# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1268 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1269 --- ## [Issues with certbot certificates and kibana](https://discuss.elastic.co/t/issues-with-certbot-certificates-and-kibana/282270)
**Author:** [@noobthenoob](https://discuss.elastic.co/u/noobthenoob)\ **Replies:** 3\ **Last updated:** [August 24, 2021, 7:09pm UTC](https://discuss.elastic.co/t/issues-with-certbot-certificates-and-kibana/282270 "2021-08-24T19:09:43Z")
\[MY\_DOMAIN\] = My externally accessable url such as "asdf.dk" \[MY\_LOCAL\_SERVER\_IP\] = My servers local IP address such as 192.168.1.2 Hello everyone, I have some issues with kibana & certbot certificates. Let me elabor… --- ## [Can't setup Nginx reverse proxy for Kibana in Localhost](https://discuss.elastic.co/t/cant-setup-nginx-reverse-proxy-for-kibana-in-localhost/282176)
**Author:** [@Amine\_Chichi](https://discuss.elastic.co/u/Amine_Chichi)\ **Replies:** 3\ **Last updated:** [August 24, 2021, 6:57pm UTC](https://discuss.elastic.co/t/cant-setup-nginx-reverse-proxy-for-kibana-in-localhost/282176 "2021-08-24T18:57:59Z")
I want to set up a reverse proxy to access kibana using a username and a password, so I followed this tutorial. When I use the URL http://elastic.local to access kibana the timeout occurs and nothing happen. But when I … --- ## [Best practices for logstash output configuration and Elasticsearch](https://discuss.elastic.co/t/best-practices-for-logstash-output-configuration-and-elasticsearch/281642)
**Author:** [@Vinay\_Kumar2](https://discuss.elastic.co/u/Vinay_Kumar2)\ **Replies:** 1\ **Last updated:** [August 24, 2021, 6:42pm UTC](https://discuss.elastic.co/t/best-practices-for-logstash-output-configuration-and-elasticsearch/281642 "2021-08-24T18:42:31Z")
Hello, My question is related to the correct way to configure the output, for Elasticsearch. Right now my Elasticsearch cluster is one dedicated master node, 3 data nodes and acts as master eligible nodes and 1 coordi… --- ## [Filebeat Multiline Pattern not working on Production servers](https://discuss.elastic.co/t/filebeat-multiline-pattern-not-working-on-production-servers/282398)
**Author:** [@Pavani\_Reddy](https://discuss.elastic.co/u/Pavani_Reddy)\ **Replies:** 0\ **Last updated:** [August 24, 2021, 6:41pm UTC](https://discuss.elastic.co/t/filebeat-multiline-pattern-not-working-on-production-servers/282398 "2021-08-24T18:41:33Z")
Hi Team, I am using multiline.pattern in filebeat for parsing logs. I am able parse the logs correctly on local lab servers, but when implemented the same on prod servers , multiple logs gets indexed as one event to el… --- ## [Formatting data as a block in logstash](https://discuss.elastic.co/t/formatting-data-as-a-block-in-logstash/282027)
**Author:** [@selin](https://discuss.elastic.co/u/selin)\ **Replies:** 1\ **Last updated:** [August 24, 2021, 6:36pm UTC](https://discuss.elastic.co/t/formatting-data-as-a-block-in-logstash/282027 "2021-08-24T18:36:52Z")
Below is my sample data. How can it be filter based on start time and end time using grok pattern. Any idea friends since the data came as a stream of blocks. Can you guys suggest and provid example. I need to know start… --- ## [Grok filter](https://discuss.elastic.co/t/grok-filter/282374)
**Author:** [@lexanic](https://discuss.elastic.co/u/lexanic)\ **Replies:** 1\ **Last updated:** [August 24, 2021, 6:16pm UTC](https://discuss.elastic.co/t/grok-filter/282374 "2021-08-24T18:16:02Z")
Не работает grok filter grok { match =\> { "message" =\> \[ "%{POSTFIX\_MSG\_ID:taskid}: client=(?\\[^\]\]+)\[%{IP:client\_ip}\]", "%{POSTFIX\_MSG\_ID:taskid}: message-id=\<(?\\[^\>\]+)\>.", "%{POSTFIX\_MSG… --- ## [\[Logstash\] \ on json with \[null\]](https://discuss.elastic.co/t/logstash-java-31-nil-on-json-with-null/282382)
**Author:** [@zenkovac](https://discuss.elastic.co/u/zenkovac)\ **Replies:** 2\ **Last updated:** [August 24, 2021, 6:14pm UTC](https://discuss.elastic.co/t/logstash-java-31-nil-on-json-with-null/282382 "2021-08-24T18:14:51Z")
hi, i'm experiencing an error when processing a json log which has a \[null\] value on a field. ■The log is the following (tested as valid json): {"message":{"errorMessage":"INTERNAL\_SERVER\_ERROR","errorDetail":{"message… --- ## [Creating a Utilization% Gauge](https://discuss.elastic.co/t/creating-a-utilization-gauge/282392)
**Author:** [@mericaforrestgumpsun](https://discuss.elastic.co/u/mericaforrestgumpsun)\ **Replies:** 0\ **Last updated:** [August 24, 2021, 5:11pm UTC](https://discuss.elastic.co/t/creating-a-utilization-gauge/282392 "2021-08-24T17:11:34Z")
Hey Everyone, I am struggling to make a Utilization% Gauge, that will take in an amount of second and tell me what percentage of a 24 Hours that took. I would like the gauge to also work if I changed the timescale any a… --- ## [Can Elasticsearch aggregate logs in a "live" manner and meet our needs at scale?](https://discuss.elastic.co/t/can-elasticsearch-aggregate-logs-in-a-live-manner-and-meet-our-needs-at-scale/282352)
**Author:** [@nsouth](https://discuss.elastic.co/u/nsouth)\ **Replies:** 4\ **Last updated:** [August 24, 2021, 4:52pm UTC](https://discuss.elastic.co/t/can-elasticsearch-aggregate-logs-in-a-live-manner-and-meet-our-needs-at-scale/282352 "2021-08-24T16:52:50Z")
My team is new to Elasticsearch and is considering it for log analysis. I need to be able to tell my manager whether the technology can scale to meet our needs. So that's my question: Can Elasticsearch meet our goals at … --- ## [Getting metricbeat error on 7.14 v](https://discuss.elastic.co/t/getting-metricbeat-error-on-7-14-v/282272)
**Author:** [@cool999](https://discuss.elastic.co/u/cool999)\ **Replies:** 4\ **Last updated:** [August 24, 2021, 4:50pm UTC](https://discuss.elastic.co/t/getting-metricbeat-error-on-7-14-v/282272 "2021-08-24T16:50:42Z")
Hi, I have ansible config files which was installing all elasticsearch components of 7.4 version. I have changed it to download and use 7.14 version. I am getting below error, elasticsearch service is not getting sta… --- ## [Ingesting PCAP dataset into ELK via Zeek and Zeek scripting](https://discuss.elastic.co/t/ingesting-pcap-dataset-into-elk-via-zeek-and-zeek-scripting/282280)
**Author:** [@momo1104](https://discuss.elastic.co/u/momo1104)\ **Replies:** 3\ **Last updated:** [August 24, 2021, 3:59pm UTC](https://discuss.elastic.co/t/ingesting-pcap-dataset-into-elk-via-zeek-and-zeek-scripting/282280 "2021-08-24T15:59:10Z")
Hello, I am having trouble with filebeat and logstash configurations I think. What I am trying to do is send a DDoS pcap dataset (saved on my ubuntu machine) to ELK, using Zeek while applying Zeek scripts to it. I hav… --- ## [How to make sure that whitelisted plugin for painless is working?](https://discuss.elastic.co/t/how-to-make-sure-that-whitelisted-plugin-for-painless-is-working/282216)
**Author:** [@gowthamkaruturi](https://discuss.elastic.co/u/gowthamkaruturi)\ **Replies:** 2\ **Last updated:** [August 24, 2021, 2:52pm UTC](https://discuss.elastic.co/t/how-to-make-sure-that-whitelisted-plugin-for-painless-is-working/282216 "2021-08-24T14:52:14Z")
Hi I have created a sample whitelist plugin for painless, so that i can use the whitelisted methods in my painless script. i used the following guide to have custom hexdigest methods compiled in to plugin Aim of the… --- ## [S3 No files found in bucket](https://discuss.elastic.co/t/s3-no-files-found-in-bucket/282332)
**Author:** [@whassanwj](https://discuss.elastic.co/u/whassanwj)\ **Replies:** 4\ **Last updated:** [August 24, 2021, 3:33pm UTC](https://discuss.elastic.co/t/s3-no-files-found-in-bucket/282332 "2021-08-24T15:33:01Z")
Hi, I'm struggling with logstash conf to read from S3 bucket which has the latest date, example structure in S3 bucket as follows: apachelogs/web/2021-08-22/ apachelogs/web/2021-08-23/ apachelogs/web/2021-08-24/ Henc… --- ## [Unique Count in Kibana Metric Graph](https://discuss.elastic.co/t/unique-count-in-kibana-metric-graph/282164)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 1\ **Last updated:** [August 24, 2021, 3:18pm UTC](https://discuss.elastic.co/t/unique-count-in-kibana-metric-graph/282164 "2021-08-24T15:18:44Z")
Hi Im using metric graph . Its showing Unique users count as a Text. But I wanted to know who are those unique users. Is it possible in this graph or any other graph? Regards Ram --- ## [Ideas? Evaluating enums and associating array values](https://discuss.elastic.co/t/ideas-evaluating-enums-and-associating-array-values/282126)
**Author:** [@Sayori](https://discuss.elastic.co/u/Sayori)\ **Replies:** 1\ **Last updated:** [August 24, 2021, 3:05pm UTC](https://discuss.elastic.co/t/ideas-evaluating-enums-and-associating-array-values/282126 "2021-08-24T15:05:48Z")
Hey all. I'm new to the whole Elastic Stack and have been replacing some spaghetti-code in-house logging solutions recently. Something that was very easy when scripting a custom website was fetching and displaying differ… --- ## [Trying to be ECS compliance in order to have visual analysis. It's hard! Help needed](https://discuss.elastic.co/t/trying-to-be-ecs-compliance-in-order-to-have-visual-analysis-its-hard-help-needed/282370)
**Author:** [@syunusic](https://discuss.elastic.co/u/syunusic)\ **Replies:** 0\ **Last updated:** [August 24, 2021, 3:04pm UTC](https://discuss.elastic.co/t/trying-to-be-ecs-compliance-in-order-to-have-visual-analysis-its-hard-help-needed/282370 "2021-08-24T15:04:13Z")
I’m renaming Fortigate’s field names from how Fortinet called them to a ECS compatible one. There is the integration section and there is also the exported field section. Which one do I have to follow? Three examples to … --- ## [Kibana 7.13.4 - Report Failure - Aborting due to maximum number of retries hit \[40\]](https://discuss.elastic.co/t/kibana-7-13-4-report-failure-aborting-due-to-maximum-number-of-retries-hit-40/282156)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 1\ **Last updated:** [August 24, 2021, 3:02pm UTC](https://discuss.elastic.co/t/kibana-7-13-4-report-failure-aborting-due-to-maximum-number-of-retries-hit-40/282156 "2021-08-24T15:02:52Z")
Hi, I have 50 reports configured in watcher to automate the sharing of CSV reports from kibana which set for on timings to share the last 24 hours of data. There are few reports getting failed by showing the below erro… --- ## [Failed to execute progress listener on query failure](https://discuss.elastic.co/t/failed-to-execute-progress-listener-on-query-failure/281852)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 15\ **Last updated:** [August 24, 2021, 2:31pm UTC](https://discuss.elastic.co/t/failed-to-execute-progress-listener-on-query-failure/281852 "2021-08-24T14:31:16Z")
Although my Elasticsearch SEEMS to be working correctly, Im getting this error in the logs Failed to execute progress listener on query failure Basically I go to Discover, pick any index and this gets logged. I try to … --- ## [Have a problem with my Suricata + ELK stack](https://discuss.elastic.co/t/have-a-problem-with-my-suricata-elk-stack/281364)
**Author:** [@Yves\_Silvere\_Randria](https://discuss.elastic.co/u/Yves_Silvere_Randria)\ **Replies:** 12\ **Last updated:** [August 24, 2021, 1:50pm UTC](https://discuss.elastic.co/t/have-a-problem-with-my-suricata-elk-stack/281364 "2021-08-24T13:50:11Z")
Hello, I have this error when I am setting up ELK servers + Suricata . --- ## [Can I put the label value outside the vertical bar?](https://discuss.elastic.co/t/can-i-put-the-label-value-outside-the-vertical-bar/282077)
**Author:** [@El\_busc](https://discuss.elastic.co/u/El_busc)\ **Replies:** 5\ **Last updated:** [August 24, 2021, 1:52pm UTC](https://discuss.elastic.co/t/can-i-put-the-label-value-outside-the-vertical-bar/282077 "2021-08-24T13:52:16Z")
Hello in previous versions of kibana it was possible to choose where the bar label would be, but in the current version I'm not able to do that, is there any way to put the label value above the bar and would it be possi… --- ## [How many workers on filebeat?](https://discuss.elastic.co/t/how-many-workers-on-filebeat/282354)
**Author:** [@Arethusa](https://discuss.elastic.co/u/Arethusa)\ **Replies:** 0\ **Last updated:** [August 24, 2021, 1:30pm UTC](https://discuss.elastic.co/t/how-many-workers-on-filebeat/282354 "2021-08-24T13:30:57Z")
Hello, I am not sure to understand how many work do I need. On this configuration I see that : # nano /etc/filebeat/filebeat.yml output.logstash: hosts: \["logstash1:5044","logstash2:5044","logstash3:5044"\] loadb… --- ## [Stack Monitoring Error](https://discuss.elastic.co/t/stack-monitoring-error/282267)
**Author:** [@bigbobolue](https://discuss.elastic.co/u/bigbobolue)\ **Replies:** 2\ **Last updated:** [August 24, 2021, 12:33pm UTC](https://discuss.elastic.co/t/stack-monitoring-error/282267 "2021-08-24T12:33:25Z")
\[illegal\_argument\_exception\] Field \[timestamp\] of type \[keyword\] is not supported for aggregation \[max\] (and) \[illegal\_argument\_exception\] Field \[timestamp\] of type \[keyword\] is not supported for aggregation \[max\] (and) … --- ## [Logstash KV filter - Wrong parsing](https://discuss.elastic.co/t/logstash-kv-filter-wrong-parsing/282333)
**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\ **Replies:** 4\ **Last updated:** [August 24, 2021, 12:37pm UTC](https://discuss.elastic.co/t/logstash-kv-filter-wrong-parsing/282333 "2021-08-24T12:37:26Z")
Hello, I'm using KV filter in Logstash. Logstash configuration: filter { #PARSING LOG #------------------------------------------ grok { patterns\_dir =\> \["/etc/logstash/grok-patterns"\] break\_on\_mat… --- ## [Metricbeat: Dashboard desired pods shown as 0 (zero)](https://discuss.elastic.co/t/metricbeat-dashboard-desired-pods-shown-as-0-zero/282340)
**Author:** [@mgo1](https://discuss.elastic.co/u/mgo1)\ **Replies:** 0\ **Last updated:** [August 24, 2021, 11:16am UTC](https://discuss.elastic.co/t/metricbeat-dashboard-desired-pods-shown-as-0-zero/282340 "2021-08-24T11:16:34Z")
Hi, As the title suggests I'm getting some metrics in the \[Metricbeat Kubernetes\] ECS Overview but I have a couple of issues. The desired pods and available pods is always zero (even though there are around 70 pods ru… --- ## [Kibana Alerts and Actions on index Threshold?](https://discuss.elastic.co/t/kibana-alerts-and-actions-on-index-threshold/280519)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 2\ **Last updated:** [August 24, 2021, 10:08am UTC](https://discuss.elastic.co/t/kibana-alerts-and-actions-on-index-threshold/280519 "2021-08-24T10:08:10Z")
I want to generate alert while condition is met. I created the alert and its action. At the time of testing its works fine. while I am running my actual file it is not generating any alert and its actions. I am also att… --- ## [Elasticsearch response order consistency issues](https://discuss.elastic.co/t/elasticsearch-response-order-consistency-issues/281767)
**Author:** [@govind\_kr](https://discuss.elastic.co/u/govind_kr)\ **Replies:** 15\ **Last updated:** [August 24, 2021, 9:36am UTC](https://discuss.elastic.co/t/elasticsearch-response-order-consistency-issues/281767 "2021-08-24T09:36:55Z")
I have been facing issues related to es response order which is getting reshuffled even though I am not querying on the fields (I have made them non-indexed so as to ignore them in scoring) and performing dfs\_query\_then\_… --- ## [Too many scroll contexts with \_update\_by\_query and/or \_delete\_by\_query](https://discuss.elastic.co/t/too-many-scroll-contexts-with-update-by-query-and-or-delete-by-query/282325)
**Author:** [@tomkirk](https://discuss.elastic.co/u/tomkirk)\ **Replies:** 0\ **Last updated:** [August 24, 2021, 9:34am UTC](https://discuss.elastic.co/t/too-many-scroll-contexts-with-update-by-query-and-or-delete-by-query/282325 "2021-08-24T09:34:24Z")
Hello, I've had an issue recently in my Elasticsearch cluster of getting this error: Trying to create too many scroll contexts. Must be less than or equal to: \[500\] None of our \_search queries use that feature, but I … --- ## [Change log4j2.properties logging location?](https://discuss.elastic.co/t/change-log4j2-properties-logging-location/282319)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 0\ **Last updated:** [August 24, 2021, 8:53am UTC](https://discuss.elastic.co/t/change-log4j2-properties-logging-location/282319 "2021-08-24T08:53:35Z")
Hello This really doesnt fit anywhere I think I want to configure log4j2.properties for both elastic and Logstash to write logs in a daily format (2021.08.24-log-name) and to another location. I know log4j2 uses varia… --- ## [Can't connect to elastic cloud instance - NEST Client](https://discuss.elastic.co/t/cant-connect-to-elastic-cloud-instance-nest-client/282117)
**Author:** [@knile](https://discuss.elastic.co/u/knile)\ **Replies:** 1\ **Last updated:** [August 24, 2021, 8:53am UTC](https://discuss.elastic.co/t/cant-connect-to-elastic-cloud-instance-nest-client/282117 "2021-08-24T08:53:03Z")
Hello, I wanted to try out elastic cloud (free trial) today but I'm having issues connecting to it. I set up simple console application in c# net 5 and latest NEST client var cloudId = "cloudid:xxxxxxxx"… --- ## [How to check what compression codec some of document use](https://discuss.elastic.co/t/how-to-check-what-compression-codec-some-of-document-use/282302)
**Author:** [@solarcore](https://discuss.elastic.co/u/solarcore)\ **Replies:** 3\ **Last updated:** [August 24, 2021, 8:59am UTC](https://discuss.elastic.co/t/how-to-check-what-compression-codec-some-of-document-use/282302 "2021-08-24T08:59:49Z")
If i have some index, and i had default value of the codec in settings, then i change this setting to best\_compression, so my question is: How to check one document in an index, to know what codec this document use, defa… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1267) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1269)