# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1373 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1374 --- ## [How to make custom graph like Monitors overview](https://discuss.elastic.co/t/how-to-make-custom-graph-like-monitors-overview/275589)
**Author:** [@mar-ro](https://discuss.elastic.co/u/mar-ro)\ **Replies:** 1\ **Last updated:** [June 10, 2021, 2:49pm UTC](https://discuss.elastic.co/t/how-to-make-custom-graph-like-monitors-overview/275589 "2021-06-10T14:49:34Z")
Good afternoon. I'm trying to create a custom dashboard that among its "widgets" has one like the one shown in the "Uptime" menu with the monitors that are "Up" and those that are "Down". My intention is to be able to … --- ## [How to change number format in Logstash](https://discuss.elastic.co/t/how-to-change-number-format-in-logstash/275587)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 1\ **Last updated:** [June 10, 2021, 2:39pm UTC](https://discuss.elastic.co/t/how-to-change-number-format-in-logstash/275587 "2021-06-10T14:39:46Z")
I have numbers like 1.553 23 2.383 26 566 When I parse this with logstash, I get string value of these. When I try to use mutate filter plugin like below; mutate { convert =\> { "number\_field" =\> "int… --- ## [ElasticSearch: Configuring keep alive time for scaling threads](https://discuss.elastic.co/t/elasticsearch-configuring-keep-alive-time-for-scaling-threads/275586)
**Author:** [@SatyaAditya](https://discuss.elastic.co/u/SatyaAditya)\ **Replies:** 0\ **Last updated:** [June 10, 2021, 2:16pm UTC](https://discuss.elastic.co/t/elasticsearch-configuring-keep-alive-time-for-scaling-threads/275586 "2021-06-10T14:16:01Z")
I am facing Java Out Of Memory issue while successive index operations. I have a custom ES plugin, which makes an API call, so for each document an API call is made and a new thread is being created for that API call. Fo… --- ## [How to set Environment variable in kibana](https://discuss.elastic.co/t/how-to-set-environment-variable-in-kibana/275483)
**Author:** [@ravi\_yadav2](https://discuss.elastic.co/u/ravi_yadav2)\ **Replies:** 3\ **Last updated:** [June 10, 2021, 2:00pm UTC](https://discuss.elastic.co/t/how-to-set-environment-variable-in-kibana/275483 "2021-06-10T14:00:51Z")
Hi Team, I am working on 7.10.2 kibana source code. On kibana UI i want to show build version which is dynamic in nature and gets changed on each build . How i can access environment variable inside header.tsx file. H… --- ## [Getting org.elasticsearch.hadoop.rest.EsHadoopRemoteException: too\_many\_clauses: too\_many\_clauses: maxClauseCount is set to 1024\\n](https://discuss.elastic.co/t/getting-org-elasticsearch-hadoop-rest-eshadoopremoteexception-too-many-clauses-too-many-clauses-maxclausecount-is-set-to-1024-n/275580)
**Author:** [@Chilaka\_Ramakrishna](https://discuss.elastic.co/u/Chilaka_Ramakrishna)\ **Replies:** 0\ **Last updated:** [June 10, 2021, 1:37pm UTC](https://discuss.elastic.co/t/getting-org-elasticsearch-hadoop-rest-eshadoopremoteexception-too-many-clauses-too-many-clauses-maxclausecount-is-set-to-1024-n/275580 "2021-06-10T13:37:43Z")
Getting the following error while running spark-sql for a simple in query org.elasticsearch.hadoop.rest.EsHadoopRemoteException: too\_many\_clauses: too\_many\_clauses: maxClauseCount is set to 1024\\n --- ## [Painless script to calculate elapsed time between two fields](https://discuss.elastic.co/t/painless-script-to-calculate-elapsed-time-between-two-fields/275133)
**Author:** [@theirfan](https://discuss.elastic.co/u/theirfan)\ **Replies:** 13\ **Last updated:** [June 10, 2021, 1:19pm UTC](https://discuss.elastic.co/t/painless-script-to-calculate-elapsed-time-between-two-fields/275133 "2021-06-10T13:19:05Z")
Hi All, i have two fields, up : "2021-06-03T07:01:56.159Z" down : "2021-06-03T10:01:29.978Z" Following the above link and solution, doc\['down'\].value.millis - doc\['up'\].value.millis shows me Script is invalid. Vi… --- ## [See autodiscovery generated configs](https://discuss.elastic.co/t/see-autodiscovery-generated-configs/275567)
**Author:** [@Moshe\_Avni](https://discuss.elastic.co/u/Moshe_Avni)\ **Replies:** 0\ **Last updated:** [June 10, 2021, 12:39pm UTC](https://discuss.elastic.co/t/see-autodiscovery-generated-configs/275567 "2021-06-10T12:39:59Z")
Hi, on the autodiscovery docs, it says: On start, Filebeat will scan existing containers and launch the proper configs for them. Is there a way to see the 'launched' configurations to debug if something is wrong with… --- ## [External API Call in kibana 7.10.2](https://discuss.elastic.co/t/external-api-call-in-kibana-7-10-2/275378)
**Author:** [@ravi\_yadav2](https://discuss.elastic.co/u/ravi_yadav2)\ **Replies:** 4\ **Last updated:** [June 10, 2021, 12:11pm UTC](https://discuss.elastic.co/t/external-api-call-in-kibana-7-10-2/275378 "2021-06-10T12:11:06Z")
Hi Team, How i can make API call to our external API. I tried to use fetch , but it misses complete cookies list in the request header. Is there any service already present in Kibana which i can reuse. Trying to make … --- ## [Documentation is lacking, how annotation should be used?](https://discuss.elastic.co/t/documentation-is-lacking-how-annotation-should-be-used/275564)
**Author:** [@Moshe\_Avni](https://discuss.elastic.co/u/Moshe_Avni)\ **Replies:** 0\ **Last updated:** [June 10, 2021, 12:07pm UTC](https://discuss.elastic.co/t/documentation-is-lacking-how-annotation-should-be-used/275564 "2021-06-10T12:07:36Z")
Hi, I'm reading the hint based autodiscovery and there should be an example for EVERY annotation, not for some. This annotation: co.elastic.logs/exclude\_lines is documented as a list of regular expressions, what is t… --- ## [Is SUBQUERY possible?](https://discuss.elastic.co/t/is-subquery-possible/275043)
**Author:** [@Jakub\_Kaczmarek](https://discuss.elastic.co/u/Jakub_Kaczmarek)\ **Replies:** 3\ **Last updated:** [June 10, 2021, 11:50am UTC](https://discuss.elastic.co/t/is-subquery-possible/275043 "2021-06-10T11:50:05Z")
Hi, I have an index "inputs", which consists of 2 columns: sessionId (string), timestamp (date). I want to calculate average session duration and try to add visualization to Canvas. SQL formula: SELECT AVG(duration) … --- ## [Geo-polygon query inside ingest pipeline](https://discuss.elastic.co/t/geo-polygon-query-inside-ingest-pipeline/274886)
**Author:** [@Roy\_Levy](https://discuss.elastic.co/u/Roy_Levy)\ **Replies:** 9\ **Last updated:** [June 10, 2021, 12:00pm UTC](https://discuss.elastic.co/t/geo-polygon-query-inside-ingest-pipeline/274886 "2021-06-10T12:00:45Z")
Hey, I want to use the Geo-polygon query (Geo-polygon query | Elasticsearch Guide \[7.13\] | Elastic) inside an ingest pipeline and I've been thinking how to do it - as there is no query processor and the example for the … --- ## [Lower Filebeat memory usage](https://discuss.elastic.co/t/lower-filebeat-memory-usage/274896)
**Author:** [@YvorL](https://discuss.elastic.co/u/YvorL)\ **Replies:** 1\ **Last updated:** [June 10, 2021, 11:53am UTC](https://discuss.elastic.co/t/lower-filebeat-memory-usage/274896 "2021-06-10T11:53:52Z")
Hi, I'm trying to give Filebeat as little memory as possible. My main issue is that I have a ton of independent containers on a VM and sometimes (due to network issues) Filebeat can't forward all the logs. However, afte… --- ## [Bypassing CORS policy in elasticsearch](https://discuss.elastic.co/t/bypassing-cors-policy-in-elasticsearch/275560)
**Author:** [@aishwarya\_Varadaraju](https://discuss.elastic.co/u/aishwarya_Varadaraju)\ **Replies:** 0\ **Last updated:** [June 10, 2021, 11:49am UTC](https://discuss.elastic.co/t/bypassing-cors-policy-in-elasticsearch/275560 "2021-06-10T11:49:22Z")
Hi Team, Kindly let me know how to divert CORS policy error in elastic search, as I need to integrate my custom app with elastic search. --- ## [Metricbeat events not indexed in Elasticsearch](https://discuss.elastic.co/t/metricbeat-events-not-indexed-in-elasticsearch/274998)
**Author:** [@Hugues\_Bernard](https://discuss.elastic.co/u/Hugues_Bernard)\ **Replies:** 2\ **Last updated:** [June 10, 2021, 11:36am UTC](https://discuss.elastic.co/t/metricbeat-events-not-indexed-in-elasticsearch/274998 "2021-06-10T11:36:14Z")
I configured metricbeat on one node of a 3 nodes elasticsearch cluster. Metricbeat output is set to a separate elasticsearch on a dedicated VM used for monitoring data only. Metricbeat is sending events every 10 secon… --- ## [Change index pattern used by metricbeat for monitoring logstash](https://discuss.elastic.co/t/change-index-pattern-used-by-metricbeat-for-monitoring-logstash/275452)
**Author:** [@BradVido](https://discuss.elastic.co/u/BradVido)\ **Replies:** 3\ **Last updated:** [June 10, 2021, 11:03am UTC](https://discuss.elastic.co/t/change-index-pattern-used-by-metricbeat-for-monitoring-logstash/275452 "2021-06-10T11:03:50Z")
We use metricbeat to monitor logstash, and it creates daily index patterns like: .monitoring-logstash-7-mb-2021.06.09 We'd prefer monthly index patterns, but can't seem to find any way to change it. Is it possible to … --- ## [Azure Event Hubs plugin problem](https://discuss.elastic.co/t/azure-event-hubs-plugin-problem/275463)
**Author:** [@cRaZyT](https://discuss.elastic.co/u/cRaZyT)\ **Replies:** 2\ **Last updated:** [June 10, 2021, 10:57am UTC](https://discuss.elastic.co/t/azure-event-hubs-plugin-problem/275463 "2021-06-10T10:57:36Z")
Hi there, I've installed logstash 7.13.1 and the logstash-input-azure\_event\_hubs 1.3.0 plugin. I got the following error during the initialization: \[ERROR\]\[logstash.inputs.azureeventhubs\]\[main\]\[07395995e41d84f42b907d… --- ## [Multiple string match to create index in filebeat](https://discuss.elastic.co/t/multiple-string-match-to-create-index-in-filebeat/275549)
**Author:** [@rahul30](https://discuss.elastic.co/u/rahul30)\ **Replies:** 0\ **Last updated:** [June 10, 2021, 9:40am UTC](https://discuss.elastic.co/t/multiple-string-match-to-create-index-in-filebeat/275549 "2021-06-10T09:40:29Z")
I want to create multiple index in filebeat by string in message - indices: - index: "billingproxy-%{+yyyy.MM.dd}" regexp: message: '(billingproxy & \\(squid-1\\))' - index:… --- ## [\[Solved\] Kibana Update 7.9.1 to 7.13.1 failed](https://discuss.elastic.co/t/solved-kibana-update-7-9-1-to-7-13-1-failed/275532)
**Author:** [@Roms](https://discuss.elastic.co/u/Roms)\ **Replies:** 1\ **Last updated:** [June 10, 2021, 9:31am UTC](https://discuss.elastic.co/t/solved-kibana-update-7-9-1-to-7-13-1-failed/275532 "2021-06-10T09:31:45Z")
Hello Elastic community, I got a problem by updating my kibana. That's trying to transform documents and seems doesn't work. I have tried a lot of cURL command but that's doesn't work at all. I got always a respond " … --- ## [Kibana doesn't work after Reloaded logging configuration](https://discuss.elastic.co/t/kibana-doesnt-work-after-reloaded-logging-configuration/274966)
**Author:** [@swb](https://discuss.elastic.co/u/swb)\ **Replies:** 2\ **Last updated:** [June 10, 2021, 9:03am UTC](https://discuss.elastic.co/t/kibana-doesnt-work-after-reloaded-logging-configuration/274966 "2021-06-10T09:03:39Z")
Hello, After updating Kibana to version 7.13.0 the service works well, but one time a day Kibana stops working after Reloaded logging configuration due to SIGHUP, what is the reason ? My Kibana configuration file: #ca… --- ## [How to manage multiple namespaces with a single elastic operator](https://discuss.elastic.co/t/how-to-manage-multiple-namespaces-with-a-single-elastic-operator/275542)
**Author:** [@Josue](https://discuss.elastic.co/u/Josue)\ **Replies:** 0\ **Last updated:** [June 10, 2021, 8:52am UTC](https://discuss.elastic.co/t/how-to-manage-multiple-namespaces-with-a-single-elastic-operator/275542 "2021-06-10T08:52:17Z")
Hello - i would like to install ECK one time and manage several namespaces, but it seems not working ! I performed : ./elastic-operator manager --namespaces=elastec,elastec2 without success ! No pods creation on es… --- ## [Range query not giving right result for lte](https://discuss.elastic.co/t/range-query-not-giving-right-result-for-lte/275460)
**Author:** [@soumyas](https://discuss.elastic.co/u/soumyas)\ **Replies:** 4\ **Last updated:** [June 10, 2021, 8:45am UTC](https://discuss.elastic.co/t/range-query-not-giving-right-result-for-lte/275460 "2021-06-10T08:45:27Z")
The result includes 23/03 in the result and miss to show 17/04. Where in data is present in the system. Any help is appreciated. "range" : { "timestamp" : { "from" : "2021-03-23", "to" : "2021-… --- ## [Can you filter a GET search field based on a String value?](https://discuss.elastic.co/t/can-you-filter-a-get-search-field-based-on-a-string-value/275539)
**Author:** [@SeanO95](https://discuss.elastic.co/u/SeanO95)\ **Replies:** 0\ **Last updated:** [June 10, 2021, 8:44am UTC](https://discuss.elastic.co/t/can-you-filter-a-get-search-field-based-on-a-string-value/275539 "2021-06-10T08:44:19Z")
Looking to search a field's result for specific results. So if I have a name field and want to find names beginning with A, I should be able to input 'A\*' and it'll bring back all names beginning with A. So far I've onl… --- ## [Error when enabling Kibana ECS Audit](https://discuss.elastic.co/t/error-when-enabling-kibana-ecs-audit/275505)
**Author:** [@preetish\_P](https://discuss.elastic.co/u/preetish_P)\ **Replies:** 2\ **Last updated:** [June 10, 2021, 8:28am UTC](https://discuss.elastic.co/t/error-when-enabling-kibana-ecs-audit/275505 "2021-06-10T08:28:42Z")
Hi All, We recently upgraded to ES v7.11.2 and would like to use the auditing features in Kibana to monitor the usage of various dashboards by various logins. etc. I tried to enable auditing in my local setup in macOS … --- ## [How to use filter exception syslog messages using logstash](https://discuss.elastic.co/t/how-to-use-filter-exception-syslog-messages-using-logstash/275536)
**Author:** [@MdRashid](https://discuss.elastic.co/u/MdRashid)\ **Replies:** 0\ **Last updated:** [June 10, 2021, 8:26am UTC](https://discuss.elastic.co/t/how-to-use-filter-exception-syslog-messages-using-logstash/275536 "2021-06-10T08:26:16Z")
Ok, let me explain u Below is the exception message Exception Alert @timestamp: 2021-06-01T11:59:38Z \_id: 6N5yx3kBz7SOxaiwHV-c \_index: logstash-2021.06.01 \_type: \_doc message: \<30\>Jun 1 11:59:38 fx-prod-1 prod\_fx-con… --- ## [Logstash Extract message field .log file](https://discuss.elastic.co/t/logstash-extract-message-field-log-file/274577)
**Author:** [@fredsson](https://discuss.elastic.co/u/fredsson)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 5:48am UTC](https://discuss.elastic.co/t/logstash-extract-message-field-log-file/274577 "2021-06-01T05:48:59Z")
Hey guys, i play a bit with the Elastic Stack and i try to visualize some log files. i allready read so many topics how to filter these files, but i didn't get a solution, hopefully i can get some help here … --- ## [High availability with exec command](https://discuss.elastic.co/t/high-availability-with-exec-command/275437)
**Author:** [@Bilanda](https://discuss.elastic.co/u/Bilanda)\ **Replies:** 2\ **Last updated:** [June 10, 2021, 7:48am UTC](https://discuss.elastic.co/t/high-availability-with-exec-command/275437 "2021-06-10T07:48:06Z")
Hello ! I'm currently configuring a highly availabable logstash cluster with two nodes. I'm also using the exec plugin with logstash in order to pull new events. I was wondering if it was possible to set the exec plug… --- ## [Using fingerprint and document\_id for at-least-once delivery and dedupe with ILM](https://discuss.elastic.co/t/using-fingerprint-and-document-id-for-at-least-once-delivery-and-dedupe-with-ilm/275522)
**Author:** [@tomr](https://discuss.elastic.co/u/tomr)\ **Replies:** 3\ **Last updated:** [June 10, 2021, 7:21am UTC](https://discuss.elastic.co/t/using-fingerprint-and-document-id-for-at-least-once-delivery-and-dedupe-with-ilm/275522 "2021-06-10T07:21:37Z")
TL;DR Is ILM compatible with at-least-once-delivery / deduplication / idempotence? Longer version.. I routinely use a fingerprint filter combined with the elasticsearch output's document\_id setting for at-least-once del… --- ## [What's the sort default score difference between elasticsearch7.9.3 and elasticsearch6.8.0](https://discuss.elastic.co/t/whats-the-sort-default-score-difference-between-elasticsearch7-9-3-and-elasticsearch6-8-0/274711)
**Author:** [@sunweiconfidence](https://discuss.elastic.co/u/sunweiconfidence)\ **Replies:** 6\ **Last updated:** [June 10, 2021, 6:42am UTC](https://discuss.elastic.co/t/whats-the-sort-default-score-difference-between-elasticsearch7-9-3-and-elasticsearch6-8-0/274711 "2021-06-10T06:42:30Z")
hi, i test in the elasticsearch7.9.3 using below query clause: URL: https://elastic:password@MACHINENAME:9500/indexname/\_search query post body: { "explain": true, "from": 0, "size": 130, "query": { "bool": { … --- ## [Elastic Search Compatability](https://discuss.elastic.co/t/elastic-search-compatability/274341)
**Author:** [@geek\_007](https://discuss.elastic.co/u/geek_007)\ **Replies:** 4\ **Last updated:** [June 10, 2021, 6:37am UTC](https://discuss.elastic.co/t/elastic-search-compatability/274341 "2021-06-10T06:37:51Z")
We are running elasticsearch 6.4.0 cluster in our production environment. For a new use case we are planning to roll out a new es cluster with version 7.10.0. Will high level java rest client version 6.8.0 be compatible … --- ## [How to retrieve metric data from prometheus](https://discuss.elastic.co/t/how-to-retrieve-metric-data-from-prometheus/275411)
**Author:** [@A\_Mightiev](https://discuss.elastic.co/u/A_Mightiev)\ **Replies:** 6\ **Last updated:** [June 10, 2021, 6:20am UTC](https://discuss.elastic.co/t/how-to-retrieve-metric-data-from-prometheus/275411 "2021-06-10T06:20:28Z")
I would like to visualize data from a prometheus server in kibana, any idea how to do it? I tried to use the module of metricbeat called prometheus, but this looks like is just monitoring the service, it doesn't give me… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1372) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1374)