# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1774 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1775 --- ## [In Filebeat config fields.type not getting picked up in index!](https://discuss.elastic.co/t/in-filebeat-config-fields-type-not-getting-picked-up-in-index/250658)
**Author:** [@jaraws](https://discuss.elastic.co/u/jaraws)\ **Replies:** 0\ **Last updated:** [October 1, 2020, 11:23am UTC](https://discuss.elastic.co/t/in-filebeat-config-fields-type-not-getting-picked-up-in-index/250658 "2020-10-01T11:23:10Z")
I am trying to add fields.type of a pipeline to my index but for some reason is not resolving and data is going in against one single index i.e. index-other. filebeat.inputs: - type: log enabled: true paths: … --- ## [Heartbeats configure using AWS Elasticsearch kibana 7.4.2](https://discuss.elastic.co/t/heartbeats-configure-using-aws-elasticsearch-kibana-7-4-2/250315)
**Author:** [@A\_Ravi\_Prashant](https://discuss.elastic.co/u/A_Ravi_Prashant)\ **Replies:** 3\ **Last updated:** [October 1, 2020, 9:06pm UTC](https://discuss.elastic.co/t/heartbeats-configure-using-aws-elasticsearch-kibana-7-4-2/250315 "2020-10-01T21:06:08Z")
Hi Team, I am using aws elasticsearch kibana 7.4.2 and i have configured filebeats, metricbeats, and hearbeats and sent it to logstash and logstash is sending data logs, metrics etc to aws elasticsearch. and configured … --- ## [Elasticdump users: does anyone else worry about WARNings on dependencies?](https://discuss.elastic.co/t/elasticdump-users-does-anyone-else-worry-about-warnings-on-dependencies/250480)
**Author:** [@viu](https://discuss.elastic.co/u/viu)\ **Replies:** 2\ **Last updated:** [October 1, 2020, 8:27pm UTC](https://discuss.elastic.co/t/elasticdump-users-does-anyone-else-worry-about-warnings-on-dependencies/250480 "2020-10-01T20:27:57Z")
Hi there, I am a newbie in this community, but lurked as a visitor for some time. I work with a very security aware IT/server administration, and it has made me semi-paranoid. The Elastick stack in use is an older ver… --- ## [Yarn start not starting up](https://discuss.elastic.co/t/yarn-start-not-starting-up/250426)
**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\ **Replies:** 4\ **Last updated:** [October 1, 2020, 7:26pm UTC](https://discuss.elastic.co/t/yarn-start-not-starting-up/250426 "2020-10-01T19:26:29Z")
i am trying to follow https://www.elastic.co/guide/en/kibana/7.9/development-getting-started.html . But when i do yarn kbn bootstrap I get the below error. Instead of cloning I downloaded the branch. \[4/5\] Linking depen… --- ## [Logstash started but filebeat says connection refused](https://discuss.elastic.co/t/logstash-started-but-filebeat-says-connection-refused/250732)
**Author:** [@Sravan\_Kumar\_Guduru](https://discuss.elastic.co/u/Sravan_Kumar_Guduru)\ **Replies:** 0\ **Last updated:** [October 1, 2020, 7:07pm UTC](https://discuss.elastic.co/t/logstash-started-but-filebeat-says-connection-refused/250732 "2020-10-01T19:07:50Z")
Interestingly my logstash is running when I tried ps -ef | grep logstash and when my filebeat tries to send the logs it is getting connection refused error. When I even do telent , i get below error message \[root@Ganes… --- ## [Filebeat is not sending logs to Logstash, logstash is localhost](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-logstash-logstash-is-localhost/250586)
**Author:** [@Sravan\_Kumar\_Guduru](https://discuss.elastic.co/u/Sravan_Kumar_Guduru)\ **Replies:** 4\ **Last updated:** [October 1, 2020, 7:06pm UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-logstash-logstash-is-localhost/250586 "2020-10-01T19:06:46Z")
Hi All, I am having trouble with my filebeat/logstash. connectivity seems to be inconsistenst. When i try it in debug mode it works fine but when i use it with systemctl start it fails . Below are my filebeat and logst… --- ## [FIlebeat httpjson support for proxy connection](https://discuss.elastic.co/t/filebeat-httpjson-support-for-proxy-connection/250731)
**Author:** [@Scott\_Harris](https://discuss.elastic.co/u/Scott_Harris)\ **Replies:** 0\ **Last updated:** [October 1, 2020, 7:03pm UTC](https://discuss.elastic.co/t/filebeat-httpjson-support-for-proxy-connection/250731 "2020-10-01T19:03:25Z")
I am attempting to configure filebeat 7.9.2 (running from docker image) to use the httpjson input. It works fine with an internally available URL but times outs on an external URL. I have verified and tried multiple comb… --- ## [Custom table color](https://discuss.elastic.co/t/custom-table-color/250594)
**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\ **Replies:** 6\ **Last updated:** [October 1, 2020, 6:33pm UTC](https://discuss.elastic.co/t/custom-table-color/250594 "2020-10-01T18:33:41Z")
Kibana version : 7.9 Elasticsearch version : 7.9 APM Server version : 7.9 APM Agent language and version : java 1.8 Fresh install or upgraded from other version? fresh install Is there anything special in your … --- ## [Installing Curator add-on with ElasticSearch on Ubuntu Focal Fossa](https://discuss.elastic.co/t/installing-curator-add-on-with-elasticsearch-on-ubuntu-focal-fossa/250727)
**Author:** [@xberg3rmanx](https://discuss.elastic.co/u/xberg3rmanx)\ **Replies:** 0\ **Last updated:** [October 1, 2020, 6:22pm UTC](https://discuss.elastic.co/t/installing-curator-add-on-with-elasticsearch-on-ubuntu-focal-fossa/250727 "2020-10-01T18:22:44Z")
When attempting to install the Curator add-on with ElasticSearch, I am receiving an error on Ubuntu 20.04. The error states "The repository 'http://ppa.launchpad.net/webupd8team/java/ubuntu focal Release' does not have … --- ## [Strict comparison](https://discuss.elastic.co/t/strict-comparison/250550)
**Author:** [@pcuvi](https://discuss.elastic.co/u/pcuvi)\ **Replies:** 2\ **Last updated:** [October 1, 2020, 5:46pm UTC](https://discuss.elastic.co/t/strict-comparison/250550 "2020-10-01T17:46:50Z")
Hello all, I want to find a document where "data.city:Barcelona". Thus, the query should return the doc 2 but not doc 1. How can I do it? Currently, I am doing a Lucene query on Kibana using "data.city:Barcelona" and i… --- ## [Sort Elasticsearch output in Logstash](https://discuss.elastic.co/t/sort-elasticsearch-output-in-logstash/250723)
**Author:** [@Nikopoulos](https://discuss.elastic.co/u/Nikopoulos)\ **Replies:** 0\ **Last updated:** [October 1, 2020, 4:53pm UTC](https://discuss.elastic.co/t/sort-elasticsearch-output-in-logstash/250723 "2020-10-01T16:53:16Z")
I have 2 logstash pipelines. The first one uploads log lines in elasticsearch using csv filter. These are the columns \[timestamp,machine,application\]. The other pipeline gets data from elasticsearch, sorts them by timest… --- ## [Machine learning](https://discuss.elastic.co/t/machine-learning/250719)
**Author:** [@liorhalperin](https://discuss.elastic.co/u/liorhalperin)\ **Replies:** 1\ **Last updated:** [October 1, 2020, 4:34pm UTC](https://discuss.elastic.co/t/machine-learning/250719 "2020-10-01T16:34:28Z")
I am beginner in the Machine learning module in ES i created single metric job and started it it creates results but I dont see that the job continues to run each 15 minutes or so and create new results what do I mi… --- ## [Filebeat lagging behind raw logs](https://discuss.elastic.co/t/filebeat-lagging-behind-raw-logs/250697)
**Author:** [@jhaugh](https://discuss.elastic.co/u/jhaugh)\ **Replies:** 0\ **Last updated:** [October 1, 2020, 2:34pm UTC](https://discuss.elastic.co/t/filebeat-lagging-behind-raw-logs/250697 "2020-10-01T14:34:51Z")
Hey Everyone, Recently primary ingest node for network devices syslogs, (unifi APs, cisco switches, sonicwalls, etc) has been lagging behind the raw logs. In my setup I'm using rsyslog to write the initial logs to file … --- ## [Event with multiple patterns](https://discuss.elastic.co/t/event-with-multiple-patterns/250700)
**Author:** [@fluss](https://discuss.elastic.co/u/fluss)\ **Replies:** 1\ **Last updated:** [October 1, 2020, 3:44pm UTC](https://discuss.elastic.co/t/event-with-multiple-patterns/250700 "2020-10-01T15:44:28Z")
Hello, I have an event as on below: Rule 'device' failed for user 'user45' reason 'Rule1:OS not found'. grok { match =\> \["event","%{GREEDYDATA}reason '%{GREEDYDATA:rule}:%{GREEDYDATA:reason}'."\] } rule: Rule1 reas… --- ## [SAML Issue in ELK 7.6.4](https://discuss.elastic.co/t/saml-issue-in-elk-7-6-4/249890)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 5\ **Last updated:** [October 1, 2020, 3:35pm UTC](https://discuss.elastic.co/t/saml-issue-in-elk-7-6-4/249890 "2020-10-01T15:35:01Z")
Hi All, I was trying to integrate Okta with elasticsearch, getting below error while logging into console, {"statusCode":401,"error":"Unauthorized","message":"\[security\_exception\] unable to authenticate user \[\ **Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 2\ **Last updated:** [October 1, 2020, 3:22pm UTC](https://discuss.elastic.co/t/logstash-if-statement-has-value/250702 "2020-10-01T15:22:12Z") In Logstash, I'm trying to set a condition where if within a file named "cowrie.json", if a new message is received that starts with "login attempt\*" - send an email. This is what I tried: output { if \[log\]\[file\]\[pat… --- ## [Linux auditd grokking without auditbeat (but from files)](https://discuss.elastic.co/t/linux-auditd-grokking-without-auditbeat-but-from-files/250710)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 0\ **Last updated:** [October 1, 2020, 3:21pm UTC](https://discuss.elastic.co/t/linux-auditd-grokking-without-auditbeat-but-from-files/250710 "2020-10-01T15:21:52Z")
We have quite lot of devices sending auditd dataset via syslog and/or filebeats (where we don't have control to install auditbeat). Does anyone have a auditd module for parsing the dataset and enrichment within logstash?… --- ## [UNABLE TO UPDATE THE DOCUMENT USING MONGODB LOGSTASH PLUGIN](https://discuss.elastic.co/t/unable-to-update-the-document-using-mongodb-logstash-plugin/250695)
**Author:** [@Raja\_Kushwah](https://discuss.elastic.co/u/Raja_Kushwah)\ **Replies:** 1\ **Last updated:** [October 1, 2020, 3:21pm UTC](https://discuss.elastic.co/t/unable-to-update-the-document-using-mongodb-logstash-plugin/250695 "2020-10-01T15:21:05Z")
Hi, I am trying to migrate the data using logstash mongodb plugin .. I am able to migrate the data but it is failing while updating the data in mongo db as it is creating a new document while i am trying to append or up… --- ## [Getting Error while trying to create and Index Pattern : "Error Fetching Fields" "Request Entity Too Large"](https://discuss.elastic.co/t/getting-error-while-trying-to-create-and-index-pattern-error-fetching-fields-request-entity-too-large/248835)
**Author:** [@Sebastien\_Lelak](https://discuss.elastic.co/u/Sebastien_Lelak)\ **Replies:** 15\ **Last updated:** [October 1, 2020, 3:08pm UTC](https://discuss.elastic.co/t/getting-error-while-trying-to-create-and-index-pattern-error-fetching-fields-request-entity-too-large/248835 "2020-10-01T15:08:41Z")
Greetings, We have an elastic cluster containing 12 nodes and 1.4Tb of documents, daily indexed through a total of 7.5k shards. Everything was working fine, but a human error caused the deletion of the .kibana\* indexes… --- ## [동일 로그에 대한 다중 인덱스 생성 방법](https://discuss.elastic.co/t/topic/250610)
**Author:** [@wwwryuwww](https://discuss.elastic.co/u/wwwryuwww)\ **Replies:** 1\ **Last updated:** [October 1, 2020, 2:38pm UTC](https://discuss.elastic.co/t/topic/250610 "2020-10-01T14:38:09Z")
현재 filebeat -\> logstash -\> elasticsearch 구조로 모두 6.6.2 버전을 사용하고 있는데 동일 서버 내 한 개의 서비스 로그를 내용 패턴과 생성 목적에 따라서 별도의 인덱스로 elasticsearch에 저장하고자 합니다. "customs.log" -\> 1. index "case1" -\> 2. index "case2" 현재는 서버의 filebeat에서 동… --- ## [CEF codec plugin](https://discuss.elastic.co/t/cef-codec-plugin/250644)
**Author:** [@david.preston](https://discuss.elastic.co/u/david.preston)\ **Replies:** 1\ **Last updated:** [October 1, 2020, 2:29pm UTC](https://discuss.elastic.co/t/cef-codec-plugin/250644 "2020-10-01T14:29:43Z")
Hi I'd like to use the CEF codec as a filter plugin - is this possible? In a similar way that you have a json input codec, and a json filter plugin. I would like to check the message is a CEF message, and process appr… --- ## [Elastic api is not working in elk6](https://discuss.elastic.co/t/elastic-api-is-not-working-in-elk6/248751)
**Author:** [@rajkumar.m](https://discuss.elastic.co/u/rajkumar.m)\ **Replies:** 5\ **Last updated:** [October 1, 2020, 2:26pm UTC](https://discuss.elastic.co/t/elastic-api-is-not-working-in-elk6/248751 "2020-10-01T14:26:49Z")
Hi Team, I am unable to create search by using elastic API, the same thing is wokring on ELK5 but not working in ELK6. Please help. Please find the below command & error: curl -H 'Authorization:Basic XXXXXXXXXX' -H … --- ## [Logstash env configuration to set the elastic search url](https://discuss.elastic.co/t/logstash-env-configuration-to-set-the-elastic-search-url/250675)
**Author:** [@masber](https://discuss.elastic.co/u/masber)\ **Replies:** 2\ **Last updated:** [October 1, 2020, 2:24pm UTC](https://discuss.elastic.co/t/logstash-env-configuration-to-set-the-elastic-search-url/250675 "2020-10-01T14:24:39Z")
Hi, I am running logstash docker container and need to know which env to use to tell logstash where to find the elasticsearch server. \[2020-10-01T11:37:39,829\]\[WARN \]\[logstash.licensechecker.licensereader\] Attempted to … --- ## [License question - am I basic or open source?](https://discuss.elastic.co/t/license-question-am-i-basic-or-open-source/247692)
**Author:** [@bn1980](https://discuss.elastic.co/u/bn1980)\ **Replies:** 6\ **Last updated:** [October 1, 2020, 2:10pm UTC](https://discuss.elastic.co/t/license-question-am-i-basic-or-open-source/247692 "2020-10-01T14:10:47Z")
I have installed ELK stack on FreeBSD using pkg manager. Kibana reports my license as BASIC. I don't appear to have the suricata module. Can someone please confirm which license i have? --- ## [Searching through PDF attachments and other documents in ElasticSearch with one query](https://discuss.elastic.co/t/searching-through-pdf-attachments-and-other-documents-in-elasticsearch-with-one-query/250519)
**Author:** [@Bertrand\_Nau](https://discuss.elastic.co/u/Bertrand_Nau)\ **Replies:** 5\ **Last updated:** [October 1, 2020, 1:46pm UTC](https://discuss.elastic.co/t/searching-through-pdf-attachments-and-other-documents-in-elasticsearch-with-one-query/250519 "2020-10-01T13:46:57Z")
Hello everybody, I'm using the ingest-attachment plugin to parse PDF files in an ElasticSearch 7 cluster. Each PDF file gives additional informations to an already existing document. I try to create a query which retri… --- ## [Connection Filebeat to Logstash SSL: certificate specifies an incompatible key usage](https://discuss.elastic.co/t/connection-filebeat-to-logstash-ssl-certificate-specifies-an-incompatible-key-usage/250684)
**Author:** [@peterol](https://discuss.elastic.co/u/peterol)\ **Replies:** 0\ **Last updated:** [October 1, 2020, 1:37pm UTC](https://discuss.elastic.co/t/connection-filebeat-to-logstash-ssl-certificate-specifies-an-incompatible-key-usage/250684 "2020-10-01T13:37:31Z")
Hey everyone, I want to establish a connection with SSL between Filebeat and Logstash according to this. Filebeat runs natively whereas Logstash is running in a Docker container. I converted my keys to the PKCS8 format,… --- ## [Wrong timestamp on kibana](https://discuss.elastic.co/t/wrong-timestamp-on-kibana/249979)
**Author:** [@leostereo](https://discuss.elastic.co/u/leostereo)\ **Replies:** 6\ **Last updated:** [October 1, 2020, 1:35pm UTC](https://discuss.elastic.co/t/wrong-timestamp-on-kibana/249979 "2020-10-01T13:35:01Z")
Hi , guys. I can not properly set time on my kibana web. As you can see on picture bellow , timestamp on kibana and timestamp on elasticsearch returned document has a 3 hours difference. Other: Both , kiabana and ela… --- ## [Can't monitor Logstash with Metricbeat](https://discuss.elastic.co/t/cant-monitor-logstash-with-metricbeat/249542)
**Author:** [@robertitox](https://discuss.elastic.co/u/robertitox)\ **Replies:** 3\ **Last updated:** [October 1, 2020, 1:27pm UTC](https://discuss.elastic.co/t/cant-monitor-logstash-with-metricbeat/249542 "2020-10-01T13:27:00Z")
Dear all, I have a 3-node Elasticsearch 7.9.1 cluster. In another server, I have a Logstash 7.9.1 service and Metricbeat with logstash-xpack module enable. The problem is that in my Kibana --\> Stack Monitoring section, … --- ## [Return only needed fields in response without metadata](https://discuss.elastic.co/t/return-only-needed-fields-in-response-without-metadata/250639)
**Author:** [@Nick\_Name](https://discuss.elastic.co/u/Nick_Name)\ **Replies:** 3\ **Last updated:** [October 1, 2020, 1:24pm UTC](https://discuss.elastic.co/t/return-only-needed-fields-in-response-without-metadata/250639 "2020-10-01T13:24:37Z")
Can I specify my SearchSourceBuilder or SearchRequest for return in SearchResponse only fields without metadata? Include fields and Exclude don't work. I want to return only code.keyword and id.keyword fields in response… --- ## [Upgrading from 2.4 -\> 7.9, Synonym reserved words?](https://discuss.elastic.co/t/upgrading-from-2-4-7-9-synonym-reserved-words/250197)
**Author:** [@ronchalant](https://discuss.elastic.co/u/ronchalant)\ **Replies:** 2\ **Last updated:** [October 1, 2020, 1:22pm UTC](https://discuss.elastic.co/t/upgrading-from-2-4-7-9-synonym-reserved-words/250197 "2020-10-01T13:22:35Z")
We're doing a big upgrade on various indexes, going from 2.4 -\> 7.9. One thing we're running into is we had a number of synonyms that had the words 'and' and 'or' in them, and they're being rejected by 7.9. One of them… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1773) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1775)