# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1797 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1798 --- ## [\_update\_by\_query throws null\_pointer\_exception](https://discuss.elastic.co/t/update-by-query-throws-null-pointer-exception/248574)
**Author:** [@Rui\_Goncalves](https://discuss.elastic.co/u/Rui_Goncalves)\ **Replies:** 2\ **Last updated:** [September 19, 2020, 12:52am UTC](https://discuss.elastic.co/t/update-by-query-throws-null-pointer-exception/248574 "2020-09-19T00:52:44Z")
I've created an index, and I'm trying to add one field. using this script: POST test\_kris\_assignment/\_update\_by\_query { "script": { "source": "ctx.\_source.field1.field2\_1 =10", "lang": "painless" }, "query": { "m… --- ## [Visualization Type Lens not present in Kibana 7.9 on windows](https://discuss.elastic.co/t/visualization-type-lens-not-present-in-kibana-7-9-on-windows/249187)
**Author:** [@Puttappaiahm](https://discuss.elastic.co/u/Puttappaiahm)\ **Replies:** 1\ **Last updated:** [September 18, 2020, 11:58pm UTC](https://discuss.elastic.co/t/visualization-type-lens-not-present-in-kibana-7-9-on-windows/249187 "2020-09-18T23:58:16Z")
I have installed ELK on windows. Under Kibana Visualizations I do not see the type 'Lens', I see all other types Area, Bar etc.. ANy suggestions on How to enable Lens? Thanks --- ## [I have problem with the logstash configuration](https://discuss.elastic.co/t/i-have-problem-with-the-logstash-configuration/249189)
**Author:** [@Pablo\_Rivadeneira](https://discuss.elastic.co/u/Pablo_Rivadeneira)\ **Replies:** 0\ **Last updated:** [September 18, 2020, 11:43pm UTC](https://discuss.elastic.co/t/i-have-problem-with-the-logstash-configuration/249189 "2020-09-18T23:43:46Z")
this is my configuration file input { file { path =\> \["C:/Users/user03/Documents/sistema\_TPG/88.-Elasticsearch/testlog.log"\] start\_position =\> "beginning" sincedb\_path =\> "C:/logstash/logstash/sincedb/logdbpath.txt" … --- ## [Processing data from logstash to elastic](https://discuss.elastic.co/t/processing-data-from-logstash-to-elastic/249183)
**Author:** [@gr0k](https://discuss.elastic.co/u/gr0k)\ **Replies:** 0\ **Last updated:** [September 18, 2020, 10:17pm UTC](https://discuss.elastic.co/t/processing-data-from-logstash-to-elastic/249183 "2020-09-18T22:17:52Z")
Worked through the RedELK install over the last week which is set to collect logs out of /root/cobaltstrike/logs. I made 1 edit to the teamserver filebeat config to collect logs from /opt/cobaltstrike/logs and it broke t… --- ## [Setting up Filebeats with the IIS module to parse IIS logs](https://discuss.elastic.co/t/setting-up-filebeats-with-the-iis-module-to-parse-iis-logs/248978)
**Author:** [@pheathers](https://discuss.elastic.co/u/pheathers)\ **Replies:** 1\ **Last updated:** [September 18, 2020, 10:05pm UTC](https://discuss.elastic.co/t/setting-up-filebeats-with-the-iis-module-to-parse-iis-logs/248978 "2020-09-18T22:05:31Z")
Hi. I'm trying to setup the Filebeats IIS module (link) so I can display IIS logs (version 10) in the canned Kibana Dashboards, however I get errors in Logstash when parsing the messages preventing them from display cor… --- ## [Problem With Date Parse - Suddenly Started Last Night](https://discuss.elastic.co/t/problem-with-date-parse-suddenly-started-last-night/249172)
**Author:** [@dmb](https://discuss.elastic.co/u/dmb)\ **Replies:** 1\ **Last updated:** [September 18, 2020, 9:40pm UTC](https://discuss.elastic.co/t/problem-with-date-parse-suddenly-started-last-night/249172 "2020-09-18T21:40:28Z")
Hi All, Very new to the ELK stack and have set up a server to ingest all my syslogs and firewall logs. Up until last night at exactly 6:59 PM all my syslogs were being ingested and the date field was being parsed out, … --- ## [I can't cancel task API enrich \_execute](https://discuss.elastic.co/t/i-cant-cancel-task-api-enrich-execute/248681)
**Author:** [@Tornis](https://discuss.elastic.co/u/Tornis)\ **Replies:** 1\ **Last updated:** [September 18, 2020, 9:36pm UTC](https://discuss.elastic.co/t/i-cant-cancel-task-api-enrich-execute/248681 "2020-09-18T21:36:31Z")
Hello guys! I have a problem and I believe it could be a bug! I created an enrichment policy pointing to an alias with 3 indexes. I started the API "\_enrich / policy/checa-fone/\_execute" and the following error is pres… --- ## [Every time read file from beginning when modified](https://discuss.elastic.co/t/every-time-read-file-from-beginning-when-modified/249030)
**Author:** [@xyz2](https://discuss.elastic.co/u/xyz2)\ **Replies:** 2\ **Last updated:** [September 18, 2020, 9:25pm UTC](https://discuss.elastic.co/t/every-time-read-file-from-beginning-when-modified/249030 "2020-09-18T21:25:41Z")
HI, I have a use case where a file is replaced with additional details periodically. I was using filebeat to do that but I see filebeat maintains an offset and considers it as same file and starts reading from the line … --- ## [Filebeat + squid module GeoIP](https://discuss.elastic.co/t/filebeat-squid-module-geoip/249176)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 0\ **Last updated:** [September 18, 2020, 8:58pm UTC](https://discuss.elastic.co/t/filebeat-squid-module-geoip/249176 "2020-09-18T20:58:44Z")
Hi there, I´m trying to setup GeoIPs from internal, private IP addresses but no luck. Follow my filebeat.yml processors: - add\_host\_metadata: netinfo.enabled: true Geo: location: -23.499294, -46.… --- ## [Using the date plugin to replace the value of @timestamp](https://discuss.elastic.co/t/using-the-date-plugin-to-replace-the-value-of-timestamp/249094)
**Author:** [@goncalobsantos](https://discuss.elastic.co/u/goncalobsantos)\ **Replies:** 1\ **Last updated:** [September 18, 2020, 7:36pm UTC](https://discuss.elastic.co/t/using-the-date-plugin-to-replace-the-value-of-timestamp/249094 "2020-09-18T19:36:04Z")
I am trying to write a .conf file to automatically build monthly indexes. I've read that Logstash uses @timestamp to identify the month of a document and that this field is in UTC by default. I'm in a timezone differe… --- ## [Hide some of "available fields" in Kibana Discover](https://discuss.elastic.co/t/hide-some-of-available-fields-in-kibana-discover/249088)
**Author:** [@a1tus](https://discuss.elastic.co/u/a1tus)\ **Replies:** 4\ **Last updated:** [September 18, 2020, 7:35pm UTC](https://discuss.elastic.co/t/hide-some-of-available-fields-in-kibana-discover/249088 "2020-09-18T19:35:21Z")
Hello. We've structured our logs so that we have only a few indexed and searchable fields and all the rest goes into "extra" field that is not indexed and can't be searched (so we put there arbitrary keys and values tha… --- ## [Containerized Logstash from it's tar ball](https://discuss.elastic.co/t/containerized-logstash-from-its-tar-ball/249158)
**Author:** [@aneeshansari](https://discuss.elastic.co/u/aneeshansari)\ **Replies:** 0\ **Last updated:** [September 18, 2020, 6:32pm UTC](https://discuss.elastic.co/t/containerized-logstash-from-its-tar-ball/249158 "2020-09-18T18:32:25Z")
Hello Everyone, can anybody help me to containerized logstash with filebeat 7.8.1. Regards, Aneesh --- ## [Calculate P95 with Transforms](https://discuss.elastic.co/t/calculate-p95-with-transforms/249018)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 1\ **Last updated:** [September 18, 2020, 5:45pm UTC](https://discuss.elastic.co/t/calculate-p95-with-transforms/249018 "2020-09-18T17:45:54Z")
Hi, I'm currently storing time-series data in my ES cluster and would like to understand how I can calculate the daily P95 values for two fields (traffic.in , traffic.out) and store the result in a separate index. I have… --- ## [Issue Vega to plot timeseries data in longer time range](https://discuss.elastic.co/t/issue-vega-to-plot-timeseries-data-in-longer-time-range/249067)
**Author:** [@f2020](https://discuss.elastic.co/u/f2020)\ **Replies:** 1\ **Last updated:** [September 18, 2020, 5:23pm UTC](https://discuss.elastic.co/t/issue-vega-to-plot-timeseries-data-in-longer-time-range/249067 "2020-09-18T17:23:49Z")
Hi, Currently we are facing an issue when plot the Vega chart in longer time range (1 year) , the recent data not shown. For example: if the time range set to 1 year such as from 9/18/2019 to 9/18/2020. The chart only … --- ## [Run http\_poller only once and terminate logstash](https://discuss.elastic.co/t/run-http-poller-only-once-and-terminate-logstash/249029)
**Author:** [@hamsinihboomi](https://discuss.elastic.co/u/hamsinihboomi)\ **Replies:** 4\ **Last updated:** [September 18, 2020, 5:22pm UTC](https://discuss.elastic.co/t/run-http-poller-only-once-and-terminate-logstash/249029 "2020-09-18T17:22:05Z")
I have an API call to JIRA which should run only once every 4 weeks. I'm using logstash http\_poller to fetch the data from JIRA. The schedule with http\_poller does not allow a complex cron schedule so I was planning on … --- ## [Why query\_string doesn't honor the usual precedence rules?](https://discuss.elastic.co/t/why-query-string-doesnt-honor-the-usual-precedence-rules/248779)
**Author:** [@android.kc](https://discuss.elastic.co/u/android.kc)\ **Replies:** 3\ **Last updated:** [September 18, 2020, 4:36pm UTC](https://discuss.elastic.co/t/why-query-string-doesnt-honor-the-usual-precedence-rules/248779 "2020-09-18T16:36:25Z")
Can anyone please explain why I got all different results in the following query\_string queries (all are the same except the parentheses) A OR B AND C (A OR B) AND C A OR (B AND C) The index only has the thre… --- ## [Module: kubernetes, metricset: container - is missing exported fields from docs (such as status?)](https://discuss.elastic.co/t/module-kubernetes-metricset-container-is-missing-exported-fields-from-docs-such-as-status/248456)
**Author:** [@Ilai\_Fallach](https://discuss.elastic.co/u/Ilai_Fallach)\ **Replies:** 2\ **Last updated:** [September 18, 2020, 4:29pm UTC](https://discuss.elastic.co/t/module-kubernetes-metricset-container-is-missing-exported-fields-from-docs-such-as-status/248456 "2020-09-18T16:29:44Z")
Hey there, I'm trying to get the status of a pod to alert for Crashloop Backoffs and other non Ready states. To achieve that I've tried the docs: https://www.elastic.co/guide/en/beats/metricbeat/current/exported-fiel… --- ## [Must\_exist](https://discuss.elastic.co/t/must-exist/249009)
**Author:** [@rihad](https://discuss.elastic.co/u/rihad)\ **Replies:** 5\ **Last updated:** [September 18, 2020, 4:26pm UTC](https://discuss.elastic.co/t/must-exist/249009 "2020-09-18T16:26:05Z")
Hi there! How do I use the must\_exist alias attribute that appeared in version 7.9? This is what I try: curl -sS -X POST http://localhost:9200/\_aliases?timeout=15m&master\_timeout=15m -H Content-Type: application/js… --- ## [Creating an index from another index with only certain fields and a different ID than the original index](https://discuss.elastic.co/t/creating-an-index-from-another-index-with-only-certain-fields-and-a-different-id-than-the-original-index/247576)
**Author:** [@edster](https://discuss.elastic.co/u/edster)\ **Replies:** 3\ **Last updated:** [September 18, 2020, 4:02pm UTC](https://discuss.elastic.co/t/creating-an-index-from-another-index-with-only-certain-fields-and-a-different-id-than-the-original-index/247576 "2020-09-18T16:02:25Z")
Is there anyway to create an index from another index but only taking certain fields, not all? The new index would have a new ID as well and include a new alias. I was looking at the reindex API and the clone API as mayb… --- ## [Filebeat+auditd module not parsed through logstash](https://discuss.elastic.co/t/filebeat-auditd-module-not-parsed-through-logstash/249126)
**Author:** [@pereyrdi](https://discuss.elastic.co/u/pereyrdi)\ **Replies:** 0\ **Last updated:** [September 18, 2020, 3:42pm UTC](https://discuss.elastic.co/t/filebeat-auditd-module-not-parsed-through-logstash/249126 "2020-09-18T15:42:26Z")
Hello! Im using filebeat with audit module enable to monitoring the audit.log, I have try configure as output directy to elasticsearch and the message field was parsed with all audit's fields correctly. But when I conf… --- ## [How to create fields dynamically?](https://discuss.elastic.co/t/how-to-create-fields-dynamically/249115)
**Author:** [@11191](https://discuss.elastic.co/u/11191)\ **Replies:** 1\ **Last updated:** [September 18, 2020, 3:14pm UTC](https://discuss.elastic.co/t/how-to-create-fields-dynamically/249115 "2020-09-18T15:14:17Z")
I have a log looking like: \[2020-09-18 12:34 smth1=38 smth2=125 ... \] and I want "smth1" to be a field name and "38" its value, what would be best way to do it considering that "smth1" might be different ea… --- ## [Best practice to search fields not available to most documents](https://discuss.elastic.co/t/best-practice-to-search-fields-not-available-to-most-documents/249040)
**Author:** [@andrew.laraia](https://discuss.elastic.co/u/andrew.laraia)\ **Replies:** 2\ **Last updated:** [September 18, 2020, 3:12pm UTC](https://discuss.elastic.co/t/best-practice-to-search-fields-not-available-to-most-documents/249040 "2020-09-18T15:12:46Z")
I'm new to the ELK stack. So far, so good. I am making progress, We're looking to use on an existing system get some real-time (or at least recent history) of client/user activity to aid in offering the most relevant ser… --- ## [How to implement task life cycle scenario](https://discuss.elastic.co/t/how-to-implement-task-life-cycle-scenario/248128)
**Author:** [@ram546](https://discuss.elastic.co/u/ram546)\ **Replies:** 9\ **Last updated:** [September 18, 2020, 3:09pm UTC](https://discuss.elastic.co/t/how-to-implement-task-life-cycle-scenario/248128 "2020-09-18T15:09:35Z")
hello, I am new to ELK stack and I want to create one scenario where I can track elapsed time. e.g I have a platform where user can CREATE ticket. and that ticket will be assigned to some department/person. then it will … --- ## [\[ERROR\]\[logstash.agent \] Failed to execute action {:id=\>:main, :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Could not execute action: PipelineAction::Create\, action\_result: false", :backtrace=\>nil}](https://discuss.elastic.co/t/error-logstash-agent-failed-to-execute-action-id-main-action-type-logstash-failedaction-message-could-not-execute-action-pipelineaction-create-main-action-result-false-backtrace-nil/249057)
**Author:** [@Sayontani\_Bose](https://discuss.elastic.co/u/Sayontani_Bose)\ **Replies:** 1\ **Last updated:** [September 18, 2020, 3:01pm UTC](https://discuss.elastic.co/t/error-logstash-agent-failed-to-execute-action-id-main-action-type-logstash-failedaction-message-could-not-execute-action-pipelineaction-create-main-action-result-false-backtrace-nil/249057 "2020-09-18T15:01:23Z")
Hi I have Installed Logstash and whenever i m trying to run by "bin/logstash --path.settings /etc/logstash -f /etc/logstash/conf.d/01-wazuh.conf --config.reload.automatic I am getting this error - \[ERROR\]\[logstash.age… --- ## [Architecture validation](https://discuss.elastic.co/t/architecture-validation/248940)
**Author:** [@vero](https://discuss.elastic.co/u/vero)\ **Replies:** 3\ **Last updated:** [September 18, 2020, 2:51pm UTC](https://discuss.elastic.co/t/architecture-validation/248940 "2020-09-18T14:51:47Z")
Hi, I'm writing to you, because I need to your help / points of view about the architecture that I choose. In fact, I just started a new project, I'm in preparation architecture stage. Normally, I have, 4 stages: Coll… --- ## [Kubernetes.container.memory.usage.bytes looks incorrect for redis container](https://discuss.elastic.co/t/kubernetes-container-memory-usage-bytes-looks-incorrect-for-redis-container/249110)
**Author:** [@willis](https://discuss.elastic.co/u/willis)\ **Replies:** 0\ **Last updated:** [September 18, 2020, 1:44pm UTC](https://discuss.elastic.co/t/kubernetes-container-memory-usage-bytes-looks-incorrect-for-redis-container/249110 "2020-09-18T13:44:10Z")
I have a redis pod with container limits of 6GB. Metricbeat (7.6.2) data from the container shows: kubernetes.container.memory.usage.bytes: 5.9GB kubernetes.container.memory.usage.limit.pct: 99.9% kubernetes.container.m… --- ## [How to customize a filebeat to parse a log?](https://discuss.elastic.co/t/how-to-customize-a-filebeat-to-parse-a-log/249049)
**Author:** [@icaruswu](https://discuss.elastic.co/u/icaruswu)\ **Replies:** 2\ **Last updated:** [September 18, 2020, 10:45am UTC](https://discuss.elastic.co/t/how-to-customize-a-filebeat-to-parse-a-log/249049 "2020-09-18T10:45:51Z")
I read a the formal docs and wanna build my own filebeat module to parse my log. But there's little essays which could be helpful to me. For example, my log is : 2020-09-17T15:48:56.998+0800 INFO chain chain/sync.go:70… --- ## [Events Received Rate is climbing high after logstash restart](https://discuss.elastic.co/t/events-received-rate-is-climbing-high-after-logstash-restart/249063)
**Author:** [@Burga](https://discuss.elastic.co/u/Burga)\ **Replies:** 1\ **Last updated:** [September 18, 2020, 10:09am UTC](https://discuss.elastic.co/t/events-received-rate-is-climbing-high-after-logstash-restart/249063 "2020-09-18T10:09:37Z")
Hi , I'm handling with strange behavior , after bouncing logstash Events Received Rate droped to 200 e/s after bounce again it climbed to 1000 e/s what can be the cause ? --- ## [Filebeat stops until log rotated](https://discuss.elastic.co/t/filebeat-stops-until-log-rotated/249083)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 0\ **Last updated:** [September 18, 2020, 10:02am UTC](https://discuss.elastic.co/t/filebeat-stops-until-log-rotated/249083 "2020-09-18T10:02:03Z")
Hi, Have a filebeat 7.9.1 running on several CentOS 7 servers watching 1 log. This log is growing ca 150.000 to 200.000 bytes per second (12 to 15 GB a day at the moment). This log is copytruncated. This issue is that … --- ## [Logstash, how to avoid output block when one elasticsearch node go down](https://discuss.elastic.co/t/logstash-how-to-avoid-output-block-when-one-elasticsearch-node-go-down/247419)
**Author:** [@daniele.lopez](https://discuss.elastic.co/u/daniele.lopez)\ **Replies:** 6\ **Last updated:** [September 18, 2020, 9:54am UTC](https://discuss.elastic.co/t/logstash-how-to-avoid-output-block-when-one-elasticsearch-node-go-down/247419 "2020-09-18T09:54:25Z")
Hi all, I have an elasticsearch cluster with 3 nodes. is a really basic cluster. On each node i have one logstash pointing to cluster nodes. If a node go down all logstash output fail, even if i have the master node u… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1796) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1798)