# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1425 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1426 --- ## [Error: ENOENT: no such file or directory, open 'config/kibana-server.key'](https://discuss.elastic.co/t/error-enoent-no-such-file-or-directory-open-config-kibana-server-key/272340)
**Author:** [@ograso](https://discuss.elastic.co/u/ograso)\ **Replies:** 5\ **Last updated:** [May 7, 2021, 3:04pm UTC](https://discuss.elastic.co/t/error-enoent-no-such-file-or-directory-open-config-kibana-server-key/272340 "2021-05-07T15:04:19Z")
I have an issue about setting up basic security for the Elastic Stack plus secured HTTPS traffic when I try to set on kibana.yml. Elastic is working and reachable over https but I receive an error are as follow when I t… --- ## [ELK Kafka integration](https://discuss.elastic.co/t/elk-kafka-integration/272435)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 4\ **Last updated:** [May 7, 2021, 8:28pm UTC](https://discuss.elastic.co/t/elk-kafka-integration/272435 "2021-05-07T20:28:28Z")
Hi All, Does ELK 7.6.2 support reading data directly from Kafka? --- ## [Is globbing not supported in S3 input plugin prefix?](https://discuss.elastic.co/t/is-globbing-not-supported-in-s3-input-plugin-prefix/272443)
**Author:** [@meatwad](https://discuss.elastic.co/u/meatwad)\ **Replies:** 1\ **Last updated:** [May 7, 2021, 8:26pm UTC](https://discuss.elastic.co/t/is-globbing-not-supported-in-s3-input-plugin-prefix/272443 "2021-05-07T20:26:35Z")
I've seen some mention of globbing not being supported in the S3 input plugin's prefix setting in threads from years ago but I just wanted to check in and see if that's still the case. At least it seems to be based on m… --- ## [Filebeat: How to export logs of specific pods](https://discuss.elastic.co/t/filebeat-how-to-export-logs-of-specific-pods/272444)
**Author:** [@vrathore18](https://discuss.elastic.co/u/vrathore18)\ **Replies:** 0\ **Last updated:** [May 7, 2021, 7:33pm UTC](https://discuss.elastic.co/t/filebeat-how-to-export-logs-of-specific-pods/272444 "2021-05-07T19:33:07Z")
This is my filebeat config map. apiVersion: v1 kind: ConfigMap metadata: name: filebeat-config namespace: kube-system labels: k8s-app: filebeat data: filebeat.yml: |- filebeat.inputs: - type: contain… --- ## [How to use nested object in Elasticsearch filter script](https://discuss.elastic.co/t/how-to-use-nested-object-in-elasticsearch-filter-script/272437)
**Author:** [@giovdb94](https://discuss.elastic.co/u/giovdb94)\ **Replies:** 0\ **Last updated:** [May 7, 2021, 4:03pm UTC](https://discuss.elastic.co/t/how-to-use-nested-object-in-elasticsearch-filter-script/272437 "2021-05-07T16:03:46Z")
I need some help. I have an index in ElasticSearch with the following mapping where I define two field for each document indexed: properties: { #field representing a document text "document\_text": … --- ## [Use curator to send elasticsearch indices to S3](https://discuss.elastic.co/t/use-curator-to-send-elasticsearch-indices-to-s3/272084)
**Author:** [@Weathmious](https://discuss.elastic.co/u/Weathmious)\ **Replies:** 5\ **Last updated:** [May 7, 2021, 3:46pm UTC](https://discuss.elastic.co/t/use-curator-to-send-elasticsearch-indices-to-s3/272084 "2021-05-07T15:46:55Z")
Hello, I just managed to link my graylog/elasticsearch server to my S3 bucket curl -X PUT "localhost:9200/\_snapshot/my\_s3\_repository?pretty" -H 'Content-Type: application/json' -d' { "type": "s3", "settings": {… --- ## [Create a propper X-Y Chart for continuous datasets (e.g. distance-force)](https://discuss.elastic.co/t/create-a-propper-x-y-chart-for-continuous-datasets-e-g-distance-force/272322)
**Author:** [@mathric](https://discuss.elastic.co/u/mathric)\ **Replies:** 3\ **Last updated:** [May 7, 2021, 3:44pm UTC](https://discuss.elastic.co/t/create-a-propper-x-y-chart-for-continuous-datasets-e-g-distance-force/272322 "2021-05-07T15:44:34Z")
Hey I'm trying to get things work in ELK. So far I created a index ('undefined') and also a pattern ('unde\*'). Inside the index I am having data like this: Measurement.Distance Measurement.Force Message.Timestamp Me… --- ## [Visualize difference in growth between two time series](https://discuss.elastic.co/t/visualize-difference-in-growth-between-two-time-series/272143)
**Author:** [@snicoll](https://discuss.elastic.co/u/snicoll)\ **Replies:** 9\ **Last updated:** [May 7, 2021, 2:57pm UTC](https://discuss.elastic.co/t/visualize-difference-in-growth-between-two-time-series/272143 "2021-05-07T14:57:24Z")
Hello, I have an index where each document in the index provides the number of open items and the number of closed items. I'd like to build a visualization that shows if the team is catching up closing issues or, if at … --- ## [Iptables module unable to parse some logs from UDM-Pro device](https://discuss.elastic.co/t/iptables-module-unable-to-parse-some-logs-from-udm-pro-device/272335)
**Author:** [@JAndritsch](https://discuss.elastic.co/u/JAndritsch)\ **Replies:** 2\ **Last updated:** [May 7, 2021, 2:11pm UTC](https://discuss.elastic.co/t/iptables-module-unable-to-parse-some-logs-from-udm-pro-device/272335 "2021-05-07T14:11:50Z")
I'm using the Iptables module of Filebeat (master branch on Github, commit ddcf8f1aa) to receive and parse logs from a Unifi Dream Machine Pro over UDP. My module configuration looks like this: - module: iptables log:… --- ## [Filebeat Processors - Can i condition between two vars?](https://discuss.elastic.co/t/filebeat-processors-can-i-condition-between-two-vars/272367)
**Author:** [@ronh](https://discuss.elastic.co/u/ronh)\ **Replies:** 5\ **Last updated:** [May 7, 2021, 2:07pm UTC](https://discuss.elastic.co/t/filebeat-processors-can-i-condition-between-two-vars/272367 "2021-05-07T14:07:08Z")
Hello, Is it possible to compare between 2 vars in input data? For example: processors: - add\_host\_metadata: netinfo.enabled: true - if: contains: host.ip: $source.ip then: - add\_fie… --- ## [How can we differentiate logs of master and data-ingest nodes](https://discuss.elastic.co/t/how-can-we-differentiate-logs-of-master-and-data-ingest-nodes/272416)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 1\ **Last updated:** [May 7, 2021, 1:13pm UTC](https://discuss.elastic.co/t/how-can-we-differentiate-logs-of-master-and-data-ingest-nodes/272416 "2021-05-07T13:13:19Z")
suppose we deployed elasticsearch cluster in GKE with 2 data-ingest and 2 master pods. When I check the kubectl logs , I am able to see similar logs for both master and data-ingest. Is console logs will be similar for b… --- ## [Master election takes minutes](https://discuss.elastic.co/t/master-election-takes-minutes/272303)
**Author:** [@jacknl](https://discuss.elastic.co/u/jacknl)\ **Replies:** 3\ **Last updated:** [May 7, 2021, 1:10pm UTC](https://discuss.elastic.co/t/master-election-takes-minutes/272303 "2021-05-07T13:10:15Z")
Recently I upgraded my 3 master-eligible nodes from Ubuntu 16.04 to 18.04. The master changed twice during this procedure. I noticed that these two master elections took about 1 minute and 4 minutes, respectively. This i… --- ## [\[ES v7.9.1\] Nested terms query runs forever and consumes massive memory](https://discuss.elastic.co/t/es-v7-9-1-nested-terms-query-runs-forever-and-consumes-massive-memory/272421)
**Author:** [@str8y](https://discuss.elastic.co/u/str8y)\ **Replies:** 0\ **Last updated:** [May 7, 2021, 1:05pm UTC](https://discuss.elastic.co/t/es-v7-9-1-nested-terms-query-runs-forever-and-consumes-massive-memory/272421 "2021-05-07T13:05:25Z")
Hi, I'm facing an issue with a nested terms query. We have documents with nested documents within and use multiple nested terms aggregations in our queries. The cardinality of each text field is also quite high. In o… --- ## [Metricbeat: Cannot index event publisher.Event for org\_opencontainers\_image\_created](https://discuss.elastic.co/t/metricbeat-cannot-index-event-publisher-event-for-org-opencontainers-image-created/272127)
**Author:** [@jmcclure](https://discuss.elastic.co/u/jmcclure)\ **Replies:** 2\ **Last updated:** [May 7, 2021, 12:49pm UTC](https://discuss.elastic.co/t/metricbeat-cannot-index-event-publisher-event-for-org-opencontainers-image-created/272127 "2021-05-07T12:49:37Z")
Elasticsearch 7.9.3 (OSS) Kibana 7.9.3 (OSS) Metricbeat 7.9.3 Hi, I have the Metricbeat docker module enabled with a number of metricsets. --- - module: docker metricsets: - container - info - cpu … --- ## [Count number of occurrence of specific keyword from specific field in all docs](https://discuss.elastic.co/t/count-number-of-occurrence-of-specific-keyword-from-specific-field-in-all-docs/272415)
**Author:** [@vradder](https://discuss.elastic.co/u/vradder)\ **Replies:** 0\ **Last updated:** [May 7, 2021, 12:07pm UTC](https://discuss.elastic.co/t/count-number-of-occurrence-of-specific-keyword-from-specific-field-in-all-docs/272415 "2021-05-07T12:07:43Z")
Hello ES Team, I am looking for query in aggregation to find total number of occurrence of specific keyword from specific field in all doc. Example: doc1 - {logEntry: 'allow\_edit\_gos=true, allow\_gos\_edit=false'} doc… --- ## [Azure event hub input](https://discuss.elastic.co/t/azure-event-hub-input/271415)
**Author:** [@BeMoore](https://discuss.elastic.co/u/BeMoore)\ **Replies:** 2\ **Last updated:** [May 7, 2021, 12:03pm UTC](https://discuss.elastic.co/t/azure-event-hub-input/271415 "2021-05-07T12:03:53Z")
I have an azure event hub i want to use the azure event input plugin to grab the data....I’ve gotten Logstash to connect in to the hub.. but im getting a strange error when the conf is running.... hoping someone has an i… --- ## [Unstable indexing rate using S3 input plugin](https://discuss.elastic.co/t/unstable-indexing-rate-using-s3-input-plugin/272410)
**Author:** [@hrochefort](https://discuss.elastic.co/u/hrochefort)\ **Replies:** 0\ **Last updated:** [May 7, 2021, 11:09am UTC](https://discuss.elastic.co/t/unstable-indexing-rate-using-s3-input-plugin/272410 "2021-05-07T11:09:18Z")
Hi, I am using logstash to ingest json files from s3 to elasticsearch and our current indexing speed does not match my needs. I noticed that the indexing rate dips regularly to 0. Sometimes for up to 5 minutes. And thi… --- ## [Kibana Field name mismatching](https://discuss.elastic.co/t/kibana-field-name-mismatching/272382)
**Author:** [@Nil\_Battey\_Sannata](https://discuss.elastic.co/u/Nil_Battey_Sannata)\ **Replies:** 4\ **Last updated:** [May 7, 2021, 10:39am UTC](https://discuss.elastic.co/t/kibana-field-name-mismatching/272382 "2021-05-07T10:39:20Z")
How to fix Kibana field name mismatch in Indexing? In below image, For ex. the data which is in winlog.event\_data.Signature and winlog.event\_data.SignatureStatus I want to be in dll.code\_signature.subject\_name and dll.co… --- ## [Filebeat Parsing issue with module aws](https://discuss.elastic.co/t/filebeat-parsing-issue-with-module-aws/271374)
**Author:** [@AJ18](https://discuss.elastic.co/u/AJ18)\ **Replies:** 9\ **Last updated:** [May 7, 2021, 10:36am UTC](https://discuss.elastic.co/t/filebeat-parsing-issue-with-module-aws/271374 "2021-05-07T10:36:29Z")
Hi, I had set up filebeat agent in my AWS account to ship logs from an S3 bucket. The s3 bucket contains Cloudtrail logs and VPC Flow Logs and has Access logging enabled. The file 'filebeat/modules.d/aws.yml' was modi… --- ## [Scan frequency working](https://discuss.elastic.co/t/scan-frequency-working/272406)
**Author:** [@Madhuri\_Penmatsa](https://discuss.elastic.co/u/Madhuri_Penmatsa)\ **Replies:** 0\ **Last updated:** [May 7, 2021, 10:34am UTC](https://discuss.elastic.co/t/scan-frequency-working/272406 "2021-05-07T10:34:41Z")
I'm new to filebeat and wanted to know how scan\_frequency in filebeat actually works. When using the default scan frequency which is 10s, Our files of size around 400MB (sending the whole file at once using the multili… --- ## [Kibana not connecting after https setup](https://discuss.elastic.co/t/kibana-not-connecting-after-https-setup/272311)
**Author:** [@andcur](https://discuss.elastic.co/u/andcur)\ **Replies:** 6\ **Last updated:** [May 7, 2021, 10:26am UTC](https://discuss.elastic.co/t/kibana-not-connecting-after-https-setup/272311 "2021-05-07T10:26:14Z")
I have enabled https on elastic search and now kibana cannot connect. log \[15:28:25.571\] \[error\]\[elasticsearch\] Request error, retrying GET https://ukee-exp004:9200/\_xpack?accept\_enterprise=true =\> connect E… --- ## [Readiness probe failed: Waiting for elasticsearch cluster to become ready](https://discuss.elastic.co/t/readiness-probe-failed-waiting-for-elasticsearch-cluster-to-become-ready/272273)
**Author:** [@vbharath2007](https://discuss.elastic.co/u/vbharath2007)\ **Replies:** 1\ **Last updated:** [May 7, 2021, 9:42am UTC](https://discuss.elastic.co/t/readiness-probe-failed-waiting-for-elasticsearch-cluster-to-become-ready/272273 "2021-05-07T09:42:59Z")
Hi, I'm running ELK stack using helm charts through the elastic community operator git repo. My ES is a single node cluster, today morning suddenly the pod failed and unable to bring up and receiving the below from the … --- ## [Registry.data.string is null](https://discuss.elastic.co/t/registry-data-string-is-null/272085)
**Author:** [@Nil\_Battey\_Sannata](https://discuss.elastic.co/u/Nil_Battey_Sannata)\ **Replies:** 3\ **Last updated:** [May 7, 2021, 9:39am UTC](https://discuss.elastic.co/t/registry-data-string-is-null/272085 "2021-05-07T09:39:36Z")
As per below logs from endpoint the field name from kibana registry.data.string should contain the value of data string from ImagePath, but it is giving Null value. the data which I want to be in registry.data.string it … --- ## [Mapping is different then discover shows](https://discuss.elastic.co/t/mapping-is-different-then-discover-shows/272330)
**Author:** [@alidrsn](https://discuss.elastic.co/u/alidrsn)\ **Replies:** 3\ **Last updated:** [May 7, 2021, 9:31am UTC](https://discuss.elastic.co/t/mapping-is-different-then-discover-shows/272330 "2021-05-07T09:31:05Z")
Hi there, I am trying to index data which is coming from logstash and ingesting with my ingest-pipeline. I am using index template to use some mapping fields. One of them is response\_time. When i check it from dev to… --- ## [Set Kibana index per Kibana space per beat via API](https://discuss.elastic.co/t/set-kibana-index-per-kibana-space-per-beat-via-api/272395)
**Author:** [@phlegx](https://discuss.elastic.co/u/phlegx)\ **Replies:** 0\ **Last updated:** [May 7, 2021, 9:06am UTC](https://discuss.elastic.co/t/set-kibana-index-per-kibana-space-per-beat-via-api/272395 "2021-05-07T09:06:01Z")
It is possible to set the index per Kibana space for logAlias and metricAlias like this: $ curl -X POST http://your-kibana.example.com/s/\/api/saved\_objects/infrastructure-ui-source/default -H 'kbn-xsrf: true'… --- ## [Filebeat no connection could be made because the target machine actively refused it](https://discuss.elastic.co/t/filebeat-no-connection-could-be-made-because-the-target-machine-actively-refused-it/272302)
**Author:** [@Rashmika\_Gamage](https://discuss.elastic.co/u/Rashmika_Gamage)\ **Replies:** 9\ **Last updated:** [May 7, 2021, 8:55am UTC](https://discuss.elastic.co/t/filebeat-no-connection-could-be-made-because-the-target-machine-actively-refused-it/272302 "2021-05-07T08:55:23Z")
Hi all, I am trying to read logs from beats to logstash in the same machine. I am getting an error no connection could be made because the target machine actively refused it My logstash conf file input { beats … --- ## [How to filter out logs from modules.d configuration?](https://discuss.elastic.co/t/how-to-filter-out-logs-from-modules-d-configuration/272365)
**Author:** [@hazcod](https://discuss.elastic.co/u/hazcod)\ **Replies:** 1\ **Last updated:** [May 7, 2021, 7:50am UTC](https://discuss.elastic.co/t/how-to-filter-out-logs-from-modules-d-configuration/272365 "2021-05-07T07:50:57Z")
Hi guys, So I am using the checkpoint module, configured in the modules.d directory. Is there a way to omit certain log lines using only the modules.d configuration? Thanks. --- ## [Installing Elasticsearch cluster in docker environment](https://discuss.elastic.co/t/installing-elasticsearch-cluster-in-docker-environment/272381)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 0\ **Last updated:** [May 7, 2021, 7:43am UTC](https://discuss.elastic.co/t/installing-elasticsearch-cluster-in-docker-environment/272381 "2021-05-07T07:43:25Z")
Would like to know the details related to installing the elasticsearch cluster in docker environment. Considering 3 VMs and having elasticsearch master and data nodes on each of these servers as containers, and also pos… --- ## [Nested Query summation aggregation for a subset received in the source](https://discuss.elastic.co/t/nested-query-summation-aggregation-for-a-subset-received-in-the-source/272038)
**Author:** [@RapTvin](https://discuss.elastic.co/u/RapTvin)\ **Replies:** 1\ **Last updated:** [May 7, 2021, 7:16am UTC](https://discuss.elastic.co/t/nested-query-summation-aggregation-for-a-subset-received-in-the-source/272038 "2021-05-07T07:16:41Z")
Hello everyone, I am trying for a an aggregated summation query on a nested object on the basis of a variable inside it and the summation on another variable present inside it. Till now I have been able to segregate the … --- ## [Not able to query MongoDB.Bson.ObjectId using ElasticSearch Nest Client](https://discuss.elastic.co/t/not-able-to-query-mongodb-bson-objectid-using-elasticsearch-nest-client/272375)
**Author:** [@zeeshan](https://discuss.elastic.co/u/zeeshan)\ **Replies:** 0\ **Last updated:** [May 7, 2021, 7:08am UTC](https://discuss.elastic.co/t/not-able-to-query-mongodb-bson-objectid-using-elasticsearch-nest-client/272375 "2021-05-07T07:08:58Z")
I have an field of type ObjectId (MongoDB.Bson) in my model, and when I index it elastic search server, it looks like following structure in Elastic Search: My question is, how can query (using NEST client) to match t… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1424) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1426)