# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1890

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1891

---

## [Kibana stops running when tried to access with curl or browser](https://discuss.elastic.co/t/kibana-stops-running-when-tried-to-access-with-curl-or-browser/243553)

<div class="topic-metadata">

**Author:** [@pramod\_n1](https://discuss.elastic.co/u/pramod_n1)\
**Replies:** 1\
**Last updated:** [August 3, 2020, 9:38pm UTC](https://discuss.elastic.co/t/kibana-stops-running-when-tried-to-access-with-curl-or-browser/243553 "2020-08-03T21:38:41Z")

</div>

{"type":"log","@timestamp":"2020-08-03T11:40:43Z","tags":\["warning","plugins-discovery"\],"pid":9766,"message":"Expect plugin "id" in camelCase, but found: eui\_utils"} {"type":"log","@timestamp":"2020-08-03T11:40:43Z","t…

---

## [Problem with the map in kibana](https://discuss.elastic.co/t/problem-with-the-map-in-kibana/243547)

<div class="topic-metadata">

**Author:** [@IneedHelp](https://discuss.elastic.co/u/IneedHelp)\
**Replies:** 1\
**Last updated:** [August 3, 2020, 9:35pm UTC](https://discuss.elastic.co/t/problem-with-the-map-in-kibana/243547 "2020-08-03T21:35:59Z")

</div>

Hello, I have a problem with the map in kibana. I use a geocoordinate map ( visualisation ) to have a look on the geo\_points returned by geoip from the client ip. When i edit this map as a visualisation, there is no p…

---

## [How to set total limit field to be other than 1000 by default](https://discuss.elastic.co/t/how-to-set-total-limit-field-to-be-other-than-1000-by-default/243564)

<div class="topic-metadata">

**Author:** [@Abdul\_Hameed](https://discuss.elastic.co/u/Abdul_Hameed)\
**Replies:** 3\
**Last updated:** [August 3, 2020, 9:30pm UTC](https://discuss.elastic.co/t/how-to-set-total-limit-field-to-be-other-than-1000-by-default/243564 "2020-08-03T21:30:18Z")

</div>

Hi, I would like to increase the limit of total fields for my indices. I know that we can change it in Kibana by sending an API call as such: PUT logstash-\*/\_settings { "index.mapping.total\_fields.limit": 5000 } Bu…

---

## [Import only a specific default dashboards](https://discuss.elastic.co/t/import-only-a-specific-default-dashboards/243539)

<div class="topic-metadata">

**Author:** [@smm](https://discuss.elastic.co/u/smm)\
**Replies:** 1\
**Last updated:** [August 3, 2020, 9:12pm UTC](https://discuss.elastic.co/t/import-only-a-specific-default-dashboards/243539 "2020-08-03T21:12:28Z")

</div>

Hi there, as you know there are ready to use default dasboards. Do you know a best practice or a trick to only import specific dashboards from the default ones? For example: I would like to only import the metricbeat d…

---

## [How to search for code in this GitHub?](https://discuss.elastic.co/t/how-to-search-for-code-in-this-github/242790)

<div class="topic-metadata">

**Author:** [@thanhlam](https://discuss.elastic.co/u/thanhlam)\
**Replies:** 1\
**Last updated:** [August 3, 2020, 9:12pm UTC](https://discuss.elastic.co/t/how-to-search-for-code-in-this-github/242790 "2020-08-03T21:12:09Z")

</div>

Hello, I'm new to this GitHub but very interested in searching for code. So that I can find and learn how something works. Can someone point me to instructions on how to search for a text string for example in the code? …

---

## [Azure Market Place Deployment](https://discuss.elastic.co/t/azure-market-place-deployment/243530)

<div class="topic-metadata">

**Author:** [@wa2rod](https://discuss.elastic.co/u/wa2rod)\
**Replies:** 1\
**Last updated:** [August 3, 2020, 9:11pm UTC](https://discuss.elastic.co/t/azure-market-place-deployment/243530 "2020-08-03T21:11:25Z")

</div>

Hi, I am new to ELK. I have installed the ELK Azure Market Place solution and i can't access Kibana. The Azure deployment was successful, the Kibana service is running on the kibana VM, the Elasticsearch service is also…

---

## [\[esaggs\] \> Internal Server Error in Dashboard error](https://discuss.elastic.co/t/esaggs-internal-server-error-in-dashboard-error/243500)

<div class="topic-metadata">

**Author:** [@nisargtest1](https://discuss.elastic.co/u/nisargtest1)\
**Replies:** 1\
**Last updated:** [August 3, 2020, 9:03pm UTC](https://discuss.elastic.co/t/esaggs-internal-server-error-in-dashboard-error/243500 "2020-08-03T21:03:06Z")

</div>

While visualizing data through dashboard,I am getting \[esaggs\] \> Internal Server Error for long time range e.g. 100 hours, 1 week, 8 days. It works fine for short time range e.g. 24 hours, 48 hours

---

## [Authorization Exception in Timelion](https://discuss.elastic.co/t/authorization-exception-in-timelion/243482)

<div class="topic-metadata">

**Author:** [@nisargtest1](https://discuss.elastic.co/u/nisargtest1)\
**Replies:** 1\
**Last updated:** [August 3, 2020, 9:00pm UTC](https://discuss.elastic.co/t/authorization-exception-in-timelion/243482 "2020-08-03T21:00:01Z")

</div>

I am trying to visualize various timelion matrics in kibana dashboard. It works perfect when I give time period upto 36 hours. but when I give larger time period(e.g. 5 days, 1 week), it throws an Authorization Exception…

---

## [Use envoy proxy between elasticsearch nodes](https://discuss.elastic.co/t/use-envoy-proxy-between-elasticsearch-nodes/243433)

<div class="topic-metadata">

**Author:** [@junhuangli](https://discuss.elastic.co/u/junhuangli)\
**Replies:** 3\
**Last updated:** [August 3, 2020, 8:38pm UTC](https://discuss.elastic.co/t/use-envoy-proxy-between-elasticsearch-nodes/243433 "2020-08-03T20:38:45Z")

</div>

Is it possible to use envoy proxy between elasticsearch nodes? The purpose is to enable tls verifications for any communication between nodes through envoy proxy. I am still in the early stage of this task, but would li…

---

## [Ruby code to iterate through list of pipelines received by Logstash API](https://discuss.elastic.co/t/ruby-code-to-iterate-through-list-of-pipelines-received-by-logstash-api/243616)

<div class="topic-metadata">

**Author:** [@aidanoc15](https://discuss.elastic.co/u/aidanoc15)\
**Replies:** 2\
**Last updated:** [August 3, 2020, 7:52pm UTC](https://discuss.elastic.co/t/ruby-code-to-iterate-through-list-of-pipelines-received-by-logstash-api/243616 "2020-08-03T19:52:48Z")

</div>

Hi, I am trying to implement monitoring and alerting for some of our pipelines that we have set up in logstash. My thought is to run a cron job on the Logstash API (specifically \_nodes/stats/pipelines) to retrieve both t…

---

## [Looking for a Logstash Kubernetes Deployment/Stateful Configuration](https://discuss.elastic.co/t/looking-for-a-logstash-kubernetes-deployment-stateful-configuration/243558)

<div class="topic-metadata">

**Author:** [@tamilarasanbravo](https://discuss.elastic.co/u/tamilarasanbravo)\
**Replies:** 1\
**Last updated:** [August 3, 2020, 7:07pm UTC](https://discuss.elastic.co/t/looking-for-a-logstash-kubernetes-deployment-stateful-configuration/243558 "2020-08-03T19:07:22Z")

</div>

Hi Team, I am trying to setup logstash in K8's cluster and after trying various ways, I ended up nowhere. I would like to know if there is any document which shows a working Logstash K8's Deployment/Statefulset files.

---

## [Delete and Insert documents in elasticsearch from logstash](https://discuss.elastic.co/t/delete-and-insert-documents-in-elasticsearch-from-logstash/243614)

<div class="topic-metadata">

**Author:** [@Gabriel\_Mare](https://discuss.elastic.co/u/Gabriel_Mare)\
**Replies:** 1\
**Last updated:** [August 3, 2020, 6:53pm UTC](https://discuss.elastic.co/t/delete-and-insert-documents-in-elasticsearch-from-logstash/243614 "2020-08-03T18:53:49Z")

</div>

Hi, I need to delete all documents and then add documents from logstash, in the same query. Is this possible? How can I do?

---

## [Updating node certificate on existing cluster](https://discuss.elastic.co/t/updating-node-certificate-on-existing-cluster/243413)

<div class="topic-metadata">

**Author:** [@TonyLuc](https://discuss.elastic.co/u/TonyLuc)\
**Replies:** 2\
**Last updated:** [August 3, 2020, 5:52pm UTC](https://discuss.elastic.co/t/updating-node-certificate-on-existing-cluster/243413 "2020-08-03T17:52:34Z")

</div>

Hello there, How to Update node certificate on existing cluster? On-Premise using Version 7.8.0 Node certificate about to expiry. The trusted chain (CAs) remains the same just new node certificate being issued. Where…

---

## [ILM Policy poll interval](https://discuss.elastic.co/t/ilm-policy-poll-interval/243211)

<div class="topic-metadata">

**Author:** [@hemanth49841](https://discuss.elastic.co/u/hemanth49841)\
**Replies:** 1\
**Last updated:** [August 3, 2020, 5:22pm UTC](https://discuss.elastic.co/t/ilm-policy-poll-interval/243211 "2020-08-03T17:22:44Z")

</div>

Hi all, In our project environment, we have changed the Cluster ILM poll interval from default (10m) to "1s". Does we face anyindices performance related issues on clusters ? Note : Our cluster size is 3 node. Also ne…

---

## [Provided Grok expressions do not match field value](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value/243607)

<div class="topic-metadata">

**Author:** [@wolf\_goe](https://discuss.elastic.co/u/wolf_goe)\
**Replies:** 0\
**Last updated:** [August 3, 2020, 5:21pm UTC](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value/243607 "2020-08-03T17:21:41Z")

</div>

I have successfully configured filebeats to ingest iis logfiles from a clients server to my elasticsearch. I can view the entries through discovery, but every message has the following error: Provided Grok expressions d…

---

## [Looking for systemd startup script examples for Elasticsearch 7.7.0, etc... CentOS 7](https://discuss.elastic.co/t/looking-for-systemd-startup-script-examples-for-elasticsearch-7-7-0-etc-centos-7/243405)

<div class="topic-metadata">

**Author:** [@uf0undzach](https://discuss.elastic.co/u/uf0undzach)\
**Replies:** 3\
**Last updated:** [August 3, 2020, 5:08pm UTC](https://discuss.elastic.co/t/looking-for-systemd-startup-script-examples-for-elasticsearch-7-7-0-etc-centos-7/243405 "2020-08-03T17:08:42Z")

</div>

Relatively new to ELK... I inherited this ELK server from another admin, and it appears that it was not installed via conventional means, as there are no x.services files in /systemd/system, etc.. The ELK processes work…

---

## [Regex search on the content field - fscrawler](https://discuss.elastic.co/t/regex-search-on-the-content-field-fscrawler/242815)

<div class="topic-metadata">

**Author:** [@arielwb](https://discuss.elastic.co/u/arielwb)\
**Replies:** 3\
**Last updated:** [August 3, 2020, 4:50pm UTC](https://discuss.elastic.co/t/regex-search-on-the-content-field-fscrawler/242815 "2020-08-03T16:50:24Z")

</div>

Hi! I'm trying to use fscrawler to index my files and kibana to do a regex search in the contents field. I'm very new to all this, but it seems that to do a regex search, first I need a keyword type field. Am I right? …

---

## [Kibana report dataset is not similar to the discover filtered dataset](https://discuss.elastic.co/t/kibana-report-dataset-is-not-similar-to-the-discover-filtered-dataset/240133)

<div class="topic-metadata">

**Author:** [@tapas](https://discuss.elastic.co/u/tapas)\
**Replies:** 4\
**Last updated:** [August 3, 2020, 4:42pm UTC](https://discuss.elastic.co/t/kibana-report-dataset-is-not-similar-to-the-discover-filtered-dataset/240133 "2020-08-03T16:42:23Z")

</div>

Hi Friends, I have a index which i selected in the discover tab as source then i am adding 4-5 filter conditions by which the no of records restricted to less number i.e 64000 but when i save that with a name and share …

---

## [AzureBlob Old/Existing logs not Ingesting](https://discuss.elastic.co/t/azureblob-old-existing-logs-not-ingesting/243603)

<div class="topic-metadata">

**Author:** [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\
**Replies:** 0\
**Last updated:** [August 3, 2020, 4:20pm UTC](https://discuss.elastic.co/t/azureblob-old-existing-logs-not-ingesting/243603 "2020-08-03T16:20:15Z")

</div>

Hello, Hope someone could help. I have logstash ingesting logs from Azureblob storage. What happened is that logs stopped ingesting 2 days ago. Today I got it working again however, the logs from the last 2 days are no…

---

## [Unrecognized @timestamp value type=class org.jruby.RubyFloat](https://discuss.elastic.co/t/unrecognized-timestamp-value-type-class-org-jruby-rubyfloat/243560)

<div class="topic-metadata">

**Author:** [@111266](https://discuss.elastic.co/u/111266)\
**Replies:** 10\
**Last updated:** [August 3, 2020, 4:08pm UTC](https://discuss.elastic.co/t/unrecognized-timestamp-value-type-class-org-jruby-rubyfloat/243560 "2020-08-03T16:08:22Z")

</div>

Use: "logstash.version"=\>"7.8.0" kafka\_2.13-2.5.0 Config: input { kafka { bootstrap\_servers =\> "ip:port" auto\_offset\_reset =\> "earliest" enable\_auto\_commit =\> true topics =\> \["logs…

---

## [Add two value from two record](https://discuss.elastic.co/t/add-two-value-from-two-record/243126)

<div class="topic-metadata">

**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Replies:** 24\
**Last updated:** [August 3, 2020, 4:02pm UTC](https://discuss.elastic.co/t/add-two-value-from-two-record/243126 "2020-08-03T16:02:47Z")

</div>

I am gone a receive two line of record every few min. example name : total code1 : 100 code2: 101 I would like to create a record { name: code1 total: 100 combine\_total: 201 } { name:code2 total: …

---

## [Logstash Configuration Error in K8](https://discuss.elastic.co/t/logstash-configuration-error-in-k8/243422)

<div class="topic-metadata">

**Author:** [@tamilarasanbravo](https://discuss.elastic.co/u/tamilarasanbravo)\
**Replies:** 2\
**Last updated:** [August 3, 2020, 3:44pm UTC](https://discuss.elastic.co/t/logstash-configuration-error-in-k8/243422 "2020-08-03T15:44:10Z")

</div>

Hi Team, Created a Pod for logstash and I am trying to solve the below error. Requesting your help for the same. \[ERROR\] 2020-07-31 04:48:57.595 \[Converge PipelineAction::Create\<main\>\] agent - Failed to execute action …

---

## [Docker:LogStash Graylog](https://discuss.elastic.co/t/docker-logstash-graylog/243599)

<div class="topic-metadata">

**Author:** [@DonPerinon](https://discuss.elastic.co/u/DonPerinon)\
**Replies:** 0\
**Last updated:** [August 3, 2020, 3:26pm UTC](https://discuss.elastic.co/t/docker-logstash-graylog/243599 "2020-08-03T15:26:02Z")

</div>

Hi, can anyone help me with my initial logstash+graylog configuration? I have 4 docker container in total: Graylog+elasticsearch+mongo Logstash So my idea was that I will send all my logs (nxlog inputs) to the Logst…

---

## [Need to ingest maillog generated by sendmail to Elasticsearch](https://discuss.elastic.co/t/need-to-ingest-maillog-generated-by-sendmail-to-elasticsearch/243598)

<div class="topic-metadata">

**Author:** [@xzelkworld](https://discuss.elastic.co/u/xzelkworld)\
**Replies:** 0\
**Last updated:** [August 3, 2020, 3:24pm UTC](https://discuss.elastic.co/t/need-to-ingest-maillog-generated-by-sendmail-to-elasticsearch/243598 "2020-08-03T15:24:37Z")

</div>

We need to ingest sendmail process generated maillog into Elasticsearch cluster. I have created latest installations of filebeat/logstash/elasticsearch stack on my test environment. I did Google search and found this is …

---

## [New cluster, lots of unused fields in filebeat-\*](https://discuss.elastic.co/t/new-cluster-lots-of-unused-fields-in-filebeat/242080)

<div class="topic-metadata">

**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Replies:** 2\
**Last updated:** [August 3, 2020, 3:22pm UTC](https://discuss.elastic.co/t/new-cluster-lots-of-unused-fields-in-filebeat/242080 "2020-08-03T15:22:23Z")

</div>

Hello, Just started a trial of an Elastic Cloud 7.8.0 cluster on GCP. Enabled the system module in Filebeat and noticed a huge amount of unused fields? Is there a way to make Kibana Discover only show fields whih are ac…

---

## [Continuous index policy targeting specific data](https://discuss.elastic.co/t/continuous-index-policy-targeting-specific-data/243561)

<div class="topic-metadata">

**Author:** [@nickgregz](https://discuss.elastic.co/u/nickgregz)\
**Replies:** 8\
**Last updated:** [August 3, 2020, 3:01pm UTC](https://discuss.elastic.co/t/continuous-index-policy-targeting-specific-data/243561 "2020-08-03T15:01:20Z")

</div>

Hello, is it possibly to create an index policy that will continuously delete index data that is older than a certain time frame. Something like the TTL which was deprecated but enabled individual documents to be delet…

---

## [Migrating to ECK](https://discuss.elastic.co/t/migrating-to-eck/243591)

<div class="topic-metadata">

**Author:** [@wadhah](https://discuss.elastic.co/u/wadhah)\
**Replies:** 0\
**Last updated:** [August 3, 2020, 2:40pm UTC](https://discuss.elastic.co/t/migrating-to-eck/243591 "2020-08-03T14:40:20Z")

</div>

Hello, I am running ELK stack on an azure kubernetes cluster. Furthermore, I have filebeat and metricbeat running as daemonsets as well. Now, we are trying to deploy ECK (and get rid of the old ES cluster) and I am loo…

---

## [Filebeat not sending metadata pipeline to logstash for pipeline ingestion](https://discuss.elastic.co/t/filebeat-not-sending-metadata-pipeline-to-logstash-for-pipeline-ingestion/243588)

<div class="topic-metadata">

**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\
**Replies:** 0\
**Last updated:** [August 3, 2020, 2:23pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-metadata-pipeline-to-logstash-for-pipeline-ingestion/243588 "2020-08-03T14:23:24Z")

</div>

Need help. We configured the filebeat apache module and send the data to logstash, then to elasticsearch for pipeline ingestion. It works fine in access logs. But not in the error logs. How could that be? btw ingest pi…

---

## [Syncing Mongodb with Elasticsearch](https://discuss.elastic.co/t/syncing-mongodb-with-elasticsearch/243328)

<div class="topic-metadata">

**Author:** [@sandeepsingh](https://discuss.elastic.co/u/sandeepsingh)\
**Replies:** 2\
**Last updated:** [August 3, 2020, 2:15pm UTC](https://discuss.elastic.co/t/syncing-mongodb-with-elasticsearch/243328 "2020-08-03T14:15:06Z")

</div>

Hi, I wish to transfer data from Elasticsearch into a Mongodb instance. The data in Elasticsearch is nearly 120 GBs and is continuoly updating with nearly 4GB per day. How do I do it? What I have tried: Logstash is ve…

---

## [Windows integration does not add any integration settings in agent configuration](https://discuss.elastic.co/t/windows-integration-does-not-add-any-integration-settings-in-agent-configuration/243465)

<div class="topic-metadata">

**Author:** [@hendry.lim](https://discuss.elastic.co/u/hendry.lim)\
**Replies:** 2\
**Last updated:** [August 3, 2020, 11:33am UTC](https://discuss.elastic.co/t/windows-integration-does-not-add-any-integration-settings-in-agent-configuration/243465 "2020-08-03T11:33:39Z")

</div>

Trying out Elastic Agent 7.9.0-SNAPSHOT on Windows. Added windows integration together with system to a new agent configuration. However, there is no configuration related to windows integration can be seen in the agent …

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1889)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1891)
