# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=252 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 253 --- ## [Error When Open Elastic Search](https://discuss.elastic.co/t/error-when-open-elastic-search/358452)
**Author:** [@tikoretech](https://discuss.elastic.co/u/tikoretech)\ **Replies:** 1\ **Last updated:** [April 30, 2024, 10:55am UTC](https://discuss.elastic.co/t/error-when-open-elastic-search/358452 "2024-04-30T10:55:40Z")
Hy, when login, i see this error: Definition of plugin "urlForwarding" not found and may have failed to load. Version: 8.13.2 Build: 72154 Error: Definition of plugin "urlForwarding" not found and may have failed to lo… --- ## [For a given folderName and Doc\_name, we need to check what are the values of Doc\_IDs](https://discuss.elastic.co/t/for-a-given-foldername-and-doc-name-we-need-to-check-what-are-the-values-of-doc-ids/357761)
**Author:** [@2328943\_dc](https://discuss.elastic.co/u/2328943_dc)\ **Replies:** 1\ **Last updated:** [April 30, 2024, 10:50am UTC](https://discuss.elastic.co/t/for-a-given-foldername-and-doc-name-we-need-to-check-what-are-the-values-of-doc-ids/357761 "2024-04-30T10:50:21Z")
For a given folderName and Doc\_name, we need to check what are the values of Doc\_IDs. Eg. There are 3 Doc\_Ids (-1, 922554842, 922555415) for the foldername=6537134057912042024 and Doc\_Name= ka28en4592.zip. Now we need … --- ## [Enrich Policy - Match IP type](https://discuss.elastic.co/t/enrich-policy-match-ip-type/357724)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 0\ **Last updated:** [April 18, 2024, 2:52pm UTC](https://discuss.elastic.co/t/enrich-policy-match-ip-type/357724 "2024-04-18T14:52:14Z")
Hello, Can you do an enrich policy where the match field is an IP address. Essentially, I want to match an IP address to another and enrich the other index with host information related to the IP. Thanks, --- ## [Switch tail to read mode, but logs not streaming to Kibana](https://discuss.elastic.co/t/switch-tail-to-read-mode-but-logs-not-streaming-to-kibana/356624)
**Author:** [@nandydesikan](https://discuss.elastic.co/u/nandydesikan)\ **Replies:** 0\ **Last updated:** [April 2, 2024, 3:43pm UTC](https://discuss.elastic.co/t/switch-tail-to-read-mode-but-logs-not-streaming-to-kibana/356624 "2024-04-02T15:43:32Z")
Thanks for insights I gained from this topic - Grokparsefailure randomly - #5 by fry2k I switched from default tail mode to read mode. However, logs are not streaming to kibana after the switch (restarted the server whi… --- ## [Start kibana docker to be available in the local network](https://discuss.elastic.co/t/start-kibana-docker-to-be-available-in-the-local-network/358116)
**Author:** [@javidr](https://discuss.elastic.co/u/javidr)\ **Replies:** 1\ **Last updated:** [April 30, 2024, 9:06am UTC](https://discuss.elastic.co/t/start-kibana-docker-to-be-available-in-the-local-network/358116 "2024-04-30T09:06:05Z")
Hi I am following this guide to start ELK in docker images - Run Elasticsearch locally | Elasticsearch Guide \[8.13\] | Elastic I want to expose my kibana to my local network so other devices at home can access those das… --- ## [Method redefined; discarding old to\_int](https://discuss.elastic.co/t/method-redefined-discarding-old-to-int/358463)
**Author:** [@m\_pahlevanzadeh](https://discuss.elastic.co/u/m_pahlevanzadeh)\ **Replies:** 1\ **Last updated:** [April 30, 2024, 8:59am UTC](https://discuss.elastic.co/t/method-redefined-discarding-old-to-int/358463 "2024-04-30T08:59:49Z")
Hello, When I don't use any filter, logstash work fine. and 5044 is up. But when I use any filter , I get the following error: /usr/share/logstash/bin/logstash -t Using bundled JDK: /usr/share/logstash/jdk /usr/share/l… --- ## [Unable to setup Uptime Monitors in Ubuntu](https://discuss.elastic.co/t/unable-to-setup-uptime-monitors-in-ubuntu/358444)
**Author:** [@Manoilayans](https://discuss.elastic.co/u/Manoilayans)\ **Replies:** 3\ **Last updated:** [April 30, 2024, 8:58am UTC](https://discuss.elastic.co/t/unable-to-setup-uptime-monitors-in-ubuntu/358444 "2024-04-30T08:58:10Z")
While running the below command ./heartbeat setup getting error as per below bash: ./heartbeat: cannot execute binary file: Exec format error Info: OS: Ubuntu Elasticsearch, Kibana version: 7.17.18 While setting u… --- ## [Search: minimum\_should\_match: 100% not working when single term expands two more terms](https://discuss.elastic.co/t/search-minimum-should-match-100-not-working-when-single-term-expands-two-more-terms/358119)
**Author:** [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Replies:** 2\ **Last updated:** [April 30, 2024, 8:55am UTC](https://discuss.elastic.co/t/search-minimum-should-match-100-not-working-when-single-term-expands-two-more-terms/358119 "2024-04-30T08:55:41Z")
Hey, I found an interesting behaviour for an OR based query that has minimum\_should\_match: 100% set. Naively I thought that this means, it behaves the same as an AND, but it does not. Example: DELETE test PUT test {… --- ## [Error when installing elastic agent using M1 and Macos Sonoma](https://discuss.elastic.co/t/error-when-installing-elastic-agent-using-m1-and-macos-sonoma/358045)
**Author:** [@dwinda3678](https://discuss.elastic.co/u/dwinda3678)\ **Replies:** 0\ **Last updated:** [April 23, 2024, 4:09pm UTC](https://discuss.elastic.co/t/error-when-installing-elastic-agent-using-m1-and-macos-sonoma/358045 "2024-04-23T16:09:49Z")
Hello, im trying to install an elastic agent with fleet using macos Sonoma, but the installation always failed and showing : Error: failed to fix permissions: chown /Library/Elastic/Agent/data/elastic-agent-913c02/elast… --- ## [Kibana unable to start](https://discuss.elastic.co/t/kibana-unable-to-start/357737)
**Author:** [@Dhia\_Said](https://discuss.elastic.co/u/Dhia_Said)\ **Replies:** 1\ **Last updated:** [April 30, 2024, 8:49am UTC](https://discuss.elastic.co/t/kibana-unable-to-start/357737 "2024-04-30T08:49:36Z")
hello so i downloaded elasticsearch and kibana 8.2.1 on my ubuntu 22.04 machine and whenever i start kibana (i added enrollement token and i edited the yaml file) it just doesn't work and i don't know , it gives me this … --- ## [Elasticsearch Performance Metrics](https://discuss.elastic.co/t/elasticsearch-performance-metrics/358001)
**Author:** [@Frances\_Chu](https://discuss.elastic.co/u/Frances_Chu)\ **Replies:** 2\ **Last updated:** [April 30, 2024, 8:14am UTC](https://discuss.elastic.co/t/elasticsearch-performance-metrics/358001 "2024-04-30T08:14:01Z")
I enabled the stack monitoring in kibana. index something like .monitoring-es created I would like to know is it possible to get the average primary shards indexing rate Max primary shards indexing rate average index… --- ## [Mixed OS cluster - poor performance](https://discuss.elastic.co/t/mixed-os-cluster-poor-performance/358400)
**Author:** [@lubasz](https://discuss.elastic.co/u/lubasz)\ **Replies:** 2\ **Last updated:** [April 30, 2024, 7:37am UTC](https://discuss.elastic.co/t/mixed-os-cluster-poor-performance/358400 "2024-04-30T07:37:58Z")
Hello, My company has made changes and for new servers we only use RHEL OS. So for current configuration I have mixed OS cluster (Elasticsearch v 8.11.1): 1x Master Node - Debian 12.2 2x Data Nodes - Debian 12.2 2x D… --- ## ["message":"Authentication of \[kibana\_system\] was terminated by realm \[reserved\] - failed to authenticate user \[kibana\_system\]"](https://discuss.elastic.co/t/message-authentication-of-kibana-system-was-terminated-by-realm-reserved-failed-to-authenticate-user-kibana-system/358460)
**Author:** [@mohammadreza\_davarza](https://discuss.elastic.co/u/mohammadreza_davarza)\ **Replies:** 0\ **Last updated:** [April 30, 2024, 5:50am UTC](https://discuss.elastic.co/t/message-authentication-of-kibana-system-was-terminated-by-realm-reserved-failed-to-authenticate-user-kibana-system/358460 "2024-04-30T05:50:41Z")
hello i wrote a compose file for setting up elastic and kibana but it seems that in kibana environment section ELASTICSEARCH\_PASSWORD="something" can't pass the value to elastic container. i checked the compose file … --- ## [Failed to load resource: the server responded with a status of 406 (Not Acceptable)](https://discuss.elastic.co/t/failed-to-load-resource-the-server-responded-with-a-status-of-406-not-acceptable/358408)
**Author:** [@Sunil\_Jagtap](https://discuss.elastic.co/u/Sunil_Jagtap)\ **Replies:** 4\ **Last updated:** [April 30, 2024, 4:43am UTC](https://discuss.elastic.co/t/failed-to-load-resource-the-server-responded-with-a-status-of-406-not-acceptable/358408 "2024-04-30T04:43:31Z")
We have added plugin to kibana but facing as error (we can see on console tab of browser) while making API call to elasticsearch=\> Failed to load resource: the server responded with a status of 406 (Not Acceptable) --- ## [Hierarchical user management setup](https://discuss.elastic.co/t/hierarchical-user-management-setup/356886)
**Author:** [@cshacks](https://discuss.elastic.co/u/cshacks)\ **Replies:** 1\ **Last updated:** [April 30, 2024, 4:40am UTC](https://discuss.elastic.co/t/hierarchical-user-management-setup/356886 "2024-04-30T04:40:08Z")
Hello, So, I am curious if there is a way to setup a hierarchical user management system where I would have one account in Kibana that has the "superuser" role, then I would have other accounts with a custom role called… --- ## [Same space usage when disabling storing the source document](https://discuss.elastic.co/t/same-space-usage-when-disabling-storing-the-source-document/358451)
**Author:** [@ahmedasadi](https://discuss.elastic.co/u/ahmedasadi)\ **Replies:** 2\ **Last updated:** [April 30, 2024, 3:20am UTC](https://discuss.elastic.co/t/same-space-usage-when-disabling-storing-the-source-document/358451 "2024-04-30T03:20:33Z")
Hi, I've ingested 120GB of data into an elasticsearch index, and ~115GB of that data is used for storing the source document. Considering I don't need the source document and I only need the IDs of the documents that ma… --- ## [Security\_exception: unable to authenticate user \[me\] for REST request \[/\_nodes?filter\_path=nodes.\*.version%2Cnodes.\*.http.publish\_address%2Cnodes.\*.ip\]](https://discuss.elastic.co/t/security-exception-unable-to-authenticate-user-me-for-rest-request-nodes-filter-path-nodes-version-2cnodes-http-publish-address-2cnodes-ip/358442)
**Author:** [@clarac1996](https://discuss.elastic.co/u/clarac1996)\ **Replies:** 5\ **Last updated:** [April 30, 2024, 2:43am UTC](https://discuss.elastic.co/t/security-exception-unable-to-authenticate-user-me-for-rest-request-nodes-filter-path-nodes-version-2cnodes-http-publish-address-2cnodes-ip/358442 "2024-04-30T02:43:21Z")
Hello! I really need some help, been struggling with this. I am trying to set up Kibana and Elasticsearch using docker-compose, and I have already generated a service account user (left it as my name clara), but the kib… --- ## [Logstash Elasticsearch input plugin configuration to pull data from cluster](https://discuss.elastic.co/t/logstash-elasticsearch-input-plugin-configuration-to-pull-data-from-cluster/358449)
**Author:** [@Sravani\_Sasubilli](https://discuss.elastic.co/u/Sravani_Sasubilli)\ **Replies:** 0\ **Last updated:** [April 29, 2024, 9:07pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-input-plugin-configuration-to-pull-data-from-cluster/358449 "2024-04-29T21:07:44Z")
Hi, I am trying to pull data from on-premises cluster is with SSL is enabled and I am working with Logstash -7.16.3 version and Elastic cluster is 7.17.11 version. Below is the error I am getting and Logstash configur… --- ## [Logstash OOM kills - k8s - 8.13.0](https://discuss.elastic.co/t/logstash-oom-kills-k8s-8-13-0/358423)
**Author:** [@d4nnyx](https://discuss.elastic.co/u/d4nnyx)\ **Replies:** 0\ **Last updated:** [April 29, 2024, 11:39am UTC](https://discuss.elastic.co/t/logstash-oom-kills-k8s-8-13-0/358423 "2024-04-29T11:39:37Z")
Hi everyone, We are using the logging pipeline Filebeat -\> Logstash -\> Dataset/Scalyr. The issue I'm dealing with is that the Logstash memory keeps increasing until the OOM kills the pod (so we are talking about OS OOM… --- ## [Canvas User not authorized for /internal/uptime/index\_status](https://discuss.elastic.co/t/canvas-user-not-authorized-for-internal-uptime-index-status/358438)
**Author:** [@fgjensen](https://discuss.elastic.co/u/fgjensen)\ **Replies:** 1\ **Last updated:** [April 29, 2024, 8:07pm UTC](https://discuss.elastic.co/t/canvas-user-not-authorized-for-internal-uptime-index-status/358438 "2024-04-29T20:07:23Z")
I have created a dedicated space and a role for a specific group users. The role gives read access to documents in some indices. The role has Kibana read privileges to dashboards and Canvas. I have deployed one Canvas an… --- ## [Filebeat installation](https://discuss.elastic.co/t/filebeat-installation/358447)
**Author:** [@Ali\_A](https://discuss.elastic.co/u/Ali_A)\ **Replies:** 0\ **Last updated:** [April 29, 2024, 7:47pm UTC](https://discuss.elastic.co/t/filebeat-installation/358447 "2024-04-29T19:47:13Z")
hello guys, I am trying to install filebeat on my firewall through kalipurple terminal, but as you can see I am not able to proceed because the make install command is not working, I tried some tricks but it's not workin… --- ## [Kibana and elasticsearch failing to start](https://discuss.elastic.co/t/kibana-and-elasticsearch-failing-to-start/357732)
**Author:** [@Ali\_A](https://discuss.elastic.co/u/Ali_A)\ **Replies:** 3\ **Last updated:** [April 29, 2024, 7:43pm UTC](https://discuss.elastic.co/t/kibana-and-elasticsearch-failing-to-start/357732 "2024-04-29T19:43:23Z")
everything was working fine until I changed the IP for my virtual machine, when I tried to open the localhost it was saying kibana server is not ready yet, after that I tried some solutions but ended up facing this frus… --- ## [Elasticsearch cluster across multiple docker hosts](https://discuss.elastic.co/t/elasticsearch-cluster-across-multiple-docker-hosts/358314)
**Author:** [@Janusz\_Mikluszka](https://discuss.elastic.co/u/Janusz_Mikluszka)\ **Replies:** 4\ **Last updated:** [April 29, 2024, 5:59pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-across-multiple-docker-hosts/358314 "2024-04-29T17:59:13Z")
Hello, I'm trying to create multi node cluster across multiple VMs running docker. For now I tried setting up master node on my local docker engine. When second node is in the same docker network then there is no issue… --- ## [Dash canvas adjustment](https://discuss.elastic.co/t/dash-canvas-adjustment/356614)
**Author:** [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\ **Replies:** 1\ **Last updated:** [April 29, 2024, 5:03pm UTC](https://discuss.elastic.co/t/dash-canvas-adjustment/356614 "2024-04-29T17:03:29Z")
In this forum I found this screen that shows the day and time in real time however it comes in the form to x/xx/xxxx 0-00-00 I would like it to be in the format xx/xx/xxxx 00-00-00 { "$schema": "https://vega.github.i… --- ## [What is the most (time-)efficient way to "join" two indexes in elasticsearch?](https://discuss.elastic.co/t/what-is-the-most-time-efficient-way-to-join-two-indexes-in-elasticsearch/358129)
**Author:** [@Knut\_Knackwurst](https://discuss.elastic.co/u/Knut_Knackwurst)\ **Replies:** 6\ **Last updated:** [April 29, 2024, 4:33pm UTC](https://discuss.elastic.co/t/what-is-the-most-time-efficient-way-to-join-two-indexes-in-elasticsearch/358129 "2024-04-29T16:33:42Z")
I have the following 2 SQL tables: Current table A: ID Data Status 1 Some Data open 2 Other Data open Historical Table B: ID Data 1 Some old Data 1 Some older Data 2 Other Data 2 Other older… --- ## [Group by in Kibana Lens](https://discuss.elastic.co/t/group-by-in-kibana-lens/357406)
**Author:** [@Stukero](https://discuss.elastic.co/u/Stukero)\ **Replies:** 1\ **Last updated:** [April 29, 2024, 4:19pm UTC](https://discuss.elastic.co/t/group-by-in-kibana-lens/357406 "2024-04-29T16:19:21Z")
Hello! I'm looking for some info about how to aggregate some fields and make a count, then show them in a particular way. I think you'll see it better with this: Lets say we have an index called "my\_index" with document… --- ## [How to monitor kafka cluster with metricbeat using jolokia module](https://discuss.elastic.co/t/how-to-monitor-kafka-cluster-with-metricbeat-using-jolokia-module/357497)
**Author:** [@kriti\_dabas](https://discuss.elastic.co/u/kriti_dabas)\ **Replies:** 0\ **Last updated:** [April 16, 2024, 9:41am UTC](https://discuss.elastic.co/t/how-to-monitor-kafka-cluster-with-metricbeat-using-jolokia-module/357497 "2024-04-16T09:41:02Z")
I have a cluster of kafka consisting three nodes. I am using kafka with kraft and metricbeat 8.12 version. kibana and elasticsearch version are 8.12. There is dashboard on the kibana of kafka metricbeat but the data i… --- ## [Kibana report generation - Spring Boot](https://discuss.elastic.co/t/kibana-report-generation-spring-boot/357522)
**Author:** [@Avijit](https://discuss.elastic.co/u/Avijit)\ **Replies:** 1\ **Last updated:** [April 29, 2024, 3:01pm UTC](https://discuss.elastic.co/t/kibana-report-generation-spring-boot/357522 "2024-04-29T15:01:29Z")
I am trying to automatically download the Kibana report in PDF format. Following the documentation here : Automatically generate reports | Kibana Guide \[8.13\] | Elastic The issue is, on hitting the path that has been re… --- ## [Issue with Creating CSV Reports in Kibana 8.8.0](https://discuss.elastic.co/t/issue-with-creating-csv-reports-in-kibana-8-8-0/357424)
**Author:** [@Oleksiy\_Alex](https://discuss.elastic.co/u/Oleksiy_Alex)\ **Replies:** 1\ **Last updated:** [April 29, 2024, 2:45pm UTC](https://discuss.elastic.co/t/issue-with-creating-csv-reports-in-kibana-8-8-0/357424 "2024-04-29T14:45:33Z")
Hello, I'm using Kibana 8.8.0 on Ubuntu 20.04.6 LTS and encountering an issue when attempting to generate CSV reports. Each attempt results in a "Failed to create report" error message. Unfortunately, the error logs do … --- ## [Elastic Search Aggregation Based On Case Insensitive](https://discuss.elastic.co/t/elastic-search-aggregation-based-on-case-insensitive/358435)
**Author:** [@ranjithkumar.rottela](https://discuss.elastic.co/u/ranjithkumar.rottela)\ **Replies:** 1\ **Last updated:** [April 29, 2024, 2:28pm UTC](https://discuss.elastic.co/t/elastic-search-aggregation-based-on-case-insensitive/358435 "2024-04-29T14:28:30Z")
Hi Team, I have requirement I need to fetch data in Elasticsearch case insensitivity, but need on both key and value field. Sample code below POST test-index999/\_doc { "key": "testKey:testValue", "count": 200, "… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=251) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=253)