# Latest **URL:** https://discuss.elastic.co/latest.md?page=1939 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1940 --- ## [Error registering Kibana Privileges with Elasticsearch for kibana-.kibana: \[exception\] Trying to create too many scroll contexts](https://discuss.elastic.co/t/error-registering-kibana-privileges-with-elasticsearch-for-kibana-kibana-exception-trying-to-create-too-many-scroll-contexts/257117)
**Author:** [@libbkmz](https://discuss.elastic.co/u/libbkmz)\ **Replies:** 4\ **Last updated:** [December 15, 2020, 8:31am UTC](https://discuss.elastic.co/t/error-registering-kibana-privileges-with-elasticsearch-for-kibana-kibana-exception-trying-to-create-too-many-scroll-contexts/257117 "2020-12-15T08:31:32Z")
Hello, I'm running many clusters of ElasticSearch with Kibana, we have version 7.6.2, this is version info: { "name" : "CLUSTER\_NAME...", "cluster\_name" : "CLUSTER\_NAME", "cluster\_uuid" : "4zR...", "version" : … --- ## [Tophits on transform group by a field not all field](https://discuss.elastic.co/t/tophits-on-transform-group-by-a-field-not-all-field/258373)
**Author:** [@charles97](https://discuss.elastic.co/u/charles97)\ **Replies:** 15\ **Last updated:** [December 15, 2020, 7:59am UTC](https://discuss.elastic.co/t/tophits-on-transform-group-by-a-field-not-all-field/258373 "2020-12-15T07:59:00Z")
So I have this case where I need to use top hits on transformation I want to show data based on I have this data email col2 col3 col4 col5 Time a.com a a a a 11:00 a.com a … --- ## [Snapshots - guarantee of correctness?](https://discuss.elastic.co/t/snapshots-guarantee-of-correctness/258025)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 5\ **Last updated:** [December 15, 2020, 7:35am UTC](https://discuss.elastic.co/t/snapshots-guarantee-of-correctness/258025 "2020-12-15T07:35:35Z")
Are the snapshots made by elasticsearch surely not to have any errors? Is there any additional option to quickly check the correctness of generated snapshots? --- ## [Save a "discover" configuration](https://discuss.elastic.co/t/save-a-discover-configuration/258513)
**Author:** [@Francisco\_Navarro](https://discuss.elastic.co/u/Francisco_Navarro)\ **Replies:** 4\ **Last updated:** [December 15, 2020, 7:28am UTC](https://discuss.elastic.co/t/save-a-discover-configuration/258513 "2020-12-15T07:28:14Z")
Hello there! When I use Kibana discover with an index it generates something like this by default: It is not useful for me to visualize this in that way. So I configure the shown fields to have this: I would like … --- ## [Logstash only reads files at startup](https://discuss.elastic.co/t/logstash-only-reads-files-at-startup/258224)
**Author:** [@BoKu](https://discuss.elastic.co/u/BoKu)\ **Replies:** 10\ **Last updated:** [December 15, 2020, 7:22am UTC](https://discuss.elastic.co/t/logstash-only-reads-files-at-startup/258224 "2020-12-15T07:22:54Z")
Hello there, if got a problem with logstash reading files. In generall my input, filter and output is working. The files are generated and copied to the correct path, every hour but logstash doesn't read them, only on (… --- ## [Need some explanation on Watcher execution](https://discuss.elastic.co/t/need-some-explanation-on-watcher-execution/258399)
**Author:** [@prajwalgmpp](https://discuss.elastic.co/u/prajwalgmpp)\ **Replies:** 3\ **Last updated:** [December 15, 2020, 7:11am UTC](https://discuss.elastic.co/t/need-some-explanation-on-watcher-execution/258399 "2020-12-15T07:11:39Z")
Under watch execution, it is noted that "On each node, that contains one of the .watches shards, a scheduler, that is bound to the watcher lifecycle runs. On each node, that contains one of the .watches shards, a sched… --- ## [Null values while indexing using logstash](https://discuss.elastic.co/t/null-values-while-indexing-using-logstash/258677)
**Author:** [@Sammeta\_David\_Raju](https://discuss.elastic.co/u/Sammeta_David_Raju)\ **Replies:** 0\ **Last updated:** [December 15, 2020, 7:05am UTC](https://discuss.elastic.co/t/null-values-while-indexing-using-logstash/258677 "2020-12-15T07:05:12Z")
what happens if sql statement has record while indexing and later it changes to null value while using the same select query in logstash in a regular intervals --- ## [ConnectionClosedException: Connection is closed exception in secure elastic search](https://discuss.elastic.co/t/connectionclosedexception-connection-is-closed-exception-in-secure-elastic-search/258540)
**Author:** [@atulthakre](https://discuss.elastic.co/u/atulthakre)\ **Replies:** 8\ **Last updated:** [December 15, 2020, 6:55am UTC](https://discuss.elastic.co/t/connectionclosedexception-connection-is-closed-exception-in-secure-elastic-search/258540 "2020-12-15T06:55:45Z")
java-version: 1.8 elastic-version: 7.10 Ubuntu: 18.04LTS we created separate Machine for Elastic search 7.10.0 in Ubuntu.In the same machine ,we installed java1.8 and also install Kibana .we setup the security in el… --- ## [Error creating connection to Oracle](https://discuss.elastic.co/t/error-creating-connection-to-oracle/257980)
**Author:** [@jenssc](https://discuss.elastic.co/u/jenssc)\ **Replies:** 24\ **Last updated:** [December 15, 2020, 6:24am UTC](https://discuss.elastic.co/t/error-creating-connection-to-oracle/257980 "2020-12-15T06:24:06Z")
Hi I'm having a lot of problems getting the metricbeat connect to my Oracle database! What ever I'm trying to put in my YML-file I always end up with this error: Error fetching data for metricset oracle.tablespace: er… --- ## [Pie chart of element count of an array](https://discuss.elastic.co/t/pie-chart-of-element-count-of-an-array/258612)
**Author:** [@NiclasK](https://discuss.elastic.co/u/NiclasK)\ **Replies:** 1\ **Last updated:** [December 15, 2020, 6:14am UTC](https://discuss.elastic.co/t/pie-chart-of-element-count-of-an-array/258612 "2020-12-15T06:14:21Z")
Hi, I'm indexing a documents that can look like this: { "ProcessID": "id1", "ErrorList": \[{ "ErrorCode": 123, "Time": "2020-01-01T12:23:45" }, { "ErrorCode": 123, "Time": "2020-01-01T12:44:00" }, … --- ## [Searchable snapshots hidden in the UI?](https://discuss.elastic.co/t/searchable-snapshots-hidden-in-the-ui/258674)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 2\ **Last updated:** [December 15, 2020, 5:50am UTC](https://discuss.elastic.co/t/searchable-snapshots-hidden-in-the-ui/258674 "2020-12-15T05:50:58Z")
Is the searchable snapshots feature available in Kibana / UI? I don't have a "searchable snapshot" action in Kibana 7.10.1 on Elastic cloud..? --- ## ["\\"\\\\xF8\\" from ASCII-8BIT to UTF-8", :error\_class=\>"LogStash::Json::GeneratorError"](https://discuss.elastic.co/t/xf8-from-ascii-8bit-to-utf-8-error-class-logstash-generatorerror/258668)
**Author:** [@charan\_teja\_sana](https://discuss.elastic.co/u/charan_teja_sana)\ **Replies:** 0\ **Last updated:** [December 15, 2020, 3:54am UTC](https://discuss.elastic.co/t/xf8-from-ascii-8bit-to-utf-8-error-class-logstash-generatorerror/258668 "2020-12-15T03:54:08Z")
Hello Team, I am getting below message while running JDBC Connection against MS-SQL DB, Could you please help Error Message: \[ERROR\] 2020-12-14 23:55:12.404 \[\[main\]\>worker0\] elasticsearch - An unknown error occurred s… --- ## [Logstash comma delimited csv file with quoted strings](https://discuss.elastic.co/t/logstash-comma-delimited-csv-file-with-quoted-strings/258671)
**Author:** [@nameisnotimportant](https://discuss.elastic.co/u/nameisnotimportant)\ **Replies:** 0\ **Last updated:** [December 15, 2020, 5:13am UTC](https://discuss.elastic.co/t/logstash-comma-delimited-csv-file-with-quoted-strings/258671 "2020-12-15T05:13:05Z")
Hi, I have following comma delimited csv file, which content has a comma in some of the columns. LogTime,Level,ApplicationId,UserId,ProcessId,FormId,Action,Status,Reference,TranRef,IP,SessionId,CIF\_REF\_NO,UserAgent 11… --- ## [Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. org.jruby.exceptions.ArgumentError: (ArgumentError) key cannot be blank](https://discuss.elastic.co/t/exception-in-pipelineworker-the-pipeline-stopped-processing-new-events-please-check-your-filter-configuration-and-restart-logstash-org-jruby-exceptions-argumenterror-argumenterror-key-cannot-be-blank/258670)
**Author:** [@bhavanikallam](https://discuss.elastic.co/u/bhavanikallam)\ **Replies:** 2\ **Last updated:** [December 15, 2020, 4:42am UTC](https://discuss.elastic.co/t/exception-in-pipelineworker-the-pipeline-stopped-processing-new-events-please-check-your-filter-configuration-and-restart-logstash-org-jruby-exceptions-argumenterror-argumenterror-key-cannot-be-blank/258670 "2020-12-15T04:42:17Z")
Plz kindly help --- ## [Searching local files/folders to test elastic search](https://discuss.elastic.co/t/searching-local-files-folders-to-test-elastic-search/258531)
**Author:** [@robo20](https://discuss.elastic.co/u/robo20)\ **Replies:** 4\ **Last updated:** [December 15, 2020, 4:36am UTC](https://discuss.elastic.co/t/searching-local-files-folders-to-test-elastic-search/258531 "2020-12-15T04:36:55Z")
Is there a simple way to do full text search on a bunch of files in various formats (e.g. PDF, EPUB, TXT, DOC) - on locally connected storage? I see the connectors for the cloud services, I just want to do local search. … --- ## [Elastitcsearch 7 : mapping types](https://discuss.elastic.co/t/elastitcsearch-7-mapping-types/258584)
**Author:** [@nages](https://discuss.elastic.co/u/nages)\ **Replies:** 3\ **Last updated:** [December 15, 2020, 3:55am UTC](https://discuss.elastic.co/t/elastitcsearch-7-mapping-types/258584 "2020-12-15T03:55:16Z")
I come across the following phrase and I am under impression that a valid 6.x query with type might give an error. I am using the cluster ES 7.10 Note that in 7.0, \_doc is a permanent part of the path, and represents t… --- ## [Getting unique results on highlight or multiple fields](https://discuss.elastic.co/t/getting-unique-results-on-highlight-or-multiple-fields/258650)
**Author:** [@sec\_r\_and\_d](https://discuss.elastic.co/u/sec_r_and_d)\ **Replies:** 2\ **Last updated:** [December 15, 2020, 3:41am UTC](https://discuss.elastic.co/t/getting-unique-results-on-highlight-or-multiple-fields/258650 "2020-12-15T03:41:53Z")
My indices contain various analyses of executable files. DELETE static\_index,strings\_index PUT static\_index/\_doc/1 { "md5": "85e9e2c4a9c0a7af309c906516aa4548", "static\_api": "ShellExecuteW" } PUT static\_index/\_doc/2… --- ## [How to calculate shard\_size](https://discuss.elastic.co/t/how-to-calculate-shard-size/258664)
**Author:** [@mohammad\_hanifah\_nur](https://discuss.elastic.co/u/mohammad_hanifah_nur)\ **Replies:** 4\ **Last updated:** [December 15, 2020, 2:41am UTC](https://discuss.elastic.co/t/how-to-calculate-shard-size/258664 "2020-12-15T02:41:20Z")
this issue came when i trying to find a top ten summary amount with aggregation by term variable A. variable A have a lot of unique data . that makes the result of the top ten summary amount is invalid. the first thing… --- ## [No need to set \`xpack.monitoring.collection.enabled\` to true when using metricbeat-based stack monitoring?](https://discuss.elastic.co/t/no-need-to-set-xpack-monitoring-collection-enabled-to-true-when-using-metricbeat-based-stack-monitoring/258237)
**Author:** [@tetsuyasodo](https://discuss.elastic.co/u/tetsuyasodo)\ **Replies:** 4\ **Last updated:** [December 15, 2020, 2:35am UTC](https://discuss.elastic.co/t/no-need-to-set-xpack-monitoring-collection-enabled-to-true-when-using-metricbeat-based-stack-monitoring/258237 "2020-12-15T02:35:26Z")
Reading this document, I'm testing stack monitoring using metricbeat not Legacy collection method. In this stack monitoring document, it says: 1.Enable the collection of monitoring data. Set xpack.monitoring.collec… --- ## [How to specify Default Quote Analyzer](https://discuss.elastic.co/t/how-to-specify-default-quote-analyzer/258659)
**Author:** [@jacksumit](https://discuss.elastic.co/u/jacksumit)\ **Replies:** 2\ **Last updated:** [December 15, 2020, 2:27am UTC](https://discuss.elastic.co/t/how-to-specify-default-quote-analyzer/258659 "2020-12-15T02:27:30Z")
Is there a way to specify default quote analyzer on index level? We can specify default index analyzer using analysis.analyzer.default. Similarly we can specify default search analyzer using analysis.analyzer.default\_se… --- ## [Best option to parse some data GROK or reindex?](https://discuss.elastic.co/t/best-option-to-parse-some-data-grok-or-reindex/258663)
**Author:** [@fastxl](https://discuss.elastic.co/u/fastxl)\ **Replies:** 0\ **Last updated:** [December 15, 2020, 2:08am UTC](https://discuss.elastic.co/t/best-option-to-parse-some-data-grok-or-reindex/258663 "2020-12-15T02:08:30Z")
I am collecting machine tool data and the logs I am getting are in the JSON format that can be sent to logstash. However I need to break down one of the JSON lines into some more documents. Should I try to run this throu… --- ## [How to search for errors in logs of Elasticsearch (Cloud instance)](https://discuss.elastic.co/t/how-to-search-for-errors-in-logs-of-elasticsearch-cloud-instance/258656)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 0\ **Last updated:** [December 15, 2020, 1:00am UTC](https://discuss.elastic.co/t/how-to-search-for-errors-in-logs-of-elasticsearch-cloud-instance/258656 "2020-12-15T01:00:27Z")
Hi, I have a cloud instance of Elasticsearch and I was intrested to see the error logs for the events which got rejected. In an in house instance the logs are availiable at the location I specify in Elasticsearch.yml, … --- ## [Diff documents](https://discuss.elastic.co/t/diff-documents/258565)
**Author:** [@pskhanapur](https://discuss.elastic.co/u/pskhanapur)\ **Replies:** 1\ **Last updated:** [December 15, 2020, 12:36am UTC](https://discuss.elastic.co/t/diff-documents/258565 "2020-12-15T00:36:19Z")
Is there a way to show diff between two documents in Kibana? Ref. example attached screenshot. Any visualizations or any plugg-in that can do that sort of the diff? Json in the screenshot is just an example, basically … --- ## [How can I delete all indices that don't have documents?](https://discuss.elastic.co/t/how-can-i-delete-all-indices-that-dont-have-documents/258571)
**Author:** [@mahalabobis](https://discuss.elastic.co/u/mahalabobis)\ **Replies:** 1\ **Last updated:** [December 15, 2020, 12:35am UTC](https://discuss.elastic.co/t/how-can-i-delete-all-indices-that-dont-have-documents/258571 "2020-12-15T00:35:09Z")
How can I delete all Elasticsearch that have no documents within? Also, is this safe ? I mean if an index has no documents then it's practically useless right? --- ## [Index pattern's Time Filter on multiple fields](https://discuss.elastic.co/t/index-patterns-time-filter-on-multiple-fields/258644)
**Author:** [@Qazeer](https://discuss.elastic.co/u/Qazeer)\ **Replies:** 1\ **Last updated:** [December 15, 2020, 12:29am UTC](https://discuss.elastic.co/t/index-patterns-time-filter-on-multiple-fields/258644 "2020-12-15T00:29:02Z")
Hello! I have an use case where events have multiple timestamps. Would it be possible to create an index pattern with a Time Filter on those multiple timestamp fields? I would prefer to it through Kibana rather than t… --- ## [Query Data in ELK](https://discuss.elastic.co/t/query-data-in-elk/258628)
**Author:** [@hassan.rana](https://discuss.elastic.co/u/hassan.rana)\ **Replies:** 4\ **Last updated:** [December 14, 2020, 11:56pm UTC](https://discuss.elastic.co/t/query-data-in-elk/258628 "2020-12-14T23:56:05Z")
I need to query messages that are sent from syslog server to logstash via filebeat . I need to curl some data out of the filebeat index. How can I write that query to get the field that what I need? Anyone? Thank you. --- ## [What security roles or rights does functionbeat require for the username in the output.elasticsearch?](https://discuss.elastic.co/t/what-security-roles-or-rights-does-functionbeat-require-for-the-username-in-the-output-elasticsearch/258646)
**Author:** [@Jonathan\_Detert](https://discuss.elastic.co/u/Jonathan_Detert)\ **Replies:** 0\ **Last updated:** [December 14, 2020, 8:52pm UTC](https://discuss.elastic.co/t/what-security-roles-or-rights-does-functionbeat-require-for-the-username-in-the-output-elasticsearch/258646 "2020-12-14T20:52:35Z")
I want to create an elasticsearch user for function beat to use in the output.elasticsearch section. The documentation doesn't say anything about what rights or roles within elasticsearch the user will need. Can someon… --- ## [Logstash - SNS output plugin - Pipeline - MissingCredentialsError](https://discuss.elastic.co/t/logstash-sns-output-plugin-pipeline-missingcredentialserror/258649)
**Author:** [@chandra2037](https://discuss.elastic.co/u/chandra2037)\ **Replies:** 0\ **Last updated:** [December 14, 2020, 9:41pm UTC](https://discuss.elastic.co/t/logstash-sns-output-plugin-pipeline-missingcredentialserror/258649 "2020-12-14T21:41:09Z")
Currently configured Logstash V 7.8.1 with SNS output plugin . It is running okay for a while then getting the following error message, then pipeline stops and never recovers. {"level":"ERROR","loggerName":"logstash.… --- ## [No enrollment token for Fleet Agent](https://discuss.elastic.co/t/no-enrollment-token-for-fleet-agent/258453)
**Author:** [@AirJordan](https://discuss.elastic.co/u/AirJordan)\ **Replies:** 2\ **Last updated:** [December 14, 2020, 9:16pm UTC](https://discuss.elastic.co/t/no-enrollment-token-for-fleet-agent/258453 "2020-12-14T21:16:31Z")
I went to do the wizard for creating a fleet agent user and let it setup everything. When I clicked create user all of a sudden it timed out my web session. I went back in and the user for fleet enrollment is there. The … --- ## [ES 8.0.0 Deletion with index lifecycle policy does nothing](https://discuss.elastic.co/t/es-8-0-0-deletion-with-index-lifecycle-policy-does-nothing/258346)
**Author:** [@nlavrov](https://discuss.elastic.co/u/nlavrov)\ **Replies:** 5\ **Last updated:** [December 14, 2020, 9:12pm UTC](https://discuss.elastic.co/t/es-8-0-0-deletion-with-index-lifecycle-policy-does-nothing/258346 "2020-12-14T21:12:26Z")
I am running an elk stack set up with helm chart running 8.0.0 version. I have a simple delete policy I created in the kibana dashboard that just deletes indices older than 1 minute (this is for testing). I then applied … [Previous page](https://discuss.elastic.co/latest.md?page=1938) [Next page](https://discuss.elastic.co/latest.md?page=1940)