# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1174 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1175 --- ## [Filebeat modules and inputs](https://discuss.elastic.co/t/filebeat-modules-and-inputs/288412)
**Author:** [@MalfuncEddie](https://discuss.elastic.co/u/MalfuncEddie)\ **Replies:** 1\ **Last updated:** [November 5, 2021, 12:27pm UTC](https://discuss.elastic.co/t/filebeat-modules-and-inputs/288412 "2021-11-05T12:27:16Z")
Hi, I'm a bit confused how modules work or if what I am trying to do is even possible. I got logs from a mssql instance that logs to an eventhub in azure. If I configure the filebeat agent to read the event hub it is s… --- ## [Metricbeat 7.15.1 Will Not Start](https://discuss.elastic.co/t/metricbeat-7-15-1-will-not-start/288429)
**Author:** [@ty9001](https://discuss.elastic.co/u/ty9001)\ **Replies:** 8\ **Last updated:** [November 5, 2021, 12:21pm UTC](https://discuss.elastic.co/t/metricbeat-7-15-1-will-not-start/288429 "2021-11-05T12:21:20Z")
Hello! I have noticed in the past few weeks my Metricbeat 7.15.1 monitoring doesn't seem to work. I finally figured out the service won't stay started properly. I was using Fedora 34 and have currently rolled out a new s… --- ## [Fleet + AWS Metrics IAM Visual Editor explanation](https://discuss.elastic.co/t/fleet-aws-metrics-iam-visual-editor-explanation/288491)
**Author:** [@zx8086](https://discuss.elastic.co/u/zx8086)\ **Replies:** 0\ **Last updated:** [November 5, 2021, 11:53am UTC](https://discuss.elastic.co/t/fleet-aws-metrics-iam-visual-editor-explanation/288491 "2021-11-05T11:53:38Z")
Can some give an explanation of usage of the visual editors and of we need this setup for the new Fleet-Managed AWS Integration as this is taken from the old Metricbeat AWS Module. Is the resource for VisualEditor1 & Vi… --- ## [Tsvb calculation](https://discuss.elastic.co/t/tsvb-calculation/288477)
**Author:** [@paigekim](https://discuss.elastic.co/u/paigekim)\ **Replies:** 1\ **Last updated:** [November 5, 2021, 10:47am UTC](https://discuss.elastic.co/t/tsvb-calculation/288477 "2021-11-05T10:47:40Z")
Hello, I have a question regards to tsvb calculation. I would like to get an accumulated Break Even Point(BEP) by using tsvb and you could see the attachment how I calculated. Currently, I divide accumulated revenue b… --- ## [Exporting data into HTML table](https://discuss.elastic.co/t/exporting-data-into-html-table/288485)
**Author:** [@AlessandroKP](https://discuss.elastic.co/u/AlessandroKP)\ **Replies:** 0\ **Last updated:** [November 5, 2021, 10:30am UTC](https://discuss.elastic.co/t/exporting-data-into-html-table/288485 "2021-11-05T10:30:02Z")
Hello, I am looking for a tool that lets you export data stored in Elasticsearch on a file in HTML format. I know that you can use Kibana to export the content of an index (or a subset) into CSV format. Do you know if… --- ## [Deprecation in Kibana 7.13.4](https://discuss.elastic.co/t/deprecation-in-kibana-7-13-4/284819)
**Author:** [@CatalinBinzari](https://discuss.elastic.co/u/CatalinBinzari)\ **Replies:** 3\ **Last updated:** [November 5, 2021, 10:26am UTC](https://discuss.elastic.co/t/deprecation-in-kibana-7-13-4/284819 "2021-11-05T10:26:28Z")
in kibana 7.13.4 i can not get rid of next deprecations: plugins.scanDirs is deprecated and is no longer used has been deprecated and will be removed in 8.0. To set the destination moving forward, you can use the "… --- ## [Logstash output creating error](https://discuss.elastic.co/t/logstash-output-creating-error/288161)
**Author:** [@BeMoore](https://discuss.elastic.co/u/BeMoore)\ **Replies:** 25\ **Last updated:** [November 5, 2021, 9:39am UTC](https://discuss.elastic.co/t/logstash-output-creating-error/288161 "2021-11-05T09:39:45Z")
Hi all, I have a weird error i can't nail down. Running 7.15.1 ES / Logstash I have a simple Logstash conf thats listening on a port for beats data and it should just push it to an index. input { beats { p… --- ## [Vizualize Netflow data in Kibana (used network trafic)](https://discuss.elastic.co/t/vizualize-netflow-data-in-kibana-used-network-trafic/287645)
**Author:** [@gmbynkrkrqz](https://discuss.elastic.co/u/gmbynkrkrqz)\ **Replies:** 3\ **Last updated:** [November 5, 2021, 8:03am UTC](https://discuss.elastic.co/t/vizualize-netflow-data-in-kibana-used-network-trafic/287645 "2021-11-05T08:03:18Z")
Hi, I would like to create a dashboard on Kibana using the OPNsense Netflow logs to vizualize the bandwith used per source IP. Here is my logstash config. input { # OPNsense netflow logs input udp { port =\> 1… --- ## [Create Aggregate field with separated by comma](https://discuss.elastic.co/t/create-aggregate-field-with-separated-by-comma/288463)
**Author:** [@ari\_wahyu\_nahar](https://discuss.elastic.co/u/ari_wahyu_nahar)\ **Replies:** 3\ **Last updated:** [November 5, 2021, 7:40am UTC](https://discuss.elastic.co/t/create-aggregate-field-with-separated-by-comma/288463 "2021-11-05T07:40:25Z")
Need Help. i have data like this: what steps should i take, to get results like this: A: 3 B: 3 C: 2 D: 3 E: 4 Thank you! --- ## [Dense\_vector in oss ES 7.6](https://discuss.elastic.co/t/dense-vector-in-oss-es-7-6/288471)
**Author:** [@gchakkalakkal](https://discuss.elastic.co/u/gchakkalakkal)\ **Replies:** 2\ **Last updated:** [November 5, 2021, 7:38am UTC](https://discuss.elastic.co/t/dense-vector-in-oss-es-7-6/288471 "2021-11-05T07:38:39Z")
hi All, Is dense\_vector available in OSS version of ES 7.6. As i getting below error while trying to create index using dense\_vector field type. "reason" : "No handler for type \[dense\_vector\] declared on field \[my\_vec… --- ## [Unable to enroll fleet server as assinged policy does not have fleet server input](https://discuss.elastic.co/t/unable-to-enroll-fleet-server-as-assinged-policy-does-not-have-fleet-server-input/277846)
**Author:** [@cheapsupps](https://discuss.elastic.co/u/cheapsupps)\ **Replies:** 26\ **Last updated:** [November 5, 2021, 7:26am UTC](https://discuss.elastic.co/t/unable-to-enroll-fleet-server-as-assinged-policy-does-not-have-fleet-server-input/277846 "2021-11-05T07:26:27Z")
Hi, I am setting up fleet-server in air-gap environment. However, I am unable to enroll the fleet-server to elasticsearch. I am having the below error. 2021-07-05T22:37:11.552+0800 INFO cmd/enroll\_cmd.go:300 Ge… --- ## [Manage system indices with Curator \[Elasticsearch 7.14.2\]](https://discuss.elastic.co/t/manage-system-indices-with-curator-elasticsearch-7-14-2/288410)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 2\ **Last updated:** [November 5, 2021, 6:41am UTC](https://discuss.elastic.co/t/manage-system-indices-with-curator-elasticsearch-7-14-2/288410 "2021-11-05T06:41:07Z")
Elasticsearch version: 7.14.2 Curator version: 5.8.4 Hi, everyone I have seen a warning message in Curator in which Elasticsearch reports that in a future major version direct access to system indices will be prevente… --- ## [Is there a way to get the key of the current aggregation bucket in script？](https://discuss.elastic.co/t/is-there-a-way-to-get-the-key-of-the-current-aggregation-bucket-in-script/288466)
**Author:** [@jakey](https://discuss.elastic.co/u/jakey)\ **Replies:** 0\ **Last updated:** [November 5, 2021, 5:27am UTC](https://discuss.elastic.co/t/is-there-a-way-to-get-the-key-of-the-current-aggregation-bucket-in-script/288466 "2021-11-05T05:27:36Z")
For example: how to get the key (country) of the current bucket in the script after aggregating countries? Hope to give a solution, thank you！ "aggs"{ "country\_group":{ "terms":{ "field":"country", "size":1000 … --- ## [Need to configure message timestamp as timestamp in elastic stack](https://discuss.elastic.co/t/need-to-configure-message-timestamp-as-timestamp-in-elastic-stack/288191)
**Author:** [@Mobin](https://discuss.elastic.co/u/Mobin)\ **Replies:** 6\ **Last updated:** [November 5, 2021, 5:06am UTC](https://discuss.elastic.co/t/need-to-configure-message-timestamp-as-timestamp-in-elastic-stack/288191 "2021-11-05T05:06:26Z")
We have created an elastic stack to monitor logs from the Linux clients. On Linux clients, filebeat is configured to ship the logs to the elastic stack. When we are searching for the logs using elastic discover option @… --- ## [Error i\_o\_exception on s3 repository](https://discuss.elastic.co/t/error-i-o-exception-on-s3-repository/288128)
**Author:** [@alfianaf](https://discuss.elastic.co/u/alfianaf)\ **Replies:** 15\ **Last updated:** [November 5, 2021, 3:10am UTC](https://discuss.elastic.co/t/error-i-o-exception-on-s3-repository/288128 "2021-11-05T03:10:53Z")
Hello, I make a repository that connect to storage with s3 protocol, after I declare the proxy.host, proxy.port, protocol, endpoint on Elasticsearch.yml, I also declare the access\_key and secret key on Elasticsearch keys… --- ## [Logstash Logging setting to output rubydebug info for running service](https://discuss.elastic.co/t/logstash-logging-setting-to-output-rubydebug-info-for-running-service/288435)
**Author:** [@teebu](https://discuss.elastic.co/u/teebu)\ **Replies:** 11\ **Last updated:** [November 5, 2021, 2:23am UTC](https://discuss.elastic.co/t/logstash-logging-setting-to-output-rubydebug-info-for-running-service/288435 "2021-11-05T02:23:28Z")
I'm using the default settings. When I run LS as a service, the logging in the plain.log file doesn't have any of the rubydebug output. When I run it with the -f flag, I see all the output normally. What setting file d… --- ## [Update mapping fails for the elastic (superuser)](https://discuss.elastic.co/t/update-mapping-fails-for-the-elastic-superuser/288450)
**Author:** [@dimitris\_sb](https://discuss.elastic.co/u/dimitris_sb)\ **Replies:** 2\ **Last updated:** [November 5, 2021, 12:31am UTC](https://discuss.elastic.co/t/update-mapping-fails-for-the-elastic-superuser/288450 "2021-11-05T00:31:11Z")
Dear All, We tried to update mapping of an existing field Request: PUT index-name\* { "mappings": { "properties": { "index\_field": { "type": "text", "fields": { "keyword": { … --- ## [7.15 auto heap for none data node](https://discuss.elastic.co/t/7-15-auto-heap-for-none-data-node/288446)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 1\ **Last updated:** [November 4, 2021, 11:11pm UTC](https://discuss.elastic.co/t/7-15-auto-heap-for-none-data-node/288446 "2021-11-04T23:11:23Z")
I have noticed that none data node still allocates half of system RAM. Wouldn't it make more sense to allocate more RAM for ES heap in such node? We don't really need to leave too much RAM for the system since there's … --- ## [Azure event hub plugin modify offset](https://discuss.elastic.co/t/azure-event-hub-plugin-modify-offset/288452)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 3\ **Last updated:** [November 4, 2021, 10:27pm UTC](https://discuss.elastic.co/t/azure-event-hub-plugin-modify-offset/288452 "2021-11-04T22:27:59Z")
Hi where is the offset of the Azure event hub plugin is located? and if si located in the blob storage can you give me some reference where to find it? I dont have access to Azure and have to give directions to a cowor… --- ## [Recommended node hardware/settings for warm data](https://discuss.elastic.co/t/recommended-node-hardware-settings-for-warm-data/288447)
**Author:** [@Maycon\_Santos](https://discuss.elastic.co/u/Maycon_Santos)\ **Replies:** 1\ **Last updated:** [November 4, 2021, 7:02pm UTC](https://discuss.elastic.co/t/recommended-node-hardware-settings-for-warm-data/288447 "2021-11-04T19:02:33Z")
Hello, I am looking at an allocation strategy to move around 2800 indices that are mostly idle with few reads per week to slower nodes and with this, clean a bit of space in our high-performance nodes. These indices acc… --- ## [How to query all unique IP addresses](https://discuss.elastic.co/t/how-to-query-all-unique-ip-addresses/288420)
**Author:** [@jeromeat](https://discuss.elastic.co/u/jeromeat)\ **Replies:** 6\ **Last updated:** [November 4, 2021, 8:18pm UTC](https://discuss.elastic.co/t/how-to-query-all-unique-ip-addresses/288420 "2021-11-04T20:18:01Z")
I'm looking for help on how to query all unique IP addresses, however, the field types that the IPs get parsed to are setup as "keyword" and not "IP". And they are setup as ip\_src, ip\_dst, dst\_ip, src\_ip. Yes, I unders… --- ## [Elastic won't start on Windows after inserting a single document](https://discuss.elastic.co/t/elastic-wont-start-on-windows-after-inserting-a-single-document/288206)
**Author:** [@lubosvr](https://discuss.elastic.co/u/lubosvr)\ **Replies:** 14\ **Last updated:** [November 4, 2021, 7:00pm UTC](https://discuss.elastic.co/t/elastic-wont-start-on-windows-after-inserting-a-single-document/288206 "2021-11-04T19:00:39Z")
Hi everybody, I've just downloaded ES 7.15.1 and latest Kibana. I was able to start ES for the first time. Then I've added a single document and dtopped the Kibana and ES. Now I'm not able to start ES. In the logs I se… --- ## [Regex query for conexus-al](https://discuss.elastic.co/t/regex-query-for-conexus-al/288437)
**Author:** [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\ **Replies:** 3\ **Last updated:** [November 4, 2021, 6:46pm UTC](https://discuss.elastic.co/t/regex-query-for-conexus-al/288437 "2021-11-04T18:46:24Z")
I am trying to search out the devices with conexus-al in the device name. I can find the conexus devices with ".conexus.", however adding ".conexus-al." finds nothing. I have tried ".conexus.al." and ".conexus\\-al.". I a… --- ## [Can kibana do visualization with multiple indexes at a time?](https://discuss.elastic.co/t/can-kibana-do-visualization-with-multiple-indexes-at-a-time/288406)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 6\ **Last updated:** [November 4, 2021, 5:46pm UTC](https://discuss.elastic.co/t/can-kibana-do-visualization-with-multiple-indexes-at-a-time/288406 "2021-11-04T17:46:17Z")
Can kibana do visualization incorporating multiple indexes at a time in one view? thanks and regards shini --- ## [Kibana spaces and loading of unauthorized index patterns](https://discuss.elastic.co/t/kibana-spaces-and-loading-of-unauthorized-index-patterns/288401)
**Author:** [@ibrooes](https://discuss.elastic.co/u/ibrooes)\ **Replies:** 2\ **Last updated:** [November 4, 2021, 4:49pm UTC](https://discuss.elastic.co/t/kibana-spaces-and-loading-of-unauthorized-index-patterns/288401 "2021-11-04T16:49:53Z")
Hello, I am trying to create a solution where users based on their roles would have access to specific spaces and specific indices. I was able to create roles that enable that, and when I log in with my test user I only … --- ## [Logstash aggregate task](https://discuss.elastic.co/t/logstash-aggregate-task/288348)
**Author:** [@rosboc](https://discuss.elastic.co/u/rosboc)\ **Replies:** 3\ **Last updated:** [November 4, 2021, 4:06pm UTC](https://discuss.elastic.co/t/logstash-aggregate-task/288348 "2021-11-04T16:06:09Z")
Hi Team, we are using aggregate function to collect all commands for a specific ssh session but recently our vendor changed the way to track session records and right now only start and stop records have the same task\_i… --- ## [Metric On Shard Reads and Writes](https://discuss.elastic.co/t/metric-on-shard-reads-and-writes/287690)
**Author:** [@Nisar\_Adappadathil1](https://discuss.elastic.co/u/Nisar_Adappadathil1)\ **Replies:** 4\ **Last updated:** [November 4, 2021, 3:53pm UTC](https://discuss.elastic.co/t/metric-on-shard-reads-and-writes/287690 "2021-11-04T15:53:14Z")
We have a huge cluster with 250 nodes. Multiple nodes go high load at various times, so want to know which shards are actually having higher READs and WRITEs so that I can see any hot shards are there. How can log coun… --- ## [Kibana plugin certificate error](https://discuss.elastic.co/t/kibana-plugin-certificate-error/288281)
**Author:** [@111505](https://discuss.elastic.co/u/111505)\ **Replies:** 1\ **Last updated:** [November 4, 2021, 3:33pm UTC](https://discuss.elastic.co/t/kibana-plugin-certificate-error/288281 "2021-11-04T15:33:58Z")
Hi :slight\_smile: I need Kibana css plugin. So I wrote the command below. ./kibana-plugin install file:///usr/local/ELK\_7.9.2/kibana-7.9.2-linux-x86\_64/kibana-dashboard-custom-css-master.zip However, I get an authent… --- ## [Lagging in ELK stack](https://discuss.elastic.co/t/lagging-in-elk-stack/288414)
**Author:** [@Narayan\_Banik](https://discuss.elastic.co/u/Narayan_Banik)\ **Replies:** 2\ **Last updated:** [November 4, 2021, 2:53pm UTC](https://discuss.elastic.co/t/lagging-in-elk-stack/288414 "2021-11-04T14:53:50Z")
Hi Experts, I'm using ELK stack in docker environment: logstash\_syslog:7.4.0 Elasticsearch:7.1 kibana:7.1 Sometimes observe lagging of logs in kibana dashboard. After 2/3 hours, it becomes adjusted. Lagging usually… --- ## [Search as you type and highlighter](https://discuss.elastic.co/t/search-as-you-type-and-highlighter/287341)
**Author:** [@mihalikv](https://discuss.elastic.co/u/mihalikv)\ **Replies:** 1\ **Last updated:** [November 4, 2021, 2:49pm UTC](https://discuss.elastic.co/t/search-as-you-type-and-highlighter/287341 "2021-11-04T14:49:07Z")
Hello, Env: ES 7.15.0 PUT my-index-000001 { "mappings": { "properties": { "my\_field": { "type": "search\_as\_you\_type" } } } } PUT my-index-000001/\_doc/1?refresh { "my\_field": "quick b… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1173) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1175)