# Latest **URL:** https://discuss.elastic.co/latest.md?page=1855 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1856 --- ## [ES HADOOP(7.9.0) , ELASTICSEARCH(7.9.0), HIVE(3.1.2)](https://discuss.elastic.co/t/es-hadoop-7-9-0-elasticsearch-7-9-0-hive-3-1-2/263338)
**Author:** [@ycseol](https://discuss.elastic.co/u/ycseol)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 7:27am UTC](https://discuss.elastic.co/t/es-hadoop-7-9-0-elasticsearch-7-9-0-hive-3-1-2/263338 "2021-02-05T07:27:18Z")
hi~ i'm setting HADOOP cluster , ES cluster. so i need to transfer data 'HDFS' to 'ES' HDFS(hive) --\> ES(static index) hive table CREATE EXTERNAL TABLE es\_test(breed string, sex string) STORED BY 'org.elasticsearc… --- ## [How to customize the name of the s3 part file](https://discuss.elastic.co/t/how-to-customize-the-name-of-the-s3-part-file/263334)
**Author:** [@kaushik.vankayala](https://discuss.elastic.co/u/kaushik.vankayala)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 7:00am UTC](https://discuss.elastic.co/t/how-to-customize-the-name-of-the-s3-part-file/263334 "2021-02-05T07:00:33Z")
Hi There, I use the S3 output plugin for persisting the raw data of our Mulesoft applicaiton. I have following configuration is my s3 output plugin; output { s3 { id =\> "experience\_rt4\_s3\_backup" codec =\> line {… --- ## [Got error in logstash. help me!](https://discuss.elastic.co/t/got-error-in-logstash-help-me/262587)
**Author:** [@Farmer\_J](https://discuss.elastic.co/u/Farmer_J)\ **Replies:** 2\ **Last updated:** [February 5, 2021, 6:39am UTC](https://discuss.elastic.co/t/got-error-in-logstash-help-me/262587 "2021-02-05T06:39:37Z")
hi guys . i got some error code in AMI when i excute logstash config file for indexing these is error codes=\> Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash… --- ## [Delete doc.delete](https://discuss.elastic.co/t/delete-doc-delete/263333)
**Author:** [@Farmer\_J](https://discuss.elastic.co/u/Farmer_J)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 6:38am UTC](https://discuss.elastic.co/t/delete-doc-delete/263333 "2021-02-05T06:38:08Z")
good after noon mates. im using logstash on AMI i have question about doc.delete data Im trying to delete doc.delete datas is it properly command shell mate? curl -X POST "https://search-everon-jkgsx53bmgr3lhvcwpgyl… --- ## [Aggregate similar documents](https://discuss.elastic.co/t/aggregate-similar-documents/263332)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 6:30am UTC](https://discuss.elastic.co/t/aggregate-similar-documents/263332 "2021-02-05T06:30:09Z")
I have a documents see example "message":"Syslog connection established; fd='15', server='AF\_INET(111.103.111.65:1514)', local='AF\_INET(0.0.0.0:0)'" "message":"Syslog connection established; fd='14', server='AF\_INET(222… --- ## [Why I got so many entries \*.createdAt and \*.updatedAt inside "fields"?](https://discuss.elastic.co/t/why-i-got-so-many-entries-createdat-and-updatedat-inside-fields/263326)
**Author:** [@thesn](https://discuss.elastic.co/u/thesn)\ **Replies:** 1\ **Last updated:** [February 5, 2021, 4:33am UTC](https://discuss.elastic.co/t/why-i-got-so-many-entries-createdat-and-updatedat-inside-fields/263326 "2021-02-05T04:33:02Z")
Hi, I am new to ELK. I have filebeat 7.8.1, Logstash 7.8.0 (in docker), Elasticsearch 7.8.0. I have log like this in my .log file: {"@timestamp":"2021-02-03T09:43:44.439+07:00","@version":"1","message":"channelAct… --- ## [Routing key for multi index query](https://discuss.elastic.co/t/routing-key-for-multi-index-query/263322)
**Author:** [@prosens](https://discuss.elastic.co/u/prosens)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 3:16am UTC](https://discuss.elastic.co/t/routing-key-for-multi-index-query/263322 "2021-02-05T03:16:13Z")
For a multi-index query, is it possible to specify a separate routing key for each index? --- ## [Security roles not working for ML issue](https://discuss.elastic.co/t/security-roles-not-working-for-ml-issue/263320)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 1:41am UTC](https://discuss.elastic.co/t/security-roles-not-working-for-ml-issue/263320 "2021-02-05T01:41:24Z")
I'm currently frustrated at the ML permissions. I've given one user access to the ML page on kibana, but I'd like the user only to be able to access the .ml index that I created for that user. I followed the directions … --- ## [Field reference with a split event](https://discuss.elastic.co/t/field-reference-with-a-split-event/263315)
**Author:** [@jiacob](https://discuss.elastic.co/u/jiacob)\ **Replies:** 1\ **Last updated:** [February 5, 2021, 12:20am UTC](https://discuss.elastic.co/t/field-reference-with-a-split-event/263315 "2021-02-05T00:20:25Z")
Hello, I'm looking into trying to split a nested field that uses a field reference and I'm not sure which is the right way of doing it. split { field =\> "\[field1\]\[field2\]\['%{\[field3\]}'\]" } This gives me a field refere… --- ## [Date format error from elasticsearch](https://discuss.elastic.co/t/date-format-error-from-elasticsearch/263307)
**Author:** [@earlsanchez](https://discuss.elastic.co/u/earlsanchez)\ **Replies:** 2\ **Last updated:** [February 4, 2021, 11:32pm UTC](https://discuss.elastic.co/t/date-format-error-from-elasticsearch/263307 "2021-02-04T23:32:11Z")
Hello, I originally posted this in the Logstash forum but it was suggested that I should post in Elasticsearch instead. I'm getting a date format error from elasticsearch but the format seems to match the posted date o… --- ## [Date format error from logstash](https://discuss.elastic.co/t/date-format-error-from-logstash/263299)
**Author:** [@earlsanchez](https://discuss.elastic.co/u/earlsanchez)\ **Replies:** 4\ **Last updated:** [February 4, 2021, 11:26pm UTC](https://discuss.elastic.co/t/date-format-error-from-logstash/263299 "2021-02-04T23:26:33Z")
Hello, I'm getting a date format error from logstash but the format seems to match the posted date object. Can some one see specifically what it is complaining about? Logstash error: {"error":{"root\_cause":\[{"type":"m… --- ## [Dropdown in Kibana](https://discuss.elastic.co/t/dropdown-in-kibana/263217)
**Author:** [@ITchandj](https://discuss.elastic.co/u/ITchandj)\ **Replies:** 2\ **Last updated:** [February 4, 2021, 11:13pm UTC](https://discuss.elastic.co/t/dropdown-in-kibana/263217 "2021-02-04T23:13:00Z")
How to make a drop-down in Kibana. In reality i want to get realised a drop-down list with the information as in the following photo. Thank you all --- ## [Filebeat IIS module - only good for the first part of a second](https://discuss.elastic.co/t/filebeat-iis-module-only-good-for-the-first-part-of-a-second/263311)
**Author:** [@Gary\_Griffith](https://discuss.elastic.co/u/Gary_Griffith)\ **Replies:** 0\ **Last updated:** [February 4, 2021, 11:06pm UTC](https://discuss.elastic.co/t/filebeat-iis-module-only-good-for-the-first-part-of-a-second/263311 "2021-02-04T23:06:05Z")
So, we installed filebeat v7.10.1 and enables the IIS System module in a pretty standard way. Under heavy load, we get a batch of IIS access logs nicely parsed into the IIS fields: method, user\_agents, geolocation, etc.… --- ## [Can ES host a form that posts to an API?](https://discuss.elastic.co/t/can-es-host-a-form-that-posts-to-an-api/263070)
**Author:** [@irwazr](https://discuss.elastic.co/u/irwazr)\ **Replies:** 2\ **Last updated:** [February 4, 2021, 10:58pm UTC](https://discuss.elastic.co/t/can-es-host-a-form-that-posts-to-an-api/263070 "2021-02-04T22:58:14Z")
We want to be able to create a form in ES/Kibana that allows users to select an option from a dropdown list, and then click a button to make a POST to an API. Is this possible in ES or Kibana? If so, how? Thanks heaps… --- ## [Filebeat's Data not showing in Kibana Dashboard](https://discuss.elastic.co/t/filebeats-data-not-showing-in-kibana-dashboard/263115)
**Author:** [@huzaifa224](https://discuss.elastic.co/u/huzaifa224)\ **Replies:** 3\ **Last updated:** [February 4, 2021, 10:47pm UTC](https://discuss.elastic.co/t/filebeats-data-not-showing-in-kibana-dashboard/263115 "2021-02-04T22:47:54Z")
I have install ELK on ubuntu18.04 for monitoring remote server logs. On remote server i have installed Filebeat to send data to logstash. Remote server's logs are showing in Kibana--\>observability--\>logs. But in dashboad… --- ## [Elasticsearch rollup question](https://discuss.elastic.co/t/elasticsearch-rollup-question/263095)
**Author:** [@jamesp220291](https://discuss.elastic.co/u/jamesp220291)\ **Replies:** 1\ **Last updated:** [February 4, 2021, 10:46pm UTC](https://discuss.elastic.co/t/elasticsearch-rollup-question/263095 "2021-02-04T22:46:08Z")
hI I Just have a question re the rollup feature. if i have a index, attached to a ILM which deletes the index after 30 days. if i roll this up daily, does the rollup job also delete the index once it has completed, or… --- ## [Simple Query String Search - Wildcard (\*) inside a phrase (" ")](https://discuss.elastic.co/t/simple-query-string-search-wildcard-inside-a-phrase/263190)
**Author:** [@russellmenezes](https://discuss.elastic.co/u/russellmenezes)\ **Replies:** 1\ **Last updated:** [February 4, 2021, 10:40pm UTC](https://discuss.elastic.co/t/simple-query-string-search-wildcard-inside-a-phrase/263190 "2021-02-04T22:40:36Z")
Hi every one, I've been looking all over the web on how to preform a wildcard query inside a phrase search. I have used the English Analyzer to index a text field. I have also modified the analyzer with a custom mappi… --- ## [Filtrar a diretiva request nos logs do NAXSI](https://discuss.elastic.co/t/filtrar-a-diretiva-request-nos-logs-do-naxsi/263302)
**Author:** [@Saulo\_Neiva](https://discuss.elastic.co/u/Saulo_Neiva)\ **Replies:** 2\ **Last updated:** [February 4, 2021, 10:36pm UTC](https://discuss.elastic.co/t/filtrar-a-diretiva-request-nos-logs-do-naxsi/263302 "2021-02-04T22:36:56Z")
Olá Pessoal Estou com um problema a meses e gostaria de uma ajuda de vocês.... Estou usando os logs do NAXSI e não estou conseguinto filtrar no logstash alguns parametros. 2021/02/03 21:53:08 \[error\] 4464#4464: \*13928… --- ## [Create Field for Control Visualization](https://discuss.elastic.co/t/create-field-for-control-visualization/261025)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 2\ **Last updated:** [February 4, 2021, 10:10pm UTC](https://discuss.elastic.co/t/create-field-for-control-visualization/261025 "2021-02-04T22:10:55Z")
I am looking at creating a friendly ID for use in the Controls Visualization to aid in filtering dashboard results. For some reason, I can't seem to create a field which is available in the Field selector of that visual… --- ## [High CPU and Harvester Errors with 20000 log files](https://discuss.elastic.co/t/high-cpu-and-harvester-errors-with-20000-log-files/263290)
**Author:** [@jbudin](https://discuss.elastic.co/u/jbudin)\ **Replies:** 2\ **Last updated:** [February 4, 2021, 10:06pm UTC](https://discuss.elastic.co/t/high-cpu-and-harvester-errors-with-20000-log-files/263290 "2021-02-04T22:06:16Z")
Hi Elastic Community, We have a bottleneck on CPU using filebeat. The service takes anywhere from 10-80% of CPU at all times. After excluding certain paths, the CPU no longer spikes. In each of the path subdirectories … --- ## [Kibana plugin standalone build](https://discuss.elastic.co/t/kibana-plugin-standalone-build/263282)
**Author:** [@zixon89](https://discuss.elastic.co/u/zixon89)\ **Replies:** 2\ **Last updated:** [February 4, 2021, 8:56pm UTC](https://discuss.elastic.co/t/kibana-plugin-standalone-build/263282 "2021-02-04T20:56:52Z")
Hi there, I'm still fresh with Kibana plugin development, so currently I'm doing building by using this (Getting started | Kibana Guide \[7.10\] | Elastic) guide: Clone Kibana repo Set my plugin inside kibana's plugin f… --- ## [Почему не работает dfs\_query\_then\_fetch?](https://discuss.elastic.co/t/dfs-query-then-fetch/262474)
**Author:** [@GreenX](https://discuss.elastic.co/u/GreenX)\ **Replies:** 23\ **Last updated:** [February 4, 2021, 8:42pm UTC](https://discuss.elastic.co/t/dfs-query-then-fetch/262474 "2021-02-04T20:42:05Z")
Давным-давно, была проблема: выполняя один и тот же запрос мы получали разный список документов. Оказалось из-за близости \_score два документна меняли местами в зависимости от того на какой шард уйдет запрос. Тогда я из… --- ## [Metricbeat showing values as 1000% in dashboard](https://discuss.elastic.co/t/metricbeat-showing-values-as-1000-in-dashboard/263216)
**Author:** [@vinod\_kumar](https://discuss.elastic.co/u/vinod_kumar)\ **Replies:** 1\ **Last updated:** [February 4, 2021, 7:00pm UTC](https://discuss.elastic.co/t/metricbeat-showing-values-as-1000-in-dashboard/263216 "2021-02-04T19:00:07Z")
I have configured Metricbeat but showing values as 1000% instead of 100%. How this can be resolved --- ## [Add Date and Time on TSVB Graph](https://discuss.elastic.co/t/add-date-and-time-on-tsvb-graph/263239)
**Author:** [@pavansh](https://discuss.elastic.co/u/pavansh)\ **Replies:** 1\ **Last updated:** [February 4, 2021, 7:00pm UTC](https://discuss.elastic.co/t/add-date-and-time-on-tsvb-graph/263239 "2021-02-04T19:00:04Z")
Check this Screenshot, Is there any way to add Date and Time on TSVB Graph? --- ## [Error 404 on \[server\]/\_search (works fine on my other instance!)](https://discuss.elastic.co/t/error-404-on-server-search-works-fine-on-my-other-instance/263288)
**Author:** [@thiago.preihs](https://discuss.elastic.co/u/thiago.preihs)\ **Replies:** 0\ **Last updated:** [February 4, 2021, 6:51pm UTC](https://discuss.elastic.co/t/error-404-on-server-search-works-fine-on-my-other-instance/263288 "2021-02-04T18:51:57Z")
Hello guys! I am scratching my head to understand why the same very simple query works fine on one instance (v. 7.6.0) but does not work on my other instance (v. 7.9.3) - I get 404. curl --location --request GET 'https… --- ## [Values near to 0 are not visible in histogram](https://discuss.elastic.co/t/values-near-to-0-are-not-visible-in-histogram/263229)
**Author:** [@Voula\_Mikr](https://discuss.elastic.co/u/Voula_Mikr)\ **Replies:** 1\ **Last updated:** [February 4, 2021, 6:30pm UTC](https://discuss.elastic.co/t/values-near-to-0-are-not-visible-in-histogram/263229 "2021-02-04T18:30:23Z")
Hi, In an histogram visualization, when the values of the field of the Metrics are near to 0, you can hardly see them. Is there any way to zoom also in x-axis except of the zoom in y-axis you can now do? Or other way to… --- ## [Next.js with search-ui - browser history bug](https://discuss.elastic.co/t/next-js-with-search-ui-browser-history-bug/263197)
**Author:** [@jason-den](https://discuss.elastic.co/u/jason-den)\ **Replies:** 1\ **Last updated:** [February 4, 2021, 6:25pm UTC](https://discuss.elastic.co/t/next-js-with-search-ui-browser-history-bug/263197 "2021-02-04T18:25:38Z")
Hi all. I'm using search-ui with my Next.js project. But I found that when I navigate away from the search page to another page using the Client-side navigations , I cannot go back by using the browser "back" button (I… --- ## [Signed Search Keys and click analytics](https://discuss.elastic.co/t/signed-search-keys-and-click-analytics/263118)
**Author:** [@kubami](https://discuss.elastic.co/u/kubami)\ **Replies:** 3\ **Last updated:** [February 4, 2021, 6:21pm UTC](https://discuss.elastic.co/t/signed-search-keys-and-click-analytics/263118 "2021-02-04T18:21:02Z")
Hi, I am using Signed Search Keys for a web client, the result retrieval works fine. I would like to still use the click analytics, however right now the click endpoint return 401 Unauthorized when authenticating with … --- ## [Parsing Windows DHCP Logs with Filebeat Microsoft Module](https://discuss.elastic.co/t/parsing-windows-dhcp-logs-with-filebeat-microsoft-module/260849)
**Author:** [@MakoWish](https://discuss.elastic.co/u/MakoWish)\ **Replies:** 3\ **Last updated:** [February 4, 2021, 5:17pm UTC](https://discuss.elastic.co/t/parsing-windows-dhcp-logs-with-filebeat-microsoft-module/260849 "2021-02-04T17:17:22Z")
I somehow lost track of the previous thread regarding this issue, and it ended up closing due to inactivity. I am still seeing this same problem now on 7.10.1. Related thread: Has this been looked into any more? --- ## [Unable to add cross-cluster index pattern](https://discuss.elastic.co/t/unable-to-add-cross-cluster-index-pattern/263014)
**Author:** [@jim1](https://discuss.elastic.co/u/jim1)\ **Replies:** 2\ **Last updated:** [February 4, 2021, 5:16pm UTC](https://discuss.elastic.co/t/unable-to-add-cross-cluster-index-pattern/263014 "2021-02-04T17:16:17Z")
Hello, I set up two Elasticsearch clusters (cluster\_a, cluster\_b) and I was able to set cluster\_a as a remote cluster on cluster\_b and vice versa. Using the dev CLI feature, I am also able to query indexes of cluster\_a… [Previous page](https://discuss.elastic.co/latest.md?page=1854) [Next page](https://discuss.elastic.co/latest.md?page=1856)