# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1751

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1752

---

## [How to view custom plugin changes in Kibana 7.5](https://discuss.elastic.co/t/how-to-view-custom-plugin-changes-in-kibana-7-5/251483)

<div class="topic-metadata">

**Author:** [@ssimmons](https://discuss.elastic.co/u/ssimmons)\
**Replies:** 2\
**Last updated:** [October 14, 2020, 12:41pm UTC](https://discuss.elastic.co/t/how-to-view-custom-plugin-changes-in-kibana-7-5/251483 "2020-10-14T12:41:51Z")

</div>

I written a few custom plugins for Kibana 7.5.0. I've found that if I install my updated plugin and then restart Kibana, I do not see my changes. If I want to see my changes to the pluign, I must uninstall my current plu…

---

## [Heartbeat URL changing after POST](https://discuss.elastic.co/t/heartbeat-url-changing-after-post/251934)

<div class="topic-metadata">

**Author:** [@OracleDBA](https://discuss.elastic.co/u/OracleDBA)\
**Replies:** 6\
**Last updated:** [October 14, 2020, 12:27pm UTC](https://discuss.elastic.co/t/heartbeat-url-changing-after-post/251934 "2020-10-14T12:27:15Z")

</div>

Hello, I have a heartbeat configuration such as: - type: http name: CHECK-A id: CHECK-A schedule: '@every: 10s' urls: \["https://website/check/checkRequest.html"\] check.request: method: POST response.inclu…

---

## [Caused by: java.lang.NullPointerException: Cannot invoke \\"org.elasticsearch.index.analysis.AnalyzerComponents.getCharFilters()\\" because \\"components\\" is null](https://discuss.elastic.co/t/caused-by-java-lang-nullpointerexception-cannot-invoke-org-elasticsearch-index-analysis-analyzercomponents-getcharfilters-because-components-is-null/251824)

<div class="topic-metadata">

**Author:** [@jdoucy](https://discuss.elastic.co/u/jdoucy)\
**Replies:** 1\
**Last updated:** [October 14, 2020, 12:25pm UTC](https://discuss.elastic.co/t/caused-by-java-lang-nullpointerexception-cannot-invoke-org-elasticsearch-index-analysis-analyzercomponents-getcharfilters-because-components-is-null/251824 "2020-10-14T12:25:05Z")

</div>

Hi there, I get an issue with \_reload\_search\_analyzers I simply try to reload a synonym file but it doesn't reload it, no error, just the new file is not taken into account. So I tried the old way, closing and re-open…

---

## [When \_index\_template is set \_template is ignored](https://discuss.elastic.co/t/when-index-template-is-set-template-is-ignored/252036)

<div class="topic-metadata">

**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\
**Replies:** 0\
**Last updated:** [October 14, 2020, 11:45am UTC](https://discuss.elastic.co/t/when-index-template-is-set-template-is-ignored/252036 "2020-10-14T11:45:29Z")

</div>

I created default \_index\_template to add attribute to settings for hot nodes since I set this parameter all \_templates are ignored. There is some incompatibility between \_index\_template and \_template do I have to migr…

---

## [Unable to create scripted field](https://discuss.elastic.co/t/unable-to-create-scripted-field/252028)

<div class="topic-metadata">

**Author:** [@Jose\_Angel\_Morena\_Si](https://discuss.elastic.co/u/Jose_Angel_Morena_Si)\
**Replies:** 5\
**Last updated:** [October 14, 2020, 11:43am UTC](https://discuss.elastic.co/t/unable-to-create-scripted-field/252028 "2020-10-14T11:43:52Z")

</div>

Hello, Elastic version: 7.9.1 Kibana version: 7.9.0 I am struggling to create a scripted field. To put it on perspective, I have the field "apache.status.total\_kbytes". And I would like to create a scripted field name…

---

## [Controls visualization filter uses the default index pattern](https://discuss.elastic.co/t/controls-visualization-filter-uses-the-default-index-pattern/251189)

<div class="topic-metadata">

**Author:** [@lorehek](https://discuss.elastic.co/u/lorehek)\
**Replies:** 1\
**Last updated:** [October 14, 2020, 11:41am UTC](https://discuss.elastic.co/t/controls-visualization-filter-uses-the-default-index-pattern/251189 "2020-10-14T11:41:35Z")

</div>

Hello community! I hope someone can help. I'd like to have the Controls visualization filter for particular value. I can do this in other visualizations such as the data table but since when creating the controls visua…

---

## [Logstash Pipeline Monitoring Data Is Blank In Kibana](https://discuss.elastic.co/t/logstash-pipeline-monitoring-data-is-blank-in-kibana/251398)

<div class="topic-metadata">

**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\
**Replies:** 0\
**Last updated:** [October 8, 2020, 8:47am UTC](https://discuss.elastic.co/t/logstash-pipeline-monitoring-data-is-blank-in-kibana/251398 "2020-10-08T08:47:18Z")

</div>

Hi All, I have 5 pipelines for logstash, out of which 4 are working fine, however for one pipeline I can see just blank in stack monitoring. I don't know where to check the error for this as well

---

## [Doubt shard allocation balance between nodes](https://discuss.elastic.co/t/doubt-shard-allocation-balance-between-nodes/249638)

<div class="topic-metadata">

**Author:** [@adrian-arapiles](https://discuss.elastic.co/u/adrian-arapiles)\
**Replies:** 11\
**Last updated:** [October 14, 2020, 11:26am UTC](https://discuss.elastic.co/t/doubt-shard-allocation-balance-between-nodes/249638 "2020-10-14T11:26:12Z")

</div>

Hi, I have a doubt about shard node allocation in elasticsearch. Maybe I missed any page of documentation, but I didn't find a solution for my issue. I have a elasticsearch cluster with n number of nodes, and I have sp…

---

## [Add field based on another](https://discuss.elastic.co/t/add-field-based-on-another/250511)

<div class="topic-metadata">

**Author:** [@sandikata](https://discuss.elastic.co/u/sandikata)\
**Replies:** 9\
**Last updated:** [October 14, 2020, 11:24am UTC](https://discuss.elastic.co/t/add-field-based-on-another/250511 "2020-10-14T11:24:07Z")

</div>

Hello. I'd like to know if there's any possibility to add new field based on request filed, but with some regex. (%{NOTSPACE:request}\[?#$\]\\S\*) i'd like to add this one as field "request\_file" and the full output to st…

---

## [Functionbeat Disable ilm Policy](https://discuss.elastic.co/t/functionbeat-disable-ilm-policy/248829)

<div class="topic-metadata">

**Author:** [@sainath](https://discuss.elastic.co/u/sainath)\
**Replies:** 5\
**Last updated:** [October 14, 2020, 11:23am UTC](https://discuss.elastic.co/t/functionbeat-disable-ilm-policy/248829 "2020-10-14T11:23:59Z")

</div>

Hi Team, I am trying to enable custom index in functionbeat using the below configuration. output.elasticsearch: hosts: \["10.10.10.10:9200"\] output.elasticsearch.index: "customname-%{\[agent.version\]}-%{+yyyy.M…

---

## [Visitor user agent information](https://discuss.elastic.co/t/visitor-user-agent-information/250515)

<div class="topic-metadata">

**Author:** [@sandikata](https://discuss.elastic.co/u/sandikata)\
**Replies:** 5\
**Last updated:** [October 14, 2020, 11:23am UTC](https://discuss.elastic.co/t/visitor-user-agent-information/250515 "2020-10-14T11:23:32Z")

</div>

Hello! I am trying to separate in fields the useragent information, i've followed instructions from user-agent-processor Everything looks good, but when i check in kibana frontend, everything is still on same line, no…

---

## [Logstash grokparsefailure](https://discuss.elastic.co/t/logstash-grokparsefailure/250598)

<div class="topic-metadata">

**Author:** [@sandikata](https://discuss.elastic.co/u/sandikata)\
**Replies:** 3\
**Last updated:** [October 14, 2020, 11:22am UTC](https://discuss.elastic.co/t/logstash-grokparsefailure/250598 "2020-10-14T11:22:53Z")

</div>

Hello! Is it there any way (human readable) to debug what is causing grokparsefailure? There's my nginx filter conf filter { if "nginx\_access" in \[tags\] { grok { patterns\_dir =\> \["/etc/logstash/patterns"\] ma…

---

## [Metricbeat for IBM MQ for remote queue manager](https://discuss.elastic.co/t/metricbeat-for-ibm-mq-for-remote-queue-manager/251423)

<div class="topic-metadata">

**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\
**Replies:** 1\
**Last updated:** [October 14, 2020, 11:02am UTC](https://discuss.elastic.co/t/metricbeat-for-ibm-mq-for-remote-queue-manager/251423 "2020-10-14T11:02:28Z")

</div>

Hi All, I am trying to use metricbeat for IBM MQ but I am Dashboard are blank and getting below message. Looks like, metricbeat isn't able to connect with my Queue manager No data to display for the selected metrics C…

---

## [String field to "mailto:" link](https://discuss.elastic.co/t/string-field-to-mailto-link/251995)

<div class="topic-metadata">

**Author:** [@sherifeldeeb](https://discuss.elastic.co/u/sherifeldeeb)\
**Replies:** 1\
**Last updated:** [October 14, 2020, 10:59am UTC](https://discuss.elastic.co/t/string-field-to-mailto-link/251995 "2020-10-14T10:59:54Z")

</div>

I am trying to make a clickable "mailto:" out of a string field in kibana. For example: field contains "test@example.com", then the field will be displayed as a link that opens the default email client (e.g. \<a href="ma…

---

## [Metricbeat System Dashboard](https://discuss.elastic.co/t/metricbeat-system-dashboard/251200)

<div class="topic-metadata">

**Author:** [@kvtang](https://discuss.elastic.co/u/kvtang)\
**Replies:** 1\
**Last updated:** [October 14, 2020, 10:53am UTC](https://discuss.elastic.co/t/metricbeat-system-dashboard/251200 "2020-10-14T10:53:41Z")

</div>

Hi all, Recently when I'm exploring metricbeat I realised that there is some custom dashboard available in json format when we installed metricbeat. However, I'm not able to load the dashboard to kibana directly as ment…

---

## [Elasticsearch won't start after 7.9.1 to 7.9.2 upgrade](https://discuss.elastic.co/t/elasticsearch-wont-start-after-7-9-1-to-7-9-2-upgrade/249878)

<div class="topic-metadata">

**Author:** [@craigothy](https://discuss.elastic.co/u/craigothy)\
**Replies:** 3\
**Last updated:** [October 14, 2020, 10:53am UTC](https://discuss.elastic.co/t/elasticsearch-wont-start-after-7-9-1-to-7-9-2-upgrade/249878 "2020-10-14T10:53:06Z")

</div>

For some reason, I am getting the following JVM error when starting elasticsearch 7.9.2 on CentOS7 after a yum upgrade. Any ideas? Thanks for any help: Exception in thread "main" java.lang.RuntimeException: starting ja…

---

## [Get visualization of missing data](https://discuss.elastic.co/t/get-visualization-of-missing-data/251285)

<div class="topic-metadata">

**Author:** [@mistrhanky](https://discuss.elastic.co/u/mistrhanky)\
**Replies:** 1\
**Last updated:** [October 14, 2020, 10:48am UTC](https://discuss.elastic.co/t/get-visualization-of-missing-data/251285 "2020-10-14T10:48:08Z")

</div>

I have data that comes in from many different sources(syslog hosts, ossec, etc). I need to visualize in a data table any sources that have been recieved in the last month but have NOT been recieved in the last 48 hours(T…

---

## [Effective strategy to recover from failed upgrade](https://discuss.elastic.co/t/effective-strategy-to-recover-from-failed-upgrade/252021)

<div class="topic-metadata">

**Author:** [@amishar](https://discuss.elastic.co/u/amishar)\
**Replies:** 0\
**Last updated:** [October 14, 2020, 10:43am UTC](https://discuss.elastic.co/t/effective-strategy-to-recover-from-failed-upgrade/252021 "2020-10-14T10:43:42Z")

</div>

For a large Elasticsearch cluster that serve frequent index creation requests(lets say 1-2 per sec) and where it is not possible to pause these index creation during the rolling upgrade, what is the most effective strate…

---

## [Getting error in kibana \[Circuit breaking exception\]](https://discuss.elastic.co/t/getting-error-in-kibana-circuit-breaking-exception/252012)

<div class="topic-metadata">

**Author:** [@Dimple\_Goyal](https://discuss.elastic.co/u/Dimple_Goyal)\
**Replies:** 1\
**Last updated:** [October 14, 2020, 10:41am UTC](https://discuss.elastic.co/t/getting-error-in-kibana-circuit-breaking-exception/252012 "2020-10-14T10:41:08Z")

</div>

{ statusCode: 429, error: "Too Many Requests", message: "\[circuit\_breaking\_exception\] \[parent\] Data too large, data for \[\<http\_request\>\] would be \[2047736072/1.9gb\], which is larger than the limit of \[2040109465/1.8gb\], …

---

## [Elastic search match query over array object](https://discuss.elastic.co/t/elastic-search-match-query-over-array-object/250786)

<div class="topic-metadata">

**Author:** [@aninda\_halder](https://discuss.elastic.co/u/aninda_halder)\
**Replies:** 2\
**Last updated:** [October 14, 2020, 10:23am UTC](https://discuss.elastic.co/t/elastic-search-match-query-over-array-object/250786 "2020-10-14T10:23:53Z")

</div>

Suppose i've 3 doc doc\_1 = { "citedIn": \[ "Bar Councils Act, 1926 - Section 15", "Contract Act, 1872 - Section 23" \] } doc\_2 = { "citedIn":\[ "15 C. B 400", "Contract Act, 18…

---

## [To find all the correlation id where response is not send back to the consumer](https://discuss.elastic.co/t/to-find-all-the-correlation-id-where-response-is-not-send-back-to-the-consumer/251896)

<div class="topic-metadata">

**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\
**Replies:** 5\
**Last updated:** [October 14, 2020, 10:12am UTC](https://discuss.elastic.co/t/to-find-all-the-correlation-id-where-response-is-not-send-back-to-the-consumer/251896 "2020-10-14T10:12:55Z")

</div>

Hi All, In our logs; For a transaction , two legs will get generated "Consumer to backend" and "Backend to Consumer" .However in case of failure , only one leg "Consumer to backend" will get generated. Unique correlati…

---

## [Retrieve multiple nested documents around the query matched document](https://discuss.elastic.co/t/retrieve-multiple-nested-documents-around-the-query-matched-document/250139)

<div class="topic-metadata">

**Author:** [@verdict-lg](https://discuss.elastic.co/u/verdict-lg)\
**Replies:** 1\
**Last updated:** [October 14, 2020, 9:35am UTC](https://discuss.elastic.co/t/retrieve-multiple-nested-documents-around-the-query-matched-document/250139 "2020-10-14T09:35:10Z")

</div>

Is there a way to retrieve multiple documents around the matching nested document. For example in this document: Book ID: ISBN8137183 Book Name: Name of the Wind Chapters: { {Chapter ID: 1 Gist: some\_text\_1 }, {Chapter …

---

## [Vega lite calcule worning](https://discuss.elastic.co/t/vega-lite-calcule-worning/251460)

<div class="topic-metadata">

**Author:** [@suibgui](https://discuss.elastic.co/u/suibgui)\
**Replies:** 1\
**Last updated:** [October 14, 2020, 9:33am UTC](https://discuss.elastic.co/t/vega-lite-calcule-worning/251460 "2020-10-14T09:33:05Z")

</div>

hello, i have a problem that many values are showing superposed in place of one value .the image represent the problème. this is my code vega: { $schema: https://vega.github.io/schema/vega-lite/v2.json "autosize":…

---

## [Kibana charts libraries](https://discuss.elastic.co/t/kibana-charts-libraries/251999)

<div class="topic-metadata">

**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\
**Replies:** 2\
**Last updated:** [October 14, 2020, 9:29am UTC](https://discuss.elastic.co/t/kibana-charts-libraries/251999 "2020-10-14T09:29:12Z")

</div>

Hello, Not exactly a Kibana question, But I'm looking for a chart library for a project I'm working on. Looking at the source of Kibana, This is a chart library, that Kibana uses: but it seems, that the elatic-u…

---

## [Can I use the aggregation with 'objetc' field?](https://discuss.elastic.co/t/can-i-use-the-aggregation-with-objetc-field/251869)

<div class="topic-metadata">

**Author:** [@icaruswu](https://discuss.elastic.co/u/icaruswu)\
**Replies:** 0\
**Last updated:** [October 13, 2020, 8:51am UTC](https://discuss.elastic.co/t/can-i-use-the-aggregation-with-objetc-field/251869 "2020-10-13T08:51:07Z")

</div>

I know that I can use aggreation with keyword type. But I wanna try to deal with some 'object' type in aggregation way. pls follow below: For this 'ddd' index, I build a 'human' object, then I will insert some 'object…

---

## [Kibana cannot read UUID file](https://discuss.elastic.co/t/kibana-cannot-read-uuid-file/252000)

<div class="topic-metadata">

**Author:** [@Ayush\_Mathur](https://discuss.elastic.co/u/Ayush_Mathur)\
**Replies:** 1\
**Last updated:** [October 14, 2020, 9:09am UTC](https://discuss.elastic.co/t/kibana-cannot-read-uuid-file/252000 "2020-10-14T09:09:52Z")

</div>

Hi, I'm trying to upgrade the Elastic Stack from 7.6.2 to 7.9.1 but for some reason Kibana is not starting. The error logged during startup is: Kibana cannot read the uuid file, please make sure server.uuid is set in …

---

## [Many small indices vs One large index](https://discuss.elastic.co/t/many-small-indices-vs-one-large-index/252008)

<div class="topic-metadata">

**Author:** [@hemangr8](https://discuss.elastic.co/u/hemangr8)\
**Replies:** 5\
**Last updated:** [October 14, 2020, 8:50am UTC](https://discuss.elastic.co/t/many-small-indices-vs-one-large-index/252008 "2020-10-14T08:50:49Z")

</div>

I know this question has been asked many times, but I needed more clarity on this topic. Let's say I have 5000 customer data which has the same number of fields in each document but is independent of each other, i.e. I w…

---

## [Empty certificate chain after upgrading from ES 7.8.1 to ES 7.9.2](https://discuss.elastic.co/t/empty-certificate-chain-after-upgrading-from-es-7-8-1-to-es-7-9-2/250145)

<div class="topic-metadata">

**Author:** [@Nicolas\_Labrot](https://discuss.elastic.co/u/Nicolas_Labrot)\
**Replies:** 7\
**Last updated:** [October 14, 2020, 8:50am UTC](https://discuss.elastic.co/t/empty-certificate-chain-after-upgrading-from-es-7-8-1-to-es-7-9-2/250145 "2020-10-14T08:50:43Z")

</div>

Hello, After the upgrade from ES 7.8.1 to ES 7.9.2, Elastic threw in the logs an "empty certificate chain" exception. I was using the following configuration: xpack.security.transport.ssl.keystore.path: /usr/share/ela…

---

## [Kibana: How to display hostname/environment on top of bar?](https://discuss.elastic.co/t/kibana-how-to-display-hostname-environment-on-top-of-bar/251863)

<div class="topic-metadata">

**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\
**Replies:** 1\
**Last updated:** [October 14, 2020, 8:31am UTC](https://discuss.elastic.co/t/kibana-how-to-display-hostname-environment-on-top-of-bar/251863 "2020-10-14T08:31:33Z")

</div>

We have quite lot of environemtents (PROD, TEST, DEV) etc and wanted to show where we have logged on. Is there an easy way to change color or put an entry in the top nav bar to show which enviornment Kibana is running? A…

---

## [Elasticsearch to Oracle Table](https://discuss.elastic.co/t/elasticsearch-to-oracle-table/251998)

<div class="topic-metadata">

**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\
**Replies:** 10\
**Last updated:** [October 14, 2020, 8:28am UTC](https://discuss.elastic.co/t/elasticsearch-to-oracle-table/251998 "2020-10-14T08:28:09Z")

</div>

Hello Team I have a requirement where in I have to move selected data from Elasticsearch INDEX to oracle Table {RDBMS} , in real-time. Could you please help me in suggesting the method / examples / links / blogs / op…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1750)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1752)
