# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1919 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1920 --- ## [Kibana Vega bubble chart not working](https://discuss.elastic.co/t/kibana-vega-bubble-chart-not-working/241786)
**Author:** [@BayMax\_07](https://discuss.elastic.co/u/BayMax_07)\ **Replies:** 2\ **Last updated:** [July 19, 2020, 11:55am UTC](https://discuss.elastic.co/t/kibana-vega-bubble-chart-not-working/241786 "2020-07-19T11:55:25Z")
I have field in index and trying to make a scatter chart out of it. But it's showing only axis. { $schema: https://vega.github.io/schema/vega-lite/v2.json mark: point data: { url: { %context%: true %timefield%: @t… --- ## [Unable to use kafka input with SASL\_SSL](https://discuss.elastic.co/t/unable-to-use-kafka-input-with-sasl-ssl/241785)
**Author:** [@madhu72](https://discuss.elastic.co/u/madhu72)\ **Replies:** 0\ **Last updated:** [July 19, 2020, 11:52am UTC](https://discuss.elastic.co/t/unable-to-use-kafka-input-with-sasl-ssl/241785 "2020-07-19T11:52:50Z")
I dont see any incoming data from Kafka to Kibana thru Logstash. I configured everything, and noticed that, it have security.protocol = PLAINTEXT even I configured SASL\_SSL. input { kafka { sasl\_mechanism =\> "SCRAM-S… --- ## [Kibana 7.8 won't start](https://discuss.elastic.co/t/kibana-7-8-wont-start/241336)
**Author:** [@Amphagory](https://discuss.elastic.co/u/Amphagory)\ **Replies:** 4\ **Last updated:** [July 19, 2020, 11:49am UTC](https://discuss.elastic.co/t/kibana-7-8-wont-start/241336 "2020-07-19T11:49:43Z")
Hello, I seen similar issues to mine on this forum and other sites (i.e. stack overflow), but no concrete solution. I thought I would post it again and see if someone has a solution now. I am unable to start Kibana: A… --- ## [Error connecting to Kibana: fail to get the Kibana version](https://discuss.elastic.co/t/error-connecting-to-kibana-fail-to-get-the-kibana-version/241747)
**Author:** [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\ **Replies:** 0\ **Last updated:** [July 18, 2020, 3:48pm UTC](https://discuss.elastic.co/t/error-connecting-to-kibana-fail-to-get-the-kibana-version/241747 "2020-07-18T15:48:03Z")
I have elasticsearch and kibana setup in my kubernetes cluster using ECK. I'm also trying to get filebeat setup. Im having trouble with getting filebeat to connect to kibana. in the filebeat logs i can see the following … --- ## [Logstash multiple pipeline on docker](https://discuss.elastic.co/t/logstash-multiple-pipeline-on-docker/241301)
**Author:** [@Abolurah](https://discuss.elastic.co/u/Abolurah)\ **Replies:** 4\ **Last updated:** [July 19, 2020, 9:09am UTC](https://discuss.elastic.co/t/logstash-multiple-pipeline-on-docker/241301 "2020-07-19T09:09:05Z")
Hi All I'm trying to build logstash on docker with multiple pipelines. After reading a lot over the internet and trying things, still can't start multiple pipelines on docker. I'm trying to run some basic configuratio… --- ## [Metricbeat beat module works for metricbeat but not for filebeat](https://discuss.elastic.co/t/metricbeat-beat-module-works-for-metricbeat-but-not-for-filebeat/239376)
**Author:** [@eyesmoker](https://discuss.elastic.co/u/eyesmoker)\ **Replies:** 1\ **Last updated:** [July 19, 2020, 7:16am UTC](https://discuss.elastic.co/t/metricbeat-beat-module-works-for-metricbeat-but-not-for-filebeat/239376 "2020-07-19T07:16:11Z")
I have this configuration for metricbeat beat module. It shows up absolutely fine on the kibana. metricbeat.autodiscover: providers: - type: kubernetes templates: - condition: … --- ## [Salvage data from a single node that once belonged to a cluster](https://discuss.elastic.co/t/salvage-data-from-a-single-node-that-once-belonged-to-a-cluster/241738)
**Author:** [@yk928](https://discuss.elastic.co/u/yk928)\ **Replies:** 9\ **Last updated:** [July 18, 2020, 1:19pm UTC](https://discuss.elastic.co/t/salvage-data-from-a-single-node-that-once-belonged-to-a-cluster/241738 "2020-07-18T13:19:35Z")
I had an ES cluster of several nodes (let's say es1, es2, ...), and I have a disk snapshot from a certain point in the past, of the disk of a single ES node (i.e. es1). I'd like to dump all the data from this es1's back… --- ## [TAB in grok filter and delete mismatched records](https://discuss.elastic.co/t/tab-in-grok-filter-and-delete-mismatched-records/241767)
**Author:** [@merlock](https://discuss.elastic.co/u/merlock)\ **Replies:** 2\ **Last updated:** [July 19, 2020, 5:49am UTC](https://discuss.elastic.co/t/tab-in-grok-filter-and-delete-mismatched-records/241767 "2020-07-19T05:49:06Z")
hi all, (sorry for my english) hello everyone I have the following problem, the log I'm trying to read comes with tabs and I can't filter correctly. I have tried several options but I cannot read it correctly 100% this… --- ## [Discover now shows fields which have no field value](https://discuss.elastic.co/t/discover-now-shows-fields-which-have-no-field-value/241736)
**Author:** [@Mitchell\_Davis](https://discuss.elastic.co/u/Mitchell_Davis)\ **Replies:** 2\ **Last updated:** [July 19, 2020, 3:30am UTC](https://discuss.elastic.co/t/discover-now-shows-fields-which-have-no-field-value/241736 "2020-07-19T03:30:39Z")
With the latest release I'm noticing that the Kibana 'Discover' view now shows all fields regardless if they have a value. This makes looking through documents extremely cumbersome, is there a legitimate reason why this… --- ## [Could not activate monitoring in kibana](https://discuss.elastic.co/t/could-not-activate-monitoring-in-kibana/241755)
**Author:** [@Shubham\_Mittal](https://discuss.elastic.co/u/Shubham_Mittal)\ **Replies:** 1\ **Last updated:** [July 18, 2020, 11:12pm UTC](https://discuss.elastic.co/t/could-not-activate-monitoring-in-kibana/241755 "2020-07-18T23:12:23Z")
I have 3 nodes as both master and data nodes and 1 dedicated data node and 1 dedicated client node in the elasticsearch cluster. I have done the required settings in elasticsearch.yml files of each node. One of those se… --- ## [Logstash Input from Firestore (Firebase) to Elasticsearch](https://discuss.elastic.co/t/logstash-input-from-firestore-firebase-to-elasticsearch/241764)
**Author:** [@estack](https://discuss.elastic.co/u/estack)\ **Replies:** 0\ **Last updated:** [July 18, 2020, 10:18pm UTC](https://discuss.elastic.co/t/logstash-input-from-firestore-firebase-to-elasticsearch/241764 "2020-07-18T22:18:48Z")
Hi Guys, I have tried to implement a logstash config by installing a custom logstash input from the link below: I have made necessary configs, but getting below error: \]\[FATAL\]\[logstash.runner \] An unexpe… --- ## [Master not discovered/elected after making changes to docker-compose.yml](https://discuss.elastic.co/t/master-not-discovered-elected-after-making-changes-to-docker-compose-yml/241495)
**Author:** [@matt-m](https://discuss.elastic.co/u/matt-m)\ **Replies:** 7\ **Last updated:** [July 18, 2020, 10:07pm UTC](https://discuss.elastic.co/t/master-not-discovered-elected-after-making-changes-to-docker-compose-yml/241495 "2020-07-18T22:07:57Z")
Hello, I've got a 3 node ES cluster running alongside Kibana as part of a docker-compose file. My compose file is below: version: '2.2' services: es01: image: docker.elastic.co/elasticsearch/elast… --- ## [Managing an arbitrary number of pipelines](https://discuss.elastic.co/t/managing-an-arbitrary-number-of-pipelines/241745)
**Author:** [@Sean.Lim](https://discuss.elastic.co/u/Sean.Lim)\ **Replies:** 1\ **Last updated:** [July 18, 2020, 5:58pm UTC](https://discuss.elastic.co/t/managing-an-arbitrary-number-of-pipelines/241745 "2020-07-18T17:58:29Z")
I am working on a project with these requirements: Each event contains a field identifying the syslog server to send the output to. Transport failure to any server should not block output to other servers. From requir… --- ## [Insufficient History for prediction](https://discuss.elastic.co/t/insufficient-history-for-prediction/241711)
**Author:** [@Shubhangi](https://discuss.elastic.co/u/Shubhangi)\ **Replies:** 3\ **Last updated:** [July 18, 2020, 5:53pm UTC](https://discuss.elastic.co/t/insufficient-history-for-prediction/241711 "2020-07-18T17:53:29Z")
Hi, I'm using Elastic ML 7.8. I've a monthly index with 350k+ documents count/events per month or 118.3mb worth of data per month. I've data from March to July present (4 months+ data). So, in total, that is 1400k even… --- ## [Fetch command in elasticsearch queries, limit query results](https://discuss.elastic.co/t/fetch-command-in-elasticsearch-queries-limit-query-results/241179)
**Author:** [@liron\_gofberg](https://discuss.elastic.co/u/liron_gofberg)\ **Replies:** 22\ **Last updated:** [July 18, 2020, 4:43pm UTC](https://discuss.elastic.co/t/fetch-command-in-elasticsearch-queries-limit-query-results/241179 "2020-07-18T16:43:41Z")
I am using python as elastic client and I want to fetch only 1 document I have noticed that the search speed for fetching one document is exactly the same as fetching a lots of documents. In oracle sql there is a fetc… --- ## [Cluster Redundancy with VMware vSphere HA](https://discuss.elastic.co/t/cluster-redundancy-with-vmware-vsphere-ha/241685)
**Author:** [@ka2](https://discuss.elastic.co/u/ka2)\ **Replies:** 3\ **Last updated:** [July 18, 2020, 2:45pm UTC](https://discuss.elastic.co/t/cluster-redundancy-with-vmware-vsphere-ha/241685 "2020-07-18T14:45:17Z")
I would like to use vSphere HA (or FT) to make my Elasticsearch cluster redundant, but I am wondering why I can't find a similar case study. Does anyone have any information that can help me with this question? The Ela… --- ## [Metricbeat failed to connect elastic search & kibana](https://discuss.elastic.co/t/metricbeat-failed-to-connect-elastic-search-kibana/241629)
**Author:** [@pankaj0172](https://discuss.elastic.co/u/pankaj0172)\ **Replies:** 1\ **Last updated:** [July 18, 2020, 12:03pm UTC](https://discuss.elastic.co/t/metricbeat-failed-to-connect-elastic-search-kibana/241629 "2020-07-18T12:03:07Z")
Hi Team, I'm using ElasticSearch cluster with authentication and I'm able to access Kibana/Elastic search through the web interface but When I'm installing metric or Audit beat on any machine to send logs to elastic sea… --- ## [How to put multiple lines in Kibana SQL search?](https://discuss.elastic.co/t/how-to-put-multiple-lines-in-kibana-sql-search/241708)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 2\ **Last updated:** [July 18, 2020, 8:12am UTC](https://discuss.elastic.co/t/how-to-put-multiple-lines-in-kibana-sql-search/241708 "2020-07-18T08:12:28Z")
hi I'm trying to put multiline sql search (as our source-code are long and in multile lines), but even if I put escape characters, error happens. Please find screenshot "type" : "json\_parse\_exception", "reas… --- ## [We are not receiving the log from kafka to logstash](https://discuss.elastic.co/t/we-are-not-receiving-the-log-from-kafka-to-logstash/241472)
**Author:** [@saravananveera](https://discuss.elastic.co/u/saravananveera)\ **Replies:** 3\ **Last updated:** [July 18, 2020, 5:08am UTC](https://discuss.elastic.co/t/we-are-not-receiving-the-log-from-kafka-to-logstash/241472 "2020-07-18T05:08:28Z")
Hi I have received the logs from beat to Kafaka, but i can't able to receive logs from kafka to logstash . Kafka log: \[root@ip kafka\]# bin/kafka-console-consumer.sh --bootstrap-server localhost:9092 --topic sscplblog… --- ## [Index rollover is not happening](https://discuss.elastic.co/t/index-rollover-is-not-happening/240645)
**Author:** [@bivaswap](https://discuss.elastic.co/u/bivaswap)\ **Replies:** 2\ **Last updated:** [July 18, 2020, 2:18am UTC](https://discuss.elastic.co/t/index-rollover-is-not-happening/240645 "2020-07-18T02:18:00Z")
I have 4 node cluster (3 master eligible+data, 1 coordinating node) Logstash output output { elasticsearch { hosts =\> \["es-node-01.xyz.local:9200", "es-node-02.xyz.local:9200", "es-node-03.xyz.local:9200"\] il… --- ## [\[WEIRD\] Only some Pipelines in Pipelines.yml stopped working, without making any changes to the conf](https://discuss.elastic.co/t/weird-only-some-pipelines-in-pipelines-yml-stopped-working-without-making-any-changes-to-the-conf/241719)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [July 18, 2020, 1:35am UTC](https://discuss.elastic.co/t/weird-only-some-pipelines-in-pipelines-yml-stopped-working-without-making-any-changes-to-the-conf/241719 "2020-07-18T01:35:22Z")
Hi, In monday about half of pipelines in my pipelines.yml, stopped working. I didn make any changes to the single pipelines configurations and to pipelines.yml. When I run them separately they work, when I run them vi… --- ## [Memory error when using scan In python to retrieve millions of documents](https://discuss.elastic.co/t/memory-error-when-using-scan-in-python-to-retrieve-millions-of-documents/241615)
**Author:** [@liron\_gofberg](https://discuss.elastic.co/u/liron_gofberg)\ **Replies:** 2\ **Last updated:** [July 17, 2020, 6:42pm UTC](https://discuss.elastic.co/t/memory-error-when-using-scan-in-python-to-retrieve-millions-of-documents/241615 "2020-07-17T18:42:32Z")
I’m using scan in python to retrieve my data It is working when I ask for thousands of documents but when I ask for millions of records I get an error after a while and that error relate to the memory What could be hap… --- ## [WEF no hosts showing up in SIEM](https://discuss.elastic.co/t/wef-no-hosts-showing-up-in-siem/241731)
**Author:** [@money1968](https://discuss.elastic.co/u/money1968)\ **Replies:** 0\ **Last updated:** [July 17, 2020, 10:35pm UTC](https://discuss.elastic.co/t/wef-no-hosts-showing-up-in-siem/241731 "2020-07-17T22:35:43Z")
I'm using WEF and upgraded to 7.8, loaded the new template, followed some suggestions and added host.name function process(event) { event.Put("host.name", event.Get("winlog.computer\_name")); … --- ## [uiCapabilities is undefined](https://discuss.elastic.co/t/uicapabilities-is-undefined/241728)
**Author:** [@npm\_install](https://discuss.elastic.co/u/npm_install)\ **Replies:** 1\ **Last updated:** [July 17, 2020, 10:26pm UTC](https://discuss.elastic.co/t/uicapabilities-is-undefined/241728 "2020-07-17T22:26:50Z")
Hi, I am creating a custom plugin for Kibana, and I am running into an issue with the plugin registration feature in this documentation: https://www.elastic.co/guide/en/kibana/current/development-plugin-feature-registra… --- ## [Httpjson crashes when receiving json array at the top level](https://discuss.elastic.co/t/httpjson-crashes-when-receiving-json-array-at-the-top-level/241714)
**Author:** [@Sasha\_Gutfraind](https://discuss.elastic.co/u/Sasha_Gutfraind)\ **Replies:** 1\ **Last updated:** [July 17, 2020, 10:15pm UTC](https://discuss.elastic.co/t/httpjson-crashes-when-receiving-json-array-at-the-top-level/241714 "2020-07-17T22:15:51Z")
I'm using your excellent https://www.elastic.co/guide/en/beats/filebeat/7.6/filebeat-input-httpjson.html version 7.6.2 I'm calling this API: filebeat.yml has no processors, and is supposed to dump the event into ES … --- ## [Slowly term queries](https://discuss.elastic.co/t/slowly-term-queries/241591)
**Author:** [@liron\_gofberg](https://discuss.elastic.co/u/liron_gofberg)\ **Replies:** 2\ **Last updated:** [July 17, 2020, 10:14pm UTC](https://discuss.elastic.co/t/slowly-term-queries/241591 "2020-07-17T22:14:50Z")
Hi, I’m using scan function in Python to retrieve more than 10000 results There are only filter queries I search only for terms There is no aggregation, only simple term queries I executed two queries with the same … --- ## [Loading Custom Plugins in Kibana](https://discuss.elastic.co/t/loading-custom-plugins-in-kibana/241706)
**Author:** [@tinhn](https://discuss.elastic.co/u/tinhn)\ **Replies:** 3\ **Last updated:** [July 17, 2020, 10:00pm UTC](https://discuss.elastic.co/t/loading-custom-plugins-in-kibana/241706 "2020-07-17T22:00:15Z")
Hello, I'm new to ELK stack and am working on a Kibana plugin, a form that submits a request to some external api. I successfully got the plugin to set up and to work following the steps in the Kibana docs. The plugin w… --- ## [Slow queries](https://discuss.elastic.co/t/slow-queries/241723)
**Author:** [@liron\_gofberg](https://discuss.elastic.co/u/liron_gofberg)\ **Replies:** 1\ **Last updated:** [July 17, 2020, 9:43pm UTC](https://discuss.elastic.co/t/slow-queries/241723 "2020-07-17T21:43:22Z")
I execute a simple term filter query and I limit my results with size but part of the queries have bad performance(search time in minutes) while other perform well(search time is very fast) with the same limit of result… --- ## [I can't able to change the font size of Visualizations. Can someone help me here?](https://discuss.elastic.co/t/i-cant-able-to-change-the-font-size-of-visualizations-can-someone-help-me-here/241680)
**Author:** [@Prasad\_k](https://discuss.elastic.co/u/Prasad_k)\ **Replies:** 1\ **Last updated:** [July 17, 2020, 9:38pm UTC](https://discuss.elastic.co/t/i-cant-able-to-change-the-font-size-of-visualizations-can-someone-help-me-here/241680 "2020-07-17T21:38:33Z")
I can't able to change the font size of Visualizations. Can someone help me here? Also I want to change the percentage of pie charts to 1 decimal currently it is 3 decimals. --- ## [Logstash on docker: configure sincedb file to use the last indexed position whenever container restarts/new](https://discuss.elastic.co/t/logstash-on-docker-configure-sincedb-file-to-use-the-last-indexed-position-whenever-container-restarts-new/241537)
**Author:** [@rahulnama](https://discuss.elastic.co/u/rahulnama)\ **Replies:** 11\ **Last updated:** [July 17, 2020, 9:22pm UTC](https://discuss.elastic.co/t/logstash-on-docker-configure-sincedb-file-to-use-the-last-indexed-position-whenever-container-restarts-new/241537 "2020-07-17T21:22:57Z")
Hi Team I mounted the logstash sincedb position to a persistent volume assuming logstash will remember the position of last indexed log. But every time I create/restart a container it's pushing all the logs again to ela… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1918) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1920)