# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1912 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1913 --- ## [Alert and Actions 'Notify Every'](https://discuss.elastic.co/t/alert-and-actions-notify-every/238827)
**Author:** [@spike83](https://discuss.elastic.co/u/spike83)\ **Replies:** 1\ **Last updated:** [July 22, 2020, 3:45pm UTC](https://discuss.elastic.co/t/alert-and-actions-notify-every/238827 "2020-07-22T15:45:38Z")
Hi, I'm running 7.8.0 on a 3 node cluster. I have an Alert configured for HDD usage against system.filesystem.used.pct for anything that is greater than or equal to 0.8 (80%). The alert is configured to check every 5 m… --- ## [Can @timestamp be renamed when dumped to elasticsearch? (version 7.8)](https://discuss.elastic.co/t/can-timestamp-be-renamed-when-dumped-to-elasticsearch-version-7-8/242225)
**Author:** [@Alex\_Tchhailo](https://discuss.elastic.co/u/Alex_Tchhailo)\ **Replies:** 0\ **Last updated:** [July 22, 2020, 3:31pm UTC](https://discuss.elastic.co/t/can-timestamp-be-renamed-when-dumped-to-elasticsearch-version-7-8/242225 "2020-07-22T15:31:29Z")
Hello friends! i was hoping to find out if when winlogbeat writes to elasticsearch the field '@timestamp' can be renamed/remapped to something i can get to with javascript when i get the records out. I located such art… --- ## [Problem ingesting vpc flow logs](https://discuss.elastic.co/t/problem-ingesting-vpc-flow-logs/239172)
**Author:** [@andywt123](https://discuss.elastic.co/u/andywt123)\ **Replies:** 4\ **Last updated:** [July 22, 2020, 3:12pm UTC](https://discuss.elastic.co/t/problem-ingesting-vpc-flow-logs/239172 "2020-07-22T15:12:29Z")
We are using filebeat 7.6.2 to ingest vpc flow logs. IT appears that it is taking longer then 24 hours for the vpc flow logs to be ingested. Everything seems to be working fine for the elb logs. The SQS queue still has … --- ## [Trouble configuring datastore](https://discuss.elastic.co/t/trouble-configuring-datastore/242206)
**Author:** [@lzukel](https://discuss.elastic.co/u/lzukel)\ **Replies:** 4\ **Last updated:** [July 22, 2020, 2:51pm UTC](https://discuss.elastic.co/t/trouble-configuring-datastore/242206 "2020-07-22T14:51:50Z")
I am unable to use an existing elasticsearch cluster as a datastore. I am unable to find how to disable certificate verification for the datastore, thus the only way I can run rally is to use the in-memory datastore. I … --- ## [Vega date\_histogram aggregation interval based on signal](https://discuss.elastic.co/t/vega-date-histogram-aggregation-interval-based-on-signal/242149)
**Author:** [@Michaela\_Krkosova](https://discuss.elastic.co/u/Michaela_Krkosova)\ **Replies:** 1\ **Last updated:** [July 22, 2020, 2:39pm UTC](https://discuss.elastic.co/t/vega-date-histogram-aggregation-interval-based-on-signal/242149 "2020-07-22T14:39:03Z")
Hi there Is it possible to choose date\_histogram aggregation interval by signal? I have data: "name": "funkce", "url": { "index": "t-function-\*", "body": { "\_source": \["@timestamp", "metricset.name", … --- ## [Aggregate query on filtered array of objects across documents](https://discuss.elastic.co/t/aggregate-query-on-filtered-array-of-objects-across-documents/242207)
**Author:** [@Aditya\_Anirudh\_T](https://discuss.elastic.co/u/Aditya_Anirudh_T)\ **Replies:** 0\ **Last updated:** [July 22, 2020, 1:57pm UTC](https://discuss.elastic.co/t/aggregate-query-on-filtered-array-of-objects-across-documents/242207 "2020-07-22T13:57:41Z")
Hi all, I want to do a term aggregation on a field inside an array of objects, after filtering the array of objects on two other fields. For example, let's say I have the below documents in my database \[ { … --- ## [How to create exact replica of data table from mysql mariaDB](https://discuss.elastic.co/t/how-to-create-exact-replica-of-data-table-from-mysql-mariadb/241903)
**Author:** [@Sahilvaishnav](https://discuss.elastic.co/u/Sahilvaishnav)\ **Replies:** 1\ **Last updated:** [July 22, 2020, 1:56pm UTC](https://discuss.elastic.co/t/how-to-create-exact-replica-of-data-table-from-mysql-mariadb/241903 "2020-07-22T13:56:21Z")
Hello, Scenario : I have a database in mysql below is the structure : JOBID Wokflow Ingest Formula Load modification\_time insertion\_time 1 Pipeline1 Completed Completed Completed 2020-07-18 17:12:35 2020-07-18… --- ## [Logs are indexed into logstash indices but not showing in kibana dashboard?](https://discuss.elastic.co/t/logs-are-indexed-into-logstash-indices-but-not-showing-in-kibana-dashboard/242015)
**Author:** [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\ **Replies:** 8\ **Last updated:** [July 22, 2020, 1:25pm UTC](https://discuss.elastic.co/t/logs-are-indexed-into-logstash-indices-but-not-showing-in-kibana-dashboard/242015 "2020-07-22T13:25:10Z")
logs are showing in index in Discover page. but not showing in dashboard. need help? here are my index patterns: here are log lines : but here in dashboard i can't see. --- ## [Grokparsefailure and type problems in logstash configuration file](https://discuss.elastic.co/t/grokparsefailure-and-type-problems-in-logstash-configuration-file/242200)
**Author:** [@Mathis\_Gourc](https://discuss.elastic.co/u/Mathis_Gourc)\ **Replies:** 0\ **Last updated:** [July 22, 2020, 1:18pm UTC](https://discuss.elastic.co/t/grokparsefailure-and-type-problems-in-logstash-configuration-file/242200 "2020-07-22T13:18:27Z")
Hi everybody, I have several problems with my configuration file. My goal is to parse three types of logs (for the moment). Here they are : \[29/05/2020 07:41:51.354\] - ih912865 - 10.107.119.121 - 93 - Transaction 7635 … --- ## [Compiling filebeat from source on ppc64le](https://discuss.elastic.co/t/compiling-filebeat-from-source-on-ppc64le/242186)
**Author:** [@seth-priya](https://discuss.elastic.co/u/seth-priya)\ **Replies:** 0\ **Last updated:** [July 22, 2020, 12:18pm UTC](https://discuss.elastic.co/t/compiling-filebeat-from-source-on-ppc64le/242186 "2020-07-22T12:18:40Z")
Hi, I am trying to build filebeat version 6.8.10 using the below steps on ppc64le, UBI-8 and had a couple of questions #Steps to build (using go.10.2) git clone https://github.com/elastic/beats.git cd beats git chec… --- ## [Nodos máster como Data](https://discuss.elastic.co/t/nodos-master-como-data/242185)
**Author:** [@Jesus2121](https://discuss.elastic.co/u/Jesus2121)\ **Replies:** 0\ **Last updated:** [July 22, 2020, 12:17pm UTC](https://discuss.elastic.co/t/nodos-master-como-data/242185 "2020-07-22T12:17:39Z")
Buenas. Tengo 4 datas, 2 máster y un nodo de ingesta. ¿Es mejor poner el ingesta que también sea data? o ¿un máster que sea data a la vez? Gracias de antemano --- ## [Discover-gce plugin and old google api libraries](https://discuss.elastic.co/t/discover-gce-plugin-and-old-google-api-libraries/242183)
**Author:** [@Daniel\_S](https://discuss.elastic.co/u/Daniel_S)\ **Replies:** 0\ **Last updated:** [July 22, 2020, 12:06pm UTC](https://discuss.elastic.co/t/discover-gce-plugin-and-old-google-api-libraries/242183 "2020-07-22T12:06:46Z")
Hi! Google is going to deprecate (Aug 12, 2020) for JSON-RPC and global HTTP batch endpoints and their recommendation for clients is to update all Google API Service packages to a version 1.23.1 or higher. Currently, d… --- ## [Kibana "Url Template" based access Issue](https://discuss.elastic.co/t/kibana-url-template-based-access-issue/241925)
**Author:** [@tenet\_testuser1](https://discuss.elastic.co/u/tenet_testuser1)\ **Replies:** 6\ **Last updated:** [July 22, 2020, 11:22am UTC](https://discuss.elastic.co/t/kibana-url-template-based-access-issue/241925 "2020-07-22T11:22:20Z")
Hello, In the index, for a column, I have the option of setting the type to "Url" and provide a url template. There are videos explaining how to get this done. I wanted to use this feature, and set the URL template UR… --- ## [Remove specific fields from index pattern](https://discuss.elastic.co/t/remove-specific-fields-from-index-pattern/242165)
**Author:** [@sfenman](https://discuss.elastic.co/u/sfenman)\ **Replies:** 1\ **Last updated:** [July 22, 2020, 11:20am UTC](https://discuss.elastic.co/t/remove-specific-fields-from-index-pattern/242165 "2020-07-22T11:20:32Z")
Hello, I am using filebeat to parse my logs to Elasticsearch and after some testing with the dissect processor on ingest pipelines, I created too many random fields by mistake as I have noticed from my index patterns on… --- ## [Logstash AWS Elastic Search issue](https://discuss.elastic.co/t/logstash-aws-elastic-search-issue/242164)
**Author:** [@ggiff](https://discuss.elastic.co/u/ggiff)\ **Replies:** 1\ **Last updated:** [July 22, 2020, 11:17am UTC](https://discuss.elastic.co/t/logstash-aws-elastic-search-issue/242164 "2020-07-22T11:17:59Z")
I have set up Logstash to send user inputs to AWS ElasticSearch, but getting the following issue: \[WARN \] 2020-07-22 09:27:50.704 \[Ruby-0-Thread-4: :1\] elasticsearch - Attempted to resurrect connection to dead ES instan… --- ## [Filebeat regexp metadata variables](https://discuss.elastic.co/t/filebeat-regexp-metadata-variables/242172)
**Author:** [@gladsheim](https://discuss.elastic.co/u/gladsheim)\ **Replies:** 0\ **Last updated:** [July 22, 2020, 11:01am UTC](https://discuss.elastic.co/t/filebeat-regexp-metadata-variables/242172 "2020-07-22T11:01:49Z")
Hi i run filebeat on Kubernetes cluster. We use them for send logs to Kafka. Sorry, but I'm rookie on Filebeat :). In our Kubernetes cluster we have a namespace naming convention: - , for example: dev-deathstar. O… --- ## [Aggregation of nearby dense vectors](https://discuss.elastic.co/t/aggregation-of-nearby-dense-vectors/242163)
**Author:** [@JulGor](https://discuss.elastic.co/u/JulGor)\ **Replies:** 0\ **Last updated:** [July 22, 2020, 9:37am UTC](https://discuss.elastic.co/t/aggregation-of-nearby-dense-vectors/242163 "2020-07-22T09:37:49Z")
Hello, Is there any aggregation that group documents in terms of closeness of dense vectors? My documents have the following structure: { "label": "value", "vector": \[1, 0, 3, 0, 0, 0, 18, 0, 0, 0, ...\] # N dimen… --- ## [Drop message content](https://discuss.elastic.co/t/drop-message-content/242158)
**Author:** [@Champion\_Xie](https://discuss.elastic.co/u/Champion_Xie)\ **Replies:** 1\ **Last updated:** [July 22, 2020, 9:35am UTC](https://discuss.elastic.co/t/drop-message-content/242158 "2020-07-22T09:35:22Z")
hi all, message content 07/20/20 23:57:48 INFO transfercity:sh(city/cityTransferQueryBusiness.cpp:72) how to only get 07/20/20 23:57:48 INFO transfercity:sh --- ## [High Availability with 2 DCs](https://discuss.elastic.co/t/high-availability-with-2-dcs/242159)
**Author:** [@Muttley](https://discuss.elastic.co/u/Muttley)\ **Replies:** 1\ **Last updated:** [July 22, 2020, 9:31am UTC](https://discuss.elastic.co/t/high-availability-with-2-dcs/242159 "2020-07-22T09:31:36Z")
Hi, I am setting up a cluster (or two) The plan is to have nodes in the US and in EU Looking through posts regarding HA I can see 3 ways this is implemented Two clusters, logstash sends to Cluster A, Cluster B uses … --- ## [File output with data from field](https://discuss.elastic.co/t/file-output-with-data-from-field/241895)
**Author:** [@elk2](https://discuss.elastic.co/u/elk2)\ **Replies:** 2\ **Last updated:** [July 21, 2020, 7:47am UTC](https://discuss.elastic.co/t/file-output-with-data-from-field/241895 "2020-07-21T07:47:47Z")
I collect different logs from various sources. I replaced logstash timestamp with machine logs timestamp to have time based events into elasticsearch and I added a "processed\_at" field with a part of logstash timestamp. … --- ## [Filebeat sets the multi-line mode, the unmatched rows are also multi-line, the match result is abnormal](https://discuss.elastic.co/t/filebeat-sets-the-multi-line-mode-the-unmatched-rows-are-also-multi-line-the-match-result-is-abnormal/239090)
**Author:** [@lklkxcxc](https://discuss.elastic.co/u/lklkxcxc)\ **Replies:** 3\ **Last updated:** [July 21, 2020, 10:09am UTC](https://discuss.elastic.co/t/filebeat-sets-the-multi-line-mode-the-unmatched-rows-are-also-multi-line-the-match-result-is-abnormal/239090 "2020-07-21T10:09:33Z")
set multiline filebeat config: multiline.pattern: '^\[0-9\]{4}-\[0-9\]{2}-\[0-9\]{2}|^\[0-9\]{4}/\[0-9\]{2}/\[0-9\]{2}' multiline.negate: true multiline.match: after As a result, the following log was matched as multiple lines i… --- ## [Log messages with same index timestamps are not in the order as in the actual log file](https://discuss.elastic.co/t/log-messages-with-same-index-timestamps-are-not-in-the-order-as-in-the-actual-log-file/242000)
**Author:** [@Aj\_t](https://discuss.elastic.co/u/Aj_t)\ **Replies:** 9\ **Last updated:** [July 22, 2020, 9:12am UTC](https://discuss.elastic.co/t/log-messages-with-same-index-timestamps-are-not-in-the-order-as-in-the-actual-log-file/242000 "2020-07-22T09:12:27Z")
I have a filebeat \> logstash \> elastic set up I am using to process multi-line logs. I can see the logs in kibana, but they are not in the right order as the actual log. Here's my filebeat.yml file: filebeat.inputs: - … --- ## [How to get string from path](https://discuss.elastic.co/t/how-to-get-string-from-path/242156)
**Author:** [@Champion\_Xie](https://discuss.elastic.co/u/Champion_Xie)\ **Replies:** 0\ **Last updated:** [July 22, 2020, 8:59am UTC](https://discuss.elastic.co/t/how-to-get-string-from-path/242156 "2020-07-22T08:59:50Z")
hi all, My application log file name format is room1\_num\_perf.log, i want get the string 'room1' ,and then the string as a new field into ES --- ## [Failed to index all results after \[N\] attempts. failure in bulk execution](https://discuss.elastic.co/t/failed-to-index-all-results-after-n-attempts-failure-in-bulk-execution/241968)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 3\ **Last updated:** [July 22, 2020, 8:19am UTC](https://discuss.elastic.co/t/failed-to-index-all-results-after-n-attempts-failure-in-bulk-execution/241968 "2020-07-22T08:19:31Z")
Hello All, I see the following error originated by one of the ML jobs Could not find anything related on the www. Any ideas? \[2020-07-21T14:33:29,745\]\[WARN \]\[o.e.x.m.u.p.ResultsPersisterService\] \[NODE3\] \[job-name\] fa… --- ## [Can't run ElasticSearch](https://discuss.elastic.co/t/cant-run-elasticsearch/238842)
**Author:** [@zepp\_e](https://discuss.elastic.co/u/zepp_e)\ **Replies:** 5\ **Last updated:** [July 22, 2020, 8:11am UTC](https://discuss.elastic.co/t/cant-run-elasticsearch/238842 "2020-07-22T08:11:58Z")
Hey guys, I try to install ElasticSearch but when I download it and try to set it up via the command window it looks like the following: '// C:\\Users\\josef\>cd C:\\Program Files\\elasticsearch-7.8.0 C:\\Program Files\\elas… --- ## [Painless scripting](https://discuss.elastic.co/t/painless-scripting/242139)
**Author:** [@richylyq](https://discuss.elastic.co/u/richylyq)\ **Replies:** 2\ **Last updated:** [July 22, 2020, 7:54am UTC](https://discuss.elastic.co/t/painless-scripting/242139 "2020-07-22T07:54:59Z")
Hi, Just to check, i am unable to use another scripted field in the new scripted field that i am trying to create when i want to derive some other information with the scripted field previously created? --- ## [GeoIP Filter Mapping Error. What dynamic mapping is required?](https://discuss.elastic.co/t/geoip-filter-mapping-error-what-dynamic-mapping-is-required/242144)
**Author:** [@clearedskies](https://discuss.elastic.co/u/clearedskies)\ **Replies:** 2\ **Last updated:** [July 22, 2020, 7:47am UTC](https://discuss.elastic.co/t/geoip-filter-mapping-error-what-dynamic-mapping-is-required/242144 "2020-07-22T07:47:46Z")
I have been attempting to parse some WAF logs so they fit with the ECS Schema which I have finally managed to do. However, my final issue is to do with the GeoIP Filter. I wish to utilise the Maps element of Kibana Visua… --- ## [Cannot call \_cluster / \_search API](https://discuss.elastic.co/t/cannot-call-cluster-search-api/241383)
**Author:** [@worapojc](https://discuss.elastic.co/u/worapojc)\ **Replies:** 2\ **Last updated:** [July 22, 2020, 7:39am UTC](https://discuss.elastic.co/t/cannot-call-cluster-search-api/241383 "2020-07-22T07:39:27Z")
Hi, I've Elasticsearch 6.3.2 installed on AWS EC2 and Kibana 6.3.2 installed on on-prem. I can call some ES API from on-prem such as \_cat, \_xpack or \_template. For \_cluster and \_search API, I always get the request ti… --- ## [Group multiple metric to one event](https://discuss.elastic.co/t/group-multiple-metric-to-one-event/241842)
**Author:** [@CHU\_XU](https://discuss.elastic.co/u/CHU_XU)\ **Replies:** 3\ **Last updated:** [July 22, 2020, 7:11am UTC](https://discuss.elastic.co/t/group-multiple-metric-to-one-event/241842 "2020-07-22T07:11:40Z")
Hi all, I'm using metricbeat to collect some instance metrics with system module. When I set cpu, memory and network in the metricsets, I found that metricbeat actually emit three lines of log repestively. Can I merge t… --- ## [Remake Kibana visualization](https://discuss.elastic.co/t/remake-kibana-visualization/241949)
**Author:** [@kibana2](https://discuss.elastic.co/u/kibana2)\ **Replies:** 3\ **Last updated:** [July 22, 2020, 7:04am UTC](https://discuss.elastic.co/t/remake-kibana-visualization/241949 "2020-07-22T07:04:50Z")
Is it possible to remake a Kibana visualization using the request that you can find under inspect. I want to share the visualizaiton with other Kibana users who have same index pattern without making them redo it all us… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1911) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1913)