# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1719 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1720 --- ## [Unable to access secured Elasticsearch using logstash](https://discuss.elastic.co/t/unable-to-access-secured-elasticsearch-using-logstash/253093)
**Author:** [@aakash075](https://discuss.elastic.co/u/aakash075)\ **Replies:** 5\ **Last updated:** [November 3, 2020, 7:07am UTC](https://discuss.elastic.co/t/unable-to-access-secured-elasticsearch-using-logstash/253093 "2020-11-03T07:07:51Z")
Hello Team, I am using Openshift environment and i deployed EFK (Elasticsearch, fluentd and Kibana) stack in it using some logging operators . and then due to some requirement i deployed Logstash as docker container in… --- ## [Sum of bucket script](https://discuss.elastic.co/t/sum-of-bucket-script/254110)
**Author:** [@gokul275](https://discuss.elastic.co/u/gokul275)\ **Replies:** 0\ **Last updated:** [November 3, 2020, 7:00am UTC](https://discuss.elastic.co/t/sum-of-bucket-script/254110 "2020-11-03T07:00:48Z")
I am trying to achieve sum of bucket script values, Is it possible? { "aggs": { "NAME": { "terms": { "field": "date", "size": 10 }, "aggs": { "bal": { "sum": { "field": "balance" } }, "rdb" : { "sum": { "… --- ## [Source a file from inside a logstash config pipeline?](https://discuss.elastic.co/t/source-a-file-from-inside-a-logstash-config-pipeline/254103)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 0\ **Last updated:** [November 3, 2020, 5:22am UTC](https://discuss.elastic.co/t/source-a-file-from-inside-a-logstash-config-pipeline/254103 "2020-11-03T05:22:38Z")
Here's my logstash input config: input { snmp { tables =\> \[ { "name" =\> "interfaces" "columns" =\> \[ ".1.3.6.1.2.1.31.1.1.1.1" … --- ## [Beats\_system role](https://discuss.elastic.co/t/beats-system-role/253391)
**Author:** [@gquintana](https://discuss.elastic.co/u/gquintana)\ **Replies:** 6\ **Last updated:** [November 3, 2020, 5:07am UTC](https://discuss.elastic.co/t/beats-system-role/253391 "2020-11-03T05:07:18Z")
I've set up an Elastic Stack 7.9.2 and enabled basic security. Metricbeat can not use to Elasticsearch user beats\_system because of a lack of permissions. The documentation Built-in users | Elasticsearch Guide \[8.11\] |… --- ## [When I created logstash offline pack, it doesn't contain the change](https://discuss.elastic.co/t/when-i-created-logstash-offline-pack-it-doesnt-contain-the-change/253983)
**Author:** [@hyon](https://discuss.elastic.co/u/hyon)\ **Replies:** 1\ **Last updated:** [November 3, 2020, 4:52am UTC](https://discuss.elastic.co/t/when-i-created-logstash-offline-pack-it-doesnt-contain-the-change/253983 "2020-11-03T04:52:08Z")
I want to modify the logstash integration rabbitmq plugin and use it (https://github.com/logstash-plugins/logstash-integration-rabbitmq.git) I modified the inputs/rabbitmq.rb and confirmed that it works properly on my l… --- ## [Kibana Email and Call Button](https://discuss.elastic.co/t/kibana-email-and-call-button/253977)
**Author:** [@Syed.Ubaid](https://discuss.elastic.co/u/Syed.Ubaid)\ **Replies:** 5\ **Last updated:** [November 3, 2020, 4:08am UTC](https://discuss.elastic.co/t/kibana-email-and-call-button/253977 "2020-11-03T04:08:54Z")
Hello. I have made dashboard in Kibana. Can we create email and call button in Kibana visualisation. For example i have list of people who have expired identification card number i want to create action button of email a… --- ## [Memcached filter plugin issues](https://discuss.elastic.co/t/memcached-filter-plugin-issues/254095)
**Author:** [@aleksf](https://discuss.elastic.co/u/aleksf)\ **Replies:** 0\ **Last updated:** [November 3, 2020, 3:48am UTC](https://discuss.elastic.co/t/memcached-filter-plugin-issues/254095 "2020-11-03T03:48:06Z")
I was hoping this was fixed in https://github.com/logstash-plugins/logstash-filter-memcached/pull/25 with the plugin release v1.1.0 Related issue was already raised in https://discuss.elastic.co/t/catch-memcached-filter… --- ## [XML Filter Output to Ruby Code](https://discuss.elastic.co/t/xml-filter-output-to-ruby-code/253870)
**Author:** [@chayelastic](https://discuss.elastic.co/u/chayelastic)\ **Replies:** 7\ **Last updated:** [November 3, 2020, 2:22am UTC](https://discuss.elastic.co/t/xml-filter-output-to-ruby-code/253870 "2020-11-03T02:22:40Z")
Hello, In my Logstash config, I have an XML filter with xpath that allows me to read the XML tags and store in a variable/field. It works well. Next step, I had to use a Ruby Filter for I need to transpose a couple o… --- ## [Filtering all Fields/Events](https://discuss.elastic.co/t/filtering-all-fields-events/254088)
**Author:** [@faridNR](https://discuss.elastic.co/u/faridNR)\ **Replies:** 1\ **Last updated:** [November 3, 2020, 2:21am UTC](https://discuss.elastic.co/t/filtering-all-fields-events/254088 "2020-11-03T02:21:55Z")
Hello Having a centralized log-stream using Logstash with more than hundreds of fields/events types. I'm trying to apply filter to all events/fields and replacing a regex in this case email address. (removing PII) wha… --- ## [Daily watcher is not running on its scheduled time](https://discuss.elastic.co/t/daily-watcher-is-not-running-on-its-scheduled-time/253896)
**Author:** [@Wilbert\_Silverio](https://discuss.elastic.co/u/Wilbert_Silverio)\ **Replies:** 1\ **Last updated:** [November 3, 2020, 2:06am UTC](https://discuss.elastic.co/t/daily-watcher-is-not-running-on-its-scheduled-time/253896 "2020-11-03T02:06:57Z")
Hi Everyone just wanted to ask questions here, I've created a watcher that would run from 23:00 to 08:00 am eastern, minute 30th, 59th { "trigger": { "schedule": { "daily": { "at": \[ { … --- ## [Kibana 7.9.3 in sublocation in Nginx](https://discuss.elastic.co/t/kibana-7-9-3-in-sublocation-in-nginx/253919)
**Author:** [@msteini](https://discuss.elastic.co/u/msteini)\ **Replies:** 2\ **Last updated:** [November 3, 2020, 1:58am UTC](https://discuss.elastic.co/t/kibana-7-9-3-in-sublocation-in-nginx/253919 "2020-11-03T01:58:24Z")
Since two days I tried several configurations to run Kibana 7.9.3 (via docker-compose) at a sublocation (for developing on my local machine at https://localhost/analytics/) via Nginx, but it do not work. I hope someone c… --- ## [\[Watcher\] 550 Access denied - Invalid HELO name (See RFC2821 4.1.1.1)](https://discuss.elastic.co/t/watcher-550-access-denied-invalid-helo-name-see-rfc2821-4-1-1-1/253806)
**Author:** [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Replies:** 3\ **Last updated:** [November 3, 2020, 1:32am UTC](https://discuss.elastic.co/t/watcher-550-access-denied-invalid-helo-name-see-rfc2821-4-1-1-1/253806 "2020-11-03T01:32:10Z")
When running watcher with email action, we are getting this error : 550 Access denied - Invalid HELO name (See RFC2821 4.1.1.1) We use a corporate SMTP server, elasticsearch.yml config looks like this xpack.notificati… --- ## [Elasticserach stuck](https://discuss.elastic.co/t/elasticserach-stuck/253735)
**Author:** [@Rafael\_Valverde](https://discuss.elastic.co/u/Rafael_Valverde)\ **Replies:** 2\ **Last updated:** [November 3, 2020, 1:27am UTC](https://discuss.elastic.co/t/elasticserach-stuck/253735 "2020-11-03T01:27:56Z")
Elasticsearch after restart it. I ran curl -u admin\_elasticsearch -X DELETE https://elasticsearch.bitbucket.com/bitbucket-search then I rebuilt it curl -u rxv112 -X POST -H 'Content-Type: application/json' -H 'Accept:… --- ## ["failed to update expiration time for async-search" in elastic search logs](https://discuss.elastic.co/t/failed-to-update-expiration-time-for-async-search-in-elastic-search-logs/253903)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 6\ **Last updated:** [November 3, 2020, 1:10am UTC](https://discuss.elastic.co/t/failed-to-update-expiration-time-for-async-search-in-elastic-search-logs/253903 "2020-11-03T01:10:16Z")
Hello, I constantly encounter a problem that throws error failed to update expiration time for async-search in elastichserach cluster application log. Not always but especially when I had haven't query an index for a lo… --- ## [Getting uniform results from ES](https://discuss.elastic.co/t/getting-uniform-results-from-es/253649)
**Author:** [@IliaIsakhin](https://discuss.elastic.co/u/IliaIsakhin)\ **Replies:** 1\ **Last updated:** [November 3, 2020, 12:23am UTC](https://discuss.elastic.co/t/getting-uniform-results-from-es/253649 "2020-11-03T00:23:10Z")
I would like to get flat and uniform results from my ES index. I have 3 different types of documents in one index and when user types search query I want to return up to 10 documents of each document type even if results… --- ## [\[Metricbeat\] Kafka Module SASL\_SSL](https://discuss.elastic.co/t/metricbeat-kafka-module-sasl-ssl/254085)
**Author:** [@tomerse](https://discuss.elastic.co/u/tomerse)\ **Replies:** 0\ **Last updated:** [November 3, 2020, 12:19am UTC](https://discuss.elastic.co/t/metricbeat-kafka-module-sasl-ssl/254085 "2020-11-03T00:19:28Z")
Hi, It seems like I'm the only one who uses SASL\_SSL with open-source Kafka in the market as i couldn't find anything related to my issue except from some unclear threads over the internet, I'm trying to get Metricbeat… --- ## [Elasticsearch service throwing failed to parse exception while indexing content](https://discuss.elastic.co/t/elasticsearch-service-throwing-failed-to-parse-exception-while-indexing-content/253651)
**Author:** [@PravinC](https://discuss.elastic.co/u/PravinC)\ **Replies:** 1\ **Last updated:** [November 3, 2020, 12:15am UTC](https://discuss.elastic.co/t/elasticsearch-service-throwing-failed-to-parse-exception-while-indexing-content/253651 "2020-11-03T00:15:21Z")
We are trying to index document in Elasticsearch with below structure, { "data": { "blocks": \[ { "block": { "note": "\Test\", "digital-asset-service": "" } }, … --- ## [Watcher: How to extract @timestamp using transform map?](https://discuss.elastic.co/t/watcher-how-to-extract-timestamp-using-transform-map/253662)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 0\ **Last updated:** [October 29, 2020, 9:20am UTC](https://discuss.elastic.co/t/watcher-how-to-extract-timestamp-using-transform-map/253662 "2020-10-29T09:20:00Z")
In Watcher, i'm trying to extract the @timestamp field from payload return \[ 'my\_group\_array': ctx.payload.hits.hits, 'my\_group\_fields': ctx.payload.hits.hits.stream() .map(t-\>… --- ## [Forcing ILM policy causing cluster to go RED](https://discuss.elastic.co/t/forcing-ilm-policy-causing-cluster-to-go-red/253687)
**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Replies:** 1\ **Last updated:** [November 3, 2020, 12:10am UTC](https://discuss.elastic.co/t/forcing-ilm-policy-causing-cluster-to-go-red/253687 "2020-11-03T00:10:03Z")
I am using settings API to force the ILM policy to all my older indices around 4000k. When I run it, my cluster goes into Red state. I don't know why this would be. Any idea? We have 9 data nodes, 2 client nodes and 3 m… --- ## [How can i access the Kibana indices if i am connected to Kibana via SSH tunnel Putty](https://discuss.elastic.co/t/how-can-i-access-the-kibana-indices-if-i-am-connected-to-kibana-via-ssh-tunnel-putty/253705)
**Author:** [@Saket\_Shankar](https://discuss.elastic.co/u/Saket_Shankar)\ **Replies:** 1\ **Last updated:** [November 3, 2020, 12:09am UTC](https://discuss.elastic.co/t/how-can-i-access-the-kibana-indices-if-i-am-connected-to-kibana-via-ssh-tunnel-putty/253705 "2020-11-03T00:09:35Z")
Elasticsearch : localhost:9200 Kibana : connected via SSH Tunnel Putty Problem : Kibana Indices not reflecting in Elasticsearch --- ## [Watcher did not run](https://discuss.elastic.co/t/watcher-did-not-run/253832)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 0\ **Last updated:** [October 30, 2020, 3:03pm UTC](https://discuss.elastic.co/t/watcher-did-not-run/253832 "2020-10-30T15:03:37Z")
hello i need help with this alert, I want to know why you didn't warn me when there was a fall at 5:45 am { "trigger": { "schedule": { "interval": "24h" } }, "input": { "search": { "req… --- ## [Is it time to rearchitect my clusters?](https://discuss.elastic.co/t/is-it-time-to-rearchitect-my-clusters/253863)
**Author:** [@reshippie](https://discuss.elastic.co/u/reshippie)\ **Replies:** 1\ **Last updated:** [November 2, 2020, 11:40pm UTC](https://discuss.elastic.co/t/is-it-time-to-rearchitect-my-clusters/253863 "2020-11-02T23:40:30Z")
I currently have 3 main clusters, 1 with 19 nodes and 2 with 15 nodes. In all 3 cases I've left things mostly in their default state, with all nodes as data and master eligible. After a disastrous upgrade followed by a… --- ## [Beat can't to create daily index although ilm.enabled=false](https://discuss.elastic.co/t/beat-cant-to-create-daily-index-although-ilm-enabled-false/253887)
**Author:** [@shinydeng](https://discuss.elastic.co/u/shinydeng)\ **Replies:** 1\ **Last updated:** [November 2, 2020, 11:36pm UTC](https://discuss.elastic.co/t/beat-cant-to-create-daily-index-although-ilm-enabled-false/253887 "2020-11-02T23:36:32Z")
HI , i'm new fro ELK , tried to intergret my mulesoft application to ELK. i found beat can't to create daily index although ilm.enabled=false. it always to create filebeat-version-timestamp indices in ELK . Here is my… --- ## [Issues setting up basic Auth on open version of Elasticsearch 7.9.2 .. solved issues](https://discuss.elastic.co/t/issues-setting-up-basic-auth-on-open-version-of-elasticsearch-7-9-2-solved-issues/253908)
**Author:** [@PeterC](https://discuss.elastic.co/u/PeterC)\ **Replies:** 0\ **Last updated:** [October 31, 2020, 5:46pm UTC](https://discuss.elastic.co/t/issues-setting-up-basic-auth-on-open-version-of-elasticsearch-7-9-2-solved-issues/253908 "2020-10-31T17:46:03Z")
Finally solved the many issues in the docs on this. Here are a few pointers to help out., This was solved on a Linux build, so is linux related, abut could also help with Windows. I used this post as an instruction.., a… --- ## [Logstash out knesis](https://discuss.elastic.co/t/logstash-out-knesis/253923)
**Author:** [@111387](https://discuss.elastic.co/u/111387)\ **Replies:** 0\ **Last updated:** [November 1, 2020, 4:55am UTC](https://discuss.elastic.co/t/logstash-out-knesis/253923 "2020-11-01T04:55:43Z")
In logstash, input plugin has knesis, but output plugin is not. There is https://github.com/samcday/logstash-output-kinesis, but it doesn't seem to be being updated anymore. Is there no knesis output method in logstash… --- ## [PacketBeat](https://discuss.elastic.co/t/packetbeat/253678)
**Author:** [@nirav.gshah](https://discuss.elastic.co/u/nirav.gshah)\ **Replies:** 2\ **Last updated:** [November 2, 2020, 11:20pm UTC](https://discuss.elastic.co/t/packetbeat/253678 "2020-11-02T23:20:14Z")
Hi Team, I am trying to use processors to limit data but drop fields and events not working together. processors: drop events: regexp: system.process.name: "svchost\*" drop\_fields: fields: \["\_id", "\_index", "\_s… --- ## [Filebeat zscaler module](https://discuss.elastic.co/t/filebeat-zscaler-module/254049)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 0\ **Last updated:** [November 2, 2020, 3:57pm UTC](https://discuss.elastic.co/t/filebeat-zscaler-module/254049 "2020-11-02T15:57:36Z")
Has anyone got this to work ? I am not getting any data from my zscaler module , everything is default I have it enabled in the module.d Folder First tried the default route with the syslog then tried to change the mod… --- ## [Add CIDR IP range in Timelion](https://discuss.elastic.co/t/add-cidr-ip-range-in-timelion/253247)
**Author:** [@savethebyte](https://discuss.elastic.co/u/savethebyte)\ **Replies:** 2\ **Last updated:** [November 2, 2020, 8:53pm UTC](https://discuss.elastic.co/t/add-cidr-ip-range-in-timelion/253247 "2020-11-02T20:53:27Z")
Is there a way to do a search for an IP range in a Timelion? I need to search a larger amount of time but only with a specific set of IPs. I need to do something like this: .es(index="filebeat-\*", metric="sum:network.b… --- ## [How to manage elasticsearch logs: disk almost full](https://discuss.elastic.co/t/how-to-manage-elasticsearch-logs-disk-almost-full/254061)
**Author:** [@Mauro\_Tridici](https://discuss.elastic.co/u/Mauro_Tridici)\ **Replies:** 13\ **Last updated:** [November 2, 2020, 8:25pm UTC](https://discuss.elastic.co/t/how-to-manage-elasticsearch-logs-disk-almost-full/254061 "2020-11-02T20:25:11Z")
Dear Users, I'm a newbie and this is the first time I use ELK stack. I was able to deploy ELK stack and capture needed information. I created my first dashboard and visualizations. They are working as expected: we are … --- ## [Parameterized looping in watcher query](https://discuss.elastic.co/t/parameterized-looping-in-watcher-query/253323)
**Author:** [@fredrick.bb](https://discuss.elastic.co/u/fredrick.bb)\ **Replies:** 3\ **Last updated:** [November 2, 2020, 8:19pm UTC](https://discuss.elastic.co/t/parameterized-looping-in-watcher-query/253323 "2020-11-02T20:19:02Z")
Hello, I have created a watcher using advanced query in ver 7.8.0. The watcher runs and fulfills my requirement. But I have to reuse the same query for different values (integer). like a function For each value, The … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1718) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1720)