# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1097 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1098 --- ## [Programmatically update Logstash configuration file](https://discuss.elastic.co/t/programmatically-update-logstash-configuration-file/294096)
**Author:** [@Matt\_Jones](https://discuss.elastic.co/u/Matt_Jones)\ **Replies:** 3\ **Last updated:** [January 12, 2022, 3:43pm UTC](https://discuss.elastic.co/t/programmatically-update-logstash-configuration-file/294096 "2022-01-12T15:43:58Z")
Hi, I would like to create multiple ingestion pipelines in Elastic Cloud, each of which containing a pipeline configuration (inputs, filters, outputs). Different pipelines are being created to support different custome… --- ## [Filebeat: Microsoft Module seems to be acquiring the same events for a period of time](https://discuss.elastic.co/t/filebeat-microsoft-module-seems-to-be-acquiring-the-same-events-for-a-period-of-time/294179)
**Author:** [@Log\_Gobbler](https://discuss.elastic.co/u/Log_Gobbler)\ **Replies:** 0\ **Last updated:** [January 12, 2022, 3:15pm UTC](https://discuss.elastic.co/t/filebeat-microsoft-module-seems-to-be-acquiring-the-same-events-for-a-period-of-time/294179 "2022-01-12T15:15:05Z")
I am testing the Filebeat Microsoft Module using the eicar test files from Download Anti Malware Testfile – Eicar. I download one of the files. Then, Windows Defender AV "prevents" the infection (and generates events fr… --- ## [Tsvb markdown with two different color table](https://discuss.elastic.co/t/tsvb-markdown-with-two-different-color-table/294054)
**Author:** [@Cap\_Ho](https://discuss.elastic.co/u/Cap_Ho)\ **Replies:** 3\ **Last updated:** [January 12, 2022, 3:05pm UTC](https://discuss.elastic.co/t/tsvb-markdown-with-two-different-color-table/294054 "2022-01-12T15:05:23Z")
Hello, I have a use case that i need to created two different bg color table in the same markdown. As i know markdown support class (so i may use class selector in css). But it seems that it don't work in Kibana tsvb ma… --- ## [\[logstash.outputsCould not index event to Elasticsearch."error {"type"=\>"mapper\_parsing\_exception", "reason"=\>"object mapping for \[host\] tried to parse field \[host\] as object, but found a concrete value"](https://discuss.elastic.co/t/logstash-outputscould-not-index-event-to-elasticsearch-error-type-mapper-parsing-exception-reason-object-mapping-for-host-tried-to-parse-field-host-as-object-but-found-a-concrete-value/294000)
**Author:** [@jannatnishat](https://discuss.elastic.co/u/jannatnishat)\ **Replies:** 3\ **Last updated:** [January 12, 2022, 2:18pm UTC](https://discuss.elastic.co/t/logstash-outputscould-not-index-event-to-elasticsearch-error-type-mapper-parsing-exception-reason-object-mapping-for-host-tried-to-parse-field-host-as-object-but-found-a-concrete-value/294000 "2022-01-12T14:18:38Z")
Getting this error \[2022-01-11T12:48:53,887\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main\]\[d60352f946d70780df98c56812b4beacd1633b0b5fb5d9c306d2c578620115b7\] Could not index event to Elasticsearch. {:status=\>400, :action=\>… --- ## [Data modelling to avoid reprocessing](https://discuss.elastic.co/t/data-modelling-to-avoid-reprocessing/293148)
**Author:** [@lunea](https://discuss.elastic.co/u/lunea)\ **Replies:** 1\ **Last updated:** [January 12, 2022, 1:58pm UTC](https://discuss.elastic.co/t/data-modelling-to-avoid-reprocessing/293148 "2022-01-12T13:58:56Z")
Hi team! I'm not experienced in Elasticsearch. I'm looking for a new technical solution to dashboard generation with filters and aggregations queries, so I decided to look at Elasticsearch. However, my data is composed… --- ## [Filebeat : Split the multiline json(array of json object) from message field to separate fields](https://discuss.elastic.co/t/filebeat-split-the-multiline-json-array-of-json-object-from-message-field-to-separate-fields/294134)
**Author:** [@Magesh\_02](https://discuss.elastic.co/u/Magesh_02)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 1:08pm UTC](https://discuss.elastic.co/t/filebeat-split-the-multiline-json-array-of-json-object-from-message-field-to-separate-fields/294134 "2022-01-12T13:08:05Z")
I need to use filebeat to push my json data into Elasticsearch, but I'm having trouble decoding my json fields into separate fields extracted from the message field. Filebeat version : 7.16.2 Filebeat.yml filebeat.inp… --- ## [To get the ingestion rate to elasticsearch cluster](https://discuss.elastic.co/t/to-get-the-ingestion-rate-to-elasticsearch-cluster/294156)
**Author:** [@Varun\_S](https://discuss.elastic.co/u/Varun_S)\ **Replies:** 1\ **Last updated:** [January 12, 2022, 12:45pm UTC](https://discuss.elastic.co/t/to-get-the-ingestion-rate-to-elasticsearch-cluster/294156 "2022-01-12T12:45:07Z")
Hi Team, We are deploying fluentd and Elasticsearch in the k8s environment, fluentd is sending data to Elasticsearch and we are monitoring Elasticsearch metrics using the Prometheus plugin. We want to calculate the inge… --- ## [Elastic Agent -\> Oracle Metrics / Oracle Logs via Filebeat to Logstash to Elasticsearch](https://discuss.elastic.co/t/elastic-agent-oracle-metrics-oracle-logs-via-filebeat-to-logstash-to-elasticsearch/294159)
**Author:** [@BoKu](https://discuss.elastic.co/u/BoKu)\ **Replies:** 0\ **Last updated:** [January 12, 2022, 12:18pm UTC](https://discuss.elastic.co/t/elastic-agent-oracle-metrics-oracle-logs-via-filebeat-to-logstash-to-elasticsearch/294159 "2022-01-12T12:18:25Z")
Hello, i am preparing to switch my beat infrastructure to Elastic-agent. I notices that there is no real integration for oracle-metrics, is that correct or what do i have to do to use oracle-metric-module within elastic… --- ## [Why there are always x.x.1 and x.x.2 under a minor version](https://discuss.elastic.co/t/why-there-are-always-x-x-1-and-x-x-2-under-a-minor-version/294128)
**Author:** [@JohnPhilip](https://discuss.elastic.co/u/JohnPhilip)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 11:42am UTC](https://discuss.elastic.co/t/why-there-are-always-x-x-1-and-x-x-2-under-a-minor-version/294128 "2022-01-12T11:42:32Z")
Hi, there, I'm curious about the release plan of Elasticsearch, it seems that there are always two version under a minor version, is it a convention or something? :rofl: --- ## [Metricbeat showing wrong usage of memory](https://discuss.elastic.co/t/metricbeat-showing-wrong-usage-of-memory/294147)
**Author:** [@lalchand\_rajak](https://discuss.elastic.co/u/lalchand_rajak)\ **Replies:** 0\ **Last updated:** [January 12, 2022, 11:11am UTC](https://discuss.elastic.co/t/metricbeat-showing-wrong-usage-of-memory/294147 "2022-01-12T11:11:10Z")
when I am using free -h command on server it's showing something else and metricbeat showing something else, attaching both snapshots. --- ## [Filebeat-\* index pattern Search Error in Discover](https://discuss.elastic.co/t/filebeat-index-pattern-search-error-in-discover/293264)
**Author:** [@mkay299](https://discuss.elastic.co/u/mkay299)\ **Replies:** 3\ **Last updated:** [January 12, 2022, 10:35am UTC](https://discuss.elastic.co/t/filebeat-index-pattern-search-error-in-discover/293264 "2022-01-12T10:35:36Z")
So I had some issues with my filebeat-\* index it wasn't updating on the new fields correctly so I deleted it and remade it. after I recreated it I get the following error in discovery. and none of the dashboards work a… --- ## [Unable to generate csv report from discover](https://discuss.elastic.co/t/unable-to-generate-csv-report-from-discover/293623)
**Author:** [@nfxitglobal](https://discuss.elastic.co/u/nfxitglobal)\ **Replies:** 1\ **Last updated:** [January 12, 2022, 10:27am UTC](https://discuss.elastic.co/t/unable-to-generate-csv-report-from-discover/293623 "2022-01-12T10:27:33Z")
Hi Pressing the generate csv report failing with the below error...any idea? Service Unavailable http\_fetch\_error\_HttpFetchError@http://localhost:5601/46307/bundles/core/core.entry.js:8:52683 fetchResponse@http://loca… --- ## [Shipping logs of system Linux with Filebeat and Logstash](https://discuss.elastic.co/t/shipping-logs-of-system-linux-with-filebeat-and-logstash/294137)
**Author:** [@Lynow](https://discuss.elastic.co/u/Lynow)\ **Replies:** 0\ **Last updated:** [January 12, 2022, 9:35am UTC](https://discuss.elastic.co/t/shipping-logs-of-system-linux-with-filebeat-and-logstash/294137 "2022-01-12T09:35:05Z")
Hello, I am setting up a log monitoring architecture, for this I am using Opensearch and Kibana to collect all the data. The data is sent by Filebeat, which retrieves the logs from Wazuh (with different agents). I then… --- ## [Stats aggregation on latitude or longitude of a geo\_point](https://discuss.elastic.co/t/stats-aggregation-on-latitude-or-longitude-of-a-geo-point/294070)
**Author:** [@seb\_2](https://discuss.elastic.co/u/seb_2)\ **Replies:** 4\ **Last updated:** [January 12, 2022, 9:30am UTC](https://discuss.elastic.co/t/stats-aggregation-on-latitude-or-longitude-of-a-geo-point/294070 "2022-01-12T09:30:01Z")
Hi I use geo\_point data and I'd like to have stats aggregation on latitude. like "aggs": { "lat": { "avg": { "field": "location.lat" } }, where location is a geo\_… --- ## [Kibana 8.0.0-alpha1](https://discuss.elastic.co/t/kibana-8-0-0-alpha1/293872)
**Author:** [@Abhishek\_Gautam](https://discuss.elastic.co/u/Abhishek_Gautam)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 9:20am UTC](https://discuss.elastic.co/t/kibana-8-0-0-alpha1/293872 "2022-01-12T09:20:51Z")
When installing dependencies for kibana using command : yarn kbn bootstrap --force-install getting the following error: succ yarn.lock analysis completed without any issues \[vscode\] succ updated /home/elastic/Abhishe… --- ## [Different Values in Kibana Table from Kibana Discover](https://discuss.elastic.co/t/different-values-in-kibana-table-from-kibana-discover/294051)
**Author:** [@Avnish\_Singh](https://discuss.elastic.co/u/Avnish_Singh)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 9:19am UTC](https://discuss.elastic.co/t/different-values-in-kibana-table-from-kibana-discover/294051 "2022-01-12T09:19:05Z")
Hi, I am getting a deviation in values in Kibana Visualize and Kibana Discover. Here is the screenshot for the value on 01-01-2022 00:00:00 The value on 02-01-2022 00:00:00 While in the Visualization they do not… --- ## [Elasticsearch integration tests with Jest](https://discuss.elastic.co/t/elasticsearch-integration-tests-with-jest/294064)
**Author:** [@kabethy](https://discuss.elastic.co/u/kabethy)\ **Replies:** 3\ **Last updated:** [January 12, 2022, 9:14am UTC](https://discuss.elastic.co/t/elasticsearch-integration-tests-with-jest/294064 "2022-01-12T09:14:24Z")
Hi, I am using Elasticsearch (Opensearch) in a Nx monorepo in a node js serverless app that connects to aws services. I would like to use jest to test but so far I have not been able to get responses from Opensearch. … --- ## [Customization winlogbeat 7.16.2 on windows server](https://discuss.elastic.co/t/customization-winlogbeat-7-16-2-on-windows-server/294110)
**Author:** [@holpa](https://discuss.elastic.co/u/holpa)\ **Replies:** 0\ **Last updated:** [January 12, 2022, 5:28am UTC](https://discuss.elastic.co/t/customization-winlogbeat-7-16-2-on-windows-server/294110 "2022-01-12T05:28:01Z")
Hello. Tell me how to set it up correctly. There is a server srvlog, it collects all logs from domain controllers (forward event). How to configure WinLogbeat to send logs received by this server? My config now: winlo… --- ## [About filebeat config error](https://discuss.elastic.co/t/about-filebeat-config-error/294119)
**Author:** [@yanwencheng](https://discuss.elastic.co/u/yanwencheng)\ **Replies:** 0\ **Last updated:** [January 12, 2022, 8:03am UTC](https://discuss.elastic.co/t/about-filebeat-config-error/294119 "2022-01-12T08:03:08Z")
filebeat config setup.kibana.then setup i get console error sudo filebeat setup Index setup finished. Loading dashboards (Kibana must be running and reachable) Exiting: error connecting to Kibana: fail to get the Kibana… --- ## [How to schedule the execution of an update\_by\_query painless script in a cluster](https://discuss.elastic.co/t/how-to-schedule-the-execution-of-an-update-by-query-painless-script-in-a-cluster/294089)
**Author:** [@Rui\_Goncalves](https://discuss.elastic.co/u/Rui_Goncalves)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 8:23am UTC](https://discuss.elastic.co/t/how-to-schedule-the-execution-of-an-update-by-query-painless-script-in-a-cluster/294089 "2022-01-12T08:23:31Z")
I need to schedule the execution of an update\_by\_query painless script so that it gets executed in the current Primary shard of the cluster regardless of the nodes of the script that might me down. I think that Kibana co… --- ## [Search\_phase\_execution\_exception error: rejected execution of org.elasticsearch.common.util.concurrent.TimedRunnable@ on QueueResizingEsThreadPoolExecutor](https://discuss.elastic.co/t/search-phase-execution-exception-error-rejected-execution-of-org-elasticsearch-common-util-concurrent-timedrunnable-on-queueresizingesthreadpoolexecutor/294008)
**Author:** [@bugb](https://discuss.elastic.co/u/bugb)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 8:18am UTC](https://discuss.elastic.co/t/search-phase-execution-exception-error-rejected-execution-of-org-elasticsearch-common-util-concurrent-timedrunnable-on-queueresizingesthreadpoolexecutor/294008 "2022-01-12T08:18:08Z")
Sometimes I got this error from my client node, is there any ideas to fix this? search\_phase\_execution\_exception: \\n at onBody (/var/server/app/node\_modules/es7/lib/Transport.js:367:23)\\n at IncomingMessage.onEnd … --- ## [Unable to log into embedded Kibana anonymously](https://discuss.elastic.co/t/unable-to-log-into-embedded-kibana-anonymously/291797)
**Author:** [@Arrick](https://discuss.elastic.co/u/Arrick)\ **Replies:** 10\ **Last updated:** [January 12, 2022, 7:59am UTC](https://discuss.elastic.co/t/unable-to-log-into-embedded-kibana-anonymously/291797 "2022-01-12T07:59:26Z")
I tried to embed Kibana into a webpage but was unable to login as they kept bringing me back to the login page. So I decided to take a different approach and allow user to log in anonymously. I create an API-Key and li… --- ## [Kibana iframe error](https://discuss.elastic.co/t/kibana-iframe-error/293997)
**Author:** [@yanwencheng](https://discuss.elastic.co/u/yanwencheng)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 7:58am UTC](https://discuss.elastic.co/t/kibana-iframe-error/293997 "2022-01-12T07:58:32Z")
i set xpack.security.sameSiteCookies: "None" Error when accessing kibana Logging in with provider "basic" (basic) log \[17:00:29.269\] \[error\]\[http\] Error: "SameSite: None" requires Secure connection at validateO… --- ## [Google Tag Manager](https://discuss.elastic.co/t/google-tag-manager/294117)
**Author:** [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Replies:** 0\ **Last updated:** [January 12, 2022, 7:10am UTC](https://discuss.elastic.co/t/google-tag-manager/294117 "2022-01-12T07:10:01Z")
Dears, Does anyone added GTM to Kibana or a custom plugin of Kibana to get some tracking informations ? Thank You --- ## [Logstash is terminating](https://discuss.elastic.co/t/logstash-is-terminating/294001)
**Author:** [@HELIXInternational](https://discuss.elastic.co/u/HELIXInternational)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 6:37am UTC](https://discuss.elastic.co/t/logstash-is-terminating/294001 "2022-01-12T06:37:09Z")
We upgraded the logstash from7.7.0 to 7.16.2, after upgrade the pipeline service is terminating. Can you please help on this. Config file: powershell .\\bin\\logstash -f config\\harvester-pipeline.conf --… --- ## [Unable to restore snapshots after reinstalling elk](https://discuss.elastic.co/t/unable-to-restore-snapshots-after-reinstalling-elk/294102)
**Author:** [@Johan\_Jesse](https://discuss.elastic.co/u/Johan_Jesse)\ **Replies:** 3\ **Last updated:** [January 12, 2022, 4:33am UTC](https://discuss.elastic.co/t/unable-to-restore-snapshots-after-reinstalling-elk/294102 "2022-01-12T04:33:57Z")
Hello Team- We have tried to update our current ELK from 7.4.0 to 7.16.0, after creating a snapshot from Kibana. However, we were unable to do so. So, we have uninstalled Elasticsearch from all our 6 nodes (which were i… --- ## [Curator: filtertype: allocated a empty key](https://discuss.elastic.co/t/curator-filtertype-allocated-a-empty-key/294100)
**Author:** [@danielmotaleite](https://discuss.elastic.co/u/danielmotaleite)\ **Replies:** 0\ **Last updated:** [January 12, 2022, 2:43am UTC](https://discuss.elastic.co/t/curator-filtertype-allocated-a-empty-key/294100 "2022-01-12T02:43:22Z")
Hi i have this code: - filtertype: allocated key: role value: null allocation\_type: require exclude: True But this fails (complains that value is required), i'm trying to exclude index that… --- ## [Functionbeat 7.16.2 parses quoted strings with periods as objects](https://discuss.elastic.co/t/functionbeat-7-16-2-parses-quoted-strings-with-periods-as-objects/294097)
**Author:** [@cafuego](https://discuss.elastic.co/u/cafuego)\ **Replies:** 0\ **Last updated:** [January 12, 2022, 1:16am UTC](https://discuss.elastic.co/t/functionbeat-7-16-2-parses-quoted-strings-with-periods-as-objects/294097 "2022-01-12T01:16:44Z")
We maintain a set of billing tags on our AWS resources that are prefixed with "cost.". The 7.16.2 version of functionbeat errors out on those tags, despite me quoting the tag strings in the yaml file, it interprets them … --- ## [Load index template for beats upgrade](https://discuss.elastic.co/t/load-index-template-for-beats-upgrade/294078)
**Author:** [@Dennis\_Qian](https://discuss.elastic.co/u/Dennis_Qian)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 1:08am UTC](https://discuss.elastic.co/t/load-index-template-for-beats-upgrade/294078 "2022-01-12T01:08:35Z")
I need to upgrade filebeat 6.8 to 7.16 and winlogbeat 6.3 to 7.16. After reading the upgrade guide, my understanding is that I need to upgrade winlogbeat to 6.8 first, then load index template. However our beats output … --- ## [File Input, just one file, with one line that is updated every 5 minutes](https://discuss.elastic.co/t/file-input-just-one-file-with-one-line-that-is-updated-every-5-minutes/294074)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [January 11, 2022, 11:56pm UTC](https://discuss.elastic.co/t/file-input-just-one-file-with-one-line-that-is-updated-every-5-minutes/294074 "2022-01-11T23:56:05Z")
Hi, I need to read from logstash one file: number\_of\_connections.txt this file is updated every 5 minutes with a new number, so no new lines are added. can I do this with file input? if not is there another input that … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1096) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1098)