# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1802 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1803 --- ## [Logstash always restart](https://discuss.elastic.co/t/logstash-always-restart/248854)
**Author:** [@loxiaopohaiol](https://discuss.elastic.co/u/loxiaopohaiol)\ **Replies:** 7\ **Last updated:** [September 16, 2020, 4:47pm UTC](https://discuss.elastic.co/t/logstash-always-restart/248854 "2020-09-16T16:47:49Z")
logstash version:6.0, jdk version: 1.8.0, but no error log for the logstash service, the /var/log/message log is that: Sep 16 23:17:20 localhost.localdomain systemd\[1\]: Started logstash. Sep 16 23:17:30 localhost.local… --- ## [Kibana Dashboard Only User along with customized viewer role getting 403 forbidden error post login](https://discuss.elastic.co/t/kibana-dashboard-only-user-along-with-customized-viewer-role-getting-403-forbidden-error-post-login/248724)
**Author:** [@ashutosh.pandey](https://discuss.elastic.co/u/ashutosh.pandey)\ **Replies:** 1\ **Last updated:** [September 16, 2020, 4:39pm UTC](https://discuss.elastic.co/t/kibana-dashboard-only-user-along-with-customized-viewer-role-getting-403-forbidden-error-post-login/248724 "2020-09-16T16:39:35Z")
I had created a kibana\_dashboard\_only\_user with index specific access and spaces specific access read permissions specified in a custom role called viewer , it was working so far but now stopped working due to unknown re… --- ## [Update document with Rest High Level Client](https://discuss.elastic.co/t/update-document-with-rest-high-level-client/248714)
**Author:** [@Emanuel\_Velzi](https://discuss.elastic.co/u/Emanuel_Velzi)\ **Replies:** 2\ **Last updated:** [September 16, 2020, 4:19pm UTC](https://discuss.elastic.co/t/update-document-with-rest-high-level-client/248714 "2020-09-16T16:19:13Z")
Hi, I have to update a document in my Java app, using the Rest High Level Client. I must to override the document, i.e.: I need to replace completely the document with a new version. I am trying this but it only makes … --- ## [Watcher gmail notification in docker-compose](https://discuss.elastic.co/t/watcher-gmail-notification-in-docker-compose/245867)
**Author:** [@vicom\_sistemas](https://discuss.elastic.co/u/vicom_sistemas)\ **Replies:** 3\ **Last updated:** [September 16, 2020, 4:12pm UTC](https://discuss.elastic.co/t/watcher-gmail-notification-in-docker-compose/245867 "2020-09-16T16:12:09Z")
Hi, I´m trying to setup watcher to send emails using gmail. I´m using a docker-compose but every time I add x-pack settings to it, I receive the following error: unknown setting \[xpack.notification.email.account.smtp.a… --- ## [Request for an improved way to make paths](https://discuss.elastic.co/t/request-for-an-improved-way-to-make-paths/248852)
**Author:** [@cmk1523](https://discuss.elastic.co/u/cmk1523)\ **Replies:** 1\ **Last updated:** [September 16, 2020, 4:11pm UTC](https://discuss.elastic.co/t/request-for-an-improved-way-to-make-paths/248852 "2020-09-16T16:11:08Z")
I'm need for Kibana to generate paths from my index of position data. The best I could come up with is adding a LineString geojson shape to every position (using the former position). Is this really the best way to accom… --- ## [Escape backslash logstash configuration](https://discuss.elastic.co/t/escape-backslash-logstash-configuration/248855)
**Author:** [@grumo35](https://discuss.elastic.co/u/grumo35)\ **Replies:** 2\ **Last updated:** [September 16, 2020, 4:06pm UTC](https://discuss.elastic.co/t/escape-backslash-logstash-configuration/248855 "2020-09-16T16:06:12Z")
Hi, I'm experiencing some troubles trying to split a string using backslash with the split plugin. XXX\\YYY I'd like to use split =\> \["field","\\"\] Quickly ran into escape problems as expected, according to the documen… --- ## [Apache logs missing SSL Protocol](https://discuss.elastic.co/t/apache-logs-missing-ssl-protocol/248070)
**Author:** [@prophoto](https://discuss.elastic.co/u/prophoto)\ **Replies:** 5\ **Last updated:** [September 16, 2020, 3:36pm UTC](https://discuss.elastic.co/t/apache-logs-missing-ssl-protocol/248070 "2020-09-16T15:36:38Z")
Despite SSL Protocol and request time showing in my logformat directive in Apache 2.4 I am not seeing either of them in ES/Kibana. How is this fixed? I am using filebeat and shipping logs directly to ES. --- ## [Wrong event start time with Fortinet module](https://discuss.elastic.co/t/wrong-event-start-time-with-fortinet-module/246599)
**Author:** [@anon56147639](https://discuss.elastic.co/u/anon56147639)\ **Replies:** 6\ **Last updated:** [September 16, 2020, 3:30pm UTC](https://discuss.elastic.co/t/wrong-event-start-time-with-fortinet-module/246599 "2020-09-16T15:30:55Z")
Hi everyone, I'm using Filebeat with its Fortinet module. In Kibana, I noticed that the fields event.start is completely wrong. It contains values such as "1970-01-19T12:01:51.846Z ". I guess there is some parsing prob… --- ## [How to get hostname of "Elastic" server / "Cluster" name where the watcher is running?](https://discuss.elastic.co/t/how-to-get-hostname-of-elastic-server-cluster-name-where-the-watcher-is-running/247552)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 2\ **Last updated:** [September 16, 2020, 3:16pm UTC](https://discuss.elastic.co/t/how-to-get-hostname-of-elastic-server-cluster-name-where-the-watcher-is-running/247552 "2020-09-16T15:16:04Z")
hi we have a clustered environment. Is there a way to get where the "watcher" have run? We have putting a same set of watcher ,but needed to ensure only PROD watchers are alerted. Hence wanted to filter on a specific ke… --- ## [Connect Elastic Search to Tableau - max file descriptors \[4096\] for elasticsearch process is too low, increase to at least \[65535\]](https://discuss.elastic.co/t/connect-elastic-search-to-tableau-max-file-descriptors-4096-for-elasticsearch-process-is-too-low-increase-to-at-least-65535/248799)
**Author:** [@DG13](https://discuss.elastic.co/u/DG13)\ **Replies:** 3\ **Last updated:** [September 16, 2020, 3:14pm UTC](https://discuss.elastic.co/t/connect-elastic-search-to-tableau-max-file-descriptors-4096-for-elasticsearch-process-is-too-low-increase-to-at-least-65535/248799 "2020-09-16T15:14:36Z")
Hi , I am getting error while running the elastic search after adding below details in elasticsearch.yml to connect elastic search to Tableau http.port: 9200 network.host: \["0.0.0.0", 127.0.0.1", "\[::1\]"\] network.bind… --- ## [How to add visualizations in Kibana custom plugins](https://discuss.elastic.co/t/how-to-add-visualizations-in-kibana-custom-plugins/248802)
**Author:** [@siiman](https://discuss.elastic.co/u/siiman)\ **Replies:** 4\ **Last updated:** [September 16, 2020, 2:55pm UTC](https://discuss.elastic.co/t/how-to-add-visualizations-in-kibana-custom-plugins/248802 "2020-09-16T14:55:42Z")
Hello everyone, I am new to plugin development and wonder how I can display visualizations in a custom Kibana plugin. Whether I include visualizations of saved objects or define new visualizations in the Javascript code… --- ## [Cylance module in filebeat docs are mixed with RSA](https://discuss.elastic.co/t/cylance-module-in-filebeat-docs-are-mixed-with-rsa/248754)
**Author:** [@jessvin.thomas](https://discuss.elastic.co/u/jessvin.thomas)\ **Replies:** 2\ **Last updated:** [September 16, 2020, 1:50pm UTC](https://discuss.elastic.co/t/cylance-module-in-filebeat-docs-are-mixed-with-rsa/248754 "2020-09-16T13:50:07Z")
The documentation for the cylance module in filebeats looks mixed up with RSA Netwitness. In this documentation: RSA fields are referenced: var.rsa\_fields And the link to exported fields also are mainly RSA fields… --- ## [Error loading yaml file-did not find expected key](https://discuss.elastic.co/t/error-loading-yaml-file-did-not-find-expected-key/248554)
**Author:** [@vsekvsek](https://discuss.elastic.co/u/vsekvsek)\ **Replies:** 6\ **Last updated:** [September 16, 2020, 1:48pm UTC](https://discuss.elastic.co/t/error-loading-yaml-file-did-not-find-expected-key/248554 "2020-09-16T13:48:45Z")
.\\filebeat.exe modules enable apache Error initializing beat: error loading config file: yaml line 70: did not find expected key This is on line 70 on the filebeat file. path: "C:\\\\Program Files\\\\filebeat\\\\module\\\\apa… --- ## [Data Correlation in Elasticsearch](https://discuss.elastic.co/t/data-correlation-in-elasticsearch/248833)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 1\ **Last updated:** [September 16, 2020, 1:42pm UTC](https://discuss.elastic.co/t/data-correlation-in-elasticsearch/248833 "2020-09-16T13:42:40Z")
Hi All, I just wanted to know whether i can use ELK for my use case, please suggest. WE are using ELK for dashboarding and reporting purpose, for this we are fetching data from multiple datasources like (servicenow, so… --- ## [Mapping Problems](https://discuss.elastic.co/t/mapping-problems/248732)
**Author:** [@Rart3001](https://discuss.elastic.co/u/Rart3001)\ **Replies:** 2\ **Last updated:** [September 16, 2020, 1:35pm UTC](https://discuss.elastic.co/t/mapping-problems/248732 "2020-09-16T13:35:09Z")
Hello, I am new in ElasticSearch, I am trying to create a new mapping with this request: PUT /my\_index/\_mapping { "mappings": { "properties": { "avatar": { "ty… --- ## [Field value equal to 0 not recognized in a IF statetement](https://discuss.elastic.co/t/field-value-equal-to-0-not-recognized-in-a-if-statetement/248830)
**Author:** [@nino](https://discuss.elastic.co/u/nino)\ **Replies:** 3\ **Last updated:** [September 16, 2020, 1:24pm UTC](https://discuss.elastic.co/t/field-value-equal-to-0-not-recognized-in-a-if-statetement/248830 "2020-09-16T13:24:34Z")
Hello all, i have this float field: { "field\_value" =\> 0.0 } And this if statement in a logstash pipeline: if \[field\_value\] == 0 { mutate{ add\_field =\> {"is\_zero" =\> "yes"} } } else { mutate{ … --- ## [How to manage shards and indexes on Production cluster?](https://discuss.elastic.co/t/how-to-manage-shards-and-indexes-on-production-cluster/248512)
**Author:** [@Sebastien\_Lelak](https://discuss.elastic.co/u/Sebastien_Lelak)\ **Replies:** 2\ **Last updated:** [September 16, 2020, 1:20pm UTC](https://discuss.elastic.co/t/how-to-manage-shards-and-indexes-on-production-cluster/248512 "2020-09-16T13:20:06Z")
Greetings, We use a 12-node ELK dockerised stack to index our webapps and access logs. We create one index per app per day. webapps logs are stored 90 days, access\_logs shall be available "forever". Currently, we are f… --- ## [About snapshot recovery](https://discuss.elastic.co/t/about-snapshot-recovery/248813)
**Author:** [@zjh](https://discuss.elastic.co/u/zjh)\ **Replies:** 1\ **Last updated:** [September 16, 2020, 1:20pm UTC](https://discuss.elastic.co/t/about-snapshot-recovery/248813 "2020-09-16T13:20:01Z")
Does ES plan to allow changes to the "number of shard" when using snapshot recovery in the future? --- ## [Vega visualizations not getting updated](https://discuss.elastic.co/t/vega-visualizations-not-getting-updated/248831)
**Author:** [@sama.sowjanya](https://discuss.elastic.co/u/sama.sowjanya)\ **Replies:** 1\ **Last updated:** [September 16, 2020, 1:16pm UTC](https://discuss.elastic.co/t/vega-visualizations-not-getting-updated/248831 "2020-09-16T13:16:14Z")
Hi In kibana dashboard, when we click on panel value in visualization it gets added to the filter and whole dashboard gets updated accordingly. But clicking on Vega visualization the value or condition is not getting ad… --- ## [SSL Error in Kibana logs](https://discuss.elastic.co/t/ssl-error-in-kibana-logs/247992)
**Author:** [@artobstrel](https://discuss.elastic.co/u/artobstrel)\ **Replies:** 14\ **Last updated:** [September 16, 2020, 1:15pm UTC](https://discuss.elastic.co/t/ssl-error-in-kibana-logs/247992 "2020-09-16T13:15:22Z")
Hi guys! I have successfully configured TLS in ELK using a corporate certificates. Everything works fine: Kibana and Elasticsearch is available by https Authentication in Kibana is ok Certificate is valid However, S… --- ## [Save a list of split series filters](https://discuss.elastic.co/t/save-a-list-of-split-series-filters/248747)
**Author:** [@buncieboy](https://discuss.elastic.co/u/buncieboy)\ **Replies:** 2\ **Last updated:** [September 16, 2020, 1:13pm UTC](https://discuss.elastic.co/t/save-a-list-of-split-series-filters/248747 "2020-09-16T13:13:34Z")
Due to the bug at #14536 our legend is out of order. To get around that instead of using a terms aggregation we are using a filters one, allowing us to control the order. Only issue is we have 10 or so filters, all with … --- ## [Can't start Elasticsearch with Full disk Space](https://discuss.elastic.co/t/cant-start-elasticsearch-with-full-disk-space/248808)
**Author:** [@Juicy45](https://discuss.elastic.co/u/Juicy45)\ **Replies:** 2\ **Last updated:** [September 16, 2020, 1:01pm UTC](https://discuss.elastic.co/t/cant-start-elasticsearch-with-full-disk-space/248808 "2020-09-16T13:01:28Z")
Hello, I have an elastic on a single server. I know, it's bad but I didn't pay so much attention to the Disk space. The /var filesystem is full at 100%. I want to properly delete the oldest data, if I can with elastic … --- ## [Request must contain a kbn-xsrf header](https://discuss.elastic.co/t/request-must-contain-a-kbn-xsrf-header/248785)
**Author:** [@todor](https://discuss.elastic.co/u/todor)\ **Replies:** 2\ **Last updated:** [September 16, 2020, 12:52pm UTC](https://discuss.elastic.co/t/request-must-contain-a-kbn-xsrf-header/248785 "2020-09-16T12:52:11Z")
I've had this issue when i'm trying to open Kibana on http://localhost:5601/app/home Can some help me? --- ## [Dynamic score calculation](https://discuss.elastic.co/t/dynamic-score-calculation/248614)
**Author:** [@Ania\_Krawet](https://discuss.elastic.co/u/Ania_Krawet)\ **Replies:** 1\ **Last updated:** [September 16, 2020, 12:32pm UTC](https://discuss.elastic.co/t/dynamic-score-calculation/248614 "2020-09-16T12:32:22Z")
I have documents like this ( simplified case of course): Category: A, Rating: 10 Category: A, Rating: 9 Category: A, Rating: 5 Category: B, Rating: 8 Category: B, Rating: 5 Category: B, Rating: 4 Category: B, Rating: 1… --- ## [Elastic watch condition proble,s](https://discuss.elastic.co/t/elastic-watch-condition-proble-s/245665)
**Author:** [@Fredrik\_Cronholm](https://discuss.elastic.co/u/Fredrik_Cronholm)\ **Replies:** 2\ **Last updated:** [September 16, 2020, 12:34pm UTC](https://discuss.elastic.co/t/elastic-watch-condition-proble-s/245665 "2020-09-16T12:34:41Z")
Hi! I'm trying to figure out a watcher with condition on the amount of hits, but the evaluation always turns out null an watcher execution (with in my mind 3 hits) gives "compare": { "resolved\_values": {… --- ## [Problem Watchers Failed Logins Index out of bounds exception Index 0 out of bounds for length 0](https://discuss.elastic.co/t/problem-watchers-failed-logins-index-out-of-bounds-exception-index-0-out-of-bounds-for-length-0/246694)
**Author:** [@SerSSH](https://discuss.elastic.co/u/SerSSH)\ **Replies:** 1\ **Last updated:** [September 16, 2020, 12:30pm UTC](https://discuss.elastic.co/t/problem-watchers-failed-logins-index-out-of-bounds-exception-index-0-out-of-bounds-for-length-0/246694 "2020-09-16T12:30:26Z")
Hi Experts, Currently I have an error that I have not been able to solve in a watcher, I am making some failed logins, so that when more than 3 attempts are detected per user it is activated and sends a notification by … --- ## [Functionbeat Get Data From All Log Groups](https://discuss.elastic.co/t/functionbeat-get-data-from-all-log-groups/248796)
**Author:** [@sainath](https://discuss.elastic.co/u/sainath)\ **Replies:** 2\ **Last updated:** [September 16, 2020, 12:17pm UTC](https://discuss.elastic.co/t/functionbeat-get-data-from-all-log-groups/248796 "2020-09-16T12:17:30Z")
I am using functionbeat 7.9 to integrate with AWS lambda logs and I am currently providing multiple log group names to fetch data from each of them. - log\_group\_name: /aws/lambda/Summary - log\_group\_name: /a… --- ## [Fine grained access control on specific watchers](https://discuss.elastic.co/t/fine-grained-access-control-on-specific-watchers/247986)
**Author:** [@iorfix](https://discuss.elastic.co/u/iorfix)\ **Replies:** 2\ **Last updated:** [September 16, 2020, 12:06pm UTC](https://discuss.elastic.co/t/fine-grained-access-control-on-specific-watchers/247986 "2020-09-16T12:06:51Z")
Hi, I want different users to create and manage their own watchers. A user could edit / create / delete / ack only the watchers he created. I noted watcher privileges are of type "cluster", so basically each watcher a… --- ## [Changes in Kibana login page](https://discuss.elastic.co/t/changes-in-kibana-login-page/248819)
**Author:** [@pankaj0172](https://discuss.elastic.co/u/pankaj0172)\ **Replies:** 1\ **Last updated:** [September 16, 2020, 11:58am UTC](https://discuss.elastic.co/t/changes-in-kibana-login-page/248819 "2020-09-16T11:58:09Z")
Hi, I need help to change Kibana home login page from "Welcome to Elastic" to something else and logo as well. Please suggest the require configuration changes. --- ## [Remove everything except Kibana dashboard while read only access to user](https://discuss.elastic.co/t/remove-everything-except-kibana-dashboard-while-read-only-access-to-user/248770)
**Author:** [@pankaj0172](https://discuss.elastic.co/u/pankaj0172)\ **Replies:** 8\ **Last updated:** [September 16, 2020, 11:27am UTC](https://discuss.elastic.co/t/remove-everything-except-kibana-dashboard-while-read-only-access-to-user/248770 "2020-09-16T11:27:38Z")
Hi Team, I have created a space in Kibana with user read only dashboard access but when I logged in it's showing home page like below but I don't want user to show this page Can I remove everything except Kibana & dash… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1801) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1803)