# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1630 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1631 --- ## [External Ruby, more than one value in a hash](https://discuss.elastic.co/t/external-ruby-more-than-one-value-in-a-hash/259434)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 3\ **Last updated:** [December 23, 2020, 3:53pm UTC](https://discuss.elastic.co/t/external-ruby-more-than-one-value-in-a-hash/259434 "2020-12-23T15:53:13Z")
I have been using this external ruby code to add data to the documents, when a document has a planet\_name equal to the key in the hash add the value to a field in the document def register(params) end def filter(event) … --- ## [Duplicate log entries](https://discuss.elastic.co/t/duplicate-log-entries/259394)
**Author:** [@leandro.borges](https://discuss.elastic.co/u/leandro.borges)\ **Replies:** 17\ **Last updated:** [December 23, 2020, 3:52pm UTC](https://discuss.elastic.co/t/duplicate-log-entries/259394 "2020-12-23T15:52:32Z")
Hi, We are facing some issues with elasticsearch. We are having lots of duplicate log entries like below. Inside logstash.yml there is only a file in path.config that we use: path.config: "/etc/logstash/pipeline.global.… --- ## [How to generate a pie chart from geo\_points within a geo\_shape in ELK?](https://discuss.elastic.co/t/how-to-generate-a-pie-chart-from-geo-points-within-a-geo-shape-in-elk/258312)
**Author:** [@MichaelLevy](https://discuss.elastic.co/u/MichaelLevy)\ **Replies:** 7\ **Last updated:** [December 23, 2020, 3:33pm UTC](https://discuss.elastic.co/t/how-to-generate-a-pie-chart-from-geo-points-within-a-geo-shape-in-elk/258312 "2020-12-23T15:33:54Z")
Hello everyone! I have created a map by importing GEOJSON data in KIBANA. The data is indexed as geo\_shape and it contains the World's territorial waters area. It represents a layer in my map. I have then added another … --- ## [Issue unzipping Kibana 7.10 installation file (kibana-7.10.0-windows-x86\_64.zip)](https://discuss.elastic.co/t/issue-unzipping-kibana-7-10-installation-file-kibana-7-10-0-windows-x86-64-zip/257332)
**Author:** [@eugenevk](https://discuss.elastic.co/u/eugenevk)\ **Replies:** 1\ **Last updated:** [December 23, 2020, 3:28pm UTC](https://discuss.elastic.co/t/issue-unzipping-kibana-7-10-installation-file-kibana-7-10-0-windows-x86-64-zip/257332 "2020-12-23T15:28:09Z")
Hi, I get an error message when unzipping kibana-7.10.0-windows-x86\_64.zip. Towards the end of the extraction process I get the error message Skipping file: unable to create a sensible filename out of "C:\\Users\\...\\add\_… --- ## [Can you configure linger.ms in the kafka output?](https://discuss.elastic.co/t/can-you-configure-linger-ms-in-the-kafka-output/259501)
**Author:** [@shayrybak](https://discuss.elastic.co/u/shayrybak)\ **Replies:** 0\ **Last updated:** [December 23, 2020, 3:17pm UTC](https://discuss.elastic.co/t/can-you-configure-linger-ms-in-the-kafka-output/259501 "2020-12-23T15:17:38Z")
Hi, I've been running filebeat to send log files to kafka for processing, I've noticed that filebeat is lingering before sending the kafka batch for about 1 second. I'm assuming that is the default value in Sarama, howe… --- ## [Filebeat - How to disable "kube-system" namespace logs?](https://discuss.elastic.co/t/filebeat-how-to-disable-kube-system-namespace-logs/259313)
**Author:** [@David\_Fachini](https://discuss.elastic.co/u/David_Fachini)\ **Replies:** 5\ **Last updated:** [December 23, 2020, 3:15pm UTC](https://discuss.elastic.co/t/filebeat-how-to-disable-kube-system-namespace-logs/259313 "2020-12-23T15:15:42Z")
Hello, I am using Elasticsearch + Filebeat and Kibana. I have two namespaces "datastore" and "logging". I would like only to collect logs from those and avoid to harvest log from "kube-system". Checking in kibana I am a… --- ## [Timestamp not mapping with event time](https://discuss.elastic.co/t/timestamp-not-mapping-with-event-time/258976)
**Author:** [@bharat1](https://discuss.elastic.co/u/bharat1)\ **Replies:** 6\ **Last updated:** [December 23, 2020, 3:00pm UTC](https://discuss.elastic.co/t/timestamp-not-mapping-with-event-time/258976 "2020-12-23T15:00:20Z")
My logs are exported in csv format and uploaded. The first column name called "Event Time" has following format event time followed by rest of the comma separated columns - "2020/11/10 00:00:00 CET" I am not able to ma… --- ## [Radar - how to create the radar chart](https://discuss.elastic.co/t/radar-how-to-create-the-radar-chart/258728)
**Author:** [@gcastro](https://discuss.elastic.co/u/gcastro)\ **Replies:** 4\ **Last updated:** [December 22, 2020, 2:53pm UTC](https://discuss.elastic.co/t/radar-how-to-create-the-radar-chart/258728 "2020-12-22T14:53:47Z")
Hello it seems you cannot do in native mode the radar graph in the new Kibana version. Has anyone managed to do it ? how ? thanks a lot for your replies regards gregory --- ## [How to migrate rollover aliases to data streams?](https://discuss.elastic.co/t/how-to-migrate-rollover-aliases-to-data-streams/259255)
**Author:** [@elk51211](https://discuss.elastic.co/u/elk51211)\ **Replies:** 1\ **Last updated:** [December 23, 2020, 2:22pm UTC](https://discuss.elastic.co/t/how-to-migrate-rollover-aliases-to-data-streams/259255 "2020-12-23T14:22:21Z")
Hey, We have over 1000 rollover indices on produciton servers. How to we migrate this environment to the data stream setup? How does the migrate path looks like? Thanks a lot, Nils --- ## [JavaScript](https://discuss.elastic.co/t/javascript/257561)
**Author:** [@ravishka](https://discuss.elastic.co/u/ravishka)\ **Replies:** 11\ **Last updated:** [December 23, 2020, 1:53pm UTC](https://discuss.elastic.co/t/javascript/257561 "2020-12-23T13:53:48Z")
Can I put Javascript code or library on the kibana canvas? --- ## [Auditbeat memory leak](https://discuss.elastic.co/t/auditbeat-memory-leak/259137)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 5\ **Last updated:** [December 23, 2020, 1:28pm UTC](https://discuss.elastic.co/t/auditbeat-memory-leak/259137 "2020-12-23T13:28:55Z")
Hi All, I was wondering if anyone else has noticed a memory leak with the last few version of Auditbeat? Currently running 7.10.0 (and had the issue in 7.8 and 7.9 as well) and I am seeing Auditbeat constantly being OO… --- ## [Index policy evaluation](https://discuss.elastic.co/t/index-policy-evaluation/259488)
**Author:** [@alfredo.deluca](https://discuss.elastic.co/u/alfredo.deluca)\ **Replies:** 2\ **Last updated:** [December 23, 2020, 1:25pm UTC](https://discuss.elastic.co/t/index-policy-evaluation/259488 "2020-12-23T13:25:20Z")
Hi all. A very quick one. I have the following policy { “policy”: { “policy\_id”: “Delete\_older\_than\_60d”, “description”: “Changes replica count and deletes”, “last\_updated\_time”: 1608542726528, “schema\_version”: 1, “er… --- ## [The shutdown process appears to be stalled due to busy or blocked plugins](https://discuss.elastic.co/t/the-shutdown-process-appears-to-be-stalled-due-to-busy-or-blocked-plugins/259487)
**Author:** [@Suddhasil\_Sarkar](https://discuss.elastic.co/u/Suddhasil_Sarkar)\ **Replies:** 0\ **Last updated:** [December 23, 2020, 1:06pm UTC](https://discuss.elastic.co/t/the-shutdown-process-appears-to-be-stalled-due-to-busy-or-blocked-plugins/259487 "2020-12-23T13:06:05Z")
Hi Team, Need help- we have ELK cluster which was down for few months. we nor brought the cluster up . Now having issues in logstash log as below.. \[ERROR\]\[logstash.shutdownwatcher \] The shutdown process appears to be s… --- ## [Sorting with wildcards. occurrences of term. amount of “\*searchstring\*”](https://discuss.elastic.co/t/sorting-with-wildcards-occurrences-of-term-amount-of-searchstring/259481)
**Author:** [@flashpeter](https://discuss.elastic.co/u/flashpeter)\ **Replies:** 0\ **Last updated:** [December 23, 2020, 12:18pm UTC](https://discuss.elastic.co/t/sorting-with-wildcards-occurrences-of-term-amount-of-searchstring/259481 "2020-12-23T12:18:35Z")
hi all i have nasty problem with elastic result sorting combined with boolean type of query (a kind of wildcard). lets say we have blog post with field "content". each post contains some info about dragons. with all co… --- ## [Weird XY data ouput with Vega Lite](https://discuss.elastic.co/t/weird-xy-data-ouput-with-vega-lite/258356)
**Author:** [@Ganymede](https://discuss.elastic.co/u/Ganymede)\ **Replies:** 3\ **Last updated:** [December 23, 2020, 11:36am UTC](https://discuss.elastic.co/t/weird-xy-data-ouput-with-vega-lite/258356 "2020-12-23T11:36:13Z")
Hello everyone, I'm sure someone can point out my stupid error. I'm quite new to Vega Lite, slightly getting the hang of it. Everything is working fine except that my numeric data and time data are mixed up as it seems… --- ## [Vega Lite - Mark: Area shows no values but points do](https://discuss.elastic.co/t/vega-lite-mark-area-shows-no-values-but-points-do/258440)
**Author:** [@Ganymede](https://discuss.elastic.co/u/Ganymede)\ **Replies:** 1\ **Last updated:** [December 23, 2020, 11:32am UTC](https://discuss.elastic.co/t/vega-lite-mark-area-shows-no-values-but-points-do/258440 "2020-12-23T11:32:16Z")
Hi everyone and thanks in advance, I hope someone can point me into the right direction on this. Why do my values only show up when I mark them as points and not line or area? Am I missing some form of aggregation? Co… --- ## [Create indices dynamically using filebeat by configuring filebeat.yml](https://discuss.elastic.co/t/create-indices-dynamically-using-filebeat-by-configuring-filebeat-yml/259473)
**Author:** [@kibelk22](https://discuss.elastic.co/u/kibelk22)\ **Replies:** 0\ **Last updated:** [December 23, 2020, 11:13am UTC](https://discuss.elastic.co/t/create-indices-dynamically-using-filebeat-by-configuring-filebeat-yml/259473 "2020-12-23T11:13:39Z")
Hi guys, I would like to create indices dynamically using filebeat and ship it directly to elasticsearch without using logstash (too heavy for my use case) by configuring filebeat.yml. I have one csv file which I woul… --- ## [Random file generated by elasticsearch](https://discuss.elastic.co/t/random-file-generated-by-elasticsearch/259453)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [December 23, 2020, 11:06am UTC](https://discuss.elastic.co/t/random-file-generated-by-elasticsearch/259453 "2020-12-23T11:06:38Z")
I am using elasticsearch cluster of 8 node (3Master+3data+2coordinate).In data node there is a file called java\_pid4907.hprof of 7.2 gb in elasticsearch data directory this file is present in all elasticsearch data node.… --- ## [Event attribute not resolved in elasticsearh output](https://discuss.elastic.co/t/event-attribute-not-resolved-in-elasticsearh-output/259472)
**Author:** [@KarlosA](https://discuss.elastic.co/u/KarlosA)\ **Replies:** 0\ **Last updated:** [December 23, 2020, 10:33am UTC](https://discuss.elastic.co/t/event-attribute-not-resolved-in-elasticsearh-output/259472 "2020-12-23T10:33:02Z")
Hello, I'm using helm chart with image: image: "docker.elastic.co/logstash/logstash-oss" imageTag: "7.10.0" I provide the following configuration in values.yml: logstashPipeline: logstash.conf: | input { … --- ## [Filebeat logger didn't work](https://discuss.elastic.co/t/filebeat-logger-didnt-work/259468)
**Author:** [@dukeyang](https://discuss.elastic.co/u/dukeyang)\ **Replies:** 0\ **Last updated:** [December 23, 2020, 10:16am UTC](https://discuss.elastic.co/t/filebeat-logger-didnt-work/259468 "2020-12-23T10:16:37Z")
I create a new output type (ghttp), and creat a new logger logger = logp.NewLogger("http") I test my logger: 168 logger.Info("got events",events) 169 logp.L().Info("got events",events) my config was: logging.l… --- ## [Audit logging for applying Licence](https://discuss.elastic.co/t/audit-logging-for-applying-licence/259443)
**Author:** [@Vineeth\_varma](https://discuss.elastic.co/u/Vineeth_varma)\ **Replies:** 0\ **Last updated:** [December 23, 2020, 4:25am UTC](https://discuss.elastic.co/t/audit-logging-for-applying-licence/259443 "2020-12-23T04:25:42Z")
Hi Team, I am using trail licence for ECK, and I have enabled auditing feature but still I am getting only few parameters, as this is testing its okay but after that will go into production one so in order to buy licenc… --- ## [Winlogbeat 7.10.0 Cannot start service (Error 1068)](https://discuss.elastic.co/t/winlogbeat-7-10-0-cannot-start-service-error-1068/259461)
**Author:** [@flavia\_b](https://discuss.elastic.co/u/flavia_b)\ **Replies:** 0\ **Last updated:** [December 23, 2020, 8:59am UTC](https://discuss.elastic.co/t/winlogbeat-7-10-0-cannot-start-service-error-1068/259461 "2020-12-23T08:59:34Z")
Hi there, I am struggling with winlogbeat 7.10.0. I installed the service in 68 hosts and everything seems fine (configuration and msi deployed via group policy). But there are a some hosts that fail to start the serv… --- ## [Drop field with dynamic name in filebeat](https://discuss.elastic.co/t/drop-field-with-dynamic-name-in-filebeat/259457)
**Author:** [@malcolm666](https://discuss.elastic.co/u/malcolm666)\ **Replies:** 0\ **Last updated:** [December 23, 2020, 8:15am UTC](https://discuss.elastic.co/t/drop-field-with-dynamic-name-in-filebeat/259457 "2020-12-23T08:15:34Z")
Hi. I have filebeat (version 7.6.1) deployed in k8s and some application. This application generates a lot of json data that is parsed. I want to drop some json fields from the filebeat output. The problem is that the n… --- ## [CANVAS SQL: condition with timestamp](https://discuss.elastic.co/t/canvas-sql-condition-with-timestamp/259282)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 2\ **Last updated:** [December 23, 2020, 8:03am UTC](https://discuss.elastic.co/t/canvas-sql-condition-with-timestamp/259282 "2020-12-23T08:03:19Z")
Hello, I am creating a canvas where I would like to show some anomalies in my cluster, and I wanna create something that show me if a new user in my AD has been created between midnight and 7am for example. I have this… --- ## [Complex SQL query calculated field generation in kibana](https://discuss.elastic.co/t/complex-sql-query-calculated-field-generation-in-kibana/259356)
**Author:** [@anjali28](https://discuss.elastic.co/u/anjali28)\ **Replies:** 7\ **Last updated:** [December 23, 2020, 7:19am UTC](https://discuss.elastic.co/t/complex-sql-query-calculated-field-generation-in-kibana/259356 "2020-12-23T07:19:56Z")
Hello, We want to created a visualization based on regular user in every month. Here is the requirement: "The visualization would display the number of regular users every month, regular users are those who have logg… --- ## [How can convert unstructured log string to json format using logstatsh](https://discuss.elastic.co/t/how-can-convert-unstructured-log-string-to-json-format-using-logstatsh/259202)
**Author:** [@abhi.coerian](https://discuss.elastic.co/u/abhi.coerian)\ **Replies:** 5\ **Last updated:** [December 23, 2020, 6:45am UTC](https://discuss.elastic.co/t/how-can-convert-unstructured-log-string-to-json-format-using-logstatsh/259202 "2020-12-23T06:45:43Z")
INFO handlers.DrivelRequestHandler: 2020-12-14 00:00:15.486 - JOB job\_1603918538928\_4026468 QUEUE queue\_test USER test AUTHORIZED\_SCHEMA message student {\\n optional int64 name;\\n optional double score;\\n required bin… --- ## [Not able to import GeoJson file using Kibana Maps](https://discuss.elastic.co/t/not-able-to-import-geojson-file-using-kibana-maps/258228)
**Author:** [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)\ **Replies:** 8\ **Last updated:** [December 23, 2020, 6:35am UTC](https://discuss.elastic.co/t/not-able-to-import-geojson-file-using-kibana-maps/258228 "2020-12-23T06:35:33Z")
Hi Team, I have created the custom geojson file for India region, when i try to import the file in kibana maps, it doesn't show any errors in elasticsearch log nor in the kibana UI. But i can see below error in kibana … --- ## [Painless scripted fields for truncating multiple values of a field](https://discuss.elastic.co/t/painless-scripted-fields-for-truncating-multiple-values-of-a-field/259440)
**Author:** [@Sivajanani](https://discuss.elastic.co/u/Sivajanani)\ **Replies:** 1\ **Last updated:** [December 23, 2020, 5:03am UTC](https://discuss.elastic.co/t/painless-scripted-fields-for-truncating-multiple-values-of-a-field/259440 "2020-12-23T05:03:19Z")
Hello All, I have my field as below. tags: targetgeo:russia, targetgeo:china, targetgeo:iran I wanted to truncate the string "targetgeo:" and need only values like russia,china,iran. My painless script is like below, … --- ## [Filebeat-logstash issue](https://discuss.elastic.co/t/filebeat-logstash-issue/259272)
**Author:** [@mustafa.husny](https://discuss.elastic.co/u/mustafa.husny)\ **Replies:** 3\ **Last updated:** [December 23, 2020, 3:16am UTC](https://discuss.elastic.co/t/filebeat-logstash-issue/259272 "2020-12-23T03:16:37Z")
I am using ELK 7.6.2 I have three piplines first for the heartbeat second for the tcp to forward logs from QRadar Third is for filebeat I am receiving logs from heartbeat and qradar, but when I installed filebeat on… --- ## [Elastic search query using a list](https://discuss.elastic.co/t/elastic-search-query-using-a-list/259439)
**Author:** [@shantanuo](https://discuss.elastic.co/u/shantanuo)\ **Replies:** 0\ **Last updated:** [December 23, 2020, 3:15am UTC](https://discuss.elastic.co/t/elastic-search-query-using-a-list/259439 "2020-12-23T03:15:56Z")
How do I pass a list as query string to match\_phrase query? This works: \`{"match\_phrase": {"requestParameters.bucketName": {"query": "auditloggingnew2232"}}},\` This does not: { "match\_phrase": { … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1629) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1631)