# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1369 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1370 --- ## [Write Logstash Data to a File While Preserving Original File Name](https://discuss.elastic.co/t/write-logstash-data-to-a-file-while-preserving-original-file-name/275841)
**Author:** [@Rod\_Guiamoy](https://discuss.elastic.co/u/Rod_Guiamoy)\ **Replies:** 0\ **Last updated:** [June 14, 2021, 1:50pm UTC](https://discuss.elastic.co/t/write-logstash-data-to-a-file-while-preserving-original-file-name/275841 "2021-06-14T13:50:53Z")
Basically I'd like to have Logstash capture the original file name and reusing it when writing the logs to another location. As if you've just copy/pasted it. Use case would be for IIS logs where using \*.log captures all… --- ## [Elasticsearch aggregation from springboot](https://discuss.elastic.co/t/elasticsearch-aggregation-from-springboot/275689)
**Author:** [@saiteja](https://discuss.elastic.co/u/saiteja)\ **Replies:** 1\ **Last updated:** [June 14, 2021, 1:48pm UTC](https://discuss.elastic.co/t/elasticsearch-aggregation-from-springboot/275689 "2021-06-14T13:48:46Z")
Hello, I am trying to get all the values for a filed with count using Aggregation Here is my code Query searchQuery = new NativeSearchQueryBuilder() .withQuery(QueryBuilders.matchAllQuery()) … --- ## [Error parsing timestamp](https://discuss.elastic.co/t/error-parsing-timestamp/275795)
**Author:** [@lani](https://discuss.elastic.co/u/lani)\ **Replies:** 1\ **Last updated:** [June 14, 2021, 1:31pm UTC](https://discuss.elastic.co/t/error-parsing-timestamp/275795 "2021-06-14T13:31:01Z")
Hi everyone, i have a weird log parsing error I failed to solve, maybe someone here can assist me. I have a docker container shipping logs in this (simple?) format: 2021-06-14 08:30:14 ERROR Some message I am shippin… --- ## [How can i make exactly same table as this table in kibana with that line graph included in datatable](https://discuss.elastic.co/t/how-can-i-make-exactly-same-table-as-this-table-in-kibana-with-that-line-graph-included-in-datatable/273166)
**Author:** [@Jay\_Gajjar](https://discuss.elastic.co/u/Jay_Gajjar)\ **Replies:** 3\ **Last updated:** [June 14, 2021, 1:28pm UTC](https://discuss.elastic.co/t/how-can-i-make-exactly-same-table-as-this-table-in-kibana-with-that-line-graph-included-in-datatable/273166 "2021-06-14T13:28:53Z")
--- ## [Authentication using apikey failed](https://discuss.elastic.co/t/authentication-using-apikey-failed/273066)
**Author:** [@nfarmer](https://discuss.elastic.co/u/nfarmer)\ **Replies:** 6\ **Last updated:** [June 14, 2021, 1:27pm UTC](https://discuss.elastic.co/t/authentication-using-apikey-failed/273066 "2021-06-14T13:27:15Z")
So I recently had to reset my ELK stack, because I was having crazy issues I couldn't fix. Without realizing it, and after looking at the logs, I saw that also killed all of my api keys. \[2021-05-14T20:39:26,217\]\[WARN \]… --- ## [Redirecto only to specific dashboard in Kibana behind Nginx reverse proxy](https://discuss.elastic.co/t/redirecto-only-to-specific-dashboard-in-kibana-behind-nginx-reverse-proxy/273052)
**Author:** [@rmartinez.rv](https://discuss.elastic.co/u/rmartinez.rv)\ **Replies:** 3\ **Last updated:** [June 14, 2021, 1:25pm UTC](https://discuss.elastic.co/t/redirecto-only-to-specific-dashboard-in-kibana-behind-nginx-reverse-proxy/273052 "2021-06-14T13:25:59Z")
Hi. I'm using nginx as a reverse proxy to auto-authenticate a dashboard iframe (via share) in another server.... So far i have this: server { listen 443 ssl http2 default\_server; ssl\_certificate… --- ## [When does Logstash update last\_run\_metadata\_path?](https://discuss.elastic.co/t/when-does-logstash-update-last-run-metadata-path/275833)
**Author:** [@chris\_ts24](https://discuss.elastic.co/u/chris_ts24)\ **Replies:** 2\ **Last updated:** [June 14, 2021, 1:21pm UTC](https://discuss.elastic.co/t/when-does-logstash-update-last-run-metadata-path/275833 "2021-06-14T13:21:07Z")
Hi all, I am working with Logstash 7.13.0 & ES 7.13.0 to populate and maintain an index with records from an Oracle DB. The maintenance is achieved by running an update Logstash service every minute. The condition to be… --- ## [Aggregate multiple nested (recursive) logstash](https://discuss.elastic.co/t/aggregate-multiple-nested-recursive-logstash/275621)
**Author:** [@maxi99](https://discuss.elastic.co/u/maxi99)\ **Replies:** 10\ **Last updated:** [June 14, 2021, 1:03pm UTC](https://discuss.elastic.co/t/aggregate-multiple-nested-recursive-logstash/275621 "2021-06-14T13:03:05Z")
I am using logstash with input jdbc, and would like to embed one object inside another with aggregate. How can I use add recursive? Ie add an object inside another object? My jdbc input would return output similar (as … --- ## [Build Custom Subversion](https://discuss.elastic.co/t/build-custom-subversion/275753)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 1\ **Last updated:** [June 14, 2021, 12:54pm UTC](https://discuss.elastic.co/t/build-custom-subversion/275753 "2021-06-14T12:54:53Z")
Hi everyone! I have cloned kibana github! I want to create .deb with custom version, e.g: v7.10.1.1 but every time i run yarn build , the output deb package's version is 7.10.1-SNAPSHOT thanks :heartbeat: --- ## [Connecting to S3 Unable to execute HTTP request: PKIX path building failed](https://discuss.elastic.co/t/connecting-to-s3-unable-to-execute-http-request-pkix-path-building-failed/275827)
**Author:** [@vaclav1](https://discuss.elastic.co/u/vaclav1)\ **Replies:** 1\ **Last updated:** [June 14, 2021, 12:20pm UTC](https://discuss.elastic.co/t/connecting-to-s3-unable-to-execute-http-request-pkix-path-building-failed/275827 "2021-06-14T12:20:43Z")
Dear team, I have imported certificate for the S3 custom bucket to the java cacerts. But still got a following issue on verifying repository: { "error": { "root\_cause": \[ { "type": "repository\_veri… --- ## [Elastic-agent stopped working after adding new integration](https://discuss.elastic.co/t/elastic-agent-stopped-working-after-adding-new-integration/275670)
**Author:** [@bravo](https://discuss.elastic.co/u/bravo)\ **Replies:** 2\ **Last updated:** [June 14, 2021, 11:49am UTC](https://discuss.elastic.co/t/elastic-agent-stopped-working-after-adding-new-integration/275670 "2021-06-14T11:49:40Z")
First of all thank you very much for providing ES Fleet, its so helpful for our small team to manage and monitor nodes easily. We have 20 nodes with elastic-agent and all are working fine except one. In NODE1 elastic-ag… --- ## [Field.keyword is not getting populated with the values from field](https://discuss.elastic.co/t/field-keyword-is-not-getting-populated-with-the-values-from-field/275622)
**Author:** [@nitish012](https://discuss.elastic.co/u/nitish012)\ **Replies:** 2\ **Last updated:** [June 14, 2021, 11:13am UTC](https://discuss.elastic.co/t/field-keyword-is-not-getting-populated-with-the-values-from-field/275622 "2021-06-14T11:13:39Z")
Hi Folks, I am trying to create a visualize in Kibana which will have a URL which will be formatted using the value in the field something like this: https://dashboard?branch={{value}}&id=CPP But I can see the value p… --- ## [Error message LEAK: ByteBuf.release() in /var/log/logstash-plain.log](https://discuss.elastic.co/t/error-message-leak-bytebuf-release-in-var-log-logstash-plain-log/275824)
**Author:** [@jgkootstra](https://discuss.elastic.co/u/jgkootstra)\ **Replies:** 0\ **Last updated:** [June 14, 2021, 10:38am UTC](https://discuss.elastic.co/t/error-message-leak-bytebuf-release-in-var-log-logstash-plain-log/275824 "2021-06-14T10:38:23Z")
io.netty.util.ResourceLeakDetector\] LEAK: ByteBuf.release() was not called before it's garbage-collected. See https://netty.io/wiki/reference-counted-objects.html for more information. for more information. What does th… --- ## [Share dashboards without authentication](https://discuss.elastic.co/t/share-dashboards-without-authentication/275820)
**Author:** [@mar-ro](https://discuss.elastic.co/u/mar-ro)\ **Replies:** 1\ **Last updated:** [June 14, 2021, 10:40am UTC](https://discuss.elastic.co/t/share-dashboards-without-authentication/275820 "2021-06-14T10:40:57Z")
Hello! I'm trying to share a custom dashboard without authentication to embed in a web but when I access to link it shows the following: How can I share the dashboard to allow its visualization without authentication… --- ## [Getting the value of a doc field inside FilterScript plugin](https://discuss.elastic.co/t/getting-the-value-of-a-doc-field-inside-filterscript-plugin/275819)
**Author:** [@lsena](https://discuss.elastic.co/u/lsena)\ **Replies:** 0\ **Last updated:** [June 14, 2021, 10:20am UTC](https://discuss.elastic.co/t/getting-the-value-of-a-doc-field-inside-filterscript-plugin/275819 "2021-06-14T10:20:49Z")
Hi! I need to fetch the value of the \_id (or other doc fields). Currently, I'm doing it like this: Is this the proper way to do it? It feels wrong. Especially fetching \_id since it even throws a warning about the dep… --- ## [FileBeat file type is not correctly set system-wide](https://discuss.elastic.co/t/filebeat-file-type-is-not-correctly-set-system-wide/275794)
**Author:** [@kwoxer](https://discuss.elastic.co/u/kwoxer)\ **Replies:** 2\ **Last updated:** [June 14, 2021, 10:16am UTC](https://discuss.elastic.co/t/filebeat-file-type-is-not-correctly-set-system-wide/275794 "2021-06-14T10:16:54Z")
I have trouble to set the file type of field via filebeat. Somehow the file type is keyword in the Index Pattern overview But in mappings tab of the Index management it says What is the type of the field now? Thi… --- ## [Newly added hosts cannot be seen in Dashboard](https://discuss.elastic.co/t/newly-added-hosts-cannot-be-seen-in-dashboard/275373)
**Author:** [@tuli](https://discuss.elastic.co/u/tuli)\ **Replies:** 3\ **Last updated:** [June 14, 2021, 10:10am UTC](https://discuss.elastic.co/t/newly-added-hosts-cannot-be-seen-in-dashboard/275373 "2021-06-14T10:10:17Z")
Hello, We have upgraded our Elastic to 7.12. And after the upgradation, we can see that when we add any new host in heartbeat/SNMP, the newly added host can be seen in Discover, but cannot find that host from dashboard … --- ## [ElasticSearch escape special character](https://discuss.elastic.co/t/elasticsearch-escape-special-character/275765)
**Author:** [@surajdalvi](https://discuss.elastic.co/u/surajdalvi)\ **Replies:** 3\ **Last updated:** [June 14, 2021, 9:34am UTC](https://discuss.elastic.co/t/elasticsearch-escape-special-character/275765 "2021-06-14T09:34:24Z")
How I escape Unicode characters using a query\_string query? For example, my documents consist of the following data: { "title":"Sachin$tendular" } I am using the query\_string query in the following way: { … --- ## [Can we restrict users to read last n days of data](https://discuss.elastic.co/t/can-we-restrict-users-to-read-last-n-days-of-data/275804)
**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Replies:** 5\ **Last updated:** [June 14, 2021, 9:27am UTC](https://discuss.elastic.co/t/can-we-restrict-users-to-read-last-n-days-of-data/275804 "2021-06-14T09:27:15Z")
we are running Elasticsearch 7.9.0 with basic liecense and we need to put some restriction on users to read the document not more than 2 days. is it possible to add range query in roles? --- ## [Need s390x (IBM System Z) support for Elastic Fleet Agent](https://discuss.elastic.co/t/need-s390x-ibm-system-z-support-for-elastic-fleet-agent/274476)
**Author:** [@kycfeel](https://discuss.elastic.co/u/kycfeel)\ **Replies:** 2\ **Last updated:** [June 14, 2021, 9:22am UTC](https://discuss.elastic.co/t/need-s390x-ibm-system-z-support-for-elastic-fleet-agent/274476 "2021-06-14T09:22:05Z")
Hi there. I want to install an elastic fleet agent on my s390x system but can't find any other builds except for the generic amd64. Unlink the normal elastic beats, it doesn't really seem like I can build my own binary… --- ## [Nested condition in drop\_event processor](https://discuss.elastic.co/t/nested-condition-in-drop-event-processor/275760)
**Author:** [@remrem](https://discuss.elastic.co/u/remrem)\ **Replies:** 1\ **Last updated:** [June 14, 2021, 9:03am UTC](https://discuss.elastic.co/t/nested-condition-in-drop-event-processor/275760 "2021-06-14T09:03:32Z")
I want to drop events with the following conditions: "If (event.id=(x or y) AND user.name=a) OR (event.id= z and process.name = 'cmd.exe') " But I just can't figure out the conditions. --- ## [If/Else condition for Output to Elasticsearch](https://discuss.elastic.co/t/if-else-condition-for-output-to-elasticsearch/275790)
**Author:** [@valhalla](https://discuss.elastic.co/u/valhalla)\ **Replies:** 3\ **Last updated:** [June 14, 2021, 9:01am UTC](https://discuss.elastic.co/t/if-else-condition-for-output-to-elasticsearch/275790 "2021-06-14T09:01:32Z")
Hi team, Would like to ask for your help with regards on having an if else condition on Filebeat’s output to elasticsearch. Would like to check if fields.age ==10 the output to be one array of hosts else other array of … --- ## [ES NEST - How to Create an index and Bulk index dynamic objects with geometry (geo\_point or geo\_shape)?](https://discuss.elastic.co/t/es-nest-how-to-create-an-index-and-bulk-index-dynamic-objects-with-geometry-geo-point-or-geo-shape/275608)
**Author:** [@Florin\_Virdol](https://discuss.elastic.co/u/Florin_Virdol)\ **Replies:** 1\ **Last updated:** [June 14, 2021, 8:59am UTC](https://discuss.elastic.co/t/es-nest-how-to-create-an-index-and-bulk-index-dynamic-objects-with-geometry-geo-point-or-geo-shape/275608 "2021-06-14T08:59:30Z")
Hi, guys! I have a Dataset for which I don't know or have the type in advance, nor the number of properties or their type. On execution, I obtain for that Dataset a DatasetSchema that contain the names, types and some … --- ## [Failed to create alias - reason":"alias \[metricbeat-staging\] has more than one write index](https://discuss.elastic.co/t/failed-to-create-alias-reason-alias-metricbeat-staging-has-more-than-one-write-index/275688)
**Author:** [@phlegx](https://discuss.elastic.co/u/phlegx)\ **Replies:** 1\ **Last updated:** [June 14, 2021, 8:50am UTC](https://discuss.elastic.co/t/failed-to-create-alias-reason-alias-metricbeat-staging-has-more-than-one-write-index/275688 "2021-06-14T08:50:48Z")
Hi there! It seems that when my metricbeat instance gets killed/restarted, something breaks. I always get this error in the metricbeat logs: Index Alias metricbeat-staging setup failed: failed to create alias: {"error… --- ## [Undo index to searchable snapshot conversion](https://discuss.elastic.co/t/undo-index-to-searchable-snapshot-conversion/275073)
**Author:** [@alexs1](https://discuss.elastic.co/u/alexs1)\ **Replies:** 7\ **Last updated:** [June 14, 2021, 8:44am UTC](https://discuss.elastic.co/t/undo-index-to-searchable-snapshot-conversion/275073 "2021-06-14T08:44:29Z")
Hello My question is: Once I checked the searchable snapshot in the ILM cold phase, the index settings, ilm settings and more have changed (as expected) Is there a way to "undo" this step, and return it to be a regul… --- ## [How to get the diff value of 2 fields and set it to a new field](https://discuss.elastic.co/t/how-to-get-the-diff-value-of-2-fields-and-set-it-to-a-new-field/275801)
**Author:** [@kwoxer](https://discuss.elastic.co/u/kwoxer)\ **Replies:** 1\ **Last updated:** [June 14, 2021, 8:30am UTC](https://discuss.elastic.co/t/how-to-get-the-diff-value-of-2-fields-and-set-it-to-a-new-field/275801 "2021-06-14T08:30:08Z")
I want to reference a field in FileBeat to calculate the difference between them. - dissect: tokenizer: '"%{licence}","%{system}","%{part}","%{uses|integer}","%{users|integer}"' field: "message" targ… --- ## [ILM issue](https://discuss.elastic.co/t/ilm-issue/274507)
**Author:** [@Saishantan\_goli](https://discuss.elastic.co/u/Saishantan_goli)\ **Replies:** 3\ **Last updated:** [June 14, 2021, 8:25am UTC](https://discuss.elastic.co/t/ilm-issue/274507 "2021-06-14T08:25:31Z")
Hi, I am trying to set up an ILM policy for the data I am having in my ES. I am getting the below exception. illegal\_argument\_exception: index name \[logstash\] does not match pattern '^.\*-\\d+$'. when I do GET /\_alias… --- ## [Created new index which is supposed to receive and collect logs from our endpoint solution however on Kibana it appears to list all the other index logs but expected?](https://discuss.elastic.co/t/created-new-index-which-is-supposed-to-receive-and-collect-logs-from-our-endpoint-solution-however-on-kibana-it-appears-to-list-all-the-other-index-logs-but-expected/275514)
**Author:** [@devashishsingh](https://discuss.elastic.co/u/devashishsingh)\ **Replies:** 2\ **Last updated:** [June 14, 2021, 7:57am UTC](https://discuss.elastic.co/t/created-new-index-which-is-supposed-to-receive-and-collect-logs-from-our-endpoint-solution-however-on-kibana-it-appears-to-list-all-the-other-index-logs-but-expected/275514 "2021-06-14T07:57:51Z")
Hello Friends, I have created a new logstash conf file for a new TCP syslogs collector and defined to send them to a new index. However on kibana the index pattern seems to have all but endpoint logs? Have I missed ay s… --- ## [Loadtesting on elasticsearch](https://discuss.elastic.co/t/loadtesting-on-elasticsearch/275788)
**Author:** [@purushothamkdr143](https://discuss.elastic.co/u/purushothamkdr143)\ **Replies:** 2\ **Last updated:** [June 14, 2021, 6:33am UTC](https://discuss.elastic.co/t/loadtesting-on-elasticsearch/275788 "2021-06-14T06:33:19Z")
Hi All, I am new to elasticsearch. usecase is to do loadtest on Elasticsearch cluster so that KPI can be monitored(for ex: documents indexed per second, repilcation etc etc). What are the available solutions for this? --- ## [Warnings shown in Rally benchmarking for bulk request](https://discuss.elastic.co/t/warnings-shown-in-rally-benchmarking-for-bulk-request/275649)
**Author:** [@DEEPTHI\_SONA\_G](https://discuss.elastic.co/u/DEEPTHI_SONA_G)\ **Replies:** 1\ **Last updated:** [June 14, 2021, 6:03am UTC](https://discuss.elastic.co/t/warnings-shown-in-rally-benchmarking-for-bulk-request/275649 "2021-06-14T06:03:04Z")
\[WARNING\] merges\_total\_time is 4362 ms indicating that the cluster is not in a defined clean state. Recorded index time metrics may be misleading. \[WARNING\] indexing\_total\_time is 423514 ms indicating that the cluster is… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1368) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1370)