# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1460 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1461 --- ## [Weird test configuration problem || log\_file --\> Syslog-ng --\> Logstash --\> another\_file](https://discuss.elastic.co/t/weird-test-configuration-problem-log-file-syslog-ng-logstash-another-file/270253)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 6:58pm UTC](https://discuss.elastic.co/t/weird-test-configuration-problem-log-file-syslog-ng-logstash-another-file/270253 "2021-04-15T18:58:42Z")
Hi All, please ignore the stupid use case as I only use this config for testing purposes. I have an Ubuntu server with installed syslog-ng and Logstash. I'd like to do the following: I have a cronjob that on every min… --- ## [Kibana:getting past login page with selenium](https://discuss.elastic.co/t/kibana-getting-past-login-page-with-selenium/269782)
**Author:** [@jmlucjav](https://discuss.elastic.co/u/jmlucjav)\ **Replies:** 14\ **Last updated:** [April 15, 2021, 6:20pm UTC](https://discuss.elastic.co/t/kibana-getting-past-login-page-with-selenium/269782 "2021-04-15T18:20:51Z")
I am trying to get some to some pages in kibana through selenium/crome dirver. I have seen some samples from some time ago where providing the user/pwd in the url worked, but now, if I do this, still gets me to the page … --- ## [Gauges don't display a number for last 5 min, but do display for last 1hr, even though there is data](https://discuss.elastic.co/t/gauges-dont-display-a-number-for-last-5-min-but-do-display-for-last-1hr-even-though-there-is-data/270282)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 3\ **Last updated:** [April 15, 2021, 5:18pm UTC](https://discuss.elastic.co/t/gauges-dont-display-a-number-for-last-5-min-but-do-display-for-last-1hr-even-though-there-is-data/270282 "2021-04-15T17:18:42Z")
Here's an issue that I'm having a hard time figuring out how to search on. So far I haven't found anyone else describing something similar. Any tips would be appreciated. So, I've configured a gauge based on the memory … --- ## [Logstash - elasticsarch and double quotes](https://discuss.elastic.co/t/logstash-elasticsarch-and-double-quotes/270133)
**Author:** [@cibernicola](https://discuss.elastic.co/u/cibernicola)\ **Replies:** 11\ **Last updated:** [April 15, 2021, 4:49pm UTC](https://discuss.elastic.co/t/logstash-elasticsarch-and-double-quotes/270133 "2021-04-15T16:49:21Z")
Hello I'm trying to ingest logs wich have " in some of their fields as part of a string, I'm trying to scape them with \\ or \\ or \\\\ but no luck, so, is there any way to ingest double quotes from logs into elasticsearch … --- ## [Java::JavaLang::IllegalStateException\` for \`PipelineAction::Create\](https://discuss.elastic.co/t/java-illegalstateexception-for-pipelineaction-create-main/270034)
**Author:** [@prajawalkp](https://discuss.elastic.co/u/prajawalkp)\ **Replies:** 3\ **Last updated:** [April 13, 2021, 5:42pm UTC](https://discuss.elastic.co/t/java-illegalstateexception-for-pipelineaction-create-main/270034 "2021-04-13T17:42:40Z")
Hii, I am new to logstash and using logstash to syncup mysql with elasticsearch. But I can't get through this error. Please help. It is urgent. Using JAVA\_HOME defined java: /Library/Java/JavaVirtualMachines/jdk-15.… --- ## [Elastic search fill missing values in aggregation](https://discuss.elastic.co/t/elastic-search-fill-missing-values-in-aggregation/270281)
**Author:** [@Ivan\_Janev](https://discuss.elastic.co/u/Ivan_Janev)\ **Replies:** 0\ **Last updated:** [April 15, 2021, 4:29pm UTC](https://discuss.elastic.co/t/elastic-search-fill-missing-values-in-aggregation/270281 "2021-04-15T16:29:19Z")
I'm doing a sum aggregation in elasticsearch and in the query part I'm using a range filter. Is there anyway to fill missing data when the results come back? To make this more clear I'm going to share the code which is c… --- ## [Filebeat Zeek module doesn’t add ECS fields to zeek logs](https://discuss.elastic.co/t/filebeat-zeek-module-doesn-t-add-ecs-fields-to-zeek-logs/270047)
**Author:** [@Automation\_Scripts](https://discuss.elastic.co/u/Automation_Scripts)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 4:36pm UTC](https://discuss.elastic.co/t/filebeat-zeek-module-doesn-t-add-ecs-fields-to-zeek-logs/270047 "2021-04-15T16:36:27Z")
Hi all, I followed the official documentation and I’ve changed zeek’s output to json logs but somehow zeek module from Filebeat does’t enrich data with ECS fields. Filebeat sends the logs, but without adding the extra f… --- ## [Problem with parent-child join](https://discuss.elastic.co/t/problem-with-parent-child-join/270278)
**Author:** [@MarlMan](https://discuss.elastic.co/u/MarlMan)\ **Replies:** 0\ **Last updated:** [April 15, 2021, 3:46pm UTC](https://discuss.elastic.co/t/problem-with-parent-child-join/270278 "2021-04-15T15:46:30Z")
Hey guys. I have a big data set with many parents and children. My goal is to find out, how many Jo-children each parent has. So I only want to know about children which have Jo as a part of their name (Joel, John, John… --- ## [Elasticsearch doesn't cache query with rounded date](https://discuss.elastic.co/t/elasticsearch-doesnt-cache-query-with-rounded-date/269706)
**Author:** [@tlinhart](https://discuss.elastic.co/u/tlinhart)\ **Replies:** 25\ **Last updated:** [April 15, 2021, 3:39pm UTC](https://discuss.elastic.co/t/elasticsearch-doesnt-cache-query-with-rounded-date/269706 "2021-04-15T15:39:48Z")
I originally posted the question to Stack Overflow but I guess it's more appropriate to ask here. (For reference, the original question is here - caching - Elasticsearch doesn't cache query with rounded date - Stack Over… --- ## [Get per process Metrics](https://discuss.elastic.co/t/get-per-process-metrics/270242)
**Author:** [@Dzious](https://discuss.elastic.co/u/Dzious)\ **Replies:** 12\ **Last updated:** [April 15, 2021, 3:33pm UTC](https://discuss.elastic.co/t/get-per-process-metrics/270242 "2021-04-15T15:33:29Z")
Hi, I'm a new user to Elastic and in order to better understand how elastic works, i would like to create a visualisation or canvas that would allow me to compare per process memory usage on my server. More used to SQL… --- ## [JDBC input parameters add quotes to query](https://discuss.elastic.co/t/jdbc-input-parameters-add-quotes-to-query/270271)
**Author:** [@mlnusd](https://discuss.elastic.co/u/mlnusd)\ **Replies:** 0\ **Last updated:** [April 15, 2021, 3:32pm UTC](https://discuss.elastic.co/t/jdbc-input-parameters-add-quotes-to-query/270271 "2021-04-15T15:32:48Z")
I'm trying to use jdbc input filter to query Oracle DB and to template a schema name. My statement looks like this: select count(1) from :schema.my\_table And my logstash config is like this: input { \[...connection … --- ## [Flattened alternative for OSS verrsion](https://discuss.elastic.co/t/flattened-alternative-for-oss-verrsion/270029)
**Author:** [@oskrdt](https://discuss.elastic.co/u/oskrdt)\ **Replies:** 4\ **Last updated:** [April 15, 2021, 3:23pm UTC](https://discuss.elastic.co/t/flattened-alternative-for-oss-verrsion/270029 "2021-04-15T15:23:18Z")
Is there an alternative/workaround for the flattened mapping type to prevent mapping explosion when using OSS elasticsearch version? --- ## [Broken grok after the update to Logstash 7.12](https://discuss.elastic.co/t/broken-grok-after-the-update-to-logstash-7-12/269863)
**Author:** [@aviadhaham](https://discuss.elastic.co/u/aviadhaham)\ **Replies:** 3\ **Last updated:** [April 15, 2021, 3:03pm UTC](https://discuss.elastic.co/t/broken-grok-after-the-update-to-logstash-7-12/269863 "2021-04-15T15:03:51Z")
Hello, In my company, after upgrading our cluster to the latest version 7.12, we noticed that one of our grok patterns stopped working. Important things to mention: The pipeline is functioning correctly, logs are com… --- ## [Multiple pipelines](https://discuss.elastic.co/t/multiple-pipelines/270238)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 3:02pm UTC](https://discuss.elastic.co/t/multiple-pipelines/270238 "2021-04-15T15:02:05Z")
can somebody helps me 4.29} \[INFO \] 2021-04-15 07:55:35.481 \[\[beats-server\]-pipeline-manager\] beats - Starting input listener {:address=\>"0.0.0.0:5044"} \[INFO \] 2021-04-15 07:55:35.666 \[\[auth\]-pipeline-manager\] javapi… --- ## [Mapping a Data in a log to another Field](https://discuss.elastic.co/t/mapping-a-data-in-a-log-to-another-field/270250)
**Author:** [@Wilks](https://discuss.elastic.co/u/Wilks)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 2:54pm UTC](https://discuss.elastic.co/t/mapping-a-data-in-a-log-to-another-field/270250 "2021-04-15T14:54:10Z")
Hey Everyone, How do you map a field from the logs to another field. So for example if I have the following log message":"03-MAR-21 00:30:46|142.122.217.10 |1| I want to parse out |1| but also then map it to an index … --- ## [Elasticsearch can't login https://localhost:9200 after setting ssl](https://discuss.elastic.co/t/elasticsearch-cant-login-https-localhost-9200-after-setting-ssl/270169)
**Author:** [@gricn](https://discuss.elastic.co/u/gricn)\ **Replies:** 10\ **Last updated:** [April 15, 2021, 2:50pm UTC](https://discuss.elastic.co/t/elasticsearch-cant-login-https-localhost-9200-after-setting-ssl/270169 "2021-04-15T14:50:25Z")
Environment: Win10 WLS2 Ubuntu 20.04, Docker version 20.10.5, Docker-compose version 1.29.0, ELK 7.12.0, nginx version 1.18.0 I have enabled xpack in the last version docker-compose.yml setting and use ./bin/elasticsear… --- ## [TSVB Table Sorted by timestamp](https://discuss.elastic.co/t/tsvb-table-sorted-by-timestamp/267271)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 6\ **Last updated:** [April 15, 2021, 2:27pm UTC](https://discuss.elastic.co/t/tsvb-table-sorted-by-timestamp/267271 "2021-04-15T14:27:20Z")
Hello, I have a nice TSVB graph and I'm trying to get a table out of it sorted by timestamp. Should be simple, but it doesn't show any value: I want a time-based table like the other Table graph, but needs to be TSVB… --- ## [ERROR instance/beat.go:971 Exiting: resource 'filebeat-7.12.0' exists, but it is not an alias](https://discuss.elastic.co/t/error-instance-beat-go-971-exiting-resource-filebeat-7-12-0-exists-but-it-is-not-an-alias/270139)
**Author:** [@thrak](https://discuss.elastic.co/u/thrak)\ **Replies:** 4\ **Last updated:** [April 15, 2021, 2:17pm UTC](https://discuss.elastic.co/t/error-instance-beat-go-971-exiting-resource-filebeat-7-12-0-exists-but-it-is-not-an-alias/270139 "2021-04-15T14:17:05Z")
Hello, I am in the process of installing filebeats 7.12 on some elastic cluster nodes in my dev environment and when I run: sudo filebeat setup -e On one of my nodes, I receive this error. ERROR instance/beat.go:971… --- ## [Filebeat systemd not writing logs to log directory](https://discuss.elastic.co/t/filebeat-systemd-not-writing-logs-to-log-directory/270247)
**Author:** [@madhan\_dhanikachalam](https://discuss.elastic.co/u/madhan_dhanikachalam)\ **Replies:** 0\ **Last updated:** [April 15, 2021, 2:04pm UTC](https://discuss.elastic.co/t/filebeat-systemd-not-writing-logs-to-log-directory/270247 "2021-04-15T14:04:48Z")
I have filebeat 7.12 and have the below systemd service \[Unit\] Description=Filebeat sends log files to Logstash or directly to Elasticsearch. Documentation=https://www.elastic.co/products/beats/filebeat Wants=network-on… --- ## [Filebeat to kafka failure](https://discuss.elastic.co/t/filebeat-to-kafka-failure/270163)
**Author:** [@madhan\_dhanikachalam](https://discuss.elastic.co/u/madhan_dhanikachalam)\ **Replies:** 4\ **Last updated:** [April 15, 2021, 1:57pm UTC](https://discuss.elastic.co/t/filebeat-to-kafka-failure/270163 "2021-04-15T13:57:56Z")
filebeat on server 1 seems to send log data to kafka perfectly, no issues.. set up filebeat on server2 to send log data to kafka and get the below error 2021-04-14T20:46:28.475-0400 INFO \[publisher\] pipeline/… --- ## [When to separate data nodes and master node roles](https://discuss.elastic.co/t/when-to-separate-data-nodes-and-master-node-roles/270127)
**Author:** [@bharat1](https://discuss.elastic.co/u/bharat1)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 1:49pm UTC](https://discuss.elastic.co/t/when-to-separate-data-nodes-and-master-node-roles/270127 "2021-04-15T13:49:39Z")
Hi All, Is there any criteria that should be followed to decide on separating Master nodes and Data nodes? --- ## [GCP Discovert Plugi installation](https://discuss.elastic.co/t/gcp-discovert-plugi-installation/270220)
**Author:** [@marcin.wizgird](https://discuss.elastic.co/u/marcin.wizgird)\ **Replies:** 5\ **Last updated:** [April 15, 2021, 1:45pm UTC](https://discuss.elastic.co/t/gcp-discovert-plugi-installation/270220 "2021-04-15T13:45:47Z")
Hi, I encountered challenge with GCP Discovery Plugin installation. ElasticSearch version which is installed is 6.8.4. whereas plugin accessible on the website is for version 6.8.15. During the installation I encounter … --- ## [Dynamic fetch data from index to generate TreeFlow](https://discuss.elastic.co/t/dynamic-fetch-data-from-index-to-generate-treeflow/268993)
**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\ **Replies:** 30\ **Last updated:** [April 15, 2021, 1:28pm UTC](https://discuss.elastic.co/t/dynamic-fetch-data-from-index-to-generate-treeflow/268993 "2021-04-15T13:28:00Z")
Kibana version : 7.9 Elasticsearch version : 7.9 APM Server version : 7.9 APM Agent language and version : java 1.8 Fresh install or upgraded from other version? fresh install Is there anything special in your setup… --- ## [Does ElasticSearch itself have access logs?](https://discuss.elastic.co/t/does-elasticsearch-itself-have-access-logs/270236)
**Author:** [@asasas234](https://discuss.elastic.co/u/asasas234)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 1:25pm UTC](https://discuss.elastic.co/t/does-elasticsearch-itself-have-access-logs/270236 "2021-04-15T13:25:23Z")
Does ElasticSearch have a feature similar to Tomcat access logs? So that I can see the history of requests at a specific time --- ## [Creating Dashbard and visualisation with python](https://discuss.elastic.co/t/creating-dashbard-and-visualisation-with-python/270235)
**Author:** [@rockiram](https://discuss.elastic.co/u/rockiram)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 1:24pm UTC](https://discuss.elastic.co/t/creating-dashbard-and-visualisation-with-python/270235 "2021-04-15T13:24:02Z")
Hi, I am new to kibana. Is it possible to create kibana visualisation and dashboard using python? If so, Please suggest me some references to start Thanks in Advance!!! --- ## [How to run rally against an existing on-premise cluster](https://discuss.elastic.co/t/how-to-run-rally-against-an-existing-on-premise-cluster/270228)
**Author:** [@anoopkv](https://discuss.elastic.co/u/anoopkv)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 1:17pm UTC](https://discuss.elastic.co/t/how-to-run-rally-against-an-existing-on-premise-cluster/270228 "2021-04-15T13:17:11Z")
I am running my elasticsearch (version 7.11) cluster on an on-premise kubernetes cluster. security is enabled in the cluster. to run rally i have created a separate pod --chart.yaml-- apiVersion: v1 kind: Pod … --- ## [\[Elasticsearch cluster status red\] : path: /.apm-agent-configuration/\_search, params: {index=.apm-agent-configuration} org.elasticsearch.action.search.SearchPhaseExecutionException: all shards failed](https://discuss.elastic.co/t/elasticsearch-cluster-status-red-path-apm-agent-configuration-search-params-index-apm-agent-configuration-org-elasticsearch-action-search-searchphaseexecutionexception-all-shards-failed/270215)
**Author:** [@abi.mc](https://discuss.elastic.co/u/abi.mc)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 12:49pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-status-red-path-apm-agent-configuration-search-params-index-apm-agent-configuration-org-elasticsearch-action-search-searchphaseexecutionexception-all-shards-failed/270215 "2021-04-15T12:49:34Z")
Our two node elasticsearch cluster status shows red. The cluster is configured with HTTP and TLS encryption. Please find below the error from elasticsearch logs. Could you please let us know how the cluster status can be… --- ## [Visualize / Search Date more than X days ago](https://discuss.elastic.co/t/visualize-search-date-more-than-x-days-ago/269905)
**Author:** [@csatola](https://discuss.elastic.co/u/csatola)\ **Replies:** 13\ **Last updated:** [April 15, 2021, 12:47pm UTC](https://discuss.elastic.co/t/visualize-search-date-more-than-x-days-ago/269905 "2021-04-15T12:47:49Z")
In my scenario, I'm logging server vulnerability data. @timestamp is when the document was added (and that's fine), but I also have a "PatchReleasedDate" field. What I would like to do is build visualizations for # of do… --- ## [Count map in kibana new version](https://discuss.elastic.co/t/count-map-in-kibana-new-version/270200)
**Author:** [@Priyanka\_chauhan](https://discuss.elastic.co/u/Priyanka_chauhan)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 12:10pm UTC](https://discuss.elastic.co/t/count-map-in-kibana-new-version/270200 "2021-04-15T12:10:13Z")
hi, I am unable to create count map in new version kibana because there is missing metric section in layer setting. I have attached image also. please anyone knows how to do it? --- ## [Extract value from Nested message field - LogStash Kibana Grok Mutate](https://discuss.elastic.co/t/extract-value-from-nested-message-field-logstash-kibana-grok-mutate/269368)
**Author:** [@Sandun\_Akalanka](https://discuss.elastic.co/u/Sandun_Akalanka)\ **Replies:** 4\ **Last updated:** [April 15, 2021, 11:39am UTC](https://discuss.elastic.co/t/extract-value-from-nested-message-field-logstash-kibana-grok-mutate/269368 "2021-04-15T11:39:58Z")
I've configured a FileBeat service to send logs to Kibana via LogStash. FileBeat and LogStash are in different servers while Kibana is inside an AWS ElasticSearch domain. The logs are visible in the Kibana dashboard. In … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1459) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1461)