# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1153 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1154 --- ## [Run logstash on windows -\>\> errors](https://discuss.elastic.co/t/run-logstash-on-windows-errors/289987)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 2\ **Last updated:** [November 23, 2021, 9:39pm UTC](https://discuss.elastic.co/t/run-logstash-on-windows-errors/289987 "2021-11-23T21:39:53Z")
Hi I need to check the performance one of my logstash conf. Therefore I've decided to install logstash on windows the new one instance as standalone. After that I've set the variable env. At least I got the error. BTW. … --- ## [Wildcard search in field doesn't work as expected](https://discuss.elastic.co/t/wildcard-search-in-field-doesnt-work-as-expected/289365)
**Author:** [@lchan](https://discuss.elastic.co/u/lchan)\ **Replies:** 2\ **Last updated:** [November 23, 2021, 9:14pm UTC](https://discuss.elastic.co/t/wildcard-search-in-field-doesnt-work-as-expected/289365 "2021-11-23T21:14:42Z")
Hi all, I am on 7.13.1 on ElasticCloud. I mapped hostname via Logstash with syslog but for some reason the KQL search doesn't come out right. What am I doing wrong? search: hostname: cr1-ams1 Result: cr1-ams1 cr2-… --- ## [How does the new (7.14+) GeoIP Processor Work?](https://discuss.elastic.co/t/how-does-the-new-7-14-geoip-processor-work/289957)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 4\ **Last updated:** [November 23, 2021, 6:00pm UTC](https://discuss.elastic.co/t/how-does-the-new-7-14-geoip-processor-work/289957 "2021-11-23T18:00:24Z")
Hi, In 7.14+ Elasticsearch enabled the GeoIP downloader and made the DB reloadable. But I was wondering how does this actually work. Looking at the docs, it seems like all this process does now is download the DB file, … --- ## [Packetbeat - full URL on HTTPS traffic?](https://discuss.elastic.co/t/packetbeat-full-url-on-https-traffic/289945)
**Author:** [@EdgeSync](https://discuss.elastic.co/u/EdgeSync)\ **Replies:** 1\ **Last updated:** [November 23, 2021, 5:20pm UTC](https://discuss.elastic.co/t/packetbeat-full-url-on-https-traffic/289945 "2021-11-23T17:20:24Z")
Is it possible to get the full URL from HTTPS traffic. I would like to be able to view the full URI that a client is attempting to access. e.g. https://myserver.com/some\_part/this\_file.exe I have packetbeat monitoring… --- ## [Elastic-Agent healthy but sends no logs](https://discuss.elastic.co/t/elastic-agent-healthy-but-sends-no-logs/289742)
**Author:** [@jobr97](https://discuss.elastic.co/u/jobr97)\ **Replies:** 2\ **Last updated:** [November 23, 2021, 5:04pm UTC](https://discuss.elastic.co/t/elastic-agent-healthy-but-sends-no-logs/289742 "2021-11-23T17:04:24Z")
Hi, Im trying to use Elastic Agent on my Windows 10 machine. I have sucessfully enrolled the machine and can see it marked as healty in the agent overview. However there is no log data delivered from the agent and also … --- ## [Kibana Field Formatting : Display Limited Decimal Points For Number Field Type](https://discuss.elastic.co/t/kibana-field-formatting-display-limited-decimal-points-for-number-field-type/289792)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 2\ **Last updated:** [November 23, 2021, 4:30pm UTC](https://discuss.elastic.co/t/kibana-field-formatting-display-limited-decimal-points-for-number-field-type/289792 "2021-11-23T16:30:45Z")
I have a number field and I want to change the color of it. I am using Kibana field formatting. While changing color, I am unable to find a way to limit the decimal points to 5 digits. For example 2.62386 Can anyone h… --- ## [Canvas Timefilter not allowing me to select a time range](https://discuss.elastic.co/t/canvas-timefilter-not-allowing-me-to-select-a-time-range/287165)
**Author:** [@hNiven](https://discuss.elastic.co/u/hNiven)\ **Replies:** 8\ **Last updated:** [November 23, 2021, 4:05pm UTC](https://discuss.elastic.co/t/canvas-timefilter-not-allowing-me-to-select-a-time-range/287165 "2021-11-23T16:05:12Z")
Hi, This is an issue that has just happened recently and I am on v7.9.1. When I try and select a time range on my canvas workpad using the Timefilter, the dropdown with the range of values does not appear. All I can do … --- ## [Query a result set from another query](https://discuss.elastic.co/t/query-a-result-set-from-another-query/289964)
**Author:** [@antonkallenberg](https://discuss.elastic.co/u/antonkallenberg)\ **Replies:** 0\ **Last updated:** [November 23, 2021, 3:46pm UTC](https://discuss.elastic.co/t/query-a-result-set-from-another-query/289964 "2021-11-23T15:46:32Z")
Hi, Is it possible to query a result set from another query? Example List all employees by organization with ID #1 \> returns 10 employees. From those 10 employees \> List all employees working at department with ID #1 … --- ## [Unable to read two json](https://discuss.elastic.co/t/unable-to-read-two-json/289963)
**Author:** [@Fosco](https://discuss.elastic.co/u/Fosco)\ **Replies:** 0\ **Last updated:** [November 23, 2021, 3:34pm UTC](https://discuss.elastic.co/t/unable-to-read-two-json/289963 "2021-11-23T15:34:40Z")
Hello, I have a python file that is executed by logstash and which prints a json composed of two different data sources, the problem is that logstash only reads the first part. I tried to change the order and nothing cha… --- ## [Highlights not matching between annotated\_text and other fields](https://discuss.elastic.co/t/highlights-not-matching-between-annotated-text-and-other-fields/289937)
**Author:** [@evoluc](https://discuss.elastic.co/u/evoluc)\ **Replies:** 4\ **Last updated:** [November 23, 2021, 3:26pm UTC](https://discuss.elastic.co/t/highlights-not-matching-between-annotated-text-and-other-fields/289937 "2021-11-23T15:26:06Z")
Executing a query\_string search on an index the returned matched highlights sometimes don't really match (this is needed to get the annotated metadata). From what I've seen there is not much support for this kind of feat… --- ## [Groupby Unique values in Kibana KQL](https://discuss.elastic.co/t/groupby-unique-values-in-kibana-kql/289915)
**Author:** [@Hamzah](https://discuss.elastic.co/u/Hamzah)\ **Replies:** 3\ **Last updated:** [November 23, 2021, 2:33pm UTC](https://discuss.elastic.co/t/groupby-unique-values-in-kibana-kql/289915 "2021-11-23T14:33:10Z")
Hi, I was just wondering if we can use kibana KQL to groupby a certain field. Let say we applied a search in which we want to see who is trying to communicate with gooogel.com and we need to extract local IP address of … --- ## [How to use multiple inddexes in a dashboard](https://discuss.elastic.co/t/how-to-use-multiple-inddexes-in-a-dashboard/288706)
**Author:** [@nandatibco](https://discuss.elastic.co/u/nandatibco)\ **Replies:** 4\ **Last updated:** [November 23, 2021, 2:25pm UTC](https://discuss.elastic.co/t/how-to-use-multiple-inddexes-in-a-dashboard/288706 "2021-11-23T14:25:18Z")
How to configure 2 or more indexes with similar structure in a kibana dashboard? Tried with Index pattern, if the index names are not having similar naming patterns how to create an index pattern with different index na… --- ## [Unable to start elasticsearch on windows "The system cannot find the path specified."](https://discuss.elastic.co/t/unable-to-start-elasticsearch-on-windows-the-system-cannot-find-the-path-specified/289914)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 1\ **Last updated:** [November 23, 2021, 2:17pm UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-on-windows-the-system-cannot-find-the-path-specified/289914 "2021-11-23T14:17:20Z")
Hi, Use case : I have to perform an upgrade activity in production environment. Upgrade from 7.7.1 version to 7.15.0 on windows 2016 64 bit OS. Before performing I am doing a testing in a lower environment. Where I h… --- ## [Best practices on multiple syslog sources](https://discuss.elastic.co/t/best-practices-on-multiple-syslog-sources/289951)
**Author:** [@eleong](https://discuss.elastic.co/u/eleong)\ **Replies:** 1\ **Last updated:** [November 23, 2021, 2:13pm UTC](https://discuss.elastic.co/t/best-practices-on-multiple-syslog-sources/289951 "2021-11-23T14:13:14Z")
Hi all, Just asking some expert opinions here, my main objective currently is to ingest syslogs from multiple sources (assuming there are 10 different brands and syslog streams). I understand that there are ways to add… --- ## [Syslogging Struggle - newbie alert](https://discuss.elastic.co/t/syslogging-struggle-newbie-alert/289861)
**Author:** [@Orpheus](https://discuss.elastic.co/u/Orpheus)\ **Replies:** 4\ **Last updated:** [November 23, 2021, 2:07pm UTC](https://discuss.elastic.co/t/syslogging-struggle-newbie-alert/289861 "2021-11-23T14:07:45Z")
Hi, I'm just getting familiar with Elastic Stack, and implementing ELK with Filebeat to a syslog server that receives the syslogs from various routers on a network. The routers are running RouterOS on mikrotik routers, … --- ## [Multiget (mget) API performance](https://discuss.elastic.co/t/multiget-mget-api-performance/289813)
**Author:** [@jon\_cabrera](https://discuss.elastic.co/u/jon_cabrera)\ **Replies:** 4\ **Last updated:** [November 23, 2021, 2:02pm UTC](https://discuss.elastic.co/t/multiget-mget-api-performance/289813 "2021-11-23T14:02:22Z")
Hello! I am working on a search engine and I have introduced the use of the mget API to obtain a series of documents from a series of ids. My question is related to a series of issues that I have been able to observe i… --- ## [Filebeat on RHEL not sending to Logstash from all managed servers](https://discuss.elastic.co/t/filebeat-on-rhel-not-sending-to-logstash-from-all-managed-servers/289952)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 0\ **Last updated:** [November 23, 2021, 1:36pm UTC](https://discuss.elastic.co/t/filebeat-on-rhel-not-sending-to-logstash-from-all-managed-servers/289952 "2021-11-23T13:36:30Z")
Good Morning; I have an odd situation with regards to my Filebeat installation. I have it installed on all of my RHEL v.8, and out of the 5 I have it installed on, only 2 are sending the information to logstash, where … --- ## [Multiline Filebeat suppresses lines](https://discuss.elastic.co/t/multiline-filebeat-suppresses-lines/289609)
**Author:** [@Tornis](https://discuss.elastic.co/u/Tornis)\ **Replies:** 1\ **Last updated:** [November 23, 2021, 12:58pm UTC](https://discuss.elastic.co/t/multiline-filebeat-suppresses-lines/289609 "2021-11-23T12:58:10Z")
Hey guys, I have a problem in the filbeat multline that is not concatenating correctly with the defined pattern. When I look at the result using it through the output.console I see that it suppresses part of the line th… --- ## [How to send alert to zabbix](https://discuss.elastic.co/t/how-to-send-alert-to-zabbix/289928)
**Author:** [@ciment](https://discuss.elastic.co/u/ciment)\ **Replies:** 1\ **Last updated:** [November 23, 2021, 12:53pm UTC](https://discuss.elastic.co/t/how-to-send-alert-to-zabbix/289928 "2021-11-23T12:53:14Z")
Hi, I would like to send some event/alert from kibana to zabbix, when machine learning detects critical problem on my services (default APM job, ML can tag services with tag healthy,warning, critical..) What is the pr… --- ## [Synchronize Vega colors with other visualisations](https://discuss.elastic.co/t/synchronize-vega-colors-with-other-visualisations/289321)
**Author:** [@Brolantor](https://discuss.elastic.co/u/Brolantor)\ **Replies:** 1\ **Last updated:** [November 23, 2021, 12:06pm UTC](https://discuss.elastic.co/t/synchronize-vega-colors-with-other-visualisations/289321 "2021-11-23T12:06:02Z")
Hello there! I'm facing a problem with a Kibana Dashboard including a Vega Senkey visualisation (Originated from the popular blog entry Sankey Visualization with Vega in Kibana 6.2 | Elastic Blog). The dashboard also in… --- ## [Error when using lens with time shift](https://discuss.elastic.co/t/error-when-using-lens-with-time-shift/289802)
**Author:** [@lifer](https://discuss.elastic.co/u/lifer)\ **Replies:** 5\ **Last updated:** [November 23, 2021, 11:51am UTC](https://discuss.elastic.co/t/error-when-using-lens-with-time-shift/289802 "2021-11-23T11:51:53Z")
Hi guys! I've tried the new lens time shift feature, everything works fine with dates indexed as "strict\_date\_time", but when I try that on index with dates indexed as "epoch\_millis" I get the following error: Is th… --- ## [Receiving data via HTTPs or Ingest Pipelines](https://discuss.elastic.co/t/receiving-data-via-https-or-ingest-pipelines/289849)
**Author:** [@sc12](https://discuss.elastic.co/u/sc12)\ **Replies:** 6\ **Last updated:** [November 23, 2021, 11:44am UTC](https://discuss.elastic.co/t/receiving-data-via-https-or-ingest-pipelines/289849 "2021-11-23T11:44:53Z")
Hello, I've been searching on the forums and haven't been able to find an answer to the problem I'm facing. The issue I'm facing: I am trying to send data via REST Api to an Elastic Cloud instance, in my head, I am su… --- ## [Logstash and Beats with mTLS](https://discuss.elastic.co/t/logstash-and-beats-with-mtls/289941)
**Author:** [@widhalmt](https://discuss.elastic.co/u/widhalmt)\ **Replies:** 0\ **Last updated:** [November 23, 2021, 11:27am UTC](https://discuss.elastic.co/t/logstash-and-beats-with-mtls/289941 "2021-11-23T11:27:12Z")
Hi, I have a working TLS connection between Beats and Logstash. What I now want is mTLS so that only Beats with a valid certificate can connect to Logstash. For policy reasons I can't use the certutil Tool within Elasti… --- ## [Mustache variable in email alert](https://discuss.elastic.co/t/mustache-variable-in-email-alert/289917)
**Author:** [@gunlomboy](https://discuss.elastic.co/u/gunlomboy)\ **Replies:** 1\ **Last updated:** [November 23, 2021, 10:45am UTC](https://discuss.elastic.co/t/mustache-variable-in-email-alert/289917 "2021-11-23T10:45:50Z")
I feel like I'm missing a simple step, but is there a simple way to access Mustache variables within an email alert? Everything I try comes up blank. Do I need to query for these values elsewhere? --- ## [CPU Total/Free Virtual Machine with vSphere Module \[Metricbeat 7.15.2\]](https://discuss.elastic.co/t/cpu-total-free-virtual-machine-with-vsphere-module-metricbeat-7-15-2/289449)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 5\ **Last updated:** [November 23, 2021, 10:26am UTC](https://discuss.elastic.co/t/cpu-total-free-virtual-machine-with-vsphere-module-metricbeat-7-15-2/289449 "2021-11-23T10:26:45Z")
Hi, everyone I have configured vSphere module in Metricbeat 7.15.2 in order to get metrics from my VMware hosts and VMs. Metricbeat send all VM memory metrics, here you are: vsphere.virtualmachine.memory.free.guest.by… --- ## [Query with multiple keywords](https://discuss.elastic.co/t/query-with-multiple-keywords/289929)
**Author:** [@Leitner](https://discuss.elastic.co/u/Leitner)\ **Replies:** 2\ **Last updated:** [November 23, 2021, 10:23am UTC](https://discuss.elastic.co/t/query-with-multiple-keywords/289929 "2021-11-23T10:23:32Z")
Hi everyone, I'm new on Elasticsearch. So sorry for my question :slight\_smile: I want build a query in the console. With a single keyword it works great: But with multiple keywords the Value of the hits is always 0… --- ## [High level rest client connection](https://discuss.elastic.co/t/high-level-rest-client-connection/289899)
**Author:** [@111505](https://discuss.elastic.co/u/111505)\ **Replies:** 4\ **Last updated:** [November 23, 2021, 9:58am UTC](https://discuss.elastic.co/t/high-level-rest-client-connection/289899 "2021-11-23T09:58:23Z")
Hello. Questions about maintaining the connection of "Elasticsearch-Rest-High-Level-Client" in Java. RestClient.builder is created using a connection. But when i am using it on a 365-day server, do i have to connect and… --- ## [Filebeat : module mysql and Problem with \\n in mysql slow query log](https://discuss.elastic.co/t/filebeat-module-mysql-and-problem-with-n-in-mysql-slow-query-log/289869)
**Author:** [@toger](https://discuss.elastic.co/u/toger)\ **Replies:** 0\ **Last updated:** [November 22, 2021, 7:42pm UTC](https://discuss.elastic.co/t/filebeat-module-mysql-and-problem-with-n-in-mysql-slow-query-log/289869 "2021-11-22T19:42:01Z")
We are using filebeat with active mysql module to send to ES slow query multiline. On kibana mysql slowlog discover view, the field mysql.slowlog.query is EMPTY in the Data Table (because of ^M or \\n in the sql query). … --- ## [Rightsizing elastic batch size and number of workers](https://discuss.elastic.co/t/rightsizing-elastic-batch-size-and-number-of-workers/289803)
**Author:** [@alaine](https://discuss.elastic.co/u/alaine)\ **Replies:** 4\ **Last updated:** [November 23, 2021, 9:33am UTC](https://discuss.elastic.co/t/rightsizing-elastic-batch-size-and-number-of-workers/289803 "2021-11-23T09:33:47Z")
I am trying to right size my configs for the logstashes that I have feeding my elastic stack. They are pushing filebeat and winlogbeat data. Right now they seem to be fairly underutilized and I am seeing a little bit of … --- ## [Kibana health check for ingress health check?](https://discuss.elastic.co/t/kibana-health-check-for-ingress-health-check/289553)
**Author:** [@TimWardFS](https://discuss.elastic.co/u/TimWardFS)\ **Replies:** 2\ **Last updated:** [November 23, 2021, 9:08am UTC](https://discuss.elastic.co/t/kibana-health-check-for-ingress-health-check/289553 "2021-11-23T09:08:19Z")
What's a lightweight endpoint that I can specify for a health check (to be used for alb.ingress.kubernetes.io/healthcheck-path)? I've seen /health suggested, but that takes a quarter of a second to send vast quantities … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1152) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1154)