# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1614 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1615 --- ## [Count fields with the same value as one](https://discuss.elastic.co/t/count-fields-with-the-same-value-as-one/260466)
**Author:** [@Angelos](https://discuss.elastic.co/u/Angelos)\ **Replies:** 1\ **Last updated:** [January 7, 2021, 7:31pm UTC](https://discuss.elastic.co/t/count-fields-with-the-same-value-as-one/260466 "2021-01-07T19:31:29Z")
Hi! I have many fields which have the same value. So let's we have those document in different time periods: @timestamp Jan 6, 2021 @ 23:00:00 field.mess value1 field.sub examp1 @timestamp Jan 6, 2021 @ 23:00:01 fie… --- ## [Help on creating a visualization of total time taken for service in Kibana](https://discuss.elastic.co/t/help-on-creating-a-visualization-of-total-time-taken-for-service-in-kibana/260401)
**Author:** [@Thols](https://discuss.elastic.co/u/Thols)\ **Replies:** 1\ **Last updated:** [January 7, 2021, 7:10pm UTC](https://discuss.elastic.co/t/help-on-creating-a-visualization-of-total-time-taken-for-service-in-kibana/260401 "2021-01-07T19:10:30Z")
Hi I am trying to create a time visualization like below Where 1 - 5 are various calls the single service travels through and come back. Each of these has a separate log source and are indexed in different patterns. … --- ## [Matching Documents by Hour](https://discuss.elastic.co/t/matching-documents-by-hour/260480)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 0\ **Last updated:** [January 7, 2021, 6:57pm UTC](https://discuss.elastic.co/t/matching-documents-by-hour/260480 "2021-01-07T18:57:31Z")
I have an issue with a dataset that we imported. The source marked the midnight timestamps as 2400 on the previous day. After ingestion, that time has been adjusted to 0000 but the day is still the previous day. So, I… --- ## [Service based on elasticsearch basic license the terms of agreement](https://discuss.elastic.co/t/service-based-on-elasticsearch-basic-license-the-terms-of-agreement/260476)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 1\ **Last updated:** [January 7, 2021, 6:12pm UTC](https://discuss.elastic.co/t/service-based-on-elasticsearch-basic-license-the-terms-of-agreement/260476 "2021-01-07T18:12:42Z")
Hello, from my understanding, It would not be a violation of the terms of basic license agreement to provide a paid monitoring service based on ELK stack as long as I do not grant access to kibana dashboards for custome… --- ## [Handling unmounted data volume](https://discuss.elastic.co/t/handling-unmounted-data-volume/260478)
**Author:** [@a06ced31bae02498a46d](https://discuss.elastic.co/u/a06ced31bae02498a46d)\ **Replies:** 1\ **Last updated:** [January 7, 2021, 5:59pm UTC](https://discuss.elastic.co/t/handling-unmounted-data-volume/260478 "2021-01-07T17:59:32Z")
Hello! We are facing an issue with the store volume hardware on a given data node which results in full production outage. While the problem is clearly lies in the system/hardware level there might be some Elasticsearch… --- ## [Kubernetes autodiscover fails if filebeat cannot determine its node name](https://discuss.elastic.co/t/kubernetes-autodiscover-fails-if-filebeat-cannot-determine-its-node-name/260375)
**Author:** [@smacl](https://discuss.elastic.co/u/smacl)\ **Replies:** 2\ **Last updated:** [January 7, 2021, 5:29pm UTC](https://discuss.elastic.co/t/kubernetes-autodiscover-fails-if-filebeat-cannot-determine-its-node-name/260375 "2021-01-07T17:29:37Z")
Hi, We are (rarely) seeing an issue using the k8s autodiscover feature in filebeat 7.9.1. If the API server is unavailable when filebeat tries to determine which node it's running on, filebeat might report an error lik… --- ## [Pipeline sending to itself](https://discuss.elastic.co/t/pipeline-sending-to-itself/260413)
**Author:** [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\ **Replies:** 3\ **Last updated:** [January 7, 2021, 5:27pm UTC](https://discuss.elastic.co/t/pipeline-sending-to-itself/260413 "2021-01-07T17:27:52Z")
Hello all, We have the following usecase: We want to read data from a service provider that requires paging when polling data(they also support pushing data but we are not accessible from the internet). I found that th… --- ## [Provided Grok expressions do not match field value:](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value/260472)
**Author:** [@millie](https://discuss.elastic.co/u/millie)\ **Replies:** 0\ **Last updated:** [January 7, 2021, 5:24pm UTC](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value/260472 "2021-01-07T17:24:29Z")
Hi, I am successfully running filebeats with the logstash module to push serial port logs to elasticsearch/kibana. However, I get the error "Provided Grok expressions do not match field value:" but haven't set up any g… --- ## [Question about logstash output plugin 7.9 and ecs](https://discuss.elastic.co/t/question-about-logstash-output-plugin-7-9-and-ecs/259154)
**Author:** [@gerbdla](https://discuss.elastic.co/u/gerbdla)\ **Replies:** 1\ **Last updated:** [January 7, 2021, 4:53pm UTC](https://discuss.elastic.co/t/question-about-logstash-output-plugin-7-9-and-ecs/259154 "2021-01-07T16:53:14Z")
I am not understanding the ecs changes in the logstash elasticsearch output plugin version 7.9 ecs compatibility. I have an issue when I try to index an event that has an object mapping for host. object mapping for \[ho… --- ## [Create visualization with actual status of process ("group by"?/subquery?)](https://discuss.elastic.co/t/create-visualization-with-actual-status-of-process-group-by-subquery/260379)
**Author:** [@Joao\_Palma](https://discuss.elastic.co/u/Joao_Palma)\ **Replies:** 3\ **Last updated:** [January 7, 2021, 4:32pm UTC](https://discuss.elastic.co/t/create-visualization-with-actual-status-of-process-group-by-subquery/260379 "2021-01-07T16:32:51Z")
Hello, I have a log file, like this : {"process": "X2", "status": "open", "@timestamp": "2021-01-05T15:34:41.061Z"} {"process": "X1", "status": "open", "@timestamp": "2021-01-05T15:35:42.061Z"} {"process": "X5", "sta… --- ## [Logstash fails to run: ES\_TEMPDIR does not get translated properly?](https://discuss.elastic.co/t/logstash-fails-to-run-es-tempdir-does-not-get-translated-properly/260441)
**Author:** [@tarkhil](https://discuss.elastic.co/u/tarkhil)\ **Replies:** 3\ **Last updated:** [January 7, 2021, 4:18pm UTC](https://discuss.elastic.co/t/logstash-fails-to-run-es-tempdir-does-not-get-translated-properly/260441 "2021-01-07T16:18:31Z")
logstash7-7.10.0 openjdk15-15.0.1 Attempt to run logstash fails with # su -m logstash -c 'sh -c "env JAVA\_HOME=/usr/local/openjdk15 /usr/local/logstash/bin/logstash --path.settings /usr/local/etc/logstash -l /var… --- ## [How to parse first line in all the next lines](https://discuss.elastic.co/t/how-to-parse-first-line-in-all-the-next-lines/260459)
**Author:** [@kevin\_urbina](https://discuss.elastic.co/u/kevin_urbina)\ **Replies:** 0\ **Last updated:** [January 7, 2021, 3:49pm UTC](https://discuss.elastic.co/t/how-to-parse-first-line-in-all-the-next-lines/260459 "2021-01-07T15:49:23Z")
Hello everyone, I am having the following log : Sun Dec 20 00:40:05 CST 2020: Starting docker, stream=prod, version=latest, pwd=PATH Processing... SERVER oc: Successfully processed 23 TSM servers. Failed: 23 Detail… --- ## [Search\_after With Collapse Pagination Alternative](https://discuss.elastic.co/t/search-after-with-collapse-pagination-alternative/260451)
**Author:** [@MilanGatyas](https://discuss.elastic.co/u/MilanGatyas)\ **Replies:** 1\ **Last updated:** [January 7, 2021, 3:35pm UTC](https://discuss.elastic.co/t/search-after-with-collapse-pagination-alternative/260451 "2021-01-07T15:35:32Z")
We want to utilize the search\_after pagination strategy rather than from-size pagination strategy as we understood that search\_after has better performance for high pagination numbers. At the same time, we do collapse o… --- ## [Data path already locked by another beat ,how to configure path.data in running on kubernetes filebeat-kubernetes.yaml](https://discuss.elastic.co/t/data-path-already-locked-by-another-beat-how-to-configure-path-data-in-running-on-kubernetes-filebeat-kubernetes-yaml/260036)
**Author:** [@umen](https://discuss.elastic.co/u/umen)\ **Replies:** 6\ **Last updated:** [January 7, 2021, 3:25pm UTC](https://discuss.elastic.co/t/data-path-already-locked-by-another-beat-how-to-configure-path-data-in-running-on-kubernetes-filebeat-kubernetes-yaml/260036 "2021-01-07T15:25:57Z")
Hey i installed filebeat using this link : right away i got the error : \[root@ip-10-xx-x-x filebeat\]# filebeat -e -d "publish" 2021-01-03T09:12:11.438Z INFO instance/beat.go:645 Home path: \[/usr/share/fi… --- ## [Filebeat TCP Input Max Connections](https://discuss.elastic.co/t/filebeat-tcp-input-max-connections/260296)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [January 7, 2021, 3:22pm UTC](https://discuss.elastic.co/t/filebeat-tcp-input-max-connections/260296 "2021-01-07T15:22:25Z")
Hello, The documentation of the Filebeat tcp input mentions max\_connections. But it does not state what's the default value? So what is the default value? Grtz Willem --- ## [Philosophy behind ignore\_above mapping parameter](https://discuss.elastic.co/t/philosophy-behind-ignore-above-mapping-parameter/260438)
**Author:** [@agx](https://discuss.elastic.co/u/agx)\ **Replies:** 5\ **Last updated:** [January 7, 2021, 3:08pm UTC](https://discuss.elastic.co/t/philosophy-behind-ignore-above-mapping-parameter/260438 "2021-01-07T15:08:31Z")
we're using serilog to send logs to elastic. it's default mapping parameter is to ignore fields above 256 characters (which might also be an elastic default?). this has been fine for us, but recently one of our devs want… --- ## [Metricbeat/K8s connect directly to elasticsearch or logstash what is best practices here?](https://discuss.elastic.co/t/metricbeat-k8s-connect-directly-to-elasticsearch-or-logstash-what-is-best-practices-here/260450)
**Author:** [@Kiril\_Churilov](https://discuss.elastic.co/u/Kiril_Churilov)\ **Replies:** 1\ **Last updated:** [January 7, 2021, 2:59pm UTC](https://discuss.elastic.co/t/metricbeat-k8s-connect-directly-to-elasticsearch-or-logstash-what-is-best-practices-here/260450 "2021-01-07T14:59:23Z")
Hello I'm new to ELK stack and beats technology. I managed to build and install Elasticseach 3 nodes cluster and kibana on kubernetes in google cloud (GKE) and plan to use it in production environment. I installed lo… --- ## [Nested terms aggregation performance](https://discuss.elastic.co/t/nested-terms-aggregation-performance/260446)
**Author:** [@shusson](https://discuss.elastic.co/u/shusson)\ **Replies:** 0\ **Last updated:** [January 7, 2021, 1:42pm UTC](https://discuss.elastic.co/t/nested-terms-aggregation-performance/260446 "2021-01-07T13:42:47Z")
I'm trying to optimize nested term aggregations for an autocomplete use case. More info on the query and mapping here: https://stackoverflow.com/questions/65613335/improve-performance-of-a-nested-term-aggregation. Based… --- ## [使用logstash7.4.2往es发送数据得用户信息如何创建用户呢](https://discuss.elastic.co/t/logstash7-4-2-es/260411)
**Author:** [@111351](https://discuss.elastic.co/u/111351)\ **Replies:** 0\ **Last updated:** [January 7, 2021, 6:36am UTC](https://discuss.elastic.co/t/logstash7-4-2-es/260411 "2021-01-07T06:36:44Z")
你好我用es里自带得logstsah\_system用户向es发数据不成功请问有人知道是怎么回事吗 --- ## [Kibana@Docker new instances occure in stack monitoring when I reboot the Kibana node](https://discuss.elastic.co/t/kibana-docker-new-instances-occure-in-stack-monitoring-when-i-reboot-the-kibana-node/258697)
**Author:** [@Waxman](https://discuss.elastic.co/u/Waxman)\ **Replies:** 3\ **Last updated:** [January 7, 2021, 1:29pm UTC](https://discuss.elastic.co/t/kibana-docker-new-instances-occure-in-stack-monitoring-when-i-reboot-the-kibana-node/258697 "2021-01-07T13:29:14Z")
Hi There, I'm running on elk 7.9.2 with two kibana's nodes. I'm noticing some interesting behaviour in the stack monitoring . When I reboot one of two kibana's node then I've lost my monitoring graphs and I start… --- ## [Need to alert if nested aggregation returns more than 3 results](https://discuss.elastic.co/t/need-to-alert-if-nested-aggregation-returns-more-than-3-results/260433)
**Author:** [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\ **Replies:** 0\ **Last updated:** [January 7, 2021, 12:13pm UTC](https://discuss.elastic.co/t/need-to-alert-if-nested-aggregation-returns-more-than-3-results/260433 "2021-01-07T12:13:57Z")
Hi, I have the following watch: { "trigger": { "schedule": { "interval": "5m" } }, "input": { "search": { "request": { "search\_type": "query\_then\_fetch", "indices": \[ … --- ## [Logstash trying to write to read-only index endlessly](https://discuss.elastic.co/t/logstash-trying-to-write-to-read-only-index-endlessly/260356)
**Author:** [@alexbde](https://discuss.elastic.co/u/alexbde)\ **Replies:** 3\ **Last updated:** [January 7, 2021, 9:52am UTC](https://discuss.elastic.co/t/logstash-trying-to-write-to-read-only-index-endlessly/260356 "2021-01-07T09:52:04Z")
Hello, we're using BELK-Stack with 5 Filebeats =\> 1 Logstash =\> 1 Elasticsearch \<= 1 Kibana. During the last weeks we experienced some downtime of 2 Filebeat services (root cause doesn't matter) which led to some buffere… --- ## [Index.lifecycle.rollover\_alias \[metricbeat\] does not point to index \[metricbeat-XXX\]](https://discuss.elastic.co/t/index-lifecycle-rollover-alias-metricbeat-does-not-point-to-index-metricbeat-xxx/260187)
**Author:** [@graimato](https://discuss.elastic.co/u/graimato)\ **Replies:** 3\ **Last updated:** [January 7, 2021, 9:50am UTC](https://discuss.elastic.co/t/index-lifecycle-rollover-alias-metricbeat-does-not-point-to-index-metricbeat-xxx/260187 "2021-01-07T09:50:10Z")
Dear all, I have a problem with a rollover for a metric beat index. I created a ILM Policy I setup metric beat to send data as follow: setup.ilm.check\_exists: false setup.ilm.overwrite: true setup.ilm.enabled… --- ## [KQL query to retrieve list of servers which are running metricbeat](https://discuss.elastic.co/t/kql-query-to-retrieve-list-of-servers-which-are-running-metricbeat/260336)
**Author:** [@Sergius92](https://discuss.elastic.co/u/Sergius92)\ **Replies:** 4\ **Last updated:** [January 7, 2021, 9:11am UTC](https://discuss.elastic.co/t/kql-query-to-retrieve-list-of-servers-which-are-running-metricbeat/260336 "2021-01-07T09:11:22Z")
Hello, I am trying to retrieve the list of servers which are running metricbeat. At this moment I have build an query but I don't know how to get the output with every host.name and the number of hits in the last minut… --- ## [Using a threshold on doc\_count within a nested aggregation](https://discuss.elastic.co/t/using-a-threshold-on-doc-count-within-a-nested-aggregation/260357)
**Author:** [@pschwippert](https://discuss.elastic.co/u/pschwippert)\ **Replies:** 4\ **Last updated:** [January 7, 2021, 9:06am UTC](https://discuss.elastic.co/t/using-a-threshold-on-doc-count-within-a-nested-aggregation/260357 "2021-01-07T09:06:10Z")
Hi, I am currnetly working on a watcher that send out an alert when a user has too many failed login attempts. I am aggregating the documents first based on the realm then based on the username. Now within the compare … --- ## [ES Cloud - Running ingest pipelines on warm nodes?](https://discuss.elastic.co/t/es-cloud-running-ingest-pipelines-on-warm-nodes/259054)
**Author:** [@Alain\_St\_Pierre](https://discuss.elastic.co/u/Alain_St_Pierre)\ **Replies:** 40\ **Last updated:** [January 7, 2021, 8:15am UTC](https://discuss.elastic.co/t/es-cloud-running-ingest-pipelines-on-warm-nodes/259054 "2021-01-07T08:15:52Z")
Hi there, I have a hot/warm cluster running on ES cloud with the following setup: 2x 29Gb hot nodes 2x 29Gb warm nodes time series data ingest rate: 2500/s (350 bytes each) ~75Gb/day enrich pipeline (with enrich snaps… --- ## [\[Threat Intelligence\]: Avoid redundancy of information in the same index](https://discuss.elastic.co/t/threat-intelligence-avoid-redundancy-of-information-in-the-same-index/260303)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 4\ **Last updated:** [January 7, 2021, 8:11am UTC](https://discuss.elastic.co/t/threat-intelligence-avoid-redundancy-of-information-in-the-same-index/260303 "2021-01-07T08:11:59Z")
Hello, I am using this pipeline to enrich my SIEM with URLhaus information: input { exec { command =\> 'curl https://urlhaus.abuse.ch/downloads/csv/ --output text.zip && unzip -c text.zip' interval =\> 86400 … --- ## [\[Need help\] Error when installing winlogbeat on Windows Server 2012 R2](https://discuss.elastic.co/t/need-help-error-when-installing-winlogbeat-on-windows-server-2012-r2/259351)
**Author:** [@lachezar.uzunov](https://discuss.elastic.co/u/lachezar.uzunov)\ **Replies:** 5\ **Last updated:** [January 7, 2021, 7:00am UTC](https://discuss.elastic.co/t/need-help-error-when-installing-winlogbeat-on-windows-server-2012-r2/259351 "2021-01-07T07:00:45Z")
Hello everyone I need help debugging what is actually going on. I am installing winlogbeat as mentioned in the documentation (www.elastic.co/guide/en/beats/winlogbeat/7.10/winlogbeat-installation-configuration.html). T… --- ## [\[HELP\] Cannot receive data from winlogbeat on Windows Server 2012 R2](https://discuss.elastic.co/t/help-cannot-receive-data-from-winlogbeat-on-windows-server-2012-r2/260092)
**Author:** [@lachezar.uzunov](https://discuss.elastic.co/u/lachezar.uzunov)\ **Replies:** 5\ **Last updated:** [January 7, 2021, 6:59am UTC](https://discuss.elastic.co/t/help-cannot-receive-data-from-winlogbeat-on-windows-server-2012-r2/260092 "2021-01-07T06:59:00Z")
Hello everyone, I am struggling at receiving logs from winlogbeat on Windows Server 2012 R2. Things to mention: On Windows Server 2016+ its working completely fine. On Windows 10 PC (Pro/Home) is working completely fi… --- ## [Logstash: Resource consumption of multiple Logstash servers are not even](https://discuss.elastic.co/t/logstash-resource-consumption-of-multiple-logstash-servers-are-not-even/260406)
**Author:** [@Hung\_Phan\_Huy](https://discuss.elastic.co/u/Hung_Phan_Huy)\ **Replies:** 1\ **Last updated:** [January 7, 2021, 6:55am UTC](https://discuss.elastic.co/t/logstash-resource-consumption-of-multiple-logstash-servers-are-not-even/260406 "2021-01-07T06:55:19Z")
Hi, I'm running my Logstash services on Docker Swarm with 4 replicas. They subscribe to the same Kafka topic and output the data to Elasticsearch. When I inspect the resource consumption of those 4 containers, I found … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1613) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1615)