# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1636 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1637 --- ## [Amazon\_s3\_exception: Access Denied Service: Amazon S3; Status Code: 403;](https://discuss.elastic.co/t/amazon-s3-exception-access-denied-service-amazon-s3-status-code-403/257267)
**Author:** [@kyle\_che](https://discuss.elastic.co/u/kyle_che)\ **Replies:** 5\ **Last updated:** [December 18, 2020, 8:11pm UTC](https://discuss.elastic.co/t/amazon-s3-exception-access-denied-service-amazon-s3-status-code-403/257267 "2020-12-18T20:11:30Z")
I have a 3 node ec2 dev cluster. I'm trying to setup a snapshot repository for elasticsearch to s3 but I'm getting the following error. AWS command line works for me but setting up through elasticsearch is not. any ide… --- ## [Scripted field add a value of 1 for every match](https://discuss.elastic.co/t/scripted-field-add-a-value-of-1-for-every-match/257746)
**Author:** [@gentle\_ghost](https://discuss.elastic.co/u/gentle_ghost)\ **Replies:** 15\ **Last updated:** [December 18, 2020, 8:06pm UTC](https://discuss.elastic.co/t/scripted-field-add-a-value-of-1-for-every-match/257746 "2020-12-18T20:06:33Z")
Hello, New to the Elastic Stack and trying to get familiar with it. I'm not sure if this should be done on the ingest pipeline or visualization (I haven't had luck on either) but attempting to solve this with a scripte… --- ## [Startup Type missing data](https://discuss.elastic.co/t/startup-type-missing-data/258049)
**Author:** [@mjsteckiel](https://discuss.elastic.co/u/mjsteckiel)\ **Replies:** 6\ **Last updated:** [December 18, 2020, 8:02pm UTC](https://discuss.elastic.co/t/startup-type-missing-data/258049 "2020-12-18T20:02:17Z")
Hey all, We have been looking into the Windows Service metricset, and have found that none of the services are coming through with Startup Type data. We are following the metricset configuration - and there doesn't even… --- ## [Search arrays with arrays](https://discuss.elastic.co/t/search-arrays-with-arrays/259132)
**Author:** [@Luca\_Frost](https://discuss.elastic.co/u/Luca_Frost)\ **Replies:** 4\ **Last updated:** [December 18, 2020, 7:07pm UTC](https://discuss.elastic.co/t/search-arrays-with-arrays/259132 "2020-12-18T19:07:32Z")
Hi all, I have an ES index where one of my mappings stores a simple array of named entities pre-set at the point of ingestion. I'm trying to search my index using a given array of entities, to return documents where co… --- ## [Can kibana date/ time picker pick date time based on](https://discuss.elastic.co/t/can-kibana-date-time-picker-pick-date-time-based-on/259131)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 4\ **Last updated:** [December 18, 2020, 6:42pm UTC](https://discuss.elastic.co/t/can-kibana-date-time-picker-pick-date-time-based-on/259131 "2020-12-18T18:42:34Z")
Can Kibana date/ time picker be configured to pick date/time based on a different timestamp say the timeCreated field as seen below? The purpose is to avoid creating a filter. --- ## [topN graph not aggregating on field](https://discuss.elastic.co/t/topn-graph-not-aggregating-on-field/259044)
**Author:** [@Andythsu](https://discuss.elastic.co/u/Andythsu)\ **Replies:** 4\ **Last updated:** [December 18, 2020, 6:38pm UTC](https://discuss.elastic.co/t/topn-graph-not-aggregating-on-field/259044 "2020-12-18T18:38:38Z")
Hello, I'm on Kibana 6.8.0 and was trying with top N graph. The top N doesn't seem to be aggregating on the field. For example, shows that the red bar sums up to 0, but the time series graph clearly shows that there is… --- ## [Geoip lookup failure while parsing http json data](https://discuss.elastic.co/t/geoip-lookup-failure-while-parsing-http-json-data/259120)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 2\ **Last updated:** [December 18, 2020, 5:49pm UTC](https://discuss.elastic.co/t/geoip-lookup-failure-while-parsing-http-json-data/259120 "2020-12-18T17:49:56Z")
I am trying to perform Geoip filter while parsing json logs data from clouflare API but it says \_geoip\_lookup\_failure here is my conf file configurations input { http\_poller { urls =\> { test… --- ## [Index duplicate documents with the different routing id](https://discuss.elastic.co/t/index-duplicate-documents-with-the-different-routing-id/259124)
**Author:** [@Maksym1](https://discuss.elastic.co/u/Maksym1)\ **Replies:** 6\ **Last updated:** [December 18, 2020, 5:46pm UTC](https://discuss.elastic.co/t/index-duplicate-documents-with-the-different-routing-id/259124 "2020-12-18T17:46:22Z")
When I try to index two similar documents (in my case, these are customers) with the same id and a different routing id, I get the first document is created, but the second document is updated. As I know, I can index tw… --- ## [Dereference arrays in painless script field](https://discuss.elastic.co/t/dereference-arrays-in-painless-script-field/258382)
**Author:** [@wsalembi](https://discuss.elastic.co/u/wsalembi)\ **Replies:** 1\ **Last updated:** [December 18, 2020, 5:33pm UTC](https://discuss.elastic.co/t/dereference-arrays-in-painless-script-field/258382 "2020-12-18T17:33:30Z")
Given following document { "addresses": \[ {"city": "New York"}, {"city": "Brussels" } \] } Is it possible to dereference the first element in the array using a pain… --- ## [Metricbeat don't get all mounting points for filesystems](https://discuss.elastic.co/t/metricbeat-dont-get-all-mounting-points-for-filesystems/259098)
**Author:** [@Vinicius\_Maia](https://discuss.elastic.co/u/Vinicius_Maia)\ **Replies:** 2\ **Last updated:** [December 18, 2020, 5:31pm UTC](https://discuss.elastic.co/t/metricbeat-dont-get-all-mounting-points-for-filesystems/259098 "2020-12-18T17:31:58Z")
Hello all, I need some help with a problem about my metricbeat setup. I'm trying to monitor my elasticsearch server disks with metricbeat. In the elasticsearch servers I created a LVM and mounted it in /var/lib/elasti… --- ## [Unable to include runtime log data in 'mutate' filter plugin](https://discuss.elastic.co/t/unable-to-include-runtime-log-data-in-mutate-filter-plugin/259125)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 6\ **Last updated:** [December 18, 2020, 5:18pm UTC](https://discuss.elastic.co/t/unable-to-include-runtime-log-data-in-mutate-filter-plugin/259125 "2020-12-18T17:18:34Z")
I am trying to fetch cloudflare log data via API and want add a new field such as actor.email in index. My end goal is to add a new field in index having data in meaningful sentence like A user someone@email.com(actor.… --- ## [Own function in search template](https://discuss.elastic.co/t/own-function-in-search-template/259126)
**Author:** [@sundarcse1216](https://discuss.elastic.co/u/sundarcse1216)\ **Replies:** 0\ **Last updated:** [December 18, 2020, 4:56pm UTC](https://discuss.elastic.co/t/own-function-in-search-template/259126 "2020-12-18T16:56:59Z")
I need to write my own function inside the search template like toJson ............. "functions": \[ { "filter": { "terms": { "empId": {{#my\_own\_function}}PARAM\_VALUE{{/my\_own\_function}} } … --- ## [Elasticsearch Closing Index after removing read-only index block followed by Restart](https://discuss.elastic.co/t/elasticsearch-closing-index-after-removing-read-only-index-block-followed-by-restart/259065)
**Author:** [@dbakti7](https://discuss.elastic.co/u/dbakti7)\ **Replies:** 4\ **Last updated:** [December 18, 2020, 4:40pm UTC](https://discuss.elastic.co/t/elasticsearch-closing-index-after-removing-read-only-index-block-followed-by-restart/259065 "2020-12-18T16:40:02Z")
Hi, We are on Elasticsearch 6.0 and we need help on the following scenario: Index A is in "Open" state Elasticsearch crossed flood\_stage watermark, Index A got read-only index block Resolve flood\_stage watermark, Remo… --- ## [Viewing the docker image Dockerfiles?](https://discuss.elastic.co/t/viewing-the-docker-image-dockerfiles/259123)
**Author:** [@BigAl](https://discuss.elastic.co/u/BigAl)\ **Replies:** 0\ **Last updated:** [December 18, 2020, 4:31pm UTC](https://discuss.elastic.co/t/viewing-the-docker-image-dockerfiles/259123 "2020-12-18T16:31:27Z")
Hi, Is there a way to view the Dockerfiles that generate the docker images that we pull from elastic.co downloads. for example: https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-oss- Thanks! --- ## [TSVB showing old field values in KQL query](https://discuss.elastic.co/t/tsvb-showing-old-field-values-in-kql-query/258548)
**Author:** [@Muhammad\_Faisal](https://discuss.elastic.co/u/Muhammad_Faisal)\ **Replies:** 1\ **Last updated:** [December 18, 2020, 3:56pm UTC](https://discuss.elastic.co/t/tsvb-showing-old-field-values-in-kql-query/258548 "2020-12-18T15:56:49Z")
hi all, in TSVB visualization , under "DATA", "Query string" , group by filter ....when i put a filter using KQL , it shows/pop-up field values which are not a part of current index pattern.....but field values of some… --- ## [Pie chart into Kibana dashboard](https://discuss.elastic.co/t/pie-chart-into-kibana-dashboard/259114)
**Author:** [@alex92360](https://discuss.elastic.co/u/alex92360)\ **Replies:** 3\ **Last updated:** [December 18, 2020, 3:42pm UTC](https://discuss.elastic.co/t/pie-chart-into-kibana-dashboard/259114 "2020-12-18T15:42:57Z")
Hello all, i'm trying to do a pie chart in Kibana dashboard based on some data i have. I don't understand if i am missing something or is Kibana that just works differently. Let's say i have the following data (n docs) … --- ## [Kibana Service won't start after 7.8 -\> 7.10 Upgrade](https://discuss.elastic.co/t/kibana-service-wont-start-after-7-8-7-10-upgrade/258866)
**Author:** [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)\ **Replies:** 9\ **Last updated:** [December 18, 2020, 3:40pm UTC](https://discuss.elastic.co/t/kibana-service-wont-start-after-7-8-7-10-upgrade/258866 "2020-12-18T15:40:18Z")
My Cluster: 3x CentOS 7 Elasticsearch 7.10 Logstash 7.10 Kibana 7.10 Filebeat 7.10 So i just upgraded my Cluster to version 7.10 Everything works fine (even Elasticsearch after messing with jvm.options a bit), but… --- ## [Metricbeat AWS Module Issues](https://discuss.elastic.co/t/metricbeat-aws-module-issues/257976)
**Author:** [@Ganesh999](https://discuss.elastic.co/u/Ganesh999)\ **Replies:** 7\ **Last updated:** [December 18, 2020, 3:08pm UTC](https://discuss.elastic.co/t/metricbeat-aws-module-issues/257976 "2020-12-18T15:08:44Z")
Hi All, Have been trying to use the aws module in metrcibeat and have included all the related credentials required for authentication but it fails and gives the following error But the same credentials when used in… --- ## [Fleet AWS Integration Error - CloudTrail logs not searchable](https://discuss.elastic.co/t/fleet-aws-integration-error-cloudtrail-logs-not-searchable/258987)
**Author:** [@matt\_t1](https://discuss.elastic.co/u/matt_t1)\ **Replies:** 2\ **Last updated:** [December 18, 2020, 2:41pm UTC](https://discuss.elastic.co/t/fleet-aws-integration-error-cloudtrail-logs-not-searchable/258987 "2020-12-18T14:41:39Z")
AWS integration version 0.3.12 uses an ingestion node pipeline to set the event.ingested field to the ingestion timestamp. There is no mapping for this field in the index template so it defaults to keyword type, which b… --- ## [Painless - check if a log contains a certain field](https://discuss.elastic.co/t/painless-check-if-a-log-contains-a-certain-field/258718)
**Author:** [@yaelg](https://discuss.elastic.co/u/yaelg)\ **Replies:** 1\ **Last updated:** [December 18, 2020, 2:39pm UTC](https://discuss.elastic.co/t/painless-check-if-a-log-contains-a-certain-field/258718 "2020-12-18T14:39:55Z")
Hey everyone, I have the following fields in my logs: "module": String "audit": {"action": String, "user": String} "audit" does not appear in all logs. I wanted to create a visualization of tag-cloud which would show… --- ## [Logstash 7.10 is ignoring custom index template](https://discuss.elastic.co/t/logstash-7-10-is-ignoring-custom-index-template/258615)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 26\ **Last updated:** [December 18, 2020, 2:35pm UTC](https://discuss.elastic.co/t/logstash-7-10-is-ignoring-custom-index-template/258615 "2020-12-18T14:35:56Z")
Hi, This is a fresh installation of ELK 7.10.0. I am trying to configure Logstash to process .csv files and index into ES. I created a config file and a custom index template. It looks like the .csv are being processed,… --- ## [Elasticsearch input plugin: range query doesn't match any document](https://discuss.elastic.co/t/elasticsearch-input-plugin-range-query-doesnt-match-any-document/259097)
**Author:** [@Mathias\_Bazin](https://discuss.elastic.co/u/Mathias_Bazin)\ **Replies:** 0\ **Last updated:** [December 18, 2020, 12:04pm UTC](https://discuss.elastic.co/t/elasticsearch-input-plugin-range-query-doesnt-match-any-document/259097 "2020-12-18T12:04:26Z")
Hello, I'm having trouble collecting data periodically from an elasticsearch index. My input config is quite simple input { elasticsearch { hosts =\> "${ELASTICSEARCH\_URL\_INPUT}" index =\> 'logcentral\_pn' d… --- ## [Kibana 7.10.1 Login Logo](https://discuss.elastic.co/t/kibana-7-10-1-login-logo/259076)
**Author:** [@haythem](https://discuss.elastic.co/u/haythem)\ **Replies:** 3\ **Last updated:** [December 18, 2020, 2:06pm UTC](https://discuss.elastic.co/t/kibana-7-10-1-login-logo/259076 "2020-12-18T14:06:58Z")
Hi guys , i downloaded the latest version of ELK and i followed the steps that @ManuelF described in this thread https://discuss.elastic.co/t/custom-logo-kibana-7-10-0-guide/257686 , i changed the loading logo but i co… --- ## [Avoid user to edit kibana visualization fields](https://discuss.elastic.co/t/avoid-user-to-edit-kibana-visualization-fields/259102)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 2\ **Last updated:** [December 18, 2020, 1:40pm UTC](https://discuss.elastic.co/t/avoid-user-to-edit-kibana-visualization-fields/259102 "2020-12-18T13:40:41Z")
Hi All, I have created a separate user for my end customer, and have restricted his usage to view only Kibana visualization. I have used a filter(Consumer = Mobile). so that he will not be able to view data of any other… --- ## [Using multi\_match from the start of fields](https://discuss.elastic.co/t/using-multi-match-from-the-start-of-fields/259110)
**Author:** [@rmbutler83](https://discuss.elastic.co/u/rmbutler83)\ **Replies:** 0\ **Last updated:** [December 18, 2020, 1:36pm UTC](https://discuss.elastic.co/t/using-multi-match-from-the-start-of-fields/259110 "2020-12-18T13:36:04Z")
Hi, I'm trying to search for drug names in my datastore, { "index": "drugs", "body": { "size": 20, "query": { "bool": { "must": \[ { "term": { "RouteOfAdmini… --- ## [Can't filebeat use multiple input/output config files in one instance?](https://discuss.elastic.co/t/cant-filebeat-use-multiple-input-output-config-files-in-one-instance/259095)
**Author:** [@iooi](https://discuss.elastic.co/u/iooi)\ **Replies:** 2\ **Last updated:** [December 18, 2020, 1:33pm UTC](https://discuss.elastic.co/t/cant-filebeat-use-multiple-input-output-config-files-in-one-instance/259095 "2020-12-18T13:33:30Z")
Want to deploy filebeat with 3 log definations together. Send to different output targets. --- apiVersion: apps/v1 kind: DaemonSet metadata: name: filebeat labels: k8s-app: filebeat spec: selector: matchLa… --- ## [Alerting and actions](https://discuss.elastic.co/t/alerting-and-actions/259109)
**Author:** [@Rafal\_Radziejewski](https://discuss.elastic.co/u/Rafal_Radziejewski)\ **Replies:** 0\ **Last updated:** [December 18, 2020, 1:33pm UTC](https://discuss.elastic.co/t/alerting-and-actions/259109 "2020-12-18T13:33:21Z")
Hello i am using version 7.9.3 of a stack i am wondering why after enabling security and setting 40 characters long key i am still unable to see alering and security tab ? Any ideas ? Regards, RR --- ## [How to use if else in logstash output](https://discuss.elastic.co/t/how-to-use-if-else-in-logstash-output/256793)
**Author:** [@lokeshbabloo](https://discuss.elastic.co/u/lokeshbabloo)\ **Replies:** 6\ **Last updated:** [December 18, 2020, 1:16pm UTC](https://discuss.elastic.co/t/how-to-use-if-else-in-logstash-output/256793 "2020-12-18T13:16:00Z")
Hi i need a help in constructing the logstash output i am having two log files like this, one is \<#\> 20200806 17:04:23.261 280018000 EV.INF \[ MVINB-LSL2.T1G1\_WEBSVR1 main.main TSP1.T1G1\_WEBSVR1 … --- ## [Relational data](https://discuss.elastic.co/t/relational-data/259082)
**Author:** [@Jean-Marc\_Autexier](https://discuss.elastic.co/u/Jean-Marc_Autexier)\ **Replies:** 3\ **Last updated:** [December 18, 2020, 12:34pm UTC](https://discuss.elastic.co/t/relational-data/259082 "2020-12-18T12:34:44Z")
Hi, I think we all know the limits of elastic when having relational data.... There are things you can solve (using de-normalization, nested, parent-child, lookups) but sometimes your uses cases require query time join… --- ## [Add +1 day to Datefield Kibana scripted fields](https://discuss.elastic.co/t/add-1-day-to-datefield-kibana-scripted-fields/258595)
**Author:** [@Datakids](https://discuss.elastic.co/u/Datakids)\ **Replies:** 9\ **Last updated:** [December 18, 2020, 11:40am UTC](https://discuss.elastic.co/t/add-1-day-to-datefield-kibana-scripted-fields/258595 "2020-12-18T11:40:16Z")
Hi there, I wonder how to add a Day to existing Date field. For example: Left Date is Original and I need on right hand the origin date + 1 Day Type: Date Format: Date I tried: doc\['Datum'\].value + ("1d") doc\['… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1635) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1637)