# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1877 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1878 --- ## [Transforms - are cumulative sums a possibility?](https://discuss.elastic.co/t/transforms-are-cumulative-sums-a-possibility/244426)
**Author:** [@Mark\_Duncan](https://discuss.elastic.co/u/Mark_Duncan)\ **Replies:** 1\ **Last updated:** [August 10, 2020, 3:30pm UTC](https://discuss.elastic.co/t/transforms-are-cumulative-sums-a-possibility/244426 "2020-08-10T15:30:07Z")
I would like to sum a metric over time using Transforms, i.e. a cumulative sum. Is this at all possible? Whilst you can plot a cumulative sum graph using the basic graphs in Kibana, it's cumulative over the date range s… --- ## [Kibana Role Mapping](https://discuss.elastic.co/t/kibana-role-mapping/244374)
**Author:** [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\ **Replies:** 3\ **Last updated:** [August 10, 2020, 3:27pm UTC](https://discuss.elastic.co/t/kibana-role-mapping/244374 "2020-08-10T15:27:21Z")
Hello All, I am trying to map a kibana role with active directory users. The ad users assigned to the role can see the index but cannot see any data within the index itself. I have mirrored a working role with the exac… --- ## [Zeek Filebeat Module - index is not populated](https://discuss.elastic.co/t/zeek-filebeat-module-index-is-not-populated/244430)
**Author:** [@ommneom](https://discuss.elastic.co/u/ommneom)\ **Replies:** 0\ **Last updated:** [August 10, 2020, 3:20pm UTC](https://discuss.elastic.co/t/zeek-filebeat-module-index-is-not-populated/244430 "2020-08-10T15:20:29Z")
Hello, I'm having trouble with what seems like a standard scenario and I can't figure out what I'm doing wrong. The setup : I installed Elasticsearch and Kibana (version 7.8.1 for both) on the same server. I kept the c… --- ## [Dropping empty buckets in TSVB visualization](https://discuss.elastic.co/t/dropping-empty-buckets-in-tsvb-visualization/244212)
**Author:** [@Goishin](https://discuss.elastic.co/u/Goishin)\ **Replies:** 1\ **Last updated:** [August 10, 2020, 3:26pm UTC](https://discuss.elastic.co/t/dropping-empty-buckets-in-tsvb-visualization/244212 "2020-08-10T15:26:45Z")
Hi all, I'm trying to plot a variety of metrics I just recently started capturing. These visualizations are using TSVB (and then within it, I'm selecting "Time Series"). Currently, my metrics are displayed using a SUM a… --- ## [Kibana UI search text for specific pattern](https://discuss.elastic.co/t/kibana-ui-search-text-for-specific-pattern/243369)
**Author:** [@dvanwesh](https://discuss.elastic.co/u/dvanwesh)\ **Replies:** 3\ **Last updated:** [August 10, 2020, 3:23pm UTC](https://discuss.elastic.co/t/kibana-ui-search-text-for-specific-pattern/243369 "2020-08-10T15:23:26Z")
I have log messages with below pattern user status for userId 1 change previous state x1 new state x2 where previous and new state are different user status for userId 2 change previous state x1 new state x1 where pr… --- ## [WARN in Logs: "cannot compute used memory / swap"](https://discuss.elastic.co/t/warn-in-logs-cannot-compute-used-memory-swap/244417)
**Author:** [@mfloryan](https://discuss.elastic.co/u/mfloryan)\ **Replies:** 1\ **Last updated:** [August 10, 2020, 3:19pm UTC](https://discuss.elastic.co/t/warn-in-logs-cannot-compute-used-memory-swap/244417 "2020-08-10T15:19:59Z")
Elasticsearch 7.8.1 installed on Debian 10 (buster) running on an OpenVZ host. It's a fresh install and the server has 8GB of memory. The logs are getting filled with the following two entires: cannot compute used mem… --- ## [Apply Fuzzy Search and Searching-with-without-spaces](https://discuss.elastic.co/t/apply-fuzzy-search-and-searching-with-without-spaces/242964)
**Author:** [@vinodthebest](https://discuss.elastic.co/u/vinodthebest)\ **Replies:** 2\ **Last updated:** [August 10, 2020, 3:19pm UTC](https://discuss.elastic.co/t/apply-fuzzy-search-and-searching-with-without-spaces/242964 "2020-08-10T15:19:46Z")
I am using Elasticsearch 7.4 and Spring boot 2.3.1 (Spring JPA Elasticsearch) would like to get the same results if the words have space or without space and would like to perform fuzzy search also for the same property. … --- ## [7.4.2 exclude\_files not workinig](https://discuss.elastic.co/t/7-4-2-exclude-files-not-workinig/244416)
**Author:** [@alces](https://discuss.elastic.co/u/alces)\ **Replies:** 1\ **Last updated:** [August 10, 2020, 2:59pm UTC](https://discuss.elastic.co/t/7-4-2-exclude-files-not-workinig/244416 "2020-08-10T14:59:54Z")
Hello, I'm running elk and beats at 7.4.2 and I'm having trouble with the "exclude\_files" config: Following are extractions of my filebeat.yml and my system.yml: filebeat.yml: filebeat.inputs: - type: log enabled: … --- ## [Whats the difference as well as the preferred way to?](https://discuss.elastic.co/t/whats-the-difference-as-well-as-the-preferred-way-to/244415)
**Author:** [@kopacko](https://discuss.elastic.co/u/kopacko)\ **Replies:** 2\ **Last updated:** [August 10, 2020, 2:55pm UTC](https://discuss.elastic.co/t/whats-the-difference-as-well-as-the-preferred-way-to/244415 "2020-08-10T14:55:36Z")
I am trying to update my Logstash configs to be the best they can be. If I am looking for a string within a field, which way is the "best" way, in terms of performance? Option #1 if \[message\] =~ /(?i)(QNAME)/ { Optio… --- ## [Help me to refine this query](https://discuss.elastic.co/t/help-me-to-refine-this-query/244023)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 4\ **Last updated:** [August 10, 2020, 1:37pm UTC](https://discuss.elastic.co/t/help-me-to-refine-this-query/244023 "2020-08-10T13:37:21Z")
Context: Logstash Elasticsearch Input plugin does not maintain a state like JDBC input plugin. However it does provide scheduling support. So I decided to pull data daily from the previous day records, e.g. from say 4t… --- ## [Logstash File input filter, ingest twice same file name](https://discuss.elastic.co/t/logstash-file-input-filter-ingest-twice-same-file-name/244385)
**Author:** [@nahiko2000](https://discuss.elastic.co/u/nahiko2000)\ **Replies:** 1\ **Last updated:** [August 10, 2020, 1:27pm UTC](https://discuss.elastic.co/t/logstash-file-input-filter-ingest-twice-same-file-name/244385 "2020-08-10T13:27:36Z")
Hi! Using Logstash File Input Filter, I will ingest text files (actually they will be .gz files) that are "finished" (I mean, they will not be written anymore) When ingest gets done, file must be automatically deleted … --- ## [Precedence of wildcard field boosts, for simple query string query](https://discuss.elastic.co/t/precedence-of-wildcard-field-boosts-for-simple-query-string-query/243592)
**Author:** [@SamyAteia](https://discuss.elastic.co/u/SamyAteia)\ **Replies:** 1\ **Last updated:** [August 10, 2020, 1:16pm UTC](https://discuss.elastic.co/t/precedence-of-wildcard-field-boosts-for-simple-query-string-query/243592 "2020-08-10T13:16:34Z")
Hi, we are using the simple query string query and want to set different boost depending on the field names. We have a lot of fields that end with e postfix such as "\_txt" and want the boost some fields such as "title\_d… --- ## [Basic authentication on ES helm chart](https://discuss.elastic.co/t/basic-authentication-on-es-helm-chart/244337)
**Author:** [@Harsh2](https://discuss.elastic.co/u/Harsh2)\ **Replies:** 8\ **Last updated:** [August 10, 2020, 1:10pm UTC](https://discuss.elastic.co/t/basic-authentication-on-es-helm-chart/244337 "2020-08-10T13:10:25Z")
i want setup basic authentication on helm cluster. helm ES chart using :https://github.com/elastic/helm-charts/tree/master/elasticsearch i am confuse about using setting parameters in elasticsearch.yaml right now i hav… --- ## [Cant see html format in my watcher's mail](https://discuss.elastic.co/t/cant-see-html-format-in-my-watchers-mail/244406)
**Author:** [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\ **Replies:** 0\ **Last updated:** [August 10, 2020, 1:06pm UTC](https://discuss.elastic.co/t/cant-see-html-format-in-my-watchers-mail/244406 "2020-08-10T13:06:08Z")
Hello, I have created an advanced watcher alert that works and has the following email section: "actions": { "send\_email": { "email": { "profile": "standard", "to": \[ "alexandros.ana… --- ## [A new field with a value from the difference between the two existing fields](https://discuss.elastic.co/t/a-new-field-with-a-value-from-the-difference-between-the-two-existing-fields/243670)
**Author:** [@Alex9](https://discuss.elastic.co/u/Alex9)\ **Replies:** 3\ **Last updated:** [August 10, 2020, 12:31pm UTC](https://discuss.elastic.co/t/a-new-field-with-a-value-from-the-difference-between-the-two-existing-fields/243670 "2020-08-10T12:31:55Z")
Hello. Please tell me the direction to the solution. There is a service that generates records. The values include: fields with a unique object id, a record of the object's action and time. Question: how to get new fi… --- ## [Multiline issue with filebeat](https://discuss.elastic.co/t/multiline-issue-with-filebeat/242234)
**Author:** [@bryand](https://discuss.elastic.co/u/bryand)\ **Replies:** 6\ **Last updated:** [August 10, 2020, 12:29pm UTC](https://discuss.elastic.co/t/multiline-issue-with-filebeat/242234 "2020-08-10T12:29:42Z")
Hi, I'm having issues with trying to aggregate java exceptions into a single message using the filebeat multiline support. From everything I've read this should be very simple, yet, no matter what I try, it doesn't wor… --- ## [Logstash move subfield to top field](https://discuss.elastic.co/t/logstash-move-subfield-to-top-field/244309)
**Author:** [@gbasic](https://discuss.elastic.co/u/gbasic)\ **Replies:** 6\ **Last updated:** [August 10, 2020, 11:52am UTC](https://discuss.elastic.co/t/logstash-move-subfield-to-top-field/244309 "2020-08-10T11:52:09Z")
"\_score" : 1.0, "\_source" : { "Europe" : { "DateTime" : { "Date" : "08.08.2020", "Time" : "15" }, "City" : \[ { … --- ## [Return documents that match a minimal number of words in the same sentence](https://discuss.elastic.co/t/return-documents-that-match-a-minimal-number-of-words-in-the-same-sentence/243848)
**Author:** [@flm](https://discuss.elastic.co/u/flm)\ **Replies:** 2\ **Last updated:** [August 10, 2020, 11:08am UTC](https://discuss.elastic.co/t/return-documents-that-match-a-minimal-number-of-words-in-the-same-sentence/243848 "2020-08-10T11:08:16Z")
I need to return documents that match at least N words in the same sentence. I split my documents per sentence and index each one as a separate value like so: PUT /test\_index/\_doc/id1 { "texts": \[ "Your first… --- ## [Miss the field winlog.keywords in ForwardedEvents event\_logs](https://discuss.elastic.co/t/miss-the-field-winlog-keywords-in-forwardedevents-event-logs/244373)
**Author:** [@Lehugo](https://discuss.elastic.co/u/Lehugo)\ **Replies:** 1\ **Last updated:** [August 10, 2020, 10:11am UTC](https://discuss.elastic.co/t/miss-the-field-winlog-keywords-in-forwardedevents-event-logs/244373 "2020-08-10T10:11:04Z")
all the security Events have the the field winlog.keywords but ForwardedEvents don't Forward it. How can i configure the winlogbeat.yml file that the ForwardedEvents fordward the field winlog.keywords ? https://www.ela… --- ## [Logstash to elasticsearch](https://discuss.elastic.co/t/logstash-to-elasticsearch/244306)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 6\ **Last updated:** [August 10, 2020, 9:52am UTC](https://discuss.elastic.co/t/logstash-to-elasticsearch/244306 "2020-08-10T09:52:47Z")
I think logstash is having trouble sending data to elasticsearch. To secure beats communications, I've set elasticsearch to use https. I think because of that logstash is having some trouble sending data to elasticsearc… --- ## [ES master nodes CPU usage decrease over time and became red nodes](https://discuss.elastic.co/t/es-master-nodes-cpu-usage-decrease-over-time-and-became-red-nodes/244366)
**Author:** [@Zeroc0pter](https://discuss.elastic.co/u/Zeroc0pter)\ **Replies:** 2\ **Last updated:** [August 10, 2020, 9:28am UTC](https://discuss.elastic.co/t/es-master-nodes-cpu-usage-decrease-over-time-and-became-red-nodes/244366 "2020-08-10T09:28:34Z")
Hi People, We have issues with our ElasticSearch cluster. Somehow, the CPU usage of the master nodes decreases over time (couple of days) and then crashes the cluster's state. A screenshot of the CPU usage of Master 1: … --- ## [Errors in kibana messages](https://discuss.elastic.co/t/errors-in-kibana-messages/244312)
**Author:** [@Shivam123](https://discuss.elastic.co/u/Shivam123)\ **Replies:** 3\ **Last updated:** [August 10, 2020, 9:09am UTC](https://discuss.elastic.co/t/errors-in-kibana-messages/244312 "2020-08-10T09:09:49Z")
Hi am getting below message in kibana. Please suggest message: �����\\�0 --- ## [elasticsearch.exceptions.RequestError: TransportError(400, 'illegal\_argument\_exception', 'Rejecting mapping update to \[sg\_index\_checker\_progress\] as the final mapping would have more than 1 type: \[\_doc, sg\_index\_checker\_progress\]')](https://discuss.elastic.co/t/elasticsearch-exceptions-requesterror-transporterror-400-illegal-argument-exception-rejecting-mapping-update-to-sg-index-checker-progress-as-the-final-mapping-would-have-more-than-1-type-doc-sg-index-checker-progress/244364)
**Author:** [@samandhare](https://discuss.elastic.co/u/samandhare)\ **Replies:** 1\ **Last updated:** [August 10, 2020, 8:51am UTC](https://discuss.elastic.co/t/elasticsearch-exceptions-requesterror-transporterror-400-illegal-argument-exception-rejecting-mapping-update-to-sg-index-checker-progress-as-the-final-mapping-would-have-more-than-1-type-doc-sg-index-checker-progress/244364 "2020-08-10T08:51:26Z")
Hi All, I am getting this error on elastic search. Could you please help me here.! Thanks in advance Loading articles from Springer API(Eddie) into sg\_index\_checker Processing dates 2020-01-01 00:00:00 - 2020-08-11 0… --- ## [X-Path Wildcard](https://discuss.elastic.co/t/x-path-wildcard/244352)
**Author:** [@bevano](https://discuss.elastic.co/u/bevano)\ **Replies:** 3\ **Last updated:** [August 10, 2020, 8:48am UTC](https://discuss.elastic.co/t/x-path-wildcard/244352 "2020-08-10T08:48:48Z")
Hey, Was wondering whether someone could help me with the following xpaths since I dont have much experience. I am trying to get the value of /eCloud1/CloudMsg/\*/name() but this field can be 16 different values. I don't… --- ## [Grant access to Stack Monitoring tab - Role](https://discuss.elastic.co/t/grant-access-to-stack-monitoring-tab-role/244190)
**Author:** [@Thomas74](https://discuss.elastic.co/u/Thomas74)\ **Replies:** 5\ **Last updated:** [August 10, 2020, 8:37am UTC](https://discuss.elastic.co/t/grant-access-to-stack-monitoring-tab-role/244190 "2020-08-10T08:37:46Z")
Hi, How can I grant access to Stack Monitoring in Kibana to a user ? I already tried to add "monitoring\_user" and "kibana\_user" to user but it doesn't work.. Maybe it's linked to my roles access. Best regards, Thoma… --- ## [Delete by query api - \[FORBIDDEN/8/index write (api)\]](https://discuss.elastic.co/t/delete-by-query-api-forbidden-8-index-write-api/244188)
**Author:** [@Angelos](https://discuss.elastic.co/u/Angelos)\ **Replies:** 2\ **Last updated:** [August 10, 2020, 8:35am UTC](https://discuss.elastic.co/t/delete-by-query-api-forbidden-8-index-write-api/244188 "2020-08-10T08:35:11Z")
Hello, The version of our Elasticsearch is: 7.8 (Platinum) I tried to delete some indices by using delete\_by\_query and I have the following error. "type" : "cluster\_block\_exception", "reason" : "index \[shrin… --- ## [Rally stalls when I try to benchmark Elasticsearch cluster](https://discuss.elastic.co/t/rally-stalls-when-i-try-to-benchmark-elasticsearch-cluster/243262)
**Author:** [@Akshay\_Raj1](https://discuss.elastic.co/u/Akshay_Raj1)\ **Replies:** 3\ **Last updated:** [August 10, 2020, 8:32am UTC](https://discuss.elastic.co/t/rally-stalls-when-i-try-to-benchmark-elasticsearch-cluster/243262 "2020-08-10T08:32:38Z")
Here are the details: \[rally1@rally ~\]$ python3 --version Python 3.6.8 \[rally1@rally ~\]$ java -version openjdk version "14.0.2" 2020-07-14 OpenJDK Runtime Environment (build 14.0.2+12-46) OpenJDK 64-Bit Server VM (build… --- ## [Indexer failures - ES rejected execution exception](https://discuss.elastic.co/t/indexer-failures-es-rejected-execution-exception/242805)
**Author:** [@Tafsir\_Alam](https://discuss.elastic.co/u/Tafsir_Alam)\ **Replies:** 9\ **Last updated:** [August 10, 2020, 8:25am UTC](https://discuss.elastic.co/t/indexer-failures-es-rejected-execution-exception/242805 "2020-08-10T08:25:21Z")
Hi, I am continuously getting Indexer failures errors on my Graylog web-UI console. This is the error: {"type":"es\_rejected\_execution\_exception","reason":"rejected execution of processing of \[1574940\]\[indices:data/writ… --- ## [Add User Beats not Create index](https://discuss.elastic.co/t/add-user-beats-not-create-index/244363)
**Author:** [@nurhambali](https://discuss.elastic.co/u/nurhambali)\ **Replies:** 0\ **Last updated:** [August 10, 2020, 8:13am UTC](https://discuss.elastic.co/t/add-user-beats-not-create-index/244363 "2020-08-10T08:13:49Z")
hi, i try add user beats with privilage setup and create index but the moment, I privilege winlogbeat indices - \* it can't create indices but if I use indices the user beats can create indices winlogbeat-\* \[\*\] … --- ## [Searching ES regex with space/colon/hypen etc](https://discuss.elastic.co/t/searching-es-regex-with-space-colon-hypen-etc/243478)
**Author:** [@Shachar0n](https://discuss.elastic.co/u/Shachar0n)\ **Replies:** 2\ **Last updated:** [August 10, 2020, 7:38am UTC](https://discuss.elastic.co/t/searching-es-regex-with-space-colon-hypen-etc/243478 "2020-08-10T07:38:43Z")
Hi, I am trying to find the way to search in our ES cluster for a substring contained within a doc field's string (where this substring may contain space, for example, as well as may contains a colon, hyphen, etc.). I … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1876) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1878)