# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1870 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1871 --- ## [How to view cloudwatch log in Kibana after deploying via functionbeat](https://discuss.elastic.co/t/how-to-view-cloudwatch-log-in-kibana-after-deploying-via-functionbeat/244473)
**Author:** [@JamaesTiger](https://discuss.elastic.co/u/JamaesTiger)\ **Replies:** 2\ **Last updated:** [August 13, 2020, 1:06am UTC](https://discuss.elastic.co/t/how-to-view-cloudwatch-log-in-kibana-after-deploying-via-functionbeat/244473 "2020-08-13T01:06:38Z")
I am testing how to stream to elastic service cloudwatch log via lambda function. Deployment seem to be fine but i couldn't create(define) index pattern. Please let me know what was problem of my tested configuration(f… --- ## [Is it safe to write into a green index in a red cluster?](https://discuss.elastic.co/t/is-it-safe-to-write-into-a-green-index-in-a-red-cluster/244743)
**Author:** [@wenhoujx](https://discuss.elastic.co/u/wenhoujx)\ **Replies:** 1\ **Last updated:** [August 12, 2020, 10:10pm UTC](https://discuss.elastic.co/t/is-it-safe-to-write-into-a-green-index-in-a-red-cluster/244743 "2020-08-12T22:10:54Z")
hello, IIUC, i can write documents to a green index even if the cluster is red and trying to allocating shards. but is it safe to do it? anything i should watch out for? Thanks --- ## [Pulling elasticsearch-oss images](https://discuss.elastic.co/t/pulling-elasticsearch-oss-images/244758)
**Author:** [@nugusbayevkk](https://discuss.elastic.co/u/nugusbayevkk)\ **Replies:** 2\ **Last updated:** [August 12, 2020, 10:10pm UTC](https://discuss.elastic.co/t/pulling-elasticsearch-oss-images/244758 "2020-08-12T22:10:06Z")
Hello, Starting today pulling images requires authentication. docker pull docker.elastic.co/elasticsearch/elasticsearch:7.8.1 Error response from daemon: Get https://docker.elastic.co/v2/elasticsearch/elasticsearch/man… --- ## [Nginx in front of ES / SSL cert issue - ELK watcher webhook to enable / disable watcher fails](https://discuss.elastic.co/t/nginx-in-front-of-es-ssl-cert-issue-elk-watcher-webhook-to-enable-disable-watcher-fails/244640)
**Author:** [@adam.klein](https://discuss.elastic.co/u/adam.klein)\ **Replies:** 2\ **Last updated:** [August 12, 2020, 8:48pm UTC](https://discuss.elastic.co/t/nginx-in-front-of-es-ssl-cert-issue-elk-watcher-webhook-to-enable-disable-watcher-fails/244640 "2020-08-12T20:48:06Z")
Running Elastic 7.8.0 locally, three elastic, two kibana, two logstash. One nginx load-balancer in front of the two kibana nodes and another nginx load-balancer in front of the three elastic nodes. Setting up a custom … --- ## [Handling multiple client's filebeat on logstash](https://discuss.elastic.co/t/handling-multiple-clients-filebeat-on-logstash/244768)
**Author:** [@Jagadeesan\_A](https://discuss.elastic.co/u/Jagadeesan_A)\ **Replies:** 2\ **Last updated:** [August 12, 2020, 8:32pm UTC](https://discuss.elastic.co/t/handling-multiple-clients-filebeat-on-logstash/244768 "2020-08-12T20:32:17Z")
I want to run filebeats on "n" number of clients, on logstash how can i distinguish each client's filebeat. Is there any way to include client name in indexing. Am able to read geo name in each filebeat message. Is the… --- ## [Bulk operation failing to index first document without attachment field](https://discuss.elastic.co/t/bulk-operation-failing-to-index-first-document-without-attachment-field/244777)
**Author:** [@russinholi](https://discuss.elastic.co/u/russinholi)\ **Replies:** 3\ **Last updated:** [August 12, 2020, 8:01pm UTC](https://discuss.elastic.co/t/bulk-operation-failing-to-index-first-document-without-attachment-field/244777 "2020-08-12T20:01:11Z")
Hi all I'm using Elasticsearch 7.8 and I'm having an weird situation while using bulk operation to index some documents, that might have or not attachment the them, like if run the following command: curl -X POST "local… --- ## [Kibana webhook](https://discuss.elastic.co/t/kibana-webhook/244246)
**Author:** [@alex\_tian](https://discuss.elastic.co/u/alex_tian)\ **Replies:** 1\ **Last updated:** [August 12, 2020, 7:36pm UTC](https://discuss.elastic.co/t/kibana-webhook/244246 "2020-08-12T19:36:21Z")
Hello everyone, I am testing the alarm function of kibana, and I encountered an error when configuring webhook. Have you configured successfully? Can you share it with me, thank you! I tried to test it directly with a … --- ## [Filebeat indices for each type of source log](https://discuss.elastic.co/t/filebeat-indices-for-each-type-of-source-log/244410)
**Author:** [@robertitox](https://discuss.elastic.co/u/robertitox)\ **Replies:** 3\ **Last updated:** [August 12, 2020, 7:05pm UTC](https://discuss.elastic.co/t/filebeat-indices-for-each-type-of-source-log/244410 "2020-08-12T19:05:31Z")
Dear all, I have an ELK 7.8.1 server with syslog and cisco module enabled from Filebeat. At the moment I'm receiving data from: Linux servers (syslog) Cisco ASA (cisco module, asa data set) Cisco IOS (cisco module, io… --- ## [Kibana TSVB - Accessing Last Bucket' Timestamp](https://discuss.elastic.co/t/kibana-tsvb-accessing-last-bucket-timestamp/238347)
**Author:** [@seth.yes](https://discuss.elastic.co/u/seth.yes)\ **Replies:** 5\ **Last updated:** [August 12, 2020, 6:22pm UTC](https://discuss.elastic.co/t/kibana-tsvb-accessing-last-bucket-timestamp/238347 "2020-08-12T18:22:22Z")
I'm attempting to forecast warranty renewal costs for hardware using a TSVB on Kibana 6.5.1. My use case is to provide a dashboard where someone can select the end-date (start date should be today), and depending on whe… --- ## [Unable to set "ssl true", "ssl\_certificate\_verification false" in logstash http output plugin](https://discuss.elastic.co/t/unable-to-set-ssl-true-ssl-certificate-verification-false-in-logstash-http-output-plugin/244764)
**Author:** [@bimanarajesh](https://discuss.elastic.co/u/bimanarajesh)\ **Replies:** 1\ **Last updated:** [August 12, 2020, 5:54pm UTC](https://discuss.elastic.co/t/unable-to-set-ssl-true-ssl-certificate-verification-false-in-logstash-http-output-plugin/244764 "2020-08-12T17:54:03Z")
With http output plugin, I am not able to set ssl =\> true ssl\_certificate\_verification =\> false We are getting configuration error when we add the above configurations in http output Pls let us know how to enable ssl… --- ## [Create a table & graph that takes only the last value and puts it in the table or graph in Kibana](https://discuss.elastic.co/t/create-a-table-graph-that-takes-only-the-last-value-and-puts-it-in-the-table-or-graph-in-kibana/244392)
**Author:** [@tamirs](https://discuss.elastic.co/u/tamirs)\ **Replies:** 1\ **Last updated:** [August 12, 2020, 5:11pm UTC](https://discuss.elastic.co/t/create-a-table-graph-that-takes-only-the-last-value-and-puts-it-in-the-table-or-graph-in-kibana/244392 "2020-08-12T17:11:00Z")
I am looking to replace our Splunk SIEM or add another platform, our purpose is to send diagnostics data from our instances and filter it out. most of the information will be sent in JSON format, I am gathering informa… --- ## [Save PySpark DataFRame to ElasticSEarch index](https://discuss.elastic.co/t/save-pyspark-dataframe-to-elasticsearch-index/244581)
**Author:** [@larryrodrigues](https://discuss.elastic.co/u/larryrodrigues)\ **Replies:** 1\ **Last updated:** [August 12, 2020, 5:08pm UTC](https://discuss.elastic.co/t/save-pyspark-dataframe-to-elasticsearch-index/244581 "2020-08-12T17:08:15Z")
Using Spark 2.6 and elasticsearch 6.8 I am trying to save a PySpark DataFrame to elasticsearch index using the external library: df\_to\_save.write.format('org.elasticsearch.spark.sql').option('es.resource', '%s/%s' % ('… --- ## [Setting up elasticsearch and kibana behind a single AWS application load balancer (on http)](https://discuss.elastic.co/t/setting-up-elasticsearch-and-kibana-behind-a-single-aws-application-load-balancer-on-http/243541)
**Author:** [@Deepak\_Atrey](https://discuss.elastic.co/u/Deepak_Atrey)\ **Replies:** 2\ **Last updated:** [August 12, 2020, 5:03pm UTC](https://discuss.elastic.co/t/setting-up-elasticsearch-and-kibana-behind-a-single-aws-application-load-balancer-on-http/243541 "2020-08-12T17:03:24Z")
Hi Experts, I am setting up the elasticsearch and kibana on amazon ECS cluster. I am able to run the elasticsearch and kibana from official docker images (v7.8.1) on Ec2 nodes. I have configured the elasticsearch targ… --- ## [Drop empty buckets](https://discuss.elastic.co/t/drop-empty-buckets/244231)
**Author:** [@Ferdous\_Khan](https://discuss.elastic.co/u/Ferdous_Khan)\ **Replies:** 1\ **Last updated:** [August 12, 2020, 5:01pm UTC](https://discuss.elastic.co/t/drop-empty-buckets/244231 "2020-08-12T17:01:28Z")
Hello, I have data table like below. I am looking for a vertical bar chart that will display sum(elapsed\_time) per week having min(sequence) of that respective week. Final table will have those asterisk highlighted rows… --- ## [Creating certs for kibana connecting to elastic](https://discuss.elastic.co/t/creating-certs-for-kibana-connecting-to-elastic/244236)
**Author:** [@AirJordan](https://discuss.elastic.co/u/AirJordan)\ **Replies:** 2\ **Last updated:** [August 12, 2020, 4:13pm UTC](https://discuss.elastic.co/t/creating-certs-for-kibana-connecting-to-elastic/244236 "2020-08-12T16:13:23Z")
So I am doing a demo of Elastic SIEM. Everything is working fine using http. Only a one server setup. Basic minimum, testing using PoC Domain. I do for the future want to know how to create certs using our domain using A… --- ## [Example logstash.conf with multiline json to elasticsearch](https://discuss.elastic.co/t/example-logstash-conf-with-multiline-json-to-elasticsearch/244741)
**Author:** [@Annette1](https://discuss.elastic.co/u/Annette1)\ **Replies:** 1\ **Last updated:** [August 12, 2020, 4:03pm UTC](https://discuss.elastic.co/t/example-logstash-conf-with-multiline-json-to-elasticsearch/244741 "2020-08-12T16:03:24Z")
kibana error - failed to format messages from /var/lib/containers/....json.log filebeat config "paths": \[/var/lib/docker/cnotainers//.log"\] "fields": {"environement": "dev", "system" : "test" "level "application"}, … --- ## [Error in logstash-input-s3-sns-sqs plugin](https://discuss.elastic.co/t/error-in-logstash-input-s3-sns-sqs-plugin/244699)
**Author:** [@Jayakumar\_R\_R](https://discuss.elastic.co/u/Jayakumar_R_R)\ **Replies:** 4\ **Last updated:** [August 12, 2020, 3:53pm UTC](https://discuss.elastic.co/t/error-in-logstash-input-s3-sns-sqs-plugin/244699 "2020-08-12T15:53:36Z")
Hi all, I am new to logstash. I am using s3snssqs plugin to pull data from s3. input { s3snssqs { region =\> "us-east-1" s3\_default\_options =\> { "endpoint\_discovery" =\> … --- ## [Value mapping GROK\\PIPELINE](https://discuss.elastic.co/t/value-mapping-grok-pipeline/244739)
**Author:** [@dmalchikov](https://discuss.elastic.co/u/dmalchikov)\ **Replies:** 1\ **Last updated:** [August 12, 2020, 3:49pm UTC](https://discuss.elastic.co/t/value-mapping-grok-pipeline/244739 "2020-08-12T15:49:29Z")
Hi there, Could not find how to modify coded field from logs. For example in logs I have value 0 or 1 but I would like to see(store) in Kibana "OK" or "Alarm" I just use Zabbix and there "Value mapping" feature exists… --- ## [Getting access to filterManager in Kibana 7.8](https://discuss.elastic.co/t/getting-access-to-filtermanager-in-kibana-7-8/244722)
**Author:** [@ssimmons](https://discuss.elastic.co/u/ssimmons)\ **Replies:** 5\ **Last updated:** [August 12, 2020, 3:45pm UTC](https://discuss.elastic.co/t/getting-access-to-filtermanager-in-kibana-7-8/244722 "2020-08-12T15:45:46Z")
I wrote a plugin for Kibana 7.5 and I'm porting it to Kibana 7.8. I need access to the filterManager from within my visualization file. Is there an example of how to do this in Kibana 7.8? In 7.5 I was able to do the fol… --- ## [Windows Event Viewer Logs Parsing without Winlogbeat](https://discuss.elastic.co/t/windows-event-viewer-logs-parsing-without-winlogbeat/244710)
**Author:** [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\ **Replies:** 1\ **Last updated:** [August 12, 2020, 3:37pm UTC](https://discuss.elastic.co/t/windows-event-viewer-logs-parsing-without-winlogbeat/244710 "2020-08-12T15:37:53Z")
Constraint: logs are coming in collected by Splunk, forwarded, along with many other log sources, to logstash. So no winlogbeat, no logstash-input-eventlog plugin. We have to pick out the Windows events from the flood of… --- ## [How to combine Multiline events into Single Event](https://discuss.elastic.co/t/how-to-combine-multiline-events-into-single-event/244714)
**Author:** [@Pavani\_Reddy](https://discuss.elastic.co/u/Pavani_Reddy)\ **Replies:** 3\ **Last updated:** [August 12, 2020, 3:29pm UTC](https://discuss.elastic.co/t/how-to-combine-multiline-events-into-single-event/244714 "2020-08-12T15:29:44Z")
I am trying to index the sip logs (telephony) , but while indexing ,it took each line as separate event .Give me some suggestions to combine those events into one single event. Here I am giving log format \<135\>85748… --- ## [Add x-server header to kibana parsing](https://discuss.elastic.co/t/add-x-server-header-to-kibana-parsing/244346)
**Author:** [@sandikata](https://discuss.elastic.co/u/sandikata)\ **Replies:** 5\ **Last updated:** [August 12, 2020, 3:28pm UTC](https://discuss.elastic.co/t/add-x-server-header-to-kibana-parsing/244346 "2020-08-12T15:28:30Z")
Hello, i am trying to add http\_x\_server field/pattern to my installation, but without success i cannot even find any info about custom patterns or so. There's my current nginx pattern file. NGUSERNAME \[a-zA-Z\\.\\@\\-\\+\_… --- ## [Logstash sending same message 3 times to elasticsearch](https://discuss.elastic.co/t/logstash-sending-same-message-3-times-to-elasticsearch/244749)
**Author:** [@srbhklkrn](https://discuss.elastic.co/u/srbhklkrn)\ **Replies:** 0\ **Last updated:** [August 12, 2020, 3:26pm UTC](https://discuss.elastic.co/t/logstash-sending-same-message-3-times-to-elasticsearch/244749 "2020-08-12T15:26:31Z")
We have Pivotal Cloud Foundry as a platform and we are sending logs to ELK. So our setup is like we have an F5 load balancer that sends logs to 3 Logstash servers and these 3 Logstash servers send logs to 3 Elastic serve… --- ## [Writing appender.json\_console logs for logstash to file](https://discuss.elastic.co/t/writing-appender-json-console-logs-for-logstash-to-file/244746)
**Author:** [@vishnuanil](https://discuss.elastic.co/u/vishnuanil)\ **Replies:** 0\ **Last updated:** [August 12, 2020, 3:16pm UTC](https://discuss.elastic.co/t/writing-appender-json-console-logs-for-logstash-to-file/244746 "2020-08-12T15:16:52Z")
Currently all appender.json\_console logs are written as stdout and logs are written into a docker container json log for logstash which is using a lot of disk space. I am aware of the options to utilize docker options -l… --- ## [Visualize Rolled Up Data and Filtering](https://discuss.elastic.co/t/visualize-rolled-up-data-and-filtering/244143)
**Author:** [@michaelpietzsch](https://discuss.elastic.co/u/michaelpietzsch)\ **Replies:** 2\ **Last updated:** [August 12, 2020, 3:12pm UTC](https://discuss.elastic.co/t/visualize-rolled-up-data-and-filtering/244143 "2020-08-12T15:12:52Z")
Hello dear community, i'm trying to make some visualisations on a rolled up index, and having issues when adding an additional filter on the visualisations. I also have a ? on my index pattern and no date and time p… --- ## [Timelion for .monitoring-logstash index](https://discuss.elastic.co/t/timelion-for-monitoring-logstash-index/244105)
**Author:** [@jason\_0](https://discuss.elastic.co/u/jason_0)\ **Replies:** 1\ **Last updated:** [August 12, 2020, 3:02pm UTC](https://discuss.elastic.co/t/timelion-for-monitoring-logstash-index/244105 "2020-08-12T15:02:21Z")
Hi Team, I'm trying to create a timelion visualisation for the delta of the 'logstash\_stats.events.out' field from the system index .monitoring-logstash\*. The problem is that nothing is displayed for this index when I c… --- ## [Problems using ingest-geoip in elasticsearch](https://discuss.elastic.co/t/problems-using-ingest-geoip-in-elasticsearch/244744)
**Author:** [@mtudisco](https://discuss.elastic.co/u/mtudisco)\ **Replies:** 0\ **Last updated:** [August 12, 2020, 2:58pm UTC](https://discuss.elastic.co/t/problems-using-ingest-geoip-in-elasticsearch/244744 "2020-08-12T14:58:04Z")
Hi, I'm using elasticsearch 7.4 and have some data indexed with ip in a field. Now i want to use a pipeline to reindex that data and generate geoip information with the ingest-geoip. I created an ingest and if i use it … --- ## [Logger.logstash.outputs.elasticsearch not printing enough logs](https://discuss.elastic.co/t/logger-logstash-outputs-elasticsearch-not-printing-enough-logs/243420)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 12\ **Last updated:** [August 12, 2020, 2:54pm UTC](https://discuss.elastic.co/t/logger-logstash-outputs-elasticsearch-not-printing-enough-logs/243420 "2020-08-12T14:54:50Z")
Hi I saw "logger.logstash.outputs.elasticsearch" : "DEBUG" is printing debug level logs only during logstash start/stop. But logstash not printing any logs when it parses an event and stores in elasticsearch My out… --- ## [Logstash aggregation filter](https://discuss.elastic.co/t/logstash-aggregation-filter/244730)
**Author:** [@sahere37](https://discuss.elastic.co/u/sahere37)\ **Replies:** 6\ **Last updated:** [August 12, 2020, 2:54pm UTC](https://discuss.elastic.co/t/logstash-aggregation-filter/244730 "2020-08-12T14:54:12Z")
Hi all, I am trying to aggregate information of multi events to one event using aggregation filter of logstash. for example events are as following: name1=c1,name2=s1 name1=c1,name2=s1 name1=c1,name2=s1 name1=c1,name2=… --- ## [Timezone offset with graph and timelion](https://discuss.elastic.co/t/timezone-offset-with-graph-and-timelion/244133)
**Author:** [@Lempkin](https://discuss.elastic.co/u/Lempkin)\ **Replies:** 1\ **Last updated:** [August 12, 2020, 2:53pm UTC](https://discuss.elastic.co/t/timezone-offset-with-graph-and-timelion/244133 "2020-08-12T14:53:37Z")
Hi I try to build a canvas to represent data sent from HeartBeat : Timelion query : .es(index=heartbeat-7.8.0,q=monitor.status:down) Problem is, in the Time filter I've set 9am to 10am, and as you can see on the gr… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1869) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1871)