# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1583 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1584 --- ## [Logstash Error](https://discuss.elastic.co/t/logstash-error/262392)
**Author:** [@PriyankaS](https://discuss.elastic.co/u/PriyankaS)\ **Replies:** 3\ **Last updated:** [January 28, 2021, 5:18pm UTC](https://discuss.elastic.co/t/logstash-error/262392 "2021-01-28T17:18:43Z")
I am trying run the logstash with the below pattern: .\* PulseSecure: .\*%{IP:\[additionalinfo\]\[client\_public\_ip\]}.\*\\\\%{USERNAME:\[additionalinfo\]\[suser\]}.\*%{IP:\[additionalinfo\]\[client\_ip\]} for the below sample log: \<182\>1… --- ## [Logstash Json remove nested properties that have empty field name](https://discuss.elastic.co/t/logstash-json-remove-nested-properties-that-have-empty-field-name/262516)
**Author:** [@david.preston](https://discuss.elastic.co/u/david.preston)\ **Replies:** 1\ **Last updated:** [January 28, 2021, 4:40pm UTC](https://discuss.elastic.co/t/logstash-json-remove-nested-properties-that-have-empty-field-name/262516 "2021-01-28T16:40:08Z")
Hi, Are there any "out of the box" logstash functions for removing json properties that have empty field names. e.g. { "event": { "data": { "" : "some value" } } } I'm not a… --- ## [Auditbeat service is not starting in Centos](https://discuss.elastic.co/t/auditbeat-service-is-not-starting-in-centos/262531)
**Author:** [@Sivapriya](https://discuss.elastic.co/u/Sivapriya)\ **Replies:** 0\ **Last updated:** [January 28, 2021, 4:25pm UTC](https://discuss.elastic.co/t/auditbeat-service-is-not-starting-in-centos/262531 "2021-01-28T16:25:32Z")
Host Info: I am running the service as a root user {"system\_info": {"host": {"architecture":"i686","boot\_time":"2020-03-06T07:06:21Z","containerized":false,"name","kernel\_version":"2.6.32-754.27.1.el6.i686","mac":\["00:… --- ## [MSSQL metric in windows](https://discuss.elastic.co/t/mssql-metric-in-windows/260197)
**Author:** [@rohan0018](https://discuss.elastic.co/u/rohan0018)\ **Replies:** 8\ **Last updated:** [January 28, 2021, 3:25pm UTC](https://discuss.elastic.co/t/mssql-metric-in-windows/260197 "2021-01-28T15:25:16Z")
I have installed metricbeat MSSQL module in windows, but when I enable MSSQL module metricbeat service auto stop. Metricbeat service worksonly if MSSQL module is disabled. Please help --- ## [Filebeat 7.10.1 cannot write to /var/log/filebeat](https://discuss.elastic.co/t/filebeat-7-10-1-cannot-write-to-var-log-filebeat/262419)
**Author:** [@matG](https://discuss.elastic.co/u/matG)\ **Replies:** 1\ **Last updated:** [January 28, 2021, 3:12pm UTC](https://discuss.elastic.co/t/filebeat-7-10-1-cannot-write-to-var-log-filebeat/262419 "2021-01-28T15:12:34Z")
Hi :slight\_smile: I am currently having an issue with filebeat. It is running and can connect to the kafka host although it is not creating /var/log/filebeat nor writing to it. Which I believe is key to then send the be… --- ## [Logstash doesn't work on windows](https://discuss.elastic.co/t/logstash-doesnt-work-on-windows/262506)
**Author:** [@l418](https://discuss.elastic.co/u/l418)\ **Replies:** 4\ **Last updated:** [January 28, 2021, 3:03pm UTC](https://discuss.elastic.co/t/logstash-doesnt-work-on-windows/262506 "2021-01-28T15:03:52Z")
Hello. Trying to populate simple elastic cluster from demo using windows Your logstash windows implementation seems broken completely file { path =\> "/var/log/apache2/access.log" start\_position =\> "beginning" since… --- ## [Custom naming the new indices from a Rollover](https://discuss.elastic.co/t/custom-naming-the-new-indices-from-a-rollover/262492)
**Author:** [@Eilon\_Reif](https://discuss.elastic.co/u/Eilon_Reif)\ **Replies:** 0\ **Last updated:** [January 28, 2021, 11:43am UTC](https://discuss.elastic.co/t/custom-naming-the-new-indices-from-a-rollover/262492 "2021-01-28T11:43:26Z")
Hi, Is there a way to name the new indices by date? something like: my-index-(now/d), instead of just an increasing number. (I'm indexing data by using the API directly, with out any ingestion server) Thanks SOLVED … --- ## [Send to different indices with filebeat modules and ILM enabled](https://discuss.elastic.co/t/send-to-different-indices-with-filebeat-modules-and-ilm-enabled/262507)
**Author:** [@nber](https://discuss.elastic.co/u/nber)\ **Replies:** 0\ **Last updated:** [January 28, 2021, 1:43pm UTC](https://discuss.elastic.co/t/send-to-different-indices-with-filebeat-modules-and-ilm-enabled/262507 "2021-01-28T13:43:36Z")
Hey there, I'd like to collect logs on a device with different modules and send them to different indices. The question itself is answered in: Though, as far as I understand, this only works when ILM is disabled. Yet… --- ## [Range in data table is not working](https://discuss.elastic.co/t/range-in-data-table-is-not-working/262490)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 4\ **Last updated:** [January 28, 2021, 1:39pm UTC](https://discuss.elastic.co/t/range-in-data-table-is-not-working/262490 "2021-01-28T13:39:42Z")
Hi, I have a ELK setup of 7.10.0v. I created a data table visualization with Range in bucket, but it is not giving the correct value. PFA of the data table with out range. Here it is givin the total U-clients "126,9… --- ## [Raw data visualization takes too much time](https://discuss.elastic.co/t/raw-data-visualization-takes-too-much-time/262479)
**Author:** [@Shalhevet](https://discuss.elastic.co/u/Shalhevet)\ **Replies:** 2\ **Last updated:** [January 28, 2021, 1:39pm UTC](https://discuss.elastic.co/t/raw-data-visualization-takes-too-much-time/262479 "2021-01-28T13:39:33Z")
Hi, I am trying to create line chart visualization of field Y vs. PatchNo field. I have more then 10K documents, but even if I limit the buckets size to 1000, it takes few minutes for the vis. to get updated. why is i… --- ## [Not able to login with a new created user into kibana](https://discuss.elastic.co/t/not-able-to-login-with-a-new-created-user-into-kibana/262454)
**Author:** [@Abhishek\_Shah](https://discuss.elastic.co/u/Abhishek_Shah)\ **Replies:** 1\ **Last updated:** [January 28, 2021, 1:32pm UTC](https://discuss.elastic.co/t/not-able-to-login-with-a-new-created-user-into-kibana/262454 "2021-01-28T13:32:29Z")
I have created a user using elasticsearch security API. But I am not able to login into kibana using the newly created user. Do I need to make any configuration changes or any other reason? ELK Stack is hosted on elasti… --- ## ['Lock' in Persistent Volumes on Openshift when deploys blue-green ELK Stack](https://discuss.elastic.co/t/lock-in-persistent-volumes-on-openshift-when-deploys-blue-green-elk-stack/262377)
**Author:** [@jonhmb](https://discuss.elastic.co/u/jonhmb)\ **Replies:** 4\ **Last updated:** [January 28, 2021, 1:17pm UTC](https://discuss.elastic.co/t/lock-in-persistent-volumes-on-openshift-when-deploys-blue-green-elk-stack/262377 "2021-01-28T13:17:57Z")
I have an ELK Stack running in a Openshift POD as 'Blue' using Persistent Volumes to storage data. When I try to deploy a second ELK Stack in a second POD using the same Persistent Volumes, i get an error because ELK Vo… --- ## [Return multiple fields when performing aggregations](https://discuss.elastic.co/t/return-multiple-fields-when-performing-aggregations/262502)
**Author:** [@ArifAlili](https://discuss.elastic.co/u/ArifAlili)\ **Replies:** 0\ **Last updated:** [January 28, 2021, 1:13pm UTC](https://discuss.elastic.co/t/return-multiple-fields-when-performing-aggregations/262502 "2021-01-28T13:13:57Z")
Hi all, Is there a way to return other fields besides "key" and "doc\_count" when performing aggregations? I don't want to do aggregation on multiple fields, I just want multiple fields to be returned in Aggregation res… --- ## [ImportError: cannot import name ‘decodestring’ from ‘base64’ (/usr/lib64/python3.9/base64.py)](https://discuss.elastic.co/t/importerror-cannot-import-name-decodestring-from-base64-usr-lib64-python3-9-base64-py/262248)
**Author:** [@Green\_Max](https://discuss.elastic.co/u/Green_Max)\ **Replies:** 4\ **Last updated:** [January 27, 2021, 12:53pm UTC](https://discuss.elastic.co/t/importerror-cannot-import-name-decodestring-from-base64-usr-lib64-python3-9-base64-py/262248 "2021-01-27T12:53:49Z")
can you help me to fix bug that says Traceback (most recent call last): File "/home/fofive/PycharmProjects/pythonProject/main.py", line 1, in \ from elasticsearch import Elasticsearch, RequestsH… --- ## [Sorting @timestamp while exporting from elasticsearch and writing into csv](https://discuss.elastic.co/t/sorting-timestamp-while-exporting-from-elasticsearch-and-writing-into-csv/262496)
**Author:** [@ritusingh](https://discuss.elastic.co/u/ritusingh)\ **Replies:** 0\ **Last updated:** [January 28, 2021, 12:35pm UTC](https://discuss.elastic.co/t/sorting-timestamp-while-exporting-from-elasticsearch-and-writing-into-csv/262496 "2021-01-28T12:35:04Z")
Hi, Problem Statement: To export the logs from elasticsearch and write into csv in timewise order(either increasing or decreasing) Solution: I am using logstash , configuration is given below, input { elasticsearch {… --- ## [Percentage in scripted fields](https://discuss.elastic.co/t/percentage-in-scripted-fields/262489)
**Author:** [@Pranusha119](https://discuss.elastic.co/u/Pranusha119)\ **Replies:** 2\ **Last updated:** [January 28, 2021, 12:38pm UTC](https://discuss.elastic.co/t/percentage-in-scripted-fields/262489 "2021-01-28T12:38:53Z")
Hi I have divided two fields using below script return doc\['StatusOpen'\].value/doc\['StatusSent'\].value for this result should be 2/31 = 0.06451 = 6.451% but it's giving 0 % As I have format as percentage and Numer… --- ## [Vega scatterplot with specific color to each value](https://discuss.elastic.co/t/vega-scatterplot-with-specific-color-to-each-value/262268)
**Author:** [@Shalhevet](https://discuss.elastic.co/u/Shalhevet)\ **Replies:** 4\ **Last updated:** [January 28, 2021, 10:59am UTC](https://discuss.elastic.co/t/vega-scatterplot-with-specific-color-to-each-value/262268 "2021-01-28T10:59:06Z")
I have an index in which each document has ‘X Location’ field, ‘Y Location’ field and ‘rgb’ field. The ‘rgb’ field contains rgb values of string format rgb(x,y,z). I would like to visualize the data, and I tried to m… --- ## [Kibana Visualization for Sensor Outage](https://discuss.elastic.co/t/kibana-visualization-for-sensor-outage/261898)
**Author:** [@kpraveeng](https://discuss.elastic.co/u/kpraveeng)\ **Replies:** 1\ **Last updated:** [January 28, 2021, 10:50am UTC](https://discuss.elastic.co/t/kibana-visualization-for-sensor-outage/261898 "2021-01-28T10:50:32Z")
I want to create Kibana Visualization for Sensor Outage. Sensor Outage means that data for a given sensor is not received for a period of 10 min. So the visualization should show the count of sensors that did not send da… --- ## [Configure TLS/SSL for elasticsearch using Letsencrypt issue](https://discuss.elastic.co/t/configure-tls-ssl-for-elasticsearch-using-letsencrypt-issue/262352)
**Author:** [@gvx3](https://discuss.elastic.co/u/gvx3)\ **Replies:** 1\ **Last updated:** [January 28, 2021, 10:21am UTC](https://discuss.elastic.co/t/configure-tls-ssl-for-elasticsearch-using-letsencrypt-issue/262352 "2021-01-28T10:21:24Z")
Hi all, I'm trying to configure TLS connection for elasticsearch using helm package, here is current configuration: protocol: https secretMounts: - name: certall secretName: certall path: /… --- ## [Data table Visualisation not showing correct result for numeric data](https://discuss.elastic.co/t/data-table-visualisation-not-showing-correct-result-for-numeric-data/261947)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 6\ **Last updated:** [January 28, 2021, 9:47am UTC](https://discuss.elastic.co/t/data-table-visualisation-not-showing-correct-result-for-numeric-data/261947 "2021-01-28T09:47:49Z")
I am working with Cloudflare analytics data and trying to create a data table visualization to show the sum of the bandwidth in descending order for fields bandwidth.ssl.encrypted, bandwidth.ssl.unencrypted, bandwidth.ss… --- ## [Problem with syslog in Fleet-Elastic agent-System Integration](https://discuss.elastic.co/t/problem-with-syslog-in-fleet-elastic-agent-system-integration/262464)
**Author:** [@bjarnej](https://discuss.elastic.co/u/bjarnej)\ **Replies:** 0\ **Last updated:** [January 28, 2021, 8:41am UTC](https://discuss.elastic.co/t/problem-with-syslog-in-fleet-elastic-agent-system-integration/262464 "2021-01-28T08:41:06Z")
I deployed an Elastic Agent 7.10.2 on Debian Linux using Fleet and the "System Integration", all metric logs disabled. Default the System integration will look in: /var/log/auth.log\* and /var/log/secure\* for "System au… --- ## [405 error when calling /\_cluster/health?level=indices from a watcher](https://discuss.elastic.co/t/405-error-when-calling-cluster-health-level-indices-from-a-watcher/262457)
**Author:** [@mkadiri](https://discuss.elastic.co/u/mkadiri)\ **Replies:** 2\ **Last updated:** [January 28, 2021, 8:30am UTC](https://discuss.elastic.co/t/405-error-when-calling-cluster-health-level-indices-from-a-watcher/262457 "2021-01-28T08:30:19Z")
I'm trying to setup a watcher to display indices health using the endpoint mentioned but keep getting a 405 error. This error goes away when I just use the following /\_cluster/health dropping the params ?level=indices, … --- ## ["failed parsing time field" + "failed using layout"](https://discuss.elastic.co/t/failed-parsing-time-field-failed-using-layout/262433)
**Author:** [@6NMgfDwZ3](https://discuss.elastic.co/u/6NMgfDwZ3)\ **Replies:** 0\ **Last updated:** [January 28, 2021, 12:23am UTC](https://discuss.elastic.co/t/failed-parsing-time-field-failed-using-layout/262433 "2021-01-28T00:23:08Z")
Hello, I am trying to convert a microseconds precision time field to @timestamp but I got error messages. A part of the Filebeat config lines, related to the issue: processors: - decode\_json\_fields: fields: \["… --- ## [Elasticsearch python async client multiple requests](https://discuss.elastic.co/t/elasticsearch-python-async-client-multiple-requests/262460)
**Author:** [@NerdSec](https://discuss.elastic.co/u/NerdSec)\ **Replies:** 0\ **Last updated:** [January 28, 2021, 7:07am UTC](https://discuss.elastic.co/t/elasticsearch-python-async-client-multiple-requests/262460 "2021-01-28T07:07:18Z")
Hi, I was trying to use the Elasticsearch python client to make async queries to Elasticsearch. I'm trying to run aggs, and have a few partitions that I want to fetch results from. Here is my query: { 'query': { 'bo… --- ## [Trying to pass mongodb id as elasticsearch id](https://discuss.elastic.co/t/trying-to-pass-mongodb-id-as-elasticsearch-id/262449)
**Author:** [@fidsamurai](https://discuss.elastic.co/u/fidsamurai)\ **Replies:** 1\ **Last updated:** [January 28, 2021, 6:40am UTC](https://discuss.elastic.co/t/trying-to-pass-mongodb-id-as-elasticsearch-id/262449 "2021-01-28T06:40:37Z")
Logstash 7.8 We have a case where we collect logs from a mobile app using parse-sdk. The data is sent to a MongoDB replicaset. Logstash is configured using the mongoschema jdbc driver to pull the data from Mongo and p… --- ## [Search based on aggregation result](https://discuss.elastic.co/t/search-based-on-aggregation-result/262431)
**Author:** [@Julian\_Ganzabal](https://discuss.elastic.co/u/Julian_Ganzabal)\ **Replies:** 2\ **Last updated:** [January 28, 2021, 1:37am UTC](https://discuss.elastic.co/t/search-based-on-aggregation-result/262431 "2021-01-28T01:37:48Z")
I am actually doing a query with an aggregation that returns a list from which I need to re-search. So, I get the aggregated data and then do a search on this aggregated data. That means 2 requests to Elasticsearch Is … --- ## [All data nodes oom down during heavily indexing periods](https://discuss.elastic.co/t/all-data-nodes-oom-down-during-heavily-indexing-periods/262376)
**Author:** [@wangxr1985](https://discuss.elastic.co/u/wangxr1985)\ **Replies:** 2\ **Last updated:** [January 28, 2021, 3:19am UTC](https://discuss.elastic.co/t/all-data-nodes-oom-down-during-heavily-indexing-periods/262376 "2021-01-28T03:19:34Z")
ES version: 7.5.2 JDK version: bundled openjdk 13 GC settings: -XX:+UseG1GC -XX:MaxGCPauseMillis=20 -XX:+UnlockExperimentalVMOptions -XX:G1NewSizePercent=2 We do heavily indexing(enable sniffing and all data node… --- ## [All documents via Cylance module are failing to extract fields](https://discuss.elastic.co/t/all-documents-via-cylance-module-are-failing-to-extract-fields/262437)
**Author:** [@10FoyfBqA](https://discuss.elastic.co/u/10FoyfBqA)\ **Replies:** 0\ **Last updated:** [January 28, 2021, 1:54am UTC](https://discuss.elastic.co/t/all-documents-via-cylance-module-are-failing-to-extract-fields/262437 "2021-01-28T01:54:59Z")
I'm trying to configure the Cylance module in Filebeat, but it is not extracting any fields from log messages, and all documents have the value dissect\_parsing\_error in the log.flags. I have setup a filebeat collector l… --- ## [Curator date match does not meet provided criteria](https://discuss.elastic.co/t/curator-date-match-does-not-meet-provided-criteria/262300)
**Author:** [@kyle\_che](https://discuss.elastic.co/u/kyle_che)\ **Replies:** 2\ **Last updated:** [January 28, 2021, 12:09am UTC](https://discuss.elastic.co/t/curator-date-match-does-not-meet-provided-criteria/262300 "2021-01-28T00:09:05Z")
I'm trying to run curator and getting "does not meet provided criteria. Removing from list." Any idea on why the pattern below is not matching the index name? 3: action: delete\_indices description: \>- De… --- ## [Jolokia agent id and name](https://discuss.elastic.co/t/jolokia-agent-id-and-name/262430)
**Author:** [@bucks](https://discuss.elastic.co/u/bucks)\ **Replies:** 0\ **Last updated:** [January 27, 2021, 11:40pm UTC](https://discuss.elastic.co/t/jolokia-agent-id-and-name/262430 "2021-01-27T23:40:05Z")
Hello All - We are trying Jolokia for capturing JVM metrics. When we configure Jolokia to receive data from multiple JVMs it is hard to identify the which JVM is sending the data. Jolokia documentation says that we hav… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1582) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1584)