# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1613 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1614 --- ## [Logstash not parsing metadata from logfile](https://discuss.elastic.co/t/logstash-not-parsing-metadata-from-logfile/260496)
**Author:** [@Rahul3](https://discuss.elastic.co/u/Rahul3)\ **Replies:** 1\ **Last updated:** [January 8, 2021, 3:13pm UTC](https://discuss.elastic.co/t/logstash-not-parsing-metadata-from-logfile/260496 "2021-01-08T15:13:44Z")
Hi, I am very new to ELK Stack, I have a requirement to parse specific metadata from a log entry, Here is a sample log entry, \[ERROR\] \[2021-01-04 14:56:41,566\] \[http-nio-8080-exec-4\] \[com.blocks.bear.server.exception.Ex… --- ## [Addition of response time into Apache access fileset](https://discuss.elastic.co/t/addition-of-response-time-into-apache-access-fileset/260548)
**Author:** [@jberanek](https://discuss.elastic.co/u/jberanek)\ **Replies:** 1\ **Last updated:** [January 8, 2021, 2:01pm UTC](https://discuss.elastic.co/t/addition-of-response-time-into-apache-access-fileset/260548 "2021-01-08T14:01:54Z")
So, I'm not sure how specific this is to our environment, but our Apache logs have response time added onto the end of one of filebeat's 'apache' module's standard formats, like: 2s 2123456 micro-seconds So, I modified… --- ## [/app/kibana redirecting (302) to /app/dashboard\_mode Kibana 7.10.1](https://discuss.elastic.co/t/app-kibana-redirecting-302-to-app-dashboard-mode-kibana-7-10-1/260540)
**Author:** [@Anmol\_Deep](https://discuss.elastic.co/u/Anmol_Deep)\ **Replies:** 1\ **Last updated:** [January 8, 2021, 1:48pm UTC](https://discuss.elastic.co/t/app-kibana-redirecting-302-to-app-dashboard-mode-kibana-7-10-1/260540 "2021-01-08T13:48:07Z")
We embed Kibana within an Iframe in our application and forward the requests to Kibana server with basic authentications scheme. This used to work in version 6.8.1 but when i upgrade to 7.10.1 the request to /app/kiban… --- ## [\[ threat intelligence \]: Display the number of alerts generated by a specific rule](https://discuss.elastic.co/t/threat-intelligence-display-the-number-of-alerts-generated-by-a-specific-rule/260528)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 1\ **Last updated:** [January 8, 2021, 1:10pm UTC](https://discuss.elastic.co/t/threat-intelligence-display-the-number-of-alerts-generated-by-a-specific-rule/260528 "2021-01-08T13:10:45Z")
Hello, I would like to display in my canvas, the number of alertes generated the last 24 hours by a specific rule (Costume rule That I have created) Could you tell me please how can I do that ? Best regards --- ## [Filebeat disk queue messing up encoding](https://discuss.elastic.co/t/filebeat-disk-queue-messing-up-encoding/260546)
**Author:** [@Valker](https://discuss.elastic.co/u/Valker)\ **Replies:** 0\ **Last updated:** [January 8, 2021, 1:00pm UTC](https://discuss.elastic.co/t/filebeat-disk-queue-messing-up-encoding/260546 "2021-01-08T13:00:25Z")
Hello, I believe I have found a misbehavior in the disk queue mechanism in the filebeat. When I’m adding a UTF-8 encoded json with a polish characters, on the output I am getting messed up value. Example: ^^^^^^^^^^^^… --- ## [Customize ingest pipelines in Fleet / Elastic Agent](https://discuss.elastic.co/t/customize-ingest-pipelines-in-fleet-elastic-agent/260236)
**Author:** [@icious](https://discuss.elastic.co/u/icious)\ **Replies:** 2\ **Last updated:** [January 8, 2021, 12:35pm UTC](https://discuss.elastic.co/t/customize-ingest-pipelines-in-fleet-elastic-agent/260236 "2021-01-08T12:35:06Z")
Hello, I was fiddling around with Elastic Agent and Fleet to integrate multiple log sources in the same agent, and I am getting "Provided Grok expressions do not match field value" error with Fortinet integration. Usin… --- ## [Nested fields & strict dynamic mapping](https://discuss.elastic.co/t/nested-fields-strict-dynamic-mapping/260533)
**Author:** [@loldebyte](https://discuss.elastic.co/u/loldebyte)\ **Replies:** 0\ **Last updated:** [January 8, 2021, 11:27am UTC](https://discuss.elastic.co/t/nested-fields-strict-dynamic-mapping/260533 "2021-01-08T11:27:54Z")
Hello, Following this stackoverlow question, i came here before opening an issue on github. An indice with the following mapping: { "test2": { "mappings": { "dynamic": "strict", "properties"… --- ## [Why logstash's redis output plugin send list data with \\n?](https://discuss.elastic.co/t/why-logstashs-redis-output-plugin-send-list-data-with-n/260525)
**Author:** [@iooi](https://discuss.elastic.co/u/iooi)\ **Replies:** 1\ **Last updated:** [January 8, 2021, 11:24am UTC](https://discuss.elastic.co/t/why-logstashs-redis-output-plugin-send-list-data-with-n/260525 "2021-01-08T11:24:46Z")
Using Redis output pluginedit to send data to Redis. output { redis { host =\> \["${REDIS\_URL}"\] data\_type =\> "list" key =\> "ID" codec =\> line { format =\> "%{\[@metadata\]\[\_id\]}"} } } Check Redis' data: … --- ## [Elasticsearch cluster - please review my configuration and advise](https://discuss.elastic.co/t/elasticsearch-cluster-please-review-my-configuration-and-advise/259502)
**Author:** [@Ged](https://discuss.elastic.co/u/Ged)\ **Replies:** 2\ **Last updated:** [January 8, 2021, 11:07am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-please-review-my-configuration-and-advise/259502 "2021-01-08T11:07:37Z")
Hi Team, I want to share my ELK stack cluster configuration shown below asking you to review it and share your thoughts and answer some questions. Elasticsearch nodes configuration for ELK SERVER A1 and ELK SERVER B1… --- ## [Circuit breaker exception because of increased time range](https://discuss.elastic.co/t/circuit-breaker-exception-because-of-increased-time-range/260317)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 3\ **Last updated:** [January 8, 2021, 11:03am UTC](https://discuss.elastic.co/t/circuit-breaker-exception-because-of-increased-time-range/260317 "2021-01-08T11:03:17Z")
Hi All, I am facing 429 circuit breaker exception when somebody selects a window of time range more than 7 days. Is there a way to lock the time filter,so that no user can search beyond 7 days. --- ## [Sort documents and reduce overlapping ranges](https://discuss.elastic.co/t/sort-documents-and-reduce-overlapping-ranges/260526)
**Author:** [@lucre](https://discuss.elastic.co/u/lucre)\ **Replies:** 0\ **Last updated:** [January 8, 2021, 9:50am UTC](https://discuss.elastic.co/t/sort-documents-and-reduce-overlapping-ranges/260526 "2021-01-08T09:50:42Z")
Hello, apologies if the query may be trivial, I am just starting using Elasticsearch. I have an index with usage docs (not nested) with a datetime\_start, datetime\_end, company\_id, user\_id, product\_id, range\_start, range… --- ## [Renaming log file in filebeat and passing index name](https://discuss.elastic.co/t/renaming-log-file-in-filebeat-and-passing-index-name/260519)
**Author:** [@navin1093](https://discuss.elastic.co/u/navin1093)\ **Replies:** 0\ **Last updated:** [January 8, 2021, 9:11am UTC](https://discuss.elastic.co/t/renaming-log-file-in-filebeat-and-passing-index-name/260519 "2021-01-08T09:11:33Z")
hi can i knowif wish to renmae the log before sending to logstash. Besides that, I also wish to set index name based on respective paths. How can this be done in filebeat. I saw we have something called fields but fiel… --- ## [Query multiple fields with and](https://discuss.elastic.co/t/query-multiple-fields-with-and/260021)
**Author:** [@bastimm](https://discuss.elastic.co/u/bastimm)\ **Replies:** 4\ **Last updated:** [January 8, 2021, 8:57am UTC](https://discuss.elastic.co/t/query-multiple-fields-with-and/260021 "2021-01-08T08:57:53Z")
Hello back again! Last time I wrote queries is about 3 years ago, so I am not sure wether something changed for my case ,-) I have multiple fields in my Index, like MPN (manufacturernumber), manufacturer, title, descri… --- ## [About the test of indicators.breaker.total.limit parameters](https://discuss.elastic.co/t/about-the-test-of-indicators-breaker-total-limit-parameters/260513)
**Author:** [@liwanjie](https://discuss.elastic.co/u/liwanjie)\ **Replies:** 1\ **Last updated:** [January 8, 2021, 8:50am UTC](https://discuss.elastic.co/t/about-the-test-of-indicators-breaker-total-limit-parameters/260513 "2021-01-08T08:50:31Z")
I want to test the test cluster. I want to see what the threshold of the indices.breaker.total.limit parameter is set to, the cluster can reject the request to ensure that it does not crash. So 20 requests were issued at… --- ## [Logstash parse json file content failed, but ok when enter one line with input plugin](https://discuss.elastic.co/t/logstash-parse-json-file-content-failed-but-ok-when-enter-one-line-with-input-plugin/260503)
**Author:** [@bo\_bo](https://discuss.elastic.co/u/bo_bo)\ **Replies:** 0\ **Last updated:** [January 8, 2021, 7:01am UTC](https://discuss.elastic.co/t/logstash-parse-json-file-content-failed-but-ok-when-enter-one-line-with-input-plugin/260503 "2021-01-08T07:01:20Z")
File content is: {"#account\_id":"43DDBF5E46FBC68F2B9C395DA7C3443B","#distinct\_id":"205aa1ec49b21576da4ee3beb994f132","#type":"track","#ip":"122.157.17 5.52","#time":"2020-01-06 19:44:54","#event\_name":"TALENT\_CAPTURE",… --- ## [ElasticSearch DAU and MAU](https://discuss.elastic.co/t/elasticsearch-dau-and-mau/260405)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 9\ **Last updated:** [January 8, 2021, 6:34am UTC](https://discuss.elastic.co/t/elasticsearch-dau-and-mau/260405 "2021-01-08T06:34:24Z")
Hello Team In Kibana Visualisation Dashboard , we have option to get charts for DAU and MAU. I would like to check the query used by Kibana in background to get the data. My purpose is to get the query and use it in C… --- ## [\[java high level client 7.9.1\] highlight in inner hit is null](https://discuss.elastic.co/t/java-high-level-client-7-9-1-highlight-in-inner-hit-is-null/260497)
**Author:** [@jaru\_kim](https://discuss.elastic.co/u/jaru_kim)\ **Replies:** 1\ **Last updated:** [January 8, 2021, 6:09am UTC](https://discuss.elastic.co/t/java-high-level-client-7-9-1-highlight-in-inner-hit-is-null/260497 "2021-01-08T06:09:31Z")
I want to get highlight data in inner hit. in response, but, highlight in inner hit is null. did I miss something? portion of class file: //-- innerHit's Highlight HighlightBuilder enHighlightBuilder = new HighlightB… --- ## [Basic License unable to enable xpack](https://discuss.elastic.co/t/basic-license-unable-to-enable-xpack/260461)
**Author:** [@navin1093](https://discuss.elastic.co/u/navin1093)\ **Replies:** 4\ **Last updated:** [January 8, 2021, 5:30am UTC](https://discuss.elastic.co/t/basic-license-unable-to-enable-xpack/260461 "2021-01-08T05:30:27Z")
Hi, i perform yum install in my centos 7 elk. When i configure security i hitting the error below. I am using basic license. Is basic license not allowed for xpack security as i want allow user to login rather than hav… --- ## [Take/calculate value from dashboard](https://discuss.elastic.co/t/take-calculate-value-from-dashboard/259093)
**Author:** [@blukit](https://discuss.elastic.co/u/blukit)\ **Replies:** 4\ **Last updated:** [January 8, 2021, 5:07am UTC](https://discuss.elastic.co/t/take-calculate-value-from-dashboard/259093 "2021-01-08T05:07:21Z")
Hi guys... Is it possible to calculate value directly from a dashboard? The underlying logic of existing metrics kinda complex, so i think it would be more simple if I could take the output for other calculation. ex… --- ## [Kibana filter](https://discuss.elastic.co/t/kibana-filter/260440)
**Author:** [@vinu89](https://discuss.elastic.co/u/vinu89)\ **Replies:** 2\ **Last updated:** [January 8, 2021, 4:49am UTC](https://discuss.elastic.co/t/kibana-filter/260440 "2021-01-08T04:49:01Z")
I have a set of domain names I want only the domains names which has .in when I tried to add filter in kibana where domainname.keywors is \*.in I m not getting any results pls suggest on how to use the wildcard operator --- ## [Get node hostname/ip on which the container is hosted](https://discuss.elastic.co/t/get-node-hostname-ip-on-which-the-container-is-hosted/260493)
**Author:** [@astrovj](https://discuss.elastic.co/u/astrovj)\ **Replies:** 0\ **Last updated:** [January 8, 2021, 3:41am UTC](https://discuss.elastic.co/t/get-node-hostname-ip-on-which-the-container-is-hosted/260493 "2021-01-08T03:41:09Z")
Is there a way to get node hostname/ip on which the container is hosted using filebeat dynamically, as a field in the ES index. Right now it gives the container id/ip as hostname/ip ? I am not using logstash. --- ## [Elk custome log](https://discuss.elastic.co/t/elk-custome-log/260407)
**Author:** [@Supun\_Madushanka](https://discuss.elastic.co/u/Supun_Madushanka)\ **Replies:** 2\ **Last updated:** [January 8, 2021, 3:35am UTC](https://discuss.elastic.co/t/elk-custome-log/260407 "2021-01-08T03:35:03Z")
Hi, I am new to elk. I have a nodejs application. current I am writing nodejs log to the log file. my log format is "type username ip eventname data". I set up filebeat in nodejs server and I setup kibana with elastic se… --- ## [Search query based of number of values a field contains](https://discuss.elastic.co/t/search-query-based-of-number-of-values-a-field-contains/260408)
**Author:** [@bevano](https://discuss.elastic.co/u/bevano)\ **Replies:** 2\ **Last updated:** [January 8, 2021, 2:34am UTC](https://discuss.elastic.co/t/search-query-based-of-number-of-values-a-field-contains/260408 "2021-01-08T02:34:14Z")
Hi, I was wondering whether you can point me at any documentation, or let me know if this is not possible for the following. I am trying to write a query of a fields called result\_code. Some of my documents contain mul… --- ## [Painless script for a comparison between two fields taken at interval](https://discuss.elastic.co/t/painless-script-for-a-comparison-between-two-fields-taken-at-interval/260464)
**Author:** [@CyaTo](https://discuss.elastic.co/u/CyaTo)\ **Replies:** 8\ **Last updated:** [January 7, 2021, 10:41pm UTC](https://discuss.elastic.co/t/painless-script-for-a-comparison-between-two-fields-taken-at-interval/260464 "2021-01-07T22:41:21Z")
Hello :wave: I take the ELK suite in hand and try to do a few things with it to learn. Currently I'm trying to make a scripted field that will be able to determine a change between two hashes taken at two different mom… --- ## [Name saved in disk when taking snapshot](https://discuss.elastic.co/t/name-saved-in-disk-when-taking-snapshot/260429)
**Author:** [@khzied](https://discuss.elastic.co/u/khzied)\ **Replies:** 1\ **Last updated:** [January 7, 2021, 9:34pm UTC](https://discuss.elastic.co/t/name-saved-in-disk-when-taking-snapshot/260429 "2021-01-07T21:34:22Z")
Hello, I have Elasticsearch 5.6 and I have a question when making snapshot: it's possible to find the same name of directory like index name after making snap. Now the directory generated is random name like this lMTV… --- ## [PanW module issues](https://discuss.elastic.co/t/panw-module-issues/260487)
**Author:** [@S3l3ct3d](https://discuss.elastic.co/u/S3l3ct3d)\ **Replies:** 0\ **Last updated:** [January 7, 2021, 8:34pm UTC](https://discuss.elastic.co/t/panw-module-issues/260487 "2021-01-07T20:34:47Z")
I have the panw module enabled in filebeat along with other modules enabled as well. For the panw module I have configured it as shown below - module: panw panos: enabled: true # Set which input to use betwee… --- ## [Kibana 7.10 custom plugin grayed out in dashboard](https://discuss.elastic.co/t/kibana-7-10-custom-plugin-grayed-out-in-dashboard/260471)
**Author:** [@ssimmons](https://discuss.elastic.co/u/ssimmons)\ **Replies:** 8\ **Last updated:** [January 7, 2021, 8:08pm UTC](https://discuss.elastic.co/t/kibana-7-10-custom-plugin-grayed-out-in-dashboard/260471 "2021-01-07T20:08:53Z")
I've create a test plugin for Kibana 7.10 using logic from a 7.8 plugin. It works fine when I create a visualization using the custom plugin. However, when I add the visualization to a dashboard everything is grayed out … --- ## [Search for String Literal in KQL](https://discuss.elastic.co/t/search-for-string-literal-in-kql/260482)
**Author:** [@Samsquantch](https://discuss.elastic.co/u/Samsquantch)\ **Replies:** 1\ **Last updated:** [January 7, 2021, 8:04pm UTC](https://discuss.elastic.co/t/search-for-string-literal-in-kql/260482 "2021-01-07T20:04:21Z")
How do I search for a literal string value? Current example query: Subject : "\[External Sender\] Test" Brings back what I'm looking for, but also the following: \[External Sender\] test-results.pdf \[External Sender\] Te… --- ## ["simple\_query\_string" with "default\_operator": "AND" doesn't imply "analyzer": "default"](https://discuss.elastic.co/t/simple-query-string-with-default-operator-and-doesnt-imply-analyzer-default/260485)
**Author:** [@Luke\_Nezda](https://discuss.elastic.co/u/Luke_Nezda)\ **Replies:** 0\ **Last updated:** [January 7, 2021, 7:59pm UTC](https://discuss.elastic.co/t/simple-query-string-with-default-operator-and-doesnt-imply-analyzer-default/260485 "2021-01-07T19:59:38Z")
Hello, all - I went to convert some code using query\_string to simple\_query\_string (using "default\_operator": "AND" for both) and was surprised to find I needed to explicitly say "analyzer": "default" despite the analyz… --- ## [Trouble With Multiline Codec Logstash](https://discuss.elastic.co/t/trouble-with-multiline-codec-logstash/260483)
**Author:** [@bigbobolue](https://discuss.elastic.co/u/bigbobolue)\ **Replies:** 1\ **Last updated:** [January 7, 2021, 7:51pm UTC](https://discuss.elastic.co/t/trouble-with-multiline-codec-logstash/260483 "2021-01-07T19:51:55Z")
I am having trouble with a particular multiline log 2021-01-07T07:17:59.942 INFO (129c-2b04) \[LogonMonitor::LogSummary\] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* Session Summary (User: User1234, Session: 1) \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* 2021-01-07T07:17:… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1612) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1614)