# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1839 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1840 --- ## [Logstash and PKCS#12 format](https://discuss.elastic.co/t/logstash-and-pkcs-12-format/246499)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 2\ **Last updated:** [August 27, 2020, 8:05pm UTC](https://discuss.elastic.co/t/logstash-and-pkcs-12-format/246499 "2020-08-27T20:05:51Z")
Hi, \*Running ELK 7.9 I am in the process of securing my ELK nodes and I have been struggling with the security settings for the last few days. After spending some time on this, I finally have Elasticsearch and Kibana c… --- ## [Some kubernetes metadata fields aren't populated in Filebeat 7.9.0](https://discuss.elastic.co/t/some-kubernetes-metadata-fields-arent-populated-in-filebeat-7-9-0/246680)
**Author:** [@delphi](https://discuss.elastic.co/u/delphi)\ **Replies:** 0\ **Last updated:** [August 27, 2020, 7:36pm UTC](https://discuss.elastic.co/t/some-kubernetes-metadata-fields-arent-populated-in-filebeat-7-9-0/246680 "2020-08-27T19:36:45Z")
In Filebeat 7.6.2 or higher (I'm using 7.9.0) the field kubernetes.deployment.name isn't populated, even using add\_kubernetes\_metadata + autodiscover. I'm getting only the higher level kubernetes.replicaset.name. There… --- ## [Rounding aggregate value](https://discuss.elastic.co/t/rounding-aggregate-value/246678)
**Author:** [@newKibanaUser](https://discuss.elastic.co/u/newKibanaUser)\ **Replies:** 0\ **Last updated:** [August 27, 2020, 6:56pm UTC](https://discuss.elastic.co/t/rounding-aggregate-value/246678 "2020-08-27T18:56:36Z")
I have this query and want "avg\_disk\_usage" to have two decimal values. I am on Elasticsearch version 7.8. Can someone give me a workable fix? Thanks ! GET .monitoring-es\*/\_search { "query": { "bool": { "mus… --- ## [Completion suggester not working as expected for field with array of strings](https://discuss.elastic.co/t/completion-suggester-not-working-as-expected-for-field-with-array-of-strings/246676)
**Author:** [@Srinivasan\_Ramaswamy](https://discuss.elastic.co/u/Srinivasan_Ramaswamy)\ **Replies:** 0\ **Last updated:** [August 27, 2020, 6:29pm UTC](https://discuss.elastic.co/t/completion-suggester-not-working-as-expected-for-field-with-array-of-strings/246676 "2020-08-27T18:29:29Z")
Here is the mapping and how i index the documents PUT http://localhost:9200/tag\_completion/ { "mappings": { "properties": { "title": { "type": "text" }, "tags": { "type": "complet… --- ## [Syslog input config for logstash](https://discuss.elastic.co/t/syslog-input-config-for-logstash/245714)
**Author:** [@Cihan\_Tunali](https://discuss.elastic.co/u/Cihan_Tunali)\ **Replies:** 7\ **Last updated:** [August 27, 2020, 6:19pm UTC](https://discuss.elastic.co/t/syslog-input-config-for-logstash/245714 "2020-08-27T18:19:38Z")
Hello all, Im using ES 7.9.0. My goal is to get syslogs from my firewall to logstash. I tried every config that i found on net. But could not solve it. I configured rsyslog to forward incoming syslogs to my logstash whi… --- ## [Translate filter is not working when the input is from filebeat module](https://discuss.elastic.co/t/translate-filter-is-not-working-when-the-input-is-from-filebeat-module/246671)
**Author:** [@Jeeth](https://discuss.elastic.co/u/Jeeth)\ **Replies:** 1\ **Last updated:** [August 27, 2020, 6:04pm UTC](https://discuss.elastic.co/t/translate-filter-is-not-working-when-the-input-is-from-filebeat-module/246671 "2020-08-27T18:04:09Z")
Hi all, We have two different logstash pipelines for two different location data. Paloalto --\> syslog --\> filebeat --\> Logstash --\> Elasticsearch (Parsing with filebeat panw module) Paloalto --\> syslog --\> Logstash --\>… --- ## [How to ungroup related items from a query](https://discuss.elastic.co/t/how-to-ungroup-related-items-from-a-query/246670)
**Author:** [@ClubberLang](https://discuss.elastic.co/u/ClubberLang)\ **Replies:** 0\ **Last updated:** [August 27, 2020, 5:34pm UTC](https://discuss.elastic.co/t/how-to-ungroup-related-items-from-a-query/246670 "2020-08-27T17:34:13Z")
Hi, I contact you because we are 3 guys trying to solve this problem, without result since weeks :frowning: Maybe you will have some ideas ? suggestions ? Anything :wink: Here is the situation, I have the following bu… --- ## [How to parse a TimeSpan value which displays the difference between to timestamps](https://discuss.elastic.co/t/how-to-parse-a-timespan-value-which-displays-the-difference-between-to-timestamps/246502)
**Author:** [@pheathers](https://discuss.elastic.co/u/pheathers)\ **Replies:** 7\ **Last updated:** [August 27, 2020, 5:29pm UTC](https://discuss.elastic.co/t/how-to-parse-a-timespan-value-which-displays-the-difference-between-to-timestamps/246502 "2020-08-27T17:29:45Z")
I'm trying to parse through a timespan value (hh:mm:ss:SSSSSS). Here is the message ... \`2020-08-05 13:28:53.128 +03:00 \[DBG\] {"Timestamp":"2020-08-05T13:28:53.1286882+03:00","Profile":"db","ProcessID":26688,"SessionId… --- ## [Custom metric calculation in Kibana](https://discuss.elastic.co/t/custom-metric-calculation-in-kibana/241905)
**Author:** [@paolinux](https://discuss.elastic.co/u/paolinux)\ **Replies:** 2\ **Last updated:** [August 27, 2020, 4:34pm UTC](https://discuss.elastic.co/t/custom-metric-calculation-in-kibana/241905 "2020-08-27T16:34:56Z")
Hi, SHORT VERSION: I need to create a visualization in Kibana that shows an index given as a ratio between a "sum" metric over a given period and a "filtered-count" metric over the same period. What is the best approach… --- ## [Unable to visualize span.http.response.status\_code](https://discuss.elastic.co/t/unable-to-visualize-span-http-response-status-code/246522)
**Author:** [@adamS](https://discuss.elastic.co/u/adamS)\ **Replies:** 1\ **Last updated:** [August 27, 2020, 4:34pm UTC](https://discuss.elastic.co/t/unable-to-visualize-span-http-response-status-code/246522 "2020-08-27T16:34:09Z")
I'm unable to use the span.http.response.status\_code field (or any of the span.http fields) on APM span documents when building a custom visualization. I can see the info I want in Discover, but it says that it is type … --- ## [Elastic not using all RAM](https://discuss.elastic.co/t/elastic-not-using-all-ram/246580)
**Author:** [@Turotakun98](https://discuss.elastic.co/u/Turotakun98)\ **Replies:** 2\ **Last updated:** [August 27, 2020, 4:28pm UTC](https://discuss.elastic.co/t/elastic-not-using-all-ram/246580 "2020-08-27T16:28:15Z")
I have a Ubuntu server with 4GB RAM. After starting kibana and logstash the server have 2.5GB of available RAM. When i try to start elasticsearch service with -Xms1g -Xmx1g it wont start and log the following error The… --- ## [Problem with Cloudwatch Input Login for ECS Namespace](https://discuss.elastic.co/t/problem-with-cloudwatch-input-login-for-ecs-namespace/246661)
**Author:** [@nareshbitla](https://discuss.elastic.co/u/nareshbitla)\ **Replies:** 0\ **Last updated:** [August 27, 2020, 4:27pm UTC](https://discuss.elastic.co/t/problem-with-cloudwatch-input-login-for-ecs-namespace/246661 "2020-08-27T16:27:29Z")
Hi, I am trying send AWS/ECS metrics from cloudwatch to kibana using logstash. Below is my config input { cloudwatch { "access\_key\_id" =\> "XXXXXXXXXXXX" "secret\_access\_key" =\> "XXXXXXXXX" #role\_arn =\> "XXXXXXXXXXX… --- ## [Widen date filter on embedded dashboard](https://discuss.elastic.co/t/widen-date-filter-on-embedded-dashboard/245390)
**Author:** [@buncieboy](https://discuss.elastic.co/u/buncieboy)\ **Replies:** 7\ **Last updated:** [August 27, 2020, 4:17pm UTC](https://discuss.elastic.co/t/widen-date-filter-on-embedded-dashboard/245390 "2020-08-27T16:17:32Z")
I have several visualizations as an embedded dashboard. When a user clicks on part of the dashboard it adds a filter to the bar at the top and they can remove it. However if they select a date range on the record frequen… --- ## [Logstash 7.x service fails to start on Ubuntu 18.04 LTS with OpenJDK 11 JDK as a service but starts otherwise](https://discuss.elastic.co/t/logstash-7-x-service-fails-to-start-on-ubuntu-18-04-lts-with-openjdk-11-jdk-as-a-service-but-starts-otherwise/246506)
**Author:** [@Henri.C.Lefevre](https://discuss.elastic.co/u/Henri.C.Lefevre)\ **Replies:** 4\ **Last updated:** [August 27, 2020, 3:58pm UTC](https://discuss.elastic.co/t/logstash-7-x-service-fails-to-start-on-ubuntu-18-04-lts-with-openjdk-11-jdk-as-a-service-but-starts-otherwise/246506 "2020-08-27T15:58:15Z")
I am trying to use logstash a SystemV service on Ubuntu 18.04 LTS. Whenever I try to use the service command, the service startup fails \> service logstash start && journalctl -u logstash logstash.service: Failed to ex… --- ## [Alerts based on a field](https://discuss.elastic.co/t/alerts-based-on-a-field/246548)
**Author:** [@bevano](https://discuss.elastic.co/u/bevano)\ **Replies:** 3\ **Last updated:** [August 27, 2020, 3:46pm UTC](https://discuss.elastic.co/t/alerts-based-on-a-field/246548 "2020-08-27T15:46:59Z")
Hi All, Is it possible to create either an alert or a watcher, that is based off the count of a specific field. I currently have application logs that ingest into elasticsearch. I then have a timelion graph that graphs… --- ## [Logstash Dynamic Template and ILM Creation](https://discuss.elastic.co/t/logstash-dynamic-template-and-ilm-creation/246653)
**Author:** [@Ramalakshmi](https://discuss.elastic.co/u/Ramalakshmi)\ **Replies:** 4\ **Last updated:** [August 27, 2020, 3:50pm UTC](https://discuss.elastic.co/t/logstash-dynamic-template-and-ilm-creation/246653 "2020-08-27T15:50:35Z")
Hi I am able to create the multiple index patterns dynamically using below configuration. output { stdout { codec =\> rubydebug } elasticsearch { hosts =\> \[ es\_host:9200" \] index =\> "lstas… --- ## [Thread leaks in logstash-output-s3 when wrong access keys are passed](https://discuss.elastic.co/t/thread-leaks-in-logstash-output-s3-when-wrong-access-keys-are-passed/246657)
**Author:** [@vinaykambam](https://discuss.elastic.co/u/vinaykambam)\ **Replies:** 0\ **Last updated:** [August 27, 2020, 3:39pm UTC](https://discuss.elastic.co/t/thread-leaks-in-logstash-output-s3-when-wrong-access-keys-are-passed/246657 "2020-08-27T15:39:40Z")
Hi There, I've observed thread leaks (S3, Stale factory sweeper) from logstash-output-s3 plugin when wrong access keys are passed in s3 output configuration. I tried same with different versions of logstash but it is th… --- ## [Send delete request only when inserted documents have been persisted](https://discuss.elastic.co/t/send-delete-request-only-when-inserted-documents-have-been-persisted/246456)
**Author:** [@makons](https://discuss.elastic.co/u/makons)\ **Replies:** 2\ **Last updated:** [August 27, 2020, 3:36pm UTC](https://discuss.elastic.co/t/send-delete-request-only-when-inserted-documents-have-been-persisted/246456 "2020-08-27T15:36:28Z")
I'm running upsert, and right after that delete by query, however, some of the documents upserted should be picked up by the following delete request. Is there a chance to send/execute the delete request only after the d… --- ## [New field base on the sum of other 3 fields not working](https://discuss.elastic.co/t/new-field-base-on-the-sum-of-other-3-fields-not-working/246612)
**Author:** [@nino](https://discuss.elastic.co/u/nino)\ **Replies:** 3\ **Last updated:** [August 27, 2020, 3:17pm UTC](https://discuss.elastic.co/t/new-field-base-on-the-sum-of-other-3-fields-not-working/246612 "2020-08-27T15:17:46Z")
Hello all, i need some help, i can't get this working. I need to create a new file base on the sum of other three fields. field1, field2, field3 are defined as float fields ruby { code =\> "event\['new\_field'\] =''" } mu… --- ## [Create a new field (customdate) like yyyy-mm(2020-08) format from eventstamp(1597739955692) type Epoch](https://discuss.elastic.co/t/create-a-new-field-customdate-like-yyyy-mm-2020-08-format-from-eventstamp-1597739955692-type-epoch/246516)
**Author:** [@wishnu2016](https://discuss.elastic.co/u/wishnu2016)\ **Replies:** 2\ **Last updated:** [August 27, 2020, 3:17pm UTC](https://discuss.elastic.co/t/create-a-new-field-customdate-like-yyyy-mm-2020-08-format-from-eventstamp-1597739955692-type-epoch/246516 "2020-08-27T15:17:23Z")
I want to create a new field with a year-month format (yyyy-mm, 2020-08) from the eventstamp field which I am receiving in Epoch format. I am new to logstash, I was able to add a new field but I don't know how to covert … --- ## [TLS 1.2 enable on elasticsearch output plugin](https://discuss.elastic.co/t/tls-1-2-enable-on-elasticsearch-output-plugin/246553)
**Author:** [@Wasantha\_Herath](https://discuss.elastic.co/u/Wasantha_Herath)\ **Replies:** 1\ **Last updated:** [August 27, 2020, 3:14pm UTC](https://discuss.elastic.co/t/tls-1-2-enable-on-elasticsearch-output-plugin/246553 "2020-08-27T15:14:56Z")
Hi Team, Currently we are using a ES cloud cluster and separate logstash (v6.3) instance which communicate with ES cloud cluster using HTTPS host name. Like below output { elasticsearch { hosts =\> \[ "https… --- ## [Auditbeat 'process.title' gone](https://discuss.elastic.co/t/auditbeat-process-title-gone/246652)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 0\ **Last updated:** [August 27, 2020, 3:14pm UTC](https://discuss.elastic.co/t/auditbeat-process-title-gone/246652 "2020-08-27T15:14:18Z")
Before deploying in production, I've made a demo deployment of elk and used auditbeat (7.8.0) to log actions on the system. In kibana, I was able to put it into a dashboard with using the process.title field. I've now d… --- ## [Troubles moving from Elasticsearch ingest pipeline to Logstash](https://discuss.elastic.co/t/troubles-moving-from-elasticsearch-ingest-pipeline-to-logstash/246490)
**Author:** [@Daniele\_Stefanucci](https://discuss.elastic.co/u/Daniele_Stefanucci)\ **Replies:** 3\ **Last updated:** [August 27, 2020, 3:14pm UTC](https://discuss.elastic.co/t/troubles-moving-from-elasticsearch-ingest-pipeline-to-logstash/246490 "2020-08-27T15:14:12Z")
Hi! I'm facing an issue while moving from elasticsearch ingest pipeline to logstash pipeline, I've correctly set up filebeat for IIS logs and configured the elasticsearch pipeline as per documentation (with logstash call… --- ## [ELMAH, xml and winlogbeat](https://discuss.elastic.co/t/elmah-xml-and-winlogbeat/246473)
**Author:** [@kawalec](https://discuss.elastic.co/u/kawalec)\ **Replies:** 3\ **Last updated:** [August 27, 2020, 3:02pm UTC](https://discuss.elastic.co/t/elmah-xml-and-winlogbeat/246473 "2020-08-27T15:02:24Z")
We are using ELMAH for logging and it writes an xml file for every error. Is there a way to use Winlogbeat to get these files into kibana? Thanks --- ## [Balancing disk usage on large clusters?](https://discuss.elastic.co/t/balancing-disk-usage-on-large-clusters/246477)
**Author:** [@akrzos](https://discuss.elastic.co/u/akrzos)\ **Replies:** 2\ **Last updated:** [August 27, 2020, 2:56pm UTC](https://discuss.elastic.co/t/balancing-disk-usage-on-large-clusters/246477 "2020-08-27T14:56:41Z")
We have a relatively large cluster and one consistent issue we have seen from time to time is inconsistent disk usage balancing because ElasticSearch is balancing by shard count rather than shard resource consumption. B… --- ## [Ruby + replace from array lines](https://discuss.elastic.co/t/ruby-replace-from-array-lines/246647)
**Author:** [@thaideval](https://discuss.elastic.co/u/thaideval)\ **Replies:** 0\ **Last updated:** [August 27, 2020, 2:53pm UTC](https://discuss.elastic.co/t/ruby-replace-from-array-lines/246647 "2020-08-27T14:53:00Z")
Hello there. First of all i am not even sure if its possible, but figured - should still ask. so.. i have two fields. String with text: {field1} = "Some text from blah X.KEY1 Some more text X.KEY2 and text here... " … --- ## [Could not index event to Elasticsearch..cluster currently has \[1000\]/\[1000\] maximum shards open](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-cluster-currently-has-1000-1000-maximum-shards-open/246620)
**Author:** [@ksaha](https://discuss.elastic.co/u/ksaha)\ **Replies:** 2\ **Last updated:** [August 27, 2020, 1:16pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-cluster-currently-has-1000-1000-maximum-shards-open/246620 "2020-08-27T13:16:21Z")
Hi, I have an Elasticsearch cluster with single node. Metricbeat and Filebeat are creating daily new index. The ELK Stack have been working properly from last few months. But from today I am getting the below error: \[2… --- ## [Elasticsearch 7.8 does not stat Java problem](https://discuss.elastic.co/t/elasticsearch-7-8-does-not-stat-java-problem/245902)
**Author:** [@aurimas](https://discuss.elastic.co/u/aurimas)\ **Replies:** 2\ **Last updated:** [August 27, 2020, 12:18pm UTC](https://discuss.elastic.co/t/elasticsearch-7-8-does-not-stat-java-problem/245902 "2020-08-27T12:18:49Z")
Hi, I am trying to fresh install and launch Elasticsearch 7.8 on RHEL 7.8 but I am getting into some kind of Java problems. I want it to run standalone. Tried various ways I found on internet to fix it. But none helpe… --- ## [Modifying a CSV file - Logstash](https://discuss.elastic.co/t/modifying-a-csv-file-logstash/246333)
**Author:** [@Aniket\_Valsangkar](https://discuss.elastic.co/u/Aniket_Valsangkar)\ **Replies:** 3\ **Last updated:** [August 27, 2020, 11:48am UTC](https://discuss.elastic.co/t/modifying-a-csv-file-logstash/246333 "2020-08-27T11:48:26Z")
Hi Team, I have a CSV file which gets updated (delete, add, change in the data in fields) regularly. The columns stay constant only the data changes. I want to write a code in logstash, which should be able to capture t… --- ## [Visualization filter DSL query](https://discuss.elastic.co/t/visualization-filter-dsl-query/246210)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 1\ **Last updated:** [August 27, 2020, 11:36am UTC](https://discuss.elastic.co/t/visualization-filter-dsl-query/246210 "2020-08-27T11:36:46Z")
Hi, in an index I have fields for interface and host, a host has many interfaces: HOST-01 : interface01, interface02 HOST-02 : interface01, interface02 and I want to filter a specific interface for a es… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1838) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1840)