# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1909 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1910 --- ## [How to create key value from Nested fields](https://discuss.elastic.co/t/how-to-create-key-value-from-nested-fields/242084)
**Author:** [@Ramalakshmi](https://discuss.elastic.co/u/Ramalakshmi)\ **Replies:** 12\ **Last updated:** [July 23, 2020, 6:52pm UTC](https://discuss.elastic.co/t/how-to-create-key-value-from-nested-fields/242084 "2020-07-23T18:52:30Z")
Hi, I am getting json data in kibana. The data having nested fields like aws.datasource.resource.instanceDetails.tags { "key": "Environment", "value": "true" }, { "key": "nga", "… --- ## [Steps to change elastic password](https://discuss.elastic.co/t/steps-to-change-elastic-password/242374)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 2\ **Last updated:** [July 23, 2020, 6:43pm UTC](https://discuss.elastic.co/t/steps-to-change-elastic-password/242374 "2020-07-23T18:43:20Z")
I try changing password for user elastic. I had many pipeline running and they all use this password. this is what I did and it starting giving me lot of error in logstash. is there step I missed? stop logstash went … --- ## [Creating/Manipulating Histograms in Scripts](https://discuss.elastic.co/t/creating-manipulating-histograms-in-scripts/242390)
**Author:** [@micah.williamson](https://discuss.elastic.co/u/micah.williamson)\ **Replies:** 0\ **Last updated:** [July 23, 2020, 6:43pm UTC](https://discuss.elastic.co/t/creating-manipulating-histograms-in-scripts/242390 "2020-07-23T18:43:07Z")
I want to store a histogram in elasticsearch but I'm having trouble finding an example of a way to do this via script. The histogram buckets will be values 0-23, and I need to be able to increment buckets individually vi… --- ## [Date range filter using strict\_date\_time\_no\_millis format failing](https://discuss.elastic.co/t/date-range-filter-using-strict-date-time-no-millis-format-failing/242255)
**Author:** [@russinholi](https://discuss.elastic.co/u/russinholi)\ **Replies:** 3\ **Last updated:** [July 23, 2020, 5:10pm UTC](https://discuss.elastic.co/t/date-range-filter-using-strict-date-time-no-millis-format-failing/242255 "2020-07-23T17:10:23Z")
Hi all, I'm porting a query of an old app we have, from ES2.0 to ES7.8, and I'm getting this error: failed to parse date field \[2020-07-23T02:59:59+0000\] with format \[strict\_date\_time\_no\_millis\] while running a query w… --- ## [Watches index is missing in 7.6](https://discuss.elastic.co/t/watches-index-is-missing-in-7-6/240206)
**Author:** [@srk1](https://discuss.elastic.co/u/srk1)\ **Replies:** 2\ **Last updated:** [July 23, 2020, 4:41pm UTC](https://discuss.elastic.co/t/watches-index-is-missing-in-7-6/240206 "2020-07-23T16:41:52Z")
Hi Elastic team, Watches index is missing all of a sudden and unable to locate all the previously located watches. After the cluster restart i can see the .watches index combing back but i can only find the ES monitored… --- ## [Documentation page for ESSingleNodeTestCase in 7.8](https://discuss.elastic.co/t/documentation-page-for-essinglenodetestcase-in-7-8/242373)
**Author:** [@Deb](https://discuss.elastic.co/u/Deb)\ **Replies:** 0\ **Last updated:** [July 23, 2020, 4:36pm UTC](https://discuss.elastic.co/t/documentation-page-for-essinglenodetestcase-in-7-8/242373 "2020-07-23T16:36:10Z")
Hi Can someone let me know where is the documentation for ESSingleNodeTestCase for the latest elasticsearch? The page below seems to have been deleted https://www.elastic.co/guide/en/elasticsearch/reference/current/uni… --- ## [Parallel search after](https://discuss.elastic.co/t/parallel-search-after/241777)
**Author:** [@liron\_gofberg](https://discuss.elastic.co/u/liron_gofberg)\ **Replies:** 2\ **Last updated:** [July 23, 2020, 4:35pm UTC](https://discuss.elastic.co/t/parallel-search-after/241777 "2020-07-23T16:35:54Z")
Hi, How can search after can be parallel if results from the previous page help the retrieval of the next page? but I can see in the documentation that it is parallel thanks, Liron --- ## [Removing "winlog" prefix in winlogbeat](https://discuss.elastic.co/t/removing-winlog-prefix-in-winlogbeat/242344)
**Author:** [@ssiws](https://discuss.elastic.co/u/ssiws)\ **Replies:** 0\ **Last updated:** [July 23, 2020, 1:31pm UTC](https://discuss.elastic.co/t/removing-winlog-prefix-in-winlogbeat/242344 "2020-07-23T13:31:34Z")
Hello, I'm upgrading winlogbeat 5.4.1 to 7.8.0. I saw that some fields are now prefixed by "winlog" (example: event\_id became winlog\_event\_id). Is there a setting, or is it possible to add rule to remove this prefix ? … --- ## [Logstash not saving additional fields](https://discuss.elastic.co/t/logstash-not-saving-additional-fields/242220)
**Author:** [@tomba2k](https://discuss.elastic.co/u/tomba2k)\ **Replies:** 6\ **Last updated:** [July 23, 2020, 4:26pm UTC](https://discuss.elastic.co/t/logstash-not-saving-additional-fields/242220 "2020-07-23T16:26:14Z")
On working elastic stack I'm trying to send mysql slowlog to OSS elasticsearch cluster. Data is saved to ES, including \[event\]\[dataset\] for example, but everything under \[mysql\]\[slowlog\] or even \[mysql\] arrays is being … --- ## [Vega Brush zoom doesn't work](https://discuss.elastic.co/t/vega-brush-zoom-doesnt-work/242291)
**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\ **Replies:** 2\ **Last updated:** [July 23, 2020, 3:58pm UTC](https://discuss.elastic.co/t/vega-brush-zoom-doesnt-work/242291 "2020-07-23T15:58:35Z")
Hi, I am trying to create an interactive vega graph which is zoomable. I have the brush and everything but it doesn't zoom in on the other graph. I oriented myself on this. My vega code: { "$schema": "https://vega.… --- ## [How to de-duplicate results in Kibana Search](https://discuss.elastic.co/t/how-to-de-duplicate-results-in-kibana-search/242193)
**Author:** [@sxddhxrthx](https://discuss.elastic.co/u/sxddhxrthx)\ **Replies:** 1\ **Last updated:** [July 23, 2020, 3:31pm UTC](https://discuss.elastic.co/t/how-to-de-duplicate-results-in-kibana-search/242193 "2020-07-23T15:31:08Z")
I am trying to build dashboards using Shakespeare play data. on searching play\_name:\* in kql search box I am getting play names all the time they are indexed. I want to display one play names only once Any help how c… --- ## [Field access in filter script](https://discuss.elastic.co/t/field-access-in-filter-script/242354)
**Author:** [@tudro](https://discuss.elastic.co/u/tudro)\ **Replies:** 0\ **Last updated:** [July 23, 2020, 2:22pm UTC](https://discuss.elastic.co/t/field-access-in-filter-script/242354 "2020-07-23T14:22:22Z")
Hello, I have a mapping like this "user": { "mappings": { "properties": { "profile": { "properties": { "cars": {...} }}}}} I am trying t… --- ## [Count of nested documents by aggregation](https://discuss.elastic.co/t/count-of-nested-documents-by-aggregation/242362)
**Author:** [@Divyanshu\_Tyagi](https://discuss.elastic.co/u/Divyanshu_Tyagi)\ **Replies:** 0\ **Last updated:** [July 23, 2020, 3:24pm UTC](https://discuss.elastic.co/t/count-of-nested-documents-by-aggregation/242362 "2020-07-23T15:24:02Z")
I have 2 level of nesting in my mapping: business -\> funds -\> admins/market I want count of f\_id's that matches with particular admin\_name ES MAPPING { "text\_index" : { "mappings" : { "prop… --- ## [Logstash relay](https://discuss.elastic.co/t/logstash-relay/242100)
**Author:** [@mariof](https://discuss.elastic.co/u/mariof)\ **Replies:** 6\ **Last updated:** [July 23, 2020, 3:21pm UTC](https://discuss.elastic.co/t/logstash-relay/242100 "2020-07-23T15:21:25Z")
i'm interested in setting up a logstash relay. i need to be able to listen for syslog and forward the messages via at least one other logstash server before hitting a group of logstash servers. do you think this is poss… --- ## [Cannot select index pattern having geo\_point field when creating map layer](https://discuss.elastic.co/t/cannot-select-index-pattern-having-geo-point-field-when-creating-map-layer/241910)
**Author:** [@mattiapdo](https://discuss.elastic.co/u/mattiapdo)\ **Replies:** 9\ **Last updated:** [July 23, 2020, 3:08pm UTC](https://discuss.elastic.co/t/cannot-select-index-pattern-having-geo-point-field-when-creating-map-layer/241910 "2020-07-23T15:08:28Z")
Hi there, I'm having troubles adding a new level creating a map in Kibana 7.6.1. I have two index patterns: index\_pat-\* and index\_pat-x-\*, both containing at least one field of type geo\_point named geoSensor.geoPoint. … --- ## [Metricbeat 7.8 only listing one drive](https://discuss.elastic.co/t/metricbeat-7-8-only-listing-one-drive/242360)
**Author:** [@prophoto](https://discuss.elastic.co/u/prophoto)\ **Replies:** 0\ **Last updated:** [July 23, 2020, 2:56pm UTC](https://discuss.elastic.co/t/metricbeat-7-8-only-listing-one-drive/242360 "2020-07-23T14:56:20Z")
I am running Metricbeat 7.8 on CentOS 7. Only one drive is showing in Kibana. \[centos@server9 modules.d\]$ df -h Filesystem Size Used Avail Use% Mounted on /dev/xvda1 … --- ## [Partial phrase or exact phrase matching](https://discuss.elastic.co/t/partial-phrase-or-exact-phrase-matching/242320)
**Author:** [@bradconor](https://discuss.elastic.co/u/bradconor)\ **Replies:** 9\ **Last updated:** [July 23, 2020, 2:53pm UTC](https://discuss.elastic.co/t/partial-phrase-or-exact-phrase-matching/242320 "2020-07-23T14:53:56Z")
Hi there, I am new to elasticsearch and I want to search for a phrase. Suppose I query with this phrase : i am new to elasticsearch And I have some data like new to elasticsearch I have tried with match\_phrase but … --- ## [Logstash Error: Unrecognized SSL message, plaintext connection?](https://discuss.elastic.co/t/logstash-error-unrecognized-ssl-message-plaintext-connection/242356)
**Author:** [@Marios\_Karatisoglou](https://discuss.elastic.co/u/Marios_Karatisoglou)\ **Replies:** 0\ **Last updated:** [July 23, 2020, 2:42pm UTC](https://discuss.elastic.co/t/logstash-error-unrecognized-ssl-message-plaintext-connection/242356 "2020-07-23T14:42:01Z")
Hello community, I use Logstash in centos 7 and when I start it, it gives the following error \*\*\[2020-07-23T10:37:01,699\]\[INFO \]\[logstash.runner \] Starting Logstash {"logstash.version"=\>"6.8.10"}\*\* \*\*\[2020… --- ## [Embed Kibana Log Stream Widget to Web page](https://discuss.elastic.co/t/embed-kibana-log-stream-widget-to-web-page/242348)
**Author:** [@Istvan\_Romhany](https://discuss.elastic.co/u/Istvan_Romhany)\ **Replies:** 1\ **Last updated:** [July 23, 2020, 2:12pm UTC](https://discuss.elastic.co/t/embed-kibana-log-stream-widget-to-web-page/242348 "2020-07-23T14:12:46Z")
Hello! I am new to the ELK stack, it's awesome, but for our use case we need just the Log Stream page of kibana (/app/logs/stream) and we need to embed it into our own web application. I see that we could utilize ifram… --- ## [Serch text with special character](https://discuss.elastic.co/t/serch-text-with-special-character/242040)
**Author:** [@Katia](https://discuss.elastic.co/u/Katia)\ **Replies:** 9\ **Last updated:** [July 23, 2020, 1:38pm UTC](https://discuss.elastic.co/t/serch-text-with-special-character/242040 "2020-07-23T13:38:56Z")
I really need help. I indexed my data using logstash. The data is as follows: 20200807 00:10:02.934 Mes émis à l'appli Hôte 3 3 -1 The issue is that, I need to search "3 3-1", but it seems that the caracter "-" cau… --- ## [Download new version of filebeat](https://discuss.elastic.co/t/download-new-version-of-filebeat/241607)
**Author:** [@JoseSaborido](https://discuss.elastic.co/u/JoseSaborido)\ **Replies:** 8\ **Last updated:** [July 23, 2020, 1:25pm UTC](https://discuss.elastic.co/t/download-new-version-of-filebeat/241607 "2020-07-23T13:25:04Z")
Hi! I've been trying to configure filebeat to create an index every day but it seems to be impossible. I have seen this issue https://github.com/elastic/beats/issues/11595 So I have been trying to download the version … --- ## [Query with more than one field](https://discuss.elastic.co/t/query-with-more-than-one-field/241509)
**Author:** [@schneider](https://discuss.elastic.co/u/schneider)\ **Replies:** 7\ **Last updated:** [July 23, 2020, 12:50pm UTC](https://discuss.elastic.co/t/query-with-more-than-one-field/241509 "2020-07-23T12:50:34Z")
Hello, i want the data witch : field "transacao" = " QuarantineTransac" and the field "assunto" = "qualquerassunto", but is retrieving data witch one OR another no the 2 at the same time { "query": { "boo… --- ## [Config Elasticsearch for a headless system](https://discuss.elastic.co/t/config-elasticsearch-for-a-headless-system/242312)
**Author:** [@Peter\_Boos](https://discuss.elastic.co/u/Peter_Boos)\ **Replies:** 3\ **Last updated:** [July 23, 2020, 12:36pm UTC](https://discuss.elastic.co/t/config-elasticsearch-for-a-headless-system/242312 "2020-07-23T12:36:26Z")
I'm (trying) to run ELK on a headless console only system. So far it only says: Kibana server is not ready yet through a ssh i can see the tail -f /var/log/syslog Logging this error which is a bit long oneliner : … --- ## [Disable Kibana info (Dismiss)](https://discuss.elastic.co/t/disable-kibana-info-dismiss/242145)
**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\ **Replies:** 1\ **Last updated:** [July 23, 2020, 12:29pm UTC](https://discuss.elastic.co/t/disable-kibana-info-dismiss/242145 "2020-07-23T12:29:34Z")
Hello, It is possible to disable permanently information messages on Kibana (currently, we must click on dismiss button). Thanks for reply. Rosm --- ## ["statusCode":500 when going to localhost:5601](https://discuss.elastic.co/t/statuscode-500-when-going-to-localhost-5601/242017)
**Author:** [@eslepakurov](https://discuss.elastic.co/u/eslepakurov)\ **Replies:** 1\ **Last updated:** [July 23, 2020, 12:11pm UTC](https://discuss.elastic.co/t/statuscode-500-when-going-to-localhost-5601/242017 "2020-07-23T12:11:55Z")
Hi, I've installed everything like here https://www.youtube.com/watch?v=FImTcHECpC0 When I paste http://localhost:5601/ to browser, {"statusCode":500,"error":"Internal Server Error","message":"An internal server error o… --- ## [Elastic search cluster](https://discuss.elastic.co/t/elastic-search-cluster/242334)
**Author:** [@Pradeep\_K\_S](https://discuss.elastic.co/u/Pradeep_K_S)\ **Replies:** 3\ **Last updated:** [July 23, 2020, 12:09pm UTC](https://discuss.elastic.co/t/elastic-search-cluster/242334 "2020-07-23T12:09:03Z")
Hi, I am not sure where exactly i can find the Elastic search logs, if any node failure or cluster is red. Also can i get information where ES index schema will be stored? is it in nodes or client/master instance? Than… --- ## [Found encoding issue with Filebeat MS SQL module](https://discuss.elastic.co/t/found-encoding-issue-with-filebeat-ms-sql-module/242336)
**Author:** [@varun1992](https://discuss.elastic.co/u/varun1992)\ **Replies:** 0\ **Last updated:** [July 23, 2020, 11:39am UTC](https://discuss.elastic.co/t/found-encoding-issue-with-filebeat-ms-sql-module/242336 "2020-07-23T11:39:25Z")
Filebeat MS SQL module has a encoding issue ERRORLOG files in SQL folder is a utf-16le-bom encoded files but that is not specified in the config.yml file of the filebeat mssql module folder please add encoding: utf… --- ## [Failed to create shard, failure IOException\[failed to obtain in-memory shard lock\]](https://discuss.elastic.co/t/failed-to-create-shard-failure-ioexception-failed-to-obtain-in-memory-shard-lock/242323)
**Author:** [@AaronSarkissian](https://discuss.elastic.co/u/AaronSarkissian)\ **Replies:** 10\ **Last updated:** [July 23, 2020, 11:31am UTC](https://discuss.elastic.co/t/failed-to-create-shard-failure-ioexception-failed-to-obtain-in-memory-shard-lock/242323 "2020-07-23T11:31:58Z")
My cluster setup is 2 nodes, both docker based on different VMs in the same network. My cluster health becomes yellow after few hours it start to get unassigned status one by one, till after a day all the replica shards… --- ## [Point to Point between geopoints](https://discuss.elastic.co/t/point-to-point-between-geopoints/242319)
**Author:** [@kibana2](https://discuss.elastic.co/u/kibana2)\ **Replies:** 2\ **Last updated:** [July 23, 2020, 11:30am UTC](https://discuss.elastic.co/t/point-to-point-between-geopoints/242319 "2020-07-23T11:30:24Z")
I would like to draw lines connecting a series of geopoints. I have given each one a source and destination geopoint (the source of each is its own location and the destination of each is the location of the next geopoin… --- ## [Obtain Search Results from Multiple Documents of Same Index](https://discuss.elastic.co/t/obtain-search-results-from-multiple-documents-of-same-index/242332)
**Author:** [@ShashikanthKomandoor](https://discuss.elastic.co/u/ShashikanthKomandoor)\ **Replies:** 0\ **Last updated:** [July 23, 2020, 11:14am UTC](https://discuss.elastic.co/t/obtain-search-results-from-multiple-documents-of-same-index/242332 "2020-07-23T11:14:03Z")
Hi Team, I have setup almost 15 relay MTAs for relaying my mails. And I am pushing the /var/log/maillog to ELK Stack. I was able to use the grok filters and create the indices, documents, fields and so and also I am ab… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1908) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1910)