# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1811 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1812 --- ## [Filebeat - input not enabled when using external config load](https://discuss.elastic.co/t/filebeat-input-not-enabled-when-using-external-config-load/245365)
**Author:** [@eMDee](https://discuss.elastic.co/u/eMDee)\ **Replies:** 5\ **Last updated:** [September 11, 2020, 4:02pm UTC](https://discuss.elastic.co/t/filebeat-input-not-enabled-when-using-external-config-load/245365 "2020-09-11T16:02:44Z")
Hi There, I'm trying to use filebeat to import logs from custom locations. In configuration I have: filebeat: config.inputs: enabled: true path: "/etc/filebeat/conf.d/\*.yml" output.logstash: … --- ## [Dynamic template for complex types](https://discuss.elastic.co/t/dynamic-template-for-complex-types/205059)
**Author:** [@parosio](https://discuss.elastic.co/u/parosio)\ **Replies:** 5\ **Last updated:** [September 11, 2020, 2:58pm UTC](https://discuss.elastic.co/t/dynamic-template-for-complex-types/205059 "2020-09-11T14:58:27Z")
Hello, is it possible to have a complex type (like a geopoint) dinamically recognized using the dynamic\_templates section of a template/index mapping? Sort of: PUT test\_loc/doc/1 { "position" : \[-64, -19.4\] } resu… --- ## [How we can determine the execution time between event name START and END ? we have msecs filed to calculate the mili second difference between two rows.I tried creating the scripted field...but it is not working as expected](https://discuss.elastic.co/t/how-we-can-determine-the-execution-time-between-event-name-start-and-end-we-have-msecs-filed-to-calculate-the-mili-second-difference-between-two-rows-i-tried-creating-the-scripted-field-but-it-is-not-working-as-expected/247572)
**Author:** [@Raja\_Kushwah](https://discuss.elastic.co/u/Raja_Kushwah)\ **Replies:** 6\ **Last updated:** [September 11, 2020, 2:44pm UTC](https://discuss.elastic.co/t/how-we-can-determine-the-execution-time-between-event-name-start-and-end-we-have-msecs-filed-to-calculate-the-mili-second-difference-between-two-rows-i-tried-creating-the-scripted-field-but-it-is-not-working-as-expected/247572 "2020-09-11T14:44:44Z")
--- ## [Execute a PLSQL procedure or funtion](https://discuss.elastic.co/t/execute-a-plsql-procedure-or-funtion/248348)
**Author:** [@Rui\_Goncalves](https://discuss.elastic.co/u/Rui_Goncalves)\ **Replies:** 0\ **Last updated:** [September 11, 2020, 2:42pm UTC](https://discuss.elastic.co/t/execute-a-plsql-procedure-or-funtion/248348 "2020-09-11T14:42:27Z")
Hi, I'm new to elk. I needed on logstash to execute a PLSQL procedure with an input parameter and an output one or as an option execute a PLSQL function with an input parameter and receive a return value. These output/re… --- ## [Is LDAP connectivity open forever? How to close connection to LDAP server after authentication is done?](https://discuss.elastic.co/t/is-ldap-connectivity-open-forever-how-to-close-connection-to-ldap-server-after-authentication-is-done/248338)
**Author:** [@adarsh.venugopal](https://discuss.elastic.co/u/adarsh.venugopal)\ **Replies:** 0\ **Last updated:** [September 11, 2020, 2:19pm UTC](https://discuss.elastic.co/t/is-ldap-connectivity-open-forever-how-to-close-connection-to-ldap-server-after-authentication-is-done/248338 "2020-09-11T14:19:13Z")
We are expecting that the LDAP connection closes after the authentication search but it is not happening. This is what we would want to see in the logs:- \[logs\]$grep conn=1138167 access CONNECT conn=1138167 fr… --- ## [Search as you type field, best practice](https://discuss.elastic.co/t/search-as-you-type-field-best-practice/248289)
**Author:** [@Daniele\_Renda](https://discuss.elastic.co/u/Daniele_Renda)\ **Replies:** 1\ **Last updated:** [September 11, 2020, 2:03pm UTC](https://discuss.elastic.co/t/search-as-you-type-field-best-practice/248289 "2020-09-11T14:03:34Z")
Hi, I made some tests with search as you type field: https://www.elastic.co/guide/en/elasticsearch/reference/7.x/search-as-you-type.html I've an index containing products. Each product(document) have many fields like: … --- ## [Composite query and filter agregation on a .ml-anomalies index](https://discuss.elastic.co/t/composite-query-and-filter-agregation-on-a-ml-anomalies-index/248201)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 6\ **Last updated:** [September 11, 2020, 1:56pm UTC](https://discuss.elastic.co/t/composite-query-and-filter-agregation-on-a-ml-anomalies-index/248201 "2020-09-11T13:56:17Z")
HI, Im trying to query the ML anomalies index with a composite query and a filter aggregation, but the filter aggs is not working, I want to get a specific job but it gets me others jobs in the index. Any ideas what is… --- ## [Grok Parse Help](https://discuss.elastic.co/t/grok-parse-help/248221)
**Author:** [@Jim\_Thunder](https://discuss.elastic.co/u/Jim_Thunder)\ **Replies:** 3\ **Last updated:** [September 11, 2020, 1:38pm UTC](https://discuss.elastic.co/t/grok-parse-help/248221 "2020-09-11T13:38:35Z")
I am trying to pull one piece of information out of a field using grok. I've tried a couple different way and nothing seems to work. Nothing crashes at all, it's just that I don't see the new field that I am expecting to… --- ## [Logstash is not pushing logs to Azure](https://discuss.elastic.co/t/logstash-is-not-pushing-logs-to-azure/248204)
**Author:** [@Henri.C.Lefevre](https://discuss.elastic.co/u/Henri.C.Lefevre)\ **Replies:** 2\ **Last updated:** [September 10, 2020, 4:50pm UTC](https://discuss.elastic.co/t/logstash-is-not-pushing-logs-to-azure/248204 "2020-09-10T16:50:35Z")
Hello, I am using Logstash 7.9 on Ubuntu 18.04 LTS with OpenJDK 11. I configured an Azure Log Analytics plugin with a configuration file which works on logstash 2.3. Logstash seems to start well but no logs are pushed … --- ## [How to have CURL command equivalent of triple quotes?](https://discuss.elastic.co/t/how-to-have-curl-command-equivalent-of-triple-quotes/248332)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 0\ **Last updated:** [September 11, 2020, 1:27pm UTC](https://discuss.elastic.co/t/how-to-have-curl-command-equivalent-of-triple-quotes/248332 "2020-09-11T13:27:49Z")
hi, we have a watcher code which contains "actions": { "index\_alert": { "transform": { "script": { "source": """ return \[ 'watch\_id': ctx.watch\_id, … --- ## [Does eager\_global\_ordinals speed up metrics calcaulations on high cardinality keyword fields?](https://discuss.elastic.co/t/does-eager-global-ordinals-speed-up-metrics-calcaulations-on-high-cardinality-keyword-fields/248330)
**Author:** [@Peter\_Steenbergen](https://discuss.elastic.co/u/Peter_Steenbergen)\ **Replies:** 0\ **Last updated:** [September 11, 2020, 1:19pm UTC](https://discuss.elastic.co/t/does-eager-global-ordinals-speed-up-metrics-calcaulations-on-high-cardinality-keyword-fields/248330 "2020-09-11T13:19:43Z")
Hi, I was wondering if people have tested with a dataset with around 1.5M records with 40k of unique terms in a particular field to do metric calculations on or a regex filtering. I know there is a wildcard field (does … --- ## [Logstash shuts down if gelf output TCP connection is refused](https://discuss.elastic.co/t/logstash-shuts-down-if-gelf-output-tcp-connection-is-refused/248132)
**Author:** [@Samuel\_Delepiere](https://discuss.elastic.co/u/Samuel_Delepiere)\ **Replies:** 3\ **Last updated:** [September 11, 2020, 1:19pm UTC](https://discuss.elastic.co/t/logstash-shuts-down-if-gelf-output-tcp-connection-is-refused/248132 "2020-09-11T13:19:03Z")
I have configured logstash with a TCP gelf output. However, if the TCP connection cannot be established (e.g graylog is down or hasn't yet been configured to listen on the port), the pipeline aborts and logstash shuts do… --- ## [Regex field starts with a string](https://discuss.elastic.co/t/regex-field-starts-with-a-string/248235)
**Author:** [@ankitachow](https://discuss.elastic.co/u/ankitachow)\ **Replies:** 2\ **Last updated:** [September 11, 2020, 1:12pm UTC](https://discuss.elastic.co/t/regex-field-starts-with-a-string/248235 "2020-09-11T13:12:29Z")
I want to add a new field if a field start with a certain string. Added below code in filter { }, to set a new field error as "Y" if text starts with ERROR: . Doesnt seem to work. if "\[dest\]\[text\]" =~ /^ERROR: .\*/ { … --- ## [Not able to start elasticsearch service](https://discuss.elastic.co/t/not-able-to-start-elasticsearch-service/246761)
**Author:** [@nidhi1](https://discuss.elastic.co/u/nidhi1)\ **Replies:** 4\ **Last updated:** [September 11, 2020, 12:53pm UTC](https://discuss.elastic.co/t/not-able-to-start-elasticsearch-service/246761 "2020-09-11T12:53:08Z")
Unit elasticsearch.service entered failed state. systemd\[1\]: elasticsearch.service failed. Unregistered Authentication Agent for u (system bus name :1.89340, object path /org/freedesktop/Po polkitd\[1243\]: Registere… --- ## [How to create new User in Kibana by using nginx](https://discuss.elastic.co/t/how-to-create-new-user-in-kibana-by-using-nginx/248317)
**Author:** [@muthug](https://discuss.elastic.co/u/muthug)\ **Replies:** 1\ **Last updated:** [September 11, 2020, 12:39pm UTC](https://discuss.elastic.co/t/how-to-create-new-user-in-kibana-by-using-nginx/248317 "2020-09-11T12:39:54Z")
ELK is very old version 4.2 :frowning: So, unable to find anything on internet or without nginx also fine --- ## [Authentication through Nginx on Kibana 7.9](https://discuss.elastic.co/t/authentication-through-nginx-on-kibana-7-9/248318)
**Author:** [@barbarad](https://discuss.elastic.co/u/barbarad)\ **Replies:** 0\ **Last updated:** [September 11, 2020, 12:27pm UTC](https://discuss.elastic.co/t/authentication-through-nginx-on-kibana-7-9/248318 "2020-09-11T12:27:44Z")
Hi, I'm try to automatically authenticate in kibana 7.9 using nginx but it's not working. I'm using native default users define in elasticsearch. This is my nginx configuration running in docker, kibana is also deploy… --- ## [Filter search results with same ID using different indices](https://discuss.elastic.co/t/filter-search-results-with-same-id-using-different-indices/248316)
**Author:** [@tim\_cgn](https://discuss.elastic.co/u/tim_cgn)\ **Replies:** 0\ **Last updated:** [September 11, 2020, 12:18pm UTC](https://discuss.elastic.co/t/filter-search-results-with-same-id-using-different-indices/248316 "2020-09-11T12:18:01Z")
Hello together, i have a simple query that performs a search on an alias. This alias contains several indices. Documents are stored in the different indexes with the same id, but have a different status, so they differ… --- ## [Cluster Yellow - Heap size overload](https://discuss.elastic.co/t/cluster-yellow-heap-size-overload/248292)
**Author:** [@Thomas74](https://discuss.elastic.co/u/Thomas74)\ **Replies:** 1\ **Last updated:** [September 11, 2020, 12:15pm UTC](https://discuss.elastic.co/t/cluster-yellow-heap-size-overload/248292 "2020-09-11T12:15:16Z")
Hi, An ILM policy had a conflict with curator last night. It wasn't working because of closed index. I reopen it and retry ilm policy and seems ok. But my cluster still yellow and cannot reallocate shard because of th… --- ## [Cumulative Sum over Terms or Hour Only](https://discuss.elastic.co/t/cumulative-sum-over-terms-or-hour-only/247257)
**Author:** [@Alexandre.Bernier](https://discuss.elastic.co/u/Alexandre.Bernier)\ **Replies:** 2\ **Last updated:** [September 11, 2020, 11:55am UTC](https://discuss.elastic.co/t/cumulative-sum-over-terms-or-hour-only/247257 "2020-09-11T11:55:51Z")
Hello dear forum members, I'm desperately trying to reproduce such a simple graphic in Kibana and it doesn't seem to be possible. The first column, textual data. The second column, numeric data. The third column, the… --- ## [Filebeats: Fortinet Module not processing data as it should](https://discuss.elastic.co/t/filebeats-fortinet-module-not-processing-data-as-it-should/241890)
**Author:** [@Khaled3500](https://discuss.elastic.co/u/Khaled3500)\ **Replies:** 4\ **Last updated:** [September 11, 2020, 11:26am UTC](https://discuss.elastic.co/t/filebeats-fortinet-module-not-processing-data-as-it-should/241890 "2020-09-11T11:26:15Z")
Hello, I'm trying to use fortinet module to parse and make logs presentable before it ships to logstash here is my filebeats configuration file: # ============================== Filebeat inputs ======================… --- ## [HttpStatus conversion to integer](https://discuss.elastic.co/t/httpstatus-conversion-to-integer/244137)
**Author:** [@graimato](https://discuss.elastic.co/u/graimato)\ **Replies:** 4\ **Last updated:** [September 11, 2020, 10:55am UTC](https://discuss.elastic.co/t/httpstatus-conversion-to-integer/244137 "2020-09-11T10:55:23Z")
Dear All, I created a custom filebeat 7.8.x module to load log data into Elastic . I created a pipeline to manage logs. I was able to convert datetime convert DATA into float But I'm trying to convert httpStatusCode … --- ## [Elasticsearch Docker: flood stage disk watermark \[95%\] exceeded](https://discuss.elastic.co/t/elasticsearch-docker-flood-stage-disk-watermark-95-exceeded/248300)
**Author:** [@Stimmot](https://discuss.elastic.co/u/Stimmot)\ **Replies:** 0\ **Last updated:** [September 11, 2020, 10:23am UTC](https://discuss.elastic.co/t/elasticsearch-docker-flood-stage-disk-watermark-95-exceeded/248300 "2020-09-11T10:23:39Z")
I have a similar issue to the one posted here: https://stackoverflow.com/questions/50609417/elasticsearch-error-cluster-block-exception-forbidden-12-index-read-only-all I'm running Elasticsearch and Kibana with docker-c… --- ## [Adding new element to list of objects with the new name of field](https://discuss.elastic.co/t/adding-new-element-to-list-of-objects-with-the-new-name-of-field/248275)
**Author:** [@charvi23](https://discuss.elastic.co/u/charvi23)\ **Replies:** 0\ **Last updated:** [September 11, 2020, 7:10am UTC](https://discuss.elastic.co/t/adding-new-element-to-list-of-objects-with-the-new-name-of-field/248275 "2020-09-11T07:10:33Z")
I am trying to add new object to list of object in an elastic search index with java HighLevelRestClient. I know I can do it with following query: String query = "ctx.\_source.custom\_analysis.custom\_analysis\_list.add(par… --- ## [Kibana timelion visualization](https://discuss.elastic.co/t/kibana-timelion-visualization/247878)
**Author:** [@Thomas74](https://discuss.elastic.co/u/Thomas74)\ **Replies:** 2\ **Last updated:** [September 11, 2020, 9:33am UTC](https://discuss.elastic.co/t/kibana-timelion-visualization/247878 "2020-09-11T09:33:28Z")
Hi, How can I inverse timelion legend selection when you have multiple curves ? When I click on one curve name, it become hidden but I would like it to be selected and not hidden. Is it possible to do it ? Best regar… --- ## [Percentage difference over two different periods](https://discuss.elastic.co/t/percentage-difference-over-two-different-periods/247838)
**Author:** [@Thomas74](https://discuss.elastic.co/u/Thomas74)\ **Replies:** 2\ **Last updated:** [September 11, 2020, 9:32am UTC](https://discuss.elastic.co/t/percentage-difference-over-two-different-periods/247838 "2020-09-11T09:32:24Z")
Hi, I would like to see how I receive specifics logs during two periods : Current month Current month - 1 The goal is to see the difference, in percentage, between them. For example, this month we increased log integ… --- ## [Ingestion from ES-Spark to Ingestion node](https://discuss.elastic.co/t/ingestion-from-es-spark-to-ingestion-node/247812)
**Author:** [@snambu5878](https://discuss.elastic.co/u/snambu5878)\ **Replies:** 7\ **Last updated:** [September 11, 2020, 8:36am UTC](https://discuss.elastic.co/t/ingestion-from-es-spark-to-ingestion-node/247812 "2020-09-11T08:36:26Z")
Hi Everyone, We have 12 node cluster, 1 ingestion, 3 master, 3 hot data, 2 warm data, 2 kibana (same for coordinating) nodes and 1 monitoring node. We are trying to ingestion data from Hadoop environment using ES-Spar… --- ## [ElasticSearch 7 nest 7 return attribute from result all result](https://discuss.elastic.co/t/elasticsearch-7-nest-7-return-attribute-from-result-all-result/247834)
**Author:** [@Isanka\_Thalagala](https://discuss.elastic.co/u/Isanka_Thalagala)\ **Replies:** 2\ **Last updated:** [September 11, 2020, 8:24am UTC](https://discuss.elastic.co/t/elasticsearch-7-nest-7-return-attribute-from-result-all-result/247834 "2020-09-11T08:24:06Z")
I'm using ElarsticSearch 7.7 & NEST 7.7 and on my web page, I'm getting 9 search result documents per page. Even I'm showing the first 9 results on the page, I need to return some property values from all the results for… --- ## [Restrict node that can join cluster](https://discuss.elastic.co/t/restrict-node-that-can-join-cluster/248175)
**Author:** [@nitin7](https://discuss.elastic.co/u/nitin7)\ **Replies:** 2\ **Last updated:** [September 11, 2020, 7:49am UTC](https://discuss.elastic.co/t/restrict-node-that-can-join-cluster/248175 "2020-09-11T07:49:25Z")
Hi all, Is there a way to define or restrict the host names which can join a specific cluster in the enterprise network on the same domain. --- ## [Filebeat Setup isn't working after update to 7.9.0](https://discuss.elastic.co/t/filebeat-setup-isnt-working-after-update-to-7-9-0/245564)
**Author:** [@BoKu](https://discuss.elastic.co/u/BoKu)\ **Replies:** 6\ **Last updated:** [September 11, 2020, 7:46am UTC](https://discuss.elastic.co/t/filebeat-setup-isnt-working-after-update-to-7-9-0/245564 "2020-09-11T07:46:49Z")
Hello there, we just upgraded our testsite (elastic, kibana, metricbeat, auditbeat and filebeat) to version 7.9.0. After the update filebeat setup fails with the following message: \[root@ELASTIC99004 ~\]# filebeat setup… --- ## [Problem indexing ES with batches](https://discuss.elastic.co/t/problem-indexing-es-with-batches/247961)
**Author:** [@magorbe](https://discuss.elastic.co/u/magorbe)\ **Replies:** 2\ **Last updated:** [September 11, 2020, 7:36am UTC](https://discuss.elastic.co/t/problem-indexing-es-with-batches/247961 "2020-09-11T07:36:29Z")
Hello. I am doing reindexing in ES with the next command : nohup curl -XPOST http:/bla:9200/\_reindex -d '{ "source": { "index": "origin\_index", "size": 5000 }, "dest": {"index": "dest\_index" }}' \> reindex\_100\_21.out … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1810) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1812)