# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=886

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 887

---

## [Elastic search query to check if property is empty/non-empty](https://discuss.elastic.co/t/elastic-search-query-to-check-if-property-is-empty-non-empty/308290)

<div class="topic-metadata">

**Author:** [@newelastic](https://discuss.elastic.co/u/newelastic)\
**Replies:** 1\
**Last updated:** [June 27, 2022, 9:12pm UTC](https://discuss.elastic.co/t/elastic-search-query-to-check-if-property-is-empty-non-empty/308290 "2022-06-27T21:12:14Z")

</div>

Hello, I was trying to find out all my documents which has property with empty value or non-empty value. The type of this property is "keyword". I'm using ES 6.8.1 version. I couldn't find anything in the documentation…

---

## [Unable to launch elasticsearch from bat file in windows 10](https://discuss.elastic.co/t/unable-to-launch-elasticsearch-from-bat-file-in-windows-10/308197)

<div class="topic-metadata">

**Author:** [@Halim\_Dris](https://discuss.elastic.co/u/Halim_Dris)\
**Replies:** 2\
**Last updated:** [June 27, 2022, 8:50pm UTC](https://discuss.elastic.co/t/unable-to-launch-elasticsearch-from-bat-file-in-windows-10/308197 "2022-06-27T20:50:17Z")

</div>

elasticsearch-8.2.3 Running elasticsearch with echo on. D:\\Elastic\\elasticsearch-8.2.3\\bin\>elasticsearch D:\\Elastic\\elasticsearch-8.2.3\\bin\>setlocal enabledelayedexpansion D:\\Elastic\\elasticsearch-8.2.3\\bin\>setlo…

---

## [How multiple logstash nodes read the same file without duplicate data?](https://discuss.elastic.co/t/how-multiple-logstash-nodes-read-the-same-file-without-duplicate-data/308285)

<div class="topic-metadata">

**Author:** [@Thuy\_Le1](https://discuss.elastic.co/u/Thuy_Le1)\
**Replies:** 1\
**Last updated:** [June 27, 2022, 6:41pm UTC](https://discuss.elastic.co/t/how-multiple-logstash-nodes-read-the-same-file-without-duplicate-data/308285 "2022-06-27T18:41:07Z")

</div>

I have multiple files, and multiple logstash nodes. how to setup multiple logstash nodes read the same file without duplicate data

---

## [How to change the value of environment variable in logstash?](https://discuss.elastic.co/t/how-to-change-the-value-of-environment-variable-in-logstash/308283)

<div class="topic-metadata">

**Author:** [@Thuy\_Le1](https://discuss.elastic.co/u/Thuy_Le1)\
**Replies:** 1\
**Last updated:** [June 27, 2022, 6:38pm UTC](https://discuss.elastic.co/t/how-to-change-the-value-of-environment-variable-in-logstash/308283 "2022-06-27T18:38:27Z")

</div>

How to change the value of environment variable in logstash? ruby { code =\> "ENV\[test\] = 1000" } =\> doesnot work

---

## [How to create auto rollover index names without "-\\\\d+$" pattern at the end?](https://discuss.elastic.co/t/how-to-create-auto-rollover-index-names-without-d-pattern-at-the-end/308284)

<div class="topic-metadata">

**Author:** [@thomas708](https://discuss.elastic.co/u/thomas708)\
**Replies:** 1\
**Last updated:** [June 27, 2022, 6:10pm UTC](https://discuss.elastic.co/t/how-to-create-auto-rollover-index-names-without-d-pattern-at-the-end/308284 "2022-06-27T18:10:54Z")

</div>

I'm using ILM to create daily auto rollover indices with dates in the index names. If bootstrap the initial index with following then it works. The next index auto created will be "test-2022.06.17-000002", then "test-2…

---

## [Index - Field Mapping](https://discuss.elastic.co/t/index-field-mapping/308205)

<div class="topic-metadata">

**Author:** [@rkummitha](https://discuss.elastic.co/u/rkummitha)\
**Replies:** 1\
**Last updated:** [June 27, 2022, 6:09pm UTC](https://discuss.elastic.co/t/index-field-mapping/308205 "2022-06-27T18:09:04Z")

</div>

Hi, I am new to ELK, Data is ingested to Index, and could see only few fields when I search the index events in discover window. Can you please help me to Map all the fields that are part of the JSON files. Thanks Rav…

---

## [Certificate invalid](https://discuss.elastic.co/t/certificate-invalid/306875)

<div class="topic-metadata">

**Author:** [@ftayyab](https://discuss.elastic.co/u/ftayyab)\
**Replies:** 4\
**Last updated:** [June 27, 2022, 5:53pm UTC](https://discuss.elastic.co/t/certificate-invalid/306875 "2022-06-27T17:53:42Z")

</div>

Hello, I am running Elasticsearch locally with default configuration out of the box. When I try to browse to https://localhost:9200, I get Privacy error in chrome, saying that connection is not private. I know that duri…

---

## [Elasticsearch Elastic Agent integration (not via Filebeat/Metricbeat)](https://discuss.elastic.co/t/elasticsearch-elastic-agent-integration-not-via-filebeat-metricbeat/308147)

<div class="topic-metadata">

**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\
**Replies:** 2\
**Last updated:** [June 27, 2022, 4:44pm UTC](https://discuss.elastic.co/t/elasticsearch-elastic-agent-integration-not-via-filebeat-metricbeat/308147 "2022-06-27T16:44:05Z")

</div>

A few days ago I noticed that there was an actual Elasticsearch monitoring integration available when browsing through the available integrations in Kibana. So I figured I'd upgrade to 8.2.3 and then enable that for mon…

---

## [Is it possibe to embed iframes into Kibana Canvas](https://discuss.elastic.co/t/is-it-possibe-to-embed-iframes-into-kibana-canvas/307932)

<div class="topic-metadata">

**Author:** [@Rorschach\_Ye](https://discuss.elastic.co/u/Rorschach_Ye)\
**Replies:** 1\
**Last updated:** [June 27, 2022, 4:21pm UTC](https://discuss.elastic.co/t/is-it-possibe-to-embed-iframes-into-kibana-canvas/307932 "2022-06-27T16:21:16Z")

</div>

Hi, May I ask that is it possible to embed an iframe from an external link in Kibana Canvas? Or will it be possible update in the future ? Example like this below: From PRTG Map \<iframe width=1521 height=2160 fra…

---

## [Add Cumulative sum and cumul %](https://discuss.elastic.co/t/add-cumulative-sum-and-cumul/307884)

<div class="topic-metadata">

**Author:** [@yasser\_elalami](https://discuss.elastic.co/u/yasser_elalami)\
**Replies:** 1\
**Last updated:** [June 27, 2022, 4:09pm UTC](https://discuss.elastic.co/t/add-cumulative-sum-and-cumul/307884 "2022-06-27T16:09:22Z")

</div>

hello iam new in kibana so i need some help as you can see i need to add some formula like this THANK YOU

---

## [Logstash HA](https://discuss.elastic.co/t/logstash-ha/307946)

<div class="topic-metadata">

**Author:** [@priyankamondalhcl](https://discuss.elastic.co/u/priyankamondalhcl)\
**Replies:** 3\
**Last updated:** [June 27, 2022, 3:58pm UTC](https://discuss.elastic.co/t/logstash-ha/307946 "2022-06-27T15:58:29Z")

</div>

Hi Team, I am using logstash component for collecting/transforming data and then send to pubsubLite. Now there are cases to collect data using push mechanism (other sources are pushing data to logstash component) as wel…

---

## [Single execution of logstash pipeline on demand](https://discuss.elastic.co/t/single-execution-of-logstash-pipeline-on-demand/306769)

<div class="topic-metadata">

**Author:** [@Jonas\_S](https://discuss.elastic.co/u/Jonas_S)\
**Replies:** 5\
**Last updated:** [June 27, 2022, 3:57pm UTC](https://discuss.elastic.co/t/single-execution-of-logstash-pipeline-on-demand/306769 "2022-06-27T15:57:01Z")

</div>

Hello, i have a logstash 8.2 instance running with multiple scheduled pipelines. What is the best way to start another logstash pipeline on demand for a single execution on the same logstash instance without restarting…

---

## [\[Discover\] Search Bar Preview trims field names](https://discuss.elastic.co/t/discover-search-bar-preview-trims-field-names/306242)

<div class="topic-metadata">

**Author:** [@TimoM](https://discuss.elastic.co/u/TimoM)\
**Replies:** 1\
**Last updated:** [June 27, 2022, 3:53pm UTC](https://discuss.elastic.co/t/discover-search-bar-preview-trims-field-names/306242 "2022-06-27T15:53:23Z")

</div>

Hey, I'm using Kibana 8.1.0 and when I try to search for certain fields in the tab "Discover", fields which are longer than a specific length are trimmed. Have a look at the Screenshot: For Example the full name is r…

---

## [Enable login page for basic user authetication in Kibana](https://discuss.elastic.co/t/enable-login-page-for-basic-user-authetication-in-kibana/306208)

<div class="topic-metadata">

**Author:** [@eduhernandezm](https://discuss.elastic.co/u/eduhernandezm)\
**Replies:** 1\
**Last updated:** [June 27, 2022, 3:20pm UTC](https://discuss.elastic.co/t/enable-login-page-for-basic-user-authetication-in-kibana/306208 "2022-06-27T15:20:37Z")

</div>

Good morning, I have the following problem. I have installed ELK version 8 on three different servers, one for each service. Now what I am trying to enable basic user authentication so that the login page is enabled in …

---

## [Increase or decrease font size of values and field headers in a data table](https://discuss.elastic.co/t/increase-or-decrease-font-size-of-values-and-field-headers-in-a-data-table/306196)

<div class="topic-metadata">

**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\
**Replies:** 1\
**Last updated:** [June 27, 2022, 3:16pm UTC](https://discuss.elastic.co/t/increase-or-decrease-font-size-of-values-and-field-headers-in-a-data-table/306196 "2022-06-27T15:16:21Z")

</div>

Hi all, I'm trying to decrease the font size of values and field headers in a data table for my custom look.. Any way we can increase or decrease font size of values that we display

---

## [Upload csv fle in elasticsearch using filebeat](https://discuss.elastic.co/t/upload-csv-fle-in-elasticsearch-using-filebeat/306018)

<div class="topic-metadata">

**Author:** [@safaeaz](https://discuss.elastic.co/u/safaeaz)\
**Replies:** 1\
**Last updated:** [June 27, 2022, 3:09pm UTC](https://discuss.elastic.co/t/upload-csv-fle-in-elasticsearch-using-filebeat/306018 "2022-06-27T15:09:53Z")

</div>

i'm trying to load csv file in Elasticsearch using filebeat here is my filebeat.yml filebeat.inputs: #- type: log - type: stdin setup.template.overwrite: true enabled: true close\_eof: true paths: - /usr/sh…

---

## [Increment date field watcher](https://discuss.elastic.co/t/increment-date-field-watcher/308190)

<div class="topic-metadata">

**Author:** [@Cheroufa](https://discuss.elastic.co/u/Cheroufa)\
**Replies:** 5\
**Last updated:** [June 27, 2022, 2:39pm UTC](https://discuss.elastic.co/t/increment-date-field-watcher/308190 "2022-06-27T14:39:40Z")

</div>

hello team, i want to increment date field """ {{ctx.payload.second.time}} + 30m """ in watcher but i don't know how to do it, any idea ? my code : "input": { "chain": { "inputs": \[ { "first": { "search": { "req…

---

## [Elastic Agent - Sucessful Enrollment, but not updating beats configuration](https://discuss.elastic.co/t/elastic-agent-sucessful-enrollment-but-not-updating-beats-configuration/308044)

<div class="topic-metadata">

**Author:** [@hodops](https://discuss.elastic.co/u/hodops)\
**Replies:** 1\
**Last updated:** [June 27, 2022, 1:40pm UTC](https://discuss.elastic.co/t/elastic-agent-sucessful-enrollment-but-not-updating-beats-configuration/308044 "2022-06-27T13:40:34Z")

</div>

Elastic Agent Version: 7.17.4 Install method: APT OS: Ubuntu 18.04 Problem Description: I've installed Elastic Agent, and successfully enrolled it into the Fleet within my ES cluster. Within fleet the agent shows "H…

---

## [Elasticsearch (NO log stash) - Keys starting with dot in JSON field](https://discuss.elastic.co/t/elasticsearch-no-log-stash-keys-starting-with-dot-in-json-field/307570)

<div class="topic-metadata">

**Author:** [@M2r12n0](https://discuss.elastic.co/u/M2r12n0)\
**Replies:** 2\
**Last updated:** [June 27, 2022, 1:35pm UTC](https://discuss.elastic.co/t/elasticsearch-no-log-stash-keys-starting-with-dot-in-json-field/307570 "2022-06-27T13:35:43Z")

</div>

Hi, Sorry for bothering with this, but I can not resolve it yet. I need to ingest a JSON type field but some of the keys starts with dots, something like this: { '.house.door' : 'nice', '.car.window' : 'blue' } I …

---

## [Vega chart has to display "No data to display" string](https://discuss.elastic.co/t/vega-chart-has-to-display-no-data-to-display-string/308229)

<div class="topic-metadata">

**Author:** [@Jovian\_Aswin](https://discuss.elastic.co/u/Jovian_Aswin)\
**Replies:** 1\
**Last updated:** [June 27, 2022, 1:28pm UTC](https://discuss.elastic.co/t/vega-chart-has-to-display-no-data-to-display-string/308229 "2022-06-27T13:28:17Z")

</div>

Vega chart has to display "No data to display" string when it has no data for the field flow.bytes over flow.src\_hostname and flow.dst\_hostname. But it display the a string "Infinite extent for field "y1": \[Infinity, -I…

---

## [How to invoke oracle DB Package and store the cursor in the Elastic cache](https://discuss.elastic.co/t/how-to-invoke-oracle-db-package-and-store-the-cursor-in-the-elastic-cache/308257)

<div class="topic-metadata">

**Author:** [@umesh\_choudary](https://discuss.elastic.co/u/umesh_choudary)\
**Replies:** 0\
**Last updated:** [June 27, 2022, 1:24pm UTC](https://discuss.elastic.co/t/how-to-invoke-oracle-db-package-and-store-the-cursor-in-the-elastic-cache/308257 "2022-06-27T13:24:39Z")

</div>

HI, we have requirement to invoke a Oracle DB function which is created in the package. and it returns a cursor object. we need to store the cursor object into Elastic cache. invoking the function using statement filep…

---

## [Create TSVB VIZ on Financial Data without any Weekends gap in the viz](https://discuss.elastic.co/t/create-tsvb-viz-on-financial-data-without-any-weekends-gap-in-the-viz/308186)

<div class="topic-metadata">

**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\
**Replies:** 1\
**Last updated:** [June 27, 2022, 12:46pm UTC](https://discuss.elastic.co/t/create-tsvb-viz-on-financial-data-without-any-weekends-gap-in-the-viz/308186 "2022-06-27T12:46:44Z")

</div>

Hi, I am building TSVB VIZ. I have Daily Historical Financial Data. On Weekends Financial markets are closed.So no data is pushed to the index. Due to which seeing gaps in the in viz. I don't want to see the gaps. Pls …

---

## [Delete vs deletebyquery](https://discuss.elastic.co/t/delete-vs-deletebyquery/308183)

<div class="topic-metadata">

**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\
**Replies:** 7\
**Last updated:** [June 27, 2022, 11:54am UTC](https://discuss.elastic.co/t/delete-vs-deletebyquery/308183 "2022-06-27T11:54:59Z")

</div>

Hi, I want to delete over 10 million documents. Which approach is better and faster? Loop and delete each document with DELETE //\_doc/\<\_id\> OR perform deletebyquery? Thanks...

---

## [Transform with fixed time interval and different sync delay](https://discuss.elastic.co/t/transform-with-fixed-time-interval-and-different-sync-delay/308075)

<div class="topic-metadata">

**Author:** [@Avarjana](https://discuss.elastic.co/u/Avarjana)\
**Replies:** 2\
**Last updated:** [June 27, 2022, 11:37am UTC](https://discuss.elastic.co/t/transform-with-fixed-time-interval-and-different-sync-delay/308075 "2022-06-27T11:37:51Z")

</div>

I have a transform to identify anomaly and trigger alert in one of my index. Following are the details of the behavior. Expected behavior For each minute, aggregate last 5 minutes data and check for alerts. …

---

## [Separate device in logstash based on the destination port](https://discuss.elastic.co/t/separate-device-in-logstash-based-on-the-destination-port/308235)

<div class="topic-metadata">

**Author:** [@abd\_sh](https://discuss.elastic.co/u/abd_sh)\
**Replies:** 0\
**Last updated:** [June 27, 2022, 10:44am UTC](https://discuss.elastic.co/t/separate-device-in-logstash-based-on-the-destination-port/308235 "2022-06-27T10:44:02Z")

</div>

Hello, i hope you are doing well. i am trying to separate device in logstash based on the destination port. i am using the below config file "input { udp { port =\> 5014} udp { port =\> 5015 } } filter { if port =…

---

## [Delete by query and date range causes unexpected "version\_conflict\_engine\_exception", 409 response](https://discuss.elastic.co/t/delete-by-query-and-date-range-causes-unexpected-version-conflict-engine-exception-409-response/308227)

<div class="topic-metadata">

**Author:** [@bizmate](https://discuss.elastic.co/u/bizmate)\
**Replies:** 0\
**Last updated:** [June 27, 2022, 9:49am UTC](https://discuss.elastic.co/t/delete-by-query-and-date-range-causes-unexpected-version-conflict-engine-exception-409-response/308227 "2022-06-27T09:49:22Z")

</div>

I am running a query to delete certain logs/entries before a certain date with a log level of "Debug" as shown here, notice the wildcard in the index name POST /my\_index\_prod\*/\_delete\_by\_query { "query": { "bool":…

---

## [Logstash Split input and save new event.original](https://discuss.elastic.co/t/logstash-split-input-and-save-new-event-original/308222)

<div class="topic-metadata">

**Author:** [@Gosborne](https://discuss.elastic.co/u/Gosborne)\
**Replies:** 0\
**Last updated:** [June 27, 2022, 9:11am UTC](https://discuss.elastic.co/t/logstash-split-input-and-save-new-event-original/308222 "2022-06-27T09:11:52Z")

</div>

Good Morning, I am trying to split up some JSON logs that are collected from an Eventhub and i'm running into a few issues. My logstash filter below works fine and splits the json based on a field called records, and t…

---

## [How dump/ingest nested API json data to elastic search](https://discuss.elastic.co/t/how-dump-ingest-nested-api-json-data-to-elastic-search/308221)

<div class="topic-metadata">

**Author:** [@azizullah2017](https://discuss.elastic.co/u/azizullah2017)\
**Replies:** 0\
**Last updated:** [June 27, 2022, 9:03am UTC](https://discuss.elastic.co/t/how-dump-ingest-nested-api-json-data-to-elastic-search/308221 "2022-06-27T09:03:33Z")

</div>

looking for help for large scale API calls of http like hundres if api call, trying to automate them with cron job. I am looking for solution where I can get data from different nested REST API and dump them on Elastics…

---

## [Error Enroll agent Centos](https://discuss.elastic.co/t/error-enroll-agent-centos/308218)

<div class="topic-metadata">

**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\
**Replies:** 0\
**Last updated:** [June 27, 2022, 8:11am UTC](https://discuss.elastic.co/t/error-enroll-agent-centos/308218 "2022-06-27T08:11:23Z")

</div>

hi guys, i have many centos server. but why in my other centos is failed to enroll agent Error: could not read configuration file /var/lib/elastic-agent/elastic-agent.yml: open /var/lib/elastic-agent/elastic-agent.yml: …

---

## [Sorting Vega](https://discuss.elastic.co/t/sorting-vega/307608)

<div class="topic-metadata">

**Author:** [@Yashwini\_Daphne](https://discuss.elastic.co/u/Yashwini_Daphne)\
**Replies:** 2\
**Last updated:** [June 27, 2022, 7:53am UTC](https://discuss.elastic.co/t/sorting-vega/307608 "2022-06-27T07:53:36Z")

</div>

Not able to sort Kibana Vega graph using sort command, Only dates are getting sorted, but not the bars, Could anyone plz help with the issue

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=885)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=887)