# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1722 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1723 --- ## [\ Use StaticDate and Time for Dev Env and CurrentDateTime for Prod Env](https://discuss.elastic.co/t/ruby-use-staticdate-and-time-for-dev-env-and-currentdatetime-for-prod-env/253925)
**Author:** [@mastersmit](https://discuss.elastic.co/u/mastersmit)\ **Replies:** 1\ **Last updated:** [November 1, 2020, 3:29pm UTC](https://discuss.elastic.co/t/ruby-use-staticdate-and-time-for-dev-env-and-currentdatetime-for-prod-env/253925 "2020-11-01T15:29:01Z")
I have a requirement where I need to use specific date/time for a testing at Ruby scripts and not at Logstash level. Is there a way i could stub those value? Currently I am using the enviorment variable to check if it i… --- ## [Elasticsearch Slowlog methodology clarification](https://discuss.elastic.co/t/elasticsearch-slowlog-methodology-clarification/253940)
**Author:** [@wittydavid](https://discuss.elastic.co/u/wittydavid)\ **Replies:** 0\ **Last updated:** [November 1, 2020, 2:35pm UTC](https://discuss.elastic.co/t/elasticsearch-slowlog-methodology-clarification/253940 "2020-11-01T14:35:14Z")
Hi all, I've read through several sources on slowlogs and I can't get my head around how should I configure it. To my understanding the granularity of the elasticsearch logging levels are from low to high: WARN, INFO, … --- ## [Navigation to kibana discover logs from grafana fails](https://discuss.elastic.co/t/navigation-to-kibana-discover-logs-from-grafana-fails/253854)
**Author:** [@Sadish\_Kumar](https://discuss.elastic.co/u/Sadish_Kumar)\ **Replies:** 3\ **Last updated:** [November 1, 2020, 12:32pm UTC](https://discuss.elastic.co/t/navigation-to-kibana-discover-logs-from-grafana-fails/253854 "2020-11-01T12:32:20Z")
HI team, I have a grafana dashboard with line graph. i want to navigate to kibana logs with corresponding time range provided by grafana. But kibana does nt show the logs on discover. it fails due to time value. This o… --- ## [Kibana development mode, yarn installation](https://discuss.elastic.co/t/kibana-development-mode-yarn-installation/253932)
**Author:** [@omerf](https://discuss.elastic.co/u/omerf)\ **Replies:** 1\ **Last updated:** [November 1, 2020, 9:53am UTC](https://discuss.elastic.co/t/kibana-development-mode-yarn-installation/253932 "2020-11-01T09:53:45Z")
Hi, I have downloaded kibana through git, and am using nvm. When I run the yarn kbn bootstrap, I receive the following error: info \[@kbn/config\] running \[kbn:bootstrap\] script info \[@kbn/es-archiver\] running \[kbn:boot… --- ## [No DevTools menu in Kibana 7.9.2](https://discuss.elastic.co/t/no-devtools-menu-in-kibana-7-9-2/253930)
**Author:** [@aLuViAn](https://discuss.elastic.co/u/aLuViAn)\ **Replies:** 2\ **Last updated:** [November 1, 2020, 9:45am UTC](https://discuss.elastic.co/t/no-devtools-menu-in-kibana-7-9-2/253930 "2020-11-01T09:45:01Z")
Installed ELK stack latest version (elastic,logstash,kibana) to do some testing with nginx log analyze that is being forwarded to syslog. After installation and preliminary configuration, I ran into some issues with the … --- ## [Elasticsearch appears to be unreachable or down](https://discuss.elastic.co/t/elasticsearch-appears-to-be-unreachable-or-down/253751)
**Author:** [@rgovinda](https://discuss.elastic.co/u/rgovinda)\ **Replies:** 3\ **Last updated:** [October 31, 2020, 1:44pm UTC](https://discuss.elastic.co/t/elasticsearch-appears-to-be-unreachable-or-down/253751 "2020-10-31T13:44:41Z")
We suddenly started seeing a huge increase ( from single digits to hundreds) in the error "Attempted to send a bulk request to elasticsearch' but Elasticsearch appears to be unreachable or down!}" This is causing signi… --- ## [Secure elasticsearch with password](https://discuss.elastic.co/t/secure-elasticsearch-with-password/253910)
**Author:** [@Labidi\_Ayoub](https://discuss.elastic.co/u/Labidi_Ayoub)\ **Replies:** 2\ **Last updated:** [October 31, 2020, 10:56pm UTC](https://discuss.elastic.co/t/secure-elasticsearch-with-password/253910 "2020-10-31T22:56:22Z")
Hello elk community, If it is possible, I want to know how to secure the elasticsearch as for example in Mysql the access with login and password, that is to say the access to the elasticsearch is done by password ?? B… --- ## [No 'Access-Control-Allow-Origin' header is present on requested resource](https://discuss.elastic.co/t/no-access-control-allow-origin-header-is-present-on-requested-resource/253914)
**Author:** [@aideveloper](https://discuss.elastic.co/u/aideveloper)\ **Replies:** 0\ **Last updated:** [October 31, 2020, 10:02pm UTC](https://discuss.elastic.co/t/no-access-control-allow-origin-header-is-present-on-requested-resource/253914 "2020-10-31T22:02:50Z")
Our elasticsearch setup has the following cors settings in elasticsearch.yml: http.cors.enabled: true http.cors.allow-credentials: true http.cors.allow-origin: "\*" http.cors.allow-methods: OPTIONS,HEAD,GET,POST,PUT,DELE… --- ## [Documents deleted from all indices](https://discuss.elastic.co/t/documents-deleted-from-all-indices/253900)
**Author:** [@venku](https://discuss.elastic.co/u/venku)\ **Replies:** 6\ **Last updated:** [October 31, 2020, 4:22pm UTC](https://discuss.elastic.co/t/documents-deleted-from-all-indices/253900 "2020-10-31T16:22:55Z")
I am running a single ElasticSearch node for past week and half and my ILM policy was to delete the index if it is 10 days old after the rollover. I have a day or 5GB limit to move from hot to delete phase. However when … --- ## [Installed filebeat on next server, but I can't see any data in Kibana](https://discuss.elastic.co/t/installed-filebeat-on-next-server-but-i-cant-see-any-data-in-kibana/253880)
**Author:** [@oicfar](https://discuss.elastic.co/u/oicfar)\ **Replies:** 1\ **Last updated:** [October 31, 2020, 4:15pm UTC](https://discuss.elastic.co/t/installed-filebeat-on-next-server-but-i-cant-see-any-data-in-kibana/253880 "2020-10-31T16:15:29Z")
Hi, weeks ago I installed ElasticSearch, Logstash, Kibana and Filebeat on same server. It wors fine. Filebeat I'm using for syslog, nginx and postgresql monitoring. Today installed Filebeat on other server. I don't se… --- ## [Kibana Visualizations Doubt](https://discuss.elastic.co/t/kibana-visualizations-doubt/253130)
**Author:** [@Jose\_Angel\_Morena\_Si](https://discuss.elastic.co/u/Jose_Angel_Morena_Si)\ **Replies:** 2\ **Last updated:** [October 31, 2020, 2:06pm UTC](https://discuss.elastic.co/t/kibana-visualizations-doubt/253130 "2020-10-31T14:06:02Z")
Hello there, I am using metricbeat, filebeat and auditbeat, default dashboards, they are great! The problem is that I am only interested in a few from the hundreds of visualizations they provide. Is there a quick/aut… --- ## [How to show the JSON spring boot logs as a seperate fields out of the messages in the table format](https://discuss.elastic.co/t/how-to-show-the-json-spring-boot-logs-as-a-seperate-fields-out-of-the-messages-in-the-table-format/253424)
**Author:** [@Aathithiyan](https://discuss.elastic.co/u/Aathithiyan)\ **Replies:** 2\ **Last updated:** [October 31, 2020, 2:02pm UTC](https://discuss.elastic.co/t/how-to-show-the-json-spring-boot-logs-as-a-seperate-fields-out-of-the-messages-in-the-table-format/253424 "2020-10-31T14:02:43Z")
Hi, I have a task that i need to view the spring boot JSON logs in the table format. It should not dump into the message field of kibana. It has to view as a seperate field in the table format. Eg: EmployeeId 123 Emp… --- ## [Graph of Simultaneous user numbers](https://discuss.elastic.co/t/graph-of-simultaneous-user-numbers/253763)
**Author:** [@elkrocks](https://discuss.elastic.co/u/elkrocks)\ **Replies:** 1\ **Last updated:** [October 31, 2020, 1:41pm UTC](https://discuss.elastic.co/t/graph-of-simultaneous-user-numbers/253763 "2020-10-31T13:41:03Z")
Hi, How can I show a graph of simultaneous user numbers accessing my site? Thanks --- ## [Export Sample Dashboard -\> Import it new cluster -\> change index?](https://discuss.elastic.co/t/export-sample-dashboard-import-it-new-cluster-change-index/253824)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 4\ **Last updated:** [October 31, 2020, 8:07am UTC](https://discuss.elastic.co/t/export-sample-dashboard-import-it-new-cluster-change-index/253824 "2020-10-31T08:07:53Z")
Dear Elastic & Community, I did this: exported the sample dashboards of a beat (auditbeat) from one cluster, imported them (ndson file) in an second cluster. In this second cluster I would like to change in Kibana the i… --- ## [Can't get enrich processor to work with beats](https://discuss.elastic.co/t/cant-get-enrich-processor-to-work-with-beats/253889)
**Author:** [@Hutuleac\_Iulius](https://discuss.elastic.co/u/Hutuleac_Iulius)\ **Replies:** 0\ **Last updated:** [October 31, 2020, 7:07am UTC](https://discuss.elastic.co/t/cant-get-enrich-processor-to-work-with-beats/253889 "2020-10-31T07:07:48Z")
Version: 7.9.2 ECK 1.5.0 Steps to Reproduce: configure filebeat with enrichment pipeline and start ingestion Hi, I am trying to add an automatic enrichment to a filebeat getting PaloAlto firewall logs but enrichment … --- ## [Externalization of hosts settings in output](https://discuss.elastic.co/t/externalization-of-hosts-settings-in-output/253680)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 5\ **Last updated:** [October 31, 2020, 6:33am UTC](https://discuss.elastic.co/t/externalization-of-hosts-settings-in-output/253680 "2020-10-31T06:33:28Z")
Hi, I have a logstash indexing to 3 elasticsearch nodes. The output filter is as below: elasticsearch { hosts =\> \[ "https://myHost9a.vsi.uat.dbs.com:9202", "https://myHost10a.vsi.uat.dbs.com:9202", "https://myHost11… --- ## [Non-zero metrics in the last 30s - Filebeat](https://discuss.elastic.co/t/non-zero-metrics-in-the-last-30s-filebeat/253884)
**Author:** [@shinydeng](https://discuss.elastic.co/u/shinydeng)\ **Replies:** 0\ **Last updated:** [October 31, 2020, 2:33am UTC](https://discuss.elastic.co/t/non-zero-metrics-in-the-last-30s-filebeat/253884 "2020-10-31T02:33:12Z")
I'm new to ELK and need to do log forwarding for my mulesoft application logs. my filebeat.yml is below ''' Here is the Filebeat log. It seems there are no errors but I am seeing any metrics on KIBANA. then i tri… --- ## [Upgrade from 7.9.0 to 7.9.3](https://discuss.elastic.co/t/upgrade-from-7-9-0-to-7-9-3/253779)
**Author:** [@fadjar340](https://discuss.elastic.co/u/fadjar340)\ **Replies:** 2\ **Last updated:** [October 31, 2020, 2:06am UTC](https://discuss.elastic.co/t/upgrade-from-7-9-0-to-7-9-3/253779 "2020-10-31T02:06:59Z")
Hi all, I have issue when I'm trying to upgrde from 7.9.0 to 7.9.3, the elasticsearch can't start. After several minutes to investigate, I think it related to the jvm.options, because I have several times upgrading ela… --- ## [Failed to publish events caused by: read tcp filebeat:33330-\>logstash:5044: read: connection reset by peer](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-read-tcp-filebeat-33330-logstash-read-connection-reset-by-peer/252615)
**Author:** [@ShadwDrgn](https://discuss.elastic.co/u/ShadwDrgn)\ **Replies:** 4\ **Last updated:** [October 31, 2020, 1:28am UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-read-tcp-filebeat-33330-logstash-read-connection-reset-by-peer/252615 "2020-10-31T01:28:05Z")
my filebeat constantly (1-3 times a second) can't seem to connect to logstash and do it's thing. I'm on the docker images for 7.9.2 Steps i've already taken: confirmed host is resolving. confirmed I can ping logstash … --- ## [How to aggregate (nested) product attributes](https://discuss.elastic.co/t/how-to-aggregate-nested-product-attributes/253882)
**Author:** [@itscaiquearaujo](https://discuss.elastic.co/u/itscaiquearaujo)\ **Replies:** 0\ **Last updated:** [October 31, 2020, 1:19am UTC](https://discuss.elastic.co/t/how-to-aggregate-nested-product-attributes/253882 "2020-10-31T01:19:30Z")
I have a really simple index with the following mapping: PUT /localindex-products { "mappings": { "properties": { "name": { "type": "text" }, "sku": { "type": "keyword" }, "description": { "type"… --- ## [Custom the logstash java-Filter meet problem(cannot create task "gem")](https://discuss.elastic.co/t/custom-the-logstash-java-filter-meet-problem-cannot-create-task-gem/253774)
**Author:** [@xiaoping1993](https://discuss.elastic.co/u/xiaoping1993)\ **Replies:** 1\ **Last updated:** [October 30, 2020, 11:45pm UTC](https://discuss.elastic.co/t/custom-the-logstash-java-filter-meet-problem-cannot-create-task-gem/253774 "2020-10-30T23:45:56Z")
I want to custom the logstash java-Filter follow the url:https://www.elastic.co/guide/en/logstash/7.6/java-filter-plugin.html but I meet a problem when I run "gradlew gem" the error is below --- ## [Filebeat cisco module missing logs](https://discuss.elastic.co/t/filebeat-cisco-module-missing-logs/253873)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 0\ **Last updated:** [October 30, 2020, 10:45pm UTC](https://discuss.elastic.co/t/filebeat-cisco-module-missing-logs/253873 "2020-10-30T22:45:43Z")
Hello, I noticed that logs for one of my asa divices are not visible inside elastic around period of time when load on the device is rising above some level. Logs are harvested from file. Harverst log level is set to 5. … --- ## [Snapshot completed with success but archive creation failed](https://discuss.elastic.co/t/snapshot-completed-with-success-but-archive-creation-failed/253866)
**Author:** [@alita](https://discuss.elastic.co/u/alita)\ **Replies:** 0\ **Last updated:** [October 30, 2020, 9:15pm UTC](https://discuss.elastic.co/t/snapshot-completed-with-success-but-archive-creation-failed/253866 "2020-10-30T21:15:20Z")
Hi folks, I created a snapshot using the following curl command: curl -X PUT "localhost:9200/\_snapshot/my\_backup/snapshot\_1?wait\_for\_completion=true&pretty" After the snapshot completed with success, I execute a simp… --- ## [Setting up Okta instegration for Cloud Elastic](https://discuss.elastic.co/t/setting-up-okta-instegration-for-cloud-elastic/253734)
**Author:** [@Beefstew](https://discuss.elastic.co/u/Beefstew)\ **Replies:** 1\ **Last updated:** [October 30, 2020, 8:10pm UTC](https://discuss.elastic.co/t/setting-up-okta-instegration-for-cloud-elastic/253734 "2020-10-30T20:10:56Z")
Hi there, could anyone please provide some intuitive doco explaining the steps to Integrate Azure Elastic authentication to Okta using SAML Thank you --- ## [Different index for new filebeat module "bind9"](https://discuss.elastic.co/t/different-index-for-new-filebeat-module-bind9/253250)
**Author:** [@mayer](https://discuss.elastic.co/u/mayer)\ **Replies:** 6\ **Last updated:** [October 30, 2020, 8:05pm UTC](https://discuss.elastic.co/t/different-index-for-new-filebeat-module-bind9/253250 "2020-10-30T20:05:16Z")
Dear All, My environment: ELK stack 7.9.2 on Debian buster I wrote a new module called "bind9" which picks up the bind query logs from a DNS server. This is writing its data to the filebeat index. I would like to have … --- ## [Error when updating an array element object using java rest client api](https://discuss.elastic.co/t/error-when-updating-an-array-element-object-using-java-rest-client-api/253835)
**Author:** [@gtoor](https://discuss.elastic.co/u/gtoor)\ **Replies:** 1\ **Last updated:** [October 30, 2020, 7:44pm UTC](https://discuss.elastic.co/t/error-when-updating-an-array-element-object-using-java-rest-client-api/253835 "2020-10-30T19:44:51Z")
I am trying to update an array element in the document. The update should replace an existing element. This is what the document looks like "first" : "johnny", "last" : "gaudreau", "elements" : \[ { … --- ## [REST API Post /api/kibana/settings/defaultIndex gives 403](https://discuss.elastic.co/t/rest-api-post-api-kibana-settings-defaultindex-gives-403/250406)
**Author:** [@annanicotera](https://discuss.elastic.co/u/annanicotera)\ **Replies:** 5\ **Last updated:** [October 30, 2020, 7:19pm UTC](https://discuss.elastic.co/t/rest-api-post-api-kibana-settings-defaultindex-gives-403/250406 "2020-10-30T19:19:47Z")
Elasticsearch 7.9.1 and KIbana 7.91. with X-pack security enabled. I have a role that can create index patterns. See attached index and space privileges screen shots. When calling the API: POST /api/kibana/settin… --- ## [Can not decode Citrix Netscaler IPFIX messages](https://discuss.elastic.co/t/can-not-decode-citrix-netscaler-ipfix-messages/244654)
**Author:** [@tkuronen](https://discuss.elastic.co/u/tkuronen)\ **Replies:** 7\ **Last updated:** [October 30, 2020, 7:17pm UTC](https://discuss.elastic.co/t/can-not-decode-citrix-netscaler-ipfix-messages/244654 "2020-10-30T19:17:17Z")
Is anyone here successfully decoded a IPFIX data send by Citrix Netscaler ? Version: Logstash (7.7.1) / logstash-codec-netflow (4.2.1) Operating System: RHEL 7.8 Logstash Input config: input { udp { id =\> … --- ## [Winlogbeat missing winlog.event\_data.IpAddress](https://discuss.elastic.co/t/winlogbeat-missing-winlog-event-data-ipaddress/253745)
**Author:** [@mtudisco](https://discuss.elastic.co/u/mtudisco)\ **Replies:** 1\ **Last updated:** [October 30, 2020, 6:41pm UTC](https://discuss.elastic.co/t/winlogbeat-missing-winlog-event-data-ipaddress/253745 "2020-10-30T18:41:23Z")
Hi, I have a windows machine with Active Directory and winlogbeat (7.3) and in the generated info i have a field winlog.event\_data.IpAddress but on a differente scenario with winlogbeat (7.4.2) that field is not present… --- ## [onPreFetchPhase listener \[org.elasticsearch.xpack.security.authz.SecuritySearchOperationListener@X\] failed](https://discuss.elastic.co/t/onprefetchphase-listener-org-elasticsearch-xpack-security-authz-securitysearchoperationlistener-x-failed/251004)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 3\ **Last updated:** [October 30, 2020, 6:17pm UTC](https://discuss.elastic.co/t/onprefetchphase-listener-org-elasticsearch-xpack-security-authz-securitysearchoperationlistener-x-failed/251004 "2020-10-30T18:17:55Z")
Hello World! I'm using Elastic Stack 6.8.12 and running into following issue: elasticsearch' logs: XXXX | \[2020-10-05T00:22:46,990\]\[WARN \]\[o.e.i.s.IndexShard \] \[XXXXX\] \[4\] onPreFetchPhase listener \[… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1721) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1723)