# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=821 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 822 --- ## [Set new value in controls-visualisation after pipeline execution/index creation](https://discuss.elastic.co/t/set-new-value-in-controls-visualisation-after-pipeline-execution-index-creation/312679)
**Author:** [@Jonas\_S](https://discuss.elastic.co/u/Jonas_S)\ **Replies:** 2\ **Last updated:** [August 23, 2022, 10:43am UTC](https://discuss.elastic.co/t/set-new-value-in-controls-visualisation-after-pipeline-execution-index-creation/312679 "2022-08-23T10:43:32Z")
Hello, i have a kibana dashboard with an index pattern where every month a new index is created by a logstash pipeline within the same index pattern. The data contains a field "month", which is selectable in a controls … --- ## [Multi match query or any search query is not working when field data is in Json string format](https://discuss.elastic.co/t/multi-match-query-or-any-search-query-is-not-working-when-field-data-is-in-json-string-format/311527)
**Author:** [@sona](https://discuss.elastic.co/u/sona)\ **Replies:** 1\ **Last updated:** [August 23, 2022, 11:01am UTC](https://discuss.elastic.co/t/multi-match-query-or-any-search-query-is-not-working-when-field-data-is-in-json-string-format/311527 "2022-08-23T11:01:53Z")
Hi, One of the field in my index is in json string format but I am not able to perform multi match search query on this. For example if I am passing query as my\_full\_name I am not getting any output. Below is the query … --- ## [Download CSV file name with visualization Name](https://discuss.elastic.co/t/download-csv-file-name-with-visualization-name/312372)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 3\ **Last updated:** [August 23, 2022, 10:53am UTC](https://discuss.elastic.co/t/download-csv-file-name-with-visualization-name/312372 "2022-08-23T10:53:59Z")
Hi all, I'm using Kibana 7.4.1. I create a data table and include it in my dashboard. When i try to download CSV on formatted button I'm only able to download filename table.CSV. For all visualizations, name of file … --- ## [Processors in elastic agent integrations](https://discuss.elastic.co/t/processors-in-elastic-agent-integrations/312692)
**Author:** [@Serhii\_Chebonenko](https://discuss.elastic.co/u/Serhii_Chebonenko)\ **Replies:** 0\ **Last updated:** [August 23, 2022, 10:34am UTC](https://discuss.elastic.co/t/processors-in-elastic-agent-integrations/312692 "2022-08-23T10:34:51Z")
Hi Everyone. I'm trying to add a field (user\_principal\_name) with processors to have common point of reference while searching different indexes (ftd, ad logs, azure logs etc.) I tried adding this processor to cisco ft… --- ## [Nest BulkAll - Error: 'BulkAll halted after receiving failures that can not be retried from \_bulk'](https://discuss.elastic.co/t/nest-bulkall-error-bulkall-halted-after-receiving-failures-that-can-not-be-retried-from-bulk/304949)
**Author:** [@dumstattd](https://discuss.elastic.co/u/dumstattd)\ **Replies:** 5\ **Last updated:** [August 23, 2022, 9:47am UTC](https://discuss.elastic.co/t/nest-bulkall-error-bulkall-halted-after-receiving-failures-that-can-not-be-retried-from-bulk/304949 "2022-08-23T09:47:45Z")
I am currently using a foreach to index through a pipeline using the nest client. This is slow and highly inefficient. But works. For that same dataset, I tried using the BulkAll command as follows to push the same data… --- ## [Do aarch64-architecture support x-pack？](https://discuss.elastic.co/t/do-aarch64-architecture-support-x-pack/311985)
**Author:** [@calvin\_zhang1206](https://discuss.elastic.co/u/calvin_zhang1206)\ **Replies:** 11\ **Last updated:** [August 23, 2022, 9:41am UTC](https://discuss.elastic.co/t/do-aarch64-architecture-support-x-pack/311985 "2022-08-23T09:41:52Z")
Hi: My server CPU architecture is aarch64, my elasticsearch version is 6.2.4，now I want to use x-pack for security, Do aarch64-architecture support x-pack？ please help me ,thank you --- ## [Error: Index pattern does not contain any geospatial fields](https://discuss.elastic.co/t/error-index-pattern-does-not-contain-any-geospatial-fields/312686)
**Author:** [@Ricard-CT](https://discuss.elastic.co/u/Ricard-CT)\ **Replies:** 0\ **Last updated:** [August 23, 2022, 8:34am UTC](https://discuss.elastic.co/t/error-index-pattern-does-not-contain-any-geospatial-fields/312686 "2022-08-23T08:34:32Z")
Hello everyone, I'm trying to use the geo\_ip filter on my logstash, but it is not working. When I try to create the map, this error appears: "Index pattern does not contain any geospatial fields" The problem is tha… --- ## [Add module threatintel to filebeat](https://discuss.elastic.co/t/add-module-threatintel-to-filebeat/312456)
**Author:** [@dounia](https://discuss.elastic.co/u/dounia)\ **Replies:** 18\ **Last updated:** [August 23, 2022, 8:18am UTC](https://discuss.elastic.co/t/add-module-threatintel-to-filebeat/312456 "2022-08-23T08:18:46Z")
Hi, I'm adding threatintel module to filebeat , but when I restart filebeat service it failed, I get this error : Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch.. --- ## [How to restart data nodes with outdated data?](https://discuss.elastic.co/t/how-to-restart-data-nodes-with-outdated-data/312363)
**Author:** [@Sylmarch](https://discuss.elastic.co/u/Sylmarch)\ **Replies:** 2\ **Last updated:** [August 23, 2022, 7:55am UTC](https://discuss.elastic.co/t/how-to-restart-data-nodes-with-outdated-data/312363 "2022-08-23T07:55:09Z")
Hi, we have an Elasticsearch 7 cluster in production with 3 physical machines. Each machines hosts 3 nodes: 1 node: master-eligible + data 2 nodes: data only Cluster is configured so that replica shards are copied o… --- ## [Can I create two or more clusters in ElasticSearch](https://discuss.elastic.co/t/can-i-create-two-or-more-clusters-in-elasticsearch/312681)
**Author:** [@Rakhshunda\_Noorein\_J](https://discuss.elastic.co/u/Rakhshunda_Noorein_J)\ **Replies:** 0\ **Last updated:** [August 23, 2022, 7:37am UTC](https://discuss.elastic.co/t/can-i-create-two-or-more-clusters-in-elasticsearch/312681 "2022-08-23T07:37:38Z")
Hi, I want to create two clusters in elasticsearch. 1 cluster will hold different indices and another cluster will hold different indices. Can I do that in Elasticsearch and if yes then how to do that?? --- ## [Slow Inexing and ES Cluster Getting Throttled after some time](https://discuss.elastic.co/t/slow-inexing-and-es-cluster-getting-throttled-after-some-time/312678)
**Author:** [@arjun\_thakur](https://discuss.elastic.co/u/arjun_thakur)\ **Replies:** 0\ **Last updated:** [August 23, 2022, 7:23am UTC](https://discuss.elastic.co/t/slow-inexing-and-es-cluster-getting-throttled-after-some-time/312678 "2022-08-23T07:23:27Z")
I am using ELK stack 7.10.0. The cluster has 7 nodes and each node is assigned approx 30 GB JVM heap. Over the past few weeks, the indexing speed is getting extremely slow. Before that System was able to ingest 700 GB o… --- ## [Elastic best Practice](https://discuss.elastic.co/t/elastic-best-practice/312671)
**Author:** [@vnovotny98](https://discuss.elastic.co/u/vnovotny98)\ **Replies:** 7\ **Last updated:** [August 23, 2022, 7:03am UTC](https://discuss.elastic.co/t/elastic-best-practice/312671 "2022-08-23T07:03:15Z")
Hello, I am indexing 1mil logs per 15 minutes in one index and I need about 10 000 of them to visualize in Grafana and make reports on it. Is it good practice to separate these 10 000/15 mins to another index? Will sear… --- ## [Cannot access stack monitoring](https://discuss.elastic.co/t/cannot-access-stack-monitoring/312589)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 2\ **Last updated:** [August 23, 2022, 6:45am UTC](https://discuss.elastic.co/t/cannot-access-stack-monitoring/312589 "2022-08-23T06:45:57Z")
Hi, we are using the free license. I cannot access the stack monitoring. Getting following error message inside kibana: The issue occurs as superuser elastic and with a newly created user called monitoring: It d… --- ## [Question about Cloudtrail ingest processor for file.path](https://discuss.elastic.co/t/question-about-cloudtrail-ingest-processor-for-file-path/311405)
**Author:** [@styks90](https://discuss.elastic.co/u/styks90)\ **Replies:** 2\ **Last updated:** [August 23, 2022, 5:18am UTC](https://discuss.elastic.co/t/question-about-cloudtrail-ingest-processor-for-file-path/311405 "2022-08-23T05:18:54Z")
We've noticed while using filebeat to process logs from Cloudtrail that for some reason the processor looks at the previous S3 object and are unsure of the reasoning behind it: - rename: field: "json.previousDig… --- ## [ILM policy is not followed correctly and index is not getting rollover as per doc size or max age](https://discuss.elastic.co/t/ilm-policy-is-not-followed-correctly-and-index-is-not-getting-rollover-as-per-doc-size-or-max-age/312306)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 6\ **Last updated:** [August 23, 2022, 5:18am UTC](https://discuss.elastic.co/t/ilm-policy-is-not-followed-correctly-and-index-is-not-getting-rollover-as-per-doc-size-or-max-age/312306 "2022-08-23T05:18:42Z")
Hello All, I'm facing major challenges with regards to ILM policy for all my indexes. In ILM policy I'm using two phase HOT and DELETE. Hot Phase- It should have max 2mb of data or data should be there for 3 min then … --- ## [Kubernetes pods are not ready in a Cluster with xpack.security.enabled: true after the pod restart](https://discuss.elastic.co/t/kubernetes-pods-are-not-ready-in-a-cluster-with-xpack-security-enabled-true-after-the-pod-restart/312670)
**Author:** [@sandeep\_kumar5](https://discuss.elastic.co/u/sandeep_kumar5)\ **Replies:** 0\ **Last updated:** [August 23, 2022, 4:50am UTC](https://discuss.elastic.co/t/kubernetes-pods-are-not-ready-in-a-cluster-with-xpack-security-enabled-true-after-the-pod-restart/312670 "2022-08-23T04:50:32Z")
I have created an elasticsearch in Kubernetes using helm charts(helm version 3) by enabling xpack.security. It was working fine and did not find any issues but when i am restarting the pod or putting any update it is giv… --- ## [Update Reindex Data](https://discuss.elastic.co/t/update-reindex-data/312667)
**Author:** [@xynobob](https://discuss.elastic.co/u/xynobob)\ **Replies:** 0\ **Last updated:** [August 23, 2022, 3:28am UTC](https://discuss.elastic.co/t/update-reindex-data/312667 "2022-08-23T03:28:56Z")
So I reindex one of my ".kibana" index to a new index called "kibana-detections" as shown below POST \_reindex { "source": { "index": ".kibana", "query": { "bool": { "must": \[\], "filter": … --- ## [Parsing JSON from Elastic Search query](https://discuss.elastic.co/t/parsing-json-from-elastic-search-query/312666)
**Author:** [@Chandana\_P](https://discuss.elastic.co/u/Chandana_P)\ **Replies:** 0\ **Last updated:** [August 23, 2022, 3:23am UTC](https://discuss.elastic.co/t/parsing-json-from-elastic-search-query/312666 "2022-08-23T03:23:18Z")
How do I parse JSON object from a URL painless or any other scripting language from the Elastic Search query? --- ## [Bucket size control for sub-aggregation](https://discuss.elastic.co/t/bucket-size-control-for-sub-aggregation/312193)
**Author:** [@lzz118](https://discuss.elastic.co/u/lzz118)\ **Replies:** 2\ **Last updated:** [August 23, 2022, 3:21am UTC](https://discuss.elastic.co/t/bucket-size-control-for-sub-aggregation/312193 "2022-08-23T03:21:49Z")
Hi there, I am using multi-level sub-aggregations in my application and I noticed that the size/shard size parameter does not seems to be used during the runtime to control the bucket size of the secondary or deeper lev… --- ## [Kibana terribly slow on /apm/traces](https://discuss.elastic.co/t/kibana-terribly-slow-on-apm-traces/312665)
**Author:** [@user2022](https://discuss.elastic.co/u/user2022)\ **Replies:** 1\ **Last updated:** [August 23, 2022, 2:39am UTC](https://discuss.elastic.co/t/kibana-terribly-slow-on-apm-traces/312665 "2022-08-23T02:39:03Z")
can any one look at the issue i posted at apm category? links: Kibana terribly slow on /apm/traces - Elastic Observability / APM - Discuss the Elastic Stack --- ## [Logstash currently bundles openjdk 11.0.15 but 11.0.16.1 is released](https://discuss.elastic.co/t/logstash-currently-bundles-openjdk-11-0-15-but-11-0-16-1-is-released/312626)
**Author:** [@lunarfs](https://discuss.elastic.co/u/lunarfs)\ **Replies:** 1\ **Last updated:** [August 23, 2022, 1:45am UTC](https://discuss.elastic.co/t/logstash-currently-bundles-openjdk-11-0-15-but-11-0-16-1-is-released/312626 "2022-08-23T01:45:04Z")
Hi, I was under the impression that Logstash would bundle the latest Eclipse Temurin jdk when a new version was released. this however does not sem to be the case. I find it a bit hard to figure what determines what dec… --- ## [Logstash did not listen to port 5044 after startup，but listened to port 9600](https://discuss.elastic.co/t/logstash-did-not-listen-to-port-5044-after-startup-but-listened-to-port-9600/312595)
**Author:** [@YodHao](https://discuss.elastic.co/u/YodHao)\ **Replies:** 4\ **Last updated:** [August 23, 2022, 1:41am UTC](https://discuss.elastic.co/t/logstash-did-not-listen-to-port-5044-after-startup-but-listened-to-port-9600/312595 "2022-08-23T01:41:26Z")
Hello, I would like to ask what is wrong with my logstash configuration. I configured the port to listen to 5044 in the pipeline.yml file, but only 9600 is monitored after logstash is started; the port 5044 is not monito… --- ## [Request latency](https://discuss.elastic.co/t/request-latency/312636)
**Author:** [@Tomas\_Rabazo](https://discuss.elastic.co/u/Tomas_Rabazo)\ **Replies:** 1\ **Last updated:** [August 23, 2022, 1:22am UTC](https://discuss.elastic.co/t/request-latency/312636 "2022-08-23T01:22:21Z")
Hello, I am trying to display latency related with a request to a backend (endpoint). For instance, I search the endpoint (backend) and I want to display average latency for that endpoint. How can I do it? --- ## [Snapshot and restore - 7.14 version to 8.0/8.x](https://discuss.elastic.co/t/snapshot-and-restore-7-14-version-to-8-0-8-x/312645)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 1\ **Last updated:** [August 23, 2022, 1:07am UTC](https://discuss.elastic.co/t/snapshot-and-restore-7-14-version-to-8-0-8-x/312645 "2022-08-23T01:07:57Z")
I do see that for upgrade from 7.14 to 8.0 requires upgrading first to 7.17 version then to 8.0 to have the compatibility of the indices. Is this applicable for "Snapshot and restore" as well, where 7.14 cluster (Remote… --- ## [Recovering from a crash](https://discuss.elastic.co/t/recovering-from-a-crash/312649)
**Author:** [@duckasylum](https://discuss.elastic.co/u/duckasylum)\ **Replies:** 1\ **Last updated:** [August 22, 2022, 10:09pm UTC](https://discuss.elastic.co/t/recovering-from-a-crash/312649 "2022-08-22T22:09:55Z")
Hi Not sure if this is more of an ES or Kibana topic but I will start with the ES part. I am running a single node cluster for development projects (official docker containers on Podman). After consecutive power failure… --- ## [Get info of SSL client certificate used for beats in logs send to Logstash](https://discuss.elastic.co/t/get-info-of-ssl-client-certificate-used-for-beats-in-logs-send-to-logstash/312654)
**Author:** [@jeroen.antsec](https://discuss.elastic.co/u/jeroen.antsec)\ **Replies:** 1\ **Last updated:** [August 22, 2022, 9:45pm UTC](https://discuss.elastic.co/t/get-info-of-ssl-client-certificate-used-for-beats-in-logs-send-to-logstash/312654 "2022-08-22T21:45:42Z")
Hi. I would like to have the CN of the certificate that is used to connect from winlogbeat/filebeat to logstash as seperate field in logstash/elastic. Does anybody know if this is possible? I cannot find this anywhere … --- ## [ILM policies conditions are getting exceeded to rollover the indices](https://discuss.elastic.co/t/ilm-policies-conditions-are-getting-exceeded-to-rollover-the-indices/312308)
**Author:** [@Mangesh\_Mathe](https://discuss.elastic.co/u/Mangesh_Mathe)\ **Replies:** 4\ **Last updated:** [August 22, 2022, 9:20pm UTC](https://discuss.elastic.co/t/ilm-policies-conditions-are-getting-exceeded-to-rollover-the-indices/312308 "2022-08-22T21:20:24Z")
Hello Elastic Team, I have applied ILM policy(test) to my Index(timeseries) where I have defined ONLY hot phase with conditions max\_age(15m) & max\_docs(5). My index is getting rollover but not following/matching above … --- ## [How to replicate Heartbeat menu on dashboard](https://discuss.elastic.co/t/how-to-replicate-heartbeat-menu-on-dashboard/312652)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 0\ **Last updated:** [August 22, 2022, 7:32pm UTC](https://discuss.elastic.co/t/how-to-replicate-heartbeat-menu-on-dashboard/312652 "2022-08-22T19:32:26Z")
So we have this menu on heartbeat where we can select between ALL, UP and DOWN. And what I've been trying to do is replicate this little menu by Markdown. I did the "ALL" part since it was simply sending the link bac… --- ## [Unable to login to Kibana using API\_KEY with restrictions](https://discuss.elastic.co/t/unable-to-login-to-kibana-using-api-key-with-restrictions/312258)
**Author:** [@Bikram\_Kundu](https://discuss.elastic.co/u/Bikram_Kundu)\ **Replies:** 12\ **Last updated:** [August 22, 2022, 12:37pm UTC](https://discuss.elastic.co/t/unable-to-login-to-kibana-using-api-key-with-restrictions/312258 "2022-08-22T12:37:58Z")
Use case: I am implementing Attribute Based Access Control as mentioned on the official blog. How can I create an API\_Key that has access to the Kibana dashboard with restricted attribute-based access control? Steps f… --- ## [Logstash Lumberjack Output](https://discuss.elastic.co/t/logstash-lumberjack-output/312646)
**Author:** [@6igwig](https://discuss.elastic.co/u/6igwig)\ **Replies:** 1\ **Last updated:** [August 22, 2022, 7:05pm UTC](https://discuss.elastic.co/t/logstash-lumberjack-output/312646 "2022-08-22T19:05:51Z")
In the documentation for lumberjack output, under the ssl\_certificate setting it just says, "This is a required setting" and "ssl certificate to use." My questions are: what is this certificate used for, and why is it r… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=820) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=822)