# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1465 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1466 --- ## [Filebeat Ingests K8S Older Logs](https://discuss.elastic.co/t/filebeat-ingests-k8s-older-logs/269950)
**Author:** [@danielc](https://discuss.elastic.co/u/danielc)\ **Replies:** 1\ **Last updated:** [April 13, 2021, 8:15am UTC](https://discuss.elastic.co/t/filebeat-ingests-k8s-older-logs/269950 "2021-04-13T08:15:06Z")
I'm using beats/filebeat-kubernetes.yaml at v7.8.1 · elastic/beats · GitHub to ingest K8S. There have been 2 issues: Filebeat picks up older logs when there is an other application deployment and generates old indices … --- ## [Winlogbeat setup error: x509 certificate is valid for \, not \](https://discuss.elastic.co/t/winlogbeat-setup-error-x509-certificate-is-valid-for-ip-not-same-ip/269176)
**Author:** [@Michlol\_502](https://discuss.elastic.co/u/Michlol_502)\ **Replies:** 6\ **Last updated:** [April 13, 2021, 7:44am UTC](https://discuss.elastic.co/t/winlogbeat-setup-error-x509-certificate-is-valid-for-ip-not-same-ip/269176 "2021-04-13T07:44:43Z")
I'm trying to send logs from Winlogbeat to my ELK stack. I did everything according to the official guide and it worked for my host. However, when copying the same winlogbeat directory to my Event Collector server, it di… --- ## [Display image from rows on kibana](https://discuss.elastic.co/t/display-image-from-rows-on-kibana/269927)
**Author:** [@erwan22](https://discuss.elastic.co/u/erwan22)\ **Replies:** 2\ **Last updated:** [April 13, 2021, 7:32am UTC](https://discuss.elastic.co/t/display-image-from-rows-on-kibana/269927 "2021-04-13T07:32:17Z")
Hello, I have a DataFrame (100 rows) in which i have a column dedicated to base64 encoded image. I have uploaded this dataframe in elastic and i'm able to visualise all the images in the "Discover" section for each row… --- ## [Watcher alert syntax error](https://discuss.elastic.co/t/watcher-alert-syntax-error/269920)
**Author:** [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\ **Replies:** 2\ **Last updated:** [April 13, 2021, 6:14am UTC](https://discuss.elastic.co/t/watcher-alert-syntax-error/269920 "2021-04-13T06:14:03Z")
Hello, I have the following watcher alert code. I simply want to check if 2 specific messages (at least 1 out of 2) exist in the message field of a certain facility named: galaxus-service. BUT i get the syntax er… --- ## [Hot warm architecture in ES](https://discuss.elastic.co/t/hot-warm-architecture-in-es/269915)
**Author:** [@sathish.mtech01](https://discuss.elastic.co/u/sathish.mtech01)\ **Replies:** 2\ **Last updated:** [April 13, 2021, 6:12am UTC](https://discuss.elastic.co/t/hot-warm-architecture-in-es/269915 "2021-04-13T06:12:22Z")
How to configure Hot warm architecture of elastic serach in kubernetes cluster? Is this comes under community edition or x-pack? Could you please share urls to configure. --- ## [Plot only documents with the latest time](https://discuss.elastic.co/t/plot-only-documents-with-the-latest-time/269800)
**Author:** [@Shalhevet](https://discuss.elastic.co/u/Shalhevet)\ **Replies:** 2\ **Last updated:** [April 13, 2021, 5:42am UTC](https://discuss.elastic.co/t/plot-only-documents-with-the-latest-time/269800 "2021-04-13T05:42:46Z")
I have an index in with time field, and for each time there are multiple documents. I want to present only the results of the latest time. how can I do it? Is there a way to calculate the maximum value of the time fiel… --- ## [Kibana visualization built with context of other logs](https://discuss.elastic.co/t/kibana-visualization-built-with-context-of-other-logs/269745)
**Author:** [@mbrad](https://discuss.elastic.co/u/mbrad)\ **Replies:** 4\ **Last updated:** [April 13, 2021, 4:39am UTC](https://discuss.elastic.co/t/kibana-visualization-built-with-context-of-other-logs/269745 "2021-04-13T04:39:05Z")
Hello - My team is using ElasticSearch/Kibana for security metric related things and we are having trouble with a specific use case: When a finding is open, a document is created with alerts.status:open associated to t… --- ## [Issues with Canvas when using a time filter](https://discuss.elastic.co/t/issues-with-canvas-when-using-a-time-filter/269958)
**Author:** [@azulgrana](https://discuss.elastic.co/u/azulgrana)\ **Replies:** 5\ **Last updated:** [April 13, 2021, 3:48am UTC](https://discuss.elastic.co/t/issues-with-canvas-when-using-a-time-filter/269958 "2021-04-13T03:48:47Z")
Hi there! I have a Canvas workpad with a few charts (metrics, horizontal bars, pie) that was working fine until I added a time filter. I added the time filter to take advantage of a timelion query I already have on the … --- ## [How Do I Change The Format Of A Metric/File Beat Log Field?](https://discuss.elastic.co/t/how-do-i-change-the-format-of-a-metric-file-beat-log-field/269723)
**Author:** [@kss](https://discuss.elastic.co/u/kss)\ **Replies:** 6\ **Last updated:** [April 13, 2021, 3:22am UTC](https://discuss.elastic.co/t/how-do-i-change-the-format-of-a-metric-file-beat-log-field/269723 "2021-04-13T03:22:21Z")
I am using ElasticSearch FileBeat and MetricBeat to provide logging for my apps. I am using Grafana to visualize this log data. I do have a question though regarding the host.hostname field.... This field is storing t… --- ## [Can Significant text aggregation work on copy\_to fields](https://discuss.elastic.co/t/can-significant-text-aggregation-work-on-copy-to-fields/269908)
**Author:** [@sj12345](https://discuss.elastic.co/u/sj12345)\ **Replies:** 2\ **Last updated:** [April 13, 2021, 3:14am UTC](https://discuss.elastic.co/t/can-significant-text-aggregation-work-on-copy-to-fields/269908 "2021-04-13T03:14:34Z")
I want to do a significant text aggregation on a field which was copied from few other fields (i.e. its a copy\_to field) "combined\_fields" : { "type" : "text", "store" : true, "norms" : fa… --- ## [Kibana visualization custom count column in table](https://discuss.elastic.co/t/kibana-visualization-custom-count-column-in-table/269925)
**Author:** [@kibanaUser3](https://discuss.elastic.co/u/kibanaUser3)\ **Replies:** 1\ **Last updated:** [April 13, 2021, 2:23am UTC](https://discuss.elastic.co/t/kibana-visualization-custom-count-column-in-table/269925 "2021-04-13T02:23:24Z")
I'd like to create visualization for IIS logs group by urls with following strucutre url, total count, total count of urls with 500 status code, total count of urls with status code 200 How do I configure the Metric: C… --- ## [Csv filter plugin not working](https://discuss.elastic.co/t/csv-filter-plugin-not-working/268777)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 28\ **Last updated:** [April 13, 2021, 1:07am UTC](https://discuss.elastic.co/t/csv-filter-plugin-not-working/268777 "2021-04-13T01:07:06Z")
I would like to use logstash to format my logs. Specifically, I have a log with the following format format: timestamp \[thread-name\] log-level class-name - log-message example: 2021-03-30 09:38:20.201 \[ConnectionChe… --- ## [Does logstash use openssl?](https://discuss.elastic.co/t/does-logstash-use-openssl/269827)
**Author:** [@TakaSeki](https://discuss.elastic.co/u/TakaSeki)\ **Replies:** 4\ **Last updated:** [April 13, 2021, 12:41am UTC](https://discuss.elastic.co/t/does-logstash-use-openssl/269827 "2021-04-13T00:41:09Z")
Does logstash use openssl when using the SSL / TLS protocol? If so, where can I find the version of openssl? --- ## [Replace the @TimeStamp with actual time during a bulk Filebeat Send](https://discuss.elastic.co/t/replace-the-timestamp-with-actual-time-during-a-bulk-filebeat-send/269882)
**Author:** [@Wilks](https://discuss.elastic.co/u/Wilks)\ **Replies:** 3\ **Last updated:** [April 12, 2021, 11:22pm UTC](https://discuss.elastic.co/t/replace-the-timestamp-with-actual-time-during-a-bulk-filebeat-send/269882 "2021-04-12T23:22:37Z")
Hi, We are collecting a large amount of logs through out the day and then sending them at 4:30am via Filebeat in a bulk send. The problem is when they end up in Elasticsearch/Kibana all the @TimeStamp fields are 4:30am… --- ## [Update vs Reindex](https://discuss.elastic.co/t/update-vs-reindex/269929)
**Author:** [@abhishekc92](https://discuss.elastic.co/u/abhishekc92)\ **Replies:** 5\ **Last updated:** [April 12, 2021, 10:04pm UTC](https://discuss.elastic.co/t/update-vs-reindex/269929 "2021-04-12T22:04:31Z")
Hello, I am evaluating a few ways of organizing my indices. One of the questions I had was generally speaking, what is the difference in overhead(if any) between updating a document within an index vs using the reindex … --- ## [Issue with Date with Python importing data into Elastic](https://discuss.elastic.co/t/issue-with-date-with-python-importing-data-into-elastic/269918)
**Author:** [@fallenour](https://discuss.elastic.co/u/fallenour)\ **Replies:** 0\ **Last updated:** [April 12, 2021, 5:07pm UTC](https://discuss.elastic.co/t/issue-with-date-with-python-importing-data-into-elastic/269918 "2021-04-12T17:07:37Z")
Hey I have a quick issue regarding using python to connect to elastic. When I go to import data as a date field, its giving me a time error due to time format, but Ive tried everything, including datestamp instead of jus… --- ## [ILM Policy not sticking to index template](https://discuss.elastic.co/t/ilm-policy-not-sticking-to-index-template/269940)
**Author:** [@leemase004](https://discuss.elastic.co/u/leemase004)\ **Replies:** 1\ **Last updated:** [April 12, 2021, 9:36pm UTC](https://discuss.elastic.co/t/ilm-policy-not-sticking-to-index-template/269940 "2021-04-12T21:36:59Z")
We have created an ILM (ex. ILM-1) and have attached it to an index-template (ex. Index-1). However, whenever the index rolls over it for some reason grabs a different, random ILM policy. We will go back to attach the … --- ## [Multiple pipeline](https://discuss.elastic.co/t/multiple-pipeline/269907)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 2\ **Last updated:** [April 12, 2021, 9:35pm UTC](https://discuss.elastic.co/t/multiple-pipeline/269907 "2021-04-12T21:35:53Z")
hi I have 2 servers , the first is DHCP server and the second is DNS server so for shipping the logs to logstash i installed filebeats so in logstash I will apply the differents filtres on DNS and DHCP so how can do th… --- ## ['search\_phase\_execution\_exception', 'action \[indices:data/read/search\[phase/query\]\] is unauthorized for user](https://discuss.elastic.co/t/search-phase-execution-exception-action-indices-data-read-search-phase-query-is-unauthorized-for-user/269657)
**Author:** [@sair\_ramos](https://discuss.elastic.co/u/sair_ramos)\ **Replies:** 1\ **Last updated:** [April 12, 2021, 8:41pm UTC](https://discuss.elastic.co/t/search-phase-execution-exception-action-indices-data-read-search-phase-query-is-unauthorized-for-user/269657 "2021-04-12T20:41:59Z")
i use a script in python to search, index and uptade data and everything works but sometimes give this error many times in a row \*\*'search\_phase\_execution\_exception', 'action \[indices:data/read/search\[phase/query\]\] is un… --- ## [Translate filter regex capture grouping](https://discuss.elastic.co/t/translate-filter-regex-capture-grouping/269922)
**Author:** [@aap323](https://discuss.elastic.co/u/aap323)\ **Replies:** 4\ **Last updated:** [April 12, 2021, 7:55pm UTC](https://discuss.elastic.co/t/translate-filter-regex-capture-grouping/269922 "2021-04-12T19:55:42Z")
Hi, I am using Logstash to parse and enter graphite metrics into InfluxDB. However, I wanted to create a large dictionary source where it can match certain metric lines based on their pattern and reorganize the string ba… --- ## [Logstash 7.12.0 High CPU usage](https://discuss.elastic.co/t/logstash-7-12-0-high-cpu-usage/269851)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 5\ **Last updated:** [April 12, 2021, 7:41pm UTC](https://discuss.elastic.co/t/logstash-7-12-0-high-cpu-usage/269851 "2021-04-12T19:41:21Z")
Hi All, I know that there are several open discussions on the topic already but nothing in there helped me resolving my situation. #1 I installed Logstash on Ubuntu 20.04 for testing purposes and enabling it to run with… --- ## [Where are shard relocations and failures logged?](https://discuss.elastic.co/t/where-are-shard-relocations-and-failures-logged/269942)
**Author:** [@Scott\_Merritt](https://discuss.elastic.co/u/Scott_Merritt)\ **Replies:** 1\ **Last updated:** [April 12, 2021, 7:26pm UTC](https://discuss.elastic.co/t/where-are-shard-relocations-and-failures-logged/269942 "2021-04-12T19:26:21Z")
Hi, We would like to detect when a shard fails, begins relocating off of a node, and finishes relocating. We do use the metrics that show the count of these active operations, but would like to additionally know the spe… --- ## [Display only most recent log per host - Complete Newb](https://discuss.elastic.co/t/display-only-most-recent-log-per-host-complete-newb/269712)
**Author:** [@Jspang01](https://discuss.elastic.co/u/Jspang01)\ **Replies:** 4\ **Last updated:** [April 12, 2021, 7:18pm UTC](https://discuss.elastic.co/t/display-only-most-recent-log-per-host-complete-newb/269712 "2021-04-12T19:18:54Z")
Hello There All, This is my first post. I fully admit that I am a total newb to Kibana. Up until this past month I was only using it to view data that we have. But I am slowly starting to be tasked with making up new v… --- ## [\_id value is getting changed in elastic](https://discuss.elastic.co/t/id-value-is-getting-changed-in-elastic/268905)
**Author:** [@gbandasha](https://discuss.elastic.co/u/gbandasha)\ **Replies:** 12\ **Last updated:** [April 12, 2021, 5:52pm UTC](https://discuss.elastic.co/t/id-value-is-getting-changed-in-elastic/268905 "2021-04-12T17:52:45Z")
I have a unique\_id value in my index and that is also used as the document\_id, but as my document count is increasing drastically I had changed the type from double because that was causing truncation of my values. I cha… --- ## [Logstash fell under load](https://discuss.elastic.co/t/logstash-fell-under-load/269766)
**Author:** [@Andrey\_RF](https://discuss.elastic.co/u/Andrey_RF)\ **Replies:** 14\ **Last updated:** [April 12, 2021, 4:54pm UTC](https://discuss.elastic.co/t/logstash-fell-under-load/269766 "2021-04-12T16:54:31Z")
Hello. I have three clients. They send logs via filebeat to main server with logstash. A few days ago there are a lot of logs somewhere around 12 M in an amount. The logstash couldn't process all this logs and it fell. … --- ## [Watcher Help](https://discuss.elastic.co/t/watcher-help/269711)
**Author:** [@mdamera](https://discuss.elastic.co/u/mdamera)\ **Replies:** 4\ **Last updated:** [April 12, 2021, 4:53pm UTC](https://discuss.elastic.co/t/watcher-help/269711 "2021-04-12T16:53:04Z")
Team, I have a need to monitor "code \[" in the filebeat logs and it should trigger an email alert when it find the word "code \[" I have tried with below string, but it did not helped me, instead of looking for "code \["… --- ## [Visualizing Weighted Average Aggregation in Kibana](https://discuss.elastic.co/t/visualizing-weighted-average-aggregation-in-kibana/269901)
**Author:** [@connersexton](https://discuss.elastic.co/u/connersexton)\ **Replies:** 1\ **Last updated:** [April 12, 2021, 3:55pm UTC](https://discuss.elastic.co/t/visualizing-weighted-average-aggregation-in-kibana/269901 "2021-04-12T15:55:42Z")
I've read a lot of documentation regarding single-value weighted average aggregation in Kibana, but can't seem to find anything on the actual application of this in a dashboard or visualization. My knowledge of Kibana sy… --- ## [Logstash with elasticsearch input](https://discuss.elastic.co/t/logstash-with-elasticsearch-input/269783)
**Author:** [@Kfiro](https://discuss.elastic.co/u/Kfiro)\ **Replies:** 5\ **Last updated:** [April 12, 2021, 3:50pm UTC](https://discuss.elastic.co/t/logstash-with-elasticsearch-input/269783 "2021-04-12T15:50:41Z")
Hi Masters, I'm trying to use Logsash with "elasticsearch" input for taking specific events from winlogbeat Index and write them to another Index, I have a problem with the "query" on the input section, when I'm tryi… --- ## [RemoteTransportException cannot be cast to class org.elasticsearch.index.IndexNotFoundException after upgrade to 7.11.2 from 7.6.0](https://discuss.elastic.co/t/remotetransportexception-cannot-be-cast-to-class-org-elasticsearch-index-indexnotfoundexception-after-upgrade-to-7-11-2-from-7-6-0/268121)
**Author:** [@Brady\_Davis](https://discuss.elastic.co/u/Brady_Davis)\ **Replies:** 4\ **Last updated:** [April 12, 2021, 3:46pm UTC](https://discuss.elastic.co/t/remotetransportexception-cannot-be-cast-to-class-org-elasticsearch-index-indexnotfoundexception-after-upgrade-to-7-11-2-from-7-6-0/268121 "2021-04-12T15:46:19Z")
Hello, We recently upgraded our elasticsearch stack to 7.11.2 from 7.6.0 and are seeing an issue when attempting PUTS on indexes that don't exist: "message": "failed to handle exception response \[org.elasticsearch.tran… --- ## [Logstash jdbc input plugin mongodb driver can not query time range](https://discuss.elastic.co/t/logstash-jdbc-input-plugin-mongodb-driver-can-not-query-time-range/269879)
**Author:** [@john.zhang](https://discuss.elastic.co/u/john.zhang)\ **Replies:** 1\ **Last updated:** [April 12, 2021, 3:43pm UTC](https://discuss.elastic.co/t/logstash-jdbc-input-plugin-mongodb-driver-can-not-query-time-range/269879 "2021-04-12T15:43:43Z")
Hi, Please help . I want to search records in mongodb during 3 days. this is my logstash conf: input { jdbc { jdbc\_driver\_class =\> "com.dbschema.MongoJdbcDriver" jdbc\_driver\_library =\> "/usr/share/logstash/logstas… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1464) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1466)