# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=738 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 739 --- ## [Date\_range field does not refresh my dashboard](https://discuss.elastic.co/t/date-range-field-does-not-refresh-my-dashboard/318328)
**Author:** [@Ilyas\_Badr](https://discuss.elastic.co/u/Ilyas_Badr)\ **Replies:** 9\ **Last updated:** [November 9, 2022, 3:50pm UTC](https://discuss.elastic.co/t/date-range-field-does-not-refresh-my-dashboard/318328 "2022-11-09T15:50:47Z")
I am using kibana to search the document of elasticsearch, somehow my dashboard stopped to be refreshed I found that date\_range filed ,which represents the time that event occurred. any idea how to fix the issue? --- ## [Missing fields from Metricbeat AWS Module](https://discuss.elastic.co/t/missing-fields-from-metricbeat-aws-module/317215)
**Author:** [@chicoco](https://discuss.elastic.co/u/chicoco)\ **Replies:** 6\ **Last updated:** [November 9, 2022, 3:49pm UTC](https://discuss.elastic.co/t/missing-fields-from-metricbeat-aws-module/317215 "2022-11-09T15:49:21Z")
Hello, I am new to Metricbeat, I want to monitor my AWS services, The overview dashboard is missing a lot of information, I started with EC2 CPU Utilization I found aws.ec2.cpu.total.pct field is missing although I trie… --- ## [Integrating Power Automate flows with Azure Elastic](https://discuss.elastic.co/t/integrating-power-automate-flows-with-azure-elastic/316465)
**Author:** [@mohan.guttula](https://discuss.elastic.co/u/mohan.guttula)\ **Replies:** 0\ **Last updated:** [October 12, 2022, 6:56pm UTC](https://discuss.elastic.co/t/integrating-power-automate-flows-with-azure-elastic/316465 "2022-10-12T18:56:22Z")
how to ingest telemetry from Power Automate to Azure Elastic ? --- ## [Failed on parsing mappings on index creation \[nyc\_taxis\]](https://discuss.elastic.co/t/failed-on-parsing-mappings-on-index-creation-nyc-taxis/318539)
**Author:** [@amitsa](https://discuss.elastic.co/u/amitsa)\ **Replies:** 11\ **Last updated:** [November 9, 2022, 3:05pm UTC](https://discuss.elastic.co/t/failed-on-parsing-mappings-on-index-creation-nyc-taxis/318539 "2022-11-09T15:05:40Z")
Previously raised issue but the issue is still not fixed. ES Version 8.2.0 ESRally Version: 2.7.0 Running on kubernetes. Using official docker image. Getting below error, message":"failed on parsing mappings on i… --- ## [Remove domain from username](https://discuss.elastic.co/t/remove-domain-from-username/318464)
**Author:** [@aivazisd](https://discuss.elastic.co/u/aivazisd)\ **Replies:** 4\ **Last updated:** [November 9, 2022, 3:05pm UTC](https://discuss.elastic.co/t/remove-domain-from-username/318464 "2022-11-09T15:05:29Z")
Working with a string: user-identity: Delete IP-User mapping 555.55.55.555 - LOCAL\\user Succeeded - VPN user logout I'm trying to extract the user field without the 'LOCAL'. I can capture the IP and string 'logout' for… --- ## [Help including host name in httpjson post request from UI](https://discuss.elastic.co/t/help-including-host-name-in-httpjson-post-request-from-ui/318456)
**Author:** [@Mark\_Round](https://discuss.elastic.co/u/Mark_Round)\ **Replies:** 0\ **Last updated:** [November 8, 2022, 4:12pm UTC](https://discuss.elastic.co/t/help-including-host-name-in-httpjson-post-request-from-ui/318456 "2022-11-08T16:12:14Z")
I am configuring an HTTPJSON Input from Fleet using the UI and doing a POST on a REST endpoint. I need to send a body in the request. If I hard code the body as json {'hostname': 'currenthostname'} with a host name it w… --- ## [Jenkins metrics using metricbeat](https://discuss.elastic.co/t/jenkins-metrics-using-metricbeat/318508)
**Author:** [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\ **Replies:** 8\ **Last updated:** [November 9, 2022, 1:12pm UTC](https://discuss.elastic.co/t/jenkins-metrics-using-metricbeat/318508 "2022-11-09T13:12:52Z")
Hi, I've installed metricbeat on jenkins server and configured the elasticsearch output and kibana dashboards in metricbeat.yml. After starting metricbeat i am getting too many entries in the dashboard page of elk serve… --- ## [MultiMatchQuery for simple phrase search](https://discuss.elastic.co/t/multimatchquery-for-simple-phrase-search/318542)
**Author:** [@jjc](https://discuss.elastic.co/u/jjc)\ **Replies:** 0\ **Last updated:** [November 9, 2022, 1:05pm UTC](https://discuss.elastic.co/t/multimatchquery-for-simple-phrase-search/318542 "2022-11-09T13:05:52Z")
Hi, i need some help. i'm simply trying to retrieve documents with the word "Cheese" in some of its fields. Below is a sample document. {"caption":"Cheese, An authentic Creole Jambalaya recipe!", "description":"Jamba… --- ## [Ingest Pipeline - ignore\_failure is ignored](https://discuss.elastic.co/t/ingest-pipeline-ignore-failure-is-ignored/318484)
**Author:** [@gunlomboy](https://discuss.elastic.co/u/gunlomboy)\ **Replies:** 5\ **Last updated:** [November 9, 2022, 12:19pm UTC](https://discuss.elastic.co/t/ingest-pipeline-ignore-failure-is-ignored/318484 "2022-11-09T12:19:21Z")
Hi, We are attempting to ingest PANW events via filebeat-\>logstash-\>elasticsearch. The filebeat-8.4.0-panw-panos-pipeline fails due to the second processor being: rename "message" to "event.original" Our event alread… --- ## [Filebeat auditd module causes mapping explosion](https://discuss.elastic.co/t/filebeat-auditd-module-causes-mapping-explosion/318205)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 1\ **Last updated:** [November 9, 2022, 12:07pm UTC](https://discuss.elastic.co/t/filebeat-auditd-module-causes-mapping-explosion/318205 "2022-11-09T12:07:24Z")
Hi folks, I am using Filebeat and auditd module to collect audit logs from linux vm. I am often running into mapping limit because the ingest pipeline creates a new field for every argument given in the log message. f… --- ## [Custom Visualisation using Vega for creating Tag Clous](https://discuss.elastic.co/t/custom-visualisation-using-vega-for-creating-tag-clous/318506)
**Author:** [@Shashank02](https://discuss.elastic.co/u/Shashank02)\ **Replies:** 1\ **Last updated:** [November 9, 2022, 11:25am UTC](https://discuss.elastic.co/t/custom-visualisation-using-vega-for-creating-tag-clous/318506 "2022-11-09T11:25:22Z")
I need some help regarding building a custom Vega Tag Cloud. So, my idea here is that we are giving scores to some of the words. So, if a word is negative it should show red color and if it is positive it should show gre… --- ## ['Missing' on field aggreagation is not available in Java Client](https://discuss.elastic.co/t/missing-on-field-aggreagation-is-not-available-in-java-client/317679)
**Author:** [@molsza](https://discuss.elastic.co/u/molsza)\ **Replies:** 2\ **Last updated:** [November 9, 2022, 9:59am UTC](https://discuss.elastic.co/t/missing-on-field-aggreagation-is-not-available-in-java-client/317679 "2022-11-09T09:59:20Z")
I am trying to do an aggregation on multi-terms fields and include the cases where there is no value for for fields. The missing property should handle that, but it looks like it cannot be set in Java Client co.elastic.c… --- ## [Cold and frozen node recommended memory specification](https://discuss.elastic.co/t/cold-and-frozen-node-recommended-memory-specification/318520)
**Author:** [@dms6978](https://discuss.elastic.co/u/dms6978)\ **Replies:** 2\ **Last updated:** [November 9, 2022, 9:38am UTC](https://discuss.elastic.co/t/cold-and-frozen-node-recommended-memory-specification/318520 "2022-11-09T09:38:39Z")
As far as I know, hot node needs 4TB of ssd, how much is cold and frozen node? --- ## [Query\_string does not work with multiple tokens with the same position](https://discuss.elastic.co/t/query-string-does-not-work-with-multiple-tokens-with-the-same-position/318454)
**Author:** [@Alex\_Shkop](https://discuss.elastic.co/u/Alex_Shkop)\ **Replies:** 2\ **Last updated:** [November 9, 2022, 8:30am UTC](https://discuss.elastic.co/t/query-string-does-not-work-with-multiple-tokens-with-the-same-position/318454 "2022-11-09T08:30:04Z")
I'm having troubles with query\_string query when my analyzer returns multiple tokens for the same position. Here's an output of \_analyze for my query: { "tokens" : \[ { "token" : "d", "start\_offset" : 6… --- ## [Not able to sign in using Keycloak in Kibana](https://discuss.elastic.co/t/not-able-to-sign-in-using-keycloak-in-kibana/318435)
**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\ **Replies:** 9\ **Last updated:** [November 9, 2022, 8:23am UTC](https://discuss.elastic.co/t/not-able-to-sign-in-using-keycloak-in-kibana/318435 "2022-11-09T08:23:52Z")
Hi, I have integrated ES, Kibana with Keycloak. Both Kibana and ES are https enabled. The below are the configurations I have made in the yml files. ## elasticsearch.yml #Open ID connect settings xpack.security.authc.… --- ## [Multiple pre & post tags in highlighter query](https://discuss.elastic.co/t/multiple-pre-post-tags-in-highlighter-query/318492)
**Author:** [@mayanknc](https://discuss.elastic.co/u/mayanknc)\ **Replies:** 1\ **Last updated:** [November 9, 2022, 7:53am UTC](https://discuss.elastic.co/t/multiple-pre-post-tags-in-highlighter-query/318492 "2022-11-09T07:53:04Z")
Hi I want to highlight individual query string's match result with different pre & post tags. Create Index PUT multilang\_index { "mappings": { "dynamic\_templates": \[ { "stripped\_section\_template": { … --- ## [How to check old pipeline is terminated or not in logstash during config reload](https://discuss.elastic.co/t/how-to-check-old-pipeline-is-terminated-or-not-in-logstash-during-config-reload/318514)
**Author:** [@teja\_tata](https://discuss.elastic.co/u/teja_tata)\ **Replies:** 0\ **Last updated:** [November 9, 2022, 7:25am UTC](https://discuss.elastic.co/t/how-to-check-old-pipeline-is-terminated-or-not-in-logstash-during-config-reload/318514 "2022-11-09T07:25:14Z")
From the above documentation we could see that Logstash swaps the existing pipeline with the new pipeline. If the checks fail, the old pipeline continues to function, and the errors are propagated to the console. How … --- ## [Cloning using DotNet Client](https://discuss.elastic.co/t/cloning-using-dotnet-client/318503)
**Author:** [@abby\_d](https://discuss.elastic.co/u/abby_d)\ **Replies:** 2\ **Last updated:** [November 9, 2022, 7:00am UTC](https://discuss.elastic.co/t/cloning-using-dotnet-client/318503 "2022-11-09T07:00:32Z")
Hi All. We can clone an index with one of the following commands in Console POST /\/\_clone/\ PUT /\/\_clone/\ Can someone point me in the direction how we can achieve the same usin… --- ## [Netflow Poor Performance with filebeat 7.13](https://discuss.elastic.co/t/netflow-poor-performance-with-filebeat-7-13/318512)
**Author:** [@vinit0711](https://discuss.elastic.co/u/vinit0711)\ **Replies:** 0\ **Last updated:** [November 9, 2022, 6:54am UTC](https://discuss.elastic.co/t/netflow-poor-performance-with-filebeat-7-13/318512 "2022-11-09T06:54:32Z")
I am capturing netflow packets and displaying the information on kibana dashboard .I am able to do so but around 30-40 % packets are being dropped . I am verfiying the packets in tcp dump and the some packets not able to… --- ## [I was logging my log from .net application using seilog before enabling Xpack security in stack the logs stopped comming](https://discuss.elastic.co/t/i-was-logging-my-log-from-net-application-using-seilog-before-enabling-xpack-security-in-stack-the-logs-stopped-comming/318499)
**Author:** [@DIVYANSH\_SINGH](https://discuss.elastic.co/u/DIVYANSH_SINGH)\ **Replies:** 4\ **Last updated:** [November 9, 2022, 6:47am UTC](https://discuss.elastic.co/t/i-was-logging-my-log-from-net-application-using-seilog-before-enabling-xpack-security-in-stack-the-logs-stopped-comming/318499 "2022-11-09T06:47:28Z")
I was logging my log from .net application using serilog before enabling Xpack security in stack the logs stopped comming How will i solve this --- ## [Import kibana dashboard using ansible playbook](https://discuss.elastic.co/t/import-kibana-dashboard-using-ansible-playbook/317965)
**Author:** [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\ **Replies:** 4\ **Last updated:** [November 9, 2022, 6:03am UTC](https://discuss.elastic.co/t/import-kibana-dashboard-using-ansible-playbook/317965 "2022-11-09T06:03:55Z")
Hi, I have created a kibana dashboard and exported it. This have a .ndjson file with me. Now I want to import this dashboard to kibana (other severs) using ansible playbook using the .ndjson file i already have. How can… --- ## [INDEX CLOSED EXCEPTION](https://discuss.elastic.co/t/index-closed-exception/318507)
**Author:** [@Gojo](https://discuss.elastic.co/u/Gojo)\ **Replies:** 0\ **Last updated:** [November 9, 2022, 6:03am UTC](https://discuss.elastic.co/t/index-closed-exception/318507 "2022-11-09T06:03:36Z")
Continuing the discussion from Index\_closed\_exception: so how can i resolve this ? --- ## [Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch](https://discuss.elastic.co/t/failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/318400)
**Author:** [@bta16](https://discuss.elastic.co/u/bta16)\ **Replies:** 12\ **Last updated:** [November 9, 2022, 5:43am UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/318400 "2022-11-09T05:43:09Z")
Hi there, i configure suricata-\>filebeat-\>kibana but when i Check that data is received from the Filebeat suricata module. There is no data. I think i get an error in filebeat. any information in my situation: i install… --- ## [INDEX IN CLOSED STATE NOT ABLE TO OPEN](https://discuss.elastic.co/t/index-in-closed-state-not-able-to-open/318396)
**Author:** [@Gojo](https://discuss.elastic.co/u/Gojo)\ **Replies:** 10\ **Last updated:** [November 9, 2022, 5:00am UTC](https://discuss.elastic.co/t/index-in-closed-state-not-able-to-open/318396 "2022-11-09T05:00:44Z")
hi all , we did rollback to our server after that suddenly all indices went to closed state --- ## [Can somebody interpret the data if the shard is unbalanced?](https://discuss.elastic.co/t/can-somebody-interpret-the-data-if-the-shard-is-unbalanced/318491)
**Author:** [@Java2avaj](https://discuss.elastic.co/u/Java2avaj)\ **Replies:** 1\ **Last updated:** [November 9, 2022, 4:19am UTC](https://discuss.elastic.co/t/can-somebody-interpret-the-data-if-the-shard-is-unbalanced/318491 "2022-11-09T04:19:48Z")
Based on the following data, may I know if the shard is unbalanced or is it evenly distributed for people index? We have 2 primary shards and 1 replica health status index uuid pri rep docs.… --- ## [Reference Set](https://discuss.elastic.co/t/reference-set/318375)
**Author:** [@gunlomboy](https://discuss.elastic.co/u/gunlomboy)\ **Replies:** 3\ **Last updated:** [November 9, 2022, 2:57am UTC](https://discuss.elastic.co/t/reference-set/318375 "2022-11-09T02:57:11Z")
Hi, We are using elasticsearch for alerting. Hosts are created and destroyed all the time for development purposes, but we have a core of devices which are tightly controlled. This list of devices is 100+ and are spre… --- ## [Filebeat PubSub module throughput issue](https://discuss.elastic.co/t/filebeat-pubsub-module-throughput-issue/318488)
**Author:** [@wendel](https://discuss.elastic.co/u/wendel)\ **Replies:** 0\ **Last updated:** [November 9, 2022, 1:51am UTC](https://discuss.elastic.co/t/filebeat-pubsub-module-throughput-issue/318488 "2022-11-09T01:51:06Z")
I have a single Filebeat 8.4.3 instance running in AWS pulling GCP audit events from a GCP PubSub topic and output to Kafka Topic. Tried various configuration/settings without any success going above 650 messages/s in Fi… --- ## [What is bucket\_influencers?](https://discuss.elastic.co/t/what-is-bucket-influencers/318486)
**Author:** [@minkiyo](https://discuss.elastic.co/u/minkiyo)\ **Replies:** 0\ **Last updated:** [November 9, 2022, 1:38am UTC](https://discuss.elastic.co/t/what-is-bucket-influencers/318486 "2022-11-09T01:38:35Z")
What I search "result\_type : bucket" in ml index, I could see bucket\_influencers info. Would you please explain exactly what bucket\_influencers is?? And Is there any document for where I can check the properties? I wo… --- ## [How to remove elasticsearch and reinstall to reset cluster](https://discuss.elastic.co/t/how-to-remove-elasticsearch-and-reinstall-to-reset-cluster/317904)
**Author:** [@tmdgk490255](https://discuss.elastic.co/u/tmdgk490255)\ **Replies:** 1\ **Last updated:** [November 9, 2022, 1:03am UTC](https://discuss.elastic.co/t/how-to-remove-elasticsearch-and-reinstall-to-reset-cluster/317904 "2022-11-09T01:03:58Z")
I want to remove es on ec2 instance and reinstall it to initialize cluster and node info How can I? I tried but it always had same cluster uuid even I uninstalled it First I installed es following these steps sudo rpm… --- ## [Sorting collapsed results based on nested documents](https://discuss.elastic.co/t/sorting-collapsed-results-based-on-nested-documents/318480)
**Author:** [@tombrisland](https://discuss.elastic.co/u/tombrisland)\ **Replies:** 0\ **Last updated:** [November 8, 2022, 10:20pm UTC](https://discuss.elastic.co/t/sorting-collapsed-results-based-on-nested-documents/318480 "2022-11-08T22:20:10Z")
I have a query which makes use of collapse to de-duplicate results. I'm expecting some collapsed results to have multiple duplicates, and some to be unique. I would like to sort the entries in such a way that the results… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=737) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=739)