# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1930 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1931 --- ## [How to divide must query into separate queries](https://discuss.elastic.co/t/how-to-divide-must-query-into-separate-queries/241115)
**Author:** [@buka\_bidzina](https://discuss.elastic.co/u/buka_bidzina)\ **Replies:** 3\ **Last updated:** [July 14, 2020, 11:27am UTC](https://discuss.elastic.co/t/how-to-divide-must-query-into-separate-queries/241115 "2020-07-14T11:27:15Z")
Mapping PUT index PUT /index/\_mapping { "properties": { "categories": { "type": "nested", "properties": { "id": { "type": "integer" } } }, "deleted": { "ty… --- ## [Filebeat getting stop without giving any error](https://discuss.elastic.co/t/filebeat-getting-stop-without-giving-any-error/241094)
**Author:** [@Rashid\_Ali](https://discuss.elastic.co/u/Rashid_Ali)\ **Replies:** 2\ **Last updated:** [July 14, 2020, 11:26am UTC](https://discuss.elastic.co/t/filebeat-getting-stop-without-giving-any-error/241094 "2020-07-14T11:26:23Z")
Hi everybody, I have a situation where filebeat automatically gets toped without giving any error in the log file. I am attaching all the logs of the filebeat. I am reading multiple files from the same path. Data in fil… --- ## [Shingles and terms aggregation not working as expected](https://discuss.elastic.co/t/shingles-and-terms-aggregation-not-working-as-expected/240705)
**Author:** [@zp230](https://discuss.elastic.co/u/zp230)\ **Replies:** 1\ **Last updated:** [July 14, 2020, 10:01am UTC](https://discuss.elastic.co/t/shingles-and-terms-aggregation-not-working-as-expected/240705 "2020-07-14T10:01:42Z")
Hi, I am having issues with getting even a simple terms aggregation on a shingled field. For context, I want to be able to get a list of words/phrases found in the sentence/display\_text field (using shingles), and their… --- ## [Get json from Http poller , store it in local variable and use it in elastic search output](https://discuss.elastic.co/t/get-json-from-http-poller-store-it-in-local-variable-and-use-it-in-elastic-search-output/239610)
**Author:** [@Abolurah](https://discuss.elastic.co/u/Abolurah)\ **Replies:** 4\ **Last updated:** [July 14, 2020, 9:56am UTC](https://discuss.elastic.co/t/get-json-from-http-poller-store-it-in-local-variable-and-use-it-in-elastic-search-output/239610 "2020-07-14T09:56:18Z")
Hi All I'm trying to configure the Logstash, that it will poll credentials from Http poller plugin store it is some local variable, get data from local elastic search (multiple Inputs), and will send it to remote AWS El… --- ## [Default Pin All filter in dashboard](https://discuss.elastic.co/t/default-pin-all-filter-in-dashboard/241107)
**Author:** [@vikramnr](https://discuss.elastic.co/u/vikramnr)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 9:56am UTC](https://discuss.elastic.co/t/default-pin-all-filter-in-dashboard/241107 "2020-07-14T09:56:09Z")
Hi, I have different charts in dashboard and when I click on in certain bars etc., filter applies for whole dashboard. But is there any option to make this filter pinned by default instead of user going and enabling it… --- ## [Get the top 10 host in composite query with agregation](https://discuss.elastic.co/t/get-the-top-10-host-in-composite-query-with-agregation/241062)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 1\ **Last updated:** [July 14, 2020, 9:44am UTC](https://discuss.elastic.co/t/get-the-top-10-host-in-composite-query-with-agregation/241062 "2020-07-14T09:44:48Z")
Hi, Im trying to emulate the anomaly explorer in a custom vega-lite visualization, for that I need to get the top ten host based on the sum of their anomaly record\_score, I have tried with this query but the record\_score… --- ## [Geolocation using packetbeat](https://discuss.elastic.co/t/geolocation-using-packetbeat/241102)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 9:27am UTC](https://discuss.elastic.co/t/geolocation-using-packetbeat/241102 "2020-07-14T09:27:44Z")
I am using geopoint filter in logstash and i am using packetbeat to send network logs to the elasticsearch through logstash. Here is my logstash config file filter { geoip { source =\> "\[server\]\[ip\]" target =\> "\[ser… --- ## [Grok parse failure splitting in to 3 blocks](https://discuss.elastic.co/t/grok-parse-failure-splitting-in-to-3-blocks/239983)
**Author:** [@karlm](https://discuss.elastic.co/u/karlm)\ **Replies:** 3\ **Last updated:** [July 14, 2020, 9:21am UTC](https://discuss.elastic.co/t/grok-parse-failure-splitting-in-to-3-blocks/239983 "2020-07-14T09:21:33Z")
I have a log file, with multiple lines like so 03-Jul-2020 10:24:00.773 +01:00 \[ERR\] this is the error message message I have a grok filter trying to extract the log in 3 separate blocks 1. DateTime 2. Priority 3. … --- ## [Kibana Discover tab not displaying data for index pattern](https://discuss.elastic.co/t/kibana-discover-tab-not-displaying-data-for-index-pattern/241083)
**Author:** [@Bhanu\_Praveen](https://discuss.elastic.co/u/Bhanu_Praveen)\ **Replies:** 8\ **Last updated:** [July 14, 2020, 9:23am UTC](https://discuss.elastic.co/t/kibana-discover-tab-not-displaying-data-for-index-pattern/241083 "2020-07-14T09:23:52Z")
Hello, My Indices showing 8 documents and created index pattern for the same. My discover tab was showing data for same indices("hc-gc-2020.07.14") before. I restarted Elastic stack and post that sometimes data is di… --- ## [How to remove unwanted records](https://discuss.elastic.co/t/how-to-remove-unwanted-records/241099)
**Author:** [@Shaun\_Mccullagh](https://discuss.elastic.co/u/Shaun_Mccullagh)\ **Replies:** 2\ **Last updated:** [July 14, 2020, 9:19am UTC](https://discuss.elastic.co/t/how-to-remove-unwanted-records/241099 "2020-07-14T09:19:51Z")
Hi, I want to delete all records containing Project:cfa\_uk and env:tst from my ElasticSearch indexes. I created this son data file: { "query": { "query\_string" : { "fields" : \["project", "env"\]… --- ## [Kibana embedded authentication](https://discuss.elastic.co/t/kibana-embedded-authentication/239634)
**Author:** [@MarkBreecher](https://discuss.elastic.co/u/MarkBreecher)\ **Replies:** 2\ **Last updated:** [July 14, 2020, 9:19am UTC](https://discuss.elastic.co/t/kibana-embedded-authentication/239634 "2020-07-14T09:19:33Z")
Hi, I have a question regarding authenticating Kibana embedded dashboards in another web app and would be grateful if someone could point me in the right direction. Our current setup is Nginx -\> Reverse Proxy -\> Kibana… --- ## [How to hide fields with index:false in discover](https://discuss.elastic.co/t/how-to-hide-fields-with-index-false-in-discover/241097)
**Author:** [@scathatheworm](https://discuss.elastic.co/u/scathatheworm)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 8:45am UTC](https://discuss.elastic.co/t/how-to-hide-fields-with-index-false-in-discover/241097 "2020-07-14T08:45:33Z")
I have a few maps in the ingested data into elasticsearch that would cause a field explosion due to the amount of possible fields, I have used dynamic: false on these maps to not have them indexed, only in the \_source. R… --- ## [Map does not shade as mentioned in guide](https://discuss.elastic.co/t/map-does-not-shade-as-mentioned-in-guide/241045)
**Author:** [@GraceYu](https://discuss.elastic.co/u/GraceYu)\ **Replies:** 3\ **Last updated:** [July 14, 2020, 8:43am UTC](https://discuss.elastic.co/t/map-does-not-shade-as-mentioned-in-guide/241045 "2020-07-14T08:43:01Z")
Hi, I have followed the tutorial guide and seems the word map does not shade as mentioned in the guide. I have tried zoom in and out. Anyone, can guide on how to trace where the problem is ? https://www.elastic.co/guid… --- ## [Problem to update to filebeat 7.7.0 and parser nginx-ingress-controller on Kubernetes](https://discuss.elastic.co/t/problem-to-update-to-filebeat-7-7-0-and-parser-nginx-ingress-controller-on-kubernetes/232461)
**Author:** [@David\_Oceans](https://discuss.elastic.co/u/David_Oceans)\ **Replies:** 5\ **Last updated:** [July 14, 2020, 8:33am UTC](https://discuss.elastic.co/t/problem-to-update-to-filebeat-7-7-0-and-parser-nginx-ingress-controller-on-kubernetes/232461 "2020-07-14T08:33:42Z")
Hi! I was using Kubernetes with this version of Filebeat: docker.elastic.co/beats/filebeat:7.3.2 In order to use the new functionalities to parser nginx-ingress-controller I've update to docker.elastic.co/beats/filebea… --- ## [Caniuse-lite is outdated. please run next command npm update](https://discuss.elastic.co/t/caniuse-lite-is-outdated-please-run-next-command-npm-update/240801)
**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\ **Replies:** 6\ **Last updated:** [July 14, 2020, 8:25am UTC](https://discuss.elastic.co/t/caniuse-lite-is-outdated-please-run-next-command-npm-update/240801 "2020-07-14T08:25:43Z")
Hi, I have installed enhanced table plugin and restarted my kibana. it is showing the error message as caniuse-lite is outdated. please run next command npm update. Is there any extra coomands i need to execute to wo… --- ## [How can move Elasticsearch index data to RDBMS](https://discuss.elastic.co/t/how-can-move-elasticsearch-index-data-to-rdbms/241093)
**Author:** [@hyungsun\_lim](https://discuss.elastic.co/u/hyungsun_lim)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 8:19am UTC](https://discuss.elastic.co/t/how-can-move-elasticsearch-index-data-to-rdbms/241093 "2020-07-14T08:19:47Z")
In order to join two indexes, i use spark-elasticsearch. However, this connecter takes so long time to join data. ex) A: 1,000,000 docs join B:500,000 makes 200,000 docs but it takes to long time. (2 hours) So i … --- ## [Beat templates do not stick to ECS?](https://discuss.elastic.co/t/beat-templates-do-not-stick-to-ecs/241064)
**Author:** [@BBQigniter](https://discuss.elastic.co/u/BBQigniter)\ **Replies:** 3\ **Last updated:** [July 14, 2020, 8:10am UTC](https://discuss.elastic.co/t/beat-templates-do-not-stick-to-ecs/241064 "2020-07-14T08:10:20Z")
Hello, am I seeing this correctly that the Beat-templates sometimes do not stick to the ECS? For example I wanted to prepare a mapping template for our ELK-Stack and so I merged auditbeat, filebeat and winlogbeat mappin… --- ## [Setting the whitespace analyzer for query\_string search](https://discuss.elastic.co/t/setting-the-whitespace-analyzer-for-query-string-search/240517)
**Author:** [@Josip\_Cagalj](https://discuss.elastic.co/u/Josip_Cagalj)\ **Replies:** 8\ **Last updated:** [July 14, 2020, 8:06am UTC](https://discuss.elastic.co/t/setting-the-whitespace-analyzer-for-query-string-search/240517 "2020-07-14T08:06:05Z")
Hi all, I have a problem regarding how the query string is tokenized when performing a query\_string search. Could it be possible to opt for the whitespace tokenizer instead of standard because I'm searching for an exact… --- ## [Load external configuration files](https://discuss.elastic.co/t/load-external-configuration-files/241046)
**Author:** [@Mrzhuang007](https://discuss.elastic.co/u/Mrzhuang007)\ **Replies:** 1\ **Last updated:** [July 14, 2020, 8:04am UTC](https://discuss.elastic.co/t/load-external-configuration-files/241046 "2020-07-14T08:04:02Z")
Hi! I can load external config through this config in filebeat.yml filebeat.config.inputs: enabled: true path: configs/\*.yml Do anyone test how many external config I can add, and will it cost to much delay? --- ## [Syslog from network devices to Filebeat](https://discuss.elastic.co/t/syslog-from-network-devices-to-filebeat/240928)
**Author:** [@sera](https://discuss.elastic.co/u/sera)\ **Replies:** 4\ **Last updated:** [July 14, 2020, 7:56am UTC](https://discuss.elastic.co/t/syslog-from-network-devices-to-filebeat/240928 "2020-07-14T07:56:21Z")
Hi - I can't seem to get Filebeat to collect syslog from ONLY my network devices. It seems to collect everything from /var/log/messages (Filebeat installed on Centos 7) and from my network devices. Here are the input/ou… --- ## [Filebeat registrar to use statestore log.json is never clean](https://discuss.elastic.co/t/filebeat-registrar-to-use-statestore-log-json-is-never-clean/241048)
**Author:** [@JKeita](https://discuss.elastic.co/u/JKeita)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 3:33am UTC](https://discuss.elastic.co/t/filebeat-registrar-to-use-statestore-log-json-is-never-clean/241048 "2020-07-14T03:33:15Z")
master branch filebeat registrar to use statestore. log.json is never clean old data. filebeat.registry.cleanup\_interval in linux is invalid. --- ## [Filebeat registry data.json is empty](https://discuss.elastic.co/t/filebeat-registry-data-json-is-empty/240709)
**Author:** [@Sai\_Avinash\_Duddupud](https://discuss.elastic.co/u/Sai_Avinash_Duddupud)\ **Replies:** 2\ **Last updated:** [July 14, 2020, 7:36am UTC](https://discuss.elastic.co/t/filebeat-registry-data-json-is-empty/240709 "2020-07-14T07:36:07Z")
I am trying to setup filebeat, but it not harvesting logs at all from the given log file path. After lot of research, I came to know that data.json in registry folder is empty which is why filebeat is unable to read log… --- ## [Filebeat not receiving logs](https://discuss.elastic.co/t/filebeat-not-receiving-logs/240829)
**Author:** [@Sai\_Avinash\_Duddupud](https://discuss.elastic.co/u/Sai_Avinash_Duddupud)\ **Replies:** 1\ **Last updated:** [July 14, 2020, 7:36am UTC](https://discuss.elastic.co/t/filebeat-not-receiving-logs/240829 "2020-07-14T07:36:05Z")
Hi all, I have setup filebeat on server, but filebeat is not receiving logs at all. my log file continuously generates logs and the directory where log file is present has drwxr-xr-x+ permission I want to understand if… --- ## [Unable to post nested json data using bulk api in an index refering docs (Elasticsearch 7.8)](https://discuss.elastic.co/t/unable-to-post-nested-json-data-using-bulk-api-in-an-index-refering-docs-elasticsearch-7-8/240446)
**Author:** [@Akash\_Gusain](https://discuss.elastic.co/u/Akash_Gusain)\ **Replies:** 2\ **Last updated:** [July 14, 2020, 7:33am UTC](https://discuss.elastic.co/t/unable-to-post-nested-json-data-using-bulk-api-in-an-index-refering-docs-elasticsearch-7-8/240446 "2020-07-14T07:33:14Z")
I am new to elastic, post data using bulk api but unable to send nested data. can any body help where i am wrong. POST \_bulk {"index":{"\_index" : "network\_data", "\_id" : "1"}} {"predictionDate": "16-07-2019", "categ… --- ## [\_dateparsefailure in tags](https://discuss.elastic.co/t/dateparsefailure-in-tags/240676)
**Author:** [@Govinda8594](https://discuss.elastic.co/u/Govinda8594)\ **Replies:** 2\ **Last updated:** [July 14, 2020, 7:21am UTC](https://discuss.elastic.co/t/dateparsefailure-in-tags/240676 "2020-07-14T07:21:24Z")
Hello Team, i am using filebeat to ship all logs to logstash,this logs are docker container logs here is my filebeat.yml file filebeat.inputs: - type: log paths: - 'var/lib/docker/containers/ec037f29884667f4e27… --- ## [Memory allocation for inserted data and timeout](https://discuss.elastic.co/t/memory-allocation-for-inserted-data-and-timeout/241063)
**Author:** [@liron\_gofberg](https://discuss.elastic.co/u/liron_gofberg)\ **Replies:** 1\ **Last updated:** [July 14, 2020, 7:20am UTC](https://discuss.elastic.co/t/memory-allocation-for-inserted-data-and-timeout/241063 "2020-07-14T07:20:22Z")
Hi, I would love to know what u think about the 2 next problems: I inserted 119mb of data Into elastic In the output of the command \_cat/allocation I could see that disk.available is 1 gb less than it was before the … --- ## [Reading cloud event avro Message](https://discuss.elastic.co/t/reading-cloud-event-avro-message/241070)
**Author:** [@revooru\_nischal](https://discuss.elastic.co/u/revooru_nischal)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 7:15am UTC](https://discuss.elastic.co/t/reading-cloud-event-avro-message/241070 "2020-07-14T07:15:38Z")
Hi , I was trying to find a plugin which is able to read a kafka message which is of format \[cloud event avro\](https://github.com/cloudevents/spec/blob/v1.0/avro-format.md eg : {"data\_base64":"LFNSVl9Qb3N0T25lVHJhbnNh… --- ## [Filter settings preserve\_original and shingle](https://discuss.elastic.co/t/filter-settings-preserve-original-and-shingle/241069)
**Author:** [@xlisfo](https://discuss.elastic.co/u/xlisfo)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 7:14am UTC](https://discuss.elastic.co/t/filter-settings-preserve-original-and-shingle/241069 "2020-07-14T07:14:15Z")
I have a question on how to use preserve\_original : true and shingle token filters together. Say, I have a query "camelCase apple", the word\_delimiter will split on case change to "camel case" first while keeping the ori… --- ## [Index Lifecycle error and index size is huge](https://discuss.elastic.co/t/index-lifecycle-error-and-index-size-is-huge/241041)
**Author:** [@alankong](https://discuss.elastic.co/u/alankong)\ **Replies:** 4\ **Last updated:** [July 14, 2020, 6:24am UTC](https://discuss.elastic.co/t/index-lifecycle-error-and-index-size-is-huge/241041 "2020-07-14T06:24:22Z")
Index lifecycle management Index lifecycle error illegal\_argument\_exception: index.lifecycle.rollover\_alias \[packetbeat-7.0.0-ilm-00000n\] does not point to index \[packetbeat-7.0.0-ilm\] I have been getting the above err… --- ## [Inspect Date is less one day compared to Search Data](https://discuss.elastic.co/t/inspect-date-is-less-one-day-compared-to-search-data/241061)
**Author:** [@GraceYu](https://discuss.elastic.co/u/GraceYu)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 6:03am UTC](https://discuss.elastic.co/t/inspect-date-is-less-one-day-compared-to-search-data/241061 "2020-07-14T06:03:36Z")
Hi, I am using the world country map with kibana log sample to query data. I selected date 14 jul, 2020@ 00:00:00 till 14 jul 2020@03:00:00 but the inspect request date query shows the following: { "range": { "timest… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1929) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1931)