# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1767 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1768 --- ## [Logstash multiple configuration](https://discuss.elastic.co/t/logstash-multiple-configuration/251065)
**Author:** [@peretz\_shlomi](https://discuss.elastic.co/u/peretz_shlomi)\ **Replies:** 7\ **Last updated:** [October 6, 2020, 12:16pm UTC](https://discuss.elastic.co/t/logstash-multiple-configuration/251065 "2020-10-06T12:16:30Z")
Hello everyone I'm trying to install the logstash system with multipel I have a error to run ths system. error: D:\\logstash\\bin\>logstash --path.settings d:/logstash/config Java HotSpot(TM) 64-Bit Server VM warning: … --- ## [Anomaly detection - partitioning data](https://discuss.elastic.co/t/anomaly-detection-partitioning-data/250957)
**Author:** [@mduzy](https://discuss.elastic.co/u/mduzy)\ **Replies:** 5\ **Last updated:** [October 6, 2020, 11:54am UTC](https://discuss.elastic.co/t/anomaly-detection-partitioning-data/250957 "2020-10-06T11:54:49Z")
Hi, I've been working with the anomaly detection functionality in Kibana. I've got about 500 records processed, all of them have a transaction.name and a custom id that works as an tenant indicator (I'll call it tenantI… --- ## [Discovery the Logstash service](https://discuss.elastic.co/t/discovery-the-logstash-service/251108)
**Author:** [@DenProg](https://discuss.elastic.co/u/DenProg)\ **Replies:** 0\ **Last updated:** [October 6, 2020, 11:15am UTC](https://discuss.elastic.co/t/discovery-the-logstash-service/251108 "2020-10-06T11:15:14Z")
Our applications connect to Logstash and send logs there. The Logstash service may be located on any ip on the net. I'd like not to write ip of Logstash to a config of a client app, but find it somehow on the net. Is it … --- ## [Configuration of ELK using iscsi LUNs instead of NFS](https://discuss.elastic.co/t/configuration-of-elk-using-iscsi-luns-instead-of-nfs/251112)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 0\ **Last updated:** [October 6, 2020, 11:46am UTC](https://discuss.elastic.co/t/configuration-of-elk-using-iscsi-luns-instead-of-nfs/251112 "2020-10-06T11:46:59Z")
We have a running ELK setup on NFS storage (3 ELS share the same NFS mount) and due to space crunch we need to migrate to iscsi mounts (LUN with unique initiator name), that will be specific to ELS server(s) Also, we wi… --- ## [Mapper\_parsing\_exception when migrating index from 5.6 to 7.9](https://discuss.elastic.co/t/mapper-parsing-exception-when-migrating-index-from-5-6-to-7-9/249116)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 2\ **Last updated:** [October 6, 2020, 11:43am UTC](https://discuss.elastic.co/t/mapper-parsing-exception-when-migrating-index-from-5-6-to-7-9/249116 "2020-10-06T11:43:12Z")
I am trying to migrate the index from version 5.6 to 7.9 and seeing the below error reason" : "failed to parse field \[fields\] of type \[text\] in document with id 'AXQd0YETZkyCPebFFOUB'. Preview of field's value: '{servic… --- ## [Exiting: 2 errors: metricset 'system/load' not found; error connecting to dbus: dial tcp 127.0.0.1:12434: connectex: No connection could be made because the target machine actively refused it](https://discuss.elastic.co/t/exiting-2-errors-metricset-system-load-not-found-error-connecting-to-dbus-dial-tcp-127-0-0-1-connectex-no-connection-could-be-made-because-the-target-machine-actively-refused-it/248781)
**Author:** [@Shriram\_Wasule](https://discuss.elastic.co/u/Shriram_Wasule)\ **Replies:** 3\ **Last updated:** [October 6, 2020, 11:24am UTC](https://discuss.elastic.co/t/exiting-2-errors-metricset-system-load-not-found-error-connecting-to-dbus-dial-tcp-127-0-0-1-connectex-no-connection-could-be-made-because-the-target-machine-actively-refused-it/248781 "2020-10-06T11:24:43Z")
I am getting above error when i am trying to start metricbeat. please help to resolve this issue --- ## [Packetbeat- Duplicated flow records even intermediate report is disabled](https://discuss.elastic.co/t/packetbeat-duplicated-flow-records-even-intermediate-report-is-disabled/251107)
**Author:** [@wphromma](https://discuss.elastic.co/u/wphromma)\ **Replies:** 0\ **Last updated:** [October 6, 2020, 11:12am UTC](https://discuss.elastic.co/t/packetbeat-duplicated-flow-records-even-intermediate-report-is-disabled/251107 "2020-10-06T11:12:19Z")
Hi, I am just curious why we are getting duplicated logs of a flow. As I understand, the flow id should be uniqued and when flow.final is to true, doesn't that mean there should be no more data for this flow? This i… --- ## [Increasing bandwidth for Rally results](https://discuss.elastic.co/t/increasing-bandwidth-for-rally-results/250434)
**Author:** [@Kailas](https://discuss.elastic.co/u/Kailas)\ **Replies:** 7\ **Last updated:** [October 6, 2020, 11:12am UTC](https://discuss.elastic.co/t/increasing-bandwidth-for-rally-results/250434 "2020-10-06T11:12:05Z")
Hi, I have my Rally instance on a different host ( not part of my ECK 1.2 ). When I run http\_logs using below command '''esrally --pipeline benchmark-only --track=http\_logs --challenge append-no-conflicts-index-only --t… --- ## [Export Dashboard on PDF](https://discuss.elastic.co/t/export-dashboard-on-pdf/251100)
**Author:** [@hiba](https://discuss.elastic.co/u/hiba)\ **Replies:** 1\ **Last updated:** [October 6, 2020, 10:26am UTC](https://discuss.elastic.co/t/export-dashboard-on-pdf/251100 "2020-10-06T10:26:46Z")
Hi team, I use ELK 7.9.0 i try to export dashbord into PDF format , but i don't find how can i do this. Any help please ! Hiba. --- ## [How to return only the matched object in a nested field, instead of the whole object?](https://discuss.elastic.co/t/how-to-return-only-the-matched-object-in-a-nested-field-instead-of-the-whole-object/251073)
**Author:** [@Bart\_de\_Man](https://discuss.elastic.co/u/Bart_de_Man)\ **Replies:** 2\ **Last updated:** [October 6, 2020, 10:16am UTC](https://discuss.elastic.co/t/how-to-return-only-the-matched-object-in-a-nested-field-instead-of-the-whole-object/251073 "2020-10-06T10:16:59Z")
Elasticsearch version ( bin/elasticsearch --version ): 5.6.11 Plugins installed : JVM version ( java -version ): openjdk version "1.8.0\_222" OpenJDK Runtime Environment (build 1.8.0\_222-8u222-b10-1ubuntu1~16.04.1-b1… --- ## [Ingest Manager requires superuser privileges](https://discuss.elastic.co/t/ingest-manager-requires-superuser-privileges/251086)
**Author:** [@LukaszBis](https://discuss.elastic.co/u/LukaszBis)\ **Replies:** 3\ **Last updated:** [October 6, 2020, 10:09am UTC](https://discuss.elastic.co/t/ingest-manager-requires-superuser-privileges/251086 "2020-10-06T10:09:24Z")
Hi, I can't open the tab Ingest Manager. Message appears what could be causing this behavior? --- ## [How to disable xpack.monitoring?](https://discuss.elastic.co/t/how-to-disable-xpack-monitoring/251096)
**Author:** [@kamolhasan](https://discuss.elastic.co/u/kamolhasan)\ **Replies:** 0\ **Last updated:** [October 6, 2020, 10:01am UTC](https://discuss.elastic.co/t/how-to-disable-xpack-monitoring/251096 "2020-10-06T10:01:45Z")
Hi, I have enabled xpack.monitoring with "elasticsearch.yml" file: ... ... ... xpack.monitoring.enabled: true xpack.monitoring.collection.enabled: true xpack.monitoring.exporters: my-http-exporter: type: http … --- ## [Searchquery using timestamp in "and" condition issue](https://discuss.elastic.co/t/searchquery-using-timestamp-in-and-condition-issue/251094)
**Author:** [@tomaszde](https://discuss.elastic.co/u/tomaszde)\ **Replies:** 1\ **Last updated:** [October 6, 2020, 9:49am UTC](https://discuss.elastic.co/t/searchquery-using-timestamp-in-and-condition-issue/251094 "2020-10-06T09:49:31Z")
hi, I'm getting more hits with more exclusive search using "and" with timestamp. is it a bug or the query syntax is wrong ? query1 GET /myindex-\*/\_search?\_source=true&track\_total\_hits=true { "query": { … --- ## [Aggregation returning contradictory results](https://discuss.elastic.co/t/aggregation-returning-contradictory-results/249058)
**Author:** [@Xavier\_Marti\_Bofill](https://discuss.elastic.co/u/Xavier_Marti_Bofill)\ **Replies:** 2\ **Last updated:** [October 6, 2020, 9:43am UTC](https://discuss.elastic.co/t/aggregation-returning-contradictory-results/249058 "2020-10-06T09:43:43Z")
Our elasticsearch cluster is returning is contradictory results. We execute the following query, searching for values below 480 (that would mean we have a problem): { "aggs": { "2": { "terms": { "fie… --- ## [Unable to run Logstash](https://discuss.elastic.co/t/unable-to-run-logstash/250989)
**Author:** [@Javier\_Stauffenberg](https://discuss.elastic.co/u/Javier_Stauffenberg)\ **Replies:** 12\ **Last updated:** [October 6, 2020, 9:22am UTC](https://discuss.elastic.co/t/unable-to-run-logstash/250989 "2020-10-06T09:22:52Z")
Hi everyone, I am completely new to the ELK stack and have been following several tutorials to set up log stash and create an index from my csv file. Even following every step, and using the uploaded config files, I get… --- ## [How to do a cohort analysis using a heatmap](https://discuss.elastic.co/t/how-to-do-a-cohort-analysis-using-a-heatmap/251091)
**Author:** [@Max\_Handle](https://discuss.elastic.co/u/Max_Handle)\ **Replies:** 4\ **Last updated:** [October 6, 2020, 9:18am UTC](https://discuss.elastic.co/t/how-to-do-a-cohort-analysis-using-a-heatmap/251091 "2020-10-06T09:18:19Z")
Hi, I tried to find a solution online, but I haven't found any answer yet. I am trying to do a cohort/ customer retention analysis. The picture shows my take on this. What I want: I want to see whether customers that w… --- ## [Vega lite viz](https://discuss.elastic.co/t/vega-lite-viz/250652)
**Author:** [@suibgui](https://discuss.elastic.co/u/suibgui)\ **Replies:** 2\ **Last updated:** [October 6, 2020, 9:15am UTC](https://discuss.elastic.co/t/vega-lite-viz/250652 "2020-10-06T09:15:44Z")
hello, i want to Create a bar visualisation with vega lite , i'm writing this code but no data showing in the visualisation. \` { "$schema": "https://vega.github.io/schema/vega-lite/v2.json", "data": { "url": { "%… --- ## [\[Logstash-ilm-elasticsearch-output\] ERROR - ilm settings in Logstash Elasticsearch output filter](https://discuss.elastic.co/t/logstash-ilm-elasticsearch-output-error-ilm-settings-in-logstash-elasticsearch-output-filter/249680)
**Author:** [@Apollyon](https://discuss.elastic.co/u/Apollyon)\ **Replies:** 6\ **Last updated:** [October 6, 2020, 9:12am UTC](https://discuss.elastic.co/t/logstash-ilm-elasticsearch-output-error-ilm-settings-in-logstash-elasticsearch-output-filter/249680 "2020-10-06T09:12:23Z")
Hello all, I am currently on Elastic Cloud (ESS) 7.9.1 Have been playing around with the ilm settings in the Elasticsearch output plugin in Logstash. The current setting that has been used and has been working is belo… --- ## [Cannot configure Open ID Connect - cant store key in elastic keystore for persistent usage](https://discuss.elastic.co/t/cannot-configure-open-id-connect-cant-store-key-in-elastic-keystore-for-persistent-usage/250099)
**Author:** [@dorinand](https://discuss.elastic.co/u/dorinand)\ **Replies:** 3\ **Last updated:** [October 6, 2020, 9:11am UTC](https://discuss.elastic.co/t/cannot-configure-open-id-connect-cant-store-key-in-elastic-keystore-for-persistent-usage/250099 "2020-10-06T09:11:52Z")
I am trying to configure OIDC according to documentation. According to instructions, I have to store xpack.security.authc.realms.oidc.oidc1.rp.client\_secret into keystore. bin/elasticsearch-keystore add xpack.security.… --- ## [Error occur after enable elasticsearch security feature](https://discuss.elastic.co/t/error-occur-after-enable-elasticsearch-security-feature/251089)
**Author:** [@P\_ng\_Chun\_Sein](https://discuss.elastic.co/u/P_ng_Chun_Sein)\ **Replies:** 0\ **Last updated:** [October 6, 2020, 9:04am UTC](https://discuss.elastic.co/t/error-occur-after-enable-elasticsearch-security-feature/251089 "2020-10-06T09:04:53Z")
Hi all, I follow the this link \[https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elastic-stack-on-centos-7\] to setup my elasticsearch in my RH linux server. Everything i… --- ## [Logstash not picking up multiline logs](https://discuss.elastic.co/t/logstash-not-picking-up-multiline-logs/250823)
**Author:** [@Ayesha](https://discuss.elastic.co/u/Ayesha)\ **Replies:** 1\ **Last updated:** [October 6, 2020, 8:57am UTC](https://discuss.elastic.co/t/logstash-not-picking-up-multiline-logs/250823 "2020-10-06T08:57:24Z")
Hi, I am parsing a log file which has both multiline and singleline logs in it. Here is a sample data 13-08-2020 11:15:41,278 DEBUG \[org.jboss.as.config\] (MSC service thread 1-7) Configured system properties: \[Standa… --- ## [Getting error while trying to populate logstash data to kibana](https://discuss.elastic.co/t/getting-error-while-trying-to-populate-logstash-data-to-kibana/250287)
**Author:** [@tomalter](https://discuss.elastic.co/u/tomalter)\ **Replies:** 7\ **Last updated:** [October 6, 2020, 8:25am UTC](https://discuss.elastic.co/t/getting-error-while-trying-to-populate-logstash-data-to-kibana/250287 "2020-10-06T08:25:16Z")
Hi Folks, I am newbie here, i am trying to populate logstash metric data into kibana through elasticsearch module but i am getting 404 error after running metricbeat -e command on logstash server where metricbeat is als… --- ## [Certificate Issue](https://discuss.elastic.co/t/certificate-issue/251053)
**Author:** [@Cassie\_Danaher](https://discuss.elastic.co/u/Cassie_Danaher)\ **Replies:** 2\ **Last updated:** [October 6, 2020, 8:10am UTC](https://discuss.elastic.co/t/certificate-issue/251053 "2020-10-06T08:10:49Z")
I am trying to update our certificate for elasticsearch. I was able to do so for Kibana with no problems. When I try to use any command for certutil I get the same error: certutil: function failed: SEC\_ERROR\_LEGAC… --- ## [How does elasticsearch store its data \[ multi node architecture \]](https://discuss.elastic.co/t/how-does-elasticsearch-store-its-data-multi-node-architecture/251056)
**Author:** [@Youssef\_Blaada](https://discuss.elastic.co/u/Youssef_Blaada)\ **Replies:** 2\ **Last updated:** [October 6, 2020, 7:58am UTC](https://discuss.elastic.co/t/how-does-elasticsearch-store-its-data-multi-node-architecture/251056 "2020-10-06T07:58:15Z")
Hi all, I'm a newbie in elasticsearch, and i have a question about how does elasticsearch store its data in a multi node architecture, what i know is each node store its data on the specified data path and if we choose … --- ## [Watch json error "Unknown key for a START\_OBJECT in \["](https://discuss.elastic.co/t/watch-json-error-unknown-key-for-a-start-object-in/250546)
**Author:** [@hubbardgd](https://discuss.elastic.co/u/hubbardgd)\ **Replies:** 5\ **Last updated:** [October 6, 2020, 7:36am UTC](https://discuss.elastic.co/t/watch-json-error-unknown-key-for-a-start-object-in/250546 "2020-10-06T07:36:55Z")
Trying to define a watch alert in ELK to trigger when a file system reaches more than 87% full. I need to aggregate on host, files system and percent full for the FS. With the script below, I'm getting the error "Unknown… --- ## [Filtering the response into the "Avg Bucket Aggregation"](https://discuss.elastic.co/t/filtering-the-response-into-the-avg-bucket-aggregation/250806)
**Author:** [@Famas](https://discuss.elastic.co/u/Famas)\ **Replies:** 2\ **Last updated:** [October 6, 2020, 6:44am UTC](https://discuss.elastic.co/t/filtering-the-response-into-the-avg-bucket-aggregation/250806 "2020-10-06T06:44:53Z")
Hi all. I'm trying to use "Avg Bucket Aggregation". This is the example given in the help page of Elasticsearch site. POST /\_search { "size": 0, "aggs": { "sales\_per\_month": { "da… --- ## [Elasticsearch 7.9.2 stuck at startip](https://discuss.elastic.co/t/elasticsearch-7-9-2-stuck-at-startip/250592)
**Author:** [@deepansh](https://discuss.elastic.co/u/deepansh)\ **Replies:** 8\ **Last updated:** [October 6, 2020, 5:40am UTC](https://discuss.elastic.co/t/elasticsearch-7-9-2-stuck-at-startip/250592 "2020-10-06T05:40:34Z")
I m trying to install elasticsearch 7.9.2 using cloudformation on AWS Ec2. When i run command "service elasticsearch start" in cloudformation cfn-init command it never completes even though elasticsearch has started. s… --- ## [Logstash connecing over HTTP to elastic not HTTPs](https://discuss.elastic.co/t/logstash-connecing-over-http-to-elastic-not-https/251042)
**Author:** [@Oliver2](https://discuss.elastic.co/u/Oliver2)\ **Replies:** 1\ **Last updated:** [October 6, 2020, 5:38am UTC](https://discuss.elastic.co/t/logstash-connecing-over-http-to-elastic-not-https/251042 "2020-10-06T05:38:25Z")
I'm having issues gettings logs into Logstash since enabling SSL. I'm sure they're probably a configuration error but I can't find where. please help. I believe this is the issues that's causing my problems: {:url=\>"ht… --- ## [How to use Elasticsearch SQL { XPACK } in Logstash](https://discuss.elastic.co/t/how-to-use-elasticsearch-sql-xpack-in-logstash/250995)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 7\ **Last updated:** [October 6, 2020, 5:29am UTC](https://discuss.elastic.co/t/how-to-use-elasticsearch-sql-xpack-in-logstash/250995 "2020-10-06T05:29:19Z")
Hello I am using Logstash 7.8.0 with Elasticsearch v7.8.0. I am using Logstash to extract data from ES Index-1 and inserting into ES Index-2. I am not finding a way to use Elasticsearch SQL a part of xpack into Logsta… --- ## [ElasticSearch - How to display an additional field name in "Multi level" aggregation query?](https://discuss.elastic.co/t/elasticsearch-how-to-display-an-additional-field-name-in-multi-level-aggregation-query/251068)
**Author:** [@rifas\_ali\_pbi](https://discuss.elastic.co/u/rifas_ali_pbi)\ **Replies:** 0\ **Last updated:** [October 6, 2020, 5:28am UTC](https://discuss.elastic.co/t/elasticsearch-how-to-display-an-additional-field-name-in-multi-level-aggregation-query/251068 "2020-10-06T05:28:32Z")
[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1766) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1768)