# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1820

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1821

---

## [java.lang.ClassCastException: org.elasticsearch.search.aggregations.bucket.terms.ParsedStringTerms cannot be cast to org.elasticsearch.search.aggregations.bucket.terms.StringTerms](https://discuss.elastic.co/t/java-lang-classcastexception-org-elasticsearch-search-aggregations-bucket-terms-parsedstringterms-cannot-be-cast-to-org-elasticsearch-search-aggregations-bucket-terms-stringterms/247615)

<div class="topic-metadata">

**Author:** [@elastic78](https://discuss.elastic.co/u/elastic78)\
**Replies:** 1\
**Last updated:** [September 8, 2020, 5:12am UTC](https://discuss.elastic.co/t/java-lang-classcastexception-org-elasticsearch-search-aggregations-bucket-terms-parsedstringterms-cannot-be-cast-to-org-elasticsearch-search-aggregations-bucket-terms-stringterms/247615 "2020-09-08T05:12:30Z")

</div>

I am trying to get aggregations using GROUP By of an attributename and getting the below error. StringTerms strAggs = response.getAggregations().get(TermsAggregation.AGGREGATION\_PREFIX + attributeName); java.lang.Class…

---

## [Limit of total fields \[1000\] in index exceeded and nested json](https://discuss.elastic.co/t/limit-of-total-fields-1000-in-index-exceeded-and-nested-json/247774)

<div class="topic-metadata">

**Author:** [@Luca\_P](https://discuss.elastic.co/u/Luca_P)\
**Replies:** 2\
**Last updated:** [September 8, 2020, 5:04am UTC](https://discuss.elastic.co/t/limit-of-total-fields-1000-in-index-exceeded-and-nested-json/247774 "2020-09-08T05:04:12Z")

</div>

Hi All, I need some help to avoid the well known 'Limit of total fields \[1000\] in index exceeded' problem. I don't consider to raise the default in the settings above 1000. The culprit seems to be a field with a json v…

---

## [Limit of total fields \[1000\] in index exceeded and nested json](https://discuss.elastic.co/t/limit-of-total-fields-1000-in-index-exceeded-and-nested-json/247716)

<div class="topic-metadata">

**Author:** [@Luca\_P](https://discuss.elastic.co/u/Luca_P)\
**Replies:** 2\
**Last updated:** [September 8, 2020, 4:58am UTC](https://discuss.elastic.co/t/limit-of-total-fields-1000-in-index-exceeded-and-nested-json/247716 "2020-09-08T04:58:38Z")

</div>

Hi All, I need some help to avoid the well known 'Limit of total fields \[1000\] in index exceeded' problem. I don't consider to raise the default in the settings above 1000. The culprit seems to be a field with a json v…

---

## [Security audit with basic licence](https://discuss.elastic.co/t/security-audit-with-basic-licence/247814)

<div class="topic-metadata">

**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\
**Replies:** 0\
**Last updated:** [September 8, 2020, 4:49am UTC](https://discuss.elastic.co/t/security-audit-with-basic-licence/247814 "2020-09-08T04:49:57Z")

</div>

Hi is there a way how I can observe user activity in Kibana without having Gold Subscription? Is there a log or any solution? thank u

---

## [Search API of elasticsearch not working](https://discuss.elastic.co/t/search-api-of-elasticsearch-not-working/247748)

<div class="topic-metadata">

**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\
**Replies:** 2\
**Last updated:** [September 8, 2020, 4:45am UTC](https://discuss.elastic.co/t/search-api-of-elasticsearch-not-working/247748 "2020-09-08T04:45:06Z")

</div>

Hi All, I am trying to use elasticsearch from SOAP ui. DELETE and POST are working fine, however, GET is throwing error. Can someone please suggest POST http://ip:9200/test\_token/\_doc/TestService { "ServiceName" : …

---

## [Comparison of two different fields in two indexes](https://discuss.elastic.co/t/comparison-of-two-different-fields-in-two-indexes/246605)

<div class="topic-metadata">

**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\
**Replies:** 2\
**Last updated:** [September 8, 2020, 4:43am UTC](https://discuss.elastic.co/t/comparison-of-two-different-fields-in-two-indexes/246605 "2020-09-08T04:43:50Z")

</div>

Hi All, We have a scenario where we need to check whether this account number exists in both the indexes , is there a way or query to check the same.

---

## [Elastic cloud and Google Authentication](https://discuss.elastic.co/t/elastic-cloud-and-google-authentication/246966)

<div class="topic-metadata">

**Author:** [@Den1](https://discuss.elastic.co/u/Den1)\
**Replies:** 1\
**Last updated:** [September 8, 2020, 4:34am UTC](https://discuss.elastic.co/t/elastic-cloud-and-google-authentication/246966 "2020-09-08T04:34:32Z")

</div>

Hello, is it possible to grand access fro google account and make access with google authentication? Or active directory with AD Federation Service? :slight\_smile: Thank you!

---

## [Is there anyother auth method for SSO in Elasticsearch other than X-Pack](https://discuss.elastic.co/t/is-there-anyother-auth-method-for-sso-in-elasticsearch-other-than-x-pack/247169)

<div class="topic-metadata">

**Author:** [@Keerthi](https://discuss.elastic.co/u/Keerthi)\
**Replies:** 1\
**Last updated:** [September 8, 2020, 4:32am UTC](https://discuss.elastic.co/t/is-there-anyother-auth-method-for-sso-in-elasticsearch-other-than-x-pack/247169 "2020-09-08T04:32:26Z")

</div>

I Need help in setting up SSO for Elasticsearch

---

## [CSV file extension error](https://discuss.elastic.co/t/csv-file-extension-error/247485)

<div class="topic-metadata">

**Author:** [@nameisnotimportant](https://discuss.elastic.co/u/nameisnotimportant)\
**Replies:** 3\
**Last updated:** [September 8, 2020, 1:59am UTC](https://discuss.elastic.co/t/csv-file-extension-error/247485 "2020-09-08T01:59:18Z")

</div>

Hi, Would like to know where do i set the CSV download file name and extension name? Please refer to my print screen, the file name is '.csv\[1\]'. And if i choose the Save As option, i can see that the Save as type form…

---

## [You are not authorized to access Ingest Manager](https://discuss.elastic.co/t/you-are-not-authorized-to-access-ingest-manager/247705)

<div class="topic-metadata">

**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\
**Replies:** 9\
**Last updated:** [September 8, 2020, 1:40am UTC](https://discuss.elastic.co/t/you-are-not-authorized-to-access-ingest-manager/247705 "2020-09-08T01:40:46Z")

</div>

I didn't set up a login user.

---

## [How to read multiple inputs in a single logstash instance](https://discuss.elastic.co/t/how-to-read-multiple-inputs-in-a-single-logstash-instance/247776)

<div class="topic-metadata">

**Author:** [@aparna\_shukla](https://discuss.elastic.co/u/aparna_shukla)\
**Replies:** 1\
**Last updated:** [September 8, 2020, 12:24am UTC](https://discuss.elastic.co/t/how-to-read-multiple-inputs-in-a-single-logstash-instance/247776 "2020-09-08T00:24:14Z")

</div>

I have metricbeat running on server 1 and filebeat running on server 2 and logstash on server 3. Can we read both metric beat and filebeat logs using one logstash ? both logs(metric and filebeat) are different and we …

---

## [Kafka module of metrcbeat field question](https://discuss.elastic.co/t/kafka-module-of-metrcbeat-field-question/247752)

<div class="topic-metadata">

**Author:** [@8wlgns](https://discuss.elastic.co/u/8wlgns)\
**Replies:** 0\
**Last updated:** [September 7, 2020, 10:06am UTC](https://discuss.elastic.co/t/kafka-module-of-metrcbeat-field-question/247752 "2020-09-07T10:06:57Z")

</div>

Hello? I want to get metrics that is newest events of duration(sec) on Kafka. Could I use kafka.broker.messages\_in ? Is it all newest events per duration (second) ? https://www.elastic.co/guide/en/beats/metricbeat/cu…

---

## [Search API is not working from other server](https://discuss.elastic.co/t/search-api-is-not-working-from-other-server/247773)

<div class="topic-metadata">

**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\
**Replies:** 1\
**Last updated:** [September 7, 2020, 10:01pm UTC](https://discuss.elastic.co/t/search-api-is-not-working-from-other-server/247773 "2020-09-07T22:01:29Z")

</div>

Hi All, When I am trying to call elasticsearch URL from SOAP UI. POST and DELETE call is working, however GET is throwing connection reset error. Can anyone please suggest , how to resolve it. PS: search is not workin…

---

## [Syslog input doesn't seem to work, rsyslog error -2027](https://discuss.elastic.co/t/syslog-input-doesnt-seem-to-work-rsyslog-error-2027/247797)

<div class="topic-metadata">

**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\
**Replies:** 2\
**Last updated:** [September 7, 2020, 9:15pm UTC](https://discuss.elastic.co/t/syslog-input-doesnt-seem-to-work-rsyslog-error-2027/247797 "2020-09-07T21:15:07Z")

</div>

Hey all, I'm having issues getting the Filebeat syslog input plugin to receive remote syslog messages. My filebeat config looks like: filebeat: config: modules: path: ${path.config}/modules.d/\*.yml r…

---

## [CircuitBreakingException: \[parent\] Data too large - troubleshoot](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large-troubleshoot/247796)

<div class="topic-metadata">

**Author:** [@cjabrantes](https://discuss.elastic.co/u/cjabrantes)\
**Replies:** 2\
**Last updated:** [September 7, 2020, 8:57pm UTC](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large-troubleshoot/247796 "2020-09-07T20:57:54Z")

</div>

Hi all, from time to time (not that far apart) i can see error CircuitBreakingException: \[parent\] Data too large. I can see a lot of similar topics but i can't find a conclusion. The exception tell us that we reached …

---

## [Specifying http.max\_content\_length](https://discuss.elastic.co/t/specifying-http-max-content-length/247804)

<div class="topic-metadata">

**Author:** [@jcannell](https://discuss.elastic.co/u/jcannell)\
**Replies:** 1\
**Last updated:** [September 7, 2020, 8:56pm UTC](https://discuss.elastic.co/t/specifying-http-max-content-length/247804 "2020-09-07T20:56:33Z")

</div>

Hello, When specifying http.max\_content\_length, do i need to do this for all nodes in my cluster? I have a lot of data to index and I'm trying to see if increasing this value might make indexing faster. I see the ques…

---

## [Logstash duplicating records while reading from elasticsearch and writing to bigquery](https://discuss.elastic.co/t/logstash-duplicating-records-while-reading-from-elasticsearch-and-writing-to-bigquery/247702)

<div class="topic-metadata">

**Author:** [@ThiagoSantos](https://discuss.elastic.co/u/ThiagoSantos)\
**Replies:** 3\
**Last updated:** [September 7, 2020, 8:53pm UTC](https://discuss.elastic.co/t/logstash-duplicating-records-while-reading-from-elasticsearch-and-writing-to-bigquery/247702 "2020-09-07T20:53:38Z")

</div>

Hi, everyone. Everytime logstash runs, it writes all records from my elasticsearch index to my bigquery database. The problem is that the records get duplicated at every run. My goal is to get only those records that …

---

## [Kibana 7.8.1 exports CSV file with time field minus 5 hours in Reporting](https://discuss.elastic.co/t/kibana-7-8-1-exports-csv-file-with-time-field-minus-5-hours-in-reporting/247743)

<div class="topic-metadata">

**Author:** [@Saadan](https://discuss.elastic.co/u/Saadan)\
**Replies:** 1\
**Last updated:** [September 7, 2020, 7:35pm UTC](https://discuss.elastic.co/t/kibana-7-8-1-exports-csv-file-with-time-field-minus-5-hours-in-reporting/247743 "2020-09-07T19:35:36Z")

</div>

I recently installed Elastic Stack 7.8.1 on a CentOS machine. The problem I am facing is that whenever I export CSV through reporting, the time fields get subtracted by 5 hours in output file. I faced this issue in prev…

---

## [How to push data from mysql to Elastic search and then visualize on kibana](https://discuss.elastic.co/t/how-to-push-data-from-mysql-to-elastic-search-and-then-visualize-on-kibana/247794)

<div class="topic-metadata">

**Author:** [@justnj](https://discuss.elastic.co/u/justnj)\
**Replies:** 1\
**Last updated:** [September 7, 2020, 7:27pm UTC](https://discuss.elastic.co/t/how-to-push-data-from-mysql-to-elastic-search-and-then-visualize-on-kibana/247794 "2020-09-07T19:27:11Z")

</div>

HI All Currently we have Mysql +python App report engine runing on centos 7 , which we want to push to Elasticsearch and kibana to visualize the same via logstash.Hope any step by step document to follow on AWS ..T…

---

## [Can't Start Filebeat from docker compose](https://discuss.elastic.co/t/cant-start-filebeat-from-docker-compose/247788)

<div class="topic-metadata">

**Author:** [@Mostafa\_Hamdy](https://discuss.elastic.co/u/Mostafa_Hamdy)\
**Replies:** 0\
**Last updated:** [September 7, 2020, 3:57pm UTC](https://discuss.elastic.co/t/cant-start-filebeat-from-docker-compose/247788 "2020-09-07T15:57:33Z")

</div>

I am trying to start filebeat using docker compose. but i am facing this error /usr/local/bin/docker-entrypoint: line 8: exec: filebeat: not found This is my docker-compose filebeat: image: docker.elasti…

---

## [java.io.IOException: Une connexion existante a d¹ Ûtre fermÚe par lÆh¶te distant](https://discuss.elastic.co/t/java-io-ioexception-une-connexion-existante-a-d-utre-fermue-par-laeh-te-distant/247786)

<div class="topic-metadata">

**Author:** [@Torjmen](https://discuss.elastic.co/u/Torjmen)\
**Replies:** 0\
**Last updated:** [September 7, 2020, 3:50pm UTC](https://discuss.elastic.co/t/java-io-ioexception-une-connexion-existante-a-d-utre-fermue-par-laeh-te-distant/247786 "2020-09-07T15:50:13Z")

</div>

hello , i'm trying to create a plugin for openEdge form SonarQube API , its' work well . I have programmes written in progress 4gl , for that i had created an AppServer using the Openedge explorer to put my program…

---

## [ILM policy "cold" phase cannot freeze if index is read\_only](https://discuss.elastic.co/t/ilm-policy-cold-phase-cannot-freeze-if-index-is-read-only/247597)

<div class="topic-metadata">

**Author:** [@mhoydis\_datto](https://discuss.elastic.co/u/mhoydis_datto)\
**Replies:** 1\
**Last updated:** [September 7, 2020, 3:30pm UTC](https://discuss.elastic.co/t/ilm-policy-cold-phase-cannot-freeze-if-index-is-read-only/247597 "2020-09-07T15:30:02Z")

</div>

Hello. I have a separate management tool which is handling what ILM would refer to as my "hot" and "warm" phases. I'm looking to invoke an ILM policy to only handle my "cold" phase - which would freeze my indices after…

---

## [How to hide the left panel of a datavisualisation through the URL](https://discuss.elastic.co/t/how-to-hide-the-left-panel-of-a-datavisualisation-through-the-url/247240)

<div class="topic-metadata">

**Author:** [@Ted1](https://discuss.elastic.co/u/Ted1)\
**Replies:** 2\
**Last updated:** [September 7, 2020, 3:28pm UTC](https://discuss.elastic.co/t/how-to-hide-the-left-panel-of-a-datavisualisation-through-the-url/247240 "2020-09-07T15:28:19Z")

</div>

Hi there, I need to have a datavisualisation OUTSIDE any dashboard (so that I can pass dynamically parameters through the URL calling the datavis). So I got a dashboard with a link to a new page with this datavis. Whe…

---

## [FileBeat as a service. After rebooting the system it starts automatically](https://discuss.elastic.co/t/filebeat-as-a-service-after-rebooting-the-system-it-starts-automatically/241075)

<div class="topic-metadata">

**Author:** [@TUSHAR\_Sinha](https://discuss.elastic.co/u/TUSHAR_Sinha)\
**Replies:** 12\
**Last updated:** [September 7, 2020, 3:04pm UTC](https://discuss.elastic.co/t/filebeat-as-a-service-after-rebooting-the-system-it-starts-automatically/241075 "2020-09-07T15:04:00Z")

</div>

Hi all, I want to know can we run filebeat as a service. So, whenever someone rebots the system it automatically starts running again. The system in which my filebeat is running, has access to different people sometimes…

---

## [How to display unique count with latest value in Kibana](https://discuss.elastic.co/t/how-to-display-unique-count-with-latest-value-in-kibana/246124)

<div class="topic-metadata">

**Author:** [@zizou\_elk](https://discuss.elastic.co/u/zizou_elk)\
**Replies:** 3\
**Last updated:** [September 7, 2020, 2:56pm UTC](https://discuss.elastic.co/t/how-to-display-unique-count-with-latest-value-in-kibana/246124 "2020-09-07T14:56:42Z")

</div>

Hello All, Heeelp please whenever logistic partner update the order status then new status is pushed into elasticseach. Now every order is having multiple enteries with order status like "ORDER CONFIRM" , "APPOINTMENT …

---

## [How to properly delete index?](https://discuss.elastic.co/t/how-to-properly-delete-index/247391)

<div class="topic-metadata">

**Author:** [@leostereo](https://discuss.elastic.co/u/leostereo)\
**Replies:** 7\
**Last updated:** [September 7, 2020, 2:54pm UTC](https://discuss.elastic.co/t/how-to-properly-delete-index/247391 "2020-09-07T14:54:58Z")

</div>

Hi guys. I was very happy playing with my filebeat / netflow platform untill today. There was nothing to see and founded following message at log file: high disk watermark \[90%\] exceeded on \[NX79WFORStGfAdCq26XLaw\]\[ub…

---

## [CSP errors when using an Kibana iframe](https://discuss.elastic.co/t/csp-errors-when-using-an-kibana-iframe/246096)

<div class="topic-metadata">

**Author:** [@Sharry\_Stowell](https://discuss.elastic.co/u/Sharry_Stowell)\
**Replies:** 19\
**Last updated:** [September 7, 2020, 2:54pm UTC](https://discuss.elastic.co/t/csp-errors-when-using-an-kibana-iframe/246096 "2020-09-07T14:54:20Z")

</div>

Running into CSP errors when using dashboard \> share \> embed \> iframe. Copied the iframe to a local html file & pasted it there. \<html\> \<body\> \<iframe src="https://kibana.myurl:5601/app/dashboards#/view/fc6ea5f0-e3bf-…

---

## [Forward logs from Kiwi to Elasticsearch](https://discuss.elastic.co/t/forward-logs-from-kiwi-to-elasticsearch/247682)

<div class="topic-metadata">

**Author:** [@markb](https://discuss.elastic.co/u/markb)\
**Replies:** 5\
**Last updated:** [September 7, 2020, 1:43pm UTC](https://discuss.elastic.co/t/forward-logs-from-kiwi-to-elasticsearch/247682 "2020-09-07T13:43:15Z")

</div>

I would like to forward logs from Kiwi Syslog Server to Elasticsearch by Logstash. After configuring both Kiwi log action and Logstash pipeline I see no log in ES side. This is the Kiwi remote host forward rule: Thi…

---

## [Elasticsearch cluster uneven distribution of data](https://discuss.elastic.co/t/elasticsearch-cluster-uneven-distribution-of-data/247737)

<div class="topic-metadata">

**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\
**Replies:** 5\
**Last updated:** [September 7, 2020, 1:11pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-uneven-distribution-of-data/247737 "2020-09-07T13:11:09Z")

</div>

Dears, How to explain uneven distribution of data between cluster nodes? GET \_cat/allocation?v&pretty shards disk.indices disk.used disk.avail disk.total disk.percent host ip node 63 375gb …

---

## [Error fetching fields for index pattern winlogbeat-\* (ID: winlogbeat-\*)](https://discuss.elastic.co/t/error-fetching-fields-for-index-pattern-winlogbeat-id-winlogbeat/247673)

<div class="topic-metadata">

**Author:** [@talaatkamal](https://discuss.elastic.co/u/talaatkamal)\
**Replies:** 3\
**Last updated:** [September 7, 2020, 12:56pm UTC](https://discuss.elastic.co/t/error-fetching-fields-for-index-pattern-winlogbeat-id-winlogbeat/247673 "2020-09-07T12:56:13Z")

</div>

Error fetching fields for index pattern winlogbeat-\* (ID: winlogbeat-\*) Not Found Error: Not Found at Anonymous function (http://10.1.106.5:5601/bundles/commons.bundle.js:1:842554) at Anonymous function (http://10.1.…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1819)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1821)