# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1974 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1975 --- ## [Matched Words are not highlighted](https://discuss.elastic.co/t/matched-words-are-not-highlighted/238452)
**Author:** [@Shubham](https://discuss.elastic.co/u/Shubham)\ **Replies:** 0\ **Last updated:** [June 24, 2020, 12:01pm UTC](https://discuss.elastic.co/t/matched-words-are-not-highlighted/238452 "2020-06-24T12:01:08Z")
I have placed highlighter in my search query and performing fuzzy search. Some of the matched words aren't highlighted in despite of fuzzy matching with two character change. For example: "James" is matching with "Thames… --- ## [Trial License Extend through Kibana](https://discuss.elastic.co/t/trial-license-extend-through-kibana/238453)
**Author:** [@onkark](https://discuss.elastic.co/u/onkark)\ **Replies:** 1\ **Last updated:** [June 25, 2020, 1:24am UTC](https://discuss.elastic.co/t/trial-license-extend-through-kibana/238453 "2020-06-25T01:24:00Z")
Hi, I wanted to extend the trial license, and i filled the form and didn't get any response. Is there any support contact that i can reach to get a trial extension. --- ## [Can you recover deleted documents when you didnt take s snapshot?](https://discuss.elastic.co/t/can-you-recover-deleted-documents-when-you-didnt-take-s-snapshot/238531)
**Author:** [@chappers72](https://discuss.elastic.co/u/chappers72)\ **Replies:** 1\ **Last updated:** [June 25, 2020, 1:16am UTC](https://discuss.elastic.co/t/can-you-recover-deleted-documents-when-you-didnt-take-s-snapshot/238531 "2020-06-25T01:16:27Z")
I deleted some documents in a bulk process last night by mistake. I need to get them back, I have restores of my VM data directory but they do not appear there (as per docs). Can I get them back? --- ## [Visualization with Kibana of data where a "field"="value"](https://discuss.elastic.co/t/visualization-with-kibana-of-data-where-a-field-value/238575)
**Author:** [@luka.klaric](https://discuss.elastic.co/u/luka.klaric)\ **Replies:** 1\ **Last updated:** [June 25, 2020, 1:13am UTC](https://discuss.elastic.co/t/visualization-with-kibana-of-data-where-a-field-value/238575 "2020-06-25T01:13:33Z")
I am having for example following fields: value\_a, value\_b, city, timestamp. In the same index I will have the the value\_X of more cities. I am trying to create an visualization (for example line) where I will visualize… --- ## [Unable to connect my java application to the Elastic Stack Instance](https://discuss.elastic.co/t/unable-to-connect-my-java-application-to-the-elastic-stack-instance/238430)
**Author:** [@Ubeta](https://discuss.elastic.co/u/Ubeta)\ **Replies:** 2\ **Last updated:** [June 25, 2020, 1:13am UTC](https://discuss.elastic.co/t/unable-to-connect-my-java-application-to-the-elastic-stack-instance/238430 "2020-06-25T01:13:03Z")
Hi! I have set up my Elastic Cloud Service through Google Cloud and have set up an Elastic Search Instance. I can upload my data to Elastic search and query my data just fine. However, when I try to connect to the Elas… --- ## [Struggling with Drop\_Event Processor Syntax and Structure](https://discuss.elastic.co/t/struggling-with-drop-event-processor-syntax-and-structure/238530)
**Author:** [@eafrost.cissp](https://discuss.elastic.co/u/eafrost.cissp)\ **Replies:** 1\ **Last updated:** [June 25, 2020, 1:06am UTC](https://discuss.elastic.co/t/struggling-with-drop-event-processor-syntax-and-structure/238530 "2020-06-25T01:06:24Z")
I'm struggling to get the proper syntax and structure for the following criteria for dropping a specific security log event in Winlogbeat. I can create something that passes the configuration check but it doesn't produce… --- ## [Filebeat with netflow module: independent index problem](https://discuss.elastic.co/t/filebeat-with-netflow-module-independent-index-problem/238571)
**Author:** [@robertitox](https://discuss.elastic.co/u/robertitox)\ **Replies:** 1\ **Last updated:** [June 25, 2020, 12:52am UTC](https://discuss.elastic.co/t/filebeat-with-netflow-module-independent-index-problem/238571 "2020-06-25T00:52:36Z")
Hi people, I enable netflow module in filebeat, and in filebeat.yml file I put this lines: output.elasticsearch: hosts: \["siemtest.provincianet.com.ar:9200"\] protocol: "http" username: "elastic" password: "xxx" ind… --- ## [Elapsed filter doesn't work sometimes](https://discuss.elastic.co/t/elapsed-filter-doesnt-work-sometimes/238557)
**Author:** [@Ferdous\_Khan](https://discuss.elastic.co/u/Ferdous_Khan)\ **Replies:** 4\ **Last updated:** [June 25, 2020, 12:26am UTC](https://discuss.elastic.co/t/elapsed-filter-doesnt-work-sometimes/238557 "2020-06-25T00:26:48Z")
Hello, I am seeing Elapsed filter doesn't work all the times in our staging environment. In our development environment, we have single logstash and elasticsearch instance and Elapsed filter works fine there. But in sta… --- ## [Cross cluster (TLS and Plain Text)](https://discuss.elastic.co/t/cross-cluster-tls-and-plain-text/237939)
**Author:** [@elk\_follower](https://discuss.elastic.co/u/elk_follower)\ **Replies:** 2\ **Last updated:** [June 25, 2020, 12:11am UTC](https://discuss.elastic.co/t/cross-cluster-tls-and-plain-text/237939 "2020-06-25T00:11:00Z")
Hi, Currently we have a ELK 6.8.6 cluster running in Prod and we plan to bring up a new stack with 7.7.1 and TLS enabled along with Open ID Connect. What option do we have to get data from both the cluster in single Ki… --- ## [Index management Logstash vs Elasticsearch](https://discuss.elastic.co/t/index-management-logstash-vs-elasticsearch/238408)
**Author:** [@envycz](https://discuss.elastic.co/u/envycz)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 10:39pm UTC](https://discuss.elastic.co/t/index-management-logstash-vs-elasticsearch/238408 "2020-06-24T22:39:26Z")
Hello, I have ELK stack deployed all on one host for testing purposes and two Filebeat klients sending data from other hosts to it. First one is sending Apache and Icinga monitoring logs from a linux machine directly d… --- ## [Watcher action to call REST API](https://discuss.elastic.co/t/watcher-action-to-call-rest-api/238472)
**Author:** [@chitraj8](https://discuss.elastic.co/u/chitraj8)\ **Replies:** 0\ **Last updated:** [June 24, 2020, 1:04pm UTC](https://discuss.elastic.co/t/watcher-action-to-call-rest-api/238472 "2020-06-24T13:04:47Z")
We would like to use the watcher feature that is part of commercial plugin in x-pack. After exploring the details from docs, we would like to get help on how to call an action that is REST API in the watcher configurati… --- ## [Fetch distinct values in a nested type field in elasticsearch? Can anyone provide one example?](https://discuss.elastic.co/t/fetch-distinct-values-in-a-nested-type-field-in-elasticsearch-can-anyone-provide-one-example/238426)
**Author:** [@divya005](https://discuss.elastic.co/u/divya005)\ **Replies:** 0\ **Last updated:** [June 24, 2020, 9:48am UTC](https://discuss.elastic.co/t/fetch-distinct-values-in-a-nested-type-field-in-elasticsearch-can-anyone-provide-one-example/238426 "2020-06-24T09:48:50Z")
{ "aggs" : { "groupBatches" : { "nested": { "path": "admin" }, "aggs" : { "batches" : { "terms" : {"field" : "admin.ids.batchId"} } } } } } This is i got from 1 link but my requirement is same can anybody h… --- ## [Setup of beat exporter doesn't work](https://discuss.elastic.co/t/setup-of-beat-exporter-doesnt-work/238433)
**Author:** [@vaishno.avi](https://discuss.elastic.co/u/vaishno.avi)\ **Replies:** 0\ **Last updated:** [June 24, 2020, 10:14am UTC](https://discuss.elastic.co/t/setup-of-beat-exporter-doesnt-work/238433 "2020-06-24T10:14:02Z")
Hello, I wanted to export filebeat metrics via beat exporter. filebeat has a conf that exposes the metrics https://www.elastic.co/guide/en/beats/filebeat/master/http-endpoint.html beat exporter's documentation als… --- ## [Enhanced Table plugin](https://discuss.elastic.co/t/enhanced-table-plugin/238486)
**Author:** [@ahadi](https://discuss.elastic.co/u/ahadi)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 10:17pm UTC](https://discuss.elastic.co/t/enhanced-table-plugin/238486 "2020-06-24T22:17:51Z")
Is enhanced table compatible with mobile? I have created a dasboard on witch i make data table and enhanced table .I can see the data table on my mobile but i can't see the enhanced table on mobile. Howerver i can see… --- ## [How to give more priority to certain words in a phrase](https://discuss.elastic.co/t/how-to-give-more-priority-to-certain-words-in-a-phrase/238497)
**Author:** [@Dilip\_Khemani](https://discuss.elastic.co/u/Dilip_Khemani)\ **Replies:** 0\ **Last updated:** [June 24, 2020, 1:52pm UTC](https://discuss.elastic.co/t/how-to-give-more-priority-to-certain-words-in-a-phrase/238497 "2020-06-24T13:52:39Z")
I have an index named product in Elastic Search 7.4 Product has a field named title. If I want to search all titles for blue watch I want to see all results which are blue watch or watch. I do not want to see results l… --- ## [Logstash ES cert authenication is paid or free?](https://discuss.elastic.co/t/logstash-es-cert-authenication-is-paid-or-free/238535)
**Author:** [@PraveenKT](https://discuss.elastic.co/u/PraveenKT)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 10:07pm UTC](https://discuss.elastic.co/t/logstash-es-cert-authenication-is-paid-or-free/238535 "2020-06-24T22:07:22Z")
Is certificate based authentication of Logstash output to elasticsearch is free or paid? --- ## [How does elasticsearch limit the results of a query on multiple index search?](https://discuss.elastic.co/t/how-does-elasticsearch-limit-the-results-of-a-query-on-multiple-index-search/238543)
**Author:** [@Amine\_Maalfi](https://discuss.elastic.co/u/Amine_Maalfi)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 10:06pm UTC](https://discuss.elastic.co/t/how-does-elasticsearch-limit-the-results-of-a-query-on-multiple-index-search/238543 "2020-06-24T22:06:43Z")
Say i queried data that is contained in 5 indexes, and the results are limited to 100 will elasticsearch search all the indexes and get 20 results from each or get 100 results from the first index it encounters? --- ## [Should I make any chown to elasticsearch](https://discuss.elastic.co/t/should-i-make-any-chown-to-elasticsearch/238547)
**Author:** [@azteker](https://discuss.elastic.co/u/azteker)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 9:59pm UTC](https://discuss.elastic.co/t/should-i-make-any-chown-to-elasticsearch/238547 "2020-06-24T21:59:35Z")
Now the /etc/elasticsearch is root.root, and /var/data/elasticsearch and /var/log/elasticsearch are elasticsearch.elasticsearch. Is this correct? --- ## [Logstash with syslog input doesn't send logs to Elasticsearch](https://discuss.elastic.co/t/logstash-with-syslog-input-doesnt-send-logs-to-elasticsearch/238553)
**Author:** [@jelocabral](https://discuss.elastic.co/u/jelocabral)\ **Replies:** 0\ **Last updated:** [June 24, 2020, 7:43pm UTC](https://discuss.elastic.co/t/logstash-with-syslog-input-doesnt-send-logs-to-elasticsearch/238553 "2020-06-24T19:43:20Z")
Dear, I've configured Logstash 7.8.0 with a Syslog input, into an index called "syslog-514-xxxxx": input { udp { port =\> 514 type =\> syslog } } output { elasticsearch { hosts =\> \[ "https://172.31.2.2:9200" \] us… --- ## [Customize filebeat iis log increase x-forwarded-for](https://discuss.elastic.co/t/customize-filebeat-iis-log-increase-x-forwarded-for/238240)
**Author:** [@Fabio\_Scoppetta](https://discuss.elastic.co/u/Fabio_Scoppetta)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 9:28pm UTC](https://discuss.elastic.co/t/customize-filebeat-iis-log-increase-x-forwarded-for/238240 "2020-06-24T21:28:26Z")
Hello, I am use elk 7.3.2 and metricbeat for monitoring capacity environment Now I am trying to use to log iis with x-forwarded-for but in elasitc and kibana i not was saw the public ip for example log 2020-06-22 12:… --- ## [Value in Pivot Field of a transform not found in source index](https://discuss.elastic.co/t/value-in-pivot-field-of-a-transform-not-found-in-source-index/238318)
**Author:** [@sanjaysubramanian](https://discuss.elastic.co/u/sanjaysubramanian)\ **Replies:** 6\ **Last updated:** [June 24, 2020, 9:21pm UTC](https://discuss.elastic.co/t/value-in-pivot-field-of-a-transform-not-found-in-source-index/238318 "2020-06-24T21:21:13Z")
Hi all My transform JSON is illustrated below. A screen shot of the Transform Preview is also attached. TRANSFORM INDEX On the Kibana Discovery Console (index = interactions\_new\_conversations\_transform\_idx) I can sea… --- ## [Send Kibana Dashboard screenshots in HTML email](https://discuss.elastic.co/t/send-kibana-dashboard-screenshots-in-html-email/238534)
**Author:** [@Lakshmy\_S](https://discuss.elastic.co/u/Lakshmy_S)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 9:15pm UTC](https://discuss.elastic.co/t/send-kibana-dashboard-screenshots-in-html-email/238534 "2020-06-24T21:15:20Z")
I have an use case which is to have a watcher check for RED/AMBER metrics in Kibana and it should automatically send a screenshot of the kibana dashboard via html email. In a nutshell the html email should have nice loo… --- ## [Ruby API: difference between indices.template.\* and indices.index\_template](https://discuss.elastic.co/t/ruby-api-difference-between-indices-template-and-indices-index-template/238558)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 0\ **Last updated:** [June 24, 2020, 8:20pm UTC](https://discuss.elastic.co/t/ruby-api-difference-between-indices-template-and-indices-index-template/238558 "2020-06-24T20:20:09Z")
I have been writing some code to manage indexing templates and became very confused over whether I should be using , say, indices.exists\_index\_template.rb or indices.exists\_template.rb. After a lot of trial and error I … --- ## [J2KImageReader not loaded](https://discuss.elastic.co/t/j2kimagereader-not-loaded/238334)
**Author:** [@SKellyRJC](https://discuss.elastic.co/u/SKellyRJC)\ **Replies:** 9\ **Last updated:** [June 24, 2020, 8:14pm UTC](https://discuss.elastic.co/t/j2kimagereader-not-loaded/238334 "2020-06-24T20:14:16Z")
Hi, I have placed the jai-imageio-core-1.3.0.jar and the jai-imageio-jpeg2000-1.3.0.jar into the LIB directory for FSCrawler, however it does not get rid of the warning saying J2KImageReader not loaded? Why would this … --- ## [Role based access control displays Management Section](https://discuss.elastic.co/t/role-based-access-control-displays-management-section/237539)
**Author:** [@bmbrit](https://discuss.elastic.co/u/bmbrit)\ **Replies:** 3\ **Last updated:** [June 24, 2020, 7:53pm UTC](https://discuss.elastic.co/t/role-based-access-control-displays-management-section/237539 "2020-06-24T19:53:39Z")
Hi, I am facing a bug on the Kibana/ElasticSeach. I created a user with a test role that can have access only with Dashboards and Discover Section access but unfortunately, it displays the "Management" Section along wi… --- ## [Save Log Stream settings in Kibana](https://discuss.elastic.co/t/save-log-stream-settings-in-kibana/238541)
**Author:** [@sjabiulla](https://discuss.elastic.co/u/sjabiulla)\ **Replies:** 1\ **Last updated:** [June 24, 2020, 7:49pm UTC](https://discuss.elastic.co/t/save-log-stream-settings-in-kibana/238541 "2020-06-24T19:49:05Z")
When I open Log Stream in Kibana, it shows the logs , which is fine. Is it possible to save that view by saving settings and create multiple views with different settings ? --- ## [Where can I find Elasticsearch,Logstash,Kibana images for 6.6.1 version for Rancher v1.6](https://discuss.elastic.co/t/where-can-i-find-elasticsearch-logstash-kibana-images-for-6-6-1-version-for-rancher-v1-6/238538)
**Author:** [@chinmoy\_padhi](https://discuss.elastic.co/u/chinmoy_padhi)\ **Replies:** 0\ **Last updated:** [June 24, 2020, 5:24pm UTC](https://discuss.elastic.co/t/where-can-i-find-elasticsearch-logstash-kibana-images-for-6-6-1-version-for-rancher-v1-6/238538 "2020-06-24T17:24:16Z")
Hi, Where can I get the Elasticsearch,Kibana,Logstash images for 6.6.1 version for Rancher 1.6 supported version Thanks --- ## [Logstash connection failure to elasticsearch (deduplication pipeline)](https://discuss.elastic.co/t/logstash-connection-failure-to-elasticsearch-deduplication-pipeline/237181)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 4\ **Last updated:** [June 24, 2020, 7:17pm UTC](https://discuss.elastic.co/t/logstash-connection-failure-to-elasticsearch-deduplication-pipeline/237181 "2020-06-24T19:17:12Z")
I have created a pipeline to deduplicate logs in an index. I am facing issues while having logstash connect to the elasticsearch node. IP hosting elasticsearch is 192.168.0.2 and has a self-signed certificate. Followin… --- ## [Message: file too big for single read](https://discuss.elastic.co/t/message-file-too-big-for-single-read/238348)
**Author:** [@hilo21](https://discuss.elastic.co/u/hilo21)\ **Replies:** 2\ **Last updated:** [June 24, 2020, 6:55pm UTC](https://discuss.elastic.co/t/message-file-too-big-for-single-read/238348 "2020-06-24T18:55:28Z")
Hello, Logstash was working fine for me until this started happening. I can't start my logstash instance and I can't find some extra information on this error anywhere. \[2020-06-23T23:03:31,655\]\[INFO \]\[logstash.runner … --- ## [Join Style Queries in Kibana](https://discuss.elastic.co/t/join-style-queries-in-kibana/237117)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 12\ **Last updated:** [June 24, 2020, 6:50pm UTC](https://discuss.elastic.co/t/join-style-queries-in-kibana/237117 "2020-06-24T18:50:44Z")
Hi, Can someone explain to me how I can formulate a query that: Matches documents where the message field contains "string 1" or "string 2" Where the transaction\_id is the same for all documents Thx D [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1973) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1975)