# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1784 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1785 --- ## [ElasticSearch filter plugin "Failed to parse query" Was Expecting TO](https://discuss.elastic.co/t/elasticsearch-filter-plugin-failed-to-parse-query-was-expecting-to/250061)
**Author:** [@subash](https://discuss.elastic.co/u/subash)\ **Replies:** 1\ **Last updated:** [September 26, 2020, 3:25pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-failed-to-parse-query-was-expecting-to/250061 "2020-09-26T15:25:36Z")
Hi, I am using Elasicsearch filter plugin to check the current event with the previous events. My elasticsearch filter plugin looks like this elasticsearch { hosts =\> "xx.xx.xx.xx" index … --- ## [Q: Does kibana support users authentification for the free version?](https://discuss.elastic.co/t/q-does-kibana-support-users-authentification-for-the-free-version/250058)
**Author:** [@0xrduf](https://discuss.elastic.co/u/0xrduf)\ **Replies:** 1\ **Last updated:** [September 26, 2020, 2:56pm UTC](https://discuss.elastic.co/t/q-does-kibana-support-users-authentification-for-the-free-version/250058 "2020-09-26T14:56:00Z")
Q: does kibana support users authentification for the free version ?? --- ## [Unable to download Logstash Avro Codec for Kafka Input](https://discuss.elastic.co/t/unable-to-download-logstash-avro-codec-for-kafka-input/250040)
**Author:** [@mastersmit](https://discuss.elastic.co/u/mastersmit)\ **Replies:** 1\ **Last updated:** [September 26, 2020, 2:33pm UTC](https://discuss.elastic.co/t/unable-to-download-logstash-avro-codec-for-kafka-input/250040 "2020-09-26T14:33:08Z")
In the organisation, the Kafka data is being sent in a Avro Schema and I am trying to load the data into Logstash using Kafka Input however without Avro Codec, I am getting the data in the below charset: \\u0001\\u000E\\u0… --- ## [Documentation on Elastic search upgrade](https://discuss.elastic.co/t/documentation-on-elastic-search-upgrade/250043)
**Author:** [@GOKUL\_R](https://discuss.elastic.co/u/GOKUL_R)\ **Replies:** 1\ **Last updated:** [September 26, 2020, 1:45pm UTC](https://discuss.elastic.co/t/documentation-on-elastic-search-upgrade/250043 "2020-09-26T13:45:46Z")
Hi, I have been trying to upgrade the ELasticsearch version from 7.1.1 to 7.8.0 and unfortunately it has broke our Kibana. I had a good reference on breaking changes and new upgrades for each version with the help of do… --- ## [I get an exception after enabling transport layer security . Can someone help me here?](https://discuss.elastic.co/t/i-get-an-exception-after-enabling-transport-layer-security-can-someone-help-me-here/250049)
**Author:** [@snehadarshini](https://discuss.elastic.co/u/snehadarshini)\ **Replies:** 1\ **Last updated:** [September 26, 2020, 11:13am UTC](https://discuss.elastic.co/t/i-get-an-exception-after-enabling-transport-layer-security-can-someone-help-me-here/250049 "2020-09-26T11:13:45Z")
\[2020-09-26T05:29:15,468\]\[WARN \]\[o.e.t.TcpTransport \] \[master-2\] exception caught on transport layer \[Netty4TcpChannel{localAddress=/10.0.1.102:9300, remoteAddress=/10.0.1.101:34044}\], closing connection io.netty.h… --- ## [Unable to run python tests - No module named beat.beat](https://discuss.elastic.co/t/unable-to-run-python-tests-no-module-named-beat-beat/249949)
**Author:** [@ebanashka](https://discuss.elastic.co/u/ebanashka)\ **Replies:** 3\ **Last updated:** [September 26, 2020, 9:54am UTC](https://discuss.elastic.co/t/unable-to-run-python-tests-no-module-named-beat-beat/249949 "2020-09-26T09:54:51Z")
I am unable to run python tests for packetbeat or any other beats. Here's what I've done: in the packetbeat dir i ran make python-dev then navigated to the tests/system folder and ran nosetests -x -v. Getting the fol… --- ## [Data loss incase of elasticsearch data node going down](https://discuss.elastic.co/t/data-loss-incase-of-elasticsearch-data-node-going-down/250042)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 2\ **Last updated:** [September 26, 2020, 9:28am UTC](https://discuss.elastic.co/t/data-loss-incase-of-elasticsearch-data-node-going-down/250042 "2020-09-26T09:28:01Z")
Hi All, We have 5 data nodes in our cluster, out of these 2 nodes went down and it looks like , I will take at-least a week to recover it. Is there a way to work with remaining 3 data nodes and we can recover other 2 da… --- ## [Error in loading data set](https://discuss.elastic.co/t/error-in-loading-data-set/249244)
**Author:** [@glitch](https://discuss.elastic.co/u/glitch)\ **Replies:** 2\ **Last updated:** [September 26, 2020, 7:34am UTC](https://discuss.elastic.co/t/error-in-loading-data-set/249244 "2020-09-26T07:34:46Z")
As a complete beginner I was following the official tutorial on Kibana. While having created a map for Shakespeare data set PUT /shakespeare { "mappings": { "properties": { "speaker": {"type": "keyword"}, "play\_n… --- ## [Month Name in Date Histogram Visualization](https://discuss.elastic.co/t/month-name-in-date-histogram-visualization/248386)
**Author:** [@GOKUL\_R](https://discuss.elastic.co/u/GOKUL_R)\ **Replies:** 2\ **Last updated:** [September 26, 2020, 7:15am UTC](https://discuss.elastic.co/t/month-name-in-date-histogram-visualization/248386 "2020-09-26T07:15:04Z")
How to display month name in the format "Jan", "Feb" on the x-axis in Date Histogram visualization instead of the default format "2020-01-01" --- ## [Re-evaluating shard setup](https://discuss.elastic.co/t/re-evaluating-shard-setup/249793)
**Author:** [@claohr](https://discuss.elastic.co/u/claohr)\ **Replies:** 9\ **Last updated:** [September 26, 2020, 6:58am UTC](https://discuss.elastic.co/t/re-evaluating-shard-setup/249793 "2020-09-26T06:58:25Z")
I'm running 3 node (26 GB EBS volume, 4GB Memory, c5.large) ES cluster v7.7 (AWS) for 1 index with the following setting PUT /my-index { "settings": { "number\_of\_shards": 1, "number\_of\_replicas": 1 } } A… --- ## [Monitoring network connectivity by ping](https://discuss.elastic.co/t/monitoring-network-connectivity-by-ping/250038)
**Author:** [@pankaj0172](https://discuss.elastic.co/u/pankaj0172)\ **Replies:** 1\ **Last updated:** [September 26, 2020, 6:00am UTC](https://discuss.elastic.co/t/monitoring-network-connectivity-by-ping/250038 "2020-09-26T06:00:06Z")
Hi, Can we monitor network connectivity through any beat if yes then which one should I use for it. Basically I'm trying to find at what time my machine dropped network or ping or network drop packets.. --- ## [Dynamic facets with applied filters](https://discuss.elastic.co/t/dynamic-facets-with-applied-filters/250039)
**Author:** [@cmodijk](https://discuss.elastic.co/u/cmodijk)\ **Replies:** 0\ **Last updated:** [September 26, 2020, 4:51am UTC](https://discuss.elastic.co/t/dynamic-facets-with-applied-filters/250039 "2020-09-26T04:51:08Z")
Hi, I have been looking for a solution for the following case and tried searching for multiple terms on the Google and here on the forum. I'm not sure what the best solution is for this case so maybe someone here can po… --- ## [Unable to set search.max\_buckets for \_cluster/settings](https://discuss.elastic.co/t/unable-to-set-search-max-buckets-for-cluster-settings/250015)
**Author:** [@Suparna\_Shankar](https://discuss.elastic.co/u/Suparna_Shankar)\ **Replies:** 5\ **Last updated:** [September 25, 2020, 10:00pm UTC](https://discuss.elastic.co/t/unable-to-set-search-max-buckets-for-cluster-settings/250015 "2020-09-25T22:00:00Z")
m trying to curl -XPUT "http://localhost:9200/\_cluster/settings -H 'Content-Type: application/json'{"transient":{"search.max\_buckets": 200000}} but am getting below error please correct me if i am wrong C:\\Users\\ssuparn… --- ## [Parsing issues with Logstash CSV plugin](https://discuss.elastic.co/t/parsing-issues-with-logstash-csv-plugin/249856)
**Author:** [@petehalatsis](https://discuss.elastic.co/u/petehalatsis)\ **Replies:** 3\ **Last updated:** [September 25, 2020, 8:13pm UTC](https://discuss.elastic.co/t/parsing-issues-with-logstash-csv-plugin/249856 "2020-09-25T20:13:19Z")
I have been beating my head on this for a while. My syslog is hitting my if statement and using the columns I have below but they are off by one. I tried adding/removing the first column to account for the shift but it d… --- ## [Plugin fails to install](https://discuss.elastic.co/t/plugin-fails-to-install/250012)
**Author:** [@tyrone](https://discuss.elastic.co/u/tyrone)\ **Replies:** 1\ **Last updated:** [September 25, 2020, 6:37pm UTC](https://discuss.elastic.co/t/plugin-fails-to-install/250012 "2020-09-25T18:37:34Z")
I am unable to install the logstash-syslog-output plugin locally I am running rhel7.8, logstash 7.8.1 I have downloaded logstash-output-syslog-master.zip from git and am running \[root@us3lpvinfelk004 bin\]# ./logstas… --- ## [Logstash 7.9.1 have issues in ARM](https://discuss.elastic.co/t/logstash-7-9-1-have-issues-in-arm/249596)
**Author:** [@goutham968](https://discuss.elastic.co/u/goutham968)\ **Replies:** 10\ **Last updated:** [September 25, 2020, 5:13pm UTC](https://discuss.elastic.co/t/logstash-7-9-1-have-issues-in-arm/249596 "2020-09-25T17:13:14Z")
\[2020-09-23T00:58:12,480\]\[ERROR\]\[logstash.javapipeline \]\[main\]\[167820c884ed4020909a7d2491232c40eac5b47a3f91495a85db21bdf02afeca\] A plugin had an unrecoverable error. Will restart this plugin. Pipeline\_id:main Plugin: \ **Author:** [@novaksam](https://discuss.elastic.co/u/novaksam)\ **Replies:** 0\ **Last updated:** [September 25, 2020, 4:37pm UTC](https://discuss.elastic.co/t/outofmemoryerror-occurred-on-es-host-accessed-via-kibana/250005 "2020-09-25T16:37:10Z") Kinda similar to OutOfMemoryError occurred in coordinating node · Issue #49699 · elastic/elasticsearch · GitHub in that I have a significant amount of my heap being consumed by byte arrays, seemingly being utilized by th… --- ## [Can we see how many users are active on the terminal server through Metricbeat](https://discuss.elastic.co/t/can-we-see-how-many-users-are-active-on-the-terminal-server-through-metricbeat/249453)
**Author:** [@pankaj0172](https://discuss.elastic.co/u/pankaj0172)\ **Replies:** 2\ **Last updated:** [September 25, 2020, 4:10pm UTC](https://discuss.elastic.co/t/can-we-see-how-many-users-are-active-on-the-terminal-server-through-metricbeat/249453 "2020-09-25T16:10:23Z")
Hi, Can someone please let me know what does meant by user in Cpu usage graph? Can we see how many users are active on terminal server through metricbeat or other beats? --- ## [Filebeat harvester open file count increasing when Logstash output to Elasticsearch Fails](https://discuss.elastic.co/t/filebeat-harvester-open-file-count-increasing-when-logstash-output-to-elasticsearch-fails/249892)
**Author:** [@arijitb](https://discuss.elastic.co/u/arijitb)\ **Replies:** 2\ **Last updated:** [September 25, 2020, 3:34pm UTC](https://discuss.elastic.co/t/filebeat-harvester-open-file-count-increasing-when-logstash-output-to-elasticsearch-fails/249892 "2020-09-25T15:34:38Z")
We have a log streaming pipeline setup with filebeat -\> logstash -\> Elasticsearch. Recently, our ES cluster started throwing 429 exceptions for all traffic and we observed that eventually logs stopped streaming to Logst… --- ## [Filebeat with syslog - error index](https://discuss.elastic.co/t/filebeat-with-syslog-error-index/249419)
**Author:** [@Paulogbr](https://discuss.elastic.co/u/Paulogbr)\ **Replies:** 3\ **Last updated:** [September 25, 2020, 3:26pm UTC](https://discuss.elastic.co/t/filebeat-with-syslog-error-index/249419 "2020-09-25T15:26:03Z")
Hello Team, I was using Logstash in my lab to input data from syslog UDP 5140. Now I tried Filebeat, but the data don't index. I follow this example: My filebeat.yml : filebeat.inputs: type: syslog enabled: t… --- ## [\[FILEBEAT\] Insert timestamp inside of logfile name](https://discuss.elastic.co/t/filebeat-insert-timestamp-inside-of-logfile-name/249843)
**Author:** [@mstojanovic](https://discuss.elastic.co/u/mstojanovic)\ **Replies:** 2\ **Last updated:** [September 25, 2020, 3:15pm UTC](https://discuss.elastic.co/t/filebeat-insert-timestamp-inside-of-logfile-name/249843 "2020-09-25T15:15:50Z")
Hello, I want to gather logs from a specific location. As the log's name is changed each day, I would like to insert timestamp in log file name. By doing so, each new day, the correct log name will be parsed by filebeat… --- ## [MetricBeat visulization not showing all data(Need urgent help)](https://discuss.elastic.co/t/metricbeat-visulization-not-showing-all-data-need-urgent-help/249895)
**Author:** [@Cute\_Baby\_Inayat\_jar](https://discuss.elastic.co/u/Cute_Baby_Inayat_jar)\ **Replies:** 1\ **Last updated:** [September 25, 2020, 3:13pm UTC](https://discuss.elastic.co/t/metricbeat-visulization-not-showing-all-data-need-urgent-help/249895 "2020-09-25T15:13:30Z")
Hi ALl, I am new in metricbeat. In my project we are sending metricbeat data to kafka topic and then from logstash pipeline we are sending to index metricbeat-\* in elasticsearch. In index data is coming properly for fil… --- ## [How to compare the current event with the previous 2 events in logstash?](https://discuss.elastic.co/t/how-to-compare-the-current-event-with-the-previous-2-events-in-logstash/249864)
**Author:** [@subash](https://discuss.elastic.co/u/subash)\ **Replies:** 3\ **Last updated:** [September 25, 2020, 2:53pm UTC](https://discuss.elastic.co/t/how-to-compare-the-current-event-with-the-previous-2-events-in-logstash/249864 "2020-09-25T14:53:22Z")
I am receiving logs every 5 minutes from many devices. In the log, there is field called crc\_error which holds numeric value For a particular Device, if the value of the crc\_error field increases consecutively for 3 lo… --- ## [Parsing nested JSON fields to separate fields](https://discuss.elastic.co/t/parsing-nested-json-fields-to-separate-fields/249973)
**Author:** [@ottramst](https://discuss.elastic.co/u/ottramst)\ **Replies:** 2\ **Last updated:** [September 25, 2020, 2:51pm UTC](https://discuss.elastic.co/t/parsing-nested-json-fields-to-separate-fields/249973 "2020-09-25T14:51:51Z")
Hello everyone! I need to create a Logstash configuration that allows me to parse nested JSON fields to single fields. Input event looks like this: { "cloud": { "instance": { "id": "XXXX" }, "machine": { … --- ## [Filter logstash - Add simple field](https://discuss.elastic.co/t/filter-logstash-add-simple-field/249490)
**Author:** [@Thomas74](https://discuss.elastic.co/u/Thomas74)\ **Replies:** 3\ **Last updated:** [September 25, 2020, 2:39pm UTC](https://discuss.elastic.co/t/filter-logstash-add-simple-field/249490 "2020-09-25T14:39:04Z")
Hi, I'm trying to assign a value to a field. This one is the same than another variable. Here is my filter : filter{ if !(\[fields\]\[hostgroup\]) { mutate { update =\> { "\[fields\]\[hostgroup\]" … --- ## [Filebeat.yml inputs vs module](https://discuss.elastic.co/t/filebeat-yml-inputs-vs-module/249768)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 1\ **Last updated:** [September 25, 2020, 2:31pm UTC](https://discuss.elastic.co/t/filebeat-yml-inputs-vs-module/249768 "2020-09-25T14:31:09Z")
Hi, for sending elasticsearch logs to elasticsearch i am using filebeat with enabled module "elasticsearch". As far as I understod while using a module I do not need to configure the paths in the inputs inside filebeat… --- ## [Filebeat IIS Module](https://discuss.elastic.co/t/filebeat-iis-module/249717)
**Author:** [@MoeAly](https://discuss.elastic.co/u/MoeAly)\ **Replies:** 1\ **Last updated:** [September 25, 2020, 2:27pm UTC](https://discuss.elastic.co/t/filebeat-iis-module/249717 "2020-09-25T14:27:48Z")
Hello Everyone, I'm using Filebeat's iis module to ingest IIS logs into ES. All is going well and I'm able to successfully ingest my logs into ES. However, there is an iis data field called x-forwarded-for that is not… --- ## [Encryption used by Logstash to talk to Elastic Search](https://discuss.elastic.co/t/encryption-used-by-logstash-to-talk-to-elastic-search/249755)
**Author:** [@Pooja](https://discuss.elastic.co/u/Pooja)\ **Replies:** 1\ **Last updated:** [September 25, 2020, 2:20pm UTC](https://discuss.elastic.co/t/encryption-used-by-logstash-to-talk-to-elastic-search/249755 "2020-09-25T14:20:56Z")
How do you ensure data processing between logstash on premise is secured while in transit to Elasticsearch --- ## [Filebeat output to Kafka cluster with LDAP Authentication](https://discuss.elastic.co/t/filebeat-output-to-kafka-cluster-with-ldap-authentication/249682)
**Author:** [@agiorgi](https://discuss.elastic.co/u/agiorgi)\ **Replies:** 1\ **Last updated:** [September 25, 2020, 2:13pm UTC](https://discuss.elastic.co/t/filebeat-output-to-kafka-cluster-with-ldap-authentication/249682 "2020-09-25T14:13:32Z")
Hi there! this might look like a silly question but i'd like to be sure... I'm looking into configuring Filebeat to output to a Kafka cluster which is using SASL LDAP (AD) as authentication mode... I can't understand … --- ## [Kibana, Alerts and Actions, does not allow adding hostname in the message](https://discuss.elastic.co/t/kibana-alerts-and-actions-does-not-allow-adding-hostname-in-the-message/249867)
**Author:** [@kattyleja](https://discuss.elastic.co/u/kattyleja)\ **Replies:** 5\ **Last updated:** [September 25, 2020, 2:06pm UTC](https://discuss.elastic.co/t/kibana-alerts-and-actions-does-not-allow-adding-hostname-in-the-message/249867 "2020-09-25T14:06:20Z")
I am using Kibana 7.9.1, to generate alerts, I need to add to the message that is sent in this case to the logs, the hostname and message. but it has not been possible to show it. I get the empty space, with ctx.pay… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1783) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1785)