# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=751 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 752 --- ## [Elasticdump never dumps data](https://discuss.elastic.co/t/elasticdump-never-dumps-data/317558)
**Author:** [@mpky](https://discuss.elastic.co/u/mpky)\ **Replies:** 0\ **Last updated:** [October 26, 2022, 8:37pm UTC](https://discuss.elastic.co/t/elasticdump-never-dumps-data/317558 "2022-10-26T20:37:00Z")
elasticdump \\ --input=http://\:\@\/news\_headlines \\ --output=./news\_data.json \\ --type=data \\ the above outputs "starting dump" and then times out. i'm on the default settings for … --- ## [Index template with only one field across multiple indices](https://discuss.elastic.co/t/index-template-with-only-one-field-across-multiple-indices/317315)
**Author:** [@not\_correct](https://discuss.elastic.co/u/not_correct)\ **Replies:** 14\ **Last updated:** [October 26, 2022, 6:03pm UTC](https://discuss.elastic.co/t/index-template-with-only-one-field-across-multiple-indices/317315 "2022-10-26T18:03:36Z")
Hi, I have multiple indices like mailbox-xx- xxxx .The xx-xxxx values are assigned dynamically. Each index contains various fields with date as a common field. The problem that date field has been read as long type by … --- ## [Kibana not showing data after turning on xpack security and TLS](https://discuss.elastic.co/t/kibana-not-showing-data-after-turning-on-xpack-security-and-tls/317470)
**Author:** [@Bruceclegg](https://discuss.elastic.co/u/Bruceclegg)\ **Replies:** 4\ **Last updated:** [October 26, 2022, 4:57pm UTC](https://discuss.elastic.co/t/kibana-not-showing-data-after-turning-on-xpack-security-and-tls/317470 "2022-10-26T16:57:27Z")
Yesterday I updated the security on our small 3 node cluster of Elasticsearch 7.17.5 running on CentOS 7. I did my best to follow the documentation: I added the passwords for the built in accounts, set up the kibana\_ke… --- ## [Data Path Change](https://discuss.elastic.co/t/data-path-change/317430)
**Author:** [@Safty](https://discuss.elastic.co/u/Safty)\ **Replies:** 4\ **Last updated:** [October 26, 2022, 4:19pm UTC](https://discuss.elastic.co/t/data-path-change/317430 "2022-10-26T16:19:13Z")
Hello, I am interested in best practices for changing the default data and log path in the elasticsearch.yml file. I have found various references on the web about how this is done (a simple copy of the data as well as… --- ## [Action/metadata line \[1\] contains an unknown parameter \[\_script\]](https://discuss.elastic.co/t/action-metadata-line-1-contains-an-unknown-parameter-script/317548)
**Author:** [@nimish](https://discuss.elastic.co/u/nimish)\ **Replies:** 0\ **Last updated:** [October 26, 2022, 3:32pm UTC](https://discuss.elastic.co/t/action-metadata-line-1-contains-an-unknown-parameter-script/317548 "2022-10-26T15:32:41Z")
facing following issue while updating document using script Encountered a retryable error (will retry with exponential backoff) { "error": { "root\_cause": \[ { "type": "illegal\_argument\_exception", "reason"… --- ## [My dashboard](https://discuss.elastic.co/t/my-dashboard/317534)
**Author:** [@VitorBarroso](https://discuss.elastic.co/u/VitorBarroso)\ **Replies:** 3\ **Last updated:** [October 26, 2022, 3:00pm UTC](https://discuss.elastic.co/t/my-dashboard/317534 "2022-10-26T15:00:19Z")
Hello I want to remove the value "Não existe" from the dashboard. Can i do it without touch any information? --- ## [Get token OAuth from Heartbeat before monitoring a service](https://discuss.elastic.co/t/get-token-oauth-from-heartbeat-before-monitoring-a-service/317526)
**Author:** [@rbr66](https://discuss.elastic.co/u/rbr66)\ **Replies:** 1\ **Last updated:** [October 26, 2022, 2:34pm UTC](https://discuss.elastic.co/t/get-token-oauth-from-heartbeat-before-monitoring-a-service/317526 "2022-10-26T14:34:34Z")
Hi, We have a health check service that for security reasons we have secured by OAuth, then to invoke it we need to have a valid token. Our current monitor is as follows: Is it possible to get a token every so often… --- ## [Docker - Elastic Agent - must be provided as an absolute path](https://discuss.elastic.co/t/docker-elastic-agent-must-be-provided-as-an-absolute-path/317523)
**Author:** [@vecjh](https://discuss.elastic.co/u/vecjh)\ **Replies:** 0\ **Last updated:** [October 26, 2022, 1:29pm UTC](https://discuss.elastic.co/t/docker-elastic-agent-must-be-provided-as-an-absolute-path/317523 "2022-10-26T13:29:46Z")
Hi, this seems inconsistent. I can reference value for all variables in the docker compose using relative paths. Like in the official Elastic Docker guide: xpack.security.http.ssl.key=certs/es01/es01.key However, I can… --- ## [Problem with filebeat or Kibana?](https://discuss.elastic.co/t/problem-with-filebeat-or-kibana/317514)
**Author:** [@kikinous](https://discuss.elastic.co/u/kikinous)\ **Replies:** 2\ **Last updated:** [October 26, 2022, 1:33pm UTC](https://discuss.elastic.co/t/problem-with-filebeat-or-kibana/317514 "2022-10-26T13:33:55Z")
hello, We have a problem with our ELK cluster. Logs retrieved by filebeat on our application servers are not completely displayed at the Kibana level. We don't know if it's a log injection problem in ELK or if it's a d… --- ## [Referenced config files FileBeat (Windows)](https://discuss.elastic.co/t/referenced-config-files-filebeat-windows/317310)
**Author:** [@Remco1985](https://discuss.elastic.co/u/Remco1985)\ **Replies:** 6\ **Last updated:** [October 26, 2022, 1:15pm UTC](https://discuss.elastic.co/t/referenced-config-files-filebeat-windows/317310 "2022-10-26T13:15:20Z")
Hi, Recently we have successfully installed Filebeat on our (test) Windows server. Right now I’m investigating to find out the best deployment strategy for Filebeat agents on all of our Windows Server systems. We would… --- ## [Filebeat monitoring metrics are "dropped" when a GEOIP pipeline is used](https://discuss.elastic.co/t/filebeat-monitoring-metrics-are-dropped-when-a-geoip-pipeline-is-used/317063)
**Author:** [@ppine7](https://discuss.elastic.co/u/ppine7)\ **Replies:** 23\ **Last updated:** [October 26, 2022, 12:53pm UTC](https://discuss.elastic.co/t/filebeat-monitoring-metrics-are-dropped-when-a-geoip-pipeline-is-used/317063 "2022-10-26T12:53:32Z")
Hi, this question comes as a result of solving one mystery in this post: Filebeat monitoring metrics not visible in ElasticSearch - #30 by stephenb - huge Thank You to @stephenb for his help! - where Filebeat monitoring… --- ## [Please tell me How to custom Kibana logo in 7.17.6](https://discuss.elastic.co/t/please-tell-me-how-to-custom-kibana-logo-in-7-17-6/316487)
**Author:** [@soniya](https://discuss.elastic.co/u/soniya)\ **Replies:** 1\ **Last updated:** [October 26, 2022, 12:58pm UTC](https://discuss.elastic.co/t/please-tell-me-how-to-custom-kibana-logo-in-7-17-6/316487 "2022-10-26T12:58:34Z")
Hi all, I am working on Kibana 7.17.6 version. I want to change Kibana logo and found some articles on logo change of Kibana, but they are for older version. please do help me with this query. --- ## [Illegal\_argument\_exception: index \[cwl-data-2022.10.14-0001\] is not the write index for alias \[cwl-data\]](https://discuss.elastic.co/t/illegal-argument-exception-index-cwl-data-2022-10-14-0001-is-not-the-write-index-for-alias-cwl-data/316910)
**Author:** [@waleedkh](https://discuss.elastic.co/u/waleedkh)\ **Replies:** 0\ **Last updated:** [October 18, 2022, 3:10pm UTC](https://discuss.elastic.co/t/illegal-argument-exception-index-cwl-data-2022-10-14-0001-is-not-the-write-index-for-alias-cwl-data/316910 "2022-10-18T15:10:30Z")
Hi there, I have an issue where this error is coming up. I see there are two other posts in the forums with similar issues but there have been no replies. Here is my policy { "policy": "cwl-data", "phase\_definition… --- ## [Unable to retrieve version information from Elasticsearch nodes](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes/317200)
**Author:** [@diegz](https://discuss.elastic.co/u/diegz)\ **Replies:** 2\ **Last updated:** [October 26, 2022, 12:38pm UTC](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes/317200 "2022-10-26T12:38:46Z")
Hello, I have this error when I start kibana : kibana1.lab.fr kibana\[2294\]: \[2022-10-21T14:42:03.355+02:00\]\[ERROR\]\[elasticsearch-service\] Unable to retrieve version information from Elasticsearch nodes. socket hang up … --- ## [Highlight produce unexpected invalid results on multivalue fields copied from other fields](https://discuss.elastic.co/t/highlight-produce-unexpected-invalid-results-on-multivalue-fields-copied-from-other-fields/317394)
**Author:** [@Maxim\_Kollegov](https://discuss.elastic.co/u/Maxim_Kollegov)\ **Replies:** 1\ **Last updated:** [October 26, 2022, 12:24pm UTC](https://discuss.elastic.co/t/highlight-produce-unexpected-invalid-results-on-multivalue-fields-copied-from-other-fields/317394 "2022-10-26T12:24:27Z")
Steps to reproduce create mapping post /test/\_mapping { "properties": { "family": { "type": "text", "index": true, "term\_vector": "with\_positions\_offsets", … --- ## [Searching two terms inside array of object](https://discuss.elastic.co/t/searching-two-terms-inside-array-of-object/317507)
**Author:** [@yashveer](https://discuss.elastic.co/u/yashveer)\ **Replies:** 4\ **Last updated:** [October 26, 2022, 12:23pm UTC](https://discuss.elastic.co/t/searching-two-terms-inside-array-of-object/317507 "2022-10-26T12:23:07Z")
"rno" : 1, "narratives": \[ { "compl": "call drop", "ts": "2015-05-01" }, { "compl": "internet connection lost ", "ts": "2016-01-… --- ## [\_update\_by\_query with PHP API](https://discuss.elastic.co/t/update-by-query-with-php-api/317500)
**Author:** [@abkrim](https://discuss.elastic.co/u/abkrim)\ **Replies:** 2\ **Last updated:** [October 26, 2022, 11:56am UTC](https://discuss.elastic.co/t/update-by-query-with-php-api/317500 "2022-10-26T11:56:17Z")
I am looking for some examples or documentation to help me know if it is possible to do a \_update\_by\_query with the PHP API. I have seen examples in the JS section, but I can't find anything on the subject in PHP Using … --- ## [Sort both hits and inner hits](https://discuss.elastic.co/t/sort-both-hits-and-inner-hits/317493)
**Author:** [@BrunoSkoon](https://discuss.elastic.co/u/BrunoSkoon)\ **Replies:** 1\ **Last updated:** [October 26, 2022, 11:00am UTC](https://discuss.elastic.co/t/sort-both-hits-and-inner-hits/317493 "2022-10-26T11:00:26Z")
Hello. I'm using Elasticsearch 8.4.3 and I need help to sort both the hits and inner hits. My data set is a list of product types, each containing a list of products. Each product then contains a price object with field… --- ## [Kibana dataview namespace](https://discuss.elastic.co/t/kibana-dataview-namespace/317475)
**Author:** [@dms6978](https://discuss.elastic.co/u/dms6978)\ **Replies:** 1\ **Last updated:** [October 26, 2022, 10:54am UTC](https://discuss.elastic.co/t/kibana-dataview-namespace/317475 "2022-10-26T10:54:16Z")
There is "namespace" properties of the data\_view object when create Data Views. (doc: Create data view API | Kibana Guide \[master\] | Elastic) curl -X POST "kibanahost:port/api/data\_views/data\_view" -H 'kbn-xsrf: true' … --- ## [Pmacct as\_path graphs](https://discuss.elastic.co/t/pmacct-as-path-graphs/317502)
**Author:** [@arphillips](https://discuss.elastic.co/u/arphillips)\ **Replies:** 0\ **Last updated:** [October 26, 2022, 10:40am UTC](https://discuss.elastic.co/t/pmacct-as-path-graphs/317502 "2022-10-26T10:40:50Z")
I am trying to make something akin to a sankey graph using showing the ASN paths. I'd like to be able to visualize the full path and each hop, pmacct is my netflow collector it sends the key "as\_path" in the format "6500… --- ## [I am getting message output data in logstash but i want to parse it to json](https://discuss.elastic.co/t/i-am-getting-message-output-data-in-logstash-but-i-want-to-parse-it-to-json/317469)
**Author:** [@ankurgupta](https://discuss.elastic.co/u/ankurgupta)\ **Replies:** 5\ **Last updated:** [October 26, 2022, 9:44am UTC](https://discuss.elastic.co/t/i-am-getting-message-output-data-in-logstash-but-i-want-to-parse-it-to-json/317469 "2022-10-26T09:44:54Z")
input{ exec { command =\> "netstat" interval =\> 30 } beats{ port =\>5044 } } filter{ grok{ match =\> {"message" =\> \[ #reqout grok: "%{DATESTAMP:time} (::slight\_smile: \[%{DATA:req}(:)\]\[(RQID:)%{DATA:rqId}\]\[(S… --- ## [Tcp output exception](https://discuss.elastic.co/t/tcp-output-exception/317227)
**Author:** [@Anusha\_Kusanghi](https://discuss.elastic.co/u/Anusha_Kusanghi)\ **Replies:** 5\ **Last updated:** [October 26, 2022, 9:44am UTC](https://discuss.elastic.co/t/tcp-output-exception/317227 "2022-10-26T09:44:14Z")
Hie Everyone, I have configured pipeline to read logs over tcp plugin. But im feeling tcp output exception every now and than the tcp connection is getting closed. Error logs: tcp output exception {:host=\>"10.109.0.0"… --- ## [Filter on nested object to return all fields under nested object with value zero](https://discuss.elastic.co/t/filter-on-nested-object-to-return-all-fields-under-nested-object-with-value-zero/317488)
**Author:** [@monaadelrabea](https://discuss.elastic.co/u/monaadelrabea)\ **Replies:** 0\ **Last updated:** [October 26, 2022, 9:07am UTC](https://discuss.elastic.co/t/filter-on-nested-object-to-return-all-fields-under-nested-object-with-value-zero/317488 "2022-10-26T09:07:01Z")
I need to filter on an index that have nested object called params, this object contains dynamic fields how to return only docs that contain fields with zero value under params nesetd object Ex: "params": { "ePwrV":\[ … --- ## [No new data in Kibana - elastic fails to create shard](https://discuss.elastic.co/t/no-new-data-in-kibana-elastic-fails-to-create-shard/316318)
**Author:** [@cjabrantes](https://discuss.elastic.co/u/cjabrantes)\ **Replies:** 1\ **Last updated:** [October 26, 2022, 9:33am UTC](https://discuss.elastic.co/t/no-new-data-in-kibana-elastic-fails-to-create-shard/316318 "2022-10-26T09:33:21Z")
Hi All, from time to time i see that kibana stops showing new data, its always the same, i have daily index (naming from LS) in ES that gets unassigned on both shard when its created, the logs i can find: obtaining sh… --- ## [Angular or React for external kibana plugin](https://discuss.elastic.co/t/angular-or-react-for-external-kibana-plugin/316986)
**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\ **Replies:** 5\ **Last updated:** [October 26, 2022, 9:17am UTC](https://discuss.elastic.co/t/angular-or-react-for-external-kibana-plugin/316986 "2022-10-26T09:17:51Z")
Hi, I am creating an external kibana plugin (which will be a bug project). Which is recommended for the same: Angular JS or React JS? Thanks --- ## [Divide query in separate new lines](https://discuss.elastic.co/t/divide-query-in-separate-new-lines/317389)
**Author:** [@oalimerko](https://discuss.elastic.co/u/oalimerko)\ **Replies:** 3\ **Last updated:** [October 26, 2022, 8:39am UTC](https://discuss.elastic.co/t/divide-query-in-separate-new-lines/317389 "2022-10-26T08:39:30Z")
Hello team, this is my new post here,i am looking forward share my experience and knowledge with community. I'm using elasticsearch and kibana for logs monitoring and also for this purpose i use the ES-Exporter for cat… --- ## [Word delimeter graph doesn't work with ICU tokenizer](https://discuss.elastic.co/t/word-delimeter-graph-doesnt-work-with-icu-tokenizer/317482)
**Author:** [@Mariusz\_Pala](https://discuss.elastic.co/u/Mariusz_Pala)\ **Replies:** 0\ **Last updated:** [October 26, 2022, 8:20am UTC](https://discuss.elastic.co/t/word-delimeter-graph-doesnt-work-with-icu-tokenizer/317482 "2022-10-26T08:20:39Z")
Hi, I want to be able to search word like "Wi-Fi" by wifi and it is possible with word delimeter graph with whitespace tokenizer. But I need the icu\_tokenizer and then it doesn't work at all, it indexes only "wi" and "f… --- ## [What should I do in case of a complete failure during the upgrade process?](https://discuss.elastic.co/t/what-should-i-do-in-case-of-a-complete-failure-during-the-upgrade-process/317326)
**Author:** [@Leonardo\_Henrique](https://discuss.elastic.co/u/Leonardo_Henrique)\ **Replies:** 1\ **Last updated:** [October 26, 2022, 7:56am UTC](https://discuss.elastic.co/t/what-should-i-do-in-case-of-a-complete-failure-during-the-upgrade-process/317326 "2022-10-26T07:56:56Z")
Hello, everyone. How have you been? I have a question related to the upgrade process. In docs (and viewing some posts here in the forum), it is said that the concept of rollback does not exist in Elasticsearch, but we h… --- ## [Binary logs parsing Logstash sent via filebeat?](https://discuss.elastic.co/t/binary-logs-parsing-logstash-sent-via-filebeat/317281)
**Author:** [@ShubhamKumarJena](https://discuss.elastic.co/u/ShubhamKumarJena)\ **Replies:** 1\ **Last updated:** [October 26, 2022, 7:47am UTC](https://discuss.elastic.co/t/binary-logs-parsing-logstash-sent-via-filebeat/317281 "2022-10-26T07:47:23Z")
Hello ! I am trying to parse few logs which are in binary format hence can somebody guide how do we proceed with that? I am attaching the message field for reference: "message" =\> "\\u0000\\u0000\\u0000\\u000384p�\<�\\u0000… --- ## [Phrase words matches anywhere in the multi fields and stemming also reduce the boosting on keyword stuffing](https://discuss.elastic.co/t/phrase-words-matches-anywhere-in-the-multi-fields-and-stemming-also-reduce-the-boosting-on-keyword-stuffing/317477)
**Author:** [@sagarc](https://discuss.elastic.co/u/sagarc)\ **Replies:** 0\ **Last updated:** [October 26, 2022, 7:25am UTC](https://discuss.elastic.co/t/phrase-words-matches-anywhere-in-the-multi-fields-and-stemming-also-reduce-the-boosting-on-keyword-stuffing/317477 "2022-10-26T07:25:02Z")
Data Types: Title: string Keywords: string Description: string Search Requirements: 1. ALL search terms MUST be found somewhere in the title or keywords or description a) Don’t search the whole DOCUMENT for terms… … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=750) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=752)