# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1017 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1018 --- ## [Turn off sending time range filter when using drilldown](https://discuss.elastic.co/t/turn-off-sending-time-range-filter-when-using-drilldown/298632)
**Author:** [@Rick\_V](https://discuss.elastic.co/u/Rick_V)\ **Replies:** 2\ **Last updated:** [March 11, 2022, 3:58pm UTC](https://discuss.elastic.co/t/turn-off-sending-time-range-filter-when-using-drilldown/298632 "2022-03-11T15:58:27Z")
Hi, I'm using drilldowns in dashboards to give a deeper detail into the visualization. I use several visualizations like line and area graph to give an insight over time like the derivative. However when i click on a do… --- ## [Fleet Server Fails At Start, No Reason Given](https://discuss.elastic.co/t/fleet-server-fails-at-start-no-reason-given/298854)
**Author:** [@CptElasticBand](https://discuss.elastic.co/u/CptElasticBand)\ **Replies:** 1\ **Last updated:** [March 11, 2022, 3:45pm UTC](https://discuss.elastic.co/t/fleet-server-fails-at-start-no-reason-given/298854 "2022-03-11T15:45:55Z")
Hello. I've been looking around to see if anyone else has experienced a similar issue but I haven't found anything. I've setup an Elasticsearch cluster and Kibana all using SSL certificates created following the Elastic … --- ## [Hashicorp's Nomad monitoring using metricbeat](https://discuss.elastic.co/t/hashicorps-nomad-monitoring-using-metricbeat/299162)
**Author:** [@Uzmasaman\_Chanderki](https://discuss.elastic.co/u/Uzmasaman_Chanderki)\ **Replies:** 1\ **Last updated:** [March 11, 2022, 2:43pm UTC](https://discuss.elastic.co/t/hashicorps-nomad-monitoring-using-metricbeat/299162 "2022-03-11T14:43:50Z")
I am new to this community and my resources are exhausted. I am trying to implement monitoring on Hashicorp's Nomad using metricbeat but there is no metricbeat.module available for now. Is there any alternative where t… --- ## [How to get and create users using the Kibana API](https://discuss.elastic.co/t/how-to-get-and-create-users-using-the-kibana-api/299408)
**Author:** [@Amphagory](https://discuss.elastic.co/u/Amphagory)\ **Replies:** 2\ **Last updated:** [March 11, 2022, 2:25pm UTC](https://discuss.elastic.co/t/how-to-get-and-create-users-using-the-kibana-api/299408 "2022-03-11T14:25:20Z")
Hello, I'm using the Elastic cloud service and the version I'm using is 7.16.2 I'm trying to get and create users from the following documentation using Postman and a Python script, GET user: Get users API | Elasti… --- ## [TimeValue error on XContentBuilder](https://discuss.elastic.co/t/timevalue-error-on-xcontentbuilder/299012)
**Author:** [@dancerjohn](https://discuss.elastic.co/u/dancerjohn)\ **Replies:** 7\ **Last updated:** [March 11, 2022, 2:14pm UTC](https://discuss.elastic.co/t/timevalue-error-on-xcontentbuilder/299012 "2022-03-11T14:14:47Z")
Getting IllegalArgumentException ("cannot write xcontent for unknown value of type TimeValue") even though org.Elasticsearch.common.unit.TimeValue is an elastic class and is used in org.Elasticsearch.search.builder.Point… --- ## [Create new file every 60seconds in Logstash CSV output](https://discuss.elastic.co/t/create-new-file-every-60seconds-in-logstash-csv-output/299380)
**Author:** [@gnam](https://discuss.elastic.co/u/gnam)\ **Replies:** 2\ **Last updated:** [March 11, 2022, 2:01pm UTC](https://discuss.elastic.co/t/create-new-file-every-60seconds-in-logstash-csv-output/299380 "2022-03-11T14:01:31Z")
I have following filter configuration in my logstatsh pipeline. What it does is, at the start of the event first filter creates a CSV file with header and sets the file name to metadata. Second filter writes the output … --- ## [Use of ELK to implement AI Algorithm](https://discuss.elastic.co/t/use-of-elk-to-implement-ai-algorithm/299235)
**Author:** [@bechir-jamoussi](https://discuss.elastic.co/u/bechir-jamoussi)\ **Replies:** 2\ **Last updated:** [March 11, 2022, 2:01pm UTC](https://discuss.elastic.co/t/use-of-elk-to-implement-ai-algorithm/299235 "2022-03-11T14:01:14Z")
Dear Community, I want to use only Beats + Logstash (for collecting and processing the data) and Elasticsearch(as a database) and then based on that data, I need to use AI to make a decision, it is not log analysis or a… --- ## [Filebeat Zeek module not reading all events with -once option](https://discuss.elastic.co/t/filebeat-zeek-module-not-reading-all-events-with-once-option/299459)
**Author:** [@dlohin](https://discuss.elastic.co/u/dlohin)\ **Replies:** 2\ **Last updated:** [March 11, 2022, 1:50pm UTC](https://discuss.elastic.co/t/filebeat-zeek-module-not-reading-all-events-with-once-option/299459 "2022-03-11T13:50:15Z")
I am using Filebeat 8.0.1 inside of a container and trying to utilize it to read through a bunch of Zeek logs formatted in JSON and ending the process when finished. Ending nicely with an error code is critical because … --- ## [How to find all the queries terminated by elasticsearch when it reaches requestTimeout](https://discuss.elastic.co/t/how-to-find-all-the-queries-terminated-by-elasticsearch-when-it-reaches-requesttimeout/299145)
**Author:** [@jatin\_gupta](https://discuss.elastic.co/u/jatin_gupta)\ **Replies:** 5\ **Last updated:** [March 11, 2022, 1:31pm UTC](https://discuss.elastic.co/t/how-to-find-all-the-queries-terminated-by-elasticsearch-when-it-reaches-requesttimeout/299145 "2022-03-11T13:31:59Z")
We have specified request\_timeout while creating Elasticsearch client using javascript library. Whenever the timeout is reached our understanding is that the query is terminated by Elasticsearch as it does not appear in … --- ## [Unable to create an enrollment token for Kibana. "Elasticsearch node HTTP layer SSL configuration Keystore doesn't contain any PrivateKey entries where the associated certificate is a CA certificate"](https://discuss.elastic.co/t/unable-to-create-an-enrollment-token-for-kibana-elasticsearch-node-http-layer-ssl-configuration-keystore-doesnt-contain-any-privatekey-entries-where-the-associated-certificate-is-a-ca-certificate/297032)
**Author:** [@maof97](https://discuss.elastic.co/u/maof97)\ **Replies:** 6\ **Last updated:** [March 11, 2022, 1:09pm UTC](https://discuss.elastic.co/t/unable-to-create-an-enrollment-token-for-kibana-elasticsearch-node-http-layer-ssl-configuration-keystore-doesnt-contain-any-privatekey-entries-where-the-associated-certificate-is-a-ca-certificate/297032 "2022-03-11T13:09:32Z")
Hello, I tried today to setup my ELK stack securely so I followed the documentation and created all certs that I need using the certutil and encrypted the CA and the node cert with passwords. I placed the http.p12 file… --- ## [After adding Nodes to a Cluster - common Users cannot authenticate on said nodes](https://discuss.elastic.co/t/after-adding-nodes-to-a-cluster-common-users-cannot-authenticate-on-said-nodes/299419)
**Author:** [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)\ **Replies:** 2\ **Last updated:** [March 11, 2022, 1:05pm UTC](https://discuss.elastic.co/t/after-adding-nodes-to-a-cluster-common-users-cannot-authenticate-on-said-nodes/299419 "2022-03-11T13:05:51Z")
Hi Everyone, i'm currently running a 3 Node Cluster, each Node is running CentOS 7. The Version of all the components is 7.15. We added 2 new nodes - because the old "Data Storing" Nodes were set up without lvm and t… --- ## [Hadoop env Hive Connectivity through logstash](https://discuss.elastic.co/t/hadoop-env-hive-connectivity-through-logstash/299452)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 0\ **Last updated:** [March 11, 2022, 1:02pm UTC](https://discuss.elastic.co/t/hadoop-env-hive-connectivity-through-logstash/299452 "2022-03-11T13:02:37Z")
Is it possible to connect to Hadoop hive environment using hive jdbc driver, through logstash jdbc connector? --- ## [Is there an equivalent feature to OpenSearch's "user attributes" in Elasticsearch?](https://discuss.elastic.co/t/is-there-an-equivalent-feature-to-opensearchs-user-attributes-in-elasticsearch/299393)
**Author:** [@catmanjan](https://discuss.elastic.co/u/catmanjan)\ **Replies:** 2\ **Last updated:** [March 11, 2022, 11:24am UTC](https://discuss.elastic.co/t/is-there-an-equivalent-feature-to-opensearchs-user-attributes-in-elasticsearch/299393 "2022-03-11T11:24:47Z")
I want to set up document level security using ABAC I want to set up a role that will mandate that a user has all the necessary attributes, but each user will have a different set of attributes - rather than making many… --- ## [Missing privileges - Stack rules not showing as rule type on creating new alert](https://discuss.elastic.co/t/missing-privileges-stack-rules-not-showing-as-rule-type-on-creating-new-alert/299437)
**Author:** [@Mark\_Veenstra](https://discuss.elastic.co/u/Mark_Veenstra)\ **Replies:** 0\ **Last updated:** [March 11, 2022, 11:10am UTC](https://discuss.elastic.co/t/missing-privileges-stack-rules-not-showing-as-rule-type-on-creating-new-alert/299437 "2022-03-11T11:10:33Z")
Within Kibana we would like to configure alert rules. When I navigate to the alerts and want to create a new rule. Some users do not have the option for Elasticsearch query based rules and/or index threshold rules. It s… --- ## [Master not discovred ( multi-nodes cluster )](https://discuss.elastic.co/t/master-not-discovred-multi-nodes-cluster/299422)
**Author:** [@Achraf\_MENSI](https://discuss.elastic.co/u/Achraf_MENSI)\ **Replies:** 5\ **Last updated:** [March 11, 2022, 10:20am UTC](https://discuss.elastic.co/t/master-not-discovred-multi-nodes-cluster/299422 "2022-03-11T10:20:49Z")
my nodes can’t see each other on my Elasticsearch cluster on vm azure \`{"error":{"root\_cause":\[{"type":"master\_not\_discovered\_exception","reason":null}\],"type":"master\_not\_discovered\_exception","reason":null},"status":5… --- ## [Connecting to the Teradata Data Source through logstash](https://discuss.elastic.co/t/connecting-to-the-teradata-data-source-through-logstash/299420)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 0\ **Last updated:** [March 11, 2022, 9:22am UTC](https://discuss.elastic.co/t/connecting-to-the-teradata-data-source-through-logstash/299420 "2022-03-11T09:22:07Z")
Is it possible to use the logstash JDBC connector to connect to the Teradata data platform? --- ## [Elastic startup exception](https://discuss.elastic.co/t/elastic-startup-exception/299415)
**Author:** [@zx\_emo](https://discuss.elastic.co/u/zx_emo)\ **Replies:** 2\ **Last updated:** [March 11, 2022, 9:05am UTC](https://discuss.elastic.co/t/elastic-startup-exception/299415 "2022-03-11T09:05:29Z")
\[es@localhost elasticsearch-8.0.1\]$ vim config/elasticsearch.yml \[es@localhost elasticsearch-8.0.1\]$ bin/elasticsearch warning: ignoring JAVA\_HOME=/usr/local/java/jdk1.8.0\_311; using bundled JDK warning: ignoring JAVA\_H… --- ## [Unable to use RESTful API in Elastic Cloud with curl](https://discuss.elastic.co/t/unable-to-use-restful-api-in-elastic-cloud-with-curl/299358)
**Author:** [@Conor\_Hennessy](https://discuss.elastic.co/u/Conor_Hennessy)\ **Replies:** 1\ **Last updated:** [March 11, 2022, 8:28am UTC](https://discuss.elastic.co/t/unable-to-use-restful-api-in-elastic-cloud-with-curl/299358 "2022-03-11T08:28:10Z")
Hi, I have a deployment on Elastic Cloud with an endpoint of the form: https://my\_host\_name.es.westusa.azure.elastic-cloud.com I wish to use the api to edit the extensions, specifically to add a synonyms file, using c… --- ## [Can't run Logstash as a Service](https://discuss.elastic.co/t/cant-run-logstash-as-a-service/299202)
**Author:** [@Simone1](https://discuss.elastic.co/u/Simone1)\ **Replies:** 26\ **Last updated:** [March 11, 2022, 8:06am UTC](https://discuss.elastic.co/t/cant-run-logstash-as-a-service/299202 "2022-03-11T08:06:57Z")
If i run logstash manually it works fine and sends all data in the right way. But when i try to run it as a service it shows this error: Cmd that i use: sudo systemctl start logstash.service OS Ubuntu 20.04.1 Log… --- ## [Elasticsearch can-match phase](https://discuss.elastic.co/t/elasticsearch-can-match-phase/299331)
**Author:** [@qixian](https://discuss.elastic.co/u/qixian)\ **Replies:** 1\ **Last updated:** [March 11, 2022, 7:24am UTC](https://discuss.elastic.co/t/elasticsearch-can-match-phase/299331 "2022-03-11T07:24:09Z")
hello,who can help me with this question,thanks. I konw that the old version of Elasticsearch before 7.16,during the can-match phase,the search’s coordinating node sent an individual request to each shard checked,is it … --- ## [Elasticsearch restore cluster with TLS enabled](https://discuss.elastic.co/t/elasticsearch-restore-cluster-with-tls-enabled/299392)
**Author:** [@auto\_reply\_007](https://discuss.elastic.co/u/auto_reply_007)\ **Replies:** 3\ **Last updated:** [March 11, 2022, 6:42am UTC](https://discuss.elastic.co/t/elasticsearch-restore-cluster-with-tls-enabled/299392 "2022-03-11T06:42:54Z")
Hello! we have Elasticsearch 7.10.2 cluster in Delhi ( with InterNode tls and users enabled ) and we want to move cluster data onto another location ( Dubai ) and how to backup all data except security indices? because … --- ## [Keycloak with ELK stack](https://discuss.elastic.co/t/keycloak-with-elk-stack/299311)
**Author:** [@shivendra95](https://discuss.elastic.co/u/shivendra95)\ **Replies:** 3\ **Last updated:** [March 11, 2022, 6:23am UTC](https://discuss.elastic.co/t/keycloak-with-elk-stack/299311 "2022-03-11T06:23:17Z")
I'm trying to use Keycloak to login into kibana dashboard. Can anyone help me on this as some of the solutions I found on the forum were not working out for me. --- ## [Want to disable Logstash http://localhost:9600/ URL JSON output](https://discuss.elastic.co/t/want-to-disable-logstash-http-localhost-9600-url-json-output/299352)
**Author:** [@shahidraza](https://discuss.elastic.co/u/shahidraza)\ **Replies:** 6\ **Last updated:** [March 11, 2022, 5:51am UTC](https://discuss.elastic.co/t/want-to-disable-logstash-http-localhost-9600-url-json-output/299352 "2022-03-11T05:51:51Z")
Hi Team, We don't want to see JSON output as it contains Hostname and other sensitive information and it's accessible without user id and password too. Please share details to disable this so that security vulnerabilit… --- ## [Logstash Helm install with jdbc connection to MySQL/Mariadb](https://discuss.elastic.co/t/logstash-helm-install-with-jdbc-connection-to-mysql-mariadb/299396)
**Author:** [@Matthew\_Ong](https://discuss.elastic.co/u/Matthew_Ong)\ **Replies:** 0\ **Last updated:** [March 11, 2022, 4:53am UTC](https://discuss.elastic.co/t/logstash-helm-install-with-jdbc-connection-to-mysql-mariadb/299396 "2022-03-11T04:53:51Z")
Hi, I am new to logstash(2 weeks). Please help me with these questions. Thanks very much in advance. How to perform JDBC connection to mysql with helm chart installation and how to upload the jdbc driver after the inst… --- ## [How to convert scripted field to runtime field - KIbana \_doc compile error](https://discuss.elastic.co/t/how-to-convert-scripted-field-to-runtime-field-kibana-doc-compile-error/299391)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 1\ **Last updated:** [March 11, 2022, 3:42am UTC](https://discuss.elastic.co/t/how-to-convert-scripted-field-to-runtime-field-kibana-doc-compile-error/299391 "2022-03-11T03:42:02Z")
Some time ago I fought scripted fields in this post: Painless doc values; how to reference grouped fields Now scripted fields are deprecated and I'm trying to convert this to a runtime field. I'm using the KIbana compon… --- ## [How to Update a Field in a document to NULL usiong NEST and the Update API](https://discuss.elastic.co/t/how-to-update-a-field-in-a-document-to-null-usiong-nest-and-the-update-api/299003)
**Author:** [@xef](https://discuss.elastic.co/u/xef)\ **Replies:** 4\ **Last updated:** [March 11, 2022, 3:40am UTC](https://discuss.elastic.co/t/how-to-update-a-field-in-a-document-to-null-usiong-nest-and-the-update-api/299003 "2022-03-11T03:40:40Z")
This is the third time we are posting this in the hope someone can shed some light on it - Please. We are using the NEST library with Elasticsearch versions 7.14. Lets say we have assigned a field a value of "hello Wor… --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/299385)
**Author:** [@AlexIch](https://discuss.elastic.co/u/AlexIch)\ **Replies:** 7\ **Last updated:** [March 11, 2022, 1:56am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/299385 "2022-03-11T01:56:36Z")
HI guys Im getting Kibana server is not ready yet error when Opening Kibana dashboard Elasticsearch.yml: cluster.name: xiake-els-server node.name: node-1 path.data: /data/Elasticsearch/data path.logs: /data/Elastic… --- ## [Can one specify format of datetime in query?](https://discuss.elastic.co/t/can-one-specify-format-of-datetime-in-query/299263)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 5\ **Last updated:** [March 11, 2022, 1:47am UTC](https://discuss.elastic.co/t/can-one-specify-format-of-datetime-in-query/299263 "2022-03-11T01:47:47Z")
Is there a way of specifying the format of times used in a query? In most of my indexes I convert times to ISO8601 but one data source had a totally non standard format and I decided that it was easier to simply specify… --- ## [Elasticsearch java api tail](https://discuss.elastic.co/t/elasticsearch-java-api-tail/299387)
**Author:** [@111505](https://discuss.elastic.co/u/111505)\ **Replies:** 0\ **Last updated:** [March 11, 2022, 1:35am UTC](https://discuss.elastic.co/t/elasticsearch-java-api-tail/299387 "2022-03-11T01:35:24Z")
Hi. I want to implement the "tail" function with Java. Will the Elasticsearch java API provide similar functions to "tail"? I plan to use it when I look at Log. The Scroll API seems to be difficult to write due to the… --- ## [Renaming multiple fields that are nested](https://discuss.elastic.co/t/renaming-multiple-fields-that-are-nested/299376)
**Author:** [@itschobot](https://discuss.elastic.co/u/itschobot)\ **Replies:** 3\ **Last updated:** [March 11, 2022, 12:05am UTC](https://discuss.elastic.co/t/renaming-multiple-fields-that-are-nested/299376 "2022-03-11T00:05:25Z")
I need help renaming multiple fields that are nested, here is my problem, I can only rename "did" within example.devices but when I attempt to rename others I would assume it's the same pattern but the results are what i… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1016) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1018)