# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=904 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 905 --- ## [Variable to store list of recipient addresses for Elastic Watcher](https://discuss.elastic.co/t/variable-to-store-list-of-recipient-addresses-for-elastic-watcher/306108)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 4\ **Last updated:** [June 14, 2022, 11:34am UTC](https://discuss.elastic.co/t/variable-to-store-list-of-recipient-addresses-for-elastic-watcher/306108 "2022-06-14T11:34:27Z")
Hi Team, In our production setup, we have multiple watcher alerts (around 100), having different sets of recipient email addresses. Now if there is any requirement from the client to update the list, we need to edit 100… --- ## [Beat service does not restart after "apt upgrade"](https://discuss.elastic.co/t/beat-service-does-not-restart-after-apt-upgrade/305145)
**Author:** [@mh\_xortex](https://discuss.elastic.co/u/mh_xortex)\ **Replies:** 3\ **Last updated:** [June 14, 2022, 11:15am UTC](https://discuss.elastic.co/t/beat-service-does-not-restart-after-apt-upgrade/305145 "2022-06-14T11:15:24Z")
"unattended upgrades " upgrade our beats (filebeat and metricbeat) but the beat services does not restarted. --- ## [Normal String field displays as list in data table or document table in kibana](https://discuss.elastic.co/t/normal-string-field-displays-as-list-in-data-table-or-document-table-in-kibana/307100)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 4\ **Last updated:** [June 14, 2022, 10:55am UTC](https://discuss.elastic.co/t/normal-string-field-displays-as-list-in-data-table-or-document-table-in-kibana/307100 "2022-06-14T10:55:05Z")
Hi all, I've seen for some fields, Normal String field displays as list in data table or document table in kibana. Even though the field is mapped as plain string, it is shown as list in data table (when taken as top hi… --- ## [Sharing Index patterns and reports across spaces](https://discuss.elastic.co/t/sharing-index-patterns-and-reports-across-spaces/307124)
**Author:** [@behappy\_alwayz0401](https://discuss.elastic.co/u/behappy_alwayz0401)\ **Replies:** 2\ **Last updated:** [June 14, 2022, 9:35am UTC](https://discuss.elastic.co/t/sharing-index-patterns-and-reports-across-spaces/307124 "2022-06-14T09:35:14Z")
Hi, How can we share a report or an index pattern without having to recreate it, from one space to another in Kibana? thanks.. --- ## [Add single filter ratio column to data table lens](https://discuss.elastic.co/t/add-single-filter-ratio-column-to-data-table-lens/306895)
**Author:** [@redfox](https://discuss.elastic.co/u/redfox)\ **Replies:** 4\ **Last updated:** [June 14, 2022, 9:16am UTC](https://discuss.elastic.co/t/add-single-filter-ratio-column-to-data-table-lens/306895 "2022-06-14T09:16:07Z")
Hoping for some help here... I have created a lens data table visualisation where I have a number of filters defining the rows in the table and a number of filters summing various criteria for the columns. I want to ad… --- ## [Cannot login to the Kibaba with the username and the password from the Secret file](https://discuss.elastic.co/t/cannot-login-to-the-kibaba-with-the-username-and-the-password-from-the-secret-file/307122)
**Author:** [@Frida](https://discuss.elastic.co/u/Frida)\ **Replies:** 0\ **Last updated:** [June 14, 2022, 9:02am UTC](https://discuss.elastic.co/t/cannot-login-to-the-kibaba-with-the-username-and-the-password-from-the-secret-file/307122 "2022-06-14T09:02:37Z")
Hi, if possible- I have a question: this is my Elasticsearch: apiVersion: elasticsearch.k8s.elastic.co/v1 kind: Elasticsearch metadata: name: jhsearch spec: version: 7.6.2 auth: fileRealm: - secretName: … --- ## [String fields display](https://discuss.elastic.co/t/string-fields-display/307104)
**Author:** [@behappy\_alwayz0401](https://discuss.elastic.co/u/behappy_alwayz0401)\ **Replies:** 2\ **Last updated:** [June 14, 2022, 8:53am UTC](https://discuss.elastic.co/t/string-fields-display/307104 "2022-06-14T08:53:55Z")
I have a string field "Account Name". I have set the format as a String, Title Case. On the Discover tab, the account names are appearing correctly with the Title Case formatting. The Account Name (Text) field has be… --- ## [Apply index pattern Field filters to the "add filter" drop down selection](https://discuss.elastic.co/t/apply-index-pattern-field-filters-to-the-add-filter-drop-down-selection/307054)
**Author:** [@tg295](https://discuss.elastic.co/u/tg295)\ **Replies:** 2\ **Last updated:** [June 14, 2022, 8:34am UTC](https://discuss.elastic.co/t/apply-index-pattern-field-filters-to-the-add-filter-drop-down-selection/307054 "2022-06-14T08:34:17Z")
I have an index alias, of which the mapping has some fields that I no longer want in my index. The documents that contained these fields have been updated so that the fields have been removed. My end goal is that i'd li… --- ## [Logstash multiline CSV](https://discuss.elastic.co/t/logstash-multiline-csv/307114)
**Author:** [@tartaarsap](https://discuss.elastic.co/u/tartaarsap)\ **Replies:** 0\ **Last updated:** [June 14, 2022, 8:24am UTC](https://discuss.elastic.co/t/logstash-multiline-csv/307114 "2022-06-14T08:24:43Z")
Hi, I recently switched from Filebeat to Logstash, but my multiline config pattern is not working anymore. My config file: input { file { path =\> \[ "D:/temp/\*test\*.csv" \] start\_position =\> "beginning" c… --- ## [Using Kibana dev tools CURL to generate CSV fails](https://discuss.elastic.co/t/using-kibana-dev-tools-curl-to-generate-csv-fails/307111)
**Author:** [@hrodriguez](https://discuss.elastic.co/u/hrodriguez)\ **Replies:** 0\ **Last updated:** [June 14, 2022, 8:18am UTC](https://discuss.elastic.co/t/using-kibana-dev-tools-curl-to-generate-csv-fails/307111 "2022-06-14T08:18:48Z")
Hi, Using Kibana 6.8.23 I am triying to obtain a url to download the csv data from a Discover query. First I tried download a CSV using Share -\> CSV Reports -\> Copy POST URL but I got the following error: {"statusCod… --- ## [\[ERROR\] Cannot race. Worker \[54\] has exited prematurely](https://discuss.elastic.co/t/error-cannot-race-worker-54-has-exited-prematurely/306981)
**Author:** [@amitsa](https://discuss.elastic.co/u/amitsa)\ **Replies:** 4\ **Last updated:** [June 14, 2022, 7:46am UTC](https://discuss.elastic.co/t/error-cannot-race-worker-54-has-exited-prematurely/306981 "2022-06-14T07:46:42Z")
Getting below error while benchmarking with nyc\_taxis Running on kubernetes 1 master - 31 gb heap 3 data - 31 gb heap System 208 VCPU mem: 1008 gb track params NUMBER\_OF\_SHARDS=${NUMBER\_OF\_SHARDS:-10} NUMBER\_OF\_RE… --- ## [Kibana Alerting Es query with field runtime\_mappings](https://discuss.elastic.co/t/kibana-alerting-es-query-with-field-runtime-mappings/307097)
**Author:** [@hanstf](https://discuss.elastic.co/u/hanstf)\ **Replies:** 0\ **Last updated:** [June 14, 2022, 6:50am UTC](https://discuss.elastic.co/t/kibana-alerting-es-query-with-field-runtime-mappings/307097 "2022-06-14T06:50:40Z")
I am trying to create an Alert rule with es query that contains runtime mappings (Elasticsearch query | Kibana Guide \[7.13\] | Elastic). My rule is like below: { "runtime\_mappings": { "file\_found\_status": { … --- ## [Logstash vs filebeat](https://discuss.elastic.co/t/logstash-vs-filebeat/307030)
**Author:** [@GARVIT\_KUMAR\_GUPTA](https://discuss.elastic.co/u/GARVIT_KUMAR_GUPTA)\ **Replies:** 3\ **Last updated:** [June 14, 2022, 6:31am UTC](https://discuss.elastic.co/t/logstash-vs-filebeat/307030 "2022-06-14T06:31:35Z")
Can Anybody tell me difference between Logstash and filebeat with their pros and cons Thanks in advance --- ## [How to define a global default index route allocation strategy?](https://discuss.elastic.co/t/how-to-define-a-global-default-index-route-allocation-strategy/307093)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 0\ **Last updated:** [June 14, 2022, 6:11am UTC](https://discuss.elastic.co/t/how-to-define-a-global-default-index-route-allocation-strategy/307093 "2022-06-14T06:11:10Z")
PUT filebeat-7.17.3-000001/ { "settings": { "index": { "lifecycle": { "name": "30-days-default", "rollover\_alias": "filebeat-7.17.3" }, "routing": { "allocation": { … --- ## [Filebeat resends log files after restart](https://discuss.elastic.co/t/filebeat-resends-log-files-after-restart/303924)
**Author:** [@alytkowski](https://discuss.elastic.co/u/alytkowski)\ **Replies:** 7\ **Last updated:** [June 14, 2022, 6:04am UTC](https://discuss.elastic.co/t/filebeat-resends-log-files-after-restart/303924 "2022-06-14T06:04:09Z")
Dear colleagues, I have an issue with Filebeat again - I've noticed that it resends the whole log files after restarting the application despite the log file stating that the registry file has been loaded successfully. … --- ## [\[LogStash\] how to intentionally slow down JDBC Input Plugin](https://discuss.elastic.co/t/logstash-how-to-intentionally-slow-down-jdbc-input-plugin/306979)
**Author:** [@JooHyukKim](https://discuss.elastic.co/u/JooHyukKim)\ **Replies:** 3\ **Last updated:** [June 14, 2022, 5:53am UTC](https://discuss.elastic.co/t/logstash-how-to-intentionally-slow-down-jdbc-input-plugin/306979 "2022-06-14T05:53:55Z")
Table Of Contents My situation What I want How I can help 1. my situation I have to run logstash jdbc input against Database running in production. I use pagination options to limit amount of data per query but since … --- ## [Adding Logos & special comments in data table download](https://discuss.elastic.co/t/adding-logos-special-comments-in-data-table-download/307025)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [June 14, 2022, 5:48am UTC](https://discuss.elastic.co/t/adding-logos-special-comments-in-data-table-download/307025 "2022-06-14T05:48:18Z")
Hi all, Right now we have facility to download Data tables as CSV . Is there any way we can include logos & comments along with data tables? --- ## [Does reindex honour \_routing option](https://discuss.elastic.co/t/does-reindex-honour-routing-option/306881)
**Author:** [@sreekanth](https://discuss.elastic.co/u/sreekanth)\ **Replies:** 1\ **Last updated:** [June 14, 2022, 5:46am UTC](https://discuss.elastic.co/t/does-reindex-honour-routing-option/306881 "2022-06-14T05:46:08Z")
We have ingested a few parent docs and few child docs per parent. For all child docs we used \_routing=parentID. So that child also sits on the same shard where the parent lies. Now we had only 1 shard and called reindex… --- ## [Synchronization of data between two spaces](https://discuss.elastic.co/t/synchronization-of-data-between-two-spaces/306851)
**Author:** [@eduhernandezm](https://discuss.elastic.co/u/eduhernandezm)\ **Replies:** 2\ **Last updated:** [June 14, 2022, 5:44am UTC](https://discuss.elastic.co/t/synchronization-of-data-between-two-spaces/306851 "2022-06-14T05:44:57Z")
Good morning, I have the following doubt. In my Kibana (version 8) I have created a series of dashboards of the data of certain indices that are loaded daily. I have created this dashboard in the default space of Kibana… --- ## [Sending data from old version of es(7.17) to newest version(8.1.1)](https://discuss.elastic.co/t/sending-data-from-old-version-of-es-7-17-to-newest-version-8-1-1/306882)
**Author:** [@Ibrahim\_Z\_HIDIR](https://discuss.elastic.co/u/Ibrahim_Z_HIDIR)\ **Replies:** 1\ **Last updated:** [June 14, 2022, 5:44am UTC](https://discuss.elastic.co/t/sending-data-from-old-version-of-es-7-17-to-newest-version-8-1-1/306882 "2022-06-14T05:44:08Z")
Hi all We have a elastic cluster 8.1.1 with 4 nodes, everything working fine. But we also have a single node 7.17. Some .net applications can only send data to 7.17 becasue of plugin compability issues( I've tried but n… --- ## [Installing Elasticsearch and Kibana on kubernetes, what is next?](https://discuss.elastic.co/t/installing-elasticsearch-and-kibana-on-kubernetes-what-is-next/306968)
**Author:** [@levitoh123](https://discuss.elastic.co/u/levitoh123)\ **Replies:** 12\ **Last updated:** [June 14, 2022, 5:35am UTC](https://discuss.elastic.co/t/installing-elasticsearch-and-kibana-on-kubernetes-what-is-next/306968 "2022-06-14T05:35:20Z")
Hi, I'm very new to ELK, and I have a very rookie question. I want to monitor the applications running in our kubernetes solution and we chose ELK for it. I have followed the instructions on Deploy ECK in your Kubernetes… --- ## [Alternate for sub aggregation in elastic search](https://discuss.elastic.co/t/alternate-for-sub-aggregation-in-elastic-search/306423)
**Author:** [@khasim\_vali\_dudekula](https://discuss.elastic.co/u/khasim_vali_dudekula)\ **Replies:** 4\ **Last updated:** [June 14, 2022, 5:13am UTC](https://discuss.elastic.co/t/alternate-for-sub-aggregation-in-elastic-search/306423 "2022-06-14T05:13:44Z")
Hi I am new to Elasticsearch, and I'm writing a query using sub aggregations. I'm not sure whether it is okay in terms of performance or any other alternatives exist. please guide me. the query looks like this { "siz… --- ## [Fast&simple url short for Discover section?](https://discuss.elastic.co/t/fast-simple-url-short-for-discover-section/307023)
**Author:** [@xxddgert](https://discuss.elastic.co/u/xxddgert)\ **Replies:** 1\ **Last updated:** [June 14, 2022, 4:14am UTC](https://discuss.elastic.co/t/fast-simple-url-short-for-discover-section/307023 "2022-06-14T04:14:29Z")
Hi I have kibana 7.17.1 in which I applied some filters to some index pattern in discover section and I have such url now: https://kibana.example.com/app/discover#/?\_g=(filters:!(),refreshInterval:(pause:!t,value:0),ti… --- ## [Very basic question](https://discuss.elastic.co/t/very-basic-question/307042)
**Author:** [@stobbe99](https://discuss.elastic.co/u/stobbe99)\ **Replies:** 2\ **Last updated:** [June 14, 2022, 2:30am UTC](https://discuss.elastic.co/t/very-basic-question/307042 "2022-06-14T02:30:48Z")
Hello, What dataset do I need to load to make the documentation examples work? KR Henk --- ## [Registering Repository](https://discuss.elastic.co/t/registering-repository/306930)
**Author:** [@wonderland14](https://discuss.elastic.co/u/wonderland14)\ **Replies:** 1\ **Last updated:** [June 14, 2022, 1:42am UTC](https://discuss.elastic.co/t/registering-repository/306930 "2022-06-14T01:42:26Z")
What is more applicable, turning On or Off source-only in registering repository? Upon my research, this is more advantage when it comes to lessen disk space, and by doing this, it only includes fields and metadata not … --- ## [No to use closing index while performing restore](https://discuss.elastic.co/t/no-to-use-closing-index-while-performing-restore/307027)
**Author:** [@wonderland14](https://discuss.elastic.co/u/wonderland14)\ **Replies:** 1\ **Last updated:** [June 14, 2022, 1:32am UTC](https://discuss.elastic.co/t/no-to-use-closing-index-while-performing-restore/307027 "2022-06-14T01:32:07Z")
Is there any possible way or steps to not close the index while performing restore? If closing is the only way then it makes user life miserable to one by one closing indexes in order to perform restore. --- ## [Moving Elasticsearch Data to New Storage](https://discuss.elastic.co/t/moving-elasticsearch-data-to-new-storage/306658)
**Author:** [@Ryan66740](https://discuss.elastic.co/u/Ryan66740)\ **Replies:** 3\ **Last updated:** [June 14, 2022, 12:33am UTC](https://discuss.elastic.co/t/moving-elasticsearch-data-to-new-storage/306658 "2022-06-14T00:33:27Z")
I have an Elasticsearch Cluster (v5.6.9) - x2 Data Nodes Both Physical Servers with Storage on different 3PAR systems + x1 Master (Quorum VM). Having 2 Shards + 1 Replica. I need to migrate both Data Nodes' storage to n… --- ## [Ingest pipeline : dissect log sentence](https://discuss.elastic.co/t/ingest-pipeline-dissect-log-sentence/305690)
**Author:** [@Micou12](https://discuss.elastic.co/u/Micou12)\ **Replies:** 3\ **Last updated:** [June 14, 2022, 12:27am UTC](https://discuss.elastic.co/t/ingest-pipeline-dissect-log-sentence/305690 "2022-06-14T00:27:38Z")
Hello All , would like to request a help on how to split a sentence into small chunk . for example I am making a pipeline from custom integration through kibana dashboard , the log is like this: \[name=tamari.mpaka@apm.rw… --- ## [Data stream indices not moving from frozen to delete state](https://discuss.elastic.co/t/data-stream-indices-not-moving-from-frozen-to-delete-state/304622)
**Author:** [@elastictor](https://discuss.elastic.co/u/elastictor)\ **Replies:** 7\ **Last updated:** [June 14, 2022, 12:27am UTC](https://discuss.elastic.co/t/data-stream-indices-not-moving-from-frozen-to-delete-state/304622 "2022-06-14T00:27:04Z")
I have created a data stream with ILM with phases ranging from Hot to Deleted. The backing indices are successfully moved into Frozen state but never continue into the Deleted phase. Why are the indices not moving to d… --- ## [Is there a way to print the SQL with the jdbc\_streaming filter?](https://discuss.elastic.co/t/is-there-a-way-to-print-the-sql-with-the-jdbc-streaming-filter/307083)
**Author:** [@Chris\_Kessel](https://discuss.elastic.co/u/Chris_Kessel)\ **Replies:** 1\ **Last updated:** [June 13, 2022, 11:50pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-print-the-sql-with-the-jdbc-streaming-filter/307083 "2022-06-13T23:50:43Z")
The jdbc input plugin conveniently prints the SQL that's being executed. Is there a way to do that with the jdbc\_streaming filter? [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=903) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=905)