# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1620 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1621 --- ## [Trying to setup beats](https://discuss.elastic.co/t/trying-to-setup-beats/257794)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 6\ **Last updated:** [January 4, 2021, 5:22pm UTC](https://discuss.elastic.co/t/trying-to-setup-beats/257794 "2021-01-04T17:22:47Z")
I had deployed Elasticsearch cluster along with kibana in GCP. I was trying to deploy beats as well. I had used the beats yaml files which are in the following link: I just changed the elastic and kibana references… --- ## [Alerting visualization in kibana](https://discuss.elastic.co/t/alerting-visualization-in-kibana/260074)
**Author:** [@anjali28](https://discuss.elastic.co/u/anjali28)\ **Replies:** 3\ **Last updated:** [January 4, 2021, 4:55pm UTC](https://discuss.elastic.co/t/alerting-visualization-in-kibana/260074 "2021-01-04T16:55:16Z")
Hello, i want to create a visual representing the application status up in green mode and when down in red mode. Data is in boolean format for UP it is 1 and down it is 0 Description : From which visualization i can… --- ## [Multipe host output using keystore passwords](https://discuss.elastic.co/t/multipe-host-output-using-keystore-passwords/260090)
**Author:** [@mcosta](https://discuss.elastic.co/u/mcosta)\ **Replies:** 4\ **Last updated:** [January 4, 2021, 4:29pm UTC](https://discuss.elastic.co/t/multipe-host-output-using-keystore-passwords/260090 "2021-01-04T16:29:29Z")
Hi All, I need to configure logstash (ver 7.7) to write to two elastisearch. I have two separate output blocks, one for each elasticsearch but how do I configure password retrieval from keystore, since documentation ref… --- ## [SocketTimeoutException within Java High Level Client](https://discuss.elastic.co/t/sockettimeoutexception-within-java-high-level-client/259871)
**Author:** [@David-Lor](https://discuss.elastic.co/u/David-Lor)\ **Replies:** 4\ **Last updated:** [January 4, 2021, 4:13pm UTC](https://discuss.elastic.co/t/sockettimeoutexception-within-java-high-level-client/259871 "2021-01-04T16:13:11Z")
I'm building an application involving SpringBoot and the official Elastic REST High Level Client, and it seems that the connection with the Elastic server eventually dies if not used after some time. On the application … --- ## [Kibana Build "ERROR \[bootstrap\] failed":](https://discuss.elastic.co/t/kibana-build-error-bootstrap-failed/259776)
**Author:** [@Dhruvil\_Doshi](https://discuss.elastic.co/u/Dhruvil_Doshi)\ **Replies:** 3\ **Last updated:** [January 4, 2021, 4:07pm UTC](https://discuss.elastic.co/t/kibana-build-error-bootstrap-failed/259776 "2021-01-04T16:07:28Z")
I have downloaded kibana 7.10 from Github. I am not able to build kibana. After running, yarn kbn bootstrap I am getting below error. yarn run v1.22.5 $ node scripts/kbn bootstrap info \[kibana\] running yarn $ node… --- ## [Hostname and timestamp gets overwritten when using archived event logs using winlogbeat](https://discuss.elastic.co/t/hostname-and-timestamp-gets-overwritten-when-using-archived-event-logs-using-winlogbeat/257739)
**Author:** [@p1k4chu](https://discuss.elastic.co/u/p1k4chu)\ **Replies:** 1\ **Last updated:** [January 4, 2021, 4:00pm UTC](https://discuss.elastic.co/t/hostname-and-timestamp-gets-overwritten-when-using-archived-event-logs-using-winlogbeat/257739 "2021-01-04T16:00:45Z")
Version : Winlogbeat 7.9.2 Platform: Windows 10 Reproduction Instructions: Use winlogbeat to upload an event log file (.evtx file using -E option) and use the default config file. I used this script to upload bulk fil… --- ## [Hot-warm policy](https://discuss.elastic.co/t/hot-warm-policy/259862)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 2\ **Last updated:** [January 4, 2021, 3:48pm UTC](https://discuss.elastic.co/t/hot-warm-policy/259862 "2021-01-04T15:48:19Z")
Hello, I would like to create a Hot-warm policy , and the index should rollover when the index is 20Gb of size or max\_age equal to 30days BUT, if the size condition occur before the age condition, the index should rollo… --- ## [Ilm - index creation time picked as future date and time](https://discuss.elastic.co/t/ilm-index-creation-time-picked-as-future-date-and-time/260075)
**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Replies:** 1\ **Last updated:** [January 4, 2021, 3:44pm UTC](https://discuss.elastic.co/t/ilm-index-creation-time-picked-as-future-date-and-time/260075 "2021-01-04T15:44:33Z")
ILM rollover stopped working from 12/27/2020, because of wrong index creation time. we verified system date, system date was correct during index creation. we could confirm by seeing the elasticsearch log that system d… --- ## [Logstash plugin is installed and listed but not found by logstash](https://discuss.elastic.co/t/logstash-plugin-is-installed-and-listed-but-not-found-by-logstash/259895)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 3\ **Last updated:** [January 4, 2021, 3:43pm UTC](https://discuss.elastic.co/t/logstash-plugin-is-installed-and-listed-but-not-found-by-logstash/259895 "2021-01-04T15:43:34Z")
Hello Elasticians ! I installed syslog output plug in (logstash-output-syslog-3.0.5.gem) using offline method as I don't have wan access on target server. Plug in has been successfully installed and is listed with lo… --- ## [Resizable Table Legends and Multiple Terms aggregations](https://discuss.elastic.co/t/resizable-table-legends-and-multiple-terms-aggregations/260039)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [January 4, 2021, 3:40pm UTC](https://discuss.elastic.co/t/resizable-table-legends-and-multiple-terms-aggregations/260039 "2021-01-04T15:40:55Z")
Hello, In Grafana we have the option to show legends as a table, showing a lot of useful aggregated info, for example: I have tried many things to achieve the same in Kibana, but never managed to get even close to w… --- ## [Renaming the user agent "Elastic-Heartbeat/7.x.x" in Heartbeat (http monitor type)](https://discuss.elastic.co/t/renaming-the-user-agent-elastic-heartbeat-7-x-x-in-heartbeat-http-monitor-type/260017)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 1\ **Last updated:** [January 4, 2021, 3:25pm UTC](https://discuss.elastic.co/t/renaming-the-user-agent-elastic-heartbeat-7-x-x-in-heartbeat-http-monitor-type/260017 "2021-01-04T15:25:51Z")
Hello, Is it possible to change the name the user agent "Elastic-Heartbeat/7.x.x" in Heartbeat (http monitor type)? Is such modification relatively easy to implement? I do not see the appropriate option in the configu… --- ## [Index multiple payload hits to hits array in new index](https://discuss.elastic.co/t/index-multiple-payload-hits-to-hits-array-in-new-index/260101)
**Author:** [@esguy](https://discuss.elastic.co/u/esguy)\ **Replies:** 0\ **Last updated:** [January 4, 2021, 3:17pm UTC](https://discuss.elastic.co/t/index-multiple-payload-hits-to-hits-array-in-new-index/260101 "2021-01-04T15:17:46Z")
Hello, I am developing a watch that needs access to previous watch payload data. Since the watch scope is that of itself, I was thinking that an index action to index the desired payload for future reference was the way… --- ## [Kibana map inport china\_provinces\_v1.geojson but Chinese charactor unidentifiable](https://discuss.elastic.co/t/kibana-map-inport-china-provinces-v1-geojson-but-chinese-charactor-unidentifiable/259931)
**Author:** [@yorkzhang](https://discuss.elastic.co/u/yorkzhang)\ **Replies:** 2\ **Last updated:** [January 4, 2021, 3:12pm UTC](https://discuss.elastic.co/t/kibana-map-inport-china-provinces-v1-geojson-but-chinese-charactor-unidentifiable/259931 "2021-01-04T15:12:27Z")
I used Kibana map, import geojson file download from map.elastic.co china\_provinces\_v1.geojson, but Chinese charactor unidentifiable. I get doc from Dev Tools and see unidentifiable chinese charactor. But if I use onlin… --- ## [Metricbeat Kubernetes Module has JSON marshal error](https://discuss.elastic.co/t/metricbeat-kubernetes-module-has-json-marshal-error/259900)
**Author:** [@matthew-mcdermott](https://discuss.elastic.co/u/matthew-mcdermott)\ **Replies:** 2\ **Last updated:** [January 4, 2021, 2:48pm UTC](https://discuss.elastic.co/t/metricbeat-kubernetes-module-has-json-marshal-error/259900 "2021-01-04T14:48:27Z")
I am using metricbeat's kubernetes module and have come across what I believe is a bug. It is related to this issue: https://github.com/elastic/beats/issues/19475. I am not a Go developer, but seems like a fix might be … --- ## [Will my "%{GREEDYDATA:\[log\_message\]}" overwrides all my other grok filters?](https://discuss.elastic.co/t/will-my-greedydata-log-message-overwrides-all-my-other-grok-filters/260063)
**Author:** [@yulaika](https://discuss.elastic.co/u/yulaika)\ **Replies:** 1\ **Last updated:** [January 4, 2021, 2:43pm UTC](https://discuss.elastic.co/t/will-my-greedydata-log-message-overwrides-all-my-other-grok-filters/260063 "2021-01-04T14:43:13Z")
grok { match =\> { "message" =\> \[ "(?\<\[log\]\[timestamp\]\>%{YEAR}-%{MONTHNUM}-%{MONTHDAY}%{SPACE}%{TIME}) \\\[%{NOTSPACE:\[LOG\]\[LEVEL\]}\\\] %{GREEDYDATA:\[log\_message\]}" , "(?\<\[log\]\[timestamp\]\>%{YEA… --- ## [Consolidate log lines sa one depending on the threadID information](https://discuss.elastic.co/t/consolidate-log-lines-sa-one-depending-on-the-threadid-information/257978)
**Author:** [@secintic](https://discuss.elastic.co/u/secintic)\ **Replies:** 1\ **Last updated:** [January 4, 2021, 1:54pm UTC](https://discuss.elastic.co/t/consolidate-log-lines-sa-one-depending-on-the-threadid-information/257978 "2021-01-04T13:54:27Z")
We have a syserr messages from one of our WebApplication servers it is writing each line with timestamp we want to group these lines depending on their threadID you can see the example log file below. The challenging thi… --- ## [Need help displaying two different counts on the same chart](https://discuss.elastic.co/t/need-help-displaying-two-different-counts-on-the-same-chart/259264)
**Author:** [@njanashia](https://discuss.elastic.co/u/njanashia)\ **Replies:** 3\ **Last updated:** [January 4, 2021, 1:40pm UTC](https://discuss.elastic.co/t/need-help-displaying-two-different-counts-on-the-same-chart/259264 "2021-01-04T13:40:37Z")
I want to display sales and refunds counts for the same day on the same chart like it is shown on the first picture. The corresponding date fields for sales and refunds are detail\_trans\_date and detail\_refund\_date. I ha… --- ## [Can't find data when doing simple KQL query ( can see the log in general search)](https://discuss.elastic.co/t/cant-find-data-when-doing-simple-kql-query-can-see-the-log-in-general-search/260034)
**Author:** [@umen](https://discuss.elastic.co/u/umen)\ **Replies:** 3\ **Last updated:** [January 4, 2021, 1:01pm UTC](https://discuss.elastic.co/t/cant-find-data-when-doing-simple-kql-query-can-see-the-log-in-general-search/260034 "2021-01-04T13:01:56Z")
im using the filebeat-\* index . when i watch the logs in discover i can see logs from the pods when i try to create simple query to get logs by namespace/name/container name i don't get any result i follow this threa… --- ## [Ms teams watcher](https://discuss.elastic.co/t/ms-teams-watcher/260076)
**Author:** [@Mohith\_Vegi](https://discuss.elastic.co/u/Mohith_Vegi)\ **Replies:** 5\ **Last updated:** [January 4, 2021, 12:47pm UTC](https://discuss.elastic.co/t/ms-teams-watcher/260076 "2021-01-04T12:47:54Z")
"type": "messaging\_exception", "reason": "failed to send email with subject \[mail alert\] via account \[outlook\_account\]", "caused\_by": { "type": "s\_m\_t\_p\_send\_failed\_exception", "reason": "554 5.2.0 STOREDRV.Submissio… --- ## [Respect bootstrapNewHistoryUUID option when restoring from snapshot](https://discuss.elastic.co/t/respect-bootstrapnewhistoryuuid-option-when-restoring-from-snapshot/259498)
**Author:** [@asce0705](https://discuss.elastic.co/u/asce0705)\ **Replies:** 9\ **Last updated:** [January 4, 2021, 12:23pm UTC](https://discuss.elastic.co/t/respect-bootstrapnewhistoryuuid-option-when-restoring-from-snapshot/259498 "2021-01-04T12:23:09Z")
Shall we enable bootstrapNewHistoryUUID option in SnapshotRecoverySource, which disable bootstraping new history uuid of the primary shard index when set false. In some environment, the primary shard may be restored fro… --- ## [Multiple resources on conf](https://discuss.elastic.co/t/multiple-resources-on-conf/260079)
**Author:** [@Sunflower](https://discuss.elastic.co/u/Sunflower)\ **Replies:** 6\ **Last updated:** [January 4, 2021, 11:40am UTC](https://discuss.elastic.co/t/multiple-resources-on-conf/260079 "2021-01-04T11:40:59Z")
Hi, I have multiple resources that I want to configure to send Syslog to Logstash and then send it to S3. I'd appreciate hearing your thoughts regarding the two following options: Multiple resources on the input, eac… --- ## [Max payload issue](https://discuss.elastic.co/t/max-payload-issue/260084)
**Author:** [@Dainius](https://discuss.elastic.co/u/Dainius)\ **Replies:** 1\ **Last updated:** [January 4, 2021, 11:29am UTC](https://discuss.elastic.co/t/max-payload-issue/260084 "2021-01-04T11:29:33Z")
Hey guys, I would like to sort out one issue I have. I get max payload error while trying to refresh index pattern in Kibana. Of course I have already increased server.maxPayloadBytes: value in kibana config file, but m… --- ## [Perform boolean operation on result sets of two queries](https://discuss.elastic.co/t/perform-boolean-operation-on-result-sets-of-two-queries/260083)
**Author:** [@tejas1\_shah](https://discuss.elastic.co/u/tejas1_shah)\ **Replies:** 0\ **Last updated:** [January 4, 2021, 11:20am UTC](https://discuss.elastic.co/t/perform-boolean-operation-on-result-sets-of-two-queries/260083 "2021-01-04T11:20:48Z")
Hello, I am creating a solution based on elastic search based on user inputs for a text. The results are to be shown in 3 groups - one group containing the exact match, second group containing only the stemmed results … --- ## [Postgres with Elastic search issue](https://discuss.elastic.co/t/postgres-with-elastic-search-issue/259448)
**Author:** [@vasimsaiyad2000](https://discuss.elastic.co/u/vasimsaiyad2000)\ **Replies:** 3\ **Last updated:** [January 4, 2021, 11:12am UTC](https://discuss.elastic.co/t/postgres-with-elastic-search-issue/259448 "2021-01-04T11:12:33Z")
I have implemented logstash with postgres to send my restaurant and menu items to Elasticsearch. I have applied paging to fetch the data from postgres and also have jdbc streaming. If i run the logstash with jdbc stream… --- ## [ILM policy - why isn't it deleting?](https://discuss.elastic.co/t/ilm-policy-why-isnt-it-deleting/259483)
**Author:** [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\ **Replies:** 3\ **Last updated:** [January 4, 2021, 11:03am UTC](https://discuss.elastic.co/t/ilm-policy-why-isnt-it-deleting/259483 "2021-01-04T11:03:55Z")
Indices are building up instead of being deleted. Here's the policy: GET \_ilm/policy/packetbeat { "packetbeat" : { "version" : 6, "modified\_date" : "2020-12-21T12:30:41.023Z", "policy" : { "phases" :… --- ## [Error while trying to Install elasticsearch on Azure as self service](https://discuss.elastic.co/t/error-while-trying-to-install-elasticsearch-on-azure-as-self-service/258236)
**Author:** [@tal.paz](https://discuss.elastic.co/u/tal.paz)\ **Replies:** 13\ **Last updated:** [January 4, 2021, 10:21am UTC](https://discuss.elastic.co/t/error-while-trying-to-install-elasticsearch-on-azure-as-self-service/258236 "2021-01-04T10:21:50Z")
Hi, I am trying to install the elasticserach as self service in Azure portal. Using the following link: https://azuremarketplace.microsoft.com/en-us/marketplace/apps/elastic.elasticsearch?tab=Overview After configurin… --- ## [Canvas drilldown](https://discuss.elastic.co/t/canvas-drilldown/257543)
**Author:** [@ravishka](https://discuss.elastic.co/u/ravishka)\ **Replies:** 5\ **Last updated:** [January 4, 2021, 9:51am UTC](https://discuss.elastic.co/t/canvas-drilldown/257543 "2021-01-04T09:51:29Z")
Is there a drilldown concept/option or similar concept on the canvas? --- ## [Kibana dashboard](https://discuss.elastic.co/t/kibana-dashboard/259983)
**Author:** [@Sajal](https://discuss.elastic.co/u/Sajal)\ **Replies:** 2\ **Last updated:** [January 4, 2021, 9:36am UTC](https://discuss.elastic.co/t/kibana-dashboard/259983 "2021-01-04T09:36:56Z")
Hi Folks , Can you please help me to make Kibana dashboard . I have got below Splunk Query from which i need to make Kibana Dashboard. We are migrating from Splunk to ELK. How to create deviation and and use in where c… --- ## [Kibana 7.8.1 user interface](https://discuss.elastic.co/t/kibana-7-8-1-user-interface/259746)
**Author:** [@RickT](https://discuss.elastic.co/u/RickT)\ **Replies:** 2\ **Last updated:** [January 4, 2021, 9:35am UTC](https://discuss.elastic.co/t/kibana-7-8-1-user-interface/259746 "2021-01-04T09:35:28Z")
hi, Our technical team has updated Kibana 6.8 to 7.8.1. Today i'm very surprise about the user interface :frowning: Lot of shorts functions has disappeared, like filters action ! Now we are obliged to multiply clicks t… --- ## [Index Alias](https://discuss.elastic.co/t/index-alias/260068)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 2\ **Last updated:** [January 4, 2021, 9:21am UTC](https://discuss.elastic.co/t/index-alias/260068 "2021-01-04T09:21:49Z")
Hi, I want to create an index with name xyz-yyyy-MM. Index Name should be like : xyz-2020-01 xyz-2020-04 xyz-2020-12 xyz-2021-05 I want to add these index into one in this pattern "xyz" with "\*" Will it be possibl… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1619) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1621)