# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1740 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1741 --- ## [Adding sorting feature to Kibana fields](https://discuss.elastic.co/t/adding-sorting-feature-to-kibana-fields/252157)
**Author:** [@rdkgn](https://discuss.elastic.co/u/rdkgn)\ **Replies:** 3\ **Last updated:** [October 21, 2020, 5:54am UTC](https://discuss.elastic.co/t/adding-sorting-feature-to-kibana-fields/252157 "2020-10-21T05:54:12Z")
Hello, I am unable to add SORTING (Arrows for ascending and descending sort) to my custom fields added to Kibana. My present GROK pattern is as below. I want to add sorting for TIME , Please help \*\*match =\> { "message… --- ## [Xpack monitoring doesn't work after migration](https://discuss.elastic.co/t/xpack-monitoring-doesnt-work-after-migration/252532)
**Author:** [@aranelofdoriath](https://discuss.elastic.co/u/aranelofdoriath)\ **Replies:** 1\ **Last updated:** [October 21, 2020, 5:46am UTC](https://discuss.elastic.co/t/xpack-monitoring-doesnt-work-after-migration/252532 "2020-10-21T05:46:20Z")
Hi all, I saw a lot of a similar questions but no one of them doesn't help me, so. We have a ES cluster with 14 nodes (each node run in docker in a separate instance) and one Kibana/Logstash node (run in a docker too). … --- ## [Alerting based on change of field values](https://discuss.elastic.co/t/alerting-based-on-change-of-field-values/252264)
**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\ **Replies:** 2\ **Last updated:** [October 21, 2020, 5:16am UTC](https://discuss.elastic.co/t/alerting-based-on-change-of-field-values/252264 "2020-10-21T05:16:23Z")
Kibana version : 7.9 Elasticsearch version : 7.9 APM Server version : 7.9 APM Agent language and version : java 1.8 Fresh install or upgraded from other version? fresh install Is there anything special in your … --- ## [SSL options not working in logstash-output-mongodb (LS v7.9.0)](https://discuss.elastic.co/t/ssl-options-not-working-in-logstash-output-mongodb-ls-v7-9-0/252481)
**Author:** [@ksathya](https://discuss.elastic.co/u/ksathya)\ **Replies:** 4\ **Last updated:** [October 21, 2020, 5:01am UTC](https://discuss.elastic.co/t/ssl-options-not-working-in-logstash-output-mongodb-ls-v7-9-0/252481 "2020-10-21T05:01:33Z")
I am using logstash v7.9.0 for Windows. I am using logstash-output-mongodb plugin v 3.1.5. My output code is as below: mongodb { collection =\> "TestColection" database =\> "TestDB" … --- ## [Elasticsearch timeout issue](https://discuss.elastic.co/t/elasticsearch-timeout-issue/252698)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 3\ **Last updated:** [October 21, 2020, 5:00am UTC](https://discuss.elastic.co/t/elasticsearch-timeout-issue/252698 "2020-10-21T05:00:59Z")
Once I have enabled clustering, at times, I see elasticsearch takes few mins to comes up. That time I saw a timeout error in OS. I saw only TimeoutStopSec in elasticsearch.service. So should I create timeout conf file in… --- ## [Grok filter by source](https://discuss.elastic.co/t/grok-filter-by-source/252623)
**Author:** [@andi](https://discuss.elastic.co/u/andi)\ **Replies:** 4\ **Last updated:** [October 21, 2020, 4:49am UTC](https://discuss.elastic.co/t/grok-filter-by-source/252623 "2020-10-21T04:49:48Z")
Hi All, Sorry i'm new on ELK, currently i'm use ELK 6.8.10, it's working properly, with filter by tags, this is my grok. filter { if "nameservice-out-staging" in \[tags\] { grok { match =\> { "message" =\> … --- ## [Timelion alternatives for canvas workpad](https://discuss.elastic.co/t/timelion-alternatives-for-canvas-workpad/252125)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 4\ **Last updated:** [October 21, 2020, 4:17am UTC](https://discuss.elastic.co/t/timelion-alternatives-for-canvas-workpad/252125 "2020-10-21T04:17:03Z")
Hello, Are there any alternatives to timelion in canvas? I would like to show time-based data, but there are bugs with timelion that I cannot workaround. The final result should look something like this: Would be h… --- ## [\[Filebeat\] K8s OOM kill causes file corruption](https://discuss.elastic.co/t/filebeat-k8s-oom-kill-causes-file-corruption/252734)
**Author:** [@boernd](https://discuss.elastic.co/u/boernd)\ **Replies:** 1\ **Last updated:** [October 21, 2020, 3:06am UTC](https://discuss.elastic.co/t/filebeat-k8s-oom-kill-causes-file-corruption/252734 "2020-10-21T03:06:49Z")
Hi, I have the following issue and think it's a bug but wanted to post here before filing a Github issue: A filebeat container gets killed/restarted because of memory limits within K8s. After the container restart the … --- ## [Search phase execution error missing error](https://discuss.elastic.co/t/search-phase-execution-error-missing-error/252624)
**Author:** [@BigSugar](https://discuss.elastic.co/u/BigSugar)\ **Replies:** 3\ **Last updated:** [October 21, 2020, 2:25am UTC](https://discuss.elastic.co/t/search-phase-execution-error-missing-error/252624 "2020-10-21T02:25:20Z")
Need help with this one: Error loading data search\_phase\_execution\_exception all shards failed Error at Fetch.\_callee3$ (https://5e. . . No error type listed in the peach banner or after Error (there is no "Bad Req… --- ## [Problem with parsing json in syslog format](https://discuss.elastic.co/t/problem-with-parsing-json-in-syslog-format/252042)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 4\ **Last updated:** [October 21, 2020, 1:16am UTC](https://discuss.elastic.co/t/problem-with-parsing-json-in-syslog-format/252042 "2020-10-21T01:16:34Z")
Hi, can you please help me with logstash config? input { #tcp { # port =\> 5014 # type =\> syslog #} udp { port =\> 5014 type =\> syslog } } filter { … --- ## [No field found for \[\] in mapping with types \[\]](https://discuss.elastic.co/t/no-field-found-for-in-mapping-with-types/250668)
**Author:** [@shobin-ebp](https://discuss.elastic.co/u/shobin-ebp)\ **Replies:** 1\ **Last updated:** [October 21, 2020, 12:08am UTC](https://discuss.elastic.co/t/no-field-found-for-in-mapping-with-types/250668 "2020-10-21T00:08:39Z")
I have following query { "query": { "function\_score": { "query": { "match\_all": {} }, "functions": \[ { "script\_score": { "script": { "lang": "p… --- ## [Nodes eventually disconnect with ssl enabled on transport layer](https://discuss.elastic.co/t/nodes-eventually-disconnect-with-ssl-enabled-on-transport-layer/252100)
**Author:** [@Sebastian\_Seith](https://discuss.elastic.co/u/Sebastian_Seith)\ **Replies:** 16\ **Last updated:** [October 20, 2020, 10:16pm UTC](https://discuss.elastic.co/t/nodes-eventually-disconnect-with-ssl-enabled-on-transport-layer/252100 "2020-10-20T22:16:22Z")
Hi Everyone, I've got a 3-node, 7.6.1 cluster running on ec2 t2.medium instances in a private vpc we're using for a machine-learning project. We got everything set up fine and had no issues with a number of different t… --- ## [Multiple entries for single file in sincedb](https://discuss.elastic.co/t/multiple-entries-for-single-file-in-sincedb/252438)
**Author:** [@chandramouli\_sriniva](https://discuss.elastic.co/u/chandramouli_sriniva)\ **Replies:** 14\ **Last updated:** [October 20, 2020, 9:29pm UTC](https://discuss.elastic.co/t/multiple-entries-for-single-file-in-sincedb/252438 "2020-10-20T21:29:21Z")
Hi, I read a single file from server(C:/Users/xx.log - its a rotating log file daily) and route to kafka. In a single sincedb file, we see multiple entries like below. Is this valid. we see dupes on Kafka topic. Is it … --- ## [Using LB for discovery.zen.ping.unicast.hosts no longer works?](https://discuss.elastic.co/t/using-lb-for-discovery-zen-ping-unicast-hosts-no-longer-works/252740)
**Author:** [@Chris\_Gatihi](https://discuss.elastic.co/u/Chris_Gatihi)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 9:19pm UTC](https://discuss.elastic.co/t/using-lb-for-discovery-zen-ping-unicast-hosts-no-longer-works/252740 "2020-10-20T21:19:01Z")
Hi, For a long time I've been able to use a load balancer IP for the discovery.zen.ping.unicast.hosts property in elasticsearch.yml. But I just upgraded from 5.6 to 6.8 and after upgrading ES is no longer able to detec… --- ## [MS SQL monitoring with Filebeat?](https://discuss.elastic.co/t/ms-sql-monitoring-with-filebeat/252392)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 10\ **Last updated:** [October 20, 2020, 8:10pm UTC](https://discuss.elastic.co/t/ms-sql-monitoring-with-filebeat/252392 "2020-10-20T20:10:21Z")
Hi, Note: - Using ELK 7.9.2 in Debian 10 - MS SQL Server 2016 SP2 Standard in Windows Server 2012 I want to start monitoring my MS SQL Server with Elasticsearch and visualize the data in Kibana. After some research I… --- ## [Known Issue Logstash 7.7.1-7.9.1: Logstash Keystore may fail when used with multiple pipelines](https://discuss.elastic.co/t/known-issue-logstash-7-7-1-7-9-1-logstash-keystore-may-fail-when-used-with-multiple-pipelines/252711)
**Author:** [@RobBavey](https://discuss.elastic.co/u/RobBavey)\ **Replies:** 3\ **Last updated:** [October 20, 2020, 7:51pm UTC](https://discuss.elastic.co/t/known-issue-logstash-7-7-1-7-9-1-logstash-keystore-may-fail-when-used-with-multiple-pipelines/252711 "2020-10-20T19:51:44Z")
A performance related change made in Logstash 7.7.1 may cause Logstash configurations with multiple pipelines to fail with the following error: "Unable to configure plugins: (ConfigurationError) Cannot evaluate \`${varia… --- ## [Ansible uri post after upgrade to 7.9.2](https://discuss.elastic.co/t/ansible-uri-post-after-upgrade-to-7-9-2/252724)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 6:00pm UTC](https://discuss.elastic.co/t/ansible-uri-post-after-upgrade-to-7-9-2/252724 "2020-10-20T18:00:57Z")
I have been using ansible to manage templates and role mappings using the uri method similar to this: - name: Post to elastic uri: url: "{{ cluster\_uri }}/\_template/{{ obj }}?pretty" method: POST … --- ## [Shards issue when trying to add a filter](https://discuss.elastic.co/t/shards-issue-when-trying-to-add-a-filter/252585)
**Author:** [@leostereo](https://discuss.elastic.co/u/leostereo)\ **Replies:** 2\ **Last updated:** [October 20, 2020, 5:24pm UTC](https://discuss.elastic.co/t/shards-issue-when-trying-to-add-a-filter/252585 "2020-10-20T17:24:55Z")
Hi guys. My elk platform was working very nice. I was running filebeat with netflow module. I also created default dashboard for kibana. Everything was ok , until tryed to add a filter. After adding a filter on the… --- ## [Next.checkpoint\_progress.total\_docs remains empty after first checkpoint](https://discuss.elastic.co/t/next-checkpoint-progress-total-docs-remains-empty-after-first-checkpoint/251729)
**Author:** [@Julien\_HENRY](https://discuss.elastic.co/u/Julien_HENRY)\ **Replies:** 17\ **Last updated:** [October 20, 2020, 4:50pm UTC](https://discuss.elastic.co/t/next-checkpoint-progress-total-docs-remains-empty-after-first-checkpoint/251729 "2020-10-20T16:50:55Z")
Hi, We have defined a continuous transform job in Elastic Cloud, using a scripted group\_by. We were previously bitten by this bug so we have upgraded Kibana to 7.9.2, and I recreated the transform job from scratch just… --- ## [Autocomplete - Hierarchical Data](https://discuss.elastic.co/t/autocomplete-hierarchical-data/252696)
**Author:** [@sumanthmitra](https://discuss.elastic.co/u/sumanthmitra)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 1:56pm UTC](https://discuss.elastic.co/t/autocomplete-hierarchical-data/252696 "2020-10-20T13:56:46Z")
Hello, I am looking for autocomplete functionality for the hierarchical data and was wondering if it's possible to achieve this functionality with elasticsearch. As an example, consider the below data. "phrase1" / "w… --- ## [Implications during shrink and force merge on index rollover](https://discuss.elastic.co/t/implications-during-shrink-and-force-merge-on-index-rollover/252712)
**Author:** [@mjedynak](https://discuss.elastic.co/u/mjedynak)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 3:55pm UTC](https://discuss.elastic.co/t/implications-during-shrink-and-force-merge-on-index-rollover/252712 "2020-10-20T15:55:49Z")
I have index lifecycle policy (hot phase 1 month -\> warm phase, read only) and during rollover there is automatic operation of shrink and force merge. My index has 2 primary shards + 1 replica (after shrinking it's 1 pr… --- ## [Upgrade from 6.8.12 oss to 7.9.2 basic](https://discuss.elastic.co/t/upgrade-from-6-8-12-oss-to-7-9-2-basic/250028)
**Author:** [@searchy](https://discuss.elastic.co/u/searchy)\ **Replies:** 2\ **Last updated:** [October 20, 2020, 3:37pm UTC](https://discuss.elastic.co/t/upgrade-from-6-8-12-oss-to-7-9-2-basic/250028 "2020-10-20T15:37:33Z")
Greetings wonderful elasticsearch wizards! I was wondering if there was any way to do a ROLLING UPGRADE from oss to basic? Specifically, we are looking to go from 6.8.12 oss to 7.9.2 elastic basic. I do see in some p… --- ## [Elaticsearch kibana ml jobs issue](https://discuss.elastic.co/t/elaticsearch-kibana-ml-jobs-issue/252486)
**Author:** [@Akhil\_Mohan](https://discuss.elastic.co/u/Akhil_Mohan)\ **Replies:** 10\ **Last updated:** [October 20, 2020, 3:34pm UTC](https://discuss.elastic.co/t/elaticsearch-kibana-ml-jobs-issue/252486 "2020-10-20T15:34:32Z")
I have created one kibana ml jobs to alert when low event rate and i have ingested data using the audit beat continuously and stop the ingestion but event is not getting triggered.how can i solve this issue. --- ## [Filebeat invalid template id](https://discuss.elastic.co/t/filebeat-invalid-template-id/252534)
**Author:** [@111401](https://discuss.elastic.co/u/111401)\ **Replies:** 2\ **Last updated:** [October 20, 2020, 3:11pm UTC](https://discuss.elastic.co/t/filebeat-invalid-template-id/252534 "2020-10-20T15:11:29Z")
Hi, I have some issue in filebeat. I had sent nProbe netflow v9 to filebeat but when I start filebeat it comes the problem below. elklab@localhost filebeat\]$ sudo filebeat -e \[sudo\] password for elklab: 2020-10-19T17… --- ## [Logfile from restarted docker container is not scanned and written to registry](https://discuss.elastic.co/t/logfile-from-restarted-docker-container-is-not-scanned-and-written-to-registry/248177)
**Author:** [@Tomas\_Bartek](https://discuss.elastic.co/u/Tomas_Bartek)\ **Replies:** 1\ **Last updated:** [October 20, 2020, 3:05pm UTC](https://discuss.elastic.co/t/logfile-from-restarted-docker-container-is-not-scanned-and-written-to-registry/248177 "2020-10-20T15:05:15Z")
Hello Team Problem We have an issue, where logfile from a restarted docker container is not scanned, registered and processed by a filebeat. We were using docker input module without problems, until we have spotted a … --- ## [Forcing a Default Dashboard](https://discuss.elastic.co/t/forcing-a-default-dashboard/252586)
**Author:** [@teej](https://discuss.elastic.co/u/teej)\ **Replies:** 6\ **Last updated:** [October 20, 2020, 3:03pm UTC](https://discuss.elastic.co/t/forcing-a-default-dashboard/252586 "2020-10-20T15:03:13Z")
Hi, Curious how I can force a dashboard to appear as default when a user logs in. Currently, they have to go to the DASHBOARD section and select one but I want them to get one of my choosing the moment they log in. Than… --- ## [Logstash pipelines dose not work independently](https://discuss.elastic.co/t/logstash-pipelines-dose-not-work-independently/252704)
**Author:** [@chamiduz](https://discuss.elastic.co/u/chamiduz)\ **Replies:** 1\ **Last updated:** [October 20, 2020, 3:00pm UTC](https://discuss.elastic.co/t/logstash-pipelines-dose-not-work-independently/252704 "2020-10-20T15:00:18Z")
Hi, I want to implement a logstash pipeline to parallelly send unprocessed data to s3 and processed data to ES. I currently have this implementation but data is not publishing to s3 when ES is not responding. how can … --- ## [Canvas Time filter breaks other elements](https://discuss.elastic.co/t/canvas-time-filter-breaks-other-elements/251754)
**Author:** [@GavinBeattie](https://discuss.elastic.co/u/GavinBeattie)\ **Replies:** 12\ **Last updated:** [October 20, 2020, 2:59pm UTC](https://discuss.elastic.co/t/canvas-time-filter-breaks-other-elements/251754 "2020-10-20T14:59:47Z")
I am trying to add a Time filter element to a Canvas Workpad, but each time I do it breaks the existing table or chart elements. I think that I have followed all online guidance/tutorials to the letter e.g. Both… --- ## [\[ERROR\]\[logstash.pipeline \] Error registering plugin {:pipeline\_id=\>"main", :plugin=\>"\\\"/usr/share/logstash/logstash-core/lib/jars/sqljdbc42.jar\\", jdbc\_connection\_string](https://discuss.elastic.co/t/error-logstash-pipeline-error-registering-plugin-pipeline-id-main-plugin-logstash-jdbc-jdbc-driver-library-usr-share-logstash-logstash-core-lib-jars-sqljdbc42-jar-jdbc-connection-string/252562)
**Author:** [@lynda](https://discuss.elastic.co/u/lynda)\ **Replies:** 11\ **Last updated:** [October 20, 2020, 2:27pm UTC](https://discuss.elastic.co/t/error-logstash-pipeline-error-registering-plugin-pipeline-id-main-plugin-logstash-jdbc-jdbc-driver-library-usr-share-logstash-logstash-core-lib-jars-sqljdbc42-jar-jdbc-connection-string/252562 "2020-10-20T14:27:14Z")
Hello, I have been trying to run logstash as a service but it keeps failing then restarting in a loop. I tried looking for a solution in similar topics without finding anything useful in my case. Here are the logs when… --- ## [Need help with setting up 1 masternode and two datanodes set up](https://discuss.elastic.co/t/need-help-with-setting-up-1-masternode-and-two-datanodes-set-up/251505)
**Author:** [@sk545](https://discuss.elastic.co/u/sk545)\ **Replies:** 10\ **Last updated:** [October 20, 2020, 2:09pm UTC](https://discuss.elastic.co/t/need-help-with-setting-up-1-masternode-and-two-datanodes-set-up/251505 "2020-10-20T14:09:56Z")
Hello All, As we are implementing ELK in our org as a pilot project, I'm trying to set up 3 nodes Elastic cluster (all acts master and data nodes ), I have created Ubuntu servers in Azure cloud with specific hardware c… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1739) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1741)