# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1586 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1587 --- ## [Metricbeat AWS module endpoint not working correctly](https://discuss.elastic.co/t/metricbeat-aws-module-endpoint-not-working-correctly/261589)
**Author:** [@cjm3625](https://discuss.elastic.co/u/cjm3625)\ **Replies:** 8\ **Last updated:** [January 26, 2021, 8:43pm UTC](https://discuss.elastic.co/t/metricbeat-aws-module-endpoint-not-working-correctly/261589 "2021-01-26T20:43:56Z")
aws.yml is as follows regions: us-iso-east-1 endpoint: us-iso-east-1.c2s.ic.gov period: 5m metricsets: - ec2 The error is ListMetricsRequest failed: send request failed. followed by a proxy error driven by … --- ## [High RAM usage by data nodes (Kubernetes)](https://discuss.elastic.co/t/high-ram-usage-by-data-nodes-kubernetes/262008)
**Author:** [@itsron](https://discuss.elastic.co/u/itsron)\ **Replies:** 4\ **Last updated:** [January 26, 2021, 7:58pm UTC](https://discuss.elastic.co/t/high-ram-usage-by-data-nodes-kubernetes/262008 "2021-01-26T19:58:32Z")
We are running v7.10.1 on Kubernetes. We've 4 data nodes each with 4 cpus and 16gb RAM (8gb heap). Currently it has only metricbeat and filebeat writing data into it which is a total of ~1.5M docs/hour (~10GB/day,retaine… --- ## [Repo for zip/tar logstash plugins](https://discuss.elastic.co/t/repo-for-zip-tar-logstash-plugins/262166)
**Author:** [@edster](https://discuss.elastic.co/u/edster)\ **Replies:** 3\ **Last updated:** [January 26, 2021, 6:16pm UTC](https://discuss.elastic.co/t/repo-for-zip-tar-logstash-plugins/262166 "2021-01-26T18:16:30Z")
Hello, I am looking for a link to a repo or some location that can provide me logstash plugin zip/tar files. My servers do not have internet connection/access. So I am looking to install logstash plugins offline. However… --- ## [OAuth authentication](https://discuss.elastic.co/t/oauth-authentication/262081)
**Author:** [@atira](https://discuss.elastic.co/u/atira)\ **Replies:** 2\ **Last updated:** [January 26, 2021, 5:49pm UTC](https://discuss.elastic.co/t/oauth-authentication/262081 "2021-01-26T17:49:03Z")
Hi, Is it somehow possible to use 2-legged OAuth authentication, specifically client\_credentials and password type, with Heartbeat? The goal is to request a token by a single request to the oauth server, extract the to… --- ## [Efficient way of querying multiple ElasticSearch Indexes at once | Tools for visualization other than kibana](https://discuss.elastic.co/t/efficient-way-of-querying-multiple-elasticsearch-indexes-at-once-tools-for-visualization-other-than-kibana/261874)
**Author:** [@Vijay\_Gupta](https://discuss.elastic.co/u/Vijay_Gupta)\ **Replies:** 1\ **Last updated:** [January 26, 2021, 5:30pm UTC](https://discuss.elastic.co/t/efficient-way-of-querying-multiple-elasticsearch-indexes-at-once-tools-for-visualization-other-than-kibana/261874 "2021-01-26T17:30:57Z")
Hello Team, We explored kibana, however it seems very limited to our need. Can you please suggest, what are others recommended tools for visualization by joining multiple indexes from ElasticSearch. And how we can que… --- ## [No error in logstash. But no data in kibana](https://discuss.elastic.co/t/no-error-in-logstash-but-no-data-in-kibana/262143)
**Author:** [@ranjini](https://discuss.elastic.co/u/ranjini)\ **Replies:** 4\ **Last updated:** [January 26, 2021, 5:08pm UTC](https://discuss.elastic.co/t/no-error-in-logstash-but-no-data-in-kibana/262143 "2021-01-26T17:08:35Z")
I don't see any indices created in amazon ES. architecture filebeat-\> logstash-\> amazon ES. filebeat conf filebeat.inputs: - type: log paths: - /var/test.log fields: tags: test environment: uflek … --- ## [Filebeat error: Exiting: Error in initing input: the processor dissect doesn't exist](https://discuss.elastic.co/t/filebeat-error-exiting-error-in-initing-input-the-processor-dissect-doesnt-exist/262255)
**Author:** [@eeijlar](https://discuss.elastic.co/u/eeijlar)\ **Replies:** 0\ **Last updated:** [January 26, 2021, 4:16pm UTC](https://discuss.elastic.co/t/filebeat-error-exiting-error-in-initing-input-the-processor-dissect-doesnt-exist/262255 "2021-01-26T16:16:08Z")
I am getting this error when I start the filebeat container in kubernetes: 2021-01-26T15:59:47.358Z INFO input/input.go:88 Starting input of type: log; ID: 11352026245999945754 2021-01-26T15:59… --- ## [Input command not executing](https://discuss.elastic.co/t/input-command-not-executing/262137)
**Author:** [@Christophe\_Dumont](https://discuss.elastic.co/u/Christophe_Dumont)\ **Replies:** 3\ **Last updated:** [January 26, 2021, 4:48pm UTC](https://discuss.elastic.co/t/input-command-not-executing/262137 "2021-01-26T16:48:12Z")
Hello, I'm trying to run a command every 10 seconds but it's not working. Here's my conf file : input { exec { command =\> "/home/xxx/CICFlow/bin/cfm \> '/tmp/logstash.log'" interval =\> 10 } } --- ## [Building Elasticsearch source code stuck at 99%](https://discuss.elastic.co/t/building-elasticsearch-source-code-stuck-at-99/262242)
**Author:** [@Amr\_Rady](https://discuss.elastic.co/u/Amr_Rady)\ **Replies:** 1\ **Last updated:** [January 26, 2021, 4:46pm UTC](https://discuss.elastic.co/t/building-elasticsearch-source-code-stuck-at-99/262242 "2021-01-26T16:46:32Z")
I am trying to build the source code but it stuck at 99% --- ## [Unable to set custom index name in metricbeat taml file](https://discuss.elastic.co/t/unable-to-set-custom-index-name-in-metricbeat-taml-file/262252)
**Author:** [@navin1093](https://discuss.elastic.co/u/navin1093)\ **Replies:** 0\ **Last updated:** [January 26, 2021, 3:51pm UTC](https://discuss.elastic.co/t/unable-to-set-custom-index-name-in-metricbeat-taml-file/262252 "2021-01-26T15:51:11Z")
I tried to set custom index name however it was not working. below are my config setup.ilm.enabled: false output.elasticsearch.index: "%{\[metricset.name\]}-=-%{\[event.module\]}%{+yyyy.MM.dd}" setup.template.name: "%{… --- ## [How to filter out IP from auth.log](https://discuss.elastic.co/t/how-to-filter-out-ip-from-auth-log/262231)
**Author:** [@john8](https://discuss.elastic.co/u/john8)\ **Replies:** 0\ **Last updated:** [January 26, 2021, 1:23pm UTC](https://discuss.elastic.co/t/how-to-filter-out-ip-from-auth-log/262231 "2021-01-26T13:23:56Z")
hello newbie here I am running ELK on VMWare16 I need a little bit of help I have enabled the filebeat module called system but I am unable to get the clientip from there it falls under the message category Filebeat.y… --- ## [XML Logs in single-line challenge](https://discuss.elastic.co/t/xml-logs-in-single-line-challenge/262249)
**Author:** [@Igor\_Teresco](https://discuss.elastic.co/u/Igor_Teresco)\ **Replies:** 0\ **Last updated:** [January 26, 2021, 3:39pm UTC](https://discuss.elastic.co/t/xml-logs-in-single-line-challenge/262249 "2021-01-26T15:39:12Z")
Have some applications writing their logs as a single line XML files, no LF, no CR... Is there a way to get them uploaded by FileBeat to LogStash? --- ## [Another Kibana instance appears to be migrating the index](https://discuss.elastic.co/t/another-kibana-instance-appears-to-be-migrating-the-index/261145)
**Author:** [@Jambo80](https://discuss.elastic.co/u/Jambo80)\ **Replies:** 8\ **Last updated:** [January 26, 2021, 3:27pm UTC](https://discuss.elastic.co/t/another-kibana-instance-appears-to-be-migrating-the-index/261145 "2021-01-26T15:27:06Z")
Hi I am relatively new to ELK and recently upgraded from 6.X to 6.8.13. When I start Kibana I now see the following error: "tags":\["warning","migrations"\],"pid":15615,"message":"Another Kibana instance appears to be mi… --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/262091)
**Author:** [@jayanth\_m](https://discuss.elastic.co/u/jayanth_m)\ **Replies:** 8\ **Last updated:** [January 26, 2021, 3:09pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/262091 "2021-01-26T15:09:13Z")
Im getting Kibana server is not ready yet error when Opening Kibana dashboard After Looking into the logs, I observed below error: {"type":"log","@timestamp":"2021-01-25T11:11:14Z","tags":\["error","elasticsearch","data… --- ## [Kibana TSVB data is not displayed on legend](https://discuss.elastic.co/t/kibana-tsvb-data-is-not-displayed-on-legend/261909)
**Author:** [@haythem](https://discuss.elastic.co/u/haythem)\ **Replies:** 3\ **Last updated:** [January 26, 2021, 2:52pm UTC](https://discuss.elastic.co/t/kibana-tsvb-data-is-not-displayed-on-legend/261909 "2021-01-26T14:52:19Z")
Hi guys , lately i installed the ELK 7.10.0 and created 2 time series graphs in TSVB , so the problem is that when i put the cursor on a point on the first graph it show me the values on the legend of that graph but no… --- ## [KIbana "Kibana server is not ready yet" -- routing disabled during upgrade](https://discuss.elastic.co/t/kibana-kibana-server-is-not-ready-yet-routing-disabled-during-upgrade/257245)
**Author:** [@OntheHighSeas](https://discuss.elastic.co/u/OntheHighSeas)\ **Replies:** 6\ **Last updated:** [January 26, 2021, 2:50pm UTC](https://discuss.elastic.co/t/kibana-kibana-server-is-not-ready-yet-routing-disabled-during-upgrade/257245 "2021-01-26T14:50:53Z")
Hi. So I think I made the mistake of upgrading to v7.10 Kibana with my cluster routing disabled, and as a result Kibana is stuck migrating. It's constantly producing log messages along the line of; \["info", "savedobj… --- ## [Dissect on a multiline message field](https://discuss.elastic.co/t/dissect-on-a-multiline-message-field/262122)
**Author:** [@abev](https://discuss.elastic.co/u/abev)\ **Replies:** 1\ **Last updated:** [January 26, 2021, 2:50pm UTC](https://discuss.elastic.co/t/dissect-on-a-multiline-message-field/262122 "2021-01-26T14:50:13Z")
I have a multiline message field and I have to extract a field with tokenizer from a starting point to the end of the line. How can I select as ending point the new line? --- ## [Upgrading Kibana to 7.10.2 hangs while migrating](https://discuss.elastic.co/t/upgrading-kibana-to-7-10-2-hangs-while-migrating/262197)
**Author:** [@IslandMan](https://discuss.elastic.co/u/IslandMan)\ **Replies:** 2\ **Last updated:** [January 26, 2021, 1:53pm UTC](https://discuss.elastic.co/t/upgrading-kibana-to-7-10-2-hangs-while-migrating/262197 "2021-01-26T13:53:31Z")
Opening a new thread as suggested by @rudolf. So I've restored .kibana\_\* from a snapshot and started a 7.10.2 kibana server that in turn starts the migration. These are the logs it producses: Jan 26 08:03:50 ip-10-164… --- ## [Setting up Metricbeat to pull Exchange Perfmon](https://discuss.elastic.co/t/setting-up-metricbeat-to-pull-exchange-perfmon/261845)
**Author:** [@zachswill](https://discuss.elastic.co/u/zachswill)\ **Replies:** 2\ **Last updated:** [January 26, 2021, 1:44pm UTC](https://discuss.elastic.co/t/setting-up-metricbeat-to-pull-exchange-perfmon/261845 "2021-01-26T13:44:07Z")
Trying to get Metricbeat to collect the exchange perfmon counters. Here is my current config. Any thoughts? I am getting counter not found. module: windows metricsets: \[perfmon\] period: 30s perfmon.ignore\_non\_existe… --- ## [Agents are running properly but no data in Data Stream](https://discuss.elastic.co/t/agents-are-running-properly-but-no-data-in-data-stream/260111)
**Author:** [@nomoneynoproblems](https://discuss.elastic.co/u/nomoneynoproblems)\ **Replies:** 16\ **Last updated:** [January 26, 2021, 1:35pm UTC](https://discuss.elastic.co/t/agents-are-running-properly-but-no-data-in-data-stream/260111 "2021-01-26T13:35:23Z")
Using Elastic Cloud I'm not seeing any data in the data stream section even though a test "Rails Prod" server is showing "Online". --- ## [Kibana Visualization: How to display long legend string?](https://discuss.elastic.co/t/kibana-visualization-how-to-display-long-legend-string/262230)
**Author:** [@AmS](https://discuss.elastic.co/u/AmS)\ **Replies:** 1\ **Last updated:** [January 26, 2021, 1:23pm UTC](https://discuss.elastic.co/t/kibana-visualization-how-to-display-long-legend-string/262230 "2021-01-26T13:23:04Z")
Hello , I am using Kibana 7.10. I would like to display a long string in the legend in my visualization . I have always a truncated part of the string like "Long string to..." rather then "long string to display" Are… --- ## [Logstah tcp input plugin](https://discuss.elastic.co/t/logstah-tcp-input-plugin/262116)
**Author:** [@gongon](https://discuss.elastic.co/u/gongon)\ **Replies:** 3\ **Last updated:** [January 26, 2021, 1:18pm UTC](https://discuss.elastic.co/t/logstah-tcp-input-plugin/262116 "2021-01-26T13:18:20Z")
Hello, When I use the tcp input plugin in mode server, it works. But it does not work in mode client.It can connect to the server,but does not receive data.It's about a webserver : I try to extract data from a database … --- ## [Logstash pipeline service failed with X-Pack](https://discuss.elastic.co/t/logstash-pipeline-service-failed-with-x-pack/262119)
**Author:** [@esijati](https://discuss.elastic.co/u/esijati)\ **Replies:** 1\ **Last updated:** [January 26, 2021, 12:58pm UTC](https://discuss.elastic.co/t/logstash-pipeline-service-failed-with-x-pack/262119 "2021-01-26T12:58:29Z")
Hi, I have created a logstash service (tarball) and enabled the x-pack management. But getting the below error while running the service. \[ERROR\]\[logstash.config.sourceloader\] Could not fetch all the sources {:exceptio… --- ## [Filebeat multiline.pattern set up](https://discuss.elastic.co/t/filebeat-multiline-pattern-set-up/262229)
**Author:** [@JimJ](https://discuss.elastic.co/u/JimJ)\ **Replies:** 0\ **Last updated:** [January 26, 2021, 12:45pm UTC](https://discuss.elastic.co/t/filebeat-multiline-pattern-set-up/262229 "2021-01-26T12:45:18Z")
I have to ingest a text file with multilines running filebeat 7.1.1. But the format is different from anything I've had so far. Here below is an example. Each line starts with timestamp+loglevel+"\[stderr\]"+ "(componen… --- ## [S3 output event per file](https://discuss.elastic.co/t/s3-output-event-per-file/262037)
**Author:** [@Sunflower](https://discuss.elastic.co/u/Sunflower)\ **Replies:** 1\ **Last updated:** [January 26, 2021, 12:23pm UTC](https://discuss.elastic.co/t/s3-output-event-per-file/262037 "2021-01-26T12:23:56Z")
Hi, I'm using the S3 output plugin and I noticed that I'm receiving files that include multiple events per file. How can I create a file for each event? I saw the option to limit the file size but I'm not sure it is g… --- ## [ES 6.8.0 on Ubuntu 16.04 starts properly but Systemd times out](https://discuss.elastic.co/t/es-6-8-0-on-ubuntu-16-04-starts-properly-but-systemd-times-out/262155)
**Author:** [@jtbis](https://discuss.elastic.co/u/jtbis)\ **Replies:** 2\ **Last updated:** [January 26, 2021, 12:15pm UTC](https://discuss.elastic.co/t/es-6-8-0-on-ubuntu-16-04-starts-properly-but-systemd-times-out/262155 "2021-01-26T12:15:30Z")
Hello, I have a server where ES is starting properly, but the service is always showing activating. With TimeoutStartSec=infinity in the service file, everything functions as normal except for the service always stayin… --- ## [Can I use "script" to truncate a field so it's 950 characters or less in a watcher?](https://discuss.elastic.co/t/can-i-use-script-to-truncate-a-field-so-its-950-characters-or-less-in-a-watcher/261277)
**Author:** [@runtman](https://discuss.elastic.co/u/runtman)\ **Replies:** 1\ **Last updated:** [January 26, 2021, 12:06pm UTC](https://discuss.elastic.co/t/can-i-use-script-to-truncate-a-field-so-its-950-characters-or-less-in-a-watcher/261277 "2021-01-26T12:06:38Z")
So, we use PagerDuty as an action for our alerts. Unfortunately, with this action you can only set description so we must try to plug as much information into the field before we fire off the alert. Sometimes this means… --- ## [Create a view mysql with logstash](https://discuss.elastic.co/t/create-a-view-mysql-with-logstash/262223)
**Author:** [@MatteoM](https://discuss.elastic.co/u/MatteoM)\ **Replies:** 0\ **Last updated:** [January 26, 2021, 11:01am UTC](https://discuss.elastic.co/t/create-a-view-mysql-with-logstash/262223 "2021-01-26T11:01:02Z")
Hi there!, I was wondering if exists a way to create a view mysql through by the statement in the pipeline input jdbc. I need to create some views because these are involved in a query that I need it to save in a index… --- ## [On startup run filebeat restart upon fail](https://discuss.elastic.co/t/on-startup-run-filebeat-restart-upon-fail/262204)
**Author:** [@Peter\_Boos](https://discuss.elastic.co/u/Peter_Boos)\ **Replies:** 6\ **Last updated:** [January 26, 2021, 10:51am UTC](https://discuss.elastic.co/t/on-startup-run-filebeat-restart-upon-fail/262204 "2021-01-26T10:51:21Z")
On a test machine with Debian 10 with a desktop, filebeat did not startup after a hard VM reset. I would like to be sure that on Debian systems with a desktop and headless systems this service restart it self upon failu… --- ## [Timezone with negative (minus) value return more bucket before gte range](https://discuss.elastic.co/t/timezone-with-negative-minus-value-return-more-bucket-before-gte-range/262133)
**Author:** [@anas-hossam](https://discuss.elastic.co/u/anas-hossam)\ **Replies:** 0\ **Last updated:** [January 25, 2021, 4:13pm UTC](https://discuss.elastic.co/t/timezone-with-negative-minus-value-return-more-bucket-before-gte-range/262133 "2021-01-25T16:13:00Z")
i am trying to get docs matching query from elastic v1.5 { "range": { "create\_time": { "gte": "2020-07-20T00:00:00", "lte": "2020-07-30T23:59:59", "time\_zone": "-2:00" … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1585) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1587)