# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1657 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1658 --- ## [Error in Dashboard/ \[filebeat System\]](https://discuss.elastic.co/t/error-in-dashboard-filebeat-system/257731)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 10\ **Last updated:** [December 7, 2020, 6:14pm UTC](https://discuss.elastic.co/t/error-in-dashboard-filebeat-system/257731 "2020-12-07T18:14:35Z")
Hi Team, I am getting error (as attached) when clicked in Dashboard and selected file-beat, here I am getting error for tabs Sudo commands | SSH logins | New users and groups. How can I see all this information. … --- ## [Threshold value for color conditioning to be taken from a variable/field rather than giving direct number](https://discuss.elastic.co/t/threshold-value-for-color-conditioning-to-be-taken-from-a-variable-field-rather-than-giving-direct-number/255585)
**Author:** [@Pranusha119](https://discuss.elastic.co/u/Pranusha119)\ **Replies:** 0\ **Last updated:** [November 16, 2020, 6:50pm UTC](https://discuss.elastic.co/t/threshold-value-for-color-conditioning-to-be-taken-from-a-variable-field-rather-than-giving-direct-number/255585 "2020-11-16T18:50:28Z")
"color": { "condition": { "test": {"field": "PercentOfTotal", "gt": 70}, "value": "#B22222" }, "value": "#006400" } By this way I am able to do color conditioning "… --- ## [ILM not deleting indices in data\_stream](https://discuss.elastic.co/t/ilm-not-deleting-indices-in-data-stream/257811)
**Author:** [@Zerobot](https://discuss.elastic.co/u/Zerobot)\ **Replies:** 1\ **Last updated:** [December 7, 2020, 5:50pm UTC](https://discuss.elastic.co/t/ilm-not-deleting-indices-in-data-stream/257811 "2020-12-07T17:50:44Z")
Hello! So I've been checking out new features of ELK stack - created a template for data stream and connected a basic ILM policy to it. ILM policy is basically: { "policy": { "phases": { "hot": { … --- ## [The Elasticsearch server could not be reached. Further data is therefore unavailable](https://discuss.elastic.co/t/the-elasticsearch-server-could-not-be-reached-further-data-is-therefore-unavailable/257701)
**Author:** [@webapps](https://discuss.elastic.co/u/webapps)\ **Replies:** 2\ **Last updated:** [December 7, 2020, 3:28pm UTC](https://discuss.elastic.co/t/the-elasticsearch-server-could-not-be-reached-further-data-is-therefore-unavailable/257701 "2020-12-07T15:28:11Z")
Hey, I'm trying to setup the Elasticsearch server in the search-api drupal 8. But I'm getting the above message when I save the server. In parallel with that I accessed the Elasticsearch server URI in the postman, but … --- ## [Auto-login in iFrame using nginx proxy](https://discuss.elastic.co/t/auto-login-in-iframe-using-nginx-proxy/257322)
**Author:** [@Docrom](https://discuss.elastic.co/u/Docrom)\ **Replies:** 3\ **Last updated:** [December 7, 2020, 5:02pm UTC](https://discuss.elastic.co/t/auto-login-in-iframe-using-nginx-proxy/257322 "2020-12-07T17:02:49Z")
Hello everyone, I'm trying to follow the post here in order login to my Kibana iFrame via nginx as proxy but I fail. I'm not really good with proxies and nginx in particular so maybe I'm missing something important tha… --- ## ["destination.geo.country\_iso\_code" field with logstash geoip?](https://discuss.elastic.co/t/destination-geo-country-iso-code-field-with-logstash-geoip/257482)
**Author:** [@Camille](https://discuss.elastic.co/u/Camille)\ **Replies:** 4\ **Last updated:** [December 7, 2020, 3:59pm UTC](https://discuss.elastic.co/t/destination-geo-country-iso-code-field-with-logstash-geoip/257482 "2020-12-07T15:59:07Z")
Hi, is it possible to have to " destination.geo.country\_iso\_code" field with the geoip plugin in logstash ? I use it but similar output fields are "destination.geo.country\_code2" and "destination.geo.country\_code3" and… --- ## [Kibana action webhook failing](https://discuss.elastic.co/t/kibana-action-webhook-failing/257855)
**Author:** [@Alexhutchinson](https://discuss.elastic.co/u/Alexhutchinson)\ **Replies:** 1\ **Last updated:** [December 7, 2020, 3:58pm UTC](https://discuss.elastic.co/t/kibana-action-webhook-failing/257855 "2020-12-07T15:58:53Z")
Hi! I have an 7.10 stack running in ECK, and have a webhook Alert and Action set up (Linked to a custom Security Detection Rule). The webhook endpoint is HTTPS with a self-signed certificate. When hitting test on the c… --- ## [Current Time Marker in vega-lite chart](https://discuss.elastic.co/t/current-time-marker-in-vega-lite-chart/256073)
**Author:** [@shin1](https://discuss.elastic.co/u/shin1)\ **Replies:** 1\ **Last updated:** [December 7, 2020, 3:37pm UTC](https://discuss.elastic.co/t/current-time-marker-in-vega-lite-chart/256073 "2020-12-07T15:37:53Z")
Hi experts, Is there any way to draw a current time marker in vega-lite? I'd like to do it on a scatter plot written in vega-lite. Many thanks in advane, Cheers Shin --- ## [Setup watcher with multiple must\_not values do not apply as expected](https://discuss.elastic.co/t/setup-watcher-with-multiple-must-not-values-do-not-apply-as-expected/256957)
**Author:** [@Aviram\_Niron](https://discuss.elastic.co/u/Aviram_Niron)\ **Replies:** 3\ **Last updated:** [December 7, 2020, 2:51pm UTC](https://discuss.elastic.co/t/setup-watcher-with-multiple-must-not-values-do-not-apply-as-expected/256957 "2020-12-07T14:51:48Z")
I've set the following watcher which aims to ignore events coming from several tenants (as indicated in the "must\_not" clause). However, these are not ignored. What am I missing? { "trigger": { "schedule": { … --- ## [7.10 ECONNREFUSED on Kibana](https://discuss.elastic.co/t/7-10-econnrefused-on-kibana/257838)
**Author:** [@CLeO\_Zap](https://discuss.elastic.co/u/CLeO_Zap)\ **Replies:** 7\ **Last updated:** [December 7, 2020, 2:38pm UTC](https://discuss.elastic.co/t/7-10-econnrefused-on-kibana/257838 "2020-12-07T14:38:57Z")
Hi All, I have a bit of a problem, I currently have a VM (Centos) running Elasticsearch 7.10, and a different VM (Centos ) running Kibana 7.10 and Nginx. The error I'm getting is: Dec 07 11:17:07 slazKIB02 kibana\[905… --- ## [Mapping the query to the highlight using FVH](https://discuss.elastic.co/t/mapping-the-query-to-the-highlight-using-fvh/257836)
**Author:** [@jackhodkinson](https://discuss.elastic.co/u/jackhodkinson)\ **Replies:** 2\ **Last updated:** [December 7, 2020, 2:35pm UTC](https://discuss.elastic.co/t/mapping-the-query-to-the-highlight-using-fvh/257836 "2020-12-07T14:35:03Z")
The highlighters are great because they help you figure out why your query matched a document. Unfortunately when they are used in conjuncture with any kind of analyzer that stems the words in the query, it is difficult … --- ## [Help: Create multi metric machine learning job](https://discuss.elastic.co/t/help-create-multi-metric-machine-learning-job/257670)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 4\ **Last updated:** [December 7, 2020, 2:29pm UTC](https://discuss.elastic.co/t/help-create-multi-metric-machine-learning-job/257670 "2020-12-07T14:29:46Z")
Hello everybody, I need help to create a multi metric job. The idea is that I want to detect users that connect from different countries, for example if a user used to connect from Germany, if one day he connects from … --- ## [Override fields with update\_per\_query](https://discuss.elastic.co/t/override-fields-with-update-per-query/257857)
**Author:** [@lina1](https://discuss.elastic.co/u/lina1)\ **Replies:** 1\ **Last updated:** [December 7, 2020, 2:17pm UTC](https://discuss.elastic.co/t/override-fields-with-update-per-query/257857 "2020-12-07T14:17:43Z")
Hi, I am new to elastic search and I am trying to filter and replace some http Status Codes. I've got error logs like these: 'Error domain: NSURLErrorDomain Code=-1005' 'HTTP 404 not found' 'Error domain: mycompany.… --- ## [Elastic plugin with pyton/spaCy](https://discuss.elastic.co/t/elastic-plugin-with-pyton-spacy/257852)
**Author:** [@Alder](https://discuss.elastic.co/u/Alder)\ **Replies:** 2\ **Last updated:** [December 7, 2020, 1:53pm UTC](https://discuss.elastic.co/t/elastic-plugin-with-pyton-spacy/257852 "2020-12-07T13:53:46Z")
Hello everyone at Elastic. With the help of this forum I developed an ingest pipline plugin with opennlp to process NER (named entity recognition). Now I'm doing tests with python/spaCy. Is it possible to write a pyth… --- ## [Disable replica shard on cold data node?](https://discuss.elastic.co/t/disable-replica-shard-on-cold-data-node/257844)
**Author:** [@diecode](https://discuss.elastic.co/u/diecode)\ **Replies:** 1\ **Last updated:** [December 7, 2020, 1:42pm UTC](https://discuss.elastic.co/t/disable-replica-shard-on-cold-data-node/257844 "2020-12-07T13:42:38Z")
Hey, I have 3 elasticsearch nodes (2 hot and 1 cold\_data at the moment). I receive logs from logstash and store them in hot nodes. I would like move "old" logs with ILM to cold\_data nodes, but when I start cold\_data nod… --- ## [How to set up looging level in Elasticsearch](https://discuss.elastic.co/t/how-to-set-up-looging-level-in-elasticsearch/257843)
**Author:** [@grynhtjnyuk](https://discuss.elastic.co/u/grynhtjnyuk)\ **Replies:** 3\ **Last updated:** [December 7, 2020, 1:25pm UTC](https://discuss.elastic.co/t/how-to-set-up-looging-level-in-elasticsearch/257843 "2020-12-07T13:25:15Z")
hi, could you tell me how to set up explicitly logging level in Elasticsearch as INFO? I would like to do that in the file: elasticsearch. yaml --- ## [Error in events Elastic agent 7.10](https://discuss.elastic.co/t/error-in-events-elastic-agent-7-10/256607)
**Author:** [@hermlam](https://discuss.elastic.co/u/hermlam)\ **Replies:** 6\ **Last updated:** [December 7, 2020, 1:21pm UTC](https://discuss.elastic.co/t/error-in-events-elastic-agent-7-10/256607 "2020-12-07T13:21:43Z")
Hi, I installed the new agent 7.10 on my windows machines. Among normaal events I see a lot of these: Nov 25, 2020 @ 07:54:06.033 Surface7 error making http request: Get "http://npipe/state": open \\default-endpoint… --- ## [Filebeat data.json missing after minor upgrade](https://discuss.elastic.co/t/filebeat-data-json-missing-after-minor-upgrade/250518)
**Author:** [@CWelsh](https://discuss.elastic.co/u/CWelsh)\ **Replies:** 6\ **Last updated:** [December 7, 2020, 12:56pm UTC](https://discuss.elastic.co/t/filebeat-data-json-missing-after-minor-upgrade/250518 "2020-12-07T12:56:33Z")
Hi there. After upgrading from filebeat v7.7.0 to v7.9.2 on a windows 2012 server I no longer have a data.json file in my registry folder. This has been replaced with a file named 'X.json' where X is an almost continuou… --- ## [Kibana ui not loading](https://discuss.elastic.co/t/kibana-ui-not-loading/257141)
**Author:** [@sudhakar\_u](https://discuss.elastic.co/u/sudhakar_u)\ **Replies:** 1\ **Last updated:** [December 7, 2020, 12:51pm UTC](https://discuss.elastic.co/t/kibana-ui-not-loading/257141 "2020-12-07T12:51:58Z")
iam using nginx proxy for kibana.My kibana ui is not loading. iam getting this in UI. Kibana did not load properly. Check the server output for more information. in the UI inspect mode .iam seeing this index.light.css:… --- ## [Logstash stopped processing because of an error: (SystemExit) exit](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error-systemexit-exit/251719)
**Author:** [@nitin194](https://discuss.elastic.co/u/nitin194)\ **Replies:** 23\ **Last updated:** [December 7, 2020, 12:47pm UTC](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error-systemexit-exit/251719 "2020-12-07T12:47:55Z")
We are trying to index Nginx access and error log separately in Elasticsearch. for that we have created Filbeat and Logstash config as below. Below is our /etc/filebeat/filebeat.yml configuration filebeat.inputs: … --- ## [Elasticsearch: Encrypting HTTP client communications - AccessControlException](https://discuss.elastic.co/t/elasticsearch-encrypting-http-client-communications-accesscontrolexception/257049)
**Author:** [@Jurilz](https://discuss.elastic.co/u/Jurilz)\ **Replies:** 2\ **Last updated:** [December 7, 2020, 12:46pm UTC](https://discuss.elastic.co/t/elasticsearch-encrypting-http-client-communications-accesscontrolexception/257049 "2020-12-07T12:46:18Z")
Good day, I'm trying to set up Encrypting HTTP client communications and followed 'https://www.elastic.co/guide/en/elasticsearch/reference/7.10/configuring-tls.html#tls-http': My Elasticsearch Docker Container failes w… --- ## [Filebeat not properly recognising truncated file](https://discuss.elastic.co/t/filebeat-not-properly-recognising-truncated-file/257849)
**Author:** [@mutt13y](https://discuss.elastic.co/u/mutt13y)\ **Replies:** 0\ **Last updated:** [December 7, 2020, 12:41pm UTC](https://discuss.elastic.co/t/filebeat-not-properly-recognising-truncated-file/257849 "2020-12-07T12:41:43Z")
in this post https://discuss.elastic.co/t/filebeat-and-truncated-files/63054 @ruflin states that filebeat will detect when a file is truncated and start reading again. I am on beats7.10 and centos 7 We are going to mo… --- ## [Fortinet rsa fields](https://discuss.elastic.co/t/fortinet-rsa-fields/257538)
**Author:** [@bernhard.fluehmann](https://discuss.elastic.co/u/bernhard.fluehmann)\ **Replies:** 2\ **Last updated:** [December 7, 2020, 12:37pm UTC](https://discuss.elastic.co/t/fortinet-rsa-fields/257538 "2020-12-07T12:37:35Z")
Hi, I have just seen at https://www.elastic.co/guide/en/beats/filebeat/7.x/exported-fields-fortinet.html that a lot of rsa fields are now exported. What information do they provide which are not part of fortinet or ECE … --- ## [Unique array elements in elasticsearch 7.4.2](https://discuss.elastic.co/t/unique-array-elements-in-elasticsearch-7-4-2/257847)
**Author:** [@Mohammad\_Mousavi](https://discuss.elastic.co/u/Mohammad_Mousavi)\ **Replies:** 0\ **Last updated:** [December 7, 2020, 12:34pm UTC](https://discuss.elastic.co/t/unique-array-elements-in-elasticsearch-7-4-2/257847 "2020-12-07T12:34:18Z")
Hi, I've found this post and I think it's a little old. I run this code in elasticsearch 7.4.2 : POST logstash-vod-2020.11/\_update\_by\_query?conflicts=proceed&refresh { "query": { "bool": { "must": \[ … --- ## [What is the best way to back up Kibana visualization and dashboard?](https://discuss.elastic.co/t/what-is-the-best-way-to-back-up-kibana-visualization-and-dashboard/257693)
**Author:** [@jhagen92](https://discuss.elastic.co/u/jhagen92)\ **Replies:** 1\ **Last updated:** [December 7, 2020, 12:04pm UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-back-up-kibana-visualization-and-dashboard/257693 "2020-12-07T12:04:52Z")
Hi, I am curious what is the best way to back up Kibana dashboard and visualization. I know there is UI in Kibana where I can choose which saved object I can make back up (json). Is there way to do this using API? Expor… --- ## [non-AWS S3 snapshot repository on Elastic Cloud](https://discuss.elastic.co/t/non-aws-s3-snapshot-repository-on-elastic-cloud/257833)
**Author:** [@yoannma](https://discuss.elastic.co/u/yoannma)\ **Replies:** 2\ **Last updated:** [December 7, 2020, 11:49am UTC](https://discuss.elastic.co/t/non-aws-s3-snapshot-repository-on-elastic-cloud/257833 "2020-12-07T11:49:00Z")
Hello, I am trying to set up a S3 snapshot repository on my Elastic Cloud cluster using an S3 service from Scaleway. Following the documentation https://www.elastic.co/guide/en/elasticsearch/plugins/7.10/repository-s3-… --- ## [Non-zero metrics in the last 30s](https://discuss.elastic.co/t/non-zero-metrics-in-the-last-30s/257268)
**Author:** [@droidus](https://discuss.elastic.co/u/droidus)\ **Replies:** 3\ **Last updated:** [December 7, 2020, 11:22am UTC](https://discuss.elastic.co/t/non-zero-metrics-in-the-last-30s/257268 "2020-12-07T11:22:23Z")
I am receiving this message. I noticed that my syslog file is being spammed with it, and I am not sure why they are being produced, and not sure how to stop them. It looks like it is json format of localhost statistics… --- ## [Ilm\_pattern not getting appended to rollover\_alias when index is created](https://discuss.elastic.co/t/ilm-pattern-not-getting-appended-to-rollover-alias-when-index-is-created/257835)
**Author:** [@Bhavrendra](https://discuss.elastic.co/u/Bhavrendra)\ **Replies:** 0\ **Last updated:** [December 7, 2020, 10:55am UTC](https://discuss.elastic.co/t/ilm-pattern-not-getting-appended-to-rollover-alias-when-index-is-created/257835 "2020-12-07T10:55:47Z")
I'm facing problem with ILM\_Pattern when i'm taking input to #Logstash from #Filebeat. The ilm\_pattern is not getting appended with ilm\_rollover\_alias in this case. Note: Same thing works fine if logstash is taking inp… --- ## [Elasticsearch service fails in my machine](https://discuss.elastic.co/t/elasticsearch-service-fails-in-my-machine/257029)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 2\ **Last updated:** [December 7, 2020, 10:31am UTC](https://discuss.elastic.co/t/elasticsearch-service-fails-in-my-machine/257029 "2020-12-07T10:31:59Z")
Hi all, Kibana is active in my system. Elasticsearch was also running fine. But i wanted it to start on boot and i made some changes in java files. I made some changes in jvm files,but don't remember. Now elasticsea… --- ## [How to prevent Data Loss on Multipipeline Configuration](https://discuss.elastic.co/t/how-to-prevent-data-loss-on-multipipeline-configuration/257822)
**Author:** [@MARCO\_RAMBALDI](https://discuss.elastic.co/u/MARCO_RAMBALDI)\ **Replies:** 0\ **Last updated:** [December 7, 2020, 9:40am UTC](https://discuss.elastic.co/t/how-to-prevent-data-loss-on-multipipeline-configuration/257822 "2020-12-07T09:40:37Z")
Hi all, I have configured different pipelines (managed with a multipipeline configuration). Often, the one with the most data doesn't load all of them. For that I have added a specific DLQ . I also have enabled persist… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1656) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1658)