# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=290 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 291 --- ## [Kibana CSP configuration](https://discuss.elastic.co/t/kibana-csp-configuration/353681)
**Author:** [@ishank](https://discuss.elastic.co/u/ishank)\ **Replies:** 1\ **Last updated:** [March 8, 2024, 1:10pm UTC](https://discuss.elastic.co/t/kibana-csp-configuration/353681 "2024-03-08T13:10:20Z")
Hi I am having difficulty changing CSP configuration in kibana.yml file. I have tried multiple ways to change like: csp.script\_src: "'self' 'unsafe-eval' 'unsafe-inline';" csp.script\_src: \['self', 'unsafe-eval', 'unsa… --- ## [In-memory evaluation](https://discuss.elastic.co/t/in-memory-evaluation/355011)
**Author:** [@arpit\_upadhyay](https://discuss.elastic.co/u/arpit_upadhyay)\ **Replies:** 1\ **Last updated:** [March 8, 2024, 1:04pm UTC](https://discuss.elastic.co/t/in-memory-evaluation/355011 "2024-03-08T13:04:11Z")
I have a json object and and Elasticsearch query , I want to evaluate if that json will match with that query or not (just like if that json document was indexed and when ES run the given query it will or will not return… --- ## [\[kibana 8.12.1\] Plugin generator generates a plugin shows server error](https://discuss.elastic.co/t/kibana-8-12-1-plugin-generator-generates-a-plugin-shows-server-error/354103)
**Author:** [@Theone0305](https://discuss.elastic.co/u/Theone0305)\ **Replies:** 1\ **Last updated:** [March 8, 2024, 12:55pm UTC](https://discuss.elastic.co/t/kibana-8-12-1-plugin-generator-generates-a-plugin-shows-server-error/354103 "2024-03-08T12:55:13Z")
Hi, I use Kibana 8.12.1 and make kiban plugin using " \[kbn-plugin-generator \] . \[kibana/packages/kbn-plugin-generator at main · elastic/kibana · GitHub \]. Unfortunately, after generating the plug-in and starting with "y… --- ## [Elasticsearch master node is not up in version 8.12.0 of multinode cluster](https://discuss.elastic.co/t/elasticsearch-master-node-is-not-up-in-version-8-12-0-of-multinode-cluster/353758)
**Author:** [@Priyanka\_chauhan](https://discuss.elastic.co/u/Priyanka_chauhan)\ **Replies:** 0\ **Last updated:** [February 21, 2024, 9:12am UTC](https://discuss.elastic.co/t/elasticsearch-master-node-is-not-up-in-version-8-12-0-of-multinode-cluster/353758 "2024-02-21T09:12:13Z")
When I restart the elasticsearch node 1 from which I formed a multinode cluster using enrollment token. Service is failed and getting the logs. tail -f /var/log/elasticsearch/HELK.log| grep ERROR \[ERROR\]\[o.e.x.s.a.s.Fi… --- ## [Migrate from Docker compose to linux cluster installation](https://discuss.elastic.co/t/migrate-from-docker-compose-to-linux-cluster-installation/353126)
**Author:** [@Nishad\_Angre](https://discuss.elastic.co/u/Nishad_Angre)\ **Replies:** 0\ **Last updated:** [February 13, 2024, 5:58am UTC](https://discuss.elastic.co/t/migrate-from-docker-compose-to-linux-cluster-installation/353126 "2024-02-13T05:58:02Z")
Currently I have a docker cluster for ELK stack on a single machine. Till now its working fine. But in future, I am expecting that there will be a increase in load on this cluster; and because its a single machine, the … --- ## [Can kibana 7.4.2 enable automatic monthly auto-creation of indexes for different spaces?](https://discuss.elastic.co/t/can-kibana-7-4-2-enable-automatic-monthly-auto-creation-of-indexes-for-different-spaces/354613)
**Author:** [@wangyu](https://discuss.elastic.co/u/wangyu)\ **Replies:** 1\ **Last updated:** [March 8, 2024, 11:44am UTC](https://discuss.elastic.co/t/can-kibana-7-4-2-enable-automatic-monthly-auto-creation-of-indexes-for-different-spaces/354613 "2024-03-08T11:44:22Z")
I use space in ELK to put different indexes in different space： my indexes are created on a monthly basis, part of my logstash is configured as shown below: Currently I create indexes manually, is it possible to … --- ## [duplicated index patterns elasticsearch after import objects ?](https://discuss.elastic.co/t/duplicated-index-patterns-elasticsearch-after-import-objects/354823)
**Author:** [@Ofek\_avigdor1](https://discuss.elastic.co/u/Ofek_avigdor1)\ **Replies:** 1\ **Last updated:** [March 8, 2024, 11:22am UTC](https://discuss.elastic.co/t/duplicated-index-patterns-elasticsearch-after-import-objects/354823 "2024-03-08T11:22:08Z")
I create dashboards and want to move them between different environments on which I have elastic. What happens when I import the dashboard from one environment to another I get another filebeat index pattern. It is impor… --- ## [Add self-managed node to cloud](https://discuss.elastic.co/t/add-self-managed-node-to-cloud/355023)
**Author:** [@Chenko](https://discuss.elastic.co/u/Chenko)\ **Replies:** 2\ **Last updated:** [March 8, 2024, 10:49am UTC](https://discuss.elastic.co/t/add-self-managed-node-to-cloud/355023 "2024-03-08T10:49:21Z")
Is it possible to add a self managed node to the cloud? --- ## [Filebeat concats multile line with \`\\n\\t\`](https://discuss.elastic.co/t/filebeat-concats-multile-line-with-n-t/355021)
**Author:** [@puppylpg](https://discuss.elastic.co/u/puppylpg)\ **Replies:** 0\ **Last updated:** [March 8, 2024, 10:35am UTC](https://discuss.elastic.co/t/filebeat-concats-multile-line-with-n-t/355021 "2024-03-08T10:35:22Z")
I'm using filebeat to collect logs from a java service into ELK stack. As we all know the java stacktrace are multilines so i config the filebeat stated here： multiline: pattern: '^\[0-9\]{4}-\[0-9\]{2}-\[0-9\]{2}.\*' … --- ## [Creating dashboard panels with code](https://discuss.elastic.co/t/creating-dashboard-panels-with-code/354617)
**Author:** [@upizs](https://discuss.elastic.co/u/upizs)\ **Replies:** 1\ **Last updated:** [March 8, 2024, 10:33am UTC](https://discuss.elastic.co/t/creating-dashboard-panels-with-code/354617 "2024-03-08T10:33:49Z")
Hello, I have created a rich dashboard of panels for visual reasons. However this dashboard is incomplete, I need to now copy paste this panels and repeat the process some 50+ more times to show all what we need. I have… --- ## [Why Composite aggregation shows Empty buckets first](https://discuss.elastic.co/t/why-composite-aggregation-shows-empty-buckets-first/354123)
**Author:** [@Anand\_Konagala](https://discuss.elastic.co/u/Anand_Konagala)\ **Replies:** 0\ **Last updated:** [February 26, 2024, 1:21pm UTC](https://discuss.elastic.co/t/why-composite-aggregation-shows-empty-buckets-first/354123 "2024-02-26T13:21:20Z")
Hi, I have a index with 9 Million documents. I performed Composite aggregation on nested field and I also mentioned doc\_count sorting. Here I lost a lot of perfect buckets. Here is my aggregation query with size 2000 "… --- ## [Create a query that looks for list of names/numbers](https://discuss.elastic.co/t/create-a-query-that-looks-for-list-of-names-numbers/354825)
**Author:** [@thomas4](https://discuss.elastic.co/u/thomas4)\ **Replies:** 1\ **Last updated:** [March 8, 2024, 10:29am UTC](https://discuss.elastic.co/t/create-a-query-that-looks-for-list-of-names-numbers/354825 "2024-03-08T10:29:53Z")
cIs there a way i can use a query like below to look for any name like this GY-CAD2-10C-001, rather than creating a filter and writing in 30-50 entries, can you create a query that will look for the all that start with G… --- ## [No notification from Alert if still Active after Maintenance Window ends](https://discuss.elastic.co/t/no-notification-from-alert-if-still-active-after-maintenance-window-ends/353116)
**Author:** [@mkf1](https://discuss.elastic.co/u/mkf1)\ **Replies:** 1\ **Last updated:** [March 8, 2024, 10:19am UTC](https://discuss.elastic.co/t/no-notification-from-alert-if-still-active-after-maintenance-window-ends/353116 "2024-03-08T10:19:16Z")
Hi, I have alert rules with actions that send notifications to a Teams channel. I have setup a Maintenance Windows for Sundays between 12:00 AM and 05:00 AM to suppress any notifications during this time period. I hav… --- ## [What happens when you go over 32GiB of JVM heap memory?](https://discuss.elastic.co/t/what-happens-when-you-go-over-32gib-of-jvm-heap-memory/354883)
**Author:** [@Santi\_Santichaivekin](https://discuss.elastic.co/u/Santi_Santichaivekin)\ **Replies:** 5\ **Last updated:** [March 8, 2024, 9:16am UTC](https://discuss.elastic.co/t/what-happens-when-you-go-over-32gib-of-jvm-heap-memory/354883 "2024-03-08T09:16:19Z")
Elasticsearch does not recommend setting memory limit over 32GiB due to a pointer optimization called "compressed oops" that only happens when the heap size is under 32GiB. (1). However, I have found little discussion o… --- ## [Change timestamp in logstash](https://discuss.elastic.co/t/change-timestamp-in-logstash/354909)
**Author:** [@sudharsanam132](https://discuss.elastic.co/u/sudharsanam132)\ **Replies:** 10\ **Last updated:** [March 8, 2024, 9:04am UTC](https://discuss.elastic.co/t/change-timestamp-in-logstash/354909 "2024-03-08T09:04:53Z")
Im having logs like below from logstash 8.9.1 2024-03-06T23:43:37.317829530Z 192.168.1.132 \<14\> 2024-03-06T23:43:37Z forwarder.tmes.trendmicro.com tmes\[1\]: CEF:0|Trend Micro|TMES|1.0.0.0|100101|DETECTION|6|rt=2024-03-06… --- ## [Duplicate Docs Getting Created](https://discuss.elastic.co/t/duplicate-docs-getting-created/355006)
**Author:** [@sajid](https://discuss.elastic.co/u/sajid)\ **Replies:** 1\ **Last updated:** [March 8, 2024, 7:34am UTC](https://discuss.elastic.co/t/duplicate-docs-getting-created/355006 "2024-03-08T07:34:11Z")
We are running fluentd in our Kubernetes cluster as DaemonSet and logs are getting shipped to Elasticsearch directly. We are observing duplicate logs are being stored in ES i.e. for a single line of log, we are seeing mu… --- ## [How to remove the information from the data stream of the agent](https://discuss.elastic.co/t/how-to-remove-the-information-from-the-data-stream-of-the-agent/355005)
**Author:** [@strawberryfly](https://discuss.elastic.co/u/strawberryfly)\ **Replies:** 0\ **Last updated:** [March 8, 2024, 6:48am UTC](https://discuss.elastic.co/t/how-to-remove-the-information-from-the-data-stream-of-the-agent/355005 "2024-03-08T06:48:26Z")
Hello everyone, I've been struggling with the following values for a few days now: agent.ephemeral\_id,agent.id,agent.name,agent.type,agent.version I use the plugin Palo Alto to transfer the logs to elasticserach and th… --- ## [ElasticSearch JAVA create custom sort in place of attribute value sort](https://discuss.elastic.co/t/elasticsearch-java-create-custom-sort-in-place-of-attribute-value-sort/354982)
**Author:** [@Manoj\_Upadhyay](https://discuss.elastic.co/u/Manoj_Upadhyay)\ **Replies:** 1\ **Last updated:** [March 8, 2024, 6:20am UTC](https://discuss.elastic.co/t/elasticsearch-java-create-custom-sort-in-place-of-attribute-value-sort/354982 "2024-03-08T06:20:47Z")
For example, I have 6 accounts (1,2,34,5,6)of transactions in index and I want to search transactions and sort by order by account 4,6,3,2,1,5(custom order ) then how I can use it . SearchResponse\ esResponse = … --- ## [A plugin had an unrecoverable error. Will restart this plugin](https://discuss.elastic.co/t/a-plugin-had-an-unrecoverable-error-will-restart-this-plugin/354973)
**Author:** [@Guilherme\_Carvalho](https://discuss.elastic.co/u/Guilherme_Carvalho)\ **Replies:** 1\ **Last updated:** [March 8, 2024, 3:42am UTC](https://discuss.elastic.co/t/a-plugin-had-an-unrecoverable-error-will-restart-this-plugin/354973 "2024-03-08T03:42:14Z")
I'm having some problems with my logsatsh pipeline, i get an error saying that the plugin had an unrecoverable error and it will restart, bellow is the log, do you guys have any ideia about this problem? \[2024-03-06T09:… --- ## [Filebeat migrate registry file - recent versions](https://discuss.elastic.co/t/filebeat-migrate-registry-file-recent-versions/354990)
**Author:** [@lucasenc](https://discuss.elastic.co/u/lucasenc)\ **Replies:** 0\ **Last updated:** [March 7, 2024, 10:14pm UTC](https://discuss.elastic.co/t/filebeat-migrate-registry-file-recent-versions/354990 "2024-03-07T22:14:29Z")
I've failing to implement the process to migrate the filebeat registry file from Elasticsearch 8.9.0 to 8.11.1 and crossed my mind that the guidance for this process found here works only for old versions. Could someone… --- ## [I am trying to install ELK in docker and facing the below error](https://discuss.elastic.co/t/i-am-trying-to-install-elk-in-docker-and-facing-the-below-error/354979)
**Author:** [@aishu\_modala](https://discuss.elastic.co/u/aishu_modala)\ **Replies:** 1\ **Last updated:** [March 7, 2024, 9:43pm UTC](https://discuss.elastic.co/t/i-am-trying-to-install-elk-in-docker-and-facing-the-below-error/354979 "2024-03-07T21:43:13Z")
\[2024-03-07T20:09:22.543+00:00\]\[ERROR\]\[elasticsearch-service\] Unable to retrieve version information from Elasticsearch nodes. security\_exception Root causes: security\_exception: unable to authenticate user \[kibana\_sys… --- ## [Kibana Maps - adding filter hides layers which dont have the filter field](https://discuss.elastic.co/t/kibana-maps-adding-filter-hides-layers-which-dont-have-the-filter-field/354773)
**Author:** [@longtake](https://discuss.elastic.co/u/longtake)\ **Replies:** 5\ **Last updated:** [March 7, 2024, 9:10pm UTC](https://discuss.elastic.co/t/kibana-maps-adding-filter-hides-layers-which-dont-have-the-filter-field/354773 "2024-03-07T21:10:23Z")
Say I have 2 layers on a map view which shows plots from elastic index documents. Say the first layer comes from index1 which has say fields "field1", "field2" + a geopoint And the second layer from index2 which has fi… --- ## [Lens: Line Graph Keyword Fields](https://discuss.elastic.co/t/lens-line-graph-keyword-fields/352556)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 5\ **Last updated:** [March 7, 2024, 7:38pm UTC](https://discuss.elastic.co/t/lens-line-graph-keyword-fields/352556 "2024-03-07T19:38:55Z")
Hello , I am attempting to create a line graph where it can show a change in field's value. This field is a keyword. is this possible? --- ## [Vector Search with Search-UI and App Search](https://discuss.elastic.co/t/vector-search-with-search-ui-and-app-search/354972)
**Author:** [@Adam\_Patarino](https://discuss.elastic.co/u/Adam_Patarino)\ **Replies:** 1\ **Last updated:** [March 7, 2024, 6:58pm UTC](https://discuss.elastic.co/t/vector-search-with-search-ui-and-app-search/354972 "2024-03-07T18:58:44Z")
Hello, we have setup Elsor on our index and now want to include those vector fields as users use our search-ui. We use search-ui with @elastic/search-ui-app-search-connector. Ideally results would be a combination of k… --- ## [Elastic Search data is not being stored in one of the three PVCs](https://discuss.elastic.co/t/elastic-search-data-is-not-being-stored-in-one-of-the-three-pvcs/354872)
**Author:** [@Siva\_Vignesh\_K](https://discuss.elastic.co/u/Siva_Vignesh_K)\ **Replies:** 3\ **Last updated:** [March 7, 2024, 6:19am UTC](https://discuss.elastic.co/t/elastic-search-data-is-not-being-stored-in-one-of-the-three-pvcs/354872 "2024-03-07T06:19:36Z")
Using Helm Chart, I have deployed three replicas of elasticsearch in a Kubernetes cluster. I've noticed that data is only being stored in the two PVCs. My storage is filling up quickly since the third one is not recei… --- ## [Query Elasticsearch DLS/ Field = Field?](https://discuss.elastic.co/t/query-elasticsearch-dls-field-field/354536)
**Author:** [@Cody-Test](https://discuss.elastic.co/u/Cody-Test)\ **Replies:** 8\ **Last updated:** [March 7, 2024, 4:38pm UTC](https://discuss.elastic.co/t/query-elasticsearch-dls-field-field/354536 "2024-03-07T16:38:46Z")
Hi Guy, I am thinking of using an Elasticsearch query to display documents where the value of Field 1 equals Field 2. Does Elasticsearch support this type of query? If anyone knows, please provide me with more details. … --- ## [Find index with conflicting field](https://discuss.elastic.co/t/find-index-with-conflicting-field/354963)
**Author:** [@Balu](https://discuss.elastic.co/u/Balu)\ **Replies:** 2\ **Last updated:** [March 7, 2024, 3:41pm UTC](https://discuss.elastic.co/t/find-index-with-conflicting-field/354963 "2024-03-07T15:41:32Z")
Hello, I do have fields in indexes that are listed as "Mapping conflict" (keyword, IP for example). I know I have to reindex documents to fix that, but how I do I figure out what indices have the wrong type of a field? … --- ## [(bump) shards constantly relocating](https://discuss.elastic.co/t/bump-shards-constantly-relocating/354966)
**Author:** [@raymondmintz11](https://discuss.elastic.co/u/raymondmintz11)\ **Replies:** 7\ **Last updated:** [March 7, 2024, 3:39pm UTC](https://discuss.elastic.co/t/bump-shards-constantly-relocating/354966 "2024-03-07T15:39:01Z")
hi sorry if there is another way to bumb expired topics/comments Was there a solution to this dialogue ? Thanks! (sorry for the irrelevant tag, the preset options arent applicable) --- ## [Yarn build --skip-os-packages --release removes added dependencies](https://discuss.elastic.co/t/yarn-build-skip-os-packages-release-removes-added-dependencies/353417)
**Author:** [@Dallas\_Toth](https://discuss.elastic.co/u/Dallas_Toth)\ **Replies:** 6\ **Last updated:** [March 7, 2024, 3:06pm UTC](https://discuss.elastic.co/t/yarn-build-skip-os-packages-release-removes-added-dependencies/353417 "2024-03-07T15:06:13Z")
We have a plugin that we have built that we are now needing to add additional dependencies to. yarn add react-paginate@^8.2.0 react-tooltip@^5.26.2 yarn kbn bootstrap respects that these dependencies exist and will incl… --- ## [Need to check whether counts of specific URL at specific hour is crossing the average value of last week for that specified hour](https://discuss.elastic.co/t/need-to-check-whether-counts-of-specific-url-at-specific-hour-is-crossing-the-average-value-of-last-week-for-that-specified-hour/354839)
**Author:** [@2328943\_dc](https://discuss.elastic.co/u/2328943_dc)\ **Replies:** 0\ **Last updated:** [March 6, 2024, 12:26pm UTC](https://discuss.elastic.co/t/need-to-check-whether-counts-of-specific-url-at-specific-hour-is-crossing-the-average-value-of-last-week-for-that-specified-hour/354839 "2024-03-06T12:26:02Z")
Dear Team, We need to check whether counts of specific URL at specific hour is crossing the average value of last week for that specific hour. Example, As shown in above charts, we need to highlight when the averag… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=289) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=291)