# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1730 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1731 --- ## [Add Synonym Analyzer for Keyword field](https://discuss.elastic.co/t/add-synonym-analyzer-for-keyword-field/253469)
**Author:** [@Coder\_Cub](https://discuss.elastic.co/u/Coder_Cub)\ **Replies:** 0\ **Last updated:** [October 27, 2020, 4:23pm UTC](https://discuss.elastic.co/t/add-synonym-analyzer-for-keyword-field/253469 "2020-10-27T16:23:12Z")
Hi everyone, I am stuck here for adding Synonym Analyzer to Keyword field while creating my index. Can you please help how can I achieve this or what am I missing? Use case: A person can have multiple nick names. If … --- ## [Issue Creating a Custom Metricset](https://discuss.elastic.co/t/issue-creating-a-custom-metricset/253358)
**Author:** [@traw1234](https://discuss.elastic.co/u/traw1234)\ **Replies:** 3\ **Last updated:** [October 27, 2020, 3:29pm UTC](https://discuss.elastic.co/t/issue-creating-a-custom-metricset/253358 "2020-10-27T15:29:28Z")
I am working to create a custom metricset for Metricbeat but am having difficulty with the documentation. I am following the guide here, have installed go, mage, ran go get for the beats repo, am writing the module withi… --- ## [Declare a field variable for use in a for cycle](https://discuss.elastic.co/t/declare-a-field-variable-for-use-in-a-for-cycle/253452)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 0\ **Last updated:** [October 27, 2020, 3:10pm UTC](https://discuss.elastic.co/t/declare-a-field-variable-for-use-in-a-for-cycle/253452 "2020-10-27T15:10:15Z")
hi, guys, i need your help with this code, it's well? { "trigger": { "schedule": { "interval": "24h" } }, "input": { "search": { "request": { "search\_type": "query\_then\_fetch", … --- ## [Terms aggregation on a keyword field returns no results](https://discuss.elastic.co/t/terms-aggregation-on-a-keyword-field-returns-no-results/253436)
**Author:** [@akhilmathew001](https://discuss.elastic.co/u/akhilmathew001)\ **Replies:** 1\ **Last updated:** [October 27, 2020, 2:52pm UTC](https://discuss.elastic.co/t/terms-aggregation-on-a-keyword-field-returns-no-results/253436 "2020-10-27T14:52:09Z")
I have Elastic search v7.2 with an index of 20 million documents. Part of es schema is as follows; { "properties": { "industries\_name": { "copy\_to": \[ "keyword\_search\_copy\_to\_field" \], "ty… --- ## [Supress errors from logstash input plugin](https://discuss.elastic.co/t/supress-errors-from-logstash-input-plugin/253414)
**Author:** [@nitzan.karni](https://discuss.elastic.co/u/nitzan.karni)\ **Replies:** 1\ **Last updated:** [October 27, 2020, 2:15pm UTC](https://discuss.elastic.co/t/supress-errors-from-logstash-input-plugin/253414 "2020-10-27T14:15:30Z")
Hi, I have set up a logstash input for syslog: syslog { port =\> 6514 codec =\> cef tags =\> \[ "syslog" \] } I have different kind of syslogs running through that input. I have messages that arrives in cef fo… --- ## [\[FIlebeat\] How to get logs default paths for modules?](https://discuss.elastic.co/t/filebeat-how-to-get-logs-default-paths-for-modules/252648)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 3\ **Last updated:** [October 27, 2020, 1:53pm UTC](https://discuss.elastic.co/t/filebeat-how-to-get-logs-default-paths-for-modules/252648 "2020-10-27T13:53:34Z")
Hello ! I'm using Filebeat (7.8) and module system. For the var.paths of the syslog fileset, documentation says : "If this setting is left empty, Filebeat will choose log paths based on your operating system." How can… --- ## [Where are the canvas stored?](https://discuss.elastic.co/t/where-are-the-canvas-stored/253170)
**Author:** [@Carlos\_Fernando\_Palm](https://discuss.elastic.co/u/Carlos_Fernando_Palm)\ **Replies:** 5\ **Last updated:** [October 27, 2020, 1:49pm UTC](https://discuss.elastic.co/t/where-are-the-canvas-stored/253170 "2020-10-27T13:49:21Z")
Hello. I am using kibana to create some canvas which will store a couple visualizations. Now this is being done via docker-compose. I would like to know the location inside the container filesystem where the canvas I jus… --- ## [Multiple Kibana users and limit access](https://discuss.elastic.co/t/multiple-kibana-users-and-limit-access/253141)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 4\ **Last updated:** [October 27, 2020, 1:47pm UTC](https://discuss.elastic.co/t/multiple-kibana-users-and-limit-access/253141 "2020-10-27T13:47:53Z")
Hello, I have this scenario: I installed auditbeat in 2 machines and created 2 users in Kibana: User 1: can access only index that has the names: Audibeat-machine-1 User 2: can access only index that has the names: Au… --- ## [ResourceNotFoundException when running percolator query](https://discuss.elastic.co/t/resourcenotfoundexception-when-running-percolator-query/253440)
**Author:** [@makons](https://discuss.elastic.co/u/makons)\ **Replies:** 0\ **Last updated:** [October 27, 2020, 12:52pm UTC](https://discuss.elastic.co/t/resourcenotfoundexception-when-running-percolator-query/253440 "2020-10-27T12:52:27Z")
I'm getting a lot of ResourceNotFoundExceptions when using percolator queries, and I cannot seem to fully understand why... So the document that is reported to be missing in an index, indeed is not there, but I don't und… --- ## [Gsub backslash escape and continue when error](https://discuss.elastic.co/t/gsub-backslash-escape-and-continue-when-error/253282)
**Author:** [@bnmtl](https://discuss.elastic.co/u/bnmtl)\ **Replies:** 1\ **Last updated:** [October 27, 2020, 12:01pm UTC](https://discuss.elastic.co/t/gsub-backslash-escape-and-continue-when-error/253282 "2020-10-27T12:01:41Z")
Hi, I have json input, and using codec =\> json { charset =\> "UTF-8" } I see that logstash giving Json::ParserError: Unrecognized character escape '' when I am getting message below; "incoming": "\\u001Btb��01w" I used … --- ## [Input / Index configuration for log browsing. Differences due to disabled xpack?](https://discuss.elastic.co/t/input-index-configuration-for-log-browsing-differences-due-to-disabled-xpack/253427)
**Author:** [@AndreasS](https://discuss.elastic.co/u/AndreasS)\ **Replies:** 0\ **Last updated:** [October 27, 2020, 11:21am UTC](https://discuss.elastic.co/t/input-index-configuration-for-log-browsing-differences-due-to-disabled-xpack/253427 "2020-10-27T11:21:32Z")
Hello, sorry for the absolute noob question. Edit: just found the solution myself. Please ignore it, nothing interesting to see here anymore... :wink: I am looking for a solution to brows all my codes (running in some… --- ## [Metricbeat --setup dashboards throws error for keystore not created](https://discuss.elastic.co/t/metricbeat-setup-dashboards-throws-error-for-keystore-not-created/253403)
**Author:** [@karthikeyanajendran1](https://discuss.elastic.co/u/karthikeyanajendran1)\ **Replies:** 7\ **Last updated:** [October 27, 2020, 11:05am UTC](https://discuss.elastic.co/t/metricbeat-setup-dashboards-throws-error-for-keystore-not-created/253403 "2020-10-27T11:05:27Z")
Hi Experts, We are developing automation script to setup metricbeat before start the metricbeat. Our automation script does the following: Download and untar the metricbeat package (7.6.1) from elastic site. Enable s… --- ## [ILM Lifecycle limit of total fields](https://discuss.elastic.co/t/ilm-lifecycle-limit-of-total-fields/253420)
**Author:** [@dfoot](https://discuss.elastic.co/u/dfoot)\ **Replies:** 0\ **Last updated:** [October 27, 2020, 10:47am UTC](https://discuss.elastic.co/t/ilm-lifecycle-limit-of-total-fields/253420 "2020-10-27T10:47:21Z")
Created ILM successfully couple of weeks ago for multi topics but one of topics I am getting error messages on logstash log - limit of total field 1000 for footy-000013. I added below: PUT micky\_aaa\_footy\*/\_settings { … --- ## [Ingest pipeline not working correctly?](https://discuss.elastic.co/t/ingest-pipeline-not-working-correctly/253291)
**Author:** [@iamtheliquor](https://discuss.elastic.co/u/iamtheliquor)\ **Replies:** 2\ **Last updated:** [October 27, 2020, 10:36am UTC](https://discuss.elastic.co/t/ingest-pipeline-not-working-correctly/253291 "2020-10-27T10:36:55Z")
Hi everybody, We have two pipelines, that are identical, one is for staging and one is for production logs; { "staging\_pipeline" : { "description" : "Staging Pipeline", "processors" : \[ … --- ## [Cant filter out events?](https://discuss.elastic.co/t/cant-filter-out-events/253174)
**Author:** [@jcor](https://discuss.elastic.co/u/jcor)\ **Replies:** 14\ **Last updated:** [October 27, 2020, 10:03am UTC](https://discuss.elastic.co/t/cant-filter-out-events/253174 "2020-10-27T10:03:07Z")
Hi all, We're trying to configure winlog beats to drop info level logs but seem to be missing something. Ive found a post that is trying to do the same thing as we are but their config isnt working. So I'm guessing my l… --- ## [A new index for each container?](https://discuss.elastic.co/t/a-new-index-for-each-container/253394)
**Author:** [@nyquillus](https://discuss.elastic.co/u/nyquillus)\ **Replies:** 1\ **Last updated:** [October 27, 2020, 9:28am UTC](https://discuss.elastic.co/t/a-new-index-for-each-container/253394 "2020-10-27T09:28:58Z")
Hi, I am currently running a test environment to try gelf logging driver to monitor container logs with a single node stack and so far it worked well. But I need to make some changes and I'm pretty new to this so I need… --- ## [Kibana search bar in dashboard](https://discuss.elastic.co/t/kibana-search-bar-in-dashboard/252801)
**Author:** [@sus](https://discuss.elastic.co/u/sus)\ **Replies:** 2\ **Last updated:** [October 27, 2020, 7:39am UTC](https://discuss.elastic.co/t/kibana-search-bar-in-dashboard/252801 "2020-10-27T07:39:38Z")
Hi! Im working in Kibana 7.8.1. I have a dashboard with a controls visualization and a table. The controls visualization has a dropdown menu - at the moment I dont have more than 100 data entries, but sooner than later… --- ## [Sending Rsyslog data to logstash](https://discuss.elastic.co/t/sending-rsyslog-data-to-logstash/249066)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 6\ **Last updated:** [October 27, 2020, 7:25am UTC](https://discuss.elastic.co/t/sending-rsyslog-data-to-logstash/249066 "2020-10-27T07:25:26Z")
I've configured two linux server for sending client rsyslog data to server.The server is receiving messages from client and i've installed elk service on server side now i want to send the rsyslog data (which the server … --- ## [Constant SocketException: Broken pipe for selective indices while taking snapshot to AWS](https://discuss.elastic.co/t/constant-socketexception-broken-pipe-for-selective-indices-while-taking-snapshot-to-aws/253389)
**Author:** [@nishant.saini](https://discuss.elastic.co/u/nishant.saini)\ **Replies:** 0\ **Last updated:** [October 27, 2020, 6:28am UTC](https://discuss.elastic.co/t/constant-socketexception-broken-pipe-for-selective-indices-while-taking-snapshot-to-aws/253389 "2020-10-27T06:28:49Z")
We have been facing a strange issue while taking snapshot of all the indices in our cluster. Issuing an API call to take snapshot works fine every time for some indices but fail every time for a few indices. Taking snap… --- ## [Logstash clustering issue](https://discuss.elastic.co/t/logstash-clustering-issue/251777)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 8\ **Last updated:** [October 27, 2020, 6:17am UTC](https://discuss.elastic.co/t/logstash-clustering-issue/251777 "2020-10-27T06:17:46Z")
Im having Elasticsearch clustering and my output.conf in logstash, looks like below hosts =\> \["node1:9200","node2:9200","node3:9200"\] So through java, Im updating output.conf and starting logstash. Now in case my elast… --- ## [Does the Metricbeat oracle module works for oracle 11.2 standard edition](https://discuss.elastic.co/t/does-the-metricbeat-oracle-module-works-for-oracle-11-2-standard-edition/251985)
**Author:** [@Sunil18](https://discuss.elastic.co/u/Sunil18)\ **Replies:** 2\ **Last updated:** [October 27, 2020, 5:39am UTC](https://discuss.elastic.co/t/does-the-metricbeat-oracle-module-works-for-oracle-11-2-standard-edition/251985 "2020-10-27T05:39:43Z")
Does the Metricbeat module works for oracle 11.2 standard version ? --- ## [Best strategy for fast recoveries after node restart](https://discuss.elastic.co/t/best-strategy-for-fast-recoveries-after-node-restart/253381)
**Author:** [@jthoni](https://discuss.elastic.co/u/jthoni)\ **Replies:** 0\ **Last updated:** [October 27, 2020, 2:35am UTC](https://discuss.elastic.co/t/best-strategy-for-fast-recoveries-after-node-restart/253381 "2020-10-27T02:35:06Z")
We have a 90 node cluster running in an Azure Service Fabric application. We have a few services in this application (logstash, a watchdog service, some compliance services, etc.). We occasionally need to roll updates ou… --- ## [How to Auto Login Kibana Dashboard which embedded in Iframe](https://discuss.elastic.co/t/how-to-auto-login-kibana-dashboard-which-embedded-in-iframe/252975)
**Author:** [@Ram\_Chaudhari](https://discuss.elastic.co/u/Ram_Chaudhari)\ **Replies:** 3\ **Last updated:** [October 27, 2020, 1:23am UTC](https://discuss.elastic.co/t/how-to-auto-login-kibana-dashboard-which-embedded-in-iframe/252975 "2020-10-27T01:23:35Z")
I am using angular 8 for front end application where we have dashboard page where a iframe of kibana dashboard will be present. If user logins to application, he should automatically get logged in to kibana also. How can… --- ## [How to format inregular json-string like this?](https://discuss.elastic.co/t/how-to-format-inregular-json-string-like-this/253375)
**Author:** [@knight](https://discuss.elastic.co/u/knight)\ **Replies:** 0\ **Last updated:** [October 27, 2020, 1:12am UTC](https://discuss.elastic.co/t/how-to-format-inregular-json-string-like-this/253375 "2020-10-27T01:12:39Z")
i have a json-string like this : { "aa":"123", "bb":"hello", "cc":"===this is inregular json==={"dd":"world","ee":"logstash"}" } now,the config file in logstash is : input { kafka { bootstrap\_servers… --- ## [How to remove document I logstash pipilnie that has no usefull fields](https://discuss.elastic.co/t/how-to-remove-document-i-logstash-pipilnie-that-has-no-usefull-fields/253243)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 8\ **Last updated:** [October 26, 2020, 11:53pm UTC](https://discuss.elastic.co/t/how-to-remove-document-i-logstash-pipilnie-that-has-no-usefull-fields/253243 "2020-10-26T23:53:44Z")
Hello, I use the logstash SNMP plugin to query my device. After that, I do some split and field renaming as below. input { snmp { interval =\> 5 hosts =\> \[ {host =\> "udp:ip/port" communit… --- ## [Changing role of a pod node](https://discuss.elastic.co/t/changing-role-of-a-pod-node/253371)
**Author:** [@asrinivasan](https://discuss.elastic.co/u/asrinivasan)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 11:49pm UTC](https://discuss.elastic.co/t/changing-role-of-a-pod-node/253371 "2020-10-26T23:49:18Z")
Hi I have a cluster with 5 master nodes and 10 data nodes deployed on GKE using the stable helm charts. Version is 7.2.0. When i setup the cluster initially i had 5 nodes which had alll the roles master,data and ingest… --- ## [Kibana export API](https://discuss.elastic.co/t/kibana-export-api/253359)
**Author:** [@Carlos\_Fernando\_Palm](https://discuss.elastic.co/u/Carlos_Fernando_Palm)\ **Replies:** 3\ **Last updated:** [October 26, 2020, 9:42pm UTC](https://discuss.elastic.co/t/kibana-export-api/253359 "2020-10-26T21:42:35Z")
Hello, I am trying to export a canvas using this: Now the request requires a type, but when I set canvas it says {"statusCode":400,"error":"Bad Request","message":"Trying to export non-exportable type(s): \*"} Ther… --- ## [{"statusCode":404,"error":"Not Found","message":"Not Found"} after security](https://discuss.elastic.co/t/statuscode-404-error-not-found-message-not-found-after-security/252730)
**Author:** [@txmrlevine](https://discuss.elastic.co/u/txmrlevine)\ **Replies:** 13\ **Last updated:** [October 26, 2020, 8:10pm UTC](https://discuss.elastic.co/t/statuscode-404-error-not-found-message-not-found-after-security/252730 "2020-10-26T20:10:51Z")
after implementing the following lines in my 7.7.1 nodes I try to bring up Kibana and AFTER I use the login credentials I supplied in the password-setup binary I get the 404. I created the cert on the master node and p… --- ## [Logstash problem](https://discuss.elastic.co/t/logstash-problem/253349)
**Author:** [@dfoot](https://discuss.elastic.co/u/dfoot)\ **Replies:** 1\ **Last updated:** [October 26, 2020, 7:53pm UTC](https://discuss.elastic.co/t/logstash-problem/253349 "2020-10-26T19:53:13Z")
Logstash version 7.1.1 after restart logstash I am getting below log message but not sure what is issue. Please advise. tail /var/log/logstash/logstash-plain.log \[2020-09-28T09:23:05,009\]\[WARN \]\[logstash.outputs.elasti… --- ## [Logstash-input-salesforce](https://discuss.elastic.co/t/logstash-input-salesforce/252906)
**Author:** [@eemtzc](https://discuss.elastic.co/u/eemtzc)\ **Replies:** 5\ **Last updated:** [October 26, 2020, 7:09pm UTC](https://discuss.elastic.co/t/logstash-input-salesforce/252906 "2020-10-26T19:09:37Z")
Hello, Right now in the actuallyty we are running a Elastic Cluster v 7.5.2 with a Logstash 6.4.2 we want to upgrade our cluster to v 7.9.2 but the only reason we are not able to do this is because in this Logstash serv… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1729) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1731)