# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1721 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1722 --- ## [Parse Apache Error Logs](https://discuss.elastic.co/t/parse-apache-error-logs/253158)
**Author:** [@prophoto](https://discuss.elastic.co/u/prophoto)\ **Replies:** 7\ **Last updated:** [November 2, 2020, 1:36pm UTC](https://discuss.elastic.co/t/parse-apache-error-logs/253158 "2020-11-02T13:36:28Z")
Is there something I'm missing? Currently using Filebeat to send Apache 2.4 logs to Elasticsearch. Access logs get parsed fine (well, mostly, have lots of grok errors) but error\_log always shows grok error and inputs log… --- ## [Timeseries visualization for plotting no. of matching documents against time](https://discuss.elastic.co/t/timeseries-visualization-for-plotting-no-of-matching-documents-against-time/253465)
**Author:** [@sharmashrayansh](https://discuss.elastic.co/u/sharmashrayansh)\ **Replies:** 3\ **Last updated:** [November 2, 2020, 1:06pm UTC](https://discuss.elastic.co/t/timeseries-visualization-for-plotting-no-of-matching-documents-against-time/253465 "2020-11-02T13:06:08Z")
Hello, We are creating a Dashboard to monitor issues from an external system. We are collecting data of "issues" using Logstash from a different application and storing them in ElasticSearch. As a crucial requirement,… --- ## [Alternatives to mapping types in Elasticsearch](https://discuss.elastic.co/t/alternatives-to-mapping-types-in-elasticsearch/254007)
**Author:** [@Kanika27](https://discuss.elastic.co/u/Kanika27)\ **Replies:** 3\ **Last updated:** [November 2, 2020, 12:23pm UTC](https://discuss.elastic.co/t/alternatives-to-mapping-types-in-elasticsearch/254007 "2020-11-02T12:23:18Z")
I understand that the mapping types are being removed, I want to know is their any other way out to have multiple schema in a single index? Something like putting different schema in different shards for one single inde… --- ## [Circuit breaker problem](https://discuss.elastic.co/t/circuit-breaker-problem/253828)
**Author:** [@gborg](https://discuss.elastic.co/u/gborg)\ **Replies:** 3\ **Last updated:** [November 2, 2020, 12:16pm UTC](https://discuss.elastic.co/t/circuit-breaker-problem/253828 "2020-11-02T12:16:47Z")
So, my situation is: I have a pretty big cluster (10TB) of real time log data, today is a high-load day and I am getting circuit breaker errors ## circuit\_breaking\_exception at \`shard\` 0 \`index\` open--2020.09.30 \`no… --- ## [How to get arrays with variable length into Elasticsearch?](https://discuss.elastic.co/t/how-to-get-arrays-with-variable-length-into-elasticsearch/254020)
**Author:** [@Toontje](https://discuss.elastic.co/u/Toontje)\ **Replies:** 0\ **Last updated:** [November 2, 2020, 12:11pm UTC](https://discuss.elastic.co/t/how-to-get-arrays-with-variable-length-into-elasticsearch/254020 "2020-11-02T12:11:55Z")
I have log files with a JSON data structure that looks like this: {"windowNumber": 1830323, "timestamp": "2020-09-24T01:26:31.673097Z", "tagData": {"103040840050DDABCD10028300003B93": {"inIntensity": "2542", "inCount": … --- ## [Sorting on keyword not working as expected](https://discuss.elastic.co/t/sorting-on-keyword-not-working-as-expected/253959)
**Author:** [@F\_eq\_kx](https://discuss.elastic.co/u/F_eq_kx)\ **Replies:** 1\ **Last updated:** [November 2, 2020, 11:56am UTC](https://discuss.elastic.co/t/sorting-on-keyword-not-working-as-expected/253959 "2020-11-02T11:56:37Z")
I am storing Windows UNC paths in a path field with the following mapping: "path": { "type": "text", "fields": { "keyword": { "type": "keyword" }, "tree": { "type"… --- ## [How to handle Daylight Savings Time in Kibana Canvas?](https://discuss.elastic.co/t/how-to-handle-daylight-savings-time-in-kibana-canvas/254014)
**Author:** [@egray](https://discuss.elastic.co/u/egray)\ **Replies:** 1\ **Last updated:** [November 2, 2020, 11:42am UTC](https://discuss.elastic.co/t/how-to-handle-daylight-savings-time-in-kibana-canvas/254014 "2020-11-02T11:42:51Z")
I am creating a Canvas with a visualization in Timelion. I am able to get accurate time buckets, and when I look at the datatable the graph is based on, I can see that @timestamp is being stored as local time with the co… --- ## [How not to get double entries in my datastream using the Index API](https://discuss.elastic.co/t/how-not-to-get-double-entries-in-my-datastream-using-the-index-api/254015)
**Author:** [@hugohendriks](https://discuss.elastic.co/u/hugohendriks)\ **Replies:** 0\ **Last updated:** [November 2, 2020, 10:53am UTC](https://discuss.elastic.co/t/how-not-to-get-double-entries-in-my-datastream-using-the-index-api/254015 "2020-11-02T10:53:45Z")
Hi, We are using the Index API to post data to my datastream. I read from a queue and then perform a POST but I do have a timeout setting of 10 seconds. What sometimes happens it seems is that elastic takes more then 10… --- ## [How to search with special character in search bar](https://discuss.elastic.co/t/how-to-search-with-special-character-in-search-bar/253572)
**Author:** [@beam5544](https://discuss.elastic.co/u/beam5544)\ **Replies:** 3\ **Last updated:** [November 2, 2020, 10:46am UTC](https://discuss.elastic.co/t/how-to-search-with-special-character-in-search-bar/253572 "2020-11-02T10:46:22Z")
Now, I already have data "reqBody" in String format ... but it look like JSON somehow. FYI, {"masterStagingId":"PAYROLL72e6972d84b047af88e62258dbaea998","paymentProductId":"PAYROLL","batchReferenceId":"PAY201028df78… --- ## [Ruby syntax error](https://discuss.elastic.co/t/ruby-syntax-error/252197)
**Author:** [@Jan\_Kabelka](https://discuss.elastic.co/u/Jan_Kabelka)\ **Replies:** 3\ **Last updated:** [November 2, 2020, 10:40am UTC](https://discuss.elastic.co/t/ruby-syntax-error/252197 "2020-11-02T10:40:21Z")
Hi, I did not find anything what would work therefore please let me ask... I need to create new field with length of DNS domain. Also I would like to have another field with entropy value for that DNS domain. What field… --- ## [How can i change the map to arc GIS?](https://discuss.elastic.co/t/how-can-i-change-the-map-to-arc-gis/253707)
**Author:** [@witcher](https://discuss.elastic.co/u/witcher)\ **Replies:** 7\ **Last updated:** [November 2, 2020, 10:20am UTC](https://discuss.elastic.co/t/how-can-i-change-the-map-to-arc-gis/253707 "2020-11-02T10:20:22Z")
I want my map tile or base map to be from ArcGIS https://www.arcgis.com/home/webmap/viewer.html?useExisting=1 How should i go about this? --- ## [3 Node cluster with docker compose](https://discuss.elastic.co/t/3-node-cluster-with-docker-compose/253998)
**Author:** [@nyquillus](https://discuss.elastic.co/u/nyquillus)\ **Replies:** 0\ **Last updated:** [November 2, 2020, 9:19am UTC](https://discuss.elastic.co/t/3-node-cluster-with-docker-compose/253998 "2020-11-02T09:19:04Z")
Hi, I'm working on a test environment elastic stack on docker from scratch to get a good grip on things. I started with "sebp/elk" docker image, then i made a docker-compose stack with 2 logstash containers one for dock… --- ## [Issue enter to Kibana](https://discuss.elastic.co/t/issue-enter-to-kibana/253981)
**Author:** [@Lamya\_Alzomai](https://discuss.elastic.co/u/Lamya_Alzomai)\ **Replies:** 3\ **Last updated:** [November 2, 2020, 9:13am UTC](https://discuss.elastic.co/t/issue-enter-to-kibana/253981 "2020-11-02T09:13:50Z")
I have an issue when singe in to Kibana it show me this message. And i try to rest the password and still same problem. --- ## [Logstash error](https://discuss.elastic.co/t/logstash-error/253664)
**Author:** [@punithjigali](https://discuss.elastic.co/u/punithjigali)\ **Replies:** 2\ **Last updated:** [November 2, 2020, 9:05am UTC](https://discuss.elastic.co/t/logstash-error/253664 "2020-11-02T09:05:48Z")
Hi team, I have installed jdk 15. I am getting this error when I run below command... C:\\Elastic stack\\logstash-7.9.3\\logstash-7.9.3\\bin\>logstash -f C:\\Elastic stack\\logstash.conf Unrecognized VM option 'UseConcMarkSw… --- ## [Failed to process cluster event (put-mapping) within 30s](https://discuss.elastic.co/t/failed-to-process-cluster-event-put-mapping-within-30s/253987)
**Author:** [@Yasiru\_Kanchana](https://discuss.elastic.co/u/Yasiru_Kanchana)\ **Replies:** 3\ **Last updated:** [November 2, 2020, 8:15am UTC](https://discuss.elastic.co/t/failed-to-process-cluster-event-put-mapping-within-30s/253987 "2020-11-02T08:15:28Z")
Currently, I am running Elasticsearch in cluster mode and there are 6 nodes. My logs are flooded with below error message. Also we are creating daily basis indexes and each having 10 shards (according to the template). I… --- ## [Date part in index names were removed automatically and the logs inside also removed](https://discuss.elastic.co/t/date-part-in-index-names-were-removed-automatically-and-the-logs-inside-also-removed/253990)
**Author:** [@Ibrahim\_ozbek](https://discuss.elastic.co/u/Ibrahim_ozbek)\ **Replies:** 0\ **Last updated:** [November 2, 2020, 8:13am UTC](https://discuss.elastic.co/t/date-part-in-index-names-were-removed-automatically-and-the-logs-inside-also-removed/253990 "2020-11-02T08:13:11Z")
I started sending data to elasticsearch via filebeat and metricbeat. The corresponding indexes were created and I worked on dashboards. After two or three days, the filebeat and metricbeat index names changed from filebe… --- ## [Unable to push data into multiple indices](https://discuss.elastic.co/t/unable-to-push-data-into-multiple-indices/253685)
**Author:** [@bhaskar\_todi](https://discuss.elastic.co/u/bhaskar_todi)\ **Replies:** 4\ **Last updated:** [November 2, 2020, 6:46am UTC](https://discuss.elastic.co/t/unable-to-push-data-into-multiple-indices/253685 "2020-11-02T06:46:50Z")
I am trying to push different streams of windows events into different elastic indices based on the event.provider But unfortunately, all my data is pushed into the default index. I am not sure if the filtering is not … --- ## [REST return Json object - How to push it to Logstash C#?](https://discuss.elastic.co/t/rest-return-json-object-how-to-push-it-to-logstash-c/253533)
**Author:** [@yaharin\_ben\_ayon](https://discuss.elastic.co/u/yaharin_ben_ayon)\ **Replies:** 3\ **Last updated:** [November 2, 2020, 5:35am UTC](https://discuss.elastic.co/t/rest-return-json-object-how-to-push-it-to-logstash-c/253533 "2020-11-02T05:35:28Z")
Hey I have a json object returning from a rest call - how can i push it to logstash? The code is in C#. Thanks! --- ## [Snapshot restore to test server](https://discuss.elastic.co/t/snapshot-restore-to-test-server/253975)
**Author:** [@bhuvaneshdct](https://discuss.elastic.co/u/bhuvaneshdct)\ **Replies:** 0\ **Last updated:** [November 2, 2020, 4:34am UTC](https://discuss.elastic.co/t/snapshot-restore-to-test-server/253975 "2020-11-02T04:34:40Z")
Im a bit confused about the ES restore process. I have a prod cluster and stage cluster. Prod cluster has daily snapshots enabled. The first time when I restored the snapshot from the prod backup it took a lot more ti… --- ## [Not able to start the elasticsearch service](https://discuss.elastic.co/t/not-able-to-start-the-elasticsearch-service/252722)
**Author:** [@narayask](https://discuss.elastic.co/u/narayask)\ **Replies:** 4\ **Last updated:** [November 2, 2020, 4:08am UTC](https://discuss.elastic.co/t/not-able-to-start-the-elasticsearch-service/252722 "2020-11-02T04:08:14Z")
Hi Team, Getting below error while starting the elastic service for version elasticsearch-7.8.1-amd64.deb elasticsearch-7.7.0-amd64.deb on ubuntu system and getting below error. Please do the needful. \[2020-10-20T1… --- ## [Transverse through multiple buckets](https://discuss.elastic.co/t/transverse-through-multiple-buckets/253974)
**Author:** [@gokul275](https://discuss.elastic.co/u/gokul275)\ **Replies:** 0\ **Last updated:** [November 2, 2020, 4:01am UTC](https://discuss.elastic.co/t/transverse-through-multiple-buckets/253974 "2020-11-02T04:01:37Z")
I am trying to achieve bucket script aggregation for value derived from multiple sub aggregation, how to transverse to the derived value My query looks like below POST /sales/\_search { "size": 0, "aggs": { "sales\_p… --- ## [Elasticsearch security - possible to block \_search but allow get/mget?](https://discuss.elastic.co/t/elasticsearch-security-possible-to-block-search-but-allow-get-mget/253847)
**Author:** [@Andy\_Wick](https://discuss.elastic.co/u/Andy_Wick)\ **Replies:** 0\ **Last updated:** [October 30, 2020, 5:08pm UTC](https://discuss.elastic.co/t/elasticsearch-security-possible-to-block-search-but-allow-get-mget/253847 "2020-10-30T17:08:34Z")
Is it possible to create an elasticsearch user that can do get/mget but not search? It looks like there is only elasticsearch privilege around reading, called "read", and not fine grain control. I could maybe use field f… --- ## [Geoip filter](https://discuss.elastic.co/t/geoip-filter/253960)
**Author:** [@Ronnie\_Raraihuru](https://discuss.elastic.co/u/Ronnie_Raraihuru)\ **Replies:** 3\ **Last updated:** [November 2, 2020, 3:01am UTC](https://discuss.elastic.co/t/geoip-filter/253960 "2020-11-02T03:01:46Z")
My sample log contents #Fields: date-time,connector-id,session-id,sequence-number,local-endpoint,remote-endpoint,event,data,context 2020-10-22T23:59:53.533Z,SIG-EXCH13-01\\Default Frontend SIG-EXCH13-01,08D8724E3CB78EDF… --- ## [Could not execute action: PipelineAction::Create\ after xpack.security enabled](https://discuss.elastic.co/t/could-not-execute-action-pipelineaction-create-main-after-xpack-security-enabled/253861)
**Author:** [@ASA01](https://discuss.elastic.co/u/ASA01)\ **Replies:** 5\ **Last updated:** [November 2, 2020, 3:06am UTC](https://discuss.elastic.co/t/could-not-execute-action-pipelineaction-create-main-after-xpack-security-enabled/253861 "2020-11-02T03:06:12Z")
Logstash works fine for me until I enable xpack security in elasticsearch.yml. When I do I get the following error from any conf that creates indices. \[ERROR\] 2020-10-30 15:52:06.741 \[Converge PipelineAction::Create\] a… --- ## [ElasticSearch Logs to Filebeat](https://discuss.elastic.co/t/elasticsearch-logs-to-filebeat/253944)
**Author:** [@Prasad\_Rajassekaran](https://discuss.elastic.co/u/Prasad_Rajassekaran)\ **Replies:** 2\ **Last updated:** [November 2, 2020, 1:41am UTC](https://discuss.elastic.co/t/elasticsearch-logs-to-filebeat/253944 "2020-11-02T01:41:52Z")
I am a novice to elasticsearch and filebeat. I wish to load all the elasticsearch logs to filebeat. Can you someone guide me please? --- ## [Problems changing type in reindex](https://discuss.elastic.co/t/problems-changing-type-in-reindex/253511)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 1\ **Last updated:** [November 2, 2020, 12:56am UTC](https://discuss.elastic.co/t/problems-changing-type-in-reindex/253511 "2020-11-02T00:56:17Z")
I am ES 6.8 -- trying to get stuff tidy to migrate to 7.x Using ruby api to do the reindex : client.reindex source: { index:index\_name, type: 'auth' }, target: { index: new\_index\_name, type: 'doc' },refresh: true The … --- ## [Two inputs Logstash](https://discuss.elastic.co/t/two-inputs-logstash/253958)
**Author:** [@yaharin\_ben\_ayon](https://discuss.elastic.co/u/yaharin_ben_ayon)\ **Replies:** 1\ **Last updated:** [November 1, 2020, 7:58pm UTC](https://discuss.elastic.co/t/two-inputs-logstash/253958 "2020-11-01T19:58:17Z")
Can i use two inputs in the config file? HTTP and File? --- ## [Gradle build task fails with docker errors](https://discuss.elastic.co/t/gradle-build-task-fails-with-docker-errors/253957)
**Author:** [@ankurtrapasiya](https://discuss.elastic.co/u/ankurtrapasiya)\ **Replies:** 0\ **Last updated:** [November 1, 2020, 6:33pm UTC](https://discuss.elastic.co/t/gradle-build-task-fails-with-docker-errors/253957 "2020-11-01T18:33:29Z")
Hi, I set-up elasticsearch codebase on my local and I see that my setup fails when I try to do gradle build in IDE. Below is the error that I receive. Docker (checked \[/usr/bin/docker, /usr/local/bin/docker\]) is r… --- ## [Score multiple phrases against single document](https://discuss.elastic.co/t/score-multiple-phrases-against-single-document/253948)
**Author:** [@JGor](https://discuss.elastic.co/u/JGor)\ **Replies:** 0\ **Last updated:** [November 1, 2020, 3:54pm UTC](https://discuss.elastic.co/t/score-multiple-phrases-against-single-document/253948 "2020-11-01T15:54:27Z")
Hi, I'm wondering how I could achieve the following: Let's say I have 100 search phrases (each search phrase contains multiple words), is it possible to construct a query that would check all of them against a text fiel… --- ## [Translate geodistance aggregation query to Java](https://discuss.elastic.co/t/translate-geodistance-aggregation-query-to-java/253947)
**Author:** [@hugofajardo1](https://discuss.elastic.co/u/hugofajardo1)\ **Replies:** 0\ **Last updated:** [November 1, 2020, 3:44pm UTC](https://discuss.elastic.co/t/translate-geodistance-aggregation-query-to-java/253947 "2020-11-01T15:44:08Z")
I need to translate a geodistance aggregation query to Java. This aggregation is working from Kibana, but I can't do it from Java: GET accidentes/\_search { "aggs": { "location": { "filter": { "geo\_distance": { "di… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1720) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1722)