# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1213 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1214 --- ## [Logstash-output-zabbix does not send to zabbix](https://discuss.elastic.co/t/logstash-output-zabbix-does-not-send-to-zabbix/285912)
**Author:** [@Paveltest](https://discuss.elastic.co/u/Paveltest)\ **Replies:** 3\ **Last updated:** [October 6, 2021, 5:12am UTC](https://discuss.elastic.co/t/logstash-output-zabbix-does-not-send-to-zabbix/285912 "2021-10-06T05:12:42Z")
When sending logs to zabbix, it gives an error. \[WARN \] 2021-10-05 \[\[main\]\>worker1\] zabbix - Field referenced by message is missing \[WARN \] 2021-10-05 \[\[main\]\>worker1\] zabbix - Zabbix server at monitoring-server.com … --- ## [Authorization implementation on elastic search results](https://discuss.elastic.co/t/authorization-implementation-on-elastic-search-results/285975)
**Author:** [@hafoosdev](https://discuss.elastic.co/u/hafoosdev)\ **Replies:** 0\ **Last updated:** [October 6, 2021, 4:53am UTC](https://discuss.elastic.co/t/authorization-implementation-on-elastic-search-results/285975 "2021-10-06T04:53:48Z")
We have a requirement to show/hide data to logged in User based on User permissions on each record that we have in Elasticsearch. The algorithm to check if the User has permissions on a given record requires to check mul… --- ## [Confusion on ILM policy and please help me to understand it](https://discuss.elastic.co/t/confusion-on-ilm-policy-and-please-help-me-to-understand-it/285969)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 0\ **Last updated:** [October 6, 2021, 3:37am UTC](https://discuss.elastic.co/t/confusion-on-ilm-policy-and-please-help-me-to-understand-it/285969 "2021-10-06T03:37:39Z")
Hi Team, I am working on a system where I expect daily I am going to ingest a data about 15 GB and my total retention of data should be about 365 days. However my active data would be about 1 month of indices. After 1 m… --- ## [FS Crawler appeared to work but Kibana displays 0 results](https://discuss.elastic.co/t/fs-crawler-appeared-to-work-but-kibana-displays-0-results/285936)
**Author:** [@neergttocsdivad](https://discuss.elastic.co/u/neergttocsdivad)\ **Replies:** 5\ **Last updated:** [October 6, 2021, 3:32am UTC](https://discuss.elastic.co/t/fs-crawler-appeared-to-work-but-kibana-displays-0-results/285936 "2021-10-06T03:32:11Z")
Hello I have created three document collections with which to experiment with Elastic (7.15) Each collection is stored in a separate folder. The folders are named: papers, numb3rs & novels. I have used FS Crawler 2.7… --- ## [Create a Single Rule with Multiple Thresholds with Different Actions per Threshold?](https://discuss.elastic.co/t/create-a-single-rule-with-multiple-thresholds-with-different-actions-per-threshold/285956)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 4\ **Last updated:** [October 5, 2021, 10:15pm UTC](https://discuss.elastic.co/t/create-a-single-rule-with-multiple-thresholds-with-different-actions-per-threshold/285956 "2021-10-05T22:15:22Z")
Hi All, I was wondering if anyone know if the following is possible Rules and Connectors, as I wasn't able to figure out how to do it in the GUI. Have a single rule, let's call it Disk Usage. The goal of this rule is… --- ## [How to parse the following nested json](https://discuss.elastic.co/t/how-to-parse-the-following-nested-json/285959)
**Author:** [@bvoros](https://discuss.elastic.co/u/bvoros)\ **Replies:** 1\ **Last updated:** [October 5, 2021, 6:53pm UTC](https://discuss.elastic.co/t/how-to-parse-the-following-nested-json/285959 "2021-10-05T18:53:35Z")
Hello, I would like to know how to parse the list of nested json "documents" inside a json list field. Thank you in advance, There is that list of name and value pairs in the following format: { "list": \[ { … --- ## [Parsing mongodb input fully via logstash =\> elasticsearch](https://discuss.elastic.co/t/parsing-mongodb-input-fully-via-logstash-elasticsearch/285843)
**Author:** [@diaztech](https://discuss.elastic.co/u/diaztech)\ **Replies:** 6\ **Last updated:** [October 5, 2021, 6:28pm UTC](https://discuss.elastic.co/t/parsing-mongodb-input-fully-via-logstash-elasticsearch/285843 "2021-10-05T18:28:23Z")
I'm parsing a mongodb input into logstash, the config file is as follows: input { mongodb { uri =\> "\" placeholder\_db\_dir =\> "\" collection =\> "modules" batch\_size =\> 50… --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/285402)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 6\ **Last updated:** [October 5, 2021, 5:47pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/285402 "2021-10-05T17:47:05Z")
I am slowly making headway with my installation of ELK Stack 7.13.4. I was at one point unable to connect and was showing a block, which turned out to be firewalls on the Red Hat Linux 8 operating systems. I have allow… --- ## [Kibana 7.14.2 Event Filter drop fails to drop events](https://discuss.elastic.co/t/kibana-7-14-2-event-filter-drop-fails-to-drop-events/284763)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 12\ **Last updated:** [October 5, 2021, 5:38pm UTC](https://discuss.elastic.co/t/kibana-7-14-2-event-filter-drop-fails-to-drop-events/284763 "2021-10-05T17:38:01Z")
Kibana 7.14.2 is no longer dropping events that are in the events filter drop list. This is creating massive amounts of excessive unneeded data. 30+mil events per hour. In kibana, Elastic Security, Event filters section… --- ## [Kibana json input](https://discuss.elastic.co/t/kibana-json-input/285857)
**Author:** [@azulgrana](https://discuss.elastic.co/u/azulgrana)\ **Replies:** 1\ **Last updated:** [October 5, 2021, 1:38am UTC](https://discuss.elastic.co/t/kibana-json-input/285857 "2021-10-05T01:38:06Z")
Hi there! I have a custom visualization that reports on network traffic by protocol, source and destination. I have added to my Split rows bucket a custom JSON input to strip out the last octet and to display the commun… --- ## [How to combine data from different index in one view while viewing in kibana?](https://discuss.elastic.co/t/how-to-combine-data-from-different-index-in-one-view-while-viewing-in-kibana/284425)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 7\ **Last updated:** [October 5, 2021, 4:47pm UTC](https://discuss.elastic.co/t/how-to-combine-data-from-different-index-in-one-view-while-viewing-in-kibana/284425 "2021-10-05T16:47:22Z")
I am trying to put traffic logs to Elasticsearch. Suppose there are 100 traffic rows. Suppose there are around 25 columns for each row. Suppose 15 columns of all of the 100 traffic logs are same . rest of the columns … --- ## [KIbana Cardinality/Unique Count Metric Lens / TSVB](https://discuss.elastic.co/t/kibana-cardinality-unique-count-metric-lens-tsvb/285944)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 3\ **Last updated:** [October 5, 2021, 4:11pm UTC](https://discuss.elastic.co/t/kibana-cardinality-unique-count-metric-lens-tsvb/285944 "2021-10-05T16:11:54Z")
Hi all, Little question: When working with normal metric aggregations it is possible under "Advanced" to set this parameter {"precision\_threshold": 40000} Does exists any way to set this threshold either globally or i… --- ## [Super Helpful Feature Request regarding Elasticsearch node data](https://discuss.elastic.co/t/super-helpful-feature-request-regarding-elasticsearch-node-data/285722)
**Author:** [@pushshift](https://discuss.elastic.co/u/pushshift)\ **Replies:** 2\ **Last updated:** [October 5, 2021, 3:56pm UTC](https://discuss.elastic.co/t/super-helpful-feature-request-regarding-elasticsearch-node-data/285722 "2021-10-05T15:56:40Z")
I know as a sysadmin, it should be my responsibility to have a list somewhere that contains all the servers / server names that belong to a specific cluster. Unfortunately, sometimes when one is in a rush to meet a deadl… --- ## [Grok pattern for this syslog message for Logstash?](https://discuss.elastic.co/t/grok-pattern-for-this-syslog-message-for-logstash/285896)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 8\ **Last updated:** [October 5, 2021, 2:35pm UTC](https://discuss.elastic.co/t/grok-pattern-for-this-syslog-message-for-logstash/285896 "2021-10-05T14:35:18Z")
Hello I have this syslog message which is ALMOST like the standard RFC3164 so the default syslog plugin should pick it up: \<134\>1 2021-10-05T08:48:18Z MYSERVER iLO5 - - - XML logout: SomeUser - 1.2.3.4(DNS name not fou… --- ## [Date from DB is changed when inserted in ES](https://discuss.elastic.co/t/date-from-db-is-changed-when-inserted-in-es/285904)
**Author:** [@Blazkowicz](https://discuss.elastic.co/u/Blazkowicz)\ **Replies:** 1\ **Last updated:** [October 5, 2021, 2:27pm UTC](https://discuss.elastic.co/t/date-from-db-is-changed-when-inserted-in-es/285904 "2021-10-05T14:27:01Z")
Hi all, Having an issue with a date field when trying to insert it in ES. Searched and tried multiple modes but to no avail. Short story, my date field from Postgres ends up in ES with a timezone attached/offset, even … --- ## [How to make data table of last value](https://discuss.elastic.co/t/how-to-make-data-table-of-last-value/285921)
**Author:** [@GinkoLucas](https://discuss.elastic.co/u/GinkoLucas)\ **Replies:** 4\ **Last updated:** [October 5, 2021, 2:19pm UTC](https://discuss.elastic.co/t/how-to-make-data-table-of-last-value/285921 "2021-10-05T14:19:36Z")
Hi, Do you know how to create a data table with the laste value of every host (for example) ? And is it possible to apply a filter based on last value ? (I dont want to see all hosts) --- ## [Setup FileBeats in AZURE ACI ( Not Azure module )](https://discuss.elastic.co/t/setup-filebeats-in-azure-aci-not-azure-module/285902)
**Author:** [@mklynx](https://discuss.elastic.co/u/mklynx)\ **Replies:** 1\ **Last updated:** [October 5, 2021, 2:03pm UTC](https://discuss.elastic.co/t/setup-filebeats-in-azure-aci-not-azure-module/285902 "2021-10-05T14:03:51Z")
I am looking for some help. I have an elastic stack running in AZURE. I have an Application container running in ACI that logs to a fileshare. I want to move the logging to the elastic stack. I was thinking to add a fil… --- ## [Data tiers, searcheable snapshots and the frozen tier](https://discuss.elastic.co/t/data-tiers-searcheable-snapshots-and-the-frozen-tier/285928)
**Author:** [@ffknob](https://discuss.elastic.co/u/ffknob)\ **Replies:** 4\ **Last updated:** [October 5, 2021, 2:01pm UTC](https://discuss.elastic.co/t/data-tiers-searcheable-snapshots-and-the-frozen-tier/285928 "2021-10-05T14:01:48Z")
Hello I need some help figuring out data tiers, searcheable snapshots and the frozen tier. Consider this: GET \_cat/nodes?v&h=name,node.role&s=name name node.role es01 hms es02 mw es03 cm es04 fm POST \_snapshot/orde… --- ## [How 2 node elastic cluster will failover to secondary node if the primary node fails](https://discuss.elastic.co/t/how-2-node-elastic-cluster-will-failover-to-secondary-node-if-the-primary-node-fails/285919)
**Author:** [@Arcadix](https://discuss.elastic.co/u/Arcadix)\ **Replies:** 1\ **Last updated:** [October 5, 2021, 12:57pm UTC](https://discuss.elastic.co/t/how-2-node-elastic-cluster-will-failover-to-secondary-node-if-the-primary-node-fails/285919 "2021-10-05T12:57:46Z")
Hi, We have 1+1 Elasticsearch Clustering setup on windows server. we need to know which Elastic node URL should call in our application to have a proper Fail over. if one node is down how the application identify that… --- ## [Issue with server.publicBaseUrl](https://discuss.elastic.co/t/issue-with-server-publicbaseurl/285796)
**Author:** [@PhilD](https://discuss.elastic.co/u/PhilD)\ **Replies:** 4\ **Last updated:** [October 5, 2021, 12:51pm UTC](https://discuss.elastic.co/t/issue-with-server-publicbaseurl/285796 "2021-10-05T12:51:11Z")
Hello, I've deployed Kibana 7.14, behind a NGINX proxy, but keep getting a toast notification that server.publicBaseUrl has not been set; yet it has been in kibana.yml. Is there a way to dump the running configuration t… --- ## [Message "Invalid JSON" when inserting a Grok pattern in a Processor for an Ingest Node Pipeline](https://discuss.elastic.co/t/message-invalid-json-when-inserting-a-grok-pattern-in-a-processor-for-an-ingest-node-pipeline/285884)
**Author:** [@ArieTwigt](https://discuss.elastic.co/u/ArieTwigt)\ **Replies:** 0\ **Last updated:** [October 5, 2021, 6:22am UTC](https://discuss.elastic.co/t/message-invalid-json-when-inserting-a-grok-pattern-in-a-processor-for-an-ingest-node-pipeline/285884 "2021-10-05T06:22:56Z")
With the Grok Debugger I managed to create the right Grok pattern for the message I would like to parse. When trying to add the following Grok pattern in the Processor for the Ingest Node Pipeline, I get an error message… --- ## [Application URL not working after upgrade from 7.8 to 7.14.2](https://discuss.elastic.co/t/application-url-not-working-after-upgrade-from-7-8-to-7-14-2/285840)
**Author:** [@hsalim](https://discuss.elastic.co/u/hsalim)\ **Replies:** 1\ **Last updated:** [October 5, 2021, 12:35pm UTC](https://discuss.elastic.co/t/application-url-not-working-after-upgrade-from-7-8-to-7-14-2/285840 "2021-10-05T12:35:04Z")
Hello, I am encountering following two issues: I get 'Application Not Found No application was found at this URL. Try going back or choosing an app from the menu.' when trying to access dashboards. See attached Co… --- ## [Fvh highlighter problem with inverted proximity search](https://discuss.elastic.co/t/fvh-highlighter-problem-with-inverted-proximity-search/285916)
**Author:** [@Wonder\_Garance](https://discuss.elastic.co/u/Wonder_Garance)\ **Replies:** 0\ **Last updated:** [October 5, 2021, 12:31pm UTC](https://discuss.elastic.co/t/fvh-highlighter-problem-with-inverted-proximity-search/285916 "2021-10-05T12:31:11Z")
Hi, I use Elasticsearch 7.9.3, I configured 2 text fileds, one of them is for exact search. Mapping: "text\_html": { "type": "text", "term\_vector": "with\_positions\_offsets", "store": true, "a… --- ## [Manually add geo point to server logs](https://discuss.elastic.co/t/manually-add-geo-point-to-server-logs/285793)
**Author:** [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\ **Replies:** 5\ **Last updated:** [October 5, 2021, 11:46am UTC](https://discuss.elastic.co/t/manually-add-geo-point-to-server-logs/285793 "2021-10-05T11:46:55Z")
How do I add the location of our servers as a geo-point that can be used with Kibana Maps to the logs of that server? For example: Let's say a log has agent.name "AgentExample01", then I would match on that, and add la… --- ## [Unable to store .security index in s3 bucket](https://discuss.elastic.co/t/unable-to-store-security-index-in-s3-bucket/283734)
**Author:** [@Vaidesh](https://discuss.elastic.co/u/Vaidesh)\ **Replies:** 3\ **Last updated:** [October 5, 2021, 11:22am UTC](https://discuss.elastic.co/t/unable-to-store-security-index-in-s3-bucket/283734 "2021-10-05T11:22:32Z")
While taking back up of .security-7 index to S3 bucket getting below error, kindly help. "failures" : \[ { "index" : ".security-7", "index\_uuid" : ".security-7", "shard\_id" : 0, "rea… --- ## [Term does not return the exact results](https://discuss.elastic.co/t/term-does-not-return-the-exact-results/285909)
**Author:** [@Tung\_Doan](https://discuss.elastic.co/u/Tung_Doan)\ **Replies:** 0\ **Last updated:** [October 5, 2021, 11:11am UTC](https://discuss.elastic.co/t/term-does-not-return-the-exact-results/285909 "2021-10-05T11:11:04Z")
I have the following nested schema: dataCollectorInfo.files.indexedData.objects.measures.properties.unit "\_source": { "dataCollectorInfo": { "files": { "indexedData": { "objects": { "measures": { "p… --- ## [Error after upgrading to 7.15](https://discuss.elastic.co/t/error-after-upgrading-to-7-15/285890)
**Author:** [@Mads\_Lundegaard](https://discuss.elastic.co/u/Mads_Lundegaard)\ **Replies:** 7\ **Last updated:** [October 5, 2021, 9:13am UTC](https://discuss.elastic.co/t/error-after-upgrading-to-7-15/285890 "2021-10-05T09:13:49Z")
I am getting errors after I upgraded my client from 7.13.4 to 7.15. I suspect this is due to incompatible versions between server and client, but I am not sure. I tried upgrading the server, running in AWS but could not … --- ## [Boolean comparison using Lens formula](https://discuss.elastic.co/t/boolean-comparison-using-lens-formula/285872)
**Author:** [@Amphagory](https://discuss.elastic.co/u/Amphagory)\ **Replies:** 1\ **Last updated:** [October 5, 2021, 8:23am UTC](https://discuss.elastic.co/t/boolean-comparison-using-lens-formula/285872 "2021-10-05T08:23:57Z")
Hello, I was wondering if this is possible using Lens formula to return a boolean true or false value? Toy example: 101 \>= 100 would return true Or maybe there is another way to achieve this result? Thanks in advanc… --- ## [Internal Server Error](https://discuss.elastic.co/t/internal-server-error/283612)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 2\ **Last updated:** [October 5, 2021, 8:19am UTC](https://discuss.elastic.co/t/internal-server-error/283612 "2021-10-05T08:19:44Z")
Hello dear friends :slight\_smile: I have a problem. First thing I want to do is: I want to backup the indexes I created before, so I created some folders in "C:\\ "and added them to my elasticsearch.yml file.Then I restar… --- ## [How to fingerprint with a removed field?](https://discuss.elastic.co/t/how-to-fingerprint-with-a-removed-field/284282)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 6\ **Last updated:** [October 5, 2021, 8:02am UTC](https://discuss.elastic.co/t/how-to-fingerprint-with-a-removed-field/284282 "2021-10-05T08:02:56Z")
Hello friends, I want to put a field in a @metadata variable and use this field for fingerprinting later in logstash conf file. Is it possible for me to do this?Does anyone have an idea? I made some attempts but no resu… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1212) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1214)