# Latest **URL:** https://discuss.elastic.co/latest.md?page=1399 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1400 --- ## [Text not stemmed after inserted in the index with language specific analyzer](https://discuss.elastic.co/t/text-not-stemmed-after-inserted-in-the-index-with-language-specific-analyzer/288645)
**Author:** [@makons](https://discuss.elastic.co/u/makons)\ **Replies:** 0\ **Last updated:** [November 8, 2021, 2:52pm UTC](https://discuss.elastic.co/t/text-not-stemmed-after-inserted-in-the-index-with-language-specific-analyzer/288645 "2021-11-08T14:52:12Z")
I have 2 fields in my index, one containing the standardly analyzed content, while the other one uses a german analyzer. However, when I insert documents, they don't seem to be stemmed at all, even though they should be … --- ## [How to run heartbeat in detached (non-interactive) mode](https://discuss.elastic.co/t/how-to-run-heartbeat-in-detached-non-interactive-mode/287601)
**Author:** [@SUMANT\_MISHRA](https://discuss.elastic.co/u/SUMANT_MISHRA)\ **Replies:** 3\ **Last updated:** [November 8, 2021, 2:47pm UTC](https://discuss.elastic.co/t/how-to-run-heartbeat-in-detached-non-interactive-mode/287601 "2021-11-08T14:47:19Z")
Hi, I have installed heartbeat in a virtual machine in Azure Portal. I am trying to start the heartbeat from my system terminal using SSH. But if I close my terminal it stops the heartbeat that's running in my remote vi… --- ## [Aggregate bucket values with SUM](https://discuss.elastic.co/t/aggregate-bucket-values-with-sum/288146)
**Author:** [@tds21](https://discuss.elastic.co/u/tds21)\ **Replies:** 1\ **Last updated:** [November 8, 2021, 1:42pm UTC](https://discuss.elastic.co/t/aggregate-bucket-values-with-sum/288146 "2021-11-08T13:42:34Z")
HI :slight\_smile: I'm new to elastic, and based on a reqeust constructed by a visualization on Kibana along with few tips, built query aggregates a 'policy' key \> 'device' (or devices) it's on - and groups the values b… --- ## [Character filter analyzer not working](https://discuss.elastic.co/t/character-filter-analyzer-not-working/288531)
**Author:** [@Kevin\_Juliano](https://discuss.elastic.co/u/Kevin_Juliano)\ **Replies:** 1\ **Last updated:** [November 8, 2021, 1:28pm UTC](https://discuss.elastic.co/t/character-filter-analyzer-not-working/288531 "2021-11-08T13:28:52Z")
Hi! I have a special character analyzer, but for some reason, I am not getting the result I want. Here are my configurations: ANALYZER: { index: "my\_idx", body: { settings: { … --- ## [Defined ILM policy not working](https://discuss.elastic.co/t/defined-ilm-policy-not-working/288302)
**Author:** [@Psyhil](https://discuss.elastic.co/u/Psyhil)\ **Replies:** 4\ **Last updated:** [November 8, 2021, 12:20pm UTC](https://discuss.elastic.co/t/defined-ilm-policy-not-working/288302 "2021-11-08T12:20:45Z")
Hi All, I hope are doing well! We are running Elastic 7.15 version with a single node. Currently the data in our winlogbeat index is all dated from back February 2021 hence we defined an ILM policy as below though ple… --- ## [Kibana server not ready after update to 7.15](https://discuss.elastic.co/t/kibana-server-not-ready-after-update-to-7-15/286509)
**Author:** [@someone83](https://discuss.elastic.co/u/someone83)\ **Replies:** 5\ **Last updated:** [November 8, 2021, 12:13pm UTC](https://discuss.elastic.co/t/kibana-server-not-ready-after-update-to-7-15/286509 "2021-11-08T12:13:55Z")
I upgraded my ELK-Stack from 7.14 to 7.15. There are two Elasticsearch nodes (1 hot / 1 warm) and a kibana server. From the kibana server on the web-interface i get just the message "Kibana server is not ready yet" and… --- ## [TSVB Metric from the difference between avg value from two time intervals](https://discuss.elastic.co/t/tsvb-metric-from-the-difference-between-avg-value-from-two-time-intervals/288570)
**Author:** [@alejandrosl](https://discuss.elastic.co/u/alejandrosl)\ **Replies:** 3\ **Last updated:** [November 8, 2021, 10:46am UTC](https://discuss.elastic.co/t/tsvb-metric-from-the-difference-between-avg-value-from-two-time-intervals/288570 "2021-11-08T10:46:54Z")
Hi there !!! I'm currently trying to make a "metric" TSVB that show the difference between of average of same field in two diferentes time intervals... For example, we have a numeric field called "value\_before", we get… --- ## [UseConcMarkSweepGC error - cannot start ElasticSearch](https://discuss.elastic.co/t/useconcmarksweepgc-error-cannot-start-elasticsearch/288616)
**Author:** [@TVRV8S](https://discuss.elastic.co/u/TVRV8S)\ **Replies:** 0\ **Last updated:** [November 8, 2021, 10:42am UTC](https://discuss.elastic.co/t/useconcmarksweepgc-error-cannot-start-elasticsearch/288616 "2021-11-08T10:42:00Z")
I posted a question on Stack Overflow but perhaps it's better here. https://stackoverflow.com/questions/69875937/elasticsearch-windows-2016-hosted-server-useconcmarksweepgc-error I downloaded the Elasticsearch ZIP and … --- ## [Updating old 6.x index pattern to use newer mapping requirments](https://discuss.elastic.co/t/updating-old-6-x-index-pattern-to-use-newer-mapping-requirments/286776)
**Author:** [@hueyg](https://discuss.elastic.co/u/hueyg)\ **Replies:** 5\ **Last updated:** [November 8, 2021, 10:10am UTC](https://discuss.elastic.co/t/updating-old-6-x-index-pattern-to-use-newer-mapping-requirments/286776 "2021-11-08T10:10:56Z")
I have an ELK cluster which I have upgraded over time from early 6.x days. Focused on resolving other issues, but somewhere along the 7.x releases my old mapping broke. This was for a host that was pushing via filebeat… --- ## [Webhook watcher action timeout](https://discuss.elastic.co/t/webhook-watcher-action-timeout/288613)
**Author:** [@gissavem](https://discuss.elastic.co/u/gissavem)\ **Replies:** 0\ **Last updated:** [November 8, 2021, 10:02am UTC](https://discuss.elastic.co/t/webhook-watcher-action-timeout/288613 "2021-11-08T10:02:49Z")
Hi! I am trying to set up a Watcher to create incidents when our applications throw errors. The watcher I've set up looks through our logs for errors and when we hit any I send a webhook request to BetterUptime to crea… --- ## [User with manage\_own\_api\_key - Best Practices (Security)](https://discuss.elastic.co/t/user-with-manage-own-api-key-best-practices-security/288559)
**Author:** [@inf](https://discuss.elastic.co/u/inf)\ **Replies:** 4\ **Last updated:** [November 8, 2021, 9:05am UTC](https://discuss.elastic.co/t/user-with-manage-own-api-key-best-practices-security/288559 "2021-11-08T09:05:09Z")
Hi, I have been using the default elastic user to create API keys. However, I do not think that this is a good security practice (please correct me if I'm wrong). Hence, I'm not sure how do others normally create API … --- ## [Logstash TCP Input with SSL failing with non descript error](https://discuss.elastic.co/t/logstash-tcp-input-with-ssl-failing-with-non-descript-error/288312)
**Author:** [@AlanMark](https://discuss.elastic.co/u/AlanMark)\ **Replies:** 14\ **Last updated:** [November 8, 2021, 8:23am UTC](https://discuss.elastic.co/t/logstash-tcp-input-with-ssl-failing-with-non-descript-error/288312 "2021-11-08T08:23:20Z")
I'm trying to set up a TCP Input with an SSL certificate, but no matter how I configure it, i keep getting a non descript error. This is running on Logstash 7.9.1 OSS. My config is the following: input { tcp {… --- ## [Do not recieve sysmon log from the Windows Integration in elastic agent](https://discuss.elastic.co/t/do-not-recieve-sysmon-log-from-the-windows-integration-in-elastic-agent/288362)
**Author:** [@RobinIT](https://discuss.elastic.co/u/RobinIT)\ **Replies:** 7\ **Last updated:** [November 8, 2021, 7:57am UTC](https://discuss.elastic.co/t/do-not-recieve-sysmon-log-from-the-windows-integration-in-elastic-agent/288362 "2021-11-08T07:57:34Z")
Hello, I want to enable in elastic agent the Windows integration (version 1.2.2) I want to use this integration to ship in Sysmon and powershell log. The agent is connected to a Fleet. Adding the integration to the age… --- ## [Dynamic field type in template](https://discuss.elastic.co/t/dynamic-field-type-in-template/288568)
**Author:** [@anna.kuranda](https://discuss.elastic.co/u/anna.kuranda)\ **Replies:** 3\ **Last updated:** [November 8, 2021, 6:17am UTC](https://discuss.elastic.co/t/dynamic-field-type-in-template/288568 "2021-11-08T06:17:04Z")
I use template and alias to manage my insert data The issue : I have field that have different types , so I failed on field type inconsistency the field can be of String type or Nested JSON Object For example : St… --- ## [Install Logstash 7.13](https://discuss.elastic.co/t/install-logstash-7-13/288358)
**Author:** [@Nikparab](https://discuss.elastic.co/u/Nikparab)\ **Replies:** 4\ **Last updated:** [November 8, 2021, 6:14am UTC](https://discuss.elastic.co/t/install-logstash-7-13/288358 "2021-11-08T06:14:15Z")
I have aws opensearch cluster of version 1.0 I want to send the logs to this cluster using logstash. But when we install the logstash it install the latest version of logstash and which is not supported by opensearch … --- ## [Will Elasticsearch optimize dsl query?](https://discuss.elastic.co/t/will-elasticsearch-optimize-dsl-query/288588)
**Author:** [@CHU\_XU](https://discuss.elastic.co/u/CHU_XU)\ **Replies:** 0\ **Last updated:** [November 8, 2021, 6:07am UTC](https://discuss.elastic.co/t/will-elasticsearch-optimize-dsl-query/288588 "2021-11-08T06:07:06Z")
Hi there, I have a program to convert some text into Elasticsearch dsl query. For some reasons it generates complex bool query which somethimes is actually can be simplified, for example: { "query":{ "bool"… --- ## [Kibana Import Objects API](https://discuss.elastic.co/t/kibana-import-objects-api/288383)
**Author:** [@Ryan\_Clark](https://discuss.elastic.co/u/Ryan_Clark)\ **Replies:** 2\ **Last updated:** [November 8, 2021, 5:40am UTC](https://discuss.elastic.co/t/kibana-import-objects-api/288383 "2021-11-08T05:40:15Z")
Hi, I'm trying to write a powershell script to import some saved objects I have created and exported from Kibana. I can get this to work just fine on linux using curl: curl -X POST "http://myserver:5601/api/saved\_obje… --- ## [FilebeatからJDBC接続できるかどうか](https://discuss.elastic.co/t/filebeat-jdbc/288124)
**Author:** [@111402](https://discuss.elastic.co/u/111402)\ **Replies:** 2\ **Last updated:** [November 8, 2021, 5:34am UTC](https://discuss.elastic.co/t/filebeat-jdbc/288124 "2021-11-08T05:34:45Z")
お世話になります。 ログに追加情報を付与するためにFilebeatからDBにJDBC接続することは可能でしょうか。 下記のURLではそのような機能はなさそうだったのですが、 もしあるようでしたらご教示お願いしたい次第です。 ※ないようであればLogstashを使用をしたいと思います。 --- ## [Template Rollover alias doesn't work with {index}](https://discuss.elastic.co/t/template-rollover-alias-doesnt-work-with-index/288464)
**Author:** [@lisiyu](https://discuss.elastic.co/u/lisiyu)\ **Replies:** 5\ **Last updated:** [November 8, 2021, 4:07am UTC](https://discuss.elastic.co/t/template-rollover-alias-doesnt-work-with-index/288464 "2021-11-08T04:07:29Z")
Index Template set rollover alias is doesn't work with {index} { "index": { "lifecycle": { "name": "k8s-logs", "rollover\_alias": "{index}" }, "routing": { "allocation": { "include… --- ## [How do I use fileBeat filter to filter network logs that receive Rsyslog](https://discuss.elastic.co/t/how-do-i-use-filebeat-filter-to-filter-network-logs-that-receive-rsyslog/288582)
**Author:** [@shuijinglan](https://discuss.elastic.co/u/shuijinglan)\ **Replies:** 0\ **Last updated:** [November 8, 2021, 4:05am UTC](https://discuss.elastic.co/t/how-do-i-use-filebeat-filter-to-filter-network-logs-that-receive-rsyslog/288582 "2021-11-08T04:05:01Z")
My network device logs point to Rsyslog, fileBeat to Rsyslog pull logs output to Elasticsearch, in Kibana display, I now want to use fileBeat filter to filter log files output to Elasticsearch.I haven't filtered it be… --- ## [Need to create unique index names for metric and filebeat where logs/metrics of one particular namespace would flow](https://discuss.elastic.co/t/need-to-create-unique-index-names-for-metric-and-filebeat-where-logs-metrics-of-one-particular-namespace-would-flow/288580)
**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\ **Replies:** 1\ **Last updated:** [November 8, 2021, 1:47am UTC](https://discuss.elastic.co/t/need-to-create-unique-index-names-for-metric-and-filebeat-where-logs-metrics-of-one-particular-namespace-would-flow/288580 "2021-11-08T01:47:44Z")
Usually all logs/Metrics goes to a common index but need a solution where dev namespace logs goes to filebeat-dev-\* How do i do this in filebeat i do not have logstash or any pipelines --- ## [Need to filter metrics from clusters which its being sent from](https://discuss.elastic.co/t/need-to-filter-metrics-from-clusters-which-its-being-sent-from/287260)
**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\ **Replies:** 3\ **Last updated:** [November 8, 2021, 1:36am UTC](https://discuss.elastic.co/t/need-to-filter-metrics-from-clusters-which-its-being-sent-from/287260 "2021-11-08T01:36:20Z")
Hi, Current situation is all logs from different cluster are mixed in the same index. We are using metric beats which is running as daemon sets in a cluster. We need same dashboards where we could list out the clusters… --- ## [Should I store user id or name in logging?](https://discuss.elastic.co/t/should-i-store-user-id-or-name-in-logging/288460)
**Author:** [@buaaytt](https://discuss.elastic.co/u/buaaytt)\ **Replies:** 2\ **Last updated:** [November 8, 2021, 12:23am UTC](https://discuss.elastic.co/t/should-i-store-user-id-or-name-in-logging/288460 "2021-11-08T00:23:10Z")
A common scenario in logging is the need to store the backend user performing the logging action. So using ES should I store the user id or its username in the document? After all, when retrieving logs, I need to return … --- ## [Kibana 7.1 No Lens / Canvas](https://discuss.elastic.co/t/kibana-7-1-no-lens-canvas/288576)
**Author:** [@Glenn\_Pauling](https://discuss.elastic.co/u/Glenn_Pauling)\ **Replies:** 3\ **Last updated:** [November 8, 2021, 12:22am UTC](https://discuss.elastic.co/t/kibana-7-1-no-lens-canvas/288576 "2021-11-08T00:22:12Z")
Hello, We recently upgraded to Kibana 7.1 by downloading install file provided by Oracle (for Peoplesoft). Peoplesoft now is integrated with Kibana, so many new companies are starting to use this product. I've done … --- ## [Talk to server... ERROR 401 Unauthorized: Unauthorized](https://discuss.elastic.co/t/talk-to-server-error-401-unauthorized-unauthorized/288469)
**Author:** [@nasirnjs](https://discuss.elastic.co/u/nasirnjs)\ **Replies:** 1\ **Last updated:** [November 8, 2021, 12:03am UTC](https://discuss.elastic.co/t/talk-to-server-error-401-unauthorized-unauthorized/288469 "2021-11-08T00:03:07Z")
Hi Experts assist me please .... after install Wazuh I have added agent, when I click agent there is no log showing. Elasticsearch: https://127.0.0.1:9200... parse url... OK connection... parse host... OK dns lookup… --- ## [X of y shards failed](https://discuss.elastic.co/t/x-of-y-shards-failed/285559)
**Author:** [@Noursh](https://discuss.elastic.co/u/Noursh)\ **Replies:** 6\ **Last updated:** [November 7, 2021, 11:55pm UTC](https://discuss.elastic.co/t/x-of-y-shards-failed/285559 "2021-11-07T23:55:45Z")
Type: es\_rejected\_execution\_exception Reason: rejected execution of org.Elasticsearch.common.util.concurrent.TimedRunnable@5ec3e8 on QueueResizingEsThreadPoolExecutor I had monitored the CPU and RAM and all the metrics… --- ## [Web crawler source code](https://discuss.elastic.co/t/web-crawler-source-code/288569)
**Author:** [@baseely](https://discuss.elastic.co/u/baseely)\ **Replies:** 2\ **Last updated:** [November 7, 2021, 10:48pm UTC](https://discuss.elastic.co/t/web-crawler-source-code/288569 "2021-11-07T22:48:49Z")
Hello Team, I tried to search for the Web Crawler source code online but I couldn't locate it. Is there any direct link to the source code / repository ? Kind Regards. --- ## [Logging into Elasticsearch](https://discuss.elastic.co/t/logging-into-elasticsearch/288535)
**Author:** [@SteveP](https://discuss.elastic.co/u/SteveP)\ **Replies:** 5\ **Last updated:** [November 7, 2021, 8:35pm UTC](https://discuss.elastic.co/t/logging-into-elasticsearch/288535 "2021-11-07T20:35:19Z")
Hello all, I have created a single node ES system, as a way to ingest security data from my firewall. As part of this I need to configure the security plugin on my firewall to login to ES and setup it’s data indices. I… --- ## [Filebeat failed to publish events: temporary bulk send failure](https://discuss.elastic.co/t/filebeat-failed-to-publish-events-temporary-bulk-send-failure/288566)
**Author:** [@cdalexndr](https://discuss.elastic.co/u/cdalexndr)\ **Replies:** 1\ **Last updated:** [November 7, 2021, 4:34pm UTC](https://discuss.elastic.co/t/filebeat-failed-to-publish-events-temporary-bulk-send-failure/288566 "2021-11-07T16:34:56Z")
Filebeat 7.14.1 is stuck in a log loop with failed to publish events: temporary bulk send failure. Turning debug log, it shows: filebeat | 2021-11-07T15:57:49.938Z INFO \[publisher\_pipeline\_output\] pipeline/o… --- ## [No "PDF Reports" and "PNG Reports" options](https://discuss.elastic.co/t/no-pdf-reports-and-png-reports-options/288564)
**Author:** [@victor.you](https://discuss.elastic.co/u/victor.you)\ **Replies:** 1\ **Last updated:** [November 7, 2021, 3:58pm UTC](https://discuss.elastic.co/t/no-pdf-reports-and-png-reports-options/288564 "2021-11-07T15:58:35Z")
Hi, all I wanna to report my dashboard in PDF format, but there's no "PDF Reports" and "PNG Reports" options in share menu. My kibana instance is in docker container using image : "docker.elastic.co/elasticsearch/elas… [Previous page](https://discuss.elastic.co/latest.md?page=1398) [Next page](https://discuss.elastic.co/latest.md?page=1400)