# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1513 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1514 --- ## [Logstash - Nested fields?](https://discuss.elastic.co/t/logstash-nested-fields/266851)
**Author:** [@SaraC](https://discuss.elastic.co/u/SaraC)\ **Replies:** 6\ **Last updated:** [March 11, 2021, 10:51am UTC](https://discuss.elastic.co/t/logstash-nested-fields/266851 "2021-03-11T10:51:20Z")
Hi, I have the following sample of log: { "@timestamp": "2021-03-10T17:30:58.899Z", "@version": "1", "Actor": \[ { "ID": "Microsoft Intune", "Type": 1 }, { … --- ## [New template doesn't works Geoip](https://discuss.elastic.co/t/new-template-doesnt-works-geoip/266801)
**Author:** [@hoff](https://discuss.elastic.co/u/hoff)\ **Replies:** 5\ **Last updated:** [March 11, 2021, 9:25am UTC](https://discuss.elastic.co/t/new-template-doesnt-works-geoip/266801 "2021-03-11T09:25:04Z")
Hi, I need to create geoip map but in my mapping field location is float type. I have some issue with create new template. I want to change field type from float to geo\_point. When I try to put new template and delete o… --- ## [Recursive search query for all leaf nodes(childs)](https://discuss.elastic.co/t/recursive-search-query-for-all-leaf-nodes-childs/266791)
**Author:** [@Paresh\_Vaniya](https://discuss.elastic.co/u/Paresh_Vaniya)\ **Replies:** 1\ **Last updated:** [March 11, 2021, 10:35am UTC](https://discuss.elastic.co/t/recursive-search-query-for-all-leaf-nodes-childs/266791 "2021-03-11T10:35:04Z")
Hi All, I need help for getting all the leaf nodes details using elasticsearch query. If I have search for root node id and it contains childEntities then it should get all the child id and its name in result. I have t… --- ## [Graph Relations not displayed](https://discuss.elastic.co/t/graph-relations-not-displayed/266775)
**Author:** [@Pruthvi\_Raj\_Venkates](https://discuss.elastic.co/u/Pruthvi_Raj_Venkates)\ **Replies:** 2\ **Last updated:** [March 11, 2021, 10:27am UTC](https://discuss.elastic.co/t/graph-relations-not-displayed/266775 "2021-03-11T10:27:26Z")
Hi Team, I have installed Elastic Search elasticsearch-7.11.1 and Kibana on Windows 10 machine. I was exploring graph functionality using a Trial license wherein I am trying to view the relationships among the different… --- ## [Different ILM alias based on fields like indeces](https://discuss.elastic.co/t/different-ilm-alias-based-on-fields-like-indeces/266919)
**Author:** [@abev](https://discuss.elastic.co/u/abev)\ **Replies:** 0\ **Last updated:** [March 11, 2021, 10:13am UTC](https://discuss.elastic.co/t/different-ilm-alias-based-on-fields-like-indeces/266919 "2021-03-11T10:13:42Z")
hey guys, I’m trying to send different logs to different ILM aliases I’ve found it here for indexes: https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html#indices-option-es and here for ILM: h… --- ## [How to remove custom metadata fields from users and roles](https://discuss.elastic.co/t/how-to-remove-custom-metadata-fields-from-users-and-roles/266646)
**Author:** [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\ **Replies:** 5\ **Last updated:** [March 11, 2021, 9:17am UTC](https://discuss.elastic.co/t/how-to-remove-custom-metadata-fields-from-users-and-roles/266646 "2021-03-11T09:17:35Z")
Hi, I am running a 7.10 Stack with Security enabled and I am currently playing around with the ElasticSearch REST API for creating users, roles and so on. The usecase here is to add advanced information to the security … --- ## [Elastic Cloud SaaS on AWS](https://discuss.elastic.co/t/elastic-cloud-saas-on-aws/266899)
**Author:** [@AJ18](https://discuss.elastic.co/u/AJ18)\ **Replies:** 3\ **Last updated:** [March 11, 2021, 9:03am UTC](https://discuss.elastic.co/t/elastic-cloud-saas-on-aws/266899 "2021-03-11T09:03:45Z")
Are all features of ELK+ Beats in Elastic Cloud available in the SaaS cloud solution on AWS? Is Elastic Agent supported by Elastic SaaS cloud solution? --- ## [Drop kubernetes metadata](https://discuss.elastic.co/t/drop-kubernetes-metadata/266885)
**Author:** [@Nurlan199206](https://discuss.elastic.co/u/Nurlan199206)\ **Replies:** 0\ **Last updated:** [March 11, 2021, 5:52am UTC](https://discuss.elastic.co/t/drop-kubernetes-metadata/266885 "2021-03-11T05:52:42Z")
i'm trying drop some unneccesary fields, but i still see metadata i follow this docs: https://www.elastic.co/guide/en/beats/filebeat/current/drop-fields.html "ecs": { "version": "1.1.0" }, "host": { … --- ## [Getting Alerts and Actions to work](https://discuss.elastic.co/t/getting-alerts-and-actions-to-work/266086)
**Author:** [@Ilai\_Velocity](https://discuss.elastic.co/u/Ilai_Velocity)\ **Replies:** 3\ **Last updated:** [March 11, 2021, 8:37am UTC](https://discuss.elastic.co/t/getting-alerts-and-actions-to-work/266086 "2021-03-11T08:37:49Z")
Hey guys, I got a few questions that I encountered when trying to setup alerts and actions. We're on the Elasticsearch as a Service (Managed) solution. Question 1 - I'm following https://www.elastic.co/guide/en/kiban… --- ## [Filebeat low throughput and slow log files read](https://discuss.elastic.co/t/filebeat-low-throughput-and-slow-log-files-read/266905)
**Author:** [@aksadvance](https://discuss.elastic.co/u/aksadvance)\ **Replies:** 0\ **Last updated:** [March 11, 2021, 8:31am UTC](https://discuss.elastic.co/t/filebeat-low-throughput-and-slow-log-files-read/266905 "2021-03-11T08:31:46Z")
Filebeat log transfer latency We have observed the high latency on Filebeat while publishing the logs to Logstash, this latency is more than 2 hours. We are using the below setup for log transfer. Filebeat (11 nodes) -\>… --- ## [Elastic 7.10.2: no way to automatically create the first index. Manually kickstart ILM still mandatory?](https://discuss.elastic.co/t/elastic-7-10-2-no-way-to-automatically-create-the-first-index-manually-kickstart-ilm-still-mandatory/266811)
**Author:** [@ORich](https://discuss.elastic.co/u/ORich)\ **Replies:** 1\ **Last updated:** [March 11, 2021, 8:30am UTC](https://discuss.elastic.co/t/elastic-7-10-2-no-way-to-automatically-create-the-first-index-manually-kickstart-ilm-still-mandatory/266811 "2021-03-11T08:30:21Z")
Dear experts, I am running Elastic 7.10.2. I would like to manage a first index with syntax filebeat-7.10.2-postfix-2021.03.10-000001. Thanks to ILM rollover mechanism next one would be filebeat-7.10.2-postfix-2021.03.1… --- ## [Can't find Logstash /bin directory](https://discuss.elastic.co/t/cant-find-logstash-bin-directory/266902)
**Author:** [@Muhammad\_Suleman](https://discuss.elastic.co/u/Muhammad_Suleman)\ **Replies:** 0\ **Last updated:** [March 11, 2021, 8:06am UTC](https://discuss.elastic.co/t/cant-find-logstash-bin-directory/266902 "2021-03-11T08:06:22Z")
I did install my ElK stack with the help of docker compose on my bare metal window server 2019. I can't find my logstash bin directory for running my logstash. Thanks, --- ## [Raw message output](https://discuss.elastic.co/t/raw-message-output/266895)
**Author:** [@st1988](https://discuss.elastic.co/u/st1988)\ **Replies:** 0\ **Last updated:** [March 11, 2021, 7:21am UTC](https://discuss.elastic.co/t/raw-message-output/266895 "2021-03-11T07:21:22Z")
Hi, I currently have an issue where I am sending Syslog to Logstash and then forwarding to ELK and via syslog to a SIEM. The SIEM however is struggling to understand the log as think it is being sent in a format its not … --- ## [Create user role with Kibana visualization permissions](https://discuss.elastic.co/t/create-user-role-with-kibana-visualization-permissions/266125)
**Author:** [@Chinmaya\_Panigrahi](https://discuss.elastic.co/u/Chinmaya_Panigrahi)\ **Replies:** 2\ **Last updated:** [March 11, 2021, 7:03am UTC](https://discuss.elastic.co/t/create-user-role-with-kibana-visualization-permissions/266125 "2021-03-11T07:03:09Z")
Hi, I want to create a user with role which will have permission to access certain visualizations of certain dashboards. I want to know what should be the cURL command to achieve this. --- ## [Elasticsearch stopped working on kubernetes](https://discuss.elastic.co/t/elasticsearch-stopped-working-on-kubernetes/266891)
**Author:** [@Naomi](https://discuss.elastic.co/u/Naomi)\ **Replies:** 0\ **Last updated:** [March 11, 2021, 6:35am UTC](https://discuss.elastic.co/t/elasticsearch-stopped-working-on-kubernetes/266891 "2021-03-11T06:35:05Z")
I have an elastic cluster on kubernetes. containing 3 master pods 2 data pods and 2 clients. everything worked fine until I installed it on environment which containing 6 kubenrtes nodes 3 Master and 3 none. now I keep g… --- ## [Control DropDown in Kibana](https://discuss.elastic.co/t/control-dropdown-in-kibana/266769)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 2\ **Last updated:** [March 11, 2021, 5:21am UTC](https://discuss.elastic.co/t/control-dropdown-in-kibana/266769 "2021-03-11T05:21:51Z")
I am not getting month-day. Month August and Total days 31 but I am only getting random 5 days. --- ## [Week over Week Percentage Change for Metric Field](https://discuss.elastic.co/t/week-over-week-percentage-change-for-metric-field/266810)
**Author:** [@Rakesh\_Rayabarapu](https://discuss.elastic.co/u/Rakesh_Rayabarapu)\ **Replies:** 2\ **Last updated:** [March 11, 2021, 5:06am UTC](https://discuss.elastic.co/t/week-over-week-percentage-change-for-metric-field/266810 "2021-03-11T05:06:42Z")
Hello Team, Please help me to get Table visualization with Category Field, Current Week Metric, Previous Week, % change as columns. --- ## [Installing logstash-output-kusto plugin thru logstash container deployment](https://discuss.elastic.co/t/installing-logstash-output-kusto-plugin-thru-logstash-container-deployment/266684)
**Author:** [@omkarg81](https://discuss.elastic.co/u/omkarg81)\ **Replies:** 1\ **Last updated:** [March 11, 2021, 3:47am UTC](https://discuss.elastic.co/t/installing-logstash-output-kusto-plugin-thru-logstash-container-deployment/266684 "2021-03-11T03:47:26Z")
Could someone please provide guidance on how we can install additional plugins like logstash-output-kusto using a command like bin/logstash-plugin install logstash-output-kusto inside a logstash container? Any example c… --- ## [Filebeat 7.10.1 and 7.11.0 not able to send the logs from windows servers to logstash and getting stuck at \[Api Webserver\] agent - Successfully started Logstash API endpoint {:port=\>9600}](https://discuss.elastic.co/t/filebeat-7-10-1-and-7-11-0-not-able-to-send-the-logs-from-windows-servers-to-logstash-and-getting-stuck-at-api-webserver-agent-successfully-started-logstash-api-endpoint-port-9600/266420)
**Author:** [@Patr123](https://discuss.elastic.co/u/Patr123)\ **Replies:** 8\ **Last updated:** [March 11, 2021, 3:06am UTC](https://discuss.elastic.co/t/filebeat-7-10-1-and-7-11-0-not-able-to-send-the-logs-from-windows-servers-to-logstash-and-getting-stuck-at-api-webserver-agent-successfully-started-logstash-api-endpoint-port-9600/266420 "2021-03-11T03:06:26Z")
I installed filebeat v7.10.1 on a windows 2016 server. I am trying to send a log file from that server to logstash server and I am using the beats plugin to parse the data. When I am running the beats config file it get… --- ## [Missing columns in Kibana generated CSV](https://discuss.elastic.co/t/missing-columns-in-kibana-generated-csv/266865)
**Author:** [@noah.solomon](https://discuss.elastic.co/u/noah.solomon)\ **Replies:** 4\ **Last updated:** [March 11, 2021, 12:52am UTC](https://discuss.elastic.co/t/missing-columns-in-kibana-generated-csv/266865 "2021-03-11T00:52:56Z")
Hi, I'm using Kibana 7.10. I'm generating a CSV from a saved search in the Kibana UI. The generated CSV doesn't contain all of the columns that are in the index that I'm viewing. The columns that are added to the CSV ar… --- ## [Grok... is it just me or is it really that difficult?](https://discuss.elastic.co/t/grok-is-it-just-me-or-is-it-really-that-difficult/266872)
**Author:** [@louis12356](https://discuss.elastic.co/u/louis12356)\ **Replies:** 0\ **Last updated:** [March 11, 2021, 12:15am UTC](https://discuss.elastic.co/t/grok-is-it-just-me-or-is-it-really-that-difficult/266872 "2021-03-11T00:15:50Z")
Hey, for some days now i try to figure out how to properly use grok to filter my logfiles. I use the classic? setup with filebeat as the input of logstash and elasticsearch and kibana for visualizing. So far i managed… --- ## [Color each individual column in vega](https://discuss.elastic.co/t/color-each-individual-column-in-vega/266863)
**Author:** [@bab](https://discuss.elastic.co/u/bab)\ **Replies:** 1\ **Last updated:** [March 10, 2021, 11:07pm UTC](https://discuss.elastic.co/t/color-each-individual-column-in-vega/266863 "2021-03-10T23:07:58Z")
Hi Vega experts, i need help on coloring my Vega Chart, i have a chart with multi series duration and i want to give each column a different color, i mean for example start1 to end1 color blue, start2 to end2 color red a… --- ## [ES7 Multiply scores from boolean queries](https://discuss.elastic.co/t/es7-multiply-scores-from-boolean-queries/266130)
**Author:** [@JF2018](https://discuss.elastic.co/u/JF2018)\ **Replies:** 4\ **Last updated:** [March 10, 2021, 10:31pm UTC](https://discuss.elastic.co/t/es7-multiply-scores-from-boolean-queries/266130 "2021-03-10T22:31:11Z")
Hey Is it possible in some way to multiply the scores of two boolean queries? I now BoolQuery.Should can add the scores together, but not multiply. Another possibility is function scores, but here I can only provide a… --- ## [Call Elasticsearch service without exposing sensitive data in the client-side](https://discuss.elastic.co/t/call-elasticsearch-service-without-exposing-sensitive-data-in-the-client-side/266862)
**Author:** [@koyassan](https://discuss.elastic.co/u/koyassan)\ **Replies:** 3\ **Last updated:** [March 10, 2021, 10:27pm UTC](https://discuss.elastic.co/t/call-elasticsearch-service-without-exposing-sensitive-data-in-the-client-side/266862 "2021-03-10T22:27:35Z")
Hey guys, I've being playing with Kibana Plugins. Now I need to migrate one of my plugins from the Legacy to the Platform API, but I'm facing some problems when trying to made some Elasticsearch requests without exposit… --- ## [Metricbeat doesn't recognize the process](https://discuss.elastic.co/t/metricbeat-doesnt-recognize-the-process/263176)
**Author:** [@xyz2](https://discuss.elastic.co/u/xyz2)\ **Replies:** 8\ **Last updated:** [March 10, 2021, 9:51pm UTC](https://discuss.elastic.co/t/metricbeat-doesnt-recognize-the-process/263176 "2021-03-10T21:51:10Z")
HI, I have configured metricbeat to check the process status. I have noticed that it doesn't get the process info sometimes even if the process was running. It is possible that the process was not active some times bu… --- ## [Single Value Visualization w/ Trend line](https://discuss.elastic.co/t/single-value-visualization-w-trend-line/266858)
**Author:** [@azulgrana](https://discuss.elastic.co/u/azulgrana)\ **Replies:** 2\ **Last updated:** [March 10, 2021, 8:41pm UTC](https://discuss.elastic.co/t/single-value-visualization-w-trend-line/266858 "2021-03-10T20:41:42Z")
Hi there, Is it possible to generate a single value visualization w/ a trendline like Splunk does? see picture below TIA! Azulgrana --- ## [\[publisher\_pipeline\_output\] pipeline /output.go:154 Failed to connect to backoff(async(tcp://logstash-xxx-xxx.apps.-xxx.xxx:443)): EOF](https://discuss.elastic.co/t/publisher-pipeline-output-pipeline-output-go-154-failed-to-connect-to-backoff-async-tcp-logstash-xxx-xxx-apps-xxx-xxx-443-eof/266451)
**Author:** [@Rohan-boogeyman](https://discuss.elastic.co/u/Rohan-boogeyman)\ **Replies:** 13\ **Last updated:** [March 10, 2021, 7:42pm UTC](https://discuss.elastic.co/t/publisher-pipeline-output-pipeline-output-go-154-failed-to-connect-to-backoff-async-tcp-logstash-xxx-xxx-apps-xxx-xxx-443-eof/266451 "2021-03-10T19:42:50Z")
Hello Guys, Thanks in advance for taking your time to look into the issue i am experiencing. Error in File beat at the time of Debug \[publisher\_pipeline\_output\] pipeline /output.go:154 Failed to connect to backof… --- ## [Create field form file name](https://discuss.elastic.co/t/create-field-form-file-name/266846)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 2\ **Last updated:** [March 10, 2021, 7:01pm UTC](https://discuss.elastic.co/t/create-field-form-file-name/266846 "2021-03-10T19:01:47Z")
Hi, Note: Running ELK 7.10.1 I am trying to generate a new field using Grok, by extracting data from the file name. File name comes from "path". path =\> "/opt/app\_logs/\*.log" Example: ip\_block-hgTest.Dev1test-2021-… --- ## [How to detect network scan using EQL](https://discuss.elastic.co/t/how-to-detect-network-scan-using-eql/266466)
**Author:** [@msszafar](https://discuss.elastic.co/u/msszafar)\ **Replies:** 4\ **Last updated:** [March 10, 2021, 6:34pm UTC](https://discuss.elastic.co/t/how-to-detect-network-scan-using-eql/266466 "2021-03-10T18:34:00Z")
Hi All, Can anyone please help me setting up a simple correlation rule using EQL that detect if same source.ip attempts more than 50 destination.ip within 15 minutes. I'm unable to write EQL. I've fortigate logs, my c… --- ## [Popover not working properly in v7.9.3](https://discuss.elastic.co/t/popover-not-working-properly-in-v7-9-3/265842)
**Author:** [@kbujold\_wr](https://discuss.elastic.co/u/kbujold_wr)\ **Replies:** 2\ **Last updated:** [March 10, 2021, 6:31pm UTC](https://discuss.elastic.co/t/popover-not-working-properly-in-v7-9-3/265842 "2021-03-10T18:31:15Z")
Hi, I recently upgrade from ES 7.6.0 to 7.9.3. I now have a weird behavior where a Popover click clears my Chart. I pass LineSeries into the Chart as {children}. It appears the children gets cleared I have no idea why. … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1512) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1514)