# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1931

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1932

---

## [Ingest Pipeline apply Java Function](https://discuss.elastic.co/t/ingest-pipeline-apply-java-function/241030)

<div class="topic-metadata">

**Author:** [@AV25242](https://discuss.elastic.co/u/AV25242)\
**Replies:** 1\
**Last updated:** [July 14, 2020, 5:49am UTC](https://discuss.elastic.co/t/ingest-pipeline-apply-java-function/241030 "2020-07-14T05:49:25Z")

</div>

This forum has been really quick in providing solutions, really appreciate it. The question I have is, I am moving data from a NOSQL database to Elastic Search , some fields in the NOSQL database are encrypted and I wou…

---

## [Fscrawler version and minimum index compatibility](https://discuss.elastic.co/t/fscrawler-version-and-minimum-index-compatibility/241031)

<div class="topic-metadata">

**Author:** [@David\_Green](https://discuss.elastic.co/u/David_Green)\
**Replies:** 1\
**Last updated:** [July 14, 2020, 5:46am UTC](https://discuss.elastic.co/t/fscrawler-version-and-minimum-index-compatibility/241031 "2020-07-14T05:46:53Z")

</div>

I used fscrawler 2.7 to index my pdf files. I've just noticed this on 'localhost:9200' "minimum index compatibility version" : "6.0.0-betal" (see below) At what 'index compatibility version' will I need to re-index my …

---

## [ELK to monitor Kubernetes Containerized application Logs and IaaS VM Infra /Application Logs](https://discuss.elastic.co/t/elk-to-monitor-kubernetes-containerized-application-logs-and-iaas-vm-infra-application-logs/241055)

<div class="topic-metadata">

**Author:** [@Shalinicts](https://discuss.elastic.co/u/Shalinicts)\
**Replies:** 2\
**Last updated:** [July 14, 2020, 5:35am UTC](https://discuss.elastic.co/t/elk-to-monitor-kubernetes-containerized-application-logs-and-iaas-vm-infra-application-logs/241055 "2020-07-14T05:35:09Z")

</div>

Hi Team , We have a requirement to monitor IaaS Infra / Application Logs and Kubernetes application logs in GCP.We also have requirement to integrate with ticketing tool and some of monitoring tools via JDBC/API Consid…

---

## [Where is beats 6.8.11?](https://discuss.elastic.co/t/where-is-beats-6-8-11/240963)

<div class="topic-metadata">

**Author:** [@Danie\_de\_Jager](https://discuss.elastic.co/u/Danie_de_Jager)\
**Replies:** 2\
**Last updated:** [July 14, 2020, 5:33am UTC](https://discuss.elastic.co/t/where-is-beats-6-8-11/240963 "2020-07-14T05:33:45Z")

</div>

I see there is a changelog for 6.8.11 and that the build of 6.8.10 has been pulled. When will 6.8.11 be released?

---

## [Remote Cluster Connectivity failure](https://discuss.elastic.co/t/remote-cluster-connectivity-failure/240955)

<div class="topic-metadata">

**Author:** [@viveknagar](https://discuss.elastic.co/u/viveknagar)\
**Replies:** 4\
**Last updated:** [July 14, 2020, 5:08am UTC](https://discuss.elastic.co/t/remote-cluster-connectivity-failure/240955 "2020-07-14T05:08:40Z")

</div>

Hello , I am trying to connect to a remote cluster which has connectivity with my server. But I am getting issue while connecting. I am sharing my elasticsearch.yml. Can anyone suggest whether configurations are correct…

---

## [Priority On Data Nodes In Elastic Search](https://discuss.elastic.co/t/priority-on-data-nodes-in-elastic-search/239804)

<div class="topic-metadata">

**Author:** [@Kumar\_Ashish](https://discuss.elastic.co/u/Kumar_Ashish)\
**Replies:** 5\
**Last updated:** [July 14, 2020, 4:52am UTC](https://discuss.elastic.co/t/priority-on-data-nodes-in-elastic-search/239804 "2020-07-14T04:52:23Z")

</div>

We have a self-hosted cluster on Kubernetes (EKS) with 1 master node and 2 master-data nodes. To get the performance, we have used NVMe instances. But if both the data node dies, the cluster gets corrupt and we have a lo…

---

## [ES 5.6 - Delete by query](https://discuss.elastic.co/t/es-5-6-delete-by-query/240745)

<div class="topic-metadata">

**Author:** [@natasha\_adewar](https://discuss.elastic.co/u/natasha_adewar)\
**Replies:** 7\
**Last updated:** [July 14, 2020, 4:29am UTC](https://discuss.elastic.co/t/es-5-6-delete-by-query/240745 "2020-07-14T04:29:47Z")

</div>

We have an index in ES 2.4 that holds 120 million plus documents with different ttl values on each of them and we do insert upto 700k documents every day into the same index. We are now migrating to ES 5.6 and are plann…

---

## [Requirements planning](https://discuss.elastic.co/t/requirements-planning/240856)

<div class="topic-metadata">

**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\
**Replies:** 7\
**Last updated:** [July 14, 2020, 4:12am UTC](https://discuss.elastic.co/t/requirements-planning/240856 "2020-07-14T04:12:19Z")

</div>

I am running Ubuntu server 20.04 LTS in a VM hosted on a NAS (Synology.) Configuration is: Compute: Intel Celeron J3455 (4 cores allocated to the VM.) 1.5 (base) / 2.3 (burst) GHz Memory: 4 GB DDR3. Storage: 7200 RPM d…

---

## [TSVB Visualisation get the filter date Value](https://discuss.elastic.co/t/tsvb-visualisation-get-the-filter-date-value/240309)

<div class="topic-metadata">

**Author:** [@umay\_fb](https://discuss.elastic.co/u/umay_fb)\
**Replies:** 6\
**Last updated:** [July 14, 2020, 3:46am UTC](https://discuss.elastic.co/t/tsvb-visualisation-get-the-filter-date-value/240309 "2020-07-14T03:46:54Z")

</div>

Hi All.... i want to create a Visualisation using TSVB. can we get a Day of time filter? exp: we get a minday = 1 , and maxday = 31 from time filter like this, or time interval of timefilter. i need this value to ca…

---

## [Elasticsearch Active-Directory: Native User Authentication Failure](https://discuss.elastic.co/t/elasticsearch-active-directory-native-user-authentication-failure/241010)

<div class="topic-metadata">

**Author:** [@vishakh](https://discuss.elastic.co/u/vishakh)\
**Replies:** 2\
**Last updated:** [July 14, 2020, 3:41am UTC](https://discuss.elastic.co/t/elasticsearch-active-directory-native-user-authentication-failure/241010 "2020-07-14T03:41:11Z")

</div>

Elasticsearch: 7.8 I'm trying to enable X-Pack Active-Directory Realm authentication along with Native user authentication feature but after the .yml config update/change I'm unable to start the elasticsearch service: …

---

## [Filebeat extremely slow startup for large number of files](https://discuss.elastic.co/t/filebeat-extremely-slow-startup-for-large-number-of-files/240746)

<div class="topic-metadata">

**Author:** [@serant](https://discuss.elastic.co/u/serant)\
**Replies:** 0\
**Last updated:** [July 10, 2020, 6:52pm UTC](https://discuss.elastic.co/t/filebeat-extremely-slow-startup-for-large-number-of-files/240746 "2020-07-10T18:52:42Z")

</div>

We use Filebeat to tail hundreds of directories, each containing up to a few thousand log files. Whenever we need to restart Filebeat, it often takes days for Filebeat to being sending logs to Logstash again. I am confi…

---

## [Heartbeat - howto configure body & check.request with password in keystore file](https://discuss.elastic.co/t/heartbeat-howto-configure-body-check-request-with-password-in-keystore-file/240917)

<div class="topic-metadata">

**Author:** [@Samuelg75](https://discuss.elastic.co/u/Samuelg75)\
**Replies:** 0\
**Last updated:** [July 13, 2020, 7:50am UTC](https://discuss.elastic.co/t/heartbeat-howto-configure-body-check-request-with-password-in-keystore-file/240917 "2020-07-13T07:50:05Z")

</div>

Hello everybody, Il use heartbeat to check some web site with check.request. For example : - type: http urls: \[http://localhost:5050/myweb/app\] schedule: '@every 1m' response.include\_body\_max\_bytes: 10240 chec…

---

## [How to check client\_ip ipv4 or ipv6?](https://discuss.elastic.co/t/how-to-check-client-ip-ipv4-or-ipv6/240654)

<div class="topic-metadata">

**Author:** [@Champion\_Xie](https://discuss.elastic.co/u/Champion_Xie)\
**Replies:** 7\
**Last updated:** [July 14, 2020, 3:30am UTC](https://discuss.elastic.co/t/how-to-check-client-ip-ipv4-or-ipv6/240654 "2020-07-14T03:30:59Z")

</div>

how to use mutate add\_field check client\_ip version v4 or v6? if \['client\_ip'\].length \>15 { mutate{ add\_field =\> { "ip\_type" =\> "ipv6" } } } else { mutate{ add\_field =\> { "ip\_type" =\> "ipv4" } }…

---

## [Internal server error when defining index pattern in kibana](https://discuss.elastic.co/t/internal-server-error-when-defining-index-pattern-in-kibana/240252)

<div class="topic-metadata">

**Author:** [@Evelyn233](https://discuss.elastic.co/u/Evelyn233)\
**Replies:** 9\
**Last updated:** [July 14, 2020, 2:36am UTC](https://discuss.elastic.co/t/internal-server-error-when-defining-index-pattern-in-kibana/240252 "2020-07-14T02:36:55Z")

</div>

when i trying to define a new index pattern in kibana, it doesn't word due to the internal server error. i don't know how to fix it. this is the display of kibana and this is the status of my index the system i use…

---

## [Unable to access VM from Host Machine](https://discuss.elastic.co/t/unable-to-access-vm-from-host-machine/240980)

<div class="topic-metadata">

**Author:** [@Mystic\_Wayfarer](https://discuss.elastic.co/u/Mystic_Wayfarer)\
**Replies:** 1\
**Last updated:** [July 14, 2020, 2:21am UTC](https://discuss.elastic.co/t/unable-to-access-vm-from-host-machine/240980 "2020-07-14T02:21:35Z")

</div>

Dears, I am new to elastic search so bear with me for basic questions. I installed Elastic Search on Ubuntu20.4, everything works on localhost. When I try to access this from my host machine by giving the IP of VM it g…

---

## [Filebeat not receiving logs and error in logstash](https://discuss.elastic.co/t/filebeat-not-receiving-logs-and-error-in-logstash/240653)

<div class="topic-metadata">

**Author:** [@Sai\_Avinash\_Duddupud](https://discuss.elastic.co/u/Sai_Avinash_Duddupud)\
**Replies:** 12\
**Last updated:** [July 12, 2020, 4:07pm UTC](https://discuss.elastic.co/t/filebeat-not-receiving-logs-and-error-in-logstash/240653 "2020-07-12T16:07:52Z")

</div>

I am trying to setup filebeat and logstash on my server1 and send data to elasticsearch located on server2 and visualize it using kibana. Following are filebeat logs and when i run filebeat test output it showed the res…

---

## [Need clarity on how to use multiple indices for creating an index-pattern](https://discuss.elastic.co/t/need-clarity-on-how-to-use-multiple-indices-for-creating-an-index-pattern/240608)

<div class="topic-metadata">

**Author:** [@sanjaysubramanian](https://discuss.elastic.co/u/sanjaysubramanian)\
**Replies:** 7\
**Last updated:** [July 14, 2020, 1:49am UTC](https://discuss.elastic.co/t/need-clarity-on-how-to-use-multiple-indices-for-creating-an-index-pattern/240608 "2020-07-14T01:49:16Z")

</div>

Hi all INDEX 1 = sid\_agent\_276043\_tsfm\_idx (docs = 18842) { "sid\_agent\_276043\_tsfm\_idx": { "mappings": { "\_meta": { "created\_by": "transform", "\_transform": { …

---

## [Logstash csv output plugin problem](https://discuss.elastic.co/t/logstash-csv-output-plugin-problem/240691)

<div class="topic-metadata">

**Author:** [@kase](https://discuss.elastic.co/u/kase)\
**Replies:** 8\
**Last updated:** [July 14, 2020, 12:39am UTC](https://discuss.elastic.co/t/logstash-csv-output-plugin-problem/240691 "2020-07-14T00:39:51Z")

</div>

Hi there, I want to output elasticsearch documents to csv file with using logstash, but faced some problems... tail -f /var/log/logstash/logstash-plain.log \[2020-07-10T11:11:02,561\]\[ERROR\]\[logstash.javapipeline \]\[e…

---

## [NEST C# aggregations - Count and Max](https://discuss.elastic.co/t/nest-c-aggregations-count-and-max/240171)

<div class="topic-metadata">

**Author:** [@rd8388](https://discuss.elastic.co/u/rd8388)\
**Replies:** 2\
**Last updated:** [July 13, 2020, 11:40pm UTC](https://discuss.elastic.co/t/nest-c-aggregations-count-and-max/240171 "2020-07-13T23:40:18Z")

</div>

var sDescriptor = new Nest.SearchDescriptor\<MyRecordType\>(); sDescriptor.Aggregations(a =\>a.Terms("sources", t =\> t.Field(f =\> f.sourceName.Suffix("keyword")))); var searchResponse = \_client.Search\<MyRecordType\>(sDescrip…

---

## [Need help with resolving - security\_exception - no permissions for \[indices:admin/create\] and User \[name=logstash](https://discuss.elastic.co/t/need-help-with-resolving-security-exception-no-permissions-for-indices-admin-create-and-user-name-logstash/241038)

<div class="topic-metadata">

**Author:** [@roligupt](https://discuss.elastic.co/u/roligupt)\
**Replies:** 0\
**Last updated:** [July 13, 2020, 11:30pm UTC](https://discuss.elastic.co/t/need-help-with-resolving-security-exception-no-permissions-for-indices-admin-create-and-user-name-logstash/241038 "2020-07-13T23:30:53Z")

</div>

I just deployed a new ELK instance in K8 platform. i keep getting these errors - \[logstash.outputs.elasticsearch\]\[main\] retrying failed action with response code: 403 ({"type"=\>"security\_exception", "reason"=\>"no permis…

---

## [Reindexing Logstash indices to use new index template](https://discuss.elastic.co/t/reindexing-logstash-indices-to-use-new-index-template/238917)

<div class="topic-metadata">

**Author:** [@vanessa](https://discuss.elastic.co/u/vanessa)\
**Replies:** 3\
**Last updated:** [July 13, 2020, 11:26pm UTC](https://discuss.elastic.co/t/reindexing-logstash-indices-to-use-new-index-template/238917 "2020-07-13T23:26:09Z")

</div>

Hi. We have some existing logstash logs in our elasticsearch cluster. Their pattern is logstash-imu-logs-\*. We have a template for that pattern, but unfortunately it was missing the mapping for one of our fields. As the …

---

## [Watcher - Alerts to call an External API](https://discuss.elastic.co/t/watcher-alerts-to-call-an-external-api/238160)

<div class="topic-metadata">

**Author:** [@sushmamagesh](https://discuss.elastic.co/u/sushmamagesh)\
**Replies:** 2\
**Last updated:** [July 13, 2020, 11:13pm UTC](https://discuss.elastic.co/t/watcher-alerts-to-call-an-external-api/238160 "2020-07-13T23:13:54Z")

</div>

Hi Can you please point to any documentation on how to connect from watcher alerts to an external third party API, basically as http call that returns a set of parameters in JSON format. The alert then needs to be able …

---

## [Average age](https://discuss.elastic.co/t/average-age/240796)

<div class="topic-metadata">

**Author:** [@joaopedro](https://discuss.elastic.co/u/joaopedro)\
**Replies:** 2\
**Last updated:** [July 13, 2020, 9:42pm UTC](https://discuss.elastic.co/t/average-age/240796 "2020-07-13T21:42:26Z")

</div>

So, I have a database whith personal information where we calculate the age of the people using the birthdate, the problem is that I want to calculate the average age of the population, but I have a problems: scalability…

---

## [Elasticsearch Active-Directory Authentication Failure](https://discuss.elastic.co/t/elasticsearch-active-directory-authentication-failure/241032)

<div class="topic-metadata">

**Author:** [@vishakh](https://discuss.elastic.co/u/vishakh)\
**Replies:** 1\
**Last updated:** [July 13, 2020, 9:27pm UTC](https://discuss.elastic.co/t/elasticsearch-active-directory-authentication-failure/241032 "2020-07-13T21:27:06Z")

</div>

Elasticsearch: 7.8 Below is my xpack conf: xpack: security: authc: realms: active\_directory: corp\_ad: order: 0 domain\_name: \<Domain-Name\> follow\_referra…

---

## [Factorial function](https://discuss.elastic.co/t/factorial-function/240828)

<div class="topic-metadata">

**Author:** [@Hugo\_Pires](https://discuss.elastic.co/u/Hugo_Pires)\
**Replies:** 3\
**Last updated:** [July 13, 2020, 9:25pm UTC](https://discuss.elastic.co/t/factorial-function/240828 "2020-07-13T21:25:48Z")

</div>

Hello Is it possible, using tiny math (or other solution), to calculate the factorial of an integer number in Kibana Canvas? Thank you Hugo

---

## [Cannot import json template for cloudfront logs to cluster](https://discuss.elastic.co/t/cannot-import-json-template-for-cloudfront-logs-to-cluster/240958)

<div class="topic-metadata">

**Author:** [@gadg3ts](https://discuss.elastic.co/u/gadg3ts)\
**Replies:** 6\
**Last updated:** [July 13, 2020, 9:10pm UTC](https://discuss.elastic.co/t/cannot-import-json-template-for-cloudfront-logs-to-cluster/240958 "2020-07-13T21:10:28Z")

</div>

Hi, I'm attempting to get my cloudfront logs into a local elasticsearch cluster (7.8.0) and am having a bit of trouble. The template I'm attempting to import is from here https://aws.amazon.com/premiumsupport/knowledg…

---

## [LDAP Settings Elastic Stack 7.8.0 released](https://discuss.elastic.co/t/ldap-settings-elastic-stack-7-8-0-released/240954)

<div class="topic-metadata">

**Author:** [@S26](https://discuss.elastic.co/u/S26)\
**Replies:** 0\
**Last updated:** [July 13, 2020, 11:03am UTC](https://discuss.elastic.co/t/ldap-settings-elastic-stack-7-8-0-released/240954 "2020-07-13T11:03:47Z")

</div>

using below settings ; xpack.security.enabled: true xpack: security: authc: realms: ldap: ldap1: order: 0 url: "ldaps://ldap.example.com:636" user\_dn\_templates: - "cn={0}, ou=users, o=marketing, dc=example, dc…

---

## [Doubt about dm\_crypt](https://discuss.elastic.co/t/doubt-about-dm-crypt/240999)

<div class="topic-metadata">

**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\
**Replies:** 1\
**Last updated:** [July 13, 2020, 8:50pm UTC](https://discuss.elastic.co/t/doubt-about-dm-crypt/240999 "2020-07-13T20:50:52Z")

</div>

Hi everybody, I know that we can use dm\_crypt with a basic license even if we will be out of support. I would like just to know: where dm\_crypt will perform the encryption? I mean, directly on the filesystem? who will …

---

## [How to configure sso for platinum account elkastic.co hosted ES deployement](https://discuss.elastic.co/t/how-to-configure-sso-for-platinum-account-elkastic-co-hosted-es-deployement/241020)

<div class="topic-metadata">

**Author:** [@aditya\_nirmala](https://discuss.elastic.co/u/aditya_nirmala)\
**Replies:** 0\
**Last updated:** [July 13, 2020, 5:52pm UTC](https://discuss.elastic.co/t/how-to-configure-sso-for-platinum-account-elkastic-co-hosted-es-deployement/241020 "2020-07-13T17:52:50Z")

</div>

Hey Guys, i want configure azure sso to my elastic search 7.0 which is hosted on elastic.co with aws deployement none of document is helpful. Is there any helpful doc that someone can share or put down steps how can i…

---

## [Date Filter Mapping](https://discuss.elastic.co/t/date-filter-mapping/240918)

<div class="topic-metadata">

**Author:** [@PRACHI\_GUPTA](https://discuss.elastic.co/u/PRACHI_GUPTA)\
**Replies:** 1\
**Last updated:** [July 13, 2020, 8:39pm UTC](https://discuss.elastic.co/t/date-filter-mapping/240918 "2020-07-13T20:39:34Z")

</div>

In my index, I do not have timestamp field I have reading\_date field. How to configure my dashboard's date filter to use reading\_date instead of timestamp field?

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1930)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1932)
