# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=862 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 863 --- ## [Unable to create webhook action with path parameter](https://discuss.elastic.co/t/unable-to-create-webhook-action-with-path-parameter/309204)
**Author:** [@Vivek\_Kumar1](https://discuss.elastic.co/u/Vivek_Kumar1)\ **Replies:** 2\ **Last updated:** [July 18, 2022, 1:32pm UTC](https://discuss.elastic.co/t/unable-to-create-webhook-action-with-path-parameter/309204 "2022-07-18T13:32:35Z")
Hi, I want to create a connector for opsgienie, which will close the alert once it will be recovered. Opsgenie allows to close alerts by the alias, Alert API. So how do I mention the id or alias in the URL? What will… --- ## [Query Time Dynamic synonym](https://discuss.elastic.co/t/query-time-dynamic-synonym/309898)
**Author:** [@pavithra\_arul](https://discuss.elastic.co/u/pavithra_arul)\ **Replies:** 0\ **Last updated:** [July 18, 2022, 12:38pm UTC](https://discuss.elastic.co/t/query-time-dynamic-synonym/309898 "2022-07-18T12:38:38Z")
Hi Team, Trying to achieve dynamic synonym expansion at Query time using Rest API call Trying to update the synonym.txt file dynamically using Rest API. (or) updating the synonyms list via Rest call without even creat… --- ## [How to "reindex" a field with "source" disabled and "store: true"?](https://discuss.elastic.co/t/how-to-reindex-a-field-with-source-disabled-and-store-true/309817)
**Author:** [@huuyafwww](https://discuss.elastic.co/u/huuyafwww)\ **Replies:** 4\ **Last updated:** [July 18, 2022, 12:52pm UTC](https://discuss.elastic.co/t/how-to-reindex-a-field-with-source-disabled-and-store-true/309817 "2022-07-18T12:52:15Z")
I am currently looking to optimize the performance of indexing and search on fields with very large text in them. And I have already read the following articles and previous forum posts. Searching in a large text fiel… --- ## [Aggregate sum till specific threshold reached](https://discuss.elastic.co/t/aggregate-sum-till-specific-threshold-reached/309897)
**Author:** [@brampurnot](https://discuss.elastic.co/u/brampurnot)\ **Replies:** 0\ **Last updated:** [July 18, 2022, 12:27pm UTC](https://discuss.elastic.co/t/aggregate-sum-till-specific-threshold-reached/309897 "2022-07-18T12:27:16Z")
Hi all, We are storing products in an index. Each product has a price and a specific quantity. Now we want to get the list of cheapest products up till a maximum quantity of 100. The total quantity should be a sum aggr… --- ## [Available fields are not visible in the Discovery panel](https://discuss.elastic.co/t/available-fields-are-not-visible-in-the-discovery-panel/309781)
**Author:** [@random\_dash](https://discuss.elastic.co/u/random_dash)\ **Replies:** 1\ **Last updated:** [July 18, 2022, 12:25pm UTC](https://discuss.elastic.co/t/available-fields-are-not-visible-in-the-discovery-panel/309781 "2022-07-18T12:25:05Z")
Hello! I have some indices where a part of their corresponding template is like this: when I query the indices in the Dev Tools, I am able to retrieve desired data and see the above fields. For example you can c… --- ## [Hide Metricbeat Dashboard](https://discuss.elastic.co/t/hide-metricbeat-dashboard/309399)
**Author:** [@Diego\_Lima](https://discuss.elastic.co/u/Diego_Lima)\ **Replies:** 1\ **Last updated:** [July 18, 2022, 12:23pm UTC](https://discuss.elastic.co/t/hide-metricbeat-dashboard/309399 "2022-07-18T12:23:05Z")
Hello guys! I would like to know how I can hide only the metricbeat dashboard, for my anonymous login user. Note: I didn't upload an example image, because I'm getting the following error here: "Sorry, there was an err… --- ## [Problems With Winlogbeat](https://discuss.elastic.co/t/problems-with-winlogbeat/308508)
**Author:** [@Jared9922](https://discuss.elastic.co/u/Jared9922)\ **Replies:** 3\ **Last updated:** [July 18, 2022, 12:22pm UTC](https://discuss.elastic.co/t/problems-with-winlogbeat/308508 "2022-07-18T12:22:56Z")
Hello, I am trying to setup Winlogbeat and I am running into some issues. I was able to get it configured correctly and when I run it in debug mode it seems to run fine. .\\winlogbeat.exe -c winlogbeat.yml -e -v -d "\*" W… --- ## [Elastic charts with angular js](https://discuss.elastic.co/t/elastic-charts-with-angular-js/309656)
**Author:** [@frankgif](https://discuss.elastic.co/u/frankgif)\ **Replies:** 1\ **Last updated:** [July 18, 2022, 12:22pm UTC](https://discuss.elastic.co/t/elastic-charts-with-angular-js/309656 "2022-07-18T12:22:13Z")
How to integrate elastic charts with Angular application. Without having react framework --- ## [Automation of Data Analysis](https://discuss.elastic.co/t/automation-of-data-analysis/309879)
**Author:** [@elkstack2](https://discuss.elastic.co/u/elkstack2)\ **Replies:** 1\ **Last updated:** [July 18, 2022, 12:17pm UTC](https://discuss.elastic.co/t/automation-of-data-analysis/309879 "2022-07-18T12:17:46Z")
Hi all! I am interning at an organisation and have been asked to research automation in the ELK stack - I don't really know what I'm doing so any help would be appreciated! One of the increasingly large challenges my or… --- ## [Filebeat: Autodiscover with Nomad + Docker Metadata](https://discuss.elastic.co/t/filebeat-autodiscover-with-nomad-docker-metadata/309404)
**Author:** [@adsr](https://discuss.elastic.co/u/adsr)\ **Replies:** 2\ **Last updated:** [July 18, 2022, 12:10pm UTC](https://discuss.elastic.co/t/filebeat-autodiscover-with-nomad-docker-metadata/309404 "2022-07-18T12:10:26Z")
Hi everyone, I am currently struggling with adding the docker metadata to my events which are fetched via the filebeat autodiscover nomad provider. filebeat.yml tyfilebeat.autodiscover: providers: - type: nomad … --- ## [Elastic v8.3 Install Errors MacOS](https://discuss.elastic.co/t/elastic-v8-3-install-errors-macos/308690)
**Author:** [@Sameer\_Malik](https://discuss.elastic.co/u/Sameer_Malik)\ **Replies:** 3\ **Last updated:** [July 18, 2022, 11:59am UTC](https://discuss.elastic.co/t/elastic-v8-3-install-errors-macos/308690 "2022-07-18T11:59:24Z")
Elasticsearch Version 8.3.1 OS Version macOS 12.3.1 Problem Description I'm very new to Elasticsearch. I'm trying to install ES v8.3.1 on my Mac by following the instructions on the download website. However, once I ru… --- ## [Group by date with aggr and apply sub aggr with group by date in elastic search](https://discuss.elastic.co/t/group-by-date-with-aggr-and-apply-sub-aggr-with-group-by-date-in-elastic-search/309894)
**Author:** [@surendrakandira](https://discuss.elastic.co/u/surendrakandira)\ **Replies:** 0\ **Last updated:** [July 18, 2022, 11:49am UTC](https://discuss.elastic.co/t/group-by-date-with-aggr-and-apply-sub-aggr-with-group-by-date-in-elastic-search/309894 "2022-07-18T11:49:37Z")
How to implement below C# entity logic in Elasticsearch var queryable1 = queryable.GroupBy(g =\> g.Date).Select(x =\> new GroupChartDto() { DailyPnL = x.Sum(s =\> s.DailyPnL), Date = x.Key, AggregateSum = queryable.Whe… --- ## [In ES 7.8 parent breaker is tripping a lot and causing unallocation of shards](https://discuss.elastic.co/t/in-es-7-8-parent-breaker-is-tripping-a-lot-and-causing-unallocation-of-shards/309635)
**Author:** [@sreekanth](https://discuss.elastic.co/u/sreekanth)\ **Replies:** 2\ **Last updated:** [July 18, 2022, 10:58am UTC](https://discuss.elastic.co/t/in-es-7-8-parent-breaker-is-tripping-a-lot-and-causing-unallocation-of-shards/309635 "2022-07-18T10:58:08Z")
We have an 8 node cluster and our load (mainly bulk ingest) is pretty high. Earlier the same load was handled well by 6 nodes in ES6.8. Now after moving to 7.8, we see many replica shards get unallocated during load. al… --- ## [Overriding logstash access "remote\_host" with client IP - Spring Boot](https://discuss.elastic.co/t/overriding-logstash-access-remote-host-with-client-ip-spring-boot/309887)
**Author:** [@Wes1](https://discuss.elastic.co/u/Wes1)\ **Replies:** 0\ **Last updated:** [July 18, 2022, 10:57am UTC](https://discuss.elastic.co/t/overriding-logstash-access-remote-host-with-client-ip-spring-boot/309887 "2022-07-18T10:57:59Z")
Good day, Does anyone know how to override "remote\_host" field within logstash access. Currently we are logging the load balancer's IP. I would like to use the "X-Forwarded-For" header. Thank you. --- ## [Group by date with aggr and apply sub aggr with group by date in elastic search](https://discuss.elastic.co/t/group-by-date-with-aggr-and-apply-sub-aggr-with-group-by-date-in-elastic-search/309877)
**Author:** [@surendrakandira](https://discuss.elastic.co/u/surendrakandira)\ **Replies:** 0\ **Last updated:** [July 18, 2022, 10:23am UTC](https://discuss.elastic.co/t/group-by-date-with-aggr-and-apply-sub-aggr-with-group-by-date-in-elastic-search/309877 "2022-07-18T10:23:20Z")
I am trying to apply filter with aggregations. c# code , I want to apply this logic in elastic search queryable = queryable.OrderBy(o =\> o.Date).ToList(); var queryable1 = queryable.GroupBy(g =\> g… --- ## [Succeeded to take snapshot of closed Elasticsearch index with ignore\_unavailable=false](https://discuss.elastic.co/t/succeeded-to-take-snapshot-of-closed-elasticsearch-index-with-ignore-unavailable-false/309853)
**Author:** [@amirmono](https://discuss.elastic.co/u/amirmono)\ **Replies:** 2\ **Last updated:** [July 18, 2022, 9:19am UTC](https://discuss.elastic.co/t/succeeded-to-take-snapshot-of-closed-elasticsearch-index-with-ignore-unavailable-false/309853 "2022-07-18T09:19:48Z")
According to the Elasticsearch Create snapshot API documentation , when creating a manual snapshot of a closed index with ignore\_unavailable = false - the snapshot should fail: ignore\_unavailable (Optional, Boolean) If… --- ## [Connection problem at the second login](https://discuss.elastic.co/t/connection-problem-at-the-second-login/309851)
**Author:** [@tamir\_raviv](https://discuss.elastic.co/u/tamir_raviv)\ **Replies:** 3\ **Last updated:** [July 18, 2022, 8:51am UTC](https://discuss.elastic.co/t/connection-problem-at-the-second-login/309851 "2022-07-18T08:51:22Z")
Hey. Running elasticsearch locally. Using elasticsearch-8.3.2 and kibana-8.3.2. I'm able to run everything smoothly the first time. After some timeout, when i'm not running anything, Kibana asking me to login again when … --- ## [How do I extract partial fields from log.file.path](https://discuss.elastic.co/t/how-do-i-extract-partial-fields-from-log-file-path/309854)
**Author:** [@regyhuang](https://discuss.elastic.co/u/regyhuang)\ **Replies:** 0\ **Last updated:** [July 18, 2022, 7:36am UTC](https://discuss.elastic.co/t/how-do-i-extract-partial-fields-from-log-file-path/309854 "2022-07-18T07:36:11Z")
for example log.file.path:/data/logs/service-name/service-name.log I want to extract the service-name of log.file.path as a tags ,How to configure filebeat.yml --- ## [Cannot connect to elastic cluster on VPN machine](https://discuss.elastic.co/t/cannot-connect-to-elastic-cluster-on-vpn-machine/309848)
**Author:** [@Michal\_Bogusz](https://discuss.elastic.co/u/Michal_Bogusz)\ **Replies:** 2\ **Last updated:** [July 18, 2022, 7:43am UTC](https://discuss.elastic.co/t/cannot-connect-to-elastic-cluster-on-vpn-machine/309848 "2022-07-18T07:43:47Z")
Hi, I am new to Elasticsearch. What I managed to do so far is to bring up ElasticSearch container and successfully connect to it using both http connection(via Postman) and using python client. However, now I want to br… --- ## [Logstash http filter with JWT](https://discuss.elastic.co/t/logstash-http-filter-with-jwt/309856)
**Author:** [@pszemesy](https://discuss.elastic.co/u/pszemesy)\ **Replies:** 0\ **Last updated:** [July 18, 2022, 7:42am UTC](https://discuss.elastic.co/t/logstash-http-filter-with-jwt/309856 "2022-07-18T07:42:10Z")
Hi, I have to creat a Logstash pipeline where I have to enrich the data from Remedy. But Remedy requires JWT based authentication. Are there any way to use JWT token based authentication in http filter? Thanks. --- ## [Duplicate document](https://discuss.elastic.co/t/duplicate-document/309827)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 3\ **Last updated:** [July 18, 2022, 7:24am UTC](https://discuss.elastic.co/t/duplicate-document/309827 "2022-07-18T07:24:17Z")
I have few servers running metricbeats and all of them sends data to proxy server on port xyz then proxy redirects them to three logstash server in load balance manner. all three logstash runs same configuration via pi… --- ## [Elasticsearch.Net.ElasticsearchClientException: BulkAll halted after failed product check](https://discuss.elastic.co/t/elasticsearch-net-elasticsearchclientexception-bulkall-halted-after-failed-product-check/309076)
**Author:** [@dawood\_ahmad](https://discuss.elastic.co/u/dawood_ahmad)\ **Replies:** 2\ **Last updated:** [July 18, 2022, 5:09am UTC](https://discuss.elastic.co/t/elasticsearch-net-elasticsearchclientexception-bulkall-halted-after-failed-product-check/309076 "2022-07-18T05:09:23Z")
Unhandled exception. Elasticsearch.Net.ElasticsearchClientException: BulkAll halted after failed product check at Nest.BlockingSubscribeExtensions.WaitOnObservable\[TObservable,TObserve,TObserver\](TObservable observabl… --- ## [Create user in elastic with only read permssion](https://discuss.elastic.co/t/create-user-in-elastic-with-only-read-permssion/309829)
**Author:** [@superuser](https://discuss.elastic.co/u/superuser)\ **Replies:** 1\ **Last updated:** [July 18, 2022, 3:58am UTC](https://discuss.elastic.co/t/create-user-in-elastic-with-only-read-permssion/309829 "2022-07-18T03:58:24Z")
Hi Team, I am trying to create a user in Kibana, who will have access to only Dashboard and Discover tabs. an it possible to give only one index to the space where one will be able to just view (in discover ) the visua… --- ## [How to add an additional ingest pipeline to filebeat when using a module](https://discuss.elastic.co/t/how-to-add-an-additional-ingest-pipeline-to-filebeat-when-using-a-module/309834)
**Author:** [@Zack1](https://discuss.elastic.co/u/Zack1)\ **Replies:** 5\ **Last updated:** [July 18, 2022, 3:06am UTC](https://discuss.elastic.co/t/how-to-add-an-additional-ingest-pipeline-to-filebeat-when-using-a-module/309834 "2022-07-18T03:06:59Z")
I have apache logs, so I use the apache module in filebeat. However, I also want to apply an ingest pipeline I have made that adds an email field, but apparently the output.elasticsearch.pipeline option doesn't work when… --- ## [What indexes will be used during elastic search?](https://discuss.elastic.co/t/what-indexes-will-be-used-during-elastic-search/309819)
**Author:** [@davecomputertips](https://discuss.elastic.co/u/davecomputertips)\ **Replies:** 7\ **Last updated:** [July 18, 2022, 3:06am UTC](https://discuss.elastic.co/t/what-indexes-will-be-used-during-elastic-search/309819 "2022-07-18T03:06:28Z")
I am confused because this is ambiguous question. Is it asking about inverted index? Or this? My teacher died last week and we haven't got a new teacher yet :frowning: RIP --- ## [Single JSON document parsed as individual key pair in logstash](https://discuss.elastic.co/t/single-json-document-parsed-as-individual-key-pair-in-logstash/309787)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 1\ **Last updated:** [July 18, 2022, 3:00am UTC](https://discuss.elastic.co/t/single-json-document-parsed-as-individual-key-pair-in-logstash/309787 "2022-07-18T03:00:27Z")
Hello, I hope my message find the community members and their loved ones safe and healthy. I am trying to ingest ~30,000 documents which are API responses with selective keys stored as a JSON document. \[ { … --- ## [Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch](https://discuss.elastic.co/t/failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/309477)
**Author:** [@Nishi\_Shah](https://discuss.elastic.co/u/Nishi_Shah)\ **Replies:** 2\ **Last updated:** [July 17, 2022, 10:53pm UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/309477 "2022-07-17T22:53:44Z")
I am trying to configure filebeat(7.17.5). when i restart filebeat only status is showing active \[root@ELK-LAB-VM filebeat\]# systemctl status filebeat ● filebeat.service - Filebeat sends log files to Logstash or dir… --- ## [How to parse CRI logs](https://discuss.elastic.co/t/how-to-parse-cri-logs/309814)
**Author:** [@redoran](https://discuss.elastic.co/u/redoran)\ **Replies:** 0\ **Last updated:** [July 17, 2022, 10:35am UTC](https://discuss.elastic.co/t/how-to-parse-cri-logs/309814 "2022-07-17T10:35:33Z")
Hello, (sry for my english) I'm trying to parse CRI logs. Logs not in JSON format are not parsed. An example of logs that are parsed correctly 2022-07-15T14:50:51.994932036Z stdout F {"@timestamp":"timestamp","@versio… --- ## [How to determine number of master nodes](https://discuss.elastic.co/t/how-to-determine-number-of-master-nodes/309780)
**Author:** [@wisam\_9mol](https://discuss.elastic.co/u/wisam_9mol)\ **Replies:** 10\ **Last updated:** [July 17, 2022, 9:37am UTC](https://discuss.elastic.co/t/how-to-determine-number-of-master-nodes/309780 "2022-07-17T09:37:58Z")
Is there a way to find out how many master nodes I need for a number of data nodes For example If I have 100 data nodes, how many masters nodes do I need? In the case of 12 data nodes Or 18 data nodes --- ## [Is there a way to place one or more elasticsearch shards on a separate disk?](https://discuss.elastic.co/t/is-there-a-way-to-place-one-or-more-elasticsearch-shards-on-a-separate-disk/309797)
**Author:** [@jalustig](https://discuss.elastic.co/u/jalustig)\ **Replies:** 5\ **Last updated:** [July 17, 2022, 8:21am UTC](https://discuss.elastic.co/t/is-there-a-way-to-place-one-or-more-elasticsearch-shards-on-a-separate-disk/309797 "2022-07-17T08:21:52Z")
I have a large elasticsearch index which is stored on an external blob storage device attached to my server, but I also have a large amount of free space on the main hard disk. Id like to put that space to use, if possib… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=861) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=863)