# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1432 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1433 --- ## [Disk threshold](https://discuss.elastic.co/t/disk-threshold/271414)
**Author:** [@Abhishek\_Shinde](https://discuss.elastic.co/u/Abhishek_Shinde)\ **Replies:** 6\ **Last updated:** [May 3, 2021, 5:57pm UTC](https://discuss.elastic.co/t/disk-threshold/271414 "2021-05-03T17:57:35Z")
We are trying to implement single node cluster of Elasticsearch per installation of our application. Our application is on-prem. I was looking at the indexing data location parameters in the Elastic documentation. I came… --- ## [IP based failover in Logstash](https://discuss.elastic.co/t/ip-based-failover-in-logstash/271978)
**Author:** [@Debarati\_Goswami](https://discuss.elastic.co/u/Debarati_Goswami)\ **Replies:** 3\ **Last updated:** [May 3, 2021, 5:49pm UTC](https://discuss.elastic.co/t/ip-based-failover-in-logstash/271978 "2021-05-03T17:49:29Z")
Hi All , I have a requirement to collect logs from various sources into Logstash cluster (of 6 nodes) of which 4 nodes are for 4 different types of logs (rsyslog , IPFIX , SFTP and FluentD) and the last two nodes would … --- ## [List all the stale data that is no longer referenced by existing snapshots](https://discuss.elastic.co/t/list-all-the-stale-data-that-is-no-longer-referenced-by-existing-snapshots/271988)
**Author:** [@Aeres-u99](https://discuss.elastic.co/u/Aeres-u99)\ **Replies:** 4\ **Last updated:** [May 3, 2021, 5:48pm UTC](https://discuss.elastic.co/t/list-all-the-stale-data-that-is-no-longer-referenced-by-existing-snapshots/271988 "2021-05-03T17:48:34Z")
We have a small setup where in we have been taking snapshots since last two years and I would like to clean it up to make some storage space on our backup server. I was going through this documentation Clean up snapsho… --- ## [Kibana not loading completely](https://discuss.elastic.co/t/kibana-not-loading-completely/271923)
**Author:** [@soberCoder](https://discuss.elastic.co/u/soberCoder)\ **Replies:** 3\ **Last updated:** [May 3, 2021, 5:03pm UTC](https://discuss.elastic.co/t/kibana-not-loading-completely/271923 "2021-05-03T17:03:26Z")
Hi, Kibana is loading half of the calls and only a blank screen is visible to the user(after the loading logo, nothing loads). I am working with ELK Stack version = 7.10.2 I am trying to share dashboards with reverse… --- ## [Change mapping of a list of indices (rollover)](https://discuss.elastic.co/t/change-mapping-of-a-list-of-indices-rollover/271614)
**Author:** [@samia](https://discuss.elastic.co/u/samia)\ **Replies:** 7\ **Last updated:** [May 3, 2021, 4:36pm UTC](https://discuss.elastic.co/t/change-mapping-of-a-list-of-indices-rollover/271614 "2021-05-03T16:36:13Z")
Hi, I'm using Elastic 7.11 I have a series of indices (not DataStreams) which rollover through an ILM policy. There's a legacy index template which refer to them. I would like to change the mapping of the future ind… --- ## [Cluster is frequently lost with no master and data nodes removed after upgrade from 7.2.1 to 7.10.2](https://discuss.elastic.co/t/cluster-is-frequently-lost-with-no-master-and-data-nodes-removed-after-upgrade-from-7-2-1-to-7-10-2/271907)
**Author:** [@rpremnath](https://discuss.elastic.co/u/rpremnath)\ **Replies:** 5\ **Last updated:** [May 3, 2021, 4:46pm UTC](https://discuss.elastic.co/t/cluster-is-frequently-lost-with-no-master-and-data-nodes-removed-after-upgrade-from-7-2-1-to-7-10-2/271907 "2021-05-03T16:46:13Z")
we are testing upgrade of Elasticsearch from 7.2.1 to 7.10.2 and we have developed custom Rollup and Alias management plugin using NodeClient. In our 3 node set up, all nodes are master, data, ingest nodes. We did not ha… --- ## [Looking for a way to autocreate visualizations on kibana](https://discuss.elastic.co/t/looking-for-a-way-to-autocreate-visualizations-on-kibana/271839)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 2\ **Last updated:** [May 3, 2021, 4:17pm UTC](https://discuss.elastic.co/t/looking-for-a-way-to-autocreate-visualizations-on-kibana/271839 "2021-05-03T16:17:16Z")
Is there a way to autocreate visualizations on Kibana .? I have a considerable amount of logs from different machines that follow the same pattern and logstash is able to parse them successfully . However is there a wa… --- ## [MongoDB Input threw an exception, restarting {:exception=\>#\}](https://discuss.elastic.co/t/mongodb-input-threw-an-exception-restarting-exception-bson-2221275031010008292cainvoicecceprimary-is-an-invalid-objectid/271932)
**Author:** [@BASHEER\_DS](https://discuss.elastic.co/u/BASHEER_DS)\ **Replies:** 3\ **Last updated:** [May 3, 2021, 4:10pm UTC](https://discuss.elastic.co/t/mongodb-input-threw-an-exception-restarting-exception-bson-2221275031010008292cainvoicecceprimary-is-an-invalid-objectid/271932 "2021-05-03T16:10:41Z")
Hi, I am getting below error while creating pipeline. please help in resolving this error. MongoDB Input threw an exception, restarting {:exception=\>#\ **Author:** [@Emanuel\_Prado](https://discuss.elastic.co/u/Emanuel_Prado)\ **Replies:** 2\ **Last updated:** [May 3, 2021, 3:29pm UTC](https://discuss.elastic.co/t/last-empty-field/271980 "2021-05-03T15:29:39Z") How can I get it to be ingested when the last information field is empty? Example all fields complete: 05.03.2021 06:20:00;BTUC8;10168.00;66.66;66.39;0.00;1.60 05.03.2021 06:20:00;BTUC8;10168.00;66.66;66.39;0.00;1.60 … --- ## [How to modified configure logstash add geo\_point and load data with logstash to elasticsearch](https://discuss.elastic.co/t/how-to-modified-configure-logstash-add-geo-point-and-load-data-with-logstash-to-elasticsearch/271984)
**Author:** [@Rizky\_Hudha](https://discuss.elastic.co/u/Rizky_Hudha)\ **Replies:** 1\ **Last updated:** [May 3, 2021, 3:10pm UTC](https://discuss.elastic.co/t/how-to-modified-configure-logstash-add-geo-point-and-load-data-with-logstash-to-elasticsearch/271984 "2021-05-03T15:10:03Z")
I have a column device.latlong where the longtitude and latitude values ​​become one column, how to add a geo\_point file to the logstash configuration, and display it in the kibana visualization and this my configure ap… --- ## [Kibana export png/PDF report missing in trial license](https://discuss.elastic.co/t/kibana-export-png-pdf-report-missing-in-trial-license/271538)
**Author:** [@dcamozzato](https://discuss.elastic.co/u/dcamozzato)\ **Replies:** 4\ **Last updated:** [May 3, 2021, 2:44pm UTC](https://discuss.elastic.co/t/kibana-export-png-pdf-report-missing-in-trial-license/271538 "2021-05-03T14:44:10Z")
I am currently using a trial license to test some of the gold subscription features. After activating the trial, I don't see the PDF / png export options in the "Share" menu in Kibana. Environment: I am running the do… --- ## [Can't setup filebeat](https://discuss.elastic.co/t/cant-setup-filebeat/271843)
**Author:** [@angeling](https://discuss.elastic.co/u/angeling)\ **Replies:** 3\ **Last updated:** [May 3, 2021, 2:56pm UTC](https://discuss.elastic.co/t/cant-setup-filebeat/271843 "2021-05-03T14:56:55Z")
Can anyone help me? I've an elk intance, it's working well, but when I try to setup a new filebeat in another instance it throws me the following: I read that I could remove the filebeat index and then it would work f… --- ## [Change color of some field based on a value of another field in the same document](https://discuss.elastic.co/t/change-color-of-some-field-based-on-a-value-of-another-field-in-the-same-document/271315)
**Author:** [@Manjula\_Piyumal](https://discuss.elastic.co/u/Manjula_Piyumal)\ **Replies:** 4\ **Last updated:** [May 3, 2021, 2:51pm UTC](https://discuss.elastic.co/t/change-color-of-some-field-based-on-a-value-of-another-field-in-the-same-document/271315 "2021-05-03T14:51:49Z")
Hi, In Kibana, is it possible to change the color of a numeric field based on a value in another filed in the same document? My document contains below two fields, I want to change the color of "count", based on the fi… --- ## [Can we have multiple HTTP input plugin configured into single logstash.conf file like below](https://discuss.elastic.co/t/can-we-have-multiple-http-input-plugin-configured-into-single-logstash-conf-file-like-below/271950)
**Author:** [@Learn\_Mulesoft\_With](https://discuss.elastic.co/u/Learn_Mulesoft_With)\ **Replies:** 1\ **Last updated:** [May 3, 2021, 2:50pm UTC](https://discuss.elastic.co/t/can-we-have-multiple-http-input-plugin-configured-into-single-logstash-conf-file-like-below/271950 "2021-05-03T14:50:50Z")
input { http { host =\> "localhost" port =\> "5044" response\_code =\> 201 } http { host =\> "localhost" port =\> "5045" response\_code =\> 201 } http { host =\> "localhost" port =\> "5046" response\_code =\> 201 } } … --- ## [Watcher using metadata array in input terms](https://discuss.elastic.co/t/watcher-using-metadata-array-in-input-terms/271273)
**Author:** [@Destan](https://discuss.elastic.co/u/Destan)\ **Replies:** 2\ **Last updated:** [May 3, 2021, 2:47pm UTC](https://discuss.elastic.co/t/watcher-using-metadata-array-in-input-terms/271273 "2021-05-03T14:47:45Z")
Hello guys, I would like to know if it's possible to use metadata as an array like this: "metadata": { "MyList": \[ "1", "2", "3", "4" \], "from": "60m" } and use it as a par… --- ## [How to install custom Kibana plugin 7.9.2 from local directory inside Docker container?](https://discuss.elastic.co/t/how-to-install-custom-kibana-plugin-7-9-2-from-local-directory-inside-docker-container/271959)
**Author:** [@theonlycatonice](https://discuss.elastic.co/u/theonlycatonice)\ **Replies:** 2\ **Last updated:** [May 3, 2021, 2:44pm UTC](https://discuss.elastic.co/t/how-to-install-custom-kibana-plugin-7-9-2-from-local-directory-inside-docker-container/271959 "2021-05-03T14:44:23Z")
Good day, in order to troubleshoot our plugin we wanted to test it via a docker container. So at the moment I have managed to download a plugin zip from our repository to the Kibana docker container but I cannot figure … --- ## [Kibana crashes](https://discuss.elastic.co/t/kibana-crashes/271900)
**Author:** [@jordan\_sumitomo](https://discuss.elastic.co/u/jordan_sumitomo)\ **Replies:** 3\ **Last updated:** [May 3, 2021, 2:41pm UTC](https://discuss.elastic.co/t/kibana-crashes/271900 "2021-05-03T14:41:05Z")
I've recently started trying out elasticsearch and kibana but kibana crashes Here's my kibana log log \[17:39:57.905\] \[info\]\[plugins-service\] Plugin "osquery" is disabled. log \[17:39:58.029\] \[warning\]\[config\]\[d… --- ## [Filebeat setup without Kibana?](https://discuss.elastic.co/t/filebeat-setup-without-kibana/271958)
**Author:** [@davidwhthomas](https://discuss.elastic.co/u/davidwhthomas)\ **Replies:** 2\ **Last updated:** [May 3, 2021, 2:31pm UTC](https://discuss.elastic.co/t/filebeat-setup-without-kibana/271958 "2021-05-03T14:31:31Z")
Working on a setup where log data is stored in elasticsearch using filebeat. However, we don't need Kibana (lovely although it is) for this application. The data is queried separately via an API. I read: Configure Kiba… --- ## [Disable Saved Search's Result Expand](https://discuss.elastic.co/t/disable-saved-searchs-result-expand/271887)
**Author:** [@bsmith](https://discuss.elastic.co/u/bsmith)\ **Replies:** 2\ **Last updated:** [May 3, 2021, 2:26pm UTC](https://discuss.elastic.co/t/disable-saved-searchs-result-expand/271887 "2021-05-03T14:26:37Z")
Don't want to have to rely on data tables due to performance, but don't want users to be able to see every single field by expanding the row in the saved search on their dashboard. Any way around this? --- ## [What is the pricing as well as disadvantages for ElasticCloud on Linux](https://discuss.elastic.co/t/what-is-the-pricing-as-well-as-disadvantages-for-elasticcloud-on-linux/271926)
**Author:** [@Yash\_Srivastava](https://discuss.elastic.co/u/Yash_Srivastava)\ **Replies:** 3\ **Last updated:** [May 3, 2021, 1:59pm UTC](https://discuss.elastic.co/t/what-is-the-pricing-as-well-as-disadvantages-for-elasticcloud-on-linux/271926 "2021-05-03T13:59:55Z")
what is the pricing as well as disadvantages for ElasticCloud on Linux --- ## [Geo point for new ECS mapped Geo fields using JDBC](https://discuss.elastic.co/t/geo-point-for-new-ecs-mapped-geo-fields-using-jdbc/271846)
**Author:** [@metalshanked](https://discuss.elastic.co/u/metalshanked)\ **Replies:** 6\ **Last updated:** [May 3, 2021, 2:07pm UTC](https://discuss.elastic.co/t/geo-point-for-new-ecs-mapped-geo-fields-using-jdbc/271846 "2021-05-03T14:07:33Z")
Hello, I am trying to map Geo Lat and Long for internal IPs to ECS geo fields such as \[source\]\[geo\]\[location\] using logstash. The standard geoip filter works well for external ips and i see it nicely mapped to the ecs … --- ## [Logstash / Protobuf plugin, removing oneOf fields that aren't set (are null)](https://discuss.elastic.co/t/logstash-protobuf-plugin-removing-oneof-fields-that-arent-set-are-null/271994)
**Author:** [@SCollins](https://discuss.elastic.co/u/SCollins)\ **Replies:** 0\ **Last updated:** [May 3, 2021, 1:48pm UTC](https://discuss.elastic.co/t/logstash-protobuf-plugin-removing-oneof-fields-that-arent-set-are-null/271994 "2021-05-03T13:48:43Z")
I'm using the logstash protobuf plugin as a mechanism to read protobuf from kafka, convert it from protobuf and write it to elasticsearch. The problem we are having is, the oneOf fields, despite being null/not set in the… --- ## [Implications of using ECK Beats to write to logs-\* metrics-\*](https://discuss.elastic.co/t/implications-of-using-eck-beats-to-write-to-logs-metrics/271833)
**Author:** [@jam01](https://discuss.elastic.co/u/jam01)\ **Replies:** 3\ **Last updated:** [May 3, 2021, 1:44pm UTC](https://discuss.elastic.co/t/implications-of-using-eck-beats-to-write-to-logs-metrics/271833 "2021-05-03T13:44:32Z")
Hey guys! We've been building up our Kubernetes platform using ECK and its custom Beat resources. We recently ran into an issue where we needed to apply different ILM policies to different types of data and we found dat… --- ## [Unable to paginate a PIT search without a sort clause](https://discuss.elastic.co/t/unable-to-paginate-a-pit-search-without-a-sort-clause/271793)
**Author:** [@yfful](https://discuss.elastic.co/u/yfful)\ **Replies:** 3\ **Last updated:** [May 3, 2021, 1:34pm UTC](https://discuss.elastic.co/t/unable-to-paginate-a-pit-search-without-a-sort-clause/271793 "2021-05-03T13:34:01Z")
Hello, I am trying to paginate a search but I am unable to do so because results don't include the sort field to search after. However, from what I understand reading the search\_after documentation Paginate search resul… --- ## [Filebeat Azure module not compatible with Maps visualisation](https://discuss.elastic.co/t/filebeat-azure-module-not-compatible-with-maps-visualisation/271910)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 3\ **Last updated:** [May 3, 2021, 1:18pm UTC](https://discuss.elastic.co/t/filebeat-azure-module-not-compatible-with-maps-visualisation/271910 "2021-05-03T13:18:28Z")
I am using Filebeat Azure module to fetch activity logs and sign-in logs. Logstash is running between Filebeat and Elasticsearch and pushing data to a custom index cloud-audit-azure. Using a custom index to store data p… --- ## [How to a emit a value for a runtime field of type geo\_point?](https://discuss.elastic.co/t/how-to-a-emit-a-value-for-a-runtime-field-of-type-geo-point/271889)
**Author:** [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Replies:** 8\ **Last updated:** [May 3, 2021, 12:50pm UTC](https://discuss.elastic.co/t/how-to-a-emit-a-value-for-a-runtime-field-of-type-geo-point/271889 "2021-05-03T12:50:00Z")
I am trying to execute a query for a geo\_point value with a runtime mapping, which according to the docs should work, but it is failing. keywords and long values work fine. For example... Where src.city.name is a keywor… --- ## ["Pipeline does not exist" issue with sonicwall filebeat module](https://discuss.elastic.co/t/pipeline-does-not-exist-issue-with-sonicwall-filebeat-module/271067)
**Author:** [@Tony51](https://discuss.elastic.co/u/Tony51)\ **Replies:** 1\ **Last updated:** [May 3, 2021, 12:41pm UTC](https://discuss.elastic.co/t/pipeline-does-not-exist-issue-with-sonicwall-filebeat-module/271067 "2021-05-03T12:41:21Z")
Hi, I'm sending logs from filebeat to logstash but it I'm getting this error from logstash connecting to elastisearch: \[2021-04-20T10:50:47,200\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main\] 673b0cb9e015302058e251f502b8… --- ## [Webhook action with https fails](https://discuss.elastic.co/t/webhook-action-with-https-fails/270699)
**Author:** [@mtoivo](https://discuss.elastic.co/u/mtoivo)\ **Replies:** 3\ **Last updated:** [May 3, 2021, 10:49am UTC](https://discuss.elastic.co/t/webhook-action-with-https-fails/270699 "2021-05-03T10:49:50Z")
Hi. I'm trying to https-enable a webhook-action, which works fine over plain http. The endpoint is nginx server, where ssl-setup is verified and working. Watcher webhook to the same server works fine over https. I under… --- ## [The JSON filter can extract empty field names, which are then unusable by Logstash](https://discuss.elastic.co/t/the-json-filter-can-extract-empty-field-names-which-are-then-unusable-by-logstash/271963)
**Author:** [@nico127](https://discuss.elastic.co/u/nico127)\ **Replies:** 0\ **Last updated:** [May 3, 2021, 10:45am UTC](https://discuss.elastic.co/t/the-json-filter-can-extract-empty-field-names-which-are-then-unusable-by-logstash/271963 "2021-05-03T10:45:00Z")
Hi, I've found a situation where the JSON filter and valid JSON can cause unusable Logstash events. It comes from 2 facts: An empty string is a valid JSON key, as explained for example in this stackoverflow answer. It … --- ## [Ship Kubernenetes events logs to kibana](https://discuss.elastic.co/t/ship-kubernenetes-events-logs-to-kibana/271388)
**Author:** [@frozen\_walker](https://discuss.elastic.co/u/frozen_walker)\ **Replies:** 0\ **Last updated:** [April 27, 2021, 1:50pm UTC](https://discuss.elastic.co/t/ship-kubernenetes-events-logs-to-kibana/271388 "2021-04-27T13:50:13Z")
How can we ship Kubernetes events logs to kibana. ie: That we can get from kubectl get events command. example output: LAST SEEN TYPE REASON OBJECT MESSAGE 47s Warning Failed p… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1431) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1433)