# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1770 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1771 --- ## [Issue with decode\_json\_fields processor](https://discuss.elastic.co/t/issue-with-decode-json-fields-processor/250965)
**Author:** [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\ **Replies:** 8\ **Last updated:** [October 5, 2020, 11:59am UTC](https://discuss.elastic.co/t/issue-with-decode-json-fields-processor/250965 "2020-10-05T11:59:21Z")
Hi, Im shipping aws logs to elastic with the use of functionbeat. I have recently added the following processor to my configuration, so that im able decode the json that is usually in the message field. processors… --- ## [Kafka-kerberos integartion with fiel beat verion 6.8.0](https://discuss.elastic.co/t/kafka-kerberos-integartion-with-fiel-beat-verion-6-8-0/250983)
**Author:** [@Vikas\_Bhardwaj](https://discuss.elastic.co/u/Vikas_Bhardwaj)\ **Replies:** 0\ **Last updated:** [October 5, 2020, 11:25am UTC](https://discuss.elastic.co/t/kafka-kerberos-integartion-with-fiel-beat-verion-6-8-0/250983 "2020-10-05T11:25:41Z")
Hi, I am trying to add kafka-kerbros to filebeat output but where I will give jaas config path my current config is this output.kafka: hosts: xxxx topic: xxxx required\_acks: 0 compression: none max\_message\_bytes: … --- ## [The number of shards on my nodes is no longer equal](https://discuss.elastic.co/t/the-number-of-shards-on-my-nodes-is-no-longer-equal/250934)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 4\ **Last updated:** [October 5, 2020, 11:17am UTC](https://discuss.elastic.co/t/the-number-of-shards-on-my-nodes-is-no-longer-equal/250934 "2020-10-05T11:17:11Z")
Hello, The number of shards on my nodes is no longer equal and I constantly see this kind of information in the logs of the main-2 node. What could be the reason for this? I am using Elasticsearch and Kibana version 7.… --- ## [Java library for Elastic Date Math](https://discuss.elastic.co/t/java-library-for-elastic-date-math/250790)
**Author:** [@Kevin\_Bourne](https://discuss.elastic.co/u/Kevin_Bourne)\ **Replies:** 2\ **Last updated:** [October 5, 2020, 11:07am UTC](https://discuss.elastic.co/t/java-library-for-elastic-date-math/250790 "2020-10-05T11:07:21Z")
Is there a Java library that converts Elastic accepted Date Math expressions ('now', 'now-1y/d') to a Java Date object? I have a case where we accept the Elastic Date Math as we pass this along to Elastic but there is an… --- ## [Dealing with multiple date fields](https://discuss.elastic.co/t/dealing-with-multiple-date-fields/250795)
**Author:** [@79g](https://discuss.elastic.co/u/79g)\ **Replies:** 6\ **Last updated:** [October 5, 2020, 10:59am UTC](https://discuss.elastic.co/t/dealing-with-multiple-date-fields/250795 "2020-10-05T10:59:46Z")
Hello, We are dealing with an index that contains multiple date type fields. The structure, summarized, is below: ... "entry\_date": { "type": "date", "ignore\_malformed": false, "format": "yyy… --- ## [Is it possible to register multiple snapshot repositories for the same S3 bucket?](https://discuss.elastic.co/t/is-it-possible-to-register-multiple-snapshot-repositories-for-the-same-s3-bucket/250948)
**Author:** [@aliservetdonmez](https://discuss.elastic.co/u/aliservetdonmez)\ **Replies:** 4\ **Last updated:** [October 5, 2020, 10:54am UTC](https://discuss.elastic.co/t/is-it-possible-to-register-multiple-snapshot-repositories-for-the-same-s3-bucket/250948 "2020-10-05T10:54:44Z")
I'd like to create separate snapshot repositories for each major Elasticsearch version, however I don't necessarily want to create separate backing S3 buckets, for storage. Is it okay/possible using the same bucket for … --- ## [Elasticsearch integration with Vault](https://discuss.elastic.co/t/elasticsearch-integration-with-vault/250488)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 2\ **Last updated:** [October 5, 2020, 10:52am UTC](https://discuss.elastic.co/t/elasticsearch-integration-with-vault/250488 "2020-10-05T10:52:19Z")
Is this possible to integrate Elasticsearch with Vault. If possible, Can anyone please give the reference how to approach that --- ## [Watcher not work perfect](https://discuss.elastic.co/t/watcher-not-work-perfect/250886)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 3\ **Last updated:** [October 5, 2020, 10:48am UTC](https://discuss.elastic.co/t/watcher-not-work-perfect/250886 "2020-10-05T10:48:01Z")
i have some aggs like this: "aggregations" : { "range\_by\_date" : { "buckets" : \[ { "key" : "2020-10-04T06:27:06.912Z-\*", "from" : 1.601792826912E12, "from\_as\_string"… --- ## [How to design ES fields for nested logical query](https://discuss.elastic.co/t/how-to-design-es-fields-for-nested-logical-query/250978)
**Author:** [@ybc\_c](https://discuss.elastic.co/u/ybc_c)\ **Replies:** 0\ **Last updated:** [October 5, 2020, 10:35am UTC](https://discuss.elastic.co/t/how-to-design-es-fields-for-nested-logical-query/250978 "2020-10-05T10:35:25Z")
I want to query ES to find docs meeting this pattern: A & (B | C) & (D | E). And A is the value of a field, both B and C are the values of the other field, and D and E are the values of another field. Here is a concrete… --- ## [Logstash \_Bulk when delete indice in elasticsearch](https://discuss.elastic.co/t/logstash-bulk-when-delete-indice-in-elasticsearch/250967)
**Author:** [@AkatsukiPain](https://discuss.elastic.co/u/AkatsukiPain)\ **Replies:** 0\ **Last updated:** [October 5, 2020, 10:04am UTC](https://discuss.elastic.co/t/logstash-bulk-when-delete-indice-in-elasticsearch/250967 "2020-10-05T10:04:03Z")
I have 2 indices sort by day like this: -network-10.02-0001 -network-10.03-0002 And I deleted network-10.03-0002 and the error occurs, can help me about this? --- ## [New enhanced data table 1.10 not working with time filter](https://discuss.elastic.co/t/new-enhanced-data-table-1-10-not-working-with-time-filter/250952)
**Author:** [@Saurabh\_Anand](https://discuss.elastic.co/u/Saurabh_Anand)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 10:09am UTC](https://discuss.elastic.co/t/new-enhanced-data-table-1-10-not-working-with-time-filter/250952 "2020-10-05T10:09:53Z")
Thank you @fbaligand for new release of Enhanced data table. Appreciate your efforts. But the new released plugin of Enhanced Data table not displaying values according to time range. Thanks --- ## [Kibana suggestion api not showing all values](https://discuss.elastic.co/t/kibana-suggestion-api-not-showing-all-values/250905)
**Author:** [@Ankur\_Mahajan](https://discuss.elastic.co/u/Ankur_Mahajan)\ **Replies:** 5\ **Last updated:** [October 5, 2020, 9:52am UTC](https://discuss.elastic.co/t/kibana-suggestion-api-not-showing-all-values/250905 "2020-10-05T09:52:43Z")
I've recently upgraded to ELK stack (Kibana) 7.9.2 from 7.8.0. I am facing a weird issue which was not in the older version. The filter doesn't populate all the values of a field in discover or dashboards. Let say a fie… --- ## [Metricbeat module with Kubernetes cluster v1.19.2](https://discuss.elastic.co/t/metricbeat-module-with-kubernetes-cluster-v1-19-2/250964)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 0\ **Last updated:** [October 5, 2020, 9:47am UTC](https://discuss.elastic.co/t/metricbeat-module-with-kubernetes-cluster-v1-19-2/250964 "2020-10-05T09:47:47Z")
hi all, do you have any news about the compatibility between Metricbeat and Kubernetes version 1.19.x? I saw that starting from K8s 1.19, the components controller-manager and scheduler have been deprecated. I mean, c… --- ## [Is it impossible to use multi-fields mapping without default type?](https://discuss.elastic.co/t/is-it-impossible-to-use-multi-fields-mapping-without-default-type/250953)
**Author:** [@taichi](https://discuss.elastic.co/u/taichi)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 9:45am UTC](https://discuss.elastic.co/t/is-it-impossible-to-use-multi-fields-mapping-without-default-type/250953 "2020-10-05T09:45:25Z")
I want to use fields named foo.ngram & foo.kuromoji (kuromoji is Japanese morphological analyzer). Setting like below does not work, saying No type specified for field \[foo\]. { "mapping": { "properties": { … --- ## [Need help with Elasticsearch query on Kibana](https://discuss.elastic.co/t/need-help-with-elasticsearch-query-on-kibana/250764)
**Author:** [@Bahar\_Yilmaz](https://discuss.elastic.co/u/Bahar_Yilmaz)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 9:36am UTC](https://discuss.elastic.co/t/need-help-with-elasticsearch-query-on-kibana/250764 "2020-10-05T09:36:26Z")
Hi , I need help with the Elasticsearch query. My query is like this below. GET record/\_search { "\_source": "Climate.Product.ProductCategory.ProductSubcategory.ProductModel.UnitMeasure.ProductModelIllustration.Produ… --- ## [How to apply a histogram aggregation from the set of doc\_counts from a previous aggregation?](https://discuss.elastic.co/t/how-to-apply-a-histogram-aggregation-from-the-set-of-doc-counts-from-a-previous-aggregation/250883)
**Author:** [@pushshift](https://discuss.elastic.co/u/pushshift)\ **Replies:** 2\ **Last updated:** [October 5, 2020, 9:26am UTC](https://discuss.elastic.co/t/how-to-apply-a-histogram-aggregation-from-the-set-of-doc-counts-from-a-previous-aggregation/250883 "2020-10-05T09:26:54Z")
I ran a terms aggregation and got back a bunch of buckets with keys and doc\_counts. I want to treat the doc\_counts from all the buckets returned as the input for a histogram aggregation (treat the doc\_counts as a set). T… --- ## [Gradle Build failing with Java 11](https://discuss.elastic.co/t/gradle-build-failing-with-java-11/250862)
**Author:** [@afeesps](https://discuss.elastic.co/u/afeesps)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 9:06am UTC](https://discuss.elastic.co/t/gradle-build-failing-with-java-11/250862 "2020-10-05T09:06:23Z")
Getting an Exception like this while compiling with Gradle ./gradlew :distribution:archives:windows-zip:assemble \*\*Execution failed for task ':x-pack:plugin:moni\*\* \*\*\> java.lang.AssertionError: isSubtype UNKNOWN\*\* OS … --- ## [Add character by a script](https://discuss.elastic.co/t/add-character-by-a-script/249983)
**Author:** [@Fred59](https://discuss.elastic.co/u/Fred59)\ **Replies:** 5\ **Last updated:** [October 5, 2020, 8:54am UTC](https://discuss.elastic.co/t/add-character-by-a-script/249983 "2020-10-05T08:54:57Z")
Hello, I have a field in string, and in this field, i have different numbers (example : 0032345643). I want to add "0" at the beginning when the number have only 9 characters, and add "00" at the beginning when the num… --- ## [Elastic Search Installation on server](https://discuss.elastic.co/t/elastic-search-installation-on-server/250940)
**Author:** [@ashley11](https://discuss.elastic.co/u/ashley11)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 8:51am UTC](https://discuss.elastic.co/t/elastic-search-installation-on-server/250940 "2020-10-05T08:51:46Z")
Hi Team, I need to install elastic search in the windows/linux server and to use the kibana and elasticsearch from the local PC. Can I achieve this ? If yes can you please drop some links which explains the same. I'm ne… --- ## [Slow Kibana after update 7.4.2 -\> 7.9.2](https://discuss.elastic.co/t/slow-kibana-after-update-7-4-2-7-9-2/250878)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 3\ **Last updated:** [October 5, 2020, 7:57am UTC](https://discuss.elastic.co/t/slow-kibana-after-update-7-4-2-7-9-2/250878 "2020-10-05T07:57:31Z")
Loading a dashboard with 5 visualizations takes 4x time with K7.9 than K7.4 (with exactly same indices and resources). ES cluster has 3 nodes, all queries take no more than 1 seconde, but dashboard is loading on 10 seco… --- ## [Explain difference between Kibana "time ellapsed" and query "took"](https://discuss.elastic.co/t/explain-difference-between-kibana-time-ellapsed-and-query-took/250763)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 7\ **Last updated:** [October 5, 2020, 7:20am UTC](https://discuss.elastic.co/t/explain-difference-between-kibana-time-ellapsed-and-query-took/250763 "2020-10-05T07:20:01Z")
In Kibana dev-console, I see a big difference between ES query took time and Kibana ellapsed time. Why ? --- ## [Multiline filter failure in filebeat](https://discuss.elastic.co/t/multiline-filter-failure-in-filebeat/250599)
**Author:** [@vikramaddagulla](https://discuss.elastic.co/u/vikramaddagulla)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 7:08am UTC](https://discuss.elastic.co/t/multiline-filter-failure-in-filebeat/250599 "2020-10-05T07:08:38Z")
Hello, I am trying to parse a log file in multiline format and each new linestarts with the date : 28-Sep-2020 18:26:19.982 I tried to configure the config as below filebeat.inputs: - type: log tags: \["PROD\_CATALIN… --- ## [How to add a sum for all columns in a table view](https://discuss.elastic.co/t/how-to-add-a-sum-for-all-columns-in-a-table-view/250888)
**Author:** [@hzarrabi](https://discuss.elastic.co/u/hzarrabi)\ **Replies:** 2\ **Last updated:** [October 5, 2020, 7:00am UTC](https://discuss.elastic.co/t/how-to-add-a-sum-for-all-columns-in-a-table-view/250888 "2020-10-05T07:00:13Z")
Hi all, I need to add a table view in my kibana dashboard with a sum for all columns like Excel. (see the picture. Is there any idea. Best Regards Hamid --- ## [How i can determine the difference of two fields(ROWS) in kibana](https://discuss.elastic.co/t/how-i-can-determine-the-difference-of-two-fields-rows-in-kibana/250922)
**Author:** [@Raja\_Kushwah](https://discuss.elastic.co/u/Raja_Kushwah)\ **Replies:** 2\ **Last updated:** [October 5, 2020, 6:43am UTC](https://discuss.elastic.co/t/how-i-can-determine-the-difference-of-two-fields-rows-in-kibana/250922 "2020-10-05T06:43:33Z")
Please find the attached screenshot.!! I am trying to create a new filed name -- 'msec different' and its value will be '0' when the event name is a start and 2nd value will be the difference of \[2nd 'msecs' value - 3… --- ## [Config Logstash with https to Elasticsearch cluster](https://discuss.elastic.co/t/config-logstash-with-https-to-elasticsearch-cluster/249606)
**Author:** [@AkatsukiPain](https://discuss.elastic.co/u/AkatsukiPain)\ **Replies:** 2\ **Last updated:** [October 5, 2020, 6:43am UTC](https://discuss.elastic.co/t/config-logstash-with-https-to-elasticsearch-cluster/249606 "2020-10-05T06:43:20Z")
Error Logs in Logstash \[2020-09-23T12:24:31,929\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main\] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>"https://palelasticsearch01mgt:9200/", :erro… --- ## [Logstash logs isn't like according to its date when see in kibana?](https://discuss.elastic.co/t/logstash-logs-isnt-like-according-to-its-date-when-see-in-kibana/250924)
**Author:** [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\ **Replies:** 4\ **Last updated:** [October 5, 2020, 6:22am UTC](https://discuss.elastic.co/t/logstash-logs-isnt-like-according-to-its-date-when-see-in-kibana/250924 "2020-10-05T06:22:48Z")
i'm using logstash v7.9.2. i have logs which are day wise like log-2020.10.03, log-2020.10.04, log-2020.10.05 it mixed up everything .i want to separate logs in separate index (daywise log). but i seeing logs of 3r… --- ## [Urgent: Date Histogram showing 2 dates for single date on X axis when we selected absolute date in calander in Kibana](https://discuss.elastic.co/t/urgent-date-histogram-showing-2-dates-for-single-date-on-x-axis-when-we-selected-absolute-date-in-calander-in-kibana/250916)
**Author:** [@Prashanth1](https://discuss.elastic.co/u/Prashanth1)\ **Replies:** 2\ **Last updated:** [October 5, 2020, 6:10am UTC](https://discuss.elastic.co/t/urgent-date-histogram-showing-2-dates-for-single-date-on-x-axis-when-we-selected-absolute-date-in-calander-in-kibana/250916 "2020-10-05T06:10:07Z")
Hi All, I am new to ELK stack so I couldn't able to resolve this. Could any one help me to resolve this issue. My problem is that when I have selected date from September 25th to 28th it should only one date on X-axis b… --- ## [Elasticsearch and ARM processors (Allwinner H6)](https://discuss.elastic.co/t/elasticsearch-and-arm-processors-allwinner-h6/250926)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 0\ **Last updated:** [October 5, 2020, 5:29am UTC](https://discuss.elastic.co/t/elasticsearch-and-arm-processors-allwinner-h6/250926 "2020-10-05T05:29:05Z")
Hi, I have a question about Elasticsearch on platforms with ARM processors. I want to test Elasticsearch on the latest version of Orange Pi 4. I'm thinking about: Orange Pi 4 4GB DDR4 with Rockchip RK3399 Dual-core C… --- ## [Query Nested Array](https://discuss.elastic.co/t/query-nested-array/250921)
**Author:** [@arinjay97](https://discuss.elastic.co/u/arinjay97)\ **Replies:** 0\ **Last updated:** [October 5, 2020, 4:42am UTC](https://discuss.elastic.co/t/query-nested-array/250921 "2020-10-05T04:42:37Z")
I have an object that I want to index into an Elasticsearch index. Some of the fields inside the object have a nested array of JSON objects inside them. For example: "history":\[ {"color":"w","from":"g2","to":"g4","fla… --- ## [HELP \[illegal\_argument\_exception: index.lifecycle.rollover\_alias \[sonicwall-\*\] does not point to index \[sonicwall-2020.09.28-000001\]\]](https://discuss.elastic.co/t/help-illegal-argument-exception-index-lifecycle-rollover-alias-sonicwall-does-not-point-to-index-sonicwall-2020-09-28-000001/250281)
**Author:** [@Akbar\_Maulana](https://discuss.elastic.co/u/Akbar_Maulana)\ **Replies:** 4\ **Last updated:** [October 5, 2020, 4:00am UTC](https://discuss.elastic.co/t/help-illegal-argument-exception-index-lifecycle-rollover-alias-sonicwall-does-not-point-to-index-sonicwall-2020-09-28-000001/250281 "2020-10-05T04:00:04Z")
I use this configuration for my indices but always returned with this error PUT \_template/sonicwall?include\_type\_name { "version": 60001, "order": 0, "index\_patterns": \[ "sonicwall-" \], "settings": { "index": { … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1769) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1771)