# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=957 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 958 --- ## [Update by query, values from another index](https://discuss.elastic.co/t/update-by-query-values-from-another-index/303608)
**Author:** [@save4elastic](https://discuss.elastic.co/u/save4elastic)\ **Replies:** 1\ **Last updated:** [April 29, 2022, 3:34pm UTC](https://discuss.elastic.co/t/update-by-query-values-from-another-index/303608 "2022-04-29T15:34:45Z")
I have an index with values like FIRST\_INDEX (10 billion entries) { id: 123, car: "Volvo" }, { id: 124, car: "Vaneo" } The goal is to fill the above FIRST\_INDEX with values from the SECOND\_INDEX. SECOND\_INDEX (1 milli… --- ## [Logstash-filter-http Post Body error](https://discuss.elastic.co/t/logstash-filter-http-post-body-error/303532)
**Author:** [@zurb3](https://discuss.elastic.co/u/zurb3)\ **Replies:** 9\ **Last updated:** [April 29, 2022, 3:24pm UTC](https://discuss.elastic.co/t/logstash-filter-http-post-body-error/303532 "2022-04-29T15:24:49Z")
I'm trying to get some kind of data enrichment using an API call to Abuse.ch as documents come into the pipeline. The logstash-filter-http plugin seems like the right answer, however it isn't working for what I need it t… --- ## [How to get rid of event.original field?](https://discuss.elastic.co/t/how-to-get-rid-of-event-original-field/303604)
**Author:** [@alytkowski](https://discuss.elastic.co/u/alytkowski)\ **Replies:** 6\ **Last updated:** [April 29, 2022, 3:03pm UTC](https://discuss.elastic.co/t/how-to-get-rid-of-event-original-field/303604 "2022-04-29T15:03:26Z")
After upgrading to ELK 8.1, I noticed that every event has the "event.original" field containing all of the log data. This is highly unwanted, how to prevent this field from being sent from Filebeat? I tried doing it on… --- ## [Search timeout not working](https://discuss.elastic.co/t/search-timeout-not-working/303044)
**Author:** [@MrFantastic2022](https://discuss.elastic.co/u/MrFantastic2022)\ **Replies:** 14\ **Last updated:** [April 29, 2022, 2:28pm UTC](https://discuss.elastic.co/t/search-timeout-not-working/303044 "2022-04-29T14:28:19Z")
Hello. I have a small index (~10000 documents) and have specified 1000 as the argument to the size() method of SearchSourceBuilder. When I inspect the totalHits value for some of my searches, that number is in excess o… --- ## [Grok Filter..so close... yet so far](https://discuss.elastic.co/t/grok-filter-so-close-yet-so-far/303592)
**Author:** [@joshn](https://discuss.elastic.co/u/joshn)\ **Replies:** 2\ **Last updated:** [April 29, 2022, 2:13pm UTC](https://discuss.elastic.co/t/grok-filter-so-close-yet-so-far/303592 "2022-04-29T14:13:16Z")
I'm using this website to debug my Grok code: https://grokdebug.herokuapp.com/ Two different logs I'm trying to ingest: 1: \<134\>1 1651225979.448642514 EMEA\_ISP ip\_flow\_end src=192.168.15.6 dst=8.8.4.4 protocol=udp spo… --- ## [Log warning about missing Windows Events](https://discuss.elastic.co/t/log-warning-about-missing-windows-events/303600)
**Author:** [@Tadas](https://discuss.elastic.co/u/Tadas)\ **Replies:** 0\ **Last updated:** [April 29, 2022, 12:20pm UTC](https://discuss.elastic.co/t/log-warning-about-missing-windows-events/303600 "2022-04-29T12:20:55Z")
Hi! There is no good way to detect situations where Winlogbeat is starting up and unable to continue ingesting events from the last bookmarked position (i.e. event log has rolled forward and some events have been lost). … --- ## [Can I add document data in aggregated group?](https://discuss.elastic.co/t/can-i-add-document-data-in-aggregated-group/303571)
**Author:** [@marauderbro](https://discuss.elastic.co/u/marauderbro)\ **Replies:** 1\ **Last updated:** [April 29, 2022, 12:08pm UTC](https://discuss.elastic.co/t/can-i-add-document-data-in-aggregated-group/303571 "2022-04-29T12:08:00Z")
I'm totally new to Elasticsearch, And I'm now logging our product view log to serve "popular product" to client side. Our logic is below.... User clicks product Client request product data to server When serving produ… --- ## [Elasticsearch async bulkprocess using low level client](https://discuss.elastic.co/t/elasticsearch-async-bulkprocess-using-low-level-client/303588)
**Author:** [@yelururao](https://discuss.elastic.co/u/yelururao)\ **Replies:** 1\ **Last updated:** [April 29, 2022, 12:06pm UTC](https://discuss.elastic.co/t/elasticsearch-async-bulkprocess-using-low-level-client/303588 "2022-04-29T12:06:34Z")
Hi, I'm using Low-level rest-client version 8.0.0. how to do async bulk process ? Thanks & Regads, Venkat --- ## [I want Message values as feild using logstash](https://discuss.elastic.co/t/i-want-message-values-as-feild-using-logstash/303519)
**Author:** [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\ **Replies:** 9\ **Last updated:** [April 29, 2022, 11:59am UTC](https://discuss.elastic.co/t/i-want-message-values-as-feild-using-logstash/303519 "2022-04-29T11:59:32Z")
Hello Every One Following is my message I want to split message value and add as field for filter and visulize how can I achive that please help any one message url=&type=click&date\_time=2013-01-01+12:00:00&initiated… --- ## [Rename added agents from fleet](https://discuss.elastic.co/t/rename-added-agents-from-fleet/303268)
**Author:** [@theacodes](https://discuss.elastic.co/u/theacodes)\ **Replies:** 2\ **Last updated:** [April 29, 2022, 11:35am UTC](https://discuss.elastic.co/t/rename-added-agents-from-fleet/303268 "2022-04-29T11:35:03Z")
how can I rename this agent host (aarsh-isg-virtualbox) to something else? --- ## [Discover, missing Date Filter and Process Chart](https://discuss.elastic.co/t/discover-missing-date-filter-and-process-chart/303589)
**Author:** [@Bavaria](https://discuss.elastic.co/u/Bavaria)\ **Replies:** 1\ **Last updated:** [April 29, 2022, 11:13am UTC](https://discuss.elastic.co/t/discover-missing-date-filter-and-process-chart/303589 "2022-04-29T11:13:37Z")
Hey, I created a new index with alias, to be able to add ILM Policy. In my Data View in discover, I am not able to see the Show dates Filter and the Process chart. (highligthed red) I am getting data in. How can I get… --- ## [\[Filebeat\]\[K8S\] How to process multiple types of logs (1 single + 2 different multiple lines) in one file?](https://discuss.elastic.co/t/filebeat-k8s-how-to-process-multiple-types-of-logs-1-single-2-different-multiple-lines-in-one-file/303160)
**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\ **Replies:** 2\ **Last updated:** [April 29, 2022, 10:51am UTC](https://discuss.elastic.co/t/filebeat-k8s-how-to-process-multiple-types-of-logs-1-single-2-different-multiple-lines-in-one-file/303160 "2022-04-29T10:51:24Z")
Hello guys, can anyone give me tip how to process multiple types of logs in one file for this usecase: In the log file I have 3 types of log: 1) PHP-FPM Access log (is single-line) 10.102.0.141 - 25/Apr/2022:11:17:5… --- ## [Confused on LS outputs and data not going to right index](https://discuss.elastic.co/t/confused-on-ls-outputs-and-data-not-going-to-right-index/303498)
**Author:** [@joshn](https://discuss.elastic.co/u/joshn)\ **Replies:** 4\ **Last updated:** [April 29, 2022, 10:26am UTC](https://discuss.elastic.co/t/confused-on-ls-outputs-and-data-not-going-to-right-index/303498 "2022-04-29T10:26:51Z")
Hey there, I'm not understanding the "output" section of my config for Logstash \> Elasticsearch. I've been following this guide: How To Install Elasticsearch, Logstash, and Kibana (Elastic Stack) on Ubuntu 22.04 | Digi… --- ## [Apply Access Control on single field](https://discuss.elastic.co/t/apply-access-control-on-single-field/303369)
**Author:** [@hamedheidarian](https://discuss.elastic.co/u/hamedheidarian)\ **Replies:** 3\ **Last updated:** [April 29, 2022, 10:23am UTC](https://discuss.elastic.co/t/apply-access-control-on-single-field/303369 "2022-04-29T10:23:39Z")
Hi, All field-level security documentation examples, apply access control on field of an index. But is there any way to apply it on field of a specific document? --- ## [Adding certificates to Fleet Server](https://discuss.elastic.co/t/adding-certificates-to-fleet-server/303586)
**Author:** [@mhoward](https://discuss.elastic.co/u/mhoward)\ **Replies:** 0\ **Last updated:** [April 29, 2022, 9:06am UTC](https://discuss.elastic.co/t/adding-certificates-to-fleet-server/303586 "2022-04-29T09:06:30Z")
I'm in the process of getting Fleet added to my Elastic cluster. I have a Fleet server and have enrolled the Fleet server using Quick Start for handling certificates when enrolling because I was having issues with certu… --- ## [Splitting json file](https://discuss.elastic.co/t/splitting-json-file/303488)
**Author:** [@javidr](https://discuss.elastic.co/u/javidr)\ **Replies:** 10\ **Last updated:** [April 29, 2022, 8:35am UTC](https://discuss.elastic.co/t/splitting-json-file/303488 "2022-04-29T08:35:43Z")
Hi I am totally new in logstash, and i am having some issues when splitting a json file. My file is super easy { "data": \[ { "name": "name1" }, { "name": "name2" … --- ## [After match, get next lines in a watcher alert](https://discuss.elastic.co/t/after-match-get-next-lines-in-a-watcher-alert/303583)
**Author:** [@sree3](https://discuss.elastic.co/u/sree3)\ **Replies:** 0\ **Last updated:** [April 29, 2022, 8:23am UTC](https://discuss.elastic.co/t/after-match-get-next-lines-in-a-watcher-alert/303583 "2022-04-29T08:23:12Z")
Hi All, I have configured a watcher alert that will search a particular query pattern. This is working fine and what i'm trying to achieve is to get the next 4 lines also added to notifications, if the above match is fo… --- ## [Merge fields between documents](https://discuss.elastic.co/t/merge-fields-between-documents/303525)
**Author:** [@Khaled\_Saidi](https://discuss.elastic.co/u/Khaled_Saidi)\ **Replies:** 2\ **Last updated:** [April 29, 2022, 8:01am UTC](https://discuss.elastic.co/t/merge-fields-between-documents/303525 "2022-04-29T08:01:45Z")
Hi everyone, I have 2 kinds of docments in an Elasticsearch index. Document 1: { "\_id": "xxxxxxx", "internal\_id": "123456", "message": "LOREM IPSUM" } Document 2: { "\_id": "yyyyyyy", "internal\_id": "123456", "… --- ## [Analysis with Lens Table return statusCode: 413](https://discuss.elastic.co/t/analysis-with-lens-table-return-statuscode-413/302926)
**Author:** [@rituzza](https://discuss.elastic.co/u/rituzza)\ **Replies:** 4\ **Last updated:** [April 29, 2022, 7:18am UTC](https://discuss.elastic.co/t/analysis-with-lens-table-return-statuscode-413/302926 "2022-04-29T07:18:33Z")
I have an enviroment with Kibana v7.14.1 e I created an analysis with lens component that return the error {statusCode: 413, error: "Request Entity Too Large",…} error: "Request Entity Too Large" message: "Payload co… --- ## [List of users and roles](https://discuss.elastic.co/t/list-of-users-and-roles/303036)
**Author:** [@rituzza](https://discuss.elastic.co/u/rituzza)\ **Replies:** 2\ **Last updated:** [April 29, 2022, 7:17am UTC](https://discuss.elastic.co/t/list-of-users-and-roles/303036 "2022-04-29T07:17:54Z")
Hi, I would like to know if there is a way to view/export the list of users and their roles. I use an environment with Kibana v 7.14.1 --- ## [Is it possible to hide the scroller of legends and display all the legends](https://discuss.elastic.co/t/is-it-possible-to-hide-the-scroller-of-legends-and-display-all-the-legends/303234)
**Author:** [@sukhwinder\_kumar](https://discuss.elastic.co/u/sukhwinder_kumar)\ **Replies:** 1\ **Last updated:** [April 29, 2022, 7:02am UTC](https://discuss.elastic.co/t/is-it-possible-to-hide-the-scroller-of-legends-and-display-all-the-legends/303234 "2022-04-29T07:02:00Z")
Is it possible to hide the scroller of legends and display all the legends? I dont need scroller, I want to show all the legends. --- ## [Kibana: getting 503 "service unavailable"](https://discuss.elastic.co/t/kibana-getting-503-service-unavailable/303471)
**Author:** [@Poojan](https://discuss.elastic.co/u/Poojan)\ **Replies:** 5\ **Last updated:** [April 29, 2022, 5:42am UTC](https://discuss.elastic.co/t/kibana-getting-503-service-unavailable/303471 "2022-04-29T05:42:56Z")
Hello guys, I am working on kibana 8.1.2 version. while creating/updating charts and loading dashboard I am getting 503 "service unavailable" message. Can anyone please help me to understand this issue? Thanks Pooja… --- ## [Dynamic kibana vizualization with filter dropdown](https://discuss.elastic.co/t/dynamic-kibana-vizualization-with-filter-dropdown/303212)
**Author:** [@Avarjana](https://discuss.elastic.co/u/Avarjana)\ **Replies:** 2\ **Last updated:** [April 29, 2022, 6:09am UTC](https://discuss.elastic.co/t/dynamic-kibana-vizualization-with-filter-dropdown/303212 "2022-04-29T06:09:15Z")
I want to render a Metric Visualization dynamically based on a dropdown filter control value. Metric value generation logic should change depending on the dropdown value. Example scenario: Filter dropdown field can hav… --- ## [Logstash filter only particular fields and index those fields](https://discuss.elastic.co/t/logstash-filter-only-particular-fields-and-index-those-fields/303470)
**Author:** [@venkatesh\_prasanth](https://discuss.elastic.co/u/venkatesh_prasanth)\ **Replies:** 7\ **Last updated:** [April 29, 2022, 5:08am UTC](https://discuss.elastic.co/t/logstash-filter-only-particular-fields-and-index-those-fields/303470 "2022-04-29T05:08:15Z")
Hi, I have heartbeat which pushed the data to 5044 through which logstash consumes. I want to index only if monitor.status is down. I am using tag heartbeat for differentiating the various beat input. My data: { "\_i… --- ## [Restricting users to only see data that has been captured about themselves](https://discuss.elastic.co/t/restricting-users-to-only-see-data-that-has-been-captured-about-themselves/302985)
**Author:** [@Matt.Wash](https://discuss.elastic.co/u/Matt.Wash)\ **Replies:** 2\ **Last updated:** [April 29, 2022, 3:25am UTC](https://discuss.elastic.co/t/restricting-users-to-only-see-data-that-has-been-captured-about-themselves/302985 "2022-04-29T03:25:31Z")
I would like to create a role that restricts users to only seeing data associated with them. for example, I only want Jenny to see data associated with a field that is user.name = Jenny Is this possible, as I would ide… --- ## [The soft link of the ElasticSearch data directory is faulty](https://discuss.elastic.co/t/the-soft-link-of-the-elasticsearch-data-directory-is-faulty/303099)
**Author:** [@Yisay](https://discuss.elastic.co/u/Yisay)\ **Replies:** 4\ **Last updated:** [April 29, 2022, 1:44am UTC](https://discuss.elastic.co/t/the-soft-link-of-the-elasticsearch-data-directory-is-faulty/303099 "2022-04-29T01:44:03Z")
I want to move the Elasticsearch data file to another directory, Here is my command to operate cp -ar aa/node/0/indices/indices\_name bb/indices\_name rm -rm aa/node/0/indices/indices\_name ln -s bb/indices\_name aa/node… --- ## [A Question for Configure SSL/TLS for self-managed Fleet Servers](https://discuss.elastic.co/t/a-question-for-configure-ssl-tls-for-self-managed-fleet-servers/303218)
**Author:** [@quhang](https://discuss.elastic.co/u/quhang)\ **Replies:** 0\ **Last updated:** [April 26, 2022, 6:29am UTC](https://discuss.elastic.co/t/a-question-for-configure-ssl-tls-for-self-managed-fleet-servers/303218 "2022-04-26T06:29:47Z")
Hello there, When try to configure SSL for the fleet and Join an elc cluster that currently has enabled https refer this article: In this document, the Elasticsearch-ca.crt confuses me, according the description, it… --- ## [How to export Watcher from one cluster to another cluster](https://discuss.elastic.co/t/how-to-export-watcher-from-one-cluster-to-another-cluster/303390)
**Author:** [@ranju](https://discuss.elastic.co/u/ranju)\ **Replies:** 0\ **Last updated:** [April 27, 2022, 10:32am UTC](https://discuss.elastic.co/t/how-to-export-watcher-from-one-cluster-to-another-cluster/303390 "2022-04-27T10:32:14Z")
All existing watchers and alarms need to be migrated to a new elastic cluster. --- ## [Why alerting is not allowing - (hyphen) in manage sender name?](https://discuss.elastic.co/t/why-alerting-is-not-allowing-hyphen-in-manage-sender-name/303391)
**Author:** [@Kanmani\_R](https://discuss.elastic.co/u/Kanmani_R)\ **Replies:** 0\ **Last updated:** [April 27, 2022, 11:05am UTC](https://discuss.elastic.co/t/why-alerting-is-not-allowing-hyphen-in-manage-sender-name/303391 "2022-04-27T11:05:33Z")
Alerting is not allowing - (hyphen) in manage sender name but it's allowing in manage email group name. In alerting it is not allowing - (hyphen) in manage sender name. But it is allowing - (hyphen) in manage email … --- ## [Action \[indices:admin/create\] is unauthorized for user](https://discuss.elastic.co/t/action-indices-admin-create-is-unauthorized-for-user/303458)
**Author:** [@mattstubbs](https://discuss.elastic.co/u/mattstubbs)\ **Replies:** 2\ **Last updated:** [April 29, 2022, 1:02am UTC](https://discuss.elastic.co/t/action-indices-admin-create-is-unauthorized-for-user/303458 "2022-04-29T01:02:57Z")
Hi Team, tl;dr: Complains that user needs one of \[create\_index,manage,all\], but user has create\_index and manage A pretty basic error message here that seems very straightforward but is giving my team trouble. I am tr… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=956) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=958)