# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=993 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 994 --- ## [Make in india percentage(This is a purchase related query)](https://discuss.elastic.co/t/make-in-india-percentage-this-is-a-purchase-related-query/301124)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 3\ **Last updated:** [March 30, 2022, 7:48pm UTC](https://discuss.elastic.co/t/make-in-india-percentage-this-is-a-purchase-related-query/301124 "2022-03-30T19:48:18Z")
What is the make in india percentage for Elasticsearch? (This is a non technical query) regards shini --- ## [Unable to add Remote Cluster for Cross Cluster Replication](https://discuss.elastic.co/t/unable-to-add-remote-cluster-for-cross-cluster-replication/299299)
**Author:** [@Prabakar](https://discuss.elastic.co/u/Prabakar)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 7:29pm UTC](https://discuss.elastic.co/t/unable-to-add-remote-cluster-for-cross-cluster-replication/299299 "2022-03-30T19:29:00Z")
Hello Team, We are using Elastic Enterprise edition license. We have created on-premise ECK (Kubenetes) clusters (2 clusters). We are trying to create remote cluster from Kibana(Cluster1) to test Cross Cluster Replicati… --- ## [Kibana stuck after upgrading to 7.17.1](https://discuss.elastic.co/t/kibana-stuck-after-upgrading-to-7-17-1/301139)
**Author:** [@danilopc](https://discuss.elastic.co/u/danilopc)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 7:22pm UTC](https://discuss.elastic.co/t/kibana-stuck-after-upgrading-to-7-17-1/301139 "2022-03-30T19:22:29Z")
Hi everyone I've upgraded my Elasticsearch cluster from 7.16.3 to 7.17.1. The process ran without problems and no errors occurred. When I upgraded the kibana from 7.16.3 to 7.17.1 it got stuck at initialization. The lo… --- ## [Logstash aggregate filter not working for GCP MySQL slow query logs](https://discuss.elastic.co/t/logstash-aggregate-filter-not-working-for-gcp-mysql-slow-query-logs/301103)
**Author:** [@Chris\_Pinto](https://discuss.elastic.co/u/Chris_Pinto)\ **Replies:** 2\ **Last updated:** [March 30, 2022, 6:53pm UTC](https://discuss.elastic.co/t/logstash-aggregate-filter-not-working-for-gcp-mysql-slow-query-logs/301103 "2022-03-30T18:53:53Z")
Hi Team, I'm trying to send Google Cloud MySQL slow query logs from GCP Cloud Logging to elastic through Logstash pubsub input. The Slow query logs are in the JSON format and Pubsub has a limitation - it does not main… --- ## [Filter to add fiels of on nested JSON name value fields](https://discuss.elastic.co/t/filter-to-add-fiels-of-on-nested-json-name-value-fields/300848)
**Author:** [@DI\_Ralph](https://discuss.elastic.co/u/DI_Ralph)\ **Replies:** 4\ **Last updated:** [March 30, 2022, 6:26pm UTC](https://discuss.elastic.co/t/filter-to-add-fiels-of-on-nested-json-name-value-fields/300848 "2022-03-30T18:26:40Z")
Hi, In Logstash I'm trying to create new fields from Nested JSON where the value of "Name" is part of the field name and "Value" is the actual value of the new field. For example I got part of an audit log here below. … --- ## [Using synonyms file in Elastic Cloud](https://discuss.elastic.co/t/using-synonyms-file-in-elastic-cloud/301136)
**Author:** [@Conor\_Hennessy](https://discuss.elastic.co/u/Conor_Hennessy)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 5:53pm UTC](https://discuss.elastic.co/t/using-synonyms-file-in-elastic-cloud/301136 "2022-03-30T17:53:46Z")
Hi, In order to use synonyms in Elasticsearch, we can use a .txt file with a list of our synonyms and add the path to this file in our index definition. See below as an example: PUT /test\_index { "settings": { "i… --- ## [Keep only domain.tld in field with various subdomains](https://discuss.elastic.co/t/keep-only-domain-tld-in-field-with-various-subdomains/301097)
**Author:** [@andre22](https://discuss.elastic.co/u/andre22)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 5:34pm UTC](https://discuss.elastic.co/t/keep-only-domain-tld-in-field-with-various-subdomains/301097 "2022-03-30T17:34:16Z")
Hi, in my DNS logs I have a lot of very long URLs, for example those from CDNs. They can have one or more levels of subdomains, and I am looking to remove these. For example: safebrowsing.googleapis.com \> googleapis.c… --- ## [Reusing internal implementation to transform JSON mapping to ES mapping](https://discuss.elastic.co/t/reusing-internal-implementation-to-transform-json-mapping-to-es-mapping/300597)
**Author:** [@vred](https://discuss.elastic.co/u/vred)\ **Replies:** 2\ **Last updated:** [March 30, 2022, 5:24pm UTC](https://discuss.elastic.co/t/reusing-internal-implementation-to-transform-json-mapping-to-es-mapping/300597 "2022-03-30T17:24:04Z")
Hello all, I have a use case where I have to do some validation on the JSON mapping passed into the PUT request body. There are several keywords (like dynamic, include\_in\_parent, etc.) and I cannot account for them all w… --- ## [Multi node setup for elastic search](https://discuss.elastic.co/t/multi-node-setup-for-elastic-search/301116)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 3\ **Last updated:** [March 30, 2022, 4:54pm UTC](https://discuss.elastic.co/t/multi-node-setup-for-elastic-search/301116 "2022-03-30T16:54:41Z")
Is it possible to set up Elasticsearch in a multiple nodes architecture with basic license? regards shini --- ## [Fs-crawler for data scraping](https://discuss.elastic.co/t/fs-crawler-for-data-scraping/301063)
**Author:** [@Um\_Ar](https://discuss.elastic.co/u/Um_Ar)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 4:37pm UTC](https://discuss.elastic.co/t/fs-crawler-for-data-scraping/301063 "2022-03-30T16:37:30Z")
I would like to use fs-crawler for page by page data extraction or extract data based on title hierarchy(title) instead of getting all the data of a document in a single row. --- ## [Changing the Font size or Font Color in Kibana widget Title](https://discuss.elastic.co/t/changing-the-font-size-or-font-color-in-kibana-widget-title/299417)
**Author:** [@Kirubanandhan](https://discuss.elastic.co/u/Kirubanandhan)\ **Replies:** 3\ **Last updated:** [March 30, 2022, 4:36pm UTC](https://discuss.elastic.co/t/changing-the-font-size-or-font-color-in-kibana-widget-title/299417 "2022-03-30T16:36:10Z")
I need to update the Font styles (color, size, ..) in Kibana widgets. Please let me know the options to do that in Kibana UI. --- ## [ERROR: for kibana Container "ee1a9f613d4a" is unhealthy](https://discuss.elastic.co/t/error-for-kibana-container-ee1a9f613d4a-is-unhealthy/301081)
**Author:** [@Arraso26](https://discuss.elastic.co/u/Arraso26)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 4:29pm UTC](https://discuss.elastic.co/t/error-for-kibana-container-ee1a9f613d4a-is-unhealthy/301081 "2022-03-30T16:29:03Z")
good, I was using the installation guide for elk 8.0.1 and everything was already configured when I went to start it and I got this error. WARNING: Found orphan containers (docker\_elasticsearch\_1, docker\_logstash\_1) for… --- ## [Drilldown Based on Query Results](https://discuss.elastic.co/t/drilldown-based-on-query-results/301122)
**Author:** [@DamiaRita](https://discuss.elastic.co/u/DamiaRita)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 4:16pm UTC](https://discuss.elastic.co/t/drilldown-based-on-query-results/301122 "2022-03-30T16:16:26Z")
Hi, I want to connect two dashboards via Drilldown (or a similar feature). I have been reading the docs regarding drilldown and did not find a way to do precisely what I want. So, I am hoping for someone with more exper… --- ## [Not able to access my elasticsearch url via public IP](https://discuss.elastic.co/t/not-able-to-access-my-elasticsearch-url-via-public-ip/301110)
**Author:** [@sandeepbisht](https://discuss.elastic.co/u/sandeepbisht)\ **Replies:** 6\ **Last updated:** [March 30, 2022, 4:14pm UTC](https://discuss.elastic.co/t/not-able-to-access-my-elasticsearch-url-via-public-ip/301110 "2022-03-30T16:14:08Z")
Hi All, I am not able to able to access url via public IP on port 9200. Even when i changed below setting in config file and tried to restart service, getting below error. network.host: \ http.port: 9200 r… --- ## [Can i apply a KQL query that works on all indices present?](https://discuss.elastic.co/t/can-i-apply-a-kql-query-that-works-on-all-indices-present/301008)
**Author:** [@Matthew\_Dominic\_Ramp](https://discuss.elastic.co/u/Matthew_Dominic_Ramp)\ **Replies:** 3\ **Last updated:** [March 30, 2022, 4:12pm UTC](https://discuss.elastic.co/t/can-i-apply-a-kql-query-that-works-on-all-indices-present/301008 "2022-03-30T16:12:58Z")
Scenario: I have a dashboard which displays info from two indices, a & b both a& b have a field (which acts as a primary key would in sql) called id i want to type into the search/query bar a filter that searches for d… --- ## [How to add leading zeros to a numeric field using the ingest pipeline?](https://discuss.elastic.co/t/how-to-add-leading-zeros-to-a-numeric-field-using-the-ingest-pipeline/300885)
**Author:** [@Patr123](https://discuss.elastic.co/u/Patr123)\ **Replies:** 2\ **Last updated:** [March 30, 2022, 3:36pm UTC](https://discuss.elastic.co/t/how-to-add-leading-zeros-to-a-numeric-field-using-the-ingest-pipeline/300885 "2022-03-30T15:36:43Z")
I have a field that needs to be a 3 digit field always. so if the field value is 1 it should be coming in as 001 and if its 11 then it should be coming in as 011. I am parsing this field from a different field using the… --- ## [Logstash.yaml configuration xpack.management.elasticsearch.hosts (Elastic 7.10.)](https://discuss.elastic.co/t/logstash-yaml-configuration-xpack-management-elasticsearch-hosts-elastic-7-10/301114)
**Author:** [@newschapmj1](https://discuss.elastic.co/u/newschapmj1)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 3:22pm UTC](https://discuss.elastic.co/t/logstash-yaml-configuration-xpack-management-elasticsearch-hosts-elastic-7-10/301114 "2022-03-30T15:22:12Z")
We have a 7 node Elasticsearch cluster (v7.10). Is it good practice to point xpack.management.Elasticsearch.hosts: to all the cluster nodes ? At the moment it is pointing to the 1st 3 nodes which was the original clus… --- ## [Copy dashboard](https://discuss.elastic.co/t/copy-dashboard/301111)
**Author:** [@Marjolein](https://discuss.elastic.co/u/Marjolein)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 3:14pm UTC](https://discuss.elastic.co/t/copy-dashboard/301111 "2022-03-30T15:14:38Z")
Hi! I'm a very new user of Kibana and running into some issues. I have a dashboard from a colleague and I want to copy the dashboard and make some alterations while the dashboard of my colleague stays the same. I tried … --- ## [Grouping legend entries](https://discuss.elastic.co/t/grouping-legend-entries/301058)
**Author:** [@Marjolein](https://discuss.elastic.co/u/Marjolein)\ **Replies:** 3\ **Last updated:** [March 30, 2022, 3:08pm UTC](https://discuss.elastic.co/t/grouping-legend-entries/301058 "2022-03-30T15:08:05Z")
Hi! I'm currently making my first Kibana dashboards and I'm running into an issue. I want to make a Pie chart of values with tags that look like this: Node1-1 Node1-2 Node1-3 Node2-1 Node2-2 Node2-3 etc I want t… --- ## [Metric aggregations on custom fields that use flattened field type](https://discuss.elastic.co/t/metric-aggregations-on-custom-fields-that-use-flattened-field-type/300724)
**Author:** [@amkoehler](https://discuss.elastic.co/u/amkoehler)\ **Replies:** 5\ **Last updated:** [March 30, 2022, 2:52pm UTC](https://discuss.elastic.co/t/metric-aggregations-on-custom-fields-that-use-flattened-field-type/300724 "2022-03-30T14:52:32Z")
Hello, I am looking for a way to index our documents in such a way that gives me the ability to run metric aggregations on custom number fields. Here's an example data structure we are indexing: { name: 'My Element',… --- ## [S3 input plugin does not recognise Glacier Flexible Retrieval](https://discuss.elastic.co/t/s3-input-plugin-does-not-recognise-glacier-flexible-retrieval/299875)
**Author:** [@banana](https://discuss.elastic.co/u/banana)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 2:42pm UTC](https://discuss.elastic.co/t/s3-input-plugin-does-not-recognise-glacier-flexible-retrieval/299875 "2022-03-30T14:42:06Z")
HI All, We have noticed that the s3 input plugin does not recognise Glacier Flexible Retrieval storage classes. The result is that logstash takes forever to process our files. We would appreciate some input on how to … --- ## [Elastic Agent for syslog](https://discuss.elastic.co/t/elastic-agent-for-syslog/301104)
**Author:** [@hebph001](https://discuss.elastic.co/u/hebph001)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 2:27pm UTC](https://discuss.elastic.co/t/elastic-agent-for-syslog/301104 "2022-03-30T14:27:12Z")
Hi Elastic community, I am trying to determine what would be the best and easiest way to gather logs and metrics from 35 SLES 12 servers because Elastic Agent is not supported on that version. I am currently collecting … --- ## [ESRally issue when running EventData track](https://discuss.elastic.co/t/esrally-issue-when-running-eventdata-track/300858)
**Author:** [@Kailas](https://discuss.elastic.co/u/Kailas)\ **Replies:** 7\ **Last updated:** [March 30, 2022, 1:56pm UTC](https://discuss.elastic.co/t/esrally-issue-when-running-eventdata-track/300858 "2022-03-30T13:56:29Z")
There were some network changes and the Rally process stopped in between and the state of ES was in “yellow/red”. Hence I deleted to index from the ES cluster. Now, when I run the below Rally command esrally race --kil… --- ## [Metricset system: users and service](https://discuss.elastic.co/t/metricset-system-users-and-service/301093)
**Author:** [@rdinis](https://discuss.elastic.co/u/rdinis)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 1:14pm UTC](https://discuss.elastic.co/t/metricset-system-users-and-service/301093 "2022-03-30T13:14:53Z")
Hi, I'm running metricbeat on container and i have found this error: {"level":"error","timestamp":"2022-03-27T16:12:45.481Z","logger":"reload","caller":"cfgfile/list.go:99","message":"Error creating runner from config:… --- ## [Accidentally deleted .security index for x-pack](https://discuss.elastic.co/t/accidentally-deleted-security-index-for-x-pack/69844)
**Author:** [@Johntdyer](https://discuss.elastic.co/u/Johntdyer)\ **Replies:** 3\ **Last updated:** [March 30, 2022, 12:29pm UTC](https://discuss.elastic.co/t/accidentally-deleted-security-index-for-x-pack/69844 "2022-03-30T12:29:45Z")
So by some horrible error we deleted the .security index for x-pack. How do we get that back? We tried reinstalling in a lab deployment and it didnt seem to recover that index. --- ## [Filebeat with AWS ELB logs = newbie problems](https://discuss.elastic.co/t/filebeat-with-aws-elb-logs-newbie-problems/301077)
**Author:** [@Bartosz\_Bubak](https://discuss.elastic.co/u/Bartosz_Bubak)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 11:19am UTC](https://discuss.elastic.co/t/filebeat-with-aws-elb-logs-newbie-problems/301077 "2022-03-30T11:19:59Z")
Hi, I am relatively "new" to ELK, I have some basics in administration and use, but I don't feel like a specialist in any way. I will briefly describe the problem I am struggling with. On one of our services (hosted on… --- ## [Can I use Vega Lite with multiple indexes?](https://discuss.elastic.co/t/can-i-use-vega-lite-with-multiple-indexes/300960)
**Author:** [@ivanhoe-dev](https://discuss.elastic.co/u/ivanhoe-dev)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 11:13am UTC](https://discuss.elastic.co/t/can-i-use-vega-lite-with-multiple-indexes/300960 "2022-03-30T11:13:08Z")
I have a use case which data sources are from two separated indexes, is it possible to plot a single chart from two indexes by vega? Thanks --- ## [Unable to search double quotes](https://discuss.elastic.co/t/unable-to-search-double-quotes/301024)
**Author:** [@Abhi\_Abhishek](https://discuss.elastic.co/u/Abhi_Abhishek)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 4:40am UTC](https://discuss.elastic.co/t/unable-to-search-double-quotes/301024 "2022-03-30T04:40:14Z")
I have a field unitDesignator = "" Even if I escape with backslash no output & field type is text. { "query":{ "match":{ "unitDesignator"="\\"\\"" } } } Can anyone help me please. --- ## [When to apply Stemmer, Stop Word and Synonym Filters](https://discuss.elastic.co/t/when-to-apply-stemmer-stop-word-and-synonym-filters/301076)
**Author:** [@duncRed](https://discuss.elastic.co/u/duncRed)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 10:50am UTC](https://discuss.elastic.co/t/when-to-apply-stemmer-stop-word-and-synonym-filters/301076 "2022-03-30T10:50:05Z")
When creating an index we apply filters in the following order: Stop token filter Stemmer token filter Synonym filter - these are user defined and then included in the index We apply them in this order due to the fol… --- ## [Updating the kibana.yml to increate max size of CSV export](https://discuss.elastic.co/t/updating-the-kibana-yml-to-increate-max-size-of-csv-export/300906)
**Author:** [@Matt.Wash](https://discuss.elastic.co/u/Matt.Wash)\ **Replies:** 3\ **Last updated:** [March 30, 2022, 10:37am UTC](https://discuss.elastic.co/t/updating-the-kibana-yml-to-increate-max-size-of-csv-export/300906 "2022-03-30T10:37:32Z")
this might be a silly question, but if i am running the cloud instance of Kibana, where can i access the Kibana.yml from to adjust the limit on the max size when exporting to csv? the video tutorials show how to do it w… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=992) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=994)