# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1682 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1683 --- ## [Help with Logstash filter and private geoip data](https://discuss.elastic.co/t/help-with-logstash-filter-and-private-geoip-data/256007)
**Author:** [@ccofer](https://discuss.elastic.co/u/ccofer)\ **Replies:** 8\ **Last updated:** [November 23, 2020, 3:46pm UTC](https://discuss.elastic.co/t/help-with-logstash-filter-and-private-geoip-data/256007 "2020-11-23T15:46:17Z")
I realize I should have a better understanding of elastic, indexes, mappings, logstash and beats before coming here asking for help, but I really need to put this behind me. I have spent days searching and reading about … --- ## [Logstash failed to create template on target server](https://discuss.elastic.co/t/logstash-failed-to-create-template-on-target-server/256232)
**Author:** [@amralieg](https://discuss.elastic.co/u/amralieg)\ **Replies:** 3\ **Last updated:** [November 23, 2020, 2:17pm UTC](https://discuss.elastic.co/t/logstash-failed-to-create-template-on-target-server/256232 "2020-11-23T14:17:46Z")
Hi, I have the following logstash configuration, and when I run it it gives me the error. the input server is hosted on elastic cloud v7.9 and the output server is hosted on AWS elasticsearch v7.8, any clue how to solve… --- ## [Unable to parse field in Kibana](https://discuss.elastic.co/t/unable-to-parse-field-in-kibana/255851)
**Author:** [@tamilarasanbravo](https://discuss.elastic.co/u/tamilarasanbravo)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 3:33pm UTC](https://discuss.elastic.co/t/unable-to-parse-field-in-kibana/255851 "2020-11-23T15:33:59Z")
Hi Team, I am gathering JSON formats to logstash and then parsing it to elasticsearch. In that process, there is a key which has array brackets to it. The key gets saved in Elasticsearch as unknown field9Already tried… --- ## [7.10 and UseConcMarkSweepGC](https://discuss.elastic.co/t/7-10-and-useconcmarksweepgc/256153)
**Author:** [@teej](https://discuss.elastic.co/u/teej)\ **Replies:** 2\ **Last updated:** [November 23, 2020, 3:30pm UTC](https://discuss.elastic.co/t/7-10-and-useconcmarksweepgc/256153 "2020-11-23T15:30:54Z")
Just upgraded to 7.10 and when restarting I get, "Unrecognized VM option 'UseConcMarkSweepGC". Is this to do with options.jvm? --- ## [Logstash datetime filter if else](https://discuss.elastic.co/t/logstash-datetime-filter-if-else/254430)
**Author:** [@tamilarasanbravo](https://discuss.elastic.co/u/tamilarasanbravo)\ **Replies:** 7\ **Last updated:** [November 23, 2020, 3:22pm UTC](https://discuss.elastic.co/t/logstash-datetime-filter-if-else/254430 "2020-11-23T15:22:18Z")
Hi Team, This is regarding the Logstash Input filter. Sometimes the application from which I receive the data(Via logstash http) sends the value in one dateformat(ISO) and at times in another(UNIX). Is there anyway I … --- ## [CSV Ingest Column 1 = Time, Row 1 = Device](https://discuss.elastic.co/t/csv-ingest-column-1-time-row-1-device/256180)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 4\ **Last updated:** [November 23, 2020, 3:06pm UTC](https://discuss.elastic.co/t/csv-ingest-column-1-time-row-1-device/256180 "2020-11-23T15:06:51Z")
I have a CSV to import that has been formatted for use in Excel. As a result, and necessary for it to open in Excel, it has not only been chopped into several files (which I can handle) but it has also been formatted su… --- ## [ECS mappings for asset tracking and port scanning output](https://discuss.elastic.co/t/ecs-mappings-for-asset-tracking-and-port-scanning-output/256162)
**Author:** [@imperial.slipper](https://discuss.elastic.co/u/imperial.slipper)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 2:45pm UTC](https://discuss.elastic.co/t/ecs-mappings-for-asset-tracking-and-port-scanning-output/256162 "2020-11-23T14:45:15Z")
Hey chaps, I'm currently working on an application that will generate asset tracking and scanning data, and one of the outputs I'm building will use the ECS standard where possible. There are broadly two kind of events… --- ## [Can't change the X-axis Label while using filters aggregation on Kibana \[possible duplication\]](https://discuss.elastic.co/t/cant-change-the-x-axis-label-while-using-filters-aggregation-on-kibana-possible-duplication/256252)
**Author:** [@Mohammadreza\_Niknam](https://discuss.elastic.co/u/Mohammadreza_Niknam)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 2:42pm UTC](https://discuss.elastic.co/t/cant-change-the-x-axis-label-while-using-filters-aggregation-on-kibana-possible-duplication/256252 "2020-11-23T14:42:39Z")
Hello all, I'm currently working with Kibana 7.6.2 and in visualization, while I'm using filters aggregation, there is no custom Label field. After a quick search, I realized there's a bug and it was reported here: … --- ## [Logstash \[ERROR\]\[logstash.agent \] Failed to execute action {:id=\>:main, :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Could not execute action: PipelineAction::Create\, action\_result: false", :backtrace=\>nil}](https://discuss.elastic.co/t/logstash-error-logstash-agent-failed-to-execute-action-id-main-action-type-logstash-failedaction-message-could-not-execute-action-pipelineaction-create-main-action-result-false-backtrace-nil/256348)
**Author:** [@salma\_widiarti](https://discuss.elastic.co/u/salma_widiarti)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 2:39pm UTC](https://discuss.elastic.co/t/logstash-error-logstash-agent-failed-to-execute-action-id-main-action-type-logstash-failedaction-message-could-not-execute-action-pipelineaction-create-main-action-result-false-backtrace-nil/256348 "2020-11-23T14:39:31Z")
Hi all, i am trying file configuration logstash like this input { http\_poller { urls =\> { users =\> { method =\> get user =\> "user" password =\> "pass… --- ## [Logstash not listening on port](https://discuss.elastic.co/t/logstash-not-listening-on-port/255356)
**Author:** [@droidus](https://discuss.elastic.co/u/droidus)\ **Replies:** 10\ **Last updated:** [November 23, 2020, 2:31pm UTC](https://discuss.elastic.co/t/logstash-not-listening-on-port/255356 "2020-11-23T14:31:01Z")
I noticed that nothing is listening on port 5044 on my ELK server. Logstash is running. Is there some configuration I missed somewhere to have it running/listening on that port? Here are the last few lines from my log … --- ## [Can't move ES indexes to another disk](https://discuss.elastic.co/t/cant-move-es-indexes-to-another-disk/256165)
**Author:** [@sourcedump](https://discuss.elastic.co/u/sourcedump)\ **Replies:** 2\ **Last updated:** [November 23, 2020, 2:19pm UTC](https://discuss.elastic.co/t/cant-move-es-indexes-to-another-disk/256165 "2020-11-23T14:19:19Z")
Hello everyone! I have an ES 6.1.3 installation that works perfectly, but now the disk where the indexes are stored (we can call it 'Disk A' with path '/data-ephemeral') is full and we can't make it larger. So I've dec… --- ## [Add filter in a dashboard proposes a wrong list of fields](https://discuss.elastic.co/t/add-filter-in-a-dashboard-proposes-a-wrong-list-of-fields/256327)
**Author:** [@pchanas](https://discuss.elastic.co/u/pchanas)\ **Replies:** 4\ **Last updated:** [November 23, 2020, 2:12pm UTC](https://discuss.elastic.co/t/add-filter-in-a-dashboard-proposes-a-wrong-list-of-fields/256327 "2020-11-23T14:12:40Z")
When I try to add manually a filter in a dashboard (using add filter on top of the page), the list of available fields belongs to the default index and not on indexes used in the visualisations of the DB... (no viz is po… --- ## [Packetbeat not sending the data to kafka multi node](https://discuss.elastic.co/t/packetbeat-not-sending-the-data-to-kafka-multi-node/256364)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 0\ **Last updated:** [November 23, 2020, 2:03pm UTC](https://discuss.elastic.co/t/packetbeat-not-sending-the-data-to-kafka-multi-node/256364 "2020-11-23T14:03:53Z")
Packetbeat version 7.9 and kafka version is 2.5 #----------------------------- Kafka output -------------------------------- output.kafka: hosts: \["kafka1:9092","kafka2:9092","kafka3:9092"\] topic: "packetbeat" … --- ## [Scripted Field URL](https://discuss.elastic.co/t/scripted-field-url/256360)
**Author:** [@nagabhushan.tr](https://discuss.elastic.co/u/nagabhushan.tr)\ **Replies:** 0\ **Last updated:** [November 23, 2020, 1:34pm UTC](https://discuss.elastic.co/t/scripted-field-url/256360 "2020-11-23T13:34:26Z")
I have a scripted field (URL type) which i use to navigate to APM on kibana from a dashboard. Is there a way i can capture time range from dashboard and pass it to scripted field, so when i navigate to APM, selected dash… --- ## [Adding indices to New Spaces - not able to](https://discuss.elastic.co/t/adding-indices-to-new-spaces-not-able-to/256014)
**Author:** [@lnxjenn](https://discuss.elastic.co/u/lnxjenn)\ **Replies:** 4\ **Last updated:** [November 23, 2020, 1:28pm UTC](https://discuss.elastic.co/t/adding-indices-to-new-spaces-not-able-to/256014 "2020-11-23T13:28:16Z")
I am creating new spaces for grouping our users together with their appropriate feeds. But I cannot see the feeds within the new space, when i try to add them into the Index Patterns. Now, as a user in the default space… --- ## [How to specify the salesforce Host for Salesforce input plugin](https://discuss.elastic.co/t/how-to-specify-the-salesforce-host-for-salesforce-input-plugin/255119)
**Author:** [@brendanlynch](https://discuss.elastic.co/u/brendanlynch)\ **Replies:** 2\ **Last updated:** [November 23, 2020, 1:14pm UTC](https://discuss.elastic.co/t/how-to-specify-the-salesforce-host-for-salesforce-input-plugin/255119 "2020-11-23T13:14:55Z")
How do you control the Salesforce HOST/URL that you want to connect to? All I see in the input fields is a boolean switch that says it will use 'test.salesforce.com'. --- ## [Filebeat - Netflow - Add flows set id to document](https://discuss.elastic.co/t/filebeat-netflow-add-flows-set-id-to-document/256357)
**Author:** [@rvd](https://discuss.elastic.co/u/rvd)\ **Replies:** 0\ **Last updated:** [November 23, 2020, 1:02pm UTC](https://discuss.elastic.co/t/filebeat-netflow-add-flows-set-id-to-document/256357 "2020-11-23T13:02:53Z")
Hi I'm using FILEBEAT as IPFIX decoder . I would like to add automatically the flow set id coming from IPFIX template ID to the produced document in ELS. Is there a way to do that ? thx RV --- ## [Too many dynamic script compilations with stored script](https://discuss.elastic.co/t/too-many-dynamic-script-compilations-with-stored-script/256354)
**Author:** [@cwinkler](https://discuss.elastic.co/u/cwinkler)\ **Replies:** 0\ **Last updated:** [November 23, 2020, 12:46pm UTC](https://discuss.elastic.co/t/too-many-dynamic-script-compilations-with-stored-script/256354 "2020-11-23T12:46:50Z")
With Elasticsearch 7.10 we are getting the following error when using a stored script. ElasticsearchException\[Elasticsearch exception \[type=general\_script\_exception, reason=Failed to compile stored script \[updateMessage… --- ## [What does max\_docs do in context of \_delete\_by\_query](https://discuss.elastic.co/t/what-does-max-docs-do-in-context-of-delete-by-query/256317)
**Author:** [@vangogh94](https://discuss.elastic.co/u/vangogh94)\ **Replies:** 3\ **Last updated:** [November 23, 2020, 10:53am UTC](https://discuss.elastic.co/t/what-does-max-docs-do-in-context-of-delete-by-query/256317 "2020-11-23T10:53:41Z")
Hi, Looking at the documentation for \_delete\_by\_query API, there is a parameter called "max\_docs". From what i see it was added to documentation in 7.3. This same parameter is shown on \_reindex API documentation and ha… --- ## [Give privilege to a user to create index pattern](https://discuss.elastic.co/t/give-privilege-to-a-user-to-create-index-pattern/256143)
**Author:** [@Angelos](https://discuss.elastic.co/u/Angelos)\ **Replies:** 2\ **Last updated:** [November 23, 2020, 10:44am UTC](https://discuss.elastic.co/t/give-privilege-to-a-user-to-create-index-pattern/256143 "2020-11-23T10:44:04Z")
Hello, How can I give privilege to a user to create index patterns but not having the right to create indices? When I use "manage" privilege then the user has access everywhere. Thank you in advance! /Angelos --- ## [Azure NSG Integration help](https://discuss.elastic.co/t/azure-nsg-integration-help/256342)
**Author:** [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 10:19am UTC](https://discuss.elastic.co/t/azure-nsg-integration-help/256342 "2020-11-23T10:19:45Z")
Hi, I am trying to integrate Azure NSG Logs into Elastic, I have done 80% but there is 1 field is proving a little difficult for me and it has all the important flow information. Each log event contaains 5 flows inform… --- ## [Metricbeat data flow problem with Kibana](https://discuss.elastic.co/t/metricbeat-data-flow-problem-with-kibana/256247)
**Author:** [@yattaes](https://discuss.elastic.co/u/yattaes)\ **Replies:** 3\ **Last updated:** [November 23, 2020, 10:15am UTC](https://discuss.elastic.co/t/metricbeat-data-flow-problem-with-kibana/256247 "2020-11-23T10:15:38Z")
Hi! I recently deployed Elasticsearch with Kibana on Azure Kubernetes environment. After that I deployed Metricbeat and it seems fine, all pods are running without problem. But I can not see any data flow to Kibana fro… --- ## [Point Kibana to a Subdomain](https://discuss.elastic.co/t/point-kibana-to-a-subdomain/256259)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 4\ **Last updated:** [November 23, 2020, 10:14am UTC](https://discuss.elastic.co/t/point-kibana-to-a-subdomain/256259 "2020-11-23T10:14:39Z")
I am struggling with pointing Kibana to a subdomain. My domain is hosted on cloudflare and I am trying to point Kibana URL to a subdomain. Do I required to make any changes internally on Elasticsearch or Kibana instance… --- ## [Kibana index pattern, matching index, how to match more than 100](https://discuss.elastic.co/t/kibana-index-pattern-matching-index-how-to-match-more-than-100/256296)
**Author:** [@yt\_h](https://discuss.elastic.co/u/yt_h)\ **Replies:** 5\ **Last updated:** [November 23, 2020, 10:02am UTC](https://discuss.elastic.co/t/kibana-index-pattern-matching-index-how-to-match-more-than-100/256296 "2020-11-23T10:02:49Z")
elasticsearch version: 7.5.1 kibana version: 7.5.1 I have more than 300 indexes. How to use one index pattern to match all of them? When I enter the "pro" index pattern, it shows that 100 indexes are matched, but 300 i… --- ## [Kibana unable to configure fleet access](https://discuss.elastic.co/t/kibana-unable-to-configure-fleet-access/255977)
**Author:** [@Mikel\_U](https://discuss.elastic.co/u/Mikel_U)\ **Replies:** 6\ **Last updated:** [November 23, 2020, 9:52am UTC](https://discuss.elastic.co/t/kibana-unable-to-configure-fleet-access/255977 "2020-11-23T09:52:49Z")
Hi there, I'm trying to configure Fleet on Kibana container. Mi elastic-docker.yml is this (have 3 instances of elastic search and 1 of kibana): version: '2.2' services: es01: image: docker.elastic.co/elasticsear… --- ## [How to shutdown logstash when jdbc or es connection failed?](https://discuss.elastic.co/t/how-to-shutdown-logstash-when-jdbc-or-es-connection-failed/256333)
**Author:** [@zhangyunkun](https://discuss.elastic.co/u/zhangyunkun)\ **Replies:** 0\ **Last updated:** [November 23, 2020, 9:46am UTC](https://discuss.elastic.co/t/how-to-shutdown-logstash-when-jdbc-or-es-connection-failed/256333 "2020-11-23T09:46:01Z")
I found that logstash won't shutdown when jdbc or es connection failed。 It troubles me because I'll never find this mistake unless I take the initiative to see it。 And i tried configue the jdbc plugin setting 'co… --- ## [Elasticsearch Transform Document ID](https://discuss.elastic.co/t/elasticsearch-transform-document-id/256192)
**Author:** [@kaijun](https://discuss.elastic.co/u/kaijun)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 9:40am UTC](https://discuss.elastic.co/t/elasticsearch-transform-document-id/256192 "2020-11-23T09:40:46Z")
When we use the transform API to transform our data into a new index, is there a way for us to set the document ID? (I think currently the default setting is randomly assigned some string as the document ID) --- ## [Alerting Webhook Action force don't use proxy](https://discuss.elastic.co/t/alerting-webhook-action-force-dont-use-proxy/256331)
**Author:** [@usrigp](https://discuss.elastic.co/u/usrigp)\ **Replies:** 0\ **Last updated:** [November 23, 2020, 9:38am UTC](https://discuss.elastic.co/t/alerting-webhook-action-force-dont-use-proxy/256331 "2020-11-23T09:38:20Z")
Hi, We need to force a Webhook Action don't use the proxy. We know we can config a webhook action using proxy.host and proxy.port. Are there any way to force it doesn't use a proxy (ignoring proxy configured on the se… --- ## [How can I read the timefilter range within an external plugin?](https://discuss.elastic.co/t/how-can-i-read-the-timefilter-range-within-an-external-plugin/256022)
**Author:** [@cascandaliato](https://discuss.elastic.co/u/cascandaliato)\ **Replies:** 4\ **Last updated:** [November 23, 2020, 9:30am UTC](https://discuss.elastic.co/t/how-can-i-read-the-timefilter-range-within-an-external-plugin/256022 "2020-11-23T09:30:23Z")
Hello, I've followed these instructions to scaffold a new plugin project (starting from master) and the plugin page comes with a time filter: How can I read the time range selected by the user? Some old posts refer… --- ## [Nodes fall out of the cluster es 7.9.1](https://discuss.elastic.co/t/nodes-fall-out-of-the-cluster-es-7-9-1/256309)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 2\ **Last updated:** [November 23, 2020, 9:25am UTC](https://discuss.elastic.co/t/nodes-fall-out-of-the-cluster-es-7-9-1/256309 "2020-11-23T09:25:58Z")
Hello, we have the following problem: nodes can periodically fall out of the cluster \[2020-11-19T09:00:37,415\]\[INFO \]\[o.e.c.s.MasterService \] \[h1-es03\] node-left\[{h1-es02}{qgmMV2UbT-ScN9uRr6YM8g}{klj1K8UMRHGtYpYozIuq… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1681) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1683)