# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=945 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 946 --- ## [Joining 2 index patterns into 1](https://discuss.elastic.co/t/joining-2-index-patterns-into-1/304140)
**Author:** [@hNiven](https://discuss.elastic.co/u/hNiven)\ **Replies:** 2\ **Last updated:** [May 10, 2022, 8:42am UTC](https://discuss.elastic.co/t/joining-2-index-patterns-into-1/304140 "2022-05-10T08:42:33Z")
Hi, If I have 2 separate index patterns, is it possible to merge them into 1 index pattern that contains both/all the data. Or if that is not possible, is there a way to take the data contained in both and create a new… --- ## [How we can use Math aggregation to access the value of series TSVB](https://discuss.elastic.co/t/how-we-can-use-math-aggregation-to-access-the-value-of-series-tsvb/303518)
**Author:** [@sara\_sara](https://discuss.elastic.co/u/sara_sara)\ **Replies:** 3\ **Last updated:** [May 10, 2022, 8:34am UTC](https://discuss.elastic.co/t/how-we-can-use-math-aggregation-to-access-the-value-of-series-tsvb/303518 "2022-05-10T08:34:15Z")
Hey everyone, I want to perform one calculation using series value: state1 - state2, but I don't know how to do it :sweat: I need help please!! --- ## [Logstash extract part of field](https://discuss.elastic.co/t/logstash-extract-part-of-field/304312)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 2\ **Last updated:** [May 10, 2022, 8:14am UTC](https://discuss.elastic.co/t/logstash-extract-part-of-field/304312 "2022-05-10T08:14:09Z")
Dears, ELK in version 7.16.3 What is the best way to extract part of mapped xml field to new field? if "app1xml" in \[tags\] { xml { source =\> "message" store\_xml =\> false force\_array =\> false xpath … --- ## [Elasticsearch index mapping causing unhashable type: 'HTMLNode'](https://discuss.elastic.co/t/elasticsearch-index-mapping-causing-unhashable-type-htmlnode/304263)
**Author:** [@elasticeror](https://discuss.elastic.co/u/elasticeror)\ **Replies:** 3\ **Last updated:** [May 10, 2022, 8:00am UTC](https://discuss.elastic.co/t/elasticsearch-index-mapping-causing-unhashable-type-htmlnode/304263 "2022-05-10T08:00:16Z")
I've created Elasticsearch index which works fine on it's own. But, for some reason, as soon as i specify mapping, the error appears when i click on the link. When Elasticsearch is off, or when index doesn't have map… --- ## [How to use the same Elastic Search Index in Multiple Environments in same server](https://discuss.elastic.co/t/how-to-use-the-same-elastic-search-index-in-multiple-environments-in-same-server/304220)
**Author:** [@Leo\_Lawrence](https://discuss.elastic.co/u/Leo_Lawrence)\ **Replies:** 11\ **Last updated:** [May 10, 2022, 7:46am UTC](https://discuss.elastic.co/t/how-to-use-the-same-elastic-search-index-in-multiple-environments-in-same-server/304220 "2022-05-10T07:46:20Z")
Im having 2 environments(Dev and Test) in a same server. I want to use the same set of Indices in both dev and Test. How to achieve this in Elasticsearch --- ## [Logstash email output occur below error: \](https://discuss.elastic.co/t/logstash-email-output-occur-below-error-errno-broken-pipe-no-message-available/304301)
**Author:** [@haohao6683](https://discuss.elastic.co/u/haohao6683)\ **Replies:** 2\ **Last updated:** [May 10, 2022, 7:31am UTC](https://discuss.elastic.co/t/logstash-email-output-occur-below-error-errno-broken-pipe-no-message-available/304301 "2022-05-10T07:31:20Z")
Hi all, I am currently using Logstash-email output with the following configuration: (version: 7.3.1) email { from =\> "sender@qq.com" subject =\> "Ignore (test run)" body =\> "log-message: I… --- ## [Is it possible to add a data table to a dashboard containing external data?](https://discuss.elastic.co/t/is-it-possible-to-add-a-data-table-to-a-dashboard-containing-external-data/304234)
**Author:** [@marcw](https://discuss.elastic.co/u/marcw)\ **Replies:** 2\ **Last updated:** [May 10, 2022, 7:23am UTC](https://discuss.elastic.co/t/is-it-possible-to-add-a-data-table-to-a-dashboard-containing-external-data/304234 "2022-05-10T07:23:22Z")
I have a dashboard which contains a graph showing data from an eleastic search index. Now I get a question to add a data table to the dashboard containing data that's not available as Elasticsearch index. Can I get data … --- ## [Can anyone help me with fuzziness](https://discuss.elastic.co/t/can-anyone-help-me-with-fuzziness/304311)
**Author:** [@RohitBR\_K](https://discuss.elastic.co/u/RohitBR_K)\ **Replies:** 0\ **Last updated:** [May 10, 2022, 6:51am UTC](https://discuss.elastic.co/t/can-anyone-help-me-with-fuzziness/304311 "2022-05-10T06:51:50Z")
q = Q( 'bool', must=\[Q('match', text\_\_lyric={"query":query,"fuzziness":"AUTO"}), Q('match', code=query)\], minimum\_should\_match=20, … --- ## [Cross cluster search](https://discuss.elastic.co/t/cross-cluster-search/303484)
**Author:** [@InJong\_Park](https://discuss.elastic.co/u/InJong_Park)\ **Replies:** 6\ **Last updated:** [May 10, 2022, 6:50am UTC](https://discuss.elastic.co/t/cross-cluster-search/303484 "2022-05-10T06:50:18Z")
Hello. I’m InJong. I have a short question. Is it possible connect es-7.2.1(self) to es-7.17(elastic-cloud) for cross cluster search. --- ## [How to create tree layout query in vega?](https://discuss.elastic.co/t/how-to-create-tree-layout-query-in-vega/304308)
**Author:** [@Arifullah](https://discuss.elastic.co/u/Arifullah)\ **Replies:** 0\ **Last updated:** [May 10, 2022, 5:58am UTC](https://discuss.elastic.co/t/how-to-create-tree-layout-query-in-vega/304308 "2022-05-10T05:58:07Z")
Hope you are doing well, I have a problem in creating kibana query for a tree layout visualization in vega. I will send the example of tree layout which I want but I don't know how to edit the query for my requirements. … --- ## [Column names / headers](https://discuss.elastic.co/t/column-names-headers/304282)
**Author:** [@stefand](https://discuss.elastic.co/u/stefand)\ **Replies:** 4\ **Last updated:** [May 10, 2022, 5:57am UTC](https://discuss.elastic.co/t/column-names-headers/304282 "2022-05-10T05:57:43Z")
We just migrated to ES/Kibana 7 and are frustrated with display of data tables. The column names are not wrapped around anymore. I do not see an option for that. Also, there is no smart autosize option. And to make it… --- ## [Document Explorer field sorting](https://discuss.elastic.co/t/document-explorer-field-sorting/304210)
**Author:** [@Anfo](https://discuss.elastic.co/u/Anfo)\ **Replies:** 4\ **Last updated:** [May 10, 2022, 5:43am UTC](https://discuss.elastic.co/t/document-explorer-field-sorting/304210 "2022-05-10T05:43:53Z")
Hello On a steep learning curve with Elasticsearch and was wondering something about Document Explorer, please. I am noting that only some columns can be sorted A-Z, presumably because they only contain alpha strings no… --- ## [Am getting an error ' resource\_already\_exists\_exception' but locally everything runs fine](https://discuss.elastic.co/t/am-getting-an-error-resource-already-exists-exception-but-locally-everything-runs-fine/304306)
**Author:** [@RohitBR\_K](https://discuss.elastic.co/u/RohitBR_K)\ **Replies:** 1\ **Last updated:** [May 10, 2022, 5:42am UTC](https://discuss.elastic.co/t/am-getting-an-error-resource-already-exists-exception-but-locally-everything-runs-fine/304306 "2022-05-10T05:42:01Z")
everything runs fine in locally but when I run search\_index --rebuild in server , am getting resource\_already\_exists\_exception. how can I resolve this. --- ## [Fail to install elasticsearch-8.2.0 on Ubuntu machine](https://discuss.elastic.co/t/fail-to-install-elasticsearch-8-2-0-on-ubuntu-machine/304257)
**Author:** [@namespace-Pt](https://discuss.elastic.co/u/namespace-Pt)\ **Replies:** 10\ **Last updated:** [May 10, 2022, 5:26am UTC](https://discuss.elastic.co/t/fail-to-install-elasticsearch-8-2-0-on-ubuntu-machine/304257 "2022-05-10T05:26:47Z")
I downloaded the .tar.gz file on a Ubuntu 16.04.1 LTS machine, and shasum output OK. After unzipping the file and running ./bin/elasticsearch, the following error happens: \[0.001s\]\[warning\]\[os,container\] Duplicate cpuse… --- ## [Enabling X-Pack on Elasticsearch Cluster Defaults](https://discuss.elastic.co/t/enabling-x-pack-on-elasticsearch-cluster-defaults/304076)
**Author:** [@pushert](https://discuss.elastic.co/u/pushert)\ **Replies:** 5\ **Last updated:** [May 10, 2022, 4:53am UTC](https://discuss.elastic.co/t/enabling-x-pack-on-elasticsearch-cluster-defaults/304076 "2022-05-10T04:53:12Z")
Hi, When enabling X-Pack to an existing cluster does this automatically enable the security features ? Do I need to disable the security features so the cluster doesn't requirement TLS connection ? Thank You, --- ## [Filebeat autodiscover namespace\_defaults not work](https://discuss.elastic.co/t/filebeat-autodiscover-namespace-defaults-not-work/303901)
**Author:** [@lcc3108](https://discuss.elastic.co/u/lcc3108)\ **Replies:** 3\ **Last updated:** [May 10, 2022, 4:49am UTC](https://discuss.elastic.co/t/filebeat-autodiscover-namespace-defaults-not-work/303901 "2022-05-10T04:49:09Z")
Hello. I'm using Elasticsearch filebeat 7.17. According to the document, filebeat can use namespace's annotation when pod's annotation does not exist. But it seems to be working against my expectations. The followi… --- ## [Add fields do not work Winlogbeat](https://discuss.elastic.co/t/add-fields-do-not-work-winlogbeat/304232)
**Author:** [@CemG](https://discuss.elastic.co/u/CemG)\ **Replies:** 1\ **Last updated:** [May 10, 2022, 1:46am UTC](https://discuss.elastic.co/t/add-fields-do-not-work-winlogbeat/304232 "2022-05-10T01:46:27Z")
Hello, I would like to add fields in \_source by using fields config, and also I tested with pocessors. But I don't even see the fields that I wanted to add Processors config processors: - add\_fields: target: … --- ## [Bucket aggregation](https://discuss.elastic.co/t/bucket-aggregation/304271)
**Author:** [@meyer1](https://discuss.elastic.co/u/meyer1)\ **Replies:** 2\ **Last updated:** [May 10, 2022, 1:38am UTC](https://discuss.elastic.co/t/bucket-aggregation/304271 "2022-05-10T01:38:08Z")
Hello everyone, I have a short question for you. Currently I am trying to make an aggregation request for a table visualization. Except that I am limited to 65000 bucket or so (by default I believe according to the erro… --- ## [Elasticsearch ca certificate problem](https://discuss.elastic.co/t/elasticsearch-ca-certificate-problem/304108)
**Author:** [@uaygun](https://discuss.elastic.co/u/uaygun)\ **Replies:** 0\ **Last updated:** [May 6, 2022, 9:36am UTC](https://discuss.elastic.co/t/elasticsearch-ca-certificate-problem/304108 "2022-05-06T09:36:11Z")
Hi guys; I have a wazuh server with running filebeat and Elasticsearch. When i am trying to establish a connection from remote filebeat to my Elasticsearch i am getting "Exiting: error loading config file: yaml: line 1… --- ## [How to monitor urls with sso authentication](https://discuss.elastic.co/t/how-to-monitor-urls-with-sso-authentication/304133)
**Author:** [@aviral\_srivastava](https://discuss.elastic.co/u/aviral_srivastava)\ **Replies:** 4\ **Last updated:** [May 10, 2022, 12:56am UTC](https://discuss.elastic.co/t/how-to-monitor-urls-with-sso-authentication/304133 "2022-05-10T00:56:02Z")
Hi, My setup Elasticsearch 6.4.0, kibana 6.4.0 and heartbeat 6.4.0 heartbeat configuration: heartbeat.monitors: - type: http # List or urls to query urls: - https://appname.in.company.com:8443/appname-6.4 … --- ## [Checking CPU load after installing a plugin](https://discuss.elastic.co/t/checking-cpu-load-after-installing-a-plugin/304128)
**Author:** [@dishant.sharma](https://discuss.elastic.co/u/dishant.sharma)\ **Replies:** 1\ **Last updated:** [May 10, 2022, 12:35am UTC](https://discuss.elastic.co/t/checking-cpu-load-after-installing-a-plugin/304128 "2022-05-10T00:35:31Z")
I have created an Elasticsearch plugin. I want to check the Elasticsearch CPU load/usage after installing the Elasticsearch plugin and indexing some documents. I am pretty new to performance and data monitoring in Elasti… --- ## [Watcher for missing string for last 4 hours](https://discuss.elastic.co/t/watcher-for-missing-string-for-last-4-hours/304205)
**Author:** [@hemanth.mutyala](https://discuss.elastic.co/u/hemanth.mutyala)\ **Replies:** 0\ **Last updated:** [May 9, 2022, 4:41am UTC](https://discuss.elastic.co/t/watcher-for-missing-string-for-last-4-hours/304205 "2022-05-09T04:41:23Z")
Hi Guys, In our current project we are having a sync happening every 4 hours which will generate some logs. so, i need to create a watcher using one string "Updated final last sync" where it should throw an alert to our … --- ## [Error when installing filebeat on Raspberry PI 3](https://discuss.elastic.co/t/error-when-installing-filebeat-on-raspberry-pi-3/304240)
**Author:** [@Dhia\_Saibi](https://discuss.elastic.co/u/Dhia_Saibi)\ **Replies:** 1\ **Last updated:** [May 10, 2022, 12:34am UTC](https://discuss.elastic.co/t/error-when-installing-filebeat-on-raspberry-pi-3/304240 "2022-05-10T00:34:05Z")
I'm trying to install filebeat on my raspberry pi 3 following this tutorial https://www.gunnarleffler.com/posts/raspberry\_pi\_filebeats/?fbclid=IwAR1v-agodz-wkxPpwGa56kMOHq3M77K8iCHGS7zoyhx9B4TRwIxU9va76dc but I'm stuck a… --- ## [Unique value counts in kibana](https://discuss.elastic.co/t/unique-value-counts-in-kibana/304241)
**Author:** [@Kara1990](https://discuss.elastic.co/u/Kara1990)\ **Replies:** 1\ **Last updated:** [May 10, 2022, 12:33am UTC](https://discuss.elastic.co/t/unique-value-counts-in-kibana/304241 "2022-05-10T00:33:45Z")
Hello. I wonder if it is possible to get a detection or notification if a unique values increases to a certain number? Is it possible and if so where? Hope you can help unique values that I am referring to are made in a… --- ## [Is there a Way Fetch Data From Multiple Indexes](https://discuss.elastic.co/t/is-there-a-way-fetch-data-from-multiple-indexes/304219)
**Author:** [@Gojo](https://discuss.elastic.co/u/Gojo)\ **Replies:** 1\ **Last updated:** [May 10, 2022, 12:27am UTC](https://discuss.elastic.co/t/is-there-a-way-fetch-data-from-multiple-indexes/304219 "2022-05-10T00:27:43Z")
Is there a Way Fetch Data From Multiple Indexes , like using scroll api ? --- ## [Adding a new and different ElasticSearch node to Kibana](https://discuss.elastic.co/t/adding-a-new-and-different-elasticsearch-node-to-kibana/304277)
**Author:** [@leonardof131](https://discuss.elastic.co/u/leonardof131)\ **Replies:** 3\ **Last updated:** [May 10, 2022, 12:23am UTC](https://discuss.elastic.co/t/adding-a-new-and-different-elasticsearch-node-to-kibana/304277 "2022-05-10T00:23:56Z")
I've seen some similar posts on the forum but none of them quite represents my issue. I've got an Elasticsearch instance running receiving some logs, and Kibana in a separete instance pointed to it. Everything works gre… --- ## [Patch release cycle (Kibana and Elasticsearch)](https://discuss.elastic.co/t/patch-release-cycle-kibana-and-elasticsearch/304294)
**Author:** [@Ktiam](https://discuss.elastic.co/u/Ktiam)\ **Replies:** 1\ **Last updated:** [May 10, 2022, 12:22am UTC](https://discuss.elastic.co/t/patch-release-cycle-kibana-and-elasticsearch/304294 "2022-05-10T00:22:16Z")
Hi everyone, I’m wondering if there is an official patch release cycle for the basic free version of Kibana and Elasticsearch? For example, 2 major updates per calendar year, etc. --- ## [Manually group specified terms in Aggregations](https://discuss.elastic.co/t/manually-group-specified-terms-in-aggregations/304176)
**Author:** [@NathBabs](https://discuss.elastic.co/u/NathBabs)\ **Replies:** 6\ **Last updated:** [May 9, 2022, 9:34pm UTC](https://discuss.elastic.co/t/manually-group-specified-terms-in-aggregations/304176 "2022-05-09T21:34:11Z")
I want to manually specify terms to group in aggregations i have a query like this { "index": "xxx-xxx", "size": 0, "body": { "query": { "bool": { "must": \[ … --- ## [Using two kibana for HA(active-active) - Pointing to the same Elastic cluster](https://discuss.elastic.co/t/using-two-kibana-for-ha-active-active-pointing-to-the-same-elastic-cluster/304283)
**Author:** [@jonatiao](https://discuss.elastic.co/u/jonatiao)\ **Replies:** 3\ **Last updated:** [May 9, 2022, 8:50pm UTC](https://discuss.elastic.co/t/using-two-kibana-for-ha-active-active-pointing-to-the-same-elastic-cluster/304283 "2022-05-09T20:50:36Z")
Hello, Is it possible to have two kibana, in different VMs, in an active-active state responding the the same address via LB? Browser(kibana.mydomain.com) -\> LB -\> kibana1,kibana2 If yes, what are the configurations w… --- ## [How to remove event with "'\'" value on an IP type field](https://discuss.elastic.co/t/how-to-remove-event-with-nil-value-on-an-ip-type-field/304273)
**Author:** [@Thuunder7](https://discuss.elastic.co/u/Thuunder7)\ **Replies:** 6\ **Last updated:** [May 9, 2022, 7:45pm UTC](https://discuss.elastic.co/t/how-to-remove-event-with-nil-value-on-an-ip-type-field/304273 "2022-05-09T19:45:23Z")
Hello, I am trying to drop events every time the field \[dns.resolved\_ip\] is ''. I have tried multiple approachs but without successs. "reason"=\>"failed to parse field \[dns.resolved\_ip\] of type \[ip\] in document with id… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=944) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=946)