# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1861 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1862 --- ## [Consumer threads for topics\_pattern](https://discuss.elastic.co/t/consumer-threads-for-topics-pattern/245303)
**Author:** [@tarunwadhwa13](https://discuss.elastic.co/u/tarunwadhwa13)\ **Replies:** 3\ **Last updated:** [August 17, 2020, 7:43pm UTC](https://discuss.elastic.co/t/consumer-threads-for-topics-pattern/245303 "2020-08-17T19:43:52Z")
The doc mentioned that consumer thread should be equal to number of partition or divided by number of logstash instances if more than 1 is running. Just wanted to understand how do i calculate the value of consumer thre… --- ## [Hitting Security API Endpoint](https://discuss.elastic.co/t/hitting-security-api-endpoint/241952)
**Author:** [@KSib](https://discuss.elastic.co/u/KSib)\ **Replies:** 7\ **Last updated:** [August 17, 2020, 7:36pm UTC](https://discuss.elastic.co/t/hitting-security-api-endpoint/241952 "2020-08-17T19:36:48Z")
A little preface: I'm trying to set up the following: Kibana: Shared dashboard with index pattern of Index-\* Site A : Embedded iframe Kibana Dashboard (with only access to Index-A) Site B : Embedded iframe Kibana Dash… --- ## [Is there a way to switch between dashboard views with one click?](https://discuss.elastic.co/t/is-there-a-way-to-switch-between-dashboard-views-with-one-click/245288)
**Author:** [@markroland](https://discuss.elastic.co/u/markroland)\ **Replies:** 5\ **Last updated:** [August 17, 2020, 7:02pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-switch-between-dashboard-views-with-one-click/245288 "2020-08-17T19:02:52Z")
I think it would be nice if there was a single-step way to switch between Dashboard views in Kibana. Currently in 7.9.1 you have to navigate out of a dashboard back to /app/kibana#/dashboards and then select a new dashbo… --- ## [Continuous transform failure](https://discuss.elastic.co/t/continuous-transform-failure/245302)
**Author:** [@Vlad\_K](https://discuss.elastic.co/u/Vlad_K)\ **Replies:** 0\ **Last updated:** [August 17, 2020, 6:14pm UTC](https://discuss.elastic.co/t/continuous-transform-failure/245302 "2020-08-17T18:14:05Z")
I have 4GB JVM heap and continuous transform with filtered search throws this errors in logs and stops with "failed" state after some period. Insufficient memory for search, reducing number of buckets per search from \[4… --- ## [Is there a way to show RAG status without Canvas?](https://discuss.elastic.co/t/is-there-a-way-to-show-rag-status-without-canvas/243827)
**Author:** [@Bhavya\_Bansal](https://discuss.elastic.co/u/Bhavya_Bansal)\ **Replies:** 3\ **Last updated:** [August 17, 2020, 5:51pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-show-rag-status-without-canvas/243827 "2020-08-17T17:51:36Z")
Hi, I need to create a RAG (red, amber green) indicator that is based on the results of a query. If all the metrics are green (using color rules in tsvb), another panel should be green. Can I achieve something like this… --- ## [Solved: Dell EMC REST API calls with Logstash plugin http\_poller](https://discuss.elastic.co/t/solved-dell-emc-rest-api-calls-with-logstash-plugin-http-poller/245283)
**Author:** [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\ **Replies:** 0\ **Last updated:** [August 17, 2020, 4:38pm UTC](https://discuss.elastic.co/t/solved-dell-emc-rest-api-calls-with-logstash-plugin-http-poller/245283 "2020-08-17T16:38:56Z")
If anyone is looking to pull performance metrics from the Dell EMC Unity Unisphere servers that they're running I hope that this saves you some time. Useful References: Dell Unisphere® Management REST API Progra… --- ## [Stuck running docker logstash with pipelines.yml (binding)](https://discuss.elastic.co/t/stuck-running-docker-logstash-with-pipelines-yml-binding/245225)
**Author:** [@nino](https://discuss.elastic.co/u/nino)\ **Replies:** 2\ **Last updated:** [August 17, 2020, 5:03pm UTC](https://discuss.elastic.co/t/stuck-running-docker-logstash-with-pipelines-yml-binding/245225 "2020-08-17T17:03:10Z")
Dear all, i can't get logstash working multipipeline mode inside a docker container. pipelines.yml (inside container) /usr/share/logstash/config bash-4.2$ stat pipelines.yml File: ‘pipelines.yml’ Access: (0644/-rw-… --- ## [How hides the password in json file for jmx input plugin logstash](https://discuss.elastic.co/t/how-hides-the-password-in-json-file-for-jmx-input-plugin-logstash/245166)
**Author:** [@ed2050](https://discuss.elastic.co/u/ed2050)\ **Replies:** 7\ **Last updated:** [August 17, 2020, 4:50pm UTC](https://discuss.elastic.co/t/how-hides-the-password-in-json-file-for-jmx-input-plugin-logstash/245166 "2020-08-17T16:50:56Z")
Hello I am using jmx input plugin logstash to read JVM metrics, everything works fine for me, the JVM I access requires authentication by user and password and in the development environment I have this data burned in t… --- ## [Linux audit trail file to ECS output](https://discuss.elastic.co/t/linux-audit-trail-file-to-ecs-output/245285)
**Author:** [@ToddH](https://discuss.elastic.co/u/ToddH)\ **Replies:** 0\ **Last updated:** [August 17, 2020, 4:42pm UTC](https://discuss.elastic.co/t/linux-audit-trail-file-to-ecs-output/245285 "2020-08-17T16:42:49Z")
I've successfully configured Auditbeat to collect logs on a Linux system (CentOS 7.7). However, I also have some systems that (for policy reasons) cannot have Auditbeat installed on them. Periodically the audit trail fi… --- ## [Monitoring the health of the Cassandra NO SQL database](https://discuss.elastic.co/t/monitoring-the-health-of-the-cassandra-no-sql-database/245284)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 0\ **Last updated:** [August 17, 2020, 4:42pm UTC](https://discuss.elastic.co/t/monitoring-the-health-of-the-cassandra-no-sql-database/245284 "2020-08-17T16:42:28Z")
Is it possible to monitor the health of the Cassandra server using Elastic Stack? --- ## [Tips and Best Practices for working / debugging Logstash pipelines on Kubernetes](https://discuss.elastic.co/t/tips-and-best-practices-for-working-debugging-logstash-pipelines-on-kubernetes/245280)
**Author:** [@Xavier\_Krantz](https://discuss.elastic.co/u/Xavier_Krantz)\ **Replies:** 0\ **Last updated:** [August 17, 2020, 4:31pm UTC](https://discuss.elastic.co/t/tips-and-best-practices-for-working-debugging-logstash-pipelines-on-kubernetes/245280 "2020-08-17T16:31:28Z")
Hi everyone :wave: I have setup a BLEK (Beats, Logstash, ElasticSearch, Kibana) stack on Kubernetes :stuck\_out\_tongue: I would like to parse and enrich some logs output from my services collected through Filebeat. Hav… --- ## [Elasticsearch search query size limit](https://discuss.elastic.co/t/elasticsearch-search-query-size-limit/245278)
**Author:** [@sahere37](https://discuss.elastic.co/u/sahere37)\ **Replies:** 0\ **Last updated:** [August 17, 2020, 4:25pm UTC](https://discuss.elastic.co/t/elasticsearch-search-query-size-limit/245278 "2020-08-17T16:25:02Z")
Hi all, I am using elasticsearch input in my logstash config file. logstash input part is as following: input { elasticsearch { hosts =\> \["http://10.0.0.1:9200/"\] index =\> "my-log\*" query =\> '{ "from" : 0, "size" : … --- ## [Help debugging ingestion flow Filebeat + Logstas](https://discuss.elastic.co/t/help-debugging-ingestion-flow-filebeat-logstas/245277)
**Author:** [@Xavier\_Krantz](https://discuss.elastic.co/u/Xavier_Krantz)\ **Replies:** 0\ **Last updated:** [August 17, 2020, 4:23pm UTC](https://discuss.elastic.co/t/help-debugging-ingestion-flow-filebeat-logstas/245277 "2020-08-17T16:23:27Z")
Hi everybody, I have setup an BLEK (Beats, Logstash, ElasticSearch, Kibana) stack :stuck\_out\_tongue: ES and Kibana are running in ES Cloud a "cluster" of Logstash instances are running on a Kubernetes cluster A servic… --- ## [Watcher : How to read values for "To :" field in Watcher feature from Database](https://discuss.elastic.co/t/watcher-how-to-read-values-for-to-field-in-watcher-feature-from-database/244908)
**Author:** [@RaTheDev](https://discuss.elastic.co/u/RaTheDev)\ **Replies:** 2\ **Last updated:** [August 17, 2020, 4:14pm UTC](https://discuss.elastic.co/t/watcher-how-to-read-values-for-to-field-in-watcher-feature-from-database/244908 "2020-08-17T16:14:20Z")
We have configured Watchers and send emails using Email feature to different distribution lists. And here comes the issue with distribution lists, since the distro's needs to be controlled by one or team we are not sure… --- ## [Best way to handle Customer Specific Visibility](https://discuss.elastic.co/t/best-way-to-handle-customer-specific-visibility/245271)
**Author:** [@mrkresc](https://discuss.elastic.co/u/mrkresc)\ **Replies:** 2\ **Last updated:** [August 17, 2020, 4:04pm UTC](https://discuss.elastic.co/t/best-way-to-handle-customer-specific-visibility/245271 "2020-08-17T16:04:53Z")
Hey guys, This question may have been asked before, but when searching, I was not able to find an answer. I am new to the forums and elasticsearch so please bear with me. I am currently working with the search applica… --- ## [Logstash Config error](https://discuss.elastic.co/t/logstash-config-error/245274)
**Author:** [@Nur\_Syahirah\_Ashri](https://discuss.elastic.co/u/Nur_Syahirah_Ashri)\ **Replies:** 0\ **Last updated:** [August 17, 2020, 4:03pm UTC](https://discuss.elastic.co/t/logstash-config-error/245274 "2020-08-17T16:03:25Z")
hi, i am new in using ELK. I have these problem that i couldn't find the solution yet. it is the cmd for logstash configuration. i have use many kind of commands but still have the same error. if anyone can help me, pl… --- ## [Huge number of open files on data node with multiple paths](https://discuss.elastic.co/t/huge-number-of-open-files-on-data-node-with-multiple-paths/245272)
**Author:** [@luiz.ooliveira](https://discuss.elastic.co/u/luiz.ooliveira)\ **Replies:** 0\ **Last updated:** [August 17, 2020, 3:57pm UTC](https://discuss.elastic.co/t/huge-number-of-open-files-on-data-node-with-multiple-paths/245272 "2020-08-17T15:57:41Z")
Hi, I added a new data node to my cluster with a different configuration from the others. I have 3 data nodes that use a single "path.data" and it is working fine. The new one was configured to use multiple data paths,… --- ## [Different behaviour from 7.6.2 and 7.8.1](https://discuss.elastic.co/t/different-behaviour-from-7-6-2-and-7-8-1/245245)
**Author:** [@DavidKHE](https://discuss.elastic.co/u/DavidKHE)\ **Replies:** 1\ **Last updated:** [August 17, 2020, 3:51pm UTC](https://discuss.elastic.co/t/different-behaviour-from-7-6-2-and-7-8-1/245245 "2020-08-17T15:51:05Z")
Hi, use case - merging two indexes into new output. the flow is to take 2 indexes, both having timestamp and pivot by time where aggregations are unique to each index. KPI1 - index1 and KPI2 - index2. when using ES 7.… --- ## [Logstash com.mysql.jdbc.Driver error](https://discuss.elastic.co/t/logstash-com-mysql-jdbc-driver-error/245256)
**Author:** [@Mohammad\_Mousavi](https://discuss.elastic.co/u/Mohammad_Mousavi)\ **Replies:** 2\ **Last updated:** [August 17, 2020, 3:44pm UTC](https://discuss.elastic.co/t/logstash-com-mysql-jdbc-driver-error/245256 "2020-08-17T15:44:19Z")
Hi. I have logstash 7.4.2 , mysql 5.7 , This is my config: filter { jdbc\_static { loaders =\> \[ { id =\> "products-table" query =\> "select id,name from products;" local\_table =\> "prod… --- ## [S3 input plugin OOM (heap space)](https://discuss.elastic.co/t/s3-input-plugin-oom-heap-space/245267)
**Author:** [@lcaflc](https://discuss.elastic.co/u/lcaflc)\ **Replies:** 0\ **Last updated:** [August 17, 2020, 3:38pm UTC](https://discuss.elastic.co/t/s3-input-plugin-oom-heap-space/245267 "2020-08-17T15:38:20Z")
Hi, I have a big issue with the S3 input plugin. I'm using it to restore files created using the s3 output plugin using gzip compression. When triyng to restore files that are more the 100M it basically eat all JVM hea… --- ## [Logstash add field based on external source](https://discuss.elastic.co/t/logstash-add-field-based-on-external-source/245236)
**Author:** [@Mohammad\_Mousavi](https://discuss.elastic.co/u/Mohammad_Mousavi)\ **Replies:** 2\ **Last updated:** [August 17, 2020, 1:57pm UTC](https://discuss.elastic.co/t/logstash-add-field-based-on-external-source/245236 "2020-08-17T13:57:04Z")
Hi, I have a stream server. I store the logs on elasticsearch. The stream server's log contain requested urls from clients. The logs are similar to nginx logs but with more fields. one of the query params in the url is "… --- ## [Logstash Ruby filter error](https://discuss.elastic.co/t/logstash-ruby-filter-error/245216)
**Author:** [@Apollyon](https://discuss.elastic.co/u/Apollyon)\ **Replies:** 4\ **Last updated:** [August 17, 2020, 3:29pm UTC](https://discuss.elastic.co/t/logstash-ruby-filter-error/245216 "2020-08-17T15:29:17Z")
Hello all, Running Logstash v7.8.1. Ruby codec v3.1.5. Been playing around using the ruby filter plugin. Great filter plugin btw!! I have a couple of logstash confs that have small ruby script filters. While all the f… --- ## [How to provide custom start\_date and time to rollup job’s indexer at rollup job’s creation time](https://discuss.elastic.co/t/how-to-provide-custom-start-date-and-time-to-rollup-job-s-indexer-at-rollup-job-s-creation-time/245262)
**Author:** [@darkwarrior](https://discuss.elastic.co/u/darkwarrior)\ **Replies:** 0\ **Last updated:** [August 17, 2020, 3:20pm UTC](https://discuss.elastic.co/t/how-to-provide-custom-start-date-and-time-to-rollup-job-s-indexer-at-rollup-job-s-creation-time/245262 "2020-08-17T15:20:23Z")
Hey all, On our ES cluster we do create daily indices with index-pattern like this =\> "index-20200101" and now we want to rollup documents from those indices with 1-day interval. But we don't want to rollup data from a… --- ## [Logstash S3 Input Plugin Error](https://discuss.elastic.co/t/logstash-s3-input-plugin-error/245201)
**Author:** [@elasticus3r](https://discuss.elastic.co/u/elasticus3r)\ **Replies:** 5\ **Last updated:** [August 17, 2020, 2:55pm UTC](https://discuss.elastic.co/t/logstash-s3-input-plugin-error/245201 "2020-08-17T14:55:13Z")
Hello All, Hoping someone could help please. I have got a simple ELk stack running and using s3 input plugin to ingest from an endpoint with the following config: input { s3 { bucket =\> "mybucket" endpoint =\>… --- ## [Filebeat, logstash handle logrotation quesiton/help](https://discuss.elastic.co/t/filebeat-logstash-handle-logrotation-quesiton-help/245254)
**Author:** [@lingfei\_ouyang](https://discuss.elastic.co/u/lingfei_ouyang)\ **Replies:** 0\ **Last updated:** [August 17, 2020, 2:52pm UTC](https://discuss.elastic.co/t/filebeat-logstash-handle-logrotation-quesiton-help/245254 "2020-08-17T14:52:35Z")
Hi, Currently hitting an issues when I setup the filebeat -\> logstash. Here is situation that I'm facing: On filebeat (application) server, if the application log been rotated, (i.e app.log -\> rotate to app.log.08172… --- ## [How does JDBC input plugin keeps timestamp last value?](https://discuss.elastic.co/t/how-does-jdbc-input-plugin-keeps-timestamp-last-value/245246)
**Author:** [@ffknob](https://discuss.elastic.co/u/ffknob)\ **Replies:** 2\ **Last updated:** [August 17, 2020, 2:52pm UTC](https://discuss.elastic.co/t/how-does-jdbc-input-plugin-keeps-timestamp-last-value/245246 "2020-08-17T14:52:04Z")
Hello I just want to figure it out how does JDBC input plugin writes the state value to the last\_run\_metadata\_path file. Let me explain: We have a SQL Server database and we are ingesting a table that now has a "last… --- ## [Create new field on object using painless](https://discuss.elastic.co/t/create-new-field-on-object-using-painless/245211)
**Author:** [@david.preston](https://discuss.elastic.co/u/david.preston)\ **Replies:** 11\ **Last updated:** [August 17, 2020, 2:50pm UTC](https://discuss.elastic.co/t/create-new-field-on-object-using-painless/245211 "2020-08-17T14:50:44Z")
Hi I'm trying to set an object field from another using an update query but am getting an error. Currently by doc has an event object in the root of the doc with a field: id i.e. { event { id: 1 } } all the docume… --- ## [Cluster.initial\_master\_nodes mandatory when upgrading?](https://discuss.elastic.co/t/cluster-initial-master-nodes-mandatory-when-upgrading/245035)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 3\ **Last updated:** [August 17, 2020, 2:45pm UTC](https://discuss.elastic.co/t/cluster-initial-master-nodes-mandatory-when-upgrading/245035 "2020-08-17T14:45:55Z")
Hello Elasticians ! I'm asking is cluster.initial\_master\_nodes is mandatory when we upgrade from a already running 6.8 cluster to 7.8 cluster I don't think so but if you could confirm.. Thanks :wink: --- ## [Winlogbeat - no winlog.logon.id](https://discuss.elastic.co/t/winlogbeat-no-winlog-logon-id/236524)
**Author:** [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\ **Replies:** 21\ **Last updated:** [August 17, 2020, 2:29pm UTC](https://discuss.elastic.co/t/winlogbeat-no-winlog-logon-id/236524 "2020-08-17T14:29:41Z")
The winlogbeat 7.7.1 dashboards reference winlog.logon.id.These two threads also mention it and imply it should be in versions \> 7.4. https://discuss.elastic.co/search?q=winlog.logon.id However, I am running 7.6.2 and … --- ## [SEQUENTIAL FIELD WHEN MATCH ID DOC](https://discuss.elastic.co/t/sequential-field-when-match-id-doc/245196)
**Author:** [@Daniel\_Lopez](https://discuss.elastic.co/u/Daniel_Lopez)\ **Replies:** 1\ **Last updated:** [August 17, 2020, 2:27pm UTC](https://discuss.elastic.co/t/sequential-field-when-match-id-doc/245196 "2020-08-17T14:27:36Z")
Hi I will try to explain what I'm in I have these lines in a log ID:1,PID:123, Path:\\123\\123 ID:2,PID:234, Path:\\234\\234 ID:1,PID:345, Path:\\345\\345 The result of indexed doc I need to get \_Id: 1 PID0:123 Path0:… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1860) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1862)