# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1845

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1846

---

## [Problem with fields mqobject\_ and mq\_ They are not displayed in Elasticsearch from Prometheus](https://discuss.elastic.co/t/problem-with-fields-mqobject-and-mq-they-are-not-displayed-in-elasticsearch-from-prometheus/245959)

<div class="topic-metadata">

**Author:** [@amateur](https://discuss.elastic.co/u/amateur)\
**Replies:** 3\
**Last updated:** [August 25, 2020, 2:34pm UTC](https://discuss.elastic.co/t/problem-with-fields-mqobject-and-mq-they-are-not-displayed-in-elasticsearch-from-prometheus/245959 "2020-08-25T14:34:53Z")

</div>

Hi, We already have MQ monitoring running in Prometehus, but we are trying to bring the metrics to ElasticSearch, we made the integration between Prometehus and Metricbeat, but they do not arrive, all the fields related…

---

## [Angular 2 or above version plugin for kibana](https://discuss.elastic.co/t/angular-2-or-above-version-plugin-for-kibana/246128)

<div class="topic-metadata">

**Author:** [@Nitheesh](https://discuss.elastic.co/u/Nitheesh)\
**Replies:** 3\
**Last updated:** [August 25, 2020, 2:23pm UTC](https://discuss.elastic.co/t/angular-2-or-above-version-plugin-for-kibana/246128 "2020-08-25T14:23:33Z")

</div>

I am having an angular application that I need to add in kibana as a plugin. Is it possible to do it in kibana? I am able to create a plugin in react but not getting any useful link or documentation to create and add a …

---

## [ES JVM use ZGC, esrally can't work](https://discuss.elastic.co/t/es-jvm-use-zgc-esrally-cant-work/246253)

<div class="topic-metadata">

**Author:** [@Zhayhp](https://discuss.elastic.co/u/Zhayhp)\
**Replies:** 2\
**Last updated:** [August 25, 2020, 2:09pm UTC](https://discuss.elastic.co/t/es-jvm-use-zgc-esrally-cant-work/246253 "2020-08-25T14:09:38Z")

</div>

There is an error in the rally code (jvm\_stats) when I set the ES Jvm use ZGC. rally.log Traceback (most recent call last): File "/usr/local/python38/lib/python3.8/site-packages/esrally/actor.py", line 85, in guard …

---

## [Pruning Indexes with 0 documents](https://discuss.elastic.co/t/pruning-indexes-with-0-documents/246172)

<div class="topic-metadata">

**Author:** [@akrzos](https://discuss.elastic.co/u/akrzos)\
**Replies:** 4\
**Last updated:** [August 25, 2020, 1:49pm UTC](https://discuss.elastic.co/t/pruning-indexes-with-0-documents/246172 "2020-08-25T13:49:57Z")

</div>

Hello, I am looking for the best method to prune indexes with 0 documents. After we migrated to ILM, we have a few indexes which rollover with 0 documents and this can cause an in-balance across a large cluster where s…

---

## [Anonymization of sensitive data by Logstash](https://discuss.elastic.co/t/anonymization-of-sensitive-data-by-logstash/245585)

<div class="topic-metadata">

**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\
**Replies:** 8\
**Last updated:** [August 25, 2020, 1:45pm UTC](https://discuss.elastic.co/t/anonymization-of-sensitive-data-by-logstash/245585 "2020-08-25T13:45:24Z")

</div>

Hello, can anyone help me how to anonymize sensitive data from multline log? How to anonymize value of parameter sensitive data: sensitive data:more than one line some part on second and on third line should be repla…

---

## [How can I get the similarity of two single words with ES](https://discuss.elastic.co/t/how-can-i-get-the-similarity-of-two-single-words-with-es/246294)

<div class="topic-metadata">

**Author:** [@Ingo](https://discuss.elastic.co/u/Ingo)\
**Replies:** 0\
**Last updated:** [August 25, 2020, 1:31pm UTC](https://discuss.elastic.co/t/how-can-i-get-the-similarity-of-two-single-words-with-es/246294 "2020-08-25T13:31:01Z")

</div>

I try to get the score of the similarity of two single words but I get always a score of 0 and no hit although the words are very similar. For example, Bundesvermoegensverwaltung and Bundesvermogensverwaltung gives me a…

---

## [Elasticsearch 5.5.1 not able to create repository in GCS](https://discuss.elastic.co/t/elasticsearch-5-5-1-not-able-to-create-repository-in-gcs/246289)

<div class="topic-metadata">

**Author:** [@Vinoth\_Kumarasamy](https://discuss.elastic.co/u/Vinoth_Kumarasamy)\
**Replies:** 0\
**Last updated:** [August 25, 2020, 1:18pm UTC](https://discuss.elastic.co/t/elasticsearch-5-5-1-not-able-to-create-repository-in-gcs/246289 "2020-08-25T13:18:57Z")

</div>

Hi, I am trying to create backup snapshot for my index running in elasticsearch 5.5.1 in GKE. I have followed below steps installed plugin (repository-gcs)and added service-account to keystore. https://www.elastic.co/g…

---

## [ELK cluster architecture](https://discuss.elastic.co/t/elk-cluster-architecture/246036)

<div class="topic-metadata">

**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Replies:** 4\
**Last updated:** [August 25, 2020, 1:07pm UTC](https://discuss.elastic.co/t/elk-cluster-architecture/246036 "2020-08-25T13:07:08Z")

</div>

Is this seems ok architecture? each system has 96gig RAM and 24 core cpus. 3 master node + kibana (kibana is there just incase I need it) 25gig for elasticsearch and 8 gig for kibana 2 co-ordinating node + kibana 25…

---

## [Elasticsearch is still initializing the kibana index... Trying again in 2.5 second](https://discuss.elastic.co/t/elasticsearch-is-still-initializing-the-kibana-index-trying-again-in-2-5-second/245701)

<div class="topic-metadata">

**Author:** [@Burga](https://discuss.elastic.co/u/Burga)\
**Replies:** 5\
**Last updated:** [August 25, 2020, 1:03pm UTC](https://discuss.elastic.co/t/elasticsearch-is-still-initializing-the-kibana-index-trying-again-in-2-5-second/245701 "2020-08-25T13:03:19Z")

</div>

Hi , I'm getting this error in Kibana Elasticsearch is still initializing the kibana index... Trying again in 2.5 second and the .kibana index is the only index in red mode any suggestions without losing all data ? E…

---

## [Logstash not reading keystore file after upgrade to ELK 7.9](https://discuss.elastic.co/t/logstash-not-reading-keystore-file-after-upgrade-to-elk-7-9/245680)

<div class="topic-metadata">

**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\
**Replies:** 1\
**Last updated:** [August 25, 2020, 12:59pm UTC](https://discuss.elastic.co/t/logstash-not-reading-keystore-file-after-upgrade-to-elk-7-9/245680 "2020-08-25T12:59:31Z")

</div>

Hi, Yesterday this was working perfectly fine. I just upgraded the server to ELK 7.9 and after restarted Logstash I am getting this error stating Logstash found the keystore file, but "... but it is not a valid Logstash…

---

## [Elastic Stack Hardware requirements](https://discuss.elastic.co/t/elastic-stack-hardware-requirements/246286)

<div class="topic-metadata">

**Author:** [@Turotakun98](https://discuss.elastic.co/u/Turotakun98)\
**Replies:** 0\
**Last updated:** [August 25, 2020, 12:59pm UTC](https://discuss.elastic.co/t/elastic-stack-hardware-requirements/246286 "2020-08-25T12:59:04Z")

</div>

Hi, I have to setup the stack on a machine with limited hardware (4GB RAM, Ubuntu 20.04, 80GB SSD). I need to run Elasticsearch, Logstash and Kibana on this machine. I am facing various problem relative to the JVM, in b…

---

## [Drill Down Visualization](https://discuss.elastic.co/t/drill-down-visualization/245413)

<div class="topic-metadata">

**Author:** [@adityaPsl](https://discuss.elastic.co/u/adityaPsl)\
**Replies:** 2\
**Last updated:** [August 25, 2020, 12:54pm UTC](https://discuss.elastic.co/t/drill-down-visualization/245413 "2020-08-25T12:54:21Z")

</div>

Hello Team, I am looking for creating a drill down , where i will have a hierarchical data in json format. for example \> { \> "Name":"L1", \> "level1":\[ \> { \> "Name":"L2", \> "level2":\[ \>…

---

## [Create Dashboard for 15 failed logon from AD in 10 Min](https://discuss.elastic.co/t/create-dashboard-for-15-failed-logon-from-ad-in-10-min/245877)

<div class="topic-metadata">

**Author:** [@Majid\_Att](https://discuss.elastic.co/u/Majid_Att)\
**Replies:** 4\
**Last updated:** [August 25, 2020, 12:51pm UTC](https://discuss.elastic.co/t/create-dashboard-for-15-failed-logon-from-ad-in-10-min/245877 "2020-08-25T12:51:07Z")

</div>

Hi Guys, we would like to enable Account Lockout in Active Directory with this policy: 15 failed logon in 10 Min will be lockout. Upfront we would like to simulate which user will be hit by this policy . we use Winlog…

---

## [100 prosent error rate on Rally when using parent-child](https://discuss.elastic.co/t/100-prosent-error-rate-on-rally-when-using-parent-child/246054)

<div class="topic-metadata">

**Author:** [@John\_bermen\_elastic](https://discuss.elastic.co/u/John_bermen_elastic)\
**Replies:** 3\
**Last updated:** [August 25, 2020, 12:41pm UTC](https://discuss.elastic.co/t/100-prosent-error-rate-on-rally-when-using-parent-child/246054 "2020-08-25T12:41:46Z")

</div>

I have an index with an parent child structure. When I try to run a "race" with it in esrally I get 100 percent error rate. As shown bellow: Metric Task Value Unit Cumulative indexing time of primary shards 0 m…

---

## [Filebeat Apache module + Logstash: "Mapping definition for \[source\] has unsupported parameters"](https://discuss.elastic.co/t/filebeat-apache-module-logstash-mapping-definition-for-source-has-unsupported-parameters/246281)

<div class="topic-metadata">

**Author:** [@rubjurgens](https://discuss.elastic.co/u/rubjurgens)\
**Replies:** 0\
**Last updated:** [August 25, 2020, 12:25pm UTC](https://discuss.elastic.co/t/filebeat-apache-module-logstash-mapping-definition-for-source-has-unsupported-parameters/246281 "2020-08-25T12:25:46Z")

</div>

Hello, For some time now, we are using ES, Logstash and Kibana with filebeats parsing application logs from different servers. Recently we configured filebeat for the first time using a module. I followed the instructi…

---

## [Delete child documents without parent using Java API](https://discuss.elastic.co/t/delete-child-documents-without-parent-using-java-api/246276)

<div class="topic-metadata">

**Author:** [@makons](https://discuss.elastic.co/u/makons)\
**Replies:** 0\
**Last updated:** [August 25, 2020, 11:59am UTC](https://discuss.elastic.co/t/delete-child-documents-without-parent-using-java-api/246276 "2020-08-25T11:59:24Z")

</div>

As the title says, I'm trying to delete all the parentless child documents using ES Java API. If I got things correctly, I need to use DeleteByQuery, and my proposed solution is this: val allParentlessChildren = QueryBu…

---

## [How to select only one field from an array?](https://discuss.elastic.co/t/how-to-select-only-one-field-from-an-array/246275)

<div class="topic-metadata">

**Author:** [@Mayank\_Ruhella](https://discuss.elastic.co/u/Mayank_Ruhella)\
**Replies:** 0\
**Last updated:** [August 25, 2020, 11:54am UTC](https://discuss.elastic.co/t/how-to-select-only-one-field-from-an-array/246275 "2020-08-25T11:54:43Z")

</div>

Output "\_source" : { "mortgagesObj" : \[ { "regDate" : "04/06/2020" }, { "regDate" : "01/10/2013" }, { "regD…

---

## [Persian Analyzer](https://discuss.elastic.co/t/persian-analyzer/246274)

<div class="topic-metadata">

**Author:** [@Pori\_Niki](https://discuss.elastic.co/u/Pori_Niki)\
**Replies:** 0\
**Last updated:** [August 25, 2020, 11:46am UTC](https://discuss.elastic.co/t/persian-analyzer/246274 "2020-08-25T11:46:58Z")

</div>

Hi. I recently checked the language analyzer in elastic docs and wonder why in all examples like this link: analysis-lang-analyzer the Persian analyzer comes after the Arabic analyzer?! Is that needed because of anything…

---

## [What is the Stable Version for Production Deployment](https://discuss.elastic.co/t/what-is-the-stable-version-for-production-deployment/246269)

<div class="topic-metadata">

**Author:** [@vivektsb](https://discuss.elastic.co/u/vivektsb)\
**Replies:** 1\
**Last updated:** [August 25, 2020, 11:43am UTC](https://discuss.elastic.co/t/what-is-the-stable-version-for-production-deployment/246269 "2020-08-25T11:43:54Z")

</div>

Hi Team, Please let me know the latest stable ELK version for production deployment. Regards, Vivek

---

## [Index is not rolling](https://discuss.elastic.co/t/index-is-not-rolling/243602)

<div class="topic-metadata">

**Author:** [@oicfar](https://discuss.elastic.co/u/oicfar)\
**Replies:** 7\
**Last updated:** [August 25, 2020, 11:39am UTC](https://discuss.elastic.co/t/index-is-not-rolling/243602 "2020-08-25T11:39:28Z")

</div>

Hi, I have the filebeat policy The hot phase is configured and the delete phase in the pilicy is set to But the index size is growing daily. And the status tell me The policy is assigned to the index te…

---

## [How To Back Up Elasticsearch Database/Data](https://discuss.elastic.co/t/how-to-back-up-elasticsearch-database-data/246113)

<div class="topic-metadata">

**Author:** [@upchair](https://discuss.elastic.co/u/upchair)\
**Replies:** 2\
**Last updated:** [August 25, 2020, 11:32am UTC](https://discuss.elastic.co/t/how-to-back-up-elasticsearch-database-data/246113 "2020-08-25T11:32:09Z")

</div>

Please can anybody please tell me how to backup my Elasticsearch Data easily. Thank You. Richard

---

## [Kibana add custom Map](https://discuss.elastic.co/t/kibana-add-custom-map/246217)

<div class="topic-metadata">

**Author:** [@Ayush\_Goyal](https://discuss.elastic.co/u/Ayush_Goyal)\
**Replies:** 1\
**Last updated:** [August 25, 2020, 10:45am UTC](https://discuss.elastic.co/t/kibana-add-custom-map/246217 "2020-08-25T10:45:35Z")

</div>

I want to add custom map which I create. I am using same format as provided in this link https://maps.elastic.co/ I can provide configuration as mentioned in this question. but where I have to save the json file for m…

---

## [Username and password-based enrollment - "environment variable VAR\_NAME does not exist"](https://discuss.elastic.co/t/username-and-password-based-enrollment-environment-variable-var-name-does-not-exist/245879)

<div class="topic-metadata">

**Author:** [@gohovd](https://discuss.elastic.co/u/gohovd)\
**Replies:** 2\
**Last updated:** [August 25, 2020, 10:43am UTC](https://discuss.elastic.co/t/username-and-password-based-enrollment-environment-variable-var-name-does-not-exist/245879 "2020-08-25T10:43:24Z")

</div>

I am working on an automated deployment of filebeat, and one of the steps is to enroll the beat. As per the documentation, to have this process scripted, I need to use 'Username and password-based enrollment', where the…

---

## [Journalbeat can't open a log file](https://discuss.elastic.co/t/journalbeat-cant-open-a-log-file/246116)

<div class="topic-metadata">

**Author:** [@DenProg](https://discuss.elastic.co/u/DenProg)\
**Replies:** 3\
**Last updated:** [August 25, 2020, 10:42am UTC](https://discuss.elastic.co/t/journalbeat-cant-open-a-log-file/246116 "2020-08-25T10:42:50Z")

</div>

Hi. I describe specific log file in the config as it's written in the docs: journalbeat.inputs: - paths: - "/var/log/syslog" This file is present, but Journalbeat can't open it for some reason: авг 24 15:53:29 com…

---

## [Guide for Upgrading from 5.5.2 to 7.8.1](https://discuss.elastic.co/t/guide-for-upgrading-from-5-5-2-to-7-8-1/246220)

<div class="topic-metadata">

**Author:** [@AmitC](https://discuss.elastic.co/u/AmitC)\
**Replies:** 19\
**Last updated:** [August 25, 2020, 10:19am UTC](https://discuss.elastic.co/t/guide-for-upgrading-from-5-5-2-to-7-8-1/246220 "2020-08-25T10:19:58Z")

</div>

Hi Team, I would like to upgrade my Elastic Stack from V5.5.2 to 7.8.1 I am using the AWS amazon server and have huge data in indexes. Also, I want to move all the dashboards created in 5.5.2 Please help!!! Thanks i…

---

## [How do I stop a Logtsash pipeline from also printing every document to STDOUT](https://discuss.elastic.co/t/how-do-i-stop-a-logtsash-pipeline-from-also-printing-every-document-to-stdout/246258)

<div class="topic-metadata">

**Author:** [@c1jt](https://discuss.elastic.co/u/c1jt)\
**Replies:** 0\
**Last updated:** [August 25, 2020, 9:40am UTC](https://discuss.elastic.co/t/how-do-i-stop-a-logtsash-pipeline-from-also-printing-every-document-to-stdout/246258 "2020-08-25T09:40:02Z")

</div>

Ayup, I have a Docker setup (E, L & K w/ compose) which has its Logstash parsing custom logs. The "Sophos" pipeline only outputs to an elastic node. However; Logstash It thinks its super funny to also print every singl…

---

## [ELK License for Kubernetes](https://discuss.elastic.co/t/elk-license-for-kubernetes/246257)

<div class="topic-metadata">

**Author:** [@Shalinicts](https://discuss.elastic.co/u/Shalinicts)\
**Replies:** 0\
**Last updated:** [August 25, 2020, 9:39am UTC](https://discuss.elastic.co/t/elk-license-for-kubernetes/246257 "2020-08-25T09:39:22Z")

</div>

Hi Team, Please let know how licensing works on ELK deployment in Kubernetes .

---

## [Visualizations on Dashboard going grey from time to time (all 2-5 seconds)](https://discuss.elastic.co/t/visualizations-on-dashboard-going-grey-from-time-to-time-all-2-5-seconds/245869)

<div class="topic-metadata">

**Author:** [@BoKu](https://discuss.elastic.co/u/BoKu)\
**Replies:** 4\
**Last updated:** [August 25, 2020, 9:03am UTC](https://discuss.elastic.co/t/visualizations-on-dashboard-going-grey-from-time-to-time-all-2-5-seconds/245869 "2020-08-25T09:03:43Z")

</div>

Hello, as mentoined in the Topic, since the update to 7.9.0 visualizations on a dashboard are going grey every few seconds. What is the reason for that behavior and what can i do about it? Thanks in advance! Boris

---

## [Logstash keeps crashing,used 7 different ports](https://discuss.elastic.co/t/logstash-keeps-crashing-used-7-different-ports/246247)

<div class="topic-metadata">

**Author:** [@divya\_lakshmi](https://discuss.elastic.co/u/divya_lakshmi)\
**Replies:** 0\
**Last updated:** [August 25, 2020, 8:06am UTC](https://discuss.elastic.co/t/logstash-keeps-crashing-used-7-different-ports/246247 "2020-08-25T08:06:11Z")

</div>

logstash keeps crashing,used 7 different ports with 7 different conf files added to pipeline.yml. How many ports in adding multiple pipeline can be logstash 6.5 version support

---

## [Is there a way to set analysis for a field?](https://discuss.elastic.co/t/is-there-a-way-to-set-analysis-for-a-field/244242)

<div class="topic-metadata">

**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\
**Replies:** 1\
**Last updated:** [August 25, 2020, 7:42am UTC](https://discuss.elastic.co/t/is-there-a-way-to-set-analysis-for-a-field/244242 "2020-08-25T07:42:02Z")

</div>

index mapping https://paste.ubuntu.com/p/9SdnNDfjM9/ I want to search for the value of productSN. Using the default analysis configuration, it seems that the result cannot be found. { "userType":2, "productSN":…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1844)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1846)
