# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1998 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1999 --- ## [Root mapping definition has unsupported parameters new](https://discuss.elastic.co/t/root-mapping-definition-has-unsupported-parameters-new/237136)
**Author:** [@Ashwini\_Machale](https://discuss.elastic.co/u/Ashwini_Machale)\ **Replies:** 1\ **Last updated:** [June 15, 2020, 10:39pm UTC](https://discuss.elastic.co/t/root-mapping-definition-has-unsupported-parameters-new/237136 "2020-06-15T22:39:41Z")
reason": "Root mapping definition has unsupported parameters: \[set : {dynamic=true, dynamic\_templates=\[{set={path\_match=\*, mapping={type=text, fields={custom={analyzer=custom\_english, type=text}, raw={index=true, type=ke… --- ## [Tls never works when using pkcs#12 keys but always works with PEM keys](https://discuss.elastic.co/t/tls-never-works-when-using-pkcs-12-keys-but-always-works-with-pem-keys/236868)
**Author:** [@tenet\_testuser1](https://discuss.elastic.co/u/tenet_testuser1)\ **Replies:** 2\ **Last updated:** [June 15, 2020, 10:37pm UTC](https://discuss.elastic.co/t/tls-never-works-when-using-pkcs-12-keys-but-always-works-with-pem-keys/236868 "2020-06-15T22:37:19Z")
I tried this with kibana setup, now this morning I was setting up ES. same issue. 2020-06-12T10:22:05.913196070Z {"type": "server", "timestamp": "2020-06-12T10:22:05,883Z", "level": "ERROR", "component": "o.e.b.Elastic… --- ## [How to update nested field using query in elasticsearch 2.4?](https://discuss.elastic.co/t/how-to-update-nested-field-using-query-in-elasticsearch-2-4/237164)
**Author:** [@prasad98](https://discuss.elastic.co/u/prasad98)\ **Replies:** 1\ **Last updated:** [June 15, 2020, 9:54pm UTC](https://discuss.elastic.co/t/how-to-update-nested-field-using-query-in-elasticsearch-2-4/237164 "2020-06-15T21:54:21Z")
I have made an Elasticsearch query: GET shop/products/\_search { "\_source": \[ "similar\_group.product\_info.product\_id", "shop\_id", "similar\_group.product\_info.tags", "similar\_group.product\_info.… --- ## [How to use search\_as\_you\_type datatype with multiple languages? Best practice/experiences](https://discuss.elastic.co/t/how-to-use-search-as-you-type-datatype-with-multiple-languages-best-practice-experiences/237153)
**Author:** [@as\_ES](https://discuss.elastic.co/u/as_ES)\ **Replies:** 0\ **Last updated:** [June 15, 2020, 2:31pm UTC](https://discuss.elastic.co/t/how-to-use-search-as-you-type-datatype-with-multiple-languages-best-practice-experiences/237153 "2020-06-15T14:31:56Z")
Hi, how does one handle the combination of search\_as\_you\_type dataytpe and fields in multiple languages? Or is it not applicable in such a use-case? For Example: An index of books has a field book\_title and alternativ… --- ## [Aggs Painless DateTime Modify inline](https://discuss.elastic.co/t/aggs-painless-datetime-modify-inline/237162)
**Author:** [@AndyS](https://discuss.elastic.co/u/AndyS)\ **Replies:** 0\ **Last updated:** [June 15, 2020, 3:37pm UTC](https://discuss.elastic.co/t/aggs-painless-datetime-modify-inline/237162 "2020-06-15T15:37:21Z")
Hia, As per title I'm stuck with a painless timezone Q: Customer, WebUI, tz UTC+5 The WebUI issues a query and converts query to UTC Elastic processes in UTC and then aggs by hour and by minute "aggs": { "time": { … --- ## [Enable docker logs with filebeat](https://discuss.elastic.co/t/enable-docker-logs-with-filebeat/237178)
**Author:** [@devwinner](https://discuss.elastic.co/u/devwinner)\ **Replies:** 0\ **Last updated:** [June 15, 2020, 6:17pm UTC](https://discuss.elastic.co/t/enable-docker-logs-with-filebeat/237178 "2020-06-15T18:17:16Z")
Informations about Elk Stack : Version of Kibana : 7.7.1 Version of Elasticsearch : 7.7.1 Version de Metricbeat : 7.7.1 Version de Filebeat : 7.7.1 I have enabled docker module in metricbeat, but i can't see docker … --- ## [Getting issue using Index Lifecycle Policies (Does not point to index and it not a write index)](https://discuss.elastic.co/t/getting-issue-using-index-lifecycle-policies-does-not-point-to-index-and-it-not-a-write-index/237186)
**Author:** [@Pao\_Alcantar](https://discuss.elastic.co/u/Pao_Alcantar)\ **Replies:** 0\ **Last updated:** [June 15, 2020, 8:39pm UTC](https://discuss.elastic.co/t/getting-issue-using-index-lifecycle-policies-does-not-point-to-index-and-it-not-a-write-index/237186 "2020-06-15T20:39:02Z")
Hi all, good day! I am new on this and on the ELK tech, I'm looking for some help to understand what I'm doing wrong with my ILM Policy. I've created the following policy: PUT \_ilm/policy/rollover-120-days { … --- ## [Calculating new fields using ruby filter](https://discuss.elastic.co/t/calculating-new-fields-using-ruby-filter/237163)
**Author:** [@inchirah](https://discuss.elastic.co/u/inchirah)\ **Replies:** 2\ **Last updated:** [June 15, 2020, 9:13pm UTC](https://discuss.elastic.co/t/calculating-new-fields-using-ruby-filter/237163 "2020-06-15T21:13:28Z")
Hi evryone i tried o use ruby filter to calculate 3 new fields: The first is the total number of observation in may table. the second id the number of observations where(Contrainte\>=-78),Contrainte is a field in my cs… --- ## [Filebeat System Module - Multi-line Log Generating One Log Per Line](https://discuss.elastic.co/t/filebeat-system-module-multi-line-log-generating-one-log-per-line/236410)
**Author:** [@uklipse](https://discuss.elastic.co/u/uklipse)\ **Replies:** 6\ **Last updated:** [June 15, 2020, 9:06pm UTC](https://discuss.elastic.co/t/filebeat-system-module-multi-line-log-generating-one-log-per-line/236410 "2020-06-15T21:06:02Z")
I'm enabling the system module of filebeat for the first time on a Ubuntu server. I can see the logs but it's taking what looks like it's taking multiline logs and placing them into single logs per line. Some logs only h… --- ## [Decode and Add derived/custom fields](https://discuss.elastic.co/t/decode-and-add-derived-custom-fields/237175)
**Author:** [@Mike\_Labman](https://discuss.elastic.co/u/Mike_Labman)\ **Replies:** 1\ **Last updated:** [June 15, 2020, 8:57pm UTC](https://discuss.elastic.co/t/decode-and-add-derived-custom-fields/237175 "2020-06-15T20:57:54Z")
I am brand new to elastic. I have regularly incoming data that has an encoded field, i.e. { id: 1, time: "2020-06-15 13:45:00", encoded: "AAIBdQYmaSUAoPy2Bbx7bP9QX4V3UKCHbYGfxjz" } I have external javascript that I us… --- ## [Searching for data over multiple indexes](https://discuss.elastic.co/t/searching-for-data-over-multiple-indexes/237182)
**Author:** [@alphalol](https://discuss.elastic.co/u/alphalol)\ **Replies:** 5\ **Last updated:** [June 15, 2020, 8:44pm UTC](https://discuss.elastic.co/t/searching-for-data-over-multiple-indexes/237182 "2020-06-15T20:44:22Z")
Lets say I have two indices: foo and bar. foo has an id and type field. bar has an id and total field. This is obviously a contrived minimal example, so while you may think the data could be refactored into one docu… --- ## [Excessive plans generated by #MetricBeat](https://discuss.elastic.co/t/excessive-plans-generated-by-metricbeat/236830)
**Author:** [@Brett\_Shearer](https://discuss.elastic.co/u/Brett_Shearer)\ **Replies:** 2\ **Last updated:** [June 15, 2020, 8:35pm UTC](https://discuss.elastic.co/t/excessive-plans-generated-by-metricbeat/236830 "2020-06-15T20:35:32Z")
Hi - I am monitoring queries generated by metric beat and can see that it iterates databases frequently, and then checks log usage on each database. This is done in a way that causes plan cache pollution USE CW-RefDb-E… --- ## [Error: \`fsevents\` module is not installed](https://discuss.elastic.co/t/error-fsevents-module-is-not-installed/237139)
**Author:** [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\ **Replies:** 11\ **Last updated:** [June 15, 2020, 8:32pm UTC](https://discuss.elastic.co/t/error-fsevents-module-is-not-installed/237139 "2020-06-15T20:32:55Z")
Setting up my development area on MacOS Catalina 10.15.5 (19F101) following kibana/CONTRIBUTING.md at main · elastic/kibana · GitHub When running YARN START I get the below error. New platform optimizer error Error: … --- ## [Can X, Y axis be rescaled and disable auto-scaling in Timelion?](https://discuss.elastic.co/t/can-x-y-axis-be-rescaled-and-disable-auto-scaling-in-timelion/237185)
**Author:** [@Maybe](https://discuss.elastic.co/u/Maybe)\ **Replies:** 0\ **Last updated:** [June 15, 2020, 8:29pm UTC](https://discuss.elastic.co/t/can-x-y-axis-be-rescaled-and-disable-auto-scaling-in-timelion/237185 "2020-06-15T20:29:39Z")
Hello, I'm making some graphs using Timelion, but the value only make sense if it's integer. I see Timelion is auto-scaling the y-axis. And I'm using timestamp as x-axis, whenever I changed the time window, or even use … --- ## [Unable to connect local filebeat to distant logstash](https://discuss.elastic.co/t/unable-to-connect-local-filebeat-to-distant-logstash/233498)
**Author:** [@dyl](https://discuss.elastic.co/u/dyl)\ **Replies:** 4\ **Last updated:** [June 15, 2020, 7:36pm UTC](https://discuss.elastic.co/t/unable-to-connect-local-filebeat-to-distant-logstash/233498 "2020-06-15T19:36:54Z")
Hey everyone, I've got an issue when i try to send some logs from A server filebeat to B server ELK. Telnet test : \[root@A:/etc/ansible\]# telnet B 5044 Trying B... Connected to B. Escape character is '^\]'. (same netw… --- ## [Index pattern timeFieldName is getting changed when using CURL command for creation](https://discuss.elastic.co/t/index-pattern-timefieldname-is-getting-changed-when-using-curl-command-for-creation/237118)
**Author:** [@manojkrishna561994](https://discuss.elastic.co/u/manojkrishna561994)\ **Replies:** 1\ **Last updated:** [June 15, 2020, 7:22pm UTC](https://discuss.elastic.co/t/index-pattern-timefieldname-is-getting-changed-when-using-curl-command-for-creation/237118 "2020-06-15T19:22:47Z")
I have a bash script which creates index-pattern using the below curl command and after that http\_poller\_plugin is run. " curl -X POST 'localhost:5601/api/saved\_objects/index-pattern/lucy\_data' -H 'kbn-xsrf: true' -H … --- ## [How to use Controls filter condition?](https://discuss.elastic.co/t/how-to-use-controls-filter-condition/237084)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 1\ **Last updated:** [June 15, 2020, 6:57pm UTC](https://discuss.elastic.co/t/how-to-use-controls-filter-condition/237084 "2020-06-15T18:57:43Z")
I don't want to display the portal-ims service in the drop-down list, but it still appears? Is there any way to filter it out? kibana: 7.4.2 --- ## [Want to have counter field](https://discuss.elastic.co/t/want-to-have-counter-field/237077)
**Author:** [@jyotis](https://discuss.elastic.co/u/jyotis)\ **Replies:** 1\ **Last updated:** [June 15, 2020, 6:50pm UTC](https://discuss.elastic.co/t/want-to-have-counter-field/237077 "2020-06-15T18:50:42Z")
Hi Team, I want to have a counter field which increases by 1 after each update. Please advise a way to achieve it. Thanks --- ## [Your query is taking a while run beyond timeout and error in visualization](https://discuss.elastic.co/t/your-query-is-taking-a-while-run-beyond-timeout-and-error-in-visualization/237071)
**Author:** [@suresh123](https://discuss.elastic.co/u/suresh123)\ **Replies:** 1\ **Last updated:** [June 15, 2020, 6:48pm UTC](https://discuss.elastic.co/t/your-query-is-taking-a-while-run-beyond-timeout-and-error-in-visualization/237071 "2020-06-15T18:48:12Z")
Hi Team, I am getting below error when i change the time frame for last 3 days and another change last 7 days your query is taking a while run beyond timeout and error in visualization Note: Also changed to 60000ms fr… --- ## [Dynamically changing pages](https://discuss.elastic.co/t/dynamically-changing-pages/237053)
**Author:** [@bevano](https://discuss.elastic.co/u/bevano)\ **Replies:** 1\ **Last updated:** [June 15, 2020, 6:43pm UTC](https://discuss.elastic.co/t/dynamically-changing-pages/237053 "2020-06-15T18:43:11Z")
Wondering whether it is possible to dynamically switch dashboards or canvas sheets? If so how? Just some context on my use case, i currently use ELK to ingest application log files. The application are are hosted in var… --- ## [Index Lifecycle Management rollover on time, but deleting every 10min](https://discuss.elastic.co/t/index-lifecycle-management-rollover-on-time-but-deleting-every-10min/237005)
**Author:** [@jbalaguero](https://discuss.elastic.co/u/jbalaguero)\ **Replies:** 3\ **Last updated:** [June 15, 2020, 6:14pm UTC](https://discuss.elastic.co/t/index-lifecycle-management-rollover-on-time-but-deleting-every-10min/237005 "2020-06-15T18:14:27Z")
Hello, We have this setting in our elasticsearch.yml configuration file: indices.lifecycle.poll\_interval: 30s And we have a set of indexes that must roll over every 3 minutes and must be alive for 6 minutes. The roll… --- ## [Getting info from website with docker's logstash image](https://discuss.elastic.co/t/getting-info-from-website-with-dockers-logstash-image/236991)
**Author:** [@brandon1](https://discuss.elastic.co/u/brandon1)\ **Replies:** 4\ **Last updated:** [June 15, 2020, 4:13pm UTC](https://discuss.elastic.co/t/getting-info-from-website-with-dockers-logstash-image/236991 "2020-06-15T16:13:35Z")
I'm new to logstash, and I've been trying to get a docker container working with logstash in order to get data from the stock market for a project. Unfortunately, primarily due to the fact that I have no experience with … --- ## [I am not able to add filebeat index pattern](https://discuss.elastic.co/t/i-am-not-able-to-add-filebeat-index-pattern/236687)
**Author:** [@Sesha\_Sai\_Suhash\_Des](https://discuss.elastic.co/u/Sesha_Sai_Suhash_Des)\ **Replies:** 1\ **Last updated:** [June 15, 2020, 3:48pm UTC](https://discuss.elastic.co/t/i-am-not-able-to-add-filebeat-index-pattern/236687 "2020-06-15T15:48:57Z")
"Your index pattern doesn't match any indices, but you have 1 index which looks similar." This is what it shows when I try to add filebeat-\* as an index. I have filebeat running on my machine. Can someone help me fin… --- ## [Add annotation to TSVB at specific time](https://discuss.elastic.co/t/add-annotation-to-tsvb-at-specific-time/235853)
**Author:** [@butchkelley](https://discuss.elastic.co/u/butchkelley)\ **Replies:** 2\ **Last updated:** [June 15, 2020, 3:35pm UTC](https://discuss.elastic.co/t/add-annotation-to-tsvb-at-specific-time/235853 "2020-06-15T15:35:13Z")
Hello, I need to add a simple annotation to a time series visual every day at 12:10am. I was thinking of adding a document every day at that time than create a annotation query to look for it. Is there a simpler way? … --- ## [Elastic searchguard auditbeat](https://discuss.elastic.co/t/elastic-searchguard-auditbeat/237127)
**Author:** [@Slava\_Gavrilov](https://discuss.elastic.co/u/Slava_Gavrilov)\ **Replies:** 6\ **Last updated:** [June 15, 2020, 3:15pm UTC](https://discuss.elastic.co/t/elastic-searchguard-auditbeat/237127 "2020-06-15T15:15:45Z")
Hi. I've installed yet another instance of auditbeat for my SIEM. The configurations is same as other. But it can't connect to elastic because of not enough permissions (monitor/xpack/license/get). Failed to connect to … --- ## [Return big amount of values without paging](https://discuss.elastic.co/t/return-big-amount-of-values-without-paging/235369)
**Author:** [@ivgenik](https://discuss.elastic.co/u/ivgenik)\ **Replies:** 1\ **Last updated:** [June 15, 2020, 3:05pm UTC](https://discuss.elastic.co/t/return-big-amount-of-values-without-paging/235369 "2020-06-15T15:05:21Z")
Hello, Lets say I got an index with a big amount of documents. Each one has a field called UniqueId. I need to create a query with a simple filter and return all of the uniqueIds that answers the query. The data look… --- ## [Multiple Index Step by step query](https://discuss.elastic.co/t/multiple-index-step-by-step-query/234096)
**Author:** [@ivgenik](https://discuss.elastic.co/u/ivgenik)\ **Replies:** 4\ **Last updated:** [June 15, 2020, 3:09pm UTC](https://discuss.elastic.co/t/multiple-index-step-by-step-query/234096 "2020-06-15T15:09:46Z")
Hello, I probably need to create a multi step multi index query and I am not sure if such a thing is supported or if it is the right approach at all. Example Data: 2 indexes , 1 for orders, 1 for invoices I made a sim… --- ## [Query and return aggs group by terms](https://discuss.elastic.co/t/query-and-return-aggs-group-by-terms/234290)
**Author:** [@ivgenik](https://discuss.elastic.co/u/ivgenik)\ **Replies:** 5\ **Last updated:** [June 15, 2020, 2:56pm UTC](https://discuss.elastic.co/t/query-and-return-aggs-group-by-terms/234290 "2020-06-15T14:56:17Z")
Hello, A minimal data example: ... References: \[ { DocType: { SysName: "order"} DocId: "12345" }, { "DocType: {SysName: "invoice"} "DocId: "22222"} \] MessageDate: "05/05/20" ... I need to query this data, scan the ref… --- ## [Send Auditbeat output to 2 seperate elasticsearch clusters](https://discuss.elastic.co/t/send-auditbeat-output-to-2-seperate-elasticsearch-clusters/237152)
**Author:** [@stenbot](https://discuss.elastic.co/u/stenbot)\ **Replies:** 2\ **Last updated:** [June 15, 2020, 2:46pm UTC](https://discuss.elastic.co/t/send-auditbeat-output-to-2-seperate-elasticsearch-clusters/237152 "2020-06-15T14:46:31Z")
Hello, we currently have Auditbeats installed on multiple servers in our environment feeding an Elasticsearch cluster that does not have TLS enabled. My question is, is it possible to output Auditbeats to a separate clus… --- ## [Would it be possible to reduce the size of the kibana RPM?](https://discuss.elastic.co/t/would-it-be-possible-to-reduce-the-size-of-the-kibana-rpm/236884)
**Author:** [@faxm0dem](https://discuss.elastic.co/u/faxm0dem)\ **Replies:** 2\ **Last updated:** [June 15, 2020, 2:18pm UTC](https://discuss.elastic.co/t/would-it-be-possible-to-reduce-the-size-of-the-kibana-rpm/236884 "2020-06-15T14:18:32Z")
The problem we face is that for some small vms ,it's not possible to upgrade kibana because of its bloated footprint. The file size of the RPM is more than 150MB and contains more than 100000 files ! The last time I tr… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1997) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1999)