# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1246 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1247 --- ## [Encrypt or hide ES credentials in td-agent configuration file](https://discuss.elastic.co/t/encrypt-or-hide-es-credentials-in-td-agent-configuration-file/283770)
**Author:** [@Swathi\_Nayak](https://discuss.elastic.co/u/Swathi_Nayak)\ **Replies:** 1\ **Last updated:** [September 9, 2021, 1:49pm UTC](https://discuss.elastic.co/t/encrypt-or-hide-es-credentials-in-td-agent-configuration-file/283770 "2021-09-09T13:49:51Z")
We have a td-agent configuration file that connects to elastic search with SSL enabled. User and password is used for safe connection. But these credentials are in plain text. How to encrypt or hide these credentials? \ **Author:** [@hNiven](https://discuss.elastic.co/u/hNiven)\ **Replies:** 2\ **Last updated:** [September 9, 2021, 1:21pm UTC](https://discuss.elastic.co/t/canvas-bar-chart-is-it-possible-to-have-the-y-axis-in-a-time-format/283642 "2021-09-09T13:21:31Z") Hi, I am creating a bar chart on canvas where the x-axis is in months and the y-axis is in seconds for some sort of process to be completed. I was wondering if instead of having the y-axis in seconds you can get it to b… --- ## [MISP objects cannot be stored in Elastic & Kibana](https://discuss.elastic.co/t/misp-objects-cannot-be-stored-in-elastic-kibana/283780)
**Author:** [@Abanob\_Medhat](https://discuss.elastic.co/u/Abanob_Medhat)\ **Replies:** 0\ **Last updated:** [September 9, 2021, 1:13pm UTC](https://discuss.elastic.co/t/misp-objects-cannot-be-stored-in-elastic-kibana/283780 "2021-09-09T13:13:28Z")
Hi , I have a problem with MISP integration with Filebeat & ELK. I'm using Virustotal module on MISP and the results of virustotoal are saved in objects in the same Event . the problem is that all objects cannot be sa… --- ## [Kibana DMARC IP location](https://discuss.elastic.co/t/kibana-dmarc-ip-location/282574)
**Author:** [@hapkoek](https://discuss.elastic.co/u/hapkoek)\ **Replies:** 4\ **Last updated:** [September 9, 2021, 8:10am UTC](https://discuss.elastic.co/t/kibana-dmarc-ip-location/282574 "2021-09-09T08:10:04Z")
Hi all, Recently I installed Elastic and Kibana to create a dashboard for DMARC statistics. (ParseDMARC) Currently Kibana uses ParseDMARC objects to import the data. Two of the fields are Source\_IP and Destination\_IP. … --- ## [Elastic Agent won't enroll](https://discuss.elastic.co/t/elastic-agent-wont-enroll/282212)
**Author:** [@greggailly](https://discuss.elastic.co/u/greggailly)\ **Replies:** 11\ **Last updated:** [September 9, 2021, 12:23pm UTC](https://discuss.elastic.co/t/elastic-agent-wont-enroll/282212 "2021-09-09T12:23:07Z")
Hi, We are having difficulties with some agents not enrolling properly into fleet especially on Windows machines. The setup seems to be ok as we can enroll from some servers. However on other servers when launching th… --- ## [Analyse usage on Kibana](https://discuss.elastic.co/t/analyse-usage-on-kibana/283443)
**Author:** [@Ankit\_Vishwakarma](https://discuss.elastic.co/u/Ankit_Vishwakarma)\ **Replies:** 3\ **Last updated:** [September 9, 2021, 11:53am UTC](https://discuss.elastic.co/t/analyse-usage-on-kibana/283443 "2021-09-09T11:53:13Z")
I want to capture the user's action on Kibana dashboard. User actions like the open dashboard, click on visualizations, etc. Is there any metric that captures user actions/events? This will help us to identify the usage… --- ## [Java Heap dump consuming disk space](https://discuss.elastic.co/t/java-heap-dump-consuming-disk-space/283068)
**Author:** [@krish0608](https://discuss.elastic.co/u/krish0608)\ **Replies:** 11\ **Last updated:** [September 9, 2021, 11:35am UTC](https://discuss.elastic.co/t/java-heap-dump-consuming-disk-space/283068 "2021-09-09T11:35:41Z")
We have been getting java heap out of memory errors quite regularly, so this time we decided to take the heap dump and analyze it. But, unfortunately its tough for us to make anything out of it. So we are seeking for … --- ## [Logstash - based on filed type create a new field](https://discuss.elastic.co/t/logstash-based-on-filed-type-create-a-new-field/283684)
**Author:** [@antonisnyc94](https://discuss.elastic.co/u/antonisnyc94)\ **Replies:** 5\ **Last updated:** [September 9, 2021, 10:43am UTC](https://discuss.elastic.co/t/logstash-based-on-filed-type-create-a-new-field/283684 "2021-09-09T10:43:42Z")
Hello, I've been trying for 1-2 days to figure out why to create new fields when the type of the event is object but I cant seem to make it work.. This is the error im getting: Could not index event to Elasticsearch. … --- ## [Is there any method to show specific host into one single chart in the dashboard?](https://discuss.elastic.co/t/is-there-any-method-to-show-specific-host-into-one-single-chart-in-the-dashboard/283166)
**Author:** [@afan](https://discuss.elastic.co/u/afan)\ **Replies:** 4\ **Last updated:** [September 9, 2021, 10:41am UTC](https://discuss.elastic.co/t/is-there-any-method-to-show-specific-host-into-one-single-chart-in-the-dashboard/283166 "2021-09-09T10:41:41Z")
I am trying to build the dashboard right now and able to show the CPU/memory usage by single specific host as below. however, I would like to group some specific hostnames (just like uat servers or app servers) to sho… --- ## [How get sum for example with integer fields of each doc](https://discuss.elastic.co/t/how-get-sum-for-example-with-integer-fields-of-each-doc/283747)
**Author:** [@Grigor\_Martirosyan](https://discuss.elastic.co/u/Grigor_Martirosyan)\ **Replies:** 5\ **Last updated:** [September 9, 2021, 10:39am UTC](https://discuss.elastic.co/t/how-get-sum-for-example-with-integer-fields-of-each-doc/283747 "2021-09-09T10:39:33Z")
I use elastic with spring boot ,and have integer fields in my doc and now I need to do some calculation with those fields for each doc ,is that possible?? this is some try Script script = new Script("{\\n" + … --- ## [Linux file beat configuration not working](https://discuss.elastic.co/t/linux-file-beat-configuration-not-working/283731)
**Author:** [@Kannan\_Rajendran](https://discuss.elastic.co/u/Kannan_Rajendran)\ **Replies:** 1\ **Last updated:** [September 9, 2021, 10:18am UTC](https://discuss.elastic.co/t/linux-file-beat-configuration-not-working/283731 "2021-09-09T10:18:34Z")
i'm trying to take log from linux machine with oracle database installed. Based on the below configuration the filebeat doesn't pull any info to elastic search. filebeat.inputs: - type: log enabled: true paths: … --- ## [Filebeat logstash communication](https://discuss.elastic.co/t/filebeat-logstash-communication/283757)
**Author:** [@Nitzan\_Zaifman](https://discuss.elastic.co/u/Nitzan_Zaifman)\ **Replies:** 0\ **Last updated:** [September 9, 2021, 9:05am UTC](https://discuss.elastic.co/t/filebeat-logstash-communication/283757 "2021-09-09T09:05:35Z")
Hi, I've took a look at However I still have multiple questions regarding filebeat's logstash output. How many TCP connections are generated? from my testing even with multiple pipelines (the default) and setting u… --- ## [Read-only Query](https://discuss.elastic.co/t/read-only-query/283040)
**Author:** [@k.schmidtke](https://discuss.elastic.co/u/k.schmidtke)\ **Replies:** 2\ **Last updated:** [September 9, 2021, 9:54am UTC](https://discuss.elastic.co/t/read-only-query/283040 "2021-09-09T09:54:23Z")
I want to have preset Dashboards for Users with fixed querys that cannot be changed. Example: I want my Dashboard to query with "header\_from : company.com", but it schouldn't be changeable by read-only users Is this p… --- ## [Need help to have space on elasticsearch](https://discuss.elastic.co/t/need-help-to-have-space-on-elasticsearch/282220)
**Author:** [@Pacous](https://discuss.elastic.co/u/Pacous)\ **Replies:** 13\ **Last updated:** [September 9, 2021, 9:42am UTC](https://discuss.elastic.co/t/need-help-to-have-space-on-elasticsearch/282220 "2021-09-09T09:42:03Z")
When I replay the logs from logstash to elasticsearch, I no longer see them on kibana. I think there is no more storage space. So I go to Stack Management -\> Index Management to delete Indices. But, that does not solve… --- ## [Filebeat - Elasticsearch output is not configured](https://discuss.elastic.co/t/filebeat-elasticsearch-output-is-not-configured/283637)
**Author:** [@X\_T](https://discuss.elastic.co/u/X_T)\ **Replies:** 14\ **Last updated:** [September 9, 2021, 9:31am UTC](https://discuss.elastic.co/t/filebeat-elasticsearch-output-is-not-configured/283637 "2021-09-09T09:31:10Z")
Hi team, i'm facing an issue when setting up Filebeat 6.5.0 (testing on this version for an upcoming upgrade) in a Windows machine. I know that Filebeat is not the best to use it on Windows but i am just sending logs in… --- ## [Drop Events works only for Linux](https://discuss.elastic.co/t/drop-events-works-only-for-linux/283263)
**Author:** [@fpsouza](https://discuss.elastic.co/u/fpsouza)\ **Replies:** 2\ **Last updated:** [September 9, 2021, 8:51am UTC](https://discuss.elastic.co/t/drop-events-works-only-for-linux/283263 "2021-09-09T08:51:32Z")
Hello Sirs, Could you please let me know when my drop events below is only working for linux and not for windows platfom? Is tere something that should be difference in the metricbeat.yml file? Follow my metricbeat.yml… --- ## [TSVB Clipping with elk 7.10.2](https://discuss.elastic.co/t/tsvb-clipping-with-elk-7-10-2/281973)
**Author:** [@Rollup\_eval](https://discuss.elastic.co/u/Rollup_eval)\ **Replies:** 1\ **Last updated:** [September 9, 2021, 8:26am UTC](https://discuss.elastic.co/t/tsvb-clipping-with-elk-7-10-2/281973 "2021-09-09T08:26:13Z")
I'am using elk 7.10.2 and TSVB kibana plugin. For TSVB , I enter axis-min 0.1 for axis betwwen 0% and 100%, i get the following Any lines with one extremity lower than axis min dissappear: clipping fails Note that … --- ## [Plain text on markdown is not displayed if I select a long time range](https://discuss.elastic.co/t/plain-text-on-markdown-is-not-displayed-if-i-select-a-long-time-range/283626)
**Author:** [@Fosco](https://discuss.elastic.co/u/Fosco)\ **Replies:** 6\ **Last updated:** [September 9, 2021, 8:17am UTC](https://discuss.elastic.co/t/plain-text-on-markdown-is-not-displayed-if-i-select-a-long-time-range/283626 "2021-09-09T08:17:43Z")
Hello, I am on kibana 7.10.2 and when I create a TSVB Markdown visual with only plain text (or with an image), and then I select a time range of one year, the visual loads a long time until this error : Thanks --- ## [Pin main menu](https://discuss.elastic.co/t/pin-main-menu/283659)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 2\ **Last updated:** [September 9, 2021, 8:09am UTC](https://discuss.elastic.co/t/pin-main-menu/283659 "2021-09-09T08:09:16Z")
Hi, Using 7.14.1 In the past there was the possibility to pin the main menu, hoewever nowadays the menu slides away always. Is there no way to pin this/ make it always visible? Cheers --- ## [7.14.x Kibana query bar (search) user interface glitch in Firefox 91/92](https://discuss.elastic.co/t/7-14-x-kibana-query-bar-search-user-interface-glitch-in-firefox-91-92/283740)
**Author:** [@jsteenkamp](https://discuss.elastic.co/u/jsteenkamp)\ **Replies:** 1\ **Last updated:** [September 9, 2021, 7:10am UTC](https://discuss.elastic.co/t/7-14-x-kibana-query-bar-search-user-interface-glitch-in-firefox-91-92/283740 "2021-09-09T07:10:19Z")
Kibana query bar (search) user interface glitch. Firefox version 91 and 92 Kibana version 7.14.0 and 7.14.1 --- ## [Index.number\_of\_replicas setting is not applied during ES startup](https://discuss.elastic.co/t/index-number-of-replicas-setting-is-not-applied-during-es-startup/281946)
**Author:** [@Viktor\_H](https://discuss.elastic.co/u/Viktor_H)\ **Replies:** 3\ **Last updated:** [September 9, 2021, 6:43am UTC](https://discuss.elastic.co/t/index-number-of-replicas-setting-is-not-applied-during-es-startup/281946 "2021-09-09T06:43:20Z")
I have a question regarding index.number\_of\_replicas setting in elasticsearch.yml. I'm using elastisearch 2.4. Let me explain the situation. I mirror the ES index from single (PROD) node into 3 nodes, which together form… --- ## [Fail to match query](https://discuss.elastic.co/t/fail-to-match-query/283737)
**Author:** [@ekrx](https://discuss.elastic.co/u/ekrx)\ **Replies:** 1\ **Last updated:** [September 9, 2021, 6:41am UTC](https://discuss.elastic.co/t/fail-to-match-query/283737 "2021-09-09T06:41:55Z")
Hi Im using multimatch with cross fields and im failing to match a query where the query contains more information than the field in the index. for example in the index I have "countryName": "United states of America" … --- ## [\[Kibana 7.10\] how to match item in two index patten](https://discuss.elastic.co/t/kibana-7-10-how-to-match-item-in-two-index-patten/283730)
**Author:** [@cps598](https://discuss.elastic.co/u/cps598)\ **Replies:** 1\ **Last updated:** [September 9, 2021, 5:52am UTC](https://discuss.elastic.co/t/kibana-7-10-how-to-match-item-in-two-index-patten/283730 "2021-09-09T05:52:45Z")
I originally have two index patterns with one same item called user.id. Now I create one more index pattern which combines those two indexes. But I find that they just simply add one index after another, which includes t… --- ## [Elastalert send me 0 hit query doesn't work ? please help](https://discuss.elastic.co/t/elastalert-send-me-0-hit-query-doesnt-work-please-help/283732)
**Author:** [@Salim\_Adnan](https://discuss.elastic.co/u/Salim_Adnan)\ **Replies:** 2\ **Last updated:** [September 9, 2021, 5:47am UTC](https://discuss.elastic.co/t/elastalert-send-me-0-hit-query-doesnt-work-please-help/283732 "2021-09-09T05:47:58Z")
\--------------my config.yaml------------ This is the folder that contains the rule yaml files Any .yaml file will be loaded as a rule rules\_folder: example\_rules How often ElastAlert will query Elasticsearch The unit c… --- ## [Setting up elastic cluster](https://discuss.elastic.co/t/setting-up-elastic-cluster/283673)
**Author:** [@elastic\_dev](https://discuss.elastic.co/u/elastic_dev)\ **Replies:** 2\ **Last updated:** [September 9, 2021, 5:25am UTC](https://discuss.elastic.co/t/setting-up-elastic-cluster/283673 "2021-09-09T05:25:28Z")
Hi, I am setting up the Elasticsearch with 2 nodes. whenever I start my node-2 it gives me error as below '\[2021-09-08T19:24:43,093\]\[ERROR\]\[o.e.i.g.DatabaseRegistry \] \[node-2\] failed to download database \[GeoLite2-ASN.m… --- ## [I need to have multiple index based on the path of log file](https://discuss.elastic.co/t/i-need-to-have-multiple-index-based-on-the-path-of-log-file/283667)
**Author:** [@akhilkandari](https://discuss.elastic.co/u/akhilkandari)\ **Replies:** 2\ **Last updated:** [September 9, 2021, 4:52am UTC](https://discuss.elastic.co/t/i-need-to-have-multiple-index-based-on-the-path-of-log-file/283667 "2021-09-09T04:52:37Z")
we have 2 environment one dev & one prod storing logs in dev path & prod path so how can i have 2 separate index for both of these based on path input { stdin{ type =\> "stdin-type" } file{ type… --- ## [Unable to create monthly index in filebeat to elasticsearch](https://discuss.elastic.co/t/unable-to-create-monthly-index-in-filebeat-to-elasticsearch/281567)
**Author:** [@Shaiju\_Sam](https://discuss.elastic.co/u/Shaiju_Sam)\ **Replies:** 3\ **Last updated:** [September 9, 2021, 4:36am UTC](https://discuss.elastic.co/t/unable-to-create-monthly-index-in-filebeat-to-elasticsearch/281567 "2021-09-09T04:36:52Z")
Hi Team, I am trying to sending logs from couple of my windows servers using filebeat to elasticsearch directly. The index patterns are getting created by default ( filebeat-7.10.2-2021.08.16) however I want to create a… --- ## [Stop Filebeat automatically after it uploaded all log files](https://discuss.elastic.co/t/stop-filebeat-automatically-after-it-uploaded-all-log-files/283473)
**Author:** [@vladik22](https://discuss.elastic.co/u/vladik22)\ **Replies:** 2\ **Last updated:** [September 9, 2021, 4:32am UTC](https://discuss.elastic.co/t/stop-filebeat-automatically-after-it-uploaded-all-log-files/283473 "2021-09-09T04:32:22Z")
There is an option to configure Filebeat to stop automatically after it uploaded all log files? Before every uploading log file I should to modify them. --- ## [How to search all Domain](https://discuss.elastic.co/t/how-to-search-all-domain/282797)
**Author:** [@Mick1](https://discuss.elastic.co/u/Mick1)\ **Replies:** 3\ **Last updated:** [September 9, 2021, 4:07am UTC](https://discuss.elastic.co/t/how-to-search-all-domain/282797 "2021-09-09T04:07:20Z")
Why domain : \*.02222105.com include www.02222105.com and 02222105.com but not include www100.02222105.com How to Search all Domain (Lucene or KQL) Thanks you Master --- ## [Kafka (topic=): dropping invalid message](https://discuss.elastic.co/t/kafka-topic-dropping-invalid-message/283728)
**Author:** [@flaviawang](https://discuss.elastic.co/u/flaviawang)\ **Replies:** 0\ **Last updated:** [September 9, 2021, 3:49am UTC](https://discuss.elastic.co/t/kafka-topic-dropping-invalid-message/283728 "2021-09-09T03:49:34Z")
2021-09-08T19:15:47.776+0800 ERROR \[kafka\] kafka/client.go:341 Kafka (topic=ilog-filebeat-test): dropping invalid message [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1245) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1247)