# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1995 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1996 --- ## [Terms query not working as expected](https://discuss.elastic.co/t/terms-query-not-working-as-expected/237357)
**Author:** [@denis\_ritchie](https://discuss.elastic.co/u/denis_ritchie)\ **Replies:** 0\ **Last updated:** [June 16, 2020, 7:43pm UTC](https://discuss.elastic.co/t/terms-query-not-working-as-expected/237357 "2020-06-16T19:43:22Z")
Below is terms query with \_msearch. But its not giving all result.As of now, it only return result for 4161 even though data exists for 4402 as well. please look suggest solution. GET \_msearch { "index": \["index1", "i… --- ## [Retrieve unique key names from "property" field](https://discuss.elastic.co/t/retrieve-unique-key-names-from-property-field/237268)
**Author:** [@mashuma](https://discuss.elastic.co/u/mashuma)\ **Replies:** 8\ **Last updated:** [June 16, 2020, 7:18pm UTC](https://discuss.elastic.co/t/retrieve-unique-key-names-from-property-field/237268 "2020-06-16T19:18:44Z")
Hello everyone, Quick question.. I've got following documents. \[ { "aid": 1, "ameta": { "City": "Brussels", "Fleet": "", "Works": "Building", "Status"… --- ## [Field aliases in search results](https://discuss.elastic.co/t/field-aliases-in-search-results/237354)
**Author:** [@Ram\_Jeghan](https://discuss.elastic.co/u/Ram_Jeghan)\ **Replies:** 0\ **Last updated:** [June 16, 2020, 6:57pm UTC](https://discuss.elastic.co/t/field-aliases-in-search-results/237354 "2020-06-16T18:57:51Z")
The field aliases in search results show the original field names and not aliases. How do we get the alias field names in the search result. Ex: PUT myindex { "mappings": { "properties": { … --- ## [Logstash is not reading the data from the filebeats](https://discuss.elastic.co/t/logstash-is-not-reading-the-data-from-the-filebeats/236636)
**Author:** [@TUSHAR\_Sinha](https://discuss.elastic.co/u/TUSHAR_Sinha)\ **Replies:** 4\ **Last updated:** [June 16, 2020, 6:52pm UTC](https://discuss.elastic.co/t/logstash-is-not-reading-the-data-from-the-filebeats/236636 "2020-06-16T18:52:17Z")
I am trying to load the data into logstash which is read by the file beat, but logstash is unable to read the data. Here are my filebeat debug data that are being generated while running it. 2020-06-11T13:01:41.607+053… --- ## [Unable to create new document/event in logstash Ruby filter using yield](https://discuss.elastic.co/t/unable-to-create-new-document-event-in-logstash-ruby-filter-using-yield/236995)
**Author:** [@Nani\_20](https://discuss.elastic.co/u/Nani_20)\ **Replies:** 2\ **Last updated:** [June 16, 2020, 6:38pm UTC](https://discuss.elastic.co/t/unable-to-create-new-document-event-in-logstash-ruby-filter-using-yield/236995 "2020-06-16T18:38:00Z")
I am trying to calculate elapsed time between the first and last line of a file using a Ruby filter and push the field in a new event using the below Ruby filter ruby { init =\> "@save\_the\_path = 'none'" code =\> " … --- ## [Adding SCSS along with my KIbana plugin (How to pre-build plugin)](https://discuss.elastic.co/t/adding-scss-along-with-my-kibana-plugin-how-to-pre-build-plugin/236949)
**Author:** [@Paul\_Gege](https://discuss.elastic.co/u/Paul_Gege)\ **Replies:** 1\ **Last updated:** [June 16, 2020, 6:29pm UTC](https://discuss.elastic.co/t/adding-scss-along-with-my-kibana-plugin-how-to-pre-build-plugin/236949 "2020-06-16T18:29:45Z")
Hi I've been trying to find out how to add an scss file to my kibana plugin, i'm using version 7.6.2. I ran into this post https://discuss.elastic.co/t/custom-webpack-settings-integration-with-kibana-plugin/195162/6?u=pa… --- ## [Kibana audit logging](https://discuss.elastic.co/t/kibana-audit-logging/236941)
**Author:** [@mtudisco](https://discuss.elastic.co/u/mtudisco)\ **Replies:** 1\ **Last updated:** [June 16, 2020, 6:27pm UTC](https://discuss.elastic.co/t/kibana-audit-logging/236941 "2020-06-16T18:27:35Z")
Hi, I'm about to enable audit logging in kibana, but found documentation lacks information, i refer to: https://www.elastic.co/guide/en/kibana/current/xpack-security-audit-logging.html It says that the events you can … --- ## [Url link have prefix that cant open the file](https://discuss.elastic.co/t/url-link-have-prefix-that-cant-open-the-file/237012)
**Author:** [@Ostr1969](https://discuss.elastic.co/u/Ostr1969)\ **Replies:** 1\ **Last updated:** [June 16, 2020, 6:02pm UTC](https://discuss.elastic.co/t/url-link-have-prefix-that-cant-open-the-file/237012 "2020-06-16T18:02:28Z")
When I click url field in search results it opens the link with prefix of http://localhost:5601. How do I cancel the prefix? --- ## [Metricbeat / php-fpm by fast-cgi protocol and multi pools](https://discuss.elastic.co/t/metricbeat-php-fpm-by-fast-cgi-protocol-and-multi-pools/237307)
**Author:** [@Claude\_Brassel](https://discuss.elastic.co/u/Claude_Brassel)\ **Replies:** 1\ **Last updated:** [June 16, 2020, 5:39pm UTC](https://discuss.elastic.co/t/metricbeat-php-fpm-by-fast-cgi-protocol-and-multi-pools/237307 "2020-06-16T17:39:37Z")
Hi I have multiple php servers that host only the php-fpm process, is they're any way to get metric beat extracting metrics from the php-fpm status page accessing it only by fast-cgi protocol ? And by the way how does … --- ## [Reindex a subset of data to a different index](https://discuss.elastic.co/t/reindex-a-subset-of-data-to-a-different-index/237341)
**Author:** [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\ **Replies:** 2\ **Last updated:** [June 16, 2020, 5:00pm UTC](https://discuss.elastic.co/t/reindex-a-subset-of-data-to-a-different-index/237341 "2020-06-16T17:00:44Z")
Hello all, we're using Elasticsearch to index Windows event logs and keeping them for 6 months; what I would like to do is reindex a subset of data such as: user creation/deletion events group creation/deletion events i… --- ## [Elasticsearch no longer writing to index(s) after upgrading from 7.6 to 7.7](https://discuss.elastic.co/t/elasticsearch-no-longer-writing-to-index-s-after-upgrading-from-7-6-to-7-7/236775)
**Author:** [@dfinn](https://discuss.elastic.co/u/dfinn)\ **Replies:** 1\ **Last updated:** [June 16, 2020, 4:49pm UTC](https://discuss.elastic.co/t/elasticsearch-no-longer-writing-to-index-s-after-upgrading-from-7-6-to-7-7/236775 "2020-06-16T16:49:03Z")
Last night we upgraded from 7.6 to 7.7. Since then we have not had any logs coming into Elasticsearch. Our pipeline looks like so: filebeat on nodes ship to a single ELK server I enabled ruby debug logging in logstas… --- ## [Synchronizing elastic search with relational database](https://discuss.elastic.co/t/synchronizing-elastic-search-with-relational-database/237342)
**Author:** [@Ragav\_Kb](https://discuss.elastic.co/u/Ragav_Kb)\ **Replies:** 0\ **Last updated:** [June 16, 2020, 4:43pm UTC](https://discuss.elastic.co/t/synchronizing-elastic-search-with-relational-database/237342 "2020-06-16T16:43:47Z")
I'm new to elastic search and evaluating a need to synchronize data from relational database to elastic search. This article provided a solution to achieve it - https://www.elastic.co/blog/how-to-keep-elasticsearch-sync… --- ## [Using remote reindex on clusters which doesn't support username & password](https://discuss.elastic.co/t/using-remote-reindex-on-clusters-which-doesnt-support-username-password/237333)
**Author:** [@ankikala](https://discuss.elastic.co/u/ankikala)\ **Replies:** 0\ **Last updated:** [June 16, 2020, 3:44pm UTC](https://discuss.elastic.co/t/using-remote-reindex-on-clusters-which-doesnt-support-username-password/237333 "2020-06-16T15:44:24Z")
Hello, I was exploring the remote reindex feature. Looking at the documentation and a bit of code reading, it seems remote reindex would only work if the cluster supports username & password kind of authentication. So … --- ## [Scalability of ES server](https://discuss.elastic.co/t/scalability-of-es-server/237329)
**Author:** [@Andre\_Dexheimer](https://discuss.elastic.co/u/Andre_Dexheimer)\ **Replies:** 0\ **Last updated:** [June 16, 2020, 3:20pm UTC](https://discuss.elastic.co/t/scalability-of-es-server/237329 "2020-06-16T15:20:16Z")
Hi, I'm running a setup with Elasticsearch, Fluentd and Kibana where a single central aggregator receives data from multiple clients and stores it into elasticsearch, running in a docker compose. I receive about 22GB o… --- ## [Store messages that fail to index to elastisearch into file for later analysis](https://discuss.elastic.co/t/store-messages-that-fail-to-index-to-elastisearch-into-file-for-later-analysis/237298)
**Author:** [@petrkalina](https://discuss.elastic.co/u/petrkalina)\ **Replies:** 1\ **Last updated:** [June 16, 2020, 3:17pm UTC](https://discuss.elastic.co/t/store-messages-that-fail-to-index-to-elastisearch-into-file-for-later-analysis/237298 "2020-06-16T15:17:43Z")
Hello Community, in a logstash / elasticsearch pipeline I notice rare errors similar to this one: \[2020-06-08T17:02:05,621\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main\] Could not index event to Elasticsearch. {:status=\>… --- ## [Creating a visualization that uses filter ratios to see utilization rate of a certain field](https://discuss.elastic.co/t/creating-a-visualization-that-uses-filter-ratios-to-see-utilization-rate-of-a-certain-field/237308)
**Author:** [@Rietty](https://discuss.elastic.co/u/Rietty)\ **Replies:** 5\ **Last updated:** [June 16, 2020, 2:55pm UTC](https://discuss.elastic.co/t/creating-a-visualization-that-uses-filter-ratios-to-see-utilization-rate-of-a-certain-field/237308 "2020-06-16T14:55:00Z")
Hi! I have a very simple query that I need to make with a dashboard/visualization, but can't figure out how. I believe I need to use the visualization builder widget and filter ratios for this, but perhaps there is a bet… --- ## [Grouped bar chart - Canvas](https://discuss.elastic.co/t/grouped-bar-chart-canvas/237151)
**Author:** [@Cate](https://discuss.elastic.co/u/Cate)\ **Replies:** 4\ **Last updated:** [June 16, 2020, 2:16pm UTC](https://discuss.elastic.co/t/grouped-bar-chart-canvas/237151 "2020-06-16T14:16:24Z")
Hi, I would like to create a grouped bar chart i Canvas. In Kibana - Visualize it is possible to create group bar chart using Buckets - Split series. How is it possible to achieve the same result in Canvas? Thanks for… --- ## [How to configure logstash input to accept https post from a third party service](https://discuss.elastic.co/t/how-to-configure-logstash-input-to-accept-https-post-from-a-third-party-service/235472)
**Author:** [@rndee](https://discuss.elastic.co/u/rndee)\ **Replies:** 1\ **Last updated:** [June 16, 2020, 2:07pm UTC](https://discuss.elastic.co/t/how-to-configure-logstash-input-to-accept-https-post-from-a-third-party-service/235472 "2020-06-16T14:07:02Z")
Hi I have a third party service which posts json data to our logstash instance. It is working using http, now I want to harden the connection using https. The third-party service ssl certificate was already registered i… --- ## [Analyzers returning exact word](https://discuss.elastic.co/t/analyzers-returning-exact-word/237201)
**Author:** [@Kevin\_Juliano](https://discuss.elastic.co/u/Kevin_Juliano)\ **Replies:** 1\ **Last updated:** [June 16, 2020, 1:57pm UTC](https://discuss.elastic.co/t/analyzers-returning-exact-word/237201 "2020-06-16T13:57:11Z")
Hi! I successfully indexed and configure phonetic and synonym analyzers, but my problem now is, when I search a word or a phrase, it is returning the exact thing instead of just returning the synonym or the soundex of t… --- ## ["doc\_values: False" not working for simple\_query\_string](https://discuss.elastic.co/t/doc-values-false-not-working-for-simple-query-string/237310)
**Author:** [@cool\_arun](https://discuss.elastic.co/u/cool_arun)\ **Replies:** 0\ **Last updated:** [June 16, 2020, 1:42pm UTC](https://discuss.elastic.co/t/doc-values-false-not-working-for-simple-query-string/237310 "2020-06-16T13:42:49Z")
Hi, I've set "doc\_values": false for some fields because of this when I try to use this in simple\_query\_string it's not searching over those fields, but if I remove the fields parameter from simple\_query\_string it search… --- ## [Differences between 2 groups of documents by multiple criteria](https://discuss.elastic.co/t/differences-between-2-groups-of-documents-by-multiple-criteria/237300)
**Author:** [@mihailo](https://discuss.elastic.co/u/mihailo)\ **Replies:** 1\ **Last updated:** [June 16, 2020, 1:32pm UTC](https://discuss.elastic.co/t/differences-between-2-groups-of-documents-by-multiple-criteria/237300 "2020-06-16T13:32:45Z")
Hello everyone, Please take a look at this dummy documents: \[ { "project": "a", "run": 1, "tool\_name": "tool\_1", "tool\_output": "abc.com" }, { "project": "a", … --- ## [Visalization with aggregate and bucket\_script](https://discuss.elastic.co/t/visalization-with-aggregate-and-bucket-script/237301)
**Author:** [@David70](https://discuss.elastic.co/u/David70)\ **Replies:** 1\ **Last updated:** [June 16, 2020, 1:12pm UTC](https://discuss.elastic.co/t/visalization-with-aggregate-and-bucket-script/237301 "2020-06-16T13:12:51Z")
I'm trying to create a visualization based on the number of days between createdAt and publishedAt. I'm struggling to add the aggregation based on a bucket\_script to Kibana's visualization tab. How do I do it? Below is … --- ## [Implement cross\_field in simple\_query\_string](https://discuss.elastic.co/t/implement-cross-field-in-simple-query-string/237304)
**Author:** [@pilo](https://discuss.elastic.co/u/pilo)\ **Replies:** 0\ **Last updated:** [June 16, 2020, 1:12pm UTC](https://discuss.elastic.co/t/implement-cross-field-in-simple-query-string/237304 "2020-06-16T13:12:39Z")
can we use cross\_fields mode in simple\_query\_string ? I just read this topic about stopword analyzer in simple\_query\_string : This topic give me two perfect solutions: one is using cross\_field mode with multi\_ma… --- ## [Fs snapshot permission issues inside a kubernetes cluster](https://discuss.elastic.co/t/fs-snapshot-permission-issues-inside-a-kubernetes-cluster/237147)
**Author:** [@Rajashree\_Sekar](https://discuss.elastic.co/u/Rajashree_Sekar)\ **Replies:** 2\ **Last updated:** [June 16, 2020, 1:06pm UTC](https://discuss.elastic.co/t/fs-snapshot-permission-issues-inside-a-kubernetes-cluster/237147 "2020-06-16T13:06:37Z")
Hi Team, I'm trying to take snapshot of elasticsearch which is deployed inside a kubernetes cluster. I'm trying to take backup on file system whereas Im getting below error. I understand that the default user will be … --- ## [Issue with filter configuration in logstash](https://discuss.elastic.co/t/issue-with-filter-configuration-in-logstash/236911)
**Author:** [@kittu9999](https://discuss.elastic.co/u/kittu9999)\ **Replies:** 4\ **Last updated:** [June 12, 2020, 5:18pm UTC](https://discuss.elastic.co/t/issue-with-filter-configuration-in-logstash/236911 "2020-06-12T17:18:40Z")
Hello, we are having an issue with filter configuration in the logstash. we have upgraded the logstash form 5 to logstash 6.8.1 version. the filter configuration was working fine in logstash 5.4 version, but not in the… --- ## [Kibana Visualization with string filter](https://discuss.elastic.co/t/kibana-visualization-with-string-filter/235964)
**Author:** [@Santosh\_Boorlagadda](https://discuss.elastic.co/u/Santosh_Boorlagadda)\ **Replies:** 2\ **Last updated:** [June 16, 2020, 12:28pm UTC](https://discuss.elastic.co/t/kibana-visualization-with-string-filter/235964 "2020-06-16T12:28:08Z")
Hi, I am trying to create a pie chart filtering two strings. I have to get a pie diagram on operation(my field) contains string with Add or subtract. Suppose If I have 10 documents with operation field string contains… --- ## [Rollup indexes - pattern definition and visualization](https://discuss.elastic.co/t/rollup-indexes-pattern-definition-and-visualization/237295)
**Author:** [@parosio](https://discuss.elastic.co/u/parosio)\ **Replies:** 0\ **Last updated:** [June 16, 2020, 12:19pm UTC](https://discuss.elastic.co/t/rollup-indexes-pattern-definition-and-visualization/237295 "2020-06-16T12:19:32Z")
Hello, I'm using a rather old version (6.8), but have some problems/questions that hope had been addressed and solved in 7.x. (because, as it is in 6.8, rollup isn't that much useful (for visualization purposes, at lea… --- ## [Multiline XML not parsing](https://discuss.elastic.co/t/multiline-xml-not-parsing/237293)
**Author:** [@DWbank](https://discuss.elastic.co/u/DWbank)\ **Replies:** 0\ **Last updated:** [June 16, 2020, 12:14pm UTC](https://discuss.elastic.co/t/multiline-xml-not-parsing/237293 "2020-06-16T12:14:35Z")
There are may different examples out here on how to take Nessus files and bring them in to Elastic via Logstash. I have read them and tried many different configs. Here is the XML file I am trying to read in. https://… --- ## [Can't run race, Cannot find /root/.rally/benchmarks/data/geonames/documents-2.json.bz2](https://discuss.elastic.co/t/cant-run-race-cannot-find-root-rally-benchmarks-data-geonames-documents-2-json-bz2/236846)
**Author:** [@huasheng\_zeng](https://discuss.elastic.co/u/huasheng_zeng)\ **Replies:** 2\ **Last updated:** [June 16, 2020, 11:59am UTC](https://discuss.elastic.co/t/cant-run-race-cannot-find-root-rally-benchmarks-data-geonames-documents-2-json-bz2/236846 "2020-06-16T11:59:26Z")
I can't run race, It says Cannot race. Error in track preparator (('Cannot find /root/.rally/benchmarks/data/geonames/documents-2.json.bz2. I'm sure my data file is exist. my operation and shell output is below \[r… --- ## [Issues with geoip data logstash and filebeat using iis logs](https://discuss.elastic.co/t/issues-with-geoip-data-logstash-and-filebeat-using-iis-logs/236933)
**Author:** [@genehunter29009](https://discuss.elastic.co/u/genehunter29009)\ **Replies:** 6\ **Last updated:** [June 16, 2020, 11:57am UTC](https://discuss.elastic.co/t/issues-with-geoip-data-logstash-and-filebeat-using-iis-logs/236933 "2020-06-16T11:57:56Z")
Having a hard time getting geoip to work. I have the latest current verion of filebeat and logstash. filebeat 7.7.7 template is loaded. one strange thing also I get like 6 ip addresses when I use geoip but nothing els… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1994) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1996)