# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1828 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1829 --- ## [Can we use workload Identity for leasticsearch backup and restore](https://discuss.elastic.co/t/can-we-use-workload-identity-for-leasticsearch-backup-and-restore/247232)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 2\ **Last updated:** [September 3, 2020, 6:33am UTC](https://discuss.elastic.co/t/can-we-use-workload-identity-for-leasticsearch-backup-and-restore/247232 "2020-09-03T06:33:54Z")
Can we use workload Identity instead of creating k8s secrets manually for easticsearch backup and restore for elasticsearch 7.4 --- ## [Tracking\_column not found in dataset when using JDBC driver with mongodb (input)](https://discuss.elastic.co/t/tracking-column-not-found-in-dataset-when-using-jdbc-driver-with-mongodb-input/246706)
**Author:** [@timgau](https://discuss.elastic.co/u/timgau)\ **Replies:** 9\ **Last updated:** [September 3, 2020, 4:50am UTC](https://discuss.elastic.co/t/tracking-column-not-found-in-dataset-when-using-jdbc-driver-with-mongodb-input/246706 "2020-09-03T04:50:24Z")
I'm quite unclear of how to use :sql\_last\_value in my mongodb query statement like: statement =\> "var lastId = ':sql\_last\_value'; db.docs.find({ \_id: { $gte : lastId }})" my config is like this input { jdbc { jd… --- ## [Elastic search: Regex for matching longest string from list of strings in autocomplete suggester](https://discuss.elastic.co/t/elastic-search-regex-for-matching-longest-string-from-list-of-strings-in-autocomplete-suggester/247322)
**Author:** [@SatyaAditya](https://discuss.elastic.co/u/SatyaAditya)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 3:48am UTC](https://discuss.elastic.co/t/elastic-search-regex-for-matching-longest-string-from-list-of-strings-in-autocomplete-suggester/247322 "2020-09-03T03:48:23Z")
I am very new to elastic search and trying to implement autocomplete suggester with regex queries. Once i receive a query, i am taking last 5 words of query and forming a list of tokens in this format query - i am tryin… --- ## [Snapshot repository encryption with FS type](https://discuss.elastic.co/t/snapshot-repository-encryption-with-fs-type/247323)
**Author:** [@nethisandeep](https://discuss.elastic.co/u/nethisandeep)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 4:03am UTC](https://discuss.elastic.co/t/snapshot-repository-encryption-with-fs-type/247323 "2020-09-03T04:03:35Z")
Any inbuilt functionality that we can use for encrypting elasticsearch snapshot repository using "FS" type? or any other known solutions? May I know in which version of elasticsearch can we see this feature https://gith… --- ## [Security Header](https://discuss.elastic.co/t/security-header/247167)
**Author:** [@champes](https://discuss.elastic.co/u/champes)\ **Replies:** 7\ **Last updated:** [September 3, 2020, 3:48am UTC](https://discuss.elastic.co/t/security-header/247167 "2020-09-03T03:48:21Z")
Any thoughts on how to configure the following HTTP secure headers: X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 ; includeSubDomains … --- ## [Is it possible to access cloned event to add some more fields to it later on](https://discuss.elastic.co/t/is-it-possible-to-access-cloned-event-to-add-some-more-fields-to-it-later-on/247313)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 1\ **Last updated:** [September 3, 2020, 3:15am UTC](https://discuss.elastic.co/t/is-it-possible-to-access-cloned-event-to-add-some-more-fields-to-it-later-on/247313 "2020-09-03T03:15:19Z")
Hi All, I have cloned an event and removed a field from it. Now I am wondering if I can later on access this cloned event in the logstash and add another field to it. clone { clones =\> \["cloned"\] … --- ## [Scheduling Logstash in Windows](https://discuss.elastic.co/t/scheduling-logstash-in-windows/247317)
**Author:** [@whyptrap](https://discuss.elastic.co/u/whyptrap)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 2:52am UTC](https://discuss.elastic.co/t/scheduling-logstash-in-windows/247317 "2020-09-03T02:52:57Z")
Hi, i think i need help. I have 2 logstash configuration files with different csv file on input, and output to different index pattern too. I've try to create 2 task scheduler to run each file, and stop the task after … --- ## [Kibana user activity log](https://discuss.elastic.co/t/kibana-user-activity-log/247307)
**Author:** [@Dave\_Laurence](https://discuss.elastic.co/u/Dave_Laurence)\ **Replies:** 1\ **Last updated:** [September 3, 2020, 12:53am UTC](https://discuss.elastic.co/t/kibana-user-activity-log/247307 "2020-09-03T00:53:05Z")
Hello. I'm a new ELK Stack user. And my project requires me to track who is accessing my kibana dashboard, and how long they are using the kibana (kibana utilization). Is there anyway to track those? The closest thing I… --- ## [Logstash failed to run](https://discuss.elastic.co/t/logstash-failed-to-run/247294)
**Author:** [@billzhang1123](https://discuss.elastic.co/u/billzhang1123)\ **Replies:** 2\ **Last updated:** [September 3, 2020, 12:47am UTC](https://discuss.elastic.co/t/logstash-failed-to-run/247294 "2020-09-03T00:47:45Z")
I have this configuration below running against the latest release of logstash. but received the error below. any suggestion? input { file { path =\> "~/logstash-data/ActionTrackingGeneral.csv" start\_position =\> "begi… --- ## [Where to see forcemerge detail](https://discuss.elastic.co/t/where-to-see-forcemerge-detail/247302)
**Author:** [@taidengpub](https://discuss.elastic.co/u/taidengpub)\ **Replies:** 1\ **Last updated:** [September 3, 2020, 12:36am UTC](https://discuss.elastic.co/t/where-to-see-forcemerge-detail/247302 "2020-09-03T00:36:42Z")
i run a forcemerge api ,and the forcemerge failed ,where to see the task detail to find out the reason? --- ## [Elasticsearch port 9200 or 9300?](https://discuss.elastic.co/t/elasticsearch-port-9200-or-9300/72080)
**Author:** [@nanshan](https://discuss.elastic.co/u/nanshan)\ **Replies:** 4\ **Last updated:** [September 2, 2020, 11:25pm UTC](https://discuss.elastic.co/t/elasticsearch-port-9200-or-9300/72080 "2020-09-02T23:25:36Z")
Can anyone explain which port number is elasticsearch listening? When I am running elasticsearch and I can see tcp6 0 0 :::9200 :::\* LISTEN 12390/java tcp6… --- ## [Error "Kibana server is not ready yet"](https://discuss.elastic.co/t/error-kibana-server-is-not-ready-yet/156834)
**Author:** [@litti](https://discuss.elastic.co/u/litti)\ **Replies:** 27\ **Last updated:** [September 2, 2020, 11:25pm UTC](https://discuss.elastic.co/t/error-kibana-server-is-not-ready-yet/156834 "2020-09-02T23:25:03Z")
Since last night I experience the error message "Kibana server is not ready yet" in the browser when I want to open Kibana. I've done a lot of research, but I can't find the reason. I've uploaded the logs at https://ww… --- ## [FORBIDDEN/12/index read-only / allow delete (api)\]](https://discuss.elastic.co/t/forbidden-12-index-read-only-allow-delete-api/110282)
**Author:** [@Tal\_Druckmann](https://discuss.elastic.co/u/Tal_Druckmann)\ **Replies:** 7\ **Last updated:** [September 2, 2020, 11:24pm UTC](https://discuss.elastic.co/t/forbidden-12-index-read-only-allow-delete-api/110282 "2020-09-02T23:24:17Z")
I am running logstash on windows 2016 vm . I use it from administrator command line. I keep getting this message. It won't let me save my visualization on kibana and keeps me from shutting it down (ctrl+c). This is the … --- ## [Up to date way to ingest logs from Java application using log4j2](https://discuss.elastic.co/t/up-to-date-way-to-ingest-logs-from-java-application-using-log4j2/241300)
**Author:** [@Daniele\_Renda](https://discuss.elastic.co/u/Daniele_Renda)\ **Replies:** 4\ **Last updated:** [September 2, 2020, 11:07pm UTC](https://discuss.elastic.co/t/up-to-date-way-to-ingest-logs-from-java-application-using-log4j2/241300 "2020-09-02T23:07:02Z")
Hi, I've a Spring Boot 2.3.1 application that produces some logs. I'd like to ingest them into my ElasticSearch stack (I'm hosted on Elastic cloud). What's the better way to do that? I saw the logstash log4j plugin is d… --- ## [How much space do keys take?](https://discuss.elastic.co/t/how-much-space-do-keys-take/247297)
**Author:** [@pcb](https://discuss.elastic.co/u/pcb)\ **Replies:** 0\ **Last updated:** [September 2, 2020, 10:44pm UTC](https://discuss.elastic.co/t/how-much-space-do-keys-take/247297 "2020-09-02T22:44:20Z")
Hi ya all, I'm thinking of adding a bunch of boolean flags to my documents and I'm curious about space usage. Would these two have similar storage? { "A": false } { "abcdefghijklmnopqrstuvwxyz1234567890ABCDEFGHIJKLM… --- ## [Time in a field of type date](https://discuss.elastic.co/t/time-in-a-field-of-type-date/247221)
**Author:** [@Alex9](https://discuss.elastic.co/u/Alex9)\ **Replies:** 1\ **Last updated:** [September 2, 2020, 10:33pm UTC](https://discuss.elastic.co/t/time-in-a-field-of-type-date/247221 "2020-09-02T22:33:07Z")
Good day :slightly\_smiling\_face: Please tell me how to set up the field correctly so that the time in it does not differ from the incoming data? PUT service100 { "mappings": { "properties": { "DELIVERY\_TIME… --- ## [\[SOLVED\] High Network Traffic on Master Nodes after change from Transport Client to REST Client (ElasticSearch 6.8)](https://discuss.elastic.co/t/solved-high-network-traffic-on-master-nodes-after-change-from-transport-client-to-rest-client-elasticsearch-6-8/247209)
**Author:** [@gotenks82](https://discuss.elastic.co/u/gotenks82)\ **Replies:** 2\ **Last updated:** [September 2, 2020, 10:21pm UTC](https://discuss.elastic.co/t/solved-high-network-traffic-on-master-nodes-after-change-from-transport-client-to-rest-client-elasticsearch-6-8/247209 "2020-09-02T22:21:09Z")
Hi Everyone! We are trying to migrate from the transport client to the high level rest client in our application, but we noticed a strange network load on the master node. Here's our setup: ElasticSearch 6.8 OSS (no x… --- ## [Failed updating index template when updating to 7.8](https://discuss.elastic.co/t/failed-updating-index-template-when-updating-to-7-8/247247)
**Author:** [@Hernan\_Paszel](https://discuss.elastic.co/u/Hernan_Paszel)\ **Replies:** 1\ **Last updated:** [September 2, 2020, 10:18pm UTC](https://discuss.elastic.co/t/failed-updating-index-template-when-updating-to-7-8/247247 "2020-09-02T22:18:45Z")
Hi! Recently we updated the stack from 7.5 to 7.8 and everything went smooth. However today we tried to update our index template through Kibana's ui and when saving the changes we got the following message. If I rec… --- ## [Unable to restore snapshots in Elasticsearch](https://discuss.elastic.co/t/unable-to-restore-snapshots-in-elasticsearch/247179)
**Author:** [@Ayush\_Agrahari](https://discuss.elastic.co/u/Ayush_Agrahari)\ **Replies:** 3\ **Last updated:** [September 2, 2020, 9:18pm UTC](https://discuss.elastic.co/t/unable-to-restore-snapshots-in-elasticsearch/247179 "2020-09-02T21:18:50Z")
I am getting error while restoring Snapshot. Details are mentioned below API Call: 'POST /\_snapshot/elkSnapshots/snapshot-20200830-sdfs/\_restore? { "indices": "\*" }' Error: { "error" : { "root\_cause" : \[ { … --- ## [Filebeat: How to differentiate data from different types sources on same port?](https://discuss.elastic.co/t/filebeat-how-to-differentiate-data-from-different-types-sources-on-same-port/247175)
**Author:** [@denis.atanasov](https://discuss.elastic.co/u/denis.atanasov)\ **Replies:** 3\ **Last updated:** [September 2, 2020, 9:12pm UTC](https://discuss.elastic.co/t/filebeat-how-to-differentiate-data-from-different-types-sources-on-same-port/247175 "2020-09-02T21:12:35Z")
Hello guys, I setup a Filebeat (7.9) on my ELK(7.9) and started receiving syslog messages. So far so good, everything is parsed and visualized successfully. However I am facing problems, when I enable 2 different modul… --- ## [How I can fetch the apache and node logs through filebeat](https://discuss.elastic.co/t/how-i-can-fetch-the-apache-and-node-logs-through-filebeat/246926)
**Author:** [@Priya\_Kapoor](https://discuss.elastic.co/u/Priya_Kapoor)\ **Replies:** 7\ **Last updated:** [September 2, 2020, 9:02pm UTC](https://discuss.elastic.co/t/how-i-can-fetch-the-apache-and-node-logs-through-filebeat/246926 "2020-09-02T21:02:24Z")
Both the logs are on same server. I am using filebeat 7.8.0 and want both the apache and node logs on different index. --- ## [Http://localhost:5601/app/kibana ,how do I disable kibana url access](https://discuss.elastic.co/t/http-localhost-5601-app-kibana-how-do-i-disable-kibana-url-access/247281)
**Author:** [@mr\_searchng](https://discuss.elastic.co/u/mr_searchng)\ **Replies:** 1\ **Last updated:** [September 2, 2020, 8:49pm UTC](https://discuss.elastic.co/t/http-localhost-5601-app-kibana-how-do-i-disable-kibana-url-access/247281 "2020-09-02T20:49:34Z")
I have a project. I use kibana inside. There is a login system in my project. Access to kibana is provided after login. However, kibana is accessed from outside with http://localhost:5601/app/kibana url. How can I preve… --- ## [Change Visualization source from Index-Pattern to Saved Search](https://discuss.elastic.co/t/change-visualization-source-from-index-pattern-to-saved-search/247255)
**Author:** [@BkQc](https://discuss.elastic.co/u/BkQc)\ **Replies:** 5\ **Last updated:** [September 2, 2020, 8:29pm UTC](https://discuss.elastic.co/t/change-visualization-source-from-index-pattern-to-saved-search/247255 "2020-09-02T20:29:09Z")
In Nov 2019, someone asked the same question and the answer was that it was not possible. Was there any change about that? I would like to modify an existing visualization that uses an index pattern and use a saved sear… --- ## [\_grokparsefailure Tag in all parsed logs with multiple grok filter](https://discuss.elastic.co/t/grokparsefailure-tag-in-all-parsed-logs-with-multiple-grok-filter/247200)
**Author:** [@mohammadamin75](https://discuss.elastic.co/u/mohammadamin75)\ **Replies:** 5\ **Last updated:** [September 2, 2020, 5:22pm UTC](https://discuss.elastic.co/t/grokparsefailure-tag-in-all-parsed-logs-with-multiple-grok-filter/247200 "2020-09-02T17:22:34Z")
I am trying to parse minecraft log with Elastic Stack and I'v faced a very strange problem (likely strange for me!) all line of my log get parsed correctly but I got \_grokparsefailure tag in everyone of them. my logsta… --- ## [Curator - create\_index - skip if index already exists](https://discuss.elastic.co/t/curator-create-index-skip-if-index-already-exists/247267)
**Author:** [@Bruceclegg](https://discuss.elastic.co/u/Bruceclegg)\ **Replies:** 0\ **Last updated:** [September 2, 2020, 5:16pm UTC](https://discuss.elastic.co/t/curator-create-index-skip-if-index-already-exists/247267 "2020-09-02T17:16:54Z")
Periodically I use cron and curator to create indices. Is there a way to build into the action.yml file a mechanism to skip the create\_index action if the named index already exists? --- ## [Parsing nested json](https://discuss.elastic.co/t/parsing-nested-json/247228)
**Author:** [@sana1](https://discuss.elastic.co/u/sana1)\ **Replies:** 1\ **Last updated:** [September 2, 2020, 5:07pm UTC](https://discuss.elastic.co/t/parsing-nested-json/247228 "2020-09-02T17:07:05Z")
I need help in parsing a nested array data ''' "abc" =\> \[ \[0\] { "obj" =\> "78", "val" =\> "0/100", "name" =\> "xyx", "email" =\> "xyz@gmail.com" }, \[1\] { "obj" =\> "78", "val" =\> "0/100", "name" =\> "xyx", "email"… --- ## [Elasticsearch installation and configuration issue](https://discuss.elastic.co/t/elasticsearch-installation-and-configuration-issue/247130)
**Author:** [@bogdan.oproescu](https://discuss.elastic.co/u/bogdan.oproescu)\ **Replies:** 24\ **Last updated:** [September 2, 2020, 5:02pm UTC](https://discuss.elastic.co/t/elasticsearch-installation-and-configuration-issue/247130 "2020-09-02T17:02:31Z")
Hello Elasticsearch forum, My name is Bogdan Oproescu and I am senior data architect for EasyDO Digital Technologies in Bucharest. I am writing you today, to report an issue with our initial Elasticsearch engine configu… --- ## [Logstash: Elasticsearch input plugin doesn't work](https://discuss.elastic.co/t/logstash-elasticsearch-input-plugin-doesnt-work/247145)
**Author:** [@Igor\_Olikh](https://discuss.elastic.co/u/Igor_Olikh)\ **Replies:** 3\ **Last updated:** [September 2, 2020, 4:51pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-input-plugin-doesnt-work/247145 "2020-09-02T16:51:25Z")
It sounds strange (at least for me) that the output plugin works: elasticsearch { hosts =\> \["https://elastict:9200"\] user =\> "elastic" password =\> "PASSWORD" ssl =\> true ssl\_certificate\_verification =\> true cacer… --- ## [Logstash Cache when elasticsearch not reachable](https://discuss.elastic.co/t/logstash-cache-when-elasticsearch-not-reachable/247181)
**Author:** [@kkhadka](https://discuss.elastic.co/u/kkhadka)\ **Replies:** 3\ **Last updated:** [September 2, 2020, 4:46pm UTC](https://discuss.elastic.co/t/logstash-cache-when-elasticsearch-not-reachable/247181 "2020-09-02T16:46:35Z")
if the elasticsearch is not reachable and data is being sent to logstash, does that data be cache by logstash until the elasticsearch is reachable? --- ## [ELK-log full with errors](https://discuss.elastic.co/t/elk-log-full-with-errors/247017)
**Author:** [@NogNeetMachinaal](https://discuss.elastic.co/u/NogNeetMachinaal)\ **Replies:** 4\ **Last updated:** [September 2, 2020, 4:43pm UTC](https://discuss.elastic.co/t/elk-log-full-with-errors/247017 "2020-09-02T16:43:40Z")
Team - The log of ElasticSearch is full with errors (see below). Most likely, because of this the system is not working as expected. Any idea what is happening and how to fix this? It is version 7.9 for Elastic and Ki… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1827) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1829)