# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1561 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1562 --- ## [How to configure Auditbeat to panic the kernel if auditing fails](https://discuss.elastic.co/t/how-to-configure-auditbeat-to-panic-the-kernel-if-auditing-fails/263919)
**Author:** [@RLPowellJr](https://discuss.elastic.co/u/RLPowellJr)\ **Replies:** 0\ **Last updated:** [February 10, 2021, 6:34pm UTC](https://discuss.elastic.co/t/how-to-configure-auditbeat-to-panic-the-kernel-if-auditing-fails/263919 "2021-02-10T18:34:30Z")
Greetings all! We have a small Elastic Stack used for security-relevant event collection in a standalone Red Hat Enterprise Linux 7.4 & 7.6 modeling & simulation enclave. The Stack is just four Elasticsearch nodes, a K… --- ## [How to create a Vega bar graph with the unique count of devices?](https://discuss.elastic.co/t/how-to-create-a-vega-bar-graph-with-the-unique-count-of-devices/263447)
**Author:** [@Chris6](https://discuss.elastic.co/u/Chris6)\ **Replies:** 14\ **Last updated:** [February 10, 2021, 6:30pm UTC](https://discuss.elastic.co/t/how-to-create-a-vega-bar-graph-with-the-unique-count-of-devices/263447 "2021-02-10T18:30:37Z")
Hello, I have some events that where created: In file 1: {"souceNetwork":"cc567", "sourceDevice":"z01", "destinationNetwork":"cc567", "destinationDevice":"z02", "path":"/user/file1"} {"sourceNetwork":"cc567", "source… --- ## [Is it possible to split a logstash file output into a random number of output files for throughput reasons?](https://discuss.elastic.co/t/is-it-possible-to-split-a-logstash-file-output-into-a-random-number-of-output-files-for-throughput-reasons/263909)
**Author:** [@jethropickering](https://discuss.elastic.co/u/jethropickering)\ **Replies:** 1\ **Last updated:** [February 10, 2021, 6:22pm UTC](https://discuss.elastic.co/t/is-it-possible-to-split-a-logstash-file-output-into-a-random-number-of-output-files-for-throughput-reasons/263909 "2021-02-10T18:22:24Z")
Hi all. We are writing to file at about 5000-20000 eps at times. logstash is able to do this fine. The reason we need to write to file and not an endpoint is because of a custom solution(that can't be changed) that read… --- ## [Update index with static value instead of scripted field](https://discuss.elastic.co/t/update-index-with-static-value-instead-of-scripted-field/263890)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 2\ **Last updated:** [February 10, 2021, 4:45pm UTC](https://discuss.elastic.co/t/update-index-with-static-value-instead-of-scripted-field/263890 "2021-02-10T16:45:49Z")
I have a scripted field generating the hour of the day in a particular index. Unfortunately due to the size and the necessary complexity (result of timezone challenges), it is making some Kibana visualizations slow. Us… --- ## [AWS Cloudwatch Metricset module and Cloudwatch Input Plugin - logstash](https://discuss.elastic.co/t/aws-cloudwatch-metricset-module-and-cloudwatch-input-plugin-logstash/263877)
**Author:** [@Priyank07](https://discuss.elastic.co/u/Priyank07)\ **Replies:** 2\ **Last updated:** [February 10, 2021, 4:34pm UTC](https://discuss.elastic.co/t/aws-cloudwatch-metricset-module-and-cloudwatch-input-plugin-logstash/263877 "2021-02-10T16:34:52Z")
Hi, I want to get metric from aws cloudwatch for this we have two options: 1 . cloudwatch input plugin - logstash 2 . aws cloudwatch metricset module - metricbeat So here is my question: Which one is more reliable? @js… --- ## [Enable Alerts and Actions](https://discuss.elastic.co/t/enable-alerts-and-actions/261180)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 16\ **Last updated:** [February 10, 2021, 4:25pm UTC](https://discuss.elastic.co/t/enable-alerts-and-actions/261180 "2021-02-10T16:25:51Z")
Is there a blog site or is there some one might have wrote step by step instruction on how to turn on Alerts and Actions? I have read few document and trying to follow this but got completely lost https://www.elastic.c… --- ## [Setup Alert for Kibana](https://discuss.elastic.co/t/setup-alert-for-kibana/263753)
**Author:** [@nguyenduyhung1979](https://discuss.elastic.co/u/nguyenduyhung1979)\ **Replies:** 1\ **Last updated:** [February 10, 2021, 3:59pm UTC](https://discuss.elastic.co/t/setup-alert-for-kibana/263753 "2021-02-10T15:59:22Z")
I have ELK stack (version 7.9.3) system work well in Windows with default setting. I tried to configure Alert for Kibana by following steps: Stop all services Update the following settings in the kibana.yml configurati… --- ## [Oracle Driver on Metricbeat Pod](https://discuss.elastic.co/t/oracle-driver-on-metricbeat-pod/263786)
**Author:** [@ssurenr](https://discuss.elastic.co/u/ssurenr)\ **Replies:** 3\ **Last updated:** [February 10, 2021, 3:40pm UTC](https://discuss.elastic.co/t/oracle-driver-on-metricbeat-pod/263786 "2021-02-10T15:40:21Z")
Hi, I am trying to collect metrics from an Oracle Database Query. I am getting the following error upon configuring the 'query' metricset from sql module. 2021-02-09T16:57:35.337Z INFO module/wrapper.go:266 E… --- ## [Sum operator in stacked bar vega](https://discuss.elastic.co/t/sum-operator-in-stacked-bar-vega/263722)
**Author:** [@Pranusha119](https://discuss.elastic.co/u/Pranusha119)\ **Replies:** 4\ **Last updated:** [February 10, 2021, 3:26pm UTC](https://discuss.elastic.co/t/sum-operator-in-stacked-bar-vega/263722 "2021-02-10T15:26:17Z")
Hi, I have aggregated StatusOpen field using sum operator, grouped by text\_sentiment and subject\_line fields. It's giving correct results in kibana. I tried it in vega using below spec : { "$schema": "https://veg… --- ## [Cron scheduler for jdbc plugin](https://discuss.elastic.co/t/cron-scheduler-for-jdbc-plugin/263878)
**Author:** [@Bryce\_Fernandes](https://discuss.elastic.co/u/Bryce_Fernandes)\ **Replies:** 10\ **Last updated:** [February 10, 2021, 3:14pm UTC](https://discuss.elastic.co/t/cron-scheduler-for-jdbc-plugin/263878 "2021-02-10T15:14:41Z")
Hi, I am using jdbc plugin and schedule for fetching data from database. Currently cron is running fine for schedule =\> "\* \* \* \* \*". My requirement is cron ingestion should start at given time (10 pm) and end at given … --- ## [Mutate add\_field and rename don't work](https://discuss.elastic.co/t/mutate-add-field-and-rename-dont-work/263868)
**Author:** [@Ernesto\_Guerra](https://discuss.elastic.co/u/Ernesto_Guerra)\ **Replies:** 2\ **Last updated:** [February 10, 2021, 2:43pm UTC](https://discuss.elastic.co/t/mutate-add-field-and-rename-dont-work/263868 "2021-02-10T14:43:31Z")
Hi, I'm trying to use mutate filter to change the name of a field. I've tried rename but it doesn't do anything, and tried creating a new field and passing the contents of the old one and didn't work either. My first t… --- ## [Elastic and LocalStack](https://discuss.elastic.co/t/elastic-and-localstack/263804)
**Author:** [@Sergiodive](https://discuss.elastic.co/u/Sergiodive)\ **Replies:** 1\ **Last updated:** [February 10, 2021, 2:42pm UTC](https://discuss.elastic.co/t/elastic-and-localstack/263804 "2021-02-10T14:42:30Z")
Hello I am running Elasticsearch 7.10 with a localstack s3 instance. The issue is when i try to register a repository. If i do this curl -X PUT "localhost:9200/\_snapshot/repo1?pretty" -H 'Content-Type: application/… --- ## [Logstash filter](https://discuss.elastic.co/t/logstash-filter/263718)
**Author:** [@Sujithra\_S](https://discuss.elastic.co/u/Sujithra_S)\ **Replies:** 3\ **Last updated:** [February 10, 2021, 2:35pm UTC](https://discuss.elastic.co/t/logstash-filter/263718 "2021-02-10T14:35:01Z")
Hi, I am fetching the data from Azure - event hubs , I need to split the data which is in message field and i have tried split filter and grok filter it is showing the error which is in tags. Please help me to sort out… --- ## [Filesetup is not working](https://discuss.elastic.co/t/filesetup-is-not-working/262775)
**Author:** [@lielar](https://discuss.elastic.co/u/lielar)\ **Replies:** 12\ **Last updated:** [February 10, 2021, 2:26pm UTC](https://discuss.elastic.co/t/filesetup-is-not-working/262775 "2021-02-10T14:26:05Z")
I am currently in the Observability Fundamentals lab. While running the command ./filebeat setup, it brings up the following error Overwriting ILM policy is disabled. Set \`setup.ilm.overwrite: true\` for enabling. Inde… --- ## [Snapshot restore failed shards](https://discuss.elastic.co/t/snapshot-restore-failed-shards/263884)
**Author:** [@sld](https://discuss.elastic.co/u/sld)\ **Replies:** 0\ **Last updated:** [February 10, 2021, 2:21pm UTC](https://discuss.elastic.co/t/snapshot-restore-failed-shards/263884 "2021-02-10T14:21:04Z")
I am setting up an automated process to test my latest elasticsearch snapshots. The snapshots are taken using slm and the snapshot data is synced from the production cluster to a local server. On the local server I have… --- ## [Multiple interface sniffing with packetbeat & output to 1 file](https://discuss.elastic.co/t/multiple-interface-sniffing-with-packetbeat-output-to-1-file/263883)
**Author:** [@luciferdude](https://discuss.elastic.co/u/luciferdude)\ **Replies:** 0\ **Last updated:** [February 10, 2021, 2:13pm UTC](https://discuss.elastic.co/t/multiple-interface-sniffing-with-packetbeat-output-to-1-file/263883 "2021-02-10T14:13:21Z")
Hello - I have packetbeat version 7.10 installed on Linux (RHEL Centos 7) server. I've configured packetbeat to listen on two interfaces. I was able to calculate this by using the command packetbeat devices command. Ever… --- ## [Is it possible to specify date range on Elastic snapshots?](https://discuss.elastic.co/t/is-it-possible-to-specify-date-range-on-elastic-snapshots/263881)
**Author:** [@eeijlar](https://discuss.elastic.co/u/eeijlar)\ **Replies:** 2\ **Last updated:** [February 10, 2021, 2:06pm UTC](https://discuss.elastic.co/t/is-it-possible-to-specify-date-range-on-elastic-snapshots/263881 "2021-02-10T14:06:41Z")
With reference to the following documentation: Is it possible to specify a time range for a snapshot? I can't see what the period for the snapshot is. Is it the last day/week/month? --- ## [More easily track a single email between services and servers](https://discuss.elastic.co/t/more-easily-track-a-single-email-between-services-and-servers/263752)
**Author:** [@jmcclelland](https://discuss.elastic.co/u/jmcclelland)\ **Replies:** 2\ **Last updated:** [February 10, 2021, 1:49pm UTC](https://discuss.elastic.co/t/more-easily-track-a-single-email-between-services-and-servers/263752 "2021-02-10T13:49:57Z")
Hi all, We are sending our postfix logs to elasticsearch using journalbeat. Our email system sends messages from one server to another and on a given server, from one service to another service (spam checking etc). Each … --- ## [Multiple configuration files](https://discuss.elastic.co/t/multiple-configuration-files/263880)
**Author:** [@Sunflower](https://discuss.elastic.co/u/Sunflower)\ **Replies:** 0\ **Last updated:** [February 10, 2021, 1:45pm UTC](https://discuss.elastic.co/t/multiple-configuration-files/263880 "2021-02-10T13:45:03Z")
Hi all, I have one conf file with multiple inputs and outputs(based on types) and I'd like to make it easy to read and to manage so I thought to create multiple configuration files, one for each type. Is there anything… --- ## [Repository-s3 plugin does not support S3-compatible services as documentation says](https://discuss.elastic.co/t/repository-s3-plugin-does-not-support-s3-compatible-services-as-documentation-says/263866)
**Author:** [@Krzysztof\_Szymanski](https://discuss.elastic.co/u/Krzysztof_Szymanski)\ **Replies:** 2\ **Last updated:** [February 10, 2021, 1:30pm UTC](https://discuss.elastic.co/t/repository-s3-plugin-does-not-support-s3-compatible-services-as-documentation-says/263866 "2021-02-10T13:30:16Z")
Hi is there anyone who achieve configuring repository-s3 plugin to work with S3-compatible service like CEPH. I completely follow the documentation (and many forums) and try to configure it but every time I failed. I did… --- ## [Filebeat and Logstash](https://discuss.elastic.co/t/filebeat-and-logstash/263873)
**Author:** [@Sunflower](https://discuss.elastic.co/u/Sunflower)\ **Replies:** 4\ **Last updated:** [February 10, 2021, 1:20pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash/263873 "2021-02-10T13:20:34Z")
Hi, I'd like to install Filebeat and send the Filebeat output to logstash, Is this documentation is relevant also to the latest version? https://www.elastic.co/guide/en/beats/filebeat/6.8/config-filebeat-logstash.htm… --- ## [Filebeat Apache Log fields (remote\_ip, geo etc)](https://discuss.elastic.co/t/filebeat-apache-log-fields-remote-ip-geo-etc/263760)
**Author:** [@radu990](https://discuss.elastic.co/u/radu990)\ **Replies:** 3\ **Last updated:** [February 10, 2021, 1:04pm UTC](https://discuss.elastic.co/t/filebeat-apache-log-fields-remote-ip-geo-etc/263760 "2021-02-10T13:04:08Z")
Hello, Sorry for bothering. I'm a new user for ELK. I have managed to enable Apache module for Filebeat and I'm seeing the Apache logs coming in Discover Section in Kibana. However the remote\_ip and other fields from Ap… --- ## [Encrypt/hide custom headers in watchers](https://discuss.elastic.co/t/encrypt-hide-custom-headers-in-watchers/263875)
**Author:** [@Smirra](https://discuss.elastic.co/u/Smirra)\ **Replies:** 0\ **Last updated:** [February 10, 2021, 1:03pm UTC](https://discuss.elastic.co/t/encrypt-hide-custom-headers-in-watchers/263875 "2021-02-10T13:03:11Z")
Hey! I have finished a webhook connection for a watcher. This webhook uses alot of custom headers and Bearer token authorization. All this is possible and working great with the headers. One issue that has come up though… --- ## [Implement Shareable URL](https://discuss.elastic.co/t/implement-shareable-url/263602)
**Author:** [@praveer](https://discuss.elastic.co/u/praveer)\ **Replies:** 2\ **Last updated:** [February 10, 2021, 12:44pm UTC](https://discuss.elastic.co/t/implement-shareable-url/263602 "2021-02-10T12:44:54Z")
Hi Team, In my application I am using data plugin to do elastic queries and display graphically. Now i have a requirement to create url which is shareable. I want to store all the applied filters in url an share it and… --- ## [After migrating from 7.8.3 to 7.10.2 kibana keeps restarting](https://discuss.elastic.co/t/after-migrating-from-7-8-3-to-7-10-2-kibana-keeps-restarting/263261)
**Author:** [@cor](https://discuss.elastic.co/u/cor)\ **Replies:** 16\ **Last updated:** [February 10, 2021, 12:38pm UTC](https://discuss.elastic.co/t/after-migrating-from-7-8-3-to-7-10-2-kibana-keeps-restarting/263261 "2021-02-10T12:38:47Z")
Hi all, Ather upgrading Elasticsearch and Kibana to 7.10.2, Kibana keeps restarting. during logging it repeats the following message over and over using different PID codes. '{"type":"log","@timestamp":"2021-02-04T14:… --- ## [Fetch the data from multiple indexes and create one report](https://discuss.elastic.co/t/fetch-the-data-from-multiple-indexes-and-create-one-report/263867)
**Author:** [@mrunalini](https://discuss.elastic.co/u/mrunalini)\ **Replies:** 0\ **Last updated:** [February 10, 2021, 12:18pm UTC](https://discuss.elastic.co/t/fetch-the-data-from-multiple-indexes-and-create-one-report/263867 "2021-02-10T12:18:48Z")
Hi Team, I have 3 different index with one transaction\_id as common in all, i am generation report with fields from all 3 indices at every midnight for transactions of last 3 days. I have different fields in all indice… --- ## [How to store boolean value or empty-able value in Index Connector of Kibana Alerts?](https://discuss.elastic.co/t/how-to-store-boolean-value-or-empty-able-value-in-index-connector-of-kibana-alerts/263481)
**Author:** [@fzyzcjy](https://discuss.elastic.co/u/fzyzcjy)\ **Replies:** 2\ **Last updated:** [February 10, 2021, 12:10pm UTC](https://discuss.elastic.co/t/how-to-store-boolean-value-or-empty-able-value-in-index-connector-of-kibana-alerts/263481 "2021-02-10T12:10:45Z")
Hi thanks for the lib! I see the {{state.isTriggered}} is a boolean. However, I cannot write down that format: If I use "{{state.isTriggered}}", then the document fail to index, because boolean fields cannot accept st… --- ## [Filebeat Pod not working properly](https://discuss.elastic.co/t/filebeat-pod-not-working-properly/263641)
**Author:** [@yimengael](https://discuss.elastic.co/u/yimengael)\ **Replies:** 3\ **Last updated:** [February 10, 2021, 11:28am UTC](https://discuss.elastic.co/t/filebeat-pod-not-working-properly/263641 "2021-02-10T11:28:33Z")
Hi Filebeat experts, I deployed Filebeat on my Kubernetes cluster using deamon set. I have many nodes in my cluster. In each node of my cluster, I have a Filebeat pods that is running and collecting all the pods logs on… --- ## [When I restart the pod and move the worker node, filebeat does not start collecting logs](https://discuss.elastic.co/t/when-i-restart-the-pod-and-move-the-worker-node-filebeat-does-not-start-collecting-logs/263490)
**Author:** [@Negi700](https://discuss.elastic.co/u/Negi700)\ **Replies:** 3\ **Last updated:** [February 10, 2021, 11:17am UTC](https://discuss.elastic.co/t/when-i-restart-the-pod-and-move-the-worker-node-filebeat-does-not-start-collecting-logs/263490 "2021-02-10T11:17:53Z")
The log of the pod of azure kubernetes system is collected from the worker node. Log collection does not start when the pod reboots and moves the worker node. Is there any good workaround? --- ## [ILM phase don't delete indexes (els 7.9)](https://discuss.elastic.co/t/ilm-phase-dont-delete-indexes-els-7-9/263704)
**Author:** [@zakabluk](https://discuss.elastic.co/u/zakabluk)\ **Replies:** 1\ **Last updated:** [February 10, 2021, 11:08am UTC](https://discuss.elastic.co/t/ilm-phase-dont-delete-indexes-els-7-9/263704 "2021-02-10T11:08:06Z")
My ILM policy PUT \_ilm/policy/delete-after-7-days { "policy": { "phases": { "hot": { "min\_age": "0ms", "actions": { "set\_priority": { "priority": 100 } … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1560) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1562)