# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1018 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1019 --- ## [How do I logout of Kibana](https://discuss.elastic.co/t/how-do-i-logout-of-kibana/299015)
**Author:** [@codewriterguy](https://discuss.elastic.co/u/codewriterguy)\ **Replies:** 8\ **Last updated:** [March 10, 2022, 11:18pm UTC](https://discuss.elastic.co/t/how-do-i-logout-of-kibana/299015 "2022-03-10T23:18:39Z")
I know this is incredibly basic and I'm not trolling, I can't find a logout button --- ## [Unable to get terminal for logstash 8.0.1](https://discuss.elastic.co/t/unable-to-get-terminal-for-logstash-8-0-1/299370)
**Author:** [@uma\_rengasamy](https://discuss.elastic.co/u/uma_rengasamy)\ **Replies:** 0\ **Last updated:** [March 10, 2022, 9:38pm UTC](https://discuss.elastic.co/t/unable-to-get-terminal-for-logstash-8-0-1/299370 "2022-03-10T21:38:21Z")
Getting below error OCI runtime exec failed: exec failed: container\_linux.go:380: starting container process caused: exec: "/bin/bash": stat /bin/bash: no such file or directory: unknown --- ## [During bootstrap Created elasticsearch keystore in /usr/share/elasticsearch/config/elasticsearch.keystore](https://discuss.elastic.co/t/during-bootstrap-created-elasticsearch-keystore-in-usr-share-elasticsearch-config-elasticsearch-keystore/299363)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 1\ **Last updated:** [March 10, 2022, 8:32pm UTC](https://discuss.elastic.co/t/during-bootstrap-created-elasticsearch-keystore-in-usr-share-elasticsearch-config-elasticsearch-keystore/299363 "2022-03-10T20:32:06Z")
Hi I don't understand I have provisioned 55 nodes over docker compose on 3 host, a few hosts wake up and still alive, but most of them when I've checked logs has a state and a few docker container was created but the b… --- ## [Snapshot for a complete beginner](https://discuss.elastic.co/t/snapshot-for-a-complete-beginner/299349)
**Author:** [@Foggie](https://discuss.elastic.co/u/Foggie)\ **Replies:** 1\ **Last updated:** [March 10, 2022, 8:16pm UTC](https://discuss.elastic.co/t/snapshot-for-a-complete-beginner/299349 "2022-03-10T20:16:07Z")
I want to understand the relationship between the current "data" and snapshots. I am about to start work on a fairly small Elasticsearch application. At 2am each day a simple \_snapshot is performed to a repository with a… --- ## [Prune filter does not work](https://discuss.elastic.co/t/prune-filter-does-not-work/299274)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 6\ **Last updated:** [March 10, 2022, 8:15pm UTC](https://discuss.elastic.co/t/prune-filter-does-not-work/299274 "2022-03-10T20:15:00Z")
good morning, hope you are well I have a problem with the "prune" filter in logstash and I have a configuration file in logstash in which the objective is to take the data from filebeat-netflow and go through the pipe i… --- ## [Delay to Metribeat system input data into Elasticsearch](https://discuss.elastic.co/t/delay-to-metribeat-system-input-data-into-elasticsearch/299348)
**Author:** [@Thiago\_Paiva](https://discuss.elastic.co/u/Thiago_Paiva)\ **Replies:** 0\ **Last updated:** [March 10, 2022, 3:15pm UTC](https://discuss.elastic.co/t/delay-to-metribeat-system-input-data-into-elasticsearch/299348 "2022-03-10T15:15:40Z")
Hi Everyone, I'm monitoring a Linux server with metricbeat, but I noticed a delay for the input of metrics into Elastic (Discover - Kibana). Time is approximately 2 minutes. My configuration is 3 master elastic nodes th… --- ## [Encountered a retryable error. Will Retry with exponential backoff {:code=\>500,](https://discuss.elastic.co/t/encountered-a-retryable-error-will-retry-with-exponential-backoff-code-500/299138)
**Author:** [@venky123](https://discuss.elastic.co/u/venky123)\ **Replies:** 4\ **Last updated:** [March 10, 2022, 7:26pm UTC](https://discuss.elastic.co/t/encountered-a-retryable-error-will-retry-with-exponential-backoff-code-500/299138 "2022-03-10T19:26:57Z")
Continuing the discussion from Encountered a retryable error. Will Retry with exponential backoff code=\>413: \[2022-03-07T02:18:15,991\]\[ERROR\]\[logstash.outputs.Elasticsearch\] Encountered a retryable error. Will Retry wit… --- ## [Unable to create kibana readonly dashboard after upgrade](https://discuss.elastic.co/t/unable-to-create-kibana-readonly-dashboard-after-upgrade/299362)
**Author:** [@ksk\_droid](https://discuss.elastic.co/u/ksk_droid)\ **Replies:** 0\ **Last updated:** [March 10, 2022, 7:05pm UTC](https://discuss.elastic.co/t/unable-to-create-kibana-readonly-dashboard-after-upgrade/299362 "2022-03-10T19:05:27Z")
Currently my Kibana/Elasticsearch version is 7.17.1 community edition. I installed it on Ubuntu. Earlier I was able to create on readonly dahsboard. Now when I want to add the newly created dashboard in admin role to … --- ## [\[Filebeat\] Specify Elasticsearch Ingest Pipeline with Hints-Based Autodiscover](https://discuss.elastic.co/t/filebeat-specify-elasticsearch-ingest-pipeline-with-hints-based-autodiscover/298545)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 1\ **Last updated:** [March 10, 2022, 6:19pm UTC](https://discuss.elastic.co/t/filebeat-specify-elasticsearch-ingest-pipeline-with-hints-based-autodiscover/298545 "2022-03-10T18:19:55Z")
How can I specify a custom Elasticsearch Ingest Pipeline for use with hints-based autodiscover. E.g., I would like to be able to include it as a pod annotation, rather than hardcode it into the autodiscover specification… --- ## [Table Chart showing incorrect doc "Count percentage"](https://discuss.elastic.co/t/table-chart-showing-incorrect-doc-count-percentage/298762)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 2\ **Last updated:** [March 10, 2022, 5:33pm UTC](https://discuss.elastic.co/t/table-chart-showing-incorrect-doc-count-percentage/298762 "2022-03-10T17:33:05Z")
Hi, I created a table in kibana viz with elastic version 7.6.1. It's showing the incorrect "Count Percentage" tab in the table. I checked the config of Table viz,but still unable to solve this. Snap-Incorrect percent… --- ## [Sort Data Created via Aggregation](https://discuss.elastic.co/t/sort-data-created-via-aggregation/299360)
**Author:** [@TomTom](https://discuss.elastic.co/u/TomTom)\ **Replies:** 0\ **Last updated:** [March 10, 2022, 5:37pm UTC](https://discuss.elastic.co/t/sort-data-created-via-aggregation/299360 "2022-03-10T17:37:35Z")
I needed to create an aggregation based on the customer id, but inside the document I have an object with the customer details, like name and email. Through a code I found, I learned to display in this aggregation the n… --- ## [Query Separate Pipeline for Logstash SNMP Input Hosts](https://discuss.elastic.co/t/query-separate-pipeline-for-logstash-snmp-input-hosts/299355)
**Author:** [@bennrtc](https://discuss.elastic.co/u/bennrtc)\ **Replies:** 1\ **Last updated:** [March 10, 2022, 4:29pm UTC](https://discuss.elastic.co/t/query-separate-pipeline-for-logstash-snmp-input-hosts/299355 "2022-03-10T16:29:27Z")
Hello! I'm using the Logstash SNMP Input to query a large number of hosts (\> 5,000). The list of host ip addresses changes frequently and requires us to regularly add and remove hosts to ensure our pipeline output is u… --- ## [Logstash Failed to Parse Date (6 milliseconds)](https://discuss.elastic.co/t/logstash-failed-to-parse-date-6-milliseconds/299271)
**Author:** [@userR](https://discuss.elastic.co/u/userR)\ **Replies:** 4\ **Last updated:** [March 10, 2022, 4:23pm UTC](https://discuss.elastic.co/t/logstash-failed-to-parse-date-6-milliseconds/299271 "2022-03-10T16:23:13Z")
"reason"=\>"failed to parse date field \[Sun Feb 20 03:36:11.782065 2022\] with format \[strict\_date\_optional\_time||epoch\_millis\]", "caused\_by"=\>{"type"=\>"date\_time\_parse\_exception", "reason"=\>"Failed to parse with all enclo… --- ## [Canvas Issue - math](https://discuss.elastic.co/t/canvas-issue-math/299090)
**Author:** [@PaulaCM](https://discuss.elastic.co/u/PaulaCM)\ **Replies:** 2\ **Last updated:** [March 10, 2022, 4:07pm UTC](https://discuss.elastic.co/t/canvas-issue-math/299090 "2022-03-10T16:07:24Z")
Hey! I don't know if someone got this issue or knows how to help: I am doing a SQL query which is working fine: // SELECT COUNT(DISTINCT "idVisit") FROM "test" but when displaying an error appears "Whoops! Expressi… --- ## [Logstash Log Stream](https://discuss.elastic.co/t/logstash-log-stream/299262)
**Author:** [@laolao](https://discuss.elastic.co/u/laolao)\ **Replies:** 3\ **Last updated:** [March 10, 2022, 3:55pm UTC](https://discuss.elastic.co/t/logstash-log-stream/299262 "2022-03-10T15:55:34Z")
I have a basic configuration of logstash sending syslogs to Elasticsearch. I created my index pattern and can make visualizations, etc. However, I want to view the logs in real time on my dashboard. My dashboard has 4 d… --- ## [Facing issue in logstash after applying basic authentication on ES](https://discuss.elastic.co/t/facing-issue-in-logstash-after-applying-basic-authentication-on-es/299308)
**Author:** [@Sandeep\_Thakur](https://discuss.elastic.co/u/Sandeep_Thakur)\ **Replies:** 1\ **Last updated:** [March 10, 2022, 3:51pm UTC](https://discuss.elastic.co/t/facing-issue-in-logstash-after-applying-basic-authentication-on-es/299308 "2022-03-10T15:51:35Z")
Hi Team, We are trying to applying basic authentication on ELk stack, when we enable security true in Elasticsearch.yml then logstash stopping pushing log on ES and give following error \[2022-03-10T08:39:43,365\]\[WARN \]… --- ## [Is it possible to monitor 2 different infrastructures?](https://discuss.elastic.co/t/is-it-possible-to-monitor-2-different-infrastructures/298590)
**Author:** [@Teckinfor](https://discuss.elastic.co/u/Teckinfor)\ **Replies:** 1\ **Last updated:** [March 10, 2022, 3:39pm UTC](https://discuss.elastic.co/t/is-it-possible-to-monitor-2-different-infrastructures/298590 "2022-03-10T15:39:52Z")
Hello, I would like to be able to monitor 2 infrastructures at the same time, I have created a space for each infrastructure as well as 2 agent policies linked to the agents of their own infrastructure. I was wondering… --- ## [Elasticsearch SQL - How to query data only from yesterday](https://discuss.elastic.co/t/elasticsearch-sql-how-to-query-data-only-from-yesterday/299151)
**Author:** [@ezra](https://discuss.elastic.co/u/ezra)\ **Replies:** 1\ **Last updated:** [March 10, 2022, 3:38pm UTC](https://discuss.elastic.co/t/elasticsearch-sql-how-to-query-data-only-from-yesterday/299151 "2022-03-10T15:38:44Z")
Hello everyone. I am looking to query data from yesterday, excluding the data from today. I have figured out how to do this when inputting a specific date and subtracting 1 day. However, I need it to be from today's dat… --- ## [Merticbeat Error dialing x509: certificate is valid for 127.0.0.1, not 172.16.0.204](https://discuss.elastic.co/t/merticbeat-error-dialing-x509-certificate-is-valid-for-127-0-0-1-not-172-16-0-204/299323)
**Author:** [@Spyros\_Agriopoulos](https://discuss.elastic.co/u/Spyros_Agriopoulos)\ **Replies:** 2\ **Last updated:** [March 10, 2022, 3:19pm UTC](https://discuss.elastic.co/t/merticbeat-error-dialing-x509-certificate-is-valid-for-127-0-0-1-not-172-16-0-204/299323 "2022-03-10T15:19:18Z")
Metricbeat has stopped working and is giving me Error dialing x509: certificate is valid for 127.0.0.1, not x.x.x.x after a yum update. Other instances that are using the exact same certificate are working fine. Any i… --- ## [ILM error killing all indexes](https://discuss.elastic.co/t/ilm-error-killing-all-indexes/298993)
**Author:** [@cstone1492](https://discuss.elastic.co/u/cstone1492)\ **Replies:** 9\ **Last updated:** [March 10, 2022, 3:06pm UTC](https://discuss.elastic.co/t/ilm-error-killing-all-indexes/298993 "2022-03-10T15:06:59Z")
The es instance I'm working with crashed, and attempting to restart the kernel leads to the run command immediately being killed (runES.sh: line 1: 92654 Killed ./bin/Elasticsearch). The log shows this … --- ## [What if I don't set index.query.default\_field?](https://discuss.elastic.co/t/what-if-i-dont-set-index-query-default-field/299108)
**Author:** [@mikewillis](https://discuss.elastic.co/u/mikewillis)\ **Replies:** 3\ **Last updated:** [March 10, 2022, 2:33pm UTC](https://discuss.elastic.co/t/what-if-i-dont-set-index-query-default-field/299108 "2022-03-10T14:33:49Z")
Our cluster is still running Elasticsearch 6.8, so I'm looking at getting it upgraded to Elasticsearch 7. The Kibana Upgrade Assistant is flagging a couple of hundred indices with this message This index has \[4234\] fie… --- ## [How to integrate knnsearch In java application](https://discuss.elastic.co/t/how-to-integrate-knnsearch-in-java-application/298897)
**Author:** [@dileepkotte4529](https://discuss.elastic.co/u/dileepkotte4529)\ **Replies:** 4\ **Last updated:** [March 10, 2022, 2:33pm UTC](https://discuss.elastic.co/t/how-to-integrate-knnsearch-in-java-application/298897 "2022-03-10T14:33:11Z")
Hi Folks , I was tried knnsearch for vector similarity search in python it worked .But Now i need to integrate that with my spring application , I don't see much resource on it. But i tried with below code Elastic Sea… --- ## [Are Elasticsearch object properties really just flat properties with a namespace?](https://discuss.elastic.co/t/are-elasticsearch-object-properties-really-just-flat-properties-with-a-namespace/299054)
**Author:** [@Robert\_Krueger](https://discuss.elastic.co/u/Robert_Krueger)\ **Replies:** 7\ **Last updated:** [March 10, 2022, 2:20pm UTC](https://discuss.elastic.co/t/are-elasticsearch-object-properties-really-just-flat-properties-with-a-namespace/299054 "2022-03-10T14:20:13Z")
In the Elasticsearch docs (Object field type | Elasticsearch Guide \[8.0\] | Elastic) it is stated that object properties internally are essentially just flat properties with a namespace. However when I do this: POST … --- ## [o.e.c.c.ClusterFormationFailureHelper failed to resolve host](https://discuss.elastic.co/t/o-e-c-c-clusterformationfailurehelper-failed-to-resolve-host/299251)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 2\ **Last updated:** [March 10, 2022, 2:16pm UTC](https://discuss.elastic.co/t/o-e-c-c-clusterformationfailurehelper-failed-to-resolve-host/299251 "2022-03-10T14:16:44Z")
Hi On the beginning I have a problem with configuration of two nodes on the same host. As first I need to create a cluster so at I've started from create network and swarm cluster. I don't know why the host name is … --- ## [Error indexing with httpjson](https://discuss.elastic.co/t/error-indexing-with-httpjson/299122)
**Author:** [@humartinez](https://discuss.elastic.co/u/humartinez)\ **Replies:** 2\ **Last updated:** [March 10, 2022, 1:59pm UTC](https://discuss.elastic.co/t/error-indexing-with-httpjson/299122 "2022-03-10T13:59:56Z")
Hi, Im having a issue while indexing via filebeat httpjson to elastic I have this configuration filebeat.inputs: - type: httpjson enabled: true config\_version: 2 fields\_under\_root: true json.keys\_under\_root: t… --- ## [Kibana error opening transforms page](https://discuss.elastic.co/t/kibana-error-opening-transforms-page/297780)
**Author:** [@gentle\_ghost](https://discuss.elastic.co/u/gentle_ghost)\ **Replies:** 3\ **Last updated:** [March 10, 2022, 1:56pm UTC](https://discuss.elastic.co/t/kibana-error-opening-transforms-page/297780 "2022-03-10T13:56:00Z")
Hello, I've been working on transforms today without much of an issue. I went to create another transform in the Kibana UI but as soon as I click "create transform" the page loads with the following error: \> Error: Fa… --- ## [Combine filebeat logs to ship to Elastic Search based on unique trace id (without Logstash)](https://discuss.elastic.co/t/combine-filebeat-logs-to-ship-to-elastic-search-based-on-unique-trace-id-without-logstash/298968)
**Author:** [@shikha1](https://discuss.elastic.co/u/shikha1)\ **Replies:** 4\ **Last updated:** [March 10, 2022, 1:50pm UTC](https://discuss.elastic.co/t/combine-filebeat-logs-to-ship-to-elastic-search-based-on-unique-trace-id-without-logstash/298968 "2022-03-10T13:50:34Z")
I have configured filebeat for shipping logs of my spring boot application directly to Elasticsearch without configuration of logstash. I want to configure filebeat multiline regex in a way that it can combine all the lo… --- ## [How to escape colon in painless](https://discuss.elastic.co/t/how-to-escape-colon-in-painless/299328)
**Author:** [@geppo](https://discuss.elastic.co/u/geppo)\ **Replies:** 1\ **Last updated:** [March 10, 2022, 1:42pm UTC](https://discuss.elastic.co/t/how-to-escape-colon-in-painless/299328 "2022-03-10T13:42:01Z")
Hi to everyone! Few days ago someone in my company has created in my cluster a field called total\_chunks.RS|24|12:24 and I would like to rename It with an update\_by\_query. I have tried this query: { "query": { … --- ## [Output.kafka filebeat (possible to add field ?)](https://discuss.elastic.co/t/output-kafka-filebeat-possible-to-add-field/299332)
**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\ **Replies:** 2\ **Last updated:** [March 10, 2022, 1:32pm UTC](https://discuss.elastic.co/t/output-kafka-filebeat-possible-to-add-field/299332 "2022-03-10T13:32:16Z")
Hi, I would like to know if it is possible to add a field in the kafka output filebeat.yml: output.kafka: hosts: \["127.0.0.1:9092"\] topic: '%{\[fields.kafka\_topic\]}' codec.format: string: '%{\[message\]}' par… --- ## [No data has been received from this module yet message](https://discuss.elastic.co/t/no-data-has-been-received-from-this-module-yet-message/299330)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 1\ **Last updated:** [March 10, 2022, 1:26pm UTC](https://discuss.elastic.co/t/no-data-has-been-received-from-this-module-yet-message/299330 "2022-03-10T13:26:54Z")
Hi, I have already configured Suricata logs to be fowarded to ES through Filebeat. I am receiving the logs but this message still appears. I am using the Suricata module aswell [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1017) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1019)