# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=685 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 686 --- ## [How to create new logstash grok field](https://discuss.elastic.co/t/how-to-create-new-logstash-grok-field/320722)
**Author:** [@anon74213320](https://discuss.elastic.co/u/anon74213320)\ **Replies:** 1\ **Last updated:** [December 27, 2022, 6:35pm UTC](https://discuss.elastic.co/t/how-to-create-new-logstash-grok-field/320722 "2022-12-27T18:35:57Z")
I have an ELK stack Filebeat---\>Logstash----\>Elasticsearch\<----Kibana. I m shipping the logs in a proper way, but I would need to add a custom fields available in Kibana, for searching puproses. The Log file contains a… --- ## [Jira Connector](https://discuss.elastic.co/t/jira-connector/321682)
**Author:** [@merayray](https://discuss.elastic.co/u/merayray)\ **Replies:** 7\ **Last updated:** [December 27, 2022, 6:30pm UTC](https://discuss.elastic.co/t/jira-connector/321682 "2022-12-27T18:30:55Z")
I am using a Jira connector but when I test it I see the following error: Unable to get issue types \[Action\]\[Jira\]: Unable to get capabilities. Error: read ECONNRESET. Reason: unknown: errorResponse was null Any idea … --- ## [ALLOCATION\_FAILED while draining nodes](https://discuss.elastic.co/t/allocation-failed-while-draining-nodes/322048)
**Author:** [@Reg\_Dancy](https://discuss.elastic.co/u/Reg_Dancy)\ **Replies:** 0\ **Last updated:** [December 27, 2022, 6:24pm UTC](https://discuss.elastic.co/t/allocation-failed-while-draining-nodes/322048 "2022-12-27T18:24:07Z")
Hello all, I was draining each node in my cluster one at a time. All of a sudden the draining paused. I received the error below: $ curl -s -H 'content-type: application/json' -XGET http://localhost:9200/\_cluster/alloca… --- ## [Hot nodes are having high cpu usage](https://discuss.elastic.co/t/hot-nodes-are-having-high-cpu-usage/322046)
**Author:** [@vamsi2](https://discuss.elastic.co/u/vamsi2)\ **Replies:** 1\ **Last updated:** [December 27, 2022, 6:10pm UTC](https://discuss.elastic.co/t/hot-nodes-are-having-high-cpu-usage/322046 "2022-12-27T18:10:13Z")
Hello, Currently I'm having three hot nodes and all the three hot nodes are having high % of CPU usage which is around 80%-100%. So can I add dedicated coordinating and Ingest instance which will help me to solve this … --- ## [JSON Array treatment in a visualization](https://discuss.elastic.co/t/json-array-treatment-in-a-visualization/321058)
**Author:** [@pedrodantas](https://discuss.elastic.co/u/pedrodantas)\ **Replies:** 1\ **Last updated:** [December 27, 2022, 6:07pm UTC](https://discuss.elastic.co/t/json-array-treatment-in-a-visualization/321058 "2022-12-27T18:07:23Z")
Hello! I was wondering if there is any way to display the contents of a JSON Array that is received in the Elastic logs in a Kibana visualization. My application is sending JSON logs to Kibana. One of the log fields is… --- ## [Compare current data with previous day's data based on time](https://discuss.elastic.co/t/compare-current-data-with-previous-days-data-based-on-time/320197)
**Author:** [@viveks](https://discuss.elastic.co/u/viveks)\ **Replies:** 1\ **Last updated:** [December 27, 2022, 5:49pm UTC](https://discuss.elastic.co/t/compare-current-data-with-previous-days-data-based-on-time/320197 "2022-12-27T17:49:05Z")
Hi, I have events that are generated throughout the day based on API processing. These events are available in Elastic and are generated throughout the day. I am trying to figure out a way to create an alert when the num… --- ## [Updating ES records : Ingestion lag and Search returns empty](https://discuss.elastic.co/t/updating-es-records-ingestion-lag-and-search-returns-empty/321167)
**Author:** [@VV1002](https://discuss.elastic.co/u/VV1002)\ **Replies:** 0\ **Last updated:** [December 13, 2022, 10:41pm UTC](https://discuss.elastic.co/t/updating-es-records-ingestion-lag-and-search-returns-empty/321167 "2022-12-13T22:41:45Z")
Hi ES team, We currently have a Nodejs import script running to process our XML,HTML files followed by ingestion to ES. The XML,HTML files are uploaded in S3 bucket and queued up in the SQS triggering the Lambda functio… --- ## [Anonymous access](https://discuss.elastic.co/t/anonymous-access/322033)
**Author:** [@Bhanuji\_paluri](https://discuss.elastic.co/u/Bhanuji_paluri)\ **Replies:** 1\ **Last updated:** [December 27, 2022, 3:59pm UTC](https://discuss.elastic.co/t/anonymous-access/322033 "2022-12-27T15:59:42Z")
Hi Team, User would like to change Elasticsearch config to allow anonymous to post data to our Elastic search. No other accesses like read or delete shall be given to anonymous. --- ## [Trying to make a canvas workpad](https://discuss.elastic.co/t/trying-to-make-a-canvas-workpad/321219)
**Author:** [@bit1290](https://discuss.elastic.co/u/bit1290)\ **Replies:** 1\ **Last updated:** [December 27, 2022, 3:42pm UTC](https://discuss.elastic.co/t/trying-to-make-a-canvas-workpad/321219 "2022-12-27T15:42:59Z")
Hello, I have this configuration: with this preview data: and the display has this configuration with the following error: Can someone help me understand why I'm having this error? Thank you very much --- ## [Kibana visualization using wildcards](https://discuss.elastic.co/t/kibana-visualization-using-wildcards/320302)
**Author:** [@tfinan](https://discuss.elastic.co/u/tfinan)\ **Replies:** 1\ **Last updated:** [December 27, 2022, 3:05pm UTC](https://discuss.elastic.co/t/kibana-visualization-using-wildcards/320302 "2022-12-27T15:05:51Z")
Probably a very basic question here, but I am can't figure it out. I have an index with many fields named "process\_" with a numeric value assigned. I would like to create a table listing these fields, sorted by the va… --- ## [Failed to setup automated snapshot with elastic operator](https://discuss.elastic.co/t/failed-to-setup-automated-snapshot-with-elastic-operator/322041)
**Author:** [@Mahmoud\_Yasser](https://discuss.elastic.co/u/Mahmoud_Yasser)\ **Replies:** 0\ **Last updated:** [December 27, 2022, 2:27pm UTC](https://discuss.elastic.co/t/failed-to-setup-automated-snapshot-with-elastic-operator/322041 "2022-12-27T14:27:33Z")
I'm launching 3 elastic nodes using elastic operator and i tried to set up automated snapshots for these instances. I used elastic operator 2.5.0 on Kubernetes version v1.23.11-gke.300 and used Elasticsearch version 8.5… --- ## [Kibana SSL configuration for Windows Server Host](https://discuss.elastic.co/t/kibana-ssl-configuration-for-windows-server-host/321050)
**Author:** [@janis.cimins](https://discuss.elastic.co/u/janis.cimins)\ **Replies:** 3\ **Last updated:** [December 27, 2022, 2:53pm UTC](https://discuss.elastic.co/t/kibana-ssl-configuration-for-windows-server-host/321050 "2022-12-27T14:53:17Z")
Hey! I am trying to set up Elastic on my testlab Windows server 2019. All is good until I try to enable SSL. I am using this guide : But seem to get an error (possible syntax problem I suppose). C:\\kibana\>.\\bin\\kib… --- ## [Out of memory error and duplicate rows](https://discuss.elastic.co/t/out-of-memory-error-and-duplicate-rows/321932)
**Author:** [@darius12](https://discuss.elastic.co/u/darius12)\ **Replies:** 4\ **Last updated:** [December 27, 2022, 2:29pm UTC](https://discuss.elastic.co/t/out-of-memory-error-and-duplicate-rows/321932 "2022-12-27T14:29:06Z")
getting this error when trying to index using logstash: warning: thread "\[main\]\>worker1" terminated with exception (report\_on\_exception is true): java.lang.OutOfMemoryError: UTF16 String size is 1371255266, should be l… --- ## [How can I make trend line as a dotted line](https://discuss.elastic.co/t/how-can-i-make-trend-line-as-a-dotted-line/320213)
**Author:** [@princejaiswal03](https://discuss.elastic.co/u/princejaiswal03)\ **Replies:** 1\ **Last updated:** [December 27, 2022, 2:24pm UTC](https://discuss.elastic.co/t/how-can-i-make-trend-line-as-a-dotted-line/320213 "2022-12-27T14:24:54Z")
I have used trend() function for generating the trend line. How can I make that trend line as a dotted line? I have one more question. Is it possible to remove the background grid lines in the timelion charts? --- ## [Security module access - bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll](https://discuss.elastic.co/t/security-module-access-bundles-kbn-ui-shared-deps-npm-kbn-ui-shared-deps-npm-dll/321133)
**Author:** [@Lamis](https://discuss.elastic.co/u/Lamis)\ **Replies:** 5\ **Last updated:** [December 27, 2022, 12:58pm UTC](https://discuss.elastic.co/t/security-module-access-bundles-kbn-ui-shared-deps-npm-kbn-ui-shared-deps-npm-dll/321133 "2022-12-27T12:58:38Z")
Hi I am getting this error when trying to access security module, // \`\`\` { "name": "Error", "body": { "message": "undefined: undefined", "status\_code": 400 }, "message": "Bad Request", "stack": "o@http://192.16… --- ## [Using jdbc in logstash to import Elasticsearch data Connection error](https://discuss.elastic.co/t/using-jdbc-in-logstash-to-import-elasticsearch-data-connection-error/322037)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [December 27, 2022, 12:37pm UTC](https://discuss.elastic.co/t/using-jdbc-in-logstash-to-import-elasticsearch-data-connection-error/322037 "2022-12-27T12:37:27Z")
Hi all, I'm trying to import data from different databases from different clusters to my elasticsearch database. Before importing mysql data to my elasticsearch database , I'm trying to import elasticsearch database fr… --- ## [I have a issue: \[es/index\] failed: \[index\_not\_found\_exception\] no such index when I write data into datastream using java client 8.5.3](https://discuss.elastic.co/t/i-have-a-issue-es-index-failed-index-not-found-exception-no-such-index-when-i-write-data-into-datastream-using-java-client-8-5-3/322035)
**Author:** [@xuxiao415](https://discuss.elastic.co/u/xuxiao415)\ **Replies:** 0\ **Last updated:** [December 27, 2022, 11:38am UTC](https://discuss.elastic.co/t/i-have-a-issue-es-index-failed-index-not-found-exception-no-such-index-when-i-write-data-into-datastream-using-java-client-8-5-3/322035 "2022-12-27T11:38:53Z")
I have a es cluster with three data nodes. I create a data stream: myindex. when I write data into data stream using java client 8.5.3, I met a problem: co.elastic.clients.elasticsearch.\_types.ElasticsearchException: \[e… --- ## [Clean filter when going back from a drilldown](https://discuss.elastic.co/t/clean-filter-when-going-back-from-a-drilldown/320045)
**Author:** [@tinrik](https://discuss.elastic.co/u/tinrik)\ **Replies:** 0\ **Last updated:** [November 29, 2022, 12:52pm UTC](https://discuss.elastic.co/t/clean-filter-when-going-back-from-a-drilldown/320045 "2022-11-29T12:52:35Z")
Hi! I currently have a pie chart in dashboard A, and have set a drilldown to go into another dashboard B + apply the filter chosen in A. That works great. Now, I want the possibility to "go back" from B to A and drilld… --- ## [Logstash - Aggregate xpath data](https://discuss.elastic.co/t/logstash-aggregate-xpath-data/321567)
**Author:** [@Basti97](https://discuss.elastic.co/u/Basti97)\ **Replies:** 8\ **Last updated:** [December 21, 2022, 1:14pm UTC](https://discuss.elastic.co/t/logstash-aggregate-xpath-data/321567 "2022-12-21T13:14:29Z")
Hello, I am a Logstash beginner and have probably a relatively simple question. Im using xpath to get data from a xml document (have shortened the code on purpose): filter { xml { source =\> "message" store\_xml =\> f… --- ## [Elastic search Reindex Count of Document not match](https://discuss.elastic.co/t/elastic-search-reindex-count-of-document-not-match/321898)
**Author:** [@Voon\_see\_hong](https://discuss.elastic.co/u/Voon_see_hong)\ **Replies:** 11\ **Last updated:** [December 27, 2022, 8:37am UTC](https://discuss.elastic.co/t/elastic-search-reindex-count-of-document-not-match/321898 "2022-12-27T08:37:00Z")
hi all, i face a weird situation here where i ran reindex POST \_reindex?wait\_for\_completion=false { "source": { "index": "stage-user" }, "conflicts": "proceed", "dest": {"index": "stage-user-test-v1", "op\_… --- ## [Kibana Calculation of a particular row under a particular column](https://discuss.elastic.co/t/kibana-calculation-of-a-particular-row-under-a-particular-column/320000)
**Author:** [@akhil\_yl](https://discuss.elastic.co/u/akhil_yl)\ **Replies:** 0\ **Last updated:** [November 29, 2022, 6:56am UTC](https://discuss.elastic.co/t/kibana-calculation-of-a-particular-row-under-a-particular-column/320000 "2022-11-29T06:56:19Z")
Hi, I am using 6.8.0 kibana and i use 2 different indexes which have 2 different queries and i need to be compare those and output should be in % and index 1 only query1 will work and in another index query 2 will work … --- ## [How to use multiple snapshot repository directory's](https://discuss.elastic.co/t/how-to-use-multiple-snapshot-repository-directorys/321991)
**Author:** [@Santhosh\_K](https://discuss.elastic.co/u/Santhosh_K)\ **Replies:** 2\ **Last updated:** [December 27, 2022, 5:26am UTC](https://discuss.elastic.co/t/how-to-use-multiple-snapshot-repository-directorys/321991 "2022-12-27T05:26:37Z")
Hi, I have to use multiple snapshot repositories, Does that support multiple directories, if so, how? I want to know how to put multiple snapshot repository directory's in elasticsearch.yml file. And what about singl… --- ## [Needs suggestion to execute painless script as part of HTTP filter plugin](https://discuss.elastic.co/t/needs-suggestion-to-execute-painless-script-as-part-of-http-filter-plugin/321981)
**Author:** [@rvadiga](https://discuss.elastic.co/u/rvadiga)\ **Replies:** 1\ **Last updated:** [December 27, 2022, 4:32am UTC](https://discuss.elastic.co/t/needs-suggestion-to-execute-painless-script-as-part-of-http-filter-plugin/321981 "2022-12-27T04:32:17Z")
Hello, I have a requirement to execute(via GET) a painless script to find a maximum value of a field in http logstash filter. I am getting parse error as the keyword 'max' is not understood by http filter. Do we have … --- ## [Matching documents with subset of queries in Percolation Index](https://discuss.elastic.co/t/matching-documents-with-subset-of-queries-in-percolation-index/322019)
**Author:** [@aneeshkoya](https://discuss.elastic.co/u/aneeshkoya)\ **Replies:** 0\ **Last updated:** [December 27, 2022, 3:41am UTC](https://discuss.elastic.co/t/matching-documents-with-subset-of-queries-in-percolation-index/322019 "2022-12-27T03:41:12Z")
Each individual document is matched against all the queries stored in the associated percolation index. This can affect the performance of the percolate queries where documents need to be matched with only a subset of qu… --- ## [How to calculate max qps with a nginx log index by a kibana visualization?](https://discuss.elastic.co/t/how-to-calculate-max-qps-with-a-nginx-log-index-by-a-kibana-visualization/321980)
**Author:** [@KeithTt](https://discuss.elastic.co/u/KeithTt)\ **Replies:** 2\ **Last updated:** [December 27, 2022, 1:51am UTC](https://discuss.elastic.co/t/how-to-calculate-max-qps-with-a-nginx-log-index-by-a-kibana-visualization/321980 "2022-12-27T01:51:44Z")
I create a line type visualization like below, and I don't know how to aggregate the buckets and get the max value. Here is the request body: { "size": 0, "\_source": { "excludes": \[\] }, "aggs": { "2"… --- ## [TSVB Metric to display score change](https://discuss.elastic.co/t/tsvb-metric-to-display-score-change/319577)
**Author:** [@azulgrana](https://discuss.elastic.co/u/azulgrana)\ **Replies:** 3\ **Last updated:** [November 29, 2022, 2:25am UTC](https://discuss.elastic.co/t/tsvb-metric-to-display-score-change/319577 "2022-11-29T02:25:50Z")
Hi there, I have a TSVB metric w/ a cumulative sum that shows the "Score" for the environment and I'm looking at adding a 2nd metric to the same visualization to display +/- offset (score change) over the last 7 days. C… --- ## [Storage on elastic search](https://discuss.elastic.co/t/storage-on-elastic-search/321996)
**Author:** [@mail2shanth](https://discuss.elastic.co/u/mail2shanth)\ **Replies:** 13\ **Last updated:** [December 26, 2022, 11:44pm UTC](https://discuss.elastic.co/t/storage-on-elastic-search/321996 "2022-12-26T23:44:30Z")
Hi, I am trying to build a benchmark on how much storage likely needed for Elasticsearch, below are some stats whenever I sent new records from logstash to Elasticsearch. I checked in Elasticsearch after every interval,… --- ## [It's not clear that it's not possible to access the \`ctx\['\_source'\]\` inside a function in a painless script](https://discuss.elastic.co/t/its-not-clear-that-its-not-possible-to-access-the-ctx-source-inside-a-function-in-a-painless-script/322013)
**Author:** [@RafaelAdao](https://discuss.elastic.co/u/RafaelAdao)\ **Replies:** 0\ **Last updated:** [December 26, 2022, 9:24pm UTC](https://discuss.elastic.co/t/its-not-clear-that-its-not-possible-to-access-the-ctx-source-inside-a-function-in-a-painless-script/322013 "2022-12-26T21:24:50Z")
It's not clear to me that it's not possible to access the ctx\['\_source'\] inside a function in a painless script. I looked in the documentation and couldn't find anything about it. Below is an example of the code I was t… --- ## [Painless script to enrich data in an index GPO GUID to Name](https://discuss.elastic.co/t/painless-script-to-enrich-data-in-an-index-gpo-guid-to-name/322011)
**Author:** [@welch27330](https://discuss.elastic.co/u/welch27330)\ **Replies:** 0\ **Last updated:** [December 26, 2022, 9:00pm UTC](https://discuss.elastic.co/t/painless-script-to-enrich-data-in-an-index-gpo-guid-to-name/322011 "2022-12-26T21:00:55Z")
When Winlogbeat ingest data from a domain controller it uses the GUID from GPO. I wanted to see if there was a way to create a new field within the index that would translate the GUID to the actual GPO name. I've looked … --- ## [Indices with lifecycle error](https://discuss.elastic.co/t/indices-with-lifecycle-error/319519)
**Author:** [@zenzedoon](https://discuss.elastic.co/u/zenzedoon)\ **Replies:** 1\ **Last updated:** [November 28, 2022, 10:23pm UTC](https://discuss.elastic.co/t/indices-with-lifecycle-error/319519 "2022-11-28T22:23:12Z")
Hello, I have an ELK cluster with 3 nodes (3 are masters , 1 hot , 1warm and1 cold ) I have a few indices with life cycle error when i check the error i got this : and i you see the indices current action i shri… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=684) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=686)