# Latest **URL:** https://discuss.elastic.co/latest.md?page=974 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 975 --- ## [Kibana report generate using docker based configuration](https://discuss.elastic.co/t/kibana-report-generate-using-docker-based-configuration/313996)
**Author:** [@maadhav](https://discuss.elastic.co/u/maadhav)\ **Replies:** 0\ **Last updated:** [September 8, 2022, 1:03pm UTC](https://discuss.elastic.co/t/kibana-report-generate-using-docker-based-configuration/313996 "2022-09-08T13:03:14Z")
Hi Team We have Docker based multi-node ES cluster v7.17.4. Kibana also runs as a docker container. When we try to generate a PDF report from Canvas, it shows following error: Error: Max attempts (3) reached for job l… --- ## [How to get the value in aggregations in watcher](https://discuss.elastic.co/t/how-to-get-the-value-in-aggregations-in-watcher/313526)
**Author:** [@upreddy](https://discuss.elastic.co/u/upreddy)\ **Replies:** 1\ **Last updated:** [September 8, 2022, 1:04pm UTC](https://discuss.elastic.co/t/how-to-get-the-value-in-aggregations-in-watcher/313526 "2022-09-08T13:04:31Z")
Hi, we are trying to create a new watcher for getting total value in perticular field for that which value is select in aggregations. "aggs": { "abc": { "filter": { "term": { "field": "abc" in abc place we need di… --- ## [Logstash delay](https://discuss.elastic.co/t/logstash-delay/313991)
**Author:** [@tom.verbeek](https://discuss.elastic.co/u/tom.verbeek)\ **Replies:** 2\ **Last updated:** [September 8, 2022, 1:03pm UTC](https://discuss.elastic.co/t/logstash-delay/313991 "2022-09-08T13:03:31Z")
Hi, I have a problem with logs being ingested into elastic with a delay. This delay does not start from the beginning but it builds up. Right now the delay is 1 day and 10 hours. We checked the Source device sending th… --- ## [I am looking to add some custom data to the date sent using Elastic Agents](https://discuss.elastic.co/t/i-am-looking-to-add-some-custom-data-to-the-date-sent-using-elastic-agents/313995)
**Author:** [@Garry](https://discuss.elastic.co/u/Garry)\ **Replies:** 0\ **Last updated:** [September 8, 2022, 12:59pm UTC](https://discuss.elastic.co/t/i-am-looking-to-add-some-custom-data-to-the-date-sent-using-elastic-agents/313995 "2022-09-08T12:59:36Z")
Hi, I am am looking to add some custom data through the integrations used by elastic agents. For example, when I manually use metricbeat I can send through static custom fields using processors: add\_host\_metadata: ~ a… --- ## [Please upgrade your browser This Kibana installation has strict security requirements enabled that your current browser does not meet](https://discuss.elastic.co/t/please-upgrade-your-browser-this-kibana-installation-has-strict-security-requirements-enabled-that-your-current-browser-does-not-meet/313989)
**Author:** [@bandodkarD](https://discuss.elastic.co/u/bandodkarD)\ **Replies:** 1\ **Last updated:** [September 8, 2022, 12:36pm UTC](https://discuss.elastic.co/t/please-upgrade-your-browser-this-kibana-installation-has-strict-security-requirements-enabled-that-your-current-browser-does-not-meet/313989 "2022-09-08T12:36:36Z")
We are building a POC to deploy Kibana iframe using a react app. We have an existing react app and have embedded the iframe into it. Elastic cloud version 8.3.3 is used. The iframe successfully loads but we do not want… --- ## [Is it possible to join field via conditions?](https://discuss.elastic.co/t/is-it-possible-to-join-field-via-conditions/313952)
**Author:** [@Stanislau\_Karaliou](https://discuss.elastic.co/u/Stanislau_Karaliou)\ **Replies:** 4\ **Last updated:** [September 8, 2022, 12:26pm UTC](https://discuss.elastic.co/t/is-it-possible-to-join-field-via-conditions/313952 "2022-09-08T12:26:59Z")
I have structure { id: 1 name: "Root folder" parent\_id: 0, inherit\_folder\_id: null, inherit\_permission: false, permissions: \[some permissions\] }, { id: 2 name: "Accounts" parent\_id: 1, inherit\_folder… --- ## [\[Filebeat : v7.9.3\] Invalid memory address or nil pointer dereference](https://discuss.elastic.co/t/filebeat-v7-9-3-invalid-memory-address-or-nil-pointer-dereference/313958)
**Author:** [@iamyeka](https://discuss.elastic.co/u/iamyeka)\ **Replies:** 3\ **Last updated:** [September 8, 2022, 8:30am UTC](https://discuss.elastic.co/t/filebeat-v7-9-3-invalid-memory-address-or-nil-pointer-dereference/313958 "2022-09-08T08:30:46Z")
Filebeat version: 7.9.3 I met some issue about "invalid memory address or nil pointer dereference" which caused a panic. But i cannot figure out why that happened. Below is the stack of the panic. panic: runtime error:… --- ## [Scroll query with slice](https://discuss.elastic.co/t/scroll-query-with-slice/313331)
**Author:** [@philkpler](https://discuss.elastic.co/u/philkpler)\ **Replies:** 1\ **Last updated:** [September 8, 2022, 12:23pm UTC](https://discuss.elastic.co/t/scroll-query-with-slice/313331 "2022-09-08T12:23:45Z")
Hello, Can someone confirm me that when querying using the scroll api, with slices, it will be targeting the same "state/snapshot" of the index ? As far as I know, to simplify, scroll allow to "freeze" a state of the … --- ## [Map / grant roles defined in keycloak to elasticsearch](https://discuss.elastic.co/t/map-grant-roles-defined-in-keycloak-to-elasticsearch/313528)
**Author:** [@Giorgi\_Jambazishvili](https://discuss.elastic.co/u/Giorgi_Jambazishvili)\ **Replies:** 5\ **Last updated:** [September 8, 2022, 12:06pm UTC](https://discuss.elastic.co/t/map-grant-roles-defined-in-keycloak-to-elasticsearch/313528 "2022-09-08T12:06:07Z")
Hello, We've setup the Keycloak Single Sing On (OIDC) integration with Elasticsearch cloud deployment and users are able sign in to the kibana using Keycloak as an authenticator. The problem is that once user is authen… --- ## [Expose part of a ELK document to another index/user](https://discuss.elastic.co/t/expose-part-of-a-elk-document-to-another-index-user/313028)
**Author:** [@Sylvain35](https://discuss.elastic.co/u/Sylvain35)\ **Replies:** 6\ **Last updated:** [September 8, 2022, 12:05pm UTC](https://discuss.elastic.co/t/expose-part-of-a-elk-document-to-another-index-user/313028 "2022-09-08T12:05:22Z")
Hello everyone ! I have a streaming process that feeds an ELK index (one new index each day) The object send is a JSON with multiple level and fields. I have a complex mapping on this Index. I want to expose a limited… --- ## [Kibana, canvas, Image reveal problem after upgrade to 8.4.1 from 8.3.1](https://discuss.elastic.co/t/kibana-canvas-image-reveal-problem-after-upgrade-to-8-4-1-from-8-3-1/313986)
**Author:** [@Ibrahim\_Z\_HIDIR](https://discuss.elastic.co/u/Ibrahim_Z_HIDIR)\ **Replies:** 0\ **Last updated:** [September 8, 2022, 11:15am UTC](https://discuss.elastic.co/t/kibana-canvas-image-reveal-problem-after-upgrade-to-8-4-1-from-8-3-1/313986 "2022-09-08T11:15:30Z")
Hi I've just upgraded elastic clsuter from 8.3.1 to 8.4.1 and also kibana. After upgrade kibana all the Image reveal images turned exclamation mark, and when I've click on an image I'am getting error "Expression failed … --- ## [Script query started to fail suddenly](https://discuss.elastic.co/t/script-query-started-to-fail-suddenly/313985)
**Author:** [@Richa\_B](https://discuss.elastic.co/u/Richa_B)\ **Replies:** 0\ **Last updated:** [September 8, 2022, 11:06am UTC](https://discuss.elastic.co/t/script-query-started-to-fail-suddenly/313985 "2022-09-08T11:06:31Z")
We have had this query for a long time { "size": 50, "query": { "match\_all": {} }, "version": false, "seq\_no\_primary\_term": false, "sort": \[ { "\_script": { "script": { "sour… --- ## [Cluster elasticsearch port](https://discuss.elastic.co/t/cluster-elasticsearch-port/313866)
**Author:** [@diegz](https://discuss.elastic.co/u/diegz)\ **Replies:** 6\ **Last updated:** [September 8, 2022, 11:00am UTC](https://discuss.elastic.co/t/cluster-elasticsearch-port/313866 "2022-09-08T11:00:57Z")
Hello, I want to set up a 3-node elasticsearch cluster in production. 2 nodes master & data and one voting-only or data. I would like to know if I can assign a single port per node and not a range. For example : node… --- ## [Unable to split the logs using child pipeline](https://discuss.elastic.co/t/unable-to-split-the-logs-using-child-pipeline/313944)
**Author:** [@Abinayaganesan](https://discuss.elastic.co/u/Abinayaganesan)\ **Replies:** 0\ **Last updated:** [September 8, 2022, 5:31am UTC](https://discuss.elastic.co/t/unable-to-split-the-logs-using-child-pipeline/313944 "2022-09-08T05:31:23Z")
Hi I can get all application logs in kibana dashboard. But I want to split the logs using log.file.path and send that respective logs to child pipeline that's why I tried conditions like if (\[log\]\[file\]\[path\] == \["/var… --- ## [How load balancing work between logstash and elasticsearch](https://discuss.elastic.co/t/how-load-balancing-work-between-logstash-and-elasticsearch/313821)
**Author:** [@Khaled\_Saidi](https://discuss.elastic.co/u/Khaled_Saidi)\ **Replies:** 8\ **Last updated:** [September 8, 2022, 10:51am UTC](https://discuss.elastic.co/t/how-load-balancing-work-between-logstash-and-elasticsearch/313821 "2022-09-08T10:51:14Z")
Hi everyone, I have a question about logstash and how it load balances to an elasticsearch servers cluster. The warning "high disk watermark \[90%\] exceeded" is displayed in the logstash log file, and documents are no l… --- ## [ElasticSearch IIS time-taken Field is Missing](https://discuss.elastic.co/t/elasticsearch-iis-time-taken-field-is-missing/313118)
**Author:** [@eagles40cnuh](https://discuss.elastic.co/u/eagles40cnuh)\ **Replies:** 2\ **Last updated:** [September 8, 2022, 10:50am UTC](https://discuss.elastic.co/t/elasticsearch-iis-time-taken-field-is-missing/313118 "2022-09-08T10:50:58Z")
My ELK Version 8.3 (Elasticsearch, Kibana, ElasticAgent, Beats....) ElasticAgent installed my Server Host (Complete) ALL IIS LogField Enabled Data collection was successful But.... Just 1 Field(Time-Taken) do… --- ## [About Voting Only Nodes](https://discuss.elastic.co/t/about-voting-only-nodes/313948)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 9\ **Last updated:** [September 8, 2022, 10:47am UTC](https://discuss.elastic.co/t/about-voting-only-nodes/313948 "2022-09-08T10:47:44Z")
Hi, With voting configurations is it recommended that, when needed, a minimum of nodes are voting-only? Or is it legitimate to make all nodes voting-only? I ask because we have clusters whose topologies vary. For examp… --- ## [LDAP ELK CLuster](https://discuss.elastic.co/t/ldap-elk-cluster/313979)
**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\ **Replies:** 2\ **Last updated:** [September 8, 2022, 10:26am UTC](https://discuss.elastic.co/t/ldap-elk-cluster/313979 "2022-09-08T10:26:32Z")
Hello! My team wants to connect our elastic to the corporate LDAP, we know how to configure it but we don't know on which nodes we have to configure it. Is this configuration only necessary on master nodes or should it… --- ## [Authentication of \[elastic\] was terminated by realm \[reserved\] - failed to authenticate user \[elastic\]](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/313838)
**Author:** [@hiruni.insyncit.net](https://discuss.elastic.co/u/hiruni.insyncit.net)\ **Replies:** 10\ **Last updated:** [September 8, 2022, 10:15am UTC](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/313838 "2022-09-08T10:15:28Z")
I have elastic cluster, one node removed(automatically) from the cluster and log shows "Authentication of \[elastic\] was terminated by realm \[reserved\] - failed to authenticate user \[elastic\]" elastic version 8.1 --- ## [Misconfiguration of filebeat on debian](https://discuss.elastic.co/t/misconfiguration-of-filebeat-on-debian/313864)
**Author:** [@mammodde](https://discuss.elastic.co/u/mammodde)\ **Replies:** 1\ **Last updated:** [September 8, 2022, 9:59am UTC](https://discuss.elastic.co/t/misconfiguration-of-filebeat-on-debian/313864 "2022-09-08T09:59:59Z")
Good morning, I am trying to install filebeat on debian with the deb file. The problem is that i have misconfigured it, so i tried to uninstall it. After the second installation i encountered a problem: it does not down… --- ## [How to use cardinality add more fields](https://discuss.elastic.co/t/how-to-use-cardinality-add-more-fields/313967)
**Author:** [@githup-DK](https://discuss.elastic.co/u/githup-DK)\ **Replies:** 0\ **Last updated:** [September 8, 2022, 8:50am UTC](https://discuss.elastic.co/t/how-to-use-cardinality-add-more-fields/313967 "2022-09-08T08:50:45Z")
Hi bro I can't upgrade my instance. my instance is 7.9.3. I want to use three field to search .I create a table with three cardinality \`fields\` ,but there is no effective,the data looks like repeated GET /testPrefor… --- ## [Elasticsearch index.blocks.read : true doesn't work with index pattern](https://discuss.elastic.co/t/elasticsearch-index-blocks-read-true-doesnt-work-with-index-pattern/313963)
**Author:** [@Ingram\_Gultom](https://discuss.elastic.co/u/Ingram_Gultom)\ **Replies:** 1\ **Last updated:** [September 8, 2022, 9:26am UTC](https://discuss.elastic.co/t/elasticsearch-index-blocks-read-true-doesnt-work-with-index-pattern/313963 "2022-09-08T09:26:59Z")
Hi all, I want to block read on some indices, using index.blocks.read : true, but it doesn't work if you try to read the indices with index pattern like index\_name\_\*. It will return error GET filebeat\*/\_search { "e… --- ## [Is it expected to have different versions in the \`\*\_LuceneXX\_X.\*\` filenames?](https://discuss.elastic.co/t/is-it-expected-to-have-different-versions-in-the-lucenexx-x-filenames/313898)
**Author:** [@vkatsikaros](https://discuss.elastic.co/u/vkatsikaros)\ **Replies:** 2\ **Last updated:** [September 8, 2022, 9:26am UTC](https://discuss.elastic.co/t/is-it-expected-to-have-different-versions-in-the-lucenexx-x-filenames/313898 "2022-09-08T09:26:29Z")
Hi This is mostly out of curiosity and not as a question tied to a specific problem. I was looking at the actual directories and files of some ES indices, I noticed a bunch of lucene files, but what got my attention is… --- ## [Filebeat send ' \\u0000 ' and the event loss and the new line append to the last line](https://discuss.elastic.co/t/filebeat-send-u0000-and-the-event-loss-and-the-new-line-append-to-the-last-line/313972)
**Author:** [@codeyoungth](https://discuss.elastic.co/u/codeyoungth)\ **Replies:** 0\ **Last updated:** [September 8, 2022, 9:03am UTC](https://discuss.elastic.co/t/filebeat-send-u0000-and-the-event-loss-and-the-new-line-append-to-the-last-line/313972 "2022-09-08T09:03:27Z")
my config is as follow: filebeat.inputs: - type: filestream enabled: true id: filebeat-input-log paths: - /app/log/\*/\*.log parsers: - multili… --- ## [How to remove duplicates on 7.9.3Version](https://discuss.elastic.co/t/how-to-remove-duplicates-on-7-9-3version/313964)
**Author:** [@githup-DK](https://discuss.elastic.co/u/githup-DK)\ **Replies:** 0\ **Last updated:** [September 8, 2022, 8:31am UTC](https://discuss.elastic.co/t/how-to-remove-duplicates-on-7-9-3version/313964 "2022-09-08T08:31:54Z")
I want to use multi-field to remove duplicates datas,I gave it a try , but it didn't work . \* I want to know how to use it on 7.9.3Version. please help me . GET /test\_2022\_9/\_search { "query": { "bool": { "f… --- ## [Function beat erroring out with license error when shipping log](https://discuss.elastic.co/t/function-beat-erroring-out-with-license-error-when-shipping-log/313959)
**Author:** [@IbrahimHectare](https://discuss.elastic.co/u/IbrahimHectare)\ **Replies:** 0\ **Last updated:** [September 8, 2022, 8:04am UTC](https://discuss.elastic.co/t/function-beat-erroring-out-with-license-error-when-shipping-log/313959 "2022-09-08T08:04:20Z")
I have set up function beat on AWS, to ship my cloudwatch logs. When the functionbeat is invoked to send the logs, it errors out due to an enterprise license being returned. licenser/elastic\_fetcher.go:136 Invalid resp… --- ## [Stop Token Filter Language Customization Not Working in Java](https://discuss.elastic.co/t/stop-token-filter-language-customization-not-working-in-java/313949)
**Author:** [@green12](https://discuss.elastic.co/u/green12)\ **Replies:** 0\ **Last updated:** [September 8, 2022, 6:34am UTC](https://discuss.elastic.co/t/stop-token-filter-language-customization-not-working-in-java/313949 "2022-09-08T06:34:05Z")
Hi everyone, I'm trying to create a customized Indonesian language stop token filter using the Java package. The following json is how the configuration looks like when using curl (which works just fine): "filter": { … --- ## [Vega tree error key is null](https://discuss.elastic.co/t/vega-tree-error-key-is-null/313946)
**Author:** [@Alice\_Ionescu](https://discuss.elastic.co/u/Alice_Ionescu)\ **Replies:** 0\ **Last updated:** [September 8, 2022, 6:15am UTC](https://discuss.elastic.co/t/vega-tree-error-key-is-null/313946 "2022-09-08T06:15:42Z")
Hello, I am trying to create a vega tree visualization. I am not sure how to complete the starting node. I've tried to put null, -, but nothing works. If the parent of the last node is null I am getting error \_.\_source… --- ## [How do I update data across indexes](https://discuss.elastic.co/t/how-do-i-update-data-across-indexes/313945)
**Author:** [@chihao9332](https://discuss.elastic.co/u/chihao9332)\ **Replies:** 0\ **Last updated:** [September 8, 2022, 6:11am UTC](https://discuss.elastic.co/t/how-do-i-update-data-across-indexes/313945 "2022-09-08T06:11:11Z")
问题描述：索引B中新增加了两个字段，现需要从索引A中获取这两个字段的值并赋值给B 详细情况： 1.索引A中部分字段：pro\_id, tran\_id, app\_id, type ....... 2.索引B中部分字段：app\_id, type ....... 3. 现 索引B中新增 pro\_id和tran\_id字段，要求将存量数据与索引A中数据同步 4. 即：当 满足 A.app\_id=B.app\_id 和 A.type=B.ty… --- ## [What is the best way to change the dims for a dense\_vector in an index?](https://discuss.elastic.co/t/what-is-the-best-way-to-change-the-dims-for-a-dense-vector-in-an-index/313920)
**Author:** [@reisner](https://discuss.elastic.co/u/reisner)\ **Replies:** 1\ **Last updated:** [September 8, 2022, 4:01am UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-change-the-dims-for-a-dense-vector-in-an-index/313920 "2022-09-08T04:01:18Z")
I have an index with a dense\_vector field with 256 dimensions. I want to change to a new embedding model that uses a different number of dimensions. I dont mind losing the data in the old field. What's the best way to ke… [Previous page](https://discuss.elastic.co/latest.md?page=973) [Next page](https://discuss.elastic.co/latest.md?page=975)