# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1188 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1189 --- ## [Create Repository with S3 Protocol on Bucket Cloud on Premise](https://discuss.elastic.co/t/create-repository-with-s3-protocol-on-bucket-cloud-on-premise/287523)
**Author:** [@alfianaf](https://discuss.elastic.co/u/alfianaf)\ **Replies:** 5\ **Last updated:** [October 25, 2021, 7:54pm UTC](https://discuss.elastic.co/t/create-repository-with-s3-protocol-on-bucket-cloud-on-premise/287523 "2021-10-25T19:54:31Z")
Hello, atm my company have cloud on premise storage with S3 protocol I want to create snapshot repository on that storage, is this possible to do, because my storage is not based on aws, but only use the s3 protocol T… --- ## [Not getting complete data on Reports](https://discuss.elastic.co/t/not-getting-complete-data-on-reports/285780)
**Author:** [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)\ **Replies:** 1\ **Last updated:** [October 25, 2021, 7:45pm UTC](https://discuss.elastic.co/t/not-getting-complete-data-on-reports/285780 "2021-10-25T19:45:27Z")
Hi Team, We have multiple reports created using data table visualization, each report are having multiple bucket aggregations (term aggregation). Whenever we set the size to 10 data in reports is getting rendered witho… --- ## [Removing the “$” sign from event\_data.TargetUserName](https://discuss.elastic.co/t/removing-the-sign-from-event-data-targetusername/285742)
**Author:** [@schroray](https://discuss.elastic.co/u/schroray)\ **Replies:** 0\ **Last updated:** [October 2, 2021, 4:18pm UTC](https://discuss.elastic.co/t/removing-the-sign-from-event-data-targetusername/285742 "2021-10-02T16:18:14Z")
I found an Elastic blog on a possible dashboard for Winlogbeat logs: Monitoring Windows Logons with Winlogbeat | Elastic Blog I was trying to remove the dollar sign "$" from usernames in the field winlog.event\_data.Targ… --- ## [Top 10 values in dynamic options](https://discuss.elastic.co/t/top-10-values-in-dynamic-options/285430)
**Author:** [@PradeepJ](https://discuss.elastic.co/u/PradeepJ)\ **Replies:** 1\ **Last updated:** [October 25, 2021, 7:41pm UTC](https://discuss.elastic.co/t/top-10-values-in-dynamic-options/285430 "2021-10-25T19:41:03Z")
Hi, The dynamic options in the controls visualization shows default 10 records (even when not selecting parent control). Can you please explain how dynamic option works with/without parent control? --- ## [How do I get histogram interval used in a custom plugin](https://discuss.elastic.co/t/how-do-i-get-histogram-interval-used-in-a-custom-plugin/285509)
**Author:** [@Addorex](https://discuss.elastic.co/u/Addorex)\ **Replies:** 1\ **Last updated:** [October 25, 2021, 7:34pm UTC](https://discuss.elastic.co/t/how-do-i-get-histogram-interval-used-in-a-custom-plugin/285509 "2021-10-25T19:34:26Z")
I am writing a custom plugin. How do I get the interval that was used for histogram aggregations. When auto scaling is used how do I retrieve the interval. I need the interval for filtering. I am developing on 7.10.2. Th… --- ## [How to extract data from multiline(codec)](https://discuss.elastic.co/t/how-to-extract-data-from-multiline-codec/287575)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 3\ **Last updated:** [October 25, 2021, 7:34pm UTC](https://discuss.elastic.co/t/how-to-extract-data-from-multiline-codec/287575 "2021-10-25T19:34:26Z")
Hi Does anyone know how to extract data from under the codec multiline. After parse xml data I need to avoid the header (prefix of name measData ) for whole of ingested rows... it makes also some keyword field and mul… --- ## [What is the grok expression that can match variable length documents from a single log file?](https://discuss.elastic.co/t/what-is-the-grok-expression-that-can-match-variable-length-documents-from-a-single-log-file/285320)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 1\ **Last updated:** [October 25, 2021, 7:32pm UTC](https://discuss.elastic.co/t/what-is-the-grok-expression-that-can-match-variable-length-documents-from-a-single-log-file/285320 "2021-10-25T19:32:41Z")
A log file is having records of different leighths, say 3 different types of records? what is the grok expression that can match variable length documents from a single log file? This will be very useful for creating i… --- ## [Canvas dropdowncontrol filter breaking if data is missing](https://discuss.elastic.co/t/canvas-dropdowncontrol-filter-breaking-if-data-is-missing/285674)
**Author:** [@sigbo](https://discuss.elastic.co/u/sigbo)\ **Replies:** 1\ **Last updated:** [October 25, 2021, 7:21pm UTC](https://discuss.elastic.co/t/canvas-dropdowncontrol-filter-breaking-if-data-is-missing/285674 "2021-10-25T19:21:25Z")
I'm working on a canvas to show comparisons between tests made on our systems. Doing that I've created filters to choose the test versions you want to compare and these filters are cross-filtering each other to avoid em… --- ## [Customize graphs in canvas](https://discuss.elastic.co/t/customize-graphs-in-canvas/285614)
**Author:** [@Mira\_9](https://discuss.elastic.co/u/Mira_9)\ **Replies:** 1\ **Last updated:** [October 25, 2021, 6:59pm UTC](https://discuss.elastic.co/t/customize-graphs-in-canvas/285614 "2021-10-25T18:59:33Z")
Hi , i'm wondering if i can add some changes in my graph's y-axis before being displayed ( i want to set a subtraction ( 100 - value Y) how is that possible? . Another thing i want to skip the "NULL" how can i delete it … --- ## [Filebeat setup dont load because kibana version](https://discuss.elastic.co/t/filebeat-setup-dont-load-because-kibana-version/285712)
**Author:** [@Francisca\_Olave](https://discuss.elastic.co/u/Francisca_Olave)\ **Replies:** 0\ **Last updated:** [October 1, 2021, 7:24pm UTC](https://discuss.elastic.co/t/filebeat-setup-dont-load-because-kibana-version/285712 "2021-10-01T19:24:30Z")
Hi, I have a single node server with a basic license in ELK and I want to monitor a machine with filebeat but the following error appears: # filebeat setup Overwriting ILM policy is disabled. Set \`setup.ilm.overwrite: … --- ## [Installation aborted, plugin 'logstash-input-jdbc' is already provided by 'logstash-integration-jdbc'](https://discuss.elastic.co/t/installation-aborted-plugin-logstash-input-jdbc-is-already-provided-by-logstash-integration-jdbc/287562)
**Author:** [@Kumar\_Reddy](https://discuss.elastic.co/u/Kumar_Reddy)\ **Replies:** 4\ **Last updated:** [October 25, 2021, 6:17pm UTC](https://discuss.elastic.co/t/installation-aborted-plugin-logstash-input-jdbc-is-already-provided-by-logstash-integration-jdbc/287562 "2021-10-25T18:17:45Z")
I am facing this issue when i try to run command from docker-compose.yml file. version: '3.7' services: Elasticsearch: image: docker.elastic.co/elasticsearch/elasticsearch:7.15.1 ports: - '9200:9200' environment: … --- ## [Authentication issue between kafka(OpenShift Operator deployed) and Logstash](https://discuss.elastic.co/t/authentication-issue-between-kafka-openshift-operator-deployed-and-logstash/287614)
**Author:** [@karanjit.rai](https://discuss.elastic.co/u/karanjit.rai)\ **Replies:** 0\ **Last updated:** [October 25, 2021, 6:02pm UTC](https://discuss.elastic.co/t/authentication-issue-between-kafka-openshift-operator-deployed-and-logstash/287614 "2021-10-25T18:02:47Z")
Hello, I have installed Kafka through the OpenShift operator and now I am trying to connect it to Logstash (running in a OpenShift cluster). I do not see anyway to connect through authentication between the two or where… --- ## [Physically Moving Indices To New Drive](https://discuss.elastic.co/t/physically-moving-indices-to-new-drive/287611)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 1\ **Last updated:** [October 25, 2021, 5:46pm UTC](https://discuss.elastic.co/t/physically-moving-indices-to-new-drive/287611 "2021-10-25T17:46:02Z")
I have a need to move where indices are stored to a new drive. How do I go about migrating to the new drive? Change Elasticsearch.yml to the new drive and then reindex all the existing data? I'd hate to do that with t… --- ## [Logstash JDBC output](https://discuss.elastic.co/t/logstash-jdbc-output/287605)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 1\ **Last updated:** [October 25, 2021, 5:44pm UTC](https://discuss.elastic.co/t/logstash-jdbc-output/287605 "2021-10-25T17:44:32Z")
Do we have the JDBC output plugin in logstash to write to the database? --- ## [Kibana watcher : Send message field in if log level is ERROR](https://discuss.elastic.co/t/kibana-watcher-send-message-field-in-if-log-level-is-error/286529)
**Author:** [@Chandrakant\_Naik](https://discuss.elastic.co/u/Chandrakant_Naik)\ **Replies:** 1\ **Last updated:** [October 25, 2021, 5:04pm UTC](https://discuss.elastic.co/t/kibana-watcher-send-message-field-in-if-log-level-is-error/286529 "2021-10-25T17:04:31Z")
i have configure watcher in kibana to notify me via email if there are ERROR in log level. for couple indices. input": { "search": { "request": { "search\_type": "query\_then\_fetch", "indices": \[ "xxxx.-\*" \], "types": \[\],… --- ## [Logstash exits after successfully installing plugin with docker-compose exited with code 0](https://discuss.elastic.co/t/logstash-exits-after-successfully-installing-plugin-with-docker-compose-exited-with-code-0/287607)
**Author:** [@Kumar\_Reddy](https://discuss.elastic.co/u/Kumar_Reddy)\ **Replies:** 0\ **Last updated:** [October 25, 2021, 4:43pm UTC](https://discuss.elastic.co/t/logstash-exits-after-successfully-installing-plugin-with-docker-compose-exited-with-code-0/287607 "2021-10-25T16:43:43Z")
I am trying to run an Elastic stack and I am trying to install a logstash plugin within the docker compose file. I am getting the message that the plugin is installed successful and right after that the container exits w… --- ## [Elasticsearch Postgresql Module Ingest Pipeline Not Parsing Postgresql 10](https://discuss.elastic.co/t/elasticsearch-postgresql-module-ingest-pipeline-not-parsing-postgresql-10/287604)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 0\ **Last updated:** [October 25, 2021, 4:09pm UTC](https://discuss.elastic.co/t/elasticsearch-postgresql-module-ingest-pipeline-not-parsing-postgresql-10/287604 "2021-10-25T16:09:02Z")
Elasticsearch ingest pipeline for postgresql module doesn't appear to parse postgresql 10 logs. This is with filebeat-7.15.0 and associated ingest pipelines under elasticsearch-7.14.1. We're using Postgresql 10. The fol… --- ## [Possible to Script Values in Synthetics?](https://discuss.elastic.co/t/possible-to-script-values-in-synthetics/287602)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 2\ **Last updated:** [October 25, 2021, 4:02pm UTC](https://discuss.elastic.co/t/possible-to-script-values-in-synthetics/287602 "2021-10-25T16:02:30Z")
Hi All, I have a use case where I want to use synthetics to monitor a page, however this page has a URL which requires it to be updated daily with the days date. Kind of like: http://url/\. Since… --- ## [Elasticsearch high level java client mock test](https://discuss.elastic.co/t/elasticsearch-high-level-java-client-mock-test/287571)
**Author:** [@111505](https://discuss.elastic.co/u/111505)\ **Replies:** 1\ **Last updated:** [October 25, 2021, 3:39pm UTC](https://discuss.elastic.co/t/elasticsearch-high-level-java-client-mock-test/287571 "2021-10-25T15:39:41Z")
I am using a RestHighlevelclient in the Spring Boot environment. I want to create a JUnit Test Code, but I can not find a way. Is there no test method to officially provide? I want to test the normal operation of basi… --- ## [Term query wrong behaviour?](https://discuss.elastic.co/t/term-query-wrong-behaviour/287530)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 4\ **Last updated:** [October 25, 2021, 3:11pm UTC](https://discuss.elastic.co/t/term-query-wrong-behaviour/287530 "2021-10-25T15:11:12Z")
Hi, according to the documentation a term query search for the exact match. but when I do the below search I get results and when I look for the exact match in uppercase I dont get any results This should not hap… --- ## [Snmp network traffic and trends](https://discuss.elastic.co/t/snmp-network-traffic-and-trends/287585)
**Author:** [@leostereo](https://discuss.elastic.co/u/leostereo)\ **Replies:** 0\ **Last updated:** [October 25, 2021, 2:22pm UTC](https://discuss.elastic.co/t/snmp-network-traffic-and-trends/287585 "2021-10-25T14:22:21Z")
Hi guys. I have same experience using elk with neflow beat. Now im looking for some way to bring traffic from my router , create graphs , similar than librenms , cacti , an so. But I would also add some intelligence t… --- ## [Stack trace parsing issue](https://discuss.elastic.co/t/stack-trace-parsing-issue/287573)
**Author:** [@Divya\_Bansal](https://discuss.elastic.co/u/Divya_Bansal)\ **Replies:** 9\ **Last updated:** [October 25, 2021, 2:15pm UTC](https://discuss.elastic.co/t/stack-trace-parsing-issue/287573 "2021-10-25T14:15:57Z")
I am having a json data in the following manne:- {"@timestamp":"2021-06-04T09:57:25.141Z","@metadata":{"beat":"filebeat","type":"\_doc","version":"7.6.3"},"log":{"offset":10413931,"file":{"path":""}},"message":"\[ERROR\] 2… --- ## [Filebeat - Datastreams?](https://discuss.elastic.co/t/filebeat-datastreams/287442)
**Author:** [@scott\_stash](https://discuss.elastic.co/u/scott_stash)\ **Replies:** 1\ **Last updated:** [October 25, 2021, 2:08pm UTC](https://discuss.elastic.co/t/filebeat-datastreams/287442 "2021-10-25T14:08:17Z")
Currently we have configured data streams in our environment and its working as expected with Logstash. For Filebeat do we just use the datastream name as the index value? Or do we create an alias to the datastream and… --- ## [Logstash file input plugin: missing first lines after log rotation](https://discuss.elastic.co/t/logstash-file-input-plugin-missing-first-lines-after-log-rotation/287112)
**Author:** [@adminunix](https://discuss.elastic.co/u/adminunix)\ **Replies:** 2\ **Last updated:** [October 25, 2021, 1:56pm UTC](https://discuss.elastic.co/t/logstash-file-input-plugin-missing-first-lines-after-log-rotation/287112 "2021-10-25T13:56:26Z")
Hello, I´m using logstash with a pipeline that collects logs with the file input plugin. Everything works fine, but when log files are rotated, logstash doesn´t collect some of the first few lines of the new log file. T… --- ## [Help with query in CLI](https://discuss.elastic.co/t/help-with-query-in-cli/287584)
**Author:** [@Nick\_Hatfield](https://discuss.elastic.co/u/Nick_Hatfield)\ **Replies:** 0\ **Last updated:** [October 25, 2021, 1:52pm UTC](https://discuss.elastic.co/t/help-with-query-in-cli/287584 "2021-10-25T13:52:11Z")
Hi guys, please help me understand how to make a query work from the cli. I either match too much or nothing at all... So here's the payload sample: { "took": 3, "timed\_out": false, "\_shards": { "total": 5, … --- ## [Calculate transaction duration](https://discuss.elastic.co/t/calculate-transaction-duration/287210)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 3\ **Last updated:** [October 25, 2021, 12:22pm UTC](https://discuss.elastic.co/t/calculate-transaction-duration/287210 "2021-10-25T12:22:51Z")
Hi I'm struggling with one interesting case: we have some data within some patterns. But we don't have any tags: start or end in these documents. How I can calculate transaction duration? I'm also see great article Ca… --- ## [Suddenly pipeline got stuck with error couldn't find any output plugin named http](https://discuss.elastic.co/t/suddenly-pipeline-got-stuck-with-error-couldnt-find-any-output-plugin-named-http/287376)
**Author:** [@michael.l](https://discuss.elastic.co/u/michael.l)\ **Replies:** 3\ **Last updated:** [October 25, 2021, 11:55am UTC](https://discuss.elastic.co/t/suddenly-pipeline-got-stuck-with-error-couldnt-find-any-output-plugin-named-http/287376 "2021-10-25T11:55:41Z")
We have a simple pipeline that has been running fine for weeks without any errors, and then suddenly stopped outputting events while repeatedly printing this error: {"level":"ERROR","loggerName":"logstash.agent","timeMi… --- ## [Doc\_as\_upsert but don't deleted nested](https://discuss.elastic.co/t/doc-as-upsert-but-dont-deleted-nested/287564)
**Author:** [@Grant\_Donovan1](https://discuss.elastic.co/u/Grant_Donovan1)\ **Replies:** 0\ **Last updated:** [October 25, 2021, 10:51am UTC](https://discuss.elastic.co/t/doc-as-upsert-but-dont-deleted-nested/287564 "2021-10-25T10:51:16Z")
I am using the doc\_as\_upsert to update my document if it already exists, for example { "doc": { "apple": "new\_name", "test\_list": \[ { "value": "first value group 1", "value\_set": {… --- ## [Is my data stream not rolling over to a new index like it's supposed to?](https://discuss.elastic.co/t/is-my-data-stream-not-rolling-over-to-a-new-index-like-its-supposed-to/287515)
**Author:** [@nsouth](https://discuss.elastic.co/u/nsouth)\ **Replies:** 2\ **Last updated:** [October 25, 2021, 10:30am UTC](https://discuss.elastic.co/t/is-my-data-stream-not-rolling-over-to-a-new-index-like-its-supposed-to/287515 "2021-10-25T10:30:56Z")
We have a data stream created by Logstash and it's using the default index template and ILM policy. My understanding is that the data stream should roll over to a new index once the initial index has 50 GB of data or is … --- ## [SLM Policy Naming](https://discuss.elastic.co/t/slm-policy-naming/287557)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 1\ **Last updated:** [October 25, 2021, 9:52am UTC](https://discuss.elastic.co/t/slm-policy-naming/287557 "2021-10-25T09:52:14Z")
Hi, I'm trying to upload an SLM policy and am getting the following error: elasticsearch.exceptions.RequestError: RequestError(400, 'action\_request\_validation\_exception', 'Validation Failed: 1: invalid snapshot name \[s… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1187) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1189)