# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1959 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1960 --- ## [Frozen Index/Node questions](https://discuss.elastic.co/t/frozen-index-node-questions/239435)
**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\ **Replies:** 5\ **Last updated:** [July 1, 2020, 9:17am UTC](https://discuss.elastic.co/t/frozen-index-node-questions/239435 "2020-07-01T09:17:36Z")
Hi, I have some questions regarding frozen indices. Is there a possibility to declare a node as a "frozen node"? I have a cluster with 3 nodes and I am wondering if I could ad a node which takes all the indices that… --- ## [Gsub - Basic example](https://discuss.elastic.co/t/gsub-basic-example/239436)
**Author:** [@Florent\_Fauvin](https://discuss.elastic.co/u/Florent_Fauvin)\ **Replies:** 2\ **Last updated:** [July 1, 2020, 9:00am UTC](https://discuss.elastic.co/t/gsub-basic-example/239436 "2020-07-01T09:00:11Z")
Hello, I'm trying to use gsub with a very simple example and it doesn't work. I just want to replace "ef" with "AA" with this example: mutate { add\_field =\> { "field1" =\> "abc def ghi jkl" } gsub =\> \["field1… --- ## [Filebeat DNS lookup failure after upgrading coreDNS](https://discuss.elastic.co/t/filebeat-dns-lookup-failure-after-upgrading-coredns/238621)
**Author:** [@Tech\_Techie](https://discuss.elastic.co/u/Tech_Techie)\ **Replies:** 1\ **Last updated:** [July 1, 2020, 8:42am UTC](https://discuss.elastic.co/t/filebeat-dns-lookup-failure-after-upgrading-coredns/238621 "2020-07-01T08:42:27Z")
I was upgrading the EKS version to 1.15 and after I upgrade the coreDNS version to 1.6.6. I got an error log from the filebeat 2020-06-20T20:00:43.298Z WARN transport/tcp.go:53 DNS lookup failure "logstash-collection-he… --- ## [Output email don´t add % fields](https://discuss.elastic.co/t/output-email-don-t-add-fields/239421)
**Author:** [@Txurrispo](https://discuss.elastic.co/u/Txurrispo)\ **Replies:** 2\ **Last updated:** [July 1, 2020, 8:28am UTC](https://discuss.elastic.co/t/output-email-don-t-add-fields/239421 "2020-07-01T08:28:42Z")
Hi all. I´m using a basic ELK stack to pharse windows DC event logs (winbeats) and send email (sendmail) to our Ticket system. When user is created, blocked, changed password etc.... All works. But i see in the docume… --- ## [Script field work in Preview results but not work outside](https://discuss.elastic.co/t/script-field-work-in-preview-results-but-not-work-outside/238631)
**Author:** [@Kirata.J](https://discuss.elastic.co/u/Kirata.J)\ **Replies:** 1\ **Last updated:** [July 1, 2020, 7:58am UTC](https://discuss.elastic.co/t/script-field-work-in-preview-results-but-not-work-outside/238631 "2020-07-01T07:58:07Z")
I try create the topic field of my log message from matching string This is my script, it work when i test it on preview. But it error when I use it on visualize or discover if(doc\['message.keyword'\].size() !=… --- ## [Kibana line cursor error- cursor jumps](https://discuss.elastic.co/t/kibana-line-cursor-error-cursor-jumps/237546)
**Author:** [@Giannis](https://discuss.elastic.co/u/Giannis)\ **Replies:** 1\ **Last updated:** [July 1, 2020, 7:51am UTC](https://discuss.elastic.co/t/kibana-line-cursor-error-cursor-jumps/237546 "2020-07-01T07:51:30Z")
I write without Blancs a word for example elastic Line cursor jumps over the cell border: elastic | and by positioning the cursor again on the end of the word elastic| and add the word search elassearchtic … --- ## [Reducing the deleted docs in the index stats](https://discuss.elastic.co/t/reducing-the-deleted-docs-in-the-index-stats/239431)
**Author:** [@shinji\_kun](https://discuss.elastic.co/u/shinji_kun)\ **Replies:** 0\ **Last updated:** [July 1, 2020, 7:51am UTC](https://discuss.elastic.co/t/reducing-the-deleted-docs-in-the-index-stats/239431 "2020-07-01T07:51:22Z")
Hello, i'm want to import CVE Entrys from a feed. The feed consists of several Files, which gets generate every hour. In each File is a list of CVE Entrys. Most of the newly generated CVE Entrys(JSON), will get enriche… --- ## [Filter Based On Average Score](https://discuss.elastic.co/t/filter-based-on-average-score/239429)
**Author:** [@zamkinos](https://discuss.elastic.co/u/zamkinos)\ **Replies:** 0\ **Last updated:** [July 1, 2020, 7:49am UTC](https://discuss.elastic.co/t/filter-based-on-average-score/239429 "2020-07-01T07:49:54Z")
Hi, I have an index keeps items. My search structure like below: QueryContainer filterDescription = null; QueryContainer filterItemNo = null; QueryContainer filterModelNo = null; QueryContainer… --- ## [Kibana visualization error](https://discuss.elastic.co/t/kibana-visualization-error/235685)
**Author:** [@AshokBachchan](https://discuss.elastic.co/u/AshokBachchan)\ **Replies:** 1\ **Last updated:** [July 1, 2020, 7:49am UTC](https://discuss.elastic.co/t/kibana-visualization-error/235685 "2020-07-01T07:49:06Z")
Dear @Christian\_Dahlqvist , We are unable to check the visualization on Kibana, recently we installed kibana on another server. from that onwards not able to monitor the visualization. Please help on this issue. getti… --- ## [Link url in search results](https://discuss.elastic.co/t/link-url-in-search-results/236633)
**Author:** [@Ostr1969](https://discuss.elastic.co/u/Ostr1969)\ **Replies:** 1\ **Last updated:** [July 1, 2020, 7:45am UTC](https://discuss.elastic.co/t/link-url-in-search-results/236633 "2020-07-01T07:45:17Z")
I have the url field at the search results(local file url) but it adds the origin localhost:5601 when I try to click it cant open. Can I remove the origin that the kibana adds? --- ## [Share kibana dashboad without other panels](https://discuss.elastic.co/t/share-kibana-dashboad-without-other-panels/238001)
**Author:** [@adityaPsl](https://discuss.elastic.co/u/adityaPsl)\ **Replies:** 1\ **Last updated:** [July 1, 2020, 7:41am UTC](https://discuss.elastic.co/t/share-kibana-dashboad-without-other-panels/238001 "2020-07-01T07:41:47Z")
Hello Team, i was just looking for the share dashboard or use Kibana as iFrame. I just want to show Kibana dashboard with filters but i dont want to show left side panel where user can select other dashboards/create vis… --- ## [Filters](https://discuss.elastic.co/t/filters/237808)
**Author:** [@hiba](https://discuss.elastic.co/u/hiba)\ **Replies:** 1\ **Last updated:** [July 1, 2020, 7:29am UTC](https://discuss.elastic.co/t/filters/237808 "2020-07-01T07:29:56Z")
Hi, i want to create controls to visualization not for dashborad. i use kibana 7.7.0 --- ## [Need to show Line chart like Similar to Excel in Kibana](https://discuss.elastic.co/t/need-to-show-line-chart-like-similar-to-excel-in-kibana/239401)
**Author:** [@lohit18](https://discuss.elastic.co/u/lohit18)\ **Replies:** 7\ **Last updated:** [July 1, 2020, 7:28am UTC](https://discuss.elastic.co/t/need-to-show-line-chart-like-similar-to-excel-in-kibana/239401 "2020-07-01T07:28:00Z")
Hello Everyone, I have two columns X - Date Column ( 07/01/2020,06/01/2020,05/01/2020) Y- Value (145,160,1820) Similar to above points line chart should come But in kibana it is not showing like this. kindly help … --- ## [When should I use filebeat instead of logstash](https://discuss.elastic.co/t/when-should-i-use-filebeat-instead-of-logstash/239415)
**Author:** [@Willem\_Jenniskens](https://discuss.elastic.co/u/Willem_Jenniskens)\ **Replies:** 2\ **Last updated:** [July 1, 2020, 7:27am UTC](https://discuss.elastic.co/t/when-should-i-use-filebeat-instead-of-logstash/239415 "2020-07-01T07:27:31Z")
I have a litte trouble understanding filebeat. What can I do with filebeat that I cannot do with logstash? I use logstash to load a bunch of logfiles into ElasticSearch. This works fine. What problem does filebeat solve?… --- ## [Circuit\_breaking\_exception \[parent\] Data too large, data for \[\\]](https://discuss.elastic.co/t/circuit-breaking-exception-parent-data-too-large-data-for-http-request/239423)
**Author:** [@Netanel\_Malka](https://discuss.elastic.co/u/Netanel_Malka)\ **Replies:** 0\ **Last updated:** [July 1, 2020, 7:22am UTC](https://discuss.elastic.co/t/circuit-breaking-exception-parent-data-too-large-data-for-http-request/239423 "2020-07-01T07:22:58Z")
I'm trying to insert bulk of data( ~60M docs) using spark(39 partitions, 10 concurrent) and I get the following exception: org.elasticsearch.hadoop.rest.EsHadoopInvalidRequest: org.elasticsearch.hadoop.rest.EsHadoopRe… --- ## [Fail-over strategy and avoid duplication of events for multiple winlogbeat sending same events to elasticsearch using Windows Event Collector](https://discuss.elastic.co/t/fail-over-strategy-and-avoid-duplication-of-events-for-multiple-winlogbeat-sending-same-events-to-elasticsearch-using-windows-event-collector/239095)
**Author:** [@sid159](https://discuss.elastic.co/u/sid159)\ **Replies:** 3\ **Last updated:** [July 1, 2020, 7:08am UTC](https://discuss.elastic.co/t/fail-over-strategy-and-avoid-duplication-of-events-for-multiple-winlogbeat-sending-same-events-to-elasticsearch-using-windows-event-collector/239095 "2020-07-01T07:08:49Z")
Background (Infrastructure) Events were collected from about thousands of machine on centralize Windows Event Collector (WEC) server. Windows Event Forwarder configure using GPO to collect events of each machine on WEC.… --- ## [Losgtash runs successfully but I doesn't see any logs on command line using stdout](https://discuss.elastic.co/t/losgtash-runs-successfully-but-i-doesnt-see-any-logs-on-command-line-using-stdout/239418)
**Author:** [@Ajaypal](https://discuss.elastic.co/u/Ajaypal)\ **Replies:** 0\ **Last updated:** [July 1, 2020, 7:05am UTC](https://discuss.elastic.co/t/losgtash-runs-successfully-but-i-doesnt-see-any-logs-on-command-line-using-stdout/239418 "2020-07-01T07:05:57Z")
Hi all On logstash system, it receives the syslog messages from my source syslog servers on port 514. Below is the code I have and I see that logstash is running successfully but I don't see output. Can any one help he… --- ## [Transforms API - 8.0 and future releases](https://discuss.elastic.co/t/transforms-api-8-0-and-future-releases/239324)
**Author:** [@tg295](https://discuss.elastic.co/u/tg295)\ **Replies:** 1\ **Last updated:** [July 1, 2020, 6:55am UTC](https://discuss.elastic.co/t/transforms-api-8-0-and-future-releases/239324 "2020-07-01T06:55:58Z")
Can anyone confirm whether the Transforms API will still be available in 8.0 and future releases, and whether it will still be part of X-Pack or a regular feature? Thanks, --- ## [CPAN ES7.8](https://discuss.elastic.co/t/cpan-es7-8/239328)
**Author:** [@R7H9H1A8K7P2R2O7](https://discuss.elastic.co/u/R7H9H1A8K7P2R2O7)\ **Replies:** 2\ **Last updated:** [July 1, 2020, 6:32am UTC](https://discuss.elastic.co/t/cpan-es7-8/239328 "2020-07-01T06:32:29Z")
Hi out there Do you know about any problems between Perl CPAN Lib for ES (https://metacpan.org/release/Search-Elasticsearch) and the new ES7.8? Last: Changes for version 6.80\_1 - 2020-03-11 Updated API and XPack endp… --- ## [How can I add the request IP address to every document?](https://discuss.elastic.co/t/how-can-i-add-the-request-ip-address-to-every-document/239112)
**Author:** [@alphalol](https://discuss.elastic.co/u/alphalol)\ **Replies:** 6\ **Last updated:** [July 1, 2020, 5:24am UTC](https://discuss.elastic.co/t/how-can-i-add-the-request-ip-address-to-every-document/239112 "2020-07-01T05:24:17Z")
Is it possible to add the IP addressed used (in the HTTP request) to the document? I want to do this to then use the geoip processor in a pipeline to add location information? --- ## [Uptime/Metrics interlinked tabs](https://discuss.elastic.co/t/uptime-metrics-interlinked-tabs/239400)
**Author:** [@bevano](https://discuss.elastic.co/u/bevano)\ **Replies:** 0\ **Last updated:** [July 1, 2020, 4:26am UTC](https://discuss.elastic.co/t/uptime-metrics-interlinked-tabs/239400 "2020-07-01T04:26:10Z")
Hi All, I have started installing Metricbeat across all my servers, with one instance of heartbeat pinging all of them as well. When I select 'Host in Uptime' on the generic metrics tab in kibana it brings me to the ge… --- ## [Logstash config for grok (always get \[0\] "\_grokparsefailure")](https://discuss.elastic.co/t/logstash-config-for-grok-always-get-0-grokparsefailure/239342)
**Author:** [@chnaahmad](https://discuss.elastic.co/u/chnaahmad)\ **Replies:** 4\ **Last updated:** [July 1, 2020, 4:03am UTC](https://discuss.elastic.co/t/logstash-config-for-grok-always-get-0-grokparsefailure/239342 "2020-07-01T04:03:46Z")
Hi, I am facing a problem to parse json string in my log file; Actaully i want to parse my json string which is embeded as data={....} as you can see below in log entry. What i am usring: Elastic search : elasticsear… --- ## [Logstash output to redis with dynamic value save in key](https://discuss.elastic.co/t/logstash-output-to-redis-with-dynamic-value-save-in-key/239211)
**Author:** [@kase](https://discuss.elastic.co/u/kase)\ **Replies:** 5\ **Last updated:** [July 1, 2020, 3:53am UTC](https://discuss.elastic.co/t/logstash-output-to-redis-with-dynamic-value-save-in-key/239211 "2020-07-01T03:53:16Z")
Hi there, https://www.elastic.co/guide/en/logstash/current/plugins-outputs-redis.html#plugins-outputs-redis-key In this doc, it says key can save dynamic name, like logstash-%{type} . I have tried key =\> "netflow-%{YY… --- ## [\[illegal\_argument\_exception\] Fielddata is disabled on text fields by default](https://discuss.elastic.co/t/illegal-argument-exception-fielddata-is-disabled-on-text-fields-by-default/237891)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 1\ **Last updated:** [July 1, 2020, 3:21am UTC](https://discuss.elastic.co/t/illegal-argument-exception-fielddata-is-disabled-on-text-fields-by-default/237891 "2020-07-01T03:21:23Z")
I click on kibana apm ui and some errors will appear. I checked the log of kibana and found the following \> "message":"\[illegal\_argument\_exception\] Fielddata is disabled on text fields by default. Set fielddata=true on … --- ## [Where Can I Find Vega-Lite Availability OF Features Comparison Between 2.6.0 and 4.13.1?](https://discuss.elastic.co/t/where-can-i-find-vega-lite-availability-of-features-comparison-between-2-6-0-and-4-13-1/239396)
**Author:** [@Ethan777100](https://discuss.elastic.co/u/Ethan777100)\ **Replies:** 0\ **Last updated:** [July 1, 2020, 3:04am UTC](https://discuss.elastic.co/t/where-can-i-find-vega-lite-availability-of-features-comparison-between-2-6-0-and-4-13-1/239396 "2020-07-01T03:04:36Z")
Since Kibana only support Vega-Lite 2.6.0, whilst the current Vega-Lite available is 4.13.1, i noticed that some visulisations i wanna do like Boxplot - is not possible due to version control. Where can i find a list or… --- ## [Incorrect date range in response and interval in date\_histogram](https://discuss.elastic.co/t/incorrect-date-range-in-response-and-interval-in-date-histogram/239393)
**Author:** [@Rakesh\_Sinha](https://discuss.elastic.co/u/Rakesh_Sinha)\ **Replies:** 0\ **Last updated:** [July 1, 2020, 3:00am UTC](https://discuss.elastic.co/t/incorrect-date-range-in-response-and-interval-in-date-histogram/239393 "2020-07-01T03:00:32Z")
I am trying to run the below query: query: { bool: { must: \[ { match: { app: 'myapp'} }, { range: { timestamp: { lt: '2020-… --- ## [I am having difficulty trying to use ELK-stack with suricata](https://discuss.elastic.co/t/i-am-having-difficulty-trying-to-use-elk-stack-with-suricata/239385)
**Author:** [@noobnoob](https://discuss.elastic.co/u/noobnoob)\ **Replies:** 0\ **Last updated:** [July 1, 2020, 1:18am UTC](https://discuss.elastic.co/t/i-am-having-difficulty-trying-to-use-elk-stack-with-suricata/239385 "2020-07-01T01:18:11Z")
First, I am not good at English, so I am writing a question with the help of Google Translator. Please understand if the grammar is wrong or strange. I'm trying to visualize IDS detections by linking ELK and suricata as… --- ## [Benchmarking search performance with randomised queries](https://discuss.elastic.co/t/benchmarking-search-performance-with-randomised-queries/239388)
**Author:** [@manud](https://discuss.elastic.co/u/manud)\ **Replies:** 1\ **Last updated:** [July 1, 2020, 2:18am UTC](https://discuss.elastic.co/t/benchmarking-search-performance-with-randomised-queries/239388 "2020-07-01T02:18:12Z")
I want to use Rally purely to benchmark search performance as is described here. In order to simulate realistic search conditions I'd like to vary my query during the search operation, for example if my operation looked… --- ## [Incorrect max value on long time spans](https://discuss.elastic.co/t/incorrect-max-value-on-long-time-spans/239389)
**Author:** [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Replies:** 0\ **Last updated:** [July 1, 2020, 2:13am UTC](https://discuss.elastic.co/t/incorrect-max-value-on-long-time-spans/239389 "2020-07-01T02:13:20Z")
Hi, I'm collecting network traffic and I need to find the maximum bytes per second value over a certain span of time. The visualization doesn't matter but for now I'm using this timelion query. $query='location:1234567… --- ## [How can I find some designated value after using split](https://discuss.elastic.co/t/how-can-i-find-some-designated-value-after-using-split/237907)
**Author:** [@kase](https://discuss.elastic.co/u/kase)\ **Replies:** 3\ **Last updated:** [July 1, 2020, 1:32am UTC](https://discuss.elastic.co/t/how-can-i-find-some-designated-value-after-using-split/237907 "2020-07-01T01:32:37Z")
Hi there, I have a filed looks like this format on kibana: flow.tcp\_flags : SYN, RST, PSH, ACK I want to split each type, so I will do fliter { mutate { split =\> \["\[flow\]\[tcp\_flags\]", ","\] } } after this, I … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1958) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1960)