# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=947 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 948 --- ## [Security Error Kibana](https://discuss.elastic.co/t/security-error-kibana/303823)
**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\ **Replies:** 4\ **Last updated:** [May 9, 2022, 7:52am UTC](https://discuss.elastic.co/t/security-error-kibana/303823 "2022-05-09T07:52:19Z")
Hello ! When I enter a dashboard with my user who has a specific role assigned, the following error appears. I can't find what permission would be needed.... \[object Object\]: security\_exception: \[security\_exception\] Re… --- ## [Failed to retrieve shard stats from node](https://discuss.elastic.co/t/failed-to-retrieve-shard-stats-from-node/304211)
**Author:** [@amitsa](https://discuss.elastic.co/u/amitsa)\ **Replies:** 1\ **Last updated:** [May 9, 2022, 7:49am UTC](https://discuss.elastic.co/t/failed-to-retrieve-shard-stats-from-node/304211 "2022-05-09T07:49:20Z")
I am running es-cluster on kubernetes on secure mode(Basic security) . I am getting below warning on master es node logs. why am i getting this error during benchmarking with esrally. i have 1 master and a data node run… --- ## [Logstash S3 input](https://discuss.elastic.co/t/logstash-s3-input/304118)
**Author:** [@shivendra95](https://discuss.elastic.co/u/shivendra95)\ **Replies:** 3\ **Last updated:** [May 9, 2022, 7:34am UTC](https://discuss.elastic.co/t/logstash-s3-input/304118 "2022-05-09T07:34:07Z")
Hi there, I'm trying to use the logstash S3 input plugin to fetch logs from S3 bucket. This is my input s3 { id =\> "terminal\_app" access\_key\_id =\> "${access\_key\_id}" secret\_access\_key =\> "${secret\_access\_k… --- ## [Timestamp field issue](https://discuss.elastic.co/t/timestamp-field-issue/304126)
**Author:** [@shivendra95](https://discuss.elastic.co/u/shivendra95)\ **Replies:** 2\ **Last updated:** [May 9, 2022, 7:31am UTC](https://discuss.elastic.co/t/timestamp-field-issue/304126 "2022-05-09T07:31:04Z")
Hi there, I'm using S3 to read input into logstash. The timestamp field generated in Elasticsearch is the time when logs are read from S3 and not the timestamp field of the json log file. Below is one object of the jso… --- ## [Why query DSL select doc which not include field?](https://discuss.elastic.co/t/why-query-dsl-select-doc-which-not-include-field/304208)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 4\ **Last updated:** [May 9, 2022, 7:25am UTC](https://discuss.elastic.co/t/why-query-dsl-select-doc-which-not-include-field/304208 "2022-05-09T07:25:40Z")
Dears, I need your advice/explanation. This is my query which select document from index which not include field f1.rc. I don't understand why. What is wrong in below query? Any idea? In my opinion this query should … --- ## [High CPU usage elasticsearch](https://discuss.elastic.co/t/high-cpu-usage-elasticsearch/304085)
**Author:** [@dishant.sharma](https://discuss.elastic.co/u/dishant.sharma)\ **Replies:** 4\ **Last updated:** [May 9, 2022, 6:40am UTC](https://discuss.elastic.co/t/high-cpu-usage-elasticsearch/304085 "2022-05-09T06:40:02Z")
I have created an Elasticsearch plugin. It is working absolutely fine. But, in the case of bulk indexing, it is getting a request timeout, and when I checked the CPU usage, it was showing 101.76% usage. I am using a lot… --- ## [What happens if I let my beats service run constantly](https://discuss.elastic.co/t/what-happens-if-i-let-my-beats-service-run-constantly/304036)
**Author:** [@smam](https://discuss.elastic.co/u/smam)\ **Replies:** 2\ **Last updated:** [May 9, 2022, 6:08am UTC](https://discuss.elastic.co/t/what-happens-if-i-let-my-beats-service-run-constantly/304036 "2022-05-09T06:08:45Z")
Hello, I have a script that changes my winlogbeat.yml as a scheduled task. What happens if I start the winlogbeat service? Would he notice the change of data and still use it or would I have to stop the service, change… --- ## [Import/export CSV data feeds to elasticsearch](https://discuss.elastic.co/t/import-export-csv-data-feeds-to-elasticsearch/304189)
**Author:** [@Samiul008](https://discuss.elastic.co/u/Samiul008)\ **Replies:** 4\ **Last updated:** [May 9, 2022, 5:18am UTC](https://discuss.elastic.co/t/import-export-csv-data-feeds-to-elasticsearch/304189 "2022-05-09T05:18:27Z")
Good Day community! is there any way to automate the process of downloading CSV files from gmail and ingest those to Elasticsearch by creating new indices? My challenges are following- Downloading the CSV files from … --- ## [Like search on multiple indexes on elastic search](https://discuss.elastic.co/t/like-search-on-multiple-indexes-on-elastic-search/304165)
**Author:** [@Rajesh\_Kumar3](https://discuss.elastic.co/u/Rajesh_Kumar3)\ **Replies:** 2\ **Last updated:** [May 9, 2022, 5:08am UTC](https://discuss.elastic.co/t/like-search-on-multiple-indexes-on-elastic-search/304165 "2022-05-09T05:08:46Z")
Hi, I stuck on like searching on multiple indexes on Elasticsearch. I am using a query string and must to extract data for the particular user. Example JSON index "tasks" { "channelName": "Weekly Task-(HT-01030284)… --- ## [Install winlogbeat dashboard](https://discuss.elastic.co/t/install-winlogbeat-dashboard/304198)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 2\ **Last updated:** [May 9, 2022, 3:53am UTC](https://discuss.elastic.co/t/install-winlogbeat-dashboard/304198 "2022-05-09T03:53:09Z")
Is there a way to install the winlogbeat dashboards on the machine running kibana? All the docs imply that this can only be done from the windows system that are being monitored (of which there are many) and I don't hav… --- ## [Logging failed shards in search response](https://discuss.elastic.co/t/logging-failed-shards-in-search-response/303109)
**Author:** [@Nobuaki\_Ito](https://discuss.elastic.co/u/Nobuaki_Ito)\ **Replies:** 1\ **Last updated:** [May 9, 2022, 3:50am UTC](https://discuss.elastic.co/t/logging-failed-shards-in-search-response/303109 "2022-05-09T03:50:23Z")
My team would like to keep track of occurrences of shard failures. Is there any way to enable logging of such events? To clarify, the event that I would like to log is the occurrence of "failed" in the \_shards block of … --- ## [Can we select history source in peer recovery by settings When both Lucene soft-deletes and Translog are available](https://discuss.elastic.co/t/can-we-select-history-source-in-peer-recovery-by-settings-when-both-lucene-soft-deletes-and-translog-are-available/304203)
**Author:** [@liurui](https://discuss.elastic.co/u/liurui)\ **Replies:** 2\ **Last updated:** [May 9, 2022, 3:12am UTC](https://discuss.elastic.co/t/can-we-select-history-source-in-peer-recovery-by-settings-when-both-lucene-soft-deletes-and-translog-are-available/304203 "2022-05-09T03:12:28Z")
Hi ~ :smile: I encountered a problem with an online cluster: Peer recovery is very slow on translog stage. Ioutil of source node full intermittently. We don't have much read/write tasks and from Jstack, we see sou… --- ## [Filebeat Docker input: exclude container by name](https://discuss.elastic.co/t/filebeat-docker-input-exclude-container-by-name/304202)
**Author:** [@alifsaddid](https://discuss.elastic.co/u/alifsaddid)\ **Replies:** 0\ **Last updated:** [May 9, 2022, 2:21am UTC](https://discuss.elastic.co/t/filebeat-docker-input-exclude-container-by-name/304202 "2022-05-09T02:21:37Z")
Hi, I am having a problem on configuring filebeat. I am running filebeat, logstash, Elasticsearch, and kibana on Docker. I want to retrieve logs of all existing containers, except from filebeat, logstash, Elasticsearch,… --- ## [How can I change the default size of the returned aggregations (10) in kibana “create new rule”?](https://discuss.elastic.co/t/how-can-i-change-the-default-size-of-the-returned-aggregations-10-in-kibana-create-new-rule/303860)
**Author:** [@MNB\_1101](https://discuss.elastic.co/u/MNB_1101)\ **Replies:** 1\ **Last updated:** [May 4, 2022, 1:09am UTC](https://discuss.elastic.co/t/how-can-i-change-the-default-size-of-the-returned-aggregations-10-in-kibana-create-new-rule/303860 "2022-05-04T01:09:45Z")
Hi, To create new rule in kibana ,when I selected "Threshold Aggregate query results to detect when number of matches exceeds threshold." , by default size is 10: { "aggregations": { "eventActionGroup": { "terms": { "o… --- ## [My filebeat start occur error](https://discuss.elastic.co/t/my-filebeat-start-occur-error/304188)
**Author:** [@zhanghao116560](https://discuss.elastic.co/u/zhanghao116560)\ **Replies:** 2\ **Last updated:** [May 9, 2022, 12:37am UTC](https://discuss.elastic.co/t/my-filebeat-start-occur-error/304188 "2022-05-09T00:37:05Z")
Here is my configuration information: processors: - add\_host\_metadata: ~ - add\_cloud\_metadata: ~ - drop\_fields: fields: \["beat"\] I want to add a filter to remove the beat attribute, However, a startup error o… --- ## [License is not available](https://discuss.elastic.co/t/license-is-not-available/304149)
**Author:** [@Onsrm](https://discuss.elastic.co/u/Onsrm)\ **Replies:** 5\ **Last updated:** [May 8, 2022, 11:46pm UTC](https://discuss.elastic.co/t/license-is-not-available/304149 "2022-05-08T23:46:26Z")
hello , when I use Elasticsearch with kibana they work together but when I add xpack.security.enabled: true in Elasticsearch.yml they stop working and I get this message : license is not available --- ## [I cant Add index in my kibana](https://discuss.elastic.co/t/i-cant-add-index-in-my-kibana/304183)
**Author:** [@DanialNabi82](https://discuss.elastic.co/u/DanialNabi82)\ **Replies:** 1\ **Last updated:** [May 8, 2022, 11:24pm UTC](https://discuss.elastic.co/t/i-cant-add-index-in-my-kibana/304183 "2022-05-08T23:24:36Z")
Hi I install new version of kibana and Elasticsearch (8.2.0) in my kibana dashboard I cant add new index --- ## [Trouble with artifacts.elastic.co ― Error 403](https://discuss.elastic.co/t/trouble-with-artifacts-elastic-co-error-403/304142)
**Author:** [@ilya.romashev](https://discuss.elastic.co/u/ilya.romashev)\ **Replies:** 1\ **Last updated:** [May 8, 2022, 10:29pm UTC](https://discuss.elastic.co/t/trouble-with-artifacts-elastic-co-error-403/304142 "2022-05-08T22:29:30Z")
Can't connect to Elasticsearch rpm repo, instead of xml with repo metadata server answers with 403 error. Is there anything wrong with this repo? --- ## [How to change default value size parameter of the terms aggregation?](https://discuss.elastic.co/t/how-to-change-default-value-size-parameter-of-the-terms-aggregation/304162)
**Author:** [@MNB\_1101](https://discuss.elastic.co/u/MNB_1101)\ **Replies:** 3\ **Last updated:** [May 8, 2022, 10:27pm UTC](https://discuss.elastic.co/t/how-to-change-default-value-size-parameter-of-the-terms-aggregation/304162 "2022-05-08T22:27:53Z")
By default, the terms aggregation returns the top ten terms with the most documents. How to change default value of the size parameter of terms aggregation? --- ## [Logstash cant start the pipeline in the conf.d file](https://discuss.elastic.co/t/logstash-cant-start-the-pipeline-in-the-conf-d-file/304172)
**Author:** [@ahmed\_barki](https://discuss.elastic.co/u/ahmed_barki)\ **Replies:** 9\ **Last updated:** [May 8, 2022, 7:49pm UTC](https://discuss.elastic.co/t/logstash-cant-start-the-pipeline-in-the-conf-d-file/304172 "2022-05-08T19:49:00Z")
Hello everyone, when i use the command /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/simple.conf here is what i get '\[INFO \] 2022-05-07 09:58:02.271 \[\[main\]-pipeline-manager\] elasticsearch - New Elasticsear… --- ## [\[.kibana\_task\_manager\] Action failed with ‘Request timed out’](https://discuss.elastic.co/t/kibana-task-manager-action-failed-with-request-timed-out/302420)
**Author:** [@ndinesh-aie](https://discuss.elastic.co/u/ndinesh-aie)\ **Replies:** 3\ **Last updated:** [May 8, 2022, 7:08pm UTC](https://discuss.elastic.co/t/kibana-task-manager-action-failed-with-request-timed-out/302420 "2022-05-08T19:08:19Z")
Continuing the discussion from \[.kibana\_task\_manager\] Action failed with 'Request timed out': --- ## [Kibana server unable to connect to :5601](https://discuss.elastic.co/t/kibana-server-unable-to-connect-to-5601/304187)
**Author:** [@Heythem\_DHAOUADI](https://discuss.elastic.co/u/Heythem_DHAOUADI)\ **Replies:** 4\ **Last updated:** [May 8, 2022, 4:21pm UTC](https://discuss.elastic.co/t/kibana-server-unable-to-connect-to-5601/304187 "2022-05-08T16:21:42Z")
This is my kibana.yml # Kibana is served by a back end server. This setting specifies the port to use. server.port: 5601 # Specifies the address to which the Kibana server will bind. IP addresses and host names are bot… --- ## [Sending data to logstash from remote machine](https://discuss.elastic.co/t/sending-data-to-logstash-from-remote-machine/304192)
**Author:** [@safaeaz](https://discuss.elastic.co/u/safaeaz)\ **Replies:** 4\ **Last updated:** [May 8, 2022, 3:58pm UTC](https://discuss.elastic.co/t/sending-data-to-logstash-from-remote-machine/304192 "2022-05-08T15:58:58Z")
i have logstash running on a different machine and want to read csv files from anothere mechine. Is there a way to set the ip in file input of config file? --- ## [Data type for Log Message Fields, does keyword add overhead?](https://discuss.elastic.co/t/data-type-for-log-message-fields-does-keyword-add-overhead/304043)
**Author:** [@scott\_stash](https://discuss.elastic.co/u/scott_stash)\ **Replies:** 6\ **Last updated:** [May 8, 2022, 6:23am UTC](https://discuss.elastic.co/t/data-type-for-log-message-fields-does-keyword-add-overhead/304043 "2022-05-08T06:23:46Z")
Currently I'm indexing log messages into Elasticsearch. Generally the initial 'message' field is dissected and stored in the following fields: @timestamp(date), logLevel(keyword), logMessage(keyword/text). … --- ## [Why ingest pipline first field is default date, How can I set it string?](https://discuss.elastic.co/t/why-ingest-pipline-first-field-is-default-date-how-can-i-set-it-string/304168)
**Author:** [@kiddingl](https://discuss.elastic.co/u/kiddingl)\ **Replies:** 4\ **Last updated:** [May 8, 2022, 2:31am UTC](https://discuss.elastic.co/t/why-ingest-pipline-first-field-is-default-date-how-can-i-set-it-string/304168 "2022-05-08T02:31:39Z")
My kibane and es version is 7.8.0 I create a pipline on kibana dashboard { "description": "test", "processors": \[ { "grok": { "field": "message", "patterns": \["%{DATA:a1} %{GREEDYDATA:con… --- ## [Getting error while setting password in interactive mode](https://discuss.elastic.co/t/getting-error-while-setting-password-in-interactive-mode/304096)
**Author:** [@amitsa](https://discuss.elastic.co/u/amitsa)\ **Replies:** 5\ **Last updated:** [May 8, 2022, 1:15am UTC](https://discuss.elastic.co/t/getting-error-while-setting-password-in-interactive-mode/304096 "2022-05-08T01:15:49Z")
Hi i am trying to generate certificate and set passwd in interactive mode during build time but getting error. Docker file ARG ELASTICSEARCH\_VER="8.1.3" ARG ELASTICSEARCH\_IMAGE=docker.elastic.co/elasticsearch/elastics… --- ## [ES8 Java Client API : Index API - Get index features flag seems missing](https://discuss.elastic.co/t/es8-java-client-api-index-api-get-index-features-flag-seems-missing/304081)
**Author:** [@Felton\_Fee](https://discuss.elastic.co/u/Felton_Fee)\ **Replies:** 2\ **Last updated:** [May 7, 2022, 2:23pm UTC](https://discuss.elastic.co/t/es8-java-client-api-index-api-get-index-features-flag-seems-missing/304081 "2022-05-07T14:23:28Z")
With ES8 java client to get index client.indices().get(c -\> c.index(name).features(...)) I didn't find the method corresponding to the following param: features (Optional, string) Return information about specific in… --- ## [Bulk Indexing API- To return the number of successful updates/creates](https://discuss.elastic.co/t/bulk-indexing-api-to-return-the-number-of-successful-updates-creates/304174)
**Author:** [@Zee\_Grinch](https://discuss.elastic.co/u/Zee_Grinch)\ **Replies:** 0\ **Last updated:** [May 7, 2022, 1:24pm UTC](https://discuss.elastic.co/t/bulk-indexing-api-to-return-the-number-of-successful-updates-creates/304174 "2022-05-07T13:24:04Z")
Not sure if this is a feature request, or is something that I missed (like a parameter in the Request that can enable this): The JSON body returned by a ~/\_bulk POST will include fairly rich info in the items\[\] array, b… --- ## [How to delete field in filebeat7.8.0](https://discuss.elastic.co/t/how-to-delete-field-in-filebeat7-8-0/302908)
**Author:** [@kiddingl](https://discuss.elastic.co/u/kiddingl)\ **Replies:** 6\ **Last updated:** [May 7, 2022, 8:36am UTC](https://discuss.elastic.co/t/how-to-delete-field-in-filebeat7-8-0/302908 "2022-05-07T08:36:58Z")
I collect log file and output to es with filebeat, But I get many unused fileds,like this: The many of field which is no value, How to delete it --- ## [Event tracking for improving conversion rate](https://discuss.elastic.co/t/event-tracking-for-improving-conversion-rate/303274)
**Author:** [@yukai](https://discuss.elastic.co/u/yukai)\ **Replies:** 2\ **Last updated:** [May 6, 2022, 7:11am UTC](https://discuss.elastic.co/t/event-tracking-for-improving-conversion-rate/303274 "2022-05-06T07:11:18Z")
We built a video search platform powered by Elasticsearch. Which consists of a search bar (of course) and many interesting functions like video recommendation, search histories, video comments and so on. Which confuses… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=946) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=948)