# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1672 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1673 --- ## [Metricbeat prometheus autodiscover metrics not appearing in ES indices](https://discuss.elastic.co/t/metricbeat-prometheus-autodiscover-metrics-not-appearing-in-es-indices/256950)
**Author:** [@k077](https://discuss.elastic.co/u/k077)\ **Replies:** 1\ **Last updated:** [November 29, 2020, 11:08pm UTC](https://discuss.elastic.co/t/metricbeat-prometheus-autodiscover-metrics-not-appearing-in-es-indices/256950 "2020-11-29T23:08:42Z")
Hi es community, I have deployed ES on kube using the operator as well as metricbeat and everything is working as expected except for metricbeats autodiscover prometheus. After enabling debugging, I can see metricbeat … --- ## [Extract xml attribute from xml](https://discuss.elastic.co/t/extract-xml-attribute-from-xml/257007)
**Author:** [@AA\_BB](https://discuss.elastic.co/u/AA_BB)\ **Replies:** 0\ **Last updated:** [November 29, 2020, 8:57pm UTC](https://discuss.elastic.co/t/extract-xml-attribute-from-xml/257007 "2020-11-29T20:57:48Z")
I am new to elastic search. Can someone help me to extract XML attributes like Name, LastName, FatherName from the below XML file? This is the XML which I need to parse:OUTPUT(20201112 12:15:23.356):\[IdExecution: '00001… --- ## [Filter conditionals not working as expected](https://discuss.elastic.co/t/filter-conditionals-not-working-as-expected/257002)
**Author:** [@blitzcrg](https://discuss.elastic.co/u/blitzcrg)\ **Replies:** 2\ **Last updated:** [November 29, 2020, 7:44pm UTC](https://discuss.elastic.co/t/filter-conditionals-not-working-as-expected/257002 "2020-11-29T19:44:09Z")
I'm new to logstash, and writing a config to parse logs from the firewall appliance in my home office. I've debugged a few issues with this config already and now I have it to a place where it works without any errors. H… --- ## [An unexpected error occurred! SocketError: initialize: name or service not known](https://discuss.elastic.co/t/an-unexpected-error-occurred-socketerror-initialize-name-or-service-not-known/256981)
**Author:** [@Barak](https://discuss.elastic.co/u/Barak)\ **Replies:** 2\ **Last updated:** [November 29, 2020, 3:23pm UTC](https://discuss.elastic.co/t/an-unexpected-error-occurred-socketerror-initialize-name-or-service-not-known/256981 "2020-11-29T15:23:52Z")
I am using a basic logstash config that used to work: input { s3 { "bucket" =\> "logs-alb-api" "prefix" =\> "AWSLogs/934###" "type" =\> "ELB\_logs" } } filter { m… --- ## [Logstash json line by line](https://discuss.elastic.co/t/logstash-json-line-by-line/256787)
**Author:** [@Didi\_Sisi](https://discuss.elastic.co/u/Didi_Sisi)\ **Replies:** 3\ **Last updated:** [November 29, 2020, 2:44pm UTC](https://discuss.elastic.co/t/logstash-json-line-by-line/256787 "2020-11-29T14:44:45Z")
Hello; I have this logstash.conf file: input { exec { command =\> "python3 news.py" interval =\> 30 codec =\> "json" } } output { stdout { } } without the code =\> json I obtain this result: "message" =\> " {\\n … --- ## [Parsing multiline log options](https://discuss.elastic.co/t/parsing-multiline-log-options/256441)
**Author:** [@newmember](https://discuss.elastic.co/u/newmember)\ **Replies:** 2\ **Last updated:** [November 29, 2020, 8:34am UTC](https://discuss.elastic.co/t/parsing-multiline-log-options/256441 "2020-11-29T08:34:01Z")
I would like to ingest this multiline event and capture some fields; Is it best to capture the fields at the host? or with logstash as part of a filter? how would I set up regex to catch TTC\_UID KVP and TCCRON … --- ## [Already deleted indices comes back as dangling whenever a node restarts](https://discuss.elastic.co/t/already-deleted-indices-comes-back-as-dangling-whenever-a-node-restarts/256841)
**Author:** [@jatin\_gupta](https://discuss.elastic.co/u/jatin_gupta)\ **Replies:** 14\ **Last updated:** [November 29, 2020, 7:55am UTC](https://discuss.elastic.co/t/already-deleted-indices-comes-back-as-dangling-whenever-a-node-restarts/256841 "2020-11-29T07:55:12Z")
Hi, I am running a 8 node ES cluster with version 7.4.2 Everytime a node on the cluster restarts the state becomes red as a lot of dangling indices which are already deleted tries to get restored on the cluster. Only … --- ## [Confusion about licensing for Stack Monitoring](https://discuss.elastic.co/t/confusion-about-licensing-for-stack-monitoring/256956)
**Author:** [@ffknob](https://discuss.elastic.co/u/ffknob)\ **Replies:** 1\ **Last updated:** [November 29, 2020, 2:51am UTC](https://discuss.elastic.co/t/confusion-about-licensing-for-stack-monitoring/256956 "2020-11-29T02:51:47Z")
I have a Platinum subscription fo a cluster in the Elastic Cloud. I'll use this cluster to monitor many other clusters... some of them are licensed, most of them are not. So, in order to be able to use the "Multi-Stack … --- ## [Document\_id is value](https://discuss.elastic.co/t/document-id-is-value/256969)
**Author:** [@salma\_widiarti](https://discuss.elastic.co/u/salma_widiarti)\ **Replies:** 2\ **Last updated:** [November 29, 2020, 12:57am UTC](https://discuss.elastic.co/t/document-id-is-value/256969 "2020-11-29T00:57:12Z")
Hi all, when I run the logstash config, why is my document id its value? Any one can help me? This is my configuration logstash input { http\_poller { urls =\> { users =\> { metho… --- ## [Index on Elastic search contains and starts with search](https://discuss.elastic.co/t/index-on-elastic-search-contains-and-starts-with-search/256968)
**Author:** [@arup\_chakraborty](https://discuss.elastic.co/u/arup_chakraborty)\ **Replies:** 0\ **Last updated:** [November 28, 2020, 11:47pm UTC](https://discuss.elastic.co/t/index-on-elastic-search-contains-and-starts-with-search/256968 "2020-11-28T23:47:54Z")
We are using elastic search for faster searching on our organization data . The data model has organization id, address, organization name, business start date and organization contacts array . We have asked to perform … --- ## [Logstash monitoring data not showing in Stack Monitoring](https://discuss.elastic.co/t/logstash-monitoring-data-not-showing-in-stack-monitoring/256920)
**Author:** [@ffknob](https://discuss.elastic.co/u/ffknob)\ **Replies:** 1\ **Last updated:** [November 28, 2020, 11:05pm UTC](https://discuss.elastic.co/t/logstash-monitoring-data-not-showing-in-stack-monitoring/256920 "2020-11-28T23:05:28Z")
Hello, I'm not managing to get my Logstash metrics to be shown in Kibana's Stack Monitoring UI: Even though it looks like Metricbeat is sending events to the cluster: GET .monitoring-logstash-7-mb-2020.11.27/\_search… --- ## [Logstash json filter plugin values as string](https://discuss.elastic.co/t/logstash-json-filter-plugin-values-as-string/256912)
**Author:** [@nunogt](https://discuss.elastic.co/u/nunogt)\ **Replies:** 4\ **Last updated:** [November 28, 2020, 10:03pm UTC](https://discuss.elastic.co/t/logstash-json-filter-plugin-values-as-string/256912 "2020-11-28T22:03:50Z")
Hi there, Consider the following logstash json filter snippet: json { skip\_on\_invalid\_json =\> true source =\> "message\_body" target =\> "jsondoc" } which results on the following logstash… --- ## [Mutate convert - Logstash shut down](https://discuss.elastic.co/t/mutate-convert-logstash-shut-down/256237)
**Author:** [@JoAnner](https://discuss.elastic.co/u/JoAnner)\ **Replies:** 3\ **Last updated:** [November 28, 2020, 9:35pm UTC](https://discuss.elastic.co/t/mutate-convert-logstash-shut-down/256237 "2020-11-28T21:35:16Z")
This config doesn't work (mutate, convert create shut down). Could somebody explain me a way to resolve this please? # Sample Logstash configuration for creating a simple # Beats -\> Logstash -\> Elasticsearch pipeline. … --- ## [Dynamic template to convert all types to string](https://discuss.elastic.co/t/dynamic-template-to-convert-all-types-to-string/256960)
**Author:** [@nunogt](https://discuss.elastic.co/u/nunogt)\ **Replies:** 0\ **Last updated:** [November 28, 2020, 6:03pm UTC](https://discuss.elastic.co/t/dynamic-template-to-convert-all-types-to-string/256960 "2020-11-28T18:03:46Z")
Hi there, Consider the following logstash json filter snippet: json { skip\_on\_invalid\_json =\> true source =\> "message\_body" target =\> "jsondoc" } which results on the following logstash… --- ## [\[Kibana\] Authenticate via Radius](https://discuss.elastic.co/t/kibana-authenticate-via-radius/256952)
**Author:** [@Ayakashi97](https://discuss.elastic.co/u/Ayakashi97)\ **Replies:** 3\ **Last updated:** [November 28, 2020, 1:15pm UTC](https://discuss.elastic.co/t/kibana-authenticate-via-radius/256952 "2020-11-28T13:15:35Z")
Hi there, is it possible to authenticate on kibana through radius authentication? If possible, how? My Version of Kibana is 7.9. Best Regards Ayakashi --- ## [Logstash - Unknown setting 'ssl\_certificate' & 'ssl\_key' for elasticsearch](https://discuss.elastic.co/t/logstash-unknown-setting-ssl-certificate-ssl-key-for-elasticsearch/256887)
**Author:** [@atharvak](https://discuss.elastic.co/u/atharvak)\ **Replies:** 6\ **Last updated:** [November 28, 2020, 10:38am UTC](https://discuss.elastic.co/t/logstash-unknown-setting-ssl-certificate-ssl-key-for-elasticsearch/256887 "2020-11-28T10:38:12Z")
Hi guys, I am trying to connect logstash with elasticsearch that has security enabled. While elasticsearch is running well with the SSL Certificates/keys, the same certificates/keys are not working for the Logstash. Fol… --- ## [How to use go-elasticsearch library with gin framework?](https://discuss.elastic.co/t/how-to-use-go-elasticsearch-library-with-gin-framework/256941)
**Author:** [@iooi](https://discuss.elastic.co/u/iooi)\ **Replies:** 0\ **Last updated:** [November 28, 2020, 8:59am UTC](https://discuss.elastic.co/t/how-to-use-go-elasticsearch-library-with-gin-framework/256941 "2020-11-28T08:59:56Z")
Using gin for API. Its route.go func Init(api \*gin.Engine) { r := api.Group("/v1") r.GET("/sites/search/:url", site.Search) } In the controller file, want to use go-elasticsearch for searching ES data. import… --- ## [Cannot remove field with ingest processor](https://discuss.elastic.co/t/cannot-remove-field-with-ingest-processor/256828)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 3\ **Last updated:** [November 28, 2020, 8:07am UTC](https://discuss.elastic.co/t/cannot-remove-field-with-ingest-processor/256828 "2020-11-28T08:07:29Z")
I using ES 7.9.0 My data { "\_index": "original-index-2020.11", "\_type": "\_doc", "\_id": "7K27Bas23a", "\_version": 1, "\_score": null, "\_source": { "http.request.auth": "-", … --- ## [Adding Image to the dashboard or to canvas from local server](https://discuss.elastic.co/t/adding-image-to-the-dashboard-or-to-canvas-from-local-server/256835)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 2\ **Last updated:** [November 28, 2020, 6:33am UTC](https://discuss.elastic.co/t/adding-image-to-the-dashboard-or-to-canvas-from-local-server/256835 "2020-11-28T06:33:29Z")
Hello, I would like to present images from the kibana/elastic server in a dashboard or in a canvas workpad. There are a few discussions around this but none worked for me. In this discussion the URL given is /usr/shar… --- ## [Default logs format filebeat](https://discuss.elastic.co/t/default-logs-format-filebeat/256933)
**Author:** [@Supun\_Madushanka](https://discuss.elastic.co/u/Supun_Madushanka)\ **Replies:** 0\ **Last updated:** [November 28, 2020, 5:21am UTC](https://discuss.elastic.co/t/default-logs-format-filebeat/256933 "2020-11-28T05:21:47Z")
I am new to elk stack. i configure filebeat and elk and kibana I have nodejs application. I write logs in to file. now i send the row log for the elk. here is my log format {phase} {ip} {room} {message} ${JSON.stringif… --- ## [How to monitor Elasticsearch snapshots](https://discuss.elastic.co/t/how-to-monitor-elasticsearch-snapshots/256037)
**Author:** [@mwise29](https://discuss.elastic.co/u/mwise29)\ **Replies:** 13\ **Last updated:** [November 28, 2020, 4:53am UTC](https://discuss.elastic.co/t/how-to-monitor-elasticsearch-snapshots/256037 "2020-11-28T04:53:47Z")
I'd like advice on how to monitor snapshots. Is there a way to do it via a monitor? We'd only want the status of the last snapshot taken (report either success or failed). --- ## [TimeOut Error during indexing](https://discuss.elastic.co/t/timeout-error-during-indexing/256312)
**Author:** [@amir\_veyseh](https://discuss.elastic.co/u/amir_veyseh)\ **Replies:** 5\ **Last updated:** [November 28, 2020, 4:51am UTC](https://discuss.elastic.co/t/timeout-error-during-indexing/256312 "2020-11-28T04:51:12Z")
I have installed EleasticSearch using the instructions from here. I run it using systemd. I have also made the following changes in the configuration: Disabling swap Change heap size to 20 GB Set refresh interval to -1 … --- ## [How to restore indices younger than](https://discuss.elastic.co/t/how-to-restore-indices-younger-than/256927)
**Author:** [@Juan\_Bertolotti](https://discuss.elastic.co/u/Juan_Bertolotti)\ **Replies:** 1\ **Last updated:** [November 28, 2020, 4:49am UTC](https://discuss.elastic.co/t/how-to-restore-indices-younger-than/256927 "2020-11-28T04:49:26Z")
Hi All, Im looking for a way to restore specific indices from a snapshot, lets say I wan yo restore just the latest 15 days. Is there any way to achieve that? Ive tried curator with no luck yet. Im running ELK 6.8.8 --- ## [Elastic-agent is parsing syslog events different (than Filebeat)](https://discuss.elastic.co/t/elastic-agent-is-parsing-syslog-events-different-than-filebeat/256895)
**Author:** [@hermlam](https://discuss.elastic.co/u/hermlam)\ **Replies:** 1\ **Last updated:** [November 28, 2020, 12:02am UTC](https://discuss.elastic.co/t/elastic-agent-is-parsing-syslog-events-different-than-filebeat/256895 "2020-11-28T00:02:13Z")
Hi, I switched from the ‘classic’ Filebeat to Elastic-Agent. Very handy, but there is a difference how events are being parsed. My Syslog events from devices and Raspberry Pies are routed via a central syslog server. A… --- ## [Metricbeat data flow problem](https://discuss.elastic.co/t/metricbeat-data-flow-problem/256416)
**Author:** [@yattaes](https://discuss.elastic.co/u/yattaes)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 10:59pm UTC](https://discuss.elastic.co/t/metricbeat-data-flow-problem/256416 "2020-11-23T22:59:08Z")
Hi, I recently deployed Elasticsearch with Kibana on Azure Kubernetes environment. My env's is like below; \> PS C:\\Users\\user\\Desktop\\ES\_YAML\\2\> kubectl get pods --all-namespaces -o wide \> NAMESPACE NAME… --- ## [Problem with WinlogBeat Dashboard ECS](https://discuss.elastic.co/t/problem-with-winlogbeat-dashboard-ecs/256848)
**Author:** [@tesla](https://discuss.elastic.co/u/tesla)\ **Replies:** 1\ **Last updated:** [November 27, 2020, 9:42pm UTC](https://discuss.elastic.co/t/problem-with-winlogbeat-dashboard-ecs/256848 "2020-11-27T21:42:03Z")
Hi Guys I have node Centos 8 kibana version 7.10.0, nano /etc/kibana/kibana.yml server.port: 5601 server.host: 0.0.0.0 elasticsearch.hosts: \["http://elasticsearch:9200"\] kibana.index: ".kibana" I have node Cento… --- ## [Logstash does not forget the previous csv header coming from filebeat](https://discuss.elastic.co/t/logstash-does-not-forget-the-previous-csv-header-coming-from-filebeat/256910)
**Author:** [@jason.greffier](https://discuss.elastic.co/u/jason.greffier)\ **Replies:** 2\ **Last updated:** [November 27, 2020, 8:36pm UTC](https://discuss.elastic.co/t/logstash-does-not-forget-the-previous-csv-header-coming-from-filebeat/256910 "2020-11-27T20:36:40Z")
Hi, My issue: When I pass csv files from filebeat with different header, csv output does not match the right column with the right value. Does someone know to manage that, forget the previous csv header read by log … --- ## [Ingesting O365 logs but having issues with specific mappings](https://discuss.elastic.co/t/ingesting-o365-logs-but-having-issues-with-specific-mappings/256081)
**Author:** [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\ **Replies:** 5\ **Last updated:** [November 27, 2020, 8:33pm UTC](https://discuss.elastic.co/t/ingesting-o365-logs-but-having-issues-with-specific-mappings/256081 "2020-11-27T20:33:52Z")
Hi, We are using Filebeat with the O365 module. These events get shipped to Redis which then Logstash fetches from. The logs are getting ingested but some of the events are having mapping issues with the field "o365.aud… --- ## [Having an issue while trying to reindex using a script](https://discuss.elastic.co/t/having-an-issue-while-trying-to-reindex-using-a-script/256915)
**Author:** [@tarek](https://discuss.elastic.co/u/tarek)\ **Replies:** 1\ **Last updated:** [November 27, 2020, 8:29pm UTC](https://discuss.elastic.co/t/having-an-issue-while-trying-to-reindex-using-a-script/256915 "2020-11-27T20:29:38Z")
Hello, So, I'm trying to reindex documents into a new index with a stored script. the used script has a parameter called "increment". when I start reindexing, I get a null pointer exception. This is my code. POST \_sc… --- ## [Kibana Canvas - Time Filter for previous month](https://discuss.elastic.co/t/kibana-canvas-time-filter-for-previous-month/256810)
**Author:** [@KevSex](https://discuss.elastic.co/u/KevSex)\ **Replies:** 1\ **Last updated:** [November 27, 2020, 8:16pm UTC](https://discuss.elastic.co/t/kibana-canvas-time-filter-for-previous-month/256810 "2020-11-27T20:16:44Z")
Is there a way to use the time filter in canvas to filter a month regardless of the current date/time. Just now, the only thing close is to create a relative time filter for 1 Months ago however this only really works w… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1671) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1673)