# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1894 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1895 --- ## [Each login/logout and failure event is populated 14 times in auditbeat index / dashboard](https://discuss.elastic.co/t/each-login-logout-and-failure-event-is-populated-14-times-in-auditbeat-index-dashboard/243388)
**Author:** [@himanshu.mainali](https://discuss.elastic.co/u/himanshu.mainali)\ **Replies:** 1\ **Last updated:** [July 31, 2020, 7:08pm UTC](https://discuss.elastic.co/t/each-login-logout-and-failure-event-is-populated-14-times-in-auditbeat-index-dashboard/243388 "2020-07-31T19:08:07Z")
Time host.hostname user.name event.outcome message Jul 31, 2020 @ 23:27:13.465 - mainalih - Logout by user mainalih (UID: 832203832) on pts/1 (PID: 17481) from 1x.2xx.xx.xx (IP: 1x.2xx.xx.xx) Jul 31, 2020 @ 23:27:1… --- ## [Path information being displayed](https://discuss.elastic.co/t/path-information-being-displayed/243315)
**Author:** [@rakeshraagu2](https://discuss.elastic.co/u/rakeshraagu2)\ **Replies:** 1\ **Last updated:** [July 31, 2020, 6:50pm UTC](https://discuss.elastic.co/t/path-information-being-displayed/243315 "2020-07-31T18:50:25Z")
Path information of kibana is being displayed on browser when viewing source code. Is it possible to filter this path info? PFB snap \[ Kindly help --- ## [Config path visible in source code of Kibana](https://discuss.elastic.co/t/config-path-visible-in-source-code-of-kibana/243320)
**Author:** [@parag7610](https://discuss.elastic.co/u/parag7610)\ **Replies:** 1\ **Last updated:** [July 31, 2020, 6:49pm UTC](https://discuss.elastic.co/t/config-path-visible-in-source-code-of-kibana/243320 "2020-07-31T18:49:47Z")
Hi team, we are using kibana 7.7.1 and our security team has found that the config path /opt/kibana-7.7.1-linux-x86\_64/ is visible when we do view source code on browser for kibana dashboard. /opt/kibana-7.7.1-linux-x8… --- ## [How to use fields in http output plugin?](https://discuss.elastic.co/t/how-to-use-fields-in-http-output-plugin/243379)
**Author:** [@srbhklkrn](https://discuss.elastic.co/u/srbhklkrn)\ **Replies:** 5\ **Last updated:** [July 31, 2020, 6:10pm UTC](https://discuss.elastic.co/t/how-to-use-fields-in-http-output-plugin/243379 "2020-07-31T18:10:36Z")
I want to attach syslog5424\_msg in message field in HTTP output plugin here is my current implementation, but it's erroring Failed to execute action I'm not sure if we can interpolate fields in this plugin, any input… --- ## [Event routing to indexes not working](https://discuss.elastic.co/t/event-routing-to-indexes-not-working/243349)
**Author:** [@bijender\_kr](https://discuss.elastic.co/u/bijender_kr)\ **Replies:** 2\ **Last updated:** [July 31, 2020, 5:58pm UTC](https://discuss.elastic.co/t/event-routing-to-indexes-not-working/243349 "2020-07-31T17:58:59Z")
Hi, I am taking windows and unix logs onto logstash and wanted these event logs to be ingested on two different indexes. Below is by config file. input { beats { port =\> "5042" } } filter { if "winlogbea… --- ## [Metricbeat scrapping dead containers for prometheus metrics](https://discuss.elastic.co/t/metricbeat-scrapping-dead-containers-for-prometheus-metrics/242945)
**Author:** [@Suman\_M](https://discuss.elastic.co/u/Suman_M)\ **Replies:** 2\ **Last updated:** [July 31, 2020, 5:08pm UTC](https://discuss.elastic.co/t/metricbeat-scrapping-dead-containers-for-prometheus-metrics/242945 "2020-07-31T17:08:39Z")
We are running metricbeat in ecs. We have the prometheus module enabled for docker autodiscovery in the metricbeat configuration. We are running metricbeat version 7.6.2 on Amazon Linux 2. This is the relevant section in… --- ## [One index template for multiple indices](https://discuss.elastic.co/t/one-index-template-for-multiple-indices/242814)
**Author:** [@randoran](https://discuss.elastic.co/u/randoran)\ **Replies:** 2\ **Last updated:** [July 31, 2020, 4:20pm UTC](https://discuss.elastic.co/t/one-index-template-for-multiple-indices/242814 "2020-07-31T16:20:50Z")
Is it possible to use one index template for multiple indices? I have an index pattern of cw-\* so that it matches any index that starts with cw- But I have an ILM policy attached to this template. It has an alias but fro… --- ## [Vega - how can I prevent tooltips from being truncated when labels are too long?](https://discuss.elastic.co/t/vega-how-can-i-prevent-tooltips-from-being-truncated-when-labels-are-too-long/241596)
**Author:** [@pma](https://discuss.elastic.co/u/pma)\ **Replies:** 1\ **Last updated:** [July 31, 2020, 3:29pm UTC](https://discuss.elastic.co/t/vega-how-can-i-prevent-tooltips-from-being-truncated-when-labels-are-too-long/241596 "2020-07-31T15:29:14Z")
Hi, I'm trying to create a Vega visualization in Kibana. I'd like to display tooltips in my plots but since corresponding labels are too long, the tooltips are getting truncated and in my use case they become useless. I… --- ## [Custom datetime picker in Kibana dashboard](https://discuss.elastic.co/t/custom-datetime-picker-in-kibana-dashboard/242833)
**Author:** [@DG13](https://discuss.elastic.co/u/DG13)\ **Replies:** 4\ **Last updated:** [July 31, 2020, 3:17pm UTC](https://discuss.elastic.co/t/custom-datetime-picker-in-kibana-dashboard/242833 "2020-07-31T15:17:21Z")
Hi , When in full screen mode , the date time picker is not visible . Is there any way where I can enable or add custom data time picker in Kibana dashboard ? I checked it is availabke for Kibana-Canvas feature howeve… --- ## [Controls enter any value](https://discuss.elastic.co/t/controls-enter-any-value/243312)
**Author:** [@111369](https://discuss.elastic.co/u/111369)\ **Replies:** 1\ **Last updated:** [July 31, 2020, 3:05pm UTC](https://discuss.elastic.co/t/controls-enter-any-value/243312 "2020-07-31T15:05:40Z")
Hello! I would like to have a visual element (like Controls) on the Dashboard panel. It should be linked with the specified Field and when entering a value in the visual element it would be filtered by this Field. The C… --- ## [Toggle in Line graph](https://discuss.elastic.co/t/toggle-in-line-graph/242822)
**Author:** [@nisargtest1](https://discuss.elastic.co/u/nisargtest1)\ **Replies:** 8\ **Last updated:** [July 31, 2020, 3:03pm UTC](https://discuss.elastic.co/t/toggle-in-line-graph/242822 "2020-07-31T15:03:30Z")
I want to put toggle in line graph, there are 16 lines in one graph and it is hard to visualize the data at a time. Is there any functionality through which I can toggle the visibility of lines. I am using Kiabana 7.4.2 … --- ## [Problem loading root cert filebeat on openshift](https://discuss.elastic.co/t/problem-loading-root-cert-filebeat-on-openshift/243364)
**Author:** [@mladen](https://discuss.elastic.co/u/mladen)\ **Replies:** 0\ **Last updated:** [July 31, 2020, 2:43pm UTC](https://discuss.elastic.co/t/problem-loading-root-cert-filebeat-on-openshift/243364 "2020-07-31T14:43:18Z")
Hello, I am trying to install filebeat on my three openshift worker nodes. Following docs I manged to install filebeat agents. In log I see the following error: 2020-07-31T14:05:31.350Z ERROR tlscommon/tls.go:145 Fail… --- ## [Unexpected token u in JSON at position 0](https://discuss.elastic.co/t/unexpected-token-u-in-json-at-position-0/243346)
**Author:** [@galvin1234](https://discuss.elastic.co/u/galvin1234)\ **Replies:** 1\ **Last updated:** [July 31, 2020, 2:25pm UTC](https://discuss.elastic.co/t/unexpected-token-u-in-json-at-position-0/243346 "2020-07-31T14:25:49Z")
before today everything was working perfectly, but now i started receiving below error. I am using Kibana 7.6.2 management ElasticIndex "number" : "7.6.2", SyntaxError: Unexpected token u in JSON at position 0 at JS… --- ## [Best practice for shipping logs from large amount of clients using logstash](https://discuss.elastic.co/t/best-practice-for-shipping-logs-from-large-amount-of-clients-using-logstash/243207)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 3\ **Last updated:** [July 31, 2020, 2:24pm UTC](https://discuss.elastic.co/t/best-practice-for-shipping-logs-from-large-amount-of-clients-using-logstash/243207 "2020-07-31T14:24:37Z")
Hi guys, I am looking for best practices for following use case: I have a lot of clients (linux vms) which going to ship logs (and maybe metrics) over logstash to elasticseach cluster. My idea is to create one index pe… --- ## [Optimum number of workers](https://discuss.elastic.co/t/optimum-number-of-workers/243324)
**Author:** [@Darshan\_Parab](https://discuss.elastic.co/u/Darshan_Parab)\ **Replies:** 1\ **Last updated:** [July 31, 2020, 2:22pm UTC](https://discuss.elastic.co/t/optimum-number-of-workers/243324 "2020-07-31T14:22:41Z")
Hello guys, I have a Kafka topic with 5 partitions. Assume I setup a 2 node Logstash cluster each with a pipeline to read from a Kafka topic, and each pipeline is assigned 4 worker nodes. Now what would be the number … --- ## [Scripted fields sort](https://discuss.elastic.co/t/scripted-fields-sort/243306)
**Author:** [@111369](https://discuss.elastic.co/u/111369)\ **Replies:** 1\ **Last updated:** [July 31, 2020, 1:57pm UTC](https://discuss.elastic.co/t/scripted-fields-sort/243306 "2020-07-31T13:57:15Z")
Hello, I've faced the following issue: I've created a script field which returns String type But when I try to make sorting on this field by the Kibana means there's an error "Error loading data \[script\_exceptio… --- ## [Calculate a percent between 2 views](https://discuss.elastic.co/t/calculate-a-percent-between-2-views/240831)
**Author:** [@Fred59](https://discuss.elastic.co/u/Fred59)\ **Replies:** 2\ **Last updated:** [July 31, 2020, 1:50pm UTC](https://discuss.elastic.co/t/calculate-a-percent-between-2-views/240831 "2020-07-31T13:50:26Z")
Hello, I'm on Kibana 6.8.10 I have 2 visualizes in metric: 5 metrics count (top 5 customer who contact me with the number of calls 1 metric count (total of customer's calls) I want to show a percentage of the addit… --- ## [Dynamic Template Not Working - float vs long - Metricbeat Windows Perfmon Counters](https://discuss.elastic.co/t/dynamic-template-not-working-float-vs-long-metricbeat-windows-perfmon-counters/243105)
**Author:** [@mazoutte](https://discuss.elastic.co/u/mazoutte)\ **Replies:** 1\ **Last updated:** [July 31, 2020, 1:28pm UTC](https://discuss.elastic.co/t/dynamic-template-not-working-float-vs-long-metricbeat-windows-perfmon-counters/243105 "2020-07-31T13:28:48Z")
Hello, I'm using ELK + Kafka. Version : 7.6.2 I'm monitoring Windows machines with Metricbeat and the perfmon module to get some counters. Here are some counters pulled (a lot of NTDS counters actually, just an exam… --- ## [Does Snmptrap input plugin of logstash support IPV6?](https://discuss.elastic.co/t/does-snmptrap-input-plugin-of-logstash-support-ipv6/243357)
**Author:** [@viveknagar](https://discuss.elastic.co/u/viveknagar)\ **Replies:** 0\ **Last updated:** [July 31, 2020, 1:13pm UTC](https://discuss.elastic.co/t/does-snmptrap-input-plugin-of-logstash-support-ipv6/243357 "2020-07-31T13:13:44Z")
Hello Everyone, I am using Snmptrap plugin of logstash to receive snmp traps. My configurations of snmptrap are below type =\> snmptrap host =\> '\[XXX.XXX.XXX.XXX.XXX.XXX.XXX.XXX\]' … --- ## [Kibana 7.8 maps does not recognize logstash index](https://discuss.elastic.co/t/kibana-7-8-maps-does-not-recognize-logstash-index/243294)
**Author:** [@smgh](https://discuss.elastic.co/u/smgh)\ **Replies:** 4\ **Last updated:** [July 31, 2020, 1:06pm UTC](https://discuss.elastic.co/t/kibana-7-8-maps-does-not-recognize-logstash-index/243294 "2020-07-31T13:06:37Z")
I have setup ELK stack on Ubuntu. My logstash config ingest my firewall logs. I am using geoip which works fine to locate public IP addresses. "fw" index has been created in Kibana and I can see the events including geoi… --- ## [Discover - ordering in text columns does not work](https://discuss.elastic.co/t/discover-ordering-in-text-columns-does-not-work/242073)
**Author:** [@Moretti\_Edmar](https://discuss.elastic.co/u/Moretti_Edmar)\ **Replies:** 2\ **Last updated:** [July 31, 2020, 12:50pm UTC](https://discuss.elastic.co/t/discover-ordering-in-text-columns-does-not-work/242073 "2020-07-31T12:50:29Z")
The option to sort fields does not work for text types. Upon inspecting the requisition, I noticed that the field type is marked as a number and should be as text. This error did not occur in version 7.5. 7.7: erro 7… --- ## [Issue with replacing @timestamp field with the timestamp from logs using date filter in logstash](https://discuss.elastic.co/t/issue-with-replacing-timestamp-field-with-the-timestamp-from-logs-using-date-filter-in-logstash/243176)
**Author:** [@saurabhsule82](https://discuss.elastic.co/u/saurabhsule82)\ **Replies:** 3\ **Last updated:** [July 31, 2020, 12:43pm UTC](https://discuss.elastic.co/t/issue-with-replacing-timestamp-field-with-the-timestamp-from-logs-using-date-filter-in-logstash/243176 "2020-07-31T12:43:37Z")
Hi, We are just learning to setup the ELK stack that includes Filebeats --\> Logstash --\> Elasticsearch \<-- Kibana. Filebeats on our server sends the logs to Logstash, which is configured to send it to Elasticsearch and … --- ## [Logstash wants JVM to use /proc/](https://discuss.elastic.co/t/logstash-wants-jvm-to-use-proc/243313)
**Author:** [@bn1980](https://discuss.elastic.co/u/bn1980)\ **Replies:** 0\ **Last updated:** [July 31, 2020, 6:41am UTC](https://discuss.elastic.co/t/logstash-wants-jvm-to-use-proc/243313 "2020-07-31T06:41:35Z")
Logstash wants JVM to access /procfs but it is not available in a FreeBSD Jail \> \[2020-07-31T14:32:10,897\]\[ERROR\]\[org.logstash.Logstash \] java.lang.InternalError: errno: 2 error: Unable to open /proc/curproc/map I… --- ## [Percentage shows top of line graph](https://discuss.elastic.co/t/percentage-shows-top-of-line-graph/240096)
**Author:** [@krille.com](https://discuss.elastic.co/u/krille.com)\ **Replies:** 10\ **Last updated:** [July 31, 2020, 12:36pm UTC](https://discuss.elastic.co/t/percentage-shows-top-of-line-graph/240096 "2020-07-31T12:36:59Z")
Is it possible to have the percentage lines showed over the Y-axis instead of the top of the graph? It look likes this now: Is it possible to have them like these lines instead? --- ## [Is it possible to show old logs(previous year) in the ELK a visualization?](https://discuss.elastic.co/t/is-it-possible-to-show-old-logs-previous-year-in-the-elk-a-visualization/242747)
**Author:** [@nikhilesh](https://discuss.elastic.co/u/nikhilesh)\ **Replies:** 8\ **Last updated:** [July 31, 2020, 12:36pm UTC](https://discuss.elastic.co/t/is-it-possible-to-show-old-logs-previous-year-in-the-elk-a-visualization/242747 "2020-07-31T12:36:11Z")
Hi Team, Below is the log message that have captured to the ELK from the server , i have configured the filebeat on july 24th ,the below date July 24th is the time and in message we have a logs of the year 2018. My req… --- ## [Logstash s3 input plugin specify dynamic prefix](https://discuss.elastic.co/t/logstash-s3-input-plugin-specify-dynamic-prefix/243353)
**Author:** [@Orest\_Gulman](https://discuss.elastic.co/u/Orest_Gulman)\ **Replies:** 0\ **Last updated:** [July 31, 2020, 12:35pm UTC](https://discuss.elastic.co/t/logstash-s3-input-plugin-specify-dynamic-prefix/243353 "2020-07-31T12:35:52Z")
Hi. I would like to use a dynamicaly changing path in prefix based on the current month and year, prefix =\> "elasticloadbalancing/region/YYYY/MM" input { s3 { access\_key\_id =\> "" secret\_access\_key =\> "38/" … --- ## [Logstash s3 input plugin file extension in prefix not working](https://discuss.elastic.co/t/logstash-s3-input-plugin-file-extension-in-prefix-not-working/243352)
**Author:** [@Orest\_Gulman](https://discuss.elastic.co/u/Orest_Gulman)\ **Replies:** 0\ **Last updated:** [July 31, 2020, 12:24pm UTC](https://discuss.elastic.co/t/logstash-s3-input-plugin-file-extension-in-prefix-not-working/243352 "2020-07-31T12:24:30Z")
Hi. I would like to specify a file extension that should be read by logstash. Below my config that I've tried and it's not working. input { s3 { access\_key\_id =\> "" secret\_access\_key =\> "" bucket =\> "log… --- ## [Elasticsearch node disk space?](https://discuss.elastic.co/t/elasticsearch-node-disk-space/242174)
**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Replies:** 7\ **Last updated:** [July 31, 2020, 12:24pm UTC](https://discuss.elastic.co/t/elasticsearch-node-disk-space/242174 "2020-07-31T12:24:27Z")
How much disk space should be given to : Dedicated Client Node Dedicated Kibana Node Will 10gb suffice? Currently the setup is, 3 Master node, 15 gb ram, 100Gb hard disk 4 Data node, 62 gb ram, 1tb hard disk 2 cli… --- ## [Filebeat not send logs to elasticsearch directly](https://discuss.elastic.co/t/filebeat-not-send-logs-to-elasticsearch-directly/238437)
**Author:** [@Andrew31](https://discuss.elastic.co/u/Andrew31)\ **Replies:** 4\ **Last updated:** [July 31, 2020, 12:12pm UTC](https://discuss.elastic.co/t/filebeat-not-send-logs-to-elasticsearch-directly/238437 "2020-07-31T12:12:24Z")
Hi I have install filebeat in a centos 7, not send to elasticsearch installed in other machine. Ports 9200 and 5601 is opened. The configs are this. --- ## [Number of events in logstash node stats on pipelines](https://discuss.elastic.co/t/number-of-events-in-logstash-node-stats-on-pipelines/243345)
**Author:** [@benvl](https://discuss.elastic.co/u/benvl)\ **Replies:** 0\ **Last updated:** [July 31, 2020, 11:48am UTC](https://discuss.elastic.co/t/number-of-events-in-logstash-node-stats-on-pipelines/243345 "2020-07-31T11:48:55Z")
Hi, when viewing logstash node stats, in particular the number of events. then I get reasonable high numbers on the 'in' and 'out' values. Eg. on a logstash 6.7 # curl -s -XGET 'localhost:9600/\_node/stats/pipelines'… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1893) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1895)