# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=820 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 821 --- ## [Kibana tables are showing very few rows(150) though there are around 4000 rows in the result](https://discuss.elastic.co/t/kibana-tables-are-showing-very-few-rows-150-though-there-are-around-4000-rows-in-the-result/312658)
**Author:** [@Vishwanatha.K](https://discuss.elastic.co/u/Vishwanatha.K)\ **Replies:** 5\ **Last updated:** [August 24, 2022, 9:28am UTC](https://discuss.elastic.co/t/kibana-tables-are-showing-very-few-rows-150-though-there-are-around-4000-rows-in-the-result/312658 "2022-08-24T09:28:00Z")
Hi, Kibana tables are showing very few rows(150) though there are around 4000 rows in the result. Is there anyway I can set the max rows to be displayed in tables data ? I tried to set the Stackmanagement-\>Advance sett… --- ## [Logstash does not parse if 'if' condition change](https://discuss.elastic.co/t/logstash-does-not-parse-if-if-condition-change/312700)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 5\ **Last updated:** [August 24, 2022, 8:59am UTC](https://discuss.elastic.co/t/logstash-does-not-parse-if-if-condition-change/312700 "2022-08-24T08:59:55Z")
Using single node ELK cluster version 7.16.3. Index won't appear in kibana if i used this configuration in logstash pipeline file output { if \[tags\] == "average\_weight" { elasticsearch { hosts =\> \["http://localhos… --- ## [HAProxy conf for Logstash](https://discuss.elastic.co/t/haproxy-conf-for-logstash/312773)
**Author:** [@magnorod](https://discuss.elastic.co/u/magnorod)\ **Replies:** 0\ **Last updated:** [August 24, 2022, 7:41am UTC](https://discuss.elastic.co/t/haproxy-conf-for-logstash/312773 "2022-08-24T07:41:35Z")
Hello, I'm contacting you because I can't get the load balancing of Logstash via HAproxy to work properly. I always have 2 Logstash out of the 4 that share the flow. I would like the flow to be fairly distributed betwe… --- ## [Set registry and log files, owner and group](https://discuss.elastic.co/t/set-registry-and-log-files-owner-and-group/312769)
**Author:** [@nahiko](https://discuss.elastic.co/u/nahiko)\ **Replies:** 0\ **Last updated:** [August 24, 2022, 7:08am UTC](https://discuss.elastic.co/t/set-registry-and-log-files-owner-and-group/312769 "2022-08-24T07:08:10Z")
Hi! I am using filebeat 7.17 I start Filebeat using a domain user (with systemd) The log files and registry file that Filebeat writes while it is working, are owned by the same user that starts Filebeat what is correc… --- ## [How to fetch the data from elasticsearch in query](https://discuss.elastic.co/t/how-to-fetch-the-data-from-elasticsearch-in-query/312756)
**Author:** [@Rain\_Water](https://discuss.elastic.co/u/Rain_Water)\ **Replies:** 3\ **Last updated:** [August 24, 2022, 6:46am UTC](https://discuss.elastic.co/t/how-to-fetch-the-data-from-elasticsearch-in-query/312756 "2022-08-24T06:46:10Z")
Hi, i want to create a query to fetch the data from elasticsearch in csv can any one help me with the query. thanks. --- ## [Multiple action, each with a condition in Watcher](https://discuss.elastic.co/t/multiple-action-each-with-a-condition-in-watcher/312766)
**Author:** [@Seemant\_Bind](https://discuss.elastic.co/u/Seemant_Bind)\ **Replies:** 0\ **Last updated:** [August 24, 2022, 6:37am UTC](https://discuss.elastic.co/t/multiple-action-each-with-a-condition-in-watcher/312766 "2022-08-24T06:37:10Z")
Hi, I am trying to get multiple action output each with different condition in watcher. For that I have tried to use this example(elasticsearch - how to send email alert to groups based on condition success in kibana wa… --- ## [500 - Internal Server : ErrorRepository\_verification\_exception, nested: RepositoryVerificationException\[\[backup\] a file written by master to the store \[C:\\\\Updates\\\\Backups\\\\ElasticSearch\] cannot be accessed on the node](https://discuss.elastic.co/t/500-internal-server-errorrepository-verification-exception-nested-repositoryverificationexception-backup-a-file-written-by-master-to-the-store-c-updates-backups-elasticsearch-cannot-be-accessed-on-the-node/311106)
**Author:** [@mujtabah](https://discuss.elastic.co/u/mujtabah)\ **Replies:** 9\ **Last updated:** [August 24, 2022, 6:07am UTC](https://discuss.elastic.co/t/500-internal-server-errorrepository-verification-exception-nested-repositoryverificationexception-backup-a-file-written-by-master-to-the-store-c-updates-backups-elasticsearch-cannot-be-accessed-on-the-node/311106 "2022-08-24T06:07:40Z")
I have a cluster of 5 nodes(3master,2 data), i have created directory in each node and included its path as path.repo in all of its yml's. then when i take snapshot its giving this error. command i used PUT \_snapshot/b… --- ## [Merge two Json arrays in logstash+ruby](https://discuss.elastic.co/t/merge-two-json-arrays-in-logstash-ruby/312759)
**Author:** [@deep08](https://discuss.elastic.co/u/deep08)\ **Replies:** 0\ **Last updated:** [August 24, 2022, 5:54am UTC](https://discuss.elastic.co/t/merge-two-json-arrays-in-logstash-ruby/312759 "2022-08-24T05:54:56Z")
Hello , I want to merge two json array based on one id matching fields and create an new array in logstash , I have two Json array data1,data2 below - "data1 "{ "tenant":"0", "city":"FLORENCE", "id":"AXY798", "stat… --- ## [Monitoring an Elasticsearch Cluster with a Single Metricbeat Instance](https://discuss.elastic.co/t/monitoring-an-elasticsearch-cluster-with-a-single-metricbeat-instance/311399)
**Author:** [@bunste](https://discuss.elastic.co/u/bunste)\ **Replies:** 1\ **Last updated:** [August 24, 2022, 5:47am UTC](https://discuss.elastic.co/t/monitoring-an-elasticsearch-cluster-with-a-single-metricbeat-instance/311399 "2022-08-24T05:47:11Z")
We are currently on version 7.17.5 with the full ELK stack and are working on getting ready to jump to 8.x with the help of Upgrade Assistant. One of the cluster issues is: Setting \[xpack.monitoring.collection.enabled… --- ## [Connect to elasticsearch cluster](https://discuss.elastic.co/t/connect-to-elasticsearch-cluster/312684)
**Author:** [@skyle52](https://discuss.elastic.co/u/skyle52)\ **Replies:** 2\ **Last updated:** [August 24, 2022, 3:33am UTC](https://discuss.elastic.co/t/connect-to-elasticsearch-cluster/312684 "2022-08-24T03:33:07Z")
Hello all, I have a question about elasticsearch cluster, please advise: I setup 3 nodes elasticsearch cluster with each node have all the default roles. But I don't know how my filebeat or logstash can push log to ela… --- ## [The reporting job failed + Error: Max attempts (3) reached for job X. Failed with: Error: Unable to get index-pattern](https://discuss.elastic.co/t/the-reporting-job-failed-error-max-attempts-3-reached-for-job-x-failed-with-error-unable-to-get-index-pattern/310588)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 7\ **Last updated:** [August 24, 2022, 3:21am UTC](https://discuss.elastic.co/t/the-reporting-job-failed-error-max-attempts-3-reached-for-job-x-failed-with-error-unable-to-get-index-pattern/310588 "2022-08-24T03:21:50Z")
Hello World! I'm trying to: yet while trying to run report (using "added\*" index-pattern), getting the following error: The reporting job failed Error: Max attempts (3) reached for job X. Failed with: Error: Unabl… --- ## [Native azure integration with Azure AD SSO failures](https://discuss.elastic.co/t/native-azure-integration-with-azure-ad-sso-failures/312660)
**Author:** [@samjpv](https://discuss.elastic.co/u/samjpv)\ **Replies:** 3\ **Last updated:** [August 23, 2022, 11:44pm UTC](https://discuss.elastic.co/t/native-azure-integration-with-azure-ad-sso-failures/312660 "2022-08-23T23:44:10Z")
I've been working to set up SSO with Azure AD on a native Azure integrated elasticsearch cluster following this guide: How to set up OpenID Connect on Elastic Cloud (with Azure, Google, Okta) | Elastic Blog. As far as I … --- ## [Elasticsearch 8.x installation and configuration problem and elasticsearch service not able to start](https://discuss.elastic.co/t/elasticsearch-8-x-installation-and-configuration-problem-and-elasticsearch-service-not-able-to-start/312745)
**Author:** [@rjoshi28](https://discuss.elastic.co/u/rjoshi28)\ **Replies:** 1\ **Last updated:** [August 23, 2022, 10:48pm UTC](https://discuss.elastic.co/t/elasticsearch-8-x-installation-and-configuration-problem-and-elasticsearch-service-not-able-to-start/312745 "2022-08-23T22:48:18Z")
Hello guys, I have trouble installing and configuring my elasticsearch 8.x on Ubuntu 20.04 with ansible role. I am getting an error of Could not create auto-configuration directory with main ERROR Unable to create file… --- ## [How to count two different message and put the value in an email in Watcher](https://discuss.elastic.co/t/how-to-count-two-different-message-and-put-the-value-in-an-email-in-watcher/312743)
**Author:** [@pshada](https://discuss.elastic.co/u/pshada)\ **Replies:** 0\ **Last updated:** [August 23, 2022, 9:09pm UTC](https://discuss.elastic.co/t/how-to-count-two-different-message-and-put-the-value-in-an-email-in-watcher/312743 "2022-08-23T21:09:06Z")
I have a watcher with query like this { "match\_phrase": { "message": { "query": "INITIAL" } } … --- ## [Elastic-agent somehow resolves localhost to my machines dns name. Why? And how do I stop it?](https://discuss.elastic.co/t/elastic-agent-somehow-resolves-localhost-to-my-machines-dns-name-why-and-how-do-i-stop-it/312738)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 0\ **Last updated:** [August 23, 2022, 8:06pm UTC](https://discuss.elastic.co/t/elastic-agent-somehow-resolves-localhost-to-my-machines-dns-name-why-and-how-do-i-stop-it/312738 "2022-08-23T20:06:09Z")
This one has me mystified. I'm trying to set up a simple dev environment with elastic-agent shipping logs to a single-node Docker instance of Elasticsearch. All on my local machine. But when I try to start up elastic-ag… --- ## [Filebeat config using keystore and arrays broke with Kibana 8 update](https://discuss.elastic.co/t/filebeat-config-using-keystore-and-arrays-broke-with-kibana-8-update/312680)
**Author:** [@archon810](https://discuss.elastic.co/u/archon810)\ **Replies:** 1\ **Last updated:** [August 23, 2022, 7:29pm UTC](https://discuss.elastic.co/t/filebeat-config-using-keystore-and-arrays-broke-with-kibana-8-update/312680 "2022-08-23T19:29:55Z")
Hi there, For years we've successfully used kibana filebeats where the var.paths variable was specified using the keystore rather than being hardcoded in the config file, like so: vi /etc/filebeat/modules.d/custom\_ngin… --- ## [Master node not trusting node certificate](https://discuss.elastic.co/t/master-node-not-trusting-node-certificate/312606)
**Author:** [@dabit\_coder](https://discuss.elastic.co/u/dabit_coder)\ **Replies:** 14\ **Last updated:** [August 23, 2022, 6:41pm UTC](https://discuss.elastic.co/t/master-node-not-trusting-node-certificate/312606 "2022-08-23T18:41:15Z")
Hello, I am writing this post as my previous post was closed by inactivity (here) We are trying to create a cluster with one master node and one data node. So far, we had no success in that regard because we always get… --- ## [GeoIP working strange after update](https://discuss.elastic.co/t/geoip-working-strange-after-update/312505)
**Author:** [@Alexander\_A](https://discuss.elastic.co/u/Alexander_A)\ **Replies:** 2\ **Last updated:** [August 23, 2022, 6:10pm UTC](https://discuss.elastic.co/t/geoip-working-strange-after-update/312505 "2022-08-23T18:10:48Z")
After GeoIP Update using geoip.elastic.co we see strange behavior country for ip 1.1.1.1 not detected and organization\_name became "CLOUDFLARENET" instead of "Cloudflare, Inc". When we use simulate API we get old data (… --- ## [Search sas you type working great, but I need fuzziness / misspell correction](https://discuss.elastic.co/t/search-sas-you-type-working-great-but-i-need-fuzziness-misspell-correction/312729)
**Author:** [@pthreat](https://discuss.elastic.co/u/pthreat)\ **Replies:** 1\ **Last updated:** [August 23, 2022, 6:04pm UTC](https://discuss.elastic.co/t/search-sas-you-type-working-great-but-i-need-fuzziness-misspell-correction/312729 "2022-08-23T18:04:20Z")
This works great, however, I want to also be able to handle mistypes such as pish or fish, should match phish: My Query: { "from": 0, "size": 5, "sort": \[ { "date": { "o… --- ## [Problem logstash runner](https://discuss.elastic.co/t/problem-logstash-runner/312730)
**Author:** [@Vitoria\_De\_Lara](https://discuss.elastic.co/u/Vitoria_De_Lara)\ **Replies:** 0\ **Last updated:** [August 23, 2022, 6:00pm UTC](https://discuss.elastic.co/t/problem-logstash-runner/312730 "2022-08-23T18:00:58Z")
I'm trying to run logstash with this command, I would like to know if the syntax is right, and if not what would be the rule to run logstash. command /usr/share/logstash/bin/logstash --config.test\_and\_exit -f /etc/logs… --- ## [Filter range on array of object](https://discuss.elastic.co/t/filter-range-on-array-of-object/312669)
**Author:** [@Jake\_Wong](https://discuss.elastic.co/u/Jake_Wong)\ **Replies:** 10\ **Last updated:** [August 23, 2022, 4:21pm UTC](https://discuss.elastic.co/t/filter-range-on-array-of-object/312669 "2022-08-23T16:21:10Z")
I have a documents with many nested fields and array of objects inside them. So when I perform search, how can I get the age range between 20 to 35? { "company\_name": "abc company", "detail": { "staff": … --- ## [Cannot create index using ElasticSearch.Net](https://discuss.elastic.co/t/cannot-create-index-using-elasticsearch-net/312725)
**Author:** [@mbooh](https://discuss.elastic.co/u/mbooh)\ **Replies:** 0\ **Last updated:** [August 23, 2022, 3:55pm UTC](https://discuss.elastic.co/t/cannot-create-index-using-elasticsearch-net/312725 "2022-08-23T15:55:21Z")
Hi! I'm trying to create an index using ElasticSearch.Net but it does not work. I have connection to Elastic since if the index exists I can send a query against it and get a result but when I try to create I get a pin… --- ## [The final policy size is bigger than the limit](https://discuss.elastic.co/t/the-final-policy-size-is-bigger-than-the-limit/312720)
**Author:** [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\ **Replies:** 0\ **Last updated:** [August 23, 2022, 3:17pm UTC](https://discuss.elastic.co/t/the-final-policy-size-is-bigger-than-the-limit/312720 "2022-08-23T15:17:49Z")
I use functionbeat to ship aws lambda function logs to elasticsearch. I added a new log group today and when i attempt to update functionbeat i get the following error: The final policy size (20576) is bigger than the l… --- ## [How to disable the default index mapping and index documents based on explicit mapping](https://discuss.elastic.co/t/how-to-disable-the-default-index-mapping-and-index-documents-based-on-explicit-mapping/312719)
**Author:** [@Kishan\_Singh](https://discuss.elastic.co/u/Kishan_Singh)\ **Replies:** 0\ **Last updated:** [August 23, 2022, 3:07pm UTC](https://discuss.elastic.co/t/how-to-disable-the-default-index-mapping-and-index-documents-based-on-explicit-mapping/312719 "2022-08-23T15:07:00Z")
The problem statement is this: i want to index documents based only on the fields that i define in my explicit mapping configuration while creating an index. i can see that even if i pass my own index mapping for speci… --- ## [Kibana is now available (was degraded)"](https://discuss.elastic.co/t/kibana-is-now-available-was-degraded/312610)
**Author:** [@sanjay\_kumar\_chahar](https://discuss.elastic.co/u/sanjay_kumar_chahar)\ **Replies:** 2\ **Last updated:** [August 23, 2022, 2:00pm UTC](https://discuss.elastic.co/t/kibana-is-now-available-was-degraded/312610 "2022-08-23T14:00:57Z")
Hi All I have configured elasticsearch, kibana and fileebeat Kibana version number: "8.3.3" Elasticsearch version number : "8.3.3" Filebeat version number : "8.3.3" I am able to login in Kibana Web UI and not able… --- ## [Question About Field order in Discover](https://discuss.elastic.co/t/question-about-field-order-in-discover/312439)
**Author:** [@Paul\_Chen](https://discuss.elastic.co/u/Paul_Chen)\ **Replies:** 1\ **Last updated:** [August 23, 2022, 1:38pm UTC](https://discuss.elastic.co/t/question-about-field-order-in-discover/312439 "2022-08-23T13:38:25Z")
I use Logstash to output data to ES from database, and in the Kibana discover, the field always sort in a-z Is there any way to make the field order follow the database field order? note: My SQL statement already has t… --- ## [Kibana Email Alerting Connector](https://discuss.elastic.co/t/kibana-email-alerting-connector/312587)
**Author:** [@Ayushi\_bhardwaj](https://discuss.elastic.co/u/Ayushi_bhardwaj)\ **Replies:** 1\ **Last updated:** [August 23, 2022, 1:18pm UTC](https://discuss.elastic.co/t/kibana-email-alerting-connector/312587 "2022-08-23T13:18:17Z")
How to setup Email Connector once the rule is created in kibana Rules & Connectors? what Username and password inside email connector option we need to give. --- ## [Missing rsyslog/logstash data: rescan?](https://discuss.elastic.co/t/missing-rsyslog-logstash-data-rescan/312706)
**Author:** [@cvcv](https://discuss.elastic.co/u/cvcv)\ **Replies:** 0\ **Last updated:** [August 23, 2022, 12:46pm UTC](https://discuss.elastic.co/t/missing-rsyslog-logstash-data-rescan/312706 "2022-08-23T12:46:55Z")
Hi, I'm an ELK newbie. I configured rsyslogd and sending logs via the json template into logstash. Things worked fine for awhile but my index got "full". I lost a few days of logs. The rsyslog data/files are still t… --- ## [Kibana Dashboard Refresh takes too long](https://discuss.elastic.co/t/kibana-dashboard-refresh-takes-too-long/312683)
**Author:** [@Scorpion21](https://discuss.elastic.co/u/Scorpion21)\ **Replies:** 1\ **Last updated:** [August 23, 2022, 11:56am UTC](https://discuss.elastic.co/t/kibana-dashboard-refresh-takes-too-long/312683 "2022-08-23T11:56:46Z")
I deploy an ELK platform using kubernetes. For a quick test, I just create a simple dashboard including one map and two bars, based on a small index including less than 4000 docs. However, it will take around 20 sec… --- ## [Monitoring Request Failed in Stack Monitoring in Kibana 8.3.3](https://discuss.elastic.co/t/monitoring-request-failed-in-stack-monitoring-in-kibana-8-3-3/312698)
**Author:** [@sumitpramanik](https://discuss.elastic.co/u/sumitpramanik)\ **Replies:** 0\ **Last updated:** [August 23, 2022, 11:27am UTC](https://discuss.elastic.co/t/monitoring-request-failed-in-stack-monitoring-in-kibana-8-3-3/312698 "2022-08-23T11:27:25Z")
Hi, I am facing below issue after updating kibana to 8.2 and in 8.3.3 its not fixed yet. How to solve this? {"ecs":{"version":"8.0.0"},"@timestamp":"2022-08-23T17:24:52.715+06:00","message":"Saved object \[task/e3353… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=819) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=821)