# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1569

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1570

---

## [Kibana specific dashboard show for users](https://discuss.elastic.co/t/kibana-specific-dashboard-show-for-users/263449)

<div class="topic-metadata">

**Author:** [@Shayan\_Delavarkhan](https://discuss.elastic.co/u/Shayan_Delavarkhan)\
**Replies:** 1\
**Last updated:** [February 5, 2021, 6:46pm UTC](https://discuss.elastic.co/t/kibana-specific-dashboard-show-for-users/263449 "2021-02-05T18:46:22Z")

</div>

Dear guys, I wanna set a permission for a user which can see only single specific dashboard instead of list of all dashboards. My question is that how can I achieve this view? thanks in advanced

---

## [GSUB & Regular Expression](https://discuss.elastic.co/t/gsub-regular-expression/263442)

<div class="topic-metadata">

**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Replies:** 1\
**Last updated:** [February 5, 2021, 6:12pm UTC](https://discuss.elastic.co/t/gsub-regular-expression/263442 "2021-02-05T18:12:39Z")

</div>

I have a text field being ingested that I want to remove an email disclaimer from, unfortunately, I can't figure out the correct syntax to remove it. I've got the mutate filter setup in the following way: mutate { gs…

---

## [Removal of mapping types in 7.x: why not include index aliases in results?](https://discuss.elastic.co/t/removal-of-mapping-types-in-7-x-why-not-include-index-aliases-in-results/263293)

<div class="topic-metadata">

**Author:** [@Thomas\_Doman](https://discuss.elastic.co/u/Thomas_Doman)\
**Replies:** 0\
**Last updated:** [February 4, 2021, 7:10pm UTC](https://discuss.elastic.co/t/removal-of-mapping-types-in-7-x-why-not-include-index-aliases-in-results/263293 "2021-02-04T19:10:56Z")

</div>

ES: 6.8.13 NEST: 6.8.6 We're preparing to upgrade to ES 7.x and are considering the type removal. We've reviewed the suggestions in Removal of mapping types. Since the 1.x days, we haven't had multiple types in any o…

---

## [Running logstash pipeline is not working](https://discuss.elastic.co/t/running-logstash-pipeline-is-not-working/263394)

<div class="topic-metadata">

**Author:** [@Srinivas\_RK](https://discuss.elastic.co/u/Srinivas_RK)\
**Replies:** 2\
**Last updated:** [February 5, 2021, 4:48pm UTC](https://discuss.elastic.co/t/running-logstash-pipeline-is-not-working/263394 "2021-02-05T16:48:01Z")

</div>

input { jdbc { id =\> "my\_plugin\_id" jdbc\_connection\_string =\> "jdbc:sqlserver://abc.database.windows.net:1433;databaseName=db;" jdbc\_driver\_library =\> "" jdbc\_driver\_class =\> "com.microsoft.sqlserver.jdbc.…

---

## [What is the best way to push/add new elements into a nested array of objects?](https://discuss.elastic.co/t/what-is-the-best-way-to-push-add-new-elements-into-a-nested-array-of-objects/263439)

<div class="topic-metadata">

**Author:** [@OB1290](https://discuss.elastic.co/u/OB1290)\
**Replies:** 0\
**Last updated:** [February 5, 2021, 4:47pm UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-push-add-new-elements-into-a-nested-array-of-objects/263439 "2021-02-05T16:47:07Z")

</div>

I have a candidate Index where documents are structured like so : { "\_index" : "candidates", "\_type" : "\_doc", "\_id" : "a23OcncBXBMGOH6pwXge", "\_version" : 1, "\_seq\_no" : 1, "\_primary\_term" : 1, "found" : …

---

## [Changing file path name every five minutes in output plugin](https://discuss.elastic.co/t/changing-file-path-name-every-five-minutes-in-output-plugin/263383)

<div class="topic-metadata">

**Author:** [@ritusingh](https://discuss.elastic.co/u/ritusingh)\
**Replies:** 1\
**Last updated:** [February 5, 2021, 4:36pm UTC](https://discuss.elastic.co/t/changing-file-path-name-every-five-minutes-in-output-plugin/263383 "2021-02-05T16:36:01Z")

</div>

Hi, My requirement is my file name should change every 5 minutes . Currently I am using below configuration to change it every minute. Please tell me some way to change it every 5 minute. output { stdout { codec =\> ru…

---

## [Metricbeat MSSQL module connecting to only localhost](https://discuss.elastic.co/t/metricbeat-mssql-module-connecting-to-only-localhost/261674)

<div class="topic-metadata">

**Author:** [@phani\_akkina](https://discuss.elastic.co/u/phani_akkina)\
**Replies:** 13\
**Last updated:** [February 5, 2021, 3:32pm UTC](https://discuss.elastic.co/t/metricbeat-mssql-module-connecting-to-only-localhost/261674 "2021-02-05T15:32:23Z")

</div>

I am trying to monitor MSSQL using metricbeat but I found some strange errors. I am trying to monitor SQL Cluster with IP and SQL instance name. But I see whenever I use the correct SQL server details then it's connecti…

---

## [Best way to install Metricbeat on hundreds of machines](https://discuss.elastic.co/t/best-way-to-install-metricbeat-on-hundreds-of-machines/263245)

<div class="topic-metadata">

**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\
**Replies:** 3\
**Last updated:** [February 5, 2021, 3:31pm UTC](https://discuss.elastic.co/t/best-way-to-install-metricbeat-on-hundreds-of-machines/263245 "2021-02-05T15:31:33Z")

</div>

Hi. what will be the best way to install metricbeat in hundreds of machines?

---

## [How to filter data from beat in logstash](https://discuss.elastic.co/t/how-to-filter-data-from-beat-in-logstash/263418)

<div class="topic-metadata">

**Author:** [@IL\_Mare](https://discuss.elastic.co/u/IL_Mare)\
**Replies:** 0\
**Last updated:** [February 5, 2021, 3:31pm UTC](https://discuss.elastic.co/t/how-to-filter-data-from-beat-in-logstash/263418 "2021-02-05T15:31:17Z")

</div>

Hello. I need to add data comes from beats to ElasticSearch. But before I need to filter to keep only records that have "status" and status is not "sent". I wrote next configuration for it. input { beats { port =\> …

---

## [Pie graph color change magically after refresh the page. Please help how to resolve this issue](https://discuss.elastic.co/t/pie-graph-color-change-magically-after-refresh-the-page-please-help-how-to-resolve-this-issue/263291)

<div class="topic-metadata">

**Author:** [@Satish\_Yadav](https://discuss.elastic.co/u/Satish_Yadav)\
**Replies:** 3\
**Last updated:** [February 5, 2021, 3:22pm UTC](https://discuss.elastic.co/t/pie-graph-color-change-magically-after-refresh-the-page-please-help-how-to-resolve-this-issue/263291 "2021-02-05T15:22:10Z")

</div>

---

## [Write in elasti is slow](https://discuss.elastic.co/t/write-in-elasti-is-slow/263403)

<div class="topic-metadata">

**Author:** [@Giovanni\_Di\_Lembo](https://discuss.elastic.co/u/Giovanni_Di_Lembo)\
**Replies:** 1\
**Last updated:** [February 5, 2021, 2:52pm UTC](https://discuss.elastic.co/t/write-in-elasti-is-slow/263403 "2021-02-05T14:52:01Z")

</div>

hi all and sorry for my poor english, I notice a write time very high on my index. I wonder if exists a way to write tons of doc quickly

---

## [Duplicate records in Elasticsearch](https://discuss.elastic.co/t/duplicate-records-in-elasticsearch/261658)

<div class="topic-metadata">

**Author:** [@sachin1112](https://discuss.elastic.co/u/sachin1112)\
**Replies:** 2\
**Last updated:** [February 5, 2021, 2:22pm UTC](https://discuss.elastic.co/t/duplicate-records-in-elasticsearch/261658 "2021-02-05T14:22:18Z")

</div>

Hello Elastic Team, We are creating our Agile dashboards using ELK Stack , we are able to extract data and push it to ES without any issues for the first time. but when we are pushing the incremental data , we are getti…

---

## [Can we access a scripted field with a scripted field](https://discuss.elastic.co/t/can-we-access-a-scripted-field-with-a-scripted-field/263388)

<div class="topic-metadata">

**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\
**Replies:** 1\
**Last updated:** [February 5, 2021, 2:19pm UTC](https://discuss.elastic.co/t/can-we-access-a-scripted-field-with-a-scripted-field/263388 "2021-02-05T14:19:05Z")

</div>

Kibana version : 7.9 Elasticsearch version : 7.9 APM Server version : 7.9 APM Agent language and version : java 1.8 Fresh install or upgraded from other version? fresh install Is there anything special in your setup…

---

## [Too many logstash processes are running on server](https://discuss.elastic.co/t/too-many-logstash-processes-are-running-on-server/263391)

<div class="topic-metadata">

**Author:** [@hariskhalique](https://discuss.elastic.co/u/hariskhalique)\
**Replies:** 0\
**Last updated:** [February 5, 2021, 1:53pm UTC](https://discuss.elastic.co/t/too-many-logstash-processes-are-running-on-server/263391 "2021-02-05T13:53:46Z")

</div>

Hi, I am using logstash pipeline to dump data in elastic search. Only two configuration define in pipeline. But when I htop my server there are lots of processes. following are screen short of htop. Also getting fol…

---

## [Rolling upgrade to 7.x](https://discuss.elastic.co/t/rolling-upgrade-to-7-x/263386)

<div class="topic-metadata">

**Author:** [@srikanth\_k](https://discuss.elastic.co/u/srikanth_k)\
**Replies:** 0\
**Last updated:** [February 5, 2021, 1:29pm UTC](https://discuss.elastic.co/t/rolling-upgrade-to-7-x/263386 "2021-02-05T13:29:20Z")

</div>

In case of rolling upgrade, "In the unlikely case of a network malfunction during the upgrade process that isolates all remaining old nodes from the cluster, you must take the old nodes offline and upgrade them to enabl…

---

## [Kafka Topics](https://discuss.elastic.co/t/kafka-topics/263379)

<div class="topic-metadata">

**Author:** [@Abderrahmen\_Ridha](https://discuss.elastic.co/u/Abderrahmen_Ridha)\
**Replies:** 0\
**Last updated:** [February 5, 2021, 11:51am UTC](https://discuss.elastic.co/t/kafka-topics/263379 "2021-02-05T11:51:18Z")

</div>

how can i get all Kafka Topics in Logstash ?

---

## [Kibana doubt about removing visualizations](https://discuss.elastic.co/t/kibana-doubt-about-removing-visualizations/263109)

<div class="topic-metadata">

**Author:** [@Jose\_Angel\_Morena\_Si](https://discuss.elastic.co/u/Jose_Angel_Morena_Si)\
**Replies:** 2\
**Last updated:** [February 5, 2021, 11:45am UTC](https://discuss.elastic.co/t/kibana-doubt-about-removing-visualizations/263109 "2021-02-05T11:45:50Z")

</div>

Hello there, I am trying to remove all objects in Kibana that meet the following two conditions: They are visualizations. They do not contain "Apache". I am using Kibana UI, Saved Objects. I am using the following qu…

---

## [Reload\_search\_analyzers behaviour](https://discuss.elastic.co/t/reload-search-analyzers-behaviour/263376)

<div class="topic-metadata">

**Author:** [@Philippus\_Baalman](https://discuss.elastic.co/u/Philippus_Baalman)\
**Replies:** 1\
**Last updated:** [February 5, 2021, 11:43am UTC](https://discuss.elastic.co/t/reload-search-analyzers-behaviour/263376 "2021-02-05T11:43:39Z")

</div>

Maybe my memory is foggy but I thought that the 'reload\_search\_analyzers'-command only reloads the synonyms file (when the 'updateable'-field is set to true) and not other files (like stop\_words and stemmer\_override). W…

---

## [Snmp agent configuration for logstash](https://discuss.elastic.co/t/snmp-agent-configuration-for-logstash/261339)

<div class="topic-metadata">

**Author:** [@shehzadshaikh](https://discuss.elastic.co/u/shehzadshaikh)\
**Replies:** 2\
**Last updated:** [February 5, 2021, 11:24am UTC](https://discuss.elastic.co/t/snmp-agent-configuration-for-logstash/261339 "2021-02-05T11:24:56Z")

</div>

I'm trying to pull data from snmp agent directly to logstash, i went through online documents but none of the are descriptive and show what exactly configuration to put on the smp agent. Also while there is plugins avail…

---

## [Load and Performance of Elastic](https://discuss.elastic.co/t/load-and-performance-of-elastic/260989)

<div class="topic-metadata">

**Author:** [@vikramnr](https://discuss.elastic.co/u/vikramnr)\
**Replies:** 2\
**Last updated:** [February 5, 2021, 10:50am UTC](https://discuss.elastic.co/t/load-and-performance-of-elastic/260989 "2021-02-05T10:50:58Z")

</div>

We are having single node architecture with 50 GB of physical space and 10 GB ram. We are looking to store around 90 Million documents spread across multiple index in the free version of Elastic search. Can Elastic sear…

---

## [@timestamp format while exporting from elasticsearch to csv](https://discuss.elastic.co/t/timestamp-format-while-exporting-from-elasticsearch-to-csv/263137)

<div class="topic-metadata">

**Author:** [@ritusingh](https://discuss.elastic.co/u/ritusingh)\
**Replies:** 5\
**Last updated:** [February 5, 2021, 10:15am UTC](https://discuss.elastic.co/t/timestamp-format-while-exporting-from-elasticsearch-to-csv/263137 "2021-02-05T10:15:12Z")

</div>

Hi, I want to know how can I change the format of @timestamp while exporting from elasticsearch to csv via logstash. In Kibana I have kept the format as "Feb-03-2021 20:03:04.603" using advance settings. I want same for…

---

## [Ssl not working in elasticsearch input plugin](https://discuss.elastic.co/t/ssl-not-working-in-elasticsearch-input-plugin/263357)

<div class="topic-metadata">

**Author:** [@ritusingh](https://discuss.elastic.co/u/ritusingh)\
**Replies:** 1\
**Last updated:** [February 5, 2021, 10:13am UTC](https://discuss.elastic.co/t/ssl-not-working-in-elasticsearch-input-plugin/263357 "2021-02-05T10:13:59Z")

</div>

Hi, I am fetching logs from elasticsearch via logstash but if I use ssl I get the following error. 2056 error: 2056 2056 2056 Manticore::ClientProtocolException 2056 PKIX path building failed: sun.…

---

## [Filebeat not publishing logs to Logstash on sebp/elk docker image](https://discuss.elastic.co/t/filebeat-not-publishing-logs-to-logstash-on-sebp-elk-docker-image/263351)

<div class="topic-metadata">

**Author:** [@Pavitar\_Dua](https://discuss.elastic.co/u/Pavitar_Dua)\
**Replies:** 0\
**Last updated:** [February 5, 2021, 8:44am UTC](https://discuss.elastic.co/t/filebeat-not-publishing-logs-to-logstash-on-sebp-elk-docker-image/263351 "2021-02-05T08:44:36Z")

</div>

I run filebeat with this command 'sudo ./filebeat -e -c filebeat.yml'. 2021-02-05T14:10:29.915+0530 INFO instance/beat.go:640 Home path: \[/Users/pavitardua/filebeat-7.9.2-darwin-x86\_64\] Config path: \[/Users/pavitardua/…

---

## [Packetbeat OSS "HTTPS Error 404 - Not Found" with YUM](https://discuss.elastic.co/t/packetbeat-oss-https-error-404-not-found-with-yum/263360)

<div class="topic-metadata">

**Author:** [@gohovd](https://discuss.elastic.co/u/gohovd)\
**Replies:** 0\
**Last updated:** [February 5, 2021, 9:40am UTC](https://discuss.elastic.co/t/packetbeat-oss-https-error-404-not-found-with-yum/263360 "2021-02-05T09:40:21Z")

</div>

Hi all, Using the following elastic repo for oss: \[elastic-7.x\] name=Elastic repository for 7.x packages baseurl=https://artifacts.elastic.co/packages/oss-7.x/yum gpgcheck=1 gpgkey=https://artifacts.elastic.co/GPG-KEY-…

---

## [How to send syslog to multiple destinations?](https://discuss.elastic.co/t/how-to-send-syslog-to-multiple-destinations/263354)

<div class="topic-metadata">

**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\
**Replies:** 0\
**Last updated:** [February 5, 2021, 8:52am UTC](https://discuss.elastic.co/t/how-to-send-syslog-to-multiple-destinations/263354 "2021-02-05T08:52:23Z")

</div>

I'm using logstash syslog module to send customized outputs to multiple destinations/port I've done as below, but somehow only the 1st destination receives message. Is there another format to have multiple syslog outpu…

---

## [Kibana role based access on remote cluster](https://discuss.elastic.co/t/kibana-role-based-access-on-remote-cluster/263235)

<div class="topic-metadata">

**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\
**Replies:** 2\
**Last updated:** [February 5, 2021, 6:18am UTC](https://discuss.elastic.co/t/kibana-role-based-access-on-remote-cluster/263235 "2021-02-05T06:18:46Z")

</div>

Hi All, We are trying to provide role based access to our partners for few indexes. It is working for the current cluster and consumer is able to see data only for allocated index. However consumer is able to see all r…

---

## [How to query by value in past bucket](https://discuss.elastic.co/t/how-to-query-by-value-in-past-bucket/263352)

<div class="topic-metadata">

**Author:** [@111439](https://discuss.elastic.co/u/111439)\
**Replies:** 0\
**Last updated:** [February 5, 2021, 8:45am UTC](https://discuss.elastic.co/t/how-to-query-by-value-in-past-bucket/263352 "2021-02-05T08:45:32Z")

</div>

Hi, Im' Newbie of ELK Stack. I have question of elasticsearch REST API, I want to select data 2 time. First I use range (-20s to -140s) and aggregation term and bucket sort to find min value in this time. ex : 08.30 AM…

---

## [How to make auto Complete filters multiple contexts with an AND operator](https://discuss.elastic.co/t/how-to-make-auto-complete-filters-multiple-contexts-with-an-and-operator/263353)

<div class="topic-metadata">

**Author:** [@awan.soekamto](https://discuss.elastic.co/u/awan.soekamto)\
**Replies:** 0\
**Last updated:** [February 5, 2021, 8:48am UTC](https://discuss.elastic.co/t/how-to-make-auto-complete-filters-multiple-contexts-with-an-and-operator/263353 "2021-02-05T08:48:45Z")

</div>

Hi, Is there any way I can return documents that match ALL the contexts? I use "contexts": { "suggestfilter\_groupid": \[3\], "suggestfilter\_userid": \[306\] } I want to just return documents that matches groupid 3 AND…

---

## [How to display only positive values after a tophit (latest) aggregation](https://discuss.elastic.co/t/how-to-display-only-positive-values-after-a-tophit-latest-aggregation/262997)

<div class="topic-metadata">

**Author:** [@Ricks](https://discuss.elastic.co/u/Ricks)\
**Replies:** 3\
**Last updated:** [February 5, 2021, 8:05am UTC](https://discuss.elastic.co/t/how-to-display-only-positive-values-after-a-tophit-latest-aggregation/262997 "2021-02-05T08:05:01Z")

</div>

Hi, currently I am exporting (once per hour) certificate expiration data to elasticsearch and visualize it with Kibana. So far so good, but I can't figure out to properly display certificates that are within 30 days to …

---

## [Syslog-ng logstash date\_time\_parse\_exception](https://discuss.elastic.co/t/syslog-ng-logstash-date-time-parse-exception/263104)

<div class="topic-metadata">

**Author:** [@tomsozolins](https://discuss.elastic.co/u/tomsozolins)\
**Replies:** 1\
**Last updated:** [February 5, 2021, 7:57am UTC](https://discuss.elastic.co/t/syslog-ng-logstash-date-time-parse-exception/263104 "2021-02-05T07:57:56Z")

</div>

Hello! I am trying to send logs from Syslog-ng to logstash and no logs are indexed in elasticsearch because of date time parse exception. I cannot use Beats on the devices, so the only option is Syslog-ng. Could anyone …

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1568)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1570)
