# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=996 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 997 --- ## [Kibana.yml map.regionmap](https://discuss.elastic.co/t/kibana-yml-map-regionmap/300935)
**Author:** [@rhsnfl1122](https://discuss.elastic.co/u/rhsnfl1122)\ **Replies:** 2\ **Last updated:** [March 29, 2022, 1:10pm UTC](https://discuss.elastic.co/t/kibana-yml-map-regionmap/300935 "2022-03-29T13:10:50Z")
I'm using Kibana version 8.1.0 In my kibana.yml, I append code as follow for use "configured GeoJSON menu" map.regionmap: layers: - name: "SEOUL ZIPCODE" url: "http://localhost/TL\_KODIS\_BAS\_11.geojson" … --- ## [Input the data into Elastic](https://discuss.elastic.co/t/input-the-data-into-elastic/300957)
**Author:** [@Thiago\_Paiva](https://discuss.elastic.co/u/Thiago_Paiva)\ **Replies:** 1\ **Last updated:** [March 29, 2022, 1:00pm UTC](https://discuss.elastic.co/t/input-the-data-into-elastic/300957 "2022-03-29T13:00:33Z")
Hi, I have an elastic cluster with 3 master nodes, ten data nodes, and of these three are ingest too. But all nodes accept data in elastic open port. I used in the logstash output master:port and node:port, always \_docs… --- ## [Can't remove key in keystone](https://discuss.elastic.co/t/cant-remove-key-in-keystone/300943)
**Author:** [@chaishiqi](https://discuss.elastic.co/u/chaishiqi)\ **Replies:** 1\ **Last updated:** [March 29, 2022, 12:53pm UTC](https://discuss.elastic.co/t/cant-remove-key-in-keystone/300943 "2022-03-29T12:53:52Z")
/usr/share/Elasticsearch/bin/Elasticsearch-keystore remove xpack.security.authc.realms.oidc.oidc1.rp.client\_secret ERROR: will not overwrite keystore at \[/etc/Elasticsearch/Elasticsearch.keystore\], because this incurs c… --- ## [Logstash service fails to start due to Ruby Error](https://discuss.elastic.co/t/logstash-service-fails-to-start-due-to-ruby-error/300902)
**Author:** [@ASA01](https://discuss.elastic.co/u/ASA01)\ **Replies:** 2\ **Last updated:** [March 29, 2022, 12:45pm UTC](https://discuss.elastic.co/t/logstash-service-fails-to-start-due-to-ruby-error/300902 "2022-03-29T12:45:25Z")
I cannot get logstash to start and keep running. I have verified all my logstash confs work individually with test\_and\_exit, but when I try to start it as a service I get the following error. \[2022-03-29T01:37:10,010\]\[… --- ## [Sum index size based on unique identifier](https://discuss.elastic.co/t/sum-index-size-based-on-unique-identifier/300581)
**Author:** [@phager](https://discuss.elastic.co/u/phager)\ **Replies:** 3\ **Last updated:** [March 29, 2022, 12:33pm UTC](https://discuss.elastic.co/t/sum-index-size-based-on-unique-identifier/300581 "2022-03-29T12:33:29Z")
I have data within Elasticsearch indexed by customer, i.e. index-custnumber-2022-w11, that I would like to sum index size per unique customer into a chart in Kibana. I can run curl -X GET "localhost:9200/\_cat/indices/ind… --- ## [How to use "DAY" Grok Pattern on Filebeat Multiline](https://discuss.elastic.co/t/how-to-use-day-grok-pattern-on-filebeat-multiline/300910)
**Author:** [@mvasqueznr](https://discuss.elastic.co/u/mvasqueznr)\ **Replies:** 1\ **Last updated:** [March 29, 2022, 12:31pm UTC](https://discuss.elastic.co/t/how-to-use-day-grok-pattern-on-filebeat-multiline/300910 "2022-03-29T12:31:42Z")
Hi. I'm use the next configuration to read a multiline file on logstash. For identify the begin of the message I use a grok pattern file { path =\> "Sample\_Type1/\*" start\_position =\> "beginning" … --- ## [Metricbeat SQL module date fields](https://discuss.elastic.co/t/metricbeat-sql-module-date-fields/297348)
**Author:** [@Garry](https://discuss.elastic.co/u/Garry)\ **Replies:** 3\ **Last updated:** [March 29, 2022, 12:30pm UTC](https://discuss.elastic.co/t/metricbeat-sql-module-date-fields/297348 "2022-03-29T12:30:16Z")
I am ingesting some sql queries via the metricbeat sql module, including date/time fields. I would like to use these fields on a Lens graph, but cannot as they are ingested as a string format. Is there any way to get K… --- ## [Using the payload data (fields) after aggregated to bucket, in Elastic Watcher Action email](https://discuss.elastic.co/t/using-the-payload-data-fields-after-aggregated-to-bucket-in-elastic-watcher-action-email/300779)
**Author:** [@SararhHewage](https://discuss.elastic.co/u/SararhHewage)\ **Replies:** 3\ **Last updated:** [March 29, 2022, 12:08pm UTC](https://discuss.elastic.co/t/using-the-payload-data-fields-after-aggregated-to-bucket-in-elastic-watcher-action-email/300779 "2022-03-29T12:08:40Z")
HI, I am seeking some help to resolve an issue that I am having in one of my Elastic Watchers. First of all, I must say this is a complex Watcher. In our environment, we gather some log data from file transferring jobs… --- ## [How to add Available Fields on my Discover menu for visualization purposes on my dashboards?](https://discuss.elastic.co/t/how-to-add-available-fields-on-my-discover-menu-for-visualization-purposes-on-my-dashboards/300954)
**Author:** [@renatoa12](https://discuss.elastic.co/u/renatoa12)\ **Replies:** 0\ **Last updated:** [March 29, 2022, 11:42am UTC](https://discuss.elastic.co/t/how-to-add-available-fields-on-my-discover-menu-for-visualization-purposes-on-my-dashboards/300954 "2022-03-29T11:42:06Z")
Hi everyone, Does anyone here know how can i add specific fields for my index for visualization purposes on my dashboards?? --- ## [Stop standard tokenizer from splitting on punctuations](https://discuss.elastic.co/t/stop-standard-tokenizer-from-splitting-on-punctuations/300951)
**Author:** [@Nipun\_Tulsyan](https://discuss.elastic.co/u/Nipun_Tulsyan)\ **Replies:** 0\ **Last updated:** [March 29, 2022, 11:28am UTC](https://discuss.elastic.co/t/stop-standard-tokenizer-from-splitting-on-punctuations/300951 "2022-03-29T11:28:00Z")
Hi We use the "standard" tokenizer in custom analyzer definitions. By default the standard tokenizer splits words on hyphens and ampersands, so for example "i-mac" is tokenized to "i" and "mac" Is there any way to co… --- ## [Kibana behind apache reverse proxy](https://discuss.elastic.co/t/kibana-behind-apache-reverse-proxy/300454)
**Author:** [@Jose\_E](https://discuss.elastic.co/u/Jose_E)\ **Replies:** 3\ **Last updated:** [March 29, 2022, 9:37am UTC](https://discuss.elastic.co/t/kibana-behind-apache-reverse-proxy/300454 "2022-03-29T09:37:35Z")
Hi I'm trying to get kibana working behind and apache reverse proxy. I already have it working, but there's one issue (for which I already have a workaround) but I need to know if it's a configuration issue or a bug. The… --- ## [Filtering a Pivot Transform](https://discuss.elastic.co/t/filtering-a-pivot-transform/299371)
**Author:** [@iamtheschmitzer](https://discuss.elastic.co/u/iamtheschmitzer)\ **Replies:** 4\ **Last updated:** [March 29, 2022, 9:35am UTC](https://discuss.elastic.co/t/filtering-a-pivot-transform/299371 "2022-03-29T09:35:37Z")
I have a pivot transform that calculates a duration between two timestamped documents by grouping them, matching like documents, then aggregating the min timestamp, the max timestamp and using a script to calculate the d… --- ## [Elasticsearch index mapping?](https://discuss.elastic.co/t/elasticsearch-index-mapping/300926)
**Author:** [@AJITH](https://discuss.elastic.co/u/AJITH)\ **Replies:** 1\ **Last updated:** [March 29, 2022, 9:27am UTC](https://discuss.elastic.co/t/elasticsearch-index-mapping/300926 "2022-03-29T09:27:34Z")
i'm beginner of Elasticsearch i doing now a simple project for my training purpose , my project is user login system with fileuploading and search option, user can upload multiple textfiles on his account there is no l… --- ## [Finding document similarity by distance and visualising clusters](https://discuss.elastic.co/t/finding-document-similarity-by-distance-and-visualising-clusters/300939)
**Author:** [@sandydesu](https://discuss.elastic.co/u/sandydesu)\ **Replies:** 0\ **Last updated:** [March 29, 2022, 9:24am UTC](https://discuss.elastic.co/t/finding-document-similarity-by-distance-and-visualising-clusters/300939 "2022-03-29T09:24:06Z")
I'm new to the stack and learning as I go along so any help would be much appreciated. I have 9.5 million records of people, with formatted\_name, formatted\_address and formatted\_birthday as indexable fields in Elasticse… --- ## [Combining Documents for test result comparison in Kibana](https://discuss.elastic.co/t/combining-documents-for-test-result-comparison-in-kibana/300829)
**Author:** [@JBufton](https://discuss.elastic.co/u/JBufton)\ **Replies:** 1\ **Last updated:** [March 29, 2022, 9:23am UTC](https://discuss.elastic.co/t/combining-documents-for-test-result-comparison-in-kibana/300829 "2022-03-29T09:23:48Z")
Hi, I'm new here so I apologise if this turns out to be a noob question. I have a large set of documents in elastic containing test result data including timestamps, runtimes, results, branch tests were ran on and test r… --- ## [Attempted to resurrect connection to dead ES instance](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance/300480)
**Author:** [@Bavaria](https://discuss.elastic.co/u/Bavaria)\ **Replies:** 1\ **Last updated:** [March 29, 2022, 9:21am UTC](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance/300480 "2022-03-29T09:21:30Z")
Am I missing something? I am trying to send in a basic tryout some logs from a Server with Filebeat, via Logstash to Elasticsearch. I am getting the data from Beats in Logstash. But Logstash is giving me following messag… --- ## [Logstash "Marking url as dead" issue and http client logging log4j2](https://discuss.elastic.co/t/logstash-marking-url-as-dead-issue-and-http-client-logging-log4j2/300937)
**Author:** [@can.ozdemir](https://discuss.elastic.co/u/can.ozdemir)\ **Replies:** 0\ **Last updated:** [March 29, 2022, 9:10am UTC](https://discuss.elastic.co/t/logstash-marking-url-as-dead-issue-and-http-client-logging-log4j2/300937 "2022-03-29T09:10:52Z")
Hello there, We are experiencing "marking url as dead" problem on our logstash machines, I know this is a known issue and there are many solutions people are discussing. I tried some of them they are not the solution t… --- ## [Concurrent IndexSearch clarification](https://discuss.elastic.co/t/concurrent-indexsearch-clarification/300073)
**Author:** [@dlants](https://discuss.elastic.co/u/dlants)\ **Replies:** 0\ **Last updated:** [March 18, 2022, 4:51pm UTC](https://discuss.elastic.co/t/concurrent-indexsearch-clarification/300073 "2022-03-18T16:51:04Z")
This blog post describes concurrent query execution in Lucene (at the IndexSearcher level), and claims: Concurrent query execution is a surprisingly little known sleeper feature in Lucene, since it is not yet exposed i… --- ## [ES \[Get by document ID\] vs \[Search by terms\] returns different results](https://discuss.elastic.co/t/es-get-by-document-id-vs-search-by-terms-returns-different-results/300700)
**Author:** [@T-Muller-25](https://discuss.elastic.co/u/T-Muller-25)\ **Replies:** 0\ **Last updated:** [March 25, 2022, 1:26pm UTC](https://discuss.elastic.co/t/es-get-by-document-id-vs-search-by-terms-returns-different-results/300700 "2022-03-25T13:26:50Z")
Hi, From my understanding, there is no difference between the get by document id and search by terms but the performance. However, I just encountered a very strange issue. when I use: GET /my\_index/\_doc/1 --\> it retur… --- ## [Drawing a time based graph](https://discuss.elastic.co/t/drawing-a-time-based-graph/300382)
**Author:** [@George915](https://discuss.elastic.co/u/George915)\ **Replies:** 1\ **Last updated:** [March 29, 2022, 8:57am UTC](https://discuss.elastic.co/t/drawing-a-time-based-graph/300382 "2022-03-29T08:57:24Z")
Hi ELK community, newbie ELK user here. I have a time based document as shown below and I was able to insert it in my Elasticsearch. I set up the timestamps field as a date date type. Timestamps are epoch time. I want t… --- ## [I am trying to perform aggregation on top aggregations results in kibana visualization tab. Can anyone please help me how to achieve this](https://discuss.elastic.co/t/i-am-trying-to-perform-aggregation-on-top-aggregations-results-in-kibana-visualization-tab-can-anyone-please-help-me-how-to-achieve-this/300795)
**Author:** [@Sumithra\_Thammineni](https://discuss.elastic.co/u/Sumithra_Thammineni)\ **Replies:** 1\ **Last updated:** [March 29, 2022, 8:51am UTC](https://discuss.elastic.co/t/i-am-trying-to-perform-aggregation-on-top-aggregations-results-in-kibana-visualization-tab-can-anyone-please-help-me-how-to-achieve-this/300795 "2022-03-29T08:51:34Z")
My use case: Group the data by "a" attribute and "b" attribute. The below is the result i am able to figure out with kibana a attribute b attribute Count A1 x 1 A1 y 1 B1 z 2 Problem: Again i want to grou… --- ## [I want to setup pattern match alerts in kibana and notify via nagios](https://discuss.elastic.co/t/i-want-to-setup-pattern-match-alerts-in-kibana-and-notify-via-nagios/300809)
**Author:** [@nour41\_nour41](https://discuss.elastic.co/u/nour41_nour41)\ **Replies:** 0\ **Last updated:** [March 28, 2022, 8:23am UTC](https://discuss.elastic.co/t/i-want-to-setup-pattern-match-alerts-in-kibana-and-notify-via-nagios/300809 "2022-03-28T08:23:22Z")
We use ELK for log management and nagios for centralized monitoring. I want to setup pattern match alerts in kibana and notify via nagios. Can you please let me know if this is feasible. --- ## [Elasticsearch date range query for range on a date-time field](https://discuss.elastic.co/t/elasticsearch-date-range-query-for-range-on-a-date-time-field/300759)
**Author:** [@Shaiwal\_Sharma](https://discuss.elastic.co/u/Shaiwal_Sharma)\ **Replies:** 4\ **Last updated:** [March 29, 2022, 8:29am UTC](https://discuss.elastic.co/t/elasticsearch-date-range-query-for-range-on-a-date-time-field/300759 "2022-03-29T08:29:28Z")
I have to get records (training) wherein I have a start\_date, and I have to get all records that have not yet ended. So I don't have an end\_date field, but just the start date, so end\_date is start\_date + 60 days. So wha… --- ## [AND in SQL query is translated to nested bool](https://discuss.elastic.co/t/and-in-sql-query-is-translated-to-nested-bool/300923)
**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\ **Replies:** 0\ **Last updated:** [March 29, 2022, 8:15am UTC](https://discuss.elastic.co/t/and-in-sql-query-is-translated-to-nested-bool/300923 "2022-03-29T08:15:35Z")
Hi, When I translate the following to DSL I see multiple nested bool instead one bool that contains all the conditions. Can I control it? GET \_sql/translate { "query": """ SELECT \* FROM "base" WHERE "Id" = '62… --- ## [Trying to include tensorflow library in my ES plugin and getting the following error](https://discuss.elastic.co/t/trying-to-include-tensorflow-library-in-my-es-plugin-and-getting-the-following-error/300735)
**Author:** [@ashwin91kumar](https://discuss.elastic.co/u/ashwin91kumar)\ **Replies:** 3\ **Last updated:** [March 29, 2022, 8:13am UTC](https://discuss.elastic.co/t/trying-to-include-tensorflow-library-in-my-es-plugin-and-getting-the-following-error/300735 "2022-03-29T08:13:59Z")
\#8 6.878 -\> Rolled back file:///plugins/plugin.zip #8 6.878 Exception in thread "main" java.lang.IllegalStateException: codebase property already set: codebase.tensorflow-core-api -\> file:/usr/share/elasticsearch/plugins… --- ## [Frequent timeout when using elasticsearch-py 8.1.0](https://discuss.elastic.co/t/frequent-timeout-when-using-elasticsearch-py-8-1-0/300831)
**Author:** [@Dheeraj\_Gupta](https://discuss.elastic.co/u/Dheeraj_Gupta)\ **Replies:** 1\ **Last updated:** [March 29, 2022, 7:51am UTC](https://discuss.elastic.co/t/frequent-timeout-when-using-elasticsearch-py-8-1-0/300831 "2022-03-29T07:51:23Z")
We have recently upgraded our Elasticsearch to 8.1.0. We have a some Python scripts which perform some searching/computations on data in the Elasticsearch cluster which use elasticsearch-py. Due to systems loads, during… --- ## [First time with grok](https://discuss.elastic.co/t/first-time-with-grok/300867)
**Author:** [@fabek.75](https://discuss.elastic.co/u/fabek.75)\ **Replies:** 2\ **Last updated:** [March 29, 2022, 7:43am UTC](https://discuss.elastic.co/t/first-time-with-grok/300867 "2022-03-29T07:43:10Z")
Hi there. I'm trying to use grok for the first time to parse a line log like this: Mar 15 10:45:13 myapp.com myapp: \[Info\] \<99999999999999\> /path/path1: \[10.255.255.255:99999\] POST /our\_queue/worker/import? 204 In th… --- ## [Java 17 Compatibility](https://discuss.elastic.co/t/java-17-compatibility/300915)
**Author:** [@shivaraj\_eric](https://discuss.elastic.co/u/shivaraj_eric)\ **Replies:** 2\ **Last updated:** [March 29, 2022, 7:16am UTC](https://discuss.elastic.co/t/java-17-compatibility/300915 "2022-03-29T07:16:14Z")
Does latest version of file beat is compatible with java 17?.Need to know on the same compatibility for the following ELK component as well. Logstash --- ## [How to Increase Kibana 8.1 Heap Size Limit?](https://discuss.elastic.co/t/how-to-increase-kibana-8-1-heap-size-limit/300908)
**Author:** [@wcpoon](https://discuss.elastic.co/u/wcpoon)\ **Replies:** 1\ **Last updated:** [March 29, 2022, 6:31am UTC](https://discuss.elastic.co/t/how-to-increase-kibana-8-1-heap-size-limit/300908 "2022-03-29T06:31:34Z")
Hi, Any idea how to increase Kibana Heap Size Limit? Which Node.js configuration file should I change? My current default Kibana Heap Size is 2 GB only, plan to increase it to 4GB --- ## [Why Elasticsearch new version appending -000001 for index name](https://discuss.elastic.co/t/why-elasticsearch-new-version-appending-000001-for-index-name/300808)
**Author:** [@Prashant\_Kamble](https://discuss.elastic.co/u/Prashant_Kamble)\ **Replies:** 6\ **Last updated:** [March 29, 2022, 5:37am UTC](https://discuss.elastic.co/t/why-elasticsearch-new-version-appending-000001-for-index-name/300808 "2022-03-29T05:37:49Z")
We are getting index name appended with -000001 for index name. Just wanted to understand why Elasticsearch appending this value for index name in elastcsearch cluster 7.10? What is the significance of it? [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=995) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=997)