# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1897 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1898 --- ## [Logstash - Syslog Output - Custom message](https://discuss.elastic.co/t/logstash-syslog-output-custom-message/240979)
**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\ **Replies:** 7\ **Last updated:** [July 30, 2020, 2:37pm UTC](https://discuss.elastic.co/t/logstash-syslog-output-custom-message/240979 "2020-07-30T14:37:23Z")
Hi, I'm working with Logstash - Syslog Output and I've found problem with custom field message. I'm using Elasticstack 7.8.0. I've installed logstash syslog-output plugin. /usr/share/logstash/bin/logstash-plugin insta… --- ## [URL Reformatting in Kibana Visualization](https://discuss.elastic.co/t/url-reformatting-in-kibana-visualization/243236)
**Author:** [@stellarwinds1](https://discuss.elastic.co/u/stellarwinds1)\ **Replies:** 1\ **Last updated:** [July 30, 2020, 2:27pm UTC](https://discuss.elastic.co/t/url-reformatting-in-kibana-visualization/243236 "2020-07-30T14:27:22Z")
Hi, In our logs we have the API being captured as something like GET:/xxx/yyy/carts/c3ui34u/status and GET:/xxx/yyy/carts/3j32j4l/status etc. i.e. the specific cartID is part of the API. So, while doing the aggregations… --- ## [Filebeat Index Template from Modules](https://discuss.elastic.co/t/filebeat-index-template-from-modules/242660)
**Author:** [@tactics](https://discuss.elastic.co/u/tactics)\ **Replies:** 5\ **Last updated:** [July 30, 2020, 2:21pm UTC](https://discuss.elastic.co/t/filebeat-index-template-from-modules/242660 "2020-07-30T14:21:16Z")
Hi, Not sure if I am overcomplicating things and bothering unnecessarily... I have finally got apache logs importing nicely using Filebeat and the Apache module. I am simply using the fields.yml and therefore the inde… --- ## [Kibana not showing filter values in the add filter section on ubuntu server](https://discuss.elastic.co/t/kibana-not-showing-filter-values-in-the-add-filter-section-on-ubuntu-server/243201)
**Author:** [@hemant\_472](https://discuss.elastic.co/u/hemant_472)\ **Replies:** 1\ **Last updated:** [July 30, 2020, 1:48pm UTC](https://discuss.elastic.co/t/kibana-not-showing-filter-values-in-the-add-filter-section-on-ubuntu-server/243201 "2020-07-30T13:48:18Z")
I am not able to see the filter value in kibana when using it as a service on an ubuntu server like below - someone please suggest how i can see values in here, i tried refreshing m index as well --- ## [Kubernetes - Packetbeat implitation](https://discuss.elastic.co/t/kubernetes-packetbeat-implitation/243230)
**Author:** [@chopper20](https://discuss.elastic.co/u/chopper20)\ **Replies:** 0\ **Last updated:** [July 30, 2020, 1:46pm UTC](https://discuss.elastic.co/t/kubernetes-packetbeat-implitation/243230 "2020-07-30T13:46:17Z")
I am trying to implement packetbeat for specific services in Kubernetes (EKS cluster) but I am unable to get proper metrics. Issues: Unable to get desired index name. the default index is packetbeat-7.8.1-2020.07.30… --- ## [Query takes to much time in elastic compare to sphinx](https://discuss.elastic.co/t/query-takes-to-much-time-in-elastic-compare-to-sphinx/243032)
**Author:** [@KrishK](https://discuss.elastic.co/u/KrishK)\ **Replies:** 4\ **Last updated:** [July 30, 2020, 1:06pm UTC](https://discuss.elastic.co/t/query-takes-to-much-time-in-elastic-compare-to-sphinx/243032 "2020-07-30T13:06:38Z")
Hi Support, We moved Sphinx to ElasticSearch. Elastic and Sphinx server configuration is the same. OS: Ubuntu 18.04 RAM: 60GB(50% occupied Elastic) Disc : 2TB Processor: 4 Core Elastic Configuration: ELK - 7.7.X W… --- ## [Unable to join to my new cluster](https://discuss.elastic.co/t/unable-to-join-to-my-new-cluster/240321)
**Author:** [@hgpit](https://discuss.elastic.co/u/hgpit)\ **Replies:** 1\ **Last updated:** [July 30, 2020, 1:03pm UTC](https://discuss.elastic.co/t/unable-to-join-to-my-new-cluster/240321 "2020-07-30T13:03:39Z")
Hello, We are very inexperienced with ES, so we imagine we are just overlooking something simple. We have built two machines, running ES (OSS) 7.8. Hostname: g000057.domain.com, IP: 10.40.1.62, Node name: g000057 Hos… --- ## [Error in visualisation \[esaggs\] \> Internal Server Error ELK 7.8](https://discuss.elastic.co/t/error-in-visualisation-esaggs-internal-server-error-elk-7-8/243217)
**Author:** [@Feriel\_Mufti](https://discuss.elastic.co/u/Feriel_Mufti)\ **Replies:** 1\ **Last updated:** [July 30, 2020, 12:59pm UTC](https://discuss.elastic.co/t/error-in-visualisation-esaggs-internal-server-error-elk-7-8/243217 "2020-07-30T12:59:30Z")
Hello , i am using Elasricsearch and kibana 7.8 , while trying to vizualise filebeat pie chart using aggregation it shows this errror : Error in visualisation \[esaggs\] \> Internal Server Error , what is the problem and … --- ## [Elapsed filter - keeps crashing](https://discuss.elastic.co/t/elapsed-filter-keeps-crashing/243215)
**Author:** [@Tommie](https://discuss.elastic.co/u/Tommie)\ **Replies:** 0\ **Last updated:** [July 30, 2020, 12:19pm UTC](https://discuss.elastic.co/t/elapsed-filter-keeps-crashing/243215 "2020-07-30T12:19:52Z")
Can anyone please help me with the following: This logstash config is working fine (only with the elapsed part commented): filter { csv { separator =\> "|" columns =\> \[ "datum","level","uniek","mes… --- ## [Unable to connect to slack from elastic notification alerting](https://discuss.elastic.co/t/unable-to-connect-to-slack-from-elastic-notification-alerting/242539)
**Author:** [@A\_Mightiev](https://discuss.elastic.co/u/A_Mightiev)\ **Replies:** 2\ **Last updated:** [July 30, 2020, 12:14pm UTC](https://discuss.elastic.co/t/unable-to-connect-to-slack-from-elastic-notification-alerting/242539 "2020-07-30T12:14:39Z")
I have an issue connecting to slack from elasticsearch action notifications. to access https from the node, I need to use a proxy i.e. if I do a \[\]# curl -v https://hooks.slack.com -x http://proxy.domain.com:5050 \* … --- ## [How to parse Proxmox log format?](https://discuss.elastic.co/t/how-to-parse-proxmox-log-format/243089)
**Author:** [@gmbynkrkrqz](https://discuss.elastic.co/u/gmbynkrkrqz)\ **Replies:** 2\ **Last updated:** [July 30, 2020, 12:04pm UTC](https://discuss.elastic.co/t/how-to-parse-proxmox-log-format/243089 "2020-07-30T12:04:50Z")
Hello, I would like to store all my Proxmox logs in Elasticsearch. I know there are Groks and I already use its for some other logs. However, as you can see below, the log format is often different : the fields are not … --- ## [Iterate\_on in Logstash no working properly](https://discuss.elastic.co/t/iterate-on-in-logstash-no-working-properly/243091)
**Author:** [@tasipasin](https://discuss.elastic.co/u/tasipasin)\ **Replies:** 2\ **Last updated:** [July 30, 2020, 12:04pm UTC](https://discuss.elastic.co/t/iterate-on-in-logstash-no-working-properly/243091 "2020-07-30T12:04:17Z")
I don't know if I'm using this wrongly or if it's a problem with the filter, but, I have the following structure: { ..., "eventDataSplit" =\> { "1" =\> { "valueKey" : "1.1.1" }, "2" =\> { "valueKey" : "2.1.1" }, "… --- ## [Boost 5.x -\> 7.x migartion performance for Gbs of data (C# Nest)](https://discuss.elastic.co/t/boost-5-x-7-x-migartion-performance-for-gbs-of-data-c-nest/243212)
**Author:** [@yBother](https://discuss.elastic.co/u/yBother)\ **Replies:** 0\ **Last updated:** [July 30, 2020, 11:55am UTC](https://discuss.elastic.co/t/boost-5-x-7-x-migartion-performance-for-gbs-of-data-c-nest/243212 "2020-07-30T11:55:51Z")
I need to migrate existing ES data from version 5.2.2 to 7.6.0. I do that by reindexing index per index to V6 and then bulk inserting index per index to a new created index and then delete the source index. I cannot us… --- ## [How to create a default index pattern via python api](https://discuss.elastic.co/t/how-to-create-a-default-index-pattern-via-python-api/243085)
**Author:** [@momora9809](https://discuss.elastic.co/u/momora9809)\ **Replies:** 9\ **Last updated:** [July 30, 2020, 11:42am UTC](https://discuss.elastic.co/t/how-to-create-a-default-index-pattern-via-python-api/243085 "2020-07-30T11:42:36Z")
Hi, I saw How to create a default index pattern via kibana api that used Kibana API. I wanted to use python, but didn't know what uri should I use. header = { "kbn-xsrf": "true", 'Content-Type': 'application/j… --- ## [Filebeat directly to Elastic ingest node](https://discuss.elastic.co/t/filebeat-directly-to-elastic-ingest-node/243194)
**Author:** [@Axellurcher](https://discuss.elastic.co/u/Axellurcher)\ **Replies:** 1\ **Last updated:** [July 30, 2020, 11:34am UTC](https://discuss.elastic.co/t/filebeat-directly-to-elastic-ingest-node/243194 "2020-07-30T11:34:00Z")
I am pretty new to ELK so some actions and questions could be simple. We are sending logs directly from Filebeats to Elasticsearch without Logstash. Logs can contain JSON in different fields that also need to be parsed… --- ## [Field is not renaming](https://discuss.elastic.co/t/field-is-not-renaming/243026)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 5\ **Last updated:** [July 29, 2020, 12:19pm UTC](https://discuss.elastic.co/t/field-is-not-renaming/243026 "2020-07-29T12:19:43Z")
I am using winlogbeat and i want to create an index which stores user sessions info. but i am doing this step by step that is i am storing successfull login of user. Everything is going good but now i am facing some prob… --- ## [Need help in listing syslog data (10000 +)](https://discuss.elastic.co/t/need-help-in-listing-syslog-data-10000/242902)
**Author:** [@nisaxena](https://discuss.elastic.co/u/nisaxena)\ **Replies:** 4\ **Last updated:** [July 30, 2020, 10:27am UTC](https://discuss.elastic.co/t/need-help-in-listing-syslog-data-10000/242902 "2020-07-30T10:27:11Z")
Hi There, I am new to ELK and need help. I am working on syslog data collected from all zonal rsyslog servers. Now I am putting some visualization to this data. there are around 10000+ unique hosts data collected everyd… --- ## [How to remove certain fields from filebeat index](https://discuss.elastic.co/t/how-to-remove-certain-fields-from-filebeat-index/241597)
**Author:** [@jijo.john](https://discuss.elastic.co/u/jijo.john)\ **Replies:** 5\ **Last updated:** [July 30, 2020, 10:16am UTC](https://discuss.elastic.co/t/how-to-remove-certain-fields-from-filebeat-index/241597 "2020-07-30T10:16:04Z")
Hi Team, I am new to Elasticsearch and we are running a POC on Elasticsearch. We would like to remove few fields from the index documents which are not relevant. Please help us to remove this from newly creating index … --- ## [How to add time of ingestion to the document?](https://discuss.elastic.co/t/how-to-add-time-of-ingestion-to-the-document/243042)
**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\ **Replies:** 2\ **Last updated:** [July 30, 2020, 10:02am UTC](https://discuss.elastic.co/t/how-to-add-time-of-ingestion-to-the-document/243042 "2020-07-30T10:02:30Z")
Hi Elasticians, I've created pipeline pipeline\_add\_ingest\_timestamp. I would like to achieve add time of ingesting by elasticsearch to the document using this pipeline. What am I doing wrong? The field is not populate t… --- ## [Elasticsearch Gradle build failed: PKIX path building failed](https://discuss.elastic.co/t/elasticsearch-gradle-build-failed-pkix-path-building-failed/243195)
**Author:** [@Crab2died](https://discuss.elastic.co/u/Crab2died)\ **Replies:** 0\ **Last updated:** [July 30, 2020, 9:55am UTC](https://discuss.elastic.co/t/elasticsearch-gradle-build-failed-pkix-path-building-failed/243195 "2020-07-30T09:55:14Z")
P1: git clone GitHub - elastic/elasticsearch: Free and Open, Distributed, RESTful Search Engine elasticsearch P2: import https://jcenter.bintray.com certification to JAVA\_HOME/lib/security/cacerts I'm sure the certi… --- ## [Watcher - formatting the description field in jira action](https://discuss.elastic.co/t/watcher-formatting-the-description-field-in-jira-action/240009)
**Author:** [@norgro2601](https://discuss.elastic.co/u/norgro2601)\ **Replies:** 3\ **Last updated:** [July 30, 2020, 9:52am UTC](https://discuss.elastic.co/t/watcher-formatting-the-description-field-in-jira-action/240009 "2020-07-30T09:52:30Z")
Hi, I try to format the description field in jira out of a watcher with different styles, bold text and so on. I've found no documentation, if this is possible and if it is, what I could use. Does anybody know if it is… --- ## [Filebeat not creating index daily](https://discuss.elastic.co/t/filebeat-not-creating-index-daily/243181)
**Author:** [@daniel\_fablius](https://discuss.elastic.co/u/daniel_fablius)\ **Replies:** 5\ **Last updated:** [July 30, 2020, 9:37am UTC](https://discuss.elastic.co/t/filebeat-not-creating-index-daily/243181 "2020-07-30T09:37:29Z")
Hi, so i use filebeat to send logs to Elasticsearch and i see an index is created with name "filebeat-7.7.1-2020.07.29-000002" i assume that filebeat will keep creating a new index based on the datetime of the data eve… --- ## [In-between Query for IP data type](https://discuss.elastic.co/t/in-between-query-for-ip-data-type/242882)
**Author:** [@shankarlogs](https://discuss.elastic.co/u/shankarlogs)\ **Replies:** 12\ **Last updated:** [July 30, 2020, 9:19am UTC](https://discuss.elastic.co/t/in-between-query-for-ip-data-type/242882 "2020-07-30T09:19:14Z")
I need to understand how to create in-between query for IP datatype. I need a specific example for IPv6 addresses --- ## [Query a range of values in phrase](https://discuss.elastic.co/t/query-a-range-of-values-in-phrase/242621)
**Author:** [@Sahithi\_Muddasani](https://discuss.elastic.co/u/Sahithi_Muddasani)\ **Replies:** 6\ **Last updated:** [July 30, 2020, 9:22am UTC](https://discuss.elastic.co/t/query-a-range-of-values-in-phrase/242621 "2020-07-30T09:22:33Z")
Hi I already have a log in the message field as below Message:Info matched and sent Http/1.2 200(345). Message:Info mismatch http/1.2 404(21) The value 200 is the status , but I don't have it in a separate field. How… --- ## [Change default for "index\_options"](https://discuss.elastic.co/t/change-default-for-index-options/243191)
**Author:** [@YvorL](https://discuss.elastic.co/u/YvorL)\ **Replies:** 0\ **Last updated:** [July 30, 2020, 9:21am UTC](https://discuss.elastic.co/t/change-default-for-index-options/243191 "2020-07-30T09:21:49Z")
Hi, I'm trying to get rid of anything unnecessary in my cluster and want to change the default for "index\_options", from positions to docs. At least generally on an index level. I don't have any query that'd benefit fro… --- ## [Filebeat resent all events of a logfile - every day](https://discuss.elastic.co/t/filebeat-resent-all-events-of-a-logfile-every-day/242478)
**Author:** [@scheffler](https://discuss.elastic.co/u/scheffler)\ **Replies:** 9\ **Last updated:** [July 30, 2020, 8:57am UTC](https://discuss.elastic.co/t/filebeat-resent-all-events-of-a-logfile-every-day/242478 "2020-07-30T08:57:43Z")
Hi The logfile has always the same name, but a housekeeping job copy and zip the file every night, with the side effect that the file gets a new inode. I guess that the inode is harvesters primary key in the registry an… --- ## [Out of the box Refiners](https://discuss.elastic.co/t/out-of-the-box-refiners/242716)
**Author:** [@aakhiezer](https://discuss.elastic.co/u/aakhiezer)\ **Replies:** 2\ **Last updated:** [July 30, 2020, 8:48am UTC](https://discuss.elastic.co/t/out-of-the-box-refiners/242716 "2020-07-30T08:48:56Z")
I'm pretty new at elastic and I'm wondering is there out of the box feature of Refiners, like in SharePoint search? Thanks a lot! --- ## [Logstash Filebeat module Configuration - No data has been received from this module yet](https://discuss.elastic.co/t/logstash-filebeat-module-configuration-no-data-has-been-received-from-this-module-yet/242990)
**Author:** [@GraceYu](https://discuss.elastic.co/u/GraceYu)\ **Replies:** 11\ **Last updated:** [July 30, 2020, 8:44am UTC](https://discuss.elastic.co/t/logstash-filebeat-module-configuration-no-data-has-been-received-from-this-module-yet/242990 "2020-07-30T08:44:54Z")
Hi, I have been trying to configure Logstash Filebeat module. However I received message "No data has been received from this module yet". I have installed Logstash. The following log from console: Sending Logstash… --- ## [Pairing nested properties in nested filter](https://discuss.elastic.co/t/pairing-nested-properties-in-nested-filter/243185)
**Author:** [@Yonatan\_Omer](https://discuss.elastic.co/u/Yonatan_Omer)\ **Replies:** 0\ **Last updated:** [July 30, 2020, 8:37am UTC](https://discuss.elastic.co/t/pairing-nested-properties-in-nested-filter/243185 "2020-07-30T08:37:51Z")
Hi Our documents have a nested array tasks. We need to filter documents having task.cpu \> X for tasks entries having tasks.id = 'foo' { "tasks" : { "type" : "nested", "properties" : { "cpu" : { "type" : "floa… --- ## [Painless matcher scripted field](https://discuss.elastic.co/t/painless-matcher-scripted-field/242522)
**Author:** [@marrel](https://discuss.elastic.co/u/marrel)\ **Replies:** 1\ **Last updated:** [July 30, 2020, 8:35am UTC](https://discuss.elastic.co/t/painless-matcher-scripted-field/242522 "2020-07-30T08:35:10Z")
hello to everyone! I am trying to create a scripted field that will return some specific values from a field. This field contains a long string and I want to take some specific values which is the some\_text\_here. The v… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1896) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1898)