# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1685 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1686 --- ## [Unable to do Cross Cluster Searching in AWS with Instances in Separate Regions](https://discuss.elastic.co/t/unable-to-do-cross-cluster-searching-in-aws-with-instances-in-separate-regions/252707)
**Author:** [@jim1](https://discuss.elastic.co/u/jim1)\ **Replies:** 5\ **Last updated:** [November 20, 2020, 5:53pm UTC](https://discuss.elastic.co/t/unable-to-do-cross-cluster-searching-in-aws-with-instances-in-separate-regions/252707 "2020-11-20T17:53:08Z")
Hello, I have two clusters installed on EC2 instances in separate regions in AWS. I am trying to use the cross cluster search feature in order to query both clusters from one central location. When I try to connect to t… --- ## [Logstash add @version which is not in the original document](https://discuss.elastic.co/t/logstash-add-version-which-is-not-in-the-original-document/256144)
**Author:** [@amralieg](https://discuss.elastic.co/u/amralieg)\ **Replies:** 3\ **Last updated:** [November 20, 2020, 4:23pm UTC](https://discuss.elastic.co/t/logstash-add-version-which-is-not-in-the-original-document/256144 "2020-11-20T16:23:04Z")
Hi, I have this logstash config that moves data between 2 elasticsearch, when I run it I get this error, any idea how to solve this? input { elasticsearch { hosts =\> \["\"\] user =\> "\*\*" … --- ## [Logstash imap plugin read a lot of Duplication email](https://discuss.elastic.co/t/logstash-imap-plugin-read-a-lot-of-duplication-email/256150)
**Author:** [@shawn\_sun](https://discuss.elastic.co/u/shawn_sun)\ **Replies:** 0\ **Last updated:** [November 20, 2020, 3:59pm UTC](https://discuss.elastic.co/t/logstash-imap-plugin-read-a-lot-of-duplication-email/256150 "2020-11-20T15:59:28Z")
version： logstash7.8.0 and elasticsearch7.8.0 When I use Logstash imap input plugin to read email from IMAP server，The elasticsearch recive many repeat email this is logstash.conf input { imap { host =\> "imap.ma… --- ## [Dashboard Creation Restrictions](https://discuss.elastic.co/t/dashboard-creation-restrictions/255849)
**Author:** [@teej](https://discuss.elastic.co/u/teej)\ **Replies:** 2\ **Last updated:** [November 20, 2020, 3:58pm UTC](https://discuss.elastic.co/t/dashboard-creation-restrictions/255849 "2020-11-20T15:58:51Z")
Hi, I am wanting to create two groups of users. Can create Dashboards but not delete any Can use others Dashboards but not create/delete any Both groups should only see the dashboards created by for them by admin or … --- ## [Match single keyword search term against multiple index keywords](https://discuss.elastic.co/t/match-single-keyword-search-term-against-multiple-index-keywords/256145)
**Author:** [@duncRed](https://discuss.elastic.co/u/duncRed)\ **Replies:** 0\ **Last updated:** [November 20, 2020, 3:41pm UTC](https://discuss.elastic.co/t/match-single-keyword-search-term-against-multiple-index-keywords/256145 "2020-11-20T15:41:06Z")
We are looking to match a search term keyword against multiple keywords in the index. For example if someone searches on "1780pixel" the intention would be that this matches both the keywords "1780" and "pixel" in the i… --- ## [Parsing Windows DHCP Logs with Filebeat Microsoft Module](https://discuss.elastic.co/t/parsing-windows-dhcp-logs-with-filebeat-microsoft-module/254814)
**Author:** [@kkojouri](https://discuss.elastic.co/u/kkojouri)\ **Replies:** 5\ **Last updated:** [November 20, 2020, 3:22pm UTC](https://discuss.elastic.co/t/parsing-windows-dhcp-logs-with-filebeat-microsoft-module/254814 "2020-11-20T15:22:33Z")
Hello, We're trying to use the new microsoft.yml module in Filebeat 7.9.0 to ingest and parse Windows DHCP logs. The configuration seems pretty straightfoward, we just pointed it to the default C:\\Windows\\System32\\dhcp\\… --- ## [How to find problematic search which contributes to high load and CPU usages?](https://discuss.elastic.co/t/how-to-find-problematic-search-which-contributes-to-high-load-and-cpu-usages/254091)
**Author:** [@smlbiobot](https://discuss.elastic.co/u/smlbiobot)\ **Replies:** 10\ **Last updated:** [November 20, 2020, 3:21pm UTC](https://discuss.elastic.co/t/how-to-find-problematic-search-which-contributes-to-high-load-and-cpu-usages/254091 "2020-11-20T15:21:51Z")
Recently our cluster has seen spikes of high load on some nodes. My hunch is that it has to do with some specific searches, but how do you determine which searches are causing it? I have seen some posts here saying that… --- ## [Filebeat removed, but still logging](https://discuss.elastic.co/t/filebeat-removed-but-still-logging/255956)
**Author:** [@Elitlogik](https://discuss.elastic.co/u/Elitlogik)\ **Replies:** 2\ **Last updated:** [November 20, 2020, 3:18pm UTC](https://discuss.elastic.co/t/filebeat-removed-but-still-logging/255956 "2020-11-20T15:18:53Z")
I wanted to uninstall Filebeat (since I'm not there yet), so I did sudo yum remove filebeat. Successful. However, there are still logs generted as below. How come filebeat generate logs when it's uninstalled? 2020-11-1… --- ## [How to generate certificate to enable alerting in Kibana?](https://discuss.elastic.co/t/how-to-generate-certificate-to-enable-alerting-in-kibana/255658)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 3\ **Last updated:** [November 20, 2020, 3:08pm UTC](https://discuss.elastic.co/t/how-to-generate-certificate-to-enable-alerting-in-kibana/255658 "2020-11-20T15:08:29Z")
Hi, As documented here, I understand that there are 3 main steps / prerequisites to enable alerting in Kibana; Set up Kibana to work with Elastic Stack security features. Set up TLS encryption between Kibana and Ela… --- ## [Enable Xpack on Docker single node, getting "You do not have permission to access the requested page"](https://discuss.elastic.co/t/enable-xpack-on-docker-single-node-getting-you-do-not-have-permission-to-access-the-requested-page/255911)
**Author:** [@cwobuzz](https://discuss.elastic.co/u/cwobuzz)\ **Replies:** 4\ **Last updated:** [November 20, 2020, 3:08pm UTC](https://discuss.elastic.co/t/enable-xpack-on-docker-single-node-getting-you-do-not-have-permission-to-access-the-requested-page/255911 "2020-11-20T15:08:10Z")
I followed the example laid out here. https://github.com/elastic/stack-docs/blob/master/docs/en/getting-started/get-started-docker.asciidoc Had to make a couple of modifications due to only wanting a single node. I will… --- ## [Elasticsearch hadpop error :java.lang.NoClassDefFoundError: Could not initialize class org.elasticsearch.spark.serialization.ScalaMetadataExtractor](https://discuss.elastic.co/t/elasticsearch-hadpop-error-java-lang-noclassdeffounderror-could-not-initialize-class-org-elasticsearch-spark-serialization-scalametadataextractor/256136)
**Author:** [@Vishnu\_Singhal](https://discuss.elastic.co/u/Vishnu_Singhal)\ **Replies:** 0\ **Last updated:** [November 20, 2020, 3:00pm UTC](https://discuss.elastic.co/t/elasticsearch-hadpop-error-java-lang-noclassdeffounderror-could-not-initialize-class-org-elasticsearch-spark-serialization-scalametadataextractor/256136 "2020-11-20T15:00:52Z")
Receiving following error after upgrading to spark 3.0.0 with any of the version of elasticsearch-hadoop jar \ \org.elasticsearch\ \elasticsearch-hadoop\ **Author:** [@codewriterguy](https://discuss.elastic.co/u/codewriterguy)\ **Replies:** 3\ **Last updated:** [November 20, 2020, 3:00pm UTC](https://discuss.elastic.co/t/json-data-wont-upload/256041 "2020-11-20T15:00:42Z") Hi, First time user here so apologies if I'm not doing things correctly. I am trying to upload a JSON file, which consists of an array of JSON elements, the longest being \< 3100 characters. For whatever reason, the Data… --- ## [Scripted field for same month data](https://discuss.elastic.co/t/scripted-field-for-same-month-data/256121)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 3\ **Last updated:** [November 20, 2020, 2:57pm UTC](https://discuss.elastic.co/t/scripted-field-for-same-month-data/256121 "2020-11-20T14:57:34Z")
Hi All, We are trying to build a dashboard for a new scenario,like we are ingesting data from servicenow using logstash, the data has ticket information like opened and closed, we want to build a dashboard for monthly… --- ## [Kibana search appearing as json object?](https://discuss.elastic.co/t/kibana-search-appearing-as-json-object/255289)
**Author:** [@sandeep1-0](https://discuss.elastic.co/u/sandeep1-0)\ **Replies:** 4\ **Last updated:** [November 20, 2020, 2:48pm UTC](https://discuss.elastic.co/t/kibana-search-appearing-as-json-object/255289 "2020-11-20T14:48:30Z")
Hi, I have metricbeat data indexing to kibana but the same is appearing as json object object instead of showing it as different field. Is this due to some template issue or missed any setting. Currently coming in the … --- ## [Replicas allocation issue in a hot cold architecture](https://discuss.elastic.co/t/replicas-allocation-issue-in-a-hot-cold-architecture/255953)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 6\ **Last updated:** [November 20, 2020, 2:45pm UTC](https://discuss.elastic.co/t/replicas-allocation-issue-in-a-hot-cold-architecture/255953 "2020-11-20T14:45:29Z")
Hello ! I have the following cluster : node1 with attributes box\_type: hot and zone: zone1 node2 with attributes box\_type: hot and zone: zone1 node3 with attributes box\_type: hot and zone: zone2 node4 with attributes b… --- ## [Grok filter not working](https://discuss.elastic.co/t/grok-filter-not-working/256077)
**Author:** [@Ajinkya\_1](https://discuss.elastic.co/u/Ajinkya_1)\ **Replies:** 1\ **Last updated:** [November 20, 2020, 2:20pm UTC](https://discuss.elastic.co/t/grok-filter-not-working/256077 "2020-11-20T14:20:55Z")
My Grok filter is not working in logstash Even though it is working in grok debugger below is the grok string: \\((?\%{DAY} %{MONTH} %{MONTHNUM} %{TIME} %{YEAR})\\) \\\[(?\(.\*))\\\] \\\[%{DATA:function}\\\] \\(%… --- ## [How can I create the visualization of filling a glass regarding margins and the current value](https://discuss.elastic.co/t/how-can-i-create-the-visualization-of-filling-a-glass-regarding-margins-and-the-current-value/255701)
**Author:** [@borisllona](https://discuss.elastic.co/u/borisllona)\ **Replies:** 2\ **Last updated:** [November 20, 2020, 1:48pm UTC](https://discuss.elastic.co/t/how-can-i-create-the-visualization-of-filling-a-glass-regarding-margins-and-the-current-value/255701 "2020-11-20T13:48:16Z")
I need to create the visualization of filling a glass regarding margins with the current value, but I can't find any tutorial on how to do that. --- ## [How to create a field that indicates value gain (for example temperature) compared to yesterday](https://discuss.elastic.co/t/how-to-create-a-field-that-indicates-value-gain-for-example-temperature-compared-to-yesterday/255699)
**Author:** [@borisllona](https://discuss.elastic.co/u/borisllona)\ **Replies:** 2\ **Last updated:** [November 20, 2020, 1:47pm UTC](https://discuss.elastic.co/t/how-to-create-a-field-that-indicates-value-gain-for-example-temperature-compared-to-yesterday/255699 "2020-11-20T13:47:47Z")
So I need a text that could say, Today is +3°C more than yesterday. Thanks in advance --- ## [Matching multiple phrases to specific fields in Nest](https://discuss.elastic.co/t/matching-multiple-phrases-to-specific-fields-in-nest/256124)
**Author:** [@adiksl](https://discuss.elastic.co/u/adiksl)\ **Replies:** 0\ **Last updated:** [November 20, 2020, 1:47pm UTC](https://discuss.elastic.co/t/matching-multiple-phrases-to-specific-fields-in-nest/256124 "2020-11-20T13:47:19Z")
I have built an application in C# which searches my Elasticsearch documents and this all works fine using this code.... List\ resultsList = Client.SearchAsync\(s =\> s .From(0) .Take(noRows) … --- ## [No cached mapping for this field after upgrading to 7.10](https://discuss.elastic.co/t/no-cached-mapping-for-this-field-after-upgrading-to-7-10/256123)
**Author:** [@datawrangler](https://discuss.elastic.co/u/datawrangler)\ **Replies:** 0\ **Last updated:** [November 20, 2020, 1:29pm UTC](https://discuss.elastic.co/t/no-cached-mapping-for-this-field-after-upgrading-to-7-10/256123 "2020-11-20T13:29:35Z")
Hello all, I had some issues when upgrading to 7.9.3 that I had to upgrade to 7.10 and unfortunately I had to delete my "filebeat-\*" index pattern. After recreating the filebeat-\* index pattern, I am now unable to upda… --- ## [How can rename logstash fields](https://discuss.elastic.co/t/how-can-rename-logstash-fields/254867)
**Author:** [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)\ **Replies:** 6\ **Last updated:** [November 20, 2020, 1:17pm UTC](https://discuss.elastic.co/t/how-can-rename-logstash-fields/254867 "2020-11-20T13:17:26Z")
rename fields: Thanks --- ## [Rollup Fail: Existing mapping for field must be of type object](https://discuss.elastic.co/t/rollup-fail-existing-mapping-for-field-must-be-of-type-object/256122)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 0\ **Last updated:** [November 20, 2020, 1:13pm UTC](https://discuss.elastic.co/t/rollup-fail-existing-mapping-for-field-must-be-of-type-object/256122 "2020-11-20T13:13:00Z")
Our rollup job will not run and we are getting the following error log: \[991\]: index \[issues-prod1\], type \[\_doc\], id \[issues-prod1$ONEl7qIplbk6ayAuSYbUkA\], message \[MapperParsingException\[Could not dynamically add mappi… --- ## [Master not discovered or elected yet, an election requires 2 nodes with ids](https://discuss.elastic.co/t/master-not-discovered-or-elected-yet-an-election-requires-2-nodes-with-ids/256116)
**Author:** [@xziten](https://discuss.elastic.co/u/xziten)\ **Replies:** 1\ **Last updated:** [November 20, 2020, 12:42pm UTC](https://discuss.elastic.co/t/master-not-discovered-or-elected-yet-an-election-requires-2-nodes-with-ids/256116 "2020-11-20T12:42:00Z")
Hi, I'm trying to setup an elasticsearch Cluster. I know that this is a common topic but I would like to understand what I'm doing wrong. Here are some informations : OS : RHEL 7.8 ES Version : 7.10 Nodes : 3 Mast… --- ## [Logstash with mongo input adding a default "document" field onto ElasticSearch Output index](https://discuss.elastic.co/t/logstash-with-mongo-input-adding-a-default-document-field-onto-elasticsearch-output-index/256120)
**Author:** [@MDuarte](https://discuss.elastic.co/u/MDuarte)\ **Replies:** 0\ **Last updated:** [November 20, 2020, 12:23pm UTC](https://discuss.elastic.co/t/logstash-with-mongo-input-adding-a-default-document-field-onto-elasticsearch-output-index/256120 "2020-11-20T12:23:47Z")
Hi there, I'm new to ELK stack. Although, I've done quite some extensive research and wasn't able to find the answer to my current problem, so I was hoping someone could help me. I've been trying to ingest documents fr… --- ## [Get more UserInfos after Openid Login](https://discuss.elastic.co/t/get-more-userinfos-after-openid-login/256079)
**Author:** [@thetell75](https://discuss.elastic.co/u/thetell75)\ **Replies:** 2\ **Last updated:** [November 20, 2020, 12:15pm UTC](https://discuss.elastic.co/t/get-more-userinfos-after-openid-login/256079 "2020-11-20T12:15:19Z")
Hi folks, I just implemented the OpenID Login with AZURE Login. I also added Claims for personal informatione about the user logging in, like Family\_Name, Given\_Name and Email. But after Login I just do see that I am l… --- ## [Aggregation bucket in Vega returns an object not a bucket](https://discuss.elastic.co/t/aggregation-bucket-in-vega-returns-an-object-not-a-bucket/255906)
**Author:** [@Maria20](https://discuss.elastic.co/u/Maria20)\ **Replies:** 4\ **Last updated:** [November 20, 2020, 12:01pm UTC](https://discuss.elastic.co/t/aggregation-bucket-in-vega-returns-an-object-not-a-bucket/255906 "2020-11-20T12:01:33Z")
Hi, I am following a tutorial on Vega visualization on Kibana. The tutorial is similar to draw a graph of bars using aggregation. I followed the steps mentioned in this thread. However, my graph is not displayed, when I… --- ## [Unexpected exception \[\_license\] error](https://discuss.elastic.co/t/unexpected-exception-license-error/256106)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 1\ **Last updated:** [November 20, 2020, 11:49am UTC](https://discuss.elastic.co/t/unexpected-exception-license-error/256106 "2020-11-20T11:49:29Z")
Hello, everyone! We have strange error in our elasticsearch log: \[2020-11-20T15:41:59,294\]\[ERROR\]\[c.a.o.s.f.OpenDistroSecurityFilter\] \[\\] Unexpected exception \[\_license\] InvalidIndexNameException\[Invalid index… --- ## [Multiple logs to different index - Filebeat](https://discuss.elastic.co/t/multiple-logs-to-different-index-filebeat/256003)
**Author:** [@Charakterny](https://discuss.elastic.co/u/Charakterny)\ **Replies:** 2\ **Last updated:** [November 20, 2020, 9:09am UTC](https://discuss.elastic.co/t/multiple-logs-to-different-index-filebeat/256003 "2020-11-20T09:09:38Z")
Hello, I have in one filebeat.yml two paths for two different logs and it works fine but I need to divide to two index. I tried as below: filebeat.inputs: - type: log enabled: true paths: - /var/log/nginx/\*.lo… --- ## [Why metricbeat is not picking up keystore entries?](https://discuss.elastic.co/t/why-metricbeat-is-not-picking-up-keystore-entries/256011)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 2\ **Last updated:** [November 20, 2020, 11:19am UTC](https://discuss.elastic.co/t/why-metricbeat-is-not-picking-up-keystore-entries/256011 "2020-11-20T11:19:10Z")
Hi, I am using elastic stack 7.9. I have a 3 node cluster and https is I have created certificates using elasticsearch-certutil command, which are generic, and I am using it across all nodes. I have the below files; e… --- ## [How to show fields value on Data table Columns?](https://discuss.elastic.co/t/how-to-show-fields-value-on-data-table-columns/255964)
**Author:** [@rmrodrigues](https://discuss.elastic.co/u/rmrodrigues)\ **Replies:** 2\ **Last updated:** [November 20, 2020, 11:11am UTC](https://discuss.elastic.co/t/how-to-show-fields-value-on-data-table-columns/255964 "2020-11-20T11:11:05Z")
Hi there, I'm a newbie here on Elastic. Just to give you some context about my journey here, I'm trying elastic to build a business analytics system. I have an index where the document is something like this: { … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1684) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1686)