# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=889 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 890 --- ## [How to add a Runtime Field for doc ingest time?](https://discuss.elastic.co/t/how-to-add-a-runtime-field-for-doc-ingest-time/305793)
**Author:** [@ykara84](https://discuss.elastic.co/u/ykara84)\ **Replies:** 2\ **Last updated:** [June 24, 2022, 11:15am UTC](https://discuss.elastic.co/t/how-to-add-a-runtime-field-for-doc-ingest-time/305793 "2022-06-24T11:15:08Z")
Hi, i'm trying to add a Runtime Field to an index-pattern which will add a new field to each doc as it arrives into the index, the new field is to contain the date/time the doc was added to the index, a field called some… --- ## [Disable incremental searching on Kibana dashboard visualize](https://discuss.elastic.co/t/disable-incremental-searching-on-kibana-dashboard-visualize/308089)
**Author:** [@rogerlee](https://discuss.elastic.co/u/rogerlee)\ **Replies:** 1\ **Last updated:** [June 24, 2022, 11:04am UTC](https://discuss.elastic.co/t/disable-incremental-searching-on-kibana-dashboard-visualize/308089 "2022-06-24T11:04:31Z")
Hi Experts, I am creating a dashboard for our customer. I found if we click a visualize, a filtering will be triggered automatically for all dashboards. Can I disable the click to filtering feature on visualize? Because… --- ## [Canvas - Error in populate dynamic variable/parameter](https://discuss.elastic.co/t/canvas-error-in-populate-dynamic-variable-parameter/307131)
**Author:** [@Chiaaa](https://discuss.elastic.co/u/Chiaaa)\ **Replies:** 2\ **Last updated:** [June 24, 2022, 10:49am UTC](https://discuss.elastic.co/t/canvas-error-in-populate-dynamic-variable-parameter/307131 "2022-06-24T10:49:12Z")
Hi ! I'm trying to create a Data Table in canvas. I would like to add 3 columns in my table: Asset Volumes (as a count of record) % On Total (as Asset Volumes/Total Volumes) I create the follow script in espression … --- ## [Time taken by ELK stack to create indices](https://discuss.elastic.co/t/time-taken-by-elk-stack-to-create-indices/307836)
**Author:** [@Divyank\_Garg](https://discuss.elastic.co/u/Divyank_Garg)\ **Replies:** 7\ **Last updated:** [June 24, 2022, 10:36am UTC](https://discuss.elastic.co/t/time-taken-by-elk-stack-to-create-indices/307836 "2022-06-24T10:36:13Z")
How much time does it take to create indices using ELK services via docker-compose file? We process total 450 files of total size of 4.6GB to create 450 indices. All these files are basically the log files. It takes aro… --- ## [Mutate - Geopoint - Copy Field](https://discuss.elastic.co/t/mutate-geopoint-copy-field/308095)
**Author:** [@shubham184](https://discuss.elastic.co/u/shubham184)\ **Replies:** 0\ **Last updated:** [June 24, 2022, 9:37am UTC](https://discuss.elastic.co/t/mutate-geopoint-copy-field/308095 "2022-06-24T09:37:21Z")
I need to convert 2 Fields (doc.geoLat and doc.geoLong) to geopoint datatype. I tried the following but it dosen't work Could you please show me where I might be making a mistake if \[type\] == \\"xxxxx\\" { … --- ## [Need-Help-On-elasticsearch in complex scenario](https://discuss.elastic.co/t/need-help-on-elasticsearch-in-complex-scenario/308074)
**Author:** [@yeziblo](https://discuss.elastic.co/u/yeziblo)\ **Replies:** 2\ **Last updated:** [June 24, 2022, 8:54am UTC](https://discuss.elastic.co/t/need-help-on-elasticsearch-in-complex-scenario/308074 "2022-06-24T08:54:48Z")
Hi team, I need your help with a very complex scenario. We have a user management system, which has a user index, which stores various attributes of user, and a user action log index, which records what the user has don… --- ## [Is there away to get a random word/words from a document?](https://discuss.elastic.co/t/is-there-away-to-get-a-random-word-words-from-a-document/307470)
**Author:** [@Tasdiq\_Shaikh](https://discuss.elastic.co/u/Tasdiq_Shaikh)\ **Replies:** 3\ **Last updated:** [June 24, 2022, 8:37am UTC](https://discuss.elastic.co/t/is-there-away-to-get-a-random-word-words-from-a-document/307470 "2022-06-24T08:37:27Z")
I want to display some random words on the screen which are present in the document. I'm using Elasticsearch 7.12. --- ## [Elastic Search Index Refresh Interval elastic.yaml file in Kubernetes](https://discuss.elastic.co/t/elastic-search-index-refresh-interval-elastic-yaml-file-in-kubernetes/308041)
**Author:** [@krishnav1](https://discuss.elastic.co/u/krishnav1)\ **Replies:** 1\ **Last updated:** [June 24, 2022, 7:58am UTC](https://discuss.elastic.co/t/elastic-search-index-refresh-interval-elastic-yaml-file-in-kubernetes/308041 "2022-06-24T07:58:43Z")
I am new to Elasticsearch. I have a 3 data node and 3 master node elastic cluster deployed in Kubernetes. It was working well until recently there is a large intake of data. Now, I am in a stage where I need to apply ind… --- ## [Where can I add actions to Auditbeat or Filebeat?](https://discuss.elastic.co/t/where-can-i-add-actions-to-auditbeat-or-filebeat/308081)
**Author:** [@Shadow\_CHN](https://discuss.elastic.co/u/Shadow_CHN)\ **Replies:** 0\ **Last updated:** [June 24, 2022, 6:52am UTC](https://discuss.elastic.co/t/where-can-i-add-actions-to-auditbeat-or-filebeat/308081 "2022-06-24T06:52:19Z")
If the contents of event.action that Auditbeat already provided me doesn't enough, or I want to add a field which means event.action for the logs Filebeat collected. How can I make this happen? Also I want to know how m… --- ## [Elasticsearch stopwords at query time](https://discuss.elastic.co/t/elasticsearch-stopwords-at-query-time/308084)
**Author:** [@theju0805](https://discuss.elastic.co/u/theju0805)\ **Replies:** 1\ **Last updated:** [June 24, 2022, 7:03am UTC](https://discuss.elastic.co/t/elasticsearch-stopwords-at-query-time/308084 "2022-06-24T07:03:59Z")
Hi , We are using Elasticsearch 7.10 which is an opensearch and we are trying to enable stopwords at search time, when the file gets updated. There is a stopword file in AWS s3 bucket and when stopword file has been mo… --- ## [Parse json in the filed message](https://discuss.elastic.co/t/parse-json-in-the-filed-message/308079)
**Author:** [@Rustam\_Kulnazarov](https://discuss.elastic.co/u/Rustam_Kulnazarov)\ **Replies:** 0\ **Last updated:** [June 24, 2022, 6:44am UTC](https://discuss.elastic.co/t/parse-json-in-the-filed-message/308079 "2022-06-24T06:44:24Z")
Hello everyone! Tell me please, how can I parse json in the field message, if the message has: 2022-06-24 12:35:53 # {json structure}\\n text text\\n text --- ## [FATAL Error: Unable to complete saved object migrations for the \[.kibana-7.17.1-ssl\] index: Unable to complete the UPDATE\_TARGET\_MAPPINGS\_WAIT\_FOR\_TASK step after 15 attempts, terminating](https://discuss.elastic.co/t/fatal-error-unable-to-complete-saved-object-migrations-for-the-kibana-7-17-1-ssl-index-unable-to-complete-the-update-target-mappings-wait-for-task-step-after-15-attempts-terminating/308076)
**Author:** [@nghia\_huynh](https://discuss.elastic.co/u/nghia_huynh)\ **Replies:** 0\ **Last updated:** [June 24, 2022, 5:24am UTC](https://discuss.elastic.co/t/fatal-error-unable-to-complete-saved-object-migrations-for-the-kibana-7-17-1-ssl-index-unable-to-complete-the-update-target-mappings-wait-for-task-step-after-15-attempts-terminating/308076 "2022-06-24T05:24:31Z")
Dear Team, I have an issue relative to restarting Kibana. Every time I have this issue, I have to delete the .kibana\* index and start again, but I don't want to delete the .kibana\* index because of data loss. Also, I d… --- ## [Fixed interval in date histogram error](https://discuss.elastic.co/t/fixed-interval-in-date-histogram-error/308071)
**Author:** [@yeylatte](https://discuss.elastic.co/u/yeylatte)\ **Replies:** 0\ **Last updated:** [June 24, 2022, 3:21am UTC](https://discuss.elastic.co/t/fixed-interval-in-date-histogram-error/308071 "2022-06-24T03:21:51Z")
Elasticsearch Version 7.17.4 Java Version 1.8.0 OS Version Linux Problem Description I use date\_histogram aggregation from Elasticsearch with fixed\_interval of 7d in time range from 2022-06-18 to 2022-07-01(14days… --- ## [Slow speed of ANN dense vector search using \_knn\_search](https://discuss.elastic.co/t/slow-speed-of-ann-dense-vector-search-using-knn-search/307448)
**Author:** [@jalustig](https://discuss.elastic.co/u/jalustig)\ **Replies:** 7\ **Last updated:** [June 24, 2022, 2:40am UTC](https://discuss.elastic.co/t/slow-speed-of-ann-dense-vector-search-using-knn-search/307448 "2022-06-24T02:40:03Z")
I'm building out a vector search application with 384 dimensional vectors. So far I have about 3 million documents in my Elasticsearch database using with a dense\_vector field. There are currently 8 shards (I am expectin… --- ## [Question regarding using a logo](https://discuss.elastic.co/t/question-regarding-using-a-logo/308027)
**Author:** [@Marko\_Todoric](https://discuss.elastic.co/u/Marko_Todoric)\ **Replies:** 1\ **Last updated:** [June 24, 2022, 12:15am UTC](https://discuss.elastic.co/t/question-regarding-using-a-logo/308027 "2022-06-24T00:15:51Z")
Hello everyone I'm creating an addon for an open source project that would essentially be filebeat and will be used to ship logs to user self-hosted elasticsearch cluster/node so they can store and/or analyze logs. I wo… --- ## [How to ship logs from filebeat to elasticsearch](https://discuss.elastic.co/t/how-to-ship-logs-from-filebeat-to-elasticsearch/308039)
**Author:** [@gisellecarballo](https://discuss.elastic.co/u/gisellecarballo)\ **Replies:** 2\ **Last updated:** [June 24, 2022, 12:10am UTC](https://discuss.elastic.co/t/how-to-ship-logs-from-filebeat-to-elasticsearch/308039 "2022-06-24T00:10:26Z")
Hi Everyone, I am trying to form a setup where my cisco devices syslog to be sent to filebeat and then filebeat will send it to elasticsearch so that it can be viewed on kibana. Problem: Filebeat error is The requested… --- ## [Metricbeat error about scanning empty io.stat file](https://discuss.elastic.co/t/metricbeat-error-about-scanning-empty-io-stat-file/308063)
**Author:** [@matutter](https://discuss.elastic.co/u/matutter)\ **Replies:** 0\ **Last updated:** [June 23, 2022, 11:53pm UTC](https://discuss.elastic.co/t/metricbeat-error-about-scanning-empty-io-stat-file/308063 "2022-06-23T23:53:52Z")
I'm deploying metricbeat and using the system and docker modules but keep getting an error message in my logs. My configs are below. The content of /hostfs/sys/fs/cgroup/io.stat on my system is nothing - it is an empty f… --- ## [Filebeat error: fail to execute the HTTP GET request: Get "https://172.30.169.50:5000/api/status": x509: certificate signed by unknown authority](https://discuss.elastic.co/t/filebeat-error-fail-to-execute-the-http-get-request-get-https-172-30-169-50-5000-api-status-x509-certificate-signed-by-unknown-authority/308057)
**Author:** [@gisellecarballo](https://discuss.elastic.co/u/gisellecarballo)\ **Replies:** 1\ **Last updated:** [June 23, 2022, 10:45pm UTC](https://discuss.elastic.co/t/filebeat-error-fail-to-execute-the-http-get-request-get-https-172-30-169-50-5000-api-status-x509-certificate-signed-by-unknown-authority/308057 "2022-06-23T22:45:21Z")
Hi Team, Anyone had an idea why I am getting this error while setting up filebeat. Thanks so much. \ Exiting: error connecting to Kibana: fail to get the Kibana version: HTTP GET request to https://172.30.169.50:5000… --- ## [Struggling to replace a string in a syslog message with sub](https://discuss.elastic.co/t/struggling-to-replace-a-string-in-a-syslog-message-with-sub/307809)
**Author:** [@ddaloia](https://discuss.elastic.co/u/ddaloia)\ **Replies:** 4\ **Last updated:** [June 23, 2022, 10:36pm UTC](https://discuss.elastic.co/t/struggling-to-replace-a-string-in-a-syslog-message-with-sub/307809 "2022-06-23T22:36:45Z")
Hi Friends. I am taking in cef syslog messages from an application called Secret Server. The messages are not parsing correctly because some of the fields usernames have a slash in the username. The format is domain\\user… --- ## [Connect azure](https://discuss.elastic.co/t/connect-azure/308058)
**Author:** [@A\_j\_xx](https://discuss.elastic.co/u/A_j_xx)\ **Replies:** 0\ **Last updated:** [June 23, 2022, 9:37pm UTC](https://discuss.elastic.co/t/connect-azure/308058 "2022-06-23T21:37:50Z")
Hi all , Is there a way to add azure account to snapshot repository from kibana console I tried this query but it turns out it does not work PUT /\_snapshot/repo\_with\_features { "type": "azure", "settings": { … --- ## [How to find events that match for every string expression on Kibana?](https://discuss.elastic.co/t/how-to-find-events-that-match-for-every-string-expression-on-kibana/307543)
**Author:** [@gabrsar](https://discuss.elastic.co/u/gabrsar)\ **Replies:** 2\ **Last updated:** [June 23, 2022, 9:26pm UTC](https://discuss.elastic.co/t/how-to-find-events-that-match-for-every-string-expression-on-kibana/307543 "2022-06-23T21:26:05Z")
Hi. In Kibana -\> Discovery. How can I make a search for all logs that contain all the phrases I want, in or out of order? For example, Logs that contain "Operation complete", "total amount" and "success", without logs … --- ## [Elasticsearch index settings locked due to unsupported setting](https://discuss.elastic.co/t/elasticsearch-index-settings-locked-due-to-unsupported-setting/308053)
**Author:** [@bren\_x](https://discuss.elastic.co/u/bren_x)\ **Replies:** 0\ **Last updated:** [June 23, 2022, 7:19pm UTC](https://discuss.elastic.co/t/elasticsearch-index-settings-locked-due-to-unsupported-setting/308053 "2022-06-23T19:19:33Z")
Hi, We are trying to upgrade our elasticsearch cluster from version 6.1 to version 6.8. While upgrading, we noticed that the index settings seem to be locked. Any command to change any index setting results in: { "er… --- ## [How can I create new field inside an array of obejcts?](https://discuss.elastic.co/t/how-can-i-create-new-field-inside-an-array-of-obejcts/308036)
**Author:** [@jvinacio](https://discuss.elastic.co/u/jvinacio)\ **Replies:** 2\ **Last updated:** [June 23, 2022, 5:42pm UTC](https://discuss.elastic.co/t/how-can-i-create-new-field-inside-an-array-of-obejcts/308036 "2022-06-23T17:42:28Z")
Hello! I have the following array: { "tempoTotalDayEvents" : \[ { "tempo7" : 25.0 }, { "tempo8" : 0.0 }, { "tempo11" : 0.0 }, { "tempo12" : 6.0 }, { "tempo13" : 0.0 }, { "tempo14" : 3.0 }, { "tempo1… --- ## [Cannot view single document however index exists](https://discuss.elastic.co/t/cannot-view-single-document-however-index-exists/308043)
**Author:** [@GloomOff](https://discuss.elastic.co/u/GloomOff)\ **Replies:** 2\ **Last updated:** [June 23, 2022, 4:49pm UTC](https://discuss.elastic.co/t/cannot-view-single-document-however-index-exists/308043 "2022-06-23T16:49:42Z")
Hello. I receive nginx logs from filebeat. Search works well. But in kibana in the expanded view, click View single document I get error: Cannot run search filebeat-7.9.2-2022.06.23-001859 is missing. \[Please ensure … --- ## [What is "Query Length"?](https://discuss.elastic.co/t/what-is-query-length/307835)
**Author:** [@minzeycat](https://discuss.elastic.co/u/minzeycat)\ **Replies:** 9\ **Last updated:** [June 23, 2022, 4:18pm UTC](https://discuss.elastic.co/t/what-is-query-length/307835 "2022-06-23T16:18:22Z")
Hi all, I'm wondering what query length is referring to in this limit guide (it is set to 128)? Limits | Elastic App Search Documentation \[8.2\] | Elastic I am having a hard time understanding what part of the query is l… --- ## [Elastic Stack Architecture and Requirements](https://discuss.elastic.co/t/elastic-stack-architecture-and-requirements/307930)
**Author:** [@Analyst](https://discuss.elastic.co/u/Analyst)\ **Replies:** 2\ **Last updated:** [June 23, 2022, 3:34pm UTC](https://discuss.elastic.co/t/elastic-stack-architecture-and-requirements/307930 "2022-06-23T15:34:23Z")
Hi Guys, I need to create an ELK architecture but I don't know how many servers and requirements (CPU, RAM,Disk space) I will need for large organization deployment. I will need to send syslog and logfiles from 7000 se… --- ## [Unknown hosts in the Trial of Elastic Cloud](https://discuss.elastic.co/t/unknown-hosts-in-the-trial-of-elastic-cloud/307754)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 3\ **Last updated:** [June 23, 2022, 3:48pm UTC](https://discuss.elastic.co/t/unknown-hosts-in-the-trial-of-elastic-cloud/307754 "2022-06-23T15:48:42Z")
What is these hosts that ocasionally appears while on elastic trial? I've seen them a few times but still don't know what it means... --- ## [Codec in gelf input plugin not working](https://discuss.elastic.co/t/codec-in-gelf-input-plugin-not-working/308017)
**Author:** [@smtp\_server](https://discuss.elastic.co/u/smtp_server)\ **Replies:** 5\ **Last updated:** [June 23, 2022, 3:37pm UTC](https://discuss.elastic.co/t/codec-in-gelf-input-plugin-not-working/308017 "2022-06-23T15:37:03Z")
I'm trying to use codec for logs coming from gelf driver of another container to aggregate multiline logs but they are turning into events for each line in message, So multiline is not working at all. input{ gelf{ … --- ## [{"expected:'\[', actual:'{', at offset:2058"}](https://discuss.elastic.co/t/expected-actual-at-offset-2058/308012)
**Author:** [@Zedson.Sagar](https://discuss.elastic.co/u/Zedson.Sagar)\ **Replies:** 2\ **Last updated:** [June 23, 2022, 3:31pm UTC](https://discuss.elastic.co/t/expected-actual-at-offset-2058/308012 "2022-06-23T15:31:45Z")
Hi, I'm new to elastic and FSCrawler. I have an index created using FSCrawler. It has only a single document which looks like below - { "content" : """MotorColour - CoatingColor - CSV """, … --- ## [Update data in Elastic with Filebeats](https://discuss.elastic.co/t/update-data-in-elastic-with-filebeats/308019)
**Author:** [@Worlock](https://discuss.elastic.co/u/Worlock)\ **Replies:** 0\ **Last updated:** [June 23, 2022, 1:48pm UTC](https://discuss.elastic.co/t/update-data-in-elastic-with-filebeats/308019 "2022-06-23T13:48:45Z")
I have some data from our Monitoring tool that is uploaded to Elastic with Filebeats. When the monitoring alert is closed, I get a new entry with "Resolution state: Closed" I would like to update the Resolution state in … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=888) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=890)