# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=992 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 993 --- ## [1h difference between rollover time and action time](https://discuss.elastic.co/t/1h-difference-between-rollover-time-and-action-time/300895)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 5\ **Last updated:** [March 31, 2022, 9:07am UTC](https://discuss.elastic.co/t/1h-difference-between-rollover-time-and-action-time/300895 "2022-03-31T09:07:23Z")
Hi, I noticed that despite my indexes are being rolled over at midnight, the "index phase time" and "index action time" are with 2h difference apart, like: { "indices" : { "suricata-ids-2022.03.28-000021" : { … --- ## [Handlebar Helpers in TSVB Markdown](https://discuss.elastic.co/t/handlebar-helpers-in-tsvb-markdown/300991)
**Author:** [@Kirubanandhan](https://discuss.elastic.co/u/Kirubanandhan)\ **Replies:** 4\ **Last updated:** [March 31, 2022, 9:02am UTC](https://discuss.elastic.co/t/handlebar-helpers-in-tsvb-markdown/300991 "2022-03-31T09:02:35Z")
Hi Team, I want to add some Handlebar helpers like below. So that i can use it in TSVB Markdown. I need to use it for calculate difference between the two count values. @tsullivan @devon.thomson @bhavyarm Help required… --- ## [cURL request not working with CA certificate on Windows](https://discuss.elastic.co/t/curl-request-not-working-with-ca-certificate-on-windows/299566)
**Author:** [@Andy0708](https://discuss.elastic.co/u/Andy0708)\ **Replies:** 9\ **Last updated:** [March 31, 2022, 8:52am UTC](https://discuss.elastic.co/t/curl-request-not-working-with-ca-certificate-on-windows/299566 "2022-03-31T08:52:49Z")
Hi, The following command works fine on macOS, but I am unable to get it to work on Windows 10. curl --cacert config\\certs\\http\_ca.crt -u elastic https://localhost:9200 This happens after starting up a fresh cluster o… --- ## [Kibana Donut chart with small inner circle](https://discuss.elastic.co/t/kibana-donut-chart-with-small-inner-circle/300977)
**Author:** [@santy1](https://discuss.elastic.co/u/santy1)\ **Replies:** 5\ **Last updated:** [March 31, 2022, 8:39am UTC](https://discuss.elastic.co/t/kibana-donut-chart-with-small-inner-circle/300977 "2022-03-31T08:39:36Z")
Hello Team, I am on ELK v7.17. I have created donut chart to represent some data, using Lens. However, I see that the inner circle is quite small. I read somewhere, that there is an options tab that can be used to chan… --- ## [Logstash output to Kibana](https://discuss.elastic.co/t/logstash-output-to-kibana/300919)
**Author:** [@RomanKau](https://discuss.elastic.co/u/RomanKau)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 8:28am UTC](https://discuss.elastic.co/t/logstash-output-to-kibana/300919 "2022-03-31T08:28:02Z")
Running Windows 10, Logstash 8.1.0, Elasticsearch, kibana and filebeat 8.0.0 all on the same machine. Getting the data from filebeat to kibana works great but the problem is that the whole log is in the field message an… --- ## [Unable to connect to secondary master node, when manually stopping primary master node](https://discuss.elastic.co/t/unable-to-connect-to-secondary-master-node-when-manually-stopping-primary-master-node/300917)
**Author:** [@Dhamodharan](https://discuss.elastic.co/u/Dhamodharan)\ **Replies:** 5\ **Last updated:** [March 31, 2022, 7:32am UTC](https://discuss.elastic.co/t/unable-to-connect-to-secondary-master-node-when-manually-stopping-primary-master-node/300917 "2022-03-31T07:32:53Z")
I got a small project so thought to go with only 2nodes ES cluster and maintain HA. Both nodes are act as Master and data node, i wanted to maintain any 1 node should be up all the time. Both machine having the same conf… --- ## [Install Kibana 7.16 fails with parse mapping](https://discuss.elastic.co/t/install-kibana-7-16-fails-with-parse-mapping/300946)
**Author:** [@Karel\_Cech](https://discuss.elastic.co/u/Karel_Cech)\ **Replies:** 4\ **Last updated:** [March 30, 2022, 9:44pm UTC](https://discuss.elastic.co/t/install-kibana-7-16-fails-with-parse-mapping/300946 "2022-03-30T21:44:14Z")
Hi, we try to install Kibana 7.16.3 in our Openshift environment, but it fails with "Failed to parse mapping \[\_doc\]" : {"type":"log","@timestamp":"2022-03-29T12:09:24+02:00","tags":\["info","savedobjects-service"\],"pid"… --- ## [Group by Count equals value](https://discuss.elastic.co/t/group-by-count-equals-value/301161)
**Author:** [@chivas](https://discuss.elastic.co/u/chivas)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 7:04am UTC](https://discuss.elastic.co/t/group-by-count-equals-value/301161 "2022-03-31T07:04:09Z")
Hello, I am using below query to group by a field and return the count, is there a way to return documents whose doc\_count equals 1 (or less than 2) GET logs-test\*/\_search { "aggs": { "2": { "terms": { … --- ## [How to sort keyword/text fields on aggregation results](https://discuss.elastic.co/t/how-to-sort-keyword-text-fields-on-aggregation-results/301160)
**Author:** [@Shushil\_Shankar](https://discuss.elastic.co/u/Shushil_Shankar)\ **Replies:** 0\ **Last updated:** [March 31, 2022, 5:51am UTC](https://discuss.elastic.co/t/how-to-sort-keyword-text-fields-on-aggregation-results/301160 "2022-03-31T05:51:48Z")
Hi Everyone! I have a aggregation results and I need to sort aggregation data using Elasticsearch.Net. When i'm trying using terms aggregation i'm getting this error "buckets\_path must reference either a number value or… --- ## [Kibana dashboard cannot load metricbeat data](https://discuss.elastic.co/t/kibana-dashboard-cannot-load-metricbeat-data/300933)
**Author:** [@leelax22](https://discuss.elastic.co/u/leelax22)\ **Replies:** 4\ **Last updated:** [March 31, 2022, 5:48am UTC](https://discuss.elastic.co/t/kibana-dashboard-cannot-load-metricbeat-data/300933 "2022-03-31T05:48:03Z")
I am testing to monitor aks using ELK stack and beat. The installation is completed with version 8.1.0, and it is confirmed that data is well accumulated in Kibana through the metricbeat-\* index. Because I did not conn… --- ## [Is access to Elasticsearch / Elastic Cloud restricted for Belarus?](https://discuss.elastic.co/t/is-access-to-elasticsearch-elastic-cloud-restricted-for-belarus/300784)
**Author:** [@Sleepy\_Panda](https://discuss.elastic.co/u/Sleepy_Panda)\ **Replies:** 2\ **Last updated:** [March 31, 2022, 5:37am UTC](https://discuss.elastic.co/t/is-access-to-elasticsearch-elastic-cloud-restricted-for-belarus/300784 "2022-03-31T05:37:03Z")
Is access to Elasticsearch restricted for Belarus? I can't pull the Docker image: docker pull docker.elastic.co/elasticsearch/elasticsearch:8.1.1 leads to The Amazon CloudFront distribution is configured to block acces… --- ## [Mapping Not showing in Discover](https://discuss.elastic.co/t/mapping-not-showing-in-discover/300452)
**Author:** [@merlin\_nunez1](https://discuss.elastic.co/u/merlin_nunez1)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 5:27am UTC](https://discuss.elastic.co/t/mapping-not-showing-in-discover/300452 "2022-03-31T05:27:56Z")
After upgrading our cluster from version 7.15 to 7.17, the discover module stopped showing all fields for our .net application logs. We index all our .net application logs to indices named ui, and the mapping shows ther… --- ## [Issue with non functionality: toogle column in table \[Kibana 8.1.1\]](https://discuss.elastic.co/t/issue-with-non-functionality-toogle-column-in-table-kibana-8-1-1/301123)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 5:21am UTC](https://discuss.elastic.co/t/issue-with-non-functionality-toogle-column-in-table-kibana-8-1-1/301123 "2022-03-31T05:21:31Z")
Hi Please fix functionality for legacy view in this version of kibana for making " toogle column in table" Now it doesn't work. --- ## [Kibana Discover 10,000 documents download limit](https://discuss.elastic.co/t/kibana-discover-10-000-documents-download-limit/300555)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 6\ **Last updated:** [March 31, 2022, 5:19am UTC](https://discuss.elastic.co/t/kibana-discover-10-000-documents-download-limit/300555 "2022-03-31T05:19:21Z")
I want to save a search and download 100,000 documents from discover page. But I'm able to download only 10,000 documents. How to increase this limit in discover...I checked in advanced settings...But it is not changin… --- ## [Intergation of elastic with a service desk app](https://discuss.elastic.co/t/intergation-of-elastic-with-a-service-desk-app/301055)
**Author:** [@Vinay\_Menon1](https://discuss.elastic.co/u/Vinay_Menon1)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 5:14am UTC](https://discuss.elastic.co/t/intergation-of-elastic-with-a-service-desk-app/301055 "2022-03-31T05:14:05Z")
Hi Team, I have a query not sure if anyone can help in this We have an in house created ticketing system which one of the developers created this we plan to integrate with elastic. We have multiple client regions & on… --- ## [Ssl\_verification\_mode in http\_poller input plugin "An exception happened when converging configuration"](https://discuss.elastic.co/t/ssl-verification-mode-in-http-poller-input-plugin-an-exception-happened-when-converging-configuration/300924)
**Author:** [@Syed\_Saqlain\_Hussain](https://discuss.elastic.co/u/Syed_Saqlain_Hussain)\ **Replies:** 4\ **Last updated:** [March 31, 2022, 3:48am UTC](https://discuss.elastic.co/t/ssl-verification-mode-in-http-poller-input-plugin-an-exception-happened-when-converging-configuration/300924 "2022-03-31T03:48:41Z")
I have this configuration file using http\_poller input plugin. input { http\_poller { urls =\> { myurl2 =\> { # Supports all options supported by ruby's Manticore HTTP client method =\> get … --- ## [Elasticsearch change CA and http and transport Certificate](https://discuss.elastic.co/t/elasticsearch-change-ca-and-http-and-transport-certificate/301078)
**Author:** [@sharbich](https://discuss.elastic.co/u/sharbich)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 3:23am UTC](https://discuss.elastic.co/t/elasticsearch-change-ca-and-http-and-transport-certificate/301078 "2022-03-31T03:23:56Z")
Hi there, i have my own self-signed CA. I would like to use this Root CA for Elasticsearch and create new http and transport certificates via my Root CA and activate them in Elasticsearch. Do I have to consider somethi… --- ## [Starting Elasticsearch 8.0.1 in Docker](https://discuss.elastic.co/t/starting-elasticsearch-8-0-1-in-docker/298997)
**Author:** [@SwampyFox](https://discuss.elastic.co/u/SwampyFox)\ **Replies:** 2\ **Last updated:** [March 31, 2022, 2:51am UTC](https://discuss.elastic.co/t/starting-elasticsearch-8-0-1-in-docker/298997 "2022-03-31T02:51:08Z")
I am running the following docker run command docker run --name es01 --net elastic -p 9200:9200 -v /home/cbryan/Elasticsearch.yml:/usr/share/Elasticsearch/config/Elasticsearch.yml -it docker.elastic.co/elasticsearch/ela… --- ## [When mounting \`elasticsearch.yml\`, docker displays \`Device or resource busy\`](https://discuss.elastic.co/t/when-mounting-elasticsearch-yml-docker-displays-device-or-resource-busy/300981)
**Author:** [@linghengqian](https://discuss.elastic.co/u/linghengqian)\ **Replies:** 3\ **Last updated:** [March 31, 2022, 2:49am UTC](https://discuss.elastic.co/t/when-mounting-elasticsearch-yml-docker-displays-device-or-resource-busy/300981 "2022-03-31T02:49:12Z")
I tried to mount elasticsearch.yml and kibana.yml inside docker-compose.yml. For kibana, it is very smooth, but for Elasticsearch, an exception is thrown and the corresponding service is aborted, which confuses me. The … --- ## [Netflow sends larger documents than others](https://discuss.elastic.co/t/netflow-sends-larger-documents-than-others/301152)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 0\ **Last updated:** [March 31, 2022, 12:58am UTC](https://discuss.elastic.co/t/netflow-sends-larger-documents-than-others/301152 "2022-03-31T00:58:51Z")
good morning I have a question and I have a filebeat running that is sending me netflow to my Elasticsearch, but I have noticed that there are more documents in some times than others, why does it look like this? i.e. ne… --- ## [How to understand logstash pipeline-to-pipeline patterns?](https://discuss.elastic.co/t/how-to-understand-logstash-pipeline-to-pipeline-patterns/301044)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 2\ **Last updated:** [March 31, 2022, 12:50am UTC](https://discuss.elastic.co/t/how-to-understand-logstash-pipeline-to-pipeline-patterns/301044 "2022-03-31T00:50:15Z")
Currently I use logstash to operate pipeline.yml, the contents are as follows, according to my understanding, a line of pipeline.id should be a thread, it should be independent, but recently I found that there is a probl… --- ## [Metricbeat - system.memory.actual.used.pct](https://discuss.elastic.co/t/metricbeat-system-memory-actual-used-pct/301035)
**Author:** [@Matt.Wash](https://discuss.elastic.co/u/Matt.Wash)\ **Replies:** 2\ **Last updated:** [March 30, 2022, 11:59pm UTC](https://discuss.elastic.co/t/metricbeat-system-memory-actual-used-pct/301035 "2022-03-30T23:59:07Z")
Hi, When i try to find the root cause of a crash using metricbeat field system.memory.actual.used.pct, my dashboard appears to change the values when i filter by host.name for the machine that crashed. Before I filter b… --- ## [Missing authentication credentials for REST request](https://discuss.elastic.co/t/missing-authentication-credentials-for-rest-request/301144)
**Author:** [@Kishan\_Kini](https://discuss.elastic.co/u/Kishan_Kini)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 11:52pm UTC](https://discuss.elastic.co/t/missing-authentication-credentials-for-rest-request/301144 "2022-03-30T23:52:13Z")
\[ERROR\]\[Elasticsearch-service\] Unable to retrieve version information from Elasticsearch nodes. security\_exception: \[security\_exception\] Reason: missing authentication credentials for REST request \[/\_nodes?filter\_path=no… --- ## [After a while the logs stop](https://discuss.elastic.co/t/after-a-while-the-logs-stop/301030)
**Author:** [@Arraso26](https://discuss.elastic.co/u/Arraso26)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 11:49pm UTC](https://discuss.elastic.co/t/after-a-while-the-logs-stop/301030 "2022-03-30T23:49:48Z")
Hello, my problem for half an hour the logs arrive perfect but after about 30 minutes or so the logs stop arriving and I get all the time the log shown below or one very similar and the rest of the logs do not arrive, I … --- ## [Previous versions of dashboards](https://discuss.elastic.co/t/previous-versions-of-dashboards/301113)
**Author:** [@Marjolein](https://discuss.elastic.co/u/Marjolein)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 11:47pm UTC](https://discuss.elastic.co/t/previous-versions-of-dashboards/301113 "2022-03-30T23:47:48Z")
Hi! I'm a very new user of kibana and running into some issues. Is it possible to revert (roll back) to a previous saved version of a dashboard? I can't find it anywhere. Thanks! --- ## [Delete oldest index if storage is full](https://discuss.elastic.co/t/delete-oldest-index-if-storage-is-full/301115)
**Author:** [@6NMgfDwZ3](https://discuss.elastic.co/u/6NMgfDwZ3)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 11:46pm UTC](https://discuss.elastic.co/t/delete-oldest-index-if-storage-is-full/301115 "2022-03-30T23:46:36Z")
Hello, ELK stack version: v7.x ... latest I've created an ILM policy that deletes the index if the index is older than x days. It works well. But sometimes too many documents arrive into the indexes so the storage bec… --- ## [Request/API to display detailed view of elasticsearch index field options](https://discuss.elastic.co/t/request-api-to-display-detailed-view-of-elasticsearch-index-field-options/301128)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 11:45pm UTC](https://discuss.elastic.co/t/request-api-to-display-detailed-view-of-elasticsearch-index-field-options/301128 "2022-03-30T23:45:23Z")
I have defined datatype and set the following options for some of the fields of an index "doc\_values": true "enabled ": false "index": false Even though data is getting indexed and some of the set options can be viewe… --- ## [Why my snapshot produced many folders for only one snapshots?](https://discuss.elastic.co/t/why-my-snapshot-produced-many-folders-for-only-one-snapshots/300958)
**Author:** [@renatoa12](https://discuss.elastic.co/u/renatoa12)\ **Replies:** 3\ **Last updated:** [March 30, 2022, 9:59pm UTC](https://discuss.elastic.co/t/why-my-snapshot-produced-many-folders-for-only-one-snapshots/300958 "2022-03-30T21:59:12Z")
Why my snapshot produced many folders for only one snapshots?? --- ## [Error in building k8 objects when using terraform to create filebeat as a resource](https://discuss.elastic.co/t/error-in-building-k8-objects-when-using-terraform-to-create-filebeat-as-a-resource/301145)
**Author:** [@surprised\_ferret](https://discuss.elastic.co/u/surprised_ferret)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 9:19pm UTC](https://discuss.elastic.co/t/error-in-building-k8-objects-when-using-terraform-to-create-filebeat-as-a-resource/301145 "2022-03-30T21:19:47Z")
I am trying to do something similar to this post over at Hashicorp: Terraform and helm\_release - #7 by stuart-c - Essentially, installing filebeat on a kubernetes cluster inside AKS. Here’s my filebeat config file (file… --- ## [Logstash ruby code DateTime fails](https://discuss.elastic.co/t/logstash-ruby-code-datetime-fails/301137)
**Author:** [@scottfred](https://discuss.elastic.co/u/scottfred)\ **Replies:** 4\ **Last updated:** [March 30, 2022, 8:19pm UTC](https://discuss.elastic.co/t/logstash-ruby-code-datetime-fails/301137 "2022-03-30T20:19:16Z")
I've tried parsing this date string, "2022-01-25 08:30:22.126714" a few different ways in Logstash, but I keep coming up short. I don't want to use filter { date {} }... I should be able to use this ruby code because i… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=991) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=993)