# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=734 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 735 --- ## [Does combined\_fields query (or multi-match+cross\_fields) support phrase?](https://discuss.elastic.co/t/does-combined-fields-query-or-multi-match-cross-fields-support-phrase/318837)
**Author:** [@yliu000](https://discuss.elastic.co/u/yliu000)\ **Replies:** 0\ **Last updated:** [November 14, 2022, 8:03am UTC](https://discuss.elastic.co/t/does-combined-fields-query-or-multi-match-cross-fields-support-phrase/318837 "2022-11-14T08:03:00Z")
Hi, I have documents with multiple fields, and want to do "term centric" search, instead of "field centric" search. (Following term centric combined\_fields for "term centric" definition). I have two needs: First, I n… --- ## [How to understand registry file in filebeat 8.3.2](https://discuss.elastic.co/t/how-to-understand-registry-file-in-filebeat-8-3-2/318827)
**Author:** [@bharat97](https://discuss.elastic.co/u/bharat97)\ **Replies:** 0\ **Last updated:** [November 14, 2022, 6:29am UTC](https://discuss.elastic.co/t/how-to-understand-registry-file-in-filebeat-8-3-2/318827 "2022-11-14T06:29:59Z")
Hi, Is there any way I can know, which all files are shipped by filebeat to logstash. I was reading the registry file but I am not able to understand what each record means. Here is a sample of my registry log file, can … --- ## [Why Current action time option of 2 indices is showing same date and time](https://discuss.elastic.co/t/why-current-action-time-option-of-2-indices-is-showing-same-date-and-time/318727)
**Author:** [@jisha](https://discuss.elastic.co/u/jisha)\ **Replies:** 2\ **Last updated:** [November 14, 2022, 5:54am UTC](https://discuss.elastic.co/t/why-current-action-time-option-of-2-indices-is-showing-same-date-and-time/318727 "2022-11-14T05:54:01Z")
Why Current action time option of 2 indices is showing same date and time. how to check the indice creation details . i have attached the screenshots too. --- ## [Elasticseach shards allocation](https://discuss.elastic.co/t/elasticseach-shards-allocation/318770)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 2\ **Last updated:** [November 14, 2022, 5:13am UTC](https://discuss.elastic.co/t/elasticseach-shards-allocation/318770 "2022-11-14T05:13:22Z")
Hi, I have elastic version 7.17.0 and I have a problem with shard allocation, which causes problems with data loading. The cluster is rejecting requests and limiting ingest due to overloading 2 nodes. The nodes are ov… --- ## [ELK Migartion to 8.4.3](https://discuss.elastic.co/t/elk-migartion-to-8-4-3/318715)
**Author:** [@Suraj\_Jannu](https://discuss.elastic.co/u/Suraj_Jannu)\ **Replies:** 1\ **Last updated:** [November 14, 2022, 3:08am UTC](https://discuss.elastic.co/t/elk-migartion-to-8-4-3/318715 "2022-11-14T03:08:08Z")
Hello, Current ELK stack version details: Elasticsearch: 7.5.1 Kibana: 6.7.2 Logstash: 6.8.12 We are using ELK purely as a log-aggregation platform and I am planning to update my ELK cluster 8.4.3. Could you ple… --- ## [Unable to start Logstash docker 8.5.0](https://discuss.elastic.co/t/unable-to-start-logstash-docker-8-5-0/318815)
**Author:** [@diogogm](https://discuss.elastic.co/u/diogogm)\ **Replies:** 4\ **Last updated:** [November 14, 2022, 2:50am UTC](https://discuss.elastic.co/t/unable-to-start-logstash-docker-8-5-0/318815 "2022-11-14T02:50:08Z")
Hi everyone, I'm trying to start my logstash docker after hours configuring jvm.options, log4j2.properties, logstash.yml and pipelines.yml it's still showing "Logstash shut down" , I'm running the latest version of Elas… --- ## [Enable user to generate API Key and access API](https://discuss.elastic.co/t/enable-user-to-generate-api-key-and-access-api/318695)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 9\ **Last updated:** [November 14, 2022, 2:43am UTC](https://discuss.elastic.co/t/enable-user-to-generate-api-key-and-access-api/318695 "2022-11-14T02:43:43Z")
Hello. We are running ELK 7.6.2 stack. I need to create a user and provide it access for API key generation along with API access. When I check in Kibana console it says "API keys not enabled in Elasticsearch" Please … --- ## [How to split ".security-7"](https://discuss.elastic.co/t/how-to-split-security-7/317807)
**Author:** [@MuFeng](https://discuss.elastic.co/u/MuFeng)\ **Replies:** 18\ **Last updated:** [November 14, 2022, 1:58am UTC](https://discuss.elastic.co/t/how-to-split-security-7/317807 "2022-11-14T01:58:29Z")
Why can't I add multiple copies of. security-7 in the ES8 cluster? How to modify the number of replicas of the system index? --- ## [Load index template into Elasticsearch](https://discuss.elastic.co/t/load-index-template-into-elasticsearch/318814)
**Author:** [@sharbich](https://discuss.elastic.co/u/sharbich)\ **Replies:** 0\ **Last updated:** [November 14, 2022, 12:53am UTC](https://discuss.elastic.co/t/load-index-template-into-elasticsearch/318814 "2022-11-14T00:53:37Z")
Hello, I want to issue the following command. However, I can only access my elasticsearch via ssl. Therefore I get the following error message: root@nmanme01:~# filebeat setup -E output.logstash.enabled=false -E outp… --- ## [Kibana setup with elasticsearch 8.4.3](https://discuss.elastic.co/t/kibana-setup-with-elasticsearch-8-4-3/318792)
**Author:** [@Suraj\_Jannu](https://discuss.elastic.co/u/Suraj_Jannu)\ **Replies:** 1\ **Last updated:** [November 14, 2022, 12:38am UTC](https://discuss.elastic.co/t/kibana-setup-with-elasticsearch-8-4-3/318792 "2022-11-14T00:38:14Z")
Hello, I am setting up the Kibana and Elasticseach instances in AWS with version 8.4.3. The Elasticsearch instance is up and running. While configuring the kibana I have set the following properties. server.host: 0.0.… --- ## [Exiting: index management requested but the Elasticsearch output is not configured/enabled](https://discuss.elastic.co/t/exiting-index-management-requested-but-the-elasticsearch-output-is-not-configured-enabled/318714)
**Author:** [@mr\_ph](https://discuss.elastic.co/u/mr_ph)\ **Replies:** 0\ **Last updated:** [November 11, 2022, 7:18am UTC](https://discuss.elastic.co/t/exiting-index-management-requested-but-the-elasticsearch-output-is-not-configured-enabled/318714 "2022-11-11T07:18:47Z")
Hi, I'm using elk stack 8.5. i want to parse the logs from beats -\> logstash -\> elasticsearch . But while i use the filebeat setup command i'm getting this error message Exiting: index management requested but the Elas… --- ## [Multiple filebeat instances sending logs](https://discuss.elastic.co/t/multiple-filebeat-instances-sending-logs/318651)
**Author:** [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\ **Replies:** 0\ **Last updated:** [November 10, 2022, 12:06pm UTC](https://discuss.elastic.co/t/multiple-filebeat-instances-sending-logs/318651 "2022-11-10T12:06:33Z")
Hi, I have installed filebeat on multiple servers to pick system logs. The filebeat for server a works fine. filebeat.yml type: log enabled: true paths: /var/log/jenkins/jenkins.log exclude\_files: \['.gz$'\] multi… --- ## [Filebeat multiline error](https://discuss.elastic.co/t/filebeat-multiline-error/318654)
**Author:** [@arhodoula](https://discuss.elastic.co/u/arhodoula)\ **Replies:** 0\ **Last updated:** [November 10, 2022, 12:13pm UTC](https://discuss.elastic.co/t/filebeat-multiline-error/318654 "2022-11-10T12:13:51Z")
we have some database records where one field could contain a new line. Filebeat returns illegal\_argument\_exception and is dropping these events. could you please help? --- ## [Filebeats can not connect to ElasticSearch](https://discuss.elastic.co/t/filebeats-can-not-connect-to-elasticsearch/318607)
**Author:** [@Zay\_Lin\_Htun](https://discuss.elastic.co/u/Zay_Lin_Htun)\ **Replies:** 7\ **Last updated:** [November 13, 2022, 11:47pm UTC](https://discuss.elastic.co/t/filebeats-can-not-connect-to-elasticsearch/318607 "2022-11-13T23:47:45Z")
In version 8.5 of Elastic Search and Filebeats I can not ship the logs from Filebeats to Elasticsearch Here is the error log {"log.level":"info","@timestamp":"2022-11-10T04:23:19.993Z","log.logger":"add\_cloud\_metadata… --- ## [What is the effect of circuit breakers limit on search queries](https://discuss.elastic.co/t/what-is-the-effect-of-circuit-breakers-limit-on-search-queries/318795)
**Author:** [@md2](https://discuss.elastic.co/u/md2)\ **Replies:** 1\ **Last updated:** [November 13, 2022, 11:36pm UTC](https://discuss.elastic.co/t/what-is-the-effect-of-circuit-breakers-limit-on-search-queries/318795 "2022-11-13T23:36:45Z")
Hi, I am wondering what happens to the queries that hit the circuit breakers memory limit, are they discarded completely and lost forever? What is the recommended method to monitor these queries? Does this entry from th… --- ## [\[winlogbeat\] where log data received from Linux\_winlogbeat is stored](https://discuss.elastic.co/t/winlogbeat-where-log-data-received-from-linux-winlogbeat-is-stored/318174)
**Author:** [@shaAbe](https://discuss.elastic.co/u/shaAbe)\ **Replies:** 3\ **Last updated:** [November 13, 2022, 11:33pm UTC](https://discuss.elastic.co/t/winlogbeat-where-log-data-received-from-linux-winlogbeat-is-stored/318174 "2022-11-13T23:33:21Z")
I'm sending windows event logs to elasticsearch using winlogbeat. And I'm using kibana to display the event log data received by elasticsearch. So I have one question. Where in the Linux directory is elasticsearch sto… --- ## [Using Elasticsearch as a Data Lake and forwarding logs to SIEM based on the use cases implemented](https://discuss.elastic.co/t/using-elasticsearch-as-a-data-lake-and-forwarding-logs-to-siem-based-on-the-use-cases-implemented/318558)
**Author:** [@bit1290](https://discuss.elastic.co/u/bit1290)\ **Replies:** 3\ **Last updated:** [November 13, 2022, 11:31pm UTC](https://discuss.elastic.co/t/using-elasticsearch-as-a-data-lake-and-forwarding-logs-to-siem-based-on-the-use-cases-implemented/318558 "2022-11-13T23:31:52Z")
Hello, I really need your help and vision on a situation I'm passing through. Here is the description: We have a SIEM (QRadar) structure, with Event Collectors that receive logs from various data sources from many … --- ## [Cannot log in to Kibana with "elastic" user, after enabling minimal security](https://discuss.elastic.co/t/cannot-log-in-to-kibana-with-elastic-user-after-enabling-minimal-security/318808)
**Author:** [@usaadi](https://discuss.elastic.co/u/usaadi)\ **Replies:** 6\ **Last updated:** [November 13, 2022, 11:20pm UTC](https://discuss.elastic.co/t/cannot-log-in-to-kibana-with-elastic-user-after-enabling-minimal-security/318808 "2022-11-13T23:20:50Z")
Hello... I have an Elasticsearch cluster that has been running with security disabled. I tried to enable security by following the instructions at: I completed all the instructions, but I also overwrote the Kibana k… --- ## [Upgrade to non free license in self managed elastic production](https://discuss.elastic.co/t/upgrade-to-non-free-license-in-self-managed-elastic-production/318807)
**Author:** [@Mahdi\_Moazami](https://discuss.elastic.co/u/Mahdi_Moazami)\ **Replies:** 2\ **Last updated:** [November 13, 2022, 9:43pm UTC](https://discuss.elastic.co/t/upgrade-to-non-free-license-in-self-managed-elastic-production/318807 "2022-11-13T21:43:25Z")
Hi there elastic team we have a self managed elastic setup in our production servers and we are looking for the way to buy Gold or Platinum license. what I got from searching in site was that this functionality is only … --- ## [Calculate elapsed time in Kibana?](https://discuss.elastic.co/t/calculate-elapsed-time-in-kibana/316575)
**Author:** [@TXBigDawg1836](https://discuss.elastic.co/u/TXBigDawg1836)\ **Replies:** 2\ **Last updated:** [November 13, 2022, 10:18am UTC](https://discuss.elastic.co/t/calculate-elapsed-time-in-kibana/316575 "2022-11-13T10:18:15Z")
ELK newbie here. Is it possible in Kibana visualization (ie. Table) to calculate the elapsed time from the timestamp and current time? Looking to populate a field in the table to show the elapsed time since the last ti… --- ## [Attempted to resurrect connection to dead ES instance](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance/318562)
**Author:** [@Zay\_Lin\_Htun](https://discuss.elastic.co/u/Zay_Lin_Htun)\ **Replies:** 2\ **Last updated:** [November 13, 2022, 4:52am UTC](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance/318562 "2022-11-13T04:52:10Z")
Hello folks, \[INFO \] 2022-11-09 16:05:14.964 \[Ruby-0-Thread-9: :1\] elasticsearch - Failed to perform request {:message=\>"PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to f… --- ## [Elasticsearch node fails after multiple G1GC triggers](https://discuss.elastic.co/t/elasticsearch-node-fails-after-multiple-g1gc-triggers/318779)
**Author:** [@BradVido](https://discuss.elastic.co/u/BradVido)\ **Replies:** 0\ **Last updated:** [November 12, 2022, 9:16pm UTC](https://discuss.elastic.co/t/elasticsearch-node-fails-after-multiple-g1gc-triggers/318779 "2022-11-12T21:16:09Z")
We have a 6 node cluster on ES 7.17.7, which is very stable except for our single coordinating node (which also is master eligible, so not a "true" coordinating node). After 4-6 hours of uptime, we always get the below … --- ## [How many Public IP need for my cluster](https://discuss.elastic.co/t/how-many-public-ip-need-for-my-cluster/318766)
**Author:** [@Zay\_Lin\_Htun](https://discuss.elastic.co/u/Zay_Lin_Htun)\ **Replies:** 1\ **Last updated:** [November 12, 2022, 11:06pm UTC](https://discuss.elastic.co/t/how-many-public-ip-need-for-my-cluster/318766 "2022-11-12T23:06:33Z")
I would like to know the how many Public IP addresses need to deploy my cluster in AWS. In my cluster, there are 2 data nodes for Hot data 2 data nodes for warm data 3 Master Nodes 2 Logstash Feel free to suggest me … --- ## [Eecute python code from Kibana](https://discuss.elastic.co/t/eecute-python-code-from-kibana/316748)
**Author:** [@Rajesh\_Sharma](https://discuss.elastic.co/u/Rajesh_Sharma)\ **Replies:** 1\ **Last updated:** [October 17, 2022, 8:45am UTC](https://discuss.elastic.co/t/eecute-python-code-from-kibana/316748 "2022-10-17T08:45:39Z")
Hi, I need to execute a python script from kibana dashboard, is it something feasible? I have requirement where I need to build a dynamic image via the python and display in the kibana dashboard in a popup/overlay. On… --- ## [Configuring logstash input for mysql jdbc](https://discuss.elastic.co/t/configuring-logstash-input-for-mysql-jdbc/318745)
**Author:** [@Khammassi\_HoussemEdd](https://discuss.elastic.co/u/Khammassi_HoussemEdd)\ **Replies:** 2\ **Last updated:** [November 12, 2022, 8:03am UTC](https://discuss.elastic.co/t/configuring-logstash-input-for-mysql-jdbc/318745 "2022-11-12T08:03:13Z")
this is my output : root@elk:/usr/share/logstash# sudo /usr/share/logstash/bin/logstash -f jdbc.conf Using bundled JDK: /usr/share/logstash/jdk WARNING: Could not find logstash.yml which is typically located in $LS\_HOME… --- ## [File "vendor/bundle/jruby/2.5.0/gems/pleaserun-0.0.31/bin/pleaserun" with access permission 777, who knows why?](https://discuss.elastic.co/t/file-vendor-bundle-jruby-2-5-0-gems-pleaserun-0-0-31-bin-pleaserun-with-access-permission-777-who-knows-why/317933)
**Author:** [@weng77](https://discuss.elastic.co/u/weng77)\ **Replies:** 1\ **Last updated:** [November 12, 2022, 6:15am UTC](https://discuss.elastic.co/t/file-vendor-bundle-jruby-2-5-0-gems-pleaserun-0-0-31-bin-pleaserun-with-access-permission-777-who-knows-why/317933 "2022-11-12T06:15:14Z")
File access permission with 777 will make things world writeable, it's an awful idea. But in logstash 7.7.0~logstash 7.12.0 pkg(from https://www.elastic.co/cn/downloads/past-releases/), we find out two files in vendor/b… --- ## [LogStash - Add fields between two unique events (start and stop)](https://discuss.elastic.co/t/logstash-add-fields-between-two-unique-events-start-and-stop/317586)
**Author:** [@Frankie\_Braybon](https://discuss.elastic.co/u/Frankie_Braybon)\ **Replies:** 1\ **Last updated:** [November 12, 2022, 3:18am UTC](https://discuss.elastic.co/t/logstash-add-fields-between-two-unique-events-start-and-stop/317586 "2022-11-12T03:18:24Z")
Hi, I have logs shipping to Logstash via FileBeat, which I'm doing log enrichment on before passing on to Elasticsearch. One of the enrichments I would like to do is add a field to each event which is between two uniqu… --- ## [Add new documents to an enrich index](https://discuss.elastic.co/t/add-new-documents-to-an-enrich-index/318759)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 3\ **Last updated:** [November 12, 2022, 1:08am UTC](https://discuss.elastic.co/t/add-new-documents-to-an-enrich-index/318759 "2022-11-12T01:08:05Z")
Hi, I have filebeat sending data to elasticsearch, this data is enriched with an ingest pipeline, I have added a new document to the enrich index that already is in use, but the changes are not showing. What do I have … --- ## [Elastic System Integration dashboard issue](https://discuss.elastic.co/t/elastic-system-integration-dashboard-issue/318549)
**Author:** [@subash](https://discuss.elastic.co/u/subash)\ **Replies:** 7\ **Last updated:** [November 11, 2022, 11:20pm UTC](https://discuss.elastic.co/t/elastic-system-integration-dashboard-issue/318549 "2022-11-11T23:20:40Z")
Mistakenly I have deleted the inbuilt dashboards of System integration with elastic. Is there any way that I can get those dashboards back? --- ## [\[ERROR\] Cannot race. This race ended with a fatal crash](https://discuss.elastic.co/t/error-cannot-race-this-race-ended-with-a-fatal-crash/318756)
**Author:** [@Sahitya\_Panchapakasa](https://discuss.elastic.co/u/Sahitya_Panchapakasa)\ **Replies:** 1\ **Last updated:** [November 11, 2022, 7:18pm UTC](https://discuss.elastic.co/t/error-cannot-race-this-race-ended-with-a-fatal-crash/318756 "2022-11-11T19:18:18Z")
Hi, Am just getting started with rally and got this error when doing esrally race --distribution-version=6.8.0 --track=geopoint --challenge=append-fast-with-conflicts Steps followed as per https://esrally.readthedocs.… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=733) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=735)