# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1766 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1767 --- ## [Using processors with modules in Filebeat](https://discuss.elastic.co/t/using-processors-with-modules-in-filebeat/251001)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 5\ **Last updated:** [October 6, 2020, 6:15pm UTC](https://discuss.elastic.co/t/using-processors-with-modules-in-filebeat/251001 "2020-10-06T18:15:19Z")
TL;DR How do I add fields (or any processors) to the config for a preexisting module without editing the module source? Issue I'm attempting to add some fields to logs ingested via the system module. This is my modules.… --- ## [Filtering Kibana dashboard using vega](https://discuss.elastic.co/t/filtering-kibana-dashboard-using-vega/250911)
**Author:** [@mhlnk](https://discuss.elastic.co/u/mhlnk)\ **Replies:** 2\ **Last updated:** [October 6, 2020, 6:11pm UTC](https://discuss.elastic.co/t/filtering-kibana-dashboard-using-vega/250911 "2020-10-06T18:11:22Z")
Hello @nyuriks, I followed your example at the end of this post (https://github.com/elastic/kibana/issues/17210) to filter my dashboard from Vega visualization. This worked great. Thanks for a very clear example. I am … --- ## [EuiImage url](https://discuss.elastic.co/t/euiimage-url/242951)
**Author:** [@pgervais](https://discuss.elastic.co/u/pgervais)\ **Replies:** 3\ **Last updated:** [October 6, 2020, 6:03pm UTC](https://discuss.elastic.co/t/euiimage-url/242951 "2020-10-06T18:03:55Z")
Does EuiImage url support file access? I have tried to specify a png file that is within the plugin i'm developing. What is the path that the png file should contain in order to use local path for use with EuiImage? --- ## [Okta integration with Elasticsearch](https://discuss.elastic.co/t/okta-integration-with-elasticsearch/249734)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 3\ **Last updated:** [October 6, 2020, 6:03pm UTC](https://discuss.elastic.co/t/okta-integration-with-elasticsearch/249734 "2020-10-06T18:03:54Z")
Hi All, We are trying to do an integration of elasticsearch with Okta, we have succeded the integration for our development box, where we have not enabled any TLS/SSL. But when do the integration for production setup, … --- ## [Dynamically change Moving Average (Timelion)](https://discuss.elastic.co/t/dynamically-change-moving-average-timelion/251144)
**Author:** [@Max\_Handle](https://discuss.elastic.co/u/Max_Handle)\ **Replies:** 1\ **Last updated:** [October 6, 2020, 5:59pm UTC](https://discuss.elastic.co/t/dynamically-change-moving-average-timelion/251144 "2020-10-06T17:59:49Z")
Hi, Is there a way to dynamically change the moving average function in timelion. For example could I somehow write a conditional statement that references the selection of the time picker? So for example if the time pi… --- ## [Aggregation interval: 1m, bucket span: 1m](https://discuss.elastic.co/t/aggregation-interval-1m-bucket-span-1m/251043)
**Author:** [@liorhalperin](https://discuss.elastic.co/u/liorhalperin)\ **Replies:** 3\ **Last updated:** [October 6, 2020, 5:52pm UTC](https://discuss.elastic.co/t/aggregation-interval-1m-bucket-span-1m/251043 "2020-10-06T17:52:18Z")
when running job in machine learning i see: aggregation interval: 1m, bucket span: 1m i defined indeed bucket of 1 minute i didnt see the definution of interval - from where it takes it? --- ## [Filebeat not showing container logs](https://discuss.elastic.co/t/filebeat-not-showing-container-logs/251059)
**Author:** [@masber](https://discuss.elastic.co/u/masber)\ **Replies:** 0\ **Last updated:** [October 6, 2020, 12:05am UTC](https://discuss.elastic.co/t/filebeat-not-showing-container-logs/251059 "2020-10-06T00:05:34Z")
Hi, I have a Kubernetes test cluster with Filebeat running as Daemonset and a Redis container I want to monitor. Filebeat log shows it can find the container because the logs path (/var/log/containers/\*-20845e0aa57813e… --- ## [FIlebeat XML Parsing in Logstash](https://discuss.elastic.co/t/filebeat-xml-parsing-in-logstash/251165)
**Author:** [@teej](https://discuss.elastic.co/u/teej)\ **Replies:** 0\ **Last updated:** [October 6, 2020, 4:55pm UTC](https://discuss.elastic.co/t/filebeat-xml-parsing-in-logstash/251165 "2020-10-06T16:55:20Z")
I was running the following code to get xml parsed from a local file into an elastic index and it appears to work fine: input { file { path =\> "/tmp/test2.xml" sincedb\_path =\> "/dev/null" start\_position =\> … --- ## [Unable to install elasticsearch in RHEL 7 due to polkit error](https://discuss.elastic.co/t/unable-to-install-elasticsearch-in-rhel-7-due-to-polkit-error/249845)
**Author:** [@aknraj](https://discuss.elastic.co/u/aknraj)\ **Replies:** 12\ **Last updated:** [October 6, 2020, 4:26pm UTC](https://discuss.elastic.co/t/unable-to-install-elasticsearch-in-rhel-7-due-to-polkit-error/249845 "2020-10-06T16:26:21Z")
Trying to install elasticsearch in RHEL 7, but it has been failed with polkit error (please refer below for the detailed error) - I tried to reinstall and also with full permissions on the file as recommended in other to… --- ## [Json parsing / containers / kubernetes](https://discuss.elastic.co/t/json-parsing-containers-kubernetes/251161)
**Author:** [@Michael\_Eaton](https://discuss.elastic.co/u/Michael_Eaton)\ **Replies:** 0\ **Last updated:** [October 6, 2020, 4:15pm UTC](https://discuss.elastic.co/t/json-parsing-containers-kubernetes/251161 "2020-10-06T16:15:29Z")
Hi I have a nodejs application that is running in Kubernetes, and i have filebeat setup as a DaemonSet - all working pretty well, i'm trying to get the logs from my nodejs app which uses the Winston logger and logs in j… --- ## [Where do I find proper syntax for configuring logstash?](https://discuss.elastic.co/t/where-do-i-find-proper-syntax-for-configuring-logstash/251160)
**Author:** [@csheridan](https://discuss.elastic.co/u/csheridan)\ **Replies:** 0\ **Last updated:** [October 6, 2020, 4:03pm UTC](https://discuss.elastic.co/t/where-do-i-find-proper-syntax-for-configuring-logstash/251160 "2020-10-06T16:03:19Z")
I have a server setup with ElasticSearch and Logstash. My plan is to have many remote servers with Filebeat installed and configured to send to this server. Currently, I am trying to get a single node setup so I know how… --- ## [ELK Platinum : Active Directory error](https://discuss.elastic.co/t/elk-platinum-active-directory-error/250780)
**Author:** [@nityaraj06](https://discuss.elastic.co/u/nityaraj06)\ **Replies:** 1\ **Last updated:** [October 6, 2020, 3:34pm UTC](https://discuss.elastic.co/t/elk-platinum-active-directory-error/250780 "2020-10-06T15:34:26Z")
Hi I have added the following config in elasticsearch.yml xpack: security: authc: realms: active\_directory: my\_ad: order: 0 domain\_name: abcd.xyz.org url: ldap://abcd.xyz.org:389 bind\_dn: nitya.raj@abcd.xyz.or… --- ## [Tracking user analytics on ELK Cloud](https://discuss.elastic.co/t/tracking-user-analytics-on-elk-cloud/251151)
**Author:** [@hsn752](https://discuss.elastic.co/u/hsn752)\ **Replies:** 1\ **Last updated:** [October 6, 2020, 3:07pm UTC](https://discuss.elastic.co/t/tracking-user-analytics-on-elk-cloud/251151 "2020-10-06T15:07:45Z")
How can we get the user metrics and their usage? I would like to know how many users are accessing/hitting my dashboards on the elk cloud. I'm using the Platinum package on the elastic cloud. Please advise --- ## [How to implement forked path pattern pipeline](https://discuss.elastic.co/t/how-to-implement-forked-path-pattern-pipeline/251154)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 0\ **Last updated:** [October 6, 2020, 3:04pm UTC](https://discuss.elastic.co/t/how-to-implement-forked-path-pattern-pipeline/251154 "2020-10-06T15:04:21Z")
Hi, I need some guidance understanding how to implement a forked path pattern pipeline as described here. I'm running Logstash in a Kubernetes environment and have the following configured in my logstash.yml file: xpa… --- ## [JSON file -\> Filebeat -\> Logstash](https://discuss.elastic.co/t/json-file-filebeat-logstash/250636)
**Author:** [@AnthonyS4](https://discuss.elastic.co/u/AnthonyS4)\ **Replies:** 6\ **Last updated:** [October 6, 2020, 2:59pm UTC](https://discuss.elastic.co/t/json-file-filebeat-logstash/250636 "2020-10-06T14:59:51Z")
Hi, I'm trying to parse a JSON file with Filebeat and then send it to Logstash, Logstash is not receiving data then there is no an output file, these are my configs.yml: filebeat.yml filebeat.inputs: - type: log … --- ## [If Else in logstash filter](https://discuss.elastic.co/t/if-else-in-logstash-filter/251019)
**Author:** [@Rahul\_Ravichandran](https://discuss.elastic.co/u/Rahul_Ravichandran)\ **Replies:** 6\ **Last updated:** [October 6, 2020, 2:53pm UTC](https://discuss.elastic.co/t/if-else-in-logstash-filter/251019 "2020-10-06T14:53:38Z")
hey Guys, kindly help me to solve this There are two types of messages that i am trying to parse 1. {"Code":"BOSIIF902","Message":"Backup stopped. Error during the backup :: SOAP-ERROR: P","time":1583470627,"userId"… --- ## [Unrecognized VM option 'UseConcMarkSweepGC'](https://discuss.elastic.co/t/unrecognized-vm-option-useconcmarksweepgc/251109)
**Author:** [@dewell](https://discuss.elastic.co/u/dewell)\ **Replies:** 1\ **Last updated:** [October 6, 2020, 2:30pm UTC](https://discuss.elastic.co/t/unrecognized-vm-option-useconcmarksweepgc/251109 "2020-10-06T14:30:07Z")
Hello, in my work I got access to a virtual machine with elasticsearch. It used to be running so I didn't have to change something myself. For some reason it stopped and when I try to restart it I get the following erro… --- ## [Logstash imap input unable to read attachment](https://discuss.elastic.co/t/logstash-imap-input-unable-to-read-attachment/251143)
**Author:** [@charles97](https://discuss.elastic.co/u/charles97)\ **Replies:** 0\ **Last updated:** [October 6, 2020, 2:27pm UTC](https://discuss.elastic.co/t/logstash-imap-input-unable-to-read-attachment/251143 "2020-10-06T14:27:05Z")
I tried to parse e-mail attachment using IMAP input plugin in Logstash, but it keeps on returning error as: \[ERROR\] 2020-10-06 21:33:40.789 \[\[main\]\"Can not decode… --- ## [How to fix the sql\_last\_value time?](https://discuss.elastic.co/t/how-to-fix-the-sql-last-value-time/251120)
**Author:** [@gabriel137](https://discuss.elastic.co/u/gabriel137)\ **Replies:** 1\ **Last updated:** [October 6, 2020, 2:25pm UTC](https://discuss.elastic.co/t/how-to-fix-the-sql-last-value-time/251120 "2020-10-06T14:25:05Z")
How do I adjust the logstash time to match my database time? When I try to synchronize with my column update, the logstash seems to be well ahead of the bank's current time --- ## [Metricbeat index without version number](https://discuss.elastic.co/t/metricbeat-index-without-version-number/251141)
**Author:** [@graimato](https://discuss.elastic.co/u/graimato)\ **Replies:** 0\ **Last updated:** [October 6, 2020, 1:52pm UTC](https://discuss.elastic.co/t/metricbeat-index-without-version-number/251141 "2020-10-06T13:52:30Z")
Dear all, I have many metricbeat and filebeat that are sending data on kibana. I set up my lifecycle policy eg. 50GB and 30d, but each metricbeat uses as index metricbeat-{version} and I have every time update lifecycle… --- ## [Java High Level Rest Client to Elasicsearch](https://discuss.elastic.co/t/java-high-level-rest-client-to-elasicsearch/250929)
**Author:** [@pathfinder225](https://discuss.elastic.co/u/pathfinder225)\ **Replies:** 4\ **Last updated:** [October 6, 2020, 2:17pm UTC](https://discuss.elastic.co/t/java-high-level-rest-client-to-elasicsearch/250929 "2020-10-06T14:17:18Z")
Hi I am using Java High Level Rest client on Spring boot to perform Search API operations. Our Elasticsearch is protected with https and basic(user/pwd) authentication. I'm receiving below exception , javax.net.ssl.S… --- ## [Elasticsearch use case and implementation approach](https://discuss.elastic.co/t/elasticsearch-use-case-and-implementation-approach/251082)
**Author:** [@ocmvin](https://discuss.elastic.co/u/ocmvin)\ **Replies:** 0\ **Last updated:** [October 6, 2020, 7:57am UTC](https://discuss.elastic.co/t/elasticsearch-use-case-and-implementation-approach/251082 "2020-10-06T07:57:12Z")
Problem Statement : Relational DB schema as below Employee 1 ---\> Many --Contact (e.g. Mobile Phone number,email id ,Office Phone number,Home Phone Number) Contact Description 1 -\>Many Contact (Contact Description Mas… --- ## [ElasticSearch Query Range with timezone is not working](https://discuss.elastic.co/t/elasticsearch-query-range-with-timezone-is-not-working/250877)
**Author:** [@mastersmit](https://discuss.elastic.co/u/mastersmit)\ **Replies:** 9\ **Last updated:** [October 6, 2020, 2:07pm UTC](https://discuss.elastic.co/t/elasticsearch-query-range-with-timezone-is-not-working/250877 "2020-10-06T14:07:46Z")
Hi, I am currently facing a weird issue, when I am include timezone, the elastic search is returning zero hits: { "took" : 0, "timed\_out" : false, "\_shards" : { "total" : 1, "successful" : 1, "skipped"… --- ## [Error: Unsupported script sort type: date at castSortType](https://discuss.elastic.co/t/error-unsupported-script-sort-type-date-at-castsorttype/250531)
**Author:** [@balamelangi](https://discuss.elastic.co/u/balamelangi)\ **Replies:** 7\ **Last updated:** [October 6, 2020, 2:02pm UTC](https://discuss.elastic.co/t/error-unsupported-script-sort-type-date-at-castsorttype/250531 "2020-10-06T14:02:42Z")
@here I added my scripted field in kibana. SimpleDateFormat f = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss Z"); f.setTimeZone(TimeZone.getTimeZone("America/Chicago")); f.parse(doc\['starttime.keyword'\].value); Even Adde… --- ## [FileBeat harvester doesn't work on the defined path with 777 permission](https://discuss.elastic.co/t/filebeat-harvester-doesnt-work-on-the-defined-path-with-777-permission/251133)
**Author:** [@BTH.S3](https://discuss.elastic.co/u/BTH.S3)\ **Replies:** 1\ **Last updated:** [October 6, 2020, 1:42pm UTC](https://discuss.elastic.co/t/filebeat-harvester-doesnt-work-on-the-defined-path-with-777-permission/251133 "2020-10-06T13:42:42Z")
I was deployed ELK on local host and filebeat on remote host in order to fetch log from remote to local by using docker-compose for ELK and docker run for filebeat. The flow will be like Filebeat(remote) -\> Logstash (lo… --- ## [Flatten the index json data](https://discuss.elastic.co/t/flatten-the-index-json-data/251076)
**Author:** [@Abhi6](https://discuss.elastic.co/u/Abhi6)\ **Replies:** 1\ **Last updated:** [October 6, 2020, 1:37pm UTC](https://discuss.elastic.co/t/flatten-the-index-json-data/251076 "2020-10-06T13:37:42Z")
\[ "code" { 1 }, "foo"{ "bar" }, "foo1" { "number": 1, "type": "In progrss", "submit\_time": "2020-10-04 "id\_type": 2153707, "order\_id": 1601849877, "foo2": \[ "xyz", "qwe", "yty" \], "order\_date": 19/09/… --- ## [Alerting In AWS Elasticsearch Kibana](https://discuss.elastic.co/t/alerting-in-aws-elasticsearch-kibana/251127)
**Author:** [@kennedy](https://discuss.elastic.co/u/kennedy)\ **Replies:** 1\ **Last updated:** [October 6, 2020, 1:24pm UTC](https://discuss.elastic.co/t/alerting-in-aws-elasticsearch-kibana/251127 "2020-10-06T13:24:08Z")
Hi Everyone, So here is the scenario , I have metricbeat installed on 2 different servers. The feed is going from the logstash to the AWS Elasticsearch. Now , I'm setting up the alerting in kibana for cpu utilization. {… --- ## [Create index pattern from C# Nest](https://discuss.elastic.co/t/create-index-pattern-from-c-nest/249113)
**Author:** [@Alder](https://discuss.elastic.co/u/Alder)\ **Replies:** 2\ **Last updated:** [October 6, 2020, 1:09pm UTC](https://discuss.elastic.co/t/create-index-pattern-from-c-nest/249113 "2020-10-06T13:09:22Z")
Hello everyone. I need to create an index pattern using C # Nest, without using kibana. I searched the Nest API but didn't find it. Is possible create index pattern using the Nest API? Regards, Alder --- ## [Get email notifications on new entries](https://discuss.elastic.co/t/get-email-notifications-on-new-entries/250672)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 2\ **Last updated:** [October 6, 2020, 1:07pm UTC](https://discuss.elastic.co/t/get-email-notifications-on-new-entries/250672 "2020-10-06T13:07:20Z")
I have set up a honeypot in one of our segments. When someone logs into it, it logs the credentials into a log file. Using filebeat, I ship the new entries from the log to the elastic stack which looks like that on the d… --- ## [Visualization by STATUS field which changes his state](https://discuss.elastic.co/t/visualization-by-status-field-which-changes-his-state/251071)
**Author:** [@ahmadsayeed3](https://discuss.elastic.co/u/ahmadsayeed3)\ **Replies:** 3\ **Last updated:** [October 6, 2020, 12:31pm UTC](https://discuss.elastic.co/t/visualization-by-status-field-which-changes-his-state/251071 "2020-10-06T12:31:33Z")
Hi, I recently started working on Kibana visualization so I know very less about it. Allow me to explain my use case. I have a STATUS field which has 4 states. In-Queue, In-Progress, Completed and Purged. In parallel… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1765) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1767)