# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1745 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1746 --- ## [Commercial Elastic: Powerful 3-nodes cluster vs weak 30-nodes cluster](https://discuss.elastic.co/t/commercial-elastic-powerful-3-nodes-cluster-vs-weak-30-nodes-cluster/252244)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 6\ **Last updated:** [October 17, 2020, 12:47am UTC](https://discuss.elastic.co/t/commercial-elastic-powerful-3-nodes-cluster-vs-weak-30-nodes-cluster/252244 "2020-10-17T00:47:47Z")
I am wondering what is the difference between the cost of a powerful 3-nodes cluster (let's say, 320gb of RAM, tons of CPUs), vs a 30-nodes cluster but each node as 2gb RAM and 2 CPUs. It seems that the 3-nodes cluster … --- ## [Kibana for arm64](https://discuss.elastic.co/t/kibana-for-arm64/252391)
**Author:** [@elaair](https://discuss.elastic.co/u/elaair)\ **Replies:** 2\ **Last updated:** [October 16, 2020, 10:59pm UTC](https://discuss.elastic.co/t/kibana-for-arm64/252391 "2020-10-16T22:59:09Z")
I just installed Elasticsearch on a pi4 and then I found that Kibana won't install because there isn't a package for arm64. Whats up with that? --- ## [Space Restriction - Seeing Other Spaces](https://discuss.elastic.co/t/space-restriction-seeing-other-spaces/252376)
**Author:** [@teej](https://discuss.elastic.co/u/teej)\ **Replies:** 5\ **Last updated:** [October 16, 2020, 10:16pm UTC](https://discuss.elastic.co/t/space-restriction-seeing-other-spaces/252376 "2020-10-16T22:16:27Z")
Hi, I am trying to restrict users from seeing each others spaces when they log in via their own account. When They log in, they should only see their own account. When I look at the restriction features I see; Discove… --- ## [Making Logstash and/or Filebeats process one entry at a time](https://discuss.elastic.co/t/making-logstash-and-or-filebeats-process-one-entry-at-a-time/251822)
**Author:** [@jonVR](https://discuss.elastic.co/u/jonVR)\ **Replies:** 9\ **Last updated:** [October 16, 2020, 10:04pm UTC](https://discuss.elastic.co/t/making-logstash-and-or-filebeats-process-one-entry-at-a-time/251822 "2020-10-16T22:04:18Z")
I currently have a setup where Filebeats is tracking a folder (in which there is only 1 file), and sends entries to Logstash. In my logstash.yml, I have pipeline.workers set to 1. Here is a snippet of my logstash.conf, f… --- ## [TSVB - Series Agg - remove or don't display 0 value](https://discuss.elastic.co/t/tsvb-series-agg-remove-or-dont-display-0-value/252329)
**Author:** [@Nibeckj](https://discuss.elastic.co/u/Nibeckj)\ **Replies:** 1\ **Last updated:** [October 16, 2020, 9:58pm UTC](https://discuss.elastic.co/t/tsvb-series-agg-remove-or-dont-display-0-value/252329 "2020-10-16T21:58:23Z")
Hello, I have TSVB time series graf. I have series Agg with filter of range day and range hours by scriplet there are no value for saturday and sunday. All are OK expected, I view some zero value in series agg be… --- ## [Drop all system event](https://discuss.elastic.co/t/drop-all-system-event/252366)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 6\ **Last updated:** [October 16, 2020, 7:53pm UTC](https://discuss.elastic.co/t/drop-all-system-event/252366 "2020-10-16T19:53:21Z")
I just want to monitor user processed using metricbeat currently it is giving me all the system process as well like kworker, systemd etc... how do I drop them? I think drop\_event in system.yml file needs to be set. bu… --- ## [Could Not index event to ElasticSearch](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch/250027)
**Author:** [@dhoman](https://discuss.elastic.co/u/dhoman)\ **Replies:** 37\ **Last updated:** [October 16, 2020, 7:05pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch/250027 "2020-10-16T19:05:06Z")
I am new to Elasticsearch, and I had been running Elasticsearch, Kibana, Filebeat, and Zabbix Server. My visualization stopped on August 28. I can pull visualization before that just fine. But when I try to watch curren… --- ## [GeoIP mapping returns wrong results](https://discuss.elastic.co/t/geoip-mapping-returns-wrong-results/251871)
**Author:** [@norgro2601](https://discuss.elastic.co/u/norgro2601)\ **Replies:** 3\ **Last updated:** [October 16, 2020, 6:54pm UTC](https://discuss.elastic.co/t/geoip-mapping-returns-wrong-results/251871 "2020-10-16T18:54:49Z")
I use the geoip processor to enhance packetbeat documents. The ingest pipeline looks like this: { "geoip-info" : { "description" : "Add geoip info", "processors" : \[ { "geoip" : { "fiel… --- ## [Suggestions on what Large test cluster footprint might look like?](https://discuss.elastic.co/t/suggestions-on-what-large-test-cluster-footprint-might-look-like/252388)
**Author:** [@rgeisman](https://discuss.elastic.co/u/rgeisman)\ **Replies:** 0\ **Last updated:** [October 16, 2020, 6:54pm UTC](https://discuss.elastic.co/t/suggestions-on-what-large-test-cluster-footprint-might-look-like/252388 "2020-10-16T18:54:24Z")
Hello all. Great conference by the way. Excellent question answer sessions and breakout talks. One question I wanted to ask is that I have setup an ELK stack to monitor 1000+ nodes with filebeat, metricbeat, Suricata and… --- ## [Elasticsearch connection idle timeout](https://discuss.elastic.co/t/elasticsearch-connection-idle-timeout/252283)
**Author:** [@lnitin](https://discuss.elastic.co/u/lnitin)\ **Replies:** 7\ **Last updated:** [October 16, 2020, 6:44pm UTC](https://discuss.elastic.co/t/elasticsearch-connection-idle-timeout/252283 "2020-10-16T18:44:58Z")
Hello, Elasticsearch server is rejecting any communication after certain amount of time interval if there is no activity from source server and connection is getting lost.? Can connection be open at all times, Is there … --- ## [Create metric graph, line graph with timetaken and want to group it by two fields (A, B)](https://discuss.elastic.co/t/create-metric-graph-line-graph-with-timetaken-and-want-to-group-it-by-two-fields-a-b/251730)
**Author:** [@Lata\_Pukale](https://discuss.elastic.co/u/Lata_Pukale)\ **Replies:** 3\ **Last updated:** [October 16, 2020, 6:38pm UTC](https://discuss.elastic.co/t/create-metric-graph-line-graph-with-timetaken-and-want-to-group-it-by-two-fields-a-b/251730 "2020-10-16T18:38:32Z")
I want to get metric and line graph visualization where it displays average timetaken by A and B where values of A can be ac,au ,ad and B can be bs,bc,bu So when I try to get metric visualization with Metric Average Ti… --- ## [How make filebeat harvest not end of file](https://discuss.elastic.co/t/how-make-filebeat-harvest-not-end-of-file/252369)
**Author:** [@Nicolas\_Perez1](https://discuss.elastic.co/u/Nicolas_Perez1)\ **Replies:** 2\ **Last updated:** [October 16, 2020, 6:33pm UTC](https://discuss.elastic.co/t/how-make-filebeat-harvest-not-end-of-file/252369 "2020-10-16T18:33:58Z")
hi, i have a application what write in the last line information incomplete and i need how make filebeat read one line before the end of file. this is a problem the application re write the last line --- ## [Append logs using filebeat](https://discuss.elastic.co/t/append-logs-using-filebeat/252322)
**Author:** [@Abhishek\_Sharma](https://discuss.elastic.co/u/Abhishek_Sharma)\ **Replies:** 1\ **Last updated:** [October 16, 2020, 5:55pm UTC](https://discuss.elastic.co/t/append-logs-using-filebeat/252322 "2020-10-16T17:55:39Z")
My logs produce some content that I can see only when appended using (-A 20) or (- A 200). For Ex: While seeing a log from a docker container, I do : docker logs \[container\_id\] | grep "something" -A 20 Now i have imple… --- ## [Elasticsearch-hadoop spark connector unable to connect/write using out-of-box ES server setup, & default library settings](https://discuss.elastic.co/t/elasticsearch-hadoop-spark-connector-unable-to-connect-write-using-out-of-box-es-server-setup-default-library-settings/251981)
**Author:** [@Chris\_Bedford](https://discuss.elastic.co/u/Chris_Bedford)\ **Replies:** 3\ **Last updated:** [October 16, 2020, 5:52pm UTC](https://discuss.elastic.co/t/elasticsearch-hadoop-spark-connector-unable-to-connect-write-using-out-of-box-es-server-setup-default-library-settings/251981 "2020-10-16T17:52:29Z")
I had some problems using the Elasticsearch connector for Spark described here: https://www.elastic.co/guide/en/elasticsearch/hadoop/master/spark.html. I could not even get the examples on their page working with a plain… --- ## [Repeatedly dashboard importing is needed for same beats in multiple machines?](https://discuss.elastic.co/t/repeatedly-dashboard-importing-is-needed-for-same-beats-in-multiple-machines/251434)
**Author:** [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Replies:** 3\ **Last updated:** [October 16, 2020, 5:25pm UTC](https://discuss.elastic.co/t/repeatedly-dashboard-importing-is-needed-for-same-beats-in-multiple-machines/251434 "2020-10-16T17:25:55Z")
Hi All , Dashboard importing is needed for same beat agents in multiple machines ? For Example I am planning to install metricbeat in 10 Linux machines . Is there dashboard importing is needed in all 10 Linux machin… --- ## [BUG assigning ILM policy to \_index\_template](https://discuss.elastic.co/t/bug-assigning-ilm-policy-to-index-template/252034)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 4\ **Last updated:** [October 16, 2020, 5:06pm UTC](https://discuss.elastic.co/t/bug-assigning-ilm-policy-to-index-template/252034 "2020-10-16T17:06:27Z")
How I can assign ILM Policy to \_index\_template I found this tutorial: I have version 7.9 and in older version (\_template) there was a button add policy to index template in recent version 7.9 \_index\_template is not… --- ## [Search\_phase\_execution\_exception all shards failed (filebeat + netflow)](https://discuss.elastic.co/t/search-phase-execution-exception-all-shards-failed-filebeat-netflow/252372)
**Author:** [@leostereo](https://discuss.elastic.co/u/leostereo)\ **Replies:** 0\ **Last updated:** [October 16, 2020, 4:56pm UTC](https://discuss.elastic.co/t/search-phase-execution-exception-all-shards-failed-filebeat-netflow/252372 "2020-10-16T16:56:17Z")
Hello , I know it is a well known issue , but after looking on others solutions can not solve it. Im running filebeat with netflow module. It was working ok , but now I have this meesage on discover kibana interface: … --- ## [Alphabetically sorting + aggregation ElasticSearch](https://discuss.elastic.co/t/alphabetically-sorting-aggregation-elasticsearch/251414)
**Author:** [@het](https://discuss.elastic.co/u/het)\ **Replies:** 8\ **Last updated:** [October 16, 2020, 4:34pm UTC](https://discuss.elastic.co/t/alphabetically-sorting-aggregation-elasticsearch/251414 "2020-10-16T16:34:13Z")
Hi team, I am using aggregation to get grouped records. I am not able to sort the buckets. Dummy Data : { "\_index": "testing-aggregation", "\_type": "employee", "\_id": "emp001\_local000000000000001", "\_s… --- ## [Large composite agg + sorting](https://discuss.elastic.co/t/large-composite-agg-sorting/252126)
**Author:** [@joropito](https://discuss.elastic.co/u/joropito)\ **Replies:** 7\ **Last updated:** [October 16, 2020, 4:19pm UTC](https://discuss.elastic.co/t/large-composite-agg-sorting/252126 "2020-10-16T16:19:21Z")
Composite aggregation doesn't work very well with bucket\_sort aggregation. I know this was talked and explained lot of times. My scenario works with a composite aggregation on few fields, some metrics inside (max, min,… --- ## [Elastic stack basic edition and login security](https://discuss.elastic.co/t/elastic-stack-basic-edition-and-login-security/252364)
**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Replies:** 1\ **Last updated:** [October 16, 2020, 3:59pm UTC](https://discuss.elastic.co/t/elastic-stack-basic-edition-and-login-security/252364 "2020-10-16T15:59:32Z")
I downloaded latest 7.9 version and I read basic security is now included in basic/free license but i dont see any option in kibana to create user/password or roles. How do I add security to the basic instance and protec… --- ## [Custom Logo Kibana 7.9.2 (guide)](https://discuss.elastic.co/t/custom-logo-kibana-7-9-2-guide/250814)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 6\ **Last updated:** [October 16, 2020, 3:49pm UTC](https://discuss.elastic.co/t/custom-logo-kibana-7-9-2-guide/250814 "2020-10-16T15:49:38Z")
Only verified on Kibana 7.9.2 running in Debian 10 Hello, For all users who, like me, need to customize the logos in Kibana, I share this guide that I have been creating myself as I have been able to solve each problem… --- ## [Date formatting yyyy.MM.dd](https://discuss.elastic.co/t/date-formatting-yyyy-mm-dd/251588)
**Author:** [@VeeT](https://discuss.elastic.co/u/VeeT)\ **Replies:** 6\ **Last updated:** [October 16, 2020, 3:26pm UTC](https://discuss.elastic.co/t/date-formatting-yyyy-mm-dd/251588 "2020-10-16T15:26:27Z")
I have a Date input in yyyy.MM.dd format but is getting converted to yyyy.MM.dd HH:mm:ss.ZZZ with the time getting set to "20:00:00.000". For example, the Date in put is "2020.10.09" but it's getting displayed in Kiban… --- ## [How to add "null" value in elastic search field if data is empty?](https://discuss.elastic.co/t/how-to-add-null-value-in-elastic-search-field-if-data-is-empty/247886)
**Author:** [@rifas\_ali\_pbi](https://discuss.elastic.co/u/rifas_ali_pbi)\ **Replies:** 3\ **Last updated:** [October 16, 2020, 3:26pm UTC](https://discuss.elastic.co/t/how-to-add-null-value-in-elastic-search-field-if-data-is-empty/247886 "2020-10-16T15:26:25Z")
--- ## [Filebeat for Openshift and Kubernetes audit logs](https://discuss.elastic.co/t/filebeat-for-openshift-and-kubernetes-audit-logs/249287)
**Author:** [@sayeedc](https://discuss.elastic.co/u/sayeedc)\ **Replies:** 3\ **Last updated:** [October 16, 2020, 2:58pm UTC](https://discuss.elastic.co/t/filebeat-for-openshift-and-kubernetes-audit-logs/249287 "2020-10-16T14:58:21Z")
Hi, What’s the best way to collect Openshift and Kubernetes audit logs with Filebeats? Auditbeat doesn’t seem to have any options to inspect Kube or OCP audit log files. Thanks, Sayeed --- ## [Use an analyzer and a normalizer at the same time on the same field?](https://discuss.elastic.co/t/use-an-analyzer-and-a-normalizer-at-the-same-time-on-the-same-field/252356)
**Author:** [@Nicolas\_Rey](https://discuss.elastic.co/u/Nicolas_Rey)\ **Replies:** 3\ **Last updated:** [October 16, 2020, 2:51pm UTC](https://discuss.elastic.co/t/use-an-analyzer-and-a-normalizer-at-the-same-time-on-the-same-field/252356 "2020-10-16T14:51:15Z")
Hi, for some reason, if need to query (prefix) with an insensitive case on a text field, but I would like to keep the advantage of the tokenisation made by the default Analyzer on the same field, is it possible ? Examp… --- ## [How put 2 scripts in a watcher](https://discuss.elastic.co/t/how-put-2-scripts-in-a-watcher/252350)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 5\ **Last updated:** [October 16, 2020, 2:21pm UTC](https://discuss.elastic.co/t/how-put-2-scripts-in-a-watcher/252350 "2020-10-16T14:21:08Z")
hello how can i put 2 scripts in an alert? i have one that is from "ctx.payload.time\_triggered" and the other is for "metric.agg". i need help with this... { "trigger": { "schedule": { "interval": "1h" }… --- ## [Pipeline not starting](https://discuss.elastic.co/t/pipeline-not-starting/252112)
**Author:** [@dorcas](https://discuss.elastic.co/u/dorcas)\ **Replies:** 0\ **Last updated:** [October 14, 2020, 10:41pm UTC](https://discuss.elastic.co/t/pipeline-not-starting/252112 "2020-10-14T22:41:35Z")
kindly help pipeline action failing :exception=\>#\ Could not execute action: PipelineAction::Create after add truststore index =\> "Sample" user =\> "Log… --- ## [Regarding Ingestion Exception](https://discuss.elastic.co/t/regarding-ingestion-exception/252230)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 2\ **Last updated:** [October 16, 2020, 2:09pm UTC](https://discuss.elastic.co/t/regarding-ingestion-exception/252230 "2020-10-16T14:09:08Z")
Hi, I'm seeing an exception during ingestion. Ingestion rates have fallen to very low rates for no apparent reason. Would appreciate some input here: \[2020-10-15T15:46:51,605\]\[WARN \]\[o.e.x.m.e.l.LocalExporter\] \[node-A\]… --- ## [Watcher with field query error](https://discuss.elastic.co/t/watcher-with-field-query-error/252059)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 1\ **Last updated:** [October 16, 2020, 1:59pm UTC](https://discuss.elastic.co/t/watcher-with-field-query-error/252059 "2020-10-16T13:59:52Z")
hello, I have a problem with a watcher, I need to find a field and is equal to the value I specify, but I get that is an unknown field and I need the "monitor.name.keyword" is equal to "01-1-CAV30328203-DATOS-PPAL-2.7G-9… --- ## [Logstash Filter Error](https://discuss.elastic.co/t/logstash-filter-error/252252)
**Author:** [@iccMe](https://discuss.elastic.co/u/iccMe)\ **Replies:** 2\ **Last updated:** [October 16, 2020, 1:59pm UTC](https://discuss.elastic.co/t/logstash-filter-error/252252 "2020-10-16T13:59:50Z")
Hi, I am trying to pull out relevant fields from a log file message and pass it into elasticsearch. I am still in testing and have managed to use the grok debugger to pull out the fields I need. An example of the log me… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1744) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1746)