# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1597 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1598 --- ## [Logstash - replace @timestamp](https://discuss.elastic.co/t/logstash-replace-timestamp/261553)
**Author:** [@iccMe](https://discuss.elastic.co/u/iccMe)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 2:16pm UTC](https://discuss.elastic.co/t/logstash-replace-timestamp/261553 "2021-01-19T14:16:49Z")
Hi, Looking for help with a date and time filter in logstash. I created a new Time field putting together a previous date and time field that I subsequently drop. The new Time field looks like the below in my output: "… --- ## [Terms Aggregation Partitioning + filter buckets](https://discuss.elastic.co/t/terms-aggregation-partitioning-filter-buckets/261550)
**Author:** [@Nam\_Nguyen](https://discuss.elastic.co/u/Nam_Nguyen)\ **Replies:** 0\ **Last updated:** [January 19, 2021, 1:40pm UTC](https://discuss.elastic.co/t/terms-aggregation-partitioning-filter-buckets/261550 "2021-01-19T13:40:05Z")
Hey :wave:, Context I am currently struggling to create a proper query for the following use case. Let's say I wanted to create a group-by aggregation for e.g. term app:.\*, I would do the following: "terms":… --- ## [Query ES cluster state size](https://discuss.elastic.co/t/query-es-cluster-state-size/261542)
**Author:** [@CanardMoussant](https://discuss.elastic.co/u/CanardMoussant)\ **Replies:** 3\ **Last updated:** [January 19, 2021, 1:36pm UTC](https://discuss.elastic.co/t/query-es-cluster-state-size/261542 "2021-01-19T13:36:37Z")
I would like to get the size of the compressed cluster state (as done in PublishClusterStateAction) using an external API. Is it something possible? I am not calling it from java so I cannot duplicate the code doing the … --- ## [Add\_kubernetes\_metadata with input type log](https://discuss.elastic.co/t/add-kubernetes-metadata-with-input-type-log/261448)
**Author:** [@Vladimir\_Rimar](https://discuss.elastic.co/u/Vladimir_Rimar)\ **Replies:** 4\ **Last updated:** [January 19, 2021, 1:32pm UTC](https://discuss.elastic.co/t/add-kubernetes-metadata-with-input-type-log/261448 "2021-01-19T13:32:12Z")
I'm using filebeat as a side-car container, having input type log. I have also configured: processors: - add\_kubernetes\_metadata: in\_cluster: true but I'm not getting any metadata like pod, name… --- ## [Logstash doesn't index to elasticsearch properly/delay in indexing](https://discuss.elastic.co/t/logstash-doesnt-index-to-elasticsearch-properly-delay-in-indexing/261536)
**Author:** [@thrower](https://discuss.elastic.co/u/thrower)\ **Replies:** 0\ **Last updated:** [January 19, 2021, 12:02pm UTC](https://discuss.elastic.co/t/logstash-doesnt-index-to-elasticsearch-properly-delay-in-indexing/261536 "2021-01-19T12:02:43Z")
There is quite a significant delay occurring when there is updation in the database. It takes up to one to half an hour for the change to be reflected in the elasticsearch index. However if I change another product or ch… --- ## [Debugging extremely slow indexing](https://discuss.elastic.co/t/debugging-extremely-slow-indexing/258498)
**Author:** [@beckerr](https://discuss.elastic.co/u/beckerr)\ **Replies:** 38\ **Last updated:** [January 19, 2021, 11:48am UTC](https://discuss.elastic.co/t/debugging-extremely-slow-indexing/258498 "2021-01-19T11:48:32Z")
I have recently "inherited" an ES cluster at work that used to run just fine (since I inherited at least) but recently has been experiencing extreme performance issues around indexing. We have 20 "processor" containers i… --- ## [Create log visualization for my recently created logs](https://discuss.elastic.co/t/create-log-visualization-for-my-recently-created-logs/261261)
**Author:** [@leostereo](https://discuss.elastic.co/u/leostereo)\ **Replies:** 7\ **Last updated:** [January 19, 2021, 11:37am UTC](https://discuss.elastic.co/t/create-log-visualization-for-my-recently-created-logs/261261 "2021-01-19T11:37:10Z")
Hy guys. Im sending some logs from a custom process using elasticsearch api interface. I can see logs at discover section. Now , I need to create a visualization for non technical personal. I dont need any graphs , j… --- ## [How to disable limitation of index fields](https://discuss.elastic.co/t/how-to-disable-limitation-of-index-fields/261347)
**Author:** [@liran1](https://discuss.elastic.co/u/liran1)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 11:29am UTC](https://discuss.elastic.co/t/how-to-disable-limitation-of-index-fields/261347 "2021-01-19T11:29:21Z")
In the ElasticSearch docs, I found a way to increase the default index fields parameter (1000), I wonder if there is an option to disable the limitation for good? Thanks :slight\_smile: --- ## [Timezone of kibana logs should be same host's timezone](https://discuss.elastic.co/t/timezone-of-kibana-logs-should-be-same-hosts-timezone/261008)
**Author:** [@pratiksha](https://discuss.elastic.co/u/pratiksha)\ **Replies:** 7\ **Last updated:** [January 19, 2021, 11:22am UTC](https://discuss.elastic.co/t/timezone-of-kibana-logs-should-be-same-hosts-timezone/261008 "2021-01-19T11:22:20Z")
We are using ELK 7.8.0 version and want to have kibana logs in the same timezone as host's timezone. In this topic "https://discuss.elastic.co/t/changing-the-timezone-of-logs-written-in-logging-dest-in-kibana-yml/117564"… --- ## [Can't start elasticsearch service after enabling TLS for Detections/Alerts - Permission Denied](https://discuss.elastic.co/t/cant-start-elasticsearch-service-after-enabling-tls-for-detections-alerts-permission-denied/261330)
**Author:** [@yarooski](https://discuss.elastic.co/u/yarooski)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 11:09am UTC](https://discuss.elastic.co/t/cant-start-elasticsearch-service-after-enabling-tls-for-detections-alerts-permission-denied/261330 "2021-01-19T11:09:23Z")
After following these instructions meticulously: How To Install Elasticsearch, Logstash, and Kibana (Elastic Stack) on Ubuntu 20.04 And then enabling TLS and setting up user permissions here: Detections prerequisites an… --- ## [Timezone in UTC causes wrong filename](https://discuss.elastic.co/t/timezone-in-utc-causes-wrong-filename/261480)
**Author:** [@yodog](https://discuss.elastic.co/u/yodog)\ **Replies:** 3\ **Last updated:** [January 19, 2021, 10:23am UTC](https://discuss.elastic.co/t/timezone-in-utc-causes-wrong-filename/261480 "2021-01-19T10:23:23Z")
i have a logserver with logstash only. no elasticsearch nor kibana. all other servers are using filebeat to send log to the logserver. logstash writes to /var/log/logstash/appname.txt.%{+YYYY-MM-dd} after some processi… --- ## [Filebeat doesn't send logs to Elasticsearch](https://discuss.elastic.co/t/filebeat-doesnt-send-logs-to-elasticsearch/259228)
**Author:** [@Pawel\_Skadorwa](https://discuss.elastic.co/u/Pawel_Skadorwa)\ **Replies:** 7\ **Last updated:** [January 19, 2021, 10:21am UTC](https://discuss.elastic.co/t/filebeat-doesnt-send-logs-to-elasticsearch/259228 "2021-01-19T10:21:15Z")
Hi, I decided to talk to you because I have no idea how to resolve the problem with the logging stack. On kubernetes 1.19 I installed elasticsearch 7.10.1, kibana, metricbeat and filebeat in the same version. Connection… --- ## [Ingressing Palo Alto logs thru syslog](https://discuss.elastic.co/t/ingressing-palo-alto-logs-thru-syslog/261456)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 10:01am UTC](https://discuss.elastic.co/t/ingressing-palo-alto-logs-thru-syslog/261456 "2021-01-19T10:01:00Z")
Hello I am trying to ingress Palo Alto logs using the module but I cannot get it to work. I have the pipeline enabled as I go to http://elasticsearchserver:9200/\_ingest/pipeline and I see Pipeline for Palo Alto Network… --- ## [Select only one field to output](https://discuss.elastic.co/t/select-only-one-field-to-output/261451)
**Author:** [@Finley](https://discuss.elastic.co/u/Finley)\ **Replies:** 0\ **Last updated:** [January 18, 2021, 4:40pm UTC](https://discuss.elastic.co/t/select-only-one-field-to-output/261451 "2021-01-18T16:40:50Z")
Hello, I'm trying to setup a logstash configuration. I want to forward the event.original field only on the udp output. I have a filebeat input, and elasticsearch/udp output. I tried the "codec line" option with "forma… --- ## [How to share Dashboard to our business client](https://discuss.elastic.co/t/how-to-share-dashboard-to-our-business-client/261431)
**Author:** [@irfangk1](https://discuss.elastic.co/u/irfangk1)\ **Replies:** 6\ **Last updated:** [January 19, 2021, 9:36am UTC](https://discuss.elastic.co/t/how-to-share-dashboard-to-our-business-client/261431 "2021-01-19T09:36:55Z")
Hi Team, I want to share Dashbaord to our Bussiness Client how can we make changes in Dashboard with our companys logo and our company details --- ## [Aggregate the data such that there's a new column which depends on the original Question?](https://discuss.elastic.co/t/aggregate-the-data-such-that-theres-a-new-column-which-depends-on-the-original-question/260859)
**Author:** [@Prabhu.292](https://discuss.elastic.co/u/Prabhu.292)\ **Replies:** 8\ **Last updated:** [January 19, 2021, 9:35am UTC](https://discuss.elastic.co/t/aggregate-the-data-such-that-theres-a-new-column-which-depends-on-the-original-question/260859 "2021-01-19T09:35:12Z")
Dear Team, Below is my requirement. I have 2 fields in my system (1. Category & 2. Questions) Here is my requirement goes. and below is my data. My requirement. I need to Manually add one more new field called Sub … --- ## [Logstash translate filter](https://discuss.elastic.co/t/logstash-translate-filter/261518)
**Author:** [@vinu89](https://discuss.elastic.co/u/vinu89)\ **Replies:** 0\ **Last updated:** [January 19, 2021, 9:31am UTC](https://discuss.elastic.co/t/logstash-translate-filter/261518 "2021-01-19T09:31:02Z")
hi, i have a csv file containing malicious domains and category,i want to check whether those domains are comings in my logs and i achieved that using translate field..but i want to extract the particular category also… --- ## [Force a node to be the master](https://discuss.elastic.co/t/force-a-node-to-be-the-master/261467)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 6\ **Last updated:** [January 19, 2021, 9:26am UTC](https://discuss.elastic.co/t/force-a-node-to-be-the-master/261467 "2021-01-19T09:26:23Z")
Just curious, how to fix a broken cluster like this: Via official Helm release, I made a 3 nodes cluster, was working fine: node-0 / node-1 / node-2 I scaled down the STS to 0, to remove all pods/nodes. Then when I s… --- ## [No stdout and logs from Packetbeat](https://discuss.elastic.co/t/no-stdout-and-logs-from-packetbeat/261517)
**Author:** [@GabrielJuilien](https://discuss.elastic.co/u/GabrielJuilien)\ **Replies:** 0\ **Last updated:** [January 19, 2021, 9:21am UTC](https://discuss.elastic.co/t/no-stdout-and-logs-from-packetbeat/261517 "2021-01-19T09:21:57Z")
Hi everyone, I am having trouble to setup Packetbeat on my client Windows. I already have som other Beats running and working as intended. The thing is I am getting no sdtout output in PowerShell when trying to run pac… --- ## [Clearing cache on stack with read only indices](https://discuss.elastic.co/t/clearing-cache-on-stack-with-read-only-indices/261507)
**Author:** [@crs](https://discuss.elastic.co/u/crs)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 9:15am UTC](https://discuss.elastic.co/t/clearing-cache-on-stack-with-read-only-indices/261507 "2021-01-19T09:15:43Z")
Hi, I have system (ES 7.6.2) with many read only indices (index.blocks.read\_only=true). All works fine but when I want to clear cache (curl -X POST "localhost:9200/\_cache/clear") then I'm getting a lot of errors "index … --- ## [How to use significant term in Y axis during visualisation](https://discuss.elastic.co/t/how-to-use-significant-term-in-y-axis-during-visualisation/261380)
**Author:** [@Aryaman\_Gupta](https://discuss.elastic.co/u/Aryaman_Gupta)\ **Replies:** 3\ **Last updated:** [January 19, 2021, 8:37am UTC](https://discuss.elastic.co/t/how-to-use-significant-term-in-y-axis-during-visualisation/261380 "2021-01-19T08:37:46Z")
I am new to use visualisation in kibana. During visualisation, I saw in Y axis by default uses count i.e number of logs filtered. But I want it to behave differently, I want Y axis to represent time and x axis to repre… --- ## [Elasticsearch Failed with signal](https://discuss.elastic.co/t/elasticsearch-failed-with-signal/260975)
**Author:** [@Joegio](https://discuss.elastic.co/u/Joegio)\ **Replies:** 4\ **Last updated:** [January 19, 2021, 8:09am UTC](https://discuss.elastic.co/t/elasticsearch-failed-with-signal/260975 "2021-01-19T08:09:15Z")
Good Morning, i'm newbie with elasticsearch. I have installed zammad on the our server with elasticsearch. ES service running but after about one hour has been killed with result 'signal'. I have tried to change confi… --- ## [Join query type in Query DSL](https://discuss.elastic.co/t/join-query-type-in-query-dsl/261423)
**Author:** [@Sivajanani](https://discuss.elastic.co/u/Sivajanani)\ **Replies:** 4\ **Last updated:** [January 19, 2021, 7:45am UTC](https://discuss.elastic.co/t/join-query-type-in-query-dsl/261423 "2021-01-19T07:45:10Z")
Hello, I have created a join field using below query, PUT test\_corr { "mappings": { "properties": { "my\_id": { "type": "keyword" }, "my\_join\_field": { "type": "join", "relations": { "indicators": "indicator" … --- ## [Elasticsearch threadpool and index settings in ECK](https://discuss.elastic.co/t/elasticsearch-threadpool-and-index-settings-in-eck/261272)
**Author:** [@zohaib](https://discuss.elastic.co/u/zohaib)\ **Replies:** 5\ **Last updated:** [January 18, 2021, 9:53am UTC](https://discuss.elastic.co/t/elasticsearch-threadpool-and-index-settings-in-eck/261272 "2021-01-18T09:53:55Z")
We are using ECK operator 1.2 and ElasticSearch 7.4.0 for a 3 node cluster with the default settings on Azure Kubernetes Services. We need to update the following ElasticSearch configuration in our cluster: threadpool.… --- ## [Is it possible set multiple pipeline a ingest pipeline](https://discuss.elastic.co/t/is-it-possible-set-multiple-pipeline-a-ingest-pipeline/261484)
**Author:** [@sungjin.kim](https://discuss.elastic.co/u/sungjin.kim)\ **Replies:** 3\ **Last updated:** [January 19, 2021, 6:03am UTC](https://discuss.elastic.co/t/is-it-possible-set-multiple-pipeline-a-ingest-pipeline/261484 "2021-01-19T06:03:59Z")
Hi friendly folks, I am planning to send various formatted logs to elastic cloud through ingest pipeline. I read many references regarding configuring filebeat.yml. it's likely that only one pipeline's possible. I… --- ## [I want to restict my Time range as per user](https://discuss.elastic.co/t/i-want-to-restict-my-time-range-as-per-user/261424)
**Author:** [@Rohit\_Kumbhar](https://discuss.elastic.co/u/Rohit_Kumbhar)\ **Replies:** 3\ **Last updated:** [January 19, 2021, 5:34am UTC](https://discuss.elastic.co/t/i-want-to-restict-my-time-range-as-per-user/261424 "2021-01-19T05:34:56Z")
Hi, I want to restrict my Kibana Dashboard Time-Range feature to specific dates as per User or Space. In brief, If A user Logs in he should be able to see data till 30 days, where B user can only search data for only … --- ## [Exiting: error loading config file: yaml: line 95: did not find expected '-' indicator](https://discuss.elastic.co/t/exiting-error-loading-config-file-yaml-line-95-did-not-find-expected-indicator/261430)
**Author:** [@Ana\_11](https://discuss.elastic.co/u/Ana_11)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 5:27am UTC](https://discuss.elastic.co/t/exiting-error-loading-config-file-yaml-line-95-did-not-find-expected-indicator/261430 "2021-01-19T05:27:51Z")
Hi I have installed filebeat on rsyslog server and have enabled system module. while running filebeat setup -e im getting the below error i have reffered other posts also but unable to find my mistake please help. "Exi… --- ## [For a day network traffic issue](https://discuss.elastic.co/t/for-a-day-network-traffic-issue/261394)
**Author:** [@daemon](https://discuss.elastic.co/u/daemon)\ **Replies:** 4\ **Last updated:** [January 19, 2021, 4:55am UTC](https://discuss.elastic.co/t/for-a-day-network-traffic-issue/261394 "2021-01-19T04:55:20Z")
0 1 \* \* \* time sync crontab metricbeat -\> network traffic to be weird --- ## [How to check monitoring logs of kibana](https://discuss.elastic.co/t/how-to-check-monitoring-logs-of-kibana/261388)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 3\ **Last updated:** [January 19, 2021, 4:11am UTC](https://discuss.elastic.co/t/how-to-check-monitoring-logs-of-kibana/261388 "2021-01-19T04:11:29Z")
Hi, I have a cluster of 3 master + data nodes and 1 kibana of 7.10.0v. I have enabled SSL and monitoring of the cluster. Now my requirement is:- When I go to stack monitoring page -\> overview of kibana I want to see… --- ## [Docker logs to elastic by filebeat](https://discuss.elastic.co/t/docker-logs-to-elastic-by-filebeat/261372)
**Author:** [@sungjin.kim](https://discuss.elastic.co/u/sungjin.kim)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 2:03am UTC](https://discuss.elastic.co/t/docker-logs-to-elastic-by-filebeat/261372 "2021-01-19T02:03:30Z")
Hi, This is docker logs I tried to send docker logs to elasticsearch by using filebeat however, in elasticsearch, I can't find docker logs. Please let me know how to load stdout load of docker Regards, Sungji… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1596) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1598)