# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1435 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1436 --- ## [Using Group By Keys to apply metric aggregation](https://discuss.elastic.co/t/using-group-by-keys-to-apply-metric-aggregation/271811)
**Author:** [@Craig\_Uss](https://discuss.elastic.co/u/Craig_Uss)\ **Replies:** 1\ **Last updated:** [April 30, 2021, 5:04pm UTC](https://discuss.elastic.co/t/using-group-by-keys-to-apply-metric-aggregation/271811 "2021-04-30T17:04:10Z")
Is it possible to use an aggregation group\_by attributes in a metric aggregation to determine if the metric should be counted or not? Here is an example: Index of documents: Schema @timestamp - UTC Timestamp c… --- ## [Nanosecond & filebeats & netflow](https://discuss.elastic.co/t/nanosecond-filebeats-netflow/271814)
**Author:** [@dorbye](https://discuss.elastic.co/u/dorbye)\ **Replies:** 0\ **Last updated:** [April 30, 2021, 4:34pm UTC](https://discuss.elastic.co/t/nanosecond-filebeats-netflow/271814 "2021-04-30T16:34:51Z")
Hello, I've an issue with filebeats and netflow : I use softflowd to send netflow metrics with a nanosecond precision to filebeats But, after decoding filebeats only send with a nanosecond precision : (part of htt… --- ## [Question about shard balancing](https://discuss.elastic.co/t/question-about-shard-balancing/271796)
**Author:** [@syn](https://discuss.elastic.co/u/syn)\ **Replies:** 1\ **Last updated:** [April 30, 2021, 4:09pm UTC](https://discuss.elastic.co/t/question-about-shard-balancing/271796 "2021-04-30T16:09:51Z")
hi all, i've a qn.. if node1 has 3 shards. i add node2 and node3 at a later time, will the 3 shards balance out automatically? i.e. 1 shard in each node --- ## [Document deleted after logstash execution](https://discuss.elastic.co/t/document-deleted-after-logstash-execution/271774)
**Author:** [@sourabhjain104](https://discuss.elastic.co/u/sourabhjain104)\ **Replies:** 4\ **Last updated:** [April 30, 2021, 4:04pm UTC](https://discuss.elastic.co/t/document-deleted-after-logstash-execution/271774 "2021-04-30T16:04:54Z")
Hello, I am using the latest version of ELK (7.11.2) on ubuntu 18.4. I am getting data from postgre using JDBC My logstash.conf file look lile : input { jdbc { jdbc\_connection\_string =\>"jdbc:postgresql://123.0.… --- ## [JSON parser error](https://discuss.elastic.co/t/json-parser-error/271283)
**Author:** [@Pacous](https://discuss.elastic.co/u/Pacous)\ **Replies:** 5\ **Last updated:** [April 30, 2021, 3:50pm UTC](https://discuss.elastic.co/t/json-parser-error/271283 "2021-04-30T15:50:17Z")
Hello, This is my logstash configuration below: filter { grok { match =\> { "message" =\> "%{SYSLOG5424PRI:syslog\_index}-\\s\*%{SYSLOGHOST:syslog\_hostname} %{GREEDYDATA:syslog\_message}" } } json { source =\> "syslog\_me… --- ## [\[ConnectionError\]: connect ECONNREFUSED 127.0.0.1:9200"} and Server is not ready](https://discuss.elastic.co/t/connectionerror-connect-econnrefused-127-0-0-1-9200-and-server-is-not-ready/271776)
**Author:** [@LombardoAndrea195](https://discuss.elastic.co/u/LombardoAndrea195)\ **Replies:** 11\ **Last updated:** [April 30, 2021, 3:49pm UTC](https://discuss.elastic.co/t/connectionerror-connect-econnrefused-127-0-0-1-9200-and-server-is-not-ready/271776 "2021-04-30T15:49:48Z")
After lunching docker-compose file I've this problem issue. In case I try to see the dashborad on loclahost:5601 there's a response ("Kibana server is not ready yet"). What's the real problem? I'm able to query informati… --- ## [Filter only required logs and send to elastic search](https://discuss.elastic.co/t/filter-only-required-logs-and-send-to-elastic-search/271738)
**Author:** [@ELK\_gj](https://discuss.elastic.co/u/ELK_gj)\ **Replies:** 1\ **Last updated:** [April 30, 2021, 3:32pm UTC](https://discuss.elastic.co/t/filter-only-required-logs-and-send-to-elastic-search/271738 "2021-04-30T15:32:59Z")
Hi, My input file contains 10 lines of logs, out of which need to parse only 5 logs based on a string, say example: NAS. So, out of 10 logs only 5 logs which contains keyword "NAS" should parse and go to elasticsearch. … --- ## [Elasticsearch: On premise restore snapshot from aws s3](https://discuss.elastic.co/t/elasticsearch-on-premise-restore-snapshot-from-aws-s3/271773)
**Author:** [@Mohammad\_Azizieh](https://discuss.elastic.co/u/Mohammad_Azizieh)\ **Replies:** 3\ **Last updated:** [April 30, 2021, 3:20pm UTC](https://discuss.elastic.co/t/elasticsearch-on-premise-restore-snapshot-from-aws-s3/271773 "2021-04-30T15:20:54Z")
This could sound pretty straightforward. However, I've spent days looking in the web for a method where I can migrate snapshot from aws s3 to on premise elasticsearch cluster. All the docs I've found mentioning how to a… --- ## [Generate multiple types with different csv](https://discuss.elastic.co/t/generate-multiple-types-with-different-csv/271797)
**Author:** [@dpb\_2000](https://discuss.elastic.co/u/dpb_2000)\ **Replies:** 0\ **Last updated:** [April 30, 2021, 2:53pm UTC](https://discuss.elastic.co/t/generate-multiple-types-with-different-csv/271797 "2021-04-30T14:53:33Z")
Hi, I am trying to generate various types in the same index based on various csv. As I don´t know the amount of csv, making an input for each one would be non-viable. So does anyone know how to generate types with the n… --- ## [API-created dashboard not rendering in kibana](https://discuss.elastic.co/t/api-created-dashboard-not-rendering-in-kibana/271783)
**Author:** [@Omar\_Ghetti](https://discuss.elastic.co/u/Omar_Ghetti)\ **Replies:** 2\ **Last updated:** [April 30, 2021, 2:40pm UTC](https://discuss.elastic.co/t/api-created-dashboard-not-rendering-in-kibana/271783 "2021-04-30T14:40:13Z")
Hello! I need help because Kibana is not rendering a dashboard that I created via API, in particular the saved\_objects functions. I generated the JSON via a Python API that i wrote myself, but after saving all the visu… --- ## [Filebeat - GCP Module - No paths were defined for input accessing config](https://discuss.elastic.co/t/filebeat-gcp-module-no-paths-were-defined-for-input-accessing-config/271016)
**Author:** [@cappy](https://discuss.elastic.co/u/cappy)\ **Replies:** 2\ **Last updated:** [April 30, 2021, 2:13pm UTC](https://discuss.elastic.co/t/filebeat-gcp-module-no-paths-were-defined-for-input-accessing-config/271016 "2021-04-30T14:13:56Z")
I'm trying to use the GCP module for Filebeat 7.11.2, but when using the following config: filebeat.modules: - module: gcp audit: enabled: true var.project\_id: project1234 var.topic: topic1234 var.subs… --- ## [Filebeat Pipeline debug output Publish event](https://discuss.elastic.co/t/filebeat-pipeline-debug-output-publish-event/271522)
**Author:** [@Leon21](https://discuss.elastic.co/u/Leon21)\ **Replies:** 3\ **Last updated:** [April 30, 2021, 1:45pm UTC](https://discuss.elastic.co/t/filebeat-pipeline-debug-output-publish-event/271522 "2021-04-30T13:45:54Z")
Hi, I'm struggling with an issue in ingest pipeline for Okta module that seems not working and I could not view events on either dashboards or in Discover panel via searching. I enabled debug output of filebeat and it … --- ## [Not all the datas are returned](https://discuss.elastic.co/t/not-all-the-datas-are-returned/271766)
**Author:** [@yasvanth](https://discuss.elastic.co/u/yasvanth)\ **Replies:** 4\ **Last updated:** [April 30, 2021, 2:06pm UTC](https://discuss.elastic.co/t/not-all-the-datas-are-returned/271766 "2021-04-30T14:06:54Z")
Hi Team, I have ELK stack deployed using docker swarm, when I query data I couldn't retrive all the data. I have multi-tenant kibana indices such as Admin-tenant can view all the data and individual-tenant where team/i… --- ## [Dropdown with fixed list](https://discuss.elastic.co/t/dropdown-with-fixed-list/271395)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 4\ **Last updated:** [April 30, 2021, 1:56pm UTC](https://discuss.elastic.co/t/dropdown-with-fixed-list/271395 "2021-04-30T13:56:56Z")
Hi, Is it possible to add a predefined list of fields to a dropdown without extracting them from a query? Thank you --- ## [Filter by categories](https://discuss.elastic.co/t/filter-by-categories/271788)
**Author:** [@ehsan\_kabiri\_33](https://discuss.elastic.co/u/ehsan_kabiri_33)\ **Replies:** 0\ **Last updated:** [April 30, 2021, 1:49pm UTC](https://discuss.elastic.co/t/filter-by-categories/271788 "2021-04-30T13:49:36Z")
My Index has a property named categoryId.My category Ids at the moment are \[1,2,3\] but there could be more categories like \[1,2,3,4,5\] in the future. Each record in my index can belongs to no categoryId , one categoryId… --- ## [Logstash & data streams](https://discuss.elastic.co/t/logstash-data-streams/271787)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 0\ **Last updated:** [April 30, 2021, 1:45pm UTC](https://discuss.elastic.co/t/logstash-data-streams/271787 "2021-04-30T13:45:40Z")
Hi, Is it possible to setup logstash to use data streams? I have checked the logstash \> elasticsearch output plugin and cannot find any mention of data\_stream =\> "true" as outlined below, not sure if its not needed o… --- ## [Watcher API Not Available](https://discuss.elastic.co/t/watcher-api-not-available/271664)
**Author:** [@Munavir\_Chavody](https://discuss.elastic.co/u/Munavir_Chavody)\ **Replies:** 3\ **Last updated:** [April 30, 2021, 1:39pm UTC](https://discuss.elastic.co/t/watcher-api-not-available/271664 "2021-04-30T13:39:06Z")
I'm trying to access Watcher API via my ES endpoint. I have 2 versions of the ES: 7.11 and 7.10, but both of the shouldn't have any differences as per the documentation. Now, the endpoint /\_watcher/\_query/watches works … --- ## [Search results | Remove parameters from URL in search results](https://discuss.elastic.co/t/search-results-remove-parameters-from-url-in-search-results/271630)
**Author:** [@jaispirit](https://discuss.elastic.co/u/jaispirit)\ **Replies:** 1\ **Last updated:** [April 30, 2021, 1:29pm UTC](https://discuss.elastic.co/t/search-results-remove-parameters-from-url-in-search-results/271630 "2021-04-30T13:29:07Z")
Dear Forum The search results show the URL with parameters (Data Table). How do I get the results without the parameters? For example: remove the question mark and everything after: url.original: Descending /somethi… --- ## [Bad Request in Dashboard for long time interval query](https://discuss.elastic.co/t/bad-request-in-dashboard-for-long-time-interval-query/271491)
**Author:** [@Elaak](https://discuss.elastic.co/u/Elaak)\ **Replies:** 1\ **Last updated:** [April 28, 2021, 10:36am UTC](https://discuss.elastic.co/t/bad-request-in-dashboard-for-long-time-interval-query/271491 "2021-04-28T10:36:23Z")
I am running Elastic Stack 7.9 and am having issues with my dashboard. When I try to catch all my data (search for last 1000 years) in my Kibana dashboard I get an error on the saved Discover table that I have included, … --- ## [Importing Kibana saved objects without CURL](https://discuss.elastic.co/t/importing-kibana-saved-objects-without-curl/271440)
**Author:** [@kudster](https://discuss.elastic.co/u/kudster)\ **Replies:** 1\ **Last updated:** [April 30, 2021, 1:06pm UTC](https://discuss.elastic.co/t/importing-kibana-saved-objects-without-curl/271440 "2021-04-30T13:06:06Z")
Hi i'm currently trying to make a kibana api call using pascal however i'm not sure how to convert the CURL request. This curl request is working from command prompt. curl -X POST "localhost:5601/api/saved\_objects/\_impo… --- ## [Changing the default user in logstash docker image build](https://discuss.elastic.co/t/changing-the-default-user-in-logstash-docker-image-build/271775)
**Author:** [@gorbroth](https://discuss.elastic.co/u/gorbroth)\ **Replies:** 0\ **Last updated:** [April 30, 2021, 12:57pm UTC](https://discuss.elastic.co/t/changing-the-default-user-in-logstash-docker-image-build/271775 "2021-04-30T12:57:02Z")
I've been tying to run my logstash as a docker container using a self created user on cent os 7 . But from what it looks like the image docker.elastic.co/logstash/logstash:6.4.2 creates it use Logstash user . Went throug… --- ## [Kibana - internal/search/es error 404](https://discuss.elastic.co/t/kibana-internal-search-es-error-404/271115)
**Author:** [@gferrette](https://discuss.elastic.co/u/gferrette)\ **Replies:** 3\ **Last updated:** [April 30, 2021, 12:45pm UTC](https://discuss.elastic.co/t/kibana-internal-search-es-error-404/271115 "2021-04-30T12:45:27Z")
Hello! I'm using kibana 7.10.2 behind a proxy with elasticsearch 7.10.2. We are facing the error "POST https://proxy-host/internal/search/es 404 (Not Found)" sometimes when using the kibana dashboards. Prior upgrading t… --- ## [Filebeat reading entire mounted azure file from start](https://discuss.elastic.co/t/filebeat-reading-entire-mounted-azure-file-from-start/271394)
**Author:** [@dthemg](https://discuss.elastic.co/u/dthemg)\ **Replies:** 3\ **Last updated:** [April 30, 2021, 12:23pm UTC](https://discuss.elastic.co/t/filebeat-reading-entire-mounted-azure-file-from-start/271394 "2021-04-30T12:23:57Z")
Hi I have an Azure file that I want to monitor using FileBeat. I am using the helm chart for this purpose, with the following values.yaml: nodeSelector: { beta.kubernetes.io/os: linux } extraVolumes: - name: mod… --- ## [Kibana Header logo, loading elastic logo and elastic comment in map-view](https://discuss.elastic.co/t/kibana-header-logo-loading-elastic-logo-and-elastic-comment-in-map-view/271674)
**Author:** [@Rachitha](https://discuss.elastic.co/u/Rachitha)\ **Replies:** 1\ **Last updated:** [April 30, 2021, 12:09pm UTC](https://discuss.elastic.co/t/kibana-header-logo-loading-elastic-logo-and-elastic-comment-in-map-view/271674 "2021-04-30T12:09:21Z")
Hello, is there any way to remove Kibana Header logo, loading elastic logo and elastic comment in map-view ? I have tried inspecting the css class in windows dev tool. But, when I change any class content for particular… --- ## [Data Streams with ECS mapping](https://discuss.elastic.co/t/data-streams-with-ecs-mapping/271765)
**Author:** [@jetnet](https://discuss.elastic.co/u/jetnet)\ **Replies:** 1\ **Last updated:** [April 30, 2021, 12:00pm UTC](https://discuss.elastic.co/t/data-streams-with-ecs-mapping/271765 "2021-04-30T12:00:30Z")
I use Logstash to create data streams like that: logs-syslog.message-namespace What's the best way to link a "legacy" ECS template ecs-logstash (which gets installed automatically) to that data stream? ELK version: 7.1… --- ## [Elasticsearch mapping with timezone](https://discuss.elastic.co/t/elasticsearch-mapping-with-timezone/271060)
**Author:** [@tkkchan](https://discuss.elastic.co/u/tkkchan)\ **Replies:** 10\ **Last updated:** [April 30, 2021, 11:06am UTC](https://discuss.elastic.co/t/elasticsearch-mapping-with-timezone/271060 "2021-04-30T11:06:27Z")
I have some JSON data that I am parsing with Filebeat and feeding into elasticsearch. There're some timestamps like this "joinTime": "2021-04-23 10:48:10+08:00" and I used the following in mapping to store it "joinTim… --- ## [PollError Gateway Timeout](https://discuss.elastic.co/t/pollerror-gateway-timeout/271756)
**Author:** [@vijnan](https://discuss.elastic.co/u/vijnan)\ **Replies:** 1\ **Last updated:** [April 30, 2021, 10:39am UTC](https://discuss.elastic.co/t/pollerror-gateway-timeout/271756 "2021-04-30T10:39:27Z")
HI, we are getting poll gate way time out error. could you suggest to resolve this Apr 30 09:23:22 ip-10-11-1-200 kibana\[5143\]: {"type":"log","@timestamp":"2021-04-30T09:23:22Z","tags":\["warning","task\_manager"\],"pid":… --- ## [Filebeat output bad permissions](https://discuss.elastic.co/t/filebeat-output-bad-permissions/271500)
**Author:** [@seddikalaouiismaili](https://discuss.elastic.co/u/seddikalaouiismaili)\ **Replies:** 1\ **Last updated:** [April 30, 2021, 10:36am UTC](https://discuss.elastic.co/t/filebeat-output-bad-permissions/271500 "2021-04-30T10:36:42Z")
hi, These are my filebeat configuration: filebeat.inputs: - type: log paths: - /var/log/file1.log - /var/log/file2.log output.file: path: "/var/log/" filename: "all.log" permissions: 0644 rot… --- ## [Metricbeat module aws elb metricbeat](https://discuss.elastic.co/t/metricbeat-module-aws-elb-metricbeat/271658)
**Author:** [@tchek14](https://discuss.elastic.co/u/tchek14)\ **Replies:** 0\ **Last updated:** [April 29, 2021, 1:56pm UTC](https://discuss.elastic.co/t/metricbeat-module-aws-elb-metricbeat/271658 "2021-04-29T13:56:57Z")
Hi, I have configured metricbeat with aws module for elb like following: module: aws period: 5m credential\_profile\_name: wazuh shared\_credential\_file: /xxxxxx/credentials metricsets: cloudwatch metrics: namespac… --- ## [Logstash Memory grows unlimited](https://discuss.elastic.co/t/logstash-memory-grows-unlimited/271757)
**Author:** [@KaustavNath](https://discuss.elastic.co/u/KaustavNath)\ **Replies:** 0\ **Last updated:** [April 30, 2021, 9:52am UTC](https://discuss.elastic.co/t/logstash-memory-grows-unlimited/271757 "2021-04-30T09:52:43Z")
Hello, I am using Logstash version 6.8.3. Recently I face issue with memory in logstash in the pipeline for beat tcp input. In the log I have below error "Caused by: java.lang.IndexOutOfBoundsException: writerIndex(214… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1434) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1436)