# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1488 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1489 --- ## [This behavior is deprecated. Specify JAVA\_HOME](https://discuss.elastic.co/t/this-behavior-is-deprecated-specify-java-home/268544)
**Author:** [@jtvdw](https://discuss.elastic.co/u/jtvdw)\ **Replies:** 1\ **Last updated:** [March 29, 2021, 12:09am UTC](https://discuss.elastic.co/t/this-behavior-is-deprecated-specify-java-home/268544 "2021-03-29T00:09:46Z")
Hi, I ran into a error when I installed the latest version of ActiveCollab, it makes use of ES6 and not ES7, not sure why, I had ES7 installed but ActiveCollab confirmed I need to use ES6 for it to work. Here is the er… --- ## [Data depending on the logged in user](https://discuss.elastic.co/t/data-depending-on-the-logged-in-user/268501)
**Author:** [@xquest](https://discuss.elastic.co/u/xquest)\ **Replies:** 2\ **Last updated:** [March 29, 2021, 12:07am UTC](https://discuss.elastic.co/t/data-depending-on-the-logged-in-user/268501 "2021-03-29T00:07:15Z")
Hi! In our organization, we collect logs from 100 servers. We also have 100 developers for these servers. We would like to provide one dashboard for all developers, but so that each of them only sees their own data. W… --- ## [Filebeat.yml correct configuration on MAC OS - docker autodiscover -- Docker daemon at unix:///var/run/docker.sock](https://discuss.elastic.co/t/filebeat-yml-correct-configuration-on-mac-os-docker-autodiscover-docker-daemon-at-unix-var-run-docker-sock/266923)
**Author:** [@Automation\_Scripts](https://discuss.elastic.co/u/Automation_Scripts)\ **Replies:** 2\ **Last updated:** [March 28, 2021, 11:38pm UTC](https://discuss.elastic.co/t/filebeat-yml-correct-configuration-on-mac-os-docker-autodiscover-docker-daemon-at-unix-var-run-docker-sock/266923 "2021-03-28T23:38:48Z")
Guys, I am new to Docker. Am running Docker on my MAC. I've created on my docker-compose file this configuration: filebeat: depends\_on: - kibana - logstash container\_name: fileb… --- ## [Filebeat failed to start in PCF](https://discuss.elastic.co/t/filebeat-failed-to-start-in-pcf/268603)
**Author:** [@mgzwarrior](https://discuss.elastic.co/u/mgzwarrior)\ **Replies:** 1\ **Last updated:** [March 28, 2021, 11:00pm UTC](https://discuss.elastic.co/t/filebeat-failed-to-start-in-pcf/268603 "2021-03-28T23:00:56Z")
Filebeat is failing to start with the following error. ERR Exiting: fileset okta/system is configured but doesn't exist I am attempting to run filebeat as an application in PCF with the input being sys logs from Okta (… --- ## [Issue in metricbeat 7.12](https://discuss.elastic.co/t/issue-in-metricbeat-7-12/268474)
**Author:** [@Aymeric\_Caroff](https://discuss.elastic.co/u/Aymeric_Caroff)\ **Replies:** 2\ **Last updated:** [March 28, 2021, 8:19pm UTC](https://discuss.elastic.co/t/issue-in-metricbeat-7-12/268474 "2021-03-28T20:19:46Z")
Hi, I've debugging an issue for some time now where metricbeat-7.12 doesn't seem to be able to create a new alias for an index template. About the set up: Elasticsearch 7.12 Kibana 7.12 Metricbeat 7.12 Security enabl… --- ## [All-in-one deployement of Wazuh](https://discuss.elastic.co/t/all-in-one-deployement-of-wazuh/268289)
**Author:** [@SafiaSo](https://discuss.elastic.co/u/SafiaSo)\ **Replies:** 2\ **Last updated:** [March 28, 2021, 6:56pm UTC](https://discuss.elastic.co/t/all-in-one-deployement-of-wazuh/268289 "2021-03-28T18:56:13Z")
Hi I'm trying to deploy Wazuh and ELK on a Centos 7 from the Wazuh official documentation. I'm blocking here : Run the Elasticsearch’s "securityadmin" script to load the new certificates information and start the clu… --- ## [Cant index field with ingest pipeline](https://discuss.elastic.co/t/cant-index-field-with-ingest-pipeline/268586)
**Author:** [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\ **Replies:** 2\ **Last updated:** [March 28, 2021, 6:25pm UTC](https://discuss.elastic.co/t/cant-index-field-with-ingest-pipeline/268586 "2021-03-28T18:25:05Z")
Hello, I am facing the following issue Steps: I am creating without problem the following ingest pipeline: PUT \_ingest/pipeline/alexpipeline { "description" : "calculate for the field http.request.body.origina… --- ## [Find document position in query](https://discuss.elastic.co/t/find-document-position-in-query/268581)
**Author:** [@vradder](https://discuss.elastic.co/u/vradder)\ **Replies:** 8\ **Last updated:** [March 28, 2021, 5:35pm UTC](https://discuss.elastic.co/t/find-document-position-in-query/268581 "2021-03-28T17:35:15Z")
Hi, I am using ES for log viewer.. logs are displayed in timestamp ascending order with some boolQuery filters.. initially 10,000 records are displayed in first page there could be around 10 pages of query results.. and … --- ## [Custom Logo in 7.12](https://discuss.elastic.co/t/custom-logo-in-7-12/268565)
**Author:** [@Jose\_Dacosta](https://discuss.elastic.co/u/Jose_Dacosta)\ **Replies:** 2\ **Last updated:** [March 28, 2021, 5:11pm UTC](https://discuss.elastic.co/t/custom-logo-in-7-12/268565 "2021-03-28T17:11:28Z")
Hello, I am a new ELK user and I ant to customize kibana Logo. Any help? --- ## [Suricata logs over Filebeat](https://discuss.elastic.co/t/suricata-logs-over-filebeat/268538)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 1\ **Last updated:** [March 28, 2021, 4:56pm UTC](https://discuss.elastic.co/t/suricata-logs-over-filebeat/268538 "2021-03-28T16:56:27Z")
Hi. I am sending Suricata logs with filebeat to a ELK server. I have the eve.json configured to rotate every day at midnight. Logs are being sent to elastic and I can see them in the dashboards and discover tabs. But i… --- ## [LogStash not sending data to ElasticSearch](https://discuss.elastic.co/t/logstash-not-sending-data-to-elasticsearch/268597)
**Author:** [@ritika3799](https://discuss.elastic.co/u/ritika3799)\ **Replies:** 4\ **Last updated:** [March 28, 2021, 4:46pm UTC](https://discuss.elastic.co/t/logstash-not-sending-data-to-elasticsearch/268597 "2021-03-28T16:46:02Z")
input { file{ path =\> "C:/elastic\_stack/\*.csv" start\_position =\> "beginning" sincedb\_path =\> "null" } } filter { csv { separator =\> "," columns =\> \["name","mfr","type","calori… --- ## [Logstash parsen logfiles](https://discuss.elastic.co/t/logstash-parsen-logfiles/268596)
**Author:** [@bab](https://discuss.elastic.co/u/bab)\ **Replies:** 0\ **Last updated:** [March 28, 2021, 3:51pm UTC](https://discuss.elastic.co/t/logstash-parsen-logfiles/268596 "2021-03-28T15:51:25Z")
Hi all, i'm new on ELK Stack, i need to Filter some log files using Logstash Filter features, so i need some input and tips how i can filter and parse my logs correctly, here is an example of a line from die log file: … --- ## [Issue importing geojson csa boundaries](https://discuss.elastic.co/t/issue-importing-geojson-csa-boundaries/266118)
**Author:** [@jvidin](https://discuss.elastic.co/u/jvidin)\ **Replies:** 6\ **Last updated:** [March 28, 2021, 3:53pm UTC](https://discuss.elastic.co/t/issue-importing-geojson-csa-boundaries/266118 "2021-03-28T15:53:46Z")
Hi there , Im following the blog post https://www.elastic.co/blog/how-to-map-custom-boundaries-in-kibana-with-reverse-geocoding and trying to import the csa geojson file i converted (using FME). Somehow at the end of t… --- ## [Store secrets in keystore using ansible](https://discuss.elastic.co/t/store-secrets-in-keystore-using-ansible/268595)
**Author:** [@cruggiero](https://discuss.elastic.co/u/cruggiero)\ **Replies:** 0\ **Last updated:** [March 28, 2021, 3:33pm UTC](https://discuss.elastic.co/t/store-secrets-in-keystore-using-ansible/268595 "2021-03-28T15:33:50Z")
Hello, I would like to store AWS credentials in the keystore. To deploy elasticsearch I used the official ansible playbook. Following the documentation I prepared this test node configuration: - hosts: 192.168.17… --- ## [Filtering by multiple rows](https://discuss.elastic.co/t/filtering-by-multiple-rows/268594)
**Author:** [@kevinevans](https://discuss.elastic.co/u/kevinevans)\ **Replies:** 0\ **Last updated:** [March 28, 2021, 3:31pm UTC](https://discuss.elastic.co/t/filtering-by-multiple-rows/268594 "2021-03-28T15:31:11Z")
I'm pretty new to ES, so this might be an obvious question. I have an index that contains rows of (field\_id, value, company\_id) where field\_id describes what kind of data value represents. I'd like to create a filtering… --- ## [Pipelines get event.duration from event.start and event.end](https://discuss.elastic.co/t/pipelines-get-event-duration-from-event-start-and-event-end/268561)
**Author:** [@Oliver2](https://discuss.elastic.co/u/Oliver2)\ **Replies:** 3\ **Last updated:** [March 28, 2021, 2:23pm UTC](https://discuss.elastic.co/t/pipelines-get-event-duration-from-event-start-and-event-end/268561 "2021-03-28T14:23:10Z")
what can i do in an elastic search pipeline to workout the event.duration from event.start and event.end --- ## [How to use logstash to collect docker logs cleanly](https://discuss.elastic.co/t/how-to-use-logstash-to-collect-docker-logs-cleanly/268548)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 6\ **Last updated:** [March 28, 2021, 2:10pm UTC](https://discuss.elastic.co/t/how-to-use-logstash-to-collect-docker-logs-cleanly/268548 "2021-03-28T14:10:19Z")
The default output of docker is in json format, which will contain many special characters (such as \\n \\r). The following log sample, I need to merge multiple lines and remove all \\n \\r. For "\\r \\n", should Line Feed a… --- ## [Find time difference between documents in search hits](https://discuss.elastic.co/t/find-time-difference-between-documents-in-search-hits/268580)
**Author:** [@vradder](https://discuss.elastic.co/u/vradder)\ **Replies:** 0\ **Last updated:** [March 28, 2021, 10:16am UTC](https://discuss.elastic.co/t/find-time-difference-between-documents-in-search-hits/268580 "2021-03-28T10:16:22Z")
Hi, I am using ES for log viewer application, how can i add new script filed(hasTimeDifference) in search hits if the time difference between current and previous log is more than specified seconds(for ex: 10 seconds).. … --- ## [Logstash multiline codec not working](https://discuss.elastic.co/t/logstash-multiline-codec-not-working/268174)
**Author:** [@111435](https://discuss.elastic.co/u/111435)\ **Replies:** 1\ **Last updated:** [March 28, 2021, 9:34am UTC](https://discuss.elastic.co/t/logstash-multiline-codec-not-working/268174 "2021-03-28T09:34:53Z")
Hello, I have multilines logs: Trace file /gh/app Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production With the Partitioning option ORACLE\_HOME System name: SunOS Node name: kz-cdb Release:… --- ## [MetricBeat as less privileged user](https://discuss.elastic.co/t/metricbeat-as-less-privileged-user/268579)
**Author:** [@tiefseeruebe](https://discuss.elastic.co/u/tiefseeruebe)\ **Replies:** 0\ **Last updated:** [March 28, 2021, 7:55am UTC](https://discuss.elastic.co/t/metricbeat-as-less-privileged-user/268579 "2021-03-28T07:55:37Z")
Hello, I wonder what would be the most secure way to run Metricbeat with enabled system module with elevated permission to fetch all the details listed here. Some of those details are described as not available as less … --- ## [Logstash not reading the environment variable properly](https://discuss.elastic.co/t/logstash-not-reading-the-environment-variable-properly/268574)
**Author:** [@mastersmit](https://discuss.elastic.co/u/mastersmit)\ **Replies:** 0\ **Last updated:** [March 28, 2021, 4:43am UTC](https://discuss.elastic.co/t/logstash-not-reading-the-environment-variable-properly/268574 "2021-03-28T04:43:39Z")
As we are connecting to a secure elasticsearch via logstash, I have decided to have the password of the elasticsearch configured as a env variable for example ${ELASTIC\_SEARCH\_PASSWORD} but it doesnt work as expected wh… --- ## [Unsupported symbol \[-\] in geohash](https://discuss.elastic.co/t/unsupported-symbol-in-geohash/268563)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [March 28, 2021, 3:06am UTC](https://discuss.elastic.co/t/unsupported-symbol-in-geohash/268563 "2021-03-28T03:06:57Z")
I am facing some issue while defining mapping for an index \[2021-03-27T23:27:36,733\]\[WARN \]\[logstash.outputs.elasticsearch\]\[packetbeat\]\[7bb6e349f13f74fc053ef83bdac5d84b4de038193ed7d008068e4432f88bd27d\] Could not index e… --- ## [How to include custom key/value in webhook?](https://discuss.elastic.co/t/how-to-include-custom-key-value-in-webhook/268570)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 1\ **Last updated:** [March 28, 2021, 12:09am UTC](https://discuss.elastic.co/t/how-to-include-custom-key-value-in-webhook/268570 "2021-03-28T00:09:47Z")
Dear all =) Does anyone know how to include a custom key/value in a webhook? E.g. "ExampleKey": "ExampleValue" My current webhook json encodes the payload, so the custom key/value would have to be part of the json bl… --- ## [Delete field mapping is impossible, but what is the technical restriction to add this feature?](https://discuss.elastic.co/t/delete-field-mapping-is-impossible-but-what-is-the-technical-restriction-to-add-this-feature/268572)
**Author:** [@timotta](https://discuss.elastic.co/u/timotta)\ **Replies:** 1\ **Last updated:** [March 27, 2021, 11:47pm UTC](https://discuss.elastic.co/t/delete-field-mapping-is-impossible-but-what-is-the-technical-restriction-to-add-this-feature/268572 "2021-03-27T23:47:47Z")
I have no knowledge yet in Elastic Search source code, so I don't know if i'm too much naive thinking that if we had a feature to delete a field mapping, the only think to do would be to delete the inverted index for thi… --- ## [Logstash not starting properly](https://discuss.elastic.co/t/logstash-not-starting-properly/268549)
**Author:** [@snobysmake](https://discuss.elastic.co/u/snobysmake)\ **Replies:** 2\ **Last updated:** [March 27, 2021, 4:34pm UTC](https://discuss.elastic.co/t/logstash-not-starting-properly/268549 "2021-03-27T16:34:49Z")
For some strange reason, starting logstash manually seems to work like, bin/logstash -f proj.conf It doesn't start if I run, systemctl start logstash Nothing on the logs since the 25th as shown below, \[2021-03-25T20… --- ## [Kibana dashboard not updating when panels are edited](https://discuss.elastic.co/t/kibana-dashboard-not-updating-when-panels-are-edited/267020)
**Author:** [@BoomBoomPow](https://discuss.elastic.co/u/BoomBoomPow)\ **Replies:** 2\ **Last updated:** [March 27, 2021, 3:54pm UTC](https://discuss.elastic.co/t/kibana-dashboard-not-updating-when-panels-are-edited/267020 "2021-03-27T15:54:39Z")
I already have my Kibana dashboard set up for some time now. Just recently, I had to update a panel and add a couple visualization. Then after saving the dashboard, everything seems normal. But when I access the dashb… --- ## [Send data kibana via curl post](https://discuss.elastic.co/t/send-data-kibana-via-curl-post/268531)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 4\ **Last updated:** [March 27, 2021, 3:49pm UTC](https://discuss.elastic.co/t/send-data-kibana-via-curl-post/268531 "2021-03-27T15:49:10Z")
Hi, I'm trying to send data to my Elastic Cloud instance via CURL POST, in this way: curl -v -X POST -u XXX:XXX -H "Content-Type: application/json" "https://XXX.es.europe-west3.gcp.cloud.es.io:9243/test/\_doc " -d' { "f… --- ## [New Settings for Cluster Replication on Multiple VMs](https://discuss.elastic.co/t/new-settings-for-cluster-replication-on-multiple-vms/268335)
**Author:** [@Automation\_Scripts](https://discuss.elastic.co/u/Automation_Scripts)\ **Replies:** 1\ **Last updated:** [March 25, 2021, 1:01pm UTC](https://discuss.elastic.co/t/new-settings-for-cluster-replication-on-multiple-vms/268335 "2021-03-25T13:01:00Z")
Guys, Can you please provide an updated post with regards on how can I set 3 ES VMs that can communicate with one another? I found on the web or here some old settings that do not work. With the new files some settings… --- ## [Select columns in a Date Histogram visualization chart](https://discuss.elastic.co/t/select-columns-in-a-date-histogram-visualization-chart/267149)
**Author:** [@Arieh\_Tal](https://discuss.elastic.co/u/Arieh_Tal)\ **Replies:** 11\ **Last updated:** [March 27, 2021, 1:05pm UTC](https://discuss.elastic.co/t/select-columns-in-a-date-histogram-visualization-chart/267149 "2021-03-27T13:05:53Z")
I want to select some columns of the following date histogram based on date range e.g 18:00 daily Added: The columns represent the sum of documents per 6 hour interval See required result below Thanks, Arieh Tal … --- ## [Shard Size is 50gb](https://discuss.elastic.co/t/shard-size-is-50gb/268441)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 3\ **Last updated:** [March 27, 2021, 5:58am UTC](https://discuss.elastic.co/t/shard-size-is-50gb/268441 "2021-03-27T05:58:38Z")
I have an index called log-wlb-sysmon-2021.03.20-00002 and i am using ILM Policy for this index { "winlogbeat\_sysmon\_policy" : { "version" : 8, "modified\_date" : "2021-03-26T05:06:42.599Z", "policy" : { … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1487) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1489)