# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1764 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1765 --- ## [Email Domain Normalizer](https://discuss.elastic.co/t/email-domain-normalizer/251316)
**Author:** [@Si\_Si](https://discuss.elastic.co/u/Si_Si)\ **Replies:** 0\ **Last updated:** [October 7, 2020, 4:45pm UTC](https://discuss.elastic.co/t/email-domain-normalizer/251316 "2020-10-07T16:45:30Z")
Anyone know how i would add a searchable domain keyword field in elasticsearch, i tried using patterns but had no luck with it. --- ## [Count active docs and display by date in Line Chart](https://discuss.elastic.co/t/count-active-docs-and-display-by-date-in-line-chart/251129)
**Author:** [@r97](https://discuss.elastic.co/u/r97)\ **Replies:** 5\ **Last updated:** [October 7, 2020, 4:00pm UTC](https://discuss.elastic.co/t/count-active-docs-and-display-by-date-in-line-chart/251129 "2020-10-07T16:00:45Z")
Hi, I have an index with the fields: @timestamp, boolean: active and solved\_date (see below). If I import the values, the solved\_date field is not set and the boolean is true. When I want to make the document inactive… --- ## [Snaphost Creation to S3 for huge indexes](https://discuss.elastic.co/t/snaphost-creation-to-s3-for-huge-indexes/251299)
**Author:** [@awstrain34](https://discuss.elastic.co/u/awstrain34)\ **Replies:** 0\ **Last updated:** [October 7, 2020, 3:47pm UTC](https://discuss.elastic.co/t/snaphost-creation-to-s3-for-huge-indexes/251299 "2020-10-07T15:47:37Z")
Hello All, Looking for suggestions! We have multiple indices in ES with size greater than 8TB. We are trying to create a snapshot of the indices to s3 and then restore it to another cluster. From initial tests, we esti… --- ## [Timestamp field reordering events from patterns?](https://discuss.elastic.co/t/timestamp-field-reordering-events-from-patterns/251249)
**Author:** [@grumo35](https://discuss.elastic.co/u/grumo35)\ **Replies:** 4\ **Last updated:** [October 7, 2020, 3:33pm UTC](https://discuss.elastic.co/t/timestamp-field-reordering-events-from-patterns/251249 "2020-10-07T15:33:45Z")
Hi, Yesterday i cam across something i can't understand. Let's say i stopped my logstash at 10 AM and put it back on at 12, usually logs are coming and re-ordered as normal ( i can't figure how since @timestamp field s… --- ## [Extract only certain tags from an XML using XML filter plugin](https://discuss.elastic.co/t/extract-only-certain-tags-from-an-xml-using-xml-filter-plugin/251277)
**Author:** [@HariniGajendran](https://discuss.elastic.co/u/HariniGajendran)\ **Replies:** 2\ **Last updated:** [October 7, 2020, 3:21pm UTC](https://discuss.elastic.co/t/extract-only-certain-tags-from-an-xml-using-xml-filter-plugin/251277 "2020-10-07T15:21:05Z")
Hi, I am using XML filter to extract certain tags from an XML input. But the filter doesnt seem to be working correctly. PFB sample XML. \ **Author:** [@OmarDacca](https://discuss.elastic.co/u/OmarDacca)\ **Replies:** 1\ **Last updated:** [October 7, 2020, 2:41pm UTC](https://discuss.elastic.co/t/query-optimization/251258 "2020-10-07T14:41:20Z") We have Elastic v 7.8.0 We have monthly indices for each client, i.e: client\_data\_{cliendId}\_2020-09. 1 primary shard, 1 replica for each index. One of the queries are taking too much time, and I'm trying understand w… --- ## [Searching word with special characters](https://discuss.elastic.co/t/searching-word-with-special-characters/251244)
**Author:** [@Kevin\_Juliano](https://discuss.elastic.co/u/Kevin_Juliano)\ **Replies:** 6\ **Last updated:** [October 7, 2020, 2:33pm UTC](https://discuss.elastic.co/t/searching-word-with-special-characters/251244 "2020-10-07T14:33:32Z")
Hi! I am having a little problem, I wanted to search a word on elasticsearch but the result that I am expecting is not coming up because it has a tailing special character. Here’s an example: The result that I want to … --- ## [Labeling in vega lite](https://discuss.elastic.co/t/labeling-in-vega-lite/251022)
**Author:** [@suibgui](https://discuss.elastic.co/u/suibgui)\ **Replies:** 2\ **Last updated:** [October 7, 2020, 2:16pm UTC](https://discuss.elastic.co/t/labeling-in-vega-lite/251022 "2020-10-07T14:16:06Z")
Hello, i have this eureur when showing value in labels in side my horizantal bar . this is my code : "layer": \[{ "mark": "bar" }, { "mark": { "type": "text", "align": "right", "xOffset": -4, "aria": false }, … --- ## [Send event logs to pipeline based on event\_id](https://discuss.elastic.co/t/send-event-logs-to-pipeline-based-on-event-id/251150)
**Author:** [@tedfs](https://discuss.elastic.co/u/tedfs)\ **Replies:** 5\ **Last updated:** [October 7, 2020, 2:12pm UTC](https://discuss.elastic.co/t/send-event-logs-to-pipeline-based-on-event-id/251150 "2020-10-07T14:12:21Z")
Hi there. I am trying to send specific windows event logs to a pipeline based on event\_id in my winlogbeat.yml config file. However, when the conditional is added to the config file, it appears to bypass the pipeline com… --- ## [Filebeat: input: awscloudwatch (expression pattern for log\_group)](https://discuss.elastic.co/t/filebeat-input-awscloudwatch-expression-pattern-for-log-group/250781)
**Author:** [@srolskyi](https://discuss.elastic.co/u/srolskyi)\ **Replies:** 2\ **Last updated:** [October 7, 2020, 2:09pm UTC](https://discuss.elastic.co/t/filebeat-input-awscloudwatch-expression-pattern-for-log-group/250781 "2020-10-07T14:09:07Z")
I have many log\_groups in clodwatch ~ 400. But I need parse only 77 from this long list. Can I grab events from log group use some pattern? For example: log\_group\_arn: arn:aws:logs:us-east-1:0000000000:log-group:/dev… --- ## [Filebeat service failing to start](https://discuss.elastic.co/t/filebeat-service-failing-to-start/251199)
**Author:** [@aviationfan](https://discuss.elastic.co/u/aviationfan)\ **Replies:** 8\ **Last updated:** [October 7, 2020, 2:03pm UTC](https://discuss.elastic.co/t/filebeat-service-failing-to-start/251199 "2020-10-07T14:03:27Z")
Ever since updating to 7.9.2, filebeat has failed to start as a service. Ubuntu 20.04.1 LTS (Focal Fossa) systemctl status filebeat ● filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch… --- ## [Importing ruby class fails in the ruby plugin](https://discuss.elastic.co/t/importing-ruby-class-fails-in-the-ruby-plugin/251281)
**Author:** [@thdesy](https://discuss.elastic.co/u/thdesy)\ **Replies:** 0\ **Last updated:** [October 7, 2020, 2:01pm UTC](https://discuss.elastic.co/t/importing-ruby-class-fails-in-the-ruby-plugin/251281 "2020-10-07T14:01:36Z")
Hi all, I am trying to use/offload some Ruby code in a filter to process XML events (due to various reasons, I have to move away from the XML input plugin). The problem is, that the import of 'nori' class fails within … --- ## [Index Block Read - Elasticsearch](https://discuss.elastic.co/t/index-block-read-elasticsearch/251280)
**Author:** [@Luan\_Souza](https://discuss.elastic.co/u/Luan_Souza)\ **Replies:** 0\ **Last updated:** [October 7, 2020, 1:50pm UTC](https://discuss.elastic.co/t/index-block-read-elasticsearch/251280 "2020-10-07T13:50:09Z")
Hello everyone I was trying to apply a case to elasticsearch by manipulating the index.block.read settings. The idea is the following, as long as the logstash is loading data into a new index, this index remains blocke… --- ## [Beat multiline on XML does not send full event and tears up into individual lines](https://discuss.elastic.co/t/beat-multiline-on-xml-does-not-send-full-event-and-tears-up-into-individual-lines/251020)
**Author:** [@thdesy](https://discuss.elastic.co/u/thdesy)\ **Replies:** 1\ **Last updated:** [October 7, 2020, 1:46pm UTC](https://discuss.elastic.co/t/beat-multiline-on-xml-does-not-send-full-event-and-tears-up-into-individual-lines/251020 "2020-10-07T13:46:54Z")
Hi, I have put a prospector onto a logfile \[1\], that is written as XML. An events is wrapped in tags, so I defined a multiline for the beat multiline: type: pattern pattern: '\' negate: true match:… --- ## [Join 2 indexes with 1 primary key logstash filter elasticsearch](https://discuss.elastic.co/t/join-2-indexes-with-1-primary-key-logstash-filter-elasticsearch/251279)
**Author:** [@charles97](https://discuss.elastic.co/u/charles97)\ **Replies:** 0\ **Last updated:** [October 7, 2020, 1:43pm UTC](https://discuss.elastic.co/t/join-2-indexes-with-1-primary-key-logstash-filter-elasticsearch/251279 "2020-10-07T13:43:09Z")
So tried to join a transfrom index to index table. I saw this as reference : How to join fields from multi events into single event? and it seems like it should work by using elasticsearch filter plugin. transform index… --- ## [Sum / Aggregations - Kibana/Logstash](https://discuss.elastic.co/t/sum-aggregations-kibana-logstash/251214)
**Author:** [@jafri6](https://discuss.elastic.co/u/jafri6)\ **Replies:** 6\ **Last updated:** [October 7, 2020, 1:12pm UTC](https://discuss.elastic.co/t/sum-aggregations-kibana-logstash/251214 "2020-10-07T13:12:41Z")
I am working on a project where the log data can be used to determine a user's performance everyday. The work users do is converting physical documents to digital ones. I have successfully loaded the data into elasticse… --- ## [Issues with GeopIP resolution](https://discuss.elastic.co/t/issues-with-geopip-resolution/251192)
**Author:** [@Roman\_Kournjaev](https://discuss.elastic.co/u/Roman_Kournjaev)\ **Replies:** 4\ **Last updated:** [October 7, 2020, 12:57pm UTC](https://discuss.elastic.co/t/issues-with-geopip-resolution/251192 "2020-10-07T12:57:27Z")
I have issues with GeoIP resolution I have a Google Cloud IP address that resolves in Elasticsearch to "geo" : { "continent\_name" : "North America", "country\_iso\_code" : "US", "location" : { … --- ## [Add policy to indextemplate index templates names are unsorted and not easy to use](https://discuss.elastic.co/t/add-policy-to-indextemplate-index-templates-names-are-unsorted-and-not-easy-to-use/251272)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 0\ **Last updated:** [October 7, 2020, 12:52pm UTC](https://discuss.elastic.co/t/add-policy-to-indextemplate-index-templates-names-are-unsorted-and-not-easy-to-use/251272 "2020-10-07T12:52:55Z")
I have elastic and kibana v"7.9.2" When I want to add ILM to index template by going to ILM-\>action-\>add\_policy\_to\_index button I receive the screen - see attached screenshot the index templates are in unsorted order … --- ## [User password](https://discuss.elastic.co/t/user-password/251268)
**Author:** [@WLM](https://discuss.elastic.co/u/WLM)\ **Replies:** 0\ **Last updated:** [October 7, 2020, 12:22pm UTC](https://discuss.elastic.co/t/user-password/251268 "2020-10-07T12:22:11Z")
How can I prevent a user from changing his password through curl in elasticsearch? How to track from what height the password in elasticsearch was changed using curl? --- ## [Dashboard for file access logs](https://discuss.elastic.co/t/dashboard-for-file-access-logs/251260)
**Author:** [@Craig2188](https://discuss.elastic.co/u/Craig2188)\ **Replies:** 0\ **Last updated:** [October 7, 2020, 11:47am UTC](https://discuss.elastic.co/t/dashboard-for-file-access-logs/251260 "2020-10-07T11:47:16Z")
Hi, We are being tasked with pushing event logs for file access to Kibana: Winlogbeat \> Logstash \> ES/Kibana I will filter it down to specific Event ID's in the winlog YML file and then let it run for 30 days to colla… --- ## [Snapshot Repositories are all unwriteable when created in Elasticsearch, they do not inherit parent permissions and have a weird owner](https://discuss.elastic.co/t/snapshot-repositories-are-all-unwriteable-when-created-in-elasticsearch-they-do-not-inherit-parent-permissions-and-have-a-weird-owner/251257)
**Author:** [@c1jt](https://discuss.elastic.co/u/c1jt)\ **Replies:** 0\ **Last updated:** [October 7, 2020, 11:21am UTC](https://discuss.elastic.co/t/snapshot-repositories-are-all-unwriteable-when-created-in-elasticsearch-they-do-not-inherit-parent-permissions-and-have-a-weird-owner/251257 "2020-10-07T11:21:13Z")
Hello! Here's a riddle: I have two Dockered Elastic stacks on two different networks: Stack A and Stack B. Both have a CIFS backup mounted with the same /etc/fstab line. Both use the same docker-compose lines to mount… --- ## [Elastic Search - Load balancer - AWS Cloud](https://discuss.elastic.co/t/elastic-search-load-balancer-aws-cloud/251123)
**Author:** [@Learner4](https://discuss.elastic.co/u/Learner4)\ **Replies:** 1\ **Last updated:** [October 7, 2020, 1:52am UTC](https://discuss.elastic.co/t/elastic-search-load-balancer-aws-cloud/251123 "2020-10-07T01:52:06Z")
Assuming there are two ACTIVE CLUSTERS in two different REGIONS in Elastic Search and both are receiving data and both the Regions having GSLB Configuration in place. I want to switch the network to Active Region automa… --- ## [\_source always zero in cardinality aggregation](https://discuss.elastic.co/t/source-always-zero-in-cardinality-aggregation/250677)
**Author:** [@autogenerated\_id](https://discuss.elastic.co/u/autogenerated_id)\ **Replies:** 11\ **Last updated:** [October 7, 2020, 10:59am UTC](https://discuss.elastic.co/t/source-always-zero-in-cardinality-aggregation/250677 "2020-10-07T10:59:02Z")
Hi! I've come across something that looks like a bug. When \_score is used in a cardinality aggregation, it always returns 0, no matter what the actual document scores are. Here's an example that illustrates it. A funct… --- ## [Get large amount of data from elastic by fastest way](https://discuss.elastic.co/t/get-large-amount-of-data-from-elastic-by-fastest-way/251252)
**Author:** [@Nick\_Name](https://discuss.elastic.co/u/Nick_Name)\ **Replies:** 2\ **Last updated:** [October 7, 2020, 10:58am UTC](https://discuss.elastic.co/t/get-large-amount-of-data-from-elastic-by-fastest-way/251252 "2020-10-07T10:58:51Z")
I need to update all documents in my elastic index by adding new field for every doc. I need to get all docs from index by fastes way. My update method get all docs -\> save to Java Map.class -\> get every doc from Map -\> … --- ## [ES crash with fatal error on search thread](https://discuss.elastic.co/t/es-crash-with-fatal-error-on-search-thread/251125)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 3\ **Last updated:** [October 7, 2020, 10:58am UTC](https://discuss.elastic.co/t/es-crash-with-fatal-error-on-search-thread/251125 "2020-10-07T10:58:12Z")
hi, I tried a query with AND operator but ES crashed everytime with the following stacktrace error: \[2020-10-06T14:45:54,221\]\[ERROR\]\[o.e.b.ElasticsearchUncaughtExceptionHandler\] \[node1\] fatal error in thread \[elasticse… --- ## [Nested json inside a json also getting parsed into different fields using JSON Filter Plugin](https://discuss.elastic.co/t/nested-json-inside-a-json-also-getting-parsed-into-different-fields-using-json-filter-plugin/250939)
**Author:** [@ParashB](https://discuss.elastic.co/u/ParashB)\ **Replies:** 4\ **Last updated:** [October 7, 2020, 10:27am UTC](https://discuss.elastic.co/t/nested-json-inside-a-json-also-getting-parsed-into-different-fields-using-json-filter-plugin/250939 "2020-10-07T10:27:33Z")
Hi, I have a nested JSON inside a JSON field which is also getting parsed. I do not want to parse the nested JSON. example json: log : {"name":"abc","location":{"city":"New York","country":"US"}} Logstash filter: jso… --- ## [DHCP Logs to Logstash](https://discuss.elastic.co/t/dhcp-logs-to-logstash/250777)
**Author:** [@Craig2188](https://discuss.elastic.co/u/Craig2188)\ **Replies:** 8\ **Last updated:** [October 7, 2020, 10:03am UTC](https://discuss.elastic.co/t/dhcp-logs-to-logstash/250777 "2020-10-07T10:03:06Z")
I plan to use Filebeat to send the DHCP log file to Logstash. I have the following setup in Logstash to send the file to Elasticsearch: # Beats -\> Logstash -\> Elasticsearch pipeline. input { beats { port =\> 5044… --- ## [Dashboard community](https://discuss.elastic.co/t/dashboard-community/251223)
**Author:** [@Babadofar](https://discuss.elastic.co/u/Babadofar)\ **Replies:** 4\ **Last updated:** [October 7, 2020, 10:11am UTC](https://discuss.elastic.co/t/dashboard-community/251223 "2020-10-07T10:11:30Z")
This idea is not new, but I think it's about time to revisit. It would be really nice if elastic had a community for sharing Kibana dashboards. Dashboards uploaded by users, or elastic staff, could be rated and have cou… --- ## [Jira Connector EMail and API-Token](https://discuss.elastic.co/t/jira-connector-email-and-api-token/240329)
**Author:** [@norgro2601](https://discuss.elastic.co/u/norgro2601)\ **Replies:** 17\ **Last updated:** [October 7, 2020, 9:53am UTC](https://discuss.elastic.co/t/jira-connector-email-and-api-token/240329 "2020-10-07T09:53:09Z")
Hi, to create a Jira connector in Alerts and Actions, Email and API token are required fields. I can't find any information, how to configure this in Jira. Do I have to define an application in Jira ? But no email is ne… --- ## [How to build 7.9.1 kibana plugin?](https://discuss.elastic.co/t/how-to-build-7-9-1-kibana-plugin/251248)
**Author:** [@Javek](https://discuss.elastic.co/u/Javek)\ **Replies:** 2\ **Last updated:** [October 7, 2020, 9:51am UTC](https://discuss.elastic.co/t/how-to-build-7-9-1-kibana-plugin/251248 "2020-10-07T09:51:42Z")
Hello. I am moving my plugin to new platform. After running node scripts/generate\_plugin my\_plugin\_name i got this (screenshot 1): So there is no package.json. How can I get a zip file so that I can install it later… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1763) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1765)