# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1530 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1531 --- ## [A question on anomaly detection](https://discuss.elastic.co/t/a-question-on-anomaly-detection/265719)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 4\ **Last updated:** [March 1, 2021, 12:56pm UTC](https://discuss.elastic.co/t/a-question-on-anomaly-detection/265719 "2021-03-01T12:56:06Z")
So we have succeeded in putting in a process which can ingest one line csv logs. Lots of them. Now the next stage is to put in some sort of anomaly detection. However here is the problem I am facing. I am not a domain e… --- ## [Rs.8000.00 withdrawn from ATM using logstash](https://discuss.elastic.co/t/rs-8000-00-withdrawn-from-atm-using-logstash/265778)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 2\ **Last updated:** [March 1, 2021, 12:10pm UTC](https://discuss.elastic.co/t/rs-8000-00-withdrawn-from-atm-using-logstash/265778 "2021-03-01T12:10:19Z")
how to get amount from above sentence and convert into integer. --- ## [Filebeat not considering registry and resending data](https://discuss.elastic.co/t/filebeat-not-considering-registry-and-resending-data/265788)
**Author:** [@gasparuben](https://discuss.elastic.co/u/gasparuben)\ **Replies:** 1\ **Last updated:** [March 1, 2021, 12:00pm UTC](https://discuss.elastic.co/t/filebeat-not-considering-registry-and-resending-data/265788 "2021-03-01T12:00:19Z")
hi, I am running filebeat on a pod in kubernetes. Filebeat has its registry on an external volume, on a CEPHFS cluster, so I dont lose memory of files being sent after each reboot. Some how this is happening and it lo… --- ## [Fields are not populating in the kibana filter](https://discuss.elastic.co/t/fields-are-not-populating-in-the-kibana-filter/265589)
**Author:** [@gobi\_s](https://discuss.elastic.co/u/gobi_s)\ **Replies:** 3\ **Last updated:** [March 1, 2021, 11:38am UTC](https://discuss.elastic.co/t/fields-are-not-populating-in-the-kibana-filter/265589 "2021-03-01T11:38:51Z")
Fields are not populating in the kibana filter. whereas i could see fields in the search. can you pls let me know if I need to add anything. --- ## [How to access data created by Greylog](https://discuss.elastic.co/t/how-to-access-data-created-by-greylog/265786)
**Author:** [@daniel90](https://discuss.elastic.co/u/daniel90)\ **Replies:** 2\ **Last updated:** [March 1, 2021, 11:32am UTC](https://discuss.elastic.co/t/how-to-access-data-created-by-greylog/265786 "2021-03-01T11:32:42Z")
According to I would do a select statement like this: curl -X POST "localhost:9200/\_sql?format=txt&pretty" -H 'Content-Type: application/json' -d' { "query": "SELECT \* FROM greylog\_10" } ' But that gives me an er… --- ## [% calculation doesn't seem correct](https://discuss.elastic.co/t/calculation-doesnt-seem-correct/265590)
**Author:** [@vivekshukla](https://discuss.elastic.co/u/vivekshukla)\ **Replies:** 4\ **Last updated:** [March 1, 2021, 11:27am UTC](https://discuss.elastic.co/t/calculation-doesnt-seem-correct/265590 "2021-03-01T11:27:34Z")
Hi Team, I drew a Metric using TSVB by following the excellent article https://www.elastic.co/blog/how-to-display-data-as-a-percentage-in-kibana-visualizations So far so good. But when I am calculating the % manually,… --- ## [Alerts don't show](https://discuss.elastic.co/t/alerts-dont-show/264835)
**Author:** [@MABN](https://discuss.elastic.co/u/MABN)\ **Replies:** 3\ **Last updated:** [March 1, 2021, 11:03am UTC](https://discuss.elastic.co/t/alerts-dont-show/264835 "2021-03-01T11:03:50Z")
Hi ELK 7.10 single node ( all ELK are installed in one os) I create custom rule but alert does not appear! what should i do? should I config SSL/TLS? I Create API & and add xpack.security.authc.api\_key.enabled & x… --- ## [Kubectl top vs kubernetes.pod.memory.usage.bytes / kubernetes.pod.cpu.usage.nanocores](https://discuss.elastic.co/t/kubectl-top-vs-kubernetes-pod-memory-usage-bytes-kubernetes-pod-cpu-usage-nanocores/265395)
**Author:** [@eeijlar](https://discuss.elastic.co/u/eeijlar)\ **Replies:** 1\ **Last updated:** [March 1, 2021, 10:44am UTC](https://discuss.elastic.co/t/kubectl-top-vs-kubernetes-pod-memory-usage-bytes-kubernetes-pod-cpu-usage-nanocores/265395 "2021-03-01T10:44:32Z")
I am comparing the output of kubectl top with kubernetes.pod.memory.usage.bytes and kubernetes.pod.cpu.usage.nanocores I am looking for a stat which is closest to kubectl top for both memory and cpu. --- ## [Kibana and logstash](https://discuss.elastic.co/t/kibana-and-logstash/265781)
**Author:** [@Gharsa\_Khouloud](https://discuss.elastic.co/u/Gharsa_Khouloud)\ **Replies:** 0\ **Last updated:** [March 1, 2021, 10:42am UTC](https://discuss.elastic.co/t/kibana-and-logstash/265781 "2021-03-01T10:42:59Z")
What is the best way to integrate more than one collection of mongodb into Kibana via Logstash and Elasticsearch . i want to join two or 3 collection from my database and index it in one index to elasticsearch ? --- ## [Elasticsearch Number of Replicas](https://discuss.elastic.co/t/elasticsearch-number-of-replicas/265593)
**Author:** [@dfoot](https://discuss.elastic.co/u/dfoot)\ **Replies:** 2\ **Last updated:** [March 1, 2021, 10:39am UTC](https://discuss.elastic.co/t/elasticsearch-number-of-replicas/265593 "2021-03-01T10:39:18Z")
Elasticsearch only has one node I created template in error e.g. 1 shard (Primary) and 1 replica so I have updated the template for no replica. PUT friday-000012/\_settings {"number\_of\_replicas": 0} I checked the templ… --- ## [Logstash has stopped processing logs suddenly](https://discuss.elastic.co/t/logstash-has-stopped-processing-logs-suddenly/264273)
**Author:** [@amanpradhan](https://discuss.elastic.co/u/amanpradhan)\ **Replies:** 1\ **Last updated:** [March 1, 2021, 10:33am UTC](https://discuss.elastic.co/t/logstash-has-stopped-processing-logs-suddenly/264273 "2021-03-01T10:33:12Z")
Hi Everyone, My logstash stopped processing logs all of sudden when i checked in kibana one day. I did not make any changes in any config and it was working earlier from past one year. Now it is giving below error At… --- ## [Logstash parsing json](https://discuss.elastic.co/t/logstash-parsing-json/265163)
**Author:** [@ali\_ghorbani](https://discuss.elastic.co/u/ali_ghorbani)\ **Replies:** 8\ **Last updated:** [March 1, 2021, 10:23am UTC](https://discuss.elastic.co/t/logstash-parsing-json/265163 "2021-03-01T10:23:51Z")
I am trying to use log-stash to read input file 1.log in JSON format and write on elasticsearch. This is my log file: {"key":"value00"} {"key":"value01"} {"key1":\[{"key2":"value02"},{"key3":"value03"},{"key4":\[{"key5":"… --- ## [Will kibana ocuupy storage when index patterns saved searches are created](https://discuss.elastic.co/t/will-kibana-ocuupy-storage-when-index-patterns-saved-searches-are-created/265760)
**Author:** [@sagar\_rao](https://discuss.elastic.co/u/sagar_rao)\ **Replies:** 1\ **Last updated:** [March 1, 2021, 10:20am UTC](https://discuss.elastic.co/t/will-kibana-ocuupy-storage-when-index-patterns-saved-searches-are-created/265760 "2021-03-01T10:20:22Z")
I have data in my elastic search. when i create index patterns in kibana will those patterns occupy storage space again? --- ## [Metricbeat Kibana Dashboard Request Time-out when there is a Virtual IP in the VM being monitored](https://discuss.elastic.co/t/metricbeat-kibana-dashboard-request-time-out-when-there-is-a-virtual-ip-in-the-vm-being-monitored/265775)
**Author:** [@thesn](https://discuss.elastic.co/u/thesn)\ **Replies:** 0\ **Last updated:** [March 1, 2021, 10:19am UTC](https://discuss.elastic.co/t/metricbeat-kibana-dashboard-request-time-out-when-there-is-a-virtual-ip-in-the-vm-being-monitored/265775 "2021-03-01T10:19:27Z")
hi, I have ES 7.11.1 and Kibana 7.11.1 setup in docker container (10.6.226.80) using docker-compose in a Linux VM. Also, I have Metricbeat 7.11.1 setup in docker container (10.6.226.104) using docker-compose in a Linux… --- ## [Extract certain values from Url.Query field](https://discuss.elastic.co/t/extract-certain-values-from-url-query-field/265633)
**Author:** [@jamesm1](https://discuss.elastic.co/u/jamesm1)\ **Replies:** 1\ **Last updated:** [March 1, 2021, 9:49am UTC](https://discuss.elastic.co/t/extract-certain-values-from-url-query-field/265633 "2021-03-01T09:49:52Z")
I currently have a Fleet module set up to ingest IIS logs into Kibana. Within the logs they contain the filed URL.Query, which holds alot of information. What i would like to do is to turn all of the parameters inside … --- ## [Dev Tools Throwing Storage Quota Error](https://discuss.elastic.co/t/dev-tools-throwing-storage-quota-error/265693)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [March 1, 2021, 9:36am UTC](https://discuss.elastic.co/t/dev-tools-throwing-storage-quota-error/265693 "2021-03-01T09:36:41Z")
Hello, Got the following error while working in Dev Tools Kibana 7.10.2: Error: Failed to execute 'setItem' on 'Storage': Setting the value of 'sense:hist\_elem\_1614440073476' exceeded the quota. at Storage.set (htt… --- ## [Date range as metric](https://discuss.elastic.co/t/date-range-as-metric/265675)
**Author:** [@sramya](https://discuss.elastic.co/u/sramya)\ **Replies:** 1\ **Last updated:** [March 1, 2021, 9:30am UTC](https://discuss.elastic.co/t/date-range-as-metric/265675 "2021-03-01T09:30:52Z")
I am new to Kibana and want to know if this is possible. My app makes service calls and many times it gets zero transactions and a few times it receives transactions. I want to create a table that may look like this S… --- ## [Kibana Dev Tools Console Broken v7.11](https://discuss.elastic.co/t/kibana-dev-tools-console-broken-v7-11/265732)
**Author:** [@Cesidio\_DiBenedetto](https://discuss.elastic.co/u/Cesidio_DiBenedetto)\ **Replies:** 1\ **Last updated:** [March 1, 2021, 9:28am UTC](https://discuss.elastic.co/t/kibana-dev-tools-console-broken-v7-11/265732 "2021-03-01T09:28:13Z")
Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-xxxxxxx'), or a nonce ('nonce-.… --- ## [Wrapped Facet in vega](https://discuss.elastic.co/t/wrapped-facet-in-vega/265601)
**Author:** [@Pranusha119](https://discuss.elastic.co/u/Pranusha119)\ **Replies:** 2\ **Last updated:** [March 1, 2021, 8:19am UTC](https://discuss.elastic.co/t/wrapped-facet-in-vega/265601 "2021-03-01T08:19:22Z")
Hello, I have used facet as well as layer in below code, I tried to limit no. of columns to 2 but it wasn't working. { "$schema": "https://vega.github.io/schema/vega-lite/v5.json", "name": "trellis\_barley", "desc… --- ## [Selecting "file" in logstash input does not send to elasticsearch](https://discuss.elastic.co/t/selecting-file-in-logstash-input-does-not-send-to-elasticsearch/265602)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 8\ **Last updated:** [March 1, 2021, 8:04am UTC](https://discuss.elastic.co/t/selecting-file-in-logstash-input-does-not-send-to-elasticsearch/265602 "2021-03-01T08:04:24Z")
I am trying to send log files from logstash to elasticsearch. I have completed the whole setup and the test to send the standard input to elasticsearch has passed. Now, I want to send the file to elasticsearch by speci… --- ## [Elastalert module error](https://discuss.elastic.co/t/elastalert-module-error/265723)
**Author:** [@Sarmad](https://discuss.elastic.co/u/Sarmad)\ **Replies:** 2\ **Last updated:** [March 1, 2021, 7:16am UTC](https://discuss.elastic.co/t/elastalert-module-error/265723 "2021-03-01T07:16:52Z")
Hi, I am trying to setup elastalert on Amazon Linux ami but getting this screenshot error when I run elastalert python3 -m elastalert.elastalert --verbose --rule example\_rules/example\_frequency.yaml I have tried wit… --- ## [Data loss in bulk update for field type date using painless script](https://discuss.elastic.co/t/data-loss-in-bulk-update-for-field-type-date-using-painless-script/265761)
**Author:** [@Manjunath\_Kadrolli](https://discuss.elastic.co/u/Manjunath_Kadrolli)\ **Replies:** 0\ **Last updated:** [March 1, 2021, 7:16am UTC](https://discuss.elastic.co/t/data-loss-in-bulk-update-for-field-type-date-using-painless-script/265761 "2021-03-01T07:16:01Z")
Following is a row from my bulk update http body When i run the same for small set of records (100) the same works fine but if i trigger the for the entire DB the the valueTimestamp field always null where other values … --- ## [How to configure ingest pipeline with filebeat to send filtered data to elastic search](https://discuss.elastic.co/t/how-to-configure-ingest-pipeline-with-filebeat-to-send-filtered-data-to-elastic-search/265755)
**Author:** [@chintu1411](https://discuss.elastic.co/u/chintu1411)\ **Replies:** 0\ **Last updated:** [March 1, 2021, 6:51am UTC](https://discuss.elastic.co/t/how-to-configure-ingest-pipeline-with-filebeat-to-send-filtered-data-to-elastic-search/265755 "2021-03-01T06:51:24Z")
Hi All, this is very first time we are using ELK with filebeat. we have been instructed to use ingest pipeline to use it with filebeat to filter the data. all over the internet and elastic.co only its given how to wri… --- ## [Kibana 7.11 problems with spaces and roles -](https://discuss.elastic.co/t/kibana-7-11-problems-with-spaces-and-roles/265679)
**Author:** [@byteandbit](https://discuss.elastic.co/u/byteandbit)\ **Replies:** 13\ **Last updated:** [March 1, 2021, 6:48am UTC](https://discuss.elastic.co/t/kibana-7-11-problems-with-spaces-and-roles/265679 "2021-03-01T06:48:19Z")
Hello, We have created a new space just for read only user to access - Visibility in Analytics-\>Dashboard, Discover and Visualise. Then we created a new role within new space only, with read only privileges again fo… --- ## [Controls visualization filter uses the default index pattern](https://discuss.elastic.co/t/controls-visualization-filter-uses-the-default-index-pattern/265553)
**Author:** [@yash\_gupta](https://discuss.elastic.co/u/yash_gupta)\ **Replies:** 2\ **Last updated:** [March 1, 2021, 6:30am UTC](https://discuss.elastic.co/t/controls-visualization-filter-uses-the-default-index-pattern/265553 "2021-03-01T06:30:45Z")
Hi, I did end up in this situation where the filter uses default index and no option to change it. I also know that this is an known defect and just wanted to check if we have any resolution or work around for this ? de… --- ## [Elasticsearch IOPS](https://discuss.elastic.co/t/elasticsearch-iops/265680)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 10\ **Last updated:** [March 1, 2021, 6:10am UTC](https://discuss.elastic.co/t/elasticsearch-iops/265680 "2021-03-01T06:10:15Z")
Hello Team I am having Elasticsearch version 5.6.3 running on RHEL 7.4. This Cluster is of 10 nodes. Hardware : 8 CPU and 32 GB RAM. Hard Disk : HDD { CEPH Storage } Elastic Data Paths : Multiple { 7 Different mount … --- ## [CPU running high only on one node at time in the ES cluster](https://discuss.elastic.co/t/cpu-running-high-only-on-one-node-at-time-in-the-es-cluster/265708)
**Author:** [@sbk-elk](https://discuss.elastic.co/u/sbk-elk)\ **Replies:** 5\ **Last updated:** [March 1, 2021, 5:03am UTC](https://discuss.elastic.co/t/cpu-running-high-only-on-one-node-at-time-in-the-es-cluster/265708 "2021-03-01T05:03:53Z")
Not sure why only one node in the cluster has such high CPU when there is nothing happening in the cluster. top - 00:34:43 up 137 days, 17:43, 1 user, load average: 1.24, 2.14, 3.15 Tasks: 198 total, 1 running, 197 … --- ## [How to stop logstash to not creating multiple conf.save file](https://discuss.elastic.co/t/how-to-stop-logstash-to-not-creating-multiple-conf-save-file/265747)
**Author:** [@asan](https://discuss.elastic.co/u/asan)\ **Replies:** 1\ **Last updated:** [March 1, 2021, 4:55am UTC](https://discuss.elastic.co/t/how-to-stop-logstash-to-not-creating-multiple-conf-save-file/265747 "2021-03-01T04:55:13Z")
Hi Recently i configured logstsh for parsing my mikrotik and fortigate log and they are working correctly but in conf.d logstsh started to create multiple conf.save like : mikrotik.conf.save.1, mikrotik.conf.save.2, m… --- ## [Elastic Stack alerting now generally available](https://discuss.elastic.co/t/elastic-stack-alerting-now-generally-available/265714)
**Author:** [@arp220](https://discuss.elastic.co/u/arp220)\ **Replies:** 1\ **Last updated:** [February 28, 2021, 4:33pm UTC](https://discuss.elastic.co/t/elastic-stack-alerting-now-generally-available/265714 "2021-02-28T16:33:09Z")
Hello. I use elasticsearch and kibana 7.11.1 but alerting slack and webhook and etc, They are not activatedfor me. . I have to do something special? thanks. --- ## [ILM how to delete index after days](https://discuss.elastic.co/t/ilm-how-to-delete-index-after-days/265490)
**Author:** [@thewasta](https://discuss.elastic.co/u/thewasta)\ **Replies:** 3\ **Last updated:** [March 1, 2021, 12:09am UTC](https://discuss.elastic.co/t/ilm-how-to-delete-index-after-days/265490 "2021-03-01T00:09:39Z")
My Enviroment { "name" : "5D776AA", "cluster\_name" : "rust-cluster", "cluster\_uuid" : "unlQZ9RcTTy34WDJkHZ1wA", "version" : { "number" : "7.10.2", "build\_flavor" : "default", "build\_type" : "deb", … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1529) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1531)