# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1591 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1592 --- ## [Geolocation configuration in logstash](https://discuss.elastic.co/t/geolocation-configuration-in-logstash/261937)
**Author:** [@Falikou1](https://discuss.elastic.co/u/Falikou1)\ **Replies:** 0\ **Last updated:** [January 22, 2021, 3:56pm UTC](https://discuss.elastic.co/t/geolocation-configuration-in-logstash/261937 "2021-01-22T15:56:33Z")
I configured my logstash to parse the logs. I now want to configure geolocation. Is there a unique configuration for geolocation? If so, I need help. Here is my logstash setup below. How to complete with the geolocati… --- ## [Elastic search raw events | Latest event retrieval](https://discuss.elastic.co/t/elastic-search-raw-events-latest-event-retrieval/261935)
**Author:** [@pkrahul236](https://discuss.elastic.co/u/pkrahul236)\ **Replies:** 0\ **Last updated:** [January 22, 2021, 3:47pm UTC](https://discuss.elastic.co/t/elastic-search-raw-events-latest-event-retrieval/261935 "2021-01-22T15:47:11Z")
Hello Folks, I want to create a dashboard on raw events data from elastic search. In this one particular raw event, I have status types as "In Progress", "Updated", "Completed" So I want to create a dashboard say "Ta… --- ## [\[Winlogbeat 7.10.1 dashboards\]: could not locate some index pattern fields](https://discuss.elastic.co/t/winlogbeat-7-10-1-dashboards-could-not-locate-some-index-pattern-fields/261530)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 5\ **Last updated:** [January 22, 2021, 3:41pm UTC](https://discuss.elastic.co/t/winlogbeat-7-10-1-dashboards-could-not-locate-some-index-pattern-fields/261530 "2021-01-22T15:41:17Z")
Hello, I am using Elasticsearch, kibana, logstash, and winlogbeat, all version 7.10.1 I configured winlogbeat and run: .\\winlogbeat.exe setup -e and I had no error in my winlogbeat logs, but in kibana there are some d… --- ## [Filter query to select only pure alphanumeric value but not numeric value](https://discuss.elastic.co/t/filter-query-to-select-only-pure-alphanumeric-value-but-not-numeric-value/261931)
**Author:** [@Vivek\_Vardhan](https://discuss.elastic.co/u/Vivek_Vardhan)\ **Replies:** 0\ **Last updated:** [January 22, 2021, 3:19pm UTC](https://discuss.elastic.co/t/filter-query-to-select-only-pure-alphanumeric-value-but-not-numeric-value/261931 "2021-01-22T15:19:50Z")
I have a field defined in ES as "fieldName": { "type": "text", "fields": { "keyword": { "type": "keyword" } … --- ## [Kibana and unknown field](https://discuss.elastic.co/t/kibana-and-unknown-field/261778)
**Author:** [@vincent2mots](https://discuss.elastic.co/u/vincent2mots)\ **Replies:** 8\ **Last updated:** [January 22, 2021, 2:58pm UTC](https://discuss.elastic.co/t/kibana-and-unknown-field/261778 "2021-01-22T14:58:49Z")
Hi there! I created an Index Pattern ".monitoring-es\*" and I try to create a dashboard on it. I would like to use the field "index\_stats.shards.total", like in the discover : Could you please help me? Why my field… --- ## [Change type data](https://discuss.elastic.co/t/change-type-data/261865)
**Author:** [@salma\_widiarti](https://discuss.elastic.co/u/salma_widiarti)\ **Replies:** 1\ **Last updated:** [January 22, 2021, 2:48pm UTC](https://discuss.elastic.co/t/change-type-data/261865 "2021-01-22T14:48:30Z")
Hi all, I want to change type data in labels.money from string to integer And i tried change using button pencil, and dropdown has no option type numeric Anyone can help me? --- ## [Changing Statistic in metricbeat](https://discuss.elastic.co/t/changing-statistic-in-metricbeat/261918)
**Author:** [@rudraram](https://discuss.elastic.co/u/rudraram)\ **Replies:** 0\ **Last updated:** [January 22, 2021, 1:24pm UTC](https://discuss.elastic.co/t/changing-statistic-in-metricbeat/261918 "2021-01-22T13:24:57Z")
Hello folks, I am trying to use metricbeat - lambda metricset to import Lambda metrics to ELK. Unfortunately all the metrics are 'averaged' while i need support for 'Sum' for few metrics I tried to add following to the … --- ## [Dockerized Filebeat monitor mounted host syslog](https://discuss.elastic.co/t/dockerized-filebeat-monitor-mounted-host-syslog/261923)
**Author:** [@d01](https://discuss.elastic.co/u/d01)\ **Replies:** 0\ **Last updated:** [January 22, 2021, 2:07pm UTC](https://discuss.elastic.co/t/dockerized-filebeat-monitor-mounted-host-syslog/261923 "2021-01-22T14:07:25Z")
I have filebeat set up along elasticsearch, logstash, kibana and other containers in docker using a docker-compose file. To monitor the host with this filebeat instance as well, I have the host /var/log/syslog mounted in… --- ## [Error occurred when reading the alert](https://discuss.elastic.co/t/error-occurred-when-reading-the-alert/261708)
**Author:** [@Anmol\_Dubey](https://discuss.elastic.co/u/Anmol_Dubey)\ **Replies:** 1\ **Last updated:** [January 22, 2021, 1:38pm UTC](https://discuss.elastic.co/t/error-occurred-when-reading-the-alert/261708 "2021-01-22T13:38:19Z")
I am seeing the following error in "alerts and Actions". Can someone guide me why this message is shown and how to resolve this? An error occurred when reading the alert.Unauthorized to get a "monitoring\_alert\_jvm\_memo… --- ## [Kibana alerts for internal elastic stack](https://discuss.elastic.co/t/kibana-alerts-for-internal-elastic-stack/261696)
**Author:** [@Anmol\_Dubey](https://discuss.elastic.co/u/Anmol_Dubey)\ **Replies:** 1\ **Last updated:** [January 22, 2021, 1:27pm UTC](https://discuss.elastic.co/t/kibana-alerts-for-internal-elastic-stack/261696 "2021-01-22T13:27:59Z")
Hello Team, I am trying to set up alerts for the internal elastic stack. I am assuming this would be a fairly common inquiry and I do not want to re-invent the wheel. Please help me identify key alerts that should be c… --- ## [Dissector mapping, pattern not found error](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-error/261904)
**Author:** [@Shubha](https://discuss.elastic.co/u/Shubha)\ **Replies:** 1\ **Last updated:** [January 22, 2021, 1:25pm UTC](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-error/261904 "2021-01-22T13:25:40Z")
Hi All, I am having the ELK version 7.10 on ec2 instances. facing the below error in logstash-plain.log. Can anyone help me on this. \[2021-01-22T10:29:00,423\]\[WARN \]\[org.logstash.dissect.Dissector\]\[main\]\[1cbe1dfc036a2… --- ## [Trouble with query term and è](https://discuss.elastic.co/t/trouble-with-query-term-and-egrave/261916)
**Author:** [@matmout](https://discuss.elastic.co/u/matmout)\ **Replies:** 0\ **Last updated:** [January 22, 2021, 1:04pm UTC](https://discuss.elastic.co/t/trouble-with-query-term-and-egrave/261916 "2021-01-22T13:04:55Z")
Hi Everybody ! I create a topic since I can't find a response anywhere, I have trouble using a query term with a term wich value contains è Here is an expemple, in Kibana console GET index/\_search { "query": { … --- ## [Logstash need server restart](https://discuss.elastic.co/t/logstash-need-server-restart/261913)
**Author:** [@Melvin\_Shaju](https://discuss.elastic.co/u/Melvin_Shaju)\ **Replies:** 1\ **Last updated:** [January 22, 2021, 1:03pm UTC](https://discuss.elastic.co/t/logstash-need-server-restart/261913 "2021-01-22T13:03:26Z")
I'm using logstash feeds to take data from json file then filter it and pass it to elastic search. Each time to run logstash feeds I need to restart the whole server, otherwise logstash is causing errors. Is there any so… --- ## [Filebeat permissions](https://discuss.elastic.co/t/filebeat-permissions/261912)
**Author:** [@mcamara](https://discuss.elastic.co/u/mcamara)\ **Replies:** 0\ **Last updated:** [January 22, 2021, 12:38pm UTC](https://discuss.elastic.co/t/filebeat-permissions/261912 "2021-01-22T12:38:04Z")
Hello, I am coming to ask for your help, for a problem I encountered with Filebeat. I installed the agent with user root and would like other users to be able to view the logs and conf. But by modifying the conf filebea… --- ## [Ensuring isolation of customer data](https://discuss.elastic.co/t/ensuring-isolation-of-customer-data/261794)
**Author:** [@ironcode](https://discuss.elastic.co/u/ironcode)\ **Replies:** 2\ **Last updated:** [January 22, 2021, 12:37pm UTC](https://discuss.elastic.co/t/ensuring-isolation-of-customer-data/261794 "2021-01-22T12:37:40Z")
Hi, I'm new to Elastic Cloud. I've been experimenting with ELK stack as part of my product, and I have a question from customer who is asking me to ensure that their data will not be on the same servers as anybody else. … --- ## [Subtract variables in Kibana canvas with essql](https://discuss.elastic.co/t/subtract-variables-in-kibana-canvas-with-essql/261803)
**Author:** [@blodstrupmoen](https://discuss.elastic.co/u/blodstrupmoen)\ **Replies:** 2\ **Last updated:** [January 21, 2021, 10:45pm UTC](https://discuss.elastic.co/t/subtract-variables-in-kibana-canvas-with-essql/261803 "2021-01-21T22:45:46Z")
Hi, Im having a real hard time subtracting one query from another. I cant seem to find any good examples on how to use var\_set and var properly. How can I subtract the value (epochtime) of variable "start" from variabl… --- ## [Stop elasticsearch from within a container](https://discuss.elastic.co/t/stop-elasticsearch-from-within-a-container/261455)
**Author:** [@cinemafunk](https://discuss.elastic.co/u/cinemafunk)\ **Replies:** 4\ **Last updated:** [January 22, 2021, 12:25pm UTC](https://discuss.elastic.co/t/stop-elasticsearch-from-within-a-container/261455 "2021-01-22T12:25:17Z")
I'm launched Graylog, MongoDB, and Elasticsearch docker container stack on a VM. My goal is to move my currently running Graylog instance from a manually installed Graylog instance from an Ubuntu VM, to another Ubtunu VM… --- ## [Two nodes, set on the same machine, can't see each other - Dev purposes](https://discuss.elastic.co/t/two-nodes-set-on-the-same-machine-cant-see-each-other-dev-purposes/261787)
**Author:** [@Mateusz\_Koper](https://discuss.elastic.co/u/Mateusz_Koper)\ **Replies:** 4\ **Last updated:** [January 22, 2021, 11:55am UTC](https://discuss.elastic.co/t/two-nodes-set-on-the-same-machine-cant-see-each-other-dev-purposes/261787 "2021-01-22T11:55:02Z")
Hi, We have a problem in our organization. We are trying to add second node, to existing cluster, on the same machine. I know it's not a good solution, but we only do it for development purposes. The version that we are… --- ## [Passing custom regex inside grok filter](https://discuss.elastic.co/t/passing-custom-regex-inside-grok-filter/261907)
**Author:** [@Flavio1](https://discuss.elastic.co/u/Flavio1)\ **Replies:** 1\ **Last updated:** [January 22, 2021, 11:49am UTC](https://discuss.elastic.co/t/passing-custom-regex-inside-grok-filter/261907 "2021-01-22T11:49:24Z")
Hi everybody, During these days i'm trying to implement a custom regex system configuration in order to have a single point, outside pipelines, in which i can make crud operations on regexes. I tried this solution: mut… --- ## [The parent task was cancelled, shouldn't start any child tasks](https://discuss.elastic.co/t/the-parent-task-was-cancelled-shouldnt-start-any-child-tasks/261686)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 6\ **Last updated:** [January 22, 2021, 10:46am UTC](https://discuss.elastic.co/t/the-parent-task-was-cancelled-shouldnt-start-any-child-tasks/261686 "2021-01-22T10:46:07Z")
Total shards 110 Data 3.7gb Indices 99 Problem in kibana monitoring section.The page was showing indices fails. In elasticsearch log file \[2021-01-20T21:27:16,584\]\[INFO \]\[o.e.m.j.JvmGcMonitorService\] \[elastic\] \[gc\]\[3… --- ## [:exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of \[ \\\\t\\\\r\\\\n\], \\"#\\", \[A-Za-z0-9\_-\], '\\"', \\"'\\", \[A-Za-z\_\], \\"-\\", \[0-9\], \\"\[\\", \\"{\\", \\"\]\\"](https://discuss.elastic.co/t/exception-logstash-configurationerror-message-expected-one-of-t-r-n-a-za-z0-9-a-za-z-0-9/261903)
**Author:** [@ashishkpal](https://discuss.elastic.co/u/ashishkpal)\ **Replies:** 0\ **Last updated:** [January 22, 2021, 10:44am UTC](https://discuss.elastic.co/t/exception-logstash-configurationerror-message-expected-one-of-t-r-n-a-za-z0-9-a-za-z-0-9/261903 "2021-01-22T10:44:23Z")
hi, i want to push the ELB logs from s3 to ELK for the same have i have written the logstash.conf file like this input { s3 { access\_key\_id =\> "..." secret\_access\_key =\> "..." bucket =\> "..." region =\> "eu-central… --- ## [Elasticsearch 7.6.2 service not starting on CentOS 7.x with cPanel installed on it](https://discuss.elastic.co/t/elasticsearch-7-6-2-service-not-starting-on-centos-7-x-with-cpanel-installed-on-it/261886)
**Author:** [@Herrick\_P](https://discuss.elastic.co/u/Herrick_P)\ **Replies:** 1\ **Last updated:** [January 22, 2021, 10:24am UTC](https://discuss.elastic.co/t/elasticsearch-7-6-2-service-not-starting-on-centos-7-x-with-cpanel-installed-on-it/261886 "2021-01-22T10:24:43Z")
I have installed elasticsearch version 7.2.6 on CentOS 7.x with cPanel on it. However, after installing it, elasticsearch service is not running. Here is the screen capture of the error. I have already tried. https://sup… --- ## [Listen to multiple topics for google-pub sub plugin Logstash](https://discuss.elastic.co/t/listen-to-multiple-topics-for-google-pub-sub-plugin-logstash/261894)
**Author:** [@curiousmind](https://discuss.elastic.co/u/curiousmind)\ **Replies:** 0\ **Last updated:** [January 22, 2021, 9:51am UTC](https://discuss.elastic.co/t/listen-to-multiple-topics-for-google-pub-sub-plugin-logstash/261894 "2021-01-22T09:51:41Z")
My current configuration is like below: google\_pubsub { project\_id =\> "svg-nsg-log-51mx7" topic =\> "audit\_logs" subscription =\> "logstash-sub-audit\_logs" include\_metadata =\> true codec =\> "json" … --- ## [Delete by query: keeping only the most recent N documents](https://discuss.elastic.co/t/delete-by-query-keeping-only-the-most-recent-n-documents/261764)
**Author:** [@jminuscula](https://discuss.elastic.co/u/jminuscula)\ **Replies:** 3\ **Last updated:** [January 22, 2021, 9:02am UTC](https://discuss.elastic.co/t/delete-by-query-keeping-only-the-most-recent-n-documents/261764 "2021-01-22T09:02:28Z")
Hi there, I want to control the number of documents in our index, so I'm planning on running a delete by query periodically. Our documents look something like this: { "client": "a51b8afa8710ccbad1", … --- ## [Connect Prometheus metrics in Kafka to Metricbeat](https://discuss.elastic.co/t/connect-prometheus-metrics-in-kafka-to-metricbeat/261880)
**Author:** [@milanvdm](https://discuss.elastic.co/u/milanvdm)\ **Replies:** 0\ **Last updated:** [January 22, 2021, 7:48am UTC](https://discuss.elastic.co/t/connect-prometheus-metrics-in-kafka-to-metricbeat/261880 "2021-01-22T07:48:57Z")
We are using a provisioned OpenShift cluster which provides its system metrics from Prometheus to a Kafka topic. Since we are not able to run privileged daemonsets, I would like to know if there is a way to still ingest… --- ## [Kibana change log axis from count to custom name](https://discuss.elastic.co/t/kibana-change-log-axis-from-count-to-custom-name/260743)
**Author:** [@navin1093](https://discuss.elastic.co/u/navin1093)\ **Replies:** 4\ **Last updated:** [January 22, 2021, 7:44am UTC](https://discuss.elastic.co/t/kibana-change-log-axis-from-count-to-custom-name/260743 "2021-01-22T07:44:08Z")
Hi experts, Please share me reference whereby i would like to do a line graph wiht y axis displaying log level (trace, eror) and x-axis displaying as timestamp. The line will indicate the name of the logs. Please share… --- ## [How to solve ELK bottlenecks](https://discuss.elastic.co/t/how-to-solve-elk-bottlenecks/261879)
**Author:** [@jang](https://discuss.elastic.co/u/jang)\ **Replies:** 0\ **Last updated:** [January 22, 2021, 7:41am UTC](https://discuss.elastic.co/t/how-to-solve-elk-bottlenecks/261879 "2021-01-22T07:41:41Z")
I am using pipeline that uses filebeat, kafka, logstash, and Elastic service. kafka and logstash consist of one server.(4core, 4GB ram) Elastic service uses one master node and three data nodes.(2core, 2GB ram) Recent… --- ## [Color in vega bar charts](https://discuss.elastic.co/t/color-in-vega-bar-charts/261739)
**Author:** [@Pranusha119](https://discuss.elastic.co/u/Pranusha119)\ **Replies:** 4\ **Last updated:** [January 22, 2021, 7:28am UTC](https://discuss.elastic.co/t/color-in-vega-bar-charts/261739 "2021-01-22T07:28:55Z")
I want to give color of the bars by using the 'v' field which consists the hexcode of color. I gave it using datum.v (mentioned in below code) { "$schema": "https://vega.github.io/schema/vega-lite/v4.json", "descri… --- ## [Elastic pricing and more than one node](https://discuss.elastic.co/t/elastic-pricing-and-more-than-one-node/261870)
**Author:** [@KarlKnarls](https://discuss.elastic.co/u/KarlKnarls)\ **Replies:** 1\ **Last updated:** [January 22, 2021, 7:27am UTC](https://discuss.elastic.co/t/elastic-pricing-and-more-than-one-node/261870 "2021-01-22T07:27:41Z")
Hello, This is probably a basic question and perhaps I’ve overlooked some obvious guidance here but here goes anyway... On the elastic.co pricing in order to get a second node (or simply more than a single node) the fi… --- ## [Attempted to resurrect connection to dead ES instance](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance/261875)
**Author:** [@deepasaju](https://discuss.elastic.co/u/deepasaju)\ **Replies:** 0\ **Last updated:** [January 22, 2021, 6:57am UTC](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance/261875 "2021-01-22T06:57:16Z")
Hi I am using Logstash and ES in same server When I am sending data to ES using logstash I am getting below error message \[2021-01-21T23:59:13,249\]\[WARN \]\[logstash.outputs.elasticsearch\]\[logstashmetricbeat\] Attempted… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1590) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1592)