# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1765

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1766

---

## [How to change the top left header logo in kibana 7.9.2](https://discuss.elastic.co/t/how-to-change-the-top-left-header-logo-in-kibana-7-9-2/250084)

<div class="topic-metadata">

**Author:** [@witcher](https://discuss.elastic.co/u/witcher)\
**Replies:** 59\
**Last updated:** [October 7, 2020, 9:37am UTC](https://discuss.elastic.co/t/how-to-change-the-top-left-header-logo-in-kibana-7-9-2/250084 "2020-10-07T09:37:57Z")

</div>

this is where the dark theme is located. kibana-7.9.2-windows-x86\_64\\node\_modules\\@kbn\\ui-shared-deps\\target and this is the theme file exactly from inspecting the element. http://localhost:5601/33984/bundles/kbn-ui-s…

---

## [Compactiability of NGNIX version for elasticsearch](https://discuss.elastic.co/t/compactiability-of-ngnix-version-for-elasticsearch/251238)

<div class="topic-metadata">

**Author:** [@amp](https://discuss.elastic.co/u/amp)\
**Replies:** 1\
**Last updated:** [October 7, 2020, 9:33am UTC](https://discuss.elastic.co/t/compactiability-of-ngnix-version-for-elasticsearch/251238 "2020-10-07T09:33:25Z")

</div>

Hi, We are using elasticsearch (5.3)as datastore of app and NGNIX(1.10.2 ) used as revere proxy in the setup. Planning upgrade elasticsearch to 6.3 and is it compactable with NGNIX(1.10.2 ) ? Regards, AMP

---

## [How can I get rid off "org.elasticsearch.ElasticsearchException: Security must be explicitly enabled when using a \[basic\] license" message](https://discuss.elastic.co/t/how-can-i-get-rid-off-org-elasticsearch-elasticsearchexception-security-must-be-explicitly-enabled-when-using-a-basic-license-message/250647)

<div class="topic-metadata">

**Author:** [@masber](https://discuss.elastic.co/u/masber)\
**Replies:** 6\
**Last updated:** [October 7, 2020, 9:19am UTC](https://discuss.elastic.co/t/how-can-i-get-rid-off-org-elasticsearch-elasticsearchexception-security-must-be-explicitly-enabled-when-using-a-basic-license-message/250647 "2020-10-07T09:19:43Z")

</div>

Hi, I am testing elasticsearch in a test environment (no production) and I see this message in the logs: org.elasticsearch.ElasticsearchException: Security must be explicitly enabled when using a \[basic\] license How …

---

## [Multi line pattern in filebeat](https://discuss.elastic.co/t/multi-line-pattern-in-filebeat/250901)

<div class="topic-metadata">

**Author:** [@billy1](https://discuss.elastic.co/u/billy1)\
**Replies:** 2\
**Last updated:** [October 7, 2020, 8:45am UTC](https://discuss.elastic.co/t/multi-line-pattern-in-filebeat/250901 "2020-10-07T08:45:04Z")

</div>

Dears what will be the multiline pattern for below message in the file beat config , i tried all the way but its not getting correct output from filebeat to logstash tried with space filter but its not sending closing …

---

## [Counting the duplicates and non-duplicates of a count aggregation (revisited)](https://discuss.elastic.co/t/counting-the-duplicates-and-non-duplicates-of-a-count-aggregation-revisited/247856)

<div class="topic-metadata">

**Author:** [@benji87](https://discuss.elastic.co/u/benji87)\
**Replies:** 2\
**Last updated:** [October 7, 2020, 8:38am UTC](https://discuss.elastic.co/t/counting-the-duplicates-and-non-duplicates-of-a-count-aggregation-revisited/247856 "2020-10-07T08:38:51Z")

</div>

Hello all, My recently submitted topic was closed due to inactivity, but I just wondered if anyone else had any thoughts on it? You can find the original post here - https://discuss.elastic.co/t/counting-the-duplicates…

---

## [Multiword Search With Stemming](https://discuss.elastic.co/t/multiword-search-with-stemming/251195)

<div class="topic-metadata">

**Author:** [@toddsiegel](https://discuss.elastic.co/u/toddsiegel)\
**Replies:** 3\
**Last updated:** [October 7, 2020, 8:14am UTC](https://discuss.elastic.co/t/multiword-search-with-stemming/251195 "2020-10-07T08:14:33Z")

</div>

Hi all, I am new to ES (on Version: 7.9.0) and I have a case there I am searching with string that has more than one word, and I want the returned docs have all the contained words in the search phrase including stemmed…

---

## [Elasticsearch not showing data to Kibana on Centos 8](https://discuss.elastic.co/t/elasticsearch-not-showing-data-to-kibana-on-centos-8/251202)

<div class="topic-metadata">

**Author:** [@Taufik\_Maulana](https://discuss.elastic.co/u/Taufik_Maulana)\
**Replies:** 8\
**Last updated:** [October 7, 2020, 7:43am UTC](https://discuss.elastic.co/t/elasticsearch-not-showing-data-to-kibana-on-centos-8/251202 "2020-10-07T07:43:12Z")

</div>

Hello everyone, I've just install my Elasticsearch, Kibana, and FIlebeat on my Centos 8 (fresh minimal install). I also have configured xpack basic on each node. But when i wanted to see data on Discover tab on Kibana,…

---

## [Timezone conversion in ingest node date processor](https://discuss.elastic.co/t/timezone-conversion-in-ingest-node-date-processor/250810)

<div class="topic-metadata">

**Author:** [@norgro2601](https://discuss.elastic.co/u/norgro2601)\
**Replies:** 8\
**Last updated:** [October 7, 2020, 7:11am UTC](https://discuss.elastic.co/t/timezone-conversion-in-ingest-node-date-processor/250810 "2020-10-07T07:11:41Z")

</div>

Hi, I have logs with a timestamp coming in a format like this. \[9/21/20 10:38:02:681 EEST\] In Logstash, I've used the translate filter plugin to convert EEST to +03:00, I can't find a similar functionality with the in…

---

## [Mapper error on bulk insert, keyword vs text](https://discuss.elastic.co/t/mapper-error-on-bulk-insert-keyword-vs-text/251181)

<div class="topic-metadata">

**Author:** [@Andrew\_DS](https://discuss.elastic.co/u/Andrew_DS)\
**Replies:** 1\
**Last updated:** [October 7, 2020, 7:06am UTC](https://discuss.elastic.co/t/mapper-error-on-bulk-insert-keyword-vs-text/251181 "2020-10-07T07:06:19Z")

</div>

I'm getting the following error message when bulk-indexing into a new index: \[2020-10-06T00:00:00,977\]\[DEBUG\]\[o.e.a.b.TransportShardBulkAction\] \[my-node\] \[my-idx\]\[1\] failed to execute bulk item (index) index {\[my-idx\]\[…

---

## [Metricbeat stopping or getting killed 7.9.1](https://discuss.elastic.co/t/metricbeat-stopping-or-getting-killed-7-9-1/251099)

<div class="topic-metadata">

**Author:** [@Prashant\_Achari](https://discuss.elastic.co/u/Prashant_Achari)\
**Replies:** 3\
**Last updated:** [October 7, 2020, 6:53am UTC](https://discuss.elastic.co/t/metricbeat-stopping-or-getting-killed-7-9-1/251099 "2020-10-07T06:53:01Z")

</div>

Hi Metric beat stops sending the metrics to elastic. Looks like it is getting killed internally. Logs as below 2020-10-06T08:02:36.529+0100 INFO \[monitoring\] log/log.go:145 Non-zero metrics in the last 30s …

---

## [Best way to visualize health and structure of data processing pipeline](https://discuss.elastic.co/t/best-way-to-visualize-health-and-structure-of-data-processing-pipeline/250458)

<div class="topic-metadata">

**Author:** [@FloJe](https://discuss.elastic.co/u/FloJe)\
**Replies:** 6\
**Last updated:** [October 7, 2020, 6:49am UTC](https://discuss.elastic.co/t/best-way-to-visualize-health-and-structure-of-data-processing-pipeline/250458 "2020-10-07T06:49:25Z")

</div>

Dear Forum, in one of our projects we want to monitor the components of several data processing pipelines. Each of these pipelines has the following structure: Connects to at least one data source Connects to at leas…

---

## [Logstash Aggregate copy last Event to Map](https://discuss.elastic.co/t/logstash-aggregate-copy-last-event-to-map/251149)

<div class="topic-metadata">

**Author:** [@siiman](https://discuss.elastic.co/u/siiman)\
**Replies:** 3\
**Last updated:** [October 7, 2020, 6:22am UTC](https://discuss.elastic.co/t/logstash-aggregate-copy-last-event-to-map/251149 "2020-10-07T06:22:12Z")

</div>

Hello there, I would like to combine several consecutive events. For this purpose I consider the use of the aggregation filter as useful. Since I don't have a specific start or end event, I will use example #3 in the Lo…

---

## [Powermax2000 monitoring](https://discuss.elastic.co/t/powermax2000-monitoring/251152)

<div class="topic-metadata">

**Author:** [@BoKu](https://discuss.elastic.co/u/BoKu)\
**Replies:** 2\
**Last updated:** [October 7, 2020, 6:18am UTC](https://discuss.elastic.co/t/powermax2000-monitoring/251152 "2020-10-07T06:18:18Z")

</div>

Hello, is there anyway to get metrics and logs of a powermax2000 into elasticsearch. It seems that the powermaxbeat is not working. Kind regards Boris

---

## [Kibana generate access\_token without user credentials](https://discuss.elastic.co/t/kibana-generate-access-token-without-user-credentials/250750)

<div class="topic-metadata">

**Author:** [@Ali\_Nazemian](https://discuss.elastic.co/u/Ali_Nazemian)\
**Replies:** 4\
**Last updated:** [October 7, 2020, 4:23am UTC](https://discuss.elastic.co/t/kibana-generate-access-token-without-user-credentials/250750 "2020-10-07T04:23:30Z")

</div>

I am looking for a way to use token based authentication for Kibana to give end-users an ability to use Kibana in an embedded iframe. Here is the flow that has worked for me: 1- use a system-level user with sufficient p…

---

## [CPU Usage (Dashboard) Not Show Value](https://discuss.elastic.co/t/cpu-usage-dashboard-not-show-value/251204)

<div class="topic-metadata">

**Author:** [@reza\_naipospos](https://discuss.elastic.co/u/reza_naipospos)\
**Replies:** 2\
**Last updated:** [October 7, 2020, 4:14am UTC](https://discuss.elastic.co/t/cpu-usage-dashboard-not-show-value/251204 "2020-10-07T04:14:02Z")

</div>

My dashboard not show CPU, RAM usage and etc. Only show Number of process value. metricbeat-7.9.1-x86\_64.rpm elasticsearch & Kibana version 7.9.1 I using logstash as output Please help me.

---

## [Benchmark jar is missing](https://discuss.elastic.co/t/benchmark-jar-is-missing/251207)

<div class="topic-metadata">

**Author:** [@Roman\_Kagan](https://discuss.elastic.co/u/Roman_Kagan)\
**Replies:** 0\
**Last updated:** [October 7, 2020, 4:11am UTC](https://discuss.elastic.co/t/benchmark-jar-is-missing/251207 "2020-10-07T04:11:48Z")

</div>

Hello: I wonder where can I find the benchmark.jar file in LogStash? Looks like it is missing from distribution. Blockquote #!/usr/bin/env bash java -cp "$(cd dirname $0/..; pwd)"'/tools/benchmark-cli/build/libs/be…

---

## [Regex can not match multiple line in painless](https://discuss.elastic.co/t/regex-can-not-match-multiple-line-in-painless/250442)

<div class="topic-metadata">

**Author:** [@le\_ba\_nam](https://discuss.elastic.co/u/le_ba_nam)\
**Replies:** 2\
**Last updated:** [October 7, 2020, 3:42am UTC](https://discuss.elastic.co/t/regex-can-not-match-multiple-line-in-painless/250442 "2020-10-07T03:42:18Z")

</div>

I want to catch some string in message field like that: 1600657611591|sendRequest\_http10.20.30.1448090BO||wsdlUrl:http://10.20.30.144:8090/BOC2Services/boc2/LocationStaffSaleHistoryService?wsdl: requestContent: \<soapenv…

---

## [Auditbeat and Filebeat ERROR instance/beat.go:951 Exiting: data path already locked by another beat](https://discuss.elastic.co/t/auditbeat-and-filebeat-error-instance-beat-go-951-exiting-data-path-already-locked-by-another-beat/251201)

<div class="topic-metadata">

**Author:** [@bilal\_abudan](https://discuss.elastic.co/u/bilal_abudan)\
**Replies:** 0\
**Last updated:** [October 7, 2020, 2:16am UTC](https://discuss.elastic.co/t/auditbeat-and-filebeat-error-instance-beat-go-951-exiting-data-path-already-locked-by-another-beat/251201 "2020-10-07T02:16:07Z")

</div>

Can someone help please...???? I am using Filebeat and Auditbeat, but when i start the services there's an error : ERROR instance/beat.go:951 Exiting: data path already locked by another beat. Please make sure tha…

---

## [Want to check check if Elastic search “read\_only\_allow\_delete” is true](https://discuss.elastic.co/t/want-to-check-check-if-elastic-search-read-only-allow-delete-is-true/251184)

<div class="topic-metadata">

**Author:** [@bob35](https://discuss.elastic.co/u/bob35)\
**Replies:** 1\
**Last updated:** [October 7, 2020, 1:55am UTC](https://discuss.elastic.co/t/want-to-check-check-if-elastic-search-read-only-allow-delete-is-true/251184 "2020-10-07T01:55:59Z")

</div>

Elastic 6.8 I want to write something (Python) that check if the “read\_only\_allow\_delete” is true, and if it’s true to do something(notify) Is it possible to write something that run all the indices and check the status …

---

## [RabbitMQ Module of Metricbeat giving 503 Service Unavailable Error](https://discuss.elastic.co/t/rabbitmq-module-of-metricbeat-giving-503-service-unavailable-error/251130)

<div class="topic-metadata">

**Author:** [@Ayush\_Agrahari](https://discuss.elastic.co/u/Ayush_Agrahari)\
**Replies:** 1\
**Last updated:** [October 6, 2020, 11:37pm UTC](https://discuss.elastic.co/t/rabbitmq-module-of-metricbeat-giving-503-service-unavailable-error/251130 "2020-10-06T23:37:39Z")

</div>

We are trying to setup RabbitMQ module in metricbeat to pull metrics. Please find metricbeat configuration details below - type: kubernetes node: ${NODE\_NAME} scope: cluster templat…

---

## [Different behavior between POST \_add and \_update endpoints on documents with epoch\_millis dates as strings or int/float](https://discuss.elastic.co/t/different-behavior-between-post-add-and-update-endpoints-on-documents-with-epoch-millis-dates-as-strings-or-int-float/251194)

<div class="topic-metadata">

**Author:** [@ljak](https://discuss.elastic.co/u/ljak)\
**Replies:** 0\
**Last updated:** [October 6, 2020, 10:45pm UTC](https://discuss.elastic.co/t/different-behavior-between-post-add-and-update-endpoints-on-documents-with-epoch-millis-dates-as-strings-or-int-float/251194 "2020-10-06T22:45:51Z")

</div>

Hello everyone, According to documentation https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-date-format.html#mapping-date-format ; Elasticsearch parses dates from Strings ... and such, even where …

---

## [How to implement document\_id/doc\_as\_upsert/action setting with amazon\_es plugin](https://discuss.elastic.co/t/how-to-implement-document-id-doc-as-upsert-action-setting-with-amazon-es-plugin/251193)

<div class="topic-metadata">

**Author:** [@Rajesh\_Parui](https://discuss.elastic.co/u/Rajesh_Parui)\
**Replies:** 0\
**Last updated:** [October 6, 2020, 10:34pm UTC](https://discuss.elastic.co/t/how-to-implement-document-id-doc-as-upsert-action-setting-with-amazon-es-plugin/251193 "2020-10-06T22:34:13Z")

</div>

Hello, I am trying to upload the data to the elastic search (hosted in AWS) via logstash with the amazon\_es plugin as an output plugin. the issue i am facing with the amazon\_es plugin I am unable to implement the doc…

---

## [Filter HTTPD\_COMBINEDLOG does not display QS:agent field in Kibana](https://discuss.elastic.co/t/filter-httpd-combinedlog-does-not-display-qs-agent-field-in-kibana/250575)

<div class="topic-metadata">

**Author:** [@earlsanchez](https://discuss.elastic.co/u/earlsanchez)\
**Replies:** 1\
**Last updated:** [October 6, 2020, 9:18pm UTC](https://discuss.elastic.co/t/filter-httpd-combinedlog-does-not-display-qs-agent-field-in-kibana/250575 "2020-10-06T21:18:42Z")

</div>

Hi All, I'm new to ELK but seems this should be an easy filter. I'm using filebeat version 7.9.2 to send Apache access logs to logstash 7.9.2 and then on to AWS Elasticsearch and Kibana 7.7 with the AWS ES plug-in. He…

---

## [Watcher custom email alert](https://discuss.elastic.co/t/watcher-custom-email-alert/251060)

<div class="topic-metadata">

**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\
**Replies:** 1\
**Last updated:** [October 6, 2020, 8:58pm UTC](https://discuss.elastic.co/t/watcher-custom-email-alert/251060 "2020-10-06T20:58:10Z")

</div>

I am trying to create an email alert using watcher. For advanced watcher options , do we have any sample templates to follow ? I would like to trigger emails when application date does not match with current date. How c…

---

## [ElasticSearch Benchmarking and stress testing](https://discuss.elastic.co/t/elasticsearch-benchmarking-and-stress-testing/251179)

<div class="topic-metadata">

**Author:** [@kagrahar](https://discuss.elastic.co/u/kagrahar)\
**Replies:** 0\
**Last updated:** [October 6, 2020, 7:16pm UTC](https://discuss.elastic.co/t/elasticsearch-benchmarking-and-stress-testing/251179 "2020-10-06T19:16:54Z")

</div>

Is there a tool other than esrally to benchmark elasticsearch? I need to generate atleast a TB of data. The goal is to see the backend storage performance on different disk media. Thanks in advance

---

## [How to use rowspan in kibana table?](https://discuss.elastic.co/t/how-to-use-rowspan-in-kibana-table/251173)

<div class="topic-metadata">

**Author:** [@WhatsIsKibana](https://discuss.elastic.co/u/WhatsIsKibana)\
**Replies:** 1\
**Last updated:** [October 6, 2020, 7:00pm UTC](https://discuss.elastic.co/t/how-to-use-rowspan-in-kibana-table/251173 "2020-10-06T19:00:02Z")

</div>

Hello there. I'm using "Data Table" visualization in kibana 6.8 with following settings: It works nice, but I would like to filter and join cells in rows into one, if values are equal. For example, I have the same va…

---

## [Bar Chart - Date Range - Display custom date format](https://discuss.elastic.co/t/bar-chart-date-range-display-custom-date-format/251049)

<div class="topic-metadata">

**Author:** [@adahn](https://discuss.elastic.co/u/adahn)\
**Replies:** 1\
**Last updated:** [October 6, 2020, 6:55pm UTC](https://discuss.elastic.co/t/bar-chart-date-range-display-custom-date-format/251049 "2020-10-06T18:55:50Z")

</div>

When I set the X axis for the chart by date range, it displays the date/time out to the millisecond. This makes the object very large with lots of whitespace on the dash. Can this be truncated or removed?

---

## [Aggregate events over a large period of time maintaining previous task maps](https://discuss.elastic.co/t/aggregate-events-over-a-large-period-of-time-maintaining-previous-task-maps/251178)

<div class="topic-metadata">

**Author:** [@arichiardi](https://discuss.elastic.co/u/arichiardi)\
**Replies:** 0\
**Last updated:** [October 6, 2020, 6:54pm UTC](https://discuss.elastic.co/t/aggregate-events-over-a-large-period-of-time-maintaining-previous-task-maps/251178 "2020-10-06T18:54:00Z")

</div>

Hi all, I am new to logstash and aggregate - but not too event sourcing/CQRS and I am looking for a strategy to handle the following problem. I have a product.created that contains the initial available products. I the…

---

## [Logstash filter conditions](https://discuss.elastic.co/t/logstash-filter-conditions/251175)

<div class="topic-metadata">

**Author:** [@MMerel](https://discuss.elastic.co/u/MMerel)\
**Replies:** 0\
**Last updated:** [October 6, 2020, 6:43pm UTC](https://discuss.elastic.co/t/logstash-filter-conditions/251175 "2020-10-06T18:43:38Z")

</div>

hi there, sorry to bother you but i´m completely new at this , I´m using version 7.9.2 of Elastic,Kibana ,Logstash and Beats , i successuflly connected them to a MQQT broker ang got some information about camera analytic…

---

## [Line Visualizations - Multiple Line - Filter specific per line](https://discuss.elastic.co/t/line-visualizations-multiple-line-filter-specific-per-line/251027)

<div class="topic-metadata">

**Author:** [@Guillaume\_Guibert](https://discuss.elastic.co/u/Guillaume_Guibert)\
**Replies:** 1\
**Last updated:** [October 6, 2020, 6:18pm UTC](https://discuss.elastic.co/t/line-visualizations-multiple-line-filter-specific-per-line/251027 "2020-10-06T18:18:23Z")

</div>

Hi to everyone, I pretty new in Kibana. I'd like to have a visualisation with 2 lines. I would like to add one filter per line. Did someone make it ? Many thanks

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1764)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1766)
