# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1642 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1643 --- ## [Logstash: regex to get part of file name](https://discuss.elastic.co/t/logstash-regex-to-get-part-of-file-name/258673)
**Author:** [@nameisnotimportant](https://discuss.elastic.co/u/nameisnotimportant)\ **Replies:** 2\ **Last updated:** [December 16, 2020, 12:39am UTC](https://discuss.elastic.co/t/logstash-regex-to-get-part-of-file-name/258673 "2020-12-16T00:39:52Z")
Hi, I am trying to get the date in the file name using following regex, but it still return a-zA-Z character: Path: /home/appadmin/Documents/ML/data/pocket\_pmo/activityLogs20201211.csv grok { match =\> { "path" =\> "(… --- ## [Error getting group status](https://discuss.elastic.co/t/error-getting-group-status/258725)
**Author:** [@SVictor](https://discuss.elastic.co/u/SVictor)\ **Replies:** 1\ **Last updated:** [December 16, 2020, 12:13am UTC](https://discuss.elastic.co/t/error-getting-group-status/258725 "2020-12-16T00:13:52Z")
Hello, can anyone help me with metricbeats. I have a kubernetes cluster 1.16 and I installed metricbeat, it work but i got 1 error: instance/metrics.go:285 error getting group status: open /proc/5806/cgroup: no such fi… --- ## [Issues while upgrading to Docker based Elastic Stack 7.10.1](https://discuss.elastic.co/t/issues-while-upgrading-to-docker-based-elastic-stack-7-10-1/258790)
**Author:** [@nielarshi](https://discuss.elastic.co/u/nielarshi)\ **Replies:** 1\ **Last updated:** [December 16, 2020, 12:05am UTC](https://discuss.elastic.co/t/issues-while-upgrading-to-docker-based-elastic-stack-7-10-1/258790 "2020-12-16T00:05:59Z")
I am trying to upgrade my Elastic Stack to 7.10.1 from 7.1.1 but facing some issues. I already have 7.1.1 version setup with 3 docker nodes cluster which works fine. I followed below to upgrade to 7.10.1 version with s… --- ## [Enable more Metrics](https://discuss.elastic.co/t/enable-more-metrics/258764)
**Author:** [@jsahiwal](https://discuss.elastic.co/u/jsahiwal)\ **Replies:** 3\ **Last updated:** [December 15, 2020, 11:32pm UTC](https://discuss.elastic.co/t/enable-more-metrics/258764 "2020-12-15T23:32:59Z")
Metrics Module What do we need to enable to see the following metrics System Paging FileSystem Paging Process Content Switches Forks Filesystems Inodes ( Total, Used, Free) --- ## [Setting up security in elasticsearch](https://discuss.elastic.co/t/setting-up-security-in-elasticsearch/258751)
**Author:** [@joret](https://discuss.elastic.co/u/joret)\ **Replies:** 1\ **Last updated:** [December 15, 2020, 11:03pm UTC](https://discuss.elastic.co/t/setting-up-security-in-elasticsearch/258751 "2020-12-15T23:03:28Z")
I have Elasticsearch set up in server and Java in another server. the java application communicates with Elasticsearch . I need to implement SSL certificate between JAVA and Elasticsearch communication --- ## [How to add authentication connexion to ELK ( with password )?](https://discuss.elastic.co/t/how-to-add-authentication-connexion-to-elk-with-password/258724)
**Author:** [@winstonsmith](https://discuss.elastic.co/u/winstonsmith)\ **Replies:** 2\ **Last updated:** [December 15, 2020, 10:58pm UTC](https://discuss.elastic.co/t/how-to-add-authentication-connexion-to-elk-with-password/258724 "2020-12-15T22:58:10Z")
Hello i want to do a few things how to dd the ELK login authentication (login and pwd) how to change the Kibana logo with another Thanks --- ## [Frozen indices and shard limitation](https://discuss.elastic.co/t/frozen-indices-and-shard-limitation/258702)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 4\ **Last updated:** [December 15, 2020, 10:29pm UTC](https://discuss.elastic.co/t/frozen-indices-and-shard-limitation/258702 "2020-12-15T22:29:53Z")
Hello all ! I know the number of shards is limited by the amount of heap. For example, on my hot node, I have 30GB of heap so limit is 600 shards on this node (20 shards par GB of heap) But what about the limit for col… --- ## [Monitoring hot threads and tasks](https://discuss.elastic.co/t/monitoring-hot-threads-and-tasks/258782)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 0\ **Last updated:** [December 15, 2020, 9:48pm UTC](https://discuss.elastic.co/t/monitoring-hot-threads-and-tasks/258782 "2020-12-15T21:48:20Z")
Hello, I was wondering what is the best way to monitor tasks and hot threads, and maybe event to create a dashboard with their data --- ## [ElasticSearch didn't start at first try](https://discuss.elastic.co/t/elasticsearch-didnt-start-at-first-try/258747)
**Author:** [@kae](https://discuss.elastic.co/u/kae)\ **Replies:** 2\ **Last updated:** [December 15, 2020, 9:01pm UTC](https://discuss.elastic.co/t/elasticsearch-didnt-start-at-first-try/258747 "2020-12-15T21:01:10Z")
Hello Everyone, during deployment of my VM in my POD, ElasticSearch didn't start. issue on Journalctl is following : Dec 15 17:33:05 systemd\[1\]: Starting Elasticsearch... -- Subject: Unit elasticsearch.service has be… --- ## [Manage multiple indicies with one ILM-Policy](https://discuss.elastic.co/t/manage-multiple-indicies-with-one-ilm-policy/258733)
**Author:** [@cwiechmann](https://discuss.elastic.co/u/cwiechmann)\ **Replies:** 2\ **Last updated:** [December 15, 2020, 8:33pm UTC](https://discuss.elastic.co/t/manage-multiple-indicies-with-one-ilm-policy/258733 "2020-12-15T20:33:03Z")
Hi All, I have the following structure of indices, that are created as needed, based on a template, to store documents received from a different regions: some-data-from-region-us-000001 some-data-from-region-eu-000001 … --- ## ["Ignore\_older" the other way around](https://discuss.elastic.co/t/ignore-older-the-other-way-around/258653)
**Author:** [@jchaves506](https://discuss.elastic.co/u/jchaves506)\ **Replies:** 2\ **Last updated:** [December 15, 2020, 8:21pm UTC](https://discuss.elastic.co/t/ignore-older-the-other-way-around/258653 "2020-12-15T20:21:14Z")
Hello does anyone knows how can I only read files older\_than = XX, something like an include\_older. Right now I'm reading files with name format log\_date.txt, the problem is that I don't want to be reading files that a… --- ## [Elasticsearch 7.10.1 - Indexing term\_vector for search\_as\_you\_type field issue](https://discuss.elastic.co/t/elasticsearch-7-10-1-indexing-term-vector-for-search-as-you-type-field-issue/258456)
**Author:** [@chandra2037](https://discuss.elastic.co/u/chandra2037)\ **Replies:** 4\ **Last updated:** [December 15, 2020, 8:20pm UTC](https://discuss.elastic.co/t/elasticsearch-7-10-1-indexing-term-vector-for-search-as-you-type-field-issue/258456 "2020-12-15T20:20:47Z")
Hi, Elasticsearch Version: 7.10.1 Getting the following error when trying to index a document {"\_index":"test1","\_type":"\_doc","\_id":"1000370980","status":400,"error":{"type":"illegal\_argument\_exception","reason":"can… --- ## [Error in start of elasticsearch on ubuntu \[first installation\]](https://discuss.elastic.co/t/error-in-start-of-elasticsearch-on-ubuntu-first-installation/258528)
**Author:** [@vlsireddy](https://discuss.elastic.co/u/vlsireddy)\ **Replies:** 3\ **Last updated:** [December 15, 2020, 7:55pm UTC](https://discuss.elastic.co/t/error-in-start-of-elasticsearch-on-ubuntu-first-installation/258528 "2020-12-15T19:55:33Z")
HI, \[1\] I Installed elastic search and tried starting it and i see this error. kryogen@Ubuntu:~/Documents/elastic/elasticsearch-7.10.1$ ./bin/elasticsearch Exception in thread "main" SettingsException\[Failed to load s… --- ## [Visualize Dynamic Series in line chart](https://discuss.elastic.co/t/visualize-dynamic-series-in-line-chart/258753)
**Author:** [@benjamin.watson](https://discuss.elastic.co/u/benjamin.watson)\ **Replies:** 2\ **Last updated:** [December 15, 2020, 7:53pm UTC](https://discuss.elastic.co/t/visualize-dynamic-series-in-line-chart/258753 "2020-12-15T19:53:55Z")
I've got some JSON documents flowing into my ES cluster. They look kind of like this: { "stats": { "Series 1": { "count": 134, "registered": 0 }, "Series 2": { … --- ## [Kibana dashboard Maps?](https://discuss.elastic.co/t/kibana-dashboard-maps/258429)
**Author:** [@GetYourSh1tTogether](https://discuss.elastic.co/u/GetYourSh1tTogether)\ **Replies:** 2\ **Last updated:** [December 15, 2020, 7:09pm UTC](https://discuss.elastic.co/t/kibana-dashboard-maps/258429 "2020-12-15T19:09:04Z")
I recently stumbled upon this filter and it seems like a great tool to use. Is anyone using this to display all AWS regions and display heat zones on how many resources are where? In my index its already pulling in the A… --- ## [Correctly map converted timestamps in watcher payload](https://discuss.elastic.co/t/correctly-map-converted-timestamps-in-watcher-payload/258748)
**Author:** [@esguy](https://discuss.elastic.co/u/esguy)\ **Replies:** 0\ **Last updated:** [December 15, 2020, 6:46pm UTC](https://discuss.elastic.co/t/correctly-map-converted-timestamps-in-watcher-payload/258748 "2020-12-15T18:46:31Z")
I am running into an issue where I can correctly convert document timestamps within a watcher payload and store into a list but I am unsure how to correctly map this to the returned payload. Hopefully some code will hel… --- ## [Date parse error](https://discuss.elastic.co/t/date-parse-error/258106)
**Author:** [@Muhammad\_Faisal](https://discuss.elastic.co/u/Muhammad_Faisal)\ **Replies:** 4\ **Last updated:** [December 15, 2020, 6:37pm UTC](https://discuss.elastic.co/t/date-parse-error/258106 "2020-12-15T18:37:13Z")
hi guys, can you assist why below does not parse input data coming as Wed Dec 02 11:11:03 Asia/Riyadh 2020 date { match =\> \[ "Timestamp", "EEE MMM dd HH:mm:ss ZZZ yyyy"\] target =\> "@timestamp" } --- ## [How to collect information using remote script and visualise them in. dedicated Kibana visualization?](https://discuss.elastic.co/t/how-to-collect-information-using-remote-script-and-visualise-them-in-dedicated-kibana-visualization/258564)
**Author:** [@Mauro\_Tridici](https://discuss.elastic.co/u/Mauro_Tridici)\ **Replies:** 6\ **Last updated:** [December 15, 2020, 6:15pm UTC](https://discuss.elastic.co/t/how-to-collect-information-using-remote-script-and-visualise-them-in-dedicated-kibana-visualization/258564 "2020-12-15T18:15:40Z")
Dear Users, I started using ELK stack from a few days, so I'm not an expert. After a very basic ELK stack deploy, everything seems to be running as expected. Now, I would like to: execute a script on a remote server,… --- ## [Suricata module - no parsing for XFF field (x forward ip)](https://discuss.elastic.co/t/suricata-module-no-parsing-for-xff-field-x-forward-ip/258641)
**Author:** [@sportelh](https://discuss.elastic.co/u/sportelh)\ **Replies:** 4\ **Last updated:** [December 15, 2020, 6:02pm UTC](https://discuss.elastic.co/t/suricata-module-no-parsing-for-xff-field-x-forward-ip/258641 "2020-12-15T18:02:07Z")
Hi Guys, I am playing arround with ELK for suricata logs, to see if it is suitable for my employer I have created some nice dashboards (kibana) so far so good. But to my surprise there is no suricata.eve field for th… --- ## [Can't connect to cluster when master node is off](https://discuss.elastic.co/t/cant-connect-to-cluster-when-master-node-is-off/258634)
**Author:** [@hamidreza\_ghadir](https://discuss.elastic.co/u/hamidreza_ghadir)\ **Replies:** 6\ **Last updated:** [December 15, 2020, 5:30pm UTC](https://discuss.elastic.co/t/cant-connect-to-cluster-when-master-node-is-off/258634 "2020-12-15T17:30:27Z")
Hi, I have a cluster with three node. When master node is turned off , I can't connect to any of nodes with their addresses. MasterNode: 0.0.0.0:9200, Node2: 0.0.0.0:9201, Node3: 0.0.0.0:9202 with this configuration: … --- ## [Stack monitoring Error fetching alert status](https://discuss.elastic.co/t/stack-monitoring-error-fetching-alert-status/257240)
**Author:** [@dedi27](https://discuss.elastic.co/u/dedi27)\ **Replies:** 10\ **Last updated:** [December 15, 2020, 5:30pm UTC](https://discuss.elastic.co/t/stack-monitoring-error-fetching-alert-status/257240 "2020-12-15T17:30:15Z")
Hello, I have an Elasticsearch cluster that is in version 7.10, and a few days ago started to display the message "Error fetching alert status" on the Stack monitoring screen. At the time I was still on version 7.9.3 of… --- ## [CPU usage per Index](https://discuss.elastic.co/t/cpu-usage-per-index/258743)
**Author:** [@valleram](https://discuss.elastic.co/u/valleram)\ **Replies:** 2\ **Last updated:** [December 15, 2020, 5:28pm UTC](https://discuss.elastic.co/t/cpu-usage-per-index/258743 "2020-12-15T17:28:07Z")
Hello All, I want to know if there is an existing way in Elasticsearch to monitor CPU usage per index. Any help would be much appreciate it? Thank you --- ## [Want to try my logstash Pipeline Testing UI?](https://discuss.elastic.co/t/want-to-try-my-logstash-pipeline-testing-ui/258640)
**Author:** [@epacke](https://discuss.elastic.co/u/epacke)\ **Replies:** 2\ **Last updated:** [December 15, 2020, 5:23pm UTC](https://discuss.elastic.co/t/want-to-try-my-logstash-pipeline-testing-ui/258640 "2020-12-15T17:23:17Z")
Hi there! Rewritten the pipeline testing tool using React and typescript to improve the UX and usability and would appreciate some feedback. It's a tool using NodeJs, Logstash and docker-compose for my colleagues that … --- ## [Importing dashboard and index pattern id](https://discuss.elastic.co/t/importing-dashboard-and-index-pattern-id/255688)
**Author:** [@Maria20](https://discuss.elastic.co/u/Maria20)\ **Replies:** 16\ **Last updated:** [December 15, 2020, 4:47pm UTC](https://discuss.elastic.co/t/importing-dashboard-and-index-pattern-id/255688 "2020-12-15T16:47:35Z")
Hi, I have an issue related to importing Kibana dashboard. My dashboard contains visualizations from different indices. When I import & export the dashboard using UI everything works fine. But when I export and then i… --- ## [Issue with loading AWS dashboard in Kibana](https://discuss.elastic.co/t/issue-with-loading-aws-dashboard-in-kibana/258629)
**Author:** [@byoungman](https://discuss.elastic.co/u/byoungman)\ **Replies:** 5\ **Last updated:** [December 15, 2020, 4:12pm UTC](https://discuss.elastic.co/t/issue-with-loading-aws-dashboard-in-kibana/258629 "2020-12-15T16:12:36Z")
I am having an issue with displaying the AWS Dashboard in Kibana. I have followed the steps detailed in the instructions for enabling & configuring the AWS module in Metricbeat. When running the setup.exe command there … --- ## [Logstash aggregate function](https://discuss.elastic.co/t/logstash-aggregate-function/258738)
**Author:** [@errupeshmca](https://discuss.elastic.co/u/errupeshmca)\ **Replies:** 0\ **Last updated:** [December 15, 2020, 4:09pm UTC](https://discuss.elastic.co/t/logstash-aggregate-function/258738 "2020-12-15T16:09:54Z")
I am looking for aggregate function to get sum of field(TotalOrderReceivedToday) in a new field (sum). but i think it's aggregating everything based on TotalOrderReceivedToday field, I need sum of one field only to { … --- ## [Not getting kubernetes metadata in my logs](https://discuss.elastic.co/t/not-getting-kubernetes-metadata-in-my-logs/258621)
**Author:** [@jknott](https://discuss.elastic.co/u/jknott)\ **Replies:** 2\ **Last updated:** [December 15, 2020, 3:52pm UTC](https://discuss.elastic.co/t/not-getting-kubernetes-metadata-in-my-logs/258621 "2020-12-15T15:52:34Z")
Here is how I have filebeat helm chart configured. What am I missing? processors: - add\_cloud\_metadata: - add\_kubernetes\_metadata: host: ${NODE\_NAME} matchers: - l… --- ## [Map string value of an ID to a custom String using JSON input](https://discuss.elastic.co/t/map-string-value-of-an-id-to-a-custom-string-using-json-input/258491)
**Author:** [@officer\_snickers](https://discuss.elastic.co/u/officer_snickers)\ **Replies:** 1\ **Last updated:** [December 15, 2020, 3:18pm UTC](https://discuss.elastic.co/t/map-string-value-of-an-id-to-a-custom-string-using-json-input/258491 "2020-12-15T15:18:57Z")
I'm totally new to kibana. I have the current problem, I created a visualisation chart which is splitting rows based on the UUID. In this Index, I unfortunately don't have the related organisation name to the UUID. My … --- ## [Detect PII Personal Identifiable Information in Kibana](https://discuss.elastic.co/t/detect-pii-personal-identifiable-information-in-kibana/258710)
**Author:** [@gregbk](https://discuss.elastic.co/u/gregbk)\ **Replies:** 1\ **Last updated:** [December 15, 2020, 3:14pm UTC](https://discuss.elastic.co/t/detect-pii-personal-identifiable-information-in-kibana/258710 "2020-12-15T15:14:28Z")
Hello Elastic community! I was researching if there was any tool to detect from Kibana (or ES, logstash) any PPI Personal Identifiable Information (name, phone number, account number, address) in Elasticsearch. So our t… --- ## [Cannot use scripted field in a date range bucket aggregation](https://discuss.elastic.co/t/cannot-use-scripted-field-in-a-date-range-bucket-aggregation/258711)
**Author:** [@kspe](https://discuss.elastic.co/u/kspe)\ **Replies:** 2\ **Last updated:** [December 15, 2020, 3:13pm UTC](https://discuss.elastic.co/t/cannot-use-scripted-field-in-a-date-range-bucket-aggregation/258711 "2020-12-15T15:13:28Z")
Hey, I have a time field in my document which is a timestamp number. It is not set as a date type field so cannot use it in the date range bucket aggregation directly (Kibana complains that the index does not contain an… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1641) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1643)