# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1149 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1150 --- ## [Logstash complex IF condition](https://discuss.elastic.co/t/logstash-complex-if-condition/290047)
**Author:** [@Jan\_Kabelka](https://discuss.elastic.co/u/Jan_Kabelka)\ **Replies:** 3\ **Last updated:** [November 26, 2021, 4:17pm UTC](https://discuss.elastic.co/t/logstash-complex-if-condition/290047 "2021-11-26T16:17:23Z")
Dear, would you know how to write complex IF condition on Logstash? I would like to add new tag once two fields have different values, except of some combinations of them. What works: if \[event\]\[code\] == "1" and \[proces… --- ## [Auditbeat+logstash+splunk](https://discuss.elastic.co/t/auditbeat-logstash-splunk/290310)
**Author:** [@alejandromariani](https://discuss.elastic.co/u/alejandromariani)\ **Replies:** 0\ **Last updated:** [November 26, 2021, 4:01pm UTC](https://discuss.elastic.co/t/auditbeat-logstash-splunk/290310 "2021-11-26T16:01:53Z")
Good afternoon, I am working on an integration between auditbeat + logstash + splunk I have my auditbeat configuration from one of my nodes, pointing to my logstash cat auditbeat.yml ###################### Auditbeat … --- ## [Metricbeat stack monitoring : i/o timeout when connecting to the same node](https://discuss.elastic.co/t/metricbeat-stack-monitoring-i-o-timeout-when-connecting-to-the-same-node/290307)
**Author:** [@preetish\_P](https://discuss.elastic.co/u/preetish_P)\ **Replies:** 0\ **Last updated:** [November 26, 2021, 3:51pm UTC](https://discuss.elastic.co/t/metricbeat-stack-monitoring-i-o-timeout-when-connecting-to-the-same-node/290307 "2021-11-26T15:51:55Z")
Hi guys, I am trying to setup Stack monitoring using metricbeat to move away from legacy collection. We run on v7.11.2 and RHEL7 with below setup: node 1: Elasticsearch, logstash, kibana node 2: Elasticsearch node 3:… --- ## [Aggregation string response to get buckets](https://discuss.elastic.co/t/aggregation-string-response-to-get-buckets/290306)
**Author:** [@silviya](https://discuss.elastic.co/u/silviya)\ **Replies:** 0\ **Last updated:** [November 26, 2021, 3:35pm UTC](https://discuss.elastic.co/t/aggregation-string-response-to-get-buckets/290306 "2021-11-26T15:35:38Z")
Hi , I have a aggregation response in the format of string . i need to get the bucket counts . Is this possible to get bucket counts from string without taking from search response please help! Thanks in advance --- ## [Filebeat multiline matching Docker log](https://discuss.elastic.co/t/filebeat-multiline-matching-docker-log/290301)
**Author:** [@exactlyaron](https://discuss.elastic.co/u/exactlyaron)\ **Replies:** 0\ **Last updated:** [November 26, 2021, 3:02pm UTC](https://discuss.elastic.co/t/filebeat-multiline-matching-docker-log/290301 "2021-11-26T15:02:18Z")
Hello, After a bit of assistance with multiline pattern matching. I'm using filebeat autodiscover Docker provider which is fine sending the logs to logstash, but pattern matching on timestamp doesn't seem to be working… --- ## [NEST vs Elastic query inconsistency](https://discuss.elastic.co/t/nest-vs-elastic-query-inconsistency/290282)
**Author:** [@Perrow](https://discuss.elastic.co/u/Perrow)\ **Replies:** 1\ **Last updated:** [November 26, 2021, 2:03pm UTC](https://discuss.elastic.co/t/nest-vs-elastic-query-inconsistency/290282 "2021-11-26T14:03:19Z")
I'm updating an application that used Elastic 1.6 to version 7.15. I've gotten indexing to work and some searching but for some reason filters aren't working. The queries are built dynamically and I think I've managed to… --- ## [Extracting a tag from an XML file using RSS input filter](https://discuss.elastic.co/t/extracting-a-tag-from-an-xml-file-using-rss-input-filter/289137)
**Author:** [@Franke2u](https://discuss.elastic.co/u/Franke2u)\ **Replies:** 6\ **Last updated:** [November 26, 2021, 1:30pm UTC](https://discuss.elastic.co/t/extracting-a-tag-from-an-xml-file-using-rss-input-filter/289137 "2021-11-26T13:30:56Z")
On Logstash the RSS input filter is not getting the 'enclosure' or 'subtitle' items below. How do I force those items to be logged? \ Day https://year/day Sat, 13 Nov 2021 Fo… --- ## [I would like to add new date range picker in kibana dashboard, my kibana setup is in developement mode in ubuntu 16.04](https://discuss.elastic.co/t/i-would-like-to-add-new-date-range-picker-in-kibana-dashboard-my-kibana-setup-is-in-developement-mode-in-ubuntu-16-04/289264)
**Author:** [@Swapnil\_Jadhav](https://discuss.elastic.co/u/Swapnil_Jadhav)\ **Replies:** 4\ **Last updated:** [November 26, 2021, 11:40am UTC](https://discuss.elastic.co/t/i-would-like-to-add-new-date-range-picker-in-kibana-dashboard-my-kibana-setup-is-in-developement-mode-in-ubuntu-16-04/289264 "2021-11-26T11:40:25Z")
Anyone knows that can help me to add this.. Thanks in advanced --- ## [Filebeat Installation Error on Linux](https://discuss.elastic.co/t/filebeat-installation-error-on-linux/290279)
**Author:** [@SuhailRumane](https://discuss.elastic.co/u/SuhailRumane)\ **Replies:** 0\ **Last updated:** [November 26, 2021, 11:30am UTC](https://discuss.elastic.co/t/filebeat-installation-error-on-linux/290279 "2021-11-26T11:30:55Z")
Hi Team, We are getting below error while running the filebeat in our RHEL 7 server. 2021-11-24T03:12:49.750-0600 ERROR \[Elasticsearch\] Elasticsearch/client.go:224 failed to perform any bulk index operations: 500 Inter… --- ## [Kibana error for theme validation](https://discuss.elastic.co/t/kibana-error-for-theme-validation/289878)
**Author:** [@DPattee](https://discuss.elastic.co/u/DPattee)\ **Replies:** 1\ **Last updated:** [November 26, 2021, 11:19am UTC](https://discuss.elastic.co/t/kibana-error-for-theme-validation/289878 "2021-11-26T11:19:14Z")
I just noticed that my kibana log is full of 'failed validation' errors... like zillions of them: log \[11:21:26.836\] \[warning\]\[ui-settings-service\] Ignore invalid UiSettings value. Error: \[validation \[theme:version\]\]… --- ## [Pie chart with filtering](https://discuss.elastic.co/t/pie-chart-with-filtering/290271)
**Author:** [@thenotoriousciu](https://discuss.elastic.co/u/thenotoriousciu)\ **Replies:** 3\ **Last updated:** [November 26, 2021, 11:14am UTC](https://discuss.elastic.co/t/pie-chart-with-filtering/290271 "2021-11-26T11:14:30Z")
Hello, everyone. I am trying to create a pie-chart based on the below data, but I am pretty sure that it can only be don with Vega, not with a regular pie-chart. However, I thought I could ask this question, see if anyo… --- ## [Unable to search for phrases between double quotes in Saved Objects Explorer](https://discuss.elastic.co/t/unable-to-search-for-phrases-between-double-quotes-in-saved-objects-explorer/288561)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [November 26, 2021, 11:12am UTC](https://discuss.elastic.co/t/unable-to-search-for-phrases-between-double-quotes-in-saved-objects-explorer/288561 "2021-11-26T11:12:13Z")
Hello, It seems it's no longer possible to search for objects in the Saved Objects Explorer with multiple words between double quotes. The result is that it's very hard to find some objects... For example searching for… --- ## [In canvas, how do I get the content of one chart and use it in another chart?](https://discuss.elastic.co/t/in-canvas-how-do-i-get-the-content-of-one-chart-and-use-it-in-another-chart/288198)
**Author:** [@li\_li](https://discuss.elastic.co/u/li_li)\ **Replies:** 1\ **Last updated:** [November 26, 2021, 11:02am UTC](https://discuss.elastic.co/t/in-canvas-how-do-i-get-the-content-of-one-chart-and-use-it-in-another-chart/288198 "2021-11-26T11:02:53Z")
Hello, I have a question to ask, how does canvas get the content in the inserted chart? As shown below, in canvas, how do I get the ordinate A of this bar graph and apply it to another graph? --- ## [When writing to ES and get 400 status code, can you get the original log message?](https://discuss.elastic.co/t/when-writing-to-es-and-get-400-status-code-can-you-get-the-original-log-message/290239)
**Author:** [@zcola](https://discuss.elastic.co/u/zcola)\ **Replies:** 1\ **Last updated:** [November 26, 2021, 10:54am UTC](https://discuss.elastic.co/t/when-writing-to-es-and-get-400-status-code-can-you-get-the-original-log-message/290239 "2021-11-26T10:54:49Z")
{:status=\>400, :action=\>\["index", {:\_id=\>nil, :\_index=\>"monitor3\_api\_logtail\_write", :\_type=\>"logs", :routing=\>nil}, #\\], :response=\>{"index"=\>{"\_index"=\>"monitor3\_api\_logtail-2021.11.25-00068… --- ## [Markdown link removed?](https://discuss.elastic.co/t/markdown-link-removed/290134)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 2\ **Last updated:** [November 26, 2021, 10:51am UTC](https://discuss.elastic.co/t/markdown-link-removed/290134 "2021-11-26T10:51:51Z")
Hi, I've always used Text element in Canvas with this markdown: creating a link on Canvas. In this way I could have a link "panel". Now this doesn't work anymore. I have to put always a text inside square brackets..… --- ## [To change Label Position](https://discuss.elastic.co/t/to-change-label-position/290238)
**Author:** [@SwetaD](https://discuss.elastic.co/u/SwetaD)\ **Replies:** 4\ **Last updated:** [November 26, 2021, 10:36am UTC](https://discuss.elastic.co/t/to-change-label-position/290238 "2021-11-26T10:36:51Z")
Can someone please help on how to change the Label Position from bottom to top? ONU ALIAS to be on top instead of bottom. Using Kibana v7.10.0 --- ## [How to use Filebeat Traefik module with Docker?](https://discuss.elastic.co/t/how-to-use-filebeat-traefik-module-with-docker/290272)
**Author:** [@bluepuma77](https://discuss.elastic.co/u/bluepuma77)\ **Replies:** 0\ **Last updated:** [November 26, 2021, 10:28am UTC](https://discuss.elastic.co/t/how-to-use-filebeat-traefik-module-with-docker/290272 "2021-11-26T10:28:26Z")
I am using Filebeat with Docker autodiscover. I added the Filebeat Traefik module to the config and it works fine when parsing access logs from the filesystem. My challenge is that Traefik does not do log roll-over. fil… --- ## [Netflow Enrich basic](https://discuss.elastic.co/t/netflow-enrich-basic/289303)
**Author:** [@randomguy](https://discuss.elastic.co/u/randomguy)\ **Replies:** 1\ **Last updated:** [November 26, 2021, 10:18am UTC](https://discuss.elastic.co/t/netflow-enrich-basic/289303 "2021-11-26T10:18:18Z")
Hi, I started to learn more about neflow in my home lab but soon realized the Filebeat Netflow module is a bit too simple. The short question: is there an easy way to enrich netflow data from filebeat? I think they ca… --- ## [Logstash file input path options](https://discuss.elastic.co/t/logstash-file-input-path-options/290269)
**Author:** [@mangesh\_shinde](https://discuss.elastic.co/u/mangesh_shinde)\ **Replies:** 0\ **Last updated:** [November 26, 2021, 10:10am UTC](https://discuss.elastic.co/t/logstash-file-input-path-options/290269 "2021-11-26T10:10:07Z")
I have two subfolders under the parent folder naming like platform\* i want to specify path option like that in parent folder whichever subfolder start with platform should be the path for .csv file --- ## [How can I take dump of freeze index?](https://discuss.elastic.co/t/how-can-i-take-dump-of-freeze-index/290268)
**Author:** [@Sage](https://discuss.elastic.co/u/Sage)\ **Replies:** 0\ **Last updated:** [November 26, 2021, 10:05am UTC](https://discuss.elastic.co/t/how-can-i-take-dump-of-freeze-index/290268 "2021-11-26T10:05:50Z")
Hi, I am facing an issue with elasticdump. I want to take dump of all index in which some of freeze indices but getting issue with freeze index. Can anyone tell me is possible to take dump of freeze index? --- ## [400 bad request error](https://discuss.elastic.co/t/400-bad-request-error/290265)
**Author:** [@Keerthana\_Paga](https://discuss.elastic.co/u/Keerthana_Paga)\ **Replies:** 1\ **Last updated:** [November 26, 2021, 9:56am UTC](https://discuss.elastic.co/t/400-bad-request-error/290265 "2021-11-26T09:56:49Z")
root@:/etc/kibana# curl -IL localhost:5601 HTTP/1.1 302 Found location: /spaces/enter kbn-name: kbn-license-sig: cache-control: private, no-cache, no-store, must-revalidate content-length: 0 Date: Fri, 26 Nov 2021… --- ## [Creating Bar Chart with missing values on the x axis](https://discuss.elastic.co/t/creating-bar-chart-with-missing-values-on-the-x-axis/288967)
**Author:** [@bodach](https://discuss.elastic.co/u/bodach)\ **Replies:** 1\ **Last updated:** [November 26, 2021, 10:02am UTC](https://discuss.elastic.co/t/creating-bar-chart-with-missing-values-on-the-x-axis/288967 "2021-11-26T10:02:31Z")
Hello, I created a bar chart for different companies using a dropdown filter. I want to see all the values there even if they dont have any related values for that column. To give an example. This is showing all the v… --- ## [How to manage filebeat logging?](https://discuss.elastic.co/t/how-to-manage-filebeat-logging/290264)
**Author:** [@Priya2](https://discuss.elastic.co/u/Priya2)\ **Replies:** 0\ **Last updated:** [November 26, 2021, 9:54am UTC](https://discuss.elastic.co/t/how-to-manage-filebeat-logging/290264 "2021-11-26T09:54:31Z")
I want to roll the os-filebeat-out.log, my Logging section in filebeat.yml looks like: logging.level: info logging.to\_files: true logging.files: path: /path/filebeat-7.14.1-linux-x86\_64 name: os-filebeat-out.… --- ## [How to aggregate sub documents](https://discuss.elastic.co/t/how-to-aggregate-sub-documents/290184)
**Author:** [@Aleem\_Ktk](https://discuss.elastic.co/u/Aleem_Ktk)\ **Replies:** 2\ **Last updated:** [November 26, 2021, 9:47am UTC](https://discuss.elastic.co/t/how-to-aggregate-sub-documents/290184 "2021-11-26T09:47:09Z")
I have sub documents in the main document , below is the format: "activities:\[ { "code": "CODE1", "price":20 }, { "code": "CODE2", "price":24 } \] I want to sum the price group by code. However, the term aggreg… --- ## [Return latency\_info.keyword in a Watcher for Kibana elasticsearch](https://discuss.elastic.co/t/return-latency-info-keyword-in-a-watcher-for-kibana-elasticsearch/290261)
**Author:** [@Aitor\_MtzAm](https://discuss.elastic.co/u/Aitor_MtzAm)\ **Replies:** 0\ **Last updated:** [November 26, 2021, 9:43am UTC](https://discuss.elastic.co/t/return-latency-info-keyword-in-a-watcher-for-kibana-elasticsearch/290261 "2021-11-26T09:43:40Z")
Hello! I am really a little newbie in Elasticsearch. I need help returning the latency\_info.keyword field. I am setting up a wathcer for an API and I need a webhook in teams to show me that field. I have this created: "… --- ## [Netflow input and output](https://discuss.elastic.co/t/netflow-input-and-output/289974)
**Author:** [@btjtaylor](https://discuss.elastic.co/u/btjtaylor)\ **Replies:** 2\ **Last updated:** [November 26, 2021, 9:29am UTC](https://discuss.elastic.co/t/netflow-input-and-output/289974 "2021-11-26T09:29:03Z")
Hi all I need to receive netflow data and output it to multiple destinations (just testing with single destination for now) Im running logstash 7.15.2 under windows I made the following logstash config file but it cra… --- ## [Missing documents after elastic restart](https://discuss.elastic.co/t/missing-documents-after-elastic-restart/290210)
**Author:** [@adminunix](https://discuss.elastic.co/u/adminunix)\ **Replies:** 5\ **Last updated:** [November 26, 2021, 9:28am UTC](https://discuss.elastic.co/t/missing-documents-after-elastic-restart/290210 "2021-11-26T09:28:16Z")
Hello, I have had a strange issue. An index has lost many documents and the elastic logs doesn´t show any message about it. These are monitoring visualizations about the index: I have noticed this issue after res… --- ## [Constructing a FunctionScoreQuery using NEST](https://discuss.elastic.co/t/constructing-a-functionscorequery-using-nest/290251)
**Author:** [@whisperingchild](https://discuss.elastic.co/u/whisperingchild)\ **Replies:** 1\ **Last updated:** [November 26, 2021, 8:54am UTC](https://discuss.elastic.co/t/constructing-a-functionscorequery-using-nest/290251 "2021-11-26T08:54:42Z")
I want to construct a query equivalent to the following JSON { "function\_score": { "script\_score": { "script": "doc\['some-field'\].value" } } } However, when I use the following code var q = new Funct… --- ## [Match with dynamic synonyms with Fasttext vectors](https://discuss.elastic.co/t/match-with-dynamic-synonyms-with-fasttext-vectors/290252)
**Author:** [@gevezex](https://discuss.elastic.co/u/gevezex)\ **Replies:** 0\ **Last updated:** [November 26, 2021, 8:10am UTC](https://discuss.elastic.co/t/match-with-dynamic-synonyms-with-fasttext-vectors/290252 "2021-11-26T08:10:21Z")
In my backend application I want to catch the search keywords of a user and find all synonyms with fasttext before passing it to es. So the idea is as follow: search terms of user: "couch fabric" fasttext will return: … --- ## [How many logstash can connect to elasticsearch cluster?](https://discuss.elastic.co/t/how-many-logstash-can-connect-to-elasticsearch-cluster/290242)
**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Replies:** 1\ **Last updated:** [November 26, 2021, 7:43am UTC](https://discuss.elastic.co/t/how-many-logstash-can-connect-to-elasticsearch-cluster/290242 "2021-11-26T07:43:01Z")
we have logstash with 4 pipeline and each pipeline.worker is set to 120 and Elasticsearch cluster has 6 data nodes.(c5.9xlarge) we are facing high cpu usage in Elasticsearch data nodes when we have more than 10 logstash… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1148) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1150)