# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1274 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1275 --- ## [Upgrading an elastic-agent behind a proxy fails](https://discuss.elastic.co/t/upgrading-an-elastic-agent-behind-a-proxy-fails/281780)
**Author:** [@leprovokateur](https://discuss.elastic.co/u/leprovokateur)\ **Replies:** 1\ **Last updated:** [August 19, 2021, 1:30pm UTC](https://discuss.elastic.co/t/upgrading-an-elastic-agent-behind-a-proxy-fails/281780 "2021-08-19T13:30:41Z")
Hi , I try to upgrade an elastic-agent behind a proxy, but fail: 09:15:49.883 elastic\_agent \[elastic\_agent\]\[error\] 2021-08-18T09:15:49+02:00 - message: Application: \[e4cf95ba-8c94-417d-a25e-2afe0a1e02b6\]: State changed… --- ## [Fleet Synthetics 7.14 - pipeline with id \[synthetics-http-0.2.1\] does not exist](https://discuss.elastic.co/t/fleet-synthetics-7-14-pipeline-with-id-synthetics-http-0-2-1-does-not-exist/281036)
**Author:** [@zx8086](https://discuss.elastic.co/u/zx8086)\ **Replies:** 6\ **Last updated:** [August 19, 2021, 1:27pm UTC](https://discuss.elastic.co/t/fleet-synthetics-7-14-pipeline-with-id-synthetics-http-0-2-1-does-not-exist/281036 "2021-08-19T13:27:36Z")
Using Fleet 7.14 and after upgrading the Integration - Elastic Synthetics, i cannot see any http Monitors and when i look at the Elastic-Agent logs, i get the following message that it cannot index the document because a… --- ## [TLS... WARN secure connection disabled talk to server... ERROR Get "http://192.168.0.101:9200": EOF](https://discuss.elastic.co/t/tls-warn-secure-connection-disabled-talk-to-server-error-get-http-192-168-0-101-9200-eof/281969)
**Author:** [@Dubey\_Ravi\_vinod](https://discuss.elastic.co/u/Dubey_Ravi_vinod)\ **Replies:** 0\ **Last updated:** [August 19, 2021, 1:17pm UTC](https://discuss.elastic.co/t/tls-warn-secure-connection-disabled-talk-to-server-error-get-http-192-168-0-101-9200-eof/281969 "2021-08-19T13:17:18Z")
Getting this error, while configuration of winlogbeat. winlogbeat.yml winlogbeat.event\_logs: - name: Application ignore\_older: 72h - name: System - name: Security processors: - script: … --- ## [Logstash elapsed filter plugin: can't connect start and end events](https://discuss.elastic.co/t/logstash-elapsed-filter-plugin-cant-connect-start-and-end-events/281927)
**Author:** [@alexandrpaliy](https://discuss.elastic.co/u/alexandrpaliy)\ **Replies:** 2\ **Last updated:** [August 19, 2021, 1:26pm UTC](https://discuss.elastic.co/t/logstash-elapsed-filter-plugin-cant-connect-start-and-end-events/281927 "2021-08-19T13:26:56Z")
Hi. Currently, my logstash filter looks something like this: filter { if ('text1' in \[message\]) { grok { ... add\_tag =\> \[ "connection\_established" \] } aggregate { ... } elapsed… --- ## [Remove fields with specific prefix at the end of LogStash pipeline](https://discuss.elastic.co/t/remove-fields-with-specific-prefix-at-the-end-of-logstash-pipeline/281911)
**Author:** [@itokai](https://discuss.elastic.co/u/itokai)\ **Replies:** 1\ **Last updated:** [August 19, 2021, 1:23pm UTC](https://discuss.elastic.co/t/remove-fields-with-specific-prefix-at-the-end-of-logstash-pipeline/281911 "2021-08-19T13:23:49Z")
Hello, how to remove children fields with specific prefix at the end of LogStash pipeline? parent.level2.level3.removewiththisprefix\_1, parent.level2.level3.removewiththisprefix\_2,... parent.level2.level3.removewiththi… --- ## [Filebeat god restart](https://discuss.elastic.co/t/filebeat-god-restart/281723)
**Author:** [@GitSpree23](https://discuss.elastic.co/u/GitSpree23)\ **Replies:** 7\ **Last updated:** [August 19, 2021, 1:21pm UTC](https://discuss.elastic.co/t/filebeat-god-restart/281723 "2021-08-19T13:21:47Z")
I want to restart an old Filebeat service after modifying its output. This is the result of ps -eaf | grep filebeat: root 6405 1 0 2020 ? 00:00:00 /usr/share/filebeat/bin/filebeat-god -r / -n -p /var/… --- ## [Grok patter to remove trailing milliseconds](https://discuss.elastic.co/t/grok-patter-to-remove-trailing-milliseconds/281643)
**Author:** [@newmember](https://discuss.elastic.co/u/newmember)\ **Replies:** 2\ **Last updated:** [August 19, 2021, 1:14pm UTC](https://discuss.elastic.co/t/grok-patter-to-remove-trailing-milliseconds/281643 "2021-08-19T13:14:14Z")
Two record formats that start a multiline event, what grok statement might I use to keep the milliseconds and set the time as the @timestamp field? Maybe I have to drop the milliseconds? Thank you 23:29:53.425: Sendi… --- ## [Does filebeats import MongoDB collections to ES?](https://discuss.elastic.co/t/does-filebeats-import-mongodb-collections-to-es/281965)
**Author:** [@evo](https://discuss.elastic.co/u/evo)\ **Replies:** 0\ **Last updated:** [August 19, 2021, 1:00pm UTC](https://discuss.elastic.co/t/does-filebeats-import-mongodb-collections-to-es/281965 "2021-08-19T13:00:08Z")
Hi, Sorry for the basic question but I am finding the docs a bit confusing. I am trying to create an ES search index for a large (1TB) mongodb and I am trying to find out how to do that. I cam across filebeat and saw … --- ## [Is it possible to Upgrade the elastic-operator without the downtime](https://discuss.elastic.co/t/is-it-possible-to-upgrade-the-elastic-operator-without-the-downtime/281960)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 0\ **Last updated:** [August 19, 2021, 12:44pm UTC](https://discuss.elastic.co/t/is-it-possible-to-upgrade-the-elastic-operator-without-the-downtime/281960 "2021-08-19T12:44:11Z")
We are trying to upgrade from elastic-operator-1.1.0 to 1.3.0,.Is there any way to upgrade the operator without any rolling restarts for existing elasticsearch pods. --- ## [Filebeat holding deleted files... please help with 'correct' values to use in close\_inactive, etc](https://discuss.elastic.co/t/filebeat-holding-deleted-files-please-help-with-correct-values-to-use-in-close-inactive-etc/281956)
**Author:** [@baldpoem54](https://discuss.elastic.co/u/baldpoem54)\ **Replies:** 0\ **Last updated:** [August 19, 2021, 12:35pm UTC](https://discuss.elastic.co/t/filebeat-holding-deleted-files-please-help-with-correct-values-to-use-in-close-inactive-etc/281956 "2021-08-19T12:35:53Z")
Hoping the community here can help me as google hasn't. I have a case where filebeat is holding deleted files open until the process is recycled. I know there on configs to help address this, but I'm struggling on what… --- ## [Unselect all fields at once in Graph in Kibana](https://discuss.elastic.co/t/unselect-all-fields-at-once-in-graph-in-kibana/280875)
**Author:** [@vladik22](https://discuss.elastic.co/u/vladik22)\ **Replies:** 6\ **Last updated:** [August 19, 2021, 11:47am UTC](https://discuss.elastic.co/t/unselect-all-fields-at-once-in-graph-in-kibana/280875 "2021-08-19T11:47:35Z")
Hi I have Bar graph with a lot of fields in Vertical axis, about 100. How to unselect all them at once? I want to turn on the fields only that I need every time. If I can turn of them all at start and turn on a few fiel… --- ## [Elastic sinc with serilog](https://discuss.elastic.co/t/elastic-sinc-with-serilog/281950)
**Author:** [@Shakila\_Jayarathna](https://discuss.elastic.co/u/Shakila_Jayarathna)\ **Replies:** 0\ **Last updated:** [August 19, 2021, 11:55am UTC](https://discuss.elastic.co/t/elastic-sinc-with-serilog/281950 "2021-08-19T11:55:15Z")
Hello, here is my code sample using serilog to log details for elastic search. And i dont get any error. But my log is not working. Any help --- ## [Duplicate Y-Axis value on number](https://discuss.elastic.co/t/duplicate-y-axis-value-on-number/281790)
**Author:** [@Celiken](https://discuss.elastic.co/u/Celiken)\ **Replies:** 12\ **Last updated:** [August 19, 2021, 11:51am UTC](https://discuss.elastic.co/t/duplicate-y-axis-value-on-number/281790 "2021-08-19T11:51:18Z")
Hi, I'm trying to create a vertical bar visualizations, but since the Y-axis range isn't big, it creates some weird things. I want to visualize the max value of invalidBatteryCount over time, this value can be in the r… --- ## [Possible to determine time diff between 2 entries which are groupable](https://discuss.elastic.co/t/possible-to-determine-time-diff-between-2-entries-which-are-groupable/281916)
**Author:** [@hugohendriks](https://discuss.elastic.co/u/hugohendriks)\ **Replies:** 2\ **Last updated:** [August 19, 2021, 10:47am UTC](https://discuss.elastic.co/t/possible-to-determine-time-diff-between-2-entries-which-are-groupable/281916 "2021-08-19T10:47:13Z")
Hi, I would like to know if its possible in Kibana to be able to determine a duration time between 2 entries with the same correlationId. For example i have 2 entries in my index with both the same correlationId so they… --- ## [Watcher if log occours](https://discuss.elastic.co/t/watcher-if-log-occours/281928)
**Author:** [@xennn](https://discuss.elastic.co/u/xennn)\ **Replies:** 2\ **Last updated:** [August 19, 2021, 10:37am UTC](https://discuss.elastic.co/t/watcher-if-log-occours/281928 "2021-08-19T10:37:19Z")
Hello, I would like to build a watcher that sends me an alarm if a log message no longer occurs every 1 minute. How can this best be done? --- ## [Search query does not return expected records](https://discuss.elastic.co/t/search-query-does-not-return-expected-records/281941)
**Author:** [@Rammi22](https://discuss.elastic.co/u/Rammi22)\ **Replies:** 0\ **Last updated:** [August 19, 2021, 9:56am UTC](https://discuss.elastic.co/t/search-query-does-not-return-expected-records/281941 "2021-08-19T09:56:15Z")
Hello, i have documents with following structure: ... // doc 1 "\_source": { ..., "data": { "main": { ... "refAccount1": 1, "refAccount2": 1, "refAccount3": 1 "refType": 1, }, … --- ## [Can I pass two sets of values to the reduce script?](https://discuss.elastic.co/t/can-i-pass-two-sets-of-values-to-the-reduce-script/281665)
**Author:** [@InesCM](https://discuss.elastic.co/u/InesCM)\ **Replies:** 1\ **Last updated:** [August 19, 2021, 10:13am UTC](https://discuss.elastic.co/t/can-i-pass-two-sets-of-values-to-the-reduce-script/281665 "2021-08-19T10:13:06Z")
Hi all, I'm preparing an scripted metric in order to perform the division of two sums and display it in a Scripted Metric in Kibana (average viewing hours per user). The problem I'm facing is that I need to perform the… --- ## [How to disable the login page of opendistro kibana 7.10.2 version in Windows](https://discuss.elastic.co/t/how-to-disable-the-login-page-of-opendistro-kibana-7-10-2-version-in-windows/281938)
**Author:** [@sai2](https://discuss.elastic.co/u/sai2)\ **Replies:** 1\ **Last updated:** [August 19, 2021, 9:54am UTC](https://discuss.elastic.co/t/how-to-disable-the-login-page-of-opendistro-kibana-7-10-2-version-in-windows/281938 "2021-08-19T09:54:46Z")
How to disable the login page of opendistro kibana 7.10.2 version in Windows Can any know this, Could you please help me on that ASAP --- ## [Logstash systemd service restarts itself](https://discuss.elastic.co/t/logstash-systemd-service-restarts-itself/279941)
**Author:** [@chris\_ts24](https://discuss.elastic.co/u/chris_ts24)\ **Replies:** 2\ **Last updated:** [August 19, 2021, 8:53am UTC](https://discuss.elastic.co/t/logstash-systemd-service-restarts-itself/279941 "2021-08-19T08:53:15Z")
Hello community, I'm running a logstash instance with the following config via a systemd service for minute-wise updates of an ES index: input { jdbc { jdbc\_driver\_class =\> "Java::oracle.jdbc.dr… --- ## [Starting separate logstash pipeline incorrectly starts Logstash Service](https://discuss.elastic.co/t/starting-separate-logstash-pipeline-incorrectly-starts-logstash-service/281933)
**Author:** [@chris\_ts24](https://discuss.elastic.co/u/chris_ts24)\ **Replies:** 0\ **Last updated:** [August 19, 2021, 9:19am UTC](https://discuss.elastic.co/t/starting-separate-logstash-pipeline-incorrectly-starts-logstash-service/281933 "2021-08-19T09:19:18Z")
Hi all, I've noticed recently that my Logstash service sometimes gets started for an unknown reason when I start a separate Logstash pipeline. The expected behavior is that this single Logstash instance is started and … --- ## [Filebeat multiline pattern for PHP stack trace](https://discuss.elastic.co/t/filebeat-multiline-pattern-for-php-stack-trace/281003)
**Author:** [@Thessis940](https://discuss.elastic.co/u/Thessis940)\ **Replies:** 1\ **Last updated:** [August 19, 2021, 8:38am UTC](https://discuss.elastic.co/t/filebeat-multiline-pattern-for-php-stack-trace/281003 "2021-08-19T08:38:06Z")
I am trying to import the PHP FPM logs into an ELK stack. For this I use the filebeat to read the files. Before sending this data to logstash, the multiline log entries should be merged. For this I built this filebeat c… --- ## [How to use new elasticsearch typescript types](https://discuss.elastic.co/t/how-to-use-new-elasticsearch-typescript-types/281924)
**Author:** [@voldemort02](https://discuss.elastic.co/u/voldemort02)\ **Replies:** 0\ **Last updated:** [August 19, 2021, 8:06am UTC](https://discuss.elastic.co/t/how-to-use-new-elasticsearch-typescript-types/281924 "2021-08-19T08:06:00Z")
I want to use new elastic search types as per this TypeScript support | Elasticsearch Node.js client \[7.x\] | Elastic document but if I do // try the new code completion when building a query! const response = await clie… --- ## [Webhdfs output writes not all fields](https://discuss.elastic.co/t/webhdfs-output-writes-not-all-fields/281919)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 1\ **Last updated:** [August 19, 2021, 7:54am UTC](https://discuss.elastic.co/t/webhdfs-output-writes-not-all-fields/281919 "2021-08-19T07:54:50Z")
Hi, community, I'm using webhdfs to write my logstash events to hdfs. But in hdfs I see only part of initial messages. In logstash: {"@timestamp":"2021-08-19T07:45:33.373Z","eventtype":"166","program":"Hostd","@version… --- ## [Dynamic height in vega visualizations](https://discuss.elastic.co/t/dynamic-height-in-vega-visualizations/281649)
**Author:** [@ErSumit](https://discuss.elastic.co/u/ErSumit)\ **Replies:** 1\ **Last updated:** [August 19, 2021, 7:24am UTC](https://discuss.elastic.co/t/dynamic-height-in-vega-visualizations/281649 "2021-08-19T07:24:47Z")
Hi, This is related to Creating Vega visualization with Image in kibana v 7.13 - Elastic Stack / Kibana - Discuss the Elastic Stack I've created visualization on kibana, and its displaying accurate data. Whenever I ap… --- ## [Elastic Synthetics vs heartbeat](https://discuss.elastic.co/t/elastic-synthetics-vs-heartbeat/281660)
**Author:** [@Robin020](https://discuss.elastic.co/u/Robin020)\ **Replies:** 1\ **Last updated:** [August 19, 2021, 7:19am UTC](https://discuss.elastic.co/t/elastic-synthetics-vs-heartbeat/281660 "2021-08-19T07:19:38Z")
Hello, Could somebody tell me what the differents are between Elastic Synthetics and Heartbeat? It looks the same for me. Regards, Robin --- ## [ILM Retry API not honoring timeouts](https://discuss.elastic.co/t/ilm-retry-api-not-honoring-timeouts/281772)
**Author:** [@Himanshu\_Mishra](https://discuss.elastic.co/u/Himanshu_Mishra)\ **Replies:** 5\ **Last updated:** [August 19, 2021, 7:10am UTC](https://discuss.elastic.co/t/ilm-retry-api-not-honoring-timeouts/281772 "2021-08-19T07:10:57Z")
I'm try to retry ILM steps for all indexes, using following command, however POST \*/\_ilm/retry { "timeout": "30m", "master\_timeout": "30m" } Still following error is thrown. Is there another param to override proce… --- ## [Logstash OData endpoint](https://discuss.elastic.co/t/logstash-odata-endpoint/281910)
**Author:** [@Jakub\_Kaczmarek](https://discuss.elastic.co/u/Jakub_Kaczmarek)\ **Replies:** 1\ **Last updated:** [August 19, 2021, 6:57am UTC](https://discuss.elastic.co/t/logstash-odata-endpoint/281910 "2021-08-19T06:57:08Z")
Hi, I'm using http\_pooler in order to fetch data from OData endpoint. url =\> "https://odata-XXXXX.com/v2.0/Inputs?apikey=apikey" -\> works correct url =\> "https://odata-XXXXX.com/v2.0/Inputs?$orderby=timestamp desc&api… --- ## [Range Aggregation is not working properly for float fields](https://discuss.elastic.co/t/range-aggregation-is-not-working-properly-for-float-fields/281908)
**Author:** [@Ofir\_Edi](https://discuss.elastic.co/u/Ofir_Edi)\ **Replies:** 0\ **Last updated:** [August 19, 2021, 6:41am UTC](https://discuss.elastic.co/t/range-aggregation-is-not-working-properly-for-float-fields/281908 "2021-08-19T06:41:57Z")
Hi, According to the documentation range aggreagation creates buckets where from in inclusive and to is exclusive. when working with float fields Elasticsearch seem to work vise versa and classify to the wrong bucket. I… --- ## [Logstash Crashback](https://discuss.elastic.co/t/logstash-crashback/281909)
**Author:** [@Vincent\_Ngai](https://discuss.elastic.co/u/Vincent_Ngai)\ **Replies:** 0\ **Last updated:** [August 19, 2021, 6:42am UTC](https://discuss.elastic.co/t/logstash-crashback/281909 "2021-08-19T06:42:27Z")
Here is background My logstash version : logstash\_oss 681 My logstash is a dockerversion (install into k8s) and my logstash docker file like this FROM docker.elastic.co/logstash/logstash-oss:6.8.1 RUN logstash-plugin … --- ## [Dynamic index names](https://discuss.elastic.co/t/dynamic-index-names/281816)
**Author:** [@rudo1](https://discuss.elastic.co/u/rudo1)\ **Replies:** 5\ **Last updated:** [August 19, 2021, 4:32am UTC](https://discuss.elastic.co/t/dynamic-index-names/281816 "2021-08-19T04:32:20Z")
Hi. I'm facing a problem with creating dynamic index names. I have few if statemnts like shown below to add new fields, but I can't see anything in kibana when I try to name index dynamically based on its value. filte… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1273) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1275)