# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1712 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1713 --- ## [Unable to start Elasticsearch service in centos](https://discuss.elastic.co/t/unable-to-start-elasticsearch-service-in-centos/254439)
**Author:** [@Dhamodharan](https://discuss.elastic.co/u/Dhamodharan)\ **Replies:** 7\ **Last updated:** [November 6, 2020, 12:24pm UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-service-in-centos/254439 "2020-11-06T12:24:20Z")
Recently setup elk stack, but unable to start the es service, its throwing the below error when i run "journalctl -xe" Also the logs of elasticsearch Can someone help me on this? --- ## [Analyzing PCAP's with Zeek(Bro) in offline mode](https://discuss.elastic.co/t/analyzing-pcaps-with-zeek-bro-in-offline-mode/254515)
**Author:** [@shabi037](https://discuss.elastic.co/u/shabi037)\ **Replies:** 3\ **Last updated:** [November 6, 2020, 11:53am UTC](https://discuss.elastic.co/t/analyzing-pcaps-with-zeek-bro-in-offline-mode/254515 "2020-11-06T11:53:04Z")
Hi all, I am using Zeek to analyze the pcaps in the offline mode. To run the pcap i use command "sudo zeek -r /path/to/file.pcap. It generates the logs (dns.log, http.log, ssl.log etc) in the /opt/zeek/logs/current fold… --- ## [Conditionals with nested fields in logstash not working](https://discuss.elastic.co/t/conditionals-with-nested-fields-in-logstash-not-working/254424)
**Author:** [@darlin](https://discuss.elastic.co/u/darlin)\ **Replies:** 2\ **Last updated:** [November 6, 2020, 11:50am UTC](https://discuss.elastic.co/t/conditionals-with-nested-fields-in-logstash-not-working/254424 "2020-11-06T11:50:33Z")
Hi, somehow when we use the input http plugin afterwards the conditionals with nested fields are not working. I've already tried with a non nested field and then it is working. With the below configuration the request … --- ## [Replace and Datatype conversion](https://discuss.elastic.co/t/replace-and-datatype-conversion/254491)
**Author:** [@Ganesh\_Kannan\_K\_S](https://discuss.elastic.co/u/Ganesh_Kannan_K_S)\ **Replies:** 2\ **Last updated:** [November 6, 2020, 11:25am UTC](https://discuss.elastic.co/t/replace-and-datatype-conversion/254491 "2020-11-06T11:25:05Z")
/Folder enumeration completed (6 s)/ This is a sample log. I need to get the number from this string Message. So I tried to split , replace and convert. That didn't work. I tried to create a scripted field first by spli… --- ## [Task not found after Elasticsearch restart](https://discuss.elastic.co/t/task-not-found-after-elasticsearch-restart/254518)
**Author:** [@nisham](https://discuss.elastic.co/u/nisham)\ **Replies:** 0\ **Last updated:** [November 6, 2020, 10:57am UTC](https://discuss.elastic.co/t/task-not-found-after-elasticsearch-restart/254518 "2020-11-06T10:57:12Z")
Hello, I had a reindexing task running, in between my Elasticsearch (7.9.1) got restarted. When I tried to get that task information using taks API its giving resource\_not\_found\_exception and "task \[2Wdrswwr433ss:11111\]… --- ## [Build Custom RPM and DEB packages](https://discuss.elastic.co/t/build-custom-rpm-and-deb-packages/254275)
**Author:** [@Domenico](https://discuss.elastic.co/u/Domenico)\ **Replies:** 5\ **Last updated:** [November 6, 2020, 10:39am UTC](https://discuss.elastic.co/t/build-custom-rpm-and-deb-packages/254275 "2020-11-06T10:39:27Z")
Hi, we need to build rpm and deb packages with custom binary and service names. I have searched for a way to build from source code but most of the posts/topics are related to old versions and have broken link to github. … --- ## [Doing computation on count aggregation in heatmap](https://discuss.elastic.co/t/doing-computation-on-count-aggregation-in-heatmap/254513)
**Author:** [@josefy](https://discuss.elastic.co/u/josefy)\ **Replies:** 0\ **Last updated:** [November 6, 2020, 10:16am UTC](https://discuss.elastic.co/t/doing-computation-on-count-aggregation-in-heatmap/254513 "2020-11-06T10:16:11Z")
Hi, I created a heatmap visualization. For the x-axis I have a date histogram, for the y-axis I have a "Terms" aggregation. For metrics I'm currently using the "Count" aggregation. What I actually want is the "Count" d… --- ## [Logtrail integration with kibana](https://discuss.elastic.co/t/logtrail-integration-with-kibana/252855)
**Author:** [@sudhakar\_u](https://discuss.elastic.co/u/sudhakar_u)\ **Replies:** 4\ **Last updated:** [November 6, 2020, 9:57am UTC](https://discuss.elastic.co/t/logtrail-integration-with-kibana/252855 "2020-11-06T09:57:03Z")
I have EFK stack setup on the Azure Kubernetes Cluster. How can i update the kibana image to have the logtrail? Pls let us know if you need further details.This is the kibana docker image iam using image: docker.elastic… --- ## [Authentication for kibana, unknown setting xpack.security.enabled](https://discuss.elastic.co/t/authentication-for-kibana-unknown-setting-xpack-security-enabled/254434)
**Author:** [@oobi89](https://discuss.elastic.co/u/oobi89)\ **Replies:** 5\ **Last updated:** [November 6, 2020, 9:47am UTC](https://discuss.elastic.co/t/authentication-for-kibana-unknown-setting-xpack-security-enabled/254434 "2020-11-06T09:47:25Z")
I've had Elasticsearch and kibana as part of my docker-compose stack for some project for a while but now I need to add authentication for kibana and came across a strange problem. According to docs I need to set xpack.s… --- ## [Passing time parameter to logstash-jdbc-input](https://discuss.elastic.co/t/passing-time-parameter-to-logstash-jdbc-input/254487)
**Author:** [@blukit](https://discuss.elastic.co/u/blukit)\ **Replies:** 2\ **Last updated:** [November 6, 2020, 8:44am UTC](https://discuss.elastic.co/t/passing-time-parameter-to-logstash-jdbc-input/254487 "2020-11-06T08:44:48Z")
Hi guys... Noobs here, so be gentle:) Is it possible to pass time parameter from top-right kibana web UI into logstash-jdbc-input statement? Passing something like: startTime-endTime, or last 3 hours. Thanks in advan… --- ## [Kibana 7.9.2 Controls issue](https://discuss.elastic.co/t/kibana-7-9-2-controls-issue/252221)
**Author:** [@Roy\_Zhang](https://discuss.elastic.co/u/Roy_Zhang)\ **Replies:** 5\ **Last updated:** [November 6, 2020, 8:42am UTC](https://discuss.elastic.co/t/kibana-7-9-2-controls-issue/252221 "2020-11-06T08:42:32Z")
Dear Kibana experts, After I upgrade to Kibana 7.9.2, there are some issue for Controls. It can work in Kibana 7.6.2. For the following graph, I select one item from Controls in my Kibana dashboard, it shows warning in… --- ## [Eland and Elk 7.6](https://discuss.elastic.co/t/eland-and-elk-7-6/254495)
**Author:** [@vinod\_kumar](https://discuss.elastic.co/u/vinod_kumar)\ **Replies:** 2\ **Last updated:** [November 6, 2020, 8:20am UTC](https://discuss.elastic.co/t/eland-and-elk-7-6/254495 "2020-11-06T08:20:12Z")
I want to know if we can configure Eland using free version of ELK 7.6. --- ## [Metricbeat setup overwrite Elastic Agent built in UI (Dashboard and Visualization)](https://discuss.elastic.co/t/metricbeat-setup-overwrite-elastic-agent-built-in-ui-dashboard-and-visualization/254235)
**Author:** [@nugroho-expereo](https://discuss.elastic.co/u/nugroho-expereo)\ **Replies:** 5\ **Last updated:** [November 6, 2020, 8:11am UTC](https://discuss.elastic.co/t/metricbeat-setup-overwrite-elastic-agent-built-in-ui-dashboard-and-visualization/254235 "2020-11-06T08:11:09Z")
Hi all, I have an issue during elastic agent evaluation in Elastic Cloud 7.9.3 (Managed EC). I can successfully setup agent on several machines (Windows and Linux) with system and endpoint-security integrations. Data is… --- ## [Got this error "Error loading data" when we search for :,\<,\> in Discover page on kibana UI](https://discuss.elastic.co/t/got-this-error-error-loading-data-when-we-search-for-in-discover-page-on-kibana-ui/249953)
**Author:** [@prashant1](https://discuss.elastic.co/u/prashant1)\ **Replies:** 11\ **Last updated:** [November 6, 2020, 8:04am UTC](https://discuss.elastic.co/t/got-this-error-error-loading-data-when-we-search-for-in-discover-page-on-kibana-ui/249953 "2020-11-06T08:04:23Z")
In the discover tab when we try to search for :,\<,\> etc we got a error "Error loading data" on Kibana UI. Please refer to the attachment. --- ## [Lucene Documents](https://discuss.elastic.co/t/lucene-documents/254378)
**Author:** [@tsp](https://discuss.elastic.co/u/tsp)\ **Replies:** 2\ **Last updated:** [November 6, 2020, 8:00am UTC](https://discuss.elastic.co/t/lucene-documents/254378 "2020-11-06T08:00:05Z")
Hi all, I am not too sure that this is the right place. But we are new to build our own full-text engine. We are planning to index files on the fly using the Lucence Java API. That would be an easy requirement as such,… --- ## [Gsuite module in Filebeat not generating logs](https://discuss.elastic.co/t/gsuite-module-in-filebeat-not-generating-logs/254288)
**Author:** [@Edwin.v](https://discuss.elastic.co/u/Edwin.v)\ **Replies:** 13\ **Last updated:** [November 6, 2020, 7:55am UTC](https://discuss.elastic.co/t/gsuite-module-in-filebeat-not-generating-logs/254288 "2020-11-06T07:55:01Z")
Gsuite module in Filebeat not pushing the logs to Elasticsearch. I have configured the service account and domain wide delegation and setup the proper scope required. Still it throws back a error code 401 which says cann… --- ## [Why I am getting one huge metricbeat index instead of daily indices?](https://discuss.elastic.co/t/why-i-am-getting-one-huge-metricbeat-index-instead-of-daily-indices/252789)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 7\ **Last updated:** [November 6, 2020, 7:15am UTC](https://discuss.elastic.co/t/why-i-am-getting-one-huge-metricbeat-index-instead-of-daily-indices/252789 "2020-11-06T07:15:19Z")
Hi, I am using elastic stack 7.9.2. I have set up metricbeat and it is exporting to elasticsearch. I haven't modified the index name setting in metricbeat.yml and is taking the default setting index: "metricbeat-%{\[agen… --- ## [Visualize a value calculated from the per-bucket sum of one field divided by the per-bucket sum of another?](https://discuss.elastic.co/t/visualize-a-value-calculated-from-the-per-bucket-sum-of-one-field-divided-by-the-per-bucket-sum-of-another/254359)
**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\ **Replies:** 3\ **Last updated:** [November 6, 2020, 4:17am UTC](https://discuss.elastic.co/t/visualize-a-value-calculated-from-the-per-bucket-sum-of-one-field-divided-by-the-per-bucket-sum-of-another/254359 "2020-11-06T04:17:49Z")
I have data in JSON Lines format that contains statistics about the tasks performed by a system over an interval of time. (The specific definition of "task" here is not important.) Each line of JSON Lines contains, amon… --- ## [Cancel a forcemerge operation](https://discuss.elastic.co/t/cancel-a-forcemerge-operation/254481)
**Author:** [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Replies:** 1\ **Last updated:** [November 6, 2020, 4:32am UTC](https://discuss.elastic.co/t/cancel-a-forcemerge-operation/254481 "2020-11-06T04:32:24Z")
Is there a way to cancel and on-going \[\_forcemerge\](https://www.elastic.co/guide/en/elasticsearch/reference/6.8/indices-forcemerge.html#indices-forcemerge) operation? ES Version 6.8.6. --- ## [Add new fields](https://discuss.elastic.co/t/add-new-fields/254017)
**Author:** [@Sakthivanan](https://discuss.elastic.co/u/Sakthivanan)\ **Replies:** 1\ **Last updated:** [November 6, 2020, 4:27am UTC](https://discuss.elastic.co/t/add-new-fields/254017 "2020-11-06T04:27:58Z")
\*\*I'm trying to add new hardcoded field in logstash filter:\*\* My logstash config: input { elasticsearch { hosts =\> "http://localhost:9200" index =\> "ccee\_mathematics\_academic\_indicator\_2018"… --- ## [Logstash: manipulate json data](https://discuss.elastic.co/t/logstash-manipulate-json-data/254198)
**Author:** [@nameisnotimportant](https://discuss.elastic.co/u/nameisnotimportant)\ **Replies:** 7\ **Last updated:** [November 6, 2020, 1:50am UTC](https://discuss.elastic.co/t/logstash-manipulate-json-data/254198 "2020-11-06T01:50:36Z")
Hi, i retrieved data from ES and would like to add/modify the json data before index it. My json data looks like below: { "john" : { "enabled" : true, "roles" : \[ "developer" \], "rules" : { … --- ## [Dedicated ml index for apm high\_mean\_transaction\_duration](https://discuss.elastic.co/t/dedicated-ml-index-for-apm-high-mean-transaction-duration/254411)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [November 6, 2020, 1:40am UTC](https://discuss.elastic.co/t/dedicated-ml-index-for-apm-high-mean-transaction-duration/254411 "2020-11-06T01:40:26Z")
Hello, Currently the auto-created ml job apm-pr-d40c-high\_mean\_transaction\_duration saves it's model in the shared ml index. This is problematic, as this index contains sensitive information which we cannot open for dev… --- ## [Index data conflict with another](https://discuss.elastic.co/t/index-data-conflict-with-another/254271)
**Author:** [@mustafa.husny](https://discuss.elastic.co/u/mustafa.husny)\ **Replies:** 12\ **Last updated:** [November 5, 2020, 11:55pm UTC](https://discuss.elastic.co/t/index-data-conflict-with-another/254271 "2020-11-05T23:55:18Z")
Hi All, I installed Heartbeat and changed the pipeline to be (Heartbeat ==\> Logstash ===\> Elasticsearch) and I loaded the heartbeat dashboards, Also I have its logs, and logs forwarded from (IBM Qradar), My issue is t… --- ## [Cron in http\_poller still triggering after changing the pipeline configuration](https://discuss.elastic.co/t/cron-in-http-poller-still-triggering-after-changing-the-pipeline-configuration/254367)
**Author:** [@fbenaven](https://discuss.elastic.co/u/fbenaven)\ **Replies:** 5\ **Last updated:** [November 5, 2020, 10:34pm UTC](https://discuss.elastic.co/t/cron-in-http-poller-still-triggering-after-changing-the-pipeline-configuration/254367 "2020-11-05T22:34:46Z")
Hi, We have a pipeline configuration using some http\_poller as inputs. After changing the config from "cron" format (at '15 of all hours) to "every" (hourly basis), we see that the poller triggers hourly as intended bu… --- ## [Convert Gauge to and from Celsius/Fahrenheit](https://discuss.elastic.co/t/convert-gauge-to-and-from-celsius-fahrenheit/254464)
**Author:** [@JeffSmith](https://discuss.elastic.co/u/JeffSmith)\ **Replies:** 1\ **Last updated:** [November 5, 2020, 10:20pm UTC](https://discuss.elastic.co/t/convert-gauge-to-and-from-celsius-fahrenheit/254464 "2020-11-05T22:20:41Z")
One thing that has always stumped me is converting a value in a visualization. I would like to have a gauge that display the current temperature. The data source is in fahrenheit but a lot of people seeing the gauge a… --- ## [Alternative for CentOS 5 machines](https://discuss.elastic.co/t/alternative-for-centos-5-machines/254396)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 2\ **Last updated:** [November 5, 2020, 9:58pm UTC](https://discuss.elastic.co/t/alternative-for-centos-5-machines/254396 "2020-11-05T21:58:18Z")
I've deployed beats on most servers and it works really well. The only problem is that there are about 10 machines left that still run CentOS 5.4 and cannot be updated. I've tried installing filebeat but it said the ker… --- ## [Why Elastic search doesn't support storing encrypted data](https://discuss.elastic.co/t/why-elastic-search-doesnt-support-storing-encrypted-data/254375)
**Author:** [@Vivek\_Sagar](https://discuss.elastic.co/u/Vivek_Sagar)\ **Replies:** 1\ **Last updated:** [November 5, 2020, 9:57pm UTC](https://discuss.elastic.co/t/why-elastic-search-doesnt-support-storing-encrypted-data/254375 "2020-11-05T21:57:16Z")
As in previous discussion, ES works on encrypted volumes(dm-crypt). Is there any specific reason why it does not support storing and searching on encrypted data? --- ## [Logstash could not index event to Elasticsearch](https://discuss.elastic.co/t/logstash-could-not-index-event-to-elasticsearch/254234)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 3\ **Last updated:** [November 5, 2020, 9:44pm UTC](https://discuss.elastic.co/t/logstash-could-not-index-event-to-elasticsearch/254234 "2020-11-05T21:44:31Z")
Hello eveybody, I am using Logstash to parse my firewall logs, and in some logs I am getting that errors: \[2020-11-03T16:07:22,361\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main\]\[f05eea78ee20871f68357cbab5919471405decdd5… --- ## [Metricbeat elasticsearch-xpack errors](https://discuss.elastic.co/t/metricbeat-elasticsearch-xpack-errors/253758)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 3\ **Last updated:** [November 5, 2020, 9:42pm UTC](https://discuss.elastic.co/t/metricbeat-elasticsearch-xpack-errors/253758 "2020-11-05T21:42:01Z")
After 7.9.2 upgrade I've lost monitoring data on the "indexes" tab. I've found errors like this on metricbeat on the active master node: Error fetching data for metricset elasticsearch.index\_summary: HTTP error 400 in… --- ## [Unable to start elasticsearch on centos 7 server](https://discuss.elastic.co/t/unable-to-start-elasticsearch-on-centos-7-server/254276)
**Author:** [@valsaraj\_pv](https://discuss.elastic.co/u/valsaraj_pv)\ **Replies:** 3\ **Last updated:** [November 5, 2020, 9:41pm UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-on-centos-7-server/254276 "2020-11-05T21:41:58Z")
After installation, we got following error when started the service: \[2020-11-04T07:20:12,233\]\[WARN \]\[o.e.b.Natives \] \[test\] unable to load JNA native support library, native methods will be disabled. java.lang.Unsati… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1711) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1713)