# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1520 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1521 --- ## [Stack Monitoring not working with Kubernetes containers](https://discuss.elastic.co/t/stack-monitoring-not-working-with-kubernetes-containers/266421)
**Author:** [@InnerJoin](https://discuss.elastic.co/u/InnerJoin)\ **Replies:** 4\ **Last updated:** [March 7, 2021, 1:38am UTC](https://discuss.elastic.co/t/stack-monitoring-not-working-with-kubernetes-containers/266421 "2021-03-07T01:38:12Z")
Hi all, I'm trying to get stack monitoring working on a cluster that I have deployed for testing in a Kubernetes cluster. I was able to get the old self monitoring to work, but if I try to monitor with metricbeat everyt… --- ## [Journalbeat has no dashboards?](https://discuss.elastic.co/t/journalbeat-has-no-dashboards/266426)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 1\ **Last updated:** [March 6, 2021, 6:28pm UTC](https://discuss.elastic.co/t/journalbeat-has-no-dashboards/266426 "2021-03-06T18:28:36Z")
Hi there, can it be that journalbeats has no predifined dashboards on board? Doing this: /usr/share/journalbeat/bin# ./journalbeat setup -e -c /etc/journalbeat/journalbeat.yml --dashboards I do not get anything in Ki… --- ## [All shards failing error](https://discuss.elastic.co/t/all-shards-failing-error/266303)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 3\ **Last updated:** [March 6, 2021, 11:02pm UTC](https://discuss.elastic.co/t/all-shards-failing-error/266303 "2021-03-06T23:02:55Z")
I am having problems with an application (Arkime) which uses ES to store its data. When it does long searches these time out and on looking at the logs I find errors from ES. The same errors are in the ES logs and I hav… --- ## [Item 381of GeoJSON will not load?](https://discuss.elastic.co/t/item-381of-geojson-will-not-load/266414)
**Author:** [@dshashek](https://discuss.elastic.co/u/dshashek)\ **Replies:** 2\ **Last updated:** [March 6, 2021, 9:57pm UTC](https://discuss.elastic.co/t/item-381of-geojson-will-not-load/266414 "2021-03-06T21:57:47Z")
I do not understand at all what is going on here. I'm trying to load a geojson of congressional districts that I've merged with additional information about each congressman using the geopandas library. Every district … --- ## [Java connection lost](https://discuss.elastic.co/t/java-connection-lost/266454)
**Author:** [@Cosmin\_Ciobanu1](https://discuss.elastic.co/u/Cosmin_Ciobanu1)\ **Replies:** 0\ **Last updated:** [March 6, 2021, 9:06pm UTC](https://discuss.elastic.co/t/java-connection-lost/266454 "2021-03-06T21:06:17Z")
Hi! I'm trying to connect to my Elasticsearch node from Java. I have this code : final CredentialsProvider credentialsProvider = new BasicCredentialsProvider(); credentialsProvider.setCredentials(AuthS… --- ## [Elasticsearch OSS Docker Images](https://discuss.elastic.co/t/elasticsearch-oss-docker-images/266091)
**Author:** [@robinhood\_lko](https://discuss.elastic.co/u/robinhood_lko)\ **Replies:** 4\ **Last updated:** [March 6, 2021, 6:53pm UTC](https://discuss.elastic.co/t/elasticsearch-oss-docker-images/266091 "2021-03-06T18:53:34Z")
Hi All, What is primary difference between Elasticsearch OSS and OSS Snapshot docker images. Any link to document will be very helpful. Thanks. --- ## [Problem with searching and deleting data in Elasticsearch using term and regexp](https://discuss.elastic.co/t/problem-with-searching-and-deleting-data-in-elasticsearch-using-term-and-regexp/266447)
**Author:** [@white\_rabbit](https://discuss.elastic.co/u/white_rabbit)\ **Replies:** 0\ **Last updated:** [March 6, 2021, 2:59pm UTC](https://discuss.elastic.co/t/problem-with-searching-and-deleting-data-in-elasticsearch-using-term-and-regexp/266447 "2021-03-06T14:59:26Z")
I am currently developing a user data analysis platform and have a problem with searching and deleting data in Elasticsearch using term and regexp. I would be very grateful for checking the solutions below and writing so… --- ## [Logstash on Docker ERROR: Failed to read pipelines yaml file. Location: /usr/share/logstash/config/pipelines.yml](https://discuss.elastic.co/t/logstash-on-docker-error-failed-to-read-pipelines-yaml-file-location-usr-share-logstash-config-pipelines-yml/266449)
**Author:** [@20031485](https://discuss.elastic.co/u/20031485)\ **Replies:** 0\ **Last updated:** [March 6, 2021, 4:40pm UTC](https://discuss.elastic.co/t/logstash-on-docker-error-failed-to-read-pipelines-yaml-file-location-usr-share-logstash-config-pipelines-yml/266449 "2021-03-06T16:40:23Z")
Hello! I am facing difficulties trying to configure my ELK stack in which Logstash should be running multiple pipelines, and the problem seems to be in the Logstash docker-compose.yml configuration. In fact, I get the fo… --- ## [Vega Scale Question - static mapping](https://discuss.elastic.co/t/vega-scale-question-static-mapping/266379)
**Author:** [@dandcp](https://discuss.elastic.co/u/dandcp)\ **Replies:** 2\ **Last updated:** [March 6, 2021, 1:31pm UTC](https://discuss.elastic.co/t/vega-scale-question-static-mapping/266379 "2021-03-06T13:31:47Z")
I apologize for the simplicity of this question, but I simply cannot figure it out from the Vega documentation and I suspect it's a simple answer. I have a scatter chart that I've created and one of the things I do is c… --- ## [Do you know how to solve this in logs?](https://discuss.elastic.co/t/do-you-know-how-to-solve-this-in-logs/266321)
**Author:** [@b4yu](https://discuss.elastic.co/u/b4yu)\ **Replies:** 6\ **Last updated:** [March 6, 2021, 9:47am UTC](https://discuss.elastic.co/t/do-you-know-how-to-solve-this-in-logs/266321 "2021-03-06T09:47:21Z")
i got this on kibana logs how to fix it so kibana logs can work? failed to format message from /var/log/suricata/eve.json --- ## [What is elasticsearch best feature to achieve what I need?](https://discuss.elastic.co/t/what-is-elasticsearch-best-feature-to-achieve-what-i-need/266360)
**Author:** [@Nuno\_Oliveira](https://discuss.elastic.co/u/Nuno_Oliveira)\ **Replies:** 3\ **Last updated:** [March 6, 2021, 8:52am UTC](https://discuss.elastic.co/t/what-is-elasticsearch-best-feature-to-achieve-what-i-need/266360 "2021-03-06T08:52:21Z")
Hi, I'm relatively new to elasticsearch and I'm not sure what is the best approach to achieve what I want, but this is what I've been trying: I have a list of dog breeds in an Index and given the input "0293 Corki USA" … --- ## [Optimization for rolling restart without stopping indexing](https://discuss.elastic.co/t/optimization-for-rolling-restart-without-stopping-indexing/266411)
**Author:** [@jthoni](https://discuss.elastic.co/u/jthoni)\ **Replies:** 0\ **Last updated:** [March 5, 2021, 10:30pm UTC](https://discuss.elastic.co/t/optimization-for-rolling-restart-without-stopping-indexing/266411 "2021-03-05T22:30:03Z")
I know the topic of shard allocation during rolling restarts is a well worn path here. When we do node restarts, we: Disable shard allocation Restart the node Once the node comes back online, we reenable allocation Whe… --- ## [The filebeat and logstash connections will be refused](https://discuss.elastic.co/t/the-filebeat-and-logstash-connections-will-be-refused/266094)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 10:15pm UTC](https://discuss.elastic.co/t/the-filebeat-and-logstash-connections-will-be-refused/266094 "2021-03-05T22:15:50Z")
I want filebeat and logstash to communicate with each other to collect multiple log files. I have run the following test command for filebeat, but the connection is refused. What is the reason for this? filebeat -e -c… --- ## [Field aliases in search results](https://discuss.elastic.co/t/field-aliases-in-search-results/266221)
**Author:** [@andreas123](https://discuss.elastic.co/u/andreas123)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 10:10pm UTC](https://discuss.elastic.co/t/field-aliases-in-search-results/266221 "2021-03-05T22:10:19Z")
Hey, we have different suppliers for data that is imported into elastic. The suppliers use different field names, but some of them use the same type of data. Example: Supplier A: last\_seen: 2020\_02\_03 IP: 10.10.10.1… --- ## [Async-search keepalive value](https://discuss.elastic.co/t/async-search-keepalive-value/266314)
**Author:** [@alexpanas](https://discuss.elastic.co/u/alexpanas)\ **Replies:** 9\ **Last updated:** [March 5, 2021, 10:04pm UTC](https://discuss.elastic.co/t/async-search-keepalive-value/266314 "2021-03-05T22:04:30Z")
Hi, As far as I can see from https://www.elastic.co/guide/en/elasticsearch/reference/current/async-search.html - the default keep-alive value for async search is 5 days and is regulated on the query side. This results … --- ## [Need help to update es6 template to es7](https://discuss.elastic.co/t/need-help-to-update-es6-template-to-es7/266409)
**Author:** [@michbsd](https://discuss.elastic.co/u/michbsd)\ **Replies:** 0\ **Last updated:** [March 5, 2021, 9:27pm UTC](https://discuss.elastic.co/t/need-help-to-update-es6-template-to-es7/266409 "2021-03-05T21:27:38Z")
Hi, I have been using varnishstatbeat in the past to ship varnish statistics to Elasticsearch. I am currently in the process of upgrading my cluster to 7.x - and there is no es7 template for the varnishstatbeat project… --- ## [Filebeat and logs with preallocated space](https://discuss.elastic.co/t/filebeat-and-logs-with-preallocated-space/266223)
**Author:** [@111449](https://discuss.elastic.co/u/111449)\ **Replies:** 2\ **Last updated:** [March 5, 2021, 9:06pm UTC](https://discuss.elastic.co/t/filebeat-and-logs-with-preallocated-space/266223 "2021-03-05T21:06:39Z")
Hello! Legacy software I have to use works on Windows and writes a log in the following way: it writes a lot of \\u0000 (NULL) symbols into the end of file to preallocate space and then (when it needs to write a log str… --- ## [Metricbeat v7 on FreeBSD system module / memory not working](https://discuss.elastic.co/t/metricbeat-v7-on-freebsd-system-module-memory-not-working/266390)
**Author:** [@michbsd](https://discuss.elastic.co/u/michbsd)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 8:14pm UTC](https://discuss.elastic.co/t/metricbeat-v7-on-freebsd-system-module-memory-not-working/266390 "2021-03-05T20:14:50Z")
metricbeat version 7.10.1 (amd64), libbeat 7.10.1 \[v7.10.1 built 2021-02-02 03:16:09 +0000 UTC\] Hi, According to the reference (https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-metricset-system-memor… --- ## [Processor for shingles, similar to split?](https://discuss.elastic.co/t/processor-for-shingles-similar-to-split/266254)
**Author:** [@Mark\_Petersen](https://discuss.elastic.co/u/Mark_Petersen)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 7:40pm UTC](https://discuss.elastic.co/t/processor-for-shingles-similar-to-split/266254 "2021-03-05T19:40:02Z")
Is there a processor that will do shingles or can I make a custom one somehow? In the pipeline processor below, I split on the space character, but I'd also like to combine words like a shingle analyzer would: PUT \_ing… --- ## [Index Policies Never Rollover to the Defined Index Life-cycle Policy](https://discuss.elastic.co/t/index-policies-never-rollover-to-the-defined-index-life-cycle-policy/266146)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 10\ **Last updated:** [March 5, 2021, 7:17pm UTC](https://discuss.elastic.co/t/index-policies-never-rollover-to-the-defined-index-life-cycle-policy/266146 "2021-03-05T19:17:25Z")
No matter what how I edit the index policies. The indexes never roll over to Warm tier. My indexes just goes straight from hot to delete. Even though my index policy says the following: PUT \_ilm/policy/filebeat { "po… --- ## [When it is useful to have multiple config files for a single Kibana instance?](https://discuss.elastic.co/t/when-it-is-useful-to-have-multiple-config-files-for-a-single-kibana-instance/266363)
**Author:** [@trex](https://discuss.elastic.co/u/trex)\ **Replies:** 3\ **Last updated:** [March 5, 2021, 7:04pm UTC](https://discuss.elastic.co/t/when-it-is-useful-to-have-multiple-config-files-for-a-single-kibana-instance/266363 "2021-03-05T19:04:58Z")
When is it useful to have multiple config files for a single Kibana instance? $ ./bin/kibana --help -c, --config \ Path to the config file, use multiple --config args to include multiple config files --- ## [Remove/Hide metrics column from DataTable visualization](https://discuss.elastic.co/t/remove-hide-metrics-column-from-datatable-visualization/266403)
**Author:** [@SUMANT\_MISHRA](https://discuss.elastic.co/u/SUMANT_MISHRA)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 6:44pm UTC](https://discuss.elastic.co/t/remove-hide-metrics-column-from-datatable-visualization/266403 "2021-03-05T18:44:34Z")
Hi, I need some help in structuring Datatable visualization so that I can download the CSV without Metrics column. If I try to create a DataTable visualization, it adds Mandatorily "Metrics" column. Business need is to a… --- ## [Ingest pipeline differences with Logstash and Beats](https://discuss.elastic.co/t/ingest-pipeline-differences-with-logstash-and-beats/266302)
**Author:** [@b133](https://discuss.elastic.co/u/b133)\ **Replies:** 2\ **Last updated:** [March 5, 2021, 5:11pm UTC](https://discuss.elastic.co/t/ingest-pipeline-differences-with-logstash-and-beats/266302 "2021-03-05T17:11:27Z")
I want to bifurcate my logs using Logstash. When I sent logs directly from Filebeat to Elasticsearch, the log fields were all properly parsed and converted to appropriate variable types. I have since changed the Filebea… --- ## [Ship logs from filebeat to logstash via NGINX reverse proxy](https://discuss.elastic.co/t/ship-logs-from-filebeat-to-logstash-via-nginx-reverse-proxy/266395)
**Author:** [@ccooper](https://discuss.elastic.co/u/ccooper)\ **Replies:** 0\ **Last updated:** [March 5, 2021, 4:55pm UTC](https://discuss.elastic.co/t/ship-logs-from-filebeat-to-logstash-via-nginx-reverse-proxy/266395 "2021-03-05T16:55:16Z")
My architecture is as follows where only port 80 and 443 are open on the NGINX proxy server: \[filebeat\] -\> \[NGINX - reverse proxy\] -\> \[logstash\] I am attempting to ship logs from filebeat to logstash via an NGINX rever… --- ## [Filebeat logging - ERROR \[logstash\] logstash/async.go:280 Failed to publish events caused by: read tcp](https://discuss.elastic.co/t/filebeat-logging-error-logstash-logstash-async-go-280-failed-to-publish-events-caused-by-read-tcp/266330)
**Author:** [@newmember](https://discuss.elastic.co/u/newmember)\ **Replies:** 2\ **Last updated:** [March 5, 2021, 4:27pm UTC](https://discuss.elastic.co/t/filebeat-logging-error-logstash-logstash-async-go-280-failed-to-publish-events-caused-by-read-tcp/266330 "2021-03-05T16:27:52Z")
I am trying to figure out if these timeouts are a bad thing or just notifications of no consequence. From a cmd I can telnet to 10.10.98.102:5044 and the port opens. There is a cert there that I can see with a cURL. T… --- ## [Logstash - how to parse rsyslog date field from logs message into @timestamp (UTC)](https://discuss.elastic.co/t/logstash-how-to-parse-rsyslog-date-field-from-logs-message-into-timestamp-utc/265897)
**Author:** [@Jenisha\_Ramanathan](https://discuss.elastic.co/u/Jenisha_Ramanathan)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 4:27pm UTC](https://discuss.elastic.co/t/logstash-how-to-parse-rsyslog-date-field-from-logs-message-into-timestamp-utc/265897 "2021-03-05T16:27:40Z")
Hi Team, I am trying to monitor Linux logs with rsyslog and kibana. Able to receive the logs from rsyslog client to rsyslog server and load the data to elastic. Getting the reported time in kibana ( UTC format ) but we … --- ## [S3snssqs - multiline support?](https://discuss.elastic.co/t/s3snssqs-multiline-support/266370)
**Author:** [@justroll](https://discuss.elastic.co/u/justroll)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 4:21pm UTC](https://discuss.elastic.co/t/s3snssqs-multiline-support/266370 "2021-03-05T16:21:33Z")
Hi we are trying to read our log usign s3snssqs ; this all works great but the only thing is when we want to detect multiline logs .. The module doesn't seem to support codec =\> multiline in order to use a pattern mis… --- ## [Configuration for Cisco ASA logs](https://discuss.elastic.co/t/configuration-for-cisco-asa-logs/266258)
**Author:** [@rudraram](https://discuss.elastic.co/u/rudraram)\ **Replies:** 3\ **Last updated:** [March 5, 2021, 4:14pm UTC](https://discuss.elastic.co/t/configuration-for-cisco-asa-logs/266258 "2021-03-05T16:14:56Z")
Hello Team, Can you provide some guidance on how to get Cisco ASA logs to ELK? Documentation here https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-cisco.html doesnt say where to install the filebeat… --- ## [Performing a conditional mutation to circumvent parsing issue](https://discuss.elastic.co/t/performing-a-conditional-mutation-to-circumvent-parsing-issue/266349)
**Author:** [@nectide](https://discuss.elastic.co/u/nectide)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 4:13pm UTC](https://discuss.elastic.co/t/performing-a-conditional-mutation-to-circumvent-parsing-issue/266349 "2021-03-05T16:13:24Z")
Hi, I'm a newcomer to Logstash, so bear with me. My logstash logs are reporting: \[WARN \]\[logstash.outputs.elasticsearch\] Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>nil, :\_index=\>"… --- ## [Kibana multiple user problem](https://discuss.elastic.co/t/kibana-multiple-user-problem/266351)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 4\ **Last updated:** [March 5, 2021, 4:10pm UTC](https://discuss.elastic.co/t/kibana-multiple-user-problem/266351 "2021-03-05T16:10:14Z")
I have setup two users one user is super and other one is non superuser for non superuser i have a custom role for user user2(non superuser) GET /\_security/role/pb\_log { "pb\_log" : { "cluster" : \[ "manage"… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1519) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1521)