# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1825 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1826 --- ## [Metricbeat and Zookeeper security](https://discuss.elastic.co/t/metricbeat-and-zookeeper-security/247491)
**Author:** [@gquintana](https://discuss.elastic.co/u/gquintana)\ **Replies:** 0\ **Last updated:** [September 4, 2020, 7:20am UTC](https://discuss.elastic.co/t/metricbeat-and-zookeeper-security/247491 "2020-09-04T07:20:50Z")
Is it possible to use a secure connection between Metricbeat Zookeeper module and Zookeeper. I mean is it possible to enable SASL authentication on Zookeeper side https://docs.confluent.io/current/security/zk-security… --- ## [Elasticsearch failed to start](https://discuss.elastic.co/t/elasticsearch-failed-to-start/247409)
**Author:** [@Bigranawab](https://discuss.elastic.co/u/Bigranawab)\ **Replies:** 7\ **Last updated:** [September 4, 2020, 8:57am UTC](https://discuss.elastic.co/t/elasticsearch-failed-to-start/247409 "2020-09-04T08:57:47Z")
Hi, My elasticsearch instance was working just fine, I made some changes to elasticsearch.yml file for email setting and restarted service, but elasticsearch failed to start and I could not even connect to elasticsearch… --- ## [Ingesting Data via Python to Elastic](https://discuss.elastic.co/t/ingesting-data-via-python-to-elastic/247230)
**Author:** [@Rahul0711](https://discuss.elastic.co/u/Rahul0711)\ **Replies:** 5\ **Last updated:** [September 4, 2020, 8:52am UTC](https://discuss.elastic.co/t/ingesting-data-via-python-to-elastic/247230 "2020-09-04T08:52:14Z")
Hello Team I need help in ingesting the data via python into elastic. I have a cert that I have already uploaded the cert on the browser. After pre-processing is completed, I converted dataframe into dict. Now I want to… --- ## [The container data collected by metricbeat is inconsistent with the computer top command](https://discuss.elastic.co/t/the-container-data-collected-by-metricbeat-is-inconsistent-with-the-computer-top-command/247470)
**Author:** [@ZenSwordzhang](https://discuss.elastic.co/u/ZenSwordzhang)\ **Replies:** 1\ **Last updated:** [September 4, 2020, 8:48am UTC](https://discuss.elastic.co/t/the-container-data-collected-by-metricbeat-is-inconsistent-with-the-computer-top-command/247470 "2020-09-04T08:48:54Z")
This is the collected es container indicator data This is the computer data seen by the top command Why is this? --- ## [Approaches to run metricbeat](https://discuss.elastic.co/t/approaches-to-run-metricbeat/247435)
**Author:** [@nan140114](https://discuss.elastic.co/u/nan140114)\ **Replies:** 1\ **Last updated:** [September 4, 2020, 8:43am UTC](https://discuss.elastic.co/t/approaches-to-run-metricbeat/247435 "2020-09-04T08:43:17Z")
Hello. I'm trying to set up metricbeat to monitor metrics from cloudwatch. I mean, I wanna send some metrics (ec2, rds, s3 ) from cloudwatch to ELK. I take a look to functionbeat but it's just for CW logs. So, the right … --- ## [Where Elasticsearch stores kibana users?](https://discuss.elastic.co/t/where-elasticsearch-stores-kibana-users/247475)
**Author:** [@recordable542](https://discuss.elastic.co/u/recordable542)\ **Replies:** 3\ **Last updated:** [September 4, 2020, 8:41am UTC](https://discuss.elastic.co/t/where-elasticsearch-stores-kibana-users/247475 "2020-09-04T08:41:49Z")
I'm Investigating peculiar behavior which kibana lose connection after a few day after installation (It connects well to elasticsearch right after the installation) My Environment: ECK (kubernetes). What I did: I fi… --- ## [Update Kibana for all visualisations to handle fields with null values](https://discuss.elastic.co/t/update-kibana-for-all-visualisations-to-handle-fields-with-null-values/243995)
**Author:** [@rbergmann](https://discuss.elastic.co/u/rbergmann)\ **Replies:** 10\ **Last updated:** [September 4, 2020, 8:39am UTC](https://discuss.elastic.co/t/update-kibana-for-all-visualisations-to-handle-fields-with-null-values/243995 "2020-09-04T08:39:03Z")
I understand that from v7+ there is an issue with the handling of null values in fields. This would check it. doc\[\\].size()==0 https://www.elastic.co/guide/en/elasticsearch/reference/current/breaking-changes-7.0… --- ## [Logstash not logging & failing after start of elasticsearch](https://discuss.elastic.co/t/logstash-not-logging-failing-after-start-of-elasticsearch/247501)
**Author:** [@apurvakhatri](https://discuss.elastic.co/u/apurvakhatri)\ **Replies:** 0\ **Last updated:** [September 4, 2020, 8:23am UTC](https://discuss.elastic.co/t/logstash-not-logging-failing-after-start-of-elasticsearch/247501 "2020-09-04T08:23:54Z")
Here is the process: sudo service logstash start sudo service logstash status logstash.service - logstash Loaded: loaded (/etc/systemd/system/logstash.service; disabled; vendor preset … --- ## [Duplicate records in Kibana](https://discuss.elastic.co/t/duplicate-records-in-kibana/245896)
**Author:** [@apurvakhatri](https://discuss.elastic.co/u/apurvakhatri)\ **Replies:** 3\ **Last updated:** [September 4, 2020, 8:08am UTC](https://discuss.elastic.co/t/duplicate-records-in-kibana/245896 "2020-09-04T08:08:26Z")
I noticed that there are multiple records for the same log. They have the same clientip, time & host. Issue: Duplicate records. (There are multiple copies of same record) Requirement: There should only be one record … --- ## [Logstash and CSV - append to field while upsert](https://discuss.elastic.co/t/logstash-and-csv-append-to-field-while-upsert/247071)
**Author:** [@AnthonyA](https://discuss.elastic.co/u/AnthonyA)\ **Replies:** 3\ **Last updated:** [September 4, 2020, 7:47am UTC](https://discuss.elastic.co/t/logstash-and-csv-append-to-field-while-upsert/247071 "2020-09-04T07:47:10Z")
Hi there :grinning: I'm using logstash. My input is a CSV file. I'm using one of the columns as the document\_id. There are lines in the CSV file that have the same document\_id. In my output, I'm using upsert. When Logs… --- ## [Error Collecting in Instrumentation of Beat Pipeline](https://discuss.elastic.co/t/error-collecting-in-instrumentation-of-beat-pipeline/247489)
**Author:** [@Byungjin\_Park](https://discuss.elastic.co/u/Byungjin_Park)\ **Replies:** 0\ **Last updated:** [September 4, 2020, 7:02am UTC](https://discuss.elastic.co/t/error-collecting-in-instrumentation-of-beat-pipeline/247489 "2020-09-04T07:02:20Z")
There is a new feature which instruments the Beat Pipeline using APM Server. However, I just see no errors in Kibana APM Error page of Beats, although there are some error logs actually. Is there error collection featu… --- ## [Advanced Configuring- Filebeat Loadbalance](https://discuss.elastic.co/t/advanced-configuring-filebeat-loadbalance/247414)
**Author:** [@ofer.h](https://discuss.elastic.co/u/ofer.h)\ **Replies:** 2\ **Last updated:** [September 4, 2020, 6:07am UTC](https://discuss.elastic.co/t/advanced-configuring-filebeat-loadbalance/247414 "2020-09-04T06:07:50Z")
Hi, I'm trying to send events from Filebeat to Logstash instances on a couple of different servers. Is there an option to configure Filebeat Loadbalance logic? I'm trying to solve these 2 problems: Split traffic dif… --- ## [Unable to create index pattern in kibana 6.5](https://discuss.elastic.co/t/unable-to-create-index-pattern-in-kibana-6-5/246479)
**Author:** [@divya\_lakshmi](https://discuss.elastic.co/u/divya_lakshmi)\ **Replies:** 3\ **Last updated:** [September 4, 2020, 5:56am UTC](https://discuss.elastic.co/t/unable-to-create-index-pattern-in-kibana-6-5/246479 "2020-09-04T05:56:00Z")
Hi, I am using kibana 6.5 and recently changed to 3 node cluster. after that when i tried to create index pattern to build visulaization it neither throwing error nor getting created.But struck as creating index. r… --- ## [Not seeing all my hosts in Kibana Infrastructure UI](https://discuss.elastic.co/t/not-seeing-all-my-hosts-in-kibana-infrastructure-ui/247122)
**Author:** [@Delep](https://discuss.elastic.co/u/Delep)\ **Replies:** 0\ **Last updated:** [September 1, 2020, 3:39pm UTC](https://discuss.elastic.co/t/not-seeing-all-my-hosts-in-kibana-infrastructure-ui/247122 "2020-09-01T15:39:05Z")
Hi, I'm using the elk suite (all in 6.8.6). I've installed metricbeat on all my hosts (more than 250). Config is identical on all hosts: #========================== Modules configuration ============================ … --- ## [Disable login UI Page of kibana](https://discuss.elastic.co/t/disable-login-ui-page-of-kibana/247480)
**Author:** [@kkhadka](https://discuss.elastic.co/u/kkhadka)\ **Replies:** 1\ **Last updated:** [September 4, 2020, 5:39am UTC](https://discuss.elastic.co/t/disable-login-ui-page-of-kibana/247480 "2020-09-04T05:39:14Z")
Hi, I enabled the basic security of Xpack and found that the kibana UI comes up with a new login page for authentication. Is there any way to disable the UI page as we are having a login page for our web application and … --- ## [ElasticsearchError error=“400 - Rejected by Elasticsearch](https://discuss.elastic.co/t/elasticsearcherror-error-400-rejected-by-elasticsearch/247477)
**Author:** [@akhinair](https://discuss.elastic.co/u/akhinair)\ **Replies:** 1\ **Last updated:** [September 4, 2020, 5:37am UTC](https://discuss.elastic.co/t/elasticsearcherror-error-400-rejected-by-elasticsearch/247477 "2020-09-04T05:37:25Z")
I am using EFK stack in my GKE cluster and recently i observed below errors in my fluentd logs. This has started after adding new data point for geopoint in the fluentd. can somebody please help on this? 2020-09-03 16… --- ## [Dot replace is not working](https://discuss.elastic.co/t/dot-replace-is-not-working/247481)
**Author:** [@KrishK](https://discuss.elastic.co/u/KrishK)\ **Replies:** 0\ **Last updated:** [September 4, 2020, 5:15am UTC](https://discuss.elastic.co/t/dot-replace-is-not-working/247481 "2020-09-04T05:15:19Z")
Hi Support, I have below configuration for index. PUT dottest { "settings":{ "index" : { "number\_of\_shards" : 1, "number\_of\_replicas" : 0 }, "analysis": { "analyzer": { "splchar\_analyzer": { "tokenizer": "st… --- ## [Resolved - Logstash - CSV parse failure field thai language](https://discuss.elastic.co/t/resolved-logstash-csv-parse-failure-field-thai-language/247478)
**Author:** [@111207](https://discuss.elastic.co/u/111207)\ **Replies:** 0\ **Last updated:** [September 4, 2020, 4:25am UTC](https://discuss.elastic.co/t/resolved-logstash-csv-parse-failure-field-thai-language/247478 "2020-09-04T04:25:51Z")
This is my csv field example input 50001979,60004305,DHL Reseller Nakorn In,THLZ3EL29,01-08-20 8:37,01-08-20 19:07,ศรีสุดา เตียเจริญ,34/53 ม.4 แขวง/ลาดพร้าว,Lat Phrao,Bangkok,10230,897957585,นภวรรณ สวัสดิ์มงคลกุล,504/1 … --- ## [Security\_exception: action \[indices:admin/rollover\] is unauthorized for user](https://discuss.elastic.co/t/security-exception-action-indices-admin-rollover-is-unauthorized-for-user/245593)
**Author:** [@hendry.lim](https://discuss.elastic.co/u/hendry.lim)\ **Replies:** 4\ **Last updated:** [September 4, 2020, 2:58am UTC](https://discuss.elastic.co/t/security-exception-action-indices-admin-rollover-is-unauthorized-for-user/245593 "2020-09-04T02:58:16Z")
Elasticsearch: 7.9.0 Kibana: 7.9.0 I am hitting the issue described in #47500. I believe the same issue has been raised a few times. However, adding manage privilege on the index level for the role does not seem to wo… --- ## [Es forcemerge question](https://discuss.elastic.co/t/es-forcemerge-question/247467)
**Author:** [@taidengpub](https://discuss.elastic.co/u/taidengpub)\ **Replies:** 4\ **Last updated:** [September 4, 2020, 2:29am UTC](https://discuss.elastic.co/t/es-forcemerge-question/247467 "2020-09-04T02:29:52Z")
i use ilm to run forcemerge with max\_num\_segments=5 and this index have 5shard a one replication,so it have 10 shards total "warm": { "min\_age": "25h", "actions": { … --- ## [Why is the advanced setting \`state:storeInSessionStorage\` turned off by default?](https://discuss.elastic.co/t/why-is-the-advanced-setting-state-storeinsessionstorage-turned-off-by-default/247308)
**Author:** [@m-amano](https://discuss.elastic.co/u/m-amano)\ **Replies:** 3\ **Last updated:** [September 4, 2020, 1:39am UTC](https://discuss.elastic.co/t/why-is-the-advanced-setting-state-storeinsessionstorage-turned-off-by-default/247308 "2020-09-04T01:39:39Z")
I have a Vega which has too large URLs and will be access error by default setting. Therefore I want to change the advanced setting state:storeInSessionStorage turn on to able to load the Dashboard with Vega. However I… --- ## [Grok WinEvt log](https://discuss.elastic.co/t/grok-winevt-log/247466)
**Author:** [@Jose\_Campos](https://discuss.elastic.co/u/Jose_Campos)\ **Replies:** 0\ **Last updated:** [September 4, 2020, 1:33am UTC](https://discuss.elastic.co/t/grok-winevt-log/247466 "2020-09-04T01:33:10Z")
Hello I was trying to grok for this CSV line that I downloaded from my windows 10 logs, I see that it is separated by commas, but the last value comes lines like this, does anyone have any ideas? 8/26/2020,5:34:23 PM,S… --- ## [Disk space problem for ELK stack running in an azure VM](https://discuss.elastic.co/t/disk-space-problem-for-elk-stack-running-in-an-azure-vm/247330)
**Author:** [@Rowshan\_Sathi](https://discuss.elastic.co/u/Rowshan_Sathi)\ **Replies:** 1\ **Last updated:** [September 4, 2020, 12:50am UTC](https://discuss.elastic.co/t/disk-space-problem-for-elk-stack-running-in-an-azure-vm/247330 "2020-09-04T00:50:03Z")
Hi, I have installed ELK stack on Azure VM. The details of my system- Ubuntu 18.04 ELasticsearch- 7.8.1 I have configured curator script and runing it every morning and also I am clearing logs according to its size b… --- ## [ILM for each module fileset](https://discuss.elastic.co/t/ilm-for-each-module-fileset/245812)
**Author:** [@mweissha](https://discuss.elastic.co/u/mweissha)\ **Replies:** 2\ **Last updated:** [September 4, 2020, 12:34am UTC](https://discuss.elastic.co/t/ilm-for-each-module-fileset/245812 "2020-09-04T00:34:41Z")
Hey all, I'm currently in the process of porting from another logging system over to elasticsearch/kibana using filebeat as the shipper and ingest pipelines on the cloud to parse the data. What I want to accomplish is to… --- ## [\_cat/indices response explanation for replica shards](https://discuss.elastic.co/t/cat-indices-response-explanation-for-replica-shards/247447)
**Author:** [@sha1](https://discuss.elastic.co/u/sha1)\ **Replies:** 2\ **Last updated:** [September 4, 2020, 12:14am UTC](https://discuss.elastic.co/t/cat-indices-response-explanation-for-replica-shards/247447 "2020-09-04T00:14:00Z")
The \_cat/indices endpoint returns primary shard count and replica factor, e.g. health status index uuid pri rep docs.count docs.deleted store.size pri.store.size yellow open hioqq… --- ## [Index rollover not working for custom indices](https://discuss.elastic.co/t/index-rollover-not-working-for-custom-indices/245853)
**Author:** [@jijo.john](https://discuss.elastic.co/u/jijo.john)\ **Replies:** 1\ **Last updated:** [September 3, 2020, 11:51pm UTC](https://discuss.elastic.co/t/index-rollover-not-working-for-custom-indices/245853 "2020-09-03T23:51:57Z")
Hi Team, Kindly help us with the below error , we are having a custom index created and rollover is not working. Below is the error i am getting. illegal\_argument\_exception: index.lifecycle.rollover\_alias \[ciscobeat-7.… --- ## [Illegal\_argument\_exception: index.lifecycle.rollover\_alias does not point to index](https://discuss.elastic.co/t/illegal-argument-exception-index-lifecycle-rollover-alias-does-not-point-to-index/247089)
**Author:** [@sgreszcz](https://discuss.elastic.co/u/sgreszcz)\ **Replies:** 5\ **Last updated:** [September 3, 2020, 11:50pm UTC](https://discuss.elastic.co/t/illegal-argument-exception-index-lifecycle-rollover-alias-does-not-point-to-index/247089 "2020-09-03T23:50:17Z")
Hi there, I am getting ILM errors on all of my indexes. For example: illegal\_argument\_exception: index.lifecycle.rollover\_alias \[ucv-voice-events-cube\] does not point to index \[ucv-voice-events-cube-2020.08.28\] In my… --- ## [Entries Duplication](https://discuss.elastic.co/t/entries-duplication/247448)
**Author:** [@js7](https://discuss.elastic.co/u/js7)\ **Replies:** 3\ **Last updated:** [September 3, 2020, 11:18pm UTC](https://discuss.elastic.co/t/entries-duplication/247448 "2020-09-03T23:18:33Z")
Hi, when I have 2 pipelines active at the same time, the data from one is somehow duplicated/redirected to the other pipeline, when I'm not using pipeline-to-pipeline communication. The output host of both are the same… --- ## [EUIDataGrid fullscreen getting cut off in custom plugin](https://discuss.elastic.co/t/euidatagrid-fullscreen-getting-cut-off-in-custom-plugin/247401)
**Author:** [@npm\_install](https://discuss.elastic.co/u/npm_install)\ **Replies:** 1\ **Last updated:** [September 3, 2020, 10:50pm UTC](https://discuss.elastic.co/t/euidatagrid-fullscreen-getting-cut-off-in-custom-plugin/247401 "2020-09-03T22:50:59Z")
Hi, so I am creating a custom plugin for Kibana on the new plugin platform (developing on the 7.6.2 version of Kibana), and I am utilizing the EuiDataGrid component, which has a fullscreen button. However, when I press t… --- ## [Force\_merge Thread\_pool](https://discuss.elastic.co/t/force-merge-thread-pool/245108)
**Author:** [@Thek10patil](https://discuss.elastic.co/u/Thek10patil)\ **Replies:** 8\ **Last updated:** [September 3, 2020, 10:40pm UTC](https://discuss.elastic.co/t/force-merge-thread-pool/245108 "2020-09-03T22:40:46Z")
Hi Everyone, I need to run force\_merge frequently to have max\_num\_segments = 1. It takes lot of time. I want to make force\_merge faster. What are the possible option do I have? I read and found that max size of threads… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1824) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1826)