# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1031 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1032 --- ## [Elastich search can not start in vps](https://discuss.elastic.co/t/elastich-search-can-not-start-in-vps/298489)
**Author:** [@poozhan](https://discuss.elastic.co/u/poozhan)\ **Replies:** 4\ **Last updated:** [March 1, 2022, 8:20pm UTC](https://discuss.elastic.co/t/elastich-search-can-not-start-in-vps/298489 "2022-03-01T20:20:01Z")
Hello I installed java and Elasticsearch in vps my vps have 4g ram and 50g ssd when i start Elasticsearch this error display elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticse… --- ## [X509: certificate signed by unknown authority](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority/298551)
**Author:** [@sath](https://discuss.elastic.co/u/sath)\ **Replies:** 0\ **Last updated:** [March 1, 2022, 7:24pm UTC](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority/298551 "2022-03-01T19:24:09Z")
Hello, I'm running Elasticsearch 8 and am trying to output files on a Windows machine to Logstash. Now in preparation, I'm trying to get the index setup by running the following: .\\filebeat.exe setup --index-managemen… --- ## [Lens table/datatable visual options (pagination) missing?](https://discuss.elastic.co/t/lens-table-datatable-visual-options-pagination-missing/298553)
**Author:** [@Moni](https://discuss.elastic.co/u/Moni)\ **Replies:** 2\ **Last updated:** [March 1, 2022, 8:12pm UTC](https://discuss.elastic.co/t/lens-table-datatable-visual-options-pagination-missing/298553 "2022-03-01T20:12:16Z")
Hi all , I don't see the Visual Options in lens table in v 7.16.3. also don't see it in v7.10.2 data table Please do let me know what I am missing here. it should have been available as this feature was added - as … --- ## [How to append a string to a value?](https://discuss.elastic.co/t/how-to-append-a-string-to-a-value/298542)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 3\ **Last updated:** [March 1, 2022, 7:53pm UTC](https://discuss.elastic.co/t/how-to-append-a-string-to-a-value/298542 "2022-03-01T19:53:57Z")
Hi, I would like to append the letter C to this key: "module-temp": 32.37 so that it looks like "module-temp": 32.37 C Tried this but didn't work: if ("\*" in \[module-temp\]) { mutate { replace =\> … --- ## [Could not execute action: PipelineAction::Create\](https://discuss.elastic.co/t/could-not-execute-action-pipelineaction-create-main/298454)
**Author:** [@sath](https://discuss.elastic.co/u/sath)\ **Replies:** 6\ **Last updated:** [March 1, 2022, 7:17pm UTC](https://discuss.elastic.co/t/could-not-execute-action-pipelineaction-create-main/298454 "2022-03-01T19:17:41Z")
Hello, Logstash isn't able to create the index, that's what my conclusion is after checking the logs. pipeline.yml - pipeline.id: main path.config: "/etc/logstash/conf.d/1.conf" 1.conf: input { beats { … --- ## [String json to SearchResponse](https://discuss.elastic.co/t/string-json-to-searchresponse/298543)
**Author:** [@RabBit\_BR](https://discuss.elastic.co/u/RabBit_BR)\ **Replies:** 1\ **Last updated:** [March 1, 2022, 6:38pm UTC](https://discuss.elastic.co/t/string-json-to-searchresponse/298543 "2022-03-01T18:38:53Z")
Hello. I used the example below to turn the json response into a SearchResponse and it worked fine. I made a change in my json file by adding the "suggest" but now I can't parse it correctly. Does anyone have any tips… --- ## [Solr metricbeat module?](https://discuss.elastic.co/t/solr-metricbeat-module/298547)
**Author:** [@MyrdhinBZH](https://discuss.elastic.co/u/MyrdhinBZH)\ **Replies:** 0\ **Last updated:** [March 1, 2022, 6:36pm UTC](https://discuss.elastic.co/t/solr-metricbeat-module/298547 "2022-03-01T18:36:14Z")
Hello, I would like to monitor my solr servers with my ELK stack but I did not find Solr beat module... has Anyone ever retrieved metrics from solr instances to ELK? Thanks, --- ## [Discover Histogram changed to use inches (from timestamps)](https://discuss.elastic.co/t/discover-histogram-changed-to-use-inches-from-timestamps/298438)
**Author:** [@Philip\_Nicolcev](https://discuss.elastic.co/u/Philip_Nicolcev)\ **Replies:** 9\ **Last updated:** [March 1, 2022, 6:08pm UTC](https://discuss.elastic.co/t/discover-histogram-changed-to-use-inches-from-timestamps/298438 "2022-03-01T18:08:08Z")
I have an issue where the Discover view's histogram has suddenly changed to using inches (or what I assume is inches, since it's broken into groups of 12) as a unit for its x axis instead of the usual timestamps. It's li… --- ## [Drop\_event not working via process name or path](https://discuss.elastic.co/t/drop-event-not-working-via-process-name-or-path/298300)
**Author:** [@Josh\_G](https://discuss.elastic.co/u/Josh_G)\ **Replies:** 2\ **Last updated:** [March 1, 2022, 5:31pm UTC](https://discuss.elastic.co/t/drop-event-not-working-via-process-name-or-path/298300 "2022-03-01T17:31:32Z")
Hi, I'm using the processer in the System integration on Elastic Agent to try and reduce the ingest as we get a lot of noise. I've been doing some testing as I'd like to filter out an event code if the process name is … --- ## [Fleet Server 8.0 w/Docker Compose](https://discuss.elastic.co/t/fleet-server-8-0-w-docker-compose/298077)
**Author:** [@variable](https://discuss.elastic.co/u/variable)\ **Replies:** 0\ **Last updated:** [February 23, 2022, 7:38pm UTC](https://discuss.elastic.co/t/fleet-server-8-0-w-docker-compose/298077 "2022-02-23T19:38:13Z")
Pre 8.0, you could set an Elastic Agent container as a Fleet Server with Docker environment variables: docker run ... -e "KIBANA\_FLEET\_SETUP=1" \\ -e "FLEET\_ENROLL=1" \\ -e "FLEET\_SERVER\_INSECURE\_HTTP=1" \\ … --- ## [Alert if any value in a specific field stops appearing](https://discuss.elastic.co/t/alert-if-any-value-in-a-specific-field-stops-appearing/297545)
**Author:** [@duttad](https://discuss.elastic.co/u/duttad)\ **Replies:** 2\ **Last updated:** [March 1, 2022, 5:29pm UTC](https://discuss.elastic.co/t/alert-if-any-value-in-a-specific-field-stops-appearing/297545 "2022-03-01T17:29:36Z")
In my index, if any value has appeared in a specific field every day in the last 3 days, I expect to see this value at least once every day in the future. I want to receive an alert if any such value suddenly stops showi… --- ## [Kibana7 Average aggregation line graph bug](https://discuss.elastic.co/t/kibana7-average-aggregation-line-graph-bug/297551)
**Author:** [@TimC](https://discuss.elastic.co/u/TimC)\ **Replies:** 6\ **Last updated:** [March 1, 2022, 5:07pm UTC](https://discuss.elastic.co/t/kibana7-average-aggregation-line-graph-bug/297551 "2022-03-01T17:07:30Z")
I am migrating visualizations and dashboards from kibana 5 to 7 In Kibana7 line graphs aggregating Average with an X-Axis of Terms sorted by Sum (in our case we have a metric that is about time/power it took for this ta… --- ## [Ingest Pipline - Multiple Pipelines For Elastic Agent Data](https://discuss.elastic.co/t/ingest-pipline-multiple-pipelines-for-elastic-agent-data/298527)
**Author:** [@m-flow](https://discuss.elastic.co/u/m-flow)\ **Replies:** 0\ **Last updated:** [March 1, 2022, 2:36pm UTC](https://discuss.elastic.co/t/ingest-pipline-multiple-pipelines-for-elastic-agent-data/298527 "2022-03-01T14:36:47Z")
Hello, I am currently researching for a solution to create a multi pipeline structure with ingest pipelines in elastic. The idea is to have some kind of post processing on the existing elastic-agent logs, for instance f… --- ## [Kibana Fleet shows Self Signed Certificate in Certificate Chain](https://discuss.elastic.co/t/kibana-fleet-shows-self-signed-certificate-in-certificate-chain/297947)
**Author:** [@SwampyFox](https://discuss.elastic.co/u/SwampyFox)\ **Replies:** 1\ **Last updated:** [March 1, 2022, 4:13pm UTC](https://discuss.elastic.co/t/kibana-fleet-shows-self-signed-certificate-in-certificate-chain/297947 "2022-03-01T16:13:17Z")
I have just run through the Elasticstack 8 instructions on Docker and have been able to get Elastic and Kibana up. However, when I click on Fleet in kibana, I get a message: "Error connecting to package registry...Reaso… --- ## [About AWS S3 Input](https://discuss.elastic.co/t/about-aws-s3-input/297922)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 5\ **Last updated:** [March 1, 2022, 4:02pm UTC](https://discuss.elastic.co/t/about-aws-s3-input/297922 "2022-03-01T16:02:33Z")
Hi, We're considering changes to the structure of our ingestion pipelines. One of those is to have dockerized services write their logs to s3 and then have filebeat read them back before forwarding. Given that we have … --- ## [Elasticsearch enrichment, join best practice](https://discuss.elastic.co/t/elasticsearch-enrichment-join-best-practice/298535)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 0\ **Last updated:** [March 1, 2022, 3:57pm UTC](https://discuss.elastic.co/t/elasticsearch-enrichment-join-best-practice/298535 "2022-03-01T15:57:10Z")
Hi, how would you handle the situation I have a large data source of 1000tis events/sec, which I need to enrich with data so that I can do analytics on it. The data source has a small amount of data (i.e. 100bytes) bu… --- ## [Correct usage of write indices for rolling over](https://discuss.elastic.co/t/correct-usage-of-write-indices-for-rolling-over/298050)
**Author:** [@whisperingstone](https://discuss.elastic.co/u/whisperingstone)\ **Replies:** 8\ **Last updated:** [March 1, 2022, 3:28pm UTC](https://discuss.elastic.co/t/correct-usage-of-write-indices-for-rolling-over/298050 "2022-03-01T15:28:56Z")
Hello. I collect logs from 10 components on dev, stage & prod envs. I don't write to the same index, the indexes are created every day for every component and environment, like this: componentname\_envYY.MM.DD or backen… --- ## [Fleet managed Elastic Agent - Wrong ES output configuration for Filebeat/Metricbeat](https://discuss.elastic.co/t/fleet-managed-elastic-agent-wrong-es-output-configuration-for-filebeat-metricbeat/297925)
**Author:** [@fuphil](https://discuss.elastic.co/u/fuphil)\ **Replies:** 1\ **Last updated:** [March 1, 2022, 3:03pm UTC](https://discuss.elastic.co/t/fleet-managed-elastic-agent-wrong-es-output-configuration-for-filebeat-metricbeat/297925 "2022-03-01T15:03:33Z")
Hi! I successfully set up a fleet server and 2 more elastic agents on different hosts. They all show up as "healthy" and seem fine in Kibana. I recognized after trying a few integrations, that only the Fleet server i… --- ## [Kibana 7.1x always resets colors when editing visualization](https://discuss.elastic.co/t/kibana-7-1x-always-resets-colors-when-editing-visualization/297599)
**Author:** [@xchess64](https://discuss.elastic.co/u/xchess64)\ **Replies:** 3\ **Last updated:** [March 1, 2022, 3:01pm UTC](https://discuss.elastic.co/t/kibana-7-1x-always-resets-colors-when-editing-visualization/297599 "2022-03-01T15:01:04Z")
Hi all, When I edit a vertical bar vizualisation in kibana, the histogram colors reset to the default value each time I edit the visualization. Before I click on the edit button (from the dashboard view) After the … --- ## [Username in auditbeat file\_integrity module](https://discuss.elastic.co/t/username-in-auditbeat-file-integrity-module/298530)
**Author:** [@sadux](https://discuss.elastic.co/u/sadux)\ **Replies:** 0\ **Last updated:** [March 1, 2022, 2:56pm UTC](https://discuss.elastic.co/t/username-in-auditbeat-file-integrity-module/298530 "2022-03-01T14:56:32Z")
Hello! We track file creation/deletion/change in Kibana with auditbeat file\_integrity module. Is there a way to see information about user, who create/change/delete file? --- ## [Metricbeat docker compose environment variables](https://discuss.elastic.co/t/metricbeat-docker-compose-environment-variables/298009)
**Author:** [@TobiasSackmann](https://discuss.elastic.co/u/TobiasSackmann)\ **Replies:** 2\ **Last updated:** [March 1, 2022, 2:52pm UTC](https://discuss.elastic.co/t/metricbeat-docker-compose-environment-variables/298009 "2022-03-01T14:52:52Z")
Hi all, I am trying to set up stack monitoring using docker via docker compose. Here is a sample I found on the Internet that uses the ELASTICSEARCH\_HOSTS variable. I'd like to define more in this section like the modu… --- ## [Can we update to 8.0 without enabling securitys](https://discuss.elastic.co/t/can-we-update-to-8-0-without-enabling-securitys/298275)
**Author:** [@Dheeraj\_Gupta](https://discuss.elastic.co/u/Dheeraj_Gupta)\ **Replies:** 1\ **Last updated:** [February 25, 2022, 12:09pm UTC](https://discuss.elastic.co/t/can-we-update-to-8-0-without-enabling-securitys/298275 "2022-02-25T12:09:23Z")
We have our filebeat-logstash-Elasticsearch-kibana ecosystem on a private subnet within our organization network. Due to the placement of all components on a fenced subnet, we don't need any security features such as rol… --- ## [Lock date range in dashboards](https://discuss.elastic.co/t/lock-date-range-in-dashboards/298504)
**Author:** [@Nasser](https://discuss.elastic.co/u/Nasser)\ **Replies:** 3\ **Last updated:** [March 1, 2022, 2:10pm UTC](https://discuss.elastic.co/t/lock-date-range-in-dashboards/298504 "2022-03-01T14:10:03Z")
Hi i have multiple dashboards i want to lock the date range in one of them so it can't be change when i change the other dashboards for example dashboard 1 date range last 1 min dashboard 2,3 it's ok to be anything --- ## [Iterat list on watcher elasticsearch](https://discuss.elastic.co/t/iterat-list-on-watcher-elasticsearch/298100)
**Author:** [@Cheroufa](https://discuss.elastic.co/u/Cheroufa)\ **Replies:** 2\ **Last updated:** [March 1, 2022, 2:07pm UTC](https://discuss.elastic.co/t/iterat-list-on-watcher-elasticsearch/298100 "2022-03-01T14:07:43Z")
hi guys i want to iterat list of indices to add them to e-mail alert and to send for every index one -e-mail alert. action : "send\_email": { "foreach" : "ctx.payload.list", "email": { "profile": "standard", "prior… --- ## [Elastic 8.0.0 - Stack Monitoring - All nodes are listed as Master Nodes](https://discuss.elastic.co/t/elastic-8-0-0-stack-monitoring-all-nodes-are-listed-as-master-nodes/298260)
**Author:** [@AndreiRD](https://discuss.elastic.co/u/AndreiRD)\ **Replies:** 6\ **Last updated:** [March 1, 2022, 1:52pm UTC](https://discuss.elastic.co/t/elastic-8-0-0-stack-monitoring-all-nodes-are-listed-as-master-nodes/298260 "2022-03-01T13:52:26Z")
I just set Stack Monitoring with Metricbeat for an Elasticsearch 8.0 cluster and I noticed a weird thing: all nodes are reported as Master Nodes (see the star icon in the screenshot below). Any idea what I did wrong? --- ## [2nd Level Nested aggregation incorrect doc\_count](https://discuss.elastic.co/t/2nd-level-nested-aggregation-incorrect-doc-count/298515)
**Author:** [@Adam\_Whittaker](https://discuss.elastic.co/u/Adam_Whittaker)\ **Replies:** 0\ **Last updated:** [March 1, 2022, 1:38pm UTC](https://discuss.elastic.co/t/2nd-level-nested-aggregation-incorrect-doc-count/298515 "2022-03-01T13:38:16Z")
Hello, Can anyone point me to why the doc\_count on my 2nd nested aggregation is not correct? The count on the first aggregation is accurate but the 2nd isnt. { "size": 0, "\_source": false, "query": { "match\_… --- ## [What is the best way to manage an index for exact search and normal search](https://discuss.elastic.co/t/what-is-the-best-way-to-manage-an-index-for-exact-search-and-normal-search/298513)
**Author:** [@Leo\_Baby\_Jacob](https://discuss.elastic.co/u/Leo_Baby_Jacob)\ **Replies:** 0\ **Last updated:** [March 1, 2022, 1:28pm UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-manage-an-index-for-exact-search-and-normal-search/298513 "2022-03-01T13:28:36Z")
I have a use case where I need normal match\_all search i.e it shows me related documents with fuzzy results also, however I need a specific search which needs to do a term query. My mappings are mostly text type: "proj… --- ## [Using top\_hits in sql](https://discuss.elastic.co/t/using-top-hits-in-sql/298517)
**Author:** [@Nirf8](https://discuss.elastic.co/u/Nirf8)\ **Replies:** 0\ **Last updated:** [March 1, 2022, 1:42pm UTC](https://discuss.elastic.co/t/using-top-hits-in-sql/298517 "2022-03-01T13:42:54Z")
Hello, im using Elasticsearch sql to run aggregations on my data. What im trying to do is devide my data into buckets of time (using histogram) and then get the top docs of each bucket (using somthing similar to top\_hi… --- ## [Unable to install Fleet Server](https://discuss.elastic.co/t/unable-to-install-fleet-server/298516)
**Author:** [@Adrian\_Palka](https://discuss.elastic.co/u/Adrian_Palka)\ **Replies:** 0\ **Last updated:** [March 1, 2022, 1:39pm UTC](https://discuss.elastic.co/t/unable-to-install-fleet-server/298516 "2022-03-01T13:39:15Z")
Hi, I've got a problem with installing fleet server. Fleet server enrolls with no errors, but kibana it's stuck in "updating" state. I was trying to install it with my own ssl (in pem format), with quick start (insecur… --- ## [Problem with Kibana & Elasticsearch communication (TLS/SSL)](https://discuss.elastic.co/t/problem-with-kibana-elasticsearch-communication-tls-ssl/298509)
**Author:** [@WhenHeWhenHeAtThe](https://discuss.elastic.co/u/WhenHeWhenHeAtThe)\ **Replies:** 0\ **Last updated:** [March 1, 2022, 1:03pm UTC](https://discuss.elastic.co/t/problem-with-kibana-elasticsearch-communication-tls-ssl/298509 "2022-03-01T13:03:19Z")
Hello, I am trying to set up Elastic stack (Elasticsearch, Kibana, Logstash) to communicate with each other via SSL/TLS. I have installed Elasticsearch but I can't get Kibana to connect to it. I am getting following er… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1030) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1032)