# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=801 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 802 --- ## [Map / grant roles defined in keycloak to elasticsearch](https://discuss.elastic.co/t/map-grant-roles-defined-in-keycloak-to-elasticsearch/313528)
**Author:** [@Giorgi\_Jambazishvili](https://discuss.elastic.co/u/Giorgi_Jambazishvili)\ **Replies:** 5\ **Last updated:** [September 8, 2022, 12:06pm UTC](https://discuss.elastic.co/t/map-grant-roles-defined-in-keycloak-to-elasticsearch/313528 "2022-09-08T12:06:07Z")
Hello, We've setup the Keycloak Single Sing On (OIDC) integration with Elasticsearch cloud deployment and users are able sign in to the kibana using Keycloak as an authenticator. The problem is that once user is authen… --- ## [Expose part of a ELK document to another index/user](https://discuss.elastic.co/t/expose-part-of-a-elk-document-to-another-index-user/313028)
**Author:** [@Sylvain35](https://discuss.elastic.co/u/Sylvain35)\ **Replies:** 6\ **Last updated:** [September 8, 2022, 12:05pm UTC](https://discuss.elastic.co/t/expose-part-of-a-elk-document-to-another-index-user/313028 "2022-09-08T12:05:22Z")
Hello everyone ! I have a streaming process that feeds an ELK index (one new index each day) The object send is a JSON with multiple level and fields. I have a complex mapping on this Index. I want to expose a limited… --- ## [Kibana, canvas, Image reveal problem after upgrade to 8.4.1 from 8.3.1](https://discuss.elastic.co/t/kibana-canvas-image-reveal-problem-after-upgrade-to-8-4-1-from-8-3-1/313986)
**Author:** [@Ibrahim\_Z\_HIDIR](https://discuss.elastic.co/u/Ibrahim_Z_HIDIR)\ **Replies:** 0\ **Last updated:** [September 8, 2022, 11:15am UTC](https://discuss.elastic.co/t/kibana-canvas-image-reveal-problem-after-upgrade-to-8-4-1-from-8-3-1/313986 "2022-09-08T11:15:30Z")
Hi I've just upgraded elastic clsuter from 8.3.1 to 8.4.1 and also kibana. After upgrade kibana all the Image reveal images turned exclamation mark, and when I've click on an image I'am getting error "Expression failed … --- ## [Script query started to fail suddenly](https://discuss.elastic.co/t/script-query-started-to-fail-suddenly/313985)
**Author:** [@Richa\_B](https://discuss.elastic.co/u/Richa_B)\ **Replies:** 0\ **Last updated:** [September 8, 2022, 11:06am UTC](https://discuss.elastic.co/t/script-query-started-to-fail-suddenly/313985 "2022-09-08T11:06:31Z")
We have had this query for a long time { "size": 50, "query": { "match\_all": {} }, "version": false, "seq\_no\_primary\_term": false, "sort": \[ { "\_script": { "script": { "sour… --- ## [Cluster elasticsearch port](https://discuss.elastic.co/t/cluster-elasticsearch-port/313866)
**Author:** [@diegz](https://discuss.elastic.co/u/diegz)\ **Replies:** 6\ **Last updated:** [September 8, 2022, 11:00am UTC](https://discuss.elastic.co/t/cluster-elasticsearch-port/313866 "2022-09-08T11:00:57Z")
Hello, I want to set up a 3-node elasticsearch cluster in production. 2 nodes master & data and one voting-only or data. I would like to know if I can assign a single port per node and not a range. For example : node… --- ## [Unable to split the logs using child pipeline](https://discuss.elastic.co/t/unable-to-split-the-logs-using-child-pipeline/313944)
**Author:** [@Abinayaganesan](https://discuss.elastic.co/u/Abinayaganesan)\ **Replies:** 0\ **Last updated:** [September 8, 2022, 5:31am UTC](https://discuss.elastic.co/t/unable-to-split-the-logs-using-child-pipeline/313944 "2022-09-08T05:31:23Z")
Hi I can get all application logs in kibana dashboard. But I want to split the logs using log.file.path and send that respective logs to child pipeline that's why I tried conditions like if (\[log\]\[file\]\[path\] == \["/var… --- ## [How load balancing work between logstash and elasticsearch](https://discuss.elastic.co/t/how-load-balancing-work-between-logstash-and-elasticsearch/313821)
**Author:** [@Khaled\_Saidi](https://discuss.elastic.co/u/Khaled_Saidi)\ **Replies:** 8\ **Last updated:** [September 8, 2022, 10:51am UTC](https://discuss.elastic.co/t/how-load-balancing-work-between-logstash-and-elasticsearch/313821 "2022-09-08T10:51:14Z")
Hi everyone, I have a question about logstash and how it load balances to an elasticsearch servers cluster. The warning "high disk watermark \[90%\] exceeded" is displayed in the logstash log file, and documents are no l… --- ## [ElasticSearch IIS time-taken Field is Missing](https://discuss.elastic.co/t/elasticsearch-iis-time-taken-field-is-missing/313118)
**Author:** [@eagles40cnuh](https://discuss.elastic.co/u/eagles40cnuh)\ **Replies:** 2\ **Last updated:** [September 8, 2022, 10:50am UTC](https://discuss.elastic.co/t/elasticsearch-iis-time-taken-field-is-missing/313118 "2022-09-08T10:50:58Z")
My ELK Version 8.3 (Elasticsearch, Kibana, ElasticAgent, Beats....) ElasticAgent installed my Server Host (Complete) ALL IIS LogField Enabled Data collection was successful But.... Just 1 Field(Time-Taken) do… --- ## [About Voting Only Nodes](https://discuss.elastic.co/t/about-voting-only-nodes/313948)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 9\ **Last updated:** [September 8, 2022, 10:47am UTC](https://discuss.elastic.co/t/about-voting-only-nodes/313948 "2022-09-08T10:47:44Z")
Hi, With voting configurations is it recommended that, when needed, a minimum of nodes are voting-only? Or is it legitimate to make all nodes voting-only? I ask because we have clusters whose topologies vary. For examp… --- ## [LDAP ELK CLuster](https://discuss.elastic.co/t/ldap-elk-cluster/313979)
**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\ **Replies:** 2\ **Last updated:** [September 8, 2022, 10:26am UTC](https://discuss.elastic.co/t/ldap-elk-cluster/313979 "2022-09-08T10:26:32Z")
Hello! My team wants to connect our elastic to the corporate LDAP, we know how to configure it but we don't know on which nodes we have to configure it. Is this configuration only necessary on master nodes or should it… --- ## [Authentication of \[elastic\] was terminated by realm \[reserved\] - failed to authenticate user \[elastic\]](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/313838)
**Author:** [@hiruni.insyncit.net](https://discuss.elastic.co/u/hiruni.insyncit.net)\ **Replies:** 10\ **Last updated:** [September 8, 2022, 10:15am UTC](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/313838 "2022-09-08T10:15:28Z")
I have elastic cluster, one node removed(automatically) from the cluster and log shows "Authentication of \[elastic\] was terminated by realm \[reserved\] - failed to authenticate user \[elastic\]" elastic version 8.1 --- ## [Misconfiguration of filebeat on debian](https://discuss.elastic.co/t/misconfiguration-of-filebeat-on-debian/313864)
**Author:** [@mammodde](https://discuss.elastic.co/u/mammodde)\ **Replies:** 1\ **Last updated:** [September 8, 2022, 9:59am UTC](https://discuss.elastic.co/t/misconfiguration-of-filebeat-on-debian/313864 "2022-09-08T09:59:59Z")
Good morning, I am trying to install filebeat on debian with the deb file. The problem is that i have misconfigured it, so i tried to uninstall it. After the second installation i encountered a problem: it does not down… --- ## [How to use cardinality add more fields](https://discuss.elastic.co/t/how-to-use-cardinality-add-more-fields/313967)
**Author:** [@githup-DK](https://discuss.elastic.co/u/githup-DK)\ **Replies:** 0\ **Last updated:** [September 8, 2022, 8:50am UTC](https://discuss.elastic.co/t/how-to-use-cardinality-add-more-fields/313967 "2022-09-08T08:50:45Z")
Hi bro I can't upgrade my instance. my instance is 7.9.3. I want to use three field to search .I create a table with three cardinality \`fields\` ,but there is no effective,the data looks like repeated GET /testPrefor… --- ## [Elasticsearch index.blocks.read : true doesn't work with index pattern](https://discuss.elastic.co/t/elasticsearch-index-blocks-read-true-doesnt-work-with-index-pattern/313963)
**Author:** [@Ingram\_Gultom](https://discuss.elastic.co/u/Ingram_Gultom)\ **Replies:** 1\ **Last updated:** [September 8, 2022, 9:26am UTC](https://discuss.elastic.co/t/elasticsearch-index-blocks-read-true-doesnt-work-with-index-pattern/313963 "2022-09-08T09:26:59Z")
Hi all, I want to block read on some indices, using index.blocks.read : true, but it doesn't work if you try to read the indices with index pattern like index\_name\_\*. It will return error GET filebeat\*/\_search { "e… --- ## [Is it expected to have different versions in the \`\*\_LuceneXX\_X.\*\` filenames?](https://discuss.elastic.co/t/is-it-expected-to-have-different-versions-in-the-lucenexx-x-filenames/313898)
**Author:** [@vkatsikaros](https://discuss.elastic.co/u/vkatsikaros)\ **Replies:** 2\ **Last updated:** [September 8, 2022, 9:26am UTC](https://discuss.elastic.co/t/is-it-expected-to-have-different-versions-in-the-lucenexx-x-filenames/313898 "2022-09-08T09:26:29Z")
Hi This is mostly out of curiosity and not as a question tied to a specific problem. I was looking at the actual directories and files of some ES indices, I noticed a bunch of lucene files, but what got my attention is… --- ## [Filebeat send ' \\u0000 ' and the event loss and the new line append to the last line](https://discuss.elastic.co/t/filebeat-send-u0000-and-the-event-loss-and-the-new-line-append-to-the-last-line/313972)
**Author:** [@codeyoungth](https://discuss.elastic.co/u/codeyoungth)\ **Replies:** 0\ **Last updated:** [September 8, 2022, 9:03am UTC](https://discuss.elastic.co/t/filebeat-send-u0000-and-the-event-loss-and-the-new-line-append-to-the-last-line/313972 "2022-09-08T09:03:27Z")
my config is as follow: filebeat.inputs: - type: filestream enabled: true id: filebeat-input-log paths: - /app/log/\*/\*.log parsers: - multili… --- ## [How to remove duplicates on 7.9.3Version](https://discuss.elastic.co/t/how-to-remove-duplicates-on-7-9-3version/313964)
**Author:** [@githup-DK](https://discuss.elastic.co/u/githup-DK)\ **Replies:** 0\ **Last updated:** [September 8, 2022, 8:31am UTC](https://discuss.elastic.co/t/how-to-remove-duplicates-on-7-9-3version/313964 "2022-09-08T08:31:54Z")
I want to use multi-field to remove duplicates datas,I gave it a try , but it didn't work . \* I want to know how to use it on 7.9.3Version. please help me . GET /test\_2022\_9/\_search { "query": { "bool": { "f… --- ## [Function beat erroring out with license error when shipping log](https://discuss.elastic.co/t/function-beat-erroring-out-with-license-error-when-shipping-log/313959)
**Author:** [@IbrahimHectare](https://discuss.elastic.co/u/IbrahimHectare)\ **Replies:** 0\ **Last updated:** [September 8, 2022, 8:04am UTC](https://discuss.elastic.co/t/function-beat-erroring-out-with-license-error-when-shipping-log/313959 "2022-09-08T08:04:20Z")
I have set up function beat on AWS, to ship my cloudwatch logs. When the functionbeat is invoked to send the logs, it errors out due to an enterprise license being returned. licenser/elastic\_fetcher.go:136 Invalid resp… --- ## [Stop Token Filter Language Customization Not Working in Java](https://discuss.elastic.co/t/stop-token-filter-language-customization-not-working-in-java/313949)
**Author:** [@green12](https://discuss.elastic.co/u/green12)\ **Replies:** 0\ **Last updated:** [September 8, 2022, 6:34am UTC](https://discuss.elastic.co/t/stop-token-filter-language-customization-not-working-in-java/313949 "2022-09-08T06:34:05Z")
Hi everyone, I'm trying to create a customized Indonesian language stop token filter using the Java package. The following json is how the configuration looks like when using curl (which works just fine): "filter": { … --- ## [Vega tree error key is null](https://discuss.elastic.co/t/vega-tree-error-key-is-null/313946)
**Author:** [@Alice\_Ionescu](https://discuss.elastic.co/u/Alice_Ionescu)\ **Replies:** 0\ **Last updated:** [September 8, 2022, 6:15am UTC](https://discuss.elastic.co/t/vega-tree-error-key-is-null/313946 "2022-09-08T06:15:42Z")
Hello, I am trying to create a vega tree visualization. I am not sure how to complete the starting node. I've tried to put null, -, but nothing works. If the parent of the last node is null I am getting error \_.\_source… --- ## [How do I update data across indexes](https://discuss.elastic.co/t/how-do-i-update-data-across-indexes/313945)
**Author:** [@chihao9332](https://discuss.elastic.co/u/chihao9332)\ **Replies:** 0\ **Last updated:** [September 8, 2022, 6:11am UTC](https://discuss.elastic.co/t/how-do-i-update-data-across-indexes/313945 "2022-09-08T06:11:11Z")
问题描述：索引B中新增加了两个字段，现需要从索引A中获取这两个字段的值并赋值给B 详细情况： 1.索引A中部分字段：pro\_id, tran\_id, app\_id, type ....... 2.索引B中部分字段：app\_id, type ....... 3. 现 索引B中新增 pro\_id和tran\_id字段，要求将存量数据与索引A中数据同步 4. 即：当 满足 A.app\_id=B.app\_id 和 A.type=B.ty… --- ## [What is the best way to change the dims for a dense\_vector in an index?](https://discuss.elastic.co/t/what-is-the-best-way-to-change-the-dims-for-a-dense-vector-in-an-index/313920)
**Author:** [@reisner](https://discuss.elastic.co/u/reisner)\ **Replies:** 1\ **Last updated:** [September 8, 2022, 4:01am UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-change-the-dims-for-a-dense-vector-in-an-index/313920 "2022-09-08T04:01:18Z")
I have an index with a dense\_vector field with 256 dimensions. I want to change to a new embedding model that uses a different number of dimensions. I dont mind losing the data in the old field. What's the best way to ke… --- ## [SSL certificate verify failed when connecting using Route53 CNAME records](https://discuss.elastic.co/t/ssl-certificate-verify-failed-when-connecting-using-route53-cname-records/313648)
**Author:** [@r-uehara0219](https://discuss.elastic.co/u/r-uehara0219)\ **Replies:** 2\ **Last updated:** [September 8, 2022, 3:12am UTC](https://discuss.elastic.co/t/ssl-certificate-verify-failed-when-connecting-using-route53-cname-records/313648 "2022-09-08T03:12:18Z")
using version Elasticsearch 7.16.1 curl 7.74.0 detail I configured traffic filters using AWS PrivateLink. (Configured with reference to the official documentation.) I have created 2 VPC endpoints, and 2 CNAME records … --- ## [Kibana Ingest pipeline Convert String to Date?](https://discuss.elastic.co/t/kibana-ingest-pipeline-convert-string-to-date/313836)
**Author:** [@eagles40cnuh](https://discuss.elastic.co/u/eagles40cnuh)\ **Replies:** 5\ **Last updated:** [September 8, 2022, 2:19am UTC](https://discuss.elastic.co/t/kibana-ingest-pipeline-convert-string-to-date/313836 "2022-09-08T02:19:44Z")
Installed elastic-agent on the server and Collect Custom Log Data I was Create a pipeline in Kibana (Stack Management -\> Ingest pipelines) And "Message" Field -\> Split Data (Success) How can I Convert String F… --- ## [Reset Elasticsearch Internal User Password](https://discuss.elastic.co/t/reset-elasticsearch-internal-user-password/313837)
**Author:** [@hjsroldan](https://discuss.elastic.co/u/hjsroldan)\ **Replies:** 8\ **Last updated:** [September 8, 2022, 1:31am UTC](https://discuss.elastic.co/t/reset-elasticsearch-internal-user-password/313837 "2022-09-08T01:31:49Z")
Hi, Does anyone know how to reset or change Elasticsearch internal user password? --- ## [Elasticsearch Super Slow and using low CPU](https://discuss.elastic.co/t/elasticsearch-super-slow-and-using-low-cpu/313922)
**Author:** [@abr4xc](https://discuss.elastic.co/u/abr4xc)\ **Replies:** 5\ **Last updated:** [September 8, 2022, 1:23am UTC](https://discuss.elastic.co/t/elasticsearch-super-slow-and-using-low-cpu/313922 "2022-09-08T01:23:48Z")
After gone offline for a day the elastic cluster started to be too slow, check of possible misconfigurations and could not fine anything to make it faster, the cluster is on green and there is not unassing shards, howeve… --- ## [How to list users that uses Elasticsearch/Kibana?](https://discuss.elastic.co/t/how-to-list-users-that-uses-elasticsearch-kibana/313934)
**Author:** [@Ggarcia](https://discuss.elastic.co/u/Ggarcia)\ **Replies:** 1\ **Last updated:** [September 8, 2022, 1:03am UTC](https://discuss.elastic.co/t/how-to-list-users-that-uses-elasticsearch-kibana/313934 "2022-09-08T01:03:53Z")
All, I am working in a project to try replace Splunk by ELK. I would like to list the users that logged in Elasticsearch/Kibana per day. Is there any internal index to audit users? Thank you in advanced, Gerson Garci… --- ## [Create custom heartbeat index](https://discuss.elastic.co/t/create-custom-heartbeat-index/313793)
**Author:** [@franckfct](https://discuss.elastic.co/u/franckfct)\ **Replies:** 1\ **Last updated:** [September 8, 2022, 12:58am UTC](https://discuss.elastic.co/t/create-custom-heartbeat-index/313793 "2022-09-08T00:58:34Z")
Hi, I'm trying during several days to make custom index in 'heartbeat'. The goal is to redirect output for diferrents clients. Here my main config in /etc/heartbeat/heartbeat.yml fields\_under\_root: true setup.ilm.ena… --- ## [Does Elastic Agent supports Kafka as an Input?](https://discuss.elastic.co/t/does-elastic-agent-supports-kafka-as-an-input/312290)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 1\ **Last updated:** [September 7, 2022, 10:15pm UTC](https://discuss.elastic.co/t/does-elastic-agent-supports-kafka-as-an-input/312290 "2022-09-07T22:15:45Z")
Hello, We are thinking in migrate some of our ingestion from Logstash to the integrations of Elastic Agent, but while researching the documentation of the Elastic Agent we were not able to find anything about using Kafk… --- ## [JSON parse error, Could not set field 'ip' on object '\.\.com' to value '10.XXX.XX.XX'.This is probably due to trying to set a field like \[foo\]\[bar\] = someValuewhen \[foo\] is not either a map or a string"](https://discuss.elastic.co/t/json-parse-error-could-not-set-field-ip-on-object-hostname-domain-com-to-value-10-xxx-xx-xx-this-is-probably-due-to-trying-to-set-a-field-like-foo-bar-somevaluewhen-foo-is-not-either-a-map-or-a-string/313928)
**Author:** [@Enzo\_baker](https://discuss.elastic.co/u/Enzo_baker)\ **Replies:** 0\ **Last updated:** [September 7, 2022, 9:41pm UTC](https://discuss.elastic.co/t/json-parse-error-could-not-set-field-ip-on-object-hostname-domain-com-to-value-10-xxx-xx-xx-this-is-probably-due-to-trying-to-set-a-field-like-foo-bar-somevaluewhen-foo-is-not-either-a-map-or-a-string/313928 "2022-09-07T21:41:51Z")
Hi, Error message - JSON parse error, Could not set field 'ip' on object '\.\.com' to value '10.XXX.XX.XX'.This is probably due to trying to set a field like \[foo\]\[bar\] = someValuewhen \[foo\] is not eit… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=800) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=802)