# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1484 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1485 --- ## [How to set @timestamp in Filebeat?](https://discuss.elastic.co/t/how-to-set-timestamp-in-filebeat/268804)
**Author:** [@fzyzcjy](https://discuss.elastic.co/u/fzyzcjy)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 12:14am UTC](https://discuss.elastic.co/t/how-to-set-timestamp-in-filebeat/268804 "2021-03-31T00:14:06Z")
Hi thanks for the wonderful elastic stack! I need to set @timestamp in Filebeat. I have seen this and this. But they seems to be outdated and no updates :frowning: --- ## [How to break long condition in logstash config](https://discuss.elastic.co/t/how-to-break-long-condition-in-logstash-config/268709)
**Author:** [@alicango](https://discuss.elastic.co/u/alicango)\ **Replies:** 2\ **Last updated:** [March 30, 2021, 10:34pm UTC](https://discuss.elastic.co/t/how-to-break-long-condition-in-logstash-config/268709 "2021-03-30T22:34:11Z")
I have a filter section that removes a field if the event matches with regex. So my if condition is very long. if \[type\] == "something" { if \[displayName\] =~ /(\[M-m\]as|MAS)\[\\d\]\*/ or \[displayName\] =~ /(\[E-e\]lk|ELK)/ … --- ## [How to add hostname value in email subject or body](https://discuss.elastic.co/t/how-to-add-hostname-value-in-email-subject-or-body/268820)
**Author:** [@AnamikaN](https://discuss.elastic.co/u/AnamikaN)\ **Replies:** 1\ **Last updated:** [March 30, 2021, 10:21pm UTC](https://discuss.elastic.co/t/how-to-add-hostname-value-in-email-subject-or-body/268820 "2021-03-30T22:21:40Z")
Hi, I would like to add 'hostname' in email subject or body whenever i get 'Failed authentication error' in log messages. I have created an index and it has data for 3 servers. So whenever we see auth error in logs, i w… --- ## [Logstash doesn't log to elastic](https://discuss.elastic.co/t/logstash-doesnt-log-to-elastic/268025)
**Author:** [@ShadwDrgn](https://discuss.elastic.co/u/ShadwDrgn)\ **Replies:** 5\ **Last updated:** [March 30, 2021, 9:43pm UTC](https://discuss.elastic.co/t/logstash-doesnt-log-to-elastic/268025 "2021-03-30T21:43:02Z")
I've been trying to troubleshoot this for quite some time and have managed to find out the following: filebeat logs everything seemingly fine turning on logstash after deleting the indexes i'm logging to SEEMINGLY wor… --- ## [Kibana showing different Packetbeat data](https://discuss.elastic.co/t/kibana-showing-different-packetbeat-data/268834)
**Author:** [@Claudio\_Ract\_Costa](https://discuss.elastic.co/u/Claudio_Ract_Costa)\ **Replies:** 3\ **Last updated:** [March 30, 2021, 8:16pm UTC](https://discuss.elastic.co/t/kibana-showing-different-packetbeat-data/268834 "2021-03-30T20:16:50Z")
Hi Guys, I have two version of Elasticsearch x Kibana (Version 7.6 and version 7.12) When i am analysing data in Kibana, using Discover, the information is showed in different ways for each ES/Kibana version. Example: … --- ## [Filebeat as a UDP Syslog Listener Dropping Alot of Logs](https://discuss.elastic.co/t/filebeat-as-a-udp-syslog-listener-dropping-alot-of-logs/267132)
**Author:** [@sudont](https://discuss.elastic.co/u/sudont)\ **Replies:** 24\ **Last updated:** [March 30, 2021, 8:04pm UTC](https://discuss.elastic.co/t/filebeat-as-a-udp-syslog-listener-dropping-alot-of-logs/267132 "2021-03-30T20:04:24Z")
So we've been using a single filebeat as a listener for a GOOD amount of Juniper SRX firewalls (like 50 or so) and it's been working really well. We recently did a test and ran a script that fires 10 firewall logs on an… --- ## [Kibana Alert API not handling float value correcly](https://discuss.elastic.co/t/kibana-alert-api-not-handling-float-value-correcly/268141)
**Author:** [@leela\_kumili](https://discuss.elastic.co/u/leela_kumili)\ **Replies:** 3\ **Last updated:** [March 30, 2021, 7:19pm UTC](https://discuss.elastic.co/t/kibana-alert-api-not-handling-float-value-correcly/268141 "2021-03-30T19:19:44Z")
I have created a monitor in Kibana using ES query Blockquote { "size": 0, "aggregations": { "byType": { "terms": { "field": "type.keyword", "size": 10, "min\_doc\_count": 1, "shard\_min\_doc\_count": 0, "show\_term… --- ## [Username and password do not work on a shared dashboard](https://discuss.elastic.co/t/username-and-password-do-not-work-on-a-shared-dashboard/268832)
**Author:** [@AlfredoC](https://discuss.elastic.co/u/AlfredoC)\ **Replies:** 1\ **Last updated:** [March 30, 2021, 6:26pm UTC](https://discuss.elastic.co/t/username-and-password-do-not-work-on-a-shared-dashboard/268832 "2021-03-30T18:26:30Z")
I am sharing a dashboard on a web page. To be able to see the dashboard, it asks me for username and password; I enter them, but it does not allow me to see the dashboard, it asks me again for username and password, and … --- ## [Is there a way to parse country names to Geospatial Coordinates?](https://discuss.elastic.co/t/is-there-a-way-to-parse-country-names-to-geospatial-coordinates/268716)
**Author:** [@caitlyn.carlisle](https://discuss.elastic.co/u/caitlyn.carlisle)\ **Replies:** 4\ **Last updated:** [March 30, 2021, 6:12pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-parse-country-names-to-geospatial-coordinates/268716 "2021-03-30T18:12:23Z")
I am attempting to create a map using Kibana. I currently only have the country name as one of my data points but was wondering if there was a way to easily convert it to the Geospatial Coordinates? I am using a Logstash… --- ## [I need help with the filter](https://discuss.elastic.co/t/i-need-help-with-the-filter/268822)
**Author:** [@Eduardo\_Bubniak](https://discuss.elastic.co/u/Eduardo_Bubniak)\ **Replies:** 1\ **Last updated:** [March 30, 2021, 5:48pm UTC](https://discuss.elastic.co/t/i-need-help-with-the-filter/268822 "2021-03-30T17:48:44Z")
I intend to build a dashboard showing only untreated errors that occur in the api, I am using error.exception.type to identify the types of errors, but I only need to track errors that do not have the keyword "company na… --- ## [Count elements in JSON payload](https://discuss.elastic.co/t/count-elements-in-json-payload/268325)
**Author:** [@cjeanne](https://discuss.elastic.co/u/cjeanne)\ **Replies:** 3\ **Last updated:** [March 30, 2021, 5:26pm UTC](https://discuss.elastic.co/t/count-elements-in-json-payload/268325 "2021-03-30T17:26:42Z")
Hello, I'm trying to detect index on read-only with a watcher. I use http input, and I juste want to count the result. My json watcher : { "trigger": { "schedule": { "interval": "10m" } }, "input":… --- ## [Could not able to create index-pattern in 7.12.0](https://discuss.elastic.co/t/could-not-able-to-create-index-pattern-in-7-12-0/268812)
**Author:** [@sasvmware](https://discuss.elastic.co/u/sasvmware)\ **Replies:** 2\ **Last updated:** [March 30, 2021, 3:43pm UTC](https://discuss.elastic.co/t/could-not-able-to-create-index-pattern-in-7-12-0/268812 "2021-03-30T15:43:11Z")
Index pattern is not getting saved in kibana in 7.12.0 --- ## [Rally race gets stuck on check-cluster-health](https://discuss.elastic.co/t/rally-race-gets-stuck-on-check-cluster-health/268815)
**Author:** [@Ellie\_Bird](https://discuss.elastic.co/u/Ellie_Bird)\ **Replies:** 4\ **Last updated:** [March 30, 2021, 4:24pm UTC](https://discuss.elastic.co/t/rally-race-gets-stuck-on-check-cluster-health/268815 "2021-03-30T16:24:36Z")
When I use the track from repository, it works without any problem. Now, I created the track data from existing cluster. and hanging at the stage of 'check-cluster-health'. I am using esrally version 2.0.4 elasticsear… --- ## [Packetbeat for monitoring a microservice](https://discuss.elastic.co/t/packetbeat-for-monitoring-a-microservice/268343)
**Author:** [@Pablo\_Albertengo](https://discuss.elastic.co/u/Pablo_Albertengo)\ **Replies:** 1\ **Last updated:** [March 30, 2021, 4:19pm UTC](https://discuss.elastic.co/t/packetbeat-for-monitoring-a-microservice/268343 "2021-03-30T16:19:23Z")
Hi! I'm doing my first tests with packetbeat. I wanted to monitor a microservice (basically http codes of responses, latency, size of responses) but it has been impossible so far. The service listens on a specific por… --- ## [Purpose of t\<300 in kuery](https://discuss.elastic.co/t/purpose-of-t-300-in-kuery/268689)
**Author:** [@EvanGertis](https://discuss.elastic.co/u/EvanGertis)\ **Replies:** 1\ **Last updated:** [March 30, 2021, 4:17pm UTC](https://discuss.elastic.co/t/purpose-of-t-300-in-kuery/268689 "2021-03-30T16:17:10Z")
What is the purpose of t\<300 in the ELB 2xx prebuilt dashboard json? \\"filter\\": {\\"query\\": \\"fileset.name : \\\\\\"elb\\\\\\" and http.response.status\_code \>= 200 and http.response.status\_code\\\\t\< 300\\", \\"language\\": \\"kue… --- ## [Visualizing Prometheus Histogram](https://discuss.elastic.co/t/visualizing-prometheus-histogram/268668)
**Author:** [@waczi](https://discuss.elastic.co/u/waczi)\ **Replies:** 5\ **Last updated:** [March 30, 2021, 2:40pm UTC](https://discuss.elastic.co/t/visualizing-prometheus-histogram/268668 "2021-03-30T14:40:19Z")
Hi, which type of aggregation should I use for the Prometheus Histogram Metrics generated like shown below. I would like to sum count and values arrays, for given time period, and then based on that create histogram… --- ## [How to limit the size of horizontal bar in Kibana Canvas data table](https://discuss.elastic.co/t/how-to-limit-the-size-of-horizontal-bar-in-kibana-canvas-data-table/268710)
**Author:** [@tangkalo](https://discuss.elastic.co/u/tangkalo)\ **Replies:** 2\ **Last updated:** [March 30, 2021, 2:24pm UTC](https://discuss.elastic.co/t/how-to-limit-the-size-of-horizontal-bar-in-kibana-canvas-data-table/268710 "2021-03-30T14:24:41Z")
Hi, I have a data table that is very wide and the header column titles are long. Is there a way I can limit the size of scroll bar and also wrap the words in each of the column header so that they fit into the fixed-size… --- ## [Filebeat Cisco AMP Module and host.name Error](https://discuss.elastic.co/t/filebeat-cisco-amp-module-and-host-name-error/268510)
**Author:** [@MakoWish](https://discuss.elastic.co/u/MakoWish)\ **Replies:** 21\ **Last updated:** [March 30, 2021, 2:21pm UTC](https://discuss.elastic.co/t/filebeat-cisco-amp-module-and-host-name-error/268510 "2021-03-30T14:21:22Z")
We are currently using Python to poll the Cisco AMP API, then Logstash picks up the results, but I noticed there is a new Cisco AMP module for Filebeat, so I figured I would give it a try. There are a few issues I have n… --- ## [Collecting powershell logs with the old beat version](https://discuss.elastic.co/t/collecting-powershell-logs-with-the-old-beat-version/268637)
**Author:** [@Anna\_Foxx](https://discuss.elastic.co/u/Anna_Foxx)\ **Replies:** 1\ **Last updated:** [March 30, 2021, 2:15pm UTC](https://discuss.elastic.co/t/collecting-powershell-logs-with-the-old-beat-version/268637 "2021-03-30T14:15:47Z")
Hi! In order to collect powershell logs by winlogbeat 6.8, I tried to change config file just adding 2 rows under winlogbeat.event\_logs: -name: Windows Powershell -name: Microsoft-Windows-Powershell/Operational Unfort… --- ## [Winlogbeat Script Processor - processing xml data](https://discuss.elastic.co/t/winlogbeat-script-processor-processing-xml-data/268383)
**Author:** [@omkarg81](https://discuss.elastic.co/u/omkarg81)\ **Replies:** 1\ **Last updated:** [March 30, 2021, 2:13pm UTC](https://discuss.elastic.co/t/winlogbeat-script-processor-processing-xml-data/268383 "2021-03-30T14:13:10Z")
Trying to add a new javascript processor using the processors section for the Winlogbeat that is reading the Windows Application log events. The custom javascript processor needs to read out an xml from within the actual… --- ## [Elasticsearch Kibana user authentication](https://discuss.elastic.co/t/elasticsearch-kibana-user-authentication/268712)
**Author:** [@twilight](https://discuss.elastic.co/u/twilight)\ **Replies:** 3\ **Last updated:** [March 30, 2021, 2:10pm UTC](https://discuss.elastic.co/t/elasticsearch-kibana-user-authentication/268712 "2021-03-30T14:10:29Z")
Hello, I have installed ES and Kibana 7.12 on an Amazon Linux AMI using the rpm packages. But I cannot see any user authentication settings in either of the config files. I have installed metricbeat on some other serv… --- ## [FileBeat disabling hints.default.default\_config](https://discuss.elastic.co/t/filebeat-disabling-hints-default-default-config/268614)
**Author:** [@Joaquin\_menchaca](https://discuss.elastic.co/u/Joaquin_menchaca)\ **Replies:** 1\ **Last updated:** [March 30, 2021, 2:09pm UTC](https://discuss.elastic.co/t/filebeat-disabling-hints-default-default-config/268614 "2021-03-30T14:09:26Z")
I don't understand why this doesn't work, any insight appreciated. When I enable hints.default\_config, I do not get anything show up in Kibana. I was following these docs for auto-discovery. My filebeats.yml config is… --- ## [Winlogbeat: best practice for 2003 logs only](https://discuss.elastic.co/t/winlogbeat-best-practice-for-2003-logs-only/268703)
**Author:** [@nathanrstacey](https://discuss.elastic.co/u/nathanrstacey)\ **Replies:** 1\ **Last updated:** [March 30, 2021, 2:03pm UTC](https://discuss.elastic.co/t/winlogbeat-best-practice-for-2003-logs-only/268703 "2021-03-30T14:03:35Z")
Questions Up Top: -Is there any value in placing these logs onto a 2003 server instead of the Win10 laptop? As in, would Winlogbeat do a better job parsing into ECS if the logs were of the same format as the OS? -Any o… --- ## [Elasticsearch API Search query does not give correct results between timestamp range](https://discuss.elastic.co/t/elasticsearch-api-search-query-does-not-give-correct-results-between-timestamp-range/268786)
**Author:** [@suresh123](https://discuss.elastic.co/u/suresh123)\ **Replies:** 1\ **Last updated:** [March 30, 2021, 2:01pm UTC](https://discuss.elastic.co/t/elasticsearch-api-search-query-does-not-give-correct-results-between-timestamp-range/268786 "2021-03-30T14:01:25Z")
Hello Guys, I have been facing this issue for last 2 days. Can anyone pls help on below issue. Am able to get exact hit counts for example 750755, but field results am not getting between timestamp range. Only few resu… --- ## [SUM for colum1 and filter](https://discuss.elastic.co/t/sum-for-colum1-and-filter/268110)
**Author:** [@EduardoM](https://discuss.elastic.co/u/EduardoM)\ **Replies:** 9\ **Last updated:** [March 30, 2021, 1:07pm UTC](https://discuss.elastic.co/t/sum-for-colum1-and-filter/268110 "2021-03-30T13:07:03Z")
I am trying to do the following: Select Sum (durationprev) from ptx\*-… where location = abc0011 and status = auto as running AVAL= running / total. filters | essql query="SELECT SUM(duration) AS running FROM \\"dat… --- ## [Want to set 'measurement.name' as a filter](https://discuss.elastic.co/t/want-to-set-measurement-name-as-a-filter/268738)
**Author:** [@Jungeun](https://discuss.elastic.co/u/Jungeun)\ **Replies:** 2\ **Last updated:** [March 30, 2021, 12:52pm UTC](https://discuss.elastic.co/t/want-to-set-measurement-name-as-a-filter/268738 "2021-03-30T12:52:18Z")
If you look at the picture attached, I'm trying to visualize the value of "measurement.value" according to "measurement.name" with "up.version". However, I cannot get the value based on the "measurement.name’ from the Y… --- ## [Logstash unexpected message - crypto/rsa verification error](https://discuss.elastic.co/t/logstash-unexpected-message-crypto-rsa-verification-error/267484)
**Author:** [@dkdlv38](https://discuss.elastic.co/u/dkdlv38)\ **Replies:** 3\ **Last updated:** [March 30, 2021, 12:29pm UTC](https://discuss.elastic.co/t/logstash-unexpected-message-crypto-rsa-verification-error/267484 "2021-03-30T12:29:49Z")
Hi all, I'm new here and I have an issue with the configuration of my Windows machines sending logs to a Logstash server through Winlogbeat (for what I understand as I recovered this installation undocumented from a col… --- ## [Understanding IndexShardSnapshotFailedException](https://discuss.elastic.co/t/understanding-indexshardsnapshotfailedexception/268783)
**Author:** [@Kambing](https://discuss.elastic.co/u/Kambing)\ **Replies:** 1\ **Last updated:** [March 30, 2021, 11:56am UTC](https://discuss.elastic.co/t/understanding-indexshardsnapshotfailedexception/268783 "2021-03-30T11:56:39Z")
I have several snapshot policy, most of them were success to execute and create snapshot, but sometimes I got some shard failed with message "INTERNAL\_SERVER\_ERROR: Aborted", when I look at the snapshot policy history, I… --- ## [Can we display TSVB Gauge in default color without any documents/value being populated](https://discuss.elastic.co/t/can-we-display-tsvb-gauge-in-default-color-without-any-documents-value-being-populated/268731)
**Author:** [@Shaiju\_Sam](https://discuss.elastic.co/u/Shaiju_Sam)\ **Replies:** 2\ **Last updated:** [March 30, 2021, 11:19am UTC](https://discuss.elastic.co/t/can-we-display-tsvb-gauge-in-default-color-without-any-documents-value-being-populated/268731 "2021-03-30T11:19:01Z")
Hi, We have created multiple TSVB gauge graph to show the health of the infrastructure using the filter ratio aggregation however few gauges are displaying in green with 0%(document being generated in ES) and few gauges… --- ## [Running Elasticsearch](https://discuss.elastic.co/t/running-elasticsearch/268768)
**Author:** [@Ullubiy\_Abdurakhmano](https://discuss.elastic.co/u/Ullubiy_Abdurakhmano)\ **Replies:** 1\ **Last updated:** [March 30, 2021, 10:30am UTC](https://discuss.elastic.co/t/running-elasticsearch/268768 "2021-03-30T10:30:38Z")
Hi. Can anyone help me? I try to run elastic from the command promt, but wright that elasticsearch is running already and I get error like this: \[2021-03-29T07:57:23,485\]\[ERROR\]\[o.e.b.Bootstrap \] \[User\] Exception java… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1483) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1485)