# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=772

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 773

---

## [How to disable inpect Action from visualisations context menu options](https://discuss.elastic.co/t/how-to-disable-inpect-action-from-visualisations-context-menu-options/313857)

<div class="topic-metadata">

**Author:** [@sanskar-panchal-gith](https://discuss.elastic.co/u/sanskar-panchal-gith)\
**Replies:** 4\
**Last updated:** [October 6, 2022, 7:49am UTC](https://discuss.elastic.co/t/how-to-disable-inpect-action-from-visualisations-context-menu-options/313857 "2022-10-06T07:49:41Z")

</div>

Hi , I have been working on a custom kibana plugin to render a dashboard. I am using dashboard.getDashboardContainerByValueRenderer(); to render the dashboard. I want to disable some actions from the context menu of t…

---

## [Is it possible to install multiple Fleet Servers?](https://discuss.elastic.co/t/is-it-possible-to-install-multiple-fleet-servers/315744)

<div class="topic-metadata">

**Author:** [@sirineb](https://discuss.elastic.co/u/sirineb)\
**Replies:** 4\
**Last updated:** [October 6, 2022, 7:15am UTC](https://discuss.elastic.co/t/is-it-possible-to-install-multiple-fleet-servers/315744 "2022-10-06T07:15:03Z")

</div>

Hi everyone, I was wondering, is it possible to install multiple Fleet Servers connected to the same ES ? I explain myself, I already have a Fleet Server installed but there might be a lot more Elastic agents than now …

---

## [Logstash health check failing for TG](https://discuss.elastic.co/t/logstash-health-check-failing-for-tg/315541)

<div class="topic-metadata">

**Author:** [@sandeepbisht](https://discuss.elastic.co/u/sandeepbisht)\
**Replies:** 1\
**Last updated:** [October 6, 2022, 7:04am UTC](https://discuss.elastic.co/t/logstash-health-check-failing-for-tg/315541 "2022-10-06T07:04:02Z")

</div>

Hi All, I had one logstash ec2 ubuntu machine, Due to frequent load issue i have added one more logstash machine and put both machines behind AWS ALB. Now both my instances are unhealthy under TG and i am not sure what…

---

## [Delete indices with 50 gb or older than](https://discuss.elastic.co/t/delete-indices-with-50-gb-or-older-than/315884)

<div class="topic-metadata">

**Author:** [@anon90868141](https://discuss.elastic.co/u/anon90868141)\
**Replies:** 7\
**Last updated:** [October 6, 2022, 6:14am UTC](https://discuss.elastic.co/t/delete-indices-with-50-gb-or-older-than/315884 "2022-10-06T06:14:34Z")

</div>

Hello, I'm currently trying to delete indices which are either greater than 50 GB or older than 31 days, but it seems like this is not possible with ILM. ILM uses, if anything defined in the hot stage, the days since r…

---

## [Order legend items](https://discuss.elastic.co/t/order-legend-items/314168)

<div class="topic-metadata">

**Author:** [@fabrizio1979](https://discuss.elastic.co/u/fabrizio1979)\
**Replies:** 2\
**Last updated:** [October 6, 2022, 5:57am UTC](https://discuss.elastic.co/t/order-legend-items/314168 "2022-10-06T05:57:51Z")

</div>

Hi there, How to order the legend items displayed on graphs? I used graphs. I would like legend items ordered as A1 A2 B1 B2 Thanks

---

## [Logstash service is not started in linux](https://discuss.elastic.co/t/logstash-service-is-not-started-in-linux/315802)

<div class="topic-metadata">

**Author:** [@Jathurshan\_Sumandira](https://discuss.elastic.co/u/Jathurshan_Sumandira)\
**Replies:** 3\
**Last updated:** [October 6, 2022, 5:11am UTC](https://discuss.elastic.co/t/logstash-service-is-not-started-in-linux/315802 "2022-10-06T05:11:49Z")

</div>

Hi, I am beginner to ELK stack and I am working on Linux server, I could try to start the logstash service but the service does not start and I could not see any logs in the command line(empty). Even though the permissio…

---

## [Get a mapping/schema of flattened field](https://discuss.elastic.co/t/get-a-mapping-schema-of-flattened-field/315919)

<div class="topic-metadata">

**Author:** [@getorca](https://discuss.elastic.co/u/getorca)\
**Replies:** 2\
**Last updated:** [October 6, 2022, 4:10am UTC](https://discuss.elastic.co/t/get-a-mapping-schema-of-flattened-field/315919 "2022-10-06T04:10:46Z")

</div>

Is there a way to get a mapping or schema of all the sub-fields that exist in my flattened field?

---

## [Constant\_scores w/ boost upon matching properties within nested](https://discuss.elastic.co/t/constant-scores-w-boost-upon-matching-properties-within-nested/315930)

<div class="topic-metadata">

**Author:** [@Paul\_Kim](https://discuss.elastic.co/u/Paul_Kim)\
**Replies:** 0\
**Last updated:** [October 6, 2022, 4:14am UTC](https://discuss.elastic.co/t/constant-scores-w-boost-upon-matching-properties-within-nested/315930 "2022-10-06T04:14:17Z")

</div>

I have below as my mapping for some\_index. { "some\_index": "properties": { "people": { "type": "nested", "properties": { "name": { "type": "keyword" …

---

## [Trouble with reindexing and ingest pipeline](https://discuss.elastic.co/t/trouble-with-reindexing-and-ingest-pipeline/315536)

<div class="topic-metadata">

**Author:** [@lubosvr](https://discuss.elastic.co/u/lubosvr)\
**Replies:** 3\
**Last updated:** [October 6, 2022, 3:07am UTC](https://discuss.elastic.co/t/trouble-with-reindexing-and-ingest-pipeline/315536 "2022-10-06T03:07:15Z")

</div>

I have problem with reindexing with ingest pipeline. Basically it seems to be working in most cases, but in some it is not and I have no clue how to debug or find a root cause. Here is my scenario: I have two indices …

---

## [Logstash fails to fetch Configuration](https://discuss.elastic.co/t/logstash-fails-to-fetch-configuration/315915)

<div class="topic-metadata">

**Author:** [@Chma](https://discuss.elastic.co/u/Chma)\
**Replies:** 6\
**Last updated:** [October 6, 2022, 1:32am UTC](https://discuss.elastic.co/t/logstash-fails-to-fetch-configuration/315915 "2022-10-06T01:32:40Z")

</div>

My logstash isn't starting. When I check the logs, I see these: Could not fetch all the sources {:exception=\>Errno::EACCES, :message=\>"Permission denied - /etc/logstash/conf.d/log.conf", :backtrace=\>\["org/jruby/RubyIO.j…

---

## ['create' vs. 'create\_doc' privilege for beats\_system](https://discuss.elastic.co/t/create-vs-create-doc-privilege-for-beats-system/315752)

<div class="topic-metadata">

**Author:** [@NominaSumpta](https://discuss.elastic.co/u/NominaSumpta)\
**Replies:** 1\
**Last updated:** [October 6, 2022, 1:16am UTC](https://discuss.elastic.co/t/create-vs-create-doc-privilege-for-beats-system/315752 "2022-10-06T01:16:12Z")

</div>

On my Elasticsearch 7.x cluster, the beats\_system role has the index privileges create\_index and create. According to Security privileges | Elasticsearch Guide \[7.17\] | Elastic, roles with the the index create privilege…

---

## [KeyCloak redirect\_uri gives 404 page not found error](https://discuss.elastic.co/t/keycloak-redirect-uri-gives-404-page-not-found-error/315892)

<div class="topic-metadata">

**Author:** [@ssimmons](https://discuss.elastic.co/u/ssimmons)\
**Replies:** 2\
**Last updated:** [October 6, 2022, 12:53am UTC](https://discuss.elastic.co/t/keycloak-redirect-uri-gives-404-page-not-found-error/315892 "2022-10-06T00:53:41Z")

</div>

I'm using Elasticsearch and Kibana 7.16.3. I've gotten SSL/TLS properly setup on my local install. I've gotten KeyCloak set up and working. I can bring up Kibana and login with Keycloak successfully. However, after login…

---

## [What does the host refer to when configuring APM integration?](https://discuss.elastic.co/t/what-does-the-host-refer-to-when-configuring-apm-integration/315922)

<div class="topic-metadata">

**Author:** [@pedroaugusto](https://discuss.elastic.co/u/pedroaugusto)\
**Replies:** 0\
**Last updated:** [October 6, 2022, 12:29am UTC](https://discuss.elastic.co/t/what-does-the-host-refer-to-when-configuring-apm-integration/315922 "2022-10-06T00:29:09Z")

</div>

Hello! I'm configuring the APM Integration and I have a question. In General -\> Server Configuration. What's the host? Is Kibana's host? Or Elastic's host? Or APM Server's host? Or the host of the application that A…

---

## ["match-boolean-query doesn't return the "exact match word" of the query](https://discuss.elastic.co/t/match-boolean-query-doesnt-return-the-exact-match-word-of-the-query/315918)

<div class="topic-metadata">

**Author:** [@paris1](https://discuss.elastic.co/u/paris1)\
**Replies:** 0\
**Last updated:** [October 5, 2022, 11:54pm UTC](https://discuss.elastic.co/t/match-boolean-query-doesnt-return-the-exact-match-word-of-the-query/315918 "2022-10-05T23:54:18Z")

</div>

I'm using "match-Boolean-prefix query but I can't get the exact match of the query.I can't use prefix queries because I also need "not exact match" results and I also need the fuzziness and word completion.I get every th…

---

## [Exclude multiple patterns in logstash s3 input](https://discuss.elastic.co/t/exclude-multiple-patterns-in-logstash-s3-input/315917)

<div class="topic-metadata">

**Author:** [@Elias\_Ojeda](https://discuss.elastic.co/u/Elias_Ojeda)\
**Replies:** 1\
**Last updated:** [October 5, 2022, 11:55pm UTC](https://discuss.elastic.co/t/exclude-multiple-patterns-in-logstash-s3-input/315917 "2022-10-05T23:55:59Z")

</div>

Logstash S3 input has an option to exclude a pattern. The example shows how to exclude a single pattern. For example: "exclude\_pattern" =\> "/2020/04/" Is it possible to exclude multiple patterns? For example, exclude…

---

## [Filter unique value fron url field](https://discuss.elastic.co/t/filter-unique-value-fron-url-field/314378)

<div class="topic-metadata">

**Author:** [@Vivek\_Nigam](https://discuss.elastic.co/u/Vivek_Nigam)\
**Replies:** 5\
**Last updated:** [October 5, 2022, 8:41pm UTC](https://discuss.elastic.co/t/filter-unique-value-fron-url-field/314378 "2022-10-05T20:41:49Z")

</div>

I want to filer all unique device id from url message , is it possible?? please help url: "/v1/default/hls-ts-fk/vodm/f452aa15-87ca-5013-856e-b0758db7c3d5/default\_ott.m3u8?PID=testing.30d&PAID=TITL0000000000391111&devic…

---

## [Kibana dashboard table view results in "Aborted"](https://discuss.elastic.co/t/kibana-dashboard-table-view-results-in-aborted/313065)

<div class="topic-metadata">

**Author:** [@matled](https://discuss.elastic.co/u/matled)\
**Replies:** 2\
**Last updated:** [October 5, 2022, 8:40pm UTC](https://discuss.elastic.co/t/kibana-dashboard-table-view-results-in-aborted/313065 "2022-10-05T20:40:37Z")

</div>

Currently we have a large Dashboard displaying multiple visualizations. However, since 8.4.0 we encounter on the following message on two table views in Kibana. I'm not sure if it is a problem with a timeout or response …

---

## [Unable to view winlogbeat log data](https://discuss.elastic.co/t/unable-to-view-winlogbeat-log-data/315910)

<div class="topic-metadata">

**Author:** [@tyc-4](https://discuss.elastic.co/u/tyc-4)\
**Replies:** 0\
**Last updated:** [October 5, 2022, 7:58pm UTC](https://discuss.elastic.co/t/unable-to-view-winlogbeat-log-data/315910 "2022-10-05T19:58:26Z")

</div>

I tried to send logs using winlogbeat to a self hosted ELK stack but I am unable to view any information other than the \_id and \_index. How do I fix this?

---

## [How can I edit output fleetserver configurations?](https://discuss.elastic.co/t/how-can-i-edit-output-fleetserver-configurations/315563)

<div class="topic-metadata">

**Author:** [@GustavoPires](https://discuss.elastic.co/u/GustavoPires)\
**Replies:** 2\
**Last updated:** [October 5, 2022, 7:26pm UTC](https://discuss.elastic.co/t/how-can-i-edit-output-fleetserver-configurations/315563 "2022-10-05T19:26:18Z")

</div>

Hello, I need to put my interface firewall at output fleetserver seetings, but it is not possible. How can I edit output? Another question, how can I generate CA trusted fingerprint?

---

## [Count of files in sincedb and file\_completed\_log\_path](https://discuss.elastic.co/t/count-of-files-in-sincedb-and-file-completed-log-path/315907)

<div class="topic-metadata">

**Author:** [@INS](https://discuss.elastic.co/u/INS)\
**Replies:** 3\
**Last updated:** [October 5, 2022, 7:07pm UTC](https://discuss.elastic.co/t/count-of-files-in-sincedb-and-file-completed-log-path/315907 "2022-10-05T19:07:09Z")

</div>

Hi Can You explain why I have a so much difference in count of particular daily file in sincedb and file\_complete\_log\_path. It seems that sincedb does not reflect the actual number of reprocessed files, hence there are n…

---

## [Null terminated message string](https://discuss.elastic.co/t/null-terminated-message-string/315905)

<div class="topic-metadata">

**Author:** [@LisaJ](https://discuss.elastic.co/u/LisaJ)\
**Replies:** 2\
**Last updated:** [October 5, 2022, 6:59pm UTC](https://discuss.elastic.co/t/null-terminated-message-string/315905 "2022-10-05T18:59:57Z")

</div>

I have a syslog message that contains a null terminated string: "syslog\_message":"A10\\u0000" -- these messages represent is-alive checks from a load balancer to the logstash servers. I would prefer not to have thousands …

---

## [Host File or Wildcards for Heartbeat](https://discuss.elastic.co/t/host-file-or-wildcards-for-heartbeat/315906)

<div class="topic-metadata">

**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\
**Replies:** 1\
**Last updated:** [October 5, 2022, 6:48pm UTC](https://discuss.elastic.co/t/host-file-or-wildcards-for-heartbeat/315906 "2022-10-05T18:48:46Z")

</div>

I'm trying to set up Heartbeat and looking for an efficient way to manage the host list for the icmp monitor. Is there an option to either reference a host file or to somehow use wildcards for the hosts list? I've looked…

---

## [Multi language support for kibana dashboards](https://discuss.elastic.co/t/multi-language-support-for-kibana-dashboards/315473)

<div class="topic-metadata">

**Author:** [@Srikanth\_V](https://discuss.elastic.co/u/Srikanth_V)\
**Replies:** 1\
**Last updated:** [October 5, 2022, 5:51pm UTC](https://discuss.elastic.co/t/multi-language-support-for-kibana-dashboards/315473 "2022-10-05T17:51:54Z")

</div>

Hey guys, Hope you are doing well. Is there a possibility to have multi language support in 1 instance of kibana? If yes, how can the language be changed from say en to fr. I have 2 different dashboards 1 for english …

---

## [Exclude fields from add filter dropdown](https://discuss.elastic.co/t/exclude-fields-from-add-filter-dropdown/315764)

<div class="topic-metadata">

**Author:** [@Jonas\_S](https://discuss.elastic.co/u/Jonas_S)\
**Replies:** 1\
**Last updated:** [October 5, 2022, 5:39pm UTC](https://discuss.elastic.co/t/exclude-fields-from-add-filter-dropdown/315764 "2022-10-05T17:39:17Z")

</div>

Hello, i have an already existing Dashboard with personal information for a small user group. Now a new user group also needs some of that information, but should only see their part. The data comes from a logstash pipe…

---

## [Vert High Latencies For GeoDistance query for 10k documents](https://discuss.elastic.co/t/vert-high-latencies-for-geodistance-query-for-10k-documents/315631)

<div class="topic-metadata">

**Author:** [@Parth\_Narang](https://discuss.elastic.co/u/Parth_Narang)\
**Replies:** 10\
**Last updated:** [October 5, 2022, 5:32pm UTC](https://discuss.elastic.co/t/vert-high-latencies-for-geodistance-query-for-10k-documents/315631 "2022-10-05T17:32:08Z")

</div>

I have a requirement to fetch 10k documents around a lat long in 10km radius while below query works fine but take around 350 ms to fetch all the documents. is there any other way to improve on this was expecting latenci…

---

## [Redirect users to dashboard directly upon login](https://discuss.elastic.co/t/redirect-users-to-dashboard-directly-upon-login/315886)

<div class="topic-metadata">

**Author:** [@mancharagopan](https://discuss.elastic.co/u/mancharagopan)\
**Replies:** 1\
**Last updated:** [October 5, 2022, 5:31pm UTC](https://discuss.elastic.co/t/redirect-users-to-dashboard-directly-upon-login/315886 "2022-10-05T17:31:58Z")

</div>

I have few dashboards to monitor performance and utilization of the network devices. I would like to redirect users to a dashboard directly when they login instead of landing on a home page. Is there any way to achieve t…

---

## [ES 7.11 How to debug search\_failures for rollup jobs](https://discuss.elastic.co/t/es-7-11-how-to-debug-search-failures-for-rollup-jobs/314896)

<div class="topic-metadata">

**Author:** [@ld\_pvl](https://discuss.elastic.co/u/ld_pvl)\
**Replies:** 1\
**Last updated:** [October 5, 2022, 4:05pm UTC](https://discuss.elastic.co/t/es-7-11-how-to-debug-search-failures-for-rollup-jobs/314896 "2022-10-05T16:05:23Z")

</div>

My new rollup job is showing search\_failures and not indexing anything. Where can I go to see the details as to why the search failures are occuring? I looked at the rollup job details and the capabilities but there are…

---

## [Mapping: how to disable array of string?](https://discuss.elastic.co/t/mapping-how-to-disable-array-of-string/315782)

<div class="topic-metadata">

**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\
**Replies:** 10\
**Last updated:** [October 5, 2022, 3:42pm UTC](https://discuss.elastic.co/t/mapping-how-to-disable-array-of-string/315782 "2022-10-05T15:42:56Z")

</div>

We want to apply a real strict mapping , but arrays are still accepted and mess around our data pipeline (because after we use Apache Spark to read data). We (at our team level) have no control on the incoming data. Ho…

---

## [Problem using SERVER\_PUBLICBASEURL with docker-compose](https://discuss.elastic.co/t/problem-using-server-publicbaseurl-with-docker-compose/315874)

<div class="topic-metadata">

**Author:** [@mammodde](https://discuss.elastic.co/u/mammodde)\
**Replies:** 12\
**Last updated:** [October 5, 2022, 3:38pm UTC](https://discuss.elastic.co/t/problem-using-server-publicbaseurl-with-docker-compose/315874 "2022-10-05T15:38:32Z")

</div>

Hi, I am currently trying to set the field SERVER\_PUBLICSBASEURL on my docker-compose.yml, but it seems that nothing is changing. I can only access to kibana through the ip but not through the hostname I wrote. the doc…

---

## [Drop irrelevant filebeat docker metadata not working](https://discuss.elastic.co/t/drop-irrelevant-filebeat-docker-metadata-not-working/315887)

<div class="topic-metadata">

**Author:** [@Chma](https://discuss.elastic.co/u/Chma)\
**Replies:** 0\
**Last updated:** [October 5, 2022, 2:23pm UTC](https://discuss.elastic.co/t/drop-irrelevant-filebeat-docker-metadata-not-working/315887 "2022-10-05T14:23:23Z")

</div>

I am using filebeat to ship container logs to ELK. I have way too many metadata that I don't need. container.id, container.name, conatiner.labels, container.image and so on. The only one I need her is container.name, so…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=771)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=773)
