# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1958

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1959

---

## [Kibana ERROR json 핸들링 방법 ㅠㅠ](https://discuss.elastic.co/t/kibana-error-json/239467)

<div class="topic-metadata">

**Author:** [@3d1171c90199bbf3aef1](https://discuss.elastic.co/u/3d1171c90199bbf3aef1)\
**Replies:** 1\
**Last updated:** [July 1, 2020, 2:33pm UTC](https://discuss.elastic.co/t/kibana-error-json/239467 "2020-07-01T14:33:52Z")

</div>

안녕하세요 키바나 쪽 궁금한 사항이 있습니다 ㅠㅠ 도와주세요.. Kibana의 Dashboard를 사용하여 URL로 제공하고있습니다. 해당 URL을 선택하면 dashboard가 나오는 형태이구요.. (http://aaaaaaaaa.com:5601/app/kibana/dashboard/283747hscw8d2?embed=true&g=() 와 같이..) kibana dashboard를 …

---

## [Vega Is Not Showing Anything Despite Code Passing Error-Free](https://discuss.elastic.co/t/vega-is-not-showing-anything-despite-code-passing-error-free/239142)

<div class="topic-metadata">

**Author:** [@Ethan777100](https://discuss.elastic.co/u/Ethan777100)\
**Replies:** 9\
**Last updated:** [July 1, 2020, 2:33pm UTC](https://discuss.elastic.co/t/vega-is-not-showing-anything-despite-code-passing-error-free/239142 "2020-07-01T14:33:14Z")

</div>

im unable to get my Vega to show smth? this the o/p using Vega-Lite 2.0 this is the o/p using Vega 4.0 { "$schema": "https://vega.github.io/schema/vega/v4.json", "data": { "url": { "%context%": true, "%t…

---

## [Index lifecycle create index every day](https://discuss.elastic.co/t/index-lifecycle-create-index-every-day/239471)

<div class="topic-metadata">

**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\
**Replies:** 9\
**Last updated:** [July 1, 2020, 2:30pm UTC](https://discuss.elastic.co/t/index-lifecycle-create-index-every-day/239471 "2020-07-01T14:30:54Z")

</div>

Hello, Is there a way to create new index in index lifecycle manager every day without taking in count the size of the index or other factors? Regards. Peter

---

## [I need help! Elasticsearch does not match my regexp, wildcard, or query\_string queries](https://discuss.elastic.co/t/i-need-help-elasticsearch-does-not-match-my-regexp-wildcard-or-query-string-queries/239473)

<div class="topic-metadata">

**Author:** [@Simon\_Moller](https://discuss.elastic.co/u/Simon_Moller)\
**Replies:** 4\
**Last updated:** [July 1, 2020, 2:29pm UTC](https://discuss.elastic.co/t/i-need-help-elasticsearch-does-not-match-my-regexp-wildcard-or-query-string-queries/239473 "2020-07-01T14:29:57Z")

</div>

I use elasticsearch version: "7.8.0, Build: default/deb/757314695644ea9a1dc2fecd26d1a43856725e65/2020-06-14T19:35:50.234439Z, JVM: 14.0.1" and I have the following document according to the packetbeat index (I have cut i…

---

## [Regression in ES 7.7.0 with es-rally http\_logs Track](https://discuss.elastic.co/t/regression-in-es-7-7-0-with-es-rally-http-logs-track/235954)

<div class="topic-metadata">

**Author:** [@Astro-es](https://discuss.elastic.co/u/Astro-es)\
**Replies:** 6\
**Last updated:** [July 1, 2020, 2:23pm UTC](https://discuss.elastic.co/t/regression-in-es-7-7-0-with-es-rally-http-logs-track/235954 "2020-07-01T14:23:47Z")

</div>

Elasticsearch 7.7.0 shows regression when benchmarked against 7.2.0 for the following challenges in es-rally: Es-Rally Version: 2.0 Track: http\_logs Challenge: append-sorted-no-conflicts Total Regressions: 18 ES Ver…

---

## [Return specified fields using spring data elastic search](https://discuss.elastic.co/t/return-specified-fields-using-spring-data-elastic-search/239465)

<div class="topic-metadata">

**Author:** [@mohsin](https://discuss.elastic.co/u/mohsin)\
**Replies:** 2\
**Last updated:** [July 1, 2020, 2:11pm UTC](https://discuss.elastic.co/t/return-specified-fields-using-spring-data-elastic-search/239465 "2020-07-01T14:11:27Z")

</div>

I have a document User having fields like User(id, name, address, List ) etc. depending upon request we want to return either these three: id, name, address or all the fields, by default ElasticsearchRepository find\*\* m…

---

## [Snapshot and restore Documentation unclear](https://discuss.elastic.co/t/snapshot-and-restore-documentation-unclear/239483)

<div class="topic-metadata">

**Author:** [@Marco\_Phillips](https://discuss.elastic.co/u/Marco_Phillips)\
**Replies:** 5\
**Last updated:** [July 1, 2020, 2:08pm UTC](https://discuss.elastic.co/t/snapshot-and-restore-documentation-unclear/239483 "2020-07-01T14:08:24Z")

</div>

Hi, I feel like the Snapshot documentation is not clear on if it is possible to register a repository locally on a member of a cluster (master) without this being accessible from the other members (non-masters). This p…

---

## [Azure Module in Metricbeat : Monitor Metricset](https://discuss.elastic.co/t/azure-module-in-metricbeat-monitor-metricset/236746)

<div class="topic-metadata">

**Author:** [@wadhah](https://discuss.elastic.co/u/wadhah)\
**Replies:** 13\
**Last updated:** [July 1, 2020, 2:07pm UTC](https://discuss.elastic.co/t/azure-module-in-metricbeat-monitor-metricset/236746 "2020-07-01T14:07:00Z")

</div>

Hello, I want to make efficient use of "Monitor" metricset in "Azure" module on metricbeat side. I am looking to get relevant information regarding disk usage, memory availability of my Azure VMs. The issue is that I …

---

## [Watcher sending alert when condition not met](https://discuss.elastic.co/t/watcher-sending-alert-when-condition-not-met/237169)

<div class="topic-metadata">

**Author:** [@andywt123](https://discuss.elastic.co/u/andywt123)\
**Replies:** 4\
**Last updated:** [July 1, 2020, 2:04pm UTC](https://discuss.elastic.co/t/watcher-sending-alert-when-condition-not-met/237169 "2020-07-01T14:04:33Z")

</div>

I want to send an alert if a cron job has not run in the last 10 minutes. I set the following up in watcher: "query": { "bool": { "must": \[ { "terms": { …

---

## [How to not store the completion suggester in the index in Elasticsearch](https://discuss.elastic.co/t/how-to-not-store-the-completion-suggester-in-the-index-in-elasticsearch/239450)

<div class="topic-metadata">

**Author:** [@gitterhh](https://discuss.elastic.co/u/gitterhh)\
**Replies:** 1\
**Last updated:** [July 1, 2020, 1:50pm UTC](https://discuss.elastic.co/t/how-to-not-store-the-completion-suggester-in-the-index-in-elasticsearch/239450 "2020-07-01T13:50:07Z")

</div>

I want to have a field tags as completion, and I do not want this field to participate in the scoring, so I am trying to apply the mapping "tags": { "type": "completion", "index": false } And I am getting an er…

---

## [Elastic Search Group by a single column - Term Aggregation - TrackTotalHits](https://discuss.elastic.co/t/elastic-search-group-by-a-single-column-term-aggregation-tracktotalhits/239361)

<div class="topic-metadata">

**Author:** [@Naveena1](https://discuss.elastic.co/u/Naveena1)\
**Replies:** 0\
**Last updated:** [June 30, 2020, 6:31pm UTC](https://discuss.elastic.co/t/elastic-search-group-by-a-single-column-term-aggregation-tracktotalhits/239361 "2020-06-30T18:31:46Z")

</div>

Can someone please help me on the below requirement ? I am able to group by single field using Term aggregation but I always end up with fetching top 10 buckets since size defaults to 10. Is there a way where I can …

---

## [Empty String on windows.service.start\_type field while using Metricbeat 7.8.0](https://discuss.elastic.co/t/empty-string-on-windows-service-start-type-field-while-using-metricbeat-7-8-0/238056)

<div class="topic-metadata">

**Author:** [@Jamaluddin](https://discuss.elastic.co/u/Jamaluddin)\
**Replies:** 3\
**Last updated:** [July 1, 2020, 1:41pm UTC](https://discuss.elastic.co/t/empty-string-on-windows-service-start-type-field-while-using-metricbeat-7-8-0/238056 "2020-07-01T13:41:17Z")

</div>

Hi Dear Friends and Master of ELK Stack, I want to ask/report about missing value on windows.service.start\_type field while using Metricbeat 7.8.0. While using Metricbeat 7.7.1 the values of windows.service.start\_type …

---

## [Retrive parent data inside child doc from index](https://discuss.elastic.co/t/retrive-parent-data-inside-child-doc-from-index/239495)

<div class="topic-metadata">

**Author:** [@Sagar\_Darekar](https://discuss.elastic.co/u/Sagar_Darekar)\
**Replies:** 0\
**Last updated:** [July 1, 2020, 1:33pm UTC](https://discuss.elastic.co/t/retrive-parent-data-inside-child-doc-from-index/239495 "2020-07-01T13:33:04Z")

</div>

We have a requirement that we need to retrieve parent fields inside the child document. Actually we have a mapping for the index as below: { "mappings": { "properties": { "relation\_type": { …

---

## [Elasticsearch IP Filtering Not Working](https://discuss.elastic.co/t/elasticsearch-ip-filtering-not-working/239486)

<div class="topic-metadata">

**Author:** [@rameshkokare1](https://discuss.elastic.co/u/rameshkokare1)\
**Replies:** 1\
**Last updated:** [July 1, 2020, 1:01pm UTC](https://discuss.elastic.co/t/elasticsearch-ip-filtering-not-working/239486 "2020-07-01T13:01:05Z")

</div>

Hello, Trying to white list IP's using XPACK security but not workign as expected My config is as below cluster.name: elasticsearch-acsrep node.name: ES1 path.data: /home/ematoacs/data/ path.logs: /home/ematoacs/lo…

---

## [Logstash "Could not index event to Elasticsearch"](https://discuss.elastic.co/t/logstash-could-not-index-event-to-elasticsearch/236181)

<div class="topic-metadata">

**Author:** [@Abdul\_Hameed](https://discuss.elastic.co/u/Abdul_Hameed)\
**Replies:** 11\
**Last updated:** [July 1, 2020, 12:39pm UTC](https://discuss.elastic.co/t/logstash-could-not-index-event-to-elasticsearch/236181 "2020-07-01T12:39:29Z")

</div>

Hi, I am trying to index my data into Elasticsearch from logstash but I keep getting this type of errors for all indices. 2020-05-06T14:38:11,434\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index event to Elastic…

---

## [Unable to create Index Patterns "Error fetching fields for index pattern "](https://discuss.elastic.co/t/unable-to-create-index-patterns-error-fetching-fields-for-index-pattern/239487)

<div class="topic-metadata">

**Author:** [@tenet\_testuser1](https://discuss.elastic.co/u/tenet_testuser1)\
**Replies:** 0\
**Last updated:** [July 1, 2020, 12:38pm UTC](https://discuss.elastic.co/t/unable-to-create-index-patterns-error-fetching-fields-for-index-pattern/239487 "2020-07-01T12:38:55Z")

</div>

Trying to understand what the issue is and how to solve this. I had an index it elasticsearch, and a index pattern in kibana based on that index. I had created reports based on this. I felt on QC that somehow the data…

---

## [Add\_kubernetes\_metadata logs\_path does not use provided value from config](https://discuss.elastic.co/t/add-kubernetes-metadata-logs-path-does-not-use-provided-value-from-config/239482)

<div class="topic-metadata">

**Author:** [@ntx-ben](https://discuss.elastic.co/u/ntx-ben)\
**Replies:** 0\
**Last updated:** [July 1, 2020, 12:27pm UTC](https://discuss.elastic.co/t/add-kubernetes-metadata-logs-path-does-not-use-provided-value-from-config/239482 "2020-07-01T12:27:51Z")

</div>

I just deployed filebeat 7.8.0 in Kubernetes. I cannot get the add\_kubernetes\_metadata to work correctly using logs in /var/log/containers folder location. I need to use that location because I am filtering on container …

---

## [Can we force run LogStash pipeline from Kibana UI](https://discuss.elastic.co/t/can-we-force-run-logstash-pipeline-from-kibana-ui/239479)

<div class="topic-metadata">

**Author:** [@qkhanhpro](https://discuss.elastic.co/u/qkhanhpro)\
**Replies:** 0\
**Last updated:** [July 1, 2020, 12:06pm UTC](https://discuss.elastic.co/t/can-we-force-run-logstash-pipeline-from-kibana-ui/239479 "2020-07-01T12:06:46Z")

</div>

Is there any easy way to configure it from Kibana? I have full control of the LogStash server and running Kibana on Elastic cloud The only possible route I can think of is to create a custom button on Kibana that call a…

---

## [Kibana Controls, Option List doesn't show all strings](https://discuss.elastic.co/t/kibana-controls-option-list-doesnt-show-all-strings/239449)

<div class="topic-metadata">

**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\
**Replies:** 1\
**Last updated:** [July 1, 2020, 11:41am UTC](https://discuss.elastic.co/t/kibana-controls-option-list-doesnt-show-all-strings/239449 "2020-07-01T11:41:55Z")

</div>

Hi I am trying to create an option list with wich I can select specific documents which then are dispayed in a data table. The problem is that the option list only shows strings outside of the \_source field but I want t…

---

## [Best approach for adding columns to a simple Data Table visualization](https://discuss.elastic.co/t/best-approach-for-adding-columns-to-a-simple-data-table-visualization/238195)

<div class="topic-metadata">

**Author:** [@Reuven\_Weiser](https://discuss.elastic.co/u/Reuven_Weiser)\
**Replies:** 2\
**Last updated:** [July 1, 2020, 11:35am UTC](https://discuss.elastic.co/t/best-approach-for-adding-columns-to-a-simple-data-table-visualization/238195 "2020-07-01T11:35:34Z")

</div>

I'm trying to create some simple Data Table visualizations in Kibana 7.4.2, essentially mimicking the results of a Saved Search in Discover, with of course the added ability to download a CSV export. Assume my index is …

---

## [In Kibana, Is there any way to hide "Add Filter" in external Embedded iframe, so that user could not modify the data, Please help out in this. or can we hide through css in source code, if so, where we can](https://discuss.elastic.co/t/in-kibana-is-there-any-way-to-hide-add-filter-in-external-embedded-iframe-so-that-user-could-not-modify-the-data-please-help-out-in-this-or-can-we-hide-through-css-in-source-code-if-so-where-we-can/239245)

<div class="topic-metadata">

**Author:** [@Sravya\_Peddi](https://discuss.elastic.co/u/Sravya_Peddi)\
**Replies:** 1\
**Last updated:** [July 1, 2020, 11:28am UTC](https://discuss.elastic.co/t/in-kibana-is-there-any-way-to-hide-add-filter-in-external-embedded-iframe-so-that-user-could-not-modify-the-data-please-help-out-in-this-or-can-we-hide-through-css-in-source-code-if-so-where-we-can/239245 "2020-07-01T11:28:30Z")

</div>

Continuing the discussion from Embed dashboard or visualization on an external web page with specified filters:

---

## [Filebeat error using processors on inputs file](https://discuss.elastic.co/t/filebeat-error-using-processors-on-inputs-file/239131)

<div class="topic-metadata">

**Author:** [@willyaranda\_vonage](https://discuss.elastic.co/u/willyaranda_vonage)\
**Replies:** 1\
**Last updated:** [July 1, 2020, 11:23am UTC](https://discuss.elastic.co/t/filebeat-error-using-processors-on-inputs-file/239131 "2020-07-01T11:23:00Z")

</div>

Hi, I have tested filebeat correctly using one single filebeat.yml file and works perfectly with my processors. I have split it into a input yml file and the processor stops working. I have tried a lot of things, and i…

---

## [Unable to send data from filebeat 7.7.0 \> logstash 7.7.0 \> elasticsearch 7.7.0](https://discuss.elastic.co/t/unable-to-send-data-from-filebeat-7-7-0-logstash-7-7-0-elasticsearch-7-7-0/239455)

<div class="topic-metadata">

**Author:** [@dyl](https://discuss.elastic.co/u/dyl)\
**Replies:** 3\
**Last updated:** [July 1, 2020, 11:12am UTC](https://discuss.elastic.co/t/unable-to-send-data-from-filebeat-7-7-0-logstash-7-7-0-elasticsearch-7-7-0/239455 "2020-07-01T11:12:51Z")

</div>

Hello, I've got a server "A" which collect informations from a local directory and i try to send these informations to a server "B" with filebeat. My logstash pipeline running into the B server looks like : input { …

---

## [Passing from in suggest queries](https://discuss.elastic.co/t/passing-from-in-suggest-queries/239461)

<div class="topic-metadata">

**Author:** [@guruprasadkk](https://discuss.elastic.co/u/guruprasadkk)\
**Replies:** 0\
**Last updated:** [July 1, 2020, 10:45am UTC](https://discuss.elastic.co/t/passing-from-in-suggest-queries/239461 "2020-07-01T10:45:38Z")

</div>

We are using from and size in normal searches to support pagination for our clients. But we also have to support size and from for typeahead queries. For supporting typeahead queries we are using CompletionSuggestionBu…

---

## [Threshold selection - How to define it?](https://discuss.elastic.co/t/threshold-selection-how-to-define-it/239433)

<div class="topic-metadata">

**Author:** [@Thomas74](https://discuss.elastic.co/u/Thomas74)\
**Replies:** 6\
**Last updated:** [July 1, 2020, 10:16am UTC](https://discuss.elastic.co/t/threshold-selection-how-to-define-it/239433 "2020-07-01T10:16:10Z")

</div>

Hi, I have 4 data nodes with 25 Tb on each for a total of 100Tb of storage. I want to change the cluster threshold because, by default, the option cluster.routing.allocation.disk.watermark.flood\_stage is at 95%. Tha…

---

## [Email fields in ECS 1.5](https://discuss.elastic.co/t/email-fields-in-ecs-1-5/239359)

<div class="topic-metadata">

**Author:** [@sidahmed](https://discuss.elastic.co/u/sidahmed)\
**Replies:** 3\
**Last updated:** [July 1, 2020, 10:11am UTC](https://discuss.elastic.co/t/email-fields-in-ecs-1-5/239359 "2020-07-01T10:11:43Z")

</div>

I have some email fields that i'm indexing. My problem is, fields like CC, Subject ...; don't seem to fit in ECS (Elastic Common Schema). Is ELK team willing to add these fiels in next ECS versions ? or should I use cus…

---

## [Add Nested Field Array Value based on Array String](https://discuss.elastic.co/t/add-nested-field-array-value-based-on-array-string/239286)

<div class="topic-metadata">

**Author:** [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\
**Replies:** 15\
**Last updated:** [July 1, 2020, 10:02am UTC](https://discuss.elastic.co/t/add-nested-field-array-value-based-on-array-string/239286 "2020-07-01T10:02:33Z")

</div>

Hello All, I would like to have some assistance on how to add a nested field array to a new field based on the key string value. As you can see in the json output below, I am simply trying to add the nested field \[prop…

---

## [Set roles priviliges anonymous access kibana](https://discuss.elastic.co/t/set-roles-priviliges-anonymous-access-kibana/239454)

<div class="topic-metadata">

**Author:** [@igarci](https://discuss.elastic.co/u/igarci)\
**Replies:** 0\
**Last updated:** [July 1, 2020, 9:57am UTC](https://discuss.elastic.co/t/set-roles-priviliges-anonymous-access-kibana/239454 "2020-07-01T09:57:08Z")

</div>

Hello I have kibana 7.2 and basic license I am trying to hide or not allow any user to access some space, but there is no documentation to do it. I just want to create a user who can access to different workspaces wit…

---

## [Group by aggregation on nested document](https://discuss.elastic.co/t/group-by-aggregation-on-nested-document/239439)

<div class="topic-metadata">

**Author:** [@davidker](https://discuss.elastic.co/u/davidker)\
**Replies:** 0\
**Last updated:** [July 1, 2020, 8:35am UTC](https://discuss.elastic.co/t/group-by-aggregation-on-nested-document/239439 "2020-07-01T08:35:13Z")

</div>

Let's say I have five document with some nested data: Doc 1 : { id:1, facilities:\[ { type:"hospital" } \], investigator:\[{ name"Robert" }, { …

---

## [Want to plot graph for message parameter value vs time for example i am getting value for response time in message like if message : 300 means 300 is response time for server .Now i want plot graph for message value vs date-time](https://discuss.elastic.co/t/want-to-plot-graph-for-message-parameter-value-vs-time-for-example-i-am-getting-value-for-response-time-in-message-like-if-message-300-means-300-is-response-time-for-server-now-i-want-plot-graph-for-message-value-vs-date-time/239452)

<div class="topic-metadata">

**Author:** [@Amit\_Barate](https://discuss.elastic.co/u/Amit_Barate)\
**Replies:** 1\
**Last updated:** [July 1, 2020, 9:44am UTC](https://discuss.elastic.co/t/want-to-plot-graph-for-message-parameter-value-vs-time-for-example-i-am-getting-value-for-response-time-in-message-like-if-message-300-means-300-is-response-time-for-server-now-i-want-plot-graph-for-message-value-vs-date-time/239452 "2020-07-01T09:44:42Z")

</div>

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1957)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1959)
