# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1405 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1406 --- ## [Session lost after log file rotation](https://discuss.elastic.co/t/session-lost-after-log-file-rotation/273531)
**Author:** [@Harm](https://discuss.elastic.co/u/Harm)\ **Replies:** 2\ **Last updated:** [May 21, 2021, 7:02am UTC](https://discuss.elastic.co/t/session-lost-after-log-file-rotation/273531 "2021-05-21T07:02:42Z")
Hi, I have recently upgraded from Kibana 7.10.0 to 7.12.1 and since then I'm observing an issue where all user sessions are getting lost after a logfile rotation. My current logging settings are: logging.dest: "/var/… --- ## [FileBeat + LogsTash port 5044](https://discuss.elastic.co/t/filebeat-logstash-port-5044/271777)
**Author:** [@Paveltest](https://discuss.elastic.co/u/Paveltest)\ **Replies:** 6\ **Last updated:** [May 21, 2021, 7:00am UTC](https://discuss.elastic.co/t/filebeat-logstash-port-5044/271777 "2021-05-21T07:00:03Z")
Error ERROR#011\[publisher\_pipeline\_output\]#011pipeline/output.go:154#011Failed to connect to backoff(async(tcp://192.168.10.14:5044)). I can not connect on port 5044 with logstash! On the logstash server port 5044 is op… --- ## [Logstash input s3 Time difference in data acceptance](https://discuss.elastic.co/t/logstash-input-s3-time-difference-in-data-acceptance/273616)
**Author:** [@xiaoloutingfengyu](https://discuss.elastic.co/u/xiaoloutingfengyu)\ **Replies:** 0\ **Last updated:** [May 21, 2021, 6:26am UTC](https://discuss.elastic.co/t/logstash-input-s3-time-difference-in-data-acceptance/273616 "2021-05-21T06:26:37Z")
Logstash receives data from aws-s3, but kibana data is dozens of minutes later than the data on S3. How to modify it? --- ## [PKI security realm lisence](https://discuss.elastic.co/t/pki-security-realm-lisence/273392)
**Author:** [@Armen\_Petrosyan](https://discuss.elastic.co/u/Armen_Petrosyan)\ **Replies:** 8\ **Last updated:** [May 21, 2021, 6:17am UTC](https://discuss.elastic.co/t/pki-security-realm-lisence/273392 "2021-05-21T06:17:18Z")
In subscription page Subscriptions | Elastic Stack Products & Support | Elastic Stated that Encrypted communications is under basic subscription. However when I defined pki real for client authentication, it didn't wor… --- ## [Is there a way to create visualizations/dashboards automatically via API calls?](https://discuss.elastic.co/t/is-there-a-way-to-create-visualizations-dashboards-automatically-via-api-calls/273379)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 3\ **Last updated:** [May 21, 2021, 6:16am UTC](https://discuss.elastic.co/t/is-there-a-way-to-create-visualizations-dashboards-automatically-via-api-calls/273379 "2021-05-21T06:16:47Z")
I have just started off with ELK stack , i have a bunch of data that needs to be visualized, while it is easy on doing it in the GUI, i was wondering if there a way to create visualizations /dashboards automatically via… --- ## [Good practices with Beats and Logstash](https://discuss.elastic.co/t/good-practices-with-beats-and-logstash/273296)
**Author:** [@mar-ro](https://discuss.elastic.co/u/mar-ro)\ **Replies:** 2\ **Last updated:** [May 21, 2021, 6:15am UTC](https://discuss.elastic.co/t/good-practices-with-beats-and-logstash/273296 "2021-05-21T06:15:48Z")
Hello to all of you! I have the following question about which option is better to be able to register two types of logs in elastic search. Let's say for example that I want to log the nginx and crontab logs. In addit… --- ## [Kibana Control visual "No matching indices found" error](https://discuss.elastic.co/t/kibana-control-visual-no-matching-indices-found-error/273553)
**Author:** [@Nisha2297](https://discuss.elastic.co/u/Nisha2297)\ **Replies:** 2\ **Last updated:** [May 21, 2021, 5:26am UTC](https://discuss.elastic.co/t/kibana-control-visual-no-matching-indices-found-error/273553 "2021-05-21T05:26:18Z")
While creating the Control visual in Kibana, I am facing "No matching indices found" error everytime I create a new visual. The index which I am using is totally different than the indices shown in the error. Please ref… --- ## [Kibana visual flexibility](https://discuss.elastic.co/t/kibana-visual-flexibility/273485)
**Author:** [@Nisha2297](https://discuss.elastic.co/u/Nisha2297)\ **Replies:** 2\ **Last updated:** [May 21, 2021, 4:41am UTC](https://discuss.elastic.co/t/kibana-visual-flexibility/273485 "2021-05-21T04:41:12Z")
Is it possible to create the below table chart in Kibana? As much as I explored, Kibana only creates a simple table visual and this type of grouping(ABC,XYZ,OTHER) of field is not possible. --- ## [How does rollup work?](https://discuss.elastic.co/t/how-does-rollup-work/273505)
**Author:** [@Nisha2297](https://discuss.elastic.co/u/Nisha2297)\ **Replies:** 2\ **Last updated:** [May 21, 2021, 4:24am UTC](https://discuss.elastic.co/t/how-does-rollup-work/273505 "2021-05-21T04:24:32Z")
How does Rollup job and rollup index work? what is the use of rolling up the data? I am not very clear of why we are rolling up an index to another one. And my Rollup job is working fine and data is getting indexed but… --- ## [Context-aware Markdown panels via attribute value of antecedent element and attribute selector in custom CSS?](https://discuss.elastic.co/t/context-aware-markdown-panels-via-attribute-value-of-antecedent-element-and-attribute-selector-in-custom-css/273539)
**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\ **Replies:** 5\ **Last updated:** [May 21, 2021, 3:51am UTC](https://discuss.elastic.co/t/context-aware-markdown-panels-via-attribute-value-of-antecedent-element-and-attribute-selector-in-custom-css/273539 "2021-05-21T03:51:39Z")
I have a TSVB Markdown panel that consists of a list of links to related dashboards. I'm inserting that panel at the top of each of the related dashboards. I'm in denial about having to create a separate version of that… --- ## [Collecting syslog from several different vendors](https://discuss.elastic.co/t/collecting-syslog-from-several-different-vendors/273497)
**Author:** [@Christer\_Palmen](https://discuss.elastic.co/u/Christer_Palmen)\ **Replies:** 2\ **Last updated:** [May 21, 2021, 3:39am UTC](https://discuss.elastic.co/t/collecting-syslog-from-several-different-vendors/273497 "2021-05-21T03:39:44Z")
Hello. We have got an task of setting up an Elasticstack server that collects as a start syslog from different vendors in their environment, visualize it in Kibana and forward the syslogs to a CERT department As a sta… --- ## [Elasticsearch/kibana mapping multi-layered/nested data](https://discuss.elastic.co/t/elasticsearch-kibana-mapping-multi-layered-nested-data/272821)
**Author:** [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)\ **Replies:** 1\ **Last updated:** [May 21, 2021, 12:21am UTC](https://discuss.elastic.co/t/elasticsearch-kibana-mapping-multi-layered-nested-data/272821 "2021-05-21T00:21:32Z")
hi, i'm having some issues wrapping my head around how to map this data in elasticsearch/kibana: I'm pulling query data from VirusTotal.com's API on malware. here is a SMALL portion of a HUGE chunk of the query: (1) … --- ## [Bucket anomalies on interfaces that belong to a server](https://discuss.elastic.co/t/bucket-anomalies-on-interfaces-that-belong-to-a-server/273592)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [May 21, 2021, 12:07am UTC](https://discuss.elastic.co/t/bucket-anomalies-on-interfaces-that-belong-to-a-server/273592 "2021-05-21T00:07:14Z")
Hi, I have bandwidth utilization data from multiple interfaces that belong to multiple specifics server. and I was wondering if I can configure the job to create buckets anomalies only when interfaces that belong to a s… --- ## [Packetbeat hardware / software requirements](https://discuss.elastic.co/t/packetbeat-hardware-software-requirements/271729)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 8\ **Last updated:** [May 20, 2021, 11:20pm UTC](https://discuss.elastic.co/t/packetbeat-hardware-software-requirements/271729 "2021-05-20T23:20:01Z")
I have a sensor with a i5-4590, 8GB memory running packetbeat and am still getting "dropped\_because\_of\_gaps" I've followed all the directions about enabling af\_packet, etc yet even on a low traffic link (1-5mbps) I stil… --- ## [Ingest pipeline rename not working](https://discuss.elastic.co/t/ingest-pipeline-rename-not-working/273234)
**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\ **Replies:** 1\ **Last updated:** [May 20, 2021, 10:36pm UTC](https://discuss.elastic.co/t/ingest-pipeline-rename-not-working/273234 "2021-05-20T22:36:57Z")
Kibana version : 7.10.2 Elasticsearch version : 7.10.2 APM Server version : 7.10.2 APM Agent language and version : java 1.8 Fresh install or upgraded from other version? fresh install Is there anything special in… --- ## [Correlation Matrix](https://discuss.elastic.co/t/correlation-matrix/273583)
**Author:** [@dxenakis](https://discuss.elastic.co/u/dxenakis)\ **Replies:** 1\ **Last updated:** [May 20, 2021, 9:36pm UTC](https://discuss.elastic.co/t/correlation-matrix/273583 "2021-05-20T21:36:38Z")
Hi, I have weather data into my elasticsearch from different weather forecast sites. In practice i use (scrapy) spiders in order to crawl the data from the sites and store them to elasticsearch. The index field struct… --- ## [Why stack\_trace field is not populated in discovery for filebeat-\* index pattern](https://discuss.elastic.co/t/why-stack-trace-field-is-not-populated-in-discovery-for-filebeat-index-pattern/273264)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 0\ **Last updated:** [May 18, 2021, 10:12am UTC](https://discuss.elastic.co/t/why-stack-trace-field-is-not-populated-in-discovery-for-filebeat-index-pattern/273264 "2021-05-18T10:12:35Z")
Hello, I am ingesting the java logs and when I have severe exceptions I am also having the error.stack\_trace.text field populated however I cannot see any of the error.stack\_trace nor the error.stack\_trace.textfields be… --- ## [Filebeat iptables module](https://discuss.elastic.co/t/filebeat-iptables-module/273319)
**Author:** [@bgreen](https://discuss.elastic.co/u/bgreen)\ **Replies:** 1\ **Last updated:** [May 20, 2021, 9:22pm UTC](https://discuss.elastic.co/t/filebeat-iptables-module/273319 "2021-05-20T21:22:11Z")
Someone mentioned this in a post in October 2019 but it appears no one responded so I feel like I should ask again - is there a reason the iptables module is missing in the modules.d directory? --- ## [Range query for date in filter ratio - TSVB](https://discuss.elastic.co/t/range-query-for-date-in-filter-ratio-tsvb/272900)
**Author:** [@ErSumit](https://discuss.elastic.co/u/ErSumit)\ **Replies:** 5\ **Last updated:** [May 20, 2021, 8:25pm UTC](https://discuss.elastic.co/t/range-query-for-date-in-filter-ratio-tsvb/272900 "2021-05-20T20:25:53Z")
I want to calculate percentage of sales between offer period. I have multiple stores having offers running during multiple dates. I tried with TSVB, filter ratio as in below image. I'm getting 0% even having data for con… --- ## [Error fetching fields for index pattern metricbeat](https://discuss.elastic.co/t/error-fetching-fields-for-index-pattern-metricbeat/273427)
**Author:** [@thrak](https://discuss.elastic.co/u/thrak)\ **Replies:** 2\ **Last updated:** [May 20, 2021, 8:11pm UTC](https://discuss.elastic.co/t/error-fetching-fields-for-index-pattern-metricbeat/273427 "2021-05-20T20:11:51Z")
Hello, Whenever I try to look at a Metricbeat dashboard, could be for anything, I get multiple spurious errors that pop up off to the side, Error fetching fields for index pattern metricbeat.\*, see attached screenshot. … --- ## [Ipv6 at dashboard](https://discuss.elastic.co/t/ipv6-at-dashboard/273482)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 1\ **Last updated:** [May 20, 2021, 7:55pm UTC](https://discuss.elastic.co/t/ipv6-at-dashboard/273482 "2021-05-20T19:55:04Z")
why in 1 hostname detect 2 ip. ipv4 and ipv6 --- ## [Kibana - calculate average bucket over multi layer data](https://discuss.elastic.co/t/kibana-calculate-average-bucket-over-multi-layer-data/273261)
**Author:** [@ErSumit](https://discuss.elastic.co/u/ErSumit)\ **Replies:** 2\ **Last updated:** [May 20, 2021, 7:53pm UTC](https://discuss.elastic.co/t/kibana-calculate-average-bucket-over-multi-layer-data/273261 "2021-05-20T19:53:17Z")
Hi, I'm able to calculate average bucket score over one layer of data, but not on two lever hierarchy data. Example: A-parent-group m-group t-team 1 A-parent-group m-group t-team 4 A-parent-group n-group p-tea… --- ## [Logstash reads input files but does not write any output](https://discuss.elastic.co/t/logstash-reads-input-files-but-does-not-write-any-output/273575)
**Author:** [@fmanfredi](https://discuss.elastic.co/u/fmanfredi)\ **Replies:** 2\ **Last updated:** [May 20, 2021, 7:14pm UTC](https://discuss.elastic.co/t/logstash-reads-input-files-but-does-not-write-any-output/273575 "2021-05-20T19:14:20Z")
Hi, I'm having problems with logstash. Looks like it is capable of reaching and reading the files I want it to read but there is no sign of processing and output. I'm trying to write both to elasticsearch and stdout bu… --- ## [Logstash: input file plugin and tcp plugins](https://discuss.elastic.co/t/logstash-input-file-plugin-and-tcp-plugins/273058)
**Author:** [@hsalim](https://discuss.elastic.co/u/hsalim)\ **Replies:** 31\ **Last updated:** [May 20, 2021, 7:13pm UTC](https://discuss.elastic.co/t/logstash-input-file-plugin-and-tcp-plugins/273058 "2021-05-20T19:13:40Z")
I have 4 pipelines. 3 using tcp plugin and 1 using file plugin. pipeline with input file plugin works fine independently, but when i add 3 other tcp plugin pipeline, the input file plugin pipeline stops running (after s… --- ## [Load more than 1 million row from SQL Server to ES with Logstash JDBC](https://discuss.elastic.co/t/load-more-than-1-million-row-from-sql-server-to-es-with-logstash-jdbc/273563)
**Author:** [@Dai\_Thai\_Hoa\_Vo](https://discuss.elastic.co/u/Dai_Thai_Hoa_Vo)\ **Replies:** 1\ **Last updated:** [May 20, 2021, 6:30pm UTC](https://discuss.elastic.co/t/load-more-than-1-million-row-from-sql-server-to-es-with-logstash-jdbc/273563 "2021-05-20T18:30:56Z")
Hi every one. I have one case that my table has more 1 million rows in SQL Server and I used logstash JDBC to load them to Elastic Search. It work fine but run very slow. This is my file config. input { jdbc { jdbc… --- ## [Running ELK Stack - Lab Environment - Ubuntu](https://discuss.elastic.co/t/running-elk-stack-lab-environment-ubuntu/272827)
**Author:** [@momo1104](https://discuss.elastic.co/u/momo1104)\ **Replies:** 8\ **Last updated:** [May 20, 2021, 6:30pm UTC](https://discuss.elastic.co/t/running-elk-stack-lab-environment-ubuntu/272827 "2021-05-20T18:30:00Z")
a newbie trying to integrate zeek logs and import them to elk stack. Running a lab environment inside Ubuntu 20.04. Elk stack running using Google Cloud Platform Tried to config filebeats, but I might be getting the c… --- ## [Logstash input plugin](https://discuss.elastic.co/t/logstash-input-plugin/273574)
**Author:** [@hsalim](https://discuss.elastic.co/u/hsalim)\ **Replies:** 0\ **Last updated:** [May 20, 2021, 6:29pm UTC](https://discuss.elastic.co/t/logstash-input-plugin/273574 "2021-05-20T18:29:56Z")
Has anyone experienced a behavior where logstash is not discovering new files and incorrectly marking new discovery as false? \[2021-05-20T18:20:02,794\]\[TRACE\]\[filewatch.discoverer \] discover\_files {"count"=\>2254} \[2… --- ## [Logstash mutate remove field name 'JSON'](https://discuss.elastic.co/t/logstash-mutate-remove-field-name-json/273572)
**Author:** [@raghav\_krishna\_agarw](https://discuss.elastic.co/u/raghav_krishna_agarw)\ **Replies:** 0\ **Last updated:** [May 20, 2021, 6:19pm UTC](https://discuss.elastic.co/t/logstash-mutate-remove-field-name-json/273572 "2021-05-20T18:19:11Z")
I am trying to remove a field name "JSON" in my mongoDB record, while dumping in ELK. But it is not working, may be the case of reserve keyword. Below is the document structure: "date" : \, "name" : "xyz", "JSON" … --- ## [Custom Visualisation in Kibana 7.5.1](https://discuss.elastic.co/t/custom-visualisation-in-kibana-7-5-1/273550)
**Author:** [@vikramnr](https://discuss.elastic.co/u/vikramnr)\ **Replies:** 1\ **Last updated:** [May 20, 2021, 5:49pm UTC](https://discuss.elastic.co/t/custom-visualisation-in-kibana-7-5-1/273550 "2021-05-20T17:49:24Z")
I found that we should place our custom viz inside kibana/plugins folder? But I couldn't find any such folder in the directory structure. Where should I place the folder and how should I start with my development. Could … --- ## [FTP logs - Filebeat](https://discuss.elastic.co/t/ftp-logs-filebeat/273430)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 7\ **Last updated:** [May 20, 2021, 4:52pm UTC](https://discuss.elastic.co/t/ftp-logs-filebeat/273430 "2021-05-20T16:52:10Z")
Hello there, Is there a way to set Filebeat to retrieve al the files from a folder located in a FTP server? if yes, can you please give me more information on how to configure filebeat for that? if no, what is the alte… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1404) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1406)