# Latest **URL:** https://discuss.elastic.co/latest.md?page=1704 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1705 --- ## [Unable to install specific logstash version in Ubuntu](https://discuss.elastic.co/t/unable-to-install-specific-logstash-version-in-ubuntu/271663)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 0\ **Last updated:** [April 29, 2021, 2:22pm UTC](https://discuss.elastic.co/t/unable-to-install-specific-logstash-version-in-ubuntu/271663 "2021-04-29T14:22:48Z")
I want to install logstash 7.11.1 in Ubuntu 18.04 but getting below error while trying to install: ubuntu@ip-xxx-xx-xx-xxx:~$ sudo apt-get install logstash=7.11.1 Reading package lists... Done Building dependency tree … --- ## [Increase shards without changing index name](https://discuss.elastic.co/t/increase-shards-without-changing-index-name/271409)
**Author:** [@ggio](https://discuss.elastic.co/u/ggio)\ **Replies:** 3\ **Last updated:** [April 29, 2021, 2:11pm UTC](https://discuss.elastic.co/t/increase-shards-without-changing-index-name/271409 "2021-04-29T14:11:28Z")
Hi, I have a couple of indexes which are very big and I want to increase the shards number. Split index API offered by ES seems to be very interesting and useful for my case but it requires to change the index name. W… --- ## [Simple elastic search cluster monitoring](https://discuss.elastic.co/t/simple-elastic-search-cluster-monitoring/271656)
**Author:** [@webfr](https://discuss.elastic.co/u/webfr)\ **Replies:** 0\ **Last updated:** [April 29, 2021, 1:52pm UTC](https://discuss.elastic.co/t/simple-elastic-search-cluster-monitoring/271656 "2021-04-29T13:52:28Z")
Hello guys, a little contribution from myself, a simple/quick script to monitor your cluster, tested on centos 7 / ES 7.11.2 :relaxed: You can easily cron it : \*/5 \* \* \* \* /root/ES\_health.sh \>\> /root/ES\_health.log ES… --- ## [PostreSQL cron values parse in EL Kibana Logstash](https://discuss.elastic.co/t/postresql-cron-values-parse-in-el-kibana-logstash/271655)
**Author:** [@markiesauce](https://discuss.elastic.co/u/markiesauce)\ **Replies:** 0\ **Last updated:** [April 29, 2021, 1:49pm UTC](https://discuss.elastic.co/t/postresql-cron-values-parse-in-el-kibana-logstash/271655 "2021-04-29T13:49:08Z")
I have database (postresql) that have cron values in it and i want to parse in logstash kibana How can I change the values in to normal dates? Cron values have asterisks, I cannot do it at the db side is it possible on… --- ## [Highlight feature - limitToMaxAnalyzedOffset - does still exist?](https://discuss.elastic.co/t/highlight-feature-limittomaxanalyzedoffset-does-still-exist/271644)
**Author:** [@jlarroque](https://discuss.elastic.co/u/jlarroque)\ **Replies:** 2\ **Last updated:** [April 29, 2021, 1:45pm UTC](https://discuss.elastic.co/t/highlight-feature-limittomaxanalyzedoffset-does-still-exist/271644 "2021-04-29T13:45:31Z")
Hi everyone, I was wondering if you could help me. I found an interesting feature added in a specific PR: But I can't find documentation of how to use that using java HighLevel rest client. Was that removed? That PR … --- ## [Need help for getting antivirus data on dashboard from a linux instance](https://discuss.elastic.co/t/need-help-for-getting-antivirus-data-on-dashboard-from-a-linux-instance/271648)
**Author:** [@Hemant\_Dhillan](https://discuss.elastic.co/u/Hemant_Dhillan)\ **Replies:** 0\ **Last updated:** [April 29, 2021, 1:24pm UTC](https://discuss.elastic.co/t/need-help-for-getting-antivirus-data-on-dashboard-from-a-linux-instance/271648 "2021-04-29T13:24:50Z")
need help in getting the antivirus data from a Linux machine which is currently running metricbeat and showing statistics on the dashboard of kibana .i 've written a small python script which is taking appropirate inform… --- ## [Provided Grok expressions do not match field value: Fortinet 7.12.1](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value-fortinet-7-12-1/271523)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 8\ **Last updated:** [April 29, 2021, 1:24pm UTC](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value-fortinet-7-12-1/271523 "2021-04-29T13:24:23Z")
Hello, recently I started a module for logs from fortigate firewalls. - module: fortinet firewall: enabled: true # Set which input to use between tcp, udp (default) or file. #var.input: udp # The in… --- ## [Dashboard Controls Filter vs VEGA](https://discuss.elastic.co/t/dashboard-controls-filter-vs-vega/271556)
**Author:** [@Alexandre.Bernier](https://discuss.elastic.co/u/Alexandre.Bernier)\ **Replies:** 2\ **Last updated:** [April 29, 2021, 1:11pm UTC](https://discuss.elastic.co/t/dashboard-controls-filter-vs-vega/271556 "2021-04-29T13:11:11Z")
Hello there! I don't really know how to ask my question, but, I will try this way... is this possible to filter a specific VEGA visualization with a specific control filter? Let me explain. First of all, I have 2 inde… --- ## [X axis range wrong](https://discuss.elastic.co/t/x-axis-range-wrong/271642)
**Author:** [@David\_Mohamad](https://discuss.elastic.co/u/David_Mohamad)\ **Replies:** 0\ **Last updated:** [April 29, 2021, 12:47pm UTC](https://discuss.elastic.co/t/x-axis-range-wrong/271642 "2021-04-29T12:47:51Z")
What is the right way to set the range of the X axis to the minimum and maximum value of the selected time range. This is what I have at the moment. If I select 2 days ago in the timefilter, it should show me the da… --- ## [ECK operator 1.3 Security vulnerabilities](https://discuss.elastic.co/t/eck-operator-1-3-security-vulnerabilities/271456)
**Author:** [@NK2812](https://discuss.elastic.co/u/NK2812)\ **Replies:** 2\ **Last updated:** [April 29, 2021, 12:28pm UTC](https://discuss.elastic.co/t/eck-operator-1-3-security-vulnerabilities/271456 "2021-04-29T12:28:00Z")
Hi Team, I am using the ECK operator 1.3.0 version docker image to provision the Elastic cluster, when I run the security scan on the ECK docker image there are security vulnerabilities and all of them comes from Packag… --- ## [New line character in painless](https://discuss.elastic.co/t/new-line-character-in-painless/271604)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 1\ **Last updated:** [April 29, 2021, 11:48am UTC](https://discuss.elastic.co/t/new-line-character-in-painless/271604 "2021-04-29T11:48:38Z")
i want to send new line char to api using watcher "actions": { "sms": { "webhook": { "scheme": "https", "host": "127.0.0.1", "port": 80, "method": "post", "path": "/api/… --- ## [ElasticsearchException got in indexing function: TransportError](https://discuss.elastic.co/t/elasticsearchexception-got-in-indexing-function-transporterror/271195)
**Author:** [@sanjay\_sheel](https://discuss.elastic.co/u/sanjay_sheel)\ **Replies:** 3\ **Last updated:** [April 29, 2021, 11:47am UTC](https://discuss.elastic.co/t/elasticsearchexception-got-in-indexing-function-transporterror/271195 "2021-04-29T11:47:25Z")
\[17:15:47\]{completed\_searching2.py:346}ERROR- Error Occured: Exception in indexing function: ElasticsearchException got in indexing function: TransportError(429, 'circuit\_breaking\_exception', '\[parent\] Data too large, da… --- ## [Update a single field vs Inserting the whole document again](https://discuss.elastic.co/t/update-a-single-field-vs-inserting-the-whole-document-again/271607)
**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Replies:** 1\ **Last updated:** [April 29, 2021, 11:33am UTC](https://discuss.elastic.co/t/update-a-single-field-vs-inserting-the-whole-document-again/271607 "2021-04-29T11:33:44Z")
Which one is more costly operation? Suppose I have 50 fields per document in an index. Updating a single field in a document Or, Re-inserting the complete whole document with that changed field. Basically \_update vs … --- ## [Can't we get total number of matches in \_search api?](https://discuss.elastic.co/t/cant-we-get-total-number-of-matches-in-search-api/271612)
**Author:** [@raja\_augstin](https://discuss.elastic.co/u/raja_augstin)\ **Replies:** 3\ **Last updated:** [April 29, 2021, 11:29am UTC](https://discuss.elastic.co/t/cant-we-get-total-number-of-matches-in-search-api/271612 "2021-04-29T11:29:48Z")
can't we get total number of matches in \_search api? i'm using following search api to get total matched document and to find number of match for the given query. in this we don't receive the actual total match for th… --- ## [Indexing with deprecated \_type field](https://discuss.elastic.co/t/indexing-with-deprecated-type-field/271478)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 16\ **Last updated:** [April 29, 2021, 11:11am UTC](https://discuss.elastic.co/t/indexing-with-deprecated-type-field/271478 "2021-04-29T11:11:52Z")
Hello community. I have a question. What happens in elasticsearch 7.10 if a write attempt occurs with deprecated \_type field (we use apache metron, that tries to write to elastic), something like this "{"index":{"\_ind… --- ## [NoClassDefFoundError starting with Java agent version 1.23](https://discuss.elastic.co/t/noclassdeffounderror-starting-with-java-agent-version-1-23/271573)
**Author:** [@JoergHeinicke5005](https://discuss.elastic.co/u/JoergHeinicke5005)\ **Replies:** 3\ **Last updated:** [April 29, 2021, 10:36am UTC](https://discuss.elastic.co/t/noclassdeffounderror-starting-with-java-agent-version-1-23/271573 "2021-04-29T10:36:11Z")
APM Agent language and version: Java Agent v1.23 \*\*Description of the problem including expected versus actual behavior. \*\*: We have a Spring Boot application in which we attach the Java APM Agent programmatically: @S… --- ## [Setting up admin user credentials for Kibana](https://discuss.elastic.co/t/setting-up-admin-user-credentials-for-kibana/271617)
**Author:** [@usman1](https://discuss.elastic.co/u/usman1)\ **Replies:** 1\ **Last updated:** [April 29, 2021, 10:33am UTC](https://discuss.elastic.co/t/setting-up-admin-user-credentials-for-kibana/271617 "2021-04-29T10:33:55Z")
I am trying to impose basic security on my Elasticstack specifically user authentication for Kibana. I enabled xpack security by adding the following configurations in elasticsearch.yml file: xpack.security.enabled: tru… --- ## [Reindex remote: not authorized](https://discuss.elastic.co/t/reindex-remote-not-authorized/271621)
**Author:** [@Davide\_Barbato](https://discuss.elastic.co/u/Davide_Barbato)\ **Replies:** 0\ **Last updated:** [April 29, 2021, 10:31am UTC](https://discuss.elastic.co/t/reindex-remote-not-authorized/271621 "2021-04-29T10:31:27Z")
Hello there :wave: I'm trying to configure reindex from remote on an ECK instance with ES version 6.8.15 I feel I've configured everything correctly but still get the infamous "not authorized". This is the configurati… --- ## [Please add count for selected indices](https://discuss.elastic.co/t/please-add-count-for-selected-indices/271610)
**Author:** [@Nurlan199206](https://discuss.elastic.co/u/Nurlan199206)\ **Replies:** 1\ **Last updated:** [April 29, 2021, 10:07am UTC](https://discuss.elastic.co/t/please-add-count-for-selected-indices/271610 "2021-04-29T10:07:52Z")
I have a suggestion, if possible you can add items count for selected indices? it is difficult to count manually. --- ## [Remote node cluster join](https://discuss.elastic.co/t/remote-node-cluster-join/271488)
**Author:** [@Makss39](https://discuss.elastic.co/u/Makss39)\ **Replies:** 12\ **Last updated:** [April 29, 2021, 9:31am UTC](https://discuss.elastic.co/t/remote-node-cluster-join/271488 "2021-04-29T09:31:40Z")
Hi, I've a 3 node cluster on my local network, it works like a charm. I just want to add a 4th node, but on another nework. But i'm not able to perform the discovery, my local master is well discovered by the remote no… --- ## [Search - keyword vs text and ngram](https://discuss.elastic.co/t/search-keyword-vs-text-and-ngram/271606)
**Author:** [@lele15](https://discuss.elastic.co/u/lele15)\ **Replies:** 0\ **Last updated:** [April 29, 2021, 9:21am UTC](https://discuss.elastic.co/t/search-keyword-vs-text-and-ngram/271606 "2021-04-29T09:21:36Z")
Hi, I have an index like: "name": { "type": "keyword" }, "address": { "type": "keyword" }, "addressText": { "type": "text", "analyzer": "autocomplete", "search\_analyzer": "autocomplete\_search" }, "nameText":… --- ## [Mapping Explosion for Kubernetes/Openshift Index](https://discuss.elastic.co/t/mapping-explosion-for-kubernetes-openshift-index/271418)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 5\ **Last updated:** [April 29, 2021, 8:54am UTC](https://discuss.elastic.co/t/mapping-explosion-for-kubernetes-openshift-index/271418 "2021-04-29T08:54:21Z")
Hi folks, I am shipping application logs using filebeat daemonset (7.9.0) from openshift to elasticsearch (7.6.2) Right now I am running into following warnings: "Limit of total fields \[10000\] in index \[filebeat-opens… --- ## [HELP! Exiting: Error in initing input: No paths were defined for input accessing 'filebeat.prospectors.1'](https://discuss.elastic.co/t/help-exiting-error-in-initing-input-no-paths-were-defined-for-input-accessing-filebeat-prospectors-1/271528)
**Author:** [@vv007b](https://discuss.elastic.co/u/vv007b)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 2:55pm UTC](https://discuss.elastic.co/t/help-exiting-error-in-initing-input-no-paths-were-defined-for-input-accessing-filebeat-prospectors-1/271528 "2021-04-28T14:55:37Z")
PS C:\\Program Files\\Filebeat\> .\\filebeat.exe -e -v 2021-04-28T17:40:17.071+0300 INFO instance/beat.go:592 Home path: \[C:\\Program Files\\Filebeat\] Config path: \[C: Program Files\\Filebeat\] Data path: \[C:\\Program … --- ## [Redindex, version\_type external](https://discuss.elastic.co/t/redindex-version-type-external/271587)
**Author:** [@Kalpa](https://discuss.elastic.co/u/Kalpa)\ **Replies:** 4\ **Last updated:** [April 29, 2021, 8:42am UTC](https://discuss.elastic.co/t/redindex-version-type-external/271587 "2021-04-29T08:42:56Z")
HI All, Reindex can be done multiple times as per the documentation, during this phase, for example. reindexed at time 1. deleted some docs from the source added some docs to the source. reindex with version\_type ext… --- ## [Elasticsearch Disk indices storage greater than the indices used space](https://discuss.elastic.co/t/elasticsearch-disk-indices-storage-greater-than-the-indices-used-space/271328)
**Author:** [@Ahmed\_Abdulaleem](https://discuss.elastic.co/u/Ahmed_Abdulaleem)\ **Replies:** 4\ **Last updated:** [April 29, 2021, 8:07am UTC](https://discuss.elastic.co/t/elasticsearch-disk-indices-storage-greater-than-the-indices-used-space/271328 "2021-04-29T08:07:54Z")
I have an issue with disk space as the disk indices greater than size of index as shown in the attached file. can anyone help me to understand why the data much greater than actual index size as sum of storage o… --- ## [Filebeat Azure module not supporting geoip map visualisation](https://discuss.elastic.co/t/filebeat-azure-module-not-supporting-geoip-map-visualisation/271593)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 0\ **Last updated:** [April 29, 2021, 7:27am UTC](https://discuss.elastic.co/t/filebeat-azure-module-not-supporting-geoip-map-visualisation/271593 "2021-04-29T07:27:40Z")
I am working with custom index, I copied Filbeat ingest pipeline and just modified name to use for my custom index. When data loaded, I can see geoip lookup data but when I go to create map visualisation it doesn't suppo… --- ## [\[processors\] required property is missing](https://discuss.elastic.co/t/processors-required-property-is-missing/271554)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 6\ **Last updated:** [April 29, 2021, 7:17am UTC](https://discuss.elastic.co/t/processors-required-property-is-missing/271554 "2021-04-29T07:17:26Z")
I am creating a ingest pipeline for custom index for Azure activity log with same configurations it has for Filebeat index. I copied pipeline content from \_ingest/pipeline. Due to character limit, I am unable to paste th… --- ## [\[packetbeat\]The response time collected by packetbeat and the database table information collected by MySQL is incorrect](https://discuss.elastic.co/t/packetbeat-the-response-time-collected-by-packetbeat-and-the-database-table-information-collected-by-mysql-is-incorrect/271585)
**Author:** [@q729007453](https://discuss.elastic.co/u/q729007453)\ **Replies:** 2\ **Last updated:** [April 29, 2021, 7:10am UTC](https://discuss.elastic.co/t/packetbeat-the-response-time-collected-by-packetbeat-and-the-database-table-information-collected-by-mysql-is-incorrect/271585 "2021-04-29T07:10:09Z")
As the title， Among them, the end time is earlier than the start time, and event.duration cannot be captured. and path fetches incorrectly Publish event is as follows 2021-04-28T14:53:43.296+0800 DEBUG \[processors\] pr… --- ## [Sankey Chart](https://discuss.elastic.co/t/sankey-chart/270335)
**Author:** [@Ashvin\_Bhutekar](https://discuss.elastic.co/u/Ashvin_Bhutekar)\ **Replies:** 9\ **Last updated:** [April 29, 2021, 6:58am UTC](https://discuss.elastic.co/t/sankey-chart/270335 "2021-04-29T06:58:03Z")
Is it possible to create 4 level (or more ) sankey chart? --- ## [Structured logging with Filebeat](https://discuss.elastic.co/t/structured-logging-with-filebeat/269383)
**Author:** [@vharabor](https://discuss.elastic.co/u/vharabor)\ **Replies:** 11\ **Last updated:** [April 29, 2021, 6:42am UTC](https://discuss.elastic.co/t/structured-logging-with-filebeat/269383 "2021-04-29T06:42:59Z")
Signed up for the elastic trial and quickly got the Filebeat up and running and getting docker statistics to Elasticsearch. I'm really stuck in trying to add any kind of structured logging to kibana. I've tried to add… [Previous page](https://discuss.elastic.co/latest.md?page=1703) [Next page](https://discuss.elastic.co/latest.md?page=1705)