Last updated:** [November 26, 2020, 1:51pm UTC](https://discuss.elastic.co/t/no-event-collected-from-sysmon-winlogbeat/256775 "2020-11-26T13:51:56Z")
Hello, I have installed sysmon in a Windows machine using the command: sysmon.exe -i -accepteula -h md5,sha256,imphash -l -n And then restart winlogbeat. In winlogbeat log everything is working well, and i have logs l… --- ## [Facing data too large exception frequently](https://discuss.elastic.co/t/facing-data-too-large-exception-frequently/255943)
**Author:** [@Divy\_Garg](https://discuss.elastic.co/u/Divy_Garg)\ **Replies:** 4\ **Last updated:** [November 26, 2020, 1:51pm UTC](https://discuss.elastic.co/t/facing-data-too-large-exception-frequently/255943 "2020-11-26T13:51:00Z")
CircuitBreakingException\[\[parent\] Data too large, data for \[internal:index/shard/recovery/start\_recovery\] would be \[7805417954/7.2gb\], which is larger than the limit of \[6941363404/6.4gb\], real usage: \[7805416568/7.2gb\],… --- ## [Filebeat исключить kubernetes namespace](https://discuss.elastic.co/t/filebeat-kubernetes-namespace/256499)
**Author:** [@Nurlan199206](https://discuss.elastic.co/u/Nurlan199206)\ **Replies:** 2\ **Last updated:** [November 25, 2020, 7:54am UTC](https://discuss.elastic.co/t/filebeat-kubernetes-namespace/256499 "2020-11-25T07:54:12Z")
Filebeat работает как DaemonSet в kubernetes. Пытаюсь исключить некоторые namespace, такие как "kube-system" и "calico-system". ConfigMap: filebeat.yml выглядит следующим образом. Что я делаю не так? С таким конфигом во… --- ## [Elasticsearch 7.10 does not start on MacOS](https://discuss.elastic.co/t/elasticsearch-7-10-does-not-start-on-macos/256740)
**Author:** [@snicoll](https://discuss.elastic.co/u/snicoll)\ **Replies:** 7\ **Last updated:** [November 26, 2020, 1:17pm UTC](https://discuss.elastic.co/t/elasticsearch-7-10-does-not-start-on-macos/256740 "2020-11-26T13:17:49Z")
I am very confused. I've downloaded the latest ELK stack to make a test on my machine. I am on MacOS 10.15.7 and Java 11 Here's what I did: Unzip the tar somewhere in my home directory cd to the elasticsearch invoke b… --- ## [S3 buckets data format unknown](https://discuss.elastic.co/t/s3-buckets-data-format-unknown/256773)
**Author:** [@shani](https://discuss.elastic.co/u/shani)\ **Replies:** 0\ **Last updated:** [November 26, 2020, 1:05pm UTC](https://discuss.elastic.co/t/s3-buckets-data-format-unknown/256773 "2020-11-26T13:05:13Z")
HI, I've 50K+ documents of unknown log format that can't be segregated until someone manually open and read the document content. Is there any way to take all documents data in input and make it parse them? What should … --- ## [Index deleted, want to restore from backup](https://discuss.elastic.co/t/index-deleted-want-to-restore-from-backup/256770)
**Author:** [@Arbind\_Bhagat](https://discuss.elastic.co/u/Arbind_Bhagat)\ **Replies:** 0\ **Last updated:** [November 26, 2020, 12:34pm UTC](https://discuss.elastic.co/t/index-deleted-want-to-restore-from-backup/256770 "2020-11-26T12:34:50Z")
All of my index have been deleted. So, I don't see them in Kibana. Of course, all the corresponding data has also been deleted. However, I do have the backup of the disk that contains all the files and folders. In this… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1673) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1675)