# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=731 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 732 --- ## [Comparing Two Indices Across Clusters](https://discuss.elastic.co/t/comparing-two-indices-across-clusters/318904)
**Author:** [@connellyethan](https://discuss.elastic.co/u/connellyethan)\ **Replies:** 5\ **Last updated:** [November 16, 2022, 7:37am UTC](https://discuss.elastic.co/t/comparing-two-indices-across-clusters/318904 "2022-11-16T07:37:08Z")
Hi All, We are currently attempting to compare two indices across clusters to verify we did not lose any records or fields during the process of cross cluster replication, which is how we chose to do this data migration… --- ## [OUTDATED\_DOCUMENTS\_SEARCH\_OPEN\_PIT. Action failed with 'search\_phase\_execution\_exception'](https://discuss.elastic.co/t/outdated-documents-search-open-pit-action-failed-with-search-phase-execution-exception/317044)
**Author:** [@Shep](https://discuss.elastic.co/u/Shep)\ **Replies:** 0\ **Last updated:** [October 19, 2022, 6:41pm UTC](https://discuss.elastic.co/t/outdated-documents-search-open-pit-action-failed-with-search-phase-execution-exception/317044 "2022-10-19T18:41:36Z")
I'm having an issue with our Elastic Search / Kibana deployment. Kibana keeps failing to open with an error. Kibana 7.14.0\_001 Windows I was getting this fatal error: log \[12:18;05.466\] \[fatal\]\[root\] Error: Unable to c… --- ## [Logstash sql pipeline stops working](https://discuss.elastic.co/t/logstash-sql-pipeline-stops-working/318945)
**Author:** [@knakul853](https://discuss.elastic.co/u/knakul853)\ **Replies:** 0\ **Last updated:** [November 15, 2022, 9:34am UTC](https://discuss.elastic.co/t/logstash-sql-pipeline-stops-working/318945 "2022-11-15T09:34:37Z")
Hi all! I have a sync job for logstash which continuously picked data that have these config setups use\_column\_value =\> true tracking\_column =\> "last\_update\_time" tracking\_column\_type =\> "timestamp" my question is … --- ## [Does update and query document in diff cache?](https://discuss.elastic.co/t/does-update-and-query-document-in-diff-cache/319014)
**Author:** [@GithubRyze](https://discuss.elastic.co/u/GithubRyze)\ **Replies:** 2\ **Last updated:** [November 16, 2022, 6:17am UTC](https://discuss.elastic.co/t/does-update-and-query-document-in-diff-cache/319014 "2022-11-16T06:17:16Z")
step: updated document query the document immediately expected: return latest of the document but retunr the old docment Does update and query document in diff cache? update in RAM CACHE and QUERY IN DISK ? --- ## [Filebeat not shipping logs to logstash](https://discuss.elastic.co/t/filebeat-not-shipping-logs-to-logstash/318951)
**Author:** [@rahul\_sirugudi](https://discuss.elastic.co/u/rahul_sirugudi)\ **Replies:** 4\ **Last updated:** [November 16, 2022, 6:05am UTC](https://discuss.elastic.co/t/filebeat-not-shipping-logs-to-logstash/318951 "2022-11-16T06:05:32Z")
Hi I am setting up ELK stack for POC. I have installed ELK 7.17 version. Installed all the packages separately like different machine. Now i have installed file beat and enabled logstash module but i don't see any logs… --- ## [Restrict data access in Kibana dashboards](https://discuss.elastic.co/t/restrict-data-access-in-kibana-dashboards/318774)
**Author:** [@Venkatesh\_Guruprasad](https://discuss.elastic.co/u/Venkatesh_Guruprasad)\ **Replies:** 2\ **Last updated:** [November 16, 2022, 3:13am UTC](https://discuss.elastic.co/t/restrict-data-access-in-kibana-dashboards/318774 "2022-11-16T03:13:05Z")
We are using Kibana dashboards as an embedded URL experience. Based on the user we want to display only relevant records and filters to the users. As an example, we have one index which stores records for all customers.… --- ## [Row calculation in Enhanced Table](https://discuss.elastic.co/t/row-calculation-in-enhanced-table/316971)
**Author:** [@Seemant\_Bind](https://discuss.elastic.co/u/Seemant_Bind)\ **Replies:** 1\ **Last updated:** [October 19, 2022, 3:38pm UTC](https://discuss.elastic.co/t/row-calculation-in-enhanced-table/316971 "2022-10-19T15:38:45Z")
Hi, I am trying to calculate row in the enhanced table where I am computing row1/ Grand total i.e. 30/187 =16.04%, refer to the pic attached with post. I have tried this in enhanced table but couldn't find any such feat… --- ## [Convert Logstash Main pipeline to multiple pipelines](https://discuss.elastic.co/t/convert-logstash-main-pipeline-to-multiple-pipelines/318899)
**Author:** [@adityak248](https://discuss.elastic.co/u/adityak248)\ **Replies:** 6\ **Last updated:** [November 16, 2022, 1:55am UTC](https://discuss.elastic.co/t/convert-logstash-main-pipeline-to-multiple-pipelines/318899 "2022-11-16T01:55:01Z")
Hello team, I have a main pipeline that has multiple inputs like beats, kafka and filters for many application and single and big output file with many if, else if and else. The pipeline is so messed now and am not cer… --- ## [Caused by: java.util.concurrent.CancellationException: Request execution cancelled](https://discuss.elastic.co/t/caused-by-java-util-concurrent-cancellationexception-request-execution-cancelled/318864)
**Author:** [@tungli](https://discuss.elastic.co/u/tungli)\ **Replies:** 2\ **Last updated:** [November 16, 2022, 1:35am UTC](https://discuss.elastic.co/t/caused-by-java-util-concurrent-cancellationexception-request-execution-cancelled/318864 "2022-11-16T01:35:53Z")
I use es7.15.2 , elasticsearch-java-8.4.2, ElasticsearchAsyncClient, After a period of time，it can't link to es and throw Caused by: java.util.concurrent.CancellationException: Request execution cancelled Caused by: jav… --- ## [How to parse glastopf honeypot log json using logstash for kibana visualization?](https://discuss.elastic.co/t/how-to-parse-glastopf-honeypot-log-json-using-logstash-for-kibana-visualization/319010)
**Author:** [@Febrian12345](https://discuss.elastic.co/u/Febrian12345)\ **Replies:** 0\ **Last updated:** [November 16, 2022, 12:45am UTC](https://discuss.elastic.co/t/how-to-parse-glastopf-honeypot-log-json-using-logstash-for-kibana-visualization/319010 "2022-11-16T00:45:12Z")
I have a raw data in json format that I want to visualize in Kibana, but I'm having trouble parsing the data in logstash, previously I was able to visualize raw data for honeypot dionaea and cowrie. please help me in doi… --- ## [Logstash stopped processing because of an error](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error/319009)
**Author:** [@bigverm23](https://discuss.elastic.co/u/bigverm23)\ **Replies:** 1\ **Last updated:** [November 16, 2022, 12:05am UTC](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error/319009 "2022-11-16T00:05:16Z")
First time installing logstash and need some help please and thanks! \[2022-11-15T18:45:54,229\]\[INFO \]\[logstash.runner \] Starting Logstash {"logstash.version"=\>"8.5.0", "jruby.version"=\>"jruby 9.3.8.0 (2.6.8) 20… --- ## [Locate json field with jsonpath (logstash)](https://discuss.elastic.co/t/locate-json-field-with-jsonpath-logstash/318812)
**Author:** [@AdxDaz](https://discuss.elastic.co/u/AdxDaz)\ **Replies:** 4\ **Last updated:** [November 15, 2022, 11:31pm UTC](https://discuss.elastic.co/t/locate-json-field-with-jsonpath-logstash/318812 "2022-11-15T23:31:32Z")
Hi Elastic team, I have the next Json: {"response-code":"4000","response":{"result":\[{"DetailsPageURL":"/show.do?resourceid=22&method=show&PRINTER\_FRIENDLY=true","TODAYUNAVAILPERCENT":"0","Attribute":\[{"DISPLAYNAME":"T… --- ## [URL scripted field w/ multiple URL link](https://discuss.elastic.co/t/url-scripted-field-w-multiple-url-link/318910)
**Author:** [@azulgrana](https://discuss.elastic.co/u/azulgrana)\ **Replies:** 2\ **Last updated:** [November 15, 2022, 9:42pm UTC](https://discuss.elastic.co/t/url-scripted-field-w-multiple-url-link/318910 "2022-11-15T21:42:42Z")
Hi there! I have a field that sometimes returns multiple comma separated values. .i.e. a,b,c I would like to create a scripted URL field that maps the values to the products on my website and show, following the above… --- ## [Sharing Kibana Visualization Search as Iframe and running into Issues on Google Chrome](https://discuss.elastic.co/t/sharing-kibana-visualization-search-as-iframe-and-running-into-issues-on-google-chrome/317016)
**Author:** [@hidanny](https://discuss.elastic.co/u/hidanny)\ **Replies:** 1\ **Last updated:** [October 19, 2022, 3:10pm UTC](https://discuss.elastic.co/t/sharing-kibana-visualization-search-as-iframe-and-running-into-issues-on-google-chrome/317016 "2022-10-19T15:10:00Z")
Hi All, Just to note, the IFrame is rendering completely fine on Firefox. I am only encountering this on Google Chrome. Basically, I am trying to embed a Kibana IFrame on a React website. However, I am getting messag… --- ## [Logstash startup error](https://discuss.elastic.co/t/logstash-startup-error/318511)
**Author:** [@harijld](https://discuss.elastic.co/u/harijld)\ **Replies:** 7\ **Last updated:** [November 15, 2022, 9:02pm UTC](https://discuss.elastic.co/t/logstash-startup-error/318511 "2022-11-15T21:02:56Z")
HI All, I am trying to bring up Logstash on production server, getting below. Same set up working fine in UAT. Error Message 2022-11-08T15:30:28,121\]\[INFO \]\[logstash.runner \] Starting Logstash {"logstash.vers… --- ## [How to create sub aggregation for bucket\_script pipeline aggregation using java api client](https://discuss.elastic.co/t/how-to-create-sub-aggregation-for-bucket-script-pipeline-aggregation-using-java-api-client/318999)
**Author:** [@Raghunandan](https://discuss.elastic.co/u/Raghunandan)\ **Replies:** 0\ **Last updated:** [November 15, 2022, 8:40pm UTC](https://discuss.elastic.co/t/how-to-create-sub-aggregation-for-bucket-script-pipeline-aggregation-using-java-api-client/318999 "2022-11-15T20:40:33Z")
We are trying to create aggregation for bucket script and getting following error: No aggregation found at path : totalEndTimeUtcAGGR Below is the aggregation query { "aggregations": { "successExecutionCountAGGR"… --- ## [How Periodic\_flush common setting helpful in ruby logstash filter?](https://discuss.elastic.co/t/how-periodic-flush-common-setting-helpful-in-ruby-logstash-filter/318980)
**Author:** [@priti](https://discuss.elastic.co/u/priti)\ **Replies:** 1\ **Last updated:** [November 15, 2022, 6:45pm UTC](https://discuss.elastic.co/t/how-periodic-flush-common-setting-helpful-in-ruby-logstash-filter/318980 "2022-11-15T18:45:37Z")
I added periodic\_flush =\> true in ruby filter but I didn't found any difference. ruby { path =\> \ periodic\_flush =\> true } --- ## [Simple\_query\_string with first term having a + or - operator](https://discuss.elastic.co/t/simple-query-string-with-first-term-having-a-or-operator/318992)
**Author:** [@Geoff\_Mueller](https://discuss.elastic.co/u/Geoff_Mueller)\ **Replies:** 0\ **Last updated:** [November 15, 2022, 6:31pm UTC](https://discuss.elastic.co/t/simple-query-string-with-first-term-having-a-or-operator/318992 "2022-11-15T18:31:39Z")
Question regarding the use of AND (+) and NOT (-) operators when using the simple\_query\_string query. It seems there is some inconsistent behavior when performing a query where the first term has an operator included in… --- ## [Date\_time\_exception: Field Year cannot be printed as the value -292275055 exceeds the maximum print width of 4\]](https://discuss.elastic.co/t/date-time-exception-field-year-cannot-be-printed-as-the-value-292275055-exceeds-the-maximum-print-width-of-4/318900)
**Author:** [@hchen1](https://discuss.elastic.co/u/hchen1)\ **Replies:** 2\ **Last updated:** [November 15, 2022, 6:15pm UTC](https://discuss.elastic.co/t/date-time-exception-field-year-cannot-be-printed-as-the-value-292275055-exceeds-the-maximum-print-width-of-4/318900 "2022-11-15T18:15:28Z")
I got date\_time\_exception after disabling dynamic mapping and adding mapping for a Date attribute like this: "mappings": { "dynamic": false, ........ "updateDate": { "type": "date", … --- ## [Offset point labels on maps](https://discuss.elastic.co/t/offset-point-labels-on-maps/316927)
**Author:** [@Cory34](https://discuss.elastic.co/u/Cory34)\ **Replies:** 2\ **Last updated:** [November 15, 2022, 4:50pm UTC](https://discuss.elastic.co/t/offset-point-labels-on-maps/316927 "2022-11-15T16:50:48Z")
Hi, is there a way to offset point labels on maps so we can display both the point icon and its label without one on top of the other? Thanks! --- ## [Send parts of a message to different Elasticsearch indices from a single Logstash instance](https://discuss.elastic.co/t/send-parts-of-a-message-to-different-elasticsearch-indices-from-a-single-logstash-instance/318950)
**Author:** [@powerful\_clouds](https://discuss.elastic.co/u/powerful_clouds)\ **Replies:** 4\ **Last updated:** [November 15, 2022, 4:14pm UTC](https://discuss.elastic.co/t/send-parts-of-a-message-to-different-elasticsearch-indices-from-a-single-logstash-instance/318950 "2022-11-15T16:14:06Z")
Suppose my message has fields A and B. I want to separately send each of the fields to the same ES instance, but to different indices. Is that possible? E.g. if this is the message: {"A": some text, "B": some more text},… --- ## [DLQ settings to handle bulk ingest encoding error](https://discuss.elastic.co/t/dlq-settings-to-handle-bulk-ingest-encoding-error/318802)
**Author:** [@tharris1](https://discuss.elastic.co/u/tharris1)\ **Replies:** 3\ **Last updated:** [November 15, 2022, 3:43pm UTC](https://discuss.elastic.co/t/dlq-settings-to-handle-bulk-ingest-encoding-error/318802 "2022-11-15T15:43:54Z")
I have a large set of archived data to ingest into Elastic and some of the log entries have encoding issues that building up and causing the logstash ingest pipeline to stall. I have DLQ enabled but still getting indefin… --- ## [Filebeat can not connect to elasticsearch and kibana can not see the data](https://discuss.elastic.co/t/filebeat-can-not-connect-to-elasticsearch-and-kibana-can-not-see-the-data/318975)
**Author:** [@liuxy](https://discuss.elastic.co/u/liuxy)\ **Replies:** 0\ **Last updated:** [November 15, 2022, 3:40pm UTC](https://discuss.elastic.co/t/filebeat-can-not-connect-to-elasticsearch-and-kibana-can-not-see-the-data/318975 "2022-11-15T15:40:57Z")
Hello! I installed elasticsearch and kibana using docker on the server and filebeat on my pc. But when my filebeat tries to setup（filebeat setup）, it shows Exiting: couldn't connect to any of the configured Elasticsear… --- ## [Add file path as a field](https://discuss.elastic.co/t/add-file-path-as-a-field/318966)
**Author:** [@Matan\_Malka](https://discuss.elastic.co/u/Matan_Malka)\ **Replies:** 5\ **Last updated:** [November 15, 2022, 3:40pm UTC](https://discuss.elastic.co/t/add-file-path-as-a-field/318966 "2022-11-15T15:40:53Z")
Hey guys, Is it possible to add a field for the file path? input{ file{ path =\> \[ "/bitnami/jenkins/jenkins\_home/jobs/create-machine/builds/\*\*/log", "/bitnami/jenkins/jenkins\_home/jobs/delete-machine/builds/\*\*/log"… --- ## [Auditbeat Connection Refused](https://discuss.elastic.co/t/auditbeat-connection-refused/318809)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 4\ **Last updated:** [November 15, 2022, 3:21pm UTC](https://discuss.elastic.co/t/auditbeat-connection-refused/318809 "2022-11-15T15:21:33Z")
I'm trying to learn how to set up auditbeat on the same server as my elasticsearch and kibana instance verison 8.5 which is running off of ubuntu 20.04. But when I do a systemctl start auditbeat.service, I get the error… --- ## [Plot a table with custom rule based color in background](https://discuss.elastic.co/t/plot-a-table-with-custom-rule-based-color-in-background/318844)
**Author:** [@Tukaram](https://discuss.elastic.co/u/Tukaram)\ **Replies:** 9\ **Last updated:** [November 15, 2022, 2:45pm UTC](https://discuss.elastic.co/t/plot-a-table-with-custom-rule-based-color-in-background/318844 "2022-11-15T14:45:03Z")
Hi, I want to plot a table with custom rule based color for each cell. so, for below table, if debt is more than income, it should be red. if income is more than debt, it should be green. is this possible? how? --- ## [Logstash Pipeline with elasticsearch output missing in Stack Monitoring](https://discuss.elastic.co/t/logstash-pipeline-with-elasticsearch-output-missing-in-stack-monitoring/318439)
**Author:** [@peet](https://discuss.elastic.co/u/peet)\ **Replies:** 1\ **Last updated:** [November 15, 2022, 12:23pm UTC](https://discuss.elastic.co/t/logstash-pipeline-with-elasticsearch-output-missing-in-stack-monitoring/318439 "2022-11-15T12:23:54Z")
Hi! We are currently setting up monitoring for our Logstash instances. Metricbeat on the Logstash is configured as described in the instructions: - module: logstash metricsets: - node - node\_stats xpack.en… --- ## [Logstash document\_id for 3 joined tables](https://discuss.elastic.co/t/logstash-document-id-for-3-joined-tables/318896)
**Author:** [@Swati\_Kanade](https://discuss.elastic.co/u/Swati_Kanade)\ **Replies:** 2\ **Last updated:** [November 15, 2022, 11:58am UTC](https://discuss.elastic.co/t/logstash-document-id-for-3-joined-tables/318896 "2022-11-15T11:58:15Z")
Hi, I am new to ELK stack search. I have created an index by joining 3 tables - message, message\_recipient and message\_attachments - using inner join on message and message\_recipient and left outer join on message\_attach… --- ## [Unable to collect Windows logs through WinLogBeat & ElasticSearch 7.17](https://discuss.elastic.co/t/unable-to-collect-windows-logs-through-winlogbeat-elasticsearch-7-17/318897)
**Author:** [@tranceptor](https://discuss.elastic.co/u/tranceptor)\ **Replies:** 0\ **Last updated:** [November 14, 2022, 7:07pm UTC](https://discuss.elastic.co/t/unable-to-collect-windows-logs-through-winlogbeat-elasticsearch-7-17/318897 "2022-11-14T19:07:41Z")
Hello, I've just installed GrayLog + Elasticsearch and I need to collect Windows logs from a Windows machine. I installed WinLogBeat following this instructions: \[Grant access using API keys | Winlogbeat Reference \[8.5\] … --- ## [Math calculation in kibana to visualize](https://discuss.elastic.co/t/math-calculation-in-kibana-to-visualize/316970)
**Author:** [@Nanditha](https://discuss.elastic.co/u/Nanditha)\ **Replies:** 3\ **Last updated:** [October 19, 2022, 10:07am UTC](https://discuss.elastic.co/t/math-calculation-in-kibana-to-visualize/316970 "2022-10-19T10:07:09Z")
I need to calculate below math calculations and visualize it in dashboard. When i push new data it should calculate the same and change. Can anyone please help on this. precision = tp/ (tp + fp) recall = tp/tp + fn Fal… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=730) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=732)