# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=829

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 830

---

## [Failed to execute action:message=\>"Unable to configure plugins](https://discuss.elastic.co/t/failed-to-execute-action-message-unable-to-configure-plugins/312106)

<div class="topic-metadata">

**Author:** [@Eina\_Zia](https://discuss.elastic.co/u/Eina_Zia)\
**Replies:** 2\
**Last updated:** [August 16, 2022, 3:35am UTC](https://discuss.elastic.co/t/failed-to-execute-action-message-unable-to-configure-plugins/312106 "2022-08-16T03:35:59Z")

</div>

Hello everyone1 I am new to logstash and I have been trying for so long to import dataset through logstash. I keep on getting error. This is my recent attempt. Without super user, it is not giving me permission even afte…

---

## [Esrally not generating any metrics](https://discuss.elastic.co/t/esrally-not-generating-any-metrics/312119)

<div class="topic-metadata">

**Author:** [@Naresh\_Sama](https://discuss.elastic.co/u/Naresh_Sama)\
**Replies:** 2\
**Last updated:** [August 16, 2022, 4:59am UTC](https://discuss.elastic.co/t/esrally-not-generating-any-metrics/312119 "2022-08-16T04:59:33Z")

</div>

While running performance testing using esrally on Elasticsearch version 7.10, rally is able to generate the load on the cluster but, once the test reaches 100% it is failing and not giving any metrics of the benchmark. …

---

## [Kibana Visualization](https://discuss.elastic.co/t/kibana-visualization/312107)

<div class="topic-metadata">

**Author:** [@Pranta\_Saha](https://discuss.elastic.co/u/Pranta_Saha)\
**Replies:** 1\
**Last updated:** [August 16, 2022, 2:59am UTC](https://discuss.elastic.co/t/kibana-visualization/312107 "2022-08-16T02:59:18Z")

</div>

Hello, I am trying to create a visualization of my Elasticsearch cluster health in Kibana. Can any one give me a hint how it can be done?

---

## [How to search data and show like this,all the fields in result are connected by dot?](https://discuss.elastic.co/t/how-to-search-data-and-show-like-this-all-the-fields-in-result-are-connected-by-dot/312133)

<div class="topic-metadata">

**Author:** [@jin\_liu](https://discuss.elastic.co/u/jin_liu)\
**Replies:** 0\
**Last updated:** [August 16, 2022, 2:46am UTC](https://discuss.elastic.co/t/how-to-search-data-and-show-like-this-all-the-fields-in-result-are-connected-by-dot/312133 "2022-08-16T02:46:23Z")

</div>

i found this when discover es data by kibana,all the fields are connected by dot,i wonder how to make this by es dsl? { "\_index": "zk\_mysql\_log-2022\_08", "\_type": "\_doc", "\_id": "DoEekIIBmO8s27BbCb\_1", "\_version…

---

## [How to make an interval of minutes in a timestamp on Lens \[Dashboards\]](https://discuss.elastic.co/t/how-to-make-an-interval-of-minutes-in-a-timestamp-on-lens-dashboards/312123)

<div class="topic-metadata">

**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\
**Replies:** 3\
**Last updated:** [August 16, 2022, 1:48am UTC](https://discuss.elastic.co/t/how-to-make-an-interval-of-minutes-in-a-timestamp-on-lens-dashboards/312123 "2022-08-16T01:48:06Z")

</div>

Hello everyone, I'm new to the making of dashboards and now I'm having a bit of problem dealing with a specific field on Lens. First here is the image in question: On the left is a random ID given to a device and on…

---

## [Index is not getting rolled over](https://discuss.elastic.co/t/index-is-not-getting-rolled-over/312124)

<div class="topic-metadata">

**Author:** [@Harper\_S1](https://discuss.elastic.co/u/Harper_S1)\
**Replies:** 5\
**Last updated:** [August 16, 2022, 1:42am UTC](https://discuss.elastic.co/t/index-is-not-getting-rolled-over/312124 "2022-08-16T01:42:51Z")

</div>

Hi, I have installed the ELK 8.2 but seems rollover is not working well. index size reached to 2+ Tb. when I tried to rollover using command line POST some-index-name/\_rollover { "conditions": { "max\_age": "30…

---

## [Errors with elasticsearch-users useradd -- 7.17.1](https://discuss.elastic.co/t/errors-with-elasticsearch-users-useradd-7-17-1/312070)

<div class="topic-metadata">

**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\
**Replies:** 4\
**Last updated:** [August 15, 2022, 11:44pm UTC](https://discuss.elastic.co/t/errors-with-elasticsearch-users-useradd-7-17-1/312070 "2022-08-15T23:44:23Z")

</div>

I am trying to add a user to the file realm to recover from the elastic user failing to login -- I have no idea why logins started to fail. From the manual I understand that the file realm is active by default so I don…

---

## [Watcher not passing variables to an e-mail message](https://discuss.elastic.co/t/watcher-not-passing-variables-to-an-e-mail-message/310932)

<div class="topic-metadata">

**Author:** [@srpmic](https://discuss.elastic.co/u/srpmic)\
**Replies:** 2\
**Last updated:** [August 16, 2022, 12:32am UTC](https://discuss.elastic.co/t/watcher-not-passing-variables-to-an-e-mail-message/310932 "2022-08-16T00:32:21Z")

</div>

Hello, I'm ingesting my Windows logs via WinlogBeat. I want to receive an e-mail when winlog.event\_id is equal to either 17, 34, 130, 21. The e-mail should contain the event.code, agent.name, time and the raw event me…

---

## [What happened to the "Gold" subscription?](https://discuss.elastic.co/t/what-happened-to-the-gold-subscription/311506)

<div class="topic-metadata">

**Author:** [@CoaxVex](https://discuss.elastic.co/u/CoaxVex)\
**Replies:** 2\
**Last updated:** [August 15, 2022, 10:36pm UTC](https://discuss.elastic.co/t/what-happened-to-the-gold-subscription/311506 "2022-08-15T22:36:57Z")

</div>

I was just made aware that the "Gold" subscription has been discontinued. When did this happen, and what is the reasoning behind it? Is this part of a strategy to push users to the cloud service? Many "Elastic stack" u…

---

## [How to create custom privileges for Elasticsearch x-pack?](https://discuss.elastic.co/t/how-to-create-custom-privileges-for-elasticsearch-x-pack/312097)

<div class="topic-metadata">

**Author:** [@WhatIsKibana](https://discuss.elastic.co/u/WhatIsKibana)\
**Replies:** 2\
**Last updated:** [August 15, 2022, 8:49pm UTC](https://discuss.elastic.co/t/how-to-create-custom-privileges-for-elasticsearch-x-pack/312097 "2022-08-15T20:49:20Z")

</div>

Hello everyone, I'm using ELK stack 6.8, but I want to replace kibana with my own simple ui which will fit better for my case. My app should contain user management, restrictions for operations (eg some users will be a…

---

## [Calculating a formula on nested fields in classic, aggregation-based visualizations](https://discuss.elastic.co/t/calculating-a-formula-on-nested-fields-in-classic-aggregation-based-visualizations/311988)

<div class="topic-metadata">

**Author:** [@slhck](https://discuss.elastic.co/u/slhck)\
**Replies:** 7\
**Last updated:** [August 15, 2022, 6:17pm UTC](https://discuss.elastic.co/t/calculating-a-formula-on-nested-fields-in-classic-aggregation-based-visualizations/311988 "2022-08-15T18:17:15Z")

</div>

I have a document field that gives me a result in kBit/s, but I would like to convert it to MBit/s (by dividing by 1,000). This should only be done during visualization; there is no need to create a runtime field or scri…

---

## [Performance of using Elasticsearch to search for people](https://discuss.elastic.co/t/performance-of-using-elasticsearch-to-search-for-people/309687)

<div class="topic-metadata">

**Author:** [@AymanHamdoun](https://discuss.elastic.co/u/AymanHamdoun)\
**Replies:** 15\
**Last updated:** [August 15, 2022, 5:18pm UTC](https://discuss.elastic.co/t/performance-of-using-elasticsearch-to-search-for-people/309687 "2022-08-15T17:18:54Z")

</div>

Problem Context I am trying to use Elasticsearch to implement user search in a platform. However its taking way too long to search. usually around 100 ms - 200 ms. I am trying to achieve something closer to 40 ms maximum…

---

## [Script in kibana](https://discuss.elastic.co/t/script-in-kibana/312036)

<div class="topic-metadata">

**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Replies:** 11\
**Last updated:** [August 15, 2022, 5:14pm UTC](https://discuss.elastic.co/t/script-in-kibana/312036 "2022-08-15T17:14:32Z")

</div>

I am trying to use simple script but output is not desirable. for example first row is 3444 and if I divide that by 10 it should be 344.4 but it comes out to be something different. why is it happening? am I using thi…

---

## [New Java API Client: Rewrite an UpdateRequest with Script Part](https://discuss.elastic.co/t/new-java-api-client-rewrite-an-updaterequest-with-script-part/310661)

<div class="topic-metadata">

**Author:** [@aga31432432](https://discuss.elastic.co/u/aga31432432)\
**Replies:** 1\
**Last updated:** [August 15, 2022, 5:12pm UTC](https://discuss.elastic.co/t/new-java-api-client-rewrite-an-updaterequest-with-script-part/310661 "2022-08-15T17:12:06Z")

</div>

Hello everyone, We need to migrate some code from the current Java High Level REST Client (HLRC) to the new Java API Client 7.7.15. I have this snippet of Kotlin code I need to rewrite using the new Java Client API: v…

---

## [Creating a New Cluster -- To Use or Not to Use Virtualization?](https://discuss.elastic.co/t/creating-a-new-cluster-to-use-or-not-to-use-virtualization/312102)

<div class="topic-metadata">

**Author:** [@pushshift](https://discuss.elastic.co/u/pushshift)\
**Replies:** 2\
**Last updated:** [August 15, 2022, 4:43pm UTC](https://discuss.elastic.co/t/creating-a-new-cluster-to-use-or-not-to-use-virtualization/312102 "2022-08-15T16:43:42Z")

</div>

We are in the process of securing COLO space to install new servers into a rack and to move our current Elasticsearch clusters into one larger cluster. I've read some material on virtualization and ES and I was hoping to…

---

## [How can I resolve "could not use PowerShell to find Visual Studio 2017 or newer" while installing kibana](https://discuss.elastic.co/t/how-can-i-resolve-could-not-use-powershell-to-find-visual-studio-2017-or-newer-while-installing-kibana/309932)

<div class="topic-metadata">

**Author:** [@najmiehsa](https://discuss.elastic.co/u/najmiehsa)\
**Replies:** 8\
**Last updated:** [August 15, 2022, 4:12pm UTC](https://discuss.elastic.co/t/how-can-i-resolve-could-not-use-powershell-to-find-visual-studio-2017-or-newer-while-installing-kibana/309932 "2022-08-15T16:12:36Z")

</div>

Hi, I have visual studio 2022 community and visual studio 2022 build tools installed and config them with npm. But when I try to install kibana I encounter this error: could not use PowerShell to find Visual Studio 20…

---

## [Tableau connecting to ES](https://discuss.elastic.co/t/tableau-connecting-to-es/312027)

<div class="topic-metadata">

**Author:** [@kjain14](https://discuss.elastic.co/u/kjain14)\
**Replies:** 4\
**Last updated:** [August 15, 2022, 3:26pm UTC](https://discuss.elastic.co/t/tableau-connecting-to-es/312027 "2022-08-15T15:26:30Z")

</div>

Hello Folks, We are trying to connect Tableau to ES server having OSS 7.6.1 ES with OpenDistro version 1.6.0. We are exploring using Download Tableau Connector for Elasticsearch | Elastic. Is it possible to use Tableau…

---

## [Disover without \_source field?](https://discuss.elastic.co/t/disover-without-source-field/311410)

<div class="topic-metadata">

**Author:** [@Dargod](https://discuss.elastic.co/u/Dargod)\
**Replies:** 3\
**Last updated:** [August 15, 2022, 3:00pm UTC](https://discuss.elastic.co/t/disover-without-source-field/311410 "2022-08-15T15:00:30Z")

</div>

Is it possible to fully use the section Discover in Kibana with disabled \_source? I disabled this field and set option: Read fields from \_source (discover:searchFieldsFromSource) - False However, I still get the erro…

---

## [Download 200k records from Elasticsearch](https://discuss.elastic.co/t/download-200k-records-from-elasticsearch/311960)

<div class="topic-metadata">

**Author:** [@snambu5878](https://discuss.elastic.co/u/snambu5878)\
**Replies:** 2\
**Last updated:** [August 15, 2022, 2:54pm UTC](https://discuss.elastic.co/t/download-200k-records-from-elasticsearch/311960 "2022-08-15T14:54:13Z")

</div>

Hi Everyone, We have built custom analytics UI (React) and using Elasticsearch as backend for SQL queries/analysis. We have Export results button that exports the queried dataset. The requirement is to download upto 20…

---

## [Fleet Integration Adding Cloud Fields to an Index from Elastic Agent's filebeat.yml](https://discuss.elastic.co/t/fleet-integration-adding-cloud-fields-to-an-index-from-elastic-agents-filebeat-yml/312109)

<div class="topic-metadata">

**Author:** [@othman](https://discuss.elastic.co/u/othman)\
**Replies:** 1\
**Last updated:** [August 15, 2022, 2:29pm UTC](https://discuss.elastic.co/t/fleet-integration-adding-cloud-fields-to-an-index-from-elastic-agents-filebeat-yml/312109 "2022-08-15T14:29:24Z")

</div>

I'm having an issue where some rogue configuration is adding cloud fields to the documents of one my indices. In particular, it looks like there is some add\_cloud\_metadata: ~ processor running somewhere. After much trou…

---

## [Elastic Agent SOMETIMES Opens Ports to Listen for Syslog Traffic (Buggy Behaviour)](https://discuss.elastic.co/t/elastic-agent-sometimes-opens-ports-to-listen-for-syslog-traffic-buggy-behaviour/312046)

<div class="topic-metadata">

**Author:** [@othman](https://discuss.elastic.co/u/othman)\
**Replies:** 1\
**Last updated:** [August 15, 2022, 1:51pm UTC](https://discuss.elastic.co/t/elastic-agent-sometimes-opens-ports-to-listen-for-syslog-traffic-buggy-behaviour/312046 "2022-08-15T13:51:35Z")

</div>

Greetings, I'm having this rather inconsistent behaviour where my elastic agent deployed on my Syslog server sometimes opens ports for incoming traffic and sometimes decides not to. Currently the agent has few integrat…

---

## [Is it possible that this happens again in an upgrade?](https://discuss.elastic.co/t/is-it-possible-that-this-happens-again-in-an-upgrade/312039)

<div class="topic-metadata">

**Author:** [@odelacruzc](https://discuss.elastic.co/u/odelacruzc)\
**Replies:** 2\
**Last updated:** [August 15, 2022, 1:42pm UTC](https://discuss.elastic.co/t/is-it-possible-that-this-happens-again-in-an-upgrade/312039 "2022-08-15T13:42:31Z")

</div>

Hi friends, we are going to migrate to the latest version of elastic 8.3, so before when we migrated from 6.x to 7.x, the alerts were affected since some configurations were automatically activated through some checkboxe…

---

## [Kibana - Alert data viewer and Edit Rule are stuck and slow](https://discuss.elastic.co/t/kibana-alert-data-viewer-and-edit-rule-are-stuck-and-slow/312103)

<div class="topic-metadata">

**Author:** [@Mor123460](https://discuss.elastic.co/u/Mor123460)\
**Replies:** 0\
**Last updated:** [August 15, 2022, 12:52pm UTC](https://discuss.elastic.co/t/kibana-alert-data-viewer-and-edit-rule-are-stuck-and-slow/312103 "2022-08-15T12:52:03Z")

</div>

Hey. I'm running a cluster in 2 different environments. With the same versions for all of the nodes and the kibana (8.1.2). But in one of the environments, the Alert data viewer or the Edit rule (any rule) are getting…

---

## [Viewing Documents in Kibana](https://discuss.elastic.co/t/viewing-documents-in-kibana/311459)

<div class="topic-metadata">

**Author:** [@jhop](https://discuss.elastic.co/u/jhop)\
**Replies:** 7\
**Last updated:** [August 15, 2022, 12:48pm UTC](https://discuss.elastic.co/t/viewing-documents-in-kibana/311459 "2022-08-15T12:48:46Z")

</div>

Hi, I am new to Elastic. I have successfully mapped and created a new index using Management\>Dev Tools\>Console. I can view the index on the Index Management screen. Using the console I successfully created two document…

---

## [Filebeat - Journald input and parser support](https://discuss.elastic.co/t/filebeat-journald-input-and-parser-support/312099)

<div class="topic-metadata">

**Author:** [@Philipp\_Wiesner](https://discuss.elastic.co/u/Philipp_Wiesner)\
**Replies:** 0\
**Last updated:** [August 15, 2022, 12:38pm UTC](https://discuss.elastic.co/t/filebeat-journald-input-and-parser-support/312099 "2022-08-15T12:38:31Z")

</div>

I've seen a couple of already closed topics, with no real result about the JournalD input of Filebeat and its support for multiline messages or even the newly added parser support. There exists a couple of GitHub issues…

---

## [Using app.kubernetes.io/name label](https://discuss.elastic.co/t/using-app-kubernetes-io-name-label/312088)

<div class="topic-metadata">

**Author:** [@AssafKatz3](https://discuss.elastic.co/u/AssafKatz3)\
**Replies:** 0\
**Last updated:** [August 15, 2022, 11:04am UTC](https://discuss.elastic.co/t/using-app-kubernetes-io-name-label/312088 "2022-08-15T11:04:46Z")

</div>

Hi, I am trying to define service as the content of app.kubernetes.io/name label if it empty by: if !\[service\] and \[kubernetes\]\[labels\]\[app\_kubernetes\_io/name\] { mutate { add\_field =\> { "service…

---

## [Index \_stats index\_total should be calculated with scroll?](https://discuss.elastic.co/t/index-stats-index-total-should-be-calculated-with-scroll/312085)

<div class="topic-metadata">

**Author:** [@kin122](https://discuss.elastic.co/u/kin122)\
**Replies:** 0\
**Last updated:** [August 15, 2022, 10:55am UTC](https://discuss.elastic.co/t/index-stats-index-total-should-be-calculated-with-scroll/312085 "2022-08-15T10:55:52Z")

</div>

hi i monitors indices with \_stats API. i found index\_total affected by scroll its calculated by irate of prometheus. How do I remove the effection of scroll to get the right statsdata？

---

## [How to (offsite) backup and recover snapshots](https://discuss.elastic.co/t/how-to-offsite-backup-and-recover-snapshots/312081)

<div class="topic-metadata">

**Author:** [@Pieter\_Agenbag](https://discuss.elastic.co/u/Pieter_Agenbag)\
**Replies:** 5\
**Last updated:** [August 15, 2022, 10:30am UTC](https://discuss.elastic.co/t/how-to-offsite-backup-and-recover-snapshots/312081 "2022-08-15T10:30:15Z")

</div>

Hi - have a ES cluster consisting of lets say 20 nodes for arguments sake. Of course the indexes and shards are spread across the nodes... now lets say I do a snapshot. It looks like each node snapshots the data on its…

---

## [Metricbeat bad request error](https://discuss.elastic.co/t/metricbeat-bad-request-error/312074)

<div class="topic-metadata">

**Author:** [@Moe\_Hmaidan](https://discuss.elastic.co/u/Moe_Hmaidan)\
**Replies:** 0\
**Last updated:** [August 15, 2022, 7:23am UTC](https://discuss.elastic.co/t/metricbeat-bad-request-error/312074 "2022-08-15T07:23:56Z")

</div>

Hello, I keep getting the following Errors by metricbeat ERROR#011module/wrapper.go:259#011Error fetching data for metricset elasticsearch.index: HTTP error 400 in : 400 Bad Request ERROR#011module/wrapper.go:259#011E…

---

## [Error using API to connect to cluster](https://discuss.elastic.co/t/error-using-api-to-connect-to-cluster/311970)

<div class="topic-metadata">

**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\
**Replies:** 2\
**Last updated:** [August 15, 2022, 9:18am UTC](https://discuss.elastic.co/t/error-using-api-to-connect-to-cluster/311970 "2022-08-15T09:18:05Z")

</div>

ES version 7.17.1 I have just enabled security on an existing cluster that date back to the time when one had to pay to get "security". ;). I can connect using curl on the elastic user and get the cluster health. So t…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=828)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=830)
