# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1368 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1369 --- ## [Log reg scoring with nested fields, use case for multiply score in should clauses?](https://discuss.elastic.co/t/log-reg-scoring-with-nested-fields-use-case-for-multiply-score-in-should-clauses/275028)
**Author:** [@nihaux](https://discuss.elastic.co/u/nihaux)\ **Replies:** 3\ **Last updated:** [June 14, 2021, 9:25pm UTC](https://discuss.elastic.co/t/log-reg-scoring-with-nested-fields-use-case-for-multiply-score-in-should-clauses/275028 "2021-06-14T21:25:40Z")
Hello everyone this might be a semi-long post. My use case is the following. We have a stack that makes use of a logistic regression on different features in python to rank documents. I am POCing a version on ES to be… --- ## [Not able to create index pattern in kibana (7.10.2)](https://discuss.elastic.co/t/not-able-to-create-index-pattern-in-kibana-7-10-2/275519)
**Author:** [@attacker](https://discuss.elastic.co/u/attacker)\ **Replies:** 3\ **Last updated:** [June 14, 2021, 9:16pm UTC](https://discuss.elastic.co/t/not-able-to-create-index-pattern-in-kibana-7-10-2/275519 "2021-06-14T21:16:29Z")
Hi, I have a standalone setup of ELK 7.10.2 on CentOS Server. I have ingested data into elasticsearch using logstash, but the problem here is after ingesting data into elasticsearch the kibana UI is not allowing me the … --- ## [How to send proxmox logs to ELK](https://discuss.elastic.co/t/how-to-send-proxmox-logs-to-elk/275153)
**Author:** [@jubin03](https://discuss.elastic.co/u/jubin03)\ **Replies:** 3\ **Last updated:** [June 14, 2021, 9:03pm UTC](https://discuss.elastic.co/t/how-to-send-proxmox-logs-to-elk/275153 "2021-06-14T21:03:10Z")
How can we configure proxmox logs to ELK. I have already using Grok for pfsense logs. Is there any way to configure log settings on proxmox --- ## [Unique count per fieldA by FieldB and sum this total per fieldC + graphing](https://discuss.elastic.co/t/unique-count-per-fielda-by-fieldb-and-sum-this-total-per-fieldc-graphing/275359)
**Author:** [@KS\_123](https://discuss.elastic.co/u/KS_123)\ **Replies:** 3\ **Last updated:** [June 14, 2021, 9:02pm UTC](https://discuss.elastic.co/t/unique-count-per-fielda-by-fieldb-and-sum-this-total-per-fieldc-graphing/275359 "2021-06-14T21:02:04Z")
I want to do a unique count per fieldA(serialNumber) by FieldB(CommandID) and sum this total per fieldC(farmID). Which I can do in Kibana, but then I want to be able to collapse the rows to just show the FieldC(farmID) … --- ## [Kibana DevTools autocomplete refresh cause circuit breaker\\ OOM on coordinators nodes](https://discuss.elastic.co/t/kibana-devtools-autocomplete-refresh-cause-circuit-breaker-oom-on-coordinators-nodes/275723)
**Author:** [@val16384](https://discuss.elastic.co/u/val16384)\ **Replies:** 7\ **Last updated:** [June 14, 2021, 8:19pm UTC](https://discuss.elastic.co/t/kibana-devtools-autocomplete-refresh-cause-circuit-breaker-oom-on-coordinators-nodes/275723 "2021-06-14T20:19:21Z")
Hey guys, We have issue with constantly increasing of Old gen part in JVM heap on coordinator nodes till OOM. As I can understand the issue - memory leaking\\OOM precisely correlated with requests to ES that gene… --- ## [Metricbeat to Logstash to ElasticSearch - Cannot See Any Hosts Defined, But Data Is Definitely Coming In](https://discuss.elastic.co/t/metricbeat-to-logstash-to-elasticsearch-cannot-see-any-hosts-defined-but-data-is-definitely-coming-in/275715)
**Author:** [@jthart](https://discuss.elastic.co/u/jthart)\ **Replies:** 8\ **Last updated:** [June 14, 2021, 7:46pm UTC](https://discuss.elastic.co/t/metricbeat-to-logstash-to-elasticsearch-cannot-see-any-hosts-defined-but-data-is-definitely-coming-in/275715 "2021-06-14T19:46:03Z")
For background information, I've tried following instructions in these posts and am still encountering an issue: Kibana Metrics – 500 Internal Server Error Host data wont populate in dashboards when upgrading beats fro… --- ## [Logstash multiple pipeline configuration using logstash helm chart](https://discuss.elastic.co/t/logstash-multiple-pipeline-configuration-using-logstash-helm-chart/275880)
**Author:** [@arijitc](https://discuss.elastic.co/u/arijitc)\ **Replies:** 0\ **Last updated:** [June 14, 2021, 5:47pm UTC](https://discuss.elastic.co/t/logstash-multiple-pipeline-configuration-using-logstash-helm-chart/275880 "2021-06-14T17:47:37Z")
While configuring multiple pipeline using logstash (version 7.13.1) helm chart , the values.yaml is having a section # Allows you to add any pipeline files in /usr/share/logstash/pipeline/ ### \*\*\*warn\*\*\* there is a hard… --- ## [Split and store tags](https://discuss.elastic.co/t/split-and-store-tags/275866)
**Author:** [@rodrigue](https://discuss.elastic.co/u/rodrigue)\ **Replies:** 2\ **Last updated:** [June 14, 2021, 5:43pm UTC](https://discuss.elastic.co/t/split-and-store-tags/275866 "2021-06-14T17:43:58Z")
Hello, Sorry to bother you but I tried everything... Il simply would like to take tags from my json and store it as a tag in logstash... Here is my configuration input { http { port =\> "5046" tags… --- ## [Elastic Search 7.13.1 Cluster bootstrapping error](https://discuss.elastic.co/t/elastic-search-7-13-1-cluster-bootstrapping-error/275858)
**Author:** [@prithvirajsivarajan](https://discuss.elastic.co/u/prithvirajsivarajan)\ **Replies:** 3\ **Last updated:** [June 14, 2021, 5:19pm UTC](https://discuss.elastic.co/t/elastic-search-7-13-1-cluster-bootstrapping-error/275858 "2021-06-14T17:19:01Z")
I configured two nodes on two Linux VMs and it is working. Currently trying to setup a third node on the cluster in my local windows machine. Getting the errors below \[node-3\] failed to join {node-1}{3eMmu1kVQtuB95A1KX… --- ## [Logstash TCP input splits events unintentionally](https://discuss.elastic.co/t/logstash-tcp-input-splits-events-unintentionally/275811)
**Author:** [@cyber\_crab](https://discuss.elastic.co/u/cyber_crab)\ **Replies:** 3\ **Last updated:** [June 14, 2021, 4:49pm UTC](https://discuss.elastic.co/t/logstash-tcp-input-splits-events-unintentionally/275811 "2021-06-14T16:49:48Z")
Hi guys, I have an issue with one of the Logstash pipelines in our stack. The incoming CEF logs from Cyberark sometimes get split into two events for no apparent reason. I ran tcpdump on the port to which CYA is suppose… --- ## [Aggregate filter timeouts and input completion](https://discuss.elastic.co/t/aggregate-filter-timeouts-and-input-completion/275719)
**Author:** [@jratliff](https://discuss.elastic.co/u/jratliff)\ **Replies:** 3\ **Last updated:** [June 14, 2021, 4:42pm UTC](https://discuss.elastic.co/t/aggregate-filter-timeouts-and-input-completion/275719 "2021-06-14T16:42:55Z")
I am using logstash to read events from elasticsearch and the aggregate filter to condense them. Because the data I am condensing has no clear start/stop events, we are using the timeout and inactivity\_timeout settings … --- ## [Filebeat autodiscover missing field accessing](https://discuss.elastic.co/t/filebeat-autodiscover-missing-field-accessing/274256)
**Author:** [@rp346](https://discuss.elastic.co/u/rp346)\ **Replies:** 2\ **Last updated:** [June 14, 2021, 4:40pm UTC](https://discuss.elastic.co/t/filebeat-autodiscover-missing-field-accessing/274256 "2021-06-14T16:40:08Z")
I am trying to setup filebeat with autodiscover, but container is failing with this error 2021-05-27T19:25:03.029Z ERROR instance/beat.go:971 Exiting: error in autodiscover provider settings: error setting up kubernetes… --- ## [Parsing XML document contained in a field](https://discuss.elastic.co/t/parsing-xml-document-contained-in-a-field/275037)
**Author:** [@fmaginga](https://discuss.elastic.co/u/fmaginga)\ **Replies:** 4\ **Last updated:** [June 14, 2021, 4:40pm UTC](https://discuss.elastic.co/t/parsing-xml-document-contained-in-a-field/275037 "2021-06-14T16:40:10Z")
We have written a logstash configuration file with kv filter plugin to extract key-value pairs successfully. Some of the values is the keys contains XML documents as example below. What is the better way to parse the XML… --- ## [By terms grouped data show the same value in time series](https://discuss.elastic.co/t/by-terms-grouped-data-show-the-same-value-in-time-series/275422)
**Author:** [@Michael\_Kramer](https://discuss.elastic.co/u/Michael_Kramer)\ **Replies:** 1\ **Last updated:** [June 14, 2021, 4:09pm UTC](https://discuss.elastic.co/t/by-terms-grouped-data-show-the-same-value-in-time-series/275422 "2021-06-14T16:09:31Z")
So I am trying to show the size of multiple folders over time in a time series diagram. The Data is formated like this: "Folder": \[ {"ID":1, "Path":"/boot", "Size\_in\_B":139174528 }, {"ID":2, "Path":"/bin", "Size\_in\_B":… --- ## [Unable to replicate to local Harbor registry](https://discuss.elastic.co/t/unable-to-replicate-to-local-harbor-registry/275869)
**Author:** [@JulioHM](https://discuss.elastic.co/u/JulioHM)\ **Replies:** 0\ **Last updated:** [June 14, 2021, 4:00pm UTC](https://discuss.elastic.co/t/unable-to-replicate-to-local-harbor-registry/275869 "2021-06-14T16:00:10Z")
We are trying to replicate some images from the official docker.elastic.co into our local Harbor registry. But we get a 401 unauthorized message from docker.elastic.co. failed to fetch artifacts: failed to fetch artifac… --- ## [Elasticsearch cluster performance looks not enough?](https://discuss.elastic.co/t/elasticsearch-cluster-performance-looks-not-enough/274498)
**Author:** [@arvanMalian](https://discuss.elastic.co/u/arvanMalian)\ **Replies:** 4\ **Last updated:** [June 14, 2021, 3:44pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-performance-looks-not-enough/274498 "2021-06-14T15:44:46Z")
Hi, I'm using elasticserach stack version 7.10.1 for all components. on my elasticsearch cluster, I have daily about 108 870 033 documents. filter on discovery section (24h) 82 620 778 hits filebeat 26 249 255 hits… --- ## [Filebeat AWS Module unable to process Logs from S3](https://discuss.elastic.co/t/filebeat-aws-module-unable-to-process-logs-from-s3/275616)
**Author:** [@vishakh](https://discuss.elastic.co/u/vishakh)\ **Replies:** 4\ **Last updated:** [June 14, 2021, 3:36pm UTC](https://discuss.elastic.co/t/filebeat-aws-module-unable-to-process-logs-from-s3/275616 "2021-06-14T15:36:44Z")
ELK-Stack: 7.11.2 and Filebeat: 7.11.2 Up until today, Filebeat-AWS Module was able to read messages(vpc logs) from sqs queue. But, of of no-where, I see filebeat is unable to process the vpc-logs. I’m seeing the below … --- ## [Why flebeat Tomcat dashboard is not in my kibana](https://discuss.elastic.co/t/why-flebeat-tomcat-dashboard-is-not-in-my-kibana/275641)
**Author:** [@venkatesh\_prasanth](https://discuss.elastic.co/u/venkatesh_prasanth)\ **Replies:** 1\ **Last updated:** [June 14, 2021, 3:25pm UTC](https://discuss.elastic.co/t/why-flebeat-tomcat-dashboard-is-not-in-my-kibana/275641 "2021-06-14T15:25:32Z")
Hello, when i give log path to tomcat.yml in filebeat , where my logs will visualize. i cant able to find a seperate dashboard for fiilebeat tomcat in kibana. --- ## [Reporting from kibana max size 10mb](https://discuss.elastic.co/t/reporting-from-kibana-max-size-10mb/275550)
**Author:** [@Matteo\_Rainieri](https://discuss.elastic.co/u/Matteo_Rainieri)\ **Replies:** 1\ **Last updated:** [June 14, 2021, 3:04pm UTC](https://discuss.elastic.co/t/reporting-from-kibana-max-size-10mb/275550 "2021-06-14T15:04:02Z")
Good morning. I have a question: we tried to export several days of logs from the share\>csv report in kibana's interface. We only got 45 minutes of logs (instead on 1 month) cause the max size appears to be 10mb. I tr… --- ## [Display a gauge from the time of the last received log](https://discuss.elastic.co/t/display-a-gauge-from-the-time-of-the-last-received-log/274088)
**Author:** [@ATEADSGEO](https://discuss.elastic.co/u/ATEADSGEO)\ **Replies:** 2\ **Last updated:** [June 14, 2021, 2:59pm UTC](https://discuss.elastic.co/t/display-a-gauge-from-the-time-of-the-last-received-log/274088 "2021-06-14T14:59:26Z")
Hello, I am begining in kibana/ELK. In a monitoring dashboard, I would like to display an 'alert' if the last received log is becoming old. The gauge seems to be adapted : green if last log is newer than 1 minute, then… --- ## [Watcher with multiple Trigger Schedules](https://discuss.elastic.co/t/watcher-with-multiple-trigger-schedules/275812)
**Author:** [@G.M](https://discuss.elastic.co/u/G.M)\ **Replies:** 2\ **Last updated:** [June 14, 2021, 2:46pm UTC](https://discuss.elastic.co/t/watcher-with-multiple-trigger-schedules/275812 "2021-06-14T14:46:16Z")
I am currently setting up watchers for my Elasticsearch indices. When trying to setup the trigger schedule, I tried to add multiple different schedules, e.g. a weekly schedule and a monthly schedule. However, after savin… --- ## [Vega visualization issue](https://discuss.elastic.co/t/vega-visualization-issue/275230)
**Author:** [@Nisha2297](https://discuss.elastic.co/u/Nisha2297)\ **Replies:** 2\ **Last updated:** [June 14, 2021, 2:45pm UTC](https://discuss.elastic.co/t/vega-visualization-issue/275230 "2021-06-14T14:45:34Z")
I am facing issue with Vega visualization. It is showing error as "EsError". Can anybody let me know what this error means and how to rectify it? --- ## [Heartbeat](https://discuss.elastic.co/t/heartbeat/275742)
**Author:** [@shani\_angarkadu](https://discuss.elastic.co/u/shani_angarkadu)\ **Replies:** 2\ **Last updated:** [June 14, 2021, 2:39pm UTC](https://discuss.elastic.co/t/heartbeat/275742 "2021-06-14T14:39:36Z")
I have a json response { "applications": \[ { "name": "APP1", "instances": \[ { "instanceId": "app1", "healthCheckUrl": "http", … --- ## [How to calculate cumulative sum on date/time difference?](https://discuss.elastic.co/t/how-to-calculate-cumulative-sum-on-date-time-difference/275707)
**Author:** [@nilei](https://discuss.elastic.co/u/nilei)\ **Replies:** 1\ **Last updated:** [June 14, 2021, 2:34pm UTC](https://discuss.elastic.co/t/how-to-calculate-cumulative-sum-on-date-time-difference/275707 "2021-06-14T14:34:16Z")
Dear all, I have documents in my index with two Date/Time fields: "Created" and "Closed". Now I want to know how many documents exist at a time on a timeline where the relative time, that is the one currently displayed/… --- ## [Use field of a document as range's value in a Goal Visualization](https://discuss.elastic.co/t/use-field-of-a-document-as-ranges-value-in-a-goal-visualization/275799)
**Author:** [@mar-ro](https://discuss.elastic.co/u/mar-ro)\ **Replies:** 4\ **Last updated:** [June 14, 2021, 2:14pm UTC](https://discuss.elastic.co/t/use-field-of-a-document-as-ranges-value-in-a-goal-visualization/275799 "2021-06-14T14:14:09Z")
Good morning! I would like to know if it's possible to use a field's value of a document as superior range's value in a Goal Visualization. My intention is indicate the total number of monitors in that field of the Goa… --- ## [Generate CSR / Template to the SSL certificate](https://discuss.elastic.co/t/generate-csr-template-to-the-ssl-certificate/275761)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 1\ **Last updated:** [June 14, 2021, 2:13pm UTC](https://discuss.elastic.co/t/generate-csr-template-to-the-ssl-certificate/275761 "2021-06-14T14:13:03Z")
Hi, I have a question about adding non self-sign certificates to Elastic Stack. What is the issue of generating CSRs and what is required in the template for certifications for Elastic Stack? What encryption with cert… --- ## [Deploying Kibana build without test script](https://discuss.elastic.co/t/deploying-kibana-build-without-test-script/275782)
**Author:** [@ravi\_yadav2](https://discuss.elastic.co/u/ravi_yadav2)\ **Replies:** 1\ **Last updated:** [June 14, 2021, 2:07pm UTC](https://discuss.elastic.co/t/deploying-kibana-build-without-test-script/275782 "2021-06-14T14:07:08Z")
Hi Team, I want to understand , is there any risk of commenting out test cases in kibana 7.10.2 "test": "grunt test" --- ## [How to set the LIMIT with FROM and TO in ES Sql query?](https://discuss.elastic.co/t/how-to-set-the-limit-with-from-and-to-in-es-sql-query/275559)
**Author:** [@Resington\_R](https://discuss.elastic.co/u/Resington_R)\ **Replies:** 1\ **Last updated:** [June 14, 2021, 1:58pm UTC](https://discuss.elastic.co/t/how-to-set-the-limit-with-from-and-to-in-es-sql-query/275559 "2021-06-14T13:58:33Z")
Hi... Can anyone please tell me how to set the Limit with FROM and TO. The below query returns more than 10 thousand records, where I would like to Paginate 50 records in a page. Is there any possibility to set limit wi… --- ## [Logstash could not start ' java.lang.IllegalStateException: Logstash stopped processing because of an error'](https://discuss.elastic.co/t/logstash-could-not-start-java-lang-illegalstateexception-logstash-stopped-processing-because-of-an-error/275805)
**Author:** [@devashishsingh](https://discuss.elastic.co/u/devashishsingh)\ **Replies:** 0\ **Last updated:** [June 14, 2021, 8:01am UTC](https://discuss.elastic.co/t/logstash-could-not-start-java-lang-illegalstateexception-logstash-stopped-processing-because-of-an-error/275805 "2021-06-14T08:01:51Z")
Hello, I experienced an error as below while restarting the Logstash plain-log \[ERROR\]\[org.logstash.Logstash \] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit Thi… --- ## [Percentage of total calculation](https://discuss.elastic.co/t/percentage-of-total-calculation/275661)
**Author:** [@didiViking](https://discuss.elastic.co/u/didiViking)\ **Replies:** 1\ **Last updated:** [June 14, 2021, 1:51pm UTC](https://discuss.elastic.co/t/percentage-of-total-calculation/275661 "2021-06-14T13:51:08Z")
Hi there, I'm filtering the requests by request\_length in order to get specific categories (request\_length between 0 and 3mb etc). The next step is to calculate how much of the total (in percentage) that specific catego… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1367) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1369)