# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1768 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1769 --- ## [Create hyperlinks in logstash](https://discuss.elastic.co/t/create-hyperlinks-in-logstash/251010)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 4\ **Last updated:** [October 6, 2020, 5:05am UTC](https://discuss.elastic.co/t/create-hyperlinks-in-logstash/251010 "2020-10-06T05:05:21Z")
In my logstash output, I have set up an email output that looks like this (put it for reference, doesn't really matter): # If our honeypot (called cowrie) gets someone, send me an email if \[log\]\[file\]\[path\] =~ "cowrie.… --- ## [Problems with Traefik/Keycloak in front of Kibana](https://discuss.elastic.co/t/problems-with-traefik-keycloak-in-front-of-kibana/250898)
**Author:** [@kodo65](https://discuss.elastic.co/u/kodo65)\ **Replies:** 2\ **Last updated:** [October 6, 2020, 4:58am UTC](https://discuss.elastic.co/t/problems-with-traefik-keycloak-in-front-of-kibana/250898 "2020-10-06T04:58:23Z")
Hi! I want to use Keycloak as a standard way of authenticating users to applications running in our Kubernetes clusters. One of the clusters is running the Elastic ECK component (v1.1.1) and we use the operator to deplo… --- ## [Getting external IP from gke node](https://discuss.elastic.co/t/getting-external-ip-from-gke-node/250832)
**Author:** [@Roman\_Kournjaev](https://discuss.elastic.co/u/Roman_Kournjaev)\ **Replies:** 2\ **Last updated:** [October 6, 2020, 3:47am UTC](https://discuss.elastic.co/t/getting-external-ip-from-gke-node/250832 "2020-10-06T03:47:06Z")
Hi I am running beats on GKE and wondering whether its possible to get the external IP of the node that i am running on with the processors: - add\_host\_metadata: what i am getting now is the internal google ip whic… --- ## [High CPU usage on warms caused by metricbeat](https://discuss.elastic.co/t/high-cpu-usage-on-warms-caused-by-metricbeat/251054)
**Author:** [@Jesbourne](https://discuss.elastic.co/u/Jesbourne)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 10:29pm UTC](https://discuss.elastic.co/t/high-cpu-usage-on-warms-caused-by-metricbeat/251054 "2020-10-05T22:29:56Z")
We've been troubleshooting an issue for several months that seems to be related to metricbeat. This weekend, within a few hours of starting metricbeat on our warms, hots, percolators and clients (we do not run it on the … --- ## [Nodes leaving Elastic Search cluster](https://discuss.elastic.co/t/nodes-leaving-elastic-search-cluster/251052)
**Author:** [@praveen4bv](https://discuss.elastic.co/u/praveen4bv)\ **Replies:** 0\ **Last updated:** [October 5, 2020, 9:35pm UTC](https://discuss.elastic.co/t/nodes-leaving-elastic-search-cluster/251052 "2020-10-05T21:35:15Z")
Hi, We have recently migrated to ES 7.6.2 from 6.5.2 and are seeing cluster instability since the upgrade. We see the below behavior from the Elastic Search cluster: Nodes in the cluster leave and join back after som… --- ## [Snapshot elasticsearch with rsync](https://discuss.elastic.co/t/snapshot-elasticsearch-with-rsync/251033)
**Author:** [@andrezenzen](https://discuss.elastic.co/u/andrezenzen)\ **Replies:** 3\ **Last updated:** [October 5, 2020, 9:06pm UTC](https://discuss.elastic.co/t/snapshot-elasticsearch-with-rsync/251033 "2020-10-05T21:06:59Z")
I have a backup routine set up, and would like to use rsync to make a copy to another server. My question is whether rsync will be able to move without breaking files with the routine enabled. --- ## [Document updates in ES rally scenarious](https://discuss.elastic.co/t/document-updates-in-es-rally-scenarious/250656)
**Author:** [@111391](https://discuss.elastic.co/u/111391)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 8:15pm UTC](https://discuss.elastic.co/t/document-updates-in-es-rally-scenarious/250656 "2020-10-05T20:15:49Z")
Hello guys, I'm going to create load tests and I'd like to understand whether implementing my use case is possible via esrally. Basically what I'd like to emulate scenario where I create documents and then update them i… --- ## [Transform exclude nodes](https://discuss.elastic.co/t/transform-exclude-nodes/250899)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 2\ **Last updated:** [October 5, 2020, 7:39pm UTC](https://discuss.elastic.co/t/transform-exclude-nodes/250899 "2020-10-05T19:39:34Z")
I'm looking for a way to exclude nodes from transform searches: Cluster has a cold/warm architecture. The transform checks the last date of data for each client (terms by client\> max date), in order to alert for delays… --- ## [Last Valid Value of a Field in Scripted Fields](https://discuss.elastic.co/t/last-valid-value-of-a-field-in-scripted-fields/250918)
**Author:** [@Nastooh](https://discuss.elastic.co/u/Nastooh)\ **Replies:** 5\ **Last updated:** [October 5, 2020, 7:23pm UTC](https://discuss.elastic.co/t/last-valid-value-of-a-field-in-scripted-fields/250918 "2020-10-05T19:23:33Z")
Hi I need to perform math functions on fields with different timestamps. For example, current value of field x, qualified by its size and the last valid value of field y: if(doc\['x'\].size()\>0){ doc\['x'\].value+doc\['y'… --- ## [How to create a Graph](https://discuss.elastic.co/t/how-to-create-a-graph/250607)
**Author:** [@udaybit45](https://discuss.elastic.co/u/udaybit45)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 7:21pm UTC](https://discuss.elastic.co/t/how-to-create-a-graph/250607 "2020-10-05T19:21:53Z")
Hi All, I'm new to ELK and wanted to create Kibana visualization based on the data as below: I have data in CSV and using ELK i was able to parsed and indexed the logs and i'm using ELK 7.8V I have data as Timestamp a… --- ## [Logstash elasticsearch input using https error](https://discuss.elastic.co/t/logstash-elasticsearch-input-using-https-error/251041)
**Author:** [@frankfoti](https://discuss.elastic.co/u/frankfoti)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 7:18pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-input-using-https-error/251041 "2020-10-05T19:18:42Z")
I am able to curl the elasticsearch https but input errors out: \[ffoti@siem-logstash-01 ~\]$ curl -XGET -u elastic:\*\*\*\*\*\*\*\*\* --cacert /etc/logstash/ca.crt --cert /etc/logstash/siem-logstash-01.crt --key /etc/logstash/sie… --- ## [How to correct custom logstash index name for use by ILM](https://discuss.elastic.co/t/how-to-correct-custom-logstash-index-name-for-use-by-ilm/246346)
**Author:** [@hueyg](https://discuss.elastic.co/u/hueyg)\ **Replies:** 6\ **Last updated:** [October 5, 2020, 7:13pm UTC](https://discuss.elastic.co/t/how-to-correct-custom-logstash-index-name-for-use-by-ilm/246346 "2020-10-05T19:13:21Z")
I have a custom logstash index named asa-%date%. I have attempted to apply an ILM policy to it, but I get an error when it attempts to apply. According to an elastic team member in another thread this is because ILM ex… --- ## [Kibana not showing all data](https://discuss.elastic.co/t/kibana-not-showing-all-data/250525)
**Author:** [@haythem](https://discuss.elastic.co/u/haythem)\ **Replies:** 7\ **Last updated:** [October 5, 2020, 7:09pm UTC](https://discuss.elastic.co/t/kibana-not-showing-all-data/250525 "2020-10-05T19:09:56Z")
Hi guys , recently i injected a 1,7 GB file in elasticsearch using logstash, so when i check the index management i find 9782102 and when i try to make a metric visualization it gives me 9007610 document any idea w… --- ## [Configure pfsense to ELK](https://discuss.elastic.co/t/configure-pfsense-to-elk/249360)
**Author:** [@Lusca\_lusca](https://discuss.elastic.co/u/Lusca_lusca)\ **Replies:** 11\ **Last updated:** [October 5, 2020, 6:29pm UTC](https://discuss.elastic.co/t/configure-pfsense-to-elk/249360 "2020-10-05T18:29:26Z")
Hi I am an intern at an IT company and I have to set up ELK to get logs from pfsense firewall, I am doing it all by myself but I don't have much knowledge about the topic. I am using an Azure server that I acess with my… --- ## [Elasticsearch 7.9.2 elasticsearch.keystore](https://discuss.elastic.co/t/elasticsearch-7-9-2-elasticsearch-keystore/251037)
**Author:** [@deepansh](https://discuss.elastic.co/u/deepansh)\ **Replies:** 0\ **Last updated:** [October 5, 2020, 6:24pm UTC](https://discuss.elastic.co/t/elasticsearch-7-9-2-elasticsearch-keystore/251037 "2020-10-05T18:24:16Z")
Is Elasticsearch 7.9.2 elasticsearch.keystore necessary and should have password? --- ## [Elastic Search Killed on start up!](https://discuss.elastic.co/t/elastic-search-killed-on-start-up/250737)
**Author:** [@aatif26](https://discuss.elastic.co/u/aatif26)\ **Replies:** 9\ **Last updated:** [October 5, 2020, 6:14pm UTC](https://discuss.elastic.co/t/elastic-search-killed-on-start-up/250737 "2020-10-05T18:14:55Z")
I just installed elasticsearch 7.9.2 in my centos 7.8.2003. Whenever I run ./bin/elasticsearch it just returns "killed" along with a bunch of warnings. I have referred this for installation. I have 2GB installed memor… --- ## [Transfer Kibana discoveries, reports , queries from Old Kibana Server to New Kibana Server](https://discuss.elastic.co/t/transfer-kibana-discoveries-reports-queries-from-old-kibana-server-to-new-kibana-server/250389)
**Author:** [@tyrone](https://discuss.elastic.co/u/tyrone)\ **Replies:** 4\ **Last updated:** [October 5, 2020, 5:55pm UTC](https://discuss.elastic.co/t/transfer-kibana-discoveries-reports-queries-from-old-kibana-server-to-new-kibana-server/250389 "2020-10-05T17:55:35Z")
We have just finished building a new ELK environment. How to I transfer all the settings from my old Kibana server to my new Kibana server to include reports, discoveries, visualizations etc? --- ## [Possibility of sorting and filtering the bucket keys as part of Term aggregation in Bar graph?](https://discuss.elastic.co/t/possibility-of-sorting-and-filtering-the-bucket-keys-as-part-of-term-aggregation-in-bar-graph/250154)
**Author:** [@parallelthought](https://discuss.elastic.co/u/parallelthought)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 5:49pm UTC](https://discuss.elastic.co/t/possibility-of-sorting-and-filtering-the-bucket-keys-as-part-of-term-aggregation-in-bar-graph/250154 "2020-10-05T17:49:01Z")
I'm trying to visualize a particular usecase described below, I'm unable to figure our if such a way is possible on Kibana (Timelion or Vertical graph). Appreciate any help/suggestion Usecase: Every ES doc contains a us… --- ## [Is there a way to get " count of records, with Status = 'closed' of previous month DIVIDED BY count of records, with status = 'New' of current month"](https://discuss.elastic.co/t/is-there-a-way-to-get-count-of-records-with-status-closed-of-previous-month-divided-by-count-of-records-with-status-new-of-current-month/250163)
**Author:** [@Pooja](https://discuss.elastic.co/u/Pooja)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 5:46pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-get-count-of-records-with-status-closed-of-previous-month-divided-by-count-of-records-with-status-new-of-current-month/250163 "2020-10-05T17:46:31Z")
I would like to get the following value to be populated on my dashboard. (Count of records, whose status: 'Closed', month : @timestamp - 1month) / (Count of records, whose status: 'New', month: @timestamp) --- ## [Creating a new field through painless scripts to calculate the difference between two timestamp](https://discuss.elastic.co/t/creating-a-new-field-through-painless-scripts-to-calculate-the-difference-between-two-timestamp/250345)
**Author:** [@Gerard\_Kamp](https://discuss.elastic.co/u/Gerard_Kamp)\ **Replies:** 2\ **Last updated:** [October 5, 2020, 5:45pm UTC](https://discuss.elastic.co/t/creating-a-new-field-through-painless-scripts-to-calculate-the-difference-between-two-timestamp/250345 "2020-10-05T17:45:26Z")
Hi all, i am trying to create a new field (time\_difference) in Kibana 7.4.2 to calculate the difference between two timestamp. First i tried this doc\['@timestamp'\].value - doc\['p.dateTimeSend'\].value and i received … --- ## [View triggered Alerts](https://discuss.elastic.co/t/view-triggered-alerts/250616)
**Author:** [@spike83](https://discuss.elastic.co/u/spike83)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 5:32pm UTC](https://discuss.elastic.co/t/view-triggered-alerts/250616 "2020-10-05T17:32:27Z")
Hi, Is it possible to see currently triggered alerts in one location? Im aware that you can click on each alert and see, but when you have 20+ alerts its a pain running through each one to see which has triggered. Alte… --- ## [Custom domain using Nginx proxy in kubernetes](https://discuss.elastic.co/t/custom-domain-using-nginx-proxy-in-kubernetes/250483)
**Author:** [@ajaykumars](https://discuss.elastic.co/u/ajaykumars)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 5:28pm UTC](https://discuss.elastic.co/t/custom-domain-using-nginx-proxy-in-kubernetes/250483 "2020-10-05T17:28:18Z")
Hi, Since using https://12312jsdjsfavhjdf.elastic.com is a pain point for our customers. So to have a custom domain like https://kibana.domain.com I have an Nginx proxy in front of the elastic cloud so our custom domai… --- ## [Not able filter out values in controls typr visualization](https://discuss.elastic.co/t/not-able-filter-out-values-in-controls-typr-visualization/250664)
**Author:** [@Matish\_Bhuyan](https://discuss.elastic.co/u/Matish_Bhuyan)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 5:13pm UTC](https://discuss.elastic.co/t/not-able-filter-out-values-in-controls-typr-visualization/250664 "2020-10-05T17:13:27Z")
Hi All, This is my controls visualization values, Where i need to filter out the "Box management" "DOCUMENT\_CREATION" "ENTITLEMENT\_CREATION" "QUANTITATIVE\_COUNTERS\_PUBLISHING" and "Box Management" and display only… --- ## [How to display a field value in Kibana without using any aggregation](https://discuss.elastic.co/t/how-to-display-a-field-value-in-kibana-without-using-any-aggregation/250676)
**Author:** [@MG555](https://discuss.elastic.co/u/MG555)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 5:07pm UTC](https://discuss.elastic.co/t/how-to-display-a-field-value-in-kibana-without-using-any-aggregation/250676 "2020-10-05T17:07:29Z")
Hi, My requirement is i'm getting a field value that contains integer numbers that shows currently running functions in my environment. I want to create a graph to display the field value as it is without using any aggr… --- ## [Kibana visualization query very slow compared to console](https://discuss.elastic.co/t/kibana-visualization-query-very-slow-compared-to-console/250714)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 5:06pm UTC](https://discuss.elastic.co/t/kibana-visualization-query-very-slow-compared-to-console/250714 "2020-10-05T17:06:58Z")
Using Kibana 7.9.0, with ES 7.9.0. Running a visualization with date historgram and terms aggregation, the query takes 1800ms according Kibana inspect panel, but the same ES query takes only 20 ms when running on the co… --- ## [Dynamic mapping error - Unable to create dynamic object](https://discuss.elastic.co/t/dynamic-mapping-error-unable-to-create-dynamic-object/250755)
**Author:** [@elastic78](https://discuss.elastic.co/u/elastic78)\ **Replies:** 5\ **Last updated:** [October 5, 2020, 5:06pm UTC](https://discuss.elastic.co/t/dynamic-mapping-error-unable-to-create-dynamic-object/250755 "2020-10-05T17:06:30Z")
Hi, We are trying to migrate from 5.5.2. to 6.8.12 version.Below is the sample of my mapping. I have set my mapping to dynamic:strict and only one object I would want to introduce dynamically so setting it to true. Thi… --- ## [How to read the failed and success messages from log file into Kibana](https://discuss.elastic.co/t/how-to-read-the-failed-and-success-messages-from-log-file-into-kibana/250730)
**Author:** [@sukumar.koganti](https://discuss.elastic.co/u/sukumar.koganti)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 5:03pm UTC](https://discuss.elastic.co/t/how-to-read-the-failed-and-success-messages-from-log-file-into-kibana/250730 "2020-10-05T17:03:15Z")
Hi, I want read the the log files bases on timestamp along with the Success messages and failed messages. here is my path (Log Files) C:\\Users\\skkoganti\\Documents\\log Sample: EDI Log-2020-08-04.txt Time|Application|M… --- ## [Can we add tooltip in the line chart? Show additional fields of the data being used?](https://discuss.elastic.co/t/can-we-add-tooltip-in-the-line-chart-show-additional-fields-of-the-data-being-used/250734)
**Author:** [@Jayasri\_Cimba](https://discuss.elastic.co/u/Jayasri_Cimba)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 5:01pm UTC](https://discuss.elastic.co/t/can-we-add-tooltip-in-the-line-chart-show-additional-fields-of-the-data-being-used/250734 "2020-10-05T17:01:35Z")
I have a line chart , which is created using Time Count Speed I wish to add additional fields to the chart like say name of the device to the chart on hover. If so , Could you please tell me how --- ## [How 'old' are the documents?](https://discuss.elastic.co/t/how-old-are-the-documents/250766)
**Author:** [@Artur\_Trindade](https://discuss.elastic.co/u/Artur_Trindade)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 4:57pm UTC](https://discuss.elastic.co/t/how-old-are-the-documents/250766 "2020-10-05T16:57:12Z")
Hello, I have need to create a plot that shows how long the documents exists in the index My first idea would be creating a scripted field that computes something like now()-timestamp How can this be performed in kiba… --- ## [How to send JSON directly to elasticsearch w/o any parsing in logstash](https://discuss.elastic.co/t/how-to-send-json-directly-to-elasticsearch-w-o-any-parsing-in-logstash/251030)
**Author:** [@nandalapadu\_shamriya](https://discuss.elastic.co/u/nandalapadu_shamriya)\ **Replies:** 0\ **Last updated:** [October 5, 2020, 4:47pm UTC](https://discuss.elastic.co/t/how-to-send-json-directly-to-elasticsearch-w-o-any-parsing-in-logstash/251030 "2020-10-05T16:47:18Z")
I am printing the JSON format logs in my syslog's like below. {"app":"Svc","@timestamp":"2020-10-05T15:25:17.965Z","logger":"com.zaxxer.hikari.pool.HikariPool","level":"WARN","class":"com.zaxxer.hikari.pool.HikariPool$H… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1767) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1769)