# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1723 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1724 --- ## [TLS config issues?](https://discuss.elastic.co/t/tls-config-issues/253602)
**Author:** [@jcor](https://discuss.elastic.co/u/jcor)\ **Replies:** 10\ **Last updated:** [October 30, 2020, 5:41pm UTC](https://discuss.elastic.co/t/tls-config-issues/253602 "2020-10-30T17:41:03Z")
I'm trying to setup tls on ELK. I have tls and https working between elastic and kibana but no luck with logstash. Below are the logstash configs. I've followed this guide almost to the T till step 7 besides swapping dns… --- ## [Low performance while searching](https://discuss.elastic.co/t/low-performance-while-searching/253746)
**Author:** [@Phandora](https://discuss.elastic.co/u/Phandora)\ **Replies:** 4\ **Last updated:** [October 30, 2020, 4:15pm UTC](https://discuss.elastic.co/t/low-performance-while-searching/253746 "2020-10-30T16:15:17Z")
Hi, We are experiencing a low searching performance in our Kubernetes ES cluster. We have a 5 node ES cluster with the following specifications per node: ES\_JAVA\_OPTS: -Xms4096m -Xmx4096m Cpu request: 500m Cpu limi… --- ## [Machine learning options](https://discuss.elastic.co/t/machine-learning-options/253760)
**Author:** [@jungsoo](https://discuss.elastic.co/u/jungsoo)\ **Replies:** 1\ **Last updated:** [October 30, 2020, 4:31pm UTC](https://discuss.elastic.co/t/machine-learning-options/253760 "2020-10-30T16:31:09Z")
Hello, I'm testing machine learning features using the kibana sample data. I couldn't find detailed information about the options when creating ml jobs. I want to know what exclude frequent means, and how I could use t… --- ## [Pipeline-to-Pipeline Configuration Does Not Work with TLS Cluster](https://discuss.elastic.co/t/pipeline-to-pipeline-configuration-does-not-work-with-tls-cluster/253692)
**Author:** [@sivanov](https://discuss.elastic.co/u/sivanov)\ **Replies:** 3\ **Last updated:** [October 30, 2020, 4:19pm UTC](https://discuss.elastic.co/t/pipeline-to-pipeline-configuration-does-not-work-with-tls-cluster/253692 "2020-10-30T16:19:25Z")
Hi guys, I have an ECK cluster that receives logs from Logstash. Logstash is deployed and running as a k8s /deployment/ pod next to that cluster. Filebeat (deployed elsewhere) is used to read logs and ship them to Logst… --- ## [TSVB Table view not picking up multi-field mapping properly](https://discuss.elastic.co/t/tsvb-table-view-not-picking-up-multi-field-mapping-properly/253799)
**Author:** [@benji87](https://discuss.elastic.co/u/benji87)\ **Replies:** 1\ **Last updated:** [October 30, 2020, 3:20pm UTC](https://discuss.elastic.co/t/tsvb-table-view-not-picking-up-multi-field-mapping-properly/253799 "2020-10-30T15:20:20Z")
Hi all, I have a date field that uses the standard format of MMM D, YYYY @ HH:mm:ss.SSS I also wanted a simplified version of this field that only includes the date and drops the time, so I created a new multi-field ma… --- ## [Linking A Space to a Graph](https://discuss.elastic.co/t/linking-a-space-to-a-graph/253604)
**Author:** [@teej](https://discuss.elastic.co/u/teej)\ **Replies:** 2\ **Last updated:** [October 30, 2020, 3:18pm UTC](https://discuss.elastic.co/t/linking-a-space-to-a-graph/253604 "2020-10-30T15:18:07Z")
Hi, I have created Spaces dedicated to specific groups. When they log in they see only the Dashboards allocated to that Space. There is, however, one link that points to a Graph but when clicked, I get: |statusCode|40… --- ## [Ansible-elasticsearch on Centos 8](https://discuss.elastic.co/t/ansible-elasticsearch-on-centos-8/250839)
**Author:** [@biggtimber](https://discuss.elastic.co/u/biggtimber)\ **Replies:** 1\ **Last updated:** [October 30, 2020, 3:10pm UTC](https://discuss.elastic.co/t/ansible-elasticsearch-on-centos-8/250839 "2020-10-30T15:10:01Z")
Is there work being put towards supporting the ansible-elasticsearch project on Centos 8, since elasticsearch has supported it for 3 releases now. --- ## [How logstash create indices based on date - wrong date](https://discuss.elastic.co/t/how-logstash-create-indices-based-on-date-wrong-date/253826)
**Author:** [@dorinand](https://discuss.elastic.co/u/dorinand)\ **Replies:** 2\ **Last updated:** [October 30, 2020, 2:59pm UTC](https://discuss.elastic.co/t/how-logstash-create-indices-based-on-date-wrong-date/253826 "2020-10-30T14:59:49Z")
I am running ELK with filebeat in kubernetes. Filebeat is harvesting logs and sending it to logstash. This is my logstash filter: if \[kubernetes\]\[annotations\]\[elastic\_index\] { mutate { add\_field … --- ## [Filebeat Auto discover config check failed for config - stopped harvesting data](https://discuss.elastic.co/t/filebeat-auto-discover-config-check-failed-for-config-stopped-harvesting-data/253675)
**Author:** [@dorinand](https://discuss.elastic.co/u/dorinand)\ **Replies:** 3\ **Last updated:** [October 30, 2020, 2:51pm UTC](https://discuss.elastic.co/t/filebeat-auto-discover-config-check-failed-for-config-stopped-harvesting-data/253675 "2020-10-30T14:51:19Z")
I harvest logs from gitlab runners created in kubernetes namespace. I implement the opciton to store elastic index in pod annotation. So all my gitlab runners has elastic.index: runner-jobs annotation. This is my autods… --- ## [Illegal\_argument\_exception](https://discuss.elastic.co/t/illegal-argument-exception/253827)
**Author:** [@fredrick.bb](https://discuss.elastic.co/u/fredrick.bb)\ **Replies:** 3\ **Last updated:** [October 30, 2020, 2:43pm UTC](https://discuss.elastic.co/t/illegal-argument-exception/253827 "2020-10-30T14:43:09Z")
Hi, I had created index and constructed Visualization every thing was working perfectly. But today when I search in kibana, I got a popup saying that 1 of 33 shards failed, with below exception Text fields are not opt… --- ## [Cron job for CSV filter](https://discuss.elastic.co/t/cron-job-for-csv-filter/253744)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 3\ **Last updated:** [October 30, 2020, 2:41pm UTC](https://discuss.elastic.co/t/cron-job-for-csv-filter/253744 "2020-10-30T14:41:04Z")
Hi All, I am using logstash to upload data into Elastic, we have been using csv filter to upload the data, i need to run this csv file on a every 15 minute frequency. csv filter doesnot allow "schedule" , how do i set… --- ## [Docker Filebeat 7.9.3 cannot collect metrics from http from outside the container](https://discuss.elastic.co/t/docker-filebeat-7-9-3-cannot-collect-metrics-from-http-from-outside-the-container/253792)
**Author:** [@Tisi](https://discuss.elastic.co/u/Tisi)\ **Replies:** 9\ **Last updated:** [October 30, 2020, 2:37pm UTC](https://discuss.elastic.co/t/docker-filebeat-7-9-3-cannot-collect-metrics-from-http-from-outside-the-container/253792 "2020-10-30T14:37:55Z")
Hello Elastic Staff I am not able to collect metrics from filebeat from the defined http port. I can get the metrics from within the filebeat container with curl -XGET localhost:5066/stats. When I want to collect the… --- ## [Creating new scripted field to showing time difference between 2 log lines](https://discuss.elastic.co/t/creating-new-scripted-field-to-showing-time-difference-between-2-log-lines/253112)
**Author:** [@singyim817](https://discuss.elastic.co/u/singyim817)\ **Replies:** 3\ **Last updated:** [October 30, 2020, 2:28pm UTC](https://discuss.elastic.co/t/creating-new-scripted-field-to-showing-time-difference-between-2-log-lines/253112 "2020-10-30T14:28:49Z")
Hi there, I got a similar situation like this. I have assigned a unique ID for each pair of lines, then I need to calculate the transaction time in second between the datetime value in these lines, finally display on … --- ## [Filebeat.yml - Environnement variable on UBUNTU](https://discuss.elastic.co/t/filebeat-yml-environnement-variable-on-ubuntu/253733)
**Author:** [@ASRLO](https://discuss.elastic.co/u/ASRLO)\ **Replies:** 3\ **Last updated:** [October 30, 2020, 2:13pm UTC](https://discuss.elastic.co/t/filebeat-yml-environnement-variable-on-ubuntu/253733 "2020-10-30T14:13:16Z")
Hello everybody , I want to use an environment variable on my path but it doesn't work. When I run the filebeat service it works but fails when sending logs to logstash I have set my environment variable in /etc/bash.b… --- ## [AWS Elasticsearch service and filebeat](https://discuss.elastic.co/t/aws-elasticsearch-service-and-filebeat/253700)
**Author:** [@alfredo.deluca](https://discuss.elastic.co/u/alfredo.deluca)\ **Replies:** 2\ **Last updated:** [October 30, 2020, 2:00pm UTC](https://discuss.elastic.co/t/aws-elasticsearch-service-and-filebeat/253700 "2020-10-30T14:00:38Z")
Hi all. For testing purposes, I ve installed AWS Elasticsearch service in my account and I have access to kibana. I tried also to send some data with CURL and it's all ok. Now I was trying to setup filebeat on my lapto… --- ## [How to format aggregation output in kibana visualization](https://discuss.elastic.co/t/how-to-format-aggregation-output-in-kibana-visualization/253769)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 7\ **Last updated:** [October 30, 2020, 1:44pm UTC](https://discuss.elastic.co/t/how-to-format-aggregation-output-in-kibana-visualization/253769 "2020-10-30T13:44:04Z")
I want to format output in Overall Average of Average system.cpu.total.norm.pct to percentage I red that I can use painless script in kibana vizulization creator. I could now found the proper syntax. How can I… --- ## [Kibana Watcher Advanced query is not working as expected](https://discuss.elastic.co/t/kibana-watcher-advanced-query-is-not-working-as-expected/253617)
**Author:** [@fredrick.bb](https://discuss.elastic.co/u/fredrick.bb)\ **Replies:** 4\ **Last updated:** [October 30, 2020, 1:42pm UTC](https://discuss.elastic.co/t/kibana-watcher-advanced-query-is-not-working-as-expected/253617 "2020-10-30T13:42:23Z")
Hello I'm finding hard time to have working query to execute Kibana Watcher. I feel my condition and query is correct but it didn't execute as per the condition. Could you confirm what is wrong in this? { "trigger": … --- ## [How can I pattern match a sequence of events?](https://discuss.elastic.co/t/how-can-i-pattern-match-a-sequence-of-events/253246)
**Author:** [@marcosvrrs](https://discuss.elastic.co/u/marcosvrrs)\ **Replies:** 5\ **Last updated:** [October 30, 2020, 1:36pm UTC](https://discuss.elastic.co/t/how-can-i-pattern-match-a-sequence-of-events/253246 "2020-10-30T13:36:47Z")
Hi guys, I'am having a steep learning curve with the syntax. I have a sequence of transactions with timestamps, and when a transaction comes with some values in certain fields, I need to check if in the next 30 seconds … --- ## [What does this "Attention" banner mean on my Kibana site?](https://discuss.elastic.co/t/what-does-this-attention-banner-mean-on-my-kibana-site/253328)
**Author:** [@sdtbone](https://discuss.elastic.co/u/sdtbone)\ **Replies:** 2\ **Last updated:** [October 30, 2020, 1:26pm UTC](https://discuss.elastic.co/t/what-does-this-attention-banner-mean-on-my-kibana-site/253328 "2020-10-30T13:26:17Z")
I'm not finding anything in the logs. Everything seems to be working fine. What does this mean? --- ## [ES 6.5.3 : having two separate logstash configuration files (and separate indexes) is causing fields from one index to bleed into the other](https://discuss.elastic.co/t/es-6-5-3-having-two-separate-logstash-configuration-files-and-separate-indexes-is-causing-fields-from-one-index-to-bleed-into-the-other/253736)
**Author:** [@terry433iid](https://discuss.elastic.co/u/terry433iid)\ **Replies:** 3\ **Last updated:** [October 30, 2020, 1:23pm UTC](https://discuss.elastic.co/t/es-6-5-3-having-two-separate-logstash-configuration-files-and-separate-indexes-is-causing-fields-from-one-index-to-bleed-into-the-other/253736 "2020-10-30T13:23:41Z")
I have two logstash configuration files - when I run logstash it is creating a bizarre situation where one of the indexes from config1 has fields from the other index in config2 See below for steps :- Create an index … --- ## [Metricbeat: \[logstash.node\] node/node.go:79 could not fetch node pipelines: HTTP error 405 in : 405 Method Not Allowed](https://discuss.elastic.co/t/metricbeat-logstash-node-node-node-go-79-could-not-fetch-node-pipelines-http-error-405-in-405-method-not-allowed/253786)
**Author:** [@Yuy\_Heero](https://discuss.elastic.co/u/Yuy_Heero)\ **Replies:** 2\ **Last updated:** [October 30, 2020, 12:52pm UTC](https://discuss.elastic.co/t/metricbeat-logstash-node-node-node-go-79-could-not-fetch-node-pipelines-http-error-405-in-405-method-not-allowed/253786 "2020-10-30T12:52:10Z")
I created one-node elasticsearch(7.9.3) and one-node logstash(7.9.3). Logstash can transfer logs via https without problem. I want to use metricbeat to monitor logstash. After I installed metricbeat in logstash node. M… --- ## [Elasticsearch unassigned shards CircuitBreakingException\[\[parent\] Data too large](https://discuss.elastic.co/t/elasticsearch-unassigned-shards-circuitbreakingexception-parent-data-too-large/253820)
**Author:** [@elknoob](https://discuss.elastic.co/u/elknoob)\ **Replies:** 0\ **Last updated:** [October 30, 2020, 12:42pm UTC](https://discuss.elastic.co/t/elasticsearch-unassigned-shards-circuitbreakingexception-parent-data-too-large/253820 "2020-10-30T12:42:28Z")
I got alert stating elasticsearch has 2 unassigned shards. I made below api calls to gather more details. // curl -s http://localhost:9200/\_cluster/allocation/explain | python -m json.tool "allocate\_explanation": "c… --- ## [Embed visualization via iframe without menus, options, editor, etc](https://discuss.elastic.co/t/embed-visualization-via-iframe-without-menus-options-editor-etc/253712)
**Author:** [@nate.goodwin](https://discuss.elastic.co/u/nate.goodwin)\ **Replies:** 6\ **Last updated:** [October 30, 2020, 12:11pm UTC](https://discuss.elastic.co/t/embed-visualization-via-iframe-without-menus-options-editor-etc/253712 "2020-10-30T12:11:59Z")
I want to embed a visualization in an iframe, but I want just the part inside the red rectangle, how can I do this? --- ## [URL Display a different field](https://discuss.elastic.co/t/url-display-a-different-field/253659)
**Author:** [@Oliver2](https://discuss.elastic.co/u/Oliver2)\ **Replies:** 1\ **Last updated:** [October 30, 2020, 12:11pm UTC](https://discuss.elastic.co/t/url-display-a-different-field/253659 "2020-10-30T12:11:53Z")
Hi all, I have an index with two fields, one is the full URL(link) I want to go to and the other is the text field(title) I want to display. Is it possible to create a configuration as such that a filed that will displa… --- ## [Failed to authenticate user with ldap realm using role mapping api](https://discuss.elastic.co/t/failed-to-authenticate-user-with-ldap-realm-using-role-mapping-api/253285)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 4\ **Last updated:** [October 30, 2020, 12:05pm UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-with-ldap-realm-using-role-mapping-api/253285 "2020-10-30T12:05:36Z")
Hi all, Currently i have successfully tried to authen to elastic with ldap, but i used the role\_mapping file, i was tesing with using the role mapping api but it is not working. When i turn on the authen debug log then… --- ## [Parsing query with @timestamp range](https://discuss.elastic.co/t/parsing-query-with-timestamp-range/253399)
**Author:** [@TKul6](https://discuss.elastic.co/u/TKul6)\ **Replies:** 1\ **Last updated:** [October 30, 2020, 11:54am UTC](https://discuss.elastic.co/t/parsing-query-with-timestamp-range/253399 "2020-10-30T11:54:42Z")
Hi, Assuming I have the following Lucene query defined in Kibana: activity\_id = '68e99866-d9e7-4e2e-abb9-b13702b13f72' AND @timestamp:\[ 2020-10-20T08:09:13.503Z TO 2020-10-20T08:09:23.503Z\] I've noticed that I have to… --- ## [Index pattern not created on saved objects import](https://discuss.elastic.co/t/index-pattern-not-created-on-saved-objects-import/253808)
**Author:** [@atharvak](https://discuss.elastic.co/u/atharvak)\ **Replies:** 2\ **Last updated:** [October 30, 2020, 11:47am UTC](https://discuss.elastic.co/t/index-pattern-not-created-on-saved-objects-import/253808 "2020-10-30T11:47:29Z")
Hello people, I am trying to import an already created dashboard into a space. I am using the visual import method for this. I want to import same dashboard in the same space multiple times. That is why I need to change… --- ## [Enable SSO in Elastic Cloud](https://discuss.elastic.co/t/enable-sso-in-elastic-cloud/253661)
**Author:** [@antony\_kavin](https://discuss.elastic.co/u/antony_kavin)\ **Replies:** 2\ **Last updated:** [October 30, 2020, 11:30am UTC](https://discuss.elastic.co/t/enable-sso-in-elastic-cloud/253661 "2020-10-30T11:30:09Z")
Hi team, I want to enable SSO in my Kibana dashboard. I am using Elasticsearch and Kibana version 7.9.2. I am currently in the Gold Plan. I went through the elasticsearch guide and it was not clear. I have the below que… --- ## [How to subtract TimeSpan in ticks from datetime in any type of query range or script](https://discuss.elastic.co/t/how-to-subtract-timespan-in-ticks-from-datetime-in-any-type-of-query-range-or-script/253807)
**Author:** [@sameer\_sawant](https://discuss.elastic.co/u/sameer_sawant)\ **Replies:** 0\ **Last updated:** [October 30, 2020, 11:29am UTC](https://discuss.elastic.co/t/how-to-subtract-timespan-in-ticks-from-datetime-in-any-type-of-query-range-or-script/253807 "2020-10-30T11:29:49Z")
I want to achive something like this endDateUtc.Subtract(timespan) \<= DateTime.Now in elastic query . both fields ( enddateutc and timespan ) available in document. i want to do something like doc\["enddateutc"\].value - … --- ## [Metricbeat: Sql Module: Oracle Driver: Sql Query Error :ERROR error opening connection: opening connection: sql: unknown driver "oracle" (forgotten import?)](https://discuss.elastic.co/t/metricbeat-sql-module-oracle-driver-sql-query-error-error-error-opening-connection-opening-connection-sql-unknown-driver-oracle-forgotten-import/253387)
**Author:** [@Sunil18](https://discuss.elastic.co/u/Sunil18)\ **Replies:** 4\ **Last updated:** [October 30, 2020, 11:13am UTC](https://discuss.elastic.co/t/metricbeat-sql-module-oracle-driver-sql-query-error-error-error-opening-connection-opening-connection-sql-unknown-driver-oracle-forgotten-import/253387 "2020-10-30T11:13:06Z")
I have configured Metricbeat Oracle Module(For Default Metrices/Dashboard ) & I am using Sql Module for customized queries to fetch the data from Oracle DB. Oracle Module is working perfectly but for Sql module I am g… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1722) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1724)