# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1859 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1860 --- ## [Unable to install repository-gcs plugin through Kubernetes startup script](https://discuss.elastic.co/t/unable-to-install-repository-gcs-plugin-through-kubernetes-startup-script/245432)
**Author:** [@Vinoth\_Kumarasamy](https://discuss.elastic.co/u/Vinoth_Kumarasamy)\ **Replies:** 0\ **Last updated:** [August 18, 2020, 1:46pm UTC](https://discuss.elastic.co/t/unable-to-install-repository-gcs-plugin-through-kubernetes-startup-script/245432 "2020-08-18T13:46:08Z")
Hi, We have existing elasticsearch cluster(6 nodes) running on GKE. I am trying to create backup repository for creating backup snapshot https://www.elastic.co/guide/en/elasticsearch/plugins/7.8/repository-gcs.html We … --- ## [CEF module and decode\_cef processor](https://discuss.elastic.co/t/cef-module-and-decode-cef-processor/245430)
**Author:** [@anon56147639](https://discuss.elastic.co/u/anon56147639)\ **Replies:** 0\ **Last updated:** [August 18, 2020, 1:41pm UTC](https://discuss.elastic.co/t/cef-module-and-decode-cef-processor/245430 "2020-08-18T13:41:56Z")
Hi everyone, I have a question about the CEF module in Filebeat. Can it only be used to listen to incoming syslog traffic or can the module also read from locally stored files? I'm asking this because there is no defin… --- ## [Merging transform indices to create new summary index](https://discuss.elastic.co/t/merging-transform-indices-to-create-new-summary-index/244720)
**Author:** [@InfiniteDreamer](https://discuss.elastic.co/u/InfiniteDreamer)\ **Replies:** 5\ **Last updated:** [August 18, 2020, 1:39pm UTC](https://discuss.elastic.co/t/merging-transform-indices-to-create-new-summary-index/244720 "2020-08-18T13:39:36Z")
we want to create a summary transform index from two main index named salesdata and visitdata respectively,both indices mapping is different where CustomerCode is like primary key present in both index. SalesData index… --- ## [Indices based on field value](https://discuss.elastic.co/t/indices-based-on-field-value/244891)
**Author:** [@jijo.john](https://discuss.elastic.co/u/jijo.john)\ **Replies:** 10\ **Last updated:** [August 18, 2020, 1:36pm UTC](https://discuss.elastic.co/t/indices-based-on-field-value/244891 "2020-08-18T13:36:38Z")
Hi There, I am doing a POC on elasticsearch, currently all the cisco asa logs are captured using filebeat cisco module. We would like to create a separate indice when a specific condition is met. Basically we need creat… --- ## [Is there a Multi-node small cluster in Elasticsearch Service (cloud) planned for future?](https://discuss.elastic.co/t/is-there-a-multi-node-small-cluster-in-elasticsearch-service-cloud-planned-for-future/245042)
**Author:** [@ojasp](https://discuss.elastic.co/u/ojasp)\ **Replies:** 6\ **Last updated:** [August 18, 2020, 1:27pm UTC](https://discuss.elastic.co/t/is-there-a-multi-node-small-cluster-in-elasticsearch-service-cloud-planned-for-future/245042 "2020-08-18T13:27:08Z")
We have a 3-node cluster running on Linux servers with 8GB memory per server. When configuring cluster in elastic cloud, there is no option for multiple nodes until you get to 58GB per node, which is cost-prohibitive for… --- ## [How can a heavily nested JSON data structure be displayed/searched in Elasticsearch](https://discuss.elastic.co/t/how-can-a-heavily-nested-json-data-structure-be-displayed-searched-in-elasticsearch/245423)
**Author:** [@siiman](https://discuss.elastic.co/u/siiman)\ **Replies:** 0\ **Last updated:** [August 18, 2020, 1:08pm UTC](https://discuss.elastic.co/t/how-can-a-heavily-nested-json-data-structure-be-displayed-searched-in-elasticsearch/245423 "2020-08-18T13:08:35Z")
Hello, everyone, I would like to know in general how a nested JSON data structure can most effectively be imported into Elasticsearch. I have read some posts on this topic and also tried the approaches with parent/chil… --- ## [Issue capture request response time in nginx logs](https://discuss.elastic.co/t/issue-capture-request-response-time-in-nginx-logs/245397)
**Author:** [@pravej](https://discuss.elastic.co/u/pravej)\ **Replies:** 1\ **Last updated:** [August 18, 2020, 12:31pm UTC](https://discuss.elastic.co/t/issue-capture-request-response-time-in-nginx-logs/245397 "2020-08-18T12:31:08Z")
Dear Team, I am not able to capture response time in nginx logs . please help to find out gork setting in logstash. i am sharing logs sample I need to capture first cloumn response time "0.241" "0.236" 200 "GET / HTT… --- ## [Keep getting error in data table for security graph](https://discuss.elastic.co/t/keep-getting-error-in-data-table-for-security-graph/245351)
**Author:** [@jamesyone](https://discuss.elastic.co/u/jamesyone)\ **Replies:** 4\ **Last updated:** [August 18, 2020, 12:28pm UTC](https://discuss.elastic.co/t/keep-getting-error-in-data-table-for-security-graph/245351 "2020-08-18T12:28:33Z")
Hi- I keep getting error in kibana when doing data table for my security graph.. Request to Elasticsearch failed: {"error":{"root\_cause":\[{"type":"too\_many\_buckets\_exception","reason":"Trying to create too many buckets.… --- ## [Sort on term sub aggregation field](https://discuss.elastic.co/t/sort-on-term-sub-aggregation-field/245313)
**Author:** [@imran1](https://discuss.elastic.co/u/imran1)\ **Replies:** 3\ **Last updated:** [August 18, 2020, 11:46am UTC](https://discuss.elastic.co/t/sort-on-term-sub-aggregation-field/245313 "2020-08-18T11:46:35Z")
Suppose I have the following query: { "aggs": { "distinct\_part": { "terms": { "field": "part", "size": 1000 } }, "aggs": { "distinct\_manufacturer": { "terms": { … --- ## [Zeek Dashboard No Results Found in Query](https://discuss.elastic.co/t/zeek-dashboard-no-results-found-in-query/243463)
**Author:** [@georgef](https://discuss.elastic.co/u/georgef)\ **Replies:** 4\ **Last updated:** [August 18, 2020, 11:43am UTC](https://discuss.elastic.co/t/zeek-dashboard-no-results-found-in-query/243463 "2020-08-18T11:43:32Z")
Hi Everyone, ELK newb here. I do not have data appearing in the Filebeat Zeek Dashboard. I have two servers in a lab environment both running Ubuntu 18.04. The first server is running Zeek and Filebeat with Zeek modu… --- ## [What makes ES not support rollbacks?](https://discuss.elastic.co/t/what-makes-es-not-support-rollbacks/245392)
**Author:** [@jbaker](https://discuss.elastic.co/u/jbaker)\ **Replies:** 2\ **Last updated:** [August 18, 2020, 11:28am UTC](https://discuss.elastic.co/t/what-makes-es-not-support-rollbacks/245392 "2020-08-18T11:28:29Z")
A number of documents are clear that it's possible to upgrade from one ES version to the next, but not downgrade. I'm wondering what the causes of this are? I assume there's a necessary forwards compatibility guarantee b… --- ## [Auth to ECK using Azure AAD SAML failing](https://discuss.elastic.co/t/auth-to-eck-using-azure-aad-saml-failing/245275)
**Author:** [@damjank](https://discuss.elastic.co/u/damjank)\ **Replies:** 8\ **Last updated:** [August 18, 2020, 11:00am UTC](https://discuss.elastic.co/t/auth-to-eck-using-azure-aad-saml-failing/245275 "2020-08-18T11:00:46Z")
Hey guys, I am facing a weird issue. Following this guide as a roadmap: https://discuss.elastic.co/t/sso-azure-ad-setup/230639/2 and mostly https://www.elastic.co/blog/saml-based-single-sign-on-with-elasticsearch-and-az… --- ## [Logstash has suddenly stopped reading input files](https://discuss.elastic.co/t/logstash-has-suddenly-stopped-reading-input-files/242540)
**Author:** [@mskadu](https://discuss.elastic.co/u/mskadu)\ **Replies:** 7\ **Last updated:** [August 18, 2020, 10:44am UTC](https://discuss.elastic.co/t/logstash-has-suddenly-stopped-reading-input-files/242540 "2020-08-18T10:44:13Z")
Hello everyone, I have an interesting one. I have a working v7.7 logstash config (on RHEL 7.x) which has suddenly stopped ingesting files. I am using the file input plugin in read mode to ingest single-use CSV files (ea… --- ## [Logstash and Kibana as coordinating nodes - Does it makes senses?](https://discuss.elastic.co/t/logstash-and-kibana-as-coordinating-nodes-does-it-makes-senses/245045)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 9\ **Last updated:** [August 18, 2020, 10:41am UTC](https://discuss.elastic.co/t/logstash-and-kibana-as-coordinating-nodes-does-it-makes-senses/245045 "2020-08-18T10:41:00Z")
Hello ! In the following setup, does it makes sense to configure Logstash-Central and Kibana as coordinating nodes ? : Syslog/beats =\> Logstash-satellite =\> Kafka \<= Logstash-central =\> Elasticsearch \<= Kibana If this… --- ## [Timelion visualization](https://discuss.elastic.co/t/timelion-visualization/244989)
**Author:** [@hiba](https://discuss.elastic.co/u/hiba)\ **Replies:** 10\ **Last updated:** [August 18, 2020, 10:25am UTC](https://discuss.elastic.co/t/timelion-visualization/244989 "2020-08-18T10:25:23Z")
Hi, i use kibana 7.7.0 , this is my data documents : {"took":0,"timed\_out":false,"\_shards":{"total":1,"successful":1,"skipped":0,"failed":0},"hits":{"total":{"value":8,"relation":"eq"},"max\_score":1,"hits":\[{"\_index"… --- ## [Getting ConnectionPoolTimeoutException while calling Elastic search cluster](https://discuss.elastic.co/t/getting-connectionpooltimeoutexception-while-calling-elastic-search-cluster/245388)
**Author:** [@itsanviv](https://discuss.elastic.co/u/itsanviv)\ **Replies:** 0\ **Last updated:** [August 18, 2020, 10:17am UTC](https://discuss.elastic.co/t/getting-connectionpooltimeoutexception-while-calling-elastic-search-cluster/245388 "2020-08-18T10:17:06Z")
Hello, We are getting ConnectionPoolTimeoutException while calling elastic search for update and get query. We are using aws elastic search services. We are using Jest client and configuration are below. public final … --- ## [Logstash stopped when received x line and not push to elasticsearch](https://discuss.elastic.co/t/logstash-stopped-when-received-x-line-and-not-push-to-elasticsearch/245387)
**Author:** [@yannice92](https://discuss.elastic.co/u/yannice92)\ **Replies:** 0\ **Last updated:** [August 18, 2020, 10:16am UTC](https://discuss.elastic.co/t/logstash-stopped-when-received-x-line-and-not-push-to-elasticsearch/245387 "2020-08-18T10:16:13Z")
I have 2 server. server log and server logstash I using only logstash 6.8 and elasticsearch (without filebeat) from server log I send the log to server logstash using cron. and in server logstash I have multiple pipel… --- ## [About Indexing Time](https://discuss.elastic.co/t/about-indexing-time/245212)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 1\ **Last updated:** [August 18, 2020, 9:47am UTC](https://discuss.elastic.co/t/about-indexing-time/245212 "2020-08-18T09:47:34Z")
Hi, Can someone confirm/clarify the difference between Index Time (ms) and Latency (ms) in x-pack monitoring? Am I right in thinking that the first measuring the computational processing time of indexing requests. Wher… --- ## [Lowercase normalizer not working](https://discuss.elastic.co/t/lowercase-normalizer-not-working/245286)
**Author:** [@AmitaS](https://discuss.elastic.co/u/AmitaS)\ **Replies:** 5\ **Last updated:** [August 18, 2020, 9:42am UTC](https://discuss.elastic.co/t/lowercase-normalizer-not-working/245286 "2020-08-18T09:42:31Z")
HI, m trying to do exact search , with case insensitve. I am able to exact search using "keyword" ,but even after adding normalizer. It does not work with case insenisitve.i have to give exact term to search. .Match(m … --- ## [Calculate Difference between 2 Dates in Scipted Field](https://discuss.elastic.co/t/calculate-difference-between-2-dates-in-scipted-field/245087)
**Author:** [@hiba](https://discuss.elastic.co/u/hiba)\ **Replies:** 8\ **Last updated:** [August 18, 2020, 9:23am UTC](https://discuss.elastic.co/t/calculate-difference-between-2-dates-in-scipted-field/245087 "2020-08-18T09:23:51Z")
Hi , i try to create a new scripted field by calculating the difference(in minitues) between 2 dates in the following format : bookingStatus.confirmed :Jan 22, 2020 @ 12:20:00.000 bookingStatus.wating :Jan 20, 2020 @… --- ## [Data field in kibana discovery getting overlapped](https://discuss.elastic.co/t/data-field-in-kibana-discovery-getting-overlapped/244434)
**Author:** [@Divya\_Mathur\_ELK](https://discuss.elastic.co/u/Divya_Mathur_ELK)\ **Replies:** 4\ **Last updated:** [August 18, 2020, 9:14am UTC](https://discuss.elastic.co/t/data-field-in-kibana-discovery-getting-overlapped/244434 "2020-08-18T09:14:56Z")
Hi Team, I have created logstash pipeline using 2 csv files and getting output also in kibana. But whenever I am viewing data in kibana , output fields are getting overlapped. Please review below configuration files and… --- ## [APM Indices growing endlessly despite ILM](https://discuss.elastic.co/t/apm-indices-growing-endlessly-despite-ilm/243846)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 7\ **Last updated:** [August 18, 2020, 8:55am UTC](https://discuss.elastic.co/t/apm-indices-growing-endlessly-despite-ilm/243846 "2020-08-18T08:55:27Z")
Our APM indices are growing without bound and extremely large despite a delete aftaer 30 days ILM policy. Each index has a policy attached which say "rollover every 7 days" (which seems to be working) and delete "delete… --- ## [Scripted field to calculate duration](https://discuss.elastic.co/t/scripted-field-to-calculate-duration/245222)
**Author:** [@hiba](https://discuss.elastic.co/u/hiba)\ **Replies:** 8\ **Last updated:** [August 18, 2020, 8:43am UTC](https://discuss.elastic.co/t/scripted-field-to-calculate-duration/245222 "2020-08-18T08:43:58Z")
Hi , i try to create a new scripted field by calculating the difference(in minutes) between 2 dates in the following format : bookingStatus.confirmed :Jan 5, 2020 @ 11:30:00.000 bookingStatus.wating :Jan 5, 2020 @ 09:… --- ## [Embedding dashboard in website with dynamic filter param](https://discuss.elastic.co/t/embedding-dashboard-in-website-with-dynamic-filter-param/244807)
**Author:** [@anilk1](https://discuss.elastic.co/u/anilk1)\ **Replies:** 1\ **Last updated:** [August 18, 2020, 8:42am UTC](https://discuss.elastic.co/t/embedding-dashboard-in-website-with-dynamic-filter-param/244807 "2020-08-18T08:42:35Z")
Is it possible to pass dynamic param/query\_string from an embedded iframe, there was discussion but no direct answer. Any help would be appreciated. --- ## [Personalize the Threshold line](https://discuss.elastic.co/t/personalize-the-threshold-line/244916)
**Author:** [@Shyrine](https://discuss.elastic.co/u/Shyrine)\ **Replies:** 1\ **Last updated:** [August 18, 2020, 8:40am UTC](https://discuss.elastic.co/t/personalize-the-threshold-line/244916 "2020-08-18T08:40:10Z")
Hi, Is there any way to personalize the Threshold line, and is it possible to have 3 threshold lines ? I'd like to have an average of my values... Thanks --- ## [Split series by object keys](https://discuss.elastic.co/t/split-series-by-object-keys/244941)
**Author:** [@Sebastian\_Stehle](https://discuss.elastic.co/u/Sebastian_Stehle)\ **Replies:** 1\ **Last updated:** [August 18, 2020, 8:38am UTC](https://discuss.elastic.co/t/split-series-by-object-keys/244941 "2020-08-18T08:38:33Z")
Hello, I do not use kibana that often, therefore sorry in advance for me stupid question. I am analyzing logs from an application. These logs sometimes contains profiler information, structure like this. { "logLev… --- ## [Heatmap Derivative aggregation not available](https://discuss.elastic.co/t/heatmap-derivative-aggregation-not-available/244924)
**Author:** [@ulfsa](https://discuss.elastic.co/u/ulfsa)\ **Replies:** 2\ **Last updated:** [August 18, 2020, 8:30am UTC](https://discuss.elastic.co/t/heatmap-derivative-aggregation-not-available/244924 "2020-08-18T08:30:32Z")
I enjoy using Heatmaps to visualize (non) change. In a heatmap of a thousand cells, the human eye can immediately spot any outliers. I would like to visualize the delta of log data such as total bytes written. I would a… --- ## [Red Cluster State: failed to create shard, failure IOException\[failed to obtain in-memory shard lock\]](https://discuss.elastic.co/t/red-cluster-state-failed-to-create-shard-failure-ioexception-failed-to-obtain-in-memory-shard-lock/245345)
**Author:** [@Asad.Anwar](https://discuss.elastic.co/u/Asad.Anwar)\ **Replies:** 0\ **Last updated:** [August 18, 2020, 5:07am UTC](https://discuss.elastic.co/t/red-cluster-state-failed-to-create-shard-failure-ioexception-failed-to-obtain-in-memory-shard-lock/245345 "2020-08-18T05:07:05Z")
Hi Team, We have 8 node cluster, where we noticed 2 shards were unassigned last week. We tried this command GET : /\_cluster/allocation/explain?pretty and got below explanation- { "index": "v20-con\*\*\*\*\*", "shard": 2, … --- ## [Shard Allocation Failed - Even Manually](https://discuss.elastic.co/t/shard-allocation-failed-even-manually/245357)
**Author:** [@tomx1](https://discuss.elastic.co/u/tomx1)\ **Replies:** 3\ **Last updated:** [August 18, 2020, 8:20am UTC](https://discuss.elastic.co/t/shard-allocation-failed-even-manually/245357 "2020-08-18T08:20:35Z")
Hey, a few weeks ago we hit the 10k shard limit in our cluster, the problem is solved now but since then we have problems with 256 replica shards which are unassigned. It is also not possible the reassign the shards, se… --- ## [DataTable visualization order by timestamp, desending](https://discuss.elastic.co/t/datatable-visualization-order-by-timestamp-desending/245068)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [August 18, 2020, 8:18am UTC](https://discuss.elastic.co/t/datatable-visualization-order-by-timestamp-desending/245068 "2020-08-18T08:18:36Z")
Hi, Im trying to order a data table visualization by timestamp,but always one row is misplaced, ( i solve this clicking in the arrow of the header of the row) and often I get missing rows when I compare it with discover. … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1858) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1860)