# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1377 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1378 --- ## [ILM not applying to metricbeats index](https://discuss.elastic.co/t/ilm-not-applying-to-metricbeats-index/274765)
**Author:** [@webfr](https://discuss.elastic.co/u/webfr)\ **Replies:** 2\ **Last updated:** [June 8, 2021, 9:13pm UTC](https://discuss.elastic.co/t/ilm-not-applying-to-metricbeats-index/274765 "2021-06-08T21:13:39Z")
Hello, I'm almost running out of space due to metricbeats index becoming very big, ILM is already applied but doesn't take my settings in account but index never decreases, thanks for your help. ILM PUT \_ilm/policy/… --- ## [Change column headings for saved search or replicate in data table](https://discuss.elastic.co/t/change-column-headings-for-saved-search-or-replicate-in-data-table/274817)
**Author:** [@jteare](https://discuss.elastic.co/u/jteare)\ **Replies:** 2\ **Last updated:** [June 8, 2021, 9:09pm UTC](https://discuss.elastic.co/t/change-column-headings-for-saved-search-or-replicate-in-data-table/274817 "2021-06-08T21:09:16Z")
Hi, I know this question has been asked before and I have read and attempted to reproduce the accepted answers but can't get any to work. I am using Kibana v 7.11.2. I would simply like to add a saved search (with some … --- ## [Help with Split Filter](https://discuss.elastic.co/t/help-with-split-filter/275339)
**Author:** [@pvxchain](https://discuss.elastic.co/u/pvxchain)\ **Replies:** 3\ **Last updated:** [June 8, 2021, 8:59pm UTC](https://discuss.elastic.co/t/help-with-split-filter/275339 "2021-06-08T20:59:08Z")
Hello I'm trying to create two events out of one so that the subsequent pipeline takes place in both. The event itself, before the split happens here: filter { if \[type\] == "pre-split" { mutate { replac… --- ## [How to hot change EUI distributed CSS file?](https://discuss.elastic.co/t/how-to-hot-change-eui-distributed-css-file/275000)
**Author:** [@danburi](https://discuss.elastic.co/u/danburi)\ **Replies:** 2\ **Last updated:** [June 8, 2021, 8:40pm UTC](https://discuss.elastic.co/t/how-to-hot-change-eui-distributed-css-file/275000 "2021-06-08T20:40:52Z")
I have Kibana v7.10.2 on linux system. Kibana loads CSS resource http://localhost:5601/36136/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.v7.light.css the only relevant file can be found at: ./node\_modules/@kbn/ui-s… --- ## [Https://community.bitnami.com/t/problem-to-login-to-elk-stack-at-aws/49257/13](https://discuss.elastic.co/t/https-community-bitnami-com-t-problem-to-login-to-elk-stack-at-aws-49257-13/274782)
**Author:** [@rhino007US](https://discuss.elastic.co/u/rhino007US)\ **Replies:** 2\ **Last updated:** [June 8, 2021, 8:39pm UTC](https://discuss.elastic.co/t/https-community-bitnami-com-t-problem-to-login-to-elk-stack-at-aws-49257-13/274782 "2021-06-08T20:39:28Z")
Hi, I have been trying to get 1 Elasticsearch Cluster Master, built on the Bitnami ELK Stack, and 2 data nodes, built on Bitnami's Elasticsearch AMI (AWS machine image) to join as a cluster for weeks. I posted link ab… --- ## [Non destructive way of clearing all indices](https://discuss.elastic.co/t/non-destructive-way-of-clearing-all-indices/275256)
**Author:** [@eeijlar](https://discuss.elastic.co/u/eeijlar)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 8:10pm UTC](https://discuss.elastic.co/t/non-destructive-way-of-clearing-all-indices/275256 "2021-06-08T20:10:52Z")
I have been using: curl -X DELETE "https://localhost:9200/\_all to delete all indices. I am doing this in a kubernetes ECK environment. It seems to break things though and kibana pod gets into trouble. Am I right in say… --- ## [Cannot link my title to permalink after adding result view](https://discuss.elastic.co/t/cannot-link-my-title-to-permalink-after-adding-result-view/275346)
**Author:** [@Sanjida](https://discuss.elastic.co/u/Sanjida)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 8:09pm UTC](https://discuss.elastic.co/t/cannot-link-my-title-to-permalink-after-adding-result-view/275346 "2021-06-08T20:09:50Z")
I am new at react.js and elastic search. I am trying to custom the UI of reference UI. But after adding the resultview in Results according to the video games tutorial the hyperlink added to the title disappears. I want … --- ## [Failed to run logstash with NotImplementedError](https://discuss.elastic.co/t/failed-to-run-logstash-with-notimplementederror/275238)
**Author:** [@tod-yangyd](https://discuss.elastic.co/u/tod-yangyd)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 8:08pm UTC](https://discuss.elastic.co/t/failed-to-run-logstash-with-notimplementederror/275238 "2021-06-08T20:08:41Z")
Errors when running logstash (solaris10 SPARCS version) java\_version : oracle jdk 1.8 I noticed that there was a reference to ubuntu's add "libc6-dev" on the Internet, but this does not apply to solaris. warning: thre… --- ## [Kibana Visualization](https://discuss.elastic.co/t/kibana-visualization/275244)
**Author:** [@vikramdayma](https://discuss.elastic.co/u/vikramdayma)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 8:05pm UTC](https://discuss.elastic.co/t/kibana-visualization/275244 "2021-06-08T20:05:08Z")
Hi, I create a pie chart visualization in kibana. And create a range slider to select range on a numeric field value. Field value range from 1 to 500 in index. But range slider on same field showing only from 14 to 84. … --- ## [Error to set custom date pattern and change value of @timestamp](https://discuss.elastic.co/t/error-to-set-custom-date-pattern-and-change-value-of-timestamp/275170)
**Author:** [@mar-ro](https://discuss.elastic.co/u/mar-ro)\ **Replies:** 3\ **Last updated:** [June 8, 2021, 7:52pm UTC](https://discuss.elastic.co/t/error-to-set-custom-date-pattern-and-change-value-of-timestamp/275170 "2021-06-08T19:52:11Z")
Hello! I've tried to use the following code to change the value of @timestamp but I couldn't do it.. input { pipeline { address =\> crontab } } filter { grok { match =\> { "message" =\> "(?\%{MONTH} %{MO… --- ## [Why are the Kibana REST APIs marked as experimental?](https://discuss.elastic.co/t/why-are-the-kibana-rest-apis-marked-as-experimental/275254)
**Author:** [@boskjoett](https://discuss.elastic.co/u/boskjoett)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 7:48pm UTC](https://discuss.elastic.co/t/why-are-the-kibana-rest-apis-marked-as-experimental/275254 "2021-06-08T19:48:36Z")
When I look at the Kibana 7.13.1 REST API documentation, for example then all the API endpoints are marked \[Experimental\]. Why is the Kibana REST API experimental? Do you not recommend customers to use them? Also on … --- ## [Can Kibana create a pie chart and table where one of the variables is from the past](https://discuss.elastic.co/t/can-kibana-create-a-pie-chart-and-table-where-one-of-the-variables-is-from-the-past/275209)
**Author:** [@kelvins](https://discuss.elastic.co/u/kelvins)\ **Replies:** 2\ **Last updated:** [June 8, 2021, 7:26pm UTC](https://discuss.elastic.co/t/can-kibana-create-a-pie-chart-and-table-where-one-of-the-variables-is-from-the-past/275209 "2021-06-08T19:26:04Z")
Hello. Not sure how to best describe it in the title. Basically, I will be reading a log file. That log file contains log entries when people uplift a file from the server. I am needing to produce both a gauge, and a… --- ## [Kibana table combining aggregations](https://discuss.elastic.co/t/kibana-table-combining-aggregations/274993)
**Author:** [@sfenman](https://discuss.elastic.co/u/sfenman)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 6:48pm UTC](https://discuss.elastic.co/t/kibana-table-combining-aggregations/274993 "2021-06-08T18:48:45Z")
Hello, Using Kibana, I have created a table visualization like this: Url | Name | Count | Duration Now, based on the name field, I want to aggregate some other metrics from different documents and add them to this tab… --- ## [GeoIP enrichment not working](https://discuss.elastic.co/t/geoip-enrichment-not-working/275084)
**Author:** [@farciarz121](https://discuss.elastic.co/u/farciarz121)\ **Replies:** 30\ **Last updated:** [June 8, 2021, 5:56pm UTC](https://discuss.elastic.co/t/geoip-enrichment-not-working/275084 "2021-06-08T17:56:39Z")
I am trying to setup Geolocation based on IP. I am conecting packetbeat to elastic cloud directly. I have followed instruction from : https://www.elastic.co/guide/en/beats/packetbeat/master/packetbeat-geoip.html But I… --- ## [Filtering logs in logstash](https://discuss.elastic.co/t/filtering-logs-in-logstash/275245)
**Author:** [@Zubaer\_Ahmad](https://discuss.elastic.co/u/Zubaer_Ahmad)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 5:02pm UTC](https://discuss.elastic.co/t/filtering-logs-in-logstash/275245 "2021-06-08T17:02:38Z")
I am trying to filter the following log in logstash but couldn't make it work. Can anyone help me on this. thanks debug | 2021-06-08 12:02:50 | +3ms | SCHEDULER | REQUEST\_ID: ff23e465-7d36-42ea-9a2b-2ba734dde41b | IP\_AD… --- ## [Logstash clone filter use event field as clones parameter](https://discuss.elastic.co/t/logstash-clone-filter-use-event-field-as-clones-parameter/275250)
**Author:** [@ebourlon](https://discuss.elastic.co/u/ebourlon)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 5:02pm UTC](https://discuss.elastic.co/t/logstash-clone-filter-use-event-field-as-clones-parameter/275250 "2021-06-08T17:02:01Z")
Hello, I made some tests with the clone filter in logstash. In my opinion there is no way to make the "clones" parameter dynamic. Does someone know how this can be done? Looking at the filter code I think it might be c… --- ## [Query configuration returns to many hits](https://discuss.elastic.co/t/query-configuration-returns-to-many-hits/275325)
**Author:** [@Rammi22](https://discuss.elastic.co/u/Rammi22)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 4:53pm UTC](https://discuss.elastic.co/t/query-configuration-returns-to-many-hits/275325 "2021-06-08T16:53:30Z")
Hi, i have 1000 index-documents with following structure: // #1 { "\_index": "my\_index\_2008", "\_type": "\_doc", "\_version": 1, "\_seq\_no": 1, "\_primary\_term": 1, "found": true, "\_source": { "meta": { ... }, … --- ## [Okta Filebeat 7.12 Sending Duplicate Events and not Writing to log.json](https://discuss.elastic.co/t/okta-filebeat-7-12-sending-duplicate-events-and-not-writing-to-log-json/275324)
**Author:** [@nferg](https://discuss.elastic.co/u/nferg)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 4:48pm UTC](https://discuss.elastic.co/t/okta-filebeat-7-12-sending-duplicate-events-and-not-writing-to-log-json/275324 "2021-06-08T16:48:47Z")
I am having trouble with the okta module in filebeats when I upgrade from 7.8.0 to 7.12.1. Upgrading causes filebeats to ship events multiple times, over a long period of time, filling up space on our drives. Additionall… --- ## [Split JSON into several events](https://discuss.elastic.co/t/split-json-into-several-events/275212)
**Author:** [@rmartinez.rv](https://discuss.elastic.co/u/rmartinez.rv)\ **Replies:** 4\ **Last updated:** [June 8, 2021, 4:17pm UTC](https://discuss.elastic.co/t/split-json-into-several-events/275212 "2021-06-08T16:17:12Z")
Hi. I'm trying to split into several events a JSON input. I have something like this: { "Domains": \[ { "name": "location", "hash\_size": 4096, "AORs": \[ {… --- ## [Maintaining Multiple Logstash Servers](https://discuss.elastic.co/t/maintaining-multiple-logstash-servers/275315)
**Author:** [@6igwig](https://discuss.elastic.co/u/6igwig)\ **Replies:** 2\ **Last updated:** [June 8, 2021, 3:54pm UTC](https://discuss.elastic.co/t/maintaining-multiple-logstash-servers/275315 "2021-06-08T15:54:07Z")
I would like to set up multiple logstash servers for load balancing as mentioned here. Is there a best practice for maintaining the multiple pipeline files (one for each instance of logstash) besides just configuring one… --- ## [Difference between enable Module and fetching logs directly](https://discuss.elastic.co/t/difference-between-enable-module-and-fetching-logs-directly/274177)
**Author:** [@Dzious](https://discuss.elastic.co/u/Dzious)\ **Replies:** 14\ **Last updated:** [June 8, 2021, 3:33pm UTC](https://discuss.elastic.co/t/difference-between-enable-module-and-fetching-logs-directly/274177 "2021-06-08T15:33:57Z")
Hi, I've recently enabled the IIS Module on filebeat. Once the module enabled and configured, i've looked at the IIS Filebeat dashboard. unfortunately there was no data to see. After some research, i've found this webs… --- ## [Filebeat modules purpose?](https://discuss.elastic.co/t/filebeat-modules-purpose/275316)
**Author:** [@rebug](https://discuss.elastic.co/u/rebug)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 3:31pm UTC](https://discuss.elastic.co/t/filebeat-modules-purpose/275316 "2021-06-08T15:31:39Z")
I just tested for the first time a Filebeat module. If I'm right, the purpose of a module is to have a ready-to-use pattern and dashboard, with a little data enrichment. So I don't undestand what is going on because th… --- ## [How to transfer index from one elastic server to another using kibana ui](https://discuss.elastic.co/t/how-to-transfer-index-from-one-elastic-server-to-another-using-kibana-ui/275239)
**Author:** [@1ac727ff300829bca0fa](https://discuss.elastic.co/u/1ac727ff300829bca0fa)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 3:16pm UTC](https://discuss.elastic.co/t/how-to-transfer-index-from-one-elastic-server-to-another-using-kibana-ui/275239 "2021-06-08T15:16:01Z")
How to transfer index from one elastic server to another using kibana ui --- ## [How to clean up curator messages about system indices being queried](https://discuss.elastic.co/t/how-to-clean-up-curator-messages-about-system-indices-being-queried/275233)
**Author:** [@cknz](https://discuss.elastic.co/u/cknz)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 2:04pm UTC](https://discuss.elastic.co/t/how-to-clean-up-curator-messages-about-system-indices-being-queried/275233 "2021-06-08T14:04:02Z")
I'm using curator to manage my indices currently. I'm suffering from cron spam due to the following: /usr/local/lib/curator/venv/lib64/python3.8/site-packages/elasticsearch/connection/base.py:200: ElasticsearchWarning:… --- ## [Force token filter to output just one token](https://discuss.elastic.co/t/force-token-filter-to-output-just-one-token/275304)
**Author:** [@grad1](https://discuss.elastic.co/u/grad1)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 1:17pm UTC](https://discuss.elastic.co/t/force-token-filter-to-output-just-one-token/275304 "2021-06-08T13:17:01Z")
Hi, I am working on the devlopment of the search solution based on Elasticsearch for Polish language. Initially, I used the recommended analysis-stempel plugin to stem Polish words but after some experiments I found it … --- ## [Cisco ASA module ingest pipeline parsing failure 7.13](https://discuss.elastic.co/t/cisco-asa-module-ingest-pipeline-parsing-failure-7-13/275294)
**Author:** [@mbst83r](https://discuss.elastic.co/u/mbst83r)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 11:49am UTC](https://discuss.elastic.co/t/cisco-asa-module-ingest-pipeline-parsing-failure-7-13/275294 "2021-06-08T11:49:43Z")
Hello, the ingest pipeline is not parsing the IPSEC messages from the Cisco ASA (602303/602304) correctly. I am using filebeat 7.13.1 and the problem is in the filebeat-7.13.1-cisco-asa-asa-ftd-pipeline. 2021-06-08T13:… --- ## [Extra fields created for event](https://discuss.elastic.co/t/extra-fields-created-for-event/275295)
**Author:** [@gyterpena](https://discuss.elastic.co/u/gyterpena)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 12:18pm UTC](https://discuss.elastic.co/t/extra-fields-created-for-event/275295 "2021-06-08T12:18:50Z")
Hello We have this strange situation where logs that have certain fields like source.ip,source.port etc(see attached) get extra fields created eg. event.module:iis OR nginx will show fields named suricata.eve.dest\_ip … --- ## [All indices with yellow status have at least 1 unassigned shard whereas greens have zero, is my analysis correct?](https://discuss.elastic.co/t/all-indices-with-yellow-status-have-at-least-1-unassigned-shard-whereas-greens-have-zero-is-my-analysis-correct/275267)
**Author:** [@devashishsingh](https://discuss.elastic.co/u/devashishsingh)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 12:03pm UTC](https://discuss.elastic.co/t/all-indices-with-yellow-status-have-at-least-1-unassigned-shard-whereas-greens-have-zero-is-my-analysis-correct/275267 "2021-06-08T12:03:43Z")
Hi there! Since all with Yellow status are having trouble processing the data, I have noticed that all indices with yellow status have at least 1 shard unassigned. How can we fix this allocation? Thank you … --- ## [How to convert the output into json in watcher body](https://discuss.elastic.co/t/how-to-convert-the-output-into-json-in-watcher-body/275293)
**Author:** [@Mojahid\_Ahmad](https://discuss.elastic.co/u/Mojahid_Ahmad)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 11:44am UTC](https://discuss.elastic.co/t/how-to-convert-the-output-into-json-in-watcher-body/275293 "2021-06-08T11:44:23Z")
Hi, I want to convert the output into JSON format in the watcher body. I tried {{#toJson}}. But I couldn't get success. Please guide me through how to resolve this issue? "body": """{{#toJson}}{{#ctx.payload.hits.hits}}… --- ## [FATAL Error: Port 5601 is already in use. Another instance of Kibana may be running!](https://discuss.elastic.co/t/fatal-error-port-5601-is-already-in-use-another-instance-of-kibana-may-be-running/274981)
**Author:** [@guxupeta](https://discuss.elastic.co/u/guxupeta)\ **Replies:** 6\ **Last updated:** [June 8, 2021, 11:39am UTC](https://discuss.elastic.co/t/fatal-error-port-5601-is-already-in-use-another-instance-of-kibana-may-be-running/274981 "2021-06-08T11:39:16Z")
Hello guys I'm having problems running start kibana every time I try to start give does tap of errors FATAL Error: Port 5601 is already in use. Another instance of Kibana may be running! I'm sending an image [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1376) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1378)