# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1728 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1729 --- ## [No Implicit conversion of Nil](https://discuss.elastic.co/t/no-implicit-conversion-of-nil/253594)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [October 28, 2020, 7:54pm UTC](https://discuss.elastic.co/t/no-implicit-conversion-of-nil/253594 "2020-10-28T19:54:16Z")
I am getting following error. but do not where in code it is getting this error from. \[ERROR\] 2020-10-28 11:41:31.825 \[\[main\]\>worker7\] WorkerLoop - Exception in pipelineworker, the pipeline stopped processing new events… --- ## [Winlogbeat unable to connect to elasticsearch](https://discuss.elastic.co/t/winlogbeat-unable-to-connect-to-elasticsearch/253612)
**Author:** [@antmar904](https://discuss.elastic.co/u/antmar904)\ **Replies:** 0\ **Last updated:** [October 28, 2020, 7:15pm UTC](https://discuss.elastic.co/t/winlogbeat-unable-to-connect-to-elasticsearch/253612 "2020-10-28T19:15:09Z")
Hi. I downloaded and installed SOF-ELK, imported it into VMware, powered it up then installed the winlogbeat on my Windows 10 laptop. I changed the following in the winlogbeat.yml file: Under the "Kibana" section I ed… --- ## [S3 logstash conf grok filter](https://discuss.elastic.co/t/s3-logstash-conf-grok-filter/253357)
**Author:** [@deep9300](https://discuss.elastic.co/u/deep9300)\ **Replies:** 5\ **Last updated:** [October 28, 2020, 6:43pm UTC](https://discuss.elastic.co/t/s3-logstash-conf-grok-filter/253357 "2020-10-28T18:43:03Z")
Hello. I want to collect s3 access logs from an s3 bucket and process them to logstash and elasticsearch. I have it working properly but the filter in the logstash conf is not working properly. Currently its giving me t… --- ## [How to create a stacked graph using Lens of license checkouts per user over time that gives the right answer regardless of timescale?](https://discuss.elastic.co/t/how-to-create-a-stacked-graph-using-lens-of-license-checkouts-per-user-over-time-that-gives-the-right-answer-regardless-of-timescale/253495)
**Author:** [@stanvick](https://discuss.elastic.co/u/stanvick)\ **Replies:** 4\ **Last updated:** [October 28, 2020, 6:27pm UTC](https://discuss.elastic.co/t/how-to-create-a-stacked-graph-using-lens-of-license-checkouts-per-user-over-time-that-gives-the-right-answer-regardless-of-timescale/253495 "2020-10-28T18:27:24Z")
I am certain this question has been asked many times before but I don't understand the answer(s) given because I am using Kibana Lens to create my graph and because I am a rank beginner. I have data sampled every 5 minut… --- ## [Different Default Dashboards for Different Groups](https://discuss.elastic.co/t/different-default-dashboards-for-different-groups/253473)
**Author:** [@teej](https://discuss.elastic.co/u/teej)\ **Replies:** 2\ **Last updated:** [October 28, 2020, 6:00pm UTC](https://discuss.elastic.co/t/different-default-dashboards-for-different-groups/253473 "2020-10-28T18:00:53Z")
Hi, How I can force a dashboard to appear as default when a user in one group logs in, but a different default dashboard for another group's login? Currently, they have to go to the DASHBOARD section and select one but … --- ## [Inconsistent date\_histogram "key\_as\_string" when "format" is set](https://discuss.elastic.co/t/inconsistent-date-histogram-key-as-string-when-format-is-set/253597)
**Author:** [@Nicolas\_Labrot](https://discuss.elastic.co/u/Nicolas_Labrot)\ **Replies:** 1\ **Last updated:** [October 28, 2020, 6:00pm UTC](https://discuss.elastic.co/t/inconsistent-date-histogram-key-as-string-when-format-is-set/253597 "2020-10-28T18:00:44Z")
Hello, I have an issue with date\_histogram on Elastic 7.9.2. The "key\_as\_string" does not seems to be correct. I have this index: PUT https://localhost:9200/test -d ' { "mappings":{ "propertie… --- ## [Logstash not working with ActiveMQ](https://discuss.elastic.co/t/logstash-not-working-with-activemq/252022)
**Author:** [@kaushik.vankayala](https://discuss.elastic.co/u/kaushik.vankayala)\ **Replies:** 4\ **Last updated:** [October 28, 2020, 5:22pm UTC](https://discuss.elastic.co/t/logstash-not-working-with-activemq/252022 "2020-10-28T17:22:53Z")
I am trying to consume a message from an ActiveMQ with the following configuration; input { jms { broker\_url =\> 'failover:(ssl://b-d5bc797b-sjd8-41d2-dfjh7-127ba48c6238-1.mq.eu-west-1.amazonaws.com:61617)?init… --- ## [Logstash http output plugin documentation outdated](https://discuss.elastic.co/t/logstash-http-output-plugin-documentation-outdated/253595)
**Author:** [@bosand](https://discuss.elastic.co/u/bosand)\ **Replies:** 0\ **Last updated:** [October 28, 2020, 5:06pm UTC](https://discuss.elastic.co/t/logstash-http-output-plugin-documentation-outdated/253595 "2020-10-28T17:06:12Z")
I did not see a feedback option on the website other than a contact form for sales purposes, so I thought I might as well post it here... The documentation on Elastic's website is not in sync with the Github version. D… --- ## [Ingest Node Pipelines making Elasticsearch Unreachable](https://discuss.elastic.co/t/ingest-node-pipelines-making-elasticsearch-unreachable/253534)
**Author:** [@Vijay\_Barai](https://discuss.elastic.co/u/Vijay_Barai)\ **Replies:** 1\ **Last updated:** [October 28, 2020, 4:18pm UTC](https://discuss.elastic.co/t/ingest-node-pipelines-making-elasticsearch-unreachable/253534 "2020-10-28T16:18:33Z")
I am using ES-7.9.1. I created few ingest pipeling for small enrichment using UI. All pipeline working fine individually when load a data using logstash-output-elasticsearch. To impliment all the enrichment I combined 5 … --- ## [Lens not showing up fields which are searchable & aggregatable?](https://discuss.elastic.co/t/lens-not-showing-up-fields-which-are-searchable-aggregatable/253551)
**Author:** [@Goodyzain](https://discuss.elastic.co/u/Goodyzain)\ **Replies:** 1\ **Last updated:** [October 28, 2020, 2:57pm UTC](https://discuss.elastic.co/t/lens-not-showing-up-fields-which-are-searchable-aggregatable/253551 "2020-10-28T14:57:57Z")
Hi i am trying to build a dashboard with lens, i have a index where 1 of the field is both marked as searchable & aggregatable but still it doesn't appear in the lens... Here is the lens, even though the data is the… --- ## [Which (json or xml) input is better for parsing in logstash in terms of scalibility , performance and nested structure?](https://discuss.elastic.co/t/which-json-or-xml-input-is-better-for-parsing-in-logstash-in-terms-of-scalibility-performance-and-nested-structure/253555)
**Author:** [@Abdul\_Gaffar\_Shaikh](https://discuss.elastic.co/u/Abdul_Gaffar_Shaikh)\ **Replies:** 2\ **Last updated:** [October 28, 2020, 2:21pm UTC](https://discuss.elastic.co/t/which-json-or-xml-input-is-better-for-parsing-in-logstash-in-terms-of-scalibility-performance-and-nested-structure/253555 "2020-10-28T14:21:46Z")
hi everyone , i need to decide which input type to parse in logstash for performance, scalibility and nested structure ? the input file could be nearly 100k records in size the data source is informatica. please let … --- ## [Process multiple Dead Letter Queues with one pipeline](https://discuss.elastic.co/t/process-multiple-dead-letter-queues-with-one-pipeline/253430)
**Author:** [@michielw](https://discuss.elastic.co/u/michielw)\ **Replies:** 2\ **Last updated:** [October 28, 2020, 2:11pm UTC](https://discuss.elastic.co/t/process-multiple-dead-letter-queues-with-one-pipeline/253430 "2020-10-28T14:11:38Z")
In our Elastic environment we use multiple pipelines on a single Logstash instance. Also, we enabled the Dead Letter Queue on all these pipelines. On creating the pipeline to process events in the DLQs I noticed I need t… --- ## [Dashboards have been unknowingly deleted, need recovery](https://discuss.elastic.co/t/dashboards-have-been-unknowingly-deleted-need-recovery/253471)
**Author:** [@tonyfwk](https://discuss.elastic.co/u/tonyfwk)\ **Replies:** 2\ **Last updated:** [October 28, 2020, 2:02pm UTC](https://discuss.elastic.co/t/dashboards-have-been-unknowingly-deleted-need-recovery/253471 "2020-10-28T14:02:41Z")
Today, I have found my custom-created dashboards were missing. Suspected have been deleted by one of the users with admin rights. Is there any way to recover from Kibana. It represents two months of work. Much obl… --- ## [How to exclude querystring reponse and keep only exact match if present?](https://discuss.elastic.co/t/how-to-exclude-querystring-reponse-and-keep-only-exact-match-if-present/253412)
**Author:** [@darshan\_ambre](https://discuss.elastic.co/u/darshan_ambre)\ **Replies:** 2\ **Last updated:** [October 28, 2020, 1:59pm UTC](https://discuss.elastic.co/t/how-to-exclude-querystring-reponse-and-keep-only-exact-match-if-present/253412 "2020-10-28T13:59:39Z")
How to return only exact match if exists else perform wildcard search. for e.g. for the below given set of data \[ { "\_index" : "priority\_test", "\_type" : "\_doc", "\_id" : "3IkeZHUBYJCjRl… --- ## [Filebeat Azure Activity Logs Ingest Pipeline; Error parsing fields with $-characters](https://discuss.elastic.co/t/filebeat-azure-activity-logs-ingest-pipeline-error-parsing-fields-with-characters/253571)
**Author:** [@C0FFEEC0FFEE](https://discuss.elastic.co/u/C0FFEEC0FFEE)\ **Replies:** 0\ **Last updated:** [October 28, 2020, 1:58pm UTC](https://discuss.elastic.co/t/filebeat-azure-activity-logs-ingest-pipeline-error-parsing-fields-with-characters/253571 "2020-10-28T13:58:08Z")
I'm trying to enhance the filebeat-7.9.3-azure-activitylogs-pipeline to parse the information about vulnerability scans (Azure Security Center / Qualys) into ECS. I'm stuck with the problem that some of the fields have … --- ## [Add trace ids to deprecation logs](https://discuss.elastic.co/t/add-trace-ids-to-deprecation-logs/252999)
**Author:** [@rdragan](https://discuss.elastic.co/u/rdragan)\ **Replies:** 1\ **Last updated:** [October 28, 2020, 1:54pm UTC](https://discuss.elastic.co/t/add-trace-ids-to-deprecation-logs/252999 "2020-10-28T13:54:44Z")
Hello, I've noticed that your search and indexing slow logs have attached trace ids \[Github code\]. I was wondering if it would be possible to add them to deprecation logs as well? The motivation behind this is the fa… --- ## [Count max consecutive values](https://discuss.elastic.co/t/count-max-consecutive-values/253565)
**Author:** [@Yevhen\_Baidiuk](https://discuss.elastic.co/u/Yevhen_Baidiuk)\ **Replies:** 0\ **Last updated:** [October 28, 2020, 1:33pm UTC](https://discuss.elastic.co/t/count-max-consecutive-values/253565 "2020-10-28T13:33:19Z")
Hello, I try to get values with specific logic. For Example, we get 2 Entity from 4 days period. Name Date Val B 01 1 (1) A 01 1 A 02 0 A … --- ## [Custom Index for Functionbeat](https://discuss.elastic.co/t/custom-index-for-functionbeat/248664)
**Author:** [@sainath](https://discuss.elastic.co/u/sainath)\ **Replies:** 4\ **Last updated:** [October 28, 2020, 1:12pm UTC](https://discuss.elastic.co/t/custom-index-for-functionbeat/248664 "2020-10-28T13:12:24Z")
Hi Team, I am trying to deploy function beat to read AWS logs which i am succesfully able to do. However, i require different index to be created in Elasticsearch for different log groups.Below id the elasticsearch outp… --- ## [Passing only loglevel ERROR FROM LOG USING GROK FILTRATION](https://discuss.elastic.co/t/passing-only-loglevel-error-from-log-using-grok-filtration/253369)
**Author:** [@noobman2logstash](https://discuss.elastic.co/u/noobman2logstash)\ **Replies:** 6\ **Last updated:** [October 28, 2020, 12:58pm UTC](https://discuss.elastic.co/t/passing-only-loglevel-error-from-log-using-grok-filtration/253369 "2020-10-28T12:58:03Z")
Hi I'm new to logstash and i need help parsing only error logs when loglevel == error i have tried many filtrations on here and im not getting the result i need. here is a sample of my error log. i just want to pick an… --- ## [Logstash read pdf by ruby-Filter](https://discuss.elastic.co/t/logstash-read-pdf-by-ruby-filter/253542)
**Author:** [@xiaoping1993](https://discuss.elastic.co/u/xiaoping1993)\ **Replies:** 2\ **Last updated:** [October 28, 2020, 12:24pm UTC](https://discuss.elastic.co/t/logstash-read-pdf-by-ruby-filter/253542 "2020-10-28T12:24:35Z")
I want use logstash to read the pdf、docx .... I think the ruby-Filter can solve the problem so I do some try: 1）create a function pdf\_to\_text(pdf\_filename) require 'docsplit' def pdf\_to\_text(pdf\_filename) Docsplit… --- ## [JDBC Oracle table to Elastic through logstash](https://discuss.elastic.co/t/jdbc-oracle-table-to-elastic-through-logstash/253338)
**Author:** [@Gopal\_Chauhan](https://discuss.elastic.co/u/Gopal_Chauhan)\ **Replies:** 2\ **Last updated:** [October 28, 2020, 12:24pm UTC](https://discuss.elastic.co/t/jdbc-oracle-table-to-elastic-through-logstash/253338 "2020-10-28T12:24:30Z")
Hi , I am trying to get oracle table data into Elastic through logstash (version 6.2, windows). I have created a pipe line. Added pipeline id into logstash.yml file and restarting logstash service. Pipeline is starting… --- ## [Error at first launch Kibana 7.9.2](https://discuss.elastic.co/t/error-at-first-launch-kibana-7-9-2/252848)
**Author:** [@Toontje](https://discuss.elastic.co/u/Toontje)\ **Replies:** 3\ **Last updated:** [October 28, 2020, 11:58am UTC](https://discuss.elastic.co/t/error-at-first-launch-kibana-7-9-2/252848 "2020-10-28T11:58:11Z")
Installed Kibana 7.9.2 from Homebrew. On first launch i get the following errors: log \[12:22:24.215\] \[info\]\[plugins\]\[reporting\] Extracting \[/usr/local/Cellar/kibana-full/7.9.2/libexec/.chromium/chromium-312d84c-… --- ## [ILM Logstash and Elastic (again)](https://discuss.elastic.co/t/ilm-logstash-and-elastic-again/253541)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 1\ **Last updated:** [October 28, 2020, 10:47am UTC](https://discuss.elastic.co/t/ilm-logstash-and-elastic-again/253541 "2020-10-28T10:47:39Z")
Hi, I have following configurations: logstash output: output { elasticsearch { hosts =\> \["elastic.server.com"\] ilm\_rollover\_alias =\> "filebeat-vm-linux" ilm\_pattern =\> "{now/d}-000001" ilm\_policy =\> "test\_… --- ## [Filebeat custom modules on macOS](https://discuss.elastic.co/t/filebeat-custom-modules-on-macos/251783)
**Author:** [@gerard1](https://discuss.elastic.co/u/gerard1)\ **Replies:** 1\ **Last updated:** [October 28, 2020, 10:06am UTC](https://discuss.elastic.co/t/filebeat-custom-modules-on-macos/251783 "2020-10-28T10:06:21Z")
I'm wondering where should custom modules be stored in macOS, after installing Filebeat with brew. In Linux, the default path is "/usr/share/filebeat/module/", but I can't find it in macOS. --- ## [Access secured Elasticsearch from Kibana](https://discuss.elastic.co/t/access-secured-elasticsearch-from-kibana/253460)
**Author:** [@Johann\_Hochtl](https://discuss.elastic.co/u/Johann_Hochtl)\ **Replies:** 1\ **Last updated:** [October 28, 2020, 9:43am UTC](https://discuss.elastic.co/t/access-secured-elasticsearch-from-kibana/253460 "2020-10-28T09:43:03Z")
I configured elasticsearch to require ssl-communication, but not https via REST, see: I can access elastic from curl using the pattern curl -u kibana\_system http://localhost:9200 I configured Kibana as following: xp… --- ## [Build kibana unreleased version](https://discuss.elastic.co/t/build-kibana-unreleased-version/253536)
**Author:** [@bering](https://discuss.elastic.co/u/bering)\ **Replies:** 2\ **Last updated:** [October 28, 2020, 9:19am UTC](https://discuss.elastic.co/t/build-kibana-unreleased-version/253536 "2020-10-28T09:19:33Z")
I would like to test the Ingest Manager with on prem package-registry mentioned here: The issue mentions that this works for Kibana v7.9.10, can I build the version with yarn somehow? --- ## [Performance graphs? Is this possible?](https://discuss.elastic.co/t/performance-graphs-is-this-possible/252980)
**Author:** [@Toontje](https://discuss.elastic.co/u/Toontje)\ **Replies:** 2\ **Last updated:** [October 28, 2020, 9:09am UTC](https://discuss.elastic.co/t/performance-graphs-is-this-possible/252980 "2020-10-28T09:09:54Z")
New to ELK. I want to collect data from two hardware devices and measure and visualise the throughput of those devices. The idea is the following: Two devices send data to Elasticsearch. In Kibana i create a dashboard t… --- ## [How to add a button in kibana 7.8.1 dashboard](https://discuss.elastic.co/t/how-to-add-a-button-in-kibana-7-8-1-dashboard/253402)
**Author:** [@Abhi6](https://discuss.elastic.co/u/Abhi6)\ **Replies:** 6\ **Last updated:** [October 28, 2020, 9:06am UTC](https://discuss.elastic.co/t/how-to-add-a-button-in-kibana-7-8-1-dashboard/253402 "2020-10-28T09:06:04Z")
Is there any way to add a button to kibana dashboard --- ## [Term aggregation size well with in search.max\_buckets, still getting too-many-bucket errors](https://discuss.elastic.co/t/term-aggregation-size-well-with-in-search-max-buckets-still-getting-too-many-bucket-errors/253535)
**Author:** [@nicholasb](https://discuss.elastic.co/u/nicholasb)\ **Replies:** 0\ **Last updated:** [October 28, 2020, 9:00am UTC](https://discuss.elastic.co/t/term-aggregation-size-well-with-in-search-max-buckets-still-getting-too-many-bucket-errors/253535 "2020-10-28T09:00:27Z")
The ES setup is with single-node and single-shard. There are around 15000 records being added on a given 8-hour window on a specific index. The search.max\_buckets is set to 10000. For the following query, if the size is… --- ## [Possible memory leak in Logstash 6.8.10](https://discuss.elastic.co/t/possible-memory-leak-in-logstash-6-8-10/253526)
**Author:** [@shreyas29](https://discuss.elastic.co/u/shreyas29)\ **Replies:** 0\ **Last updated:** [October 28, 2020, 8:04am UTC](https://discuss.elastic.co/t/possible-memory-leak-in-logstash-6-8-10/253526 "2020-10-28T08:04:20Z")
Version: Logstash 6.8.10 Operating System: Ubuntu 16.04 Config File (if you have sensitive info, please remove it): Not possible to share Sample Data: NA Steps to Reproduce: NA We are using Logstash in one of our micro… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1727) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1729)