# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1298 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1299 --- ## [Logstash strip string from field](https://discuss.elastic.co/t/logstash-strip-string-from-field/280233)
**Author:** [@Hamza\_El\_Aouane](https://discuss.elastic.co/u/Hamza_El_Aouane)\ **Replies:** 8\ **Last updated:** [August 2, 2021, 5:24pm UTC](https://discuss.elastic.co/t/logstash-strip-string-from-field/280233 "2021-08-02T17:24:16Z")
Hi guys. In my logstash stream, I have a some filter to add a fields which is the merging of other fields. as follow: if \[destinationUserName\] and \[sourceUserName\] { mutate { add\_field =\> { "userID" =\> "%{ad.login… --- ## [Incorrect Postgres Timestamp with Filebeat & ES](https://discuss.elastic.co/t/incorrect-postgres-timestamp-with-filebeat-es/280152)
**Author:** [@kellizer](https://discuss.elastic.co/u/kellizer)\ **Replies:** 6\ **Last updated:** [August 2, 2021, 5:24pm UTC](https://discuss.elastic.co/t/incorrect-postgres-timestamp-with-filebeat-es/280152 "2021-08-02T17:24:00Z")
I've been knocking my head on this one for days and can't seem to debug what is happening.. I've setup the filebeat module to stream postgres-13 csv logs into ES - everything works great except the time is out of sync (c… --- ## [Drop incoming messages](https://discuss.elastic.co/t/drop-incoming-messages/280236)
**Author:** [@rosboc](https://discuss.elastic.co/u/rosboc)\ **Replies:** 6\ **Last updated:** [August 2, 2021, 5:22pm UTC](https://discuss.elastic.co/t/drop-incoming-messages/280236 "2021-08-02T17:22:44Z")
Hi, i am using logstash 6.1.1 with following configuration and need to drop messages containing "type= traffic" string and i am not able to get it working. input { udp { port =\> 2514 type =\> "syslog… --- ## [Find documents containing not more terms than in the query with fuzzines](https://discuss.elastic.co/t/find-documents-containing-not-more-terms-than-in-the-query-with-fuzzines/280043)
**Author:** [@karolix1279](https://discuss.elastic.co/u/karolix1279)\ **Replies:** 6\ **Last updated:** [August 2, 2021, 5:19pm UTC](https://discuss.elastic.co/t/find-documents-containing-not-more-terms-than-in-the-query-with-fuzzines/280043 "2021-08-02T17:19:10Z")
Let's assume there are three documents in database: {name: "John"} {name: "John Brown"} {name: "Brown"} I would like to search documents in the following way: Search: "John". Result: document 1 Search: "John Brown".… --- ## [Urgent help: How to feed live data from Kibana or from Grafana into Excel?](https://discuss.elastic.co/t/urgent-help-how-to-feed-live-data-from-kibana-or-from-grafana-into-excel/280228)
**Author:** [@BIIntern1](https://discuss.elastic.co/u/BIIntern1)\ **Replies:** 2\ **Last updated:** [August 2, 2021, 4:13pm UTC](https://discuss.elastic.co/t/urgent-help-how-to-feed-live-data-from-kibana-or-from-grafana-into-excel/280228 "2021-08-02T16:13:36Z")
Hi all, I have been trying to create Grafana dashboard for visualization and I have been using Excel for data analysis. I figured out it would be best for me to use “What-if-analysis” in Excel to answer my project quest… --- ## [Sorting fragments returned by hit highlighting](https://discuss.elastic.co/t/sorting-fragments-returned-by-hit-highlighting/278707)
**Author:** [@timforr](https://discuss.elastic.co/u/timforr)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 4:04pm UTC](https://discuss.elastic.co/t/sorting-fragments-returned-by-hit-highlighting/278707 "2021-08-02T16:04:45Z")
I have documents with multiple content fields which I am getting highlighted fragments from. The fragments from within the same field are sorted according to score, but the order the fields are returned in is random. I… --- ## [Superuser doesn't have access to read a document?](https://discuss.elastic.co/t/superuser-doesnt-have-access-to-read-a-document/280128)
**Author:** [@panagiss](https://discuss.elastic.co/u/panagiss)\ **Replies:** 3\ **Last updated:** [August 2, 2021, 1:43pm UTC](https://discuss.elastic.co/t/superuser-doesnt-have-access-to-read-a-document/280128 "2021-08-02T13:43:26Z")
This is my user's privileges { "cluster" : \[ "all" \], "global" : \[ \], "indices" : \[ { "names" : \[ "\*" \], "privileges" : \[ "all" \], "allow\_restricted\_indices"… --- ## [Winlogbeat Dashbord Setup Error](https://discuss.elastic.co/t/winlogbeat-dashbord-setup-error/279720)
**Author:** [@Ashwin\_Patil1](https://discuss.elastic.co/u/Ashwin_Patil1)\ **Replies:** 10\ **Last updated:** [August 2, 2021, 3:43pm UTC](https://discuss.elastic.co/t/winlogbeat-dashbord-setup-error/279720 "2021-08-02T15:43:14Z")
I am trying to setup dashboards, below is the .yml file . # ------------------------------ Logstash Output ------------------------------- output.logstash: # The Logstash hosts hosts: \["172.16.12.18:5044"\] user: "… --- ## [Elasticsearch: Apply index templates at start-up](https://discuss.elastic.co/t/elasticsearch-apply-index-templates-at-start-up/279701)
**Author:** [@raoulvdberge](https://discuss.elastic.co/u/raoulvdberge)\ **Replies:** 3\ **Last updated:** [August 2, 2021, 2:26pm UTC](https://discuss.elastic.co/t/elasticsearch-apply-index-templates-at-start-up/279701 "2021-08-02T14:26:24Z")
Hi, I was wondering if it's possible to start up Elasticsearch with index templates applied (for example by being defined in a config). We currently have a pod that has Elastic and Logstash containers, and the Logstash… --- ## [Master\_not\_discovered\_exception](https://discuss.elastic.co/t/master-not-discovered-exception/280225)
**Author:** [@prithvirajsivarajan](https://discuss.elastic.co/u/prithvirajsivarajan)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 1:31pm UTC](https://discuss.elastic.co/t/master-not-discovered-exception/280225 "2021-08-02T13:31:30Z")
I have an elasticsearch cluster with 2 nodes. When I stop elasticsearch instance on master node the other one is not becoming master automatically. It gives the master not discovered exception elasticsearch.yml on node-… --- ## [How to create : Stacked bar chart with negative values](https://discuss.elastic.co/t/how-to-create-stacked-bar-chart-with-negative-values/280169)
**Author:** [@HuongCV](https://discuss.elastic.co/u/HuongCV)\ **Replies:** 2\ **Last updated:** [August 2, 2021, 1:14pm UTC](https://discuss.elastic.co/t/how-to-create-stacked-bar-chart-with-negative-values/280169 "2021-08-02T13:14:40Z")
I want to create a visualization : Stacked bar chart with negative values. Let me know if kibana supports this chart. Thanks --- ## [Standard IIS grok templates can't parse](https://discuss.elastic.co/t/standard-iis-grok-templates-cant-parse/279963)
**Author:** [@dmalchikov](https://discuss.elastic.co/u/dmalchikov)\ **Replies:** 4\ **Last updated:** [August 2, 2021, 1:04pm UTC](https://discuss.elastic.co/t/standard-iis-grok-templates-cant-parse/279963 "2021-08-02T13:04:19Z")
Hi! Can't find a reason... ANy idea? I have errors Provided Grok expressions do not match field value. But it pass if I copy template and data to grokconstructor.appspot.com Standard module IIS template in use (7.13.3) … --- ## [Elasticsearch index not matching stdout test](https://discuss.elastic.co/t/elasticsearch-index-not-matching-stdout-test/280221)
**Author:** [@kgeil](https://discuss.elastic.co/u/kgeil)\ **Replies:** 0\ **Last updated:** [August 2, 2021, 12:56pm UTC](https://discuss.elastic.co/t/elasticsearch-index-not-matching-stdout-test/280221 "2021-08-02T12:56:20Z")
Good morning. I'm currently vexed by a situation with my elastic stack (7.13) and how things are parsing. I am parsing some exported IIS logs, and if I test my config with stdout, things look smashing. When I change m… --- ## [How to display other \_source fields in a metric aggregation result?](https://discuss.elastic.co/t/how-to-display-other-source-fields-in-a-metric-aggregation-result/280209)
**Author:** [@StephaneB](https://discuss.elastic.co/u/StephaneB)\ **Replies:** 2\ **Last updated:** [August 2, 2021, 12:43pm UTC](https://discuss.elastic.co/t/how-to-display-other-source-fields-in-a-metric-aggregation-result/280209 "2021-08-02T12:43:06Z")
Hello, I'm working on ML job documents with the following fields: { "\_index" : ".ml-anomalies-custom-job\_device1", "\_type" : "\_doc", "\_id" : "job\_device1\_model\_forecast\_Gwn4wnoB0F2uUBpmgO6… --- ## [Kibana - Parse Out / Aggregate Total Values Scripted Code](https://discuss.elastic.co/t/kibana-parse-out-aggregate-total-values-scripted-code/272945)
**Author:** [@prohit](https://discuss.elastic.co/u/prohit)\ **Replies:** 6\ **Last updated:** [August 2, 2021, 11:49am UTC](https://discuss.elastic.co/t/kibana-parse-out-aggregate-total-values-scripted-code/272945 "2021-08-02T11:49:08Z")
Hi All, Need help in writing script painless code to parse out/aggregate the "hours worked" in below document. My Kibana Variable Document: \[{"Dateweeklycomments":"2020-04-09T00:00:00.000Z","Name":"Roger Benny","Role":… --- ## [Windows Server 2019 Core Compatibility](https://discuss.elastic.co/t/windows-server-2019-core-compatibility/280019)
**Author:** [@Jimbuctoo](https://discuss.elastic.co/u/Jimbuctoo)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 11:18am UTC](https://discuss.elastic.co/t/windows-server-2019-core-compatibility/280019 "2021-08-02T11:18:06Z")
I noticed on the Support Matrix, under Winlogbeat, it states Windows Server 2019 but fails to state other Windows Server types \[for 2019\] including Windows Server 2019 Core. For clarity, does Filebeats and Winlogbeats al… --- ## [How to judge whether a TCP connection is successful](https://discuss.elastic.co/t/how-to-judge-whether-a-tcp-connection-is-successful/280156)
**Author:** [@chinaxushi](https://discuss.elastic.co/u/chinaxushi)\ **Replies:** 2\ **Last updated:** [August 2, 2021, 11:11am UTC](https://discuss.elastic.co/t/how-to-judge-whether-a-tcp-connection-is-successful/280156 "2021-08-02T11:11:10Z")
When I enabled packetbeat FLOW How to judge whether the connection to the port succeeds or fails from the data returned by packetbeat I compared the successful and unsuccessful two returned data, as if there was no dif… --- ## [Winlogbeat SSL](https://discuss.elastic.co/t/winlogbeat-ssl/280181)
**Author:** [@Abdullah\_Al-Mansour1](https://discuss.elastic.co/u/Abdullah_Al-Mansour1)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 10:58am UTC](https://discuss.elastic.co/t/winlogbeat-ssl/280181 "2021-08-02T10:58:38Z")
Hello - I'm performing my first secure install of elastic stack. Everything is going well. I'm at the last leg of the race, ingesting data from Winlogbeat. I created a winlogbeat\_writer role, assigned it to a winlogbeat\_… --- ## [Edit IIS Module Pipeline](https://discuss.elastic.co/t/edit-iis-module-pipeline/280083)
**Author:** [@Dzious](https://discuss.elastic.co/u/Dzious)\ **Replies:** 4\ **Last updated:** [August 2, 2021, 9:55am UTC](https://discuss.elastic.co/t/edit-iis-module-pipeline/280083 "2021-08-02T09:55:58Z")
Hi, I'm i a company where I need to ingest data from IIS. I've enable the module but i'd like to modify a bit the pipeline. I've found that pipeline are stored in filebeat modules folder (on window : filebeat/module/ii… --- ## [Lifecycle policy min\_document to not rollover empty indices](https://discuss.elastic.co/t/lifecycle-policy-min-document-to-not-rollover-empty-indices/280201)
**Author:** [@francois75](https://discuss.elastic.co/u/francois75)\ **Replies:** 0\ **Last updated:** [August 2, 2021, 9:47am UTC](https://discuss.elastic.co/t/lifecycle-policy-min-document-to-not-rollover-empty-indices/280201 "2021-08-02T09:47:37Z")
I've set the max\_age to one day so I have one index per day. But this rollover also empty indices. Is there a way to avoid this ? Adding a min\_document to rollover could help with this. --- ## [Document level & Field level security with HighLevelRest client](https://discuss.elastic.co/t/document-level-field-level-security-with-highlevelrest-client/280186)
**Author:** [@PraveenKumar\_KG](https://discuss.elastic.co/u/PraveenKumar_KG)\ **Replies:** 2\ **Last updated:** [August 2, 2021, 9:32am UTC](https://discuss.elastic.co/t/document-level-field-level-security-with-highlevelrest-client/280186 "2021-08-02T09:32:35Z")
Hi, We have built an angular and SpringBoot based application to search the data in elasticsearch and render the search details in UI. Angular frontend has sign in with access restricted with RBAC. Now I want to restr… --- ## [Ctx.payload.hits NOT working error (Good format)](https://discuss.elastic.co/t/ctx-payload-hits-not-working-error-good-format/280071)
**Author:** [@alex14](https://discuss.elastic.co/u/alex14)\ **Replies:** 2\ **Last updated:** [August 2, 2021, 8:14am UTC](https://discuss.elastic.co/t/ctx-payload-hits-not-working-error-good-format/280071 "2021-08-02T08:14:58Z")
Hey there, I´m trying to create a watcher but i need to use some fields from my index to send that information via email but i always get the same error I need to use the fields hit.\_source.service.address, 'NodeName':… --- ## [Sort and limit with aggregation](https://discuss.elastic.co/t/sort-and-limit-with-aggregation/280007)
**Author:** [@raviverel](https://discuss.elastic.co/u/raviverel)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 7:52am UTC](https://discuss.elastic.co/t/sort-and-limit-with-aggregation/280007 "2021-08-02T07:52:57Z")
hey, i am want to do aggregation only on the first X items sort by some attributes, is it possible ? didn't find a way ( elastic 7.13 ) thanks --- ## [Query on elasticsearch.keystore file present in ES config directory](https://discuss.elastic.co/t/query-on-elasticsearch-keystore-file-present-in-es-config-directory/278652)
**Author:** [@chaitra\_hegde](https://discuss.elastic.co/u/chaitra_hegde)\ **Replies:** 2\ **Last updated:** [August 2, 2021, 7:51am UTC](https://discuss.elastic.co/t/query-on-elasticsearch-keystore-file-present-in-es-config-directory/278652 "2021-08-02T07:51:26Z")
Hi, I am using Elasticsearch-oss 7.8.0 in k8s environment. I want to know what is elasticsearch.keystore file present in ES Config directory(/etc/elasticsearch) which comes by default when ES rpm is installed. I saw thi… --- ## [Whats difference org.elasticsearch.index.mapper.GeoPointFieldMapper and org.elasticsearch.xpack.ml.extractor.GeoPointField](https://discuss.elastic.co/t/whats-difference-org-elasticsearch-index-mapper-geopointfieldmapper-and-org-elasticsearch-xpack-ml-extractor-geopointfield/280042)
**Author:** [@drake-jin](https://discuss.elastic.co/u/drake-jin)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 7:50am UTC](https://discuss.elastic.co/t/whats-difference-org-elasticsearch-index-mapper-geopointfieldmapper-and-org-elasticsearch-xpack-ml-extractor-geopointfield/280042 "2021-08-02T07:50:36Z")
I wonder why same role classes are here in elasticsearch repository. What org.elasticsearch.xpack.ml.extractor.GeoPointField is for? What org.elasticsearch.index.mapper.GeoPointFieldMapper is for? Any documents? --- ## [Can I change the system index mapping and enrich it with new fields](https://discuss.elastic.co/t/can-i-change-the-system-index-mapping-and-enrich-it-with-new-fields/280057)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 7:28am UTC](https://discuss.elastic.co/t/can-i-change-the-system-index-mapping-and-enrich-it-with-new-fields/280057 "2021-08-02T07:28:45Z")
Hi, Can I change the mapping of the system index and enrich it with new fields. The current mapping of an index is "dynamic":"strict" and the index is hidden by default and its name starting with "." System index --- ## [Logstash exit with code 0](https://discuss.elastic.co/t/logstash-exit-with-code-0/279891)
**Author:** [@abdo37](https://discuss.elastic.co/u/abdo37)\ **Replies:** 4\ **Last updated:** [August 2, 2021, 7:25am UTC](https://discuss.elastic.co/t/logstash-exit-with-code-0/279891 "2021-08-02T07:25:39Z")
heey i'm trynig to use docker-compose for logstash,elasticsearch,postgresql and when i start docker-compose all containers are working except logstash container it gives me logstash exit with code 0 there is my docker… --- ## [Filebeat integration as file](https://discuss.elastic.co/t/filebeat-integration-as-file/279990)
**Author:** [@doragon](https://discuss.elastic.co/u/doragon)\ **Replies:** 2\ **Last updated:** [August 2, 2021, 7:25am UTC](https://discuss.elastic.co/t/filebeat-integration-as-file/279990 "2021-08-02T07:25:30Z")
Good afternoon. I tried to setup a disconnected architecture between production and monitoring, as I have non-connectivity between my production servers and my ELK stack (local network). I planed to work as follow: f… --- ## [\[Visualization\]\[Treemap\] Multiple object case](https://discuss.elastic.co/t/visualization-treemap-multiple-object-case/280170)
**Author:** [@kwang\_hee\_Han](https://discuss.elastic.co/u/kwang_hee_Han)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 7:20am UTC](https://discuss.elastic.co/t/visualization-treemap-multiple-object-case/280170 "2021-08-02T07:20:57Z")
Hello, I have tried creating "TreeMap" visualization in Lens. I couldn't get appropriate Visual. I need help to customizing. \[Indexed Document Schema\] \[TreeMap in Lens\] Attached first imaged tells, category : ":… --- ## [Same index-pattern created with kibana UI and REST command](https://discuss.elastic.co/t/same-index-pattern-created-with-kibana-ui-and-rest-command/280079)
**Author:** [@prashant1](https://discuss.elastic.co/u/prashant1)\ **Replies:** 4\ **Last updated:** [August 2, 2021, 7:13am UTC](https://discuss.elastic.co/t/same-index-pattern-created-with-kibana-ui-and-rest-command/280079 "2021-08-02T07:13:18Z")
Hi We have deployed kibana 7.8.0. We notice one observation if we try to create one index pattern through Kibana UI and another through REST API in that case we are able to create the same index-pattern. But if we try t… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1297) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1299)