# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1755 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1756 --- ## [ElasticSearch 7.7.1 Connection issues with Windows Server 2019 vs Windows Server 2012 R2](https://discuss.elastic.co/t/elasticsearch-7-7-1-connection-issues-with-windows-server-2019-vs-windows-server-2012-r2/251818)
**Author:** [@aurelio.rama](https://discuss.elastic.co/u/aurelio.rama)\ **Replies:** 7\ **Last updated:** [October 13, 2020, 6:39am UTC](https://discuss.elastic.co/t/elasticsearch-7-7-1-connection-issues-with-windows-server-2019-vs-windows-server-2012-r2/251818 "2020-10-13T06:39:52Z")
I am running the ElasticSearch service fine on Windows 2012 R2 and when performing netstat I see :\\Windows\\system32\>netstat -ano | find ":9200" TCP 0.0.0.0:9200 0.0.0.0:0 LISTENING 2276 … --- ## [Document level access](https://discuss.elastic.co/t/document-level-access/251536)
**Author:** [@Rahul0711](https://discuss.elastic.co/u/Rahul0711)\ **Replies:** 2\ **Last updated:** [October 13, 2020, 6:21am UTC](https://discuss.elastic.co/t/document-level-access/251536 "2020-10-13T06:21:12Z")
Hello Team I am trying to create role at the document level , but getting the error as attached. I am using xpack to create the role. Link followed While running the query getting the error attached . --- ## [Is it possible to reload the javascript files in filebeat script processor without restarting filebeat](https://discuss.elastic.co/t/is-it-possible-to-reload-the-javascript-files-in-filebeat-script-processor-without-restarting-filebeat/251821)
**Author:** [@kiterunner](https://discuss.elastic.co/u/kiterunner)\ **Replies:** 1\ **Last updated:** [October 13, 2020, 6:02am UTC](https://discuss.elastic.co/t/is-it-possible-to-reload-the-javascript-files-in-filebeat-script-processor-without-restarting-filebeat/251821 "2020-10-13T06:02:40Z")
I am trying to process some ips using filebeat script processor. I have created the code that can pick the ip and translate the ip to a device name from the event and send the event with a new field to elasticsearch. Th… --- ## [Discover: How to show last occurrence?](https://discuss.elastic.co/t/discover-how-to-show-last-occurrence/251700)
**Author:** [@nameisnotimportant](https://discuss.elastic.co/u/nameisnotimportant)\ **Replies:** 3\ **Last updated:** [October 13, 2020, 5:58am UTC](https://discuss.elastic.co/t/discover-how-to-show-last-occurrence/251700 "2020-10-13T05:58:39Z")
Hi, \[edit\] my ELK version: 7.8.0 I am able to get the last occurrence of my data in the console as following: However, when i copy the code to Discover, it return 5 results: May i know how do i get Discover to di… --- ## [Setting \[index.lifecycle.rollover\_alias\] for index \[ilm-history\] is empty or not defined](https://discuss.elastic.co/t/setting-index-lifecycle-rollover-alias-for-index-ilm-history-is-empty-or-not-defined/251842)
**Author:** [@tonyfwk](https://discuss.elastic.co/u/tonyfwk)\ **Replies:** 0\ **Last updated:** [October 13, 2020, 5:21am UTC](https://discuss.elastic.co/t/setting-index-lifecycle-rollover-alias-for-index-ilm-history-is-empty-or-not-defined/251842 "2020-10-13T05:21:58Z")
Hi, I get the \[ilm-history\] error. However, I believe both the "index.lifecycle.rollover\_alias" and index "ilm-history" were setup by default when I enabled the "setup\_ilm\_enable: true", along with setup.ilm.rollover\_al… --- ## [Possible to Control Order that Beats Processes and Ships Files/Log Lines?](https://discuss.elastic.co/t/possible-to-control-order-that-beats-processes-and-ships-files-log-lines/251764)
**Author:** [@NomadicCodeGuy](https://discuss.elastic.co/u/NomadicCodeGuy)\ **Replies:** 3\ **Last updated:** [October 13, 2020, 4:59am UTC](https://discuss.elastic.co/t/possible-to-control-order-that-beats-processes-and-ships-files-log-lines/251764 "2020-10-13T04:59:07Z")
I am using Beats to ship entries from log files to Logstash. I have aggregations in Logstash that are order dependent. I cannot seem to find a way to control the order that Beats processes my log files or the individual … --- ## [Logstash Start and shutdown intermittently](https://discuss.elastic.co/t/logstash-start-and-shutdown-intermittently/251836)
**Author:** [@Amit\_K\_Yadav](https://discuss.elastic.co/u/Amit_K_Yadav)\ **Replies:** 1\ **Last updated:** [October 13, 2020, 4:29am UTC](https://discuss.elastic.co/t/logstash-start-and-shutdown-intermittently/251836 "2020-10-13T04:29:30Z")
I am new to ELK world. I installed ELK, each on different server. My Elastic Stack was working fine before x-pack enabled. After enabling x-pack, Elasticsearch and kibana working fine. Logstash start and shutdown repeat… --- ## [Is there any possibilite to access the nested arrays in json input data to show it in kibana charts](https://discuss.elastic.co/t/is-there-any-possibilite-to-access-the-nested-arrays-in-json-input-data-to-show-it-in-kibana-charts/251711)
**Author:** [@chaithanya\_sivapuram](https://discuss.elastic.co/u/chaithanya_sivapuram)\ **Replies:** 2\ **Last updated:** [October 13, 2020, 4:29am UTC](https://discuss.elastic.co/t/is-there-any-possibilite-to-access-the-nested-arrays-in-json-input-data-to-show-it-in-kibana-charts/251711 "2020-10-13T04:29:16Z")
{ "freqIteration": \[ { "frequency": "2.4GHz", "channel": "1", "antenna": "2x2", "bandwidth": "40MHz", "rawData": \[ { "angle": "0", "testLocation": "10", … --- ## [What value to be used for max\_num\_segments for Es 7.9 when we do force merge? is it a permanent change or the segment no will go increasing once we start writing to the index again?](https://discuss.elastic.co/t/what-value-to-be-used-for-max-num-segments-for-es-7-9-when-we-do-force-merge-is-it-a-permanent-change-or-the-segment-no-will-go-increasing-once-we-start-writing-to-the-index-again/251839)
**Author:** [@GauriA](https://discuss.elastic.co/u/GauriA)\ **Replies:** 0\ **Last updated:** [October 13, 2020, 4:25am UTC](https://discuss.elastic.co/t/what-value-to-be-used-for-max-num-segments-for-es-7-9-when-we-do-force-merge-is-it-a-permanent-change-or-the-segment-no-will-go-increasing-once-we-start-writing-to-the-index-again/251839 "2020-10-13T04:25:21Z")
I am upgrading ES 1.4.2 to ES 7.9. For that I had to do remote indexing by re-indexing API to get all the data from old cluster to new cluster. But after re-indexning the search query performance of ES 7.9 got decreased … --- ## [Filebeat/elasticsearch create daily index](https://discuss.elastic.co/t/filebeat-elasticsearch-create-daily-index/251532)
**Author:** [@Jack\_Daniels](https://discuss.elastic.co/u/Jack_Daniels)\ **Replies:** 2\ **Last updated:** [October 13, 2020, 3:54am UTC](https://discuss.elastic.co/t/filebeat-elasticsearch-create-daily-index/251532 "2020-10-13T03:54:41Z")
Hi, im trying create per day index with filebeat. Can you help me? Here is part of filebeat.yml file output.elasticsearch: # Array of hosts to connect to. hosts: \["test2019:9200"\] pipeline: "logpipe… --- ## [Kibana iframe Loading time](https://discuss.elastic.co/t/kibana-iframe-loading-time/251787)
**Author:** [@RBT](https://discuss.elastic.co/u/RBT)\ **Replies:** 1\ **Last updated:** [October 12, 2020, 11:44pm UTC](https://discuss.elastic.co/t/kibana-iframe-loading-time/251787 "2020-10-12T23:44:14Z")
Hi, I am using Kibana dashboard in iframe of UI. Its taking more time to load the dashboard in embedded iframe. Could you please suggest to load the kibana dashboard quicker in embedded iframe. --- ## [How to disable(prune) meta data related fields in the dashboard](https://discuss.elastic.co/t/how-to-disable-prune-meta-data-related-fields-in-the-dashboard/251765)
**Author:** [@mastersmit](https://discuss.elastic.co/u/mastersmit)\ **Replies:** 1\ **Last updated:** [October 12, 2020, 11:37pm UTC](https://discuss.elastic.co/t/how-to-disable-prune-meta-data-related-fields-in-the-dashboard/251765 "2020-10-12T23:37:06Z")
I am currently preparing dashboard for my Business Users (who are not used to Kibana) and was wondering if I can disable(hide, prune) some attributes from the dashboard view-ed content. In the below image if you see, th… --- ## [Kibana server is not ready yet after upgrading from 6.2.3. to 6.8.0](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-after-upgrading-from-6-2-3-to-6-8-0/251760)
**Author:** [@Mehrdad\_Hosseinian](https://discuss.elastic.co/u/Mehrdad_Hosseinian)\ **Replies:** 1\ **Last updated:** [October 12, 2020, 11:17pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-after-upgrading-from-6-2-3-to-6-8-0/251760 "2020-10-12T23:17:51Z")
Hi, I upgrade kibana fro version 6.2.3 to 6.8.0 but after upgrade I get "Kibana server is not ready yet". Under upgrading to new version I keeped kibana.yml. I don't get any error during the upgrading. --- ## [Plot grouped and normalized values on bar chart?](https://discuss.elastic.co/t/plot-grouped-and-normalized-values-on-bar-chart/249087)
**Author:** [@NiclasK](https://discuss.elastic.co/u/NiclasK)\ **Replies:** 2\ **Last updated:** [October 12, 2020, 10:49pm UTC](https://discuss.elastic.co/t/plot-grouped-and-normalized-values-on-bar-chart/249087 "2020-10-12T22:49:18Z")
Hi, I collect the exit status for sessions reported by many IOT-devices. To get an overview, I would like to group a few of the statuses and then plot them on a bar chart. On the X axis I want to have the SW version the… --- ## [Action\_snapshot error](https://discuss.elastic.co/t/action-snapshot-error/251820)
**Author:** [@ANILL\_KUMAR](https://discuss.elastic.co/u/ANILL_KUMAR)\ **Replies:** 0\ **Last updated:** [October 12, 2020, 10:36pm UTC](https://discuss.elastic.co/t/action-snapshot-error/251820 "2020-10-12T22:36:48Z")
Hi, I'm configuring curator to take snapshot, but failing to do so. ending up with a PARTIAL error. our cluster is with 5 master nodes, 18 data nodes. sharing nfs data domain. curator log is below 2020-10-12 22:20:2… --- ## [Canvas bar chart not sorting](https://discuss.elastic.co/t/canvas-bar-chart-not-sorting/251708)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 2\ **Last updated:** [October 12, 2020, 10:11pm UTC](https://discuss.elastic.co/t/canvas-bar-chart-not-sorting/251708 "2020-10-12T22:11:24Z")
Hello, I am running an ESQL to visualise a bar chart. Sort by is not working for me. The same query on a table works as expected. Am I missing anything? Bug? Feature? Version 7.9.2 filters "timefilterControl" | ess… --- ## [S3 Filebeat Input error](https://discuss.elastic.co/t/s3-filebeat-input-error/246654)
**Author:** [@haseev](https://discuss.elastic.co/u/haseev)\ **Replies:** 4\ **Last updated:** [October 12, 2020, 9:09pm UTC](https://discuss.elastic.co/t/s3-filebeat-input-error/246654 "2020-10-12T21:09:10Z")
There is an error within filebeat plugin after integrating aws sqs with filebeat. The error occured after receivng this message: handleSQSMessage failed: json unmarshal sqs message body failed: invalid character 'e' in … --- ## [Implementing Update by Query in Logstash](https://discuss.elastic.co/t/implementing-update-by-query-in-logstash/251813)
**Author:** [@NomadicCodeGuy](https://discuss.elastic.co/u/NomadicCodeGuy)\ **Replies:** 0\ **Last updated:** [October 12, 2020, 8:47pm UTC](https://discuss.elastic.co/t/implementing-update-by-query-in-logstash/251813 "2020-10-12T20:47:32Z")
I am attempting to use Update by Query with logstash to copy a field \[scenario\] from entries that share the same field \[file\]. I am implementing the solution described by badger in this thread: https://discuss.elastic.co… --- ## [Rollover not happening after ilm policy set](https://discuss.elastic.co/t/rollover-not-happening-after-ilm-policy-set/251812)
**Author:** [@venku](https://discuss.elastic.co/u/venku)\ **Replies:** 0\ **Last updated:** [October 12, 2020, 8:47pm UTC](https://discuss.elastic.co/t/rollover-not-happening-after-ilm-policy-set/251812 "2020-10-12T20:47:28Z")
Hi, I am trying to setup an ilm policy for the index. I created the policy and attached it to the template. Used the same template in the logstash output. But I don't see the rollover happening. For testing purpose I ha… --- ## [Need help to mask XML elements](https://discuss.elastic.co/t/need-help-to-mask-xml-elements/251354)
**Author:** [@tgkumarmca](https://discuss.elastic.co/u/tgkumarmca)\ **Replies:** 4\ **Last updated:** [October 12, 2020, 8:28pm UTC](https://discuss.elastic.co/t/need-help-to-mask-xml-elements/251354 "2020-10-12T20:28:56Z")
Hello, I'm actually stuck to perform the masking! I would request you to help in this regard I need to perform masking of some sensitive data(like card number, account number, etc) from the input XML message. I am cur… --- ## [Manually do an ILM poll during development and tests](https://discuss.elastic.co/t/manually-do-an-ilm-poll-during-development-and-tests/251421)
**Author:** [@Sravan\_Reddy](https://discuss.elastic.co/u/Sravan_Reddy)\ **Replies:** 1\ **Last updated:** [October 12, 2020, 8:15pm UTC](https://discuss.elastic.co/t/manually-do-an-ilm-poll-during-development-and-tests/251421 "2020-10-12T20:15:49Z")
Hello, When using ILM, on indices.lifecycle.poll\_interval there is a lower bound of 1 second. Our current test setup involves waiting one second after every doc insertion to let ILM do its job. This makes our tests ve… --- ## [The repository 'https://artifacts.elastic.co/packages/6.x/apt stable Release' does not have a Release file](https://discuss.elastic.co/t/the-repository-https-artifacts-elastic-co-packages-6-x-apt-stable-release-does-not-have-a-release-file/251810)
**Author:** [@Ion\_Drugalea](https://discuss.elastic.co/u/Ion_Drugalea)\ **Replies:** 0\ **Last updated:** [October 12, 2020, 7:58pm UTC](https://discuss.elastic.co/t/the-repository-https-artifacts-elastic-co-packages-6-x-apt-stable-release-does-not-have-a-release-file/251810 "2020-10-12T19:58:36Z")
I still have this issue, any solutions? this is my content of /etc/apt/source.list.d/elasticsearch.list deb https://artifacts.elastic.co/packages/6.x/apt stable main apt-get update -o Debug::pkgProblemResolver=true -o… --- ## [Filebeat breaks with error data path already locked by another beat](https://discuss.elastic.co/t/filebeat-breaks-with-error-data-path-already-locked-by-another-beat/251807)
**Author:** [@Joe\_Cool2016](https://discuss.elastic.co/u/Joe_Cool2016)\ **Replies:** 0\ **Last updated:** [October 12, 2020, 7:50pm UTC](https://discuss.elastic.co/t/filebeat-breaks-with-error-data-path-already-locked-by-another-beat/251807 "2020-10-12T19:50:36Z")
How do I get around this error "data path already locked by another beat"? Can you give a yml file example for windows? --- ## [How to display 1500 rows in a kibana canvas markdown](https://discuss.elastic.co/t/how-to-display-1500-rows-in-a-kibana-canvas-markdown/250453)
**Author:** [@Saurabh\_Anand](https://discuss.elastic.co/u/Saurabh_Anand)\ **Replies:** 4\ **Last updated:** [October 12, 2020, 7:24pm UTC](https://discuss.elastic.co/t/how-to-display-1500-rows-in-a-kibana-canvas-markdown/250453 "2020-10-12T19:24:04Z")
Is it possible to display 1500 values in Kibana markdown in canvas. If yes then how it can be done? --- ## [Logstash output custom template](https://discuss.elastic.co/t/logstash-output-custom-template/251664)
**Author:** [@venku](https://discuss.elastic.co/u/venku)\ **Replies:** 9\ **Last updated:** [October 12, 2020, 7:20pm UTC](https://discuss.elastic.co/t/logstash-output-custom-template/251664 "2020-10-12T19:20:10Z")
Hi, I am new to ELK stack. This is my set so far for sending application logs : filebeat -\> redis(dockers) -\> logstash(dockers) -\> ES. My Question is what is the the correct way to setup custom index in logstash output? … --- ## [7.9.2 FileBeat CloudTrail AWS Module Changes Break Log Collection](https://discuss.elastic.co/t/7-9-2-filebeat-cloudtrail-aws-module-changes-break-log-collection/251661)
**Author:** [@djcullen](https://discuss.elastic.co/u/djcullen)\ **Replies:** 2\ **Last updated:** [October 12, 2020, 6:34pm UTC](https://discuss.elastic.co/t/7-9-2-filebeat-cloudtrail-aws-module-changes-break-log-collection/251661 "2020-10-12T18:34:26Z")
It appears that the changes made to the FileBeat AWS module in 7.9.2 (specifically 21086) break the module for anyone whose CloudTrail S3 object key does not conform to the following regex: ^AWSLogs/\\d+/CloudTrail/ My … --- ## [Trying to secure Logstash](https://discuss.elastic.co/t/trying-to-secure-logstash/251602)
**Author:** [@thatch56](https://discuss.elastic.co/u/thatch56)\ **Replies:** 7\ **Last updated:** [October 12, 2020, 5:27pm UTC](https://discuss.elastic.co/t/trying-to-secure-logstash/251602 "2020-10-12T17:27:16Z")
So im trying to secure the communication to logstash in my elk stack. I have a certificate that is working for kibana so i was going to test and see if it would work with logstash. Kibana and Logstash are on the same ser… --- ## [Suricata-IDS and ELK](https://discuss.elastic.co/t/suricata-ids-and-elk/251725)
**Author:** [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Replies:** 3\ **Last updated:** [October 12, 2020, 5:15pm UTC](https://discuss.elastic.co/t/suricata-ids-and-elk/251725 "2020-10-12T17:15:42Z")
Hello, I have a Suricata-IDS server and I want to see the logs by ELK. I don't like to install the ELK package on my Suricata-IDS server. I want to know is "Beats" enough for my Suricata-IDS server? How can I harden "Be… --- ## [Heap Size in Stack monitoring does not match jvm.options setting](https://discuss.elastic.co/t/heap-size-in-stack-monitoring-does-not-match-jvm-options-setting/251709)
**Author:** [@ratnakarn](https://discuss.elastic.co/u/ratnakarn)\ **Replies:** 4\ **Last updated:** [October 12, 2020, 4:32pm UTC](https://discuss.elastic.co/t/heap-size-in-stack-monitoring-does-not-match-jvm-options-setting/251709 "2020-10-12T16:32:26Z")
Hello, We have Prod/QA/Test identical clusters - 3 nodes (centos / 8core / 64g / 2tb ssd each). Jvm.options Heap size (-Xmx) is not set in prod & qa. Its set to -Xmx32g in test cluster. However, Kibana shows differen… --- ## [Unable to get Source filter while doing elastic search with spring boot class org.elasticsearch.search.builder.SearchSourceBuilder](https://discuss.elastic.co/t/unable-to-get-source-filter-while-doing-elastic-search-with-spring-boot-class-org-elasticsearch-search-builder-searchsourcebuilder/250640)
**Author:** [@Rajan\_Gupta](https://discuss.elastic.co/u/Rajan_Gupta)\ **Replies:** 11\ **Last updated:** [October 12, 2020, 4:26pm UTC](https://discuss.elastic.co/t/unable-to-get-source-filter-while-doing-elastic-search-with-spring-boot-class-org-elasticsearch-search-builder-searchsourcebuilder/250640 "2020-10-12T16:26:03Z")
This is the code Sample which i m using to get the result:- SearchRequest searchRequest = new SearchRequest(); searchRequest.indices("contentsearch"); SearchSourceBuilder searchSourceBuilder = new SearchSourceBuilder();… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1754) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1756)