# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1896 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1897 --- ## [How to visualise syslog reporting data deltas](https://discuss.elastic.co/t/how-to-visualise-syslog-reporting-data-deltas/242753)
**Author:** [@nisaxena](https://discuss.elastic.co/u/nisaxena)\ **Replies:** 1\ **Last updated:** [July 30, 2020, 9:30pm UTC](https://discuss.elastic.co/t/how-to-visualise-syslog-reporting-data-deltas/242753 "2020-07-30T21:30:35Z")
Hi There, I am new to ELK, so need suggestion on visualisation of rsyslog data. I am continuously ingesting rsyslog data from multiple rsyslog servers to my ELK stack. What I wish to have is, a view wherein I can have a… --- ## [Is Kibana Space causing long time to load?](https://discuss.elastic.co/t/is-kibana-space-causing-long-time-to-load/242931)
**Author:** [@stongia](https://discuss.elastic.co/u/stongia)\ **Replies:** 1\ **Last updated:** [July 30, 2020, 9:18pm UTC](https://discuss.elastic.co/t/is-kibana-space-causing-long-time-to-load/242931 "2020-07-30T21:18:04Z")
In our Kibana setup we are creating multiple space (8 to be specific) and adding dashboards to it. When we load those dashboard as embedded link in Iframe of our application, dashboard are taking long time to load. Want… --- ## [Create a bar chart that shows the number of empty fields compared with the total number of records](https://discuss.elastic.co/t/create-a-bar-chart-that-shows-the-number-of-empty-fields-compared-with-the-total-number-of-records/243107)
**Author:** [@dandcp](https://discuss.elastic.co/u/dandcp)\ **Replies:** 1\ **Last updated:** [July 30, 2020, 9:15pm UTC](https://discuss.elastic.co/t/create-a-bar-chart-that-shows-the-number-of-empty-fields-compared-with-the-total-number-of-records/243107 "2020-07-30T21:15:48Z")
I know I can do this using Vega, and I also am fairly confident I can solve this using scripted fields, but I'm curious if I'm doing this the wrong way and making something that should be really, really easy much harder. … --- ## [How to find last element of array in logstash](https://discuss.elastic.co/t/how-to-find-last-element-of-array-in-logstash/243276)
**Author:** [@Rakesh\_Katakam](https://discuss.elastic.co/u/Rakesh_Katakam)\ **Replies:** 4\ **Last updated:** [July 30, 2020, 8:44pm UTC](https://discuss.elastic.co/t/how-to-find-last-element-of-array-in-logstash/243276 "2020-07-30T20:44:10Z")
Hi, I am trying to split string and add a new event with last index as value. Here below is code snippet which I am trying. Could someone please help me out on the same. Input : eqdomain/eqlogs/abc/hyper.log Script: … --- ## [New Platform - is it possible to use modules from the legacy platform?](https://discuss.elastic.co/t/new-platform-is-it-possible-to-use-modules-from-the-legacy-platform/243208)
**Author:** [@AndreaTosti](https://discuss.elastic.co/u/AndreaTosti)\ **Replies:** 1\ **Last updated:** [July 30, 2020, 8:33pm UTC](https://discuss.elastic.co/t/new-platform-is-it-possible-to-use-modules-from-the-legacy-platform/243208 "2020-07-30T20:33:57Z")
I want to migrate my plugin to the new platform and I generated the skeleton using https://github.com/elastic/kibana/tree/master/packages/kbn-plugin-generator. I have encountered two anomalies: On 7.7.0, after inserti… --- ## [Why Can't Histogram Interval Be Decimal](https://discuss.elastic.co/t/why-cant-histogram-interval-be-decimal/243146)
**Author:** [@Ethan777100](https://discuss.elastic.co/u/Ethan777100)\ **Replies:** 0\ **Last updated:** [July 30, 2020, 3:04am UTC](https://discuss.elastic.co/t/why-cant-histogram-interval-be-decimal/243146 "2020-07-30T03:04:25Z")
Continuing the discussion from Histogram interval: I disagree with the constraint that the interval must be a decimal. I have a use case whose data is time duration which nominally falls between 0-5seconds. i also wann… --- ## [Embed Dashboard on external web page with search](https://discuss.elastic.co/t/embed-dashboard-on-external-web-page-with-search/242972)
**Author:** [@Jana](https://discuss.elastic.co/u/Jana)\ **Replies:** 2\ **Last updated:** [July 30, 2020, 8:17pm UTC](https://discuss.elastic.co/t/embed-dashboard-on-external-web-page-with-search/242972 "2020-07-30T20:17:25Z")
Hi, I want to embed a kibana dashboard on an external html page. To do this I took the dashboard as iframe code via 'Share' and created the following simple page: \ \ \ \ **Author:** [@issaissa](https://discuss.elastic.co/u/issaissa)\ **Replies:** 3\ **Last updated:** [July 30, 2020, 8:08pm UTC](https://discuss.elastic.co/t/preserve-heights-order-of-the-rectangles-when-i-use-time-based-axis/240115 "2020-07-30T20:08:30Z") I am working on this project where I defined the following scales as follows: "scales": \[ { "name": "xtime", "type": "band", "range":"width", "round": true, "domain": {"data": "events… --- ## [Possible snapshot bug v7.8.0](https://discuss.elastic.co/t/possible-snapshot-bug-v7-8-0/243280)
**Author:** [@Siqi\_Deng](https://discuss.elastic.co/u/Siqi_Deng)\ **Replies:** 0\ **Last updated:** [July 30, 2020, 8:01pm UTC](https://discuss.elastic.co/t/possible-snapshot-bug-v7-8-0/243280 "2020-07-30T20:01:36Z")
Hi, I try to create a snapshot of five indices via the Kibana dev\_tools like below PUT \_snapshot/shrink-cori-syslog/shrink-cori-syslog\_2020-04-24\_2020-04-29 { "indices": "shrink-cori-syslog-000101,shrink-cori-syslog-… --- ## [Metricbeat / Filebeat blocked by Gatekeeper on macOS Catalina](https://discuss.elastic.co/t/metricbeat-filebeat-blocked-by-gatekeeper-on-macos-catalina/243279)
**Author:** [@djune](https://discuss.elastic.co/u/djune)\ **Replies:** 0\ **Last updated:** [July 30, 2020, 8:01pm UTC](https://discuss.elastic.co/t/metricbeat-filebeat-blocked-by-gatekeeper-on-macos-catalina/243279 "2020-07-30T20:01:34Z")
Attempting to upgrade from 7.6.2 to 7.8.0 (or 7.8.1) and running into issues with Gatekeeper blocking metricbeat and filebeat from loading on boot. Both are able to launch manually with ./metricbeat -e and ./filebeat -e … --- ## [Kibana Calculate increase of Metric value](https://discuss.elastic.co/t/kibana-calculate-increase-of-metric-value/243179)
**Author:** [@sout13](https://discuss.elastic.co/u/sout13)\ **Replies:** 1\ **Last updated:** [July 30, 2020, 8:01pm UTC](https://discuss.elastic.co/t/kibana-calculate-increase-of-metric-value/243179 "2020-07-30T20:01:20Z")
Hello, I am just starting to use Elasticsearch and Kibana. Was able to get a cumulative matric into elasticsearch, but are struggling to visualize or get my head around visualizing the increase of the value for set time… --- ## [Matching field with response](https://discuss.elastic.co/t/matching-field-with-response/243257)
**Author:** [@Eknoor](https://discuss.elastic.co/u/Eknoor)\ **Replies:** 1\ **Last updated:** [July 30, 2020, 7:55pm UTC](https://discuss.elastic.co/t/matching-field-with-response/243257 "2020-07-30T19:55:19Z")
Is there any way to get the field matched in response? Specifically any indication in response that with which field the query is matched?? Using elasticsearch 7.7.1 --- ## [Filebeat not sending Apache logs to Logstash](https://discuss.elastic.co/t/filebeat-not-sending-apache-logs-to-logstash/243118)
**Author:** [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\ **Replies:** 4\ **Last updated:** [July 30, 2020, 7:53pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-apache-logs-to-logstash/243118 "2020-07-30T19:53:08Z")
Hello, All, I have an issue where I have filebeat installed on my apache server with the following config: filebeat: prospectors: - enabled: true backoff: 1s backoff\_factor: 2 clean\_inactive: 0 … --- ## [Lots of empty fields in expanded document view](https://discuss.elastic.co/t/lots-of-empty-fields-in-expanded-document-view/243271)
**Author:** [@opoplawski](https://discuss.elastic.co/u/opoplawski)\ **Replies:** 1\ **Last updated:** [July 30, 2020, 7:49pm UTC](https://discuss.elastic.co/t/lots-of-empty-fields-in-expanded-document-view/243271 "2020-07-30T19:49:20Z")
This behavior seems fairly new with a recent kibana or other update - when looking at the expanded document for an item in the discover list I see lots of empty fields. Apparently these are “date\_time” fields that kib… --- ## [Elasticsearch Master Node JVM reaching 99%](https://discuss.elastic.co/t/elasticsearch-master-node-jvm-reaching-99/241907)
**Author:** [@rsmith013](https://discuss.elastic.co/u/rsmith013)\ **Replies:** 7\ **Last updated:** [July 30, 2020, 6:48pm UTC](https://discuss.elastic.co/t/elasticsearch-master-node-jvm-reaching-99/241907 "2020-07-30T18:48:28Z")
I am running a 3 Master 8 Data node cluster. Elasticsearch Version 7.8.0 The cluster bumps along happily for several days with the regular sawtooth JVM pattern then suddenly ramps up and then hits 99%. This leads to… --- ## [Loop through results and update another index](https://discuss.elastic.co/t/loop-through-results-and-update-another-index/243260)
**Author:** [@msf127](https://discuss.elastic.co/u/msf127)\ **Replies:** 1\ **Last updated:** [July 30, 2020, 6:31pm UTC](https://discuss.elastic.co/t/loop-through-results-and-update-another-index/243260 "2020-07-30T18:31:15Z")
Is it possible to loop through the results of a query and update (add a scripted field in) another index based on data within the result set? Another way to think about this is updating an index with a lookup value from… --- ## [Full Screen by default](https://discuss.elastic.co/t/full-screen-by-default/242942)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 6\ **Last updated:** [July 30, 2020, 4:36pm UTC](https://discuss.elastic.co/t/full-screen-by-default/242942 "2020-07-30T16:36:59Z")
Hi, Is there a way to set "Full screen" mode as default for a dashboard? The goal is that every time we call the dashboard, it will open in full screen mode, without having to click on the button. A way to obtain a sha… --- ## [Logstash multi-pipeline output failure breaks other pipelines](https://discuss.elastic.co/t/logstash-multi-pipeline-output-failure-breaks-other-pipelines/243246)
**Author:** [@Dave\_Waters](https://discuss.elastic.co/u/Dave_Waters)\ **Replies:** 2\ **Last updated:** [July 30, 2020, 6:15pm UTC](https://discuss.elastic.co/t/logstash-multi-pipeline-output-failure-breaks-other-pipelines/243246 "2020-07-30T18:15:15Z")
Running Logstash 7.8.1 Multi pipelines Pipeline A output to B and C B output to ES cluster 1 C output to ES cluster 2 Shutdown ES cluster 1 Error from output attempt to send bulk request... normal error when ES is … --- ## [Logstash csv filter plugin, with mariadb audit plugin logs](https://discuss.elastic.co/t/logstash-csv-filter-plugin-with-mariadb-audit-plugin-logs/242953)
**Author:** [@fabrizio73](https://discuss.elastic.co/u/fabrizio73)\ **Replies:** 6\ **Last updated:** [July 30, 2020, 5:29pm UTC](https://discuss.elastic.co/t/logstash-csv-filter-plugin-with-mariadb-audit-plugin-logs/242953 "2020-07-30T17:29:32Z")
Hi, we are develeping our log management ELK Platform, and we managed almost everything we need in order to get logs with filebeat from percona, mariadb, ssh and SAMBA4 ADC access. The only issue we are facing is that lo… --- ## [Stemmer for keyword-fields before index](https://discuss.elastic.co/t/stemmer-for-keyword-fields-before-index/243231)
**Author:** [@Arol](https://discuss.elastic.co/u/Arol)\ **Replies:** 4\ **Last updated:** [July 30, 2020, 5:28pm UTC](https://discuss.elastic.co/t/stemmer-for-keyword-fields-before-index/243231 "2020-07-30T17:28:48Z")
Salut. I have field "Title". I use this field for aggregations, including building in the Kibana Tags Cloud, so the field is declared as a keyword. In this field, I write the title text, where each word is an array ele… --- ## [Log rotation script for logstash/elasticsearch logs](https://discuss.elastic.co/t/log-rotation-script-for-logstash-elasticsearch-logs/243214)
**Author:** [@pkshara](https://discuss.elastic.co/u/pkshara)\ **Replies:** 1\ **Last updated:** [July 30, 2020, 5:25pm UTC](https://discuss.elastic.co/t/log-rotation-script-for-logstash-elasticsearch-logs/243214 "2020-07-30T17:25:34Z")
Hi Team, I am trying to understand the log rotation scripts for logstash/elasticsearch enabled by default. however i cannot find any logrotate script in servers. Can you please explain, what is the default log rotation… --- ## [Logstash - Filter.Aggregate - push\_map\_as\_event\_on\_timeout not happening](https://discuss.elastic.co/t/logstash-filter-aggregate-push-map-as-event-on-timeout-not-happening/243044)
**Author:** [@GitsBdr](https://discuss.elastic.co/u/GitsBdr)\ **Replies:** 3\ **Last updated:** [July 30, 2020, 5:17pm UTC](https://discuss.elastic.co/t/logstash-filter-aggregate-push-map-as-event-on-timeout-not-happening/243044 "2020-07-30T17:17:53Z")
Hi there, Thanks in advance for your time I'm trying to use filter { aggregate { } } while reading/parsing an old log file Into this log file, every second, there is a block of statistics generated that I'd like to ag… --- ## [High\_min & low\_max functions - feature request?](https://discuss.elastic.co/t/high-min-low-max-functions-feature-request/242567)
**Author:** [@cosruss](https://discuss.elastic.co/u/cosruss)\ **Replies:** 1\ **Last updated:** [July 30, 2020, 4:58pm UTC](https://discuss.elastic.co/t/high-min-low-max-functions-feature-request/242567 "2020-07-30T16:58:23Z")
The current detector functions for min and max only look for anomalies in unusually low mins and unusually high maxes. It would be useful to have high\_min and low\_max detector functions. This allows detection on how high… --- ## [Can Filebeat creating multiple logging files](https://discuss.elastic.co/t/can-filebeat-creating-multiple-logging-files/242460)
**Author:** [@vijayjavaprgmr](https://discuss.elastic.co/u/vijayjavaprgmr)\ **Replies:** 2\ **Last updated:** [July 30, 2020, 4:52pm UTC](https://discuss.elastic.co/t/can-filebeat-creating-multiple-logging-files/242460 "2020-07-30T16:52:50Z")
Hi Team, I am currently using Filebeat 7.6.2. could like to monitor the filebeat logging logs and want to write if any error during filebeat process then error logs need to writes in separate log file ex. \[filebeat\_erro… --- ## [Filebeat encryption error](https://discuss.elastic.co/t/filebeat-encryption-error/243227)
**Author:** [@elk6](https://discuss.elastic.co/u/elk6)\ **Replies:** 4\ **Last updated:** [July 30, 2020, 4:32pm UTC](https://discuss.elastic.co/t/filebeat-encryption-error/243227 "2020-07-30T16:32:32Z")
I'm trying to get filebeat to send encrypted data to logstash. In filebeat.yml, this is my output.logstash: output.logstash: hosts: \["91.242.11.220:5044"\] # Not the real IP ssl.enabled: true ssl.certificate\_autho… --- ## [Can you answer these ELK questions?](https://discuss.elastic.co/t/can-you-answer-these-elk-questions/243047)
**Author:** [@myrsecurity](https://discuss.elastic.co/u/myrsecurity)\ **Replies:** 5\ **Last updated:** [July 30, 2020, 3:38pm UTC](https://discuss.elastic.co/t/can-you-answer-these-elk-questions/243047 "2020-07-30T15:38:40Z")
Given the following use case: Filebeat and Metricbeat installed on 10 centos. Each centos location represents a different customer (tenant): Topology and authentication Can we authenticate each feed and make sure tha… --- ## [Potential bug in painless execute API since 7.5](https://discuss.elastic.co/t/potential-bug-in-painless-execute-api-since-7-5/242760)
**Author:** [@Denne](https://discuss.elastic.co/u/Denne)\ **Replies:** 1\ **Last updated:** [July 30, 2020, 3:33pm UTC](https://discuss.elastic.co/t/potential-bug-in-painless-execute-api-since-7-5/242760 "2020-07-30T15:33:12Z")
I'm getting a strange error when using the painless execute API with cosineSimilarity. This only happens with version 7.5+. With version 7.4 this is not happening for me. Here a minimal working example that uses the exa… --- ## [Duplicate Entries in Filebeat Registry File For Kubernetes Pod Restart](https://discuss.elastic.co/t/duplicate-entries-in-filebeat-registry-file-for-kubernetes-pod-restart/242564)
**Author:** [@pulkit007](https://discuss.elastic.co/u/pulkit007)\ **Replies:** 5\ **Last updated:** [July 30, 2020, 3:23pm UTC](https://discuss.elastic.co/t/duplicate-entries-in-filebeat-registry-file-for-kubernetes-pod-restart/242564 "2020-07-30T15:23:07Z")
Hi, I am running filebeat in a Docker Container on Kubernetes Cluster for Processing Logs of our Application and send them to Logstash. Our Log Data is stored in PV, so I ran only one pod of filebeat that takes logs fro… --- ## [Secure filebeat to logstash](https://discuss.elastic.co/t/secure-filebeat-to-logstash/242899)
**Author:** [@elk6](https://discuss.elastic.co/u/elk6)\ **Replies:** 21\ **Last updated:** [July 30, 2020, 3:06pm UTC](https://discuss.elastic.co/t/secure-filebeat-to-logstash/242899 "2020-07-30T15:06:31Z")
I was tasked to secure the whole elastic flow and was able to secure the logstash-elasticsearch-kibana flow. I'm now having some trouble encrypting filebeat to logstash (It's the last step). According to the "secure fil… --- ## [Metric not being visualising in Gauge graph](https://discuss.elastic.co/t/metric-not-being-visualising-in-gauge-graph/241865)
**Author:** [@jimmyvalmer19](https://discuss.elastic.co/u/jimmyvalmer19)\ **Replies:** 2\ **Last updated:** [July 30, 2020, 2:38pm UTC](https://discuss.elastic.co/t/metric-not-being-visualising-in-gauge-graph/241865 "2020-07-30T14:38:32Z")
Hi there, I'm having issues in my gauge visualization. It does't react on the metrict at all - it stays at 0. I use stress feature to stress 2 cores of my CPU at max. This gives me 50% CPU usage at the moment, cause I … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1895) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1897)