# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1688 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1689 --- ## [Filebeat is not sending logs to logstash](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-logstash/255855)
**Author:** [@Jurilz](https://discuss.elastic.co/u/Jurilz)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 12:48pm UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-logstash/255855 "2020-11-19T12:48:58Z")
I'm trying to read Tomcat logfiles with filebeat, send them to logstash, format them and forward them to elasticsearch. Problem: I'm pretty sure the logs never reach logstash, because they don't apper at stdout version… --- ## [Is there a way to customise the order of the x axis values in visualisations](https://discuss.elastic.co/t/is-there-a-way-to-customise-the-order-of-the-x-axis-values-in-visualisations/254912)
**Author:** [@casreenath](https://discuss.elastic.co/u/casreenath)\ **Replies:** 4\ **Last updated:** [November 19, 2020, 12:26pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-customise-the-order-of-the-x-axis-values-in-visualisations/254912 "2020-11-19T12:26:57Z")
The order of the x-axis seems to not match my requirement. Is there a way I can customise it to the order I need. I basically want the values to be sorted and the value 'imix' to be at the end. --- ## [What is the replacement for "index.mapper.dynamic":"true" in ES version 6.8.0 to ES version 7.9.3](https://discuss.elastic.co/t/what-is-the-replacement-for-index-mapper-dynamic-true-in-es-version-6-8-0-to-es-version-7-9-3/255968)
**Author:** [@Tamil\_Selvan](https://discuss.elastic.co/u/Tamil_Selvan)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 12:14pm UTC](https://discuss.elastic.co/t/what-is-the-replacement-for-index-mapper-dynamic-true-in-es-version-6-8-0-to-es-version-7-9-3/255968 "2020-11-19T12:14:46Z")
What is the replacement for "index.mapper.dynamic":"true" in ES version 6.8.0 to ES version 7.9.3 --- ## [Does DELETE /\_all actually erase data from disk?](https://discuss.elastic.co/t/does-delete-all-actually-erase-data-from-disk/255973)
**Author:** [@mahalabobis](https://discuss.elastic.co/u/mahalabobis)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 12:13pm UTC](https://discuss.elastic.co/t/does-delete-all-actually-erase-data-from-disk/255973 "2020-11-19T12:13:43Z")
What does the below request mean? curl -X DELETE http://elasticsearch:9200/\_all Does it erase data from disk? If not how can I achieve this? --- ## [Spring StringQuery not working while actual query directly works on postman](https://discuss.elastic.co/t/spring-stringquery-not-working-while-actual-query-directly-works-on-postman/255882)
**Author:** [@satyarajp](https://discuss.elastic.co/u/satyarajp)\ **Replies:** 2\ **Last updated:** [November 19, 2020, 12:07pm UTC](https://discuss.elastic.co/t/spring-stringquery-not-working-while-actual-query-directly-works-on-postman/255882 "2020-11-19T12:07:19Z")
I'm migrating our native to springboot+java and am stuck here with this search. Didn't find much examples around web also. { "query": output in log below} I'm getting output in postman. Yet the actual java code retu… --- ## [How to search without punctuations when the document has punctuations](https://discuss.elastic.co/t/how-to-search-without-punctuations-when-the-document-has-punctuations/255983)
**Author:** [@Trupti\_Shet](https://discuss.elastic.co/u/Trupti_Shet)\ **Replies:** 0\ **Last updated:** [November 19, 2020, 12:03pm UTC](https://discuss.elastic.co/t/how-to-search-without-punctuations-when-the-document-has-punctuations/255983 "2020-11-19T12:03:51Z")
When I search for Brother's I can see the exact document in suggestions I am searching for. What do I do if I wish to see the exact same suggestion after typing Brother or Brothers. --- ## [Metricbeat AWS module metricsets and exported fields](https://discuss.elastic.co/t/metricbeat-aws-module-metricsets-and-exported-fields/255976)
**Author:** [@nickgregz](https://discuss.elastic.co/u/nickgregz)\ **Replies:** 0\ **Last updated:** [November 19, 2020, 11:45am UTC](https://discuss.elastic.co/t/metricbeat-aws-module-metricsets-and-exported-fields/255976 "2020-11-19T11:45:39Z")
Hello, I have a question regarding exported fields of metricsets for the AWS metricbeat module, specifically if they all include some variation of a unique identifier. For example the RDS module has an exported field a… --- ## [Upgrading from Basic to Gold license](https://discuss.elastic.co/t/upgrading-from-basic-to-gold-license/255975)
**Author:** [@linfordwoode](https://discuss.elastic.co/u/linfordwoode)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 11:44am UTC](https://discuss.elastic.co/t/upgrading-from-basic-to-gold-license/255975 "2020-11-19T11:44:59Z")
Hello Community, I have an elk stack with 1 node each for Elasticsearch, Logstash, and Kibana with a basic license. I am thinking of upgrading from a basic license to gold. Are there any prerequisites or requirements th… --- ## [Audit file is empty](https://discuss.elastic.co/t/audit-file-is-empty/255865)
**Author:** [@Andex](https://discuss.elastic.co/u/Andex)\ **Replies:** 5\ **Last updated:** [November 19, 2020, 11:20am UTC](https://discuss.elastic.co/t/audit-file-is-empty/255865 "2020-11-19T11:20:29Z")
Hi, i enabled Audit on all my elasticsearch.yml : xpack.security.audit.enabled: true I have already enabled https and transport inside my cluster. I don't know why my \_audit.json file is empty . The owner - group to t… --- ## [Parsing logs with logstash](https://discuss.elastic.co/t/parsing-logs-with-logstash/255960)
**Author:** [@Falikou1](https://discuss.elastic.co/u/Falikou1)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 10:58am UTC](https://discuss.elastic.co/t/parsing-logs-with-logstash/255960 "2020-11-19T10:58:25Z")
I need to help on the parsing of my logs. This is my parser: input{ tcp { port =\> "5140" tags =\> "syslog" } } filter { grok { match =\> { "message" =\> "%{SYSLOG5424PRI:syslog\_index}%{SYSLOGHOST:syslog\_host} %{GR… --- ## [Anyone, Help me about vizualization with my log pattern!](https://discuss.elastic.co/t/anyone-help-me-about-vizualization-with-my-log-pattern/255871)
**Author:** [@quangdv.6466](https://discuss.elastic.co/u/quangdv.6466)\ **Replies:** 3\ **Last updated:** [November 19, 2020, 10:40am UTC](https://discuss.elastic.co/t/anyone-help-me-about-vizualization-with-my-log-pattern/255871 "2020-11-19T10:40:56Z")
Hi there! Here is my complete configuration of the elk stack for my stub. Log example: Filebeat configuration: Logstash configuration: Fields auto define on kibana: And here is result on my Kibana… --- ## [Regex in Kibana Search bar?](https://discuss.elastic.co/t/regex-in-kibana-search-bar/255944)
**Author:** [@cskowronnek](https://discuss.elastic.co/u/cskowronnek)\ **Replies:** 2\ **Last updated:** [November 19, 2020, 9:51am UTC](https://discuss.elastic.co/t/regex-in-kibana-search-bar/255944 "2020-11-19T09:51:37Z")
Hi all, I have a text field which I want to query for values containing only digits. This search works just fine: "query": { "regexp":{ "Overall State": "\[0-9\]\*" } } When I try to p… --- ## [What all credentials should be configured in metricbeat, and how, while working with secure elasticsearch having https and built in user roles?](https://discuss.elastic.co/t/what-all-credentials-should-be-configured-in-metricbeat-and-how-while-working-with-secure-elasticsearch-having-https-and-built-in-user-roles/255947)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 0\ **Last updated:** [November 19, 2020, 8:29am UTC](https://discuss.elastic.co/t/what-all-credentials-should-be-configured-in-metricbeat-and-how-while-working-with-secure-elasticsearch-having-https-and-built-in-user-roles/255947 "2020-11-19T08:29:41Z")
Hi, I am using elastic stack 7.9. I have a 3 node elasticsearch cluster with https enabled using http.p12 and I have configured kibana as well (but kibana still runs in http). I have set up credenatials for built-in use… --- ## [Elastic-Agent - Custom Log Integration](https://discuss.elastic.co/t/elastic-agent-custom-log-integration/255736)
**Author:** [@PhilA](https://discuss.elastic.co/u/PhilA)\ **Replies:** 3\ **Last updated:** [November 19, 2020, 9:26am UTC](https://discuss.elastic.co/t/elastic-agent-custom-log-integration/255736 "2020-11-19T09:26:20Z")
Hi I am trying to get a 'Custom Log' working with Elastic-Agent via the GUI. I have managed to get the custom log file being processed but I need to define mappings for it. the format of the file is minimal at this st… --- ## [Unable to get X-Forwarded-For to display](https://discuss.elastic.co/t/unable-to-get-x-forwarded-for-to-display/255176)
**Author:** [@computerbart](https://discuss.elastic.co/u/computerbart)\ **Replies:** 6\ **Last updated:** [November 19, 2020, 9:24am UTC](https://discuss.elastic.co/t/unable-to-get-x-forwarded-for-to-display/255176 "2020-11-19T09:24:29Z")
Hi All, New user here. I set out to try Elastic Stack for some more visibility/search-ability for our IIS logs. Unfortunately I have bumped into something I cannot get to work. I set up a 3 node Elastic cluster + Kiban… --- ## [Filebeat high disk usage when reboot server. How fix it?](https://discuss.elastic.co/t/filebeat-high-disk-usage-when-reboot-server-how-fix-it/255876)
**Author:** [@Andrew\_Foxis](https://discuss.elastic.co/u/Andrew_Foxis)\ **Replies:** 6\ **Last updated:** [November 19, 2020, 9:23am UTC](https://discuss.elastic.co/t/filebeat-high-disk-usage-when-reboot-server-how-fix-it/255876 "2020-11-19T09:23:14Z")
Hi all! Filebeat on server send many events from logs of exchange (windows) server to logstash. When we reboot server filebeat make high disk usage. Other services can't load for a long time. How can i fix it? Thank y… --- ## [After adding new mapping half way through re-indexing fails](https://discuss.elastic.co/t/after-adding-new-mapping-half-way-through-re-indexing-fails/255951)
**Author:** [@NutaN\_Shrivastava](https://discuss.elastic.co/u/NutaN_Shrivastava)\ **Replies:** 2\ **Last updated:** [November 19, 2020, 9:17am UTC](https://discuss.elastic.co/t/after-adding-new-mapping-half-way-through-re-indexing-fails/255951 "2020-11-19T09:17:50Z")
I used the below code to add new mapping to a new index PUT \_index\_template/engage-logs { "index\_patterns": \[ "engage-log-reindexed-\*" \], "template": { "mappings": { "dynamic\_… --- ## [.ml-anomalies-\* indices not listed in \_cat/indices/\_all but it is listed in \_cat/indices/.ml-anomalies-\*?](https://discuss.elastic.co/t/ml-anomalies-indices-not-listed-in-cat-indices-all-but-it-is-listed-in-cat-indices-ml-anomalies/255949)
**Author:** [@bertr](https://discuss.elastic.co/u/bertr)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 8:59am UTC](https://discuss.elastic.co/t/ml-anomalies-indices-not-listed-in-cat-indices-all-but-it-is-listed-in-cat-indices-ml-anomalies/255949 "2020-11-19T08:59:06Z")
Version 7.8.1 ML is working properly, but I don't see the .ml-anomalies-\* indices listed when running \_cat/indices/\_all? The indices also dont show in Index Management screen, but I can/could create an index pattern .ml… --- ## [Create Kibana dashboard has problems](https://discuss.elastic.co/t/create-kibana-dashboard-has-problems/255015)
**Author:** [@bogdan.oproescu](https://discuss.elastic.co/u/bogdan.oproescu)\ **Replies:** 11\ **Last updated:** [November 19, 2020, 8:50am UTC](https://discuss.elastic.co/t/create-kibana-dashboard-has-problems/255015 "2020-11-19T08:50:29Z")
Hello discuss.elastic.co, My name is Bogdan Oproescu, and I am senior data architect for EasyDO Technologies in Bucharest. I am leading our Elastic projects and technology at EasyDO, and we currently have the following … --- ## [Aggregation with significant\_text on wildcard fields](https://discuss.elastic.co/t/aggregation-with-significant-text-on-wildcard-fields/255921)
**Author:** [@newman\_chiang](https://discuss.elastic.co/u/newman_chiang)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 8:39am UTC](https://discuss.elastic.co/t/aggregation-with-significant-text-on-wildcard-fields/255921 "2020-11-19T08:39:07Z")
Hi, everyone I have query below GET contract/\_search { "query": { "bool": { "should": \[ { "query\_string": { "fields": \[ … --- ## [How to setup 2 Node Cluster](https://discuss.elastic.co/t/how-to-setup-2-node-cluster/255937)
**Author:** [@azeiner](https://discuss.elastic.co/u/azeiner)\ **Replies:** 4\ **Last updated:** [November 19, 2020, 8:20am UTC](https://discuss.elastic.co/t/how-to-setup-2-node-cluster/255937 "2020-11-19T08:20:03Z")
Hi everybody, i've got a question concerning a project we're doing currently where the customer is only willing to use his existing 2 VM's for an Elastic cluster which concerns me a little bit - normally we use 3+ nodes … --- ## [Indexing and reindexing index with single shard take too much time](https://discuss.elastic.co/t/indexing-and-reindexing-index-with-single-shard-take-too-much-time/255942)
**Author:** [@Dahea\_Moon](https://discuss.elastic.co/u/Dahea_Moon)\ **Replies:** 7\ **Last updated:** [November 19, 2020, 8:15am UTC](https://discuss.elastic.co/t/indexing-and-reindexing-index-with-single-shard-take-too-much-time/255942 "2020-11-19T08:15:06Z")
Hi, Elastic Team I cannot understand why indexing and reindexing my index takes too much time. I'm using Elasticsearch 7.9.0 with two nodes. (Nodes have default setting; both can be master and data.) There is only one… --- ## [3 hour time difference between Kibana reports and PostgreSQL database](https://discuss.elastic.co/t/3-hour-time-difference-between-kibana-reports-and-postgresql-database/254551)
**Author:** [@bogdan.oproescu](https://discuss.elastic.co/u/bogdan.oproescu)\ **Replies:** 31\ **Last updated:** [November 19, 2020, 8:12am UTC](https://discuss.elastic.co/t/3-hour-time-difference-between-kibana-reports-and-postgresql-database/254551 "2020-11-19T08:12:10Z")
hello Elastic forum, We have noticed a 3-hour time difference in our results, when comparing the output of our PostgreSQL database and our Kibana reports, and various requests to the \_search endpoint with Query DSL. For… --- ## [Scaleup (adding CPU) of ES node](https://discuss.elastic.co/t/scaleup-adding-cpu-of-es-node/255812)
**Author:** [@Shilpa\_S\_Shetty](https://discuss.elastic.co/u/Shilpa_S_Shetty)\ **Replies:** 8\ **Last updated:** [November 19, 2020, 8:02am UTC](https://discuss.elastic.co/t/scaleup-adding-cpu-of-es-node/255812 "2020-11-19T08:02:03Z")
I have requirement to add CPU to elastic search ,was looking into the specific document.Is it possible to add CPU to exisiting elastic search .New to elastic search but concepts are saying NO.Am I right or can v add more… --- ## [Generate .csv using Elasticsearch API](https://discuss.elastic.co/t/generate-csv-using-elasticsearch-api/255841)
**Author:** [@Aniket\_Salvi](https://discuss.elastic.co/u/Aniket_Salvi)\ **Replies:** 5\ **Last updated:** [November 19, 2020, 7:48am UTC](https://discuss.elastic.co/t/generate-csv-using-elasticsearch-api/255841 "2020-11-19T07:48:45Z")
Hi team, Can I create .csv file using Elasticsearch REST API. Because I want automatic .csv file generation mechanism. Thanks --- ## [Failed to find action \[org.elasticsearch.script.mustache.SearchTemplateAction@76440dba\] to execute](https://discuss.elastic.co/t/failed-to-find-action-org-elasticsearch-script-mustache-searchtemplateaction-76440dba-to-execute/255644)
**Author:** [@rakeshdkaatkar](https://discuss.elastic.co/u/rakeshdkaatkar)\ **Replies:** 6\ **Last updated:** [November 19, 2020, 7:24am UTC](https://discuss.elastic.co/t/failed-to-find-action-org-elasticsearch-script-mustache-searchtemplateaction-76440dba-to-execute/255644 "2020-11-19T07:24:29Z")
Im getting below exception when im trying to use mustache template. failed to find action \[org.elasticsearch.script.mustache.SearchTemplateAction@76440dba\] to execute --- ## [ElasticSearch7.9.3 can't start successfully as a window service in win10 system](https://discuss.elastic.co/t/elasticsearch7-9-3-cant-start-successfully-as-a-window-service-in-win10-system/255784)
**Author:** [@sunweiconfidence](https://discuss.elastic.co/u/sunweiconfidence)\ **Replies:** 3\ **Last updated:** [November 19, 2020, 7:23am UTC](https://discuss.elastic.co/t/elasticsearch7-9-3-cant-start-successfully-as-a-window-service-in-win10-system/255784 "2020-11-19T07:23:09Z")
hi, i coonfigure the elasticsearch.yml and jvm.option, can work normally in cmd window, but when i put it as a window service, it can start and running, after several seconds, it stop the service, error log as below, i … --- ## [When I upgrade ES from 7.0.0 to 7.9.0 my custom plugin(which contain mustache) is not working](https://discuss.elastic.co/t/when-i-upgrade-es-from-7-0-0-to-7-9-0-my-custom-plugin-which-contain-mustache-is-not-working/255936)
**Author:** [@rakeshdkaatkar](https://discuss.elastic.co/u/rakeshdkaatkar)\ **Replies:** 0\ **Last updated:** [November 19, 2020, 7:21am UTC](https://discuss.elastic.co/t/when-i-upgrade-es-from-7-0-0-to-7-9-0-my-custom-plugin-which-contain-mustache-is-not-working/255936 "2020-11-19T07:21:38Z")
I have placed lang-mustache-client-7.9.0.jar to libs and deleted lang-mustache folder from modules.But im getting below error. TenantNull failed to find action \[org.elasticsearch.script.mustache.SearchTemplateAction@764… --- ## [Index management in Kibana](https://discuss.elastic.co/t/index-management-in-kibana/255771)
**Author:** [@since1976](https://discuss.elastic.co/u/since1976)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 6:17am UTC](https://discuss.elastic.co/t/index-management-in-kibana/255771 "2020-11-19T06:17:20Z")
Hi, From Kibana, dashboard, how do we know which are the indicies being used in the dashboard? And how do we remove these indices if its not needed Any beginner guide for indices management? --- ## [Get data from excel file into elasticsearch](https://discuss.elastic.co/t/get-data-from-excel-file-into-elasticsearch/255926)
**Author:** [@111411](https://discuss.elastic.co/u/111411)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 5:49am UTC](https://discuss.elastic.co/t/get-data-from-excel-file-into-elasticsearch/255926 "2020-11-19T05:49:36Z")
hello. I'm try get data from excel file into elasticsearch. Message: Error: wrong number of arguments (given 0, expected 3) Exception: ArgumentError Stack: /Users/nguyenzuanbka/logstash-7.10.0/vendor/bundle/jruby/2.… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1687) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1689)