# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=948 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 949 --- ## [Elastic query is not fast and response time is high](https://discuss.elastic.co/t/elastic-query-is-not-fast-and-response-time-is-high/303982)
**Author:** [@alpine\_f1](https://discuss.elastic.co/u/alpine_f1)\ **Replies:** 8\ **Last updated:** [May 7, 2022, 5:01am UTC](https://discuss.elastic.co/t/elastic-query-is-not-fast-and-response-time-is-high/303982 "2022-05-07T05:01:48Z")
Cluster setup: I am running Elasticsearch cluster (2 master, 2 data and 1 voter) as docker containers. Kibana setup: I also have Kibana configured to connect to the elastic cluster. Frontend: I have an angular web a… --- ## [How do we make a search suggestions like amazon in elasticsearch](https://discuss.elastic.co/t/how-do-we-make-a-search-suggestions-like-amazon-in-elasticsearch/304116)
**Author:** [@RohitBR\_K](https://discuss.elastic.co/u/RohitBR_K)\ **Replies:** 3\ **Last updated:** [May 7, 2022, 2:06am UTC](https://discuss.elastic.co/t/how-do-we-make-a-search-suggestions-like-amazon-in-elasticsearch/304116 "2022-05-07T02:06:15Z")
am using Elasticsearch for my suggestion. I need a suggestion like amazon. how can i do it with Elasticsearch ? --- ## [Indexes rolling over due to ILM are not adding an alias](https://discuss.elastic.co/t/indexes-rolling-over-due-to-ilm-are-not-adding-an-alias/304150)
**Author:** [@perfecto25](https://discuss.elastic.co/u/perfecto25)\ **Replies:** 1\ **Last updated:** [May 7, 2022, 12:44am UTC](https://discuss.elastic.co/t/indexes-rolling-over-due-to-ilm-are-not-adding-an-alias/304150 "2022-05-07T00:44:14Z")
Hello, is it possible to configure Filebeat, Metricbeat, etc to automaticlaly create an alias whenever the index rolls over a to a new one due to ILM lifecycle policy?, ie, my index for Fbeat rolled over due to ILM poli… --- ## [Getting a discover/dashboard error of: "Unexpected token \< in JSON at position 0"](https://discuss.elastic.co/t/getting-a-discover-dashboard-error-of-unexpected-token-in-json-at-position-0/303785)
**Author:** [@jonezy7173](https://discuss.elastic.co/u/jonezy7173)\ **Replies:** 11\ **Last updated:** [May 7, 2022, 12:26am UTC](https://discuss.elastic.co/t/getting-a-discover-dashboard-error-of-unexpected-token-in-json-at-position-0/303785 "2022-05-07T00:26:44Z")
I'm not able to find much information about this online except for this post. However, their issue was caused by a proxy. I'm simply setup on a single node in my homelab off of a span port on my switch (and I have a mana… --- ## [Issue Using the Connector from PySpark in 7.17.3](https://discuss.elastic.co/t/issue-using-the-connector-from-pyspark-in-7-17-3/304084)
**Author:** [@ito](https://discuss.elastic.co/u/ito)\ **Replies:** 3\ **Last updated:** [May 7, 2022, 12:18am UTC](https://discuss.elastic.co/t/issue-using-the-connector-from-pyspark-in-7-17-3/304084 "2022-05-07T00:18:45Z")
I have Elasticsearch 7.17.3 running on localhost:9200, so I downloaded Elasticsearch for Apache Hadoop 7.17.3. Then I copied Elasticsearch-spark-20\_2.11-7.17.3.jar to my jar folder. I read "Using the connector from PySp… --- ## [Simple scatter plot - infinite extents when using transform](https://discuss.elastic.co/t/simple-scatter-plot-infinite-extents-when-using-transform/303981)
**Author:** [@qd-danh](https://discuss.elastic.co/u/qd-danh)\ **Replies:** 4\ **Last updated:** [May 6, 2022, 10:59pm UTC](https://discuss.elastic.co/t/simple-scatter-plot-infinite-extents-when-using-transform/303981 "2022-05-06T22:59:16Z")
New to Kibana + Vega and going through lots of tutorials, landed on this video to try to make a simple scatter plot. Using the sample eCommerce data. I am so close, but seemingly something slightly wrong. Comparing what… --- ## [Locked myself out of my superuser role by accident, how do I get access back?](https://discuss.elastic.co/t/locked-myself-out-of-my-superuser-role-by-accident-how-do-i-get-access-back/303977)
**Author:** [@pritster5](https://discuss.elastic.co/u/pritster5)\ **Replies:** 5\ **Last updated:** [May 6, 2022, 10:50pm UTC](https://discuss.elastic.co/t/locked-myself-out-of-my-superuser-role-by-accident-how-do-i-get-access-back/303977 "2022-05-06T22:50:20Z")
Being the idiot I am, I had a use case where I needed to make two accounts for myself, one with admin access and one with regular access. Instead of making the new admin account BEFORE I demoted my current account to th… --- ## [Return Selected Fields from DSL Aggregation](https://discuss.elastic.co/t/return-selected-fields-from-dsl-aggregation/304158)
**Author:** [@fefontana](https://discuss.elastic.co/u/fefontana)\ **Replies:** 0\ **Last updated:** [May 6, 2022, 10:06pm UTC](https://discuss.elastic.co/t/return-selected-fields-from-dsl-aggregation/304158 "2022-05-06T22:06:24Z")
Hello, I have the following \_search query: { "size": 0, "aggs": { "3": { "terms": { "field": "REGIONAL.keyword", "order": { "\_count"… --- ## [Agents in Fleet Healthy, but no logs](https://discuss.elastic.co/t/agents-in-fleet-healthy-but-no-logs/304154)
**Author:** [@jumpie](https://discuss.elastic.co/u/jumpie)\ **Replies:** 1\ **Last updated:** [May 6, 2022, 10:04pm UTC](https://discuss.elastic.co/t/agents-in-fleet-healthy-but-no-logs/304154 "2022-05-06T22:04:50Z")
Hello, I have a couple agents managed by Fleet. They say healthy in Fleet and when I run elastic-agent -health on the client, but they have no logs in Discover. I also have a couple agents running standalone and they d… --- ## [Help enhancing bubble chart](https://discuss.elastic.co/t/help-enhancing-bubble-chart/302161)
**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\ **Replies:** 1\ **Last updated:** [May 6, 2022, 8:41pm UTC](https://discuss.elastic.co/t/help-enhancing-bubble-chart/302161 "2022-05-06T20:41:03Z")
Hello. I was able to create a Bubble Chart using Vega, but I need to do the following enhancements; Add click bubble to filter Add hover legend text to highlight bubble Add "kilo" format to X axis (100.000 =\> 100K) wor… --- ## [Local Logstash 7.9.3 error: (EACCES) Permission denied - NUL](https://discuss.elastic.co/t/local-logstash-7-9-3-error-eacces-permission-denied-nul/304153)
**Author:** [@JonathanHai](https://discuss.elastic.co/u/JonathanHai)\ **Replies:** 1\ **Last updated:** [May 6, 2022, 8:23pm UTC](https://discuss.elastic.co/t/local-logstash-7-9-3-error-eacces-permission-denied-nul/304153 "2022-05-06T20:23:17Z")
Hi everyone, I'm attempting to run a local instance of Logstash 7.9.3 on my windows machine. Specifically, C:\\logstash-7.9.3\\bin\>logstash.bat \[ERROR\] 2022-05-06 15:04:57.066 \[main\] Logstash - java.lang.IllegalStateExce… --- ## [Kibana keeps logging users out with message "An unexpected authentication error occurred. Please log in again."](https://discuss.elastic.co/t/kibana-keeps-logging-users-out-with-message-an-unexpected-authentication-error-occurred-please-log-in-again/299729)
**Author:** [@Amphagory](https://discuss.elastic.co/u/Amphagory)\ **Replies:** 10\ **Last updated:** [May 6, 2022, 5:00pm UTC](https://discuss.elastic.co/t/kibana-keeps-logging-users-out-with-message-an-unexpected-authentication-error-occurred-please-log-in-again/299729 "2022-05-06T17:00:39Z")
I am running an Elastic Service v7.16.2, when I open a single tab or multiply tabs of Kibana, it unexpectedly logs the user out, sometimes after a minute or less. Other times it seems to be stable and keeps user logged i… --- ## [Throttle Filter Logstash](https://discuss.elastic.co/t/throttle-filter-logstash/304104)
**Author:** [@Bigboy0706](https://discuss.elastic.co/u/Bigboy0706)\ **Replies:** 1\ **Last updated:** [May 6, 2022, 4:47pm UTC](https://discuss.elastic.co/t/throttle-filter-logstash/304104 "2022-05-06T16:47:21Z")
Hi As there are some deduplicated log ingressing into logstash That's why I would like to use the Throttle Filter to filter out the log The config is listed as below filter { if \[name\] == "pack\_incident\_response… --- ## [XML plugin parse](https://discuss.elastic.co/t/xml-plugin-parse/304124)
**Author:** [@adrianfusco](https://discuss.elastic.co/u/adrianfusco)\ **Replies:** 1\ **Last updated:** [May 6, 2022, 4:41pm UTC](https://discuss.elastic.co/t/xml-plugin-parse/304124 "2022-05-06T16:41:09Z")
Hello, I've been using the XML filtering plugin because I need to parse some XML data. This is a simple example: \ \ \ Desc… --- ## [Grok help needed](https://discuss.elastic.co/t/grok-help-needed/304102)
**Author:** [@sdevasy73](https://discuss.elastic.co/u/sdevasy73)\ **Replies:** 6\ **Last updated:** [May 6, 2022, 3:53pm UTC](https://discuss.elastic.co/t/grok-help-needed/304102 "2022-05-06T15:53:16Z")
i am a newbie to grok pattern, trying to parse the below mentioned cisco firewall syslog. With the try struggling with what type to use to extract the interested fields, some of them works if i paste it individually, bu… --- ## [Logstash can't connect to Elasticsearch](https://discuss.elastic.co/t/logstash-cant-connect-to-elasticsearch/303623)
**Author:** [@ozz](https://discuss.elastic.co/u/ozz)\ **Replies:** 2\ **Last updated:** [May 6, 2022, 3:37pm UTC](https://discuss.elastic.co/t/logstash-cant-connect-to-elasticsearch/303623 "2022-05-06T15:37:51Z")
Hi guys. I'm trying to connect to Elasticsearch from Logstash, but it fails due to certificate issues. To give some background data: Version 8.1.3 on Kubernetes with Rancher. I build a couple of kustomization yaml files… --- ## [Kibana\_system privileges - unauthorized for user \[kibana\_system\] with roles \[kibana\_system\] on indices](https://discuss.elastic.co/t/kibana-system-privileges-unauthorized-for-user-kibana-system-with-roles-kibana-system-on-indices/303505)
**Author:** [@Penchev](https://discuss.elastic.co/u/Penchev)\ **Replies:** 3\ **Last updated:** [May 6, 2022, 3:01pm UTC](https://discuss.elastic.co/t/kibana-system-privileges-unauthorized-for-user-kibana-system-with-roles-kibana-system-on-indices/303505 "2022-05-06T15:01:23Z")
Hi, I changed the deprecated user kibana to kibana\_system and now I have this error. {"type":"log","@timestamp":"2022-04-28T02:45:00-04:00","tags":\["error","plugins","wazuh","monitoring"\],"pid":29306,"message":"secur… --- ## [Visualize grouped endpoints excluding unique IDs](https://discuss.elastic.co/t/visualize-grouped-endpoints-excluding-unique-ids/302217)
**Author:** [@ethranes](https://discuss.elastic.co/u/ethranes)\ **Replies:** 3\ **Last updated:** [May 6, 2022, 2:34pm UTC](https://discuss.elastic.co/t/visualize-grouped-endpoints-excluding-unique-ids/302217 "2022-05-06T14:34:07Z")
Hi I'm trying to get a visualization of the count of endpoints hit in a timeframe. My issue is that when I add my url.path feild to the visualization it displays like this (as an example) /rest/endpoint/8372812 /rest/e… --- ## [Kibana Dashboard import from 7.x to 8.x](https://discuss.elastic.co/t/kibana-dashboard-import-from-7-x-to-8-x/304003)
**Author:** [@Aman\_Gupta1](https://discuss.elastic.co/u/Aman_Gupta1)\ **Replies:** 4\ **Last updated:** [May 6, 2022, 2:13pm UTC](https://discuss.elastic.co/t/kibana-dashboard-import-from-7-x-to-8-x/304003 "2022-05-06T14:13:30Z")
Hi Team, I have moved my ELK stack from 7.x to 8.x i have exported dashboards from 7.x but while uploading to 8.x it gives error. Not supported. As format is changed from .json to .ndjson. Is there any way to do this… --- ## [Elasticsearch nodejs client 8.2 msearch error](https://discuss.elastic.co/t/elasticsearch-nodejs-client-8-2-msearch-error/304132)
**Author:** [@Akaren](https://discuss.elastic.co/u/Akaren)\ **Replies:** 1\ **Last updated:** [May 6, 2022, 2:02pm UTC](https://discuss.elastic.co/t/elasticsearch-nodejs-client-8-2-msearch-error/304132 "2022-05-06T14:02:35Z")
We have been using elastic node js client version 8.1.0 and updated to @elastic/Elasticsearch@8.2.0. Suddently our msearch query stopped working with ResponseError: illegal\_argument\_exception: \[illegal\_argument\_except… --- ## [Push json array to elasticsearch](https://discuss.elastic.co/t/push-json-array-to-elasticsearch/304099)
**Author:** [@SnehaB](https://discuss.elastic.co/u/SnehaB)\ **Replies:** 1\ **Last updated:** [May 6, 2022, 1:59pm UTC](https://discuss.elastic.co/t/push-json-array-to-elasticsearch/304099 "2022-05-06T13:59:51Z")
Hi Team, I am trying to pushing the json array of data to Elasticsearch but its showing as error How to push below json array to Elasticsearch:- \[ { "operation": "create", "senderid": "jmbaxi001", "values": \[ { … --- ## [Log Flow/Stream](https://discuss.elastic.co/t/log-flow-stream/303605)
**Author:** [@Bo-Wyatt](https://discuss.elastic.co/u/Bo-Wyatt)\ **Replies:** 4\ **Last updated:** [May 6, 2022, 1:35pm UTC](https://discuss.elastic.co/t/log-flow-stream/303605 "2022-05-06T13:35:58Z")
Hello, I want to display a visualization of my log stream on my Dashboard. I only have a data view/index pattern matching my Index. I'm currently using a table but I can only show up to 1000 records (and it's represented… --- ## [Password cannot be changed because it contains quotes](https://discuss.elastic.co/t/password-cannot-be-changed-because-it-contains-quotes/304111)
**Author:** [@frankmehlhop](https://discuss.elastic.co/u/frankmehlhop)\ **Replies:** 4\ **Last updated:** [May 6, 2022, 12:59pm UTC](https://discuss.elastic.co/t/password-cannot-be-changed-because-it-contains-quotes/304111 "2022-05-06T12:59:26Z")
When I generate elastic I got a password which includes quotes. ( like 'xxxxx"xxxx' ) This is hard to use in code (C#) so I like to change the password. But there I get exception because the quotes too. How can I chan… --- ## [Logstash hangs before indexing the last log event](https://discuss.elastic.co/t/logstash-hangs-before-indexing-the-last-log-event/303725)
**Author:** [@aviral\_srivastava](https://discuss.elastic.co/u/aviral_srivastava)\ **Replies:** 6\ **Last updated:** [May 6, 2022, 12:24pm UTC](https://discuss.elastic.co/t/logstash-hangs-before-indexing-the-last-log-event/303725 "2022-05-06T12:24:51Z")
Hi, My setup: Elasticsearch 8.1.0, kibana 8.1.0, logstash 8.1.0 My logstash config: input{ file{ path =\> "C:/Users/avisriva/Documents/Logs/TDW\_9 Logs/logs\_14082020.txt" codec =\> multiline{ pattern =\> "Log Ent… --- ## [Winlogbeat dashboard missing fields](https://discuss.elastic.co/t/winlogbeat-dashboard-missing-fields/304123)
**Author:** [@CemG](https://discuss.elastic.co/u/CemG)\ **Replies:** 1\ **Last updated:** [May 6, 2022, 12:18pm UTC](https://discuss.elastic.co/t/winlogbeat-dashboard-missing-fields/304123 "2022-05-06T12:18:48Z")
Hello, I have an issue with winlogbeat output. When I am trying to see information with Winlogbeat dashboards in Kibana, it says that there is missing fields in my data when I output to kafka because my architecture is… --- ## [AWS Cloudwatch \> Logstash \> Elasticsearch](https://discuss.elastic.co/t/aws-cloudwatch-logstash-elasticsearch/302938)
**Author:** [@wallace84](https://discuss.elastic.co/u/wallace84)\ **Replies:** 3\ **Last updated:** [May 6, 2022, 11:39am UTC](https://discuss.elastic.co/t/aws-cloudwatch-logstash-elasticsearch/302938 "2022-05-06T11:39:20Z")
Hello community, I was designing a log filtering process and I would like to know if there is a way to send logs from AWS Cloudwatch to our logstash docker container in a server and from there being processed to be inde… --- ## [Logstash Multiple input missbehaving](https://discuss.elastic.co/t/logstash-multiple-input-missbehaving/304092)
**Author:** [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\ **Replies:** 2\ **Last updated:** [May 6, 2022, 8:57am UTC](https://discuss.elastic.co/t/logstash-multiple-input-missbehaving/304092 "2022-05-06T08:57:33Z")
Hello Every One I m using logstash http input and tcp inout in multiple conf file in single logstash machine while I start machin I am getting tcp input DATA in to http input this is ODD how can I fix this please sugg… --- ## [Audit logging](https://discuss.elastic.co/t/audit-logging/304091)
**Author:** [@kartika23](https://discuss.elastic.co/u/kartika23)\ **Replies:** 5\ **Last updated:** [May 6, 2022, 7:16am UTC](https://discuss.elastic.co/t/audit-logging/304091 "2022-05-06T07:16:06Z")
Hi everyone, i am having issue in enabling audit logs in kibana server i am running kibana server with wazuh ,i have tried multiple options but it is not working --- ## [S3 snapshot and restore](https://discuss.elastic.co/t/s3-snapshot-and-restore/303988)
**Author:** [@askadityav](https://discuss.elastic.co/u/askadityav)\ **Replies:** 5\ **Last updated:** [May 6, 2022, 7:04am UTC](https://discuss.elastic.co/t/s3-snapshot-and-restore/303988 "2022-05-06T07:04:37Z")
Hello All, I am making use of Elasticsearch version 7.10.2 and i did install the s3-client plugin and provided the credentials as mentioned in the documentations and i am able to take the snapshots, restore it as well. … --- ## [Heartbeat HTTP monitor evaluate a Date JSON response Field](https://discuss.elastic.co/t/heartbeat-http-monitor-evaluate-a-date-json-response-field/303999)
**Author:** [@mktbec](https://discuss.elastic.co/u/mktbec)\ **Replies:** 4\ **Last updated:** [May 6, 2022, 6:58am UTC](https://discuss.elastic.co/t/heartbeat-http-monitor-evaluate-a-date-json-response-field/303999 "2022-05-06T06:58:21Z")
Hi everyone I need to evaluate a Date field in a JSON response with a heartbeat monitor. it look like there is a date() option using gval, but I can't make it work. the HTTP response looks like this. { "syncTables" … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=947) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=949)