# Latest **URL:** https://discuss.elastic.co/latest.md?page=1656 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1657 --- ## [Stacked vertical graph in Kibana](https://discuss.elastic.co/t/stacked-vertical-graph-in-kibana/274058)
**Author:** [@dinesh5](https://discuss.elastic.co/u/dinesh5)\ **Replies:** 1\ **Last updated:** [May 26, 2021, 4:38pm UTC](https://discuss.elastic.co/t/stacked-vertical-graph-in-kibana/274058 "2021-05-26T16:38:51Z")
Hello I'm new to Kibana, trying to create a vertical graph with a two split in a bar. My data set Ariyalur,11.1401,79.0786,215,4 Chengalpattu,12.6819,79.9888,1870,36 Chennai,13.0827,80.2707,4041,88 Coimbatore,11.016… --- ## [Xml filter Xpath nested fields](https://discuss.elastic.co/t/xml-filter-xpath-nested-fields/274190)
**Author:** [@roua.B](https://discuss.elastic.co/u/roua.B)\ **Replies:** 0\ **Last updated:** [May 27, 2021, 11:12am UTC](https://discuss.elastic.co/t/xml-filter-xpath-nested-fields/274190 "2021-05-27T11:12:49Z")
Hello, I have an xml file witch is a collection of tags like this: \ \ \ \ **Author:** [@ima](https://discuss.elastic.co/u/ima)\ **Replies:** 0\ **Last updated:** [May 27, 2021, 11:02am UTC](https://discuss.elastic.co/t/logstash-healthcheck/274185 "2021-05-27T11:02:05Z") Hello does anybody have an idea about healthchecks wa can do for logstash --- ## [Metricbeat SQL Module storing datetime field as string](https://discuss.elastic.co/t/metricbeat-sql-module-storing-datetime-field-as-string/274178)
**Author:** [@Sathish22](https://discuss.elastic.co/u/Sathish22)\ **Replies:** 0\ **Last updated:** [May 27, 2021, 10:09am UTC](https://discuss.elastic.co/t/metricbeat-sql-module-storing-datetime-field-as-string/274178 "2021-05-27T10:09:07Z")
Dear Team, We have a custom query to be configured in metricbeat SQL module. And query consist of field with the name as Date\_Time as datetime format. After configured the SQL in sql module, it is pushing Date\_Time fi… --- ## [Don't working scheduler in snapshot policy](https://discuss.elastic.co/t/dont-working-scheduler-in-snapshot-policy/274156)
**Author:** [@Valery1976](https://discuss.elastic.co/u/Valery1976)\ **Replies:** 0\ **Last updated:** [May 27, 2021, 8:06am UTC](https://discuss.elastic.co/t/dont-working-scheduler-in-snapshot-policy/274156 "2021-05-27T08:06:33Z")
Hi, I'm was install 3nodes-cluster elasticsearch. Setted the snapshot policy for indecies rotation. Running the policy manually working success, but through scheduler don't work. Version of ElasticSearch is 7.12.1 G… --- ## [PodDisruptionBudget was restarting](https://discuss.elastic.co/t/poddisruptionbudget-was-restarting/273914)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 2\ **Last updated:** [May 27, 2021, 8:56am UTC](https://discuss.elastic.co/t/poddisruptionbudget-was-restarting/273914 "2021-05-27T08:56:21Z")
I had deployed eck 1.3.0 in GKE cluster. I saw pdb was refreshing even though there were no changes in any elasticsearch cluster nor pdb related configurations. Can anyone please tell why would this happen. --- ## [The Dockerfile of filebeat](https://discuss.elastic.co/t/the-dockerfile-of-filebeat/274162)
**Author:** [@HeGaoYuan](https://discuss.elastic.co/u/HeGaoYuan)\ **Replies:** 0\ **Last updated:** [May 27, 2021, 8:52am UTC](https://discuss.elastic.co/t/the-dockerfile-of-filebeat/274162 "2021-05-27T08:52:03Z")
Hi, elastic/filebeat team I use the filebeat 7.5.2 docer image in beats/filebeat:7.5.2 | Docker @ Elastic , but I found some question, so I need to add some log to debug. I modify the source code from https://github.c… --- ## [How can i filter errors in filebeat](https://discuss.elastic.co/t/how-can-i-filter-errors-in-filebeat/273893)
**Author:** [@Martin\_perez](https://discuss.elastic.co/u/Martin_perez)\ **Replies:** 4\ **Last updated:** [May 27, 2021, 8:20am UTC](https://discuss.elastic.co/t/how-can-i-filter-errors-in-filebeat/273893 "2021-05-27T08:20:14Z")
Hi, I have an elk stack mounted, which receives data from two filebeats. I want to configure my filebeat configuration files so that it only collects files whose error is anything other than 500, and I have tried to do … --- ## [Logtash |7.12.1 | Multiple pipelines](https://discuss.elastic.co/t/logtash-7-12-1-multiple-pipelines/273607)
**Author:** [@Tarun\_N](https://discuss.elastic.co/u/Tarun_N)\ **Replies:** 5\ **Last updated:** [May 27, 2021, 8:12am UTC](https://discuss.elastic.co/t/logtash-7-12-1-multiple-pipelines/273607 "2021-05-27T08:12:34Z")
Hello All I have to configure multiple pipelines for which I carried out the changes in pipelines.yml with simple test configuration, after removing all the code to debug to make it work. Below is the sample configurati… --- ## [Filebeat cannot merge partial events](https://discuss.elastic.co/t/filebeat-cannot-merge-partial-events/274119)
**Author:** [@delta9](https://discuss.elastic.co/u/delta9)\ **Replies:** 1\ **Last updated:** [May 27, 2021, 7:55am UTC](https://discuss.elastic.co/t/filebeat-cannot-merge-partial-events/274119 "2021-05-27T07:55:39Z")
Hi all. We use filebeat to collect events from pods in k8s cluster. To do this we run it as daemonset and mounts /var/lib/docker/containers, /var/log/pods and /var/log/containers from cluster nodes into filebeat pods. … --- ## [FileBeat Startup error - No paths were defined for input accessing](https://discuss.elastic.co/t/filebeat-startup-error-no-paths-were-defined-for-input-accessing/274014)
**Author:** [@Parveen\_Sharma](https://discuss.elastic.co/u/Parveen_Sharma)\ **Replies:** 4\ **Last updated:** [May 27, 2021, 7:52am UTC](https://discuss.elastic.co/t/filebeat-startup-error-no-paths-were-defined-for-input-accessing/274014 "2021-05-27T07:52:17Z")
I am using filebeat 7.8.1 Following is the filebeat configuration file - type: kubernetes in\_cluster: true tags: - "kubernetes" templates: - condi… --- ## [Index is not Rollover](https://discuss.elastic.co/t/index-is-not-rollover/273636)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [May 27, 2021, 7:42am UTC](https://discuss.elastic.co/t/index-is-not-rollover/273636 "2021-05-27T07:42:56Z")
I have 8 node cluster 3 master 3 hot node and 2 warm node.I have an index called log-wlb-system in hot node it will rotate every index after 1 day or when its size reach to 1gb and in warm node the retention is 2 days … --- ## [Is it possible to embed a canvas in a document?](https://discuss.elastic.co/t/is-it-possible-to-embed-a-canvas-in-a-document/274132)
**Author:** [@Ali\_Nazemian](https://discuss.elastic.co/u/Ali_Nazemian)\ **Replies:** 3\ **Last updated:** [May 27, 2021, 7:26am UTC](https://discuss.elastic.co/t/is-it-possible-to-embed-a-canvas-in-a-document/274132 "2021-05-27T07:26:06Z")
I am looking for a way that a Canvas object can be embedded in a document? I am trying to create a custom template for it to generate some high-level reports in our organisation. I was wondering if anybody has used Canva… --- ## [Reindex API is extremely slow](https://discuss.elastic.co/t/reindex-api-is-extremely-slow/273510)
**Author:** [@abhinav2](https://discuss.elastic.co/u/abhinav2)\ **Replies:** 1\ **Last updated:** [May 27, 2021, 6:57am UTC](https://discuss.elastic.co/t/reindex-api-is-extremely-slow/273510 "2021-05-27T06:57:26Z")
I'm getting a write speed of 680 KB/s per node for the reindex API. Cluster is a 16 data node cluster with 3 master nodes. Each data node has 1.3 TB gp3 Disk with 3000 IOPS and 125 MBps throughput. Reindex API is using… --- ## [APM profiler stopping with https://discuss.elastic.co/c/apm on latest adoptopenjdk/openjdk8-openj9:alpine-slim](https://discuss.elastic.co/t/apm-profiler-stopping-with-https-discuss-elastic-co-c-apm-on-latest-adoptopenjdk-openjdk8-openj9-alpine-slim/273428)
**Author:** [@Kim\_Attree](https://discuss.elastic.co/u/Kim_Attree)\ **Replies:** 13\ **Last updated:** [May 27, 2021, 6:54am UTC](https://discuss.elastic.co/t/apm-profiler-stopping-with-https-discuss-elastic-co-c-apm-on-latest-adoptopenjdk-openjdk8-openj9-alpine-slim/273428 "2021-05-27T06:54:31Z")
Kibana version: 7.4.1 Elasticsearch version: 7.4.1 APM Server version: 7.4.1 APM Agent language and version: Java 1.20 Browser version: n/a Original install method (e.g. download page, yum, deb, from source, etc.) a… --- ## [Terms query success on ID, fails on everything else](https://discuss.elastic.co/t/terms-query-success-on-id-fails-on-everything-else/274075)
**Author:** [@pyrovoice](https://discuss.elastic.co/u/pyrovoice)\ **Replies:** 1\ **Last updated:** [May 27, 2021, 6:47am UTC](https://discuss.elastic.co/t/terms-query-success-on-id-fails-on-everything-else/274075 "2021-05-27T06:47:50Z")
Doing the following search: curl --location --request POST 'localhost:9200/author/\_search?pretty' \\ --header 'Content-Type: application/json' \\ --data-raw '{ "query": { "terms": { "\_id": \[ "myName" \] … --- ## [Help in a search query](https://discuss.elastic.co/t/help-in-a-search-query/274112)
**Author:** [@appydam](https://discuss.elastic.co/u/appydam)\ **Replies:** 2\ **Last updated:** [May 27, 2021, 6:24am UTC](https://discuss.elastic.co/t/help-in-a-search-query/274112 "2021-05-27T06:24:59Z")
I have {id, title, short\_description and description} in my document. I have to do search query on description text and want to reach title. Like if a person enters something in the description then matching titles appe… --- ## [ElasticSearch Windows 2019 service fails to start](https://discuss.elastic.co/t/elasticsearch-windows-2019-service-fails-to-start/274137)
**Author:** [@ddemland](https://discuss.elastic.co/u/ddemland)\ **Replies:** 1\ **Last updated:** [May 27, 2021, 6:13am UTC](https://discuss.elastic.co/t/elasticsearch-windows-2019-service-fails-to-start/274137 "2021-05-27T06:13:56Z")
I have installed ElasticSerach on Windows 2019 server. When I start the service manually it starts, but seems to be a little slow. When I reboot the system the Event log shows the following error: The Elasticsearch serv… --- ## [Same Condition Logs Parse on Logstash](https://discuss.elastic.co/t/same-condition-logs-parse-on-logstash/274139)
**Author:** [@Nazakat](https://discuss.elastic.co/u/Nazakat)\ **Replies:** 0\ **Last updated:** [May 27, 2021, 6:13am UTC](https://discuss.elastic.co/t/same-condition-logs-parse-on-logstash/274139 "2021-05-27T06:13:30Z")
how to parse logs in same condition? --- ## [Help/Advice needed setting up geo-ip filters in an on-prem Logstash to SIEM in Elastic Cloud instance](https://discuss.elastic.co/t/help-advice-needed-setting-up-geo-ip-filters-in-an-on-prem-logstash-to-siem-in-elastic-cloud-instance/273593)
**Author:** [@ronmer](https://discuss.elastic.co/u/ronmer)\ **Replies:** 11\ **Last updated:** [May 27, 2021, 5:26am UTC](https://discuss.elastic.co/t/help-advice-needed-setting-up-geo-ip-filters-in-an-on-prem-logstash-to-siem-in-elastic-cloud-instance/273593 "2021-05-27T05:26:54Z")
I need help confirming the exact steps required to get geo-ip information to map to the SIEM network map in Kabana My environment: Windows and Linux hosts running either Auditbeat, Packetbeat or Winlogbeat, Packetbeat … --- ## [Elastic-APM Invalid index name \[\_license\]](https://discuss.elastic.co/t/elastic-apm-invalid-index-name-license/274131)
**Author:** [@pszm](https://discuss.elastic.co/u/pszm)\ **Replies:** 1\ **Last updated:** [May 27, 2021, 5:01am UTC](https://discuss.elastic.co/t/elastic-apm-invalid-index-name-license/274131 "2021-05-27T05:01:24Z")
We are trying to get elastic-apm install (for now on our development systems). According to Homebrew, we have the latest elasticsearch-oss (7.10.2), kibana-oss (7.10.2) and today installed apm-server-oss (which is at ve… --- ## [Elasticsearch query type alert in kibana alerts](https://discuss.elastic.co/t/elasticsearch-query-type-alert-in-kibana-alerts/273921)
**Author:** [@Priyanka\_chauhan](https://discuss.elastic.co/u/Priyanka_chauhan)\ **Replies:** 5\ **Last updated:** [May 27, 2021, 4:46am UTC](https://discuss.elastic.co/t/elasticsearch-query-type-alert-in-kibana-alerts/273921 "2021-05-27T04:46:14Z")
I am creating elasticsearch query type alerts in Kibana Alerts and Action section. I have put a condition to send an alert when blacklist IP met with threshold condition in my query. Alerts are generated in index with p… --- ## [Transfer data/fields from one index to another](https://discuss.elastic.co/t/transfer-data-fields-from-one-index-to-another/273961)
**Author:** [@Nisha2297](https://discuss.elastic.co/u/Nisha2297)\ **Replies:** 4\ **Last updated:** [May 27, 2021, 4:07am UTC](https://discuss.elastic.co/t/transfer-data-fields-from-one-index-to-another/273961 "2021-05-27T04:07:16Z")
Can anybody help me moving the data from one index to another in Kibana. I have an index "abc" with lot number of documents and say 100 fields and I want to extract 10 fields out of it and with some filter applied to re… --- ## [Metricbeat Elasticsearch Module not working](https://discuss.elastic.co/t/metricbeat-elasticsearch-module-not-working/274020)
**Author:** [@anandd4](https://discuss.elastic.co/u/anandd4)\ **Replies:** 1\ **Last updated:** [May 27, 2021, 3:54am UTC](https://discuss.elastic.co/t/metricbeat-elasticsearch-module-not-working/274020 "2021-05-27T03:54:44Z")
Issue - Trying to set up metricbeat to collect ES metric but upon testing the elasticsearch-xpack module, its not able to connect except for "node\_stats" metric and generating the error as shown below. Can someone poin… --- ## [Give A User Permissions To On-board New Users](https://discuss.elastic.co/t/give-a-user-permissions-to-on-board-new-users/274059)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 1\ **Last updated:** [May 27, 2021, 3:08am UTC](https://discuss.elastic.co/t/give-a-user-permissions-to-on-board-new-users/274059 "2021-05-27T03:08:06Z")
I want to create a user who can create and manage new user onboarding. What I did is, created a user and assign a role with manage\_security permission for the cluster. Problem: the user who is assigned with manage\_secu… --- ## [“No results match your search criteria”](https://discuss.elastic.co/t/no-results-match-your-search-criteria/274043)
**Author:** [@sosogh](https://discuss.elastic.co/u/sosogh)\ **Replies:** 2\ **Last updated:** [May 27, 2021, 2:05am UTC](https://discuss.elastic.co/t/no-results-match-your-search-criteria/274043 "2021-05-27T02:05:51Z")
The timestamp format in the original log is "2021-05-26 18:00:00". I use fluentd to "modify" it to "2021-05-26T18:00:00.000Z" , supply it as the value of key "fulltime" , and then send it to ES. When creating index … --- ## [After enable xpack i cant change passwords](https://discuss.elastic.co/t/after-enable-xpack-i-cant-change-passwords/274092)
**Author:** [@Dimitri\_Goldshtein](https://discuss.elastic.co/u/Dimitri_Goldshtein)\ **Replies:** 1\ **Last updated:** [May 27, 2021, 1:22am UTC](https://discuss.elastic.co/t/after-enable-xpack-i-cant-change-passwords/274092 "2021-05-27T01:22:07Z")
After enable xpack i cant change passwords, commen to discovery.seed\_hosts and cluster.initial\_master\_nodes did not help! I get this error when trying to setup password: /usr/share/elasticsearch/bin# sudo ./elast… --- ## [Filebeat (with ILM) -\> Logstash -\> Elasticsearch not working](https://discuss.elastic.co/t/filebeat-with-ilm-logstash-elasticsearch-not-working/273895)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 5\ **Last updated:** [May 27, 2021, 1:18am UTC](https://discuss.elastic.co/t/filebeat-with-ilm-logstash-elasticsearch-not-working/273895 "2021-05-27T01:18:32Z")
Hi, I think I am missing some simple settings here. I have enabled the ILM in beats: setup.ilm.enabled: true setup.ilm.rollover\_alias: "log-dev-filebeat" setup.ilm.pattern: "{now/d}-000001" setup.ilm.policy\_name: "fil… --- ## [Merge lines in filebeat](https://discuss.elastic.co/t/merge-lines-in-filebeat/273981)
**Author:** [@syrine\_chelly](https://discuss.elastic.co/u/syrine_chelly)\ **Replies:** 1\ **Last updated:** [May 27, 2021, 1:14am UTC](https://discuss.elastic.co/t/merge-lines-in-filebeat/273981 "2021-05-27T01:14:00Z")
this is an extract from my file log i want to merge the lines for example under "Server 'ILPPRAGLM', Line 14" in one event every time it finds Server it merges the lines how can i do it without merging the other lin… --- ## [Differentiate Pinned Items in jQuery Plugin Autocomplete Search Results](https://discuss.elastic.co/t/differentiate-pinned-items-in-jquery-plugin-autocomplete-search-results/273318)
**Author:** [@noerbot](https://discuss.elastic.co/u/noerbot)\ **Replies:** 2\ **Last updated:** [May 27, 2021, 1:06am UTC](https://discuss.elastic.co/t/differentiate-pinned-items-in-jquery-plugin-autocomplete-search-results/273318 "2021-05-27T01:06:43Z")
Hello! Is there a way to differentiate pinned items in autocomplete search results via the jQuery Plugin? We want to show pinned results as "sponsored" on one of our projects, but there's nothing in the jQuery guide, Gi… [Previous page](https://discuss.elastic.co/latest.md?page=1655) [Next page](https://discuss.elastic.co/latest.md?page=1657)