# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1837 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1838 --- ## [Error running input: error receiving slowlog data: ERR unknown command \`SLOWLOG\`, with args beginning with: \`GET\`](https://discuss.elastic.co/t/error-running-input-error-receiving-slowlog-data-err-unknown-command-slowlog-with-args-beginning-with-get/246826)
**Author:** [@fzyzcjy](https://discuss.elastic.co/u/fzyzcjy)\ **Replies:** 1\ **Last updated:** [August 28, 2020, 11:52pm UTC](https://discuss.elastic.co/t/error-running-input-error-receiving-slowlog-data-err-unknown-command-slowlog-with-args-beginning-with-get/246826 "2020-08-28T23:52:05Z")
Hi I am using redis filebeat with the following config. However the error Error running input: error receiving slowlog data: ERR unknown command SLOWLOG, with args beginning with: GET occurs very frequently. Thanks for … --- ## [Condition to compare if two fields are equal](https://discuss.elastic.co/t/condition-to-compare-if-two-fields-are-equal/246825)
**Author:** [@mathiascg](https://discuss.elastic.co/u/mathiascg)\ **Replies:** 0\ **Last updated:** [August 28, 2020, 11:03pm UTC](https://discuss.elastic.co/t/condition-to-compare-if-two-fields-are-equal/246825 "2020-08-28T23:03:19Z")
In the processor pipeline, is it possible to compare two exported fields to check for equality? A condition like: fields\_equal: - field\_1 - field\_2 Which would return true/false. From what I understand from the doc… --- ## [Packetbeat duplicated HTTP events in Kubernetes Cluster](https://discuss.elastic.co/t/packetbeat-duplicated-http-events-in-kubernetes-cluster/246374)
**Author:** [@mathiascg](https://discuss.elastic.co/u/mathiascg)\ **Replies:** 4\ **Last updated:** [August 28, 2020, 10:53pm UTC](https://discuss.elastic.co/t/packetbeat-duplicated-http-events-in-kubernetes-cluster/246374 "2020-08-28T22:53:28Z")
Hi, we are experiencing a similar issue as in this post. Configuration: packetbeat.ignore\_outgoing: true setup.dashboards.enabled: true setup.template.enabled: true setup.template.name: "packetbeat" setup.template.p… --- ## [Performance weird stuff](https://discuss.elastic.co/t/performance-weird-stuff/246117)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 12\ **Last updated:** [August 28, 2020, 9:57pm UTC](https://discuss.elastic.co/t/performance-weird-stuff/246117 "2020-08-28T21:57:51Z")
Hello, I have this cluster with 6 ES nodes, 3 logstashes and numbers of servers shippings logs with filebeat. Versions are 6.8.1 for filebeat, 6.6.1for logstash and 6.7.1for ES . Clusterstate is green. The load on … --- ## [Winlogbeat secure connection](https://discuss.elastic.co/t/winlogbeat-secure-connection/246803)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 2\ **Last updated:** [August 28, 2020, 9:06pm UTC](https://discuss.elastic.co/t/winlogbeat-secure-connection/246803 "2020-08-28T21:06:03Z")
Hi, \*I am using ELK 7.9 I am trying use Winlogbeat to ship data to an Elasticsearch node, which has secure connection settings enabled: xpack.security.enabled: true xpack.security.transport.ssl.enabled: true xpack.sec… --- ## [Improve grok pattern](https://discuss.elastic.co/t/improve-grok-pattern/246770)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 5\ **Last updated:** [August 28, 2020, 8:47pm UTC](https://discuss.elastic.co/t/improve-grok-pattern/246770 "2020-08-28T20:47:20Z")
This is some sample data I have: Aug 27 20:21:46 SERVER-150 john: USER=john PWD=/root PID=\[9103\] CMD="cat /etc/passwd" Exit=\[0\] CONNECTION=1.2.3.4 Aug 21 13:21:46 SERVER-230 root: USER=root PWD=/etc/folder PID=\[9023\] CM… --- ## [No raw logs from logstash](https://discuss.elastic.co/t/no-raw-logs-from-logstash/246775)
**Author:** [@jhayvee](https://discuss.elastic.co/u/jhayvee)\ **Replies:** 1\ **Last updated:** [August 28, 2020, 8:31pm UTC](https://discuss.elastic.co/t/no-raw-logs-from-logstash/246775 "2020-08-28T20:31:58Z")
I'm trying to do the import logs using IIS logs here's my config below. input{ file{ path =\>"C:/Users/Administrator/Documents/New folder/u\_ex200419.log" type =\>"iis" start\_position =\> "beginning" } } output{ ela… --- ## [Need a GeoIP Example](https://discuss.elastic.co/t/need-a-geoip-example/246746)
**Author:** [@Amantha](https://discuss.elastic.co/u/Amantha)\ **Replies:** 2\ **Last updated:** [August 28, 2020, 8:30pm UTC](https://discuss.elastic.co/t/need-a-geoip-example/246746 "2020-08-28T20:30:41Z")
Can someone provide a geoip example for logstash with a log file? --- ## [Add visualize with some missing field](https://discuss.elastic.co/t/add-visualize-with-some-missing-field/246780)
**Author:** [@elk2](https://discuss.elastic.co/u/elk2)\ **Replies:** 1\ **Last updated:** [August 28, 2020, 7:59pm UTC](https://discuss.elastic.co/t/add-visualize-with-some-missing-field/246780 "2020-08-28T19:59:56Z")
I have different system logs with missing field that depending of user action. Example: login {@timestamp, user:A, src:10.10.10.10, action:login, dst:20.20.20.20} logout {@timestamp, user:A, action:logout, dst:20.20… --- ## [Resta con Ruby en logstash](https://discuss.elastic.co/t/resta-con-ruby-en-logstash/246815)
**Author:** [@mildreey11](https://discuss.elastic.co/u/mildreey11)\ **Replies:** 0\ **Last updated:** [August 28, 2020, 7:30pm UTC](https://discuss.elastic.co/t/resta-con-ruby-en-logstash/246815 "2020-08-28T19:30:08Z")
Buenas Tardes, Estoy realizando una resta de dos fechas con horas(fechainicio y fecha final) en ruby de esta manera en el logstash pero no me muestra el resultado nada muestra .¿alguien sabe que esta mal o que falta agr… --- ## [Assume role in s3snssqs logstash plugin](https://discuss.elastic.co/t/assume-role-in-s3snssqs-logstash-plugin/246795)
**Author:** [@Jayakumar\_R\_R](https://discuss.elastic.co/u/Jayakumar_R_R)\ **Replies:** 0\ **Last updated:** [August 28, 2020, 4:55pm UTC](https://discuss.elastic.co/t/assume-role-in-s3snssqs-logstash-plugin/246795 "2020-08-28T16:55:01Z")
Can we use assume role in s3sqssns plugin? s3snssqs{ queue =\> "name" queue\_owner\_aws\_account\_id =\> "1111111" access\_key\_id =\> "accesskey of trusted account" secret\_key\_id =\> "secretkey of trusted accou… --- ## [TopHits not working with a filter Kibana](https://discuss.elastic.co/t/tophits-not-working-with-a-filter-kibana/246810)
**Author:** [@zizou\_elk](https://discuss.elastic.co/u/zizou_elk)\ **Replies:** 1\ **Last updated:** [August 28, 2020, 6:44pm UTC](https://discuss.elastic.co/t/tophits-not-working-with-a-filter-kibana/246810 "2020-08-28T18:44:21Z")
Hello , I'm using TopHits to show latest values,It works well but when I Change a filter , I get different result : (see image) Thanks --- ## [7.8 doesn't parse apache access logs](https://discuss.elastic.co/t/7-8-doesnt-parse-apache-access-logs/242342)
**Author:** [@prophoto](https://discuss.elastic.co/u/prophoto)\ **Replies:** 15\ **Last updated:** [August 28, 2020, 6:07pm UTC](https://discuss.elastic.co/t/7-8-doesnt-parse-apache-access-logs/242342 "2020-08-28T18:07:39Z")
I had an old 6.x stack setup a while ago but had to shut it down. I'm back to try another round and hopefully its permanent this time. I need to have my Apache 2.4 logs parsed so I can create custom dashboards. All serv… --- ## [Logs parsing error post upgrading filebeat from 5.x to 7.x](https://discuss.elastic.co/t/logs-parsing-error-post-upgrading-filebeat-from-5-x-to-7-x/246808)
**Author:** [@latif.siddiqui](https://discuss.elastic.co/u/latif.siddiqui)\ **Replies:** 0\ **Last updated:** [August 28, 2020, 6:02pm UTC](https://discuss.elastic.co/t/logs-parsing-error-post-upgrading-filebeat-from-5-x-to-7-x/246808 "2020-08-28T18:02:10Z")
We recently updated the filebeat to 7.9.0 for ECS Clusters but after updating it stopped parsing the logs and sending file path in the log field. sample log: log": { "file": { "path": "/var/lib/docker/con… --- ## [I want to get the exact distinct count and the docs in query](https://discuss.elastic.co/t/i-want-to-get-the-exact-distinct-count-and-the-docs-in-query/246330)
**Author:** [@nandalapadu\_shamriya](https://discuss.elastic.co/u/nandalapadu_shamriya)\ **Replies:** 7\ **Last updated:** [August 28, 2020, 5:49pm UTC](https://discuss.elastic.co/t/i-want-to-get-the-exact-distinct-count-and-the-docs-in-query/246330 "2020-08-28T17:49:16Z")
I am new to ES,i have a requirement where i need to get the distinct values and distinct exact count of records till 60000 from elastic search query but my query is always returning the approximate counts only.Can some o… --- ## [Script sorting retun type exception](https://discuss.elastic.co/t/script-sorting-retun-type-exception/246660)
**Author:** [@Muhammad\_Zeeshan](https://discuss.elastic.co/u/Muhammad_Zeeshan)\ **Replies:** 3\ **Last updated:** [August 28, 2020, 5:00pm UTC](https://discuss.elastic.co/t/script-sorting-retun-type-exception/246660 "2020-08-28T17:00:25Z")
I'm trying to sort query results based on script. As nested \_script has type number, for missing value return null throwing exception and return 0 or -1 are useless. Here is error message "Cannot cast null to a primitiv… --- ## [Linechart labelling is not proper](https://discuss.elastic.co/t/linechart-labelling-is-not-proper/246725)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 3\ **Last updated:** [August 28, 2020, 4:27pm UTC](https://discuss.elastic.co/t/linechart-labelling-is-not-proper/246725 "2020-08-28T16:27:36Z")
Hi All, I am trying to build a monthly trend using line chart, data, line everything is proper, only problem is the labels for month, is showing multiple time. FYI.. Why am i getting the month as 4 times instead of … --- ## [Monthly indexes](https://discuss.elastic.co/t/monthly-indexes/246585)
**Author:** [@goncalobsantos](https://discuss.elastic.co/u/goncalobsantos)\ **Replies:** 3\ **Last updated:** [August 28, 2020, 4:18pm UTC](https://discuss.elastic.co/t/monthly-indexes/246585 "2020-08-28T16:18:50Z")
I am using Logstash to create monthly indexes using the following format in the .conf file: output{ elasticsearch{ index =\> "index\_name-%{+YYYY.MM}" ... } } This format places most events in the correct month. Yet… --- ## [New index patterns are not created](https://discuss.elastic.co/t/new-index-patterns-are-not-created/246645)
**Author:** [@fuggi](https://discuss.elastic.co/u/fuggi)\ **Replies:** 2\ **Last updated:** [August 28, 2020, 3:52pm UTC](https://discuss.elastic.co/t/new-index-patterns-are-not-created/246645 "2020-08-28T15:52:51Z")
Hi, here is the history of issues I've had with ELK the last days: ELK stopped running out of the blue a few days ago showing errors like org.elasticsearch.action.NoShardAvailableActionException: No shard available … --- ## [Kibana logger quiestion](https://discuss.elastic.co/t/kibana-logger-quiestion/246259)
**Author:** [@masterThomas](https://discuss.elastic.co/u/masterThomas)\ **Replies:** 2\ **Last updated:** [August 28, 2020, 3:52pm UTC](https://discuss.elastic.co/t/kibana-logger-quiestion/246259 "2020-08-28T15:52:48Z")
Hi team, writing custom plugin and want to use kibana logging feature from this to log my plugin events with native kibana instrument. So can anybody please provide some working logger snippet of code for Kibana 6.7 ? --- ## [When relocating/initializing 3 or more shards, ES is overloaded, REST API is very slow, Kibana and es-exporter cannot reach ES](https://discuss.elastic.co/t/when-relocating-initializing-3-or-more-shards-es-is-overloaded-rest-api-is-very-slow-kibana-and-es-exporter-cannot-reach-es/246323)
**Author:** [@danksim](https://discuss.elastic.co/u/danksim)\ **Replies:** 5\ **Last updated:** [August 28, 2020, 3:52pm UTC](https://discuss.elastic.co/t/when-relocating-initializing-3-or-more-shards-es-is-overloaded-rest-api-is-very-slow-kibana-and-es-exporter-cannot-reach-es/246323 "2020-08-28T15:52:36Z")
Hello, I am running a TLS-enabled Elastic Stack 7.6.2 (currently running on EKS with kubernetes nodes on AWS m5.4xlarge machines 16CPUs 64GB - these are NOT SSD s) and whenever Elasticsearch relocates/initia… --- ## [Issue with a WMS layer](https://discuss.elastic.co/t/issue-with-a-wms-layer/246306)
**Author:** [@m4rk](https://discuss.elastic.co/u/m4rk)\ **Replies:** 6\ **Last updated:** [August 28, 2020, 3:41pm UTC](https://discuss.elastic.co/t/issue-with-a-wms-layer/246306 "2020-08-28T15:41:41Z")
I have a problem which seems to be caused by a WMS layer. I have created a map in Kibana. The first layer contains some geo markers (created from a geoJSON file). I have set this layer to "visible". The second layer l… --- ## [Error failed to mark Task endpoint](https://discuss.elastic.co/t/error-failed-to-mark-task-endpoint/246452)
**Author:** [@twright8](https://discuss.elastic.co/u/twright8)\ **Replies:** 3\ **Last updated:** [August 28, 2020, 3:12pm UTC](https://discuss.elastic.co/t/error-failed-to-mark-task-endpoint/246452 "2020-08-28T15:12:51Z")
Hey, every few seconds Kibana spits out this message: {"type":"log","@timestamp":"2020-08-26T12:57:31Z","tags":\["error","plugins","taskManager","taskManager"\],"pid":6,"message":"Failed to mark Task endpoint:user-artifact… --- ## [Kibana read-only role (7.9.0)](https://discuss.elastic.co/t/kibana-read-only-role-7-9-0/246613)
**Author:** [@niklaskurvinen](https://discuss.elastic.co/u/niklaskurvinen)\ **Replies:** 2\ **Last updated:** [August 28, 2020, 2:46pm UTC](https://discuss.elastic.co/t/kibana-read-only-role-7-9-0/246613 "2020-08-28T14:46:46Z")
I'm trying to achieve a generic read-only role in kibana (7.9.0), and since the kibana\_user role is deprecated (and not really replaced with a new one) one would assume that it should be pretty simple. However I'm bumpi… --- ## [How to pass parameters to a datavisualisation through a dashboard URL](https://discuss.elastic.co/t/how-to-pass-parameters-to-a-datavisualisation-through-a-dashboard-url/246767)
**Author:** [@Ted1](https://discuss.elastic.co/u/Ted1)\ **Replies:** 2\ **Last updated:** [August 28, 2020, 2:42pm UTC](https://discuss.elastic.co/t/how-to-pass-parameters-to-a-datavisualisation-through-a-dashboard-url/246767 "2020-08-28T14:42:48Z")
Hi folks, I'm quite new to Kibana and can't find a solution to my problem. I got a visualisation (based on the "enhanced table" plugin) and I'm able to pass parameters through its URL (rf {{col0}} and {{col1}} in the c… --- ## [Kibana portal is loading and it shows the error as "Kibana server is not ready yet"](https://discuss.elastic.co/t/kibana-portal-is-loading-and-it-shows-the-error-as-kibana-server-is-not-ready-yet/246749)
**Author:** [@Arunap12](https://discuss.elastic.co/u/Arunap12)\ **Replies:** 1\ **Last updated:** [August 28, 2020, 2:37pm UTC](https://discuss.elastic.co/t/kibana-portal-is-loading-and-it-shows-the-error-as-kibana-server-is-not-ready-yet/246749 "2020-08-28T14:37:29Z")
Kibana is installed and configured on VMware player on a single node - but the site is loading. How to fix the issue ? --- ## [Kibana and Kibana Plugins Architecture Overview Graphics](https://discuss.elastic.co/t/kibana-and-kibana-plugins-architecture-overview-graphics/246752)
**Author:** [@burakka](https://discuss.elastic.co/u/burakka)\ **Replies:** 1\ **Last updated:** [August 28, 2020, 2:36pm UTC](https://discuss.elastic.co/t/kibana-and-kibana-plugins-architecture-overview-graphics/246752 "2020-08-28T14:36:39Z")
Hello all👋 I am working as part of my thesis on a Architecture overview of Kibana with its main components in general and the architecture view for custom plugins in particular. Are there any architecture graphics for … --- ## [Kibana server is not ready yet while loading kibana on web](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-while-loading-kibana-on-web/246754)
**Author:** [@Arunap12](https://discuss.elastic.co/u/Arunap12)\ **Replies:** 1\ **Last updated:** [August 28, 2020, 2:25pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-while-loading-kibana-on-web/246754 "2020-08-28T14:25:40Z")
Config \[root@centos ab7732e8a55e47edb13dc713bf18f24e\]# cat /etc/elasticsearch/elasticsearch.yml | grep -v "#" node.name: 192.168.18.200 path.data: /var/lib/elasticsearch path.logs: /var/log/elasticsearch network.hos… --- ## [Multisearch in order to use the first query result as parameters to the second query](https://discuss.elastic.co/t/multisearch-in-order-to-use-the-first-query-result-as-parameters-to-the-second-query/246751)
**Author:** [@ricardomaximino](https://discuss.elastic.co/u/ricardomaximino)\ **Replies:** 2\ **Last updated:** [August 28, 2020, 1:58pm UTC](https://discuss.elastic.co/t/multisearch-in-order-to-use-the-first-query-result-as-parameters-to-the-second-query/246751 "2020-08-28T13:58:37Z")
If I have an index PEOPLE with personid, name, birthday, relation where the relation is a list that contains the personid of the linked person. How can I use a \_msearch to search for a person and get only the documents … --- ## [Stat metricbeat.yml: no such file or directory](https://discuss.elastic.co/t/stat-metricbeat-yml-no-such-file-or-directory/246303)
**Author:** [@teej](https://discuss.elastic.co/u/teej)\ **Replies:** 4\ **Last updated:** [August 28, 2020, 1:39pm UTC](https://discuss.elastic.co/t/stat-metricbeat-yml-no-such-file-or-directory/246303 "2020-08-28T13:39:16Z")
Hi, I am new with the Beats. I did a yum install of metricbeat and followed the instructions on Elastic site for setting up a keystore but oddly when I try to do: /usr/share/metricbeat/bin/metricbeat keystore create I… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1836) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1838)