# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1581 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1582 --- ## [REST API for adding users](https://discuss.elastic.co/t/rest-api-for-adding-users/262570)
**Author:** [@umesh2020](https://discuss.elastic.co/u/umesh2020)\ **Replies:** 4\ **Last updated:** [January 29, 2021, 7:23pm UTC](https://discuss.elastic.co/t/rest-api-for-adding-users/262570 "2021-01-29T19:23:47Z")
Hi Is there a REST API for adding users provided by Kibana ? OR I can use the elasticsearch create user API to add users ? Thanks, Umesh --- ## [Filter visualisation not providing full terms list, autocomplete settings are not making any differences](https://discuss.elastic.co/t/filter-visualisation-not-providing-full-terms-list-autocomplete-settings-are-not-making-any-differences/262618)
**Author:** [@Luukv](https://discuss.elastic.co/u/Luukv)\ **Replies:** 3\ **Last updated:** [January 29, 2021, 6:29pm UTC](https://discuss.elastic.co/t/filter-visualisation-not-providing-full-terms-list-autocomplete-settings-are-not-making-any-differences/262618 "2021-01-29T18:29:42Z")
Hello, In the past months I have made several filter/control panel visualisations for multiple dashboards. These have all worked well, but with the most recent one I've ran into some problems. We were experiencing some… --- ## [Kibana scripted fields](https://discuss.elastic.co/t/kibana-scripted-fields/262675)
**Author:** [@Gokul6](https://discuss.elastic.co/u/Gokul6)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 6:20pm UTC](https://discuss.elastic.co/t/kibana-scripted-fields/262675 "2021-01-29T18:20:53Z")
i have several boolean fields like weekDays.friday.is24HourService, weekDays.saturday.is24HourService in my index. i am getting the day of week using \[doc\['@timestamp'\].value.dayOfWeek\] which returns a numeric value, fo… --- ## [Split field and add new fields](https://discuss.elastic.co/t/split-field-and-add-new-fields/262571)
**Author:** [@jtillman2020](https://discuss.elastic.co/u/jtillman2020)\ **Replies:** 3\ **Last updated:** [January 29, 2021, 5:01pm UTC](https://discuss.elastic.co/t/split-field-and-add-new-fields/262571 "2021-01-29T17:01:51Z")
I have a string field named "One". \<165\>Original Address=1.1.1.1 1 2021-01-28T15:08:03.136-05:00 DeviceName - - - - fpc3 DHCP Packet Drop: Packet src ip/mac 192.168.123.1/54:48:10:db:86:b6 I use mutate { split =\> … --- ## [Delete old indexes via Index lifecycle policy doesn't work because of shards error](https://discuss.elastic.co/t/delete-old-indexes-via-index-lifecycle-policy-doesnt-work-because-of-shards-error/262619)
**Author:** [@mfa](https://discuss.elastic.co/u/mfa)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 4:24pm UTC](https://discuss.elastic.co/t/delete-old-indexes-via-index-lifecycle-policy-doesnt-work-because-of-shards-error/262619 "2021-01-29T16:24:03Z")
I have read through the docs and some posts here, however my delete policy is not working as expected. Here is my policy: PUT \_ilm/policy/deleting\_policy { "policy": { "phases": { "hot": … --- ## [Grok not parsing any pattern](https://discuss.elastic.co/t/grok-not-parsing-any-pattern/262669)
**Author:** [@werther158](https://discuss.elastic.co/u/werther158)\ **Replies:** 0\ **Last updated:** [January 29, 2021, 4:14pm UTC](https://discuss.elastic.co/t/grok-not-parsing-any-pattern/262669 "2021-01-29T16:14:02Z")
Hi, I'm trying to parse some apache logs like this: 46.105.14.53 - - \[20/May/2015:21:05:15 +0000\] "GET /blog/tags/puppet?flav=rss20 HTTP/1.1" 200 14872 "-" "UniversalFeedParser/4.2-pre-314-svn +http://feedparser.org/" F… --- ## [Is my data just not conforming to the pipeline? Filebeat not processing iptables](https://discuss.elastic.co/t/is-my-data-just-not-conforming-to-the-pipeline-filebeat-not-processing-iptables/262259)
**Author:** [@rfischman](https://discuss.elastic.co/u/rfischman)\ **Replies:** 2\ **Last updated:** [January 29, 2021, 3:54pm UTC](https://discuss.elastic.co/t/is-my-data-just-not-conforming-to-the-pipeline-filebeat-not-processing-iptables/262259 "2021-01-29T15:54:00Z")
Hopefully the group can help me out here... I've got my network infrastructure (coming out of a unifi controller) sending syslog to a filebeat over UDP/514. The messages are iptables logs. I'm not seeing any of the me… --- ## [Grok pattern to parse to multiple values](https://discuss.elastic.co/t/grok-pattern-to-parse-to-multiple-values/262651)
**Author:** [@Deny7](https://discuss.elastic.co/u/Deny7)\ **Replies:** 5\ **Last updated:** [January 29, 2021, 3:49pm UTC](https://discuss.elastic.co/t/grok-pattern-to-parse-to-multiple-values/262651 "2021-01-29T15:49:29Z")
Hi, I have log line like this: ",session":"kred06@gmail.com" Grok Pattern: (,"session":"(%{DATA:name}@%{DATA:company})?")? and I want to split the email to values name and company and also save email as whole to s… --- ## [Need to execute watcher alert based on each element of array](https://discuss.elastic.co/t/need-to-execute-watcher-alert-based-on-each-element-of-array/262592)
**Author:** [@Sumit\_Kumar1](https://discuss.elastic.co/u/Sumit_Kumar1)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 3:39pm UTC](https://discuss.elastic.co/t/need-to-execute-watcher-alert-based-on-each-element-of-array/262592 "2021-01-29T15:39:34Z")
Need to execute watcher alert based on each element of array. I am using chain input . First search provides me list of array . So, for each element of the array i need to make a search on each iteration . My result of… --- ## [Masking logic is not working](https://discuss.elastic.co/t/masking-logic-is-not-working/261827)
**Author:** [@shree2](https://discuss.elastic.co/u/shree2)\ **Replies:** 10\ **Last updated:** [January 29, 2021, 3:31pm UTC](https://discuss.elastic.co/t/masking-logic-is-not-working/261827 "2021-01-29T15:31:49Z")
Hi, I want to mask the few fields input is coming from json . Please find the configuration below. input { file { path =\> "xxx/sample.log" } } filter { mutate { gsub =\> \["message", "PASSWORD:((?=.\[a-z\])(?=.\[… --- ## [Persistent queue and kafka](https://discuss.elastic.co/t/persistent-queue-and-kafka/262662)
**Author:** [@bovy89](https://discuss.elastic.co/u/bovy89)\ **Replies:** 0\ **Last updated:** [January 29, 2021, 3:31pm UTC](https://discuss.elastic.co/t/persistent-queue-and-kafka/262662 "2021-01-29T15:31:35Z")
Hi, we are using logstash with persistent queue feature enabled and the following setup: filebeat ---\> logstash (with PQ) ---\> elasticsearch Now we are moving to a kafka based setup like that: filebeat ---\> kafka ---… --- ## [Get current active users in the application using Elastic/Kibana Visualization](https://discuss.elastic.co/t/get-current-active-users-in-the-application-using-elastic-kibana-visualization/262030)
**Author:** [@SAKA\_RAM\_DEWASI](https://discuss.elastic.co/u/SAKA_RAM_DEWASI)\ **Replies:** 3\ **Last updated:** [January 29, 2021, 3:27pm UTC](https://discuss.elastic.co/t/get-current-active-users-in-the-application-using-elastic-kibana-visualization/262030 "2021-01-29T15:27:03Z")
Hi all, I am new to elastic and kibana. I want to get current active users in web application using audit logs stored in elastic index. We capture login and logout event of user in audit log and stored as document in el… --- ## [Not parsing apache access and error logs](https://discuss.elastic.co/t/not-parsing-apache-access-and-error-logs/262535)
**Author:** [@kevintts](https://discuss.elastic.co/u/kevintts)\ **Replies:** 2\ **Last updated:** [January 29, 2021, 2:58pm UTC](https://discuss.elastic.co/t/not-parsing-apache-access-and-error-logs/262535 "2021-01-29T14:58:49Z")
I am using filebeat to send apache logs to logstash on my elastic server. I can see the log entries with event.dataset set to apache.access , but they aren't being parsed, so no info in dashboard apache screens. Also, wh… --- ## [Kibana Error Alerting - Filter Similiar Error Messages | Similarity Query \[Elastalert\]](https://discuss.elastic.co/t/kibana-error-alerting-filter-similiar-error-messages-similarity-query-elastalert/262517)
**Author:** [@MartinJaskulla](https://discuss.elastic.co/u/MartinJaskulla)\ **Replies:** 2\ **Last updated:** [January 29, 2021, 2:02pm UTC](https://discuss.elastic.co/t/kibana-error-alerting-filter-similiar-error-messages-similarity-query-elastalert/262517 "2021-01-29T14:02:09Z")
My goal is to be alerted for unique error types only (Elasticsearch 6.8 + Elastalert). Example error logs (5 documents, same index, same field): Error 9837 in Component X trying to reconnect in 9.3 seconds Error 9837 … --- ## [Kibana Timezone incompatiblities](https://discuss.elastic.co/t/kibana-timezone-incompatiblities/262649)
**Author:** [@d3v3lop3r](https://discuss.elastic.co/u/d3v3lop3r)\ **Replies:** 4\ **Last updated:** [January 29, 2021, 1:21pm UTC](https://discuss.elastic.co/t/kibana-timezone-incompatiblities/262649 "2021-01-29T13:21:24Z")
Hello there, Iam trying to make my Data visible in the Discover Tab of Kibana and it's just not working out for me. Iam sitting on a project for my studies and built a weather station. The station submits its data once… --- ## [Many or single pipeline performance with querys](https://discuss.elastic.co/t/many-or-single-pipeline-performance-with-querys/262650)
**Author:** [@pereyrdi](https://discuss.elastic.co/u/pereyrdi)\ **Replies:** 0\ **Last updated:** [January 29, 2021, 1:18pm UTC](https://discuss.elastic.co/t/many-or-single-pipeline-performance-with-querys/262650 "2021-01-29T13:18:21Z")
Hello everyone, Im working updating configurations of logstash and Im wondering with method is more performance. For example Multiple pipelines going to a single pipepile to do some checks (sql querys) before ingest i… --- ## [ElasticSearch delete\_by\_query: Trying to create too many scroll contexts](https://discuss.elastic.co/t/elasticsearch-delete-by-query-trying-to-create-too-many-scroll-contexts/262627)
**Author:** [@lankin1](https://discuss.elastic.co/u/lankin1)\ **Replies:** 2\ **Last updated:** [January 29, 2021, 1:14pm UTC](https://discuss.elastic.co/t/elasticsearch-delete-by-query-trying-to-create-too-many-scroll-contexts/262627 "2021-01-29T13:14:14Z")
Hi, I am trying to fix this error while running delete\_by\_query API on AWS ElasticSearch: Trying to create too many scroll contexts. Must be less than or equal to: \[500\]. This limit can be set by changing the \[search.m… --- ## [Kibana alert condition](https://discuss.elastic.co/t/kibana-alert-condition/262645)
**Author:** [@Guy\_Assaf](https://discuss.elastic.co/u/Guy_Assaf)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 1:13pm UTC](https://discuss.elastic.co/t/kibana-alert-condition/262645 "2021-01-29T13:13:10Z")
See the image, I'm trying to define an alert such that a certain percentage will trigger the alert. Two issues: how to take the ERROR/SUCCESS doc from the list, I tried with (buckets{key:SUCCESS} which does not work) t… --- ## [Stats endpoint fails after creating an index](https://discuss.elastic.co/t/stats-endpoint-fails-after-creating-an-index/262562)
**Author:** [@tommyzli](https://discuss.elastic.co/u/tommyzli)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 12:58pm UTC](https://discuss.elastic.co/t/stats-endpoint-fails-after-creating-an-index/262562 "2021-01-29T12:58:48Z")
Hi Elasticsearch version 7.6 I have a cluster with 3 master only nodes, 20 data nodes, and one index with 10 shards and 10 replicas. After I create a new index called profiles\_v1 with 10 shards and 0 replicas, the stat… --- ## [Timeout for snapshot process](https://discuss.elastic.co/t/timeout-for-snapshot-process/262640)
**Author:** [@sreekanth](https://discuss.elastic.co/u/sreekanth)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 12:12pm UTC](https://discuss.elastic.co/t/timeout-for-snapshot-process/262640 "2021-01-29T12:12:47Z")
Hi, Anyway to set timeout for snapshot process? I am running with "?wait\_for\_completion=true" . Some times it gets stuck for a long time. I know that it should finish by 10min for the data i have. Anyway to set a timeou… --- ## [Streaming pipeline](https://discuss.elastic.co/t/streaming-pipeline/262628)
**Author:** [@vincent2mots](https://discuss.elastic.co/u/vincent2mots)\ **Replies:** 0\ **Last updated:** [January 29, 2021, 10:25am UTC](https://discuss.elastic.co/t/streaming-pipeline/262628 "2021-01-29T10:25:35Z")
Hi experts! I made a data pipeline using Filebeat and Logstash. I was expecting to see the data streamed from the log file into Elasticsearch but it's not the case. When new lines are inserted into the log file, I some… --- ## [Monitor APIC on kubernetes using metricbeat](https://discuss.elastic.co/t/monitor-apic-on-kubernetes-using-metricbeat/261465)
**Author:** [@Sagar\_Naik](https://discuss.elastic.co/u/Sagar_Naik)\ **Replies:** 2\ **Last updated:** [January 29, 2021, 9:10am UTC](https://discuss.elastic.co/t/monitor-apic-on-kubernetes-using-metricbeat/261465 "2021-01-29T09:10:49Z")
I am getting 400 bad request while trying to configure metricbeat for monitoring kubernetes cluster deployed along with IBM API Connect. System information is displaying , but no kubernetes info , We need to monitor tr… --- ## [Reg csv file import into Elasticsearch using Logstash](https://discuss.elastic.co/t/reg-csv-file-import-into-elasticsearch-using-logstash/261449)
**Author:** [@mohanss08](https://discuss.elastic.co/u/mohanss08)\ **Replies:** 12\ **Last updated:** [January 29, 2021, 9:06am UTC](https://discuss.elastic.co/t/reg-csv-file-import-into-elasticsearch-using-logstash/261449 "2021-01-29T09:06:04Z")
Hello Support team, I have query regarding csv file upload into elasticsearch using logstash. With this fourm https://www.bmc.com/blogs/elasticsearch-load-csv-logstash/ Able to import our csv files into elasticsearch … --- ## [How to specify subpath to logstash host in filebeat.yml](https://discuss.elastic.co/t/how-to-specify-subpath-to-logstash-host-in-filebeat-yml/262501)
**Author:** [@eeijlar](https://discuss.elastic.co/u/eeijlar)\ **Replies:** 2\ **Last updated:** [January 28, 2021, 4:24pm UTC](https://discuss.elastic.co/t/how-to-specify-subpath-to-logstash-host-in-filebeat-yml/262501 "2021-01-28T16:24:44Z")
I am trying to ship logs to logstash from filebeat. With reference to: In the filebeat.yml, it says to use this for the host: output.logstash: hosts: \["127.0.0.1:5044"\] My logstash URL has /logstash appending o… --- ## [How to load balance an ES-cluster with 70+nodes and 70+ replica shards?](https://discuss.elastic.co/t/how-to-load-balance-an-es-cluster-with-70-nodes-and-70-replica-shards/262608)
**Author:** [@niidy](https://discuss.elastic.co/u/niidy)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 8:16am UTC](https://discuss.elastic.co/t/how-to-load-balance-an-es-cluster-with-70-nodes-and-70-replica-shards/262608 "2021-01-29T08:16:42Z")
My es is 70+nodes and there is an index with a pri shard and 70+ replica shards, because there is no new data written, but there are a lot of queries. but now, only some of them are 80+ cpu and 20+ load (my node is 16c … --- ## [New document in one index should update a value in another index](https://discuss.elastic.co/t/new-document-in-one-index-should-update-a-value-in-another-index/262601)
**Author:** [@Parimelazhagan\_Vinay](https://discuss.elastic.co/u/Parimelazhagan_Vinay)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 8:14am UTC](https://discuss.elastic.co/t/new-document-in-one-index-should-update-a-value-in-another-index/262601 "2021-01-29T08:14:30Z")
Hi All, I am new elasticsearch. Any help on the below use case would be helpful. I have the data which is flowing into one index say index\_raw ELK Dev 1.0 Time1 ELK Dev 2.0 Time2 ELK Stage 1.0 Time3 Now I wanted t… --- ## [Custom authentication plugin for Elastic search(7.10.0)](https://discuss.elastic.co/t/custom-authentication-plugin-for-elastic-search-7-10-0/262315)
**Author:** [@Hargovind](https://discuss.elastic.co/u/Hargovind)\ **Replies:** 5\ **Last updated:** [January 29, 2021, 8:11am UTC](https://discuss.elastic.co/t/custom-authentication-plugin-for-elastic-search-7-10-0/262315 "2021-01-29T08:11:46Z")
Hi everyone, I need to secure my elasticsearch server with custom authentication. pls help me to create a plugin for custom authentication in elasticsearch. Thanks. --- ## [MongoDB logs no more displayed in Kibana Filebeat MongoDB dashboard after 7.10 migration](https://discuss.elastic.co/t/mongodb-logs-no-more-displayed-in-kibana-filebeat-mongodb-dashboard-after-7-10-migration/262344)
**Author:** [@ORich](https://discuss.elastic.co/u/ORich)\ **Replies:** 5\ **Last updated:** [January 29, 2021, 7:37am UTC](https://discuss.elastic.co/t/mongodb-logs-no-more-displayed-in-kibana-filebeat-mongodb-dashboard-after-7-10-migration/262344 "2021-01-29T07:37:31Z")
Dear experts, after migration from 6.5.4 to 7.10.2, I cannot display anymore my logs collected by the default Filebeat MongoDB module in Kibana Dashboard Overview \[Filebeat MongoDB\]. I notice some updates in the provid… --- ## [How to get response header with cookie from POST request to Kibana REST API /internal/security/login](https://discuss.elastic.co/t/how-to-get-response-header-with-cookie-from-post-request-to-kibana-rest-api-internal-security-login/262530)
**Author:** [@gaetano](https://discuss.elastic.co/u/gaetano)\ **Replies:** 1\ **Last updated:** [January 29, 2021, 7:12am UTC](https://discuss.elastic.co/t/how-to-get-response-header-with-cookie-from-post-request-to-kibana-rest-api-internal-security-login/262530 "2021-01-29T07:12:27Z")
My goal is to skip login page in Kibana. With an HTTP request, I would to login in Kibana using the REST API /internal/security/login. The request is come from my Angular application and to bypass CORS and multi-origi… --- ## [How to re-generate certificate for nodes elasticsearch to enable xpack](https://discuss.elastic.co/t/how-to-re-generate-certificate-for-nodes-elasticsearch-to-enable-xpack/262554)
**Author:** [@testsemd\_email](https://discuss.elastic.co/u/testsemd_email)\ **Replies:** 2\ **Last updated:** [January 29, 2021, 7:07am UTC](https://discuss.elastic.co/t/how-to-re-generate-certificate-for-nodes-elasticsearch-to-enable-xpack/262554 "2021-01-29T07:07:39Z")
How to re-generate certificate for nodes elasticsearch after the password is generated for elastic cluster. I re-generated the certificate for nodes, got the error "client did not trust this server's certificate, closi… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1580) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1582)