# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1822 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1823 --- ## [defaultRoute parameter on Kibana \[7.9.x\]](https://discuss.elastic.co/t/defaultroute-parameter-on-kibana-7-9-x/247529)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 2\ **Last updated:** [September 7, 2020, 5:45am UTC](https://discuss.elastic.co/t/defaultroute-parameter-on-kibana-7-9-x/247529 "2020-09-07T05:45:40Z")
Hi, everyone I have noticed that kibana.defaultAppId is deprecated and will be removed in 8.0. Kibana's documentation inform to use defaultRoute. This parameter can be used on kibana.yml? Thanks in advance, Rodrigo --- ## [Can you help me on this ..., I am facing little issues while doing this for the elastic operator](https://discuss.elastic.co/t/can-you-help-me-on-this-i-am-facing-little-issues-while-doing-this-for-the-elastic-operator/247212)
**Author:** [@Vineeth\_varma](https://discuss.elastic.co/u/Vineeth_varma)\ **Replies:** 1\ **Last updated:** [September 7, 2020, 5:09am UTC](https://discuss.elastic.co/t/can-you-help-me-on-this-i-am-facing-little-issues-while-doing-this-for-the-elastic-operator/247212 "2020-09-07T05:09:32Z")
Continuing the discussion from ELK Stack integration with Keycloak: --- ## [Hot-Warm-Cold Log Transistion](https://discuss.elastic.co/t/hot-warm-cold-log-transistion/247688)
**Author:** [@vishakh](https://discuss.elastic.co/u/vishakh)\ **Replies:** 4\ **Last updated:** [September 7, 2020, 5:06am UTC](https://discuss.elastic.co/t/hot-warm-cold-log-transistion/247688 "2020-09-07T05:06:50Z")
Objective: Implement Hot-Warm-Cold Architecture At first when ingested from beats, data should be only be ingested and spread across only on Hot nodes. After 30-days logs moved to warm and then after 60 days to cold (E… --- ## [Logstash - not pushing all data into elasticsearch](https://discuss.elastic.co/t/logstash-not-pushing-all-data-into-elasticsearch/247523)
**Author:** [@SwatiD](https://discuss.elastic.co/u/SwatiD)\ **Replies:** 2\ **Last updated:** [September 7, 2020, 4:39am UTC](https://discuss.elastic.co/t/logstash-not-pushing-all-data-into-elasticsearch/247523 "2020-09-07T04:39:48Z")
I have 7,00,000 records with 300 columns in my database,but when I am pushing it into elasticsearch through logstash,It is pushing records samething like 2,50,000 only. I have use below in logstash config file useCurs… --- ## [Number of fields and size](https://discuss.elastic.co/t/number-of-fields-and-size/247610)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [September 7, 2020, 2:01am UTC](https://discuss.elastic.co/t/number-of-fields-and-size/247610 "2020-09-07T02:01:27Z")
if I turn on metricbeat by default it has more then 2000+ field. but if I am only monitoring system matric. will that empthy field that I saw in pattern will use space? removing them is very time consuming exercise. --- ## [Should Elasticsearch plugin includes jackson-databind jars?](https://discuss.elastic.co/t/should-elasticsearch-plugin-includes-jackson-databind-jars/247689)
**Author:** [@Trevor\_Lee](https://discuss.elastic.co/u/Trevor_Lee)\ **Replies:** 0\ **Last updated:** [September 7, 2020, 1:51am UTC](https://discuss.elastic.co/t/should-elasticsearch-plugin-includes-jackson-databind-jars/247689 "2020-09-07T01:51:10Z")
if jackson-databind jars included, will end up "jar hell" if jackson-databind jars not inclued, will run into the situation: java.lang.NoClassDefFoundError: Could not initialize class com.fasterxml.jackson.databind.Obje… --- ## [Unable to find elasticsearch-keystore Data](https://discuss.elastic.co/t/unable-to-find-elasticsearch-keystore-data/247490)
**Author:** [@Ayush\_Agrahari](https://discuss.elastic.co/u/Ayush_Agrahari)\ **Replies:** 1\ **Last updated:** [September 7, 2020, 12:27am UTC](https://discuss.elastic.co/t/unable-to-find-elasticsearch-keystore-data/247490 "2020-09-07T00:27:23Z")
I want to setup JIRA configuration with ELK so I have configured few data in elasticsearch-keystore in Docker. Docker file data is below RUN elasticsearch-keystore create RUN echo "\*\*\*\*" | elasticsearch-keystor… --- ## [Does the time logged in slow logs include the time it spent in the search queue on the node?](https://discuss.elastic.co/t/does-the-time-logged-in-slow-logs-include-the-time-it-spent-in-the-search-queue-on-the-node/247424)
**Author:** [@Priyanka\_Raju](https://discuss.elastic.co/u/Priyanka_Raju)\ **Replies:** 5\ **Last updated:** [September 7, 2020, 12:17am UTC](https://discuss.elastic.co/t/does-the-time-logged-in-slow-logs-include-the-time-it-spent-in-the-search-queue-on-the-node/247424 "2020-09-07T00:17:59Z")
Hi, We are observing that there are a few nodes in our cluster seem to have a spike in search queue items (correlated with a spike in latency). We are relying on slow logs for some part of debugging and I wasn't sure if… --- ## [Kibana is not running on global IP](https://discuss.elastic.co/t/kibana-is-not-running-on-global-ip/247657)
**Author:** [@infected](https://discuss.elastic.co/u/infected)\ **Replies:** 2\ **Last updated:** [September 6, 2020, 11:59pm UTC](https://discuss.elastic.co/t/kibana-is-not-running-on-global-ip/247657 "2020-09-06T23:59:39Z")
I tried to run kibana on my global ip address. ・error messages log \[17:59:06.707\] \[info\]\[plugins-service\] Plugin "case" is disabled. log \[18:00:21.994\] \[fatal\]\[root\] { Error: listen EADDRNOTAVAIL: address not a… --- ## [Gsub remove words less than 4 characters in length](https://discuss.elastic.co/t/gsub-remove-words-less-than-4-characters-in-length/247649)
**Author:** [@kopacko](https://discuss.elastic.co/u/kopacko)\ **Replies:** 6\ **Last updated:** [September 6, 2020, 11:50pm UTC](https://discuss.elastic.co/t/gsub-remove-words-less-than-4-characters-in-length/247649 "2020-09-06T23:50:52Z")
I am attempting to use a gsub mutate to remove words that are less than 4 characters in length. mutate { gsub =\> \[ "\[tag\]\[cloud\]\[chat\]", "(\\S+){1,3}", "" \] } But it is removing everything. Any suggestions? --- ## [Ingest pipeline drops the field as @timestamp while loading Elasticsearch's server and slowlog using filebeat](https://discuss.elastic.co/t/ingest-pipeline-drops-the-field-as-timestamp-while-loading-elasticsearchs-server-and-slowlog-using-filebeat/247031)
**Author:** [@Prashant\_Agrawal](https://discuss.elastic.co/u/Prashant_Agrawal)\ **Replies:** 9\ **Last updated:** [September 6, 2020, 11:08pm UTC](https://discuss.elastic.co/t/ingest-pipeline-drops-the-field-as-timestamp-while-loading-elasticsearchs-server-and-slowlog-using-filebeat/247031 "2020-09-06T23:08:34Z")
Ingest pipeline drops the field as @timestamp while loading Elasticsearch's server and slowlog using filebeat. "filebeat-7.9.0-elasticsearch-server-pipeline" : { "description" : "Pipeline for parsing elasticsearch ser… --- ## [Kibana not showing correct logs](https://discuss.elastic.co/t/kibana-not-showing-correct-logs/247547)
**Author:** [@samra1810](https://discuss.elastic.co/u/samra1810)\ **Replies:** 1\ **Last updated:** [September 6, 2020, 9:41pm UTC](https://discuss.elastic.co/t/kibana-not-showing-correct-logs/247547 "2020-09-06T21:41:27Z")
EFK (Elasticsearch+Fluentd-(td-agent)+Kibana): Kibana not showing correct logs I have installed EFK on redhat linux system(version 7.6). Stable distribution of fluentd, that is td-agent is used instead of fluentd. Path… --- ## [Pipelines.yml distributor pattern more than 1 pipeline same events](https://discuss.elastic.co/t/pipelines-yml-distributor-pattern-more-than-1-pipeline-same-events/247684)
**Author:** [@nino](https://discuss.elastic.co/u/nino)\ **Replies:** 2\ **Last updated:** [September 6, 2020, 9:35pm UTC](https://discuss.elastic.co/t/pipelines-yml-distributor-pattern-more-than-1-pipeline-same-events/247684 "2020-09-06T21:35:35Z")
Hello all, this is my pipelines.yml file and is working really fine - pipeline.id: distributor config.string: | input { beats { port =\> 5044 } } output { if "pc1" in \[tags\] { pipeline { sen… --- ## [Converting ES binary to single valued binary](https://discuss.elastic.co/t/converting-es-binary-to-single-valued-binary/247668)
**Author:** [@mehekek](https://discuss.elastic.co/u/mehekek)\ **Replies:** 0\ **Last updated:** [September 6, 2020, 10:30am UTC](https://discuss.elastic.co/t/converting-es-binary-to-single-valued-binary/247668 "2020-09-06T10:30:21Z")
Hi there :slight\_smile: To my knowledge, Unlike Lucene, Elasticsearch supports multi-valued byte arrays hence it embeds byte arrays by prefixing it with the number of byte arrays embedded and number of bytes remaining… --- ## [Metricbeat setup error](https://discuss.elastic.co/t/metricbeat-setup-error/247671)
**Author:** [@hanuman513](https://discuss.elastic.co/u/hanuman513)\ **Replies:** 4\ **Last updated:** [September 6, 2020, 9:29pm UTC](https://discuss.elastic.co/t/metricbeat-setup-error/247671 "2020-09-06T21:29:09Z")
metricbeat setup --dashboards Loading dashboards (Kibana must be running and reachable) Exiting: fail to create the Kibana loader: Error creating Kibana client: Error creating Kibana client: fail to get the Kibana ver… --- ## [Docker Elasticsearch failing](https://discuss.elastic.co/t/docker-elasticsearch-failing/247686)
**Author:** [@tamilarasanbravo](https://discuss.elastic.co/u/tamilarasanbravo)\ **Replies:** 1\ **Last updated:** [September 6, 2020, 8:39pm UTC](https://discuss.elastic.co/t/docker-elasticsearch-failing/247686 "2020-09-06T20:39:15Z")
Hi Team, I have created a 3 node elasticsearch setup. One of my docker container fails with the below error lasticsearch/config/roles.yml\]" } {"type": "server", "timestamp": "2020-09-06T20:23:28,362Z", "level": "INFO",… --- ## [Logstash Issue in finding the filter](https://discuss.elastic.co/t/logstash-issue-in-finding-the-filter/247683)
**Author:** [@tamilarasanbravo](https://discuss.elastic.co/u/tamilarasanbravo)\ **Replies:** 3\ **Last updated:** [September 6, 2020, 6:40pm UTC](https://discuss.elastic.co/t/logstash-issue-in-finding-the-filter/247683 "2020-09-06T18:40:38Z")
Hi Team, I am trying to get the logstash configured but I am unable to start the logstash with the below error. The file exists but still the logstash fails to open/read it. \[2020-09-06T12:50:11,299\]\[INFO \]\[org.reflec… --- ## [Remote Cluster Enterprise feature?](https://discuss.elastic.co/t/remote-cluster-enterprise-feature/247514)
**Author:** [@antex](https://discuss.elastic.co/u/antex)\ **Replies:** 1\ **Last updated:** [September 6, 2020, 6:02pm UTC](https://discuss.elastic.co/t/remote-cluster-enterprise-feature/247514 "2020-09-06T18:02:48Z")
Hi, I want to setup cross-cluster search in my self-managed cluster on Kubernetes using ECK. According to https://www.elastic.co/subscriptions this should be possible with the OpenSource license. But when I try to setup… --- ## [Need help on arithmetic operators usage in ingestion / scripted fields](https://discuss.elastic.co/t/need-help-on-arithmetic-operators-usage-in-ingestion-scripted-fields/247660)
**Author:** [@prabhakar\_talari](https://discuss.elastic.co/u/prabhakar_talari)\ **Replies:** 2\ **Last updated:** [September 6, 2020, 1:29pm UTC](https://discuss.elastic.co/t/need-help-on-arithmetic-operators-usage-in-ingestion-scripted-fields/247660 "2020-09-06T13:29:10Z")
Hi All, I have a field called duration which is number ( in seconds ). I would like to write ingestion pipeline OR scripted field add new field called duration\_hr by dividing the duration with 3600. my ES version is 7.6… --- ## [Recreation of ES data node failed](https://discuss.elastic.co/t/recreation-of-es-data-node-failed/247669)
**Author:** [@KOTOXJle6](https://discuss.elastic.co/u/KOTOXJle6)\ **Replies:** 8\ **Last updated:** [September 6, 2020, 12:47pm UTC](https://discuss.elastic.co/t/recreation-of-es-data-node-failed/247669 "2020-09-06T12:47:09Z")
Good afternoon. There was an elasticsearch cluster consisting of three data nodes and one coordinator with Kibana. It happened that one server died and was re-created. The ES version is the same, Java is the same, and t… --- ## [Shut down master-data node](https://discuss.elastic.co/t/shut-down-master-data-node/247556)
**Author:** [@elastic\_user1](https://discuss.elastic.co/u/elastic_user1)\ **Replies:** 2\ **Last updated:** [September 6, 2020, 12:43pm UTC](https://discuss.elastic.co/t/shut-down-master-data-node/247556 "2020-09-06T12:43:30Z")
I have shut down one node with both data and master roles. How can I remove this node from cluster? I have seen that the node have disappeared from my cluster and its replica shard became primary. --- ## [Logstash 7.9.1-1 installation errors - service not found](https://discuss.elastic.co/t/logstash-7-9-1-1-installation-errors-service-not-found/247644)
**Author:** [@finbarr996](https://discuss.elastic.co/u/finbarr996)\ **Replies:** 7\ **Last updated:** [September 6, 2020, 12:40pm UTC](https://discuss.elastic.co/t/logstash-7-9-1-1-installation-errors-service-not-found/247644 "2020-09-06T12:40:14Z")
Hi there, Just tried re-installing logstash having removed it on an ubuntu server and had the following errors: Get:1 https://artifacts.elastic.co/packages/7.x/apt stable/main amd64 logstash all 1:7.9.1-1 \[159 MB\] Fetc… --- ## [Setup filebeat module](https://discuss.elastic.co/t/setup-filebeat-module/247658)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 6\ **Last updated:** [September 6, 2020, 11:35am UTC](https://discuss.elastic.co/t/setup-filebeat-module/247658 "2020-09-06T11:35:12Z")
I'm trying to set up the apache module in filebeat. I output filebeat to logstash. Just for some context I've enabled pipelines with this command: filebeat setup --pipelines --dashboards --modules apache -E output.logst… --- ## [Separate index for every aggs bucket](https://discuss.elastic.co/t/separate-index-for-every-aggs-bucket/247661)
**Author:** [@bornatalebi](https://discuss.elastic.co/u/bornatalebi)\ **Replies:** 4\ **Last updated:** [September 6, 2020, 10:45am UTC](https://discuss.elastic.co/t/separate-index-for-every-aggs-bucket/247661 "2020-09-06T10:45:47Z")
Hi, I want to create a separate index for every aggs buckets. here is my watcher. I know I have to use "foreach" for my problem but can't figure out what value should I give it. thanks. --- ## [Using amazon\_es output plugin via proxy](https://discuss.elastic.co/t/using-amazon-es-output-plugin-via-proxy/247667)
**Author:** [@Abolurah](https://discuss.elastic.co/u/Abolurah)\ **Replies:** 0\ **Last updated:** [September 6, 2020, 10:26am UTC](https://discuss.elastic.co/t/using-amazon-es-output-plugin-via-proxy/247667 "2020-09-06T10:26:21Z")
Hi , This is the only knowledge sharing with the community, after long hours spent on issue solving of sending data via amazon\_es output plugin, only thing you need to do is to add your proxy like an example below, … --- ## [DataType Changes after rollover of Index](https://discuss.elastic.co/t/datatype-changes-after-rollover-of-index/247619)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 9\ **Last updated:** [September 6, 2020, 9:19am UTC](https://discuss.elastic.co/t/datatype-changes-after-rollover-of-index/247619 "2020-09-06T09:19:56Z")
Hi Team I am using Elasticsearch Version 7.5.2. I have one index with grows in size and documents. Once it has reached 1000 documents , we are performing rollover. Command : curl -XPOST '10.10.10.1:9200/myevents/\_rol… --- ## [Faster to index raw data or load a static data dump](https://discuss.elastic.co/t/faster-to-index-raw-data-or-load-a-static-data-dump/247581)
**Author:** [@fallenreaper](https://discuss.elastic.co/u/fallenreaper)\ **Replies:** 8\ **Last updated:** [September 6, 2020, 7:02am UTC](https://discuss.elastic.co/t/faster-to-index-raw-data-or-load-a-static-data-dump/247581 "2020-09-06T07:02:51Z")
I want to leverage ES for analysis of static data. I was using a subset and it worked as planned. I would be able to query, build graphs in kibana etc. It is quite useful. That being said, since the data is static, S… --- ## [Default ingest pipeline not working](https://discuss.elastic.co/t/default-ingest-pipeline-not-working/247639)
**Author:** [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Replies:** 5\ **Last updated:** [September 6, 2020, 6:26am UTC](https://discuss.elastic.co/t/default-ingest-pipeline-not-working/247639 "2020-09-06T06:26:03Z")
Hi, I'm pretty new in elastic search so sorry if it's a newbie question. I want to change the ingest pipeline and index for my cisco ios module. I tried changing them in filebeat.yml file. my config so far: filebeat.in… --- ## [How to add first row first column value as a field in to other rows' documents of a csv file in logstash filters?](https://discuss.elastic.co/t/how-to-add-first-row-first-column-value-as-a-field-in-to-other-rows-documents-of-a-csv-file-in-logstash-filters/243806)
**Author:** [@DSMilestone](https://discuss.elastic.co/u/DSMilestone)\ **Replies:** 40\ **Last updated:** [September 6, 2020, 4:25am UTC](https://discuss.elastic.co/t/how-to-add-first-row-first-column-value-as-a-field-in-to-other-rows-documents-of-a-csv-file-in-logstash-filters/243806 "2020-09-06T04:25:00Z")
I was trying out logstash pipeline config file, in order to add the first row first column value to other documents as a new field. But I got no where! My csv file is, Suite/Test/Step Name,Browser,Description,Tag,Start… --- ## [Best way to manage daily index](https://discuss.elastic.co/t/best-way-to-manage-daily-index/247647)
**Author:** [@smalljimmy](https://discuss.elastic.co/u/smalljimmy)\ **Replies:** 1\ **Last updated:** [September 6, 2020, 4:05am UTC](https://discuss.elastic.co/t/best-way-to-manage-daily-index/247647 "2020-09-06T04:05:27Z")
Hi guys We have a requirement as following: Ingest safety item list into ES daily. The source data is written to S3 to folder with path bucket/{date}/part\*.json from a batch job and are the continuously ingested to ES… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1821) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1823)