# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1451 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1452 --- ## [Logstash KUSTOS output plugin](https://discuss.elastic.co/t/logstash-kustos-output-plugin/270922)
**Author:** [@shadu88](https://discuss.elastic.co/u/shadu88)\ **Replies:** 0\ **Last updated:** [April 22, 2021, 6:15am UTC](https://discuss.elastic.co/t/logstash-kustos-output-plugin/270922 "2021-04-22T06:15:20Z")
Dear ELKan's Have ever tried kustos output plugin to ingest the data from Logstash to Azure Data explorer. I'm currently following Azure documentation for the same. If you can help me with additional information/refere… --- ## [How can I index the data in an array?](https://discuss.elastic.co/t/how-can-i-index-the-data-in-an-array/270664)
**Author:** [@xo1534](https://discuss.elastic.co/u/xo1534)\ **Replies:** 2\ **Last updated:** [April 20, 2021, 7:27am UTC](https://discuss.elastic.co/t/how-can-i-index-the-data-in-an-array/270664 "2021-04-20T07:27:44Z")
biz\_tag data is A,B,C,D,E i want result data.... biz\_tag: \[ A, B, C, D, E \] but... Actual Results biz\_tag: A What's the problem??? Thank you... --- ## [Is this the exact information for \_nodes/stats response](https://discuss.elastic.co/t/is-this-the-exact-information-for-nodes-stats-response/270037)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 5\ **Last updated:** [April 22, 2021, 5:46am UTC](https://discuss.elastic.co/t/is-this-the-exact-information-for-nodes-stats-response/270037 "2021-04-22T05:46:39Z")
I had deployed eck-1.3.0 and elasticsearch 7.9.0 in GKE with 2 data-ingest and 3 master pods. Below is the one when I do get pods: kubectl -n \ get po NAME READY STATU… --- ## [Kibana Data Table Pagination](https://discuss.elastic.co/t/kibana-data-table-pagination/270819)
**Author:** [@Noobmaster](https://discuss.elastic.co/u/Noobmaster)\ **Replies:** 6\ **Last updated:** [April 22, 2021, 4:50am UTC](https://discuss.elastic.co/t/kibana-data-table-pagination/270819 "2021-04-22T04:50:23Z")
Hi there, I am new to elk and kibana. I have created this data table using 'kibana sample ecommerce data' by going through these steps 1. Dashboards-\> 2.Create Panel-\>3.Aggregation based-\>4. Data Tables. And I dragged … --- ## [Filebeat 6.8.x rotated filehandles filehandles held onto forever](https://discuss.elastic.co/t/filebeat-6-8-x-rotated-filehandles-filehandles-held-onto-forever/270917)
**Author:** [@filipeGuerreiro](https://discuss.elastic.co/u/filipeGuerreiro)\ **Replies:** 0\ **Last updated:** [April 22, 2021, 3:28am UTC](https://discuss.elastic.co/t/filebeat-6-8-x-rotated-filehandles-filehandles-held-onto-forever/270917 "2021-04-22T03:28:49Z")
Tested on 6.8.4 and 6.8.15. This issue seems to crop up in applications with a high rate of logs. Takes a day or two to get to that point, noticed the file handles count increasing steadily throughout. \[root@ldap-mast… --- ## [Can a Custom Realm be installed in Elastic Cloud?](https://discuss.elastic.co/t/can-a-custom-realm-be-installed-in-elastic-cloud/270893)
**Author:** [@pablomartinez](https://discuss.elastic.co/u/pablomartinez)\ **Replies:** 2\ **Last updated:** [April 22, 2021, 2:22am UTC](https://discuss.elastic.co/t/can-a-custom-realm-be-installed-in-elastic-cloud/270893 "2021-04-22T02:22:59Z")
Just as the title says: Can a Custom Realm be installed in Elastic Cloud? --- ## [Syslog from Aruba Switches](https://discuss.elastic.co/t/syslog-from-aruba-switches/270543)
**Author:** [@Peque](https://discuss.elastic.co/u/Peque)\ **Replies:** 2\ **Last updated:** [April 22, 2021, 1:36am UTC](https://discuss.elastic.co/t/syslog-from-aruba-switches/270543 "2021-04-22T01:36:30Z")
Hi Forum I've build my first ELK server - and have some incomming data - But I cannot make my Aruba 2530 Switches send the logfiles to elastic - and missing something somewhere. On My Aruba switches - I set the followi… --- ## [Event.created is always 8 hours later then @timestamp](https://discuss.elastic.co/t/event-created-is-always-8-hours-later-then-timestamp/270211)
**Author:** [@new2\_elk](https://discuss.elastic.co/u/new2_elk)\ **Replies:** 3\ **Last updated:** [April 22, 2021, 1:21am UTC](https://discuss.elastic.co/t/event-created-is-always-8-hours-later-then-timestamp/270211 "2021-04-22T01:21:09Z")
Hi everyone, I am facing a issue that the event.created is always 8 hours later than the @timestamp and the timestamp is the current time which is correct. Below is the example. Time event.created event.timezone … --- ## [Filebeat push same event in multiple indices](https://discuss.elastic.co/t/filebeat-push-same-event-in-multiple-indices/270828)
**Author:** [@screwyy](https://discuss.elastic.co/u/screwyy)\ **Replies:** 1\ **Last updated:** [April 22, 2021, 1:06am UTC](https://discuss.elastic.co/t/filebeat-push-same-event-in-multiple-indices/270828 "2021-04-22T01:06:55Z")
Hello, is it possible to send the same event into multiple indices in the same elasticsearch cluster? Example filebeat.yml: filebeat.config.inputs: enabled: true path: ${path.config}/inputs/\*.yml reload: en… --- ## [Error initializing processors: each processor must have exactly one action, but found 2 actions](https://discuss.elastic.co/t/error-initializing-processors-each-processor-must-have-exactly-one-action-but-found-2-actions/270901)
**Author:** [@manojkrishna561994](https://discuss.elastic.co/u/manojkrishna561994)\ **Replies:** 1\ **Last updated:** [April 22, 2021, 12:54am UTC](https://discuss.elastic.co/t/error-initializing-processors-each-processor-must-have-exactly-one-action-but-found-2-actions/270901 "2021-04-22T00:54:27Z")
I'm installing ELK on my Ubuntu machine. When i'm installing Filebeats it is throwing me this error. When i run this command sudo filebeat modules list im getting this error. root@lucy0094:~# sudo filebeat modules list… --- ## [Cannot start ElasticSearch service](https://discuss.elastic.co/t/cannot-start-elasticsearch-service/270873)
**Author:** [@Egdar\_Navvasardyan](https://discuss.elastic.co/u/Egdar_Navvasardyan)\ **Replies:** 1\ **Last updated:** [April 21, 2021, 11:17pm UTC](https://discuss.elastic.co/t/cannot-start-elasticsearch-service/270873 "2021-04-21T23:17:20Z")
I am trying to run Elasticsearch doing the following: sudo su systemctl start elasticsearch My .yml file looks like this: cluster.name: petlon-app node.name: my-app-node path.data: /var/lib/elasticsearch path.logs: /… --- ## [Elasticsearch hadoop config](https://discuss.elastic.co/t/elasticsearch-hadoop-config/270889)
**Author:** [@D\_Jerry](https://discuss.elastic.co/u/D_Jerry)\ **Replies:** 0\ **Last updated:** [April 21, 2021, 5:48pm UTC](https://discuss.elastic.co/t/elasticsearch-hadoop-config/270889 "2021-04-21T17:48:14Z")
I have docker desktop and I'm trying to do a poc connectivity between ES and Hive. I have ES container running and hive container. I'm adding the jar file to hive before creating the external table. However, it fails… --- ## [How to use multiple filter files in logstash-filter-verifier command](https://discuss.elastic.co/t/how-to-use-multiple-filter-files-in-logstash-filter-verifier-command/270908)
**Author:** [@Usman18](https://discuss.elastic.co/u/Usman18)\ **Replies:** 0\ **Last updated:** [April 21, 2021, 10:33pm UTC](https://discuss.elastic.co/t/how-to-use-multiple-filter-files-in-logstash-filter-verifier-command/270908 "2021-04-21T22:33:09Z")
I am using logstash-filter-verifier to execute my test cases for testing various logstash pipelines. From the git documentation I can see the command that will be used to run those test cases $ path/to/logstash-filter-v… --- ## [Replicating Logstash Fingerprint in elasticsearch\_dsl\_py](https://discuss.elastic.co/t/replicating-logstash-fingerprint-in-elasticsearch-dsl-py/270905)
**Author:** [@Mark\_Parrish](https://discuss.elastic.co/u/Mark_Parrish)\ **Replies:** 5\ **Last updated:** [April 21, 2021, 10:46pm UTC](https://discuss.elastic.co/t/replicating-logstash-fingerprint-in-elasticsearch-dsl-py/270905 "2021-04-21T22:46:25Z")
I am trying replicate this piece of code in the python. ruby { code =\> ' physical = \[ event.get("address1").to\_s, event.get("address2").to\_s, event.get("city").to\_s, event.get… --- ## [F5 load balancer attributes/configuration with Elasticsearch cluster](https://discuss.elastic.co/t/f5-load-balancer-attributes-configuration-with-elasticsearch-cluster/270904)
**Author:** [@fletches](https://discuss.elastic.co/u/fletches)\ **Replies:** 1\ **Last updated:** [April 21, 2021, 10:30pm UTC](https://discuss.elastic.co/t/f5-load-balancer-attributes-configuration-with-elasticsearch-cluster/270904 "2021-04-21T22:30:49Z")
We will be configuring an F5 load balancer for our Elasticsearch cluster. This question is not about the use of a load balancer vs coordinator role. That discussion is elsewhere in many places. The decision has been made… --- ## [Too many requests disk usage exceeded flood stage water mark](https://discuss.elastic.co/t/too-many-requests-disk-usage-exceeded-flood-stage-water-mark/270676)
**Author:** [@divakar\_maradana](https://discuss.elastic.co/u/divakar_maradana)\ **Replies:** 3\ **Last updated:** [April 21, 2021, 10:30pm UTC](https://discuss.elastic.co/t/too-many-requests-disk-usage-exceeded-flood-stage-water-mark/270676 "2021-04-21T22:30:13Z")
HI Team, We are using highend i3.2xlarge instance for elasticsearch(trail version) and m5d.large instance for kibana(trail version) , we can able to see logs on kibana from beats. But here is the -- issue index \[.asyn… --- ## [Elasticsearch bulk Ingestion](https://discuss.elastic.co/t/elasticsearch-bulk-ingestion/270754)
**Author:** [@Rokshan\_Jahan](https://discuss.elastic.co/u/Rokshan_Jahan)\ **Replies:** 3\ **Last updated:** [April 21, 2021, 10:29pm UTC](https://discuss.elastic.co/t/elasticsearch-bulk-ingestion/270754 "2021-04-21T22:29:52Z")
Hi, I have 7 TB ( 32 billion records) to ingest in elastic search. What would be the best elastic search configuration we can use to load these data quickly. --- ## [How are "applications" supposed to be used in context of the create/update application privileges api?](https://discuss.elastic.co/t/how-are-applications-supposed-to-be-used-in-context-of-the-create-update-application-privileges-api/269594)
**Author:** [@fletches](https://discuss.elastic.co/u/fletches)\ **Replies:** 5\ **Last updated:** [April 21, 2021, 9:01pm UTC](https://discuss.elastic.co/t/how-are-applications-supposed-to-be-used-in-context-of-the-create-update-application-privileges-api/269594 "2021-04-21T21:01:22Z")
I'm new to Elasticsearch. We have the need for multiple applications to share the same cluster and restrict indices privileges to those owned by that team. I see the application api to create/update application privileg… --- ## [Remote cluster monitoring creating alerts with percentage values](https://discuss.elastic.co/t/remote-cluster-monitoring-creating-alerts-with-percentage-values/269477)
**Author:** [@jugonzalezv](https://discuss.elastic.co/u/jugonzalezv)\ **Replies:** 13\ **Last updated:** [April 21, 2021, 8:46pm UTC](https://discuss.elastic.co/t/remote-cluster-monitoring-creating-alerts-with-percentage-values/269477 "2021-04-21T20:46:57Z")
Good day everyone, lately I've been trying to create alarms on remotely connected clusters using the following command on the clusters i connect: the connection part has been succesful so far, but I'm posting it to c… --- ## [Monitoring Elasticsearch with metricbeats 7.9.2](https://discuss.elastic.co/t/monitoring-elasticsearch-with-metricbeats-7-9-2/270903)
**Author:** [@frankfoti](https://discuss.elastic.co/u/frankfoti)\ **Replies:** 0\ **Last updated:** [April 21, 2021, 8:35pm UTC](https://discuss.elastic.co/t/monitoring-elasticsearch-with-metricbeats-7-9-2/270903 "2021-04-21T20:35:32Z")
I followed the steps to switch to metricbeat monitoring but still not working in kibana: Metricbeat quick start: installation and configuration | Metricbeat Reference \[7.9\] | Elastic metricbeat-\* index pattern exists … --- ## [Reproduce 206 Partial result](https://discuss.elastic.co/t/reproduce-206-partial-result/270875)
**Author:** [@theredcat](https://discuss.elastic.co/u/theredcat)\ **Replies:** 3\ **Last updated:** [April 21, 2021, 7:08pm UTC](https://discuss.elastic.co/t/reproduce-206-partial-result/270875 "2021-04-21T19:08:08Z")
Hi, I had a problem in production that seems related to a 206 partial response being returned when I restarted one of my node for maintenance. I'm trying to reproduce this but I had no luck for now. Is there any proced… --- ## [Metricsets CPU what metric to use](https://discuss.elastic.co/t/metricsets-cpu-what-metric-to-use/270879)
**Author:** [@maheshe](https://discuss.elastic.co/u/maheshe)\ **Replies:** 1\ **Last updated:** [April 21, 2021, 5:44pm UTC](https://discuss.elastic.co/t/metricsets-cpu-what-metric-to-use/270879 "2021-04-21T17:44:49Z")
On 7.9 Metricbeat-Metricset-CPU metrics I see these two entries. which one should I use for total CPU percentage system.cpu.total.norm.pct 0.026 system.cpu.total.pct 0.211 In the documentation I don't see cpu.total m… --- ## [Date field mapping error with type \[date\] to \[long\]](https://discuss.elastic.co/t/date-field-mapping-error-with-type-date-to-long/270766)
**Author:** [@Lorenzo\_Zuluaga](https://discuss.elastic.co/u/Lorenzo_Zuluaga)\ **Replies:** 12\ **Last updated:** [April 21, 2021, 1:45am UTC](https://discuss.elastic.co/t/date-field-mapping-error-with-type-date-to-long/270766 "2021-04-21T01:45:10Z")
Hi, I'm currently having a strange issue and I can't find anything related to it. I have an elasticsearch cluster for my production environment with 3 nodes. Recently I created a single-node cluster for my staging enviro… --- ## [Kibana visualization built with context of other logs](https://discuss.elastic.co/t/kibana-visualization-built-with-context-of-other-logs/268696)
**Author:** [@mbrad](https://discuss.elastic.co/u/mbrad)\ **Replies:** 3\ **Last updated:** [April 21, 2021, 4:49pm UTC](https://discuss.elastic.co/t/kibana-visualization-built-with-context-of-other-logs/268696 "2021-04-21T16:49:56Z")
Hello - My team is using ElasticSearch/Kibana for security metric related things and we are having trouble with a specific use case: When a finding is open, a document is created with alerts.status:open associated to t… --- ## [Best approach to create visualizations/dashboard via API calls?](https://discuss.elastic.co/t/best-approach-to-create-visualizations-dashboard-via-api-calls/270603)
**Author:** [@rmartinez.rv](https://discuss.elastic.co/u/rmartinez.rv)\ **Replies:** 5\ **Last updated:** [April 21, 2021, 4:44pm UTC](https://discuss.elastic.co/t/best-approach-to-create-visualizations-dashboard-via-api-calls/270603 "2021-04-21T16:44:43Z")
Hi. I'm trying to create a visualization in Kibana via API calls. So far i'm a little bit confused on how to do this. Please try to follow me.. and correct me if i'm wrong... So far i discovered two types of API call… --- ## [Group Element through query to use in Vega visualisation](https://discuss.elastic.co/t/group-element-through-query-to-use-in-vega-visualisation/270389)
**Author:** [@Dzious](https://discuss.elastic.co/u/Dzious)\ **Replies:** 15\ **Last updated:** [April 21, 2021, 4:12pm UTC](https://discuss.elastic.co/t/group-element-through-query-to-use-in-vega-visualisation/270389 "2021-04-21T16:12:41Z")
Hi, I'm currently learning about query and stuffs. In order to do so I aim to have a vega visualisation that would allow me to visualise a per process memory usage. So far, i managed to do it using both Lens and TSVB.… --- ## [Canvas from minutes to hours](https://discuss.elastic.co/t/canvas-from-minutes-to-hours/270686)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 6\ **Last updated:** [April 21, 2021, 3:16pm UTC](https://discuss.elastic.co/t/canvas-from-minutes-to-hours/270686 "2021-04-21T15:16:25Z")
Hi, in Canvas I have a SQL query that returns me a time value in minutes. How do I turn it into "hours, days, months, etc"? filters | essql query="SELECT uptime FROM \\"device\_data\_bridgenuzoo\\" ORDER BY date DESC L… --- ## [Filebeat with Suricata module](https://discuss.elastic.co/t/filebeat-with-suricata-module/270863)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 0\ **Last updated:** [April 21, 2021, 3:13pm UTC](https://discuss.elastic.co/t/filebeat-with-suricata-module/270863 "2021-04-21T15:13:46Z")
Hi there! Here is my question. I have Filebeat sending Suricata logs directly to Elasticsearch (via Suricata module). My Suricata log files are divided by types of events (eve-alerts, eve-dns, eve-events). In Kibana is… --- ## [Seeking advice on parsing Nagios logs using pre-built pattern files from herokuapp.com](https://discuss.elastic.co/t/seeking-advice-on-parsing-nagios-logs-using-pre-built-pattern-files-from-herokuapp-com/270850)
**Author:** [@kgeil](https://discuss.elastic.co/u/kgeil)\ **Replies:** 2\ **Last updated:** [April 21, 2021, 2:48pm UTC](https://discuss.elastic.co/t/seeking-advice-on-parsing-nagios-logs-using-pre-built-pattern-files-from-herokuapp-com/270850 "2021-04-21T14:48:09Z")
Good morning everyone. I'm early in the Elastic Stack learning curve, and I'm working on parsing some nagios logs this morning. I Have nagios logging to syslog, and can use the pattern file located on the herokuapp gro… --- ## [Kibana Discover not working as expected](https://discuss.elastic.co/t/kibana-discover-not-working-as-expected/262101)
**Author:** [@rubans](https://discuss.elastic.co/u/rubans)\ **Replies:** 5\ **Last updated:** [April 21, 2021, 2:44pm UTC](https://discuss.elastic.co/t/kibana-discover-not-working-as-expected/262101 "2021-04-21T14:44:33Z")
I have setup a Kibana and ElasticSearch on my own GKE cluster. Following the guide -\> https://www.digitalocean.com/community/tutorials/how-to-set-up-an-elasticsearch-fluentd-and-kibana-efk-logging-stack-on-kubernetes H… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1450) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1452)