# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1791 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1792 --- ## [ElasticSearch 7 start up error - the default discovery settings are unsuitable for production use](https://discuss.elastic.co/t/elasticsearch-7-start-up-error-the-default-discovery-settings-are-unsuitable-for-production-use/249222)
**Author:** [@linfordwoode](https://discuss.elastic.co/u/linfordwoode)\ **Replies:** 3\ **Last updated:** [September 23, 2020, 1:07am UTC](https://discuss.elastic.co/t/elasticsearch-7-start-up-error-the-default-discovery-settings-are-unsuitable-for-production-use/249222 "2020-09-23T01:07:40Z")
I am having this issue( the default discovery settings are unsuitable for production use: at least one of \[discovery.seed\_hosts, discovery.seed\_providers, cluster.initial\_master\_nodes\] must be configured) with my Elastic… --- ## [Set "target" in JSON filter to be variable](https://discuss.elastic.co/t/set-target-in-json-filter-to-be-variable/249434)
**Author:** [@Mohamed\_Saeed](https://discuss.elastic.co/u/Mohamed_Saeed)\ **Replies:** 2\ **Last updated:** [September 23, 2020, 12:36am UTC](https://discuss.elastic.co/t/set-target-in-json-filter-to-be-variable/249434 "2020-09-23T00:36:10Z")
I'm trying to use json filter to parse logs but I want to save them under a new field. I know that I can do something like the following: filter { json{ source =\> "message" target =\> … --- ## [CloudFront log arrived as giant blob, how to make it searchable in Kibana?](https://discuss.elastic.co/t/cloudfront-log-arrived-as-giant-blob-how-to-make-it-searchable-in-kibana/249167)
**Author:** [@jchiu](https://discuss.elastic.co/u/jchiu)\ **Replies:** 1\ **Last updated:** [September 23, 2020, 12:15am UTC](https://discuss.elastic.co/t/cloudfront-log-arrived-as-giant-blob-how-to-make-it-searchable-in-kibana/249167 "2020-09-23T00:15:12Z")
Hello All, Relatively new to the ELK world and I am having trouble making the information in the CloudFront log searchable in Kibana. Let me explain in detail: I was able to have CF (CloudFront) logs delivered to log… --- ## [Is it possible to limit retrieved documents based on a sum aggregation?](https://discuss.elastic.co/t/is-it-possible-to-limit-retrieved-documents-based-on-a-sum-aggregation/249582)
**Author:** [@jmwilkinson](https://discuss.elastic.co/u/jmwilkinson)\ **Replies:** 1\ **Last updated:** [September 22, 2020, 11:18pm UTC](https://discuss.elastic.co/t/is-it-possible-to-limit-retrieved-documents-based-on-a-sum-aggregation/249582 "2020-09-22T23:18:49Z")
Lets say i have the documents: {"name": "foo", "size": 1} {"name": "bar", "size": 10} {"name": "baz", "size": 2} {"name": "fred", "size": 5} I could perform the following aggregation: POST /my-docs/\_search?size=0 { … --- ## [Winlogbeat 7.9 removed a field?](https://discuss.elastic.co/t/winlogbeat-7-9-removed-a-field/249588)
**Author:** [@ted1621](https://discuss.elastic.co/u/ted1621)\ **Replies:** 1\ **Last updated:** [September 22, 2020, 11:11pm UTC](https://discuss.elastic.co/t/winlogbeat-7-9-removed-a-field/249588 "2020-09-22T23:11:33Z")
I just completed upgrading my winlogbeat versions to 7.9.1. As part of this upgrade it now appears that my winlogbeat agent is no longer parsing this particular event type? This event type is part a sysmon job that i… --- ## [Logstash not listening](https://discuss.elastic.co/t/logstash-not-listening/249325)
**Author:** [@Chandana\_Koppal](https://discuss.elastic.co/u/Chandana_Koppal)\ **Replies:** 1\ **Last updated:** [September 22, 2020, 10:27pm UTC](https://discuss.elastic.co/t/logstash-not-listening/249325 "2020-09-22T22:27:16Z")
2020-09-21T11:01:30.174+0530 INFO cfgfile/reload.go:224 Loading of config files completed. 2020-09-21T11:01:31.181+0530 INFO \[publisher\_pipeline\_output\] pipeline/output.go:143 Connecting to backoff(as… --- ## [Increase the query per sec and latency for very less data](https://discuss.elastic.co/t/increase-the-query-per-sec-and-latency-for-very-less-data/249345)
**Author:** [@Nupur](https://discuss.elastic.co/u/Nupur)\ **Replies:** 1\ **Last updated:** [September 22, 2020, 10:26pm UTC](https://discuss.elastic.co/t/increase-the-query-per-sec-and-latency-for-very-less-data/249345 "2020-09-22T22:26:41Z")
how to do horizontal scaling to increase the query/s and latency when i have very less data(less than 50 mb) and only one shard --- ## [Filter array values using painless script](https://discuss.elastic.co/t/filter-array-values-using-painless-script/249468)
**Author:** [@askids](https://discuss.elastic.co/u/askids)\ **Replies:** 0\ **Last updated:** [September 22, 2020, 7:53am UTC](https://discuss.elastic.co/t/filter-array-values-using-painless-script/249468 "2020-09-22T07:53:49Z")
hi, I am trying to get some stats for field that has array values. Just for overall stats, I am using the stats api (sample given below). But now, I want to apply a filter on values within the array and get stats only w… --- ## [Language Identification in Elastic Cloud](https://discuss.elastic.co/t/language-identification-in-elastic-cloud/249498)
**Author:** [@antony\_kavin](https://discuss.elastic.co/u/antony_kavin)\ **Replies:** 2\ **Last updated:** [September 22, 2020, 10:19pm UTC](https://discuss.elastic.co/t/language-identification-in-elastic-cloud/249498 "2020-09-22T22:19:36Z")
Hi team, I am currently on platinum plan of Elastic cloud. I want to use the Language Identification feature in elasticsearch.I would like to use identify the language of a text field and add it as a separate column be… --- ## [Elasticsearch in Geoportal](https://discuss.elastic.co/t/elasticsearch-in-geoportal/249323)
**Author:** [@Durga07](https://discuss.elastic.co/u/Durga07)\ **Replies:** 4\ **Last updated:** [September 22, 2020, 9:53pm UTC](https://discuss.elastic.co/t/elasticsearch-in-geoportal/249323 "2020-09-22T21:53:20Z")
Hi I am using Elasticsearch in Geoportal. I don't have much knowledge on Search engines. I went through the Lucene Search Text Queries(Lucene Search Syntax) in which it is mentioned that we should use double quotes ("w… --- ## [Docker image for Elasticsearch - Raspberry PI](https://discuss.elastic.co/t/docker-image-for-elasticsearch-raspberry-pi/249584)
**Author:** [@javidr](https://discuss.elastic.co/u/javidr)\ **Replies:** 0\ **Last updated:** [September 22, 2020, 9:09pm UTC](https://discuss.elastic.co/t/docker-image-for-elasticsearch-raspberry-pi/249584 "2020-09-22T21:09:38Z")
Hi I did open a topic the other day asking for support to run ELK in a raspberry pi and i had little support there. For me this is a great functionality for pi so i was surprised to see so little info about it I have c… --- ## [Run additional options for logstash in docker container](https://discuss.elastic.co/t/run-additional-options-for-logstash-in-docker-container/249578)
**Author:** [@vinci](https://discuss.elastic.co/u/vinci)\ **Replies:** 2\ **Last updated:** [September 22, 2020, 8:31pm UTC](https://discuss.elastic.co/t/run-additional-options-for-logstash-in-docker-container/249578 "2020-09-22T20:31:59Z")
Hello, I would like to run logstash as such: logstash -e 'input { stdin {}} output { stdout {}}' but within a docker container, using the logstash official image. Is there a way I can do this? I simply want to test th… --- ## [Winlogbeat processor for powershell module](https://discuss.elastic.co/t/winlogbeat-processor-for-powershell-module/249390)
**Author:** [@v.n](https://discuss.elastic.co/u/v.n)\ **Replies:** 2\ **Last updated:** [September 22, 2020, 8:03pm UTC](https://discuss.elastic.co/t/winlogbeat-processor-for-powershell-module/249390 "2020-09-22T20:03:18Z")
This page shows how to enable modules for security and sysmon but nothing for powershell. winlogbeat.event\_logs: name: ForwardedEvents tags: \[forwarded\] processors: script: when.equals.winlog.channel: Security l… --- ## [How do I disable enterprise search in Kibana 7.9?](https://discuss.elastic.co/t/how-do-i-disable-enterprise-search-in-kibana-7-9/249559)
**Author:** [@Rhonda\_Gregory](https://discuss.elastic.co/u/Rhonda_Gregory)\ **Replies:** 2\ **Last updated:** [September 22, 2020, 7:45pm UTC](https://discuss.elastic.co/t/how-do-i-disable-enterprise-search-in-kibana-7-9/249559 "2020-09-22T19:45:33Z")
Our elastic/kibana instances reside on an air gapped network so we can not leverage the features of enterprise search. Are there configuration settings for kibana.yml that we can use to disable this feature? We would a… --- ## [Data node not able to discover master node](https://discuss.elastic.co/t/data-node-not-able-to-discover-master-node/249570)
**Author:** [@srbhklkrn](https://discuss.elastic.co/u/srbhklkrn)\ **Replies:** 4\ **Last updated:** [September 22, 2020, 7:04pm UTC](https://discuss.elastic.co/t/data-node-not-able-to-discover-master-node/249570 "2020-09-22T19:04:55Z")
I have 1 master eligible node and 1 data node Master config: # ---------------------------------- Cluster ----------------------------------- cluster.name: ELS\_Cluster # ------------------------------------ Node ------… --- ## [Latest released version (v7.9.1) python environment fails](https://discuss.elastic.co/t/latest-released-version-v7-9-1-python-environment-fails/249568)
**Author:** [@Sean\_Houghton](https://discuss.elastic.co/u/Sean_Houghton)\ **Replies:** 1\ **Last updated:** [September 22, 2020, 6:00pm UTC](https://discuss.elastic.co/t/latest-released-version-v7-9-1-python-environment-fails/249568 "2020-09-22T18:00:47Z")
When using the latest pinned version (as everyone should be doing in production) the python-dev makefile target fails with setuptools errors ImportError: cannot import name 'Feature' from 'setuptools' (/private/tmp/… --- ## [Including Metricbeat Custom Field in Watch](https://discuss.elastic.co/t/including-metricbeat-custom-field-in-watch/249130)
**Author:** [@butchkelley](https://discuss.elastic.co/u/butchkelley)\ **Replies:** 7\ **Last updated:** [September 22, 2020, 2:55pm UTC](https://discuss.elastic.co/t/including-metricbeat-custom-field-in-watch/249130 "2020-09-22T14:55:24Z")
Hello - I have the following Watch which triggers when Metricbeat shows system.cpu.total.pct is over 75%. PUT \_watcher/watch/testwatch { "trigger": { "schedule": { "interval": "10s" } }, "metadata":… --- ## [Can we rebuild Anomaly Exporter and Single metric in ML Module](https://discuss.elastic.co/t/can-we-rebuild-anomaly-exporter-and-single-metric-in-ml-module/249314)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 1\ **Last updated:** [September 22, 2020, 3:38pm UTC](https://discuss.elastic.co/t/can-we-rebuild-anomaly-exporter-and-single-metric-in-ml-module/249314 "2020-09-22T15:38:31Z")
Hi, I try to rebuild some chart in ML module include Anomaly exporter and single metric on Kibana. So can i do that with ML data in ES? I mean what data source that will be use to do this? .ml-anomalies-shared Data s… --- ## [Elasticsearch input on logstash duplicating documents](https://discuss.elastic.co/t/elasticsearch-input-on-logstash-duplicating-documents/249544)
**Author:** [@Matthew\_Field](https://discuss.elastic.co/u/Matthew_Field)\ **Replies:** 0\ **Last updated:** [September 22, 2020, 3:10pm UTC](https://discuss.elastic.co/t/elasticsearch-input-on-logstash-duplicating-documents/249544 "2020-09-22T15:10:25Z")
According to the docs, if i don't set a schedule, the logstash input plugin should run once and only once. However i find logstash keeps adding new duplicate/triplicate etc documents to my output for the longer i run. … --- ## [UDP Input - Get host - how?](https://discuss.elastic.co/t/udp-input-get-host-how/249458)
**Author:** [@diecode](https://discuss.elastic.co/u/diecode)\ **Replies:** 1\ **Last updated:** [September 22, 2020, 2:50pm UTC](https://discuss.elastic.co/t/udp-input-get-host-how/249458 "2020-09-22T14:50:11Z")
Hey, How can I get the sender IP in UDP Input? I would like create an if expression for set type. I tried this, but it is not working: input { udp { port =\> 1514 if \[host\] == "1.1.1.1" {… --- ## [Splitting the data in logstash](https://discuss.elastic.co/t/splitting-the-data-in-logstash/249404)
**Author:** [@subash](https://discuss.elastic.co/u/subash)\ **Replies:** 3\ **Last updated:** [September 22, 2020, 2:46pm UTC](https://discuss.elastic.co/t/splitting-the-data-in-logstash/249404 "2020-09-22T14:46:03Z")
I have a field 'brief' in the below format. "brief": \[ {rx-usage: 0.0, tx-stats: {tx-errors: 0, tx-bytes: 3597278194, tx-bps: 1808, tx-pps: 3, tx-packets: 8620093}, name: vni-0/0, host-inf: eth1, if-oper-status: up, … --- ## [Substracting event fields in partitioned data](https://discuss.elastic.co/t/substracting-event-fields-in-partitioned-data/249119)
**Author:** [@JorritvdLaan](https://discuss.elastic.co/u/JorritvdLaan)\ **Replies:** 3\ **Last updated:** [September 22, 2020, 2:40pm UTC](https://discuss.elastic.co/t/substracting-event-fields-in-partitioned-data/249119 "2020-09-22T14:40:32Z")
Hello, I am working with a set of devices that pushes data to my database every 5 minutes. The data contains a field with the device's id and a field with a float value. Now, for every device I would like to substract … --- ## [UnsupportedOperationException causes snapshots to fail](https://discuss.elastic.co/t/unsupportedoperationexception-causes-snapshots-to-fail/249181)
**Author:** [@OliviaTrewin](https://discuss.elastic.co/u/OliviaTrewin)\ **Replies:** 3\ **Last updated:** [September 22, 2020, 2:25pm UTC](https://discuss.elastic.co/t/unsupportedoperationexception-causes-snapshots-to-fail/249181 "2020-09-22T14:25:58Z")
We have an Elasticsearch 7.9.1 cluster that suddenly started to fail snapshotting with a strange exception. Here's the details for one of the machines in the cluster: $ uname -a Linux \[REDACTED\] 4.4.0-1095-aws #106-Ubun… --- ## [API | Session management | User authentication and logout | Kibana / Elastic](https://discuss.elastic.co/t/api-session-management-user-authentication-and-logout-kibana-elastic/248509)
**Author:** [@tarun1](https://discuss.elastic.co/u/tarun1)\ **Replies:** 4\ **Last updated:** [September 22, 2020, 2:15pm UTC](https://discuss.elastic.co/t/api-session-management-user-authentication-and-logout-kibana-elastic/248509 "2020-09-22T14:15:39Z")
I'm trying to use rest api to authenticate and logout session for Kibana. 1)The only api I can see to authenticate in kibana is https://localhost:9200/\_security/user/jacknich Which responds with user role, metadata but … --- ## [Watchguard firewall on ingestion manager](https://discuss.elastic.co/t/watchguard-firewall-on-ingestion-manager/249482)
**Author:** [@JLT](https://discuss.elastic.co/u/JLT)\ **Replies:** 2\ **Last updated:** [September 22, 2020, 1:49pm UTC](https://discuss.elastic.co/t/watchguard-firewall-on-ingestion-manager/249482 "2020-09-22T13:49:05Z")
The ingestion manager was long due and i am quite pleased with what i see. For this client there is a request to on-board watchguard devices, can i contribute to an effort of creating an ingestion profile for watchguard… --- ## [ElasticSearch. Select by date range in array of dates and sort by matching dates](https://discuss.elastic.co/t/elasticsearch-select-by-date-range-in-array-of-dates-and-sort-by-matching-dates/249509)
**Author:** [@AHeavyObject](https://discuss.elastic.co/u/AHeavyObject)\ **Replies:** 1\ **Last updated:** [September 22, 2020, 1:38pm UTC](https://discuss.elastic.co/t/elasticsearch-select-by-date-range-in-array-of-dates-and-sort-by-matching-dates/249509 "2020-09-22T13:38:36Z")
Every document has several dates. I want to select documents withing a date range (any of dates fits the range - the document matches). This part works. And I want to sort the selected document by date, but sorting inc… --- ## [How to match documents that don't have a specific nested object](https://discuss.elastic.co/t/how-to-match-documents-that-dont-have-a-specific-nested-object/249514)
**Author:** [@thomashiron](https://discuss.elastic.co/u/thomashiron)\ **Replies:** 1\ **Last updated:** [September 22, 2020, 1:34pm UTC](https://discuss.elastic.co/t/how-to-match-documents-that-dont-have-a-specific-nested-object/249514 "2020-09-22T13:34:20Z")
Hi! I'd like to find documents with nested objects that don't match a specific query. For example, I want to match documents that don't have an Alice user. If I follow the documentation, and execute the query below, I… --- ## [Yum install filebeat oss version fails](https://discuss.elastic.co/t/yum-install-filebeat-oss-version-fails/249529)
**Author:** [@xachman](https://discuss.elastic.co/u/xachman)\ **Replies:** 1\ **Last updated:** [September 22, 2020, 1:29pm UTC](https://discuss.elastic.co/t/yum-install-filebeat-oss-version-fails/249529 "2020-09-22T13:29:08Z")
When installing filebeat oss version I get the error. The non oss version installed fine. filebeat-7.9.1-x86\_64.rpm FAILED https://artifacts.elastic.co/packages/oss-7.x/yum/7.9.1/filebeat-7.9.1-x86\_64.rpm: \[Errno … --- ## [Creating multiple tabs in kibana](https://discuss.elastic.co/t/creating-multiple-tabs-in-kibana/249310)
**Author:** [@antony\_kavin](https://discuss.elastic.co/u/antony_kavin)\ **Replies:** 3\ **Last updated:** [September 22, 2020, 1:23pm UTC](https://discuss.elastic.co/t/creating-multiple-tabs-in-kibana/249310 "2020-09-22T13:23:58Z")
Hi team, In the dashboard, I want to create a Navigation pane and create tab names like demand,supply,etc.And when the user clicks on any tab name, it should navigate to the correspoding dashboard(or view). Essentially… --- ## [Logstash how to solve the problem about jackson-databind CVE-2020-9548](https://discuss.elastic.co/t/logstash-how-to-solve-the-problem-about-jackson-databind-cve-2020-9548/249526)
**Author:** [@geraintj](https://discuss.elastic.co/u/geraintj)\ **Replies:** 0\ **Last updated:** [September 22, 2020, 1:13pm UTC](https://discuss.elastic.co/t/logstash-how-to-solve-the-problem-about-jackson-databind-cve-2020-9548/249526 "2020-09-22T13:13:21Z")
Hi. We're using Logstash 6.8.6, which has a dependency on jackson-databind 2.9.9.3. Our scans are flagging it as vulnerable to CVE-2020-9548: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction b… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1790) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1792)