# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1470 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1471 --- ## [What is this red dot in index data?](https://discuss.elastic.co/t/what-is-this-red-dot-in-index-data/269612)
**Author:** [@Aurel\_Drejta](https://discuss.elastic.co/u/Aurel_Drejta)\ **Replies:** 10\ **Last updated:** [April 8, 2021, 8:54pm UTC](https://discuss.elastic.co/t/what-is-this-red-dot-in-index-data/269612 "2021-04-08T20:54:15Z")
Hi I'm seeing this red dot appear in my index data as shown below: This has also been reported by other people here in the discuss section of elasticsearch. See: Here And here In both cases there was nothing rea… --- ## [Using Metricbeat to Monitor MS SQL Server Performance - What Permissions in MS SQL Server?](https://discuss.elastic.co/t/using-metricbeat-to-monitor-ms-sql-server-performance-what-permissions-in-ms-sql-server/267417)
**Author:** [@efaile](https://discuss.elastic.co/u/efaile)\ **Replies:** 1\ **Last updated:** [April 8, 2021, 8:38pm UTC](https://discuss.elastic.co/t/using-metricbeat-to-monitor-ms-sql-server-performance-what-permissions-in-ms-sql-server/267417 "2021-04-08T20:38:43Z")
Instructions tell you how to install metricbeat and enable the MS SQL server module - but I can find no coverage (anywhere - google, elasticsearch, metricbeat docs) on what the required permissions within MS SQL must be … --- ## [\[Kibana Enhanced Table\] Cell line / separator](https://discuss.elastic.co/t/kibana-enhanced-table-cell-line-separator/267072)
**Author:** [@uusername](https://discuss.elastic.co/u/uusername)\ **Replies:** 7\ **Last updated:** [April 8, 2021, 7:20pm UTC](https://discuss.elastic.co/t/kibana-enhanced-table-cell-line-separator/267072 "2021-04-08T19:20:32Z")
Hi @fbaligand, I'm very thank you for creating Kibana Enhanced Table Plugin. Can I know if there is a way to achieve to draw the table cell line / separator in this plugin? --- ## [Filebeat fails with connecting to Kibana over GET 127.0.0.1:5601](https://discuss.elastic.co/t/filebeat-fails-with-connecting-to-kibana-over-get-127-0-0-1-5601/269193)
**Author:** [@makrellen](https://discuss.elastic.co/u/makrellen)\ **Replies:** 7\ **Last updated:** [April 8, 2021, 7:10pm UTC](https://discuss.elastic.co/t/filebeat-fails-with-connecting-to-kibana-over-get-127-0-0-1-5601/269193 "2021-04-08T19:10:45Z")
Description of problem I'm trying to get Filebeat to work on my Ubuntu VPS via docker-compose and I've set it up behind my caddy-reverse proxy and configured everything as I should according to the Filebeat docs, but I … --- ## [Questions re Sniffing in Logstash elasticsearch output](https://discuss.elastic.co/t/questions-re-sniffing-in-logstash-elasticsearch-output/269631)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 3\ **Last updated:** [April 8, 2021, 6:59pm UTC](https://discuss.elastic.co/t/questions-re-sniffing-in-logstash-elasticsearch-output/269631 "2021-04-08T18:59:47Z")
I'm testing Logstash sniffing in our environment for the Elasticsearch output. So far, it appears to resolve a few issues I've had, but I've got a few questions: sniffing =\> true in my elasticsearch output appears to … --- ## [Logstash Parser error - tried to parse field as object, but found a concrete value](https://discuss.elastic.co/t/logstash-parser-error-tried-to-parse-field-as-object-but-found-a-concrete-value/269140)
**Author:** [@Automation\_Scripts](https://discuss.elastic.co/u/Automation_Scripts)\ **Replies:** 13\ **Last updated:** [April 8, 2021, 6:42pm UTC](https://discuss.elastic.co/t/logstash-parser-error-tried-to-parse-field-as-object-but-found-a-concrete-value/269140 "2021-04-08T18:42:57Z")
Hi, I am trying to parse a log but i have this error. \[source\] tried to parse field \[source\] as object, but found a concrete value if "string" in \[tags\] { grok { match =\> \[ "message", "(?\ **Author:** [@gneves](https://discuss.elastic.co/u/gneves)\ **Replies:** 1\ **Last updated:** [April 8, 2021, 5:51pm UTC](https://discuss.elastic.co/t/epoch-to-readable-timestamp/269623 "2021-04-08T17:51:52Z") Hello guys. Hope you are doing well. Im having a little problem trying to convert an event time in epoch to a readable timestamp, per example in UTC. So, the log that i have is something like this: event\_time=1613523… --- ## [Same Snap Repository, Less Snaps](https://discuss.elastic.co/t/same-snap-repository-less-snaps/269364)
**Author:** [@glimmbo](https://discuss.elastic.co/u/glimmbo)\ **Replies:** 7\ **Last updated:** [April 8, 2021, 5:48pm UTC](https://discuss.elastic.co/t/same-snap-repository-less-snaps/269364 "2021-04-08T17:48:50Z")
Using AWS ES Service, with repository-s3 plugin, I have two instances, launched with the same settings. I register the same snap repo successfully, but when I GET /\_cat/snapshots/repo\_name?v the second instance (created … --- ## [Composite Query and Aggregation results different doc\_count value](https://discuss.elastic.co/t/composite-query-and-aggregation-results-different-doc-count-value/269626)
**Author:** [@amr1](https://discuss.elastic.co/u/amr1)\ **Replies:** 0\ **Last updated:** [April 8, 2021, 4:41pm UTC](https://discuss.elastic.co/t/composite-query-and-aggregation-results-different-doc-count-value/269626 "2021-04-08T16:41:57Z")
I am trying to query on my data set with composite query. Here is my Query 1: curl -X POST "localhost:9200/index1-202103/\_search?size=0&pretty" -H 'Content-Type: application/json' -d' { "query": {"bool": {"filter": \[{ … --- ## [Unable to access https://localhost:9200, issue with Elastic User](https://discuss.elastic.co/t/unable-to-access-https-localhost-9200-issue-with-elastic-user/269510)
**Author:** [@Bbruteforce](https://discuss.elastic.co/u/Bbruteforce)\ **Replies:** 5\ **Last updated:** [April 8, 2021, 4:19pm UTC](https://discuss.elastic.co/t/unable-to-access-https-localhost-9200-issue-with-elastic-user/269510 "2021-04-08T16:19:38Z")
Hello Team, I am trying to send data from Wazuh Manager to Elasticsearch via Filebeat over port 9200. In the "Discover" tab of Kibana i see no data , even though the agent seems to sending data properly to manager I se… --- ## [Watcher - display for each bucket, its corresponding sub buckets results](https://discuss.elastic.co/t/watcher-display-for-each-bucket-its-corresponding-sub-buckets-results/269620)
**Author:** [@toms130](https://discuss.elastic.co/u/toms130)\ **Replies:** 0\ **Last updated:** [April 8, 2021, 4:00pm UTC](https://discuss.elastic.co/t/watcher-display-for-each-bucket-its-corresponding-sub-buckets-results/269620 "2021-04-08T16:00:43Z")
Hi there, I've a query result like this : "aggregations": { "backend": { "doc\_count\_error\_upper\_bound": 0, "sum\_other\_doc\_count": 0, "buckets": \[ … --- ## [XML parser, alter field](https://discuss.elastic.co/t/xml-parser-alter-field/269415)
**Author:** [@Soren\_vdc](https://discuss.elastic.co/u/Soren_vdc)\ **Replies:** 3\ **Last updated:** [April 8, 2021, 3:55pm UTC](https://discuss.elastic.co/t/xml-parser-alter-field/269415 "2021-04-08T15:55:29Z")
Hi, I have this setup for XML parser: xml { source =\> "message" target =\> "xml" add\_field =\> { Audit\_Type =\> "%{\[xml\]\[Audit\_Type\]}" Ext\_Name … --- ## [Kibana Road Map layer is not showing](https://discuss.elastic.co/t/kibana-road-map-layer-is-not-showing/269574)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 4\ **Last updated:** [April 8, 2021, 3:49pm UTC](https://discuss.elastic.co/t/kibana-road-map-layer-is-not-showing/269574 "2021-04-08T15:49:46Z")
I am using elk stack 7.11 , the road map layer is not showing --- ## [Clickable URL kibana 7.11](https://discuss.elastic.co/t/clickable-url-kibana-7-11/269476)
**Author:** [@Chaimaa\_ABD](https://discuss.elastic.co/u/Chaimaa_ABD)\ **Replies:** 5\ **Last updated:** [April 8, 2021, 3:47pm UTC](https://discuss.elastic.co/t/clickable-url-kibana-7-11/269476 "2021-04-08T15:47:52Z")
How to display a field as a clickable URL in data table visualization in kibana 7.11 ? I tried to format the field but it doesn't work --- ## [Show all unique values](https://discuss.elastic.co/t/show-all-unique-values/269606)
**Author:** [@Andrey\_RF](https://discuss.elastic.co/u/Andrey_RF)\ **Replies:** 3\ **Last updated:** [April 8, 2021, 3:30pm UTC](https://discuss.elastic.co/t/show-all-unique-values/269606 "2021-04-08T15:30:00Z")
I have a field and I need to get all unique values by this field in table or something else. Does it have some tools for it ? --- ## [Functionbeat environment variables](https://discuss.elastic.co/t/functionbeat-environment-variables/269617)
**Author:** [@sce81](https://discuss.elastic.co/u/sce81)\ **Replies:** 0\ **Last updated:** [April 8, 2021, 3:08pm UTC](https://discuss.elastic.co/t/functionbeat-environment-variables/269617 "2021-04-08T15:08:17Z")
Hi, i am wondering if it is possible to override the functionbeat.yml parameters using environment variables? eg: i want to send to elasticsearch with credentials stored as encrypted env vars, but i want this configured… --- ## [Field contains CSV want to extract to array of strings](https://discuss.elastic.co/t/field-contains-csv-want-to-extract-to-array-of-strings/269494)
**Author:** [@ian351c](https://discuss.elastic.co/u/ian351c)\ **Replies:** 4\ **Last updated:** [April 8, 2021, 3:00pm UTC](https://discuss.elastic.co/t/field-contains-csv-want-to-extract-to-array-of-strings/269494 "2021-04-08T15:00:36Z")
Hello all, I am working on migrating from Splunk to ELK for my Palo Alto Networks firewall logs using the pre-built processor in Filebeat. The pipeline is Syslog \> Filebeat \> Elastic. The PANW logs contain two separate … --- ## [AWS NLB config infront of FileBeats Instance](https://discuss.elastic.co/t/aws-nlb-config-infront-of-filebeats-instance/269065)
**Author:** [@Ravi342883](https://discuss.elastic.co/u/Ravi342883)\ **Replies:** 6\ **Last updated:** [April 8, 2021, 2:46pm UTC](https://discuss.elastic.co/t/aws-nlb-config-infront-of-filebeats-instance/269065 "2021-04-08T14:46:40Z")
Hi All, I'm trying to setup a AWS Network Load Balancer (NLB) in-front of Filebeat instance. Need help in 1. How to configure the NLB & 2. How to do health check in NLB. Note: This setup is to collect the logs from v… --- ## [Elasticsearch Autoscaling](https://discuss.elastic.co/t/elasticsearch-autoscaling/269454)
**Author:** [@Mkian](https://discuss.elastic.co/u/Mkian)\ **Replies:** 3\ **Last updated:** [April 8, 2021, 2:39pm UTC](https://discuss.elastic.co/t/elasticsearch-autoscaling/269454 "2021-04-08T14:39:42Z")
With the introduction of Autoscaling on Elastic cloud, does anyone know if Scale In is also in place? Or it's just adding more nodes? --- ## [Snapshot got stuck in IN\_PROGRESS state](https://discuss.elastic.co/t/snapshot-got-stuck-in-in-progress-state/269595)
**Author:** [@akshatsharma](https://discuss.elastic.co/u/akshatsharma)\ **Replies:** 1\ **Last updated:** [April 8, 2021, 2:20pm UTC](https://discuss.elastic.co/t/snapshot-got-stuck-in-in-progress-state/269595 "2021-04-08T14:20:27Z")
Hi, We noticed that one of our snapshots is stuck in IN\_PROGRESS state for a while now: GET \_cat/snapshots/es\_backup es-snapshot-1 SUCCESS 1615184123 06:15:23 1615184133 06:15:33 9.4s 17 17 0 17 es-snapshot-2 S… --- ## [Filebeat Cisco Module Nexus dissect\_parsing\_error](https://discuss.elastic.co/t/filebeat-cisco-module-nexus-dissect-parsing-error/265662)
**Author:** [@vqjanderson](https://discuss.elastic.co/u/vqjanderson)\ **Replies:** 5\ **Last updated:** [April 8, 2021, 2:15pm UTC](https://discuss.elastic.co/t/filebeat-cisco-module-nexus-dissect-parsing-error/265662 "2021-04-08T14:15:26Z")
Not sure why these logs are not being parsed correctly. Are the optimized access logging logs not supported by the module? --- ## [Logstash](https://discuss.elastic.co/t/logstash/268923)
**Author:** [@wpr](https://discuss.elastic.co/u/wpr)\ **Replies:** 2\ **Last updated:** [April 8, 2021, 2:12pm UTC](https://discuss.elastic.co/t/logstash/268923 "2021-04-08T14:12:25Z")
Hi, I am using Logstash to migrate data from ES 5.6 to ES 7.9. I am aware of the changes between those versions. I have the following mapping for a document in 5.6: "transaction\_information": { … --- ## [Elastic No mapping found for \[\_shard\_doc\] in order to sort on](https://discuss.elastic.co/t/elastic-no-mapping-found-for-shard-doc-in-order-to-sort-on/268188)
**Author:** [@111452](https://discuss.elastic.co/u/111452)\ **Replies:** 4\ **Last updated:** [April 8, 2021, 2:11pm UTC](https://discuss.elastic.co/t/elastic-no-mapping-found-for-shard-doc-in-order-to-sort-on/268188 "2021-04-08T14:11:32Z")
I'm trying to use search after parameter in the query to retrieve the next page as it says in Paginate search results | Elasticsearch Reference \[7.12\] | Elastic. If I sort it like "sort": \[ {"@timestamp": "asc"}, … --- ## [Does Search Alert in 7.12 include query?](https://discuss.elastic.co/t/does-search-alert-in-7-12-include-query/269572)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 4\ **Last updated:** [April 8, 2021, 2:10pm UTC](https://discuss.elastic.co/t/does-search-alert-in-7-12-include-query/269572 "2021-04-08T14:10:36Z")
Dear all =) When I read the summary for https://github.com/elastic/kibana/pull/88528 it says New stack alert for executing ES DSL (query only, no aggregation support) and evaluating the number of matches against a thr… --- ## [Remote Access Available But Local Access Not Available](https://discuss.elastic.co/t/remote-access-available-but-local-access-not-available/268752)
**Author:** [@sewox](https://discuss.elastic.co/u/sewox)\ **Replies:** 22\ **Last updated:** [April 8, 2021, 1:53pm UTC](https://discuss.elastic.co/t/remote-access-available-but-local-access-not-available/268752 "2021-04-08T13:53:43Z")
Hi Everyone, I can access it remotely elasticsearch but I can't access local with PHP driver. \ **Author:** [@AneskaFrisbib](https://discuss.elastic.co/u/AneskaFrisbib)\ **Replies:** 1\ **Last updated:** [April 8, 2021, 1:05pm UTC](https://discuss.elastic.co/t/dot-in-field-names-in-es7-11/269588 "2021-04-08T13:05:31Z") Hello, I currently have the same problem as the one described here : How to handle dot in field names in ES 7.0 Unfortunately, I can't modify the document field names as suggested in the last update. Is there any othe… --- ## [Elasticsearch query time range issue](https://discuss.elastic.co/t/elasticsearch-query-time-range-issue/268672)
**Author:** [@suresh123](https://discuss.elastic.co/u/suresh123)\ **Replies:** 50\ **Last updated:** [April 8, 2021, 12:41pm UTC](https://discuss.elastic.co/t/elasticsearch-query-time-range-issue/268672 "2021-04-08T12:41:54Z")
Hello Experts, I am not able to retrieve all the status\_code values with below query. It has given only less value than actual values. \*\*My query\*\* "\_source": \[ "status\_code", "referrer", "timestamp" \], "query":… --- ## [I want to input row of csv file](https://discuss.elastic.co/t/i-want-to-input-row-of-csv-file/269538)
**Author:** [@BlackCat](https://discuss.elastic.co/u/BlackCat)\ **Replies:** 2\ **Last updated:** [April 8, 2021, 12:12pm UTC](https://discuss.elastic.co/t/i-want-to-input-row-of-csv-file/269538 "2021-04-08T12:12:44Z")
I want to input per one row and csv file haven't column name. Please teach me how to set for logstash. Data flow is filebeat → logstash → elasticsearch. I attached sample image of csv file. --- ## [Kibana service is not running it's waiting with “loading elastic”](https://discuss.elastic.co/t/kibana-service-is-not-running-its-waiting-with-loading-elastic/269550)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 8\ **Last updated:** [April 8, 2021, 12:04pm UTC](https://discuss.elastic.co/t/kibana-service-is-not-running-its-waiting-with-loading-elastic/269550 "2021-04-08T12:04:16Z")
When I try to run bin/kibana. I get the below message. When I check the localhost:5601. Kibana is waiting "loading elastic" message. How can i solve this problem ? log \[16:25:00.767\] \[info\]\[plugins-service\] Plugi… --- ## [Actual values in ML single metric viewer doesnt match the raw data](https://discuss.elastic.co/t/actual-values-in-ml-single-metric-viewer-doesnt-match-the-raw-data/269539)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [April 8, 2021, 11:20am UTC](https://discuss.elastic.co/t/actual-values-in-ml-single-metric-viewer-doesnt-match-the-raw-data/269539 "2021-04-08T11:20:27Z")
In th first image the actual is 2.987, but the values displayed in the Y axis, and the value displayed in the second image, that is next to this anomaly , aren't near the value of the actual, and it seems the typical is … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1469) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1471)