# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1814 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1815 --- ## [Access original, un-decoded input message](https://discuss.elastic.co/t/access-original-un-decoded-input-message/248100)
**Author:** [@truekonrads](https://discuss.elastic.co/u/truekonrads)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 3:04pm UTC](https://discuss.elastic.co/t/access-original-un-decoded-input-message/248100 "2020-09-10T15:04:18Z")
Hello, How can I access the original input message before it was decoded so that I can refer to it from filter or output? The setup is as follows: I am reading JSON from rabbitmq; the default codec is json and it bre… --- ## [How to filter log file by id in kibana](https://discuss.elastic.co/t/how-to-filter-log-file-by-id-in-kibana/248148)
**Author:** [@HR\_Amani](https://discuss.elastic.co/u/HR_Amani)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 2:58pm UTC](https://discuss.elastic.co/t/how-to-filter-log-file-by-id-in-kibana/248148 "2020-09-10T14:58:44Z")
Hi i am new to ELk stack . i have a log file that contain many bills. every bill has more then 200 lignes of information plus the id of the bill presented in this way informations about bill 1 : informations bill ID :… --- ## [LogStash not showing output on console](https://discuss.elastic.co/t/logstash-not-showing-output-on-console/248163)
**Author:** [@Vishal\_Donderia](https://discuss.elastic.co/u/Vishal_Donderia)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 2:57pm UTC](https://discuss.elastic.co/t/logstash-not-showing-output-on-console/248163 "2020-09-10T14:57:55Z")
I was trying to use filebeat to push data into logstash filebeat.yml type: log # Change to true to enable this input configuration. enabled: false #Paths that should be crawled and fetched. Glob based paths. … --- ## [Index rollover given an error for alias](https://discuss.elastic.co/t/index-rollover-given-an-error-for-alias/246049)
**Author:** [@jijo.john](https://discuss.elastic.co/u/jijo.john)\ **Replies:** 6\ **Last updated:** [September 10, 2020, 2:55pm UTC](https://discuss.elastic.co/t/index-rollover-given-an-error-for-alias/246049 "2020-09-10T14:55:13Z")
Hi Team, Kindly help us to resolve below error which we are receiving for our custom index created from filebeat cisco asa module. illegal\_argument\_exception: index.lifecycle.rollover\_alias \[ciscobeat-7.6.2\] does not … --- ## [When using SQL, the IN statement does not work in the SELECT section of a query](https://discuss.elastic.co/t/when-using-sql-the-in-statement-does-not-work-in-the-select-section-of-a-query/247118)
**Author:** [@meadows.120](https://discuss.elastic.co/u/meadows.120)\ **Replies:** 2\ **Last updated:** [September 10, 2020, 2:47pm UTC](https://discuss.elastic.co/t/when-using-sql-the-in-statement-does-not-work-in-the-select-section-of-a-query/247118 "2020-09-10T14:47:09Z")
ES Version: 7.8 I’m trying to run the following in SQL Workbench, and one query works, but the other one does not…any thoughts? Successful: SELECT \* FROM my\_index WHERE a.b IN ('115') Failure: SELECT a.b IN … --- ## [Index pattern type in Elasticsearch](https://discuss.elastic.co/t/index-pattern-type-in-elasticsearch/248183)
**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Replies:** 2\ **Last updated:** [September 10, 2020, 2:27pm UTC](https://discuss.elastic.co/t/index-pattern-type-in-elasticsearch/248183 "2020-09-10T14:27:33Z")
HI Team, I would like to take some suggestion to create index pattern in ELK. As per my current configuration in production, i'm index data in ES by monthly index with 1 Primary Shard and 2 replicas. Due to that i was… --- ## [CSP in Kibana](https://discuss.elastic.co/t/csp-in-kibana/248149)
**Author:** [@Alder](https://discuss.elastic.co/u/Alder)\ **Replies:** 3\ **Last updated:** [September 10, 2020, 2:07pm UTC](https://discuss.elastic.co/t/csp-in-kibana/248149 "2020-09-10T14:07:42Z")
Hello to all of the elastic team. I'm trying create a space with the C# code below. The http response suggests that CSP rules are blocking my request private void testCreateSpace() { string spaceJson = … --- ## [Logstash HA](https://discuss.elastic.co/t/logstash-ha/247956)
**Author:** [@aksshm](https://discuss.elastic.co/u/aksshm)\ **Replies:** 8\ **Last updated:** [September 10, 2020, 2:07pm UTC](https://discuss.elastic.co/t/logstash-ha/247956 "2020-09-10T14:07:21Z")
Hi, We're trying to install/achieve logstash HA. Is logstash support HA? or Is there any way to achieve the same? --- ## [Heartbeat high network utilization](https://discuss.elastic.co/t/heartbeat-high-network-utilization/248184)
**Author:** [@ehausig1](https://discuss.elastic.co/u/ehausig1)\ **Replies:** 0\ **Last updated:** [September 10, 2020, 1:50pm UTC](https://discuss.elastic.co/t/heartbeat-high-network-utilization/248184 "2020-09-10T13:50:30Z")
I'm trying to figure out why Heartbeat seems to be using so much network bandwidth: I have a single http monitor for an Elasticsearch endpoint that is scheduled every 10s. The endpoint returns about a 600 byte response … --- ## [Comparison of two lists in Elsticsearch](https://discuss.elastic.co/t/comparison-of-two-lists-in-elsticsearch/248182)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 0\ **Last updated:** [September 10, 2020, 1:43pm UTC](https://discuss.elastic.co/t/comparison-of-two-lists-in-elsticsearch/248182 "2020-09-10T13:43:44Z")
Hi All, I am new to ELK and facing issues with below scenario. I am trying to compare two lists, listA and listB. This should provide a list of numbers which are present in listB but are not there in listA. I have wri… --- ## [How to add all log groups in functionbeat.yml](https://discuss.elastic.co/t/how-to-add-all-log-groups-in-functionbeat-yml/248181)
**Author:** [@deepasaju](https://discuss.elastic.co/u/deepasaju)\ **Replies:** 0\ **Last updated:** [September 10, 2020, 1:43pm UTC](https://discuss.elastic.co/t/how-to-add-all-log-groups-in-functionbeat-yml/248181 "2020-09-10T13:43:41Z")
Team, How to add delimiter in functionbeat.yml file to include the entire log groups of a service ? ex. If I have multiple logs start with API-Gateway , what is the exact syntax to include them? /API-Gateway-\* is … --- ## [Winlogbeat - only new logs?](https://discuss.elastic.co/t/winlogbeat-only-new-logs/248174)
**Author:** [@Shawn\_Keslar](https://discuss.elastic.co/u/Shawn_Keslar)\ **Replies:** 2\ **Last updated:** [September 10, 2020, 1:38pm UTC](https://discuss.elastic.co/t/winlogbeat-only-new-logs/248174 "2020-09-10T13:38:04Z")
How do I configure Winlogbeat to only read new data? I'm adding my DC's to our SIEM, and it's reading all of the audit data on the box. Taking a lot to process it. I'd like to avoid this issue as I add new servers. TIA. --- ## [Sql Query vs Dsl Query](https://discuss.elastic.co/t/sql-query-vs-dsl-query/247048)
**Author:** [@Nupur](https://discuss.elastic.co/u/Nupur)\ **Replies:** 2\ **Last updated:** [September 10, 2020, 1:32pm UTC](https://discuss.elastic.co/t/sql-query-vs-dsl-query/247048 "2020-09-10T13:32:07Z")
querying through sql access api or querying through dsl .. which is faster in searching . Is there is performance difference in both. --- ## [Gpu beats for metricbeat](https://discuss.elastic.co/t/gpu-beats-for-metricbeat/248036)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 2\ **Last updated:** [September 10, 2020, 1:31pm UTC](https://discuss.elastic.co/t/gpu-beats-for-metricbeat/248036 "2020-09-10T13:31:02Z")
Is there a beats to monitor GPU stats ? --- ## [How to properly display prices in Kibana](https://discuss.elastic.co/t/how-to-properly-display-prices-in-kibana/247563)
**Author:** [@Jackson](https://discuss.elastic.co/u/Jackson)\ **Replies:** 4\ **Last updated:** [September 10, 2020, 1:29pm UTC](https://discuss.elastic.co/t/how-to-properly-display-prices-in-kibana/247563 "2020-09-10T13:29:46Z")
Hello, I'm trying to properly display prices in Kibaba. Currently, prices are mapped as a long integer so that 120.00 is stored as 12000. We have some dashboards we show to clients such as their total revenue. I need t… --- ## [Kibana index document count increasing even when there are no saved objects](https://discuss.elastic.co/t/kibana-index-document-count-increasing-even-when-there-are-no-saved-objects/247177)
**Author:** [@prashant1](https://discuss.elastic.co/u/prashant1)\ **Replies:** 5\ **Last updated:** [September 10, 2020, 1:24pm UTC](https://discuss.elastic.co/t/kibana-index-document-count-increasing-even-when-there-are-no-saved-objects/247177 "2020-09-10T13:24:49Z")
Hi, we recently migrated elk version from 7.0.1 to 7.8.0. In kibana 7.0.1, the document count for kibana index increases when we create any new saved object. But with elk 7.8.0, we observed that the document count of k… --- ## [Composite Aggregation Sorting Based on Field Which is Not Key](https://discuss.elastic.co/t/composite-aggregation-sorting-based-on-field-which-is-not-key/248146)
**Author:** [@mstzn](https://discuss.elastic.co/u/mstzn)\ **Replies:** 3\ **Last updated:** [September 10, 2020, 1:07pm UTC](https://discuss.elastic.co/t/composite-aggregation-sorting-based-on-field-which-is-not-key/248146 "2020-09-10T13:07:17Z")
Hello Everyone, I have a composite aggregation which aggregate bucket based on a term field like number field. Composite aggregation orders buckets by natural order of key. I want to order buckets based on max date on … --- ## [Relative value calculation and visualization in Kibana](https://discuss.elastic.co/t/relative-value-calculation-and-visualization-in-kibana/246927)
**Author:** [@Hung\_The](https://discuss.elastic.co/u/Hung_The)\ **Replies:** 4\ **Last updated:** [September 10, 2020, 12:42pm UTC](https://discuss.elastic.co/t/relative-value-calculation-and-visualization-in-kibana/246927 "2020-09-10T12:42:33Z")
Hi All, I am new to Kibana and ES. I get some issues with how to display our data in relative fashion. I want to get the minimum of queried result and divided all other values in the queried result to that minimum so w… --- ## [Unable to configure filebeat to send to logstash or elasticsearch](https://discuss.elastic.co/t/unable-to-configure-filebeat-to-send-to-logstash-or-elasticsearch/248106)
**Author:** [@muru1](https://discuss.elastic.co/u/muru1)\ **Replies:** 0\ **Last updated:** [September 10, 2020, 5:05am UTC](https://discuss.elastic.co/t/unable-to-configure-filebeat-to-send-to-logstash-or-elasticsearch/248106 "2020-09-10T05:05:13Z")
I am trying to setup elk stack with filebeat and unable to send any logs to elasticsearch or logstash using filebeat . I am not sure if I am missing something simple - if I use gelf input (ie myapp is shipped to elastic… --- ## [Time entry in Index different from application](https://discuss.elastic.co/t/time-entry-in-index-different-from-application/248161)
**Author:** [@fastxl](https://discuss.elastic.co/u/fastxl)\ **Replies:** 0\ **Last updated:** [September 10, 2020, 11:49am UTC](https://discuss.elastic.co/t/time-entry-in-index-different-from-application/248161 "2020-09-10T11:49:55Z")
I am trying to learn Elasticsearch and I have made a Python script that will send data to an index. One of the things I am sending is the date/time. The format of the date/time in my output is 'date': '2020-09-10T06:45… --- ## [Manually appending log lines to log file, filebeat is not sending the appended logs](https://discuss.elastic.co/t/manually-appending-log-lines-to-log-file-filebeat-is-not-sending-the-appended-logs/248158)
**Author:** [@ranjini](https://discuss.elastic.co/u/ranjini)\ **Replies:** 0\ **Last updated:** [September 10, 2020, 11:39am UTC](https://discuss.elastic.co/t/manually-appending-log-lines-to-log-file-filebeat-is-not-sending-the-appended-logs/248158 "2020-09-10T11:39:39Z")
I manually appended the lines to a file using echo "2020-09-09T11:07:56,826 DEBUG test log file , send to logstash" \>\>test.log in powershell. restarted filebeat service. It's no luck. Tried to check the publish messa… --- ## [Not able to view the index in elastic search and kibana](https://discuss.elastic.co/t/not-able-to-view-the-index-in-elastic-search-and-kibana/248157)
**Author:** [@Jaya\_chandra](https://discuss.elastic.co/u/Jaya_chandra)\ **Replies:** 0\ **Last updated:** [September 10, 2020, 11:38am UTC](https://discuss.elastic.co/t/not-able-to-view-the-index-in-elastic-search-and-kibana/248157 "2020-09-10T11:38:18Z")
Hi, I am trying to import the s3 data from aws to logstash. However, when i look at elastic search/kibana i am not able to find the index. Below is my configuration details of logstash: input { s3 { "access\_key\_id" … --- ## [Elasticsearch stops after running for a week](https://discuss.elastic.co/t/elasticsearch-stops-after-running-for-a-week/248137)
**Author:** [@Mason](https://discuss.elastic.co/u/Mason)\ **Replies:** 3\ **Last updated:** [September 10, 2020, 9:22am UTC](https://discuss.elastic.co/t/elasticsearch-stops-after-running-for-a-week/248137 "2020-09-10T09:22:43Z")
I am using ELK stack (Elasticsearch and Kibana ) in a docker setup to monitor one of our application which is running in docker. This is a dedicated machine. I use filebeats to send logs to the ELK. Filebeats also run in… --- ## [Filebeat Module for Sonicwall gives Dissect parse error](https://discuss.elastic.co/t/filebeat-module-for-sonicwall-gives-dissect-parse-error/245602)
**Author:** [@imran](https://discuss.elastic.co/u/imran)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 11:33am UTC](https://discuss.elastic.co/t/filebeat-module-for-sonicwall-gives-dissect-parse-error/245602 "2020-09-10T11:33:39Z")
Dear support, I have deployed the latest version 7.9 filebeat to include sonicwall syslog logs, i have enabled the sonicwall module, however the events in discover keep throwing the dissect\_parsing\_error. Below are som… --- ## [Cisco Filebeat module loading 4286 fields](https://discuss.elastic.co/t/cisco-filebeat-module-loading-4286-fields/248032)
**Author:** [@ebaena](https://discuss.elastic.co/u/ebaena)\ **Replies:** 3\ **Last updated:** [September 10, 2020, 11:31am UTC](https://discuss.elastic.co/t/cisco-filebeat-module-loading-4286-fields/248032 "2020-09-10T11:31:49Z")
Hello community, I’m using the latest stable Elasticsearch and Filebeat version 7.9.1 and enabled the cisco module to analyse the logs. I know there is an open issue about the module not showing the message fields on th… --- ## [Manual manage agent binary version](https://discuss.elastic.co/t/manual-manage-agent-binary-version/248009)
**Author:** [@mladen](https://discuss.elastic.co/u/mladen)\ **Replies:** 3\ **Last updated:** [September 10, 2020, 11:04am UTC](https://discuss.elastic.co/t/manual-manage-agent-binary-version/248009 "2020-09-10T11:04:42Z")
Hi, in Ingest manager I can't select: Manually manage agent binary versions. Requires gold license. This is very strange because I have platinum licences :grinning:. So my question is someone have the same problem? … --- ## [Retain long data type value in SQL output](https://discuss.elastic.co/t/retain-long-data-type-value-in-sql-output/246997)
**Author:** [@askids](https://discuss.elastic.co/u/askids)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 11:01am UTC](https://discuss.elastic.co/t/retain-long-data-type-value-in-sql-output/246997 "2020-09-10T11:01:28Z")
hi, I am trying to get min value of an attribute using SQL api. My query looks like this SELECT MIN(attr1) as min\_val from index\_name However, in the output, the value is getting converted to scientific value and is l… --- ## [Pushing index templates fails on 7.9 with Java transport client](https://discuss.elastic.co/t/pushing-index-templates-fails-on-7-9-with-java-transport-client/248151)
**Author:** [@amugofjava](https://discuss.elastic.co/u/amugofjava)\ **Replies:** 0\ **Last updated:** [September 10, 2020, 11:01am UTC](https://discuss.elastic.co/t/pushing-index-templates-fails-on-7-9-with-java-transport-client/248151 "2020-09-10T11:01:20Z")
I am in the progress of migrating from 6.8 to 7.9. I have updated my index templates to work with the 7.9 format and if I submit the template via REST it installs fine; however, if I use the PutIndexTemplateRequest with … --- ## [Kibana 7.9 Decrypt .key problem](https://discuss.elastic.co/t/kibana-7-9-decrypt-key-problem/247888)
**Author:** [@AleksandrN](https://discuss.elastic.co/u/AleksandrN)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 10:59am UTC](https://discuss.elastic.co/t/kibana-7-9-decrypt-key-problem/247888 "2020-09-10T10:59:15Z")
I have configured Kibana to use HTTPS and TLS. TLS key is somehow not encrypted (can read it in a cleartext, just encoded), despite I used --password option. But HTTPS key is encrypted, and it seems like Kibana at the … --- ## [Unable to build custom beat](https://discuss.elastic.co/t/unable-to-build-custom-beat/244915)
**Author:** [@sdndude](https://discuss.elastic.co/u/sdndude)\ **Replies:** 4\ **Last updated:** [September 10, 2020, 10:49am UTC](https://discuss.elastic.co/t/unable-to-build-custom-beat/244915 "2020-09-10T10:49:05Z")
I am trying to follow the instructions building the countbeat example here on Ubuntu 18.04 but am not having much luck. After figuring out that the mage instructions are wrong, I was able to get past that by building it… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1813) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1815)