# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1941 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1942 --- ## [Filebeat multiple sources netflow module](https://discuss.elastic.co/t/filebeat-multiple-sources-netflow-module/240421)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 2\ **Last updated:** [July 9, 2020, 3:20pm UTC](https://discuss.elastic.co/t/filebeat-multiple-sources-netflow-module/240421 "2020-07-09T15:20:14Z")
Hello there, My ELK Stack is composed by: Elasticsearch Kibana Filebeat My question is, how can I accomplish multiple sources (firewall) to send same port 2055 netflow module? Is possible? Or not? Thanks in advance… --- ## [Connecting two nodes and form cluster](https://discuss.elastic.co/t/connecting-two-nodes-and-form-cluster/240546)
**Author:** [@akhilsai1499](https://discuss.elastic.co/u/akhilsai1499)\ **Replies:** 0\ **Last updated:** [July 9, 2020, 3:14pm UTC](https://discuss.elastic.co/t/connecting-two-nodes-and-form-cluster/240546 "2020-07-09T15:14:06Z")
Hi Elk team. I have two different servers. Let's say. 10.41.23.17 and 10.41.23.18 I moved elastic search tar in two servers or nodes and untarred it. Now I want to connect two servers with each other and for cluster. … --- ## [Elasticsearch groovy script query Not working properly](https://discuss.elastic.co/t/elasticsearch-groovy-script-query-not-working-properly/240540)
**Author:** [@Abhishek\_Kumar5](https://discuss.elastic.co/u/Abhishek_Kumar5)\ **Replies:** 0\ **Last updated:** [July 9, 2020, 2:19pm UTC](https://discuss.elastic.co/t/elasticsearch-groovy-script-query-not-working-properly/240540 "2020-07-09T14:19:58Z")
Hi Everybody, I have a issue. Want your review on it to fix. Mapping { "supply": {"properties": { "rotation\_list": { "type": "nested", "properties": { "project\_end\_date": { "type": "nested",… --- ## [Kibana Pie Chart Title Label vanishes once you add "split slices" and "terms aggregation"](https://discuss.elastic.co/t/kibana-pie-chart-title-label-vanishes-once-you-add-split-slices-and-terms-aggregation/237376)
**Author:** [@sanjaysubramanian](https://discuss.elastic.co/u/sanjaysubramanian)\ **Replies:** 7\ **Last updated:** [July 9, 2020, 2:45pm UTC](https://discuss.elastic.co/t/kibana-pie-chart-title-label-vanishes-once-you-add-split-slices-and-terms-aggregation/237376 "2020-07-09T14:45:03Z")
Hi all My Kibana and ES versions are bth 7.7.0 Here is the link to the video that demonstrates the problem I am facing Thanks warmly sanjay --- ## [Errors in filebeat i/o timeout, reconnecting](https://discuss.elastic.co/t/errors-in-filebeat-i-o-timeout-reconnecting/240026)
**Author:** [@George\_Wainwright](https://discuss.elastic.co/u/George_Wainwright)\ **Replies:** 3\ **Last updated:** [July 9, 2020, 2:34pm UTC](https://discuss.elastic.co/t/errors-in-filebeat-i-o-timeout-reconnecting/240026 "2020-07-09T14:34:30Z")
Hi, from time to time I see periodic errors in filebeat logs: 2020-07-06T09:00:12.479-0500 ERROR logstash/sync.go:96 error closing connection to logstash host test-logstash:5044: write tcp 10.120.248.89:48856-\>10.120.24… --- ## [Not skipping the folders and files sending from filebeat to elaticsearch](https://discuss.elastic.co/t/not-skipping-the-folders-and-files-sending-from-filebeat-to-elaticsearch/240267)
**Author:** [@sukku77](https://discuss.elastic.co/u/sukku77)\ **Replies:** 1\ **Last updated:** [July 9, 2020, 2:33pm UTC](https://discuss.elastic.co/t/not-skipping-the-folders-and-files-sending-from-filebeat-to-elaticsearch/240267 "2020-07-09T14:33:31Z")
Hi , I am using filebeat version 7.3.1. There is an issue with the below sample filebeat configuration. I need to skip all the folders named "ignore" as mentioned in paths. I used the exclude\_files pattern, But those l… --- ## [Using Kibana for host and service monitoring](https://discuss.elastic.co/t/using-kibana-for-host-and-service-monitoring/237590)
**Author:** [@ponchofiesta](https://discuss.elastic.co/u/ponchofiesta)\ **Replies:** 1\ **Last updated:** [July 9, 2020, 2:28pm UTC](https://discuss.elastic.co/t/using-kibana-for-host-and-service-monitoring/237590 "2020-07-09T14:28:05Z")
Hi, I'm new to Elasticsearch, Kibana and Beats. Coming from Icinga I have to get host and service monitoring into Kibana (monitoring like which host or service has problems or is not running). Actually I can't see a way… --- ## [NGINX - restructure logging to match nginx module](https://discuss.elastic.co/t/nginx-restructure-logging-to-match-nginx-module/240415)
**Author:** [@Mikki](https://discuss.elastic.co/u/Mikki)\ **Replies:** 1\ **Last updated:** [July 9, 2020, 2:27pm UTC](https://discuss.elastic.co/t/nginx-restructure-logging-to-match-nginx-module/240415 "2020-07-09T14:27:44Z")
Im trying to ingest a custom logformat from nginx log\_format main '$remote\_addr - $http\_x\_forwarded\_for - $http\_true\_client\_ip - $remote\_user \[$time\_local\] "$host" "$request" ' '$status $body\_bytes\_sent "$http\_referer" … --- ## [Upgrade to 7.8.0 failed](https://discuss.elastic.co/t/upgrade-to-7-8-0-failed/240331)
**Author:** [@ggrocott](https://discuss.elastic.co/u/ggrocott)\ **Replies:** 8\ **Last updated:** [July 9, 2020, 2:24pm UTC](https://discuss.elastic.co/t/upgrade-to-7-8-0-failed/240331 "2020-07-09T14:24:33Z")
I have just upgraded from 6.8 to 7.8. When I restarted the service, it fails: ● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: disabled) Ac… --- ## [Multi-String search not working as expeced](https://discuss.elastic.co/t/multi-string-search-not-working-as-expeced/240457)
**Author:** [@ksarkar](https://discuss.elastic.co/u/ksarkar)\ **Replies:** 3\ **Last updated:** [July 9, 2020, 2:23pm UTC](https://discuss.elastic.co/t/multi-string-search-not-working-as-expeced/240457 "2020-07-09T14:23:22Z")
While executing following query, GET /rm\_inventory\_details\*/\_search { "query": { "query\_string": { "default\_field": "usage", "query": "(XYZ)" } } } Getting result. again GET /rm\_inven… --- ## [Kibana Controller widget](https://discuss.elastic.co/t/kibana-controller-widget/237665)
**Author:** [@foakboyun](https://discuss.elastic.co/u/foakboyun)\ **Replies:** 1\ **Last updated:** [July 9, 2020, 2:20pm UTC](https://discuss.elastic.co/t/kibana-controller-widget/237665 "2020-07-09T14:20:03Z")
Hi Everybody, When I add a controller widget on Kibana. The controller affect all widgets on dashboard. I want to disable some controller for some widgets. Can I do this on Kibana? Can you help me? Please. Thanks --- ## [Sorting, Paginating the aggregated data](https://discuss.elastic.co/t/sorting-paginating-the-aggregated-data/240456)
**Author:** [@ankitagarwal9156](https://discuss.elastic.co/u/ankitagarwal9156)\ **Replies:** 11\ **Last updated:** [July 9, 2020, 2:16pm UTC](https://discuss.elastic.co/t/sorting-paginating-the-aggregated-data/240456 "2020-07-09T14:16:52Z")
I need to aggregate the data on the basis of two fields (composite aggregation), sort all the data and then perform pagination. Is is possible using elastic search? If Yes, Can you please share an example. --- ## [Metricbeat mssql performance module does not record data from named instance](https://discuss.elastic.co/t/metricbeat-mssql-performance-module-does-not-record-data-from-named-instance/240536)
**Author:** [@Dominik\_Skiba](https://discuss.elastic.co/u/Dominik_Skiba)\ **Replies:** 2\ **Last updated:** [July 9, 2020, 1:54pm UTC](https://discuss.elastic.co/t/metricbeat-mssql-performance-module-does-not-record-data-from-named-instance/240536 "2020-07-09T13:54:04Z")
Hello, I'd like to re-raise an issue exactly as described in this post Reason I'm doing this is because original post was automatically closed and I couldn't find such bug recorded. Counter query should take named ins… --- ## [How logstash memory behaves with lot of beats connections?](https://discuss.elastic.co/t/how-logstash-memory-behaves-with-lot-of-beats-connections/240365)
**Author:** [@obuez](https://discuss.elastic.co/u/obuez)\ **Replies:** 7\ **Last updated:** [July 9, 2020, 1:47pm UTC](https://discuss.elastic.co/t/how-logstash-memory-behaves-with-lot-of-beats-connections/240365 "2020-07-09T13:47:19Z")
Hi all, We got some little issues in production around Logstash and we are a bit worried for the future, we would like to know the community's opinion on this. Let me explain: We have ran Logstash in production so far … --- ## [Elasticsearch doesn't start node validation exception](https://discuss.elastic.co/t/elasticsearch-doesnt-start-node-validation-exception/240530)
**Author:** [@n4gu4l](https://discuss.elastic.co/u/n4gu4l)\ **Replies:** 0\ **Last updated:** [July 9, 2020, 1:11pm UTC](https://discuss.elastic.co/t/elasticsearch-doesnt-start-node-validation-exception/240530 "2020-07-09T13:11:09Z")
Hi there, After experiencing some disk usage issues i freed some disk space deleting an old index from Kibana WEBUI interface. I wanted to share the path to another partition with more disk space and proceeded to restar… --- ## [Node pool upgrade](https://discuss.elastic.co/t/node-pool-upgrade/240526)
**Author:** [@amanjain](https://discuss.elastic.co/u/amanjain)\ **Replies:** 0\ **Last updated:** [July 9, 2020, 12:42pm UTC](https://discuss.elastic.co/t/node-pool-upgrade/240526 "2020-07-09T12:42:13Z")
Hi Elastic team, I have deployed Elasticsearch 6.x in GKE and I want to perform node pool upgrade. I have checked this doc https://www.elastic.co/guide/en/elasticsearch/reference/current/rolling-upgrades.html I will cr… --- ## [Could not initialize GeoHashGridAggregationBuilder for elastic search 7.8.0](https://discuss.elastic.co/t/could-not-initialize-geohashgridaggregationbuilder-for-elastic-search-7-8-0/240102)
**Author:** [@ayse](https://discuss.elastic.co/u/ayse)\ **Replies:** 6\ **Last updated:** [July 9, 2020, 12:12pm UTC](https://discuss.elastic.co/t/could-not-initialize-geohashgridaggregationbuilder-for-elastic-search-7-8-0/240102 "2020-07-09T12:12:18Z")
Hello, I upgraded Elastic search version to 7.8.0. When I call ElasticSearchAPI I faced with "Caused By: java.lang.NoClassDefFoundError: Could not initialize class org.elasticsearch.search.aggregations.bucket.geogrid.Ge… --- ## [How to generate \_id field manually](https://discuss.elastic.co/t/how-to-generate-id-field-manually/240302)
**Author:** [@onkark](https://discuss.elastic.co/u/onkark)\ **Replies:** 8\ **Last updated:** [July 9, 2020, 12:06pm UTC](https://discuss.elastic.co/t/how-to-generate-id-field-manually/240302 "2020-07-09T12:06:32Z")
I have imported a data of 3.5 crore documents in elasticsearch by using logstash. After I found that the unique field "\_id" is not generated. Now, I want to generate the unique field as "\_id" on all the documents. Can a… --- ## [Aggregation based on terms field is not working](https://discuss.elastic.co/t/aggregation-based-on-terms-field-is-not-working/240423)
**Author:** [@rajthilakr](https://discuss.elastic.co/u/rajthilakr)\ **Replies:** 2\ **Last updated:** [July 9, 2020, 11:59am UTC](https://discuss.elastic.co/t/aggregation-based-on-terms-field-is-not-working/240423 "2020-07-09T11:59:21Z")
Aggregation based on terms field is not working. I loaded the data with different (\_id), with the same data. I Am trying to find a duplicate of records based on one of the index fields. using the below simple terms quer… --- ## [Index reapears 1sec after deleting it](https://discuss.elastic.co/t/index-reapears-1sec-after-deleting-it/240522)
**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\ **Replies:** 2\ **Last updated:** [July 9, 2020, 11:58am UTC](https://discuss.elastic.co/t/index-reapears-1sec-after-deleting-it/240522 "2020-07-09T11:58:15Z")
Hi, I try to delete 2 indices on my cluster. DELETE http://elastic:PASSWORD@IP:9200/index I get back acknowledged true. It gets delteted for 1 second and after that it reapears What it looks like when I look at the s… --- ## [Logstash Output dosent publishes logs while using systemctl](https://discuss.elastic.co/t/logstash-output-dosent-publishes-logs-while-using-systemctl/240410)
**Author:** [@Rahul\_Ravichandran](https://discuss.elastic.co/u/Rahul_Ravichandran)\ **Replies:** 6\ **Last updated:** [July 9, 2020, 11:55am UTC](https://discuss.elastic.co/t/logstash-output-dosent-publishes-logs-while-using-systemctl/240410 "2020-07-09T11:55:19Z")
If I start the logstash service using service or systemctl, it starts there are no errors started successfully but logs dosen't get published there in kibana. If i use " bin/logstash -f /etc/logstash/conf.d/logsta… --- ## [Aggregation by the first character of field](https://discuss.elastic.co/t/aggregation-by-the-first-character-of-field/240307)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 5\ **Last updated:** [July 9, 2020, 11:48am UTC](https://discuss.elastic.co/t/aggregation-by-the-first-character-of-field/240307 "2020-07-09T11:48:49Z")
Dears, Is there any way to do doc aggregation on the first character instead of whole field? My query in case of whole field: GET /log-2020.07.07/\_search?size=0 { "aggs": { "TEXT1": { "terms": { "f… --- ## [Kibana count and elasticsearch count are different](https://discuss.elastic.co/t/kibana-count-and-elasticsearch-count-are-different/240375)
**Author:** [@elisavet](https://discuss.elastic.co/u/elisavet)\ **Replies:** 2\ **Last updated:** [July 9, 2020, 11:44am UTC](https://discuss.elastic.co/t/kibana-count-and-elasticsearch-count-are-different/240375 "2020-07-09T11:44:18Z")
Hello! When I count docs in elasticsearch with the \_count API I get 844, while in kibana I get 623. Why does this happen? Thank you, elisavet --- ## [Need to setup rollover on indexes in elasticsearch](https://discuss.elastic.co/t/need-to-setup-rollover-on-indexes-in-elasticsearch/240516)
**Author:** [@manjeetsingh](https://discuss.elastic.co/u/manjeetsingh)\ **Replies:** 0\ **Last updated:** [July 9, 2020, 11:10am UTC](https://discuss.elastic.co/t/need-to-setup-rollover-on-indexes-in-elasticsearch/240516 "2020-07-09T11:10:39Z")
Hi, I am looking for help in rollover indexes using ILM policy on existing indexes. I have created one policy with below parameters { "rollup-policy" : { "version" : 1, "modified\_date" : "2020-07-09T10:48:54.921Z", … --- ## [Check if restore operation is still running](https://discuss.elastic.co/t/check-if-restore-operation-is-still-running/239764)
**Author:** [@JacFal](https://discuss.elastic.co/u/JacFal)\ **Replies:** 13\ **Last updated:** [July 9, 2020, 11:40am UTC](https://discuss.elastic.co/t/check-if-restore-operation-is-still-running/239764 "2020-07-09T11:40:05Z")
Hello, Is there any way to monitor restore if wait\_for\_completion flag is set to false? For now I use the GET \_recovery API. I have few conditions for each shard in indices to check if restore operation is still runnin… --- ## [\[Filebeat\] "Configured paths: ... " log printed twice every time](https://discuss.elastic.co/t/filebeat-configured-paths-log-printed-twice-every-time/240518)
**Author:** [@wflyer](https://discuss.elastic.co/u/wflyer)\ **Replies:** 0\ **Last updated:** [July 9, 2020, 11:35am UTC](https://discuss.elastic.co/t/filebeat-configured-paths-log-printed-twice-every-time/240518 "2020-07-09T11:35:39Z")
Hello, I'm trying to upgrade filebeat daemonsets in my kubernetes cluster from 7.5.0 to 7.8.0 to fix some bugs. While evaluating new version, I found an issue in the filebeat log. 2020-07-09T11:15:26.303Z INFO … --- ## [Getting error in MAC OS](https://discuss.elastic.co/t/getting-error-in-mac-os/240500)
**Author:** [@inandi](https://discuss.elastic.co/u/inandi)\ **Replies:** 1\ **Last updated:** [July 9, 2020, 11:22am UTC](https://discuss.elastic.co/t/getting-error-in-mac-os/240500 "2020-07-09T11:22:30Z")
getting this error while starting elasticsearch in macOS Catalina via brew \[2020-07-09T14:38:59,510\]\[INFO \]\[o.e.n.Node \] \[node-testgobinda\] initialized \[2020-07-09T14:38:59,512\]\[INFO \]\[o.e.n.Node … --- ## [Error while injecting data from sqlite3 database](https://discuss.elastic.co/t/error-while-injecting-data-from-sqlite3-database/240509)
**Author:** [@Vikash\_Singh1](https://discuss.elastic.co/u/Vikash_Singh1)\ **Replies:** 5\ **Last updated:** [July 9, 2020, 11:19am UTC](https://discuss.elastic.co/t/error-while-injecting-data-from-sqlite3-database/240509 "2020-07-09T11:19:55Z")
Hi I am trying to create index for sqlite3 database but I am getting error saying Pipeline\_id:main Plugin: \"/home/kagamee/liveshield/api-sqlite/Yogesh/SimpleSocketIO/db/networkdata.db", … --- ## [Unable to use variable in curl bash script](https://discuss.elastic.co/t/unable-to-use-variable-in-curl-bash-script/240003)
**Author:** [@Jose\_H](https://discuss.elastic.co/u/Jose_H)\ **Replies:** 2\ **Last updated:** [July 9, 2020, 11:03am UTC](https://discuss.elastic.co/t/unable-to-use-variable-in-curl-bash-script/240003 "2020-07-09T11:03:30Z")
Hi guys. I've been trying to use a variable called "Time Period Variable" in my bash script, but im unable to make it work: #!/bin/bash ES EVENT Threshold number=10 Time Period Variable es\_period=now-1d Elasticsearc… --- ## [Intercept all requests from Kibana to Elasticsearch by using the plugin](https://discuss.elastic.co/t/intercept-all-requests-from-kibana-to-elasticsearch-by-using-the-plugin/240507)
**Author:** [@Uldis\_Liepins](https://discuss.elastic.co/u/Uldis_Liepins)\ **Replies:** 0\ **Last updated:** [July 9, 2020, 10:19am UTC](https://discuss.elastic.co/t/intercept-all-requests-from-kibana-to-elasticsearch-by-using-the-plugin/240507 "2020-07-09T10:19:40Z")
Hi, I am trying to intercept all requests coming from browser to \_msearch (e.g. \_msearch?rest\_total\_hits\_as\_int=true&ignore\_throttled=true) by using the plugin. The idea is to be able to add additional search parameter… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1940) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1942)