# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1683 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1684 --- ## [Setup metricbeat to monitor docker containers](https://discuss.elastic.co/t/setup-metricbeat-to-monitor-docker-containers/255985)
**Author:** [@Sauerbrei](https://discuss.elastic.co/u/Sauerbrei)\ **Replies:** 2\ **Last updated:** [November 23, 2020, 9:21am UTC](https://discuss.elastic.co/t/setup-metricbeat-to-monitor-docker-containers/255985 "2020-11-23T09:21:21Z")
Hi there, I am trying to setup metricbeat inside a local docker environment to write the collected data into an AWS Elastic Search Service. The Service runs and authentication is available via Basic Authentication. Here… --- ## [Need to remove two Node out of three node Elasticsearch clusters](https://discuss.elastic.co/t/need-to-remove-two-node-out-of-three-node-elasticsearch-clusters/256101)
**Author:** [@SumanUk](https://discuss.elastic.co/u/SumanUk)\ **Replies:** 4\ **Last updated:** [November 23, 2020, 9:13am UTC](https://discuss.elastic.co/t/need-to-remove-two-node-out-of-three-node-elasticsearch-clusters/256101 "2020-11-23T09:13:33Z")
Hi Team, Need guidelines for how to remove two Nodes out of three Node in Elastic Cluster without data loss we have install Elasticsearch in single node but it has connected three node which is early install still it's… --- ## [Aggregate filter plugin](https://discuss.elastic.co/t/aggregate-filter-plugin/255729)
**Author:** [@Andex](https://discuss.elastic.co/u/Andex)\ **Replies:** 5\ **Last updated:** [November 23, 2020, 9:09am UTC](https://discuss.elastic.co/t/aggregate-filter-plugin/255729 "2020-11-23T09:09:25Z")
Hi, i create my aggregate filter plugin but it doesn't start with this error : \[ERROR\]\[logstash.filters.aggregate\] Missing a required setting for the aggregate filter plugin: filter { aggregate { code =\> # SETTING MI… --- ## [Export/Import Saved objects](https://discuss.elastic.co/t/export-import-saved-objects/256148)
**Author:** [@alfredo.deluca](https://discuss.elastic.co/u/alfredo.deluca)\ **Replies:** 4\ **Last updated:** [November 23, 2020, 8:36am UTC](https://discuss.elastic.co/t/export-import-saved-objects/256148 "2020-11-23T08:36:27Z")
Hi all. I have 2 elastic installed. one is 7.7 and the second one is 7.8. Trying to export/import saved objects and specifically Visualizations but I got errors as per below when I do export Your file is downloading … --- ## [Http.max\_header\_size](https://discuss.elastic.co/t/http-max-header-size/256318)
**Author:** [@thetell75](https://discuss.elastic.co/u/thetell75)\ **Replies:** 2\ **Last updated:** [November 23, 2020, 8:24am UTC](https://discuss.elastic.co/t/http-max-header-size/256318 "2020-11-23T08:24:40Z")
Hello everybody, I have an issue with User having to many groups on Microsoft Azure. As we do authenticate through openid on Azure. I saw a Problem with Header Size. So I tried to increase the Header\_Size from 8KB to 1… --- ## [Sending New Relic Logs to ELK](https://discuss.elastic.co/t/sending-new-relic-logs-to-elk/256311)
**Author:** [@Edwin.v](https://discuss.elastic.co/u/Edwin.v)\ **Replies:** 0\ **Last updated:** [November 23, 2020, 7:10am UTC](https://discuss.elastic.co/t/sending-new-relic-logs-to-elk/256311 "2020-11-23T07:10:13Z")
Hello Everyone, I would like to know if there is a way I can send new relic logs to ELK stack. Any documentation will be really helpful. Thanks. --- ## [Kibana 7.10.0. licensing error](https://discuss.elastic.co/t/kibana-7-10-0-licensing-error/256019)
**Author:** [@ans\_x](https://discuss.elastic.co/u/ans_x)\ **Replies:** 6\ **Last updated:** [November 23, 2020, 6:53am UTC](https://discuss.elastic.co/t/kibana-7-10-0-licensing-error/256019 "2020-11-23T06:53:03Z")
After upgrading the stack from version 7.8.0 to 7.10.0, a license error appeared in Kibana. Full kibana.log xpack settings were included. After the update, the config did not change, only deleted the Kibana system in… --- ## [Filebeat MSSQL ECS](https://discuss.elastic.co/t/filebeat-mssql-ecs/256308)
**Author:** [@bering](https://discuss.elastic.co/u/bering)\ **Replies:** 0\ **Last updated:** [November 23, 2020, 6:52am UTC](https://discuss.elastic.co/t/filebeat-mssql-ecs/256308 "2020-11-23T06:52:26Z")
I would like to improve the MSSQL module in filebeats so that that the multiline messages in the SQL log maps into an ECS structure. The multiline messages that I am looking at always has 'Error:' in the messsage. What… --- ## [Metricbeat MSSQL User Role required](https://discuss.elastic.co/t/metricbeat-mssql-user-role-required/256159)
**Author:** [@kotha](https://discuss.elastic.co/u/kotha)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 6:33am UTC](https://discuss.elastic.co/t/metricbeat-mssql-user-role-required/256159 "2020-11-23T06:33:40Z")
what is the minimum role required to gather stats for Metric MSSQL beat. Right now we are using sysadmin role, but there is a push back from the DBA in using that role for the user that collects the metrics for MSSQL --- ## [Can we store two Elastic search indices in different data directory](https://discuss.elastic.co/t/can-we-store-two-elastic-search-indices-in-different-data-directory/256221)
**Author:** [@Vivek\_Sagar](https://discuss.elastic.co/u/Vivek_Sagar)\ **Replies:** 4\ **Last updated:** [November 23, 2020, 6:20am UTC](https://discuss.elastic.co/t/can-we-store-two-elastic-search-indices-in-different-data-directory/256221 "2020-11-23T06:20:06Z")
Can we have multiple indices in different data paths in elastic search? In my application, I want to separate index to keep sensitive data in dm-crypted volume and others on non encrypted volume. So separate indices for … --- ## [Kibana NoShardsAvailable Exception](https://discuss.elastic.co/t/kibana-noshardsavailable-exception/256080)
**Author:** [@tamilarasanbravo](https://discuss.elastic.co/u/tamilarasanbravo)\ **Replies:** 2\ **Last updated:** [November 23, 2020, 6:13am UTC](https://discuss.elastic.co/t/kibana-noshardsavailable-exception/256080 "2020-11-23T06:13:07Z")
Hi Team, I have been using Kibana to visualize and the last few days it is throwing error :NoShardsAvailableException, please find the snap below. Note : Ignore the index name Please note that I ran few queries to u… --- ## [Unable to set up SAML on elastic cloud 7.9 deployment](https://discuss.elastic.co/t/unable-to-set-up-saml-on-elastic-cloud-7-9-deployment/256203)
**Author:** [@cguerrero](https://discuss.elastic.co/u/cguerrero)\ **Replies:** 2\ **Last updated:** [November 23, 2020, 5:55am UTC](https://discuss.elastic.co/t/unable-to-set-up-saml-on-elastic-cloud-7-9-deployment/256203 "2020-11-23T05:55:47Z")
Deployment ID: 020c87b v7.9.3 I keep running into the following error while trying to authenticate to kibana on an elastic cloud deployment, using SAML (OneLogin). Authentication to realm saml1 failed - Provided SAML … --- ## [Length of a field - Multi-line](https://discuss.elastic.co/t/length-of-a-field-multi-line/256300)
**Author:** [@bevano](https://discuss.elastic.co/u/bevano)\ **Replies:** 0\ **Last updated:** [November 23, 2020, 4:48am UTC](https://discuss.elastic.co/t/length-of-a-field-multi-line/256300 "2020-11-23T04:48:20Z")
Hi All, Need some help with writing a query. I have a field called receipttext (mapped as a text and keyword) and it contains data that spans over multiple lines (eg. think of a receipt that you get from a purchase). I… --- ## [Page not Found /management/kibana/settings](https://discuss.elastic.co/t/page-not-found-management-kibana-settings/256255)
**Author:** [@zbioe](https://discuss.elastic.co/u/zbioe)\ **Replies:** 4\ **Last updated:** [November 23, 2020, 4:01am UTC](https://discuss.elastic.co/t/page-not-found-management-kibana-settings/256255 "2020-11-23T04:01:30Z")
When i go to Visualize in elasticsearch, i see this message. When i click in the link, who sees like: https://kibana.example.com.com/app/visualize#/management/kibana/settings I go to this error page Someone can h… --- ## [Format email in the Alerting and Actions](https://discuss.elastic.co/t/format-email-in-the-alerting-and-actions/254505)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 1:33am UTC](https://discuss.elastic.co/t/format-email-in-the-alerting-and-actions/254505 "2020-11-23T01:33:24Z")
Hi all, I want to format the mail that when SIEM or system monitor send mail there will be some information that i can see so i dont really have to access SIEM app to see them. From what i know the watcher has that for… --- ## [Filebeat 7.10 doesn't follow log while log rotation occur](https://discuss.elastic.co/t/filebeat-7-10-doesnt-follow-log-while-log-rotation-occur/256034)
**Author:** [@Mahoni](https://discuss.elastic.co/u/Mahoni)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 12:33am UTC](https://discuss.elastic.co/t/filebeat-7-10-doesnt-follow-log-while-log-rotation-occur/256034 "2020-11-23T00:33:46Z")
filebeat 7.10 doesn't follow log while log rotation occur, log files inode number is changing but filebeat doesn't follow the log file; # ls -ltr /logs/user-app.tomcat/applicationLogs/tra\*.log\* -rw-r--r-- 1 use… --- ## [Index Lifecycle Policies vs Rollup Jobs](https://discuss.elastic.co/t/index-lifecycle-policies-vs-rollup-jobs/256290)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 12:14am UTC](https://discuss.elastic.co/t/index-lifecycle-policies-vs-rollup-jobs/256290 "2020-11-23T00:14:28Z")
Hello, Can someone explain the main differences between Index Lifecycle Policies vs Rollup Jobs? Thank you! --- ## [Watcher that outputs the total number of snapshots in a repository](https://discuss.elastic.co/t/watcher-that-outputs-the-total-number-of-snapshots-in-a-repository/256244)
**Author:** [@mwise29](https://discuss.elastic.co/u/mwise29)\ **Replies:** 0\ **Last updated:** [November 21, 2020, 10:09pm UTC](https://discuss.elastic.co/t/watcher-that-outputs-the-total-number-of-snapshots-in-a-repository/256244 "2020-11-21T22:09:48Z")
How do I get the total number of snapshots from a repository with this input? I've tried ctx.payload.hits and ctx.payload.hits.value but the value is blank. Any help would be greatly appreciated. "input" : { "ht… --- ## [Kibana add wrong duplicate values](https://discuss.elastic.co/t/kibana-add-wrong-duplicate-values/256256)
**Author:** [@Mohammad\_Mousavi](https://discuss.elastic.co/u/Mohammad_Mousavi)\ **Replies:** 1\ **Last updated:** [November 22, 2020, 11:55pm UTC](https://discuss.elastic.co/t/kibana-add-wrong-duplicate-values/256256 "2020-11-22T23:55:27Z")
Hi, This is a sample from discovery section in kibana. It happens only some times that values are duplicate. The exact log in Grok Debugger looks fine. Whys this is happening? I've added this line to logstash but not… --- ## [Kibana Dev Tools: can the commands in console be saved?](https://discuss.elastic.co/t/kibana-dev-tools-can-the-commands-in-console-be-saved/256263)
**Author:** [@smlbiobot](https://discuss.elastic.co/u/smlbiobot)\ **Replies:** 1\ **Last updated:** [November 22, 2020, 10:59pm UTC](https://discuss.elastic.co/t/kibana-dev-tools-can-the-commands-in-console-be-saved/256263 "2020-11-22T22:59:39Z")
Right now, the commands in the Kibana Dev Tools console appears to be tied to the browser. If you change computers or use a different browser session, it is gone completely. It is probably implemented this way because t… --- ## [Group\_concat aggragation](https://discuss.elastic.co/t/group-concat-aggragation/256285)
**Author:** [@chupacabra](https://discuss.elastic.co/u/chupacabra)\ **Replies:** 0\ **Last updated:** [November 22, 2020, 9:15pm UTC](https://discuss.elastic.co/t/group-concat-aggragation/256285 "2020-11-22T21:15:40Z")
Hello everybody. I am new to elasticsearch and I would like to create a group\_concat aggregation. But I don't know how. Can someone help me please. The example data: POST /example\_measures/\_bulk {"index":{"\_id"… --- ## [ILM in kubernetes](https://discuss.elastic.co/t/ilm-in-kubernetes/255603)
**Author:** [@Armen\_Khachikyan](https://discuss.elastic.co/u/Armen_Khachikyan)\ **Replies:** 4\ **Last updated:** [November 22, 2020, 8:09pm UTC](https://discuss.elastic.co/t/ilm-in-kubernetes/255603 "2020-11-22T20:09:24Z")
community I need your help, I am using ELK like 3 months, and now I need to add ILM policy in elasticsearch pod in kubernetes with curl -XPUT -u username:password http://localhost:9200/\_ilm/policy/name --header "Conte… --- ## [Set custom @timestamp from fields not working](https://discuss.elastic.co/t/set-custom-timestamp-from-fields-not-working/256262)
**Author:** [@nino](https://discuss.elastic.co/u/nino)\ **Replies:** 2\ **Last updated:** [November 22, 2020, 5:31pm UTC](https://discuss.elastic.co/t/set-custom-timestamp-from-fields-not-working/256262 "2020-11-22T17:31:48Z")
Hello all, i need help setting @timestamp from fields, why date plugin is not parsing my custom fill\_date correctly? mutate { add\_field =\> { "fill\_date" =\> "%{FillDate} %{FillTime}" } } date { timezone =\> "UCT… --- ## [Got response code '400' contacting Elasticsearch](https://discuss.elastic.co/t/got-response-code-400-contacting-elasticsearch/256276)
**Author:** [@Rnx](https://discuss.elastic.co/u/Rnx)\ **Replies:** 1\ **Last updated:** [November 22, 2020, 2:35pm UTC](https://discuss.elastic.co/t/got-response-code-400-contacting-elasticsearch/256276 "2020-11-22T14:35:08Z")
Using local instance of Logstash 7.10. with output to Cloud services made an horror hours to me as it is 'pretty bad not telling a thing' issue, however: If your Logstash starts properly and connects to a cloud; If you… --- ## [Elasticsearch 7.9.3 upgrade - GC issues](https://discuss.elastic.co/t/elasticsearch-7-9-3-upgrade-gc-issues/256257)
**Author:** [@Lior\_Yakobov](https://discuss.elastic.co/u/Lior_Yakobov)\ **Replies:** 3\ **Last updated:** [November 22, 2020, 2:34pm UTC](https://discuss.elastic.co/t/elasticsearch-7-9-3-upgrade-gc-issues/256257 "2020-11-22T14:34:02Z")
Hello, I have started the upgrade process to Elasticsearch-7.9.3 and I see that although I was using CMS GC before, and G1GC configurations are commented out, the instance starts and logs indicates that G1GC is used. W… --- ## [How to get a scripted field value as metric in heatmap](https://discuss.elastic.co/t/how-to-get-a-scripted-field-value-as-metric-in-heatmap/255707)
**Author:** [@preeti1211](https://discuss.elastic.co/u/preeti1211)\ **Replies:** 4\ **Last updated:** [November 22, 2020, 12:21pm UTC](https://discuss.elastic.co/t/how-to-get-a-scripted-field-value-as-metric-in-heatmap/255707 "2020-11-22T12:21:20Z")
My scenario - On heatmap, I want y axis to be defined in three rows, one for each environment(dev,test,val) and x axis should correspond to latest 10 builds for each environment. Each cell in a heatmap represents a uni… --- ## [Dynamic color changing text box based on Pipeline Build Status](https://discuss.elastic.co/t/dynamic-color-changing-text-box-based-on-pipeline-build-status/254443)
**Author:** [@sachin1112](https://discuss.elastic.co/u/sachin1112)\ **Replies:** 22\ **Last updated:** [November 22, 2020, 12:20pm UTC](https://discuss.elastic.co/t/dynamic-color-changing-text-box-based-on-pipeline-build-status/254443 "2020-11-22T12:20:20Z")
Hello , I am trying to create a textbox whose background color will change based on the status of the latest build. I need this visualization on Dashboard rather than on canvas. Thanks, Sachin --- ## [Can't start auditbeat](https://discuss.elastic.co/t/cant-start-auditbeat/255097)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 24\ **Last updated:** [November 22, 2020, 10:18am UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097 "2020-11-22T10:18:32Z")
I have installed auditbeat (latest version). This is my config file (I hid the output.logstash/kibana part as it's irrelevant and has sensitive data. Also, it doesn't even have audit rules - it didn't work before so I r… --- ## [Logstash S3 Input Error](https://discuss.elastic.co/t/logstash-s3-input-error/256250)
**Author:** [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)\ **Replies:** 1\ **Last updated:** [November 22, 2020, 7:22am UTC](https://discuss.elastic.co/t/logstash-s3-input-error/256250 "2020-11-22T07:22:39Z")
Hi All, I am getting this error while running logstash with S3 input plugin. Is there anything wrong with my config. include\_object\_properties=\>false\> Error: Net::OpenTimeout Exception: Seahorse::Client::Networkin… --- ## [How to use S3 Input Plugin with assume role\_arn](https://discuss.elastic.co/t/how-to-use-s3-input-plugin-with-assume-role-arn/256248)
**Author:** [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)\ **Replies:** 0\ **Last updated:** [November 22, 2020, 1:52am UTC](https://discuss.elastic.co/t/how-to-use-s3-input-plugin-with-assume-role-arn/256248 "2020-11-22T01:52:08Z")
Hi, I am trying to find a way to use the S3 input plugin to ingest AWS Cloudtrail data. I have the config working but the way I am doing doesn't seem to be streamlined. So this is how I am able to make it work till now. … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1682) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1684)