# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1812 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1813 --- ## [Filebeat not sending output](https://discuss.elastic.co/t/filebeat-not-sending-output/248190)
**Author:** [@humartinez](https://discuss.elastic.co/u/humartinez)\ **Replies:** 2\ **Last updated:** [September 11, 2020, 7:30am UTC](https://discuss.elastic.co/t/filebeat-not-sending-output/248190 "2020-09-11T07:30:16Z")
I was trying to debug why my filebeat is not sending output to kafka but after debuging I'd change it to file output to see if my config is ok, but Im not getting any output also This is my config file cat filebeat.yml… --- ## [ES performance reliablity issue](https://discuss.elastic.co/t/es-performance-reliablity-issue/247974)
**Author:** [@wangxr1985](https://discuss.elastic.co/u/wangxr1985)\ **Replies:** 6\ **Last updated:** [September 11, 2020, 7:27am UTC](https://discuss.elastic.co/t/es-performance-reliablity-issue/247974 "2020-09-11T07:27:31Z")
My query is very simple, just like this: { "query": {"bool": { "filter": {"term": {"user\_guid": "xxxx" }}}}} the user\_guid is equal to document id, and the query contains routing argument. If I do this query sever… --- ## [Filebeat not respecting ingest pipeline in output settings when using syslog inputs](https://discuss.elastic.co/t/filebeat-not-respecting-ingest-pipeline-in-output-settings-when-using-syslog-inputs/248060)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 3\ **Last updated:** [September 11, 2020, 7:21am UTC](https://discuss.elastic.co/t/filebeat-not-respecting-ingest-pipeline-in-output-settings-when-using-syslog-inputs/248060 "2020-09-11T07:21:43Z")
Hi, I'm having issues using ingest pipelines with Filebeat. Filebeat is supposed to collect any syslog messages and send them to the ingest pipeline "syslog\_distributor". However, the incoming documents are not passed t… --- ## [ES SQL - Order by Count](https://discuss.elastic.co/t/es-sql-order-by-count/248195)
**Author:** [@Jose\_H](https://discuss.elastic.co/u/Jose_H)\ **Replies:** 2\ **Last updated:** [September 11, 2020, 7:02am UTC](https://discuss.elastic.co/t/es-sql-order-by-count/248195 "2020-09-11T07:02:51Z")
Hi all, Im trying to order and display by the highest count for @computed.message field, but encountering the below error: POST /\_sql?format=txt { "query":"SELECT \\"@timestamp\\", \\"@computed.message\\", \\"@computed.… --- ## [This action would add \[2\] total shards, but this cluster currently has \[2000\]/\[2000\] maximum shards open;](https://discuss.elastic.co/t/this-action-would-add-2-total-shards-but-this-cluster-currently-has-2000-2000-maximum-shards-open/248255)
**Author:** [@Maricar\_Laygo](https://discuss.elastic.co/u/Maricar_Laygo)\ **Replies:** 1\ **Last updated:** [September 11, 2020, 5:12am UTC](https://discuss.elastic.co/t/this-action-would-add-2-total-shards-but-this-cluster-currently-has-2000-2000-maximum-shards-open/248255 "2020-09-11T05:12:05Z")
Invalid Bulk items: operation\[0\]: index returned 400 \_index: transactions-es-nfnxl530-20200911 \_type: \_doc \_id: 909090892 \_version: 0 error: Type: validation\_exception Reason: Validation Failed: 1: this action would add … --- ## [Elasticsearch group by, having and pagenation](https://discuss.elastic.co/t/elasticsearch-group-by-having-and-pagenation/248251)
**Author:** [@coolyrat](https://discuss.elastic.co/u/coolyrat)\ **Replies:** 0\ **Last updated:** [September 11, 2020, 2:24am UTC](https://discuss.elastic.co/t/elasticsearch-group-by-having-and-pagenation/248251 "2020-09-11T02:24:42Z")
I have a SQL that would like to query the same result set in ES. The result set would need to pagination. So I've tried Composite aggregation, it works fine for pagination and order. But I have no idea how to filter with… --- ## [Index Allocation based on attribute not working](https://discuss.elastic.co/t/index-allocation-based-on-attribute-not-working/248147)
**Author:** [@gruselglatz](https://discuss.elastic.co/u/gruselglatz)\ **Replies:** 9\ **Last updated:** [September 11, 2020, 6:25am UTC](https://discuss.elastic.co/t/index-allocation-based-on-attribute-not-working/248147 "2020-09-11T06:25:38Z")
Hi! Can someone pls explain to me why some shards dont get relocated to the correct node in my cluster? I want no shard on node-4 at the moment. Infos: GET \_cat/nodeattrs node-4 172.21.2.174 172.21.2.174 ml.machine\_m… --- ## [Host.keyword shows no value](https://discuss.elastic.co/t/host-keyword-shows-no-value/247864)
**Author:** [@Stevek](https://discuss.elastic.co/u/Stevek)\ **Replies:** 2\ **Last updated:** [September 11, 2020, 6:10am UTC](https://discuss.elastic.co/t/host-keyword-shows-no-value/247864 "2020-09-11T06:10:59Z")
Hello all, I am currently struggling to get my host.keyword working for filtering the nodes in dashboard. From the discovery tab it is visible there are 3 different values within host(image1), but host.keyword only pro… --- ## [What is elasticsearch xpack? it is available for all elasticsearch versions ? example 4](https://discuss.elastic.co/t/what-is-elasticsearch-xpack-it-is-available-for-all-elasticsearch-versions-example-4/248262)
**Author:** [@muthug](https://discuss.elastic.co/u/muthug)\ **Replies:** 1\ **Last updated:** [September 11, 2020, 5:26am UTC](https://discuss.elastic.co/t/what-is-elasticsearch-xpack-it-is-available-for-all-elasticsearch-versions-example-4/248262 "2020-09-11T05:26:17Z")
what is elasticsearch xpack? it is available for all elasticsearch versions ? example version 4.2 Kibana 4.2 --- ## [Documents with duplicate \_id in an index split by time?](https://discuss.elastic.co/t/documents-with-duplicate-id-in-an-index-split-by-time/248260)
**Author:** [@mykael](https://discuss.elastic.co/u/mykael)\ **Replies:** 1\ **Last updated:** [September 11, 2020, 5:05am UTC](https://discuss.elastic.co/t/documents-with-duplicate-id-in-an-index-split-by-time/248260 "2020-09-11T05:05:10Z")
Might just be me misunderstanding how ids and indexing work here. I've got a stream of records and I write them to an index - my\_data Now, to keep it manigable, because there are lots of records, I'm telling logstash t… --- ## [Logstash unable to decode Cisco protobuf](https://discuss.elastic.co/t/logstash-unable-to-decode-cisco-protobuf/247955)
**Author:** [@Scottsdash](https://discuss.elastic.co/u/Scottsdash)\ **Replies:** 3\ **Last updated:** [September 11, 2020, 5:01am UTC](https://discuss.elastic.co/t/logstash-unable-to-decode-cisco-protobuf/247955 "2020-09-11T05:01:11Z")
Hoping someone has configured logstash to receive Cisco telemetry before, I'm able to receive the events but can't decode the telemetry. I'm getting the folowing error from logstash: \[WARN \] 2020-09-09 05:18:01.074 \[ni… --- ## [Elastic NEST attribute mapping for multiple fields](https://discuss.elastic.co/t/elastic-nest-attribute-mapping-for-multiple-fields/247542)
**Author:** [@user7](https://discuss.elastic.co/u/user7)\ **Replies:** 1\ **Last updated:** [September 11, 2020, 3:18am UTC](https://discuss.elastic.co/t/elastic-nest-attribute-mapping-for-multiple-fields/247542 "2020-09-11T03:18:12Z")
I have an alias on two very large indices that have many common properties. The property names on the indices have however different naming conventions. For example: "index1" : { "mappings" : { "X" : { … --- ## [Kibana 7.7: Get associated saved search for visualization plugin](https://discuss.elastic.co/t/kibana-7-7-get-associated-saved-search-for-visualization-plugin/247932)
**Author:** [@jdd1](https://discuss.elastic.co/u/jdd1)\ **Replies:** 4\ **Last updated:** [September 10, 2020, 11:30pm UTC](https://discuss.elastic.co/t/kibana-7-7-get-associated-saved-search-for-visualization-plugin/247932 "2020-09-10T23:30:27Z")
I have built a custom ReactJS visualization plugin, in which I use a custom request handler. Since I have requiresSearch set to true, I am able to choose an index pattern or saved search as the data source, and I am abl… --- ## [Kibana visualization issue](https://discuss.elastic.co/t/kibana-visualization-issue/247645)
**Author:** [@torten](https://discuss.elastic.co/u/torten)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 11:12pm UTC](https://discuss.elastic.co/t/kibana-visualization-issue/247645 "2020-09-10T23:12:09Z")
Hi everyone, I have an issue with kibana visualization, when using stack graph with range over byte field. Range values does not convert into human readable format (Kb, Mb, Gb) and numbers stay the same in the graph. … --- ## [Kibana Embed Dashboard with time filter then drilldown and time filter is lost](https://discuss.elastic.co/t/kibana-embed-dashboard-with-time-filter-then-drilldown-and-time-filter-is-lost/247214)
**Author:** [@johnwood](https://discuss.elastic.co/u/johnwood)\ **Replies:** 2\ **Last updated:** [September 10, 2020, 10:59pm UTC](https://discuss.elastic.co/t/kibana-embed-dashboard-with-time-filter-then-drilldown-and-time-filter-is-lost/247214 "2020-09-10T22:59:02Z")
Hello, 7.9 gives us the ability to create iframe links to embed in external sites that include the time filter control (or other filters). This feature is great! In the eternally embedded dashboard, when we drill f… --- ## [Most efficient way to search an array for a value (Painless)](https://discuss.elastic.co/t/most-efficient-way-to-search-an-array-for-a-value-painless/248247)
**Author:** [@emarthinsen](https://discuss.elastic.co/u/emarthinsen)\ **Replies:** 0\ **Last updated:** [September 10, 2020, 10:51pm UTC](https://discuss.elastic.co/t/most-efficient-way-to-search-an-array-for-a-value-painless/248247 "2020-09-10T22:51:14Z")
I wrote a script for generating a calculated field. It's written in Painless. I'm adding a feature to it where I need to see if an array that is on the document has a value in it. The property in the document is called c… --- ## [Filebeat is not sending logs to ELastic search](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-elastic-search/247745)
**Author:** [@Raman\_Sawhney](https://discuss.elastic.co/u/Raman_Sawhney)\ **Replies:** 8\ **Last updated:** [September 10, 2020, 10:44pm UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-elastic-search/247745 "2020-09-10T22:44:02Z")
Hello Team, We have an issue where filebeat is not sending some logs to elasticsearch so we can see it on kibana. The error we have received for the same is as below. Entity Too Large\\u003c/title\\u003e\\u003c/head\\u003… --- ## [License Elasticsearch 8.x nodes](https://discuss.elastic.co/t/license-elasticsearch-8-x-nodes/248244)
**Author:** [@mv\_guy](https://discuss.elastic.co/u/mv_guy)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 10:36pm UTC](https://discuss.elastic.co/t/license-elasticsearch-8-x-nodes/248244 "2020-09-10T22:36:49Z")
Hi, We recently purchased a 3 node Premium license for our work environment. I'm planning on running the newest 8.x stack, however when attempting to update the license, only up to 7.x is available to be downloaded/used… --- ## [Logstash config not found](https://discuss.elastic.co/t/logstash-config-not-found/248246)
**Author:** [@Sfec](https://discuss.elastic.co/u/Sfec)\ **Replies:** 0\ **Last updated:** [September 10, 2020, 10:28pm UTC](https://discuss.elastic.co/t/logstash-config-not-found/248246 "2020-09-10T22:28:21Z")
I created a logstash config file with the following code input { jdbc { jdbc\_connection\_string =\> "jdbc:sqlserver://localhost/serverName;database=dbName;integratedSecurity=true" jdbc\_… --- ## [Events received Rate expression using metricbeat on Timelion](https://discuss.elastic.co/t/events-received-rate-expression-using-metricbeat-on-timelion/247822)
**Author:** [@8wlgns](https://discuss.elastic.co/u/8wlgns)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 10:37pm UTC](https://discuss.elastic.co/t/events-received-rate-expression-using-metricbeat-on-timelion/247822 "2020-09-10T22:37:05Z")
Hello? I wanna draw Events received Rates per second on Kibana timelion using metricbeat :slight\_smile: Is this right expressions for this purpose? .es( index=test-monitoring\*, timefield='@timestamp', q='event.module:… --- ## [Line visualize show only top 10](https://discuss.elastic.co/t/line-visualize-show-only-top-10/247847)
**Author:** [@umay\_fb](https://discuss.elastic.co/u/umay_fb)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 10:30pm UTC](https://discuss.elastic.co/t/line-visualize-show-only-top-10/247847 "2020-09-10T22:30:37Z")
i want to show top 10 count of my data per day, but in line visualize i get its top 10 for each date, can we show top 10 for total data? --- ## [CloudTrail log is different between elasticsearch output and logstash output in Filebeat](https://discuss.elastic.co/t/cloudtrail-log-is-different-between-elasticsearch-output-and-logstash-output-in-filebeat/246075)
**Author:** [@TuongBma](https://discuss.elastic.co/u/TuongBma)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 10:06pm UTC](https://discuss.elastic.co/t/cloudtrail-log-is-different-between-elasticsearch-output-and-logstash-output-in-filebeat/246075 "2020-09-10T22:06:40Z")
I try to get cloudtrail log from AWS by filebeat. Scenario 1: I use elastic search output in filebeat, there are many enrichment fields such as geo, ... in the cloudtrail index. Scenario 2: I use log stash output in fi… --- ## [Best practices for validating elasticsearch snapshots](https://discuss.elastic.co/t/best-practices-for-validating-elasticsearch-snapshots/248240)
**Author:** [@proton](https://discuss.elastic.co/u/proton)\ **Replies:** 0\ **Last updated:** [September 10, 2020, 9:54pm UTC](https://discuss.elastic.co/t/best-practices-for-validating-elasticsearch-snapshots/248240 "2020-09-10T21:54:12Z")
We used verify the snapshots on daily bases to make sure they are in good state i.e has no corrupted data. We do this by spinning up a new cluster and restoring it to validate the we have at least one good snapshot. How… --- ## [How does split filtered events processed?](https://discuss.elastic.co/t/how-does-split-filtered-events-processed/248135)
**Author:** [@sharma\_yash](https://discuss.elastic.co/u/sharma_yash)\ **Replies:** 2\ **Last updated:** [September 10, 2020, 9:30pm UTC](https://discuss.elastic.co/t/how-does-split-filtered-events-processed/248135 "2020-09-10T21:30:02Z")
Hi, I am new to this community and come to know about splitting the events into multiple events. Got to know split filter plugin is the answer. I didn't understand the flow of pipeline when using this plugin. For ex:- … --- ## [Logstash not creating multiple index](https://discuss.elastic.co/t/logstash-not-creating-multiple-index/248234)
**Author:** [@shubham\_gour](https://discuss.elastic.co/u/shubham_gour)\ **Replies:** 4\ **Last updated:** [September 10, 2020, 9:24pm UTC](https://discuss.elastic.co/t/logstash-not-creating-multiple-index/248234 "2020-09-10T21:24:10Z")
i have this code use in conf file of logstash input { beats{ port =\> 5044 } } filter { grok{ match =\> { "message" =\> "%{INT:Event\_Date} %{MONTH:Event\_Month} %{YEAR:Event\_Year} | %{TIME:SFS\_Event\_Time},%{INT:LOG\_N… --- ## [Confusion matrix](https://discuss.elastic.co/t/confusion-matrix/248171)
**Author:** [@Eugene\_Dobrovolskyi](https://discuss.elastic.co/u/Eugene_Dobrovolskyi)\ **Replies:** 2\ **Last updated:** [September 10, 2020, 9:16pm UTC](https://discuss.elastic.co/t/confusion-matrix/248171 "2020-09-10T21:16:36Z")
Hi all! I am looking for a way to build a confusion matrix for image detection results (machine learning domain). I already uploaded my data to ElasticSearch and built index patterns for it. I tried different existing v… --- ## [KQL query not part of the query](https://discuss.elastic.co/t/kql-query-not-part-of-the-query/247052)
**Author:** [@Tobias\_Eriksson](https://discuss.elastic.co/u/Tobias_Eriksson)\ **Replies:** 2\ **Last updated:** [September 10, 2020, 8:47pm UTC](https://discuss.elastic.co/t/kql-query-not-part-of-the-query/247052 "2020-09-10T20:47:56Z")
For some reason the query is not included in the query sent to Elastic However "+ Add Filter" part of the query IS included in the query I had a look at the "Inspect" and it is clearly so that what ever I type in is no… --- ## [How to enrich data and filter by this data with Canvas?](https://discuss.elastic.co/t/how-to-enrich-data-and-filter-by-this-data-with-canvas/246561)
**Author:** [@rmartinez](https://discuss.elastic.co/u/rmartinez)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 8:40pm UTC](https://discuss.elastic.co/t/how-to-enrich-data-and-filter-by-this-data-with-canvas/246561 "2020-09-10T20:40:53Z")
Hello, We have a use case four our dashboards and it's not clear the feasibility. We have IoT devices gathering and indexing information from our customer locations. In these locations we want to measure the effect in… --- ## [Unable to import saved objects file](https://discuss.elastic.co/t/unable-to-import-saved-objects-file/248080)
**Author:** [@sc\_1010](https://discuss.elastic.co/u/sc_1010)\ **Replies:** 2\ **Last updated:** [September 10, 2020, 8:31pm UTC](https://discuss.elastic.co/t/unable-to-import-saved-objects-file/248080 "2020-09-10T20:31:14Z")
Hi all, I was doing a full restore of all of the saved objects when migrating my elastic datasource. Versions: Elastic 7.7.1 Kibana 7.7.1 I got a full export from /api/saved\_objects/\_export to an ndjson file. When … --- ## [A way to expand the Available Fields list?](https://discuss.elastic.co/t/a-way-to-expand-the-available-fields-list/248232)
**Author:** [@DThompson55](https://discuss.elastic.co/u/DThompson55)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 8:15pm UTC](https://discuss.elastic.co/t/a-way-to-expand-the-available-fields-list/248232 "2020-09-10T20:15:35Z")
In the Discover window, is there a way to widen or expand the pane that shows the list of available fields? Our field names are very long so it's hard to pick the right one. Hovering works, but is slow. [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1811) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1813)