# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=920 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 921 --- ## [Elastic alerts get queued and never run thereafter](https://discuss.elastic.co/t/elastic-alerts-get-queued-and-never-run-thereafter/306049)
**Author:** [@Tesla\_User](https://discuss.elastic.co/u/Tesla_User)\ **Replies:** 0\ **Last updated:** [May 31, 2022, 2:43pm UTC](https://discuss.elastic.co/t/elastic-alerts-get-queued-and-never-run-thereafter/306049 "2022-05-31T14:43:27Z")
Whenever I create and run an alert, the alert is getting queued but not running thereafter. Is there a way to clear the threadpool queue and make the alerts run faster. Error: { "\_id" : "log\_error\_watch1\_4730bca4-191… --- ## [Querying Nested Structure](https://discuss.elastic.co/t/querying-nested-structure/305960)
**Author:** [@obadaqaf](https://discuss.elastic.co/u/obadaqaf)\ **Replies:** 3\ **Last updated:** [May 31, 2022, 2:07pm UTC](https://discuss.elastic.co/t/querying-nested-structure/305960 "2022-05-31T14:07:40Z")
I try to query documents that have nested objects: { "name":"Adam", "cities":\[ { "name":"California", "activities":\[ { "name":"Hicking" … --- ## [Kibana - controal {No options found}](https://discuss.elastic.co/t/kibana-controal-no-options-found/305678)
**Author:** [@as\_dh](https://discuss.elastic.co/u/as_dh)\ **Replies:** 6\ **Last updated:** [May 31, 2022, 1:57pm UTC](https://discuss.elastic.co/t/kibana-controal-no-options-found/305678 "2022-05-31T13:57:21Z")
Hello when i create Controls in dashbord page i got No options found kibana and elastic virsion 8.2 please help :frowning: --- ## [Filebeat sending a json file to stdout but filebeat errors "Error decoding JSON: invalid character" for the stdout logs](https://discuss.elastic.co/t/filebeat-sending-a-json-file-to-stdout-but-filebeat-errors-error-decoding-json-invalid-character-for-the-stdout-logs/305989)
**Author:** [@Adrian\_Romero](https://discuss.elastic.co/u/Adrian_Romero)\ **Replies:** 1\ **Last updated:** [May 31, 2022, 1:54pm UTC](https://discuss.elastic.co/t/filebeat-sending-a-json-file-to-stdout-but-filebeat-errors-error-decoding-json-invalid-character-for-the-stdout-logs/305989 "2022-05-31T13:54:31Z")
Hi people! here is the deal, I using k8s, my apps write down thier logs into a json formatted file, so I decided to send this file to the stdout (with a soft link kind of how nginx does it), so now if you check the stdou… --- ## [Filebeat suricata](https://discuss.elastic.co/t/filebeat-suricata/305863)
**Author:** [@TARIK\_MAZOUZ](https://discuss.elastic.co/u/TARIK_MAZOUZ)\ **Replies:** 9\ **Last updated:** [May 31, 2022, 1:52pm UTC](https://discuss.elastic.co/t/filebeat-suricata/305863 "2022-05-31T13:52:44Z")
hey ELK STACK community, please i've installed filebeat , and i wanted to install suricata module, so i've did install it, the problem is i don't get any information in kibana from suricata ? did i've missed something or… --- ## [Individual visualization link](https://discuss.elastic.co/t/individual-visualization-link/306039)
**Author:** [@elknick](https://discuss.elastic.co/u/elknick)\ **Replies:** 2\ **Last updated:** [May 31, 2022, 1:45pm UTC](https://discuss.elastic.co/t/individual-visualization-link/306039 "2022-05-31T13:45:41Z")
Hi, I'm trying to use iFrame links to show my data elsewhere. I see that I can create a link to embed the entire dashboard. Is it possible to share a individual visualization out of the dashboard and not the whole thing… --- ## [SQL (Kibana Canvas) - How to drop all text to the left of a string pattern](https://discuss.elastic.co/t/sql-kibana-canvas-how-to-drop-all-text-to-the-left-of-a-string-pattern/305754)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 2\ **Last updated:** [May 31, 2022, 1:40pm UTC](https://discuss.elastic.co/t/sql-kibana-canvas-how-to-drop-all-text-to-the-left-of-a-string-pattern/305754 "2022-05-31T13:40:59Z")
Hi All, (Note: Asking under SQL even though the use-case is in Kibana Canvas, as the question pertains to ESSQL specifically.) I'm working on a Canvas setup and have the following query: SELECT kibana.alert.rule.name … --- ## [Embed Kibana Visualizations in HTML Page](https://discuss.elastic.co/t/embed-kibana-visualizations-in-html-page/306040)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 0\ **Last updated:** [May 31, 2022, 1:34pm UTC](https://discuss.elastic.co/t/embed-kibana-visualizations-in-html-page/306040 "2022-05-31T13:34:16Z")
Similarly to this question we want to embed a vizualisation in an external web page. However, the solution given there, "use the iframe src from the dashboard" does not work. The dashboard does not use iframes and when w… --- ## [Fuzzy collapse](https://discuss.elastic.co/t/fuzzy-collapse/306037)
**Author:** [@Quentin\_Feuillade](https://discuss.elastic.co/u/Quentin_Feuillade)\ **Replies:** 0\ **Last updated:** [May 31, 2022, 12:55pm UTC](https://discuss.elastic.co/t/fuzzy-collapse/306037 "2022-05-31T12:55:53Z")
Hello :wave: , I am working on a deduplication project in O(n) time by using precomputed clusterIDs. It is working pretty well already but I found out that by collapsing id with a levenshtein distance between IDs, it i… --- ## [Need table format of ELK watcher](https://discuss.elastic.co/t/need-table-format-of-elk-watcher/306033)
**Author:** [@Sumanth\_Varma](https://discuss.elastic.co/u/Sumanth_Varma)\ **Replies:** 0\ **Last updated:** [May 31, 2022, 12:35pm UTC](https://discuss.elastic.co/t/need-table-format-of-elk-watcher/306033 "2022-05-31T12:35:06Z")
I am trying to get action of watcher output in a table format and the values will be added from aggr buckets. I am able to get it in table but all the values are getting printed in a single column. --- ## [Logstash - syslog output](https://discuss.elastic.co/t/logstash-syslog-output/305288)
**Author:** [@humartinez](https://discuss.elastic.co/u/humartinez)\ **Replies:** 8\ **Last updated:** [May 31, 2022, 12:33pm UTC](https://discuss.elastic.co/t/logstash-syslog-output/305288 "2022-05-31T12:33:53Z")
Hi, Im with some issues configuring the output to syslog. It may be some syntax that Im unaware of, but I can't use my document field values to map some of the plugin output fields. Im trying to use one of my records f… --- ## [How to filter options from a field selected](https://discuss.elastic.co/t/how-to-filter-options-from-a-field-selected/304480)
**Author:** [@Srikanth\_V](https://discuss.elastic.co/u/Srikanth_V)\ **Replies:** 4\ **Last updated:** [May 31, 2022, 12:23pm UTC](https://discuss.elastic.co/t/how-to-filter-options-from-a-field-selected/304480 "2022-05-31T12:23:53Z")
Hello, Is there a possibility to filter values from the field that has been selected? For example, my field A has 20 options. Scenario 1 - a) I want my field A to show only the necessary values - 8 of them Scenario 2… --- ## [Easy way to remove keywords mapping](https://discuss.elastic.co/t/easy-way-to-remove-keywords-mapping/305478)
**Author:** [@Evgeny\_Barykin](https://discuss.elastic.co/u/Evgeny_Barykin)\ **Replies:** 4\ **Last updated:** [May 31, 2022, 11:42am UTC](https://discuss.elastic.co/t/easy-way-to-remove-keywords-mapping/305478 "2022-05-31T11:42:01Z")
Hello! I am looking for an easy way to remove any keywords mapping from my metricbeat index. Can you give me an example of how can I do it, please? --- ## [Minimum\_should\_match don´t return correctly](https://discuss.elastic.co/t/minimum-should-match-don-t-return-correctly/305967)
**Author:** [@eduardohmferreira](https://discuss.elastic.co/u/eduardohmferreira)\ **Replies:** 4\ **Last updated:** [May 31, 2022, 11:24am UTC](https://discuss.elastic.co/t/minimum-should-match-don-t-return-correctly/305967 "2022-05-31T11:24:39Z")
Hy everyone! I'm new to the elastic universe and I have a question about a query. I'll try to describe it here: I have a document called 'store' with several stores registered and within each store item a list of custo… --- ## [C# NEST - Elastic search \_Id mapping to DocumentId fails and results in duplicate results in ES](https://discuss.elastic.co/t/c-nest-elastic-search-id-mapping-to-documentid-fails-and-results-in-duplicate-results-in-es/306027)
**Author:** [@Sohaib\_Ameen](https://discuss.elastic.co/u/Sohaib_Ameen)\ **Replies:** 0\ **Last updated:** [May 31, 2022, 10:13am UTC](https://discuss.elastic.co/t/c-nest-elastic-search-id-mapping-to-documentid-fails-and-results-in-duplicate-results-in-es/306027 "2022-05-31T10:13:18Z")
Hello everyone, I am using C# NEST functions to create indexes in Elasticsearch and tried to map \_id field with a custom field of DocumentId but it does not work as it put some random string value in \_id instead of docu… --- ## [Elasticsearch does not start after rebooting my virtual machine](https://discuss.elastic.co/t/elasticsearch-does-not-start-after-rebooting-my-virtual-machine/305982)
**Author:** [@rockers](https://discuss.elastic.co/u/rockers)\ **Replies:** 6\ **Last updated:** [May 31, 2022, 9:59am UTC](https://discuss.elastic.co/t/elasticsearch-does-not-start-after-rebooting-my-virtual-machine/305982 "2022-05-31T09:59:48Z")
last day i shut down my virtual machine and next day i open my virtual machine and run Elasticsearch it is not running and it shows this error sudo service elasticsearch status × elasticsearch.service - Elasticsearch … --- ## [Unable to install plugin analysis-icu in elasticsearch/plugin](https://discuss.elastic.co/t/unable-to-install-plugin-analysis-icu-in-elasticsearch-plugin/305935)
**Author:** [@Sharad\_Jain](https://discuss.elastic.co/u/Sharad_Jain)\ **Replies:** 13\ **Last updated:** [May 31, 2022, 9:50am UTC](https://discuss.elastic.co/t/unable-to-install-plugin-analysis-icu-in-elasticsearch-plugin/305935 "2022-05-31T09:50:13Z")
\< '$ Elasticsearch-7.14.0/bin/Elasticsearch-plugin install' 'file:///scratch/fccs812/Elasticsearch-7.14.0/plugins/analysis-icu-7.14.0.zip' '-\> Installing file:///scratch/fccs812/Elasticsearch-7.14.0/plugins/analysis-ic… --- ## [Sincedb file is being created empty](https://discuss.elastic.co/t/sincedb-file-is-being-created-empty/305912)
**Author:** [@automation\_learner](https://discuss.elastic.co/u/automation_learner)\ **Replies:** 17\ **Last updated:** [May 31, 2022, 9:29am UTC](https://discuss.elastic.co/t/sincedb-file-is-being-created-empty/305912 "2022-05-31T09:29:19Z")
when i am trying to use file input plugin to created index it is not working as sincedb file is being created empty and in logs it says discovered files count =0 also when using disable sincedb it says open file /dev/nu… --- ## [Kibana maintenance mode](https://discuss.elastic.co/t/kibana-maintenance-mode/305909)
**Author:** [@andresf](https://discuss.elastic.co/u/andresf)\ **Replies:** 4\ **Last updated:** [May 31, 2022, 9:01am UTC](https://discuss.elastic.co/t/kibana-maintenance-mode/305909 "2022-05-31T09:01:34Z")
Hi, Currently at our office, we have maintenance schedule every night for the next couple of month. How can we ignore alert that happen from 7 PM to 7 AM? In other monitoring solution we have maintenance mode to tackle… --- ## [Index don't want deleted automatically](https://discuss.elastic.co/t/index-dont-want-deleted-automatically/305554)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 14\ **Last updated:** [May 31, 2022, 9:00am UTC](https://discuss.elastic.co/t/index-dont-want-deleted-automatically/305554 "2022-05-31T09:00:42Z")
Hi there, i wanna ask about index and retention. so here is the question in my Elasticsearch i have created index automatically and give them policy to go away after 5 days. the problem is they don't want to be deleted… --- ## [Create new indices on each Beats update](https://discuss.elastic.co/t/create-new-indices-on-each-beats-update/306016)
**Author:** [@queried1](https://discuss.elastic.co/u/queried1)\ **Replies:** 0\ **Last updated:** [May 31, 2022, 8:59am UTC](https://discuss.elastic.co/t/create-new-indices-on-each-beats-update/306016 "2022-05-31T08:59:08Z")
Hello! I have an ELK cluster, the topology is quite simple: Linux\_host -\> Logstash\_node -\> Elasticsearch\_nde Each Linux\_host has filebeat+auditbeat installed and sends data to the Logstash\_node. The Logstash\_node rec… --- ## [Geoip setup failure](https://discuss.elastic.co/t/geoip-setup-failure/306011)
**Author:** [@kalev](https://discuss.elastic.co/u/kalev)\ **Replies:** 0\ **Last updated:** [May 31, 2022, 7:52am UTC](https://discuss.elastic.co/t/geoip-setup-failure/306011 "2022-05-31T07:52:32Z")
Hi, I'm trying to setup logstash (ver 7.16) with offline geoip update based on Geoip filter plugin | Logstash Reference \[7.16\] | Elastic , but it fails on step 4: ./bin/elasticsearch-geoip -s /usr/share/GeoIP A CLI to… --- ## [Unable to parse svclog using filbeat](https://discuss.elastic.co/t/unable-to-parse-svclog-using-filbeat/305778)
**Author:** [@Gaurav\_kr](https://discuss.elastic.co/u/Gaurav_kr)\ **Replies:** 4\ **Last updated:** [May 31, 2022, 7:52am UTC](https://discuss.elastic.co/t/unable-to-parse-svclog-using-filbeat/305778 "2022-05-31T07:52:14Z")
Hi Team, I am unable to parse the svclog ( a XML family) using Filebeat. Please suggest how i can par --- ## [Functionbeat unable to export cloudwatch logs to elastic](https://discuss.elastic.co/t/functionbeat-unable-to-export-cloudwatch-logs-to-elastic/305927)
**Author:** [@rishabhtryroll](https://discuss.elastic.co/u/rishabhtryroll)\ **Replies:** 2\ **Last updated:** [May 31, 2022, 7:16am UTC](https://discuss.elastic.co/t/functionbeat-unable-to-export-cloudwatch-logs-to-elastic/305927 "2022-05-31T07:16:51Z")
I am using function beat to export cloud watch logs to elastic but got no data in the indices. Followed that doc https://www.elastic.co/guide/en/beats/functionbeat/current/functionbeat-installation-configuration.html T… --- ## [200 pipelines in logstash causing scalability issues](https://discuss.elastic.co/t/200-pipelines-in-logstash-causing-scalability-issues/305999)
**Author:** [@jatin\_gupta](https://discuss.elastic.co/u/jatin_gupta)\ **Replies:** 0\ **Last updated:** [May 31, 2022, 6:21am UTC](https://discuss.elastic.co/t/200-pipelines-in-logstash-causing-scalability-issues/305999 "2022-05-31T06:21:24Z")
Hey I need a design suggestion. We have 200 microservices and a 4 node logstash HA setup. Now each microservice has to send logs to a different index. Current setup I have is, for each microservice we have a different… --- ## [Search guard is not installing in Elasticsearch windows server](https://discuss.elastic.co/t/search-guard-is-not-installing-in-elasticsearch-windows-server/305996)
**Author:** [@jisha](https://discuss.elastic.co/u/jisha)\ **Replies:** 1\ **Last updated:** [May 31, 2022, 6:12am UTC](https://discuss.elastic.co/t/search-guard-is-not-installing-in-elasticsearch-windows-server/305996 "2022-05-31T06:12:33Z")
Hi, I have installed a Elasticsearch 7.13.3 in windows server, I have downloaded and search guard 53.1.0v. I have edited Elasticsearch.yml by adding following command: searchguard.enterprise\_modules\_enabled: false An… --- ## [Wrong term search result with case\_insensitive=true](https://discuss.elastic.co/t/wrong-term-search-result-with-case-insensitive-true/305916)
**Author:** [@MikeSER](https://discuss.elastic.co/u/MikeSER)\ **Replies:** 4\ **Last updated:** [May 31, 2022, 5:02am UTC](https://discuss.elastic.co/t/wrong-term-search-result-with-case-insensitive-true/305916 "2022-05-31T05:02:05Z")
I have a problem with a specific search when using a term query and case\_insensitive=true. To demonstrate that I've created a shell script. It deletes then creates index "a" with an attribute "my\_kw" of type "keyword". … --- ## [How can I known who update my doc](https://discuss.elastic.co/t/how-can-i-known-who-update-my-doc/305991)
**Author:** [@nanili](https://discuss.elastic.co/u/nanili)\ **Replies:** 1\ **Last updated:** [May 31, 2022, 3:48am UTC](https://discuss.elastic.co/t/how-can-i-known-who-update-my-doc/305991 "2022-05-31T03:48:55Z")
If somebody call the POST restful to update my doc,how can I know who do it,when do it. XPack can give me the answer? --- ## [How to read the monitoring log of filebeat?](https://discuss.elastic.co/t/how-to-read-the-monitoring-log-of-filebeat/305721)
**Author:** [@Kuo\_Hugo](https://discuss.elastic.co/u/Kuo_Hugo)\ **Replies:** 2\ **Last updated:** [May 31, 2022, 3:24am UTC](https://discuss.elastic.co/t/how-to-read-the-monitoring-log-of-filebeat/305721 "2022-05-31T03:24:40Z")
I'm working on tuning for the filebeat to process logs. Changing the output.Elasticsearch There're 7 Elasticsearch targets in the hosts list. workers:2 bulk\_max\_size: 2048 flush\_interval: 5 It's around 600 log line… --- ## [New documents not searchable](https://discuss.elastic.co/t/new-documents-not-searchable/305961)
**Author:** [@abls1](https://discuss.elastic.co/u/abls1)\ **Replies:** 3\ **Last updated:** [May 31, 2022, 2:35am UTC](https://discuss.elastic.co/t/new-documents-not-searchable/305961 "2022-05-31T02:35:36Z")
I created an index with 44 documents then, I added 10 more documents and they are seen in kibana but, when I do a search on The web search box they are not found, is there a way to add new documents without have to rein… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=919) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=921)