# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1441 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1442 --- ## [Filebeat exclude\_lines is not working on Openshift](https://discuss.elastic.co/t/filebeat-exclude-lines-is-not-working-on-openshift/271407)
**Author:** [@Ferdous\_Khan](https://discuss.elastic.co/u/Ferdous_Khan)\ **Replies:** 1\ **Last updated:** [April 28, 2021, 8:37am UTC](https://discuss.elastic.co/t/filebeat-exclude-lines-is-not-working-on-openshift/271407 "2021-04-28T08:37:43Z")
Hello, We have this Filebeat (v7.1) configuration on OpenShift Pod that only excludes lines that have 'ACPI' in it: - type: log paths: - /var/log/kern.log enabled: true exclude\_lines: \['AC… --- ## [Import dashboard with new ID using API?](https://discuss.elastic.co/t/import-dashboard-with-new-id-using-api/271448)
**Author:** [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Replies:** 4\ **Last updated:** [April 28, 2021, 8:33am UTC](https://discuss.elastic.co/t/import-dashboard-with-new-id-using-api/271448 "2021-04-28T08:33:13Z")
Hi, I want to automatically add dashboards to a space. My dashboard are all the same except for a filter and the title. I was thinking about using the import API and have a script change the filter and title values but… --- ## [Reindex from 2.x to elastic 5.x](https://discuss.elastic.co/t/reindex-from-2-x-to-elastic-5-x/271333)
**Author:** [@lmrc](https://discuss.elastic.co/u/lmrc)\ **Replies:** 2\ **Last updated:** [April 28, 2021, 8:24am UTC](https://discuss.elastic.co/t/reindex-from-2-x-to-elastic-5-x/271333 "2021-04-28T08:24:36Z")
Good morning everyone, I am trying to upgrade elasticsearch with graylog to the newest version. Currently I have the elasticsearch indexes in version 1.7, I can read them from elasticsearch 2.x but I need to reindex to … --- ## [Is GCE Discovery still a thing?](https://discuss.elastic.co/t/is-gce-discovery-still-a-thing/271363)
**Author:** [@ppuschmann](https://discuss.elastic.co/u/ppuschmann)\ **Replies:** 7\ **Last updated:** [April 28, 2021, 8:06am UTC](https://discuss.elastic.co/t/is-gce-discovery-still-a-thing/271363 "2021-04-28T08:06:37Z")
Hi there, currently I'm investigating if it was sensible to enable the GCE-discovery in Elasticsearch. According to this (older) thread, there are some hints about documentation and possibly implementation being outdat… --- ## [Unable setup password for 3 nodes cluster](https://discuss.elastic.co/t/unable-setup-password-for-3-nodes-cluster/271481)
**Author:** [@overbid](https://discuss.elastic.co/u/overbid)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 8:04am UTC](https://discuss.elastic.co/t/unable-setup-password-for-3-nodes-cluster/271481 "2021-04-28T08:04:44Z")
I use podman to deploy 3 nodes cluster in 3 machines. version: "3" services: es01: image: docker.elastic.co/elasticsearch/elasticsearch:7.12.0 container\_name: es01 environment: - node.name=es01 … --- ## [Tooltip on image or shape - canvas](https://discuss.elastic.co/t/tooltip-on-image-or-shape-canvas/271247)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 7\ **Last updated:** [April 28, 2021, 7:48am UTC](https://discuss.elastic.co/t/tooltip-on-image-or-shape-canvas/271247 "2021-04-28T07:48:45Z")
Hello, is it possible to add the tooltip (HTML title attribute) to an image or canvas shape? If so, how? Thank you --- ## [I want to import aws cloudtrail eventTime through logstash](https://discuss.elastic.co/t/i-want-to-import-aws-cloudtrail-eventtime-through-logstash/271479)
**Author:** [@loanshark](https://discuss.elastic.co/u/loanshark)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 7:47am UTC](https://discuss.elastic.co/t/i-want-to-import-aws-cloudtrail-eventtime-through-logstash/271479 "2021-04-28T07:47:57Z")
I want to import aws cloudtrail eventTime through logstash. Works well but fails to get eventTime. my logstash.conf input { s3 { bucket =\> "xxxxx" prefix =\> "xxxxx" sincedb\_path =\> "/etc/logstash/sincedb/… --- ## [Completed handshake with but follow up connection failed](https://discuss.elastic.co/t/completed-handshake-with-but-follow-up-connection-failed/271353)
**Author:** [@overbid](https://discuss.elastic.co/u/overbid)\ **Replies:** 3\ **Last updated:** [April 27, 2021, 11:15am UTC](https://discuss.elastic.co/t/completed-handshake-with-but-follow-up-connection-failed/271353 "2021-04-27T11:15:57Z")
I'm trying to install via podman compose in 3 machines on AWS EC2 version: "3" services: es01: image: docker.elastic.co/elasticsearch/elasticsearch:7.12.0 container\_name: es01 environment: - node.nam… --- ## [Conditional with chinese character in ingest issue](https://discuss.elastic.co/t/conditional-with-chinese-character-in-ingest-issue/271475)
**Author:** [@tbs575](https://discuss.elastic.co/u/tbs575)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 7:40am UTC](https://discuss.elastic.co/t/conditional-with-chinese-character-in-ingest-issue/271475 "2021-04-28T07:40:02Z")
Elasticsearch 7.12, filebeat get log message then send to elasticsearch. messages with keyword '上报请求信息' include json data, I created ingest with condition try to get these json data, the following is my ingest content. … --- ## [JVM heap spikes on data node](https://discuss.elastic.co/t/jvm-heap-spikes-on-data-node/270870)
**Author:** [@radovan](https://discuss.elastic.co/u/radovan)\ **Replies:** 10\ **Last updated:** [April 28, 2021, 7:39am UTC](https://discuss.elastic.co/t/jvm-heap-spikes-on-data-node/270870 "2021-04-28T07:39:56Z")
Hello, I'm not really educated in this topic, but when I first saw this log in our logstash: \[2021-04-15T14:11:47,605\]\[INFO \]\[logstash.outputs.elasticsearch\]\[beats-monitoring-crypto\]\[3228c43cca49b666651ceb4c7945f188f5… --- ## [Anonymous Kibana Users](https://discuss.elastic.co/t/anonymous-kibana-users/270071)
**Author:** [@caitlyn.carlisle](https://discuss.elastic.co/u/caitlyn.carlisle)\ **Replies:** 27\ **Last updated:** [April 28, 2021, 7:35am UTC](https://discuss.elastic.co/t/anonymous-kibana-users/270071 "2021-04-28T07:35:10Z")
I am attempting to add anonymous users to view my Kibana dashboards but it is giving me this error when I attempt to edit the elasticsearch.yml file. Additionally, will adding this feature allow the dashboard to comp… --- ## [Packetbeat on high volume production Windows-AD-DNS-Servers](https://discuss.elastic.co/t/packetbeat-on-high-volume-production-windows-ad-dns-servers/270652)
**Author:** [@Mischa\_Diehm](https://discuss.elastic.co/u/Mischa_Diehm)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 6:07am UTC](https://discuss.elastic.co/t/packetbeat-on-high-volume-production-windows-ad-dns-servers/270652 "2021-04-28T06:07:08Z")
Hi, we are trying to visualize and permanently record our DNS traffic. The DNS Server is run on Windows 10 and the logs it writes are ok but extending it with packetbeat would increase the visibility a lot. The concerns… --- ## [Alert kibana error](https://discuss.elastic.co/t/alert-kibana-error/271324)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 2\ **Last updated:** [April 28, 2021, 6:05am UTC](https://discuss.elastic.co/t/alert-kibana-error/271324 "2021-04-28T06:05:24Z")
i try to activate my alert. but when i start my kibana failure to start. here's my configuration # Kibana is served by a back end server. This setting specifies the port to use. # server.port: 5601 server.port: 5601 # … --- ## [Most optimal ElasticSearch](https://discuss.elastic.co/t/most-optimal-elasticsearch/271445)
**Author:** [@ekrx](https://discuss.elastic.co/u/ekrx)\ **Replies:** 6\ **Last updated:** [April 28, 2021, 5:16am UTC](https://discuss.elastic.co/t/most-optimal-elasticsearch/271445 "2021-04-28T05:16:12Z")
This is a very ambiguous question since I don't know exactly where to start. We require the most optimized ES performance for a mission critical system. Currently our ES queries are taking somewhere around 100-200 ms to … --- ## [How to remove special character on JSON file in logstash](https://discuss.elastic.co/t/how-to-remove-special-character-on-json-file-in-logstash/271462)
**Author:** [@mario\_kazela](https://discuss.elastic.co/u/mario_kazela)\ **Replies:** 1\ **Last updated:** [April 28, 2021, 5:06am UTC](https://discuss.elastic.co/t/how-to-remove-special-character-on-json-file-in-logstash/271462 "2021-04-28T05:06:16Z")
Hi, I'm new with ELK. Just want to ask, how to remove "\[" on the logstash? \[{"uuid": "8153990955613214174559836954673410970", "label": \["Phone", "Laptop", "Pc", "Computer", "Iphone", "Mobile Phone", "Electronics", "Cel… --- ## [Unable to create very simple runtime mapping](https://discuss.elastic.co/t/unable-to-create-very-simple-runtime-mapping/271307)
**Author:** [@Sam\_Critchley](https://discuss.elastic.co/u/Sam_Critchley)\ **Replies:** 1\ **Last updated:** [April 28, 2021, 4:48am UTC](https://discuss.elastic.co/t/unable-to-create-very-simple-runtime-mapping/271307 "2021-04-28T04:48:04Z")
Hi. I'm trying to define a mapping for a transform. But any attempt to read the field I want to examine results in "Bad Request: \[script\_exception\] runtime error". { "target\_id": { "type": "keywo… --- ## [Custom font canvas](https://discuss.elastic.co/t/custom-font-canvas/271265)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 6\ **Last updated:** [April 28, 2021, 4:02am UTC](https://discuss.elastic.co/t/custom-font-canvas/271265 "2021-04-28T04:02:07Z")
hi, how can I add custom font in Canvas? Thanks --- ## [Moving From ES 5.x to 7.x and OS Upgrade](https://discuss.elastic.co/t/moving-from-es-5-x-to-7-x-and-os-upgrade/270979)
**Author:** [@cis4life](https://discuss.elastic.co/u/cis4life)\ **Replies:** 6\ **Last updated:** [April 28, 2021, 3:32am UTC](https://discuss.elastic.co/t/moving-from-es-5-x-to-7-x-and-os-upgrade/270979 "2021-04-28T03:32:39Z")
Good Morning, I have a clustered ES 5.x environment that I need to do a few things. 1.) Upgrade the Server OS from Ubuntu 16.04 to 18.04 possibly 20.04. When we attempted this last week, we tried to upgrade by using..… --- ## [Marking index location in read only mode](https://discuss.elastic.co/t/marking-index-location-in-read-only-mode/271416)
**Author:** [@Abhishek\_Shinde](https://discuss.elastic.co/u/Abhishek_Shinde)\ **Replies:** 5\ **Last updated:** [April 28, 2021, 3:29am UTC](https://discuss.elastic.co/t/marking-index-location-in-read-only-mode/271416 "2021-04-28T03:29:38Z")
I wanted to know, how to close existing index location (ready-only mode) and open new index location for writing the index data? Consider a use case that, I want to chage my storage type in which old data will remain on … --- ## [TCP connection limit of Elasticsearch](https://discuss.elastic.co/t/tcp-connection-limit-of-elasticsearch/271454)
**Author:** [@iammanmale](https://discuss.elastic.co/u/iammanmale)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 3:28am UTC](https://discuss.elastic.co/t/tcp-connection-limit-of-elasticsearch/271454 "2021-04-28T03:28:26Z")
We harvest logs on aws machines by filebeat. Filebeat on each machine push those log to local logstash nodes and then logstash nodes push the data to local Elasticsearch nodes. It seems to me that both logstash node and… --- ## [Convert File, Group, Record and Unit Separator](https://discuss.elastic.co/t/convert-file-group-record-and-unit-separator/271452)
**Author:** [@bibhuWork](https://discuss.elastic.co/u/bibhuWork)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 3:01am UTC](https://discuss.elastic.co/t/convert-file-group-record-and-unit-separator/271452 "2021-04-28T03:01:20Z")
Hi Friends I am trying to convert my message containing ^\\ , ^\] , ^^ and ^\_ into comma using mutate-\>gsub but its not working I am trying out \\u005E, \\u001E , \\u001F etc but no luck. Can you please help me out here. S… --- ## [Switch dashboard between last value (single value) and time range (aggregrated values)?](https://discuss.elastic.co/t/switch-dashboard-between-last-value-single-value-and-time-range-aggregrated-values/271314)
**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\ **Replies:** 2\ **Last updated:** [April 28, 2021, 1:45am UTC](https://discuss.elastic.co/t/switch-dashboard-between-last-value-single-value-and-time-range-aggregrated-values/271314 "2021-04-28T01:45:29Z")
I'm creating visualizations in Kibana based on existing visualizations in a proprietary app. (I won't mention that app by name.) That app offers the user several choices for the time span of a viz—at display time, witho… --- ## [Missing Authentication Credentials for REST Request](https://discuss.elastic.co/t/missing-authentication-credentials-for-rest-request/271158)
**Author:** [@hussshe](https://discuss.elastic.co/u/hussshe)\ **Replies:** 1\ **Last updated:** [April 28, 2021, 1:40am UTC](https://discuss.elastic.co/t/missing-authentication-credentials-for-rest-request/271158 "2021-04-28T01:40:25Z")
Hello Elastic Users, I am trying to check if my Elasticsearch is working fine or not by running the following command in WindowsPowershell. Invoke-RestMethod http://localhost:9200 But it threw an 401-Authentication er… --- ## [X-pack monitoring failed to display CPU utilization](https://discuss.elastic.co/t/x-pack-monitoring-failed-to-display-cpu-utilization/271236)
**Author:** [@ktpktr0](https://discuss.elastic.co/u/ktpktr0)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 1:37am UTC](https://discuss.elastic.co/t/x-pack-monitoring-failed-to-display-cpu-utilization/271236 "2021-04-28T01:37:28Z")
I turned on stack monitoring for x-pack. However, the CPU utilization of ES can not be obtained. I installed elk7.8.1 in RPM mode In the overview interface, CPU utilization is shown as follows： In the overview inte… --- ## [Master not discovered or elected yet, an election requires 2 nodes with ids](https://discuss.elastic.co/t/master-not-discovered-or-elected-yet-an-election-requires-2-nodes-with-ids/271435)
**Author:** [@spartin07](https://discuss.elastic.co/u/spartin07)\ **Replies:** 1\ **Last updated:** [April 28, 2021, 1:22am UTC](https://discuss.elastic.co/t/master-not-discovered-or-elected-yet-an-election-requires-2-nodes-with-ids/271435 "2021-04-28T01:22:48Z")
I am trying to enable SSL/TLS for my elasticsearch cluster using docker and docker-compose. My setup is 3 seperate machines all with a single elasticsearch node running on them. For the certificates I created them on a s… --- ## [Elastic Search 7.12 Java CPU useage](https://discuss.elastic.co/t/elastic-search-7-12-java-cpu-useage/270996)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 4\ **Last updated:** [April 28, 2021, 12:29am UTC](https://discuss.elastic.co/t/elastic-search-7-12-java-cpu-useage/270996 "2021-04-28T00:29:16Z")
1 x3 node cluster 2 stand alone nodes all showing the same signs. Elastic+ Java process is running at 100% CPU. CentOS 8. Anyone else running into the issue. The same machines have been fine with the CPU and memory sin… --- ## [Questions on creating user and password?](https://discuss.elastic.co/t/questions-on-creating-user-and-password/269277)
**Author:** [@killmasta93](https://discuss.elastic.co/u/killmasta93)\ **Replies:** 8\ **Last updated:** [April 27, 2021, 11:47pm UTC](https://discuss.elastic.co/t/questions-on-creating-user-and-password/269277 "2021-04-27T23:47:56Z")
HI, I was wondering if someone could shed some light, Currently trying to configure x-pack to create username and password for the elastic stack, but i see that there is a few documentation but not sure which i should u… --- ## [Documentation or help to autodiscover kubernetes](https://discuss.elastic.co/t/documentation-or-help-to-autodiscover-kubernetes/271443)
**Author:** [@flaco0](https://discuss.elastic.co/u/flaco0)\ **Replies:** 0\ **Last updated:** [April 27, 2021, 9:33pm UTC](https://discuss.elastic.co/t/documentation-or-help-to-autodiscover-kubernetes/271443 "2021-04-27T21:33:43Z")
Hi team, I want config some filebeats to kubernetes. I have problems to understand somethings about like setting my need it. I think that need more documentation, have some guide or similar out of elasticsearch web ref… --- ## [Minimum nodes for elasticsearch 7.11.2 cluster?](https://discuss.elastic.co/t/minimum-nodes-for-elasticsearch-7-11-2-cluster/271023)
**Author:** [@webfr](https://discuss.elastic.co/u/webfr)\ **Replies:** 15\ **Last updated:** [April 27, 2021, 9:31pm UTC](https://discuss.elastic.co/t/minimum-nodes-for-elasticsearch-7-11-2-cluster/271023 "2021-04-27T21:31:33Z")
Hello, I'm using standalone ES node at the moment. I would like to add another node in another datacenter to increase data resilience and use cluster functions. Is it possible with just another node? Any documentation … --- ## [In house testing for cloud vs self hosted before self hosted release](https://discuss.elastic.co/t/in-house-testing-for-cloud-vs-self-hosted-before-self-hosted-release/271429)
**Author:** [@cealliance](https://discuss.elastic.co/u/cealliance)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 8:15pm UTC](https://discuss.elastic.co/t/in-house-testing-for-cloud-vs-self-hosted-before-self-hosted-release/271429 "2021-04-27T20:15:48Z")
I am looking to test integration with keycloak, and other features that require a higher tier license. Cloud licenses are cheaper. Can I get away with testing/developing on a cloud server and applying my findings to th… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1440) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1442)