# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1511 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1512 --- ## [Custom formatting for boolean fields](https://discuss.elastic.co/t/custom-formatting-for-boolean-fields/266949)
**Author:** [@bg.andrew](https://discuss.elastic.co/u/bg.andrew)\ **Replies:** 2\ **Last updated:** [March 12, 2021, 10:49am UTC](https://discuss.elastic.co/t/custom-formatting-for-boolean-fields/266949 "2021-03-12T10:49:54Z")
Hi, should be quite a simple question. I'm using kibana with elasticsearch service in AWS. Does anybody knows what is the best way to customise the look of a boolean field values in kibana? The client wants to see those … --- ## [Region join a multivalued field (maps)](https://discuss.elastic.co/t/region-join-a-multivalued-field-maps/266845)
**Author:** [@Rom1](https://discuss.elastic.co/u/Rom1)\ **Replies:** 2\ **Last updated:** [March 12, 2021, 10:08am UTC](https://discuss.elastic.co/t/region-join-a-multivalued-field-maps/266845 "2021-03-12T10:08:00Z")
Hi everyone, Playing with maps on ES 7.10.2, I'm stuck and I need help. I have a first index containing areas and sub areas (geojson) with a code (ID). I have another index containing documents (with a field area\_id) … --- ## [Docker logstash in ECS receives SIGTERM after ~5 min](https://discuss.elastic.co/t/docker-logstash-in-ecs-receives-sigterm-after-5-min/267012)
**Author:** [@tiberiu89](https://discuss.elastic.co/u/tiberiu89)\ **Replies:** 3\ **Last updated:** [March 12, 2021, 10:06am UTC](https://discuss.elastic.co/t/docker-logstash-in-ecs-receives-sigterm-after-5-min/267012 "2021-03-12T10:06:06Z")
Well, the title says it all, I have logstash container deployed in ECS, with a hard memory limit if 1.5GB, pipeline config is already tested locally so I'm fairly sure that's not the problem. I'm sending container logs … --- ## [Increase the precision\_threshold in TSVB](https://discuss.elastic.co/t/increase-the-precision-threshold-in-tsvb/267070)
**Author:** [@zevodku](https://discuss.elastic.co/u/zevodku)\ **Replies:** 1\ **Last updated:** [March 12, 2021, 9:53am UTC](https://discuss.elastic.co/t/increase-the-precision-threshold-in-tsvb/267070 "2021-03-12T09:53:18Z")
Hi, I cannot find a way to increase the precision\_threshold in TSVB when using cardinality agg. How can I do that ? Thanks --- ## [Packetbeat logging traffic from Ip with different subnet](https://discuss.elastic.co/t/packetbeat-logging-traffic-from-ip-with-different-subnet/267057)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 0\ **Last updated:** [March 12, 2021, 8:38am UTC](https://discuss.elastic.co/t/packetbeat-logging-traffic-from-ip-with-different-subnet/267057 "2021-03-12T08:38:30Z")
Hi, I'm receiving logs from packetbeat from an IP with different subnet. Like my ip is 192.168.0.100 on network card index 1 for example, and I'm getting logs from this Ip and 192.168.1.92 which has different subnet. I… --- ## [PUT mappings API overriding the exsisting mappings](https://discuss.elastic.co/t/put-mappings-api-overriding-the-exsisting-mappings/267055)
**Author:** [@Nishikant\_Tayade](https://discuss.elastic.co/u/Nishikant_Tayade)\ **Replies:** 0\ **Last updated:** [March 12, 2021, 8:23am UTC](https://discuss.elastic.co/t/put-mappings-api-overriding-the-exsisting-mappings/267055 "2021-03-12T08:23:06Z")
Hello, I have created an index template, where I am defining an "ignore\_above" mapping parameter for a "keyword" field type. Now I want to update the mappings and want to add a new parameter "eager\_global\_ordinals" for… --- ## [Logstash Filter](https://discuss.elastic.co/t/logstash-filter/266182)
**Author:** [@Anu6006](https://discuss.elastic.co/u/Anu6006)\ **Replies:** 2\ **Last updated:** [March 12, 2021, 8:21am UTC](https://discuss.elastic.co/t/logstash-filter/266182 "2021-03-12T08:21:31Z")
Hi Team, I'm trying to get NSG Flow logs through Azure Blob Storage (logstash-input-azureblob (0.9.12)). But the filtering part is not working properly and showing the errors \_jsonparsefailure, \_split\_type\_failure, \_da… --- ## [Filebeat not sending kubernetes metadata](https://discuss.elastic.co/t/filebeat-not-sending-kubernetes-metadata/267054)
**Author:** [@Martinho\_MOREIRA](https://discuss.elastic.co/u/Martinho_MOREIRA)\ **Replies:** 0\ **Last updated:** [March 12, 2021, 8:20am UTC](https://discuss.elastic.co/t/filebeat-not-sending-kubernetes-metadata/267054 "2021-03-12T08:20:25Z")
Hi, I just upgrade my filebeat from 7.10.2 to 7.11.2 and kubernetes metadata are missing now: Here is my configuration file. Did I miss something ? filebeat.inputs: - type: container paths: - /var/log/container… --- ## [Check whether a field has mapping store=true](https://discuss.elastic.co/t/check-whether-a-field-has-mapping-store-true/264792)
**Author:** [@Nishikant\_Tayade](https://discuss.elastic.co/u/Nishikant_Tayade)\ **Replies:** 2\ **Last updated:** [March 12, 2021, 8:15am UTC](https://discuss.elastic.co/t/check-whether-a-field-has-mapping-store-true/264792 "2021-03-12T08:15:42Z")
I am trying out the following use case: I want only the fields from index template, or index mapping, for which mapping property store=true, though I can get the mapping and parse it and check for the criteria or can u… --- ## [Unable to index data as casesensitive using jdbc input in logstash](https://discuss.elastic.co/t/unable-to-index-data-as-casesensitive-using-jdbc-input-in-logstash/266820)
**Author:** [@Sammeta\_David\_Raju](https://discuss.elastic.co/u/Sammeta_David_Raju)\ **Replies:** 2\ **Last updated:** [March 12, 2021, 8:10am UTC](https://discuss.elastic.co/t/unable-to-index-data-as-casesensitive-using-jdbc-input-in-logstash/266820 "2021-03-12T08:10:51Z")
\`Unable to index data as case-sensitive using jdbc input in logstash\` even after using lowercase\_column\_names =\> false --- ## [How to send different logs to logstash and elasticsearch](https://discuss.elastic.co/t/how-to-send-different-logs-to-logstash-and-elasticsearch/267038)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 1\ **Last updated:** [March 12, 2021, 8:04am UTC](https://discuss.elastic.co/t/how-to-send-different-logs-to-logstash-and-elasticsearch/267038 "2021-03-12T08:04:30Z")
It turns out that filebeat.yml can send the output to elasticsearch or logstash. Is it possible to change the destination depending on the logs collected by filebeat? For example, is it possible to send general logs th… --- ## [Elastic snapshots - is one big repository recommended?](https://discuss.elastic.co/t/elastic-snapshots-is-one-big-repository-recommended/267045)
**Author:** [@JimJ](https://discuss.elastic.co/u/JimJ)\ **Replies:** 1\ **Last updated:** [March 12, 2021, 7:25am UTC](https://discuss.elastic.co/t/elastic-snapshots-is-one-big-repository-recommended/267045 "2021-03-12T07:25:20Z")
I am putting in place a shared filesystem repository to take snapshots. I noticed the second cluster I configured with the sahred FS automatically gets info about existing snapshots, even if I give a different name to t… --- ## [How to add index to datastream manually?](https://discuss.elastic.co/t/how-to-add-index-to-datastream-manually/267043)
**Author:** [@LoadingZhang](https://discuss.elastic.co/u/LoadingZhang)\ **Replies:** 0\ **Last updated:** [March 12, 2021, 6:48am UTC](https://discuss.elastic.co/t/how-to-add-index-to-datastream-manually/267043 "2021-03-12T06:48:22Z")
I use split api to an index which belong to a datastream, but the new index not set the datastream automatically. How can I set the new index let it belong to datastream? --- ## [Ilm index not migrating](https://discuss.elastic.co/t/ilm-index-not-migrating/267039)
**Author:** [@Vishnu\_Singhal](https://discuss.elastic.co/u/Vishnu_Singhal)\ **Replies:** 0\ **Last updated:** [March 12, 2021, 6:24am UTC](https://discuss.elastic.co/t/ilm-index-not-migrating/267039 "2021-03-12T06:24:32Z")
Hi, i have a index eligible to move to w"message": "\[ryvscale54\_raw\_session\_20210306\] lifecycle abc\_20210306": { "index": "abc\_20210306", "managed": true, "policy": "ilm-uniq-com", "lifecycle\_date\_millis": 161499459084… --- ## [Load is not distributed evenly between cpus](https://discuss.elastic.co/t/load-is-not-distributed-evenly-between-cpus/267040)
**Author:** [@nyquillus](https://discuss.elastic.co/u/nyquillus)\ **Replies:** 0\ **Last updated:** [March 12, 2021, 6:29am UTC](https://discuss.elastic.co/t/load-is-not-distributed-evenly-between-cpus/267040 "2021-03-12T06:29:17Z")
We're operating an Elastic Stack on kubernetes on a single host(Centos 7). The host has 2x Intel E5-2640 v4 @ 2.40GHz. The processes are supposedly working with all cores but the load is mainly on the first cpu. Most of … --- ## [How to test EUI changes in Kibana(7.10.x) during development?](https://discuss.elastic.co/t/how-to-test-eui-changes-in-kibana-7-10-x-during-development/266114)
**Author:** [@hardik.rapidops](https://discuss.elastic.co/u/hardik.rapidops)\ **Replies:** 6\ **Last updated:** [March 12, 2021, 6:18am UTC](https://discuss.elastic.co/t/how-to-test-eui-changes-in-kibana-7-10-x-during-development/266114 "2021-03-12T06:18:36Z")
I want to integrate eui with my local kibana, Is there any way to integrate eui with link e.g @elastic/eui": "link:\ in package.json in kibana 7.10.x version ? I have tried it. It's not working. Can anyon… --- ## [Kibana Plugin Link](https://discuss.elastic.co/t/kibana-plugin-link/266884)
**Author:** [@hayzjd836](https://discuss.elastic.co/u/hayzjd836)\ **Replies:** 2\ **Last updated:** [March 12, 2021, 5:45am UTC](https://discuss.elastic.co/t/kibana-plugin-link/266884 "2021-03-12T05:45:42Z")
Hello I'm trying to get access to my own dashboard from the sidebar. For example, if there's a "my\_dashboard" in the sidebar and you click on it, you can go to the "app/dashboard/...". So I created the plug-in accordi… --- ## [Kibana handle multiple authentication methods](https://discuss.elastic.co/t/kibana-handle-multiple-authentication-methods/265202)
**Author:** [@anon42972578](https://discuss.elastic.co/u/anon42972578)\ **Replies:** 2\ **Last updated:** [March 12, 2021, 5:33am UTC](https://discuss.elastic.co/t/kibana-handle-multiple-authentication-methods/265202 "2021-03-12T05:33:54Z")
Hello, we have some questions about how to handle multiple authentication methods in Kibana. It would be great if we can learn from you and your solutions or your ideas. at the moment we can offer three different authe… --- ## [Filebeat getting error when parsing json](https://discuss.elastic.co/t/filebeat-getting-error-when-parsing-json/267033)
**Author:** [@hackercat](https://discuss.elastic.co/u/hackercat)\ **Replies:** 0\ **Last updated:** [March 12, 2021, 4:59am UTC](https://discuss.elastic.co/t/filebeat-getting-error-when-parsing-json/267033 "2021-03-12T04:59:46Z")
Hi there, Really new to the filebeat. I have a beat config like below. filebeat.inputs: - type: log enabled: true paths: - /tmp/api\_json.log fields: log\_group: gitlab\_test log\_id: api\_json json.key… --- ## [Problem in kibana (web browser not working)](https://discuss.elastic.co/t/problem-in-kibana-web-browser-not-working/267022)
**Author:** [@gregory7](https://discuss.elastic.co/u/gregory7)\ **Replies:** 2\ **Last updated:** [March 12, 2021, 4:13am UTC](https://discuss.elastic.co/t/problem-in-kibana-web-browser-not-working/267022 "2021-03-12T04:13:13Z")
Hi, I installed elasticsearch and kibana on my local pc with virtualbox machine. They are works good. later, I install same application on linux server, they are not working. The linux server cannot access internet c… --- ## [PacketBeat DNS protocol wrong registered\_domain when uppercase](https://discuss.elastic.co/t/packetbeat-dns-protocol-wrong-registered-domain-when-uppercase/267021)
**Author:** [@glee](https://discuss.elastic.co/u/glee)\ **Replies:** 0\ **Last updated:** [March 12, 2021, 1:52am UTC](https://discuss.elastic.co/t/packetbeat-dns-protocol-wrong-registered-domain-when-uppercase/267021 "2021-03-12T01:52:44Z")
Goodday. I'm monitoring my powerdns with packetbeat and elasticsearch. When domain query with all lowercase, everything is fine. ex) dig sub.example.co.kr dns.question.name : sub.example.co.kr dns.question.registered… --- ## [The following security realms are not matched across Elasticsearch and stateless resources:](https://discuss.elastic.co/t/the-following-security-realms-are-not-matched-across-elasticsearch-and-stateless-resources/267013)
**Author:** [@MuhammadEzzat](https://discuss.elastic.co/u/MuhammadEzzat)\ **Replies:** 0\ **Last updated:** [March 12, 2021, 1:08am UTC](https://discuss.elastic.co/t/the-following-security-realms-are-not-matched-across-elasticsearch-and-stateless-resources/267013 "2021-03-12T01:08:20Z")
Can't edit deployment from elastic cloud configuration and I always get the following response. The following security realms are not matched across Elasticsearch and stateless resources: --- ## [How to filter a json field in an event?](https://discuss.elastic.co/t/how-to-filter-a-json-field-in-an-event/267007)
**Author:** [@hackercat](https://discuss.elastic.co/u/hackercat)\ **Replies:** 2\ **Last updated:** [March 11, 2021, 11:57pm UTC](https://discuss.elastic.co/t/how-to-filter-a-json-field-in-an-event/267007 "2021-03-11T23:57:26Z")
Hi, I am really new to logstash and was spending quite a few hours working on this but couldn't make any progress so hopefully, someone can point me out in some correct direction. The event eventually in the kabana is l… --- ## [Can I use STMPS in Watcher](https://discuss.elastic.co/t/can-i-use-stmps-in-watcher/267008)
**Author:** [@VeeT](https://discuss.elastic.co/u/VeeT)\ **Replies:** 0\ **Last updated:** [March 11, 2021, 11:36pm UTC](https://discuss.elastic.co/t/can-i-use-stmps-in-watcher/267008 "2021-03-11T23:36:22Z")
Can Elasticsearch Watcher work on SMTPS? --- ## [Filebeat timestamp conversion from PST to EST](https://discuss.elastic.co/t/filebeat-timestamp-conversion-from-pst-to-est/265414)
**Author:** [@mguttula](https://discuss.elastic.co/u/mguttula)\ **Replies:** 4\ **Last updated:** [March 11, 2021, 11:22pm UTC](https://discuss.elastic.co/t/filebeat-timestamp-conversion-from-pst-to-est/265414 "2021-03-11T23:22:44Z")
Input file has PST timestamp like "2020 Feb 12 13:54:07:447 GMT -0800" in a message event like below: 2020 Feb 12 13:54:07:447 GMT -0800 myservice Error \[mybusinessworks\] BWENGINE-100001 process initialization failed fo… --- ## [Packetbeat create pcap file and ingest data](https://discuss.elastic.co/t/packetbeat-create-pcap-file-and-ingest-data/266992)
**Author:** [@andywt123](https://discuss.elastic.co/u/andywt123)\ **Replies:** 1\ **Last updated:** [March 11, 2021, 9:01pm UTC](https://discuss.elastic.co/t/packetbeat-create-pcap-file-and-ingest-data/266992 "2021-03-11T21:01:42Z")
We have a requirement to create and store pcap files for all of our web server traffic. I wanted to find out if anyone has used packetbeat to create pcap files to be store and also ingest the data to be used in dashboard… --- ## [Translate filter dictionary update](https://discuss.elastic.co/t/translate-filter-dictionary-update/267000)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [March 11, 2021, 8:55pm UTC](https://discuss.elastic.co/t/translate-filter-dictionary-update/267000 "2021-03-11T20:55:16Z")
I am using logstash pipeline. one of the job has translate filter. if I change translate dictionary file key-value. do I have to restart logstash? or will it read the dictionary yml file everytime it runs pipeline? --- ## [Mapping, error my normalizer](https://discuss.elastic.co/t/mapping-error-my-normalizer/266995)
**Author:** [@jcornejo](https://discuss.elastic.co/u/jcornejo)\ **Replies:** 5\ **Last updated:** [March 11, 2021, 8:53pm UTC](https://discuss.elastic.co/t/mapping-error-my-normalizer/266995 "2021-03-11T20:53:58Z")
Help, how to create a mapping in elasticsearch ? PUT /sdm\_cr\_nrt/\_mapping { "properties" : { "@timestamp" : { "type" : "date" }, "@version" : { "type" : "text" … --- ## [Help with filtering message based on regex](https://discuss.elastic.co/t/help-with-filtering-message-based-on-regex/266582)
**Author:** [@judge](https://discuss.elastic.co/u/judge)\ **Replies:** 2\ **Last updated:** [March 11, 2021, 7:46pm UTC](https://discuss.elastic.co/t/help-with-filtering-message-based-on-regex/266582 "2021-03-11T19:46:12Z")
Hi, I really need some help with logstash. I a trying to filter messages based on content and send them to an alternative server for example: {"type":"syslog","host":"1.1.1.1","@timestamp":"2021-03-08T13:18:55.722Z","m… --- ## [Filter for value Button in Discovery](https://discuss.elastic.co/t/filter-for-value-button-in-discovery/266807)
**Author:** [@logger](https://discuss.elastic.co/u/logger)\ **Replies:** 3\ **Last updated:** [March 11, 2021, 7:30pm UTC](https://discuss.elastic.co/t/filter-for-value-button-in-discovery/266807 "2021-03-11T19:30:29Z")
Hi there, I have a question about the layout. Is there a way to set the position of the "filter for value" button. Because we upgraded from 7.8.1 to 7.11.1 and now the filtering is quite difficult. We have experienced… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1510) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1512)