# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1920 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1921 --- ## [Kibana discover page URL with time filter](https://discuss.elastic.co/t/kibana-discover-page-url-with-time-filter/241724)
**Author:** [@christine-gong](https://discuss.elastic.co/u/christine-gong)\ **Replies:** 1\ **Last updated:** [July 17, 2020, 8:57pm UTC](https://discuss.elastic.co/t/kibana-discover-page-url-with-time-filter/241724 "2020-07-17T20:57:55Z")
Hi, I want to generate dynamic urls for logs viewing, but I have epoch time in my integrated service. So when i pass something like time:(from:1595007316121,mode:absolute,to:1595007816121) the time picker on the upper r… --- ## [Wildcards in logstash remove\_field](https://discuss.elastic.co/t/wildcards-in-logstash-remove-field/241644)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 11\ **Last updated:** [July 17, 2020, 8:40pm UTC](https://discuss.elastic.co/t/wildcards-in-logstash-remove-field/241644 "2020-07-17T20:40:27Z")
Hi All, I have a data source with almost 692 fields, out of which only 200 fields are valid, i want to remove those fields , i tried using below one, but no luck mutate { remove\_field =\> \[ ".value" \] } all the unwant… --- ## [Multiline is split from main log message - Any help please](https://discuss.elastic.co/t/multiline-is-split-from-main-log-message-any-help-please/241254)
**Author:** [@calanon](https://discuss.elastic.co/u/calanon)\ **Replies:** 4\ **Last updated:** [July 17, 2020, 8:00pm UTC](https://discuss.elastic.co/t/multiline-is-split-from-main-log-message-any-help-please/241254 "2020-07-17T20:00:43Z")
Here is a snippet of the raw log output: \[2020-07-15T08:21:58+02:00\] 172.16.35.104 ERROR Exception: \{"exception":"\[object\] (App\\\\Action\\\\Exception\\\\MethodNotAllowedException(code: 405): There is no action d… --- ## [Gpg check winlogbeat download... key file?](https://discuss.elastic.co/t/gpg-check-winlogbeat-download-key-file/241707)
**Author:** [@money1968](https://discuss.elastic.co/u/money1968)\ **Replies:** 1\ **Last updated:** [July 17, 2020, 7:59pm UTC](https://discuss.elastic.co/t/gpg-check-winlogbeat-download-key-file/241707 "2020-07-17T19:59:21Z")
Sorry for what I guess is a basic question... Is there any instructions anywhere for verifying the winlogbeats download? I downloaded the asc and the file buuut isn't there supposed to be a key somewhere? Thought I ne… --- ## [CrowdStrike Module unable to convert value \[\]: value is not a valid IP address](https://discuss.elastic.co/t/crowdstrike-module-unable-to-convert-value-value-is-not-a-valid-ip-address/239187)
**Author:** [@James\_Cribbs](https://discuss.elastic.co/u/James_Cribbs)\ **Replies:** 4\ **Last updated:** [July 17, 2020, 7:48pm UTC](https://discuss.elastic.co/t/crowdstrike-module-unable-to-convert-value-value-is-not-a-valid-ip-address/239187 "2020-07-17T19:48:46Z")
The CrowdStrike Filebeat (version 7.8) module appears to have two issues. Null / non-existent values in event.UserIP field causing parse errors during ingest. Parsing of UTCTimestamp to crowdstrike.event.UTCTimestamp (… --- ## [Filebeat favors single logstash node after significant backpressure](https://discuss.elastic.co/t/filebeat-favors-single-logstash-node-after-significant-backpressure/241716)
**Author:** [@Derek\_Gallo](https://discuss.elastic.co/u/Derek_Gallo)\ **Replies:** 0\ **Last updated:** [July 17, 2020, 7:36pm UTC](https://discuss.elastic.co/t/filebeat-favors-single-logstash-node-after-significant-backpressure/241716 "2020-07-17T19:36:53Z")
We are running Filebeat via a daemonset in Kubernetes. We are running logstash as a statefulset with persistent queues and 12 nodes. Filebeat is configured with the hostname to each logstash node and loadbalance is set… --- ## [Any way to use DEV tools page to query Kibana API?](https://discuss.elastic.co/t/any-way-to-use-dev-tools-page-to-query-kibana-api/241352)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 3\ **Last updated:** [July 17, 2020, 6:23pm UTC](https://discuss.elastic.co/t/any-way-to-use-dev-tools-page-to-query-kibana-api/241352 "2020-07-17T18:23:30Z")
The dev tools page in Kibana (\/app/kibana#/dev\_tools/console) seems to connect to elasticsearch API only (eg I can query elasticsearch data, searches etc) But the Kibana API's (like siem rules api, saved\_objects, … --- ## [Not seeing cloudwatch streamed logs via functionbeat in elasticsearch](https://discuss.elastic.co/t/not-seeing-cloudwatch-streamed-logs-via-functionbeat-in-elasticsearch/241005)
**Author:** [@randoran](https://discuss.elastic.co/u/randoran)\ **Replies:** 1\ **Last updated:** [July 17, 2020, 6:14pm UTC](https://discuss.elastic.co/t/not-seeing-cloudwatch-streamed-logs-via-functionbeat-in-elasticsearch/241005 "2020-07-17T18:14:53Z")
I am fairly new to Elastic stack and I am trying use functionbeat to stream logs to logstash and then to elasticsearch. I tested my streaming with the following logstash config: input { beats { port =\> … --- ## [Kibana Visualization of Pipeline Aggregation](https://discuss.elastic.co/t/kibana-visualization-of-pipeline-aggregation/241690)
**Author:** [@krenaut](https://discuss.elastic.co/u/krenaut)\ **Replies:** 2\ **Last updated:** [July 17, 2020, 6:13pm UTC](https://discuss.elastic.co/t/kibana-visualization-of-pipeline-aggregation/241690 "2020-07-17T18:13:50Z")
After much pain I was able to create the pipeline aggregation below in the console. But, I can't figure out how I am supposed to get it into a visualization. I just want to create a guage to display the "availabile\_per… --- ## [Boolean similarity module with fuzzy search scoring](https://discuss.elastic.co/t/boolean-similarity-module-with-fuzzy-search-scoring/241705)
**Author:** [@mckennajp](https://discuss.elastic.co/u/mckennajp)\ **Replies:** 0\ **Last updated:** [July 17, 2020, 5:59pm UTC](https://discuss.elastic.co/t/boolean-similarity-module-with-fuzzy-search-scoring/241705 "2020-07-17T17:59:23Z")
I've updated the default similarity module for my index to be boolean. The score should only be based on whether the query terms match or not. Boolean similarity gives terms a score equal to their query boost Howeve… --- ## [Mapper\_parsing\_exception error](https://discuss.elastic.co/t/mapper-parsing-exception-error/241703)
**Author:** [@AjitR](https://discuss.elastic.co/u/AjitR)\ **Replies:** 0\ **Last updated:** [July 17, 2020, 5:53pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception-error/241703 "2020-07-17T17:53:16Z")
Hi All, I an getting error in Kibana as, Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0x38baf060, ext:63730582410, loc:(\*time.Location)(nil)}, Meta:common.MapStr(nil), Fields:common.Ma… --- ## [Data too large, data for \[\\]](https://discuss.elastic.co/t/data-too-large-data-for-transport-request/241702)
**Author:** [@Dawood](https://discuss.elastic.co/u/Dawood)\ **Replies:** 0\ **Last updated:** [July 17, 2020, 5:48pm UTC](https://discuss.elastic.co/t/data-too-large-data-for-transport-request/241702 "2020-07-17T17:48:37Z")
i got the following in elasticsearch container logs: log:\[parent\] Data too large, data for \[\\] would be \[1020455062/973.1mb\], which is larger than the limit of \[1011774259/964.9mb\], real usage: \[102045… --- ## [How is actual and typical values computed in machine learning?](https://discuss.elastic.co/t/how-is-actual-and-typical-values-computed-in-machine-learning/241633)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 1\ **Last updated:** [July 17, 2020, 4:38pm UTC](https://discuss.elastic.co/t/how-is-actual-and-typical-values-computed-in-machine-learning/241633 "2020-07-17T16:38:43Z")
Need help pls. --- ## [Query\_string & min\_score?](https://discuss.elastic.co/t/query-string-min-score/241693)
**Author:** [@ClubberLang](https://discuss.elastic.co/u/ClubberLang)\ **Replies:** 0\ **Last updated:** [July 17, 2020, 4:18pm UTC](https://discuss.elastic.co/t/query-string-min-score/241693 "2020-07-17T16:18:26Z")
Hi, I have a basic query, and I wish to exclude all the results when the score is \< 0.5. It seems that min\_score does not work with! Noticed that I have a random\_score, if I use min\_score in "functions" it will be app… --- ## [Logstash filter basted on log file age](https://discuss.elastic.co/t/logstash-filter-basted-on-log-file-age/241350)
**Author:** [@Bader](https://discuss.elastic.co/u/Bader)\ **Replies:** 6\ **Last updated:** [July 17, 2020, 4:16pm UTC](https://discuss.elastic.co/t/logstash-filter-basted-on-log-file-age/241350 "2020-07-17T16:16:48Z")
Hello. I am running ELK 6.6 on a CentOS 7 box. I have filebeat configured on a Windows machine to forward specific logs to Logstash. The problem I have is that my Logstash filter has a throttling mechanism setup as to … --- ## [SASL GSSAPI mechanism added in Beats 7.8?](https://discuss.elastic.co/t/sasl-gssapi-mechanism-added-in-beats-7-8/241692)
**Author:** [@savvy](https://discuss.elastic.co/u/savvy)\ **Replies:** 0\ **Last updated:** [July 17, 2020, 4:02pm UTC](https://discuss.elastic.co/t/sasl-gssapi-mechanism-added-in-beats-7-8/241692 "2020-07-17T16:02:26Z")
Hi, Is SASL GSSAPI mechanism to produce data to kafka added in latest Beats 7.8? If no, what is the ETA for this? --- ## [Write log into 2 elasticsearch in realtime](https://discuss.elastic.co/t/write-log-into-2-elasticsearch-in-realtime/241111)
**Author:** [@elk2](https://discuss.elastic.co/u/elk2)\ **Replies:** 4\ **Last updated:** [July 17, 2020, 3:44pm UTC](https://discuss.elastic.co/t/write-log-into-2-elasticsearch-in-realtime/241111 "2020-07-17T15:44:53Z")
I would like to write with logstash into elasticsearch pseudonymized data in a way that it can no be linked to a single subject without the use of additional data. Also this additional data should be kept separate … --- ## [Migrating 3 millions of records from RDBMS to Elastic Search using logstash](https://discuss.elastic.co/t/migrating-3-millions-of-records-from-rdbms-to-elastic-search-using-logstash/240427)
**Author:** [@rao7806](https://discuss.elastic.co/u/rao7806)\ **Replies:** 7\ **Last updated:** [July 17, 2020, 3:27pm UTC](https://discuss.elastic.co/t/migrating-3-millions-of-records-from-rdbms-to-elastic-search-using-logstash/240427 "2020-07-17T15:27:33Z")
Hi All, We are trying to migrate around 3 million records from oracle to Elastic Search using Logstash. We are applying a couple of jdbc\_streaming filters as a part of our logstash script, one to load connecting nested… --- ## [Voting exclusion api wrong HTTP method](https://discuss.elastic.co/t/voting-exclusion-api-wrong-http-method/241638)
**Author:** [@tmporary](https://discuss.elastic.co/u/tmporary)\ **Replies:** 1\ **Last updated:** [July 17, 2020, 3:26pm UTC](https://discuss.elastic.co/t/voting-exclusion-api-wrong-http-method/241638 "2020-07-17T15:26:36Z")
Im using this dcumentation as a reference: https://www.elastic.co/guide/en/elasticsearch/reference/current/voting-config-exclusions.html POST https://MY\_DOMAIN/\_cluster/voting\_config\_exclusions?node\_ids=firstId,secondI… --- ## [Further details of how a pipeline configuration works](https://discuss.elastic.co/t/further-details-of-how-a-pipeline-configuration-works/241687)
**Author:** [@damasu](https://discuss.elastic.co/u/damasu)\ **Replies:** 0\ **Last updated:** [July 17, 2020, 3:24pm UTC](https://discuss.elastic.co/t/further-details-of-how-a-pipeline-configuration-works/241687 "2020-07-17T15:24:48Z")
I wondering about my pipeline setup: - pipeline.id: bal path.config: "/usr/share/logstash/pipeline/1\*.conf" pipeline.workers: 24 pipeline.batch.size: 2000 - pipeline.id: soul path.config: "/usr/share/logstash/pi… --- ## [Filebeat vs Winlogbeat with ingest pipelines](https://discuss.elastic.co/t/filebeat-vs-winlogbeat-with-ingest-pipelines/241329)
**Author:** [@sera](https://discuss.elastic.co/u/sera)\ **Replies:** 1\ **Last updated:** [July 17, 2020, 3:06pm UTC](https://discuss.elastic.co/t/filebeat-vs-winlogbeat-with-ingest-pipelines/241329 "2020-07-17T15:06:54Z")
I understand the Filebeat and its sample dashboards do not function properly without ingest pipelines. Is this also the case with Winlogbeat? I have Winlogbeat working well, and the sample dashboard is populating nicely,… --- ## [Unable to authorize user. Multiple Kibana instances running against same ES cluster](https://discuss.elastic.co/t/unable-to-authorize-user-multiple-kibana-instances-running-against-same-es-cluster/236663)
**Author:** [@peternijem](https://discuss.elastic.co/u/peternijem)\ **Replies:** 7\ **Last updated:** [July 17, 2020, 3:00pm UTC](https://discuss.elastic.co/t/unable-to-authorize-user-multiple-kibana-instances-running-against-same-es-cluster/236663 "2020-07-17T15:00:07Z")
Hi, We've recently upgraded our Kibana and ES from 6.3 to 7.5.1 Currently, in our dev environment, we have several Kibana instances running against the same ES cluster (2 nodes). The initial Kibana user was created us… --- ## [Use ssl/tls between Filebeat and Logstash problems](https://discuss.elastic.co/t/use-ssl-tls-between-filebeat-and-logstash-problems/241632)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 1\ **Last updated:** [July 17, 2020, 2:57pm UTC](https://discuss.elastic.co/t/use-ssl-tls-between-filebeat-and-logstash-problems/241632 "2020-07-17T14:57:02Z")
Dears, When I created the certs for Filebeat: /usr/share/elasticsearch/bin/elasticsearch-certutil cert --pem --ca-cert /etc/elasticsearch/certs/ca.crt --ca-key /etc/elasticsearch/certs/ca.key --in /tmp/filebeats.yml --… --- ## [Elasticsearch as producer/consumer solution](https://discuss.elastic.co/t/elasticsearch-as-producer-consumer-solution/241645)
**Author:** [@invenisso](https://discuss.elastic.co/u/invenisso)\ **Replies:** 3\ **Last updated:** [July 17, 2020, 2:53pm UTC](https://discuss.elastic.co/t/elasticsearch-as-producer-consumer-solution/241645 "2020-07-17T14:53:18Z")
Hello Community! Is it possible to use Elasticserach in a producer / consumer scenario? The producer writes documents to Elasticserach. The consumer reads documents from Eleasticserach and processes them. The order o… --- ## [No logs in filebeat index even though it has docs](https://discuss.elastic.co/t/no-logs-in-filebeat-index-even-though-it-has-docs/241675)
**Author:** [@misheck](https://discuss.elastic.co/u/misheck)\ **Replies:** 0\ **Last updated:** [July 17, 2020, 2:50pm UTC](https://discuss.elastic.co/t/no-logs-in-filebeat-index-even-though-it-has-docs/241675 "2020-07-17T14:50:41Z")
I am using filebeat docker image with syslog enabled. When I run a search under discover I am not getting any results even though I know there is logs because if I run a search in Dev Tools I can see some of the log mess… --- ## [Random\_score , how to moderate its impact?](https://discuss.elastic.co/t/random-score-how-to-moderate-its-impact/241555)
**Author:** [@ClubberLang](https://discuss.elastic.co/u/ClubberLang)\ **Replies:** 0\ **Last updated:** [July 16, 2020, 10:02pm UTC](https://discuss.elastic.co/t/random-score-how-to-moderate-its-impact/241555 "2020-07-16T22:02:27Z")
Hi, I use the following query, in this one I have 2 functions: distance\_feature : compute a score based on distance random\_score : compute a value between 0 and 1 The final score = distance\_feature \* random\_score Th… --- ## [Can't ship logs with filebeat to logstash](https://discuss.elastic.co/t/cant-ship-logs-with-filebeat-to-logstash/241608)
**Author:** [@elk6](https://discuss.elastic.co/u/elk6)\ **Replies:** 10\ **Last updated:** [July 17, 2020, 1:43pm UTC](https://discuss.elastic.co/t/cant-ship-logs-with-filebeat-to-logstash/241608 "2020-07-17T13:43:39Z")
I'm trying to make filebeat send log to logstash on another machine and I just can't get it to work. This is the filebeat.yml configuration: https://pastebin.com/8a2RtGBa (Using pastebin because of character limit) Thi… --- ## [Auditbeat - Triggering file integrity event.action:updated when hash.sha1 is unchanged](https://discuss.elastic.co/t/auditbeat-triggering-file-integrity-event-action-updated-when-hash-sha1-is-unchanged/241656)
**Author:** [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\ **Replies:** 0\ **Last updated:** [July 17, 2020, 2:03pm UTC](https://discuss.elastic.co/t/auditbeat-triggering-file-integrity-event-action-updated-when-hash-sha1-is-unchanged/241656 "2020-07-17T14:03:57Z")
I think this is a submitted bug but it's 4 months old and no one has addressed it and it's pretty damn important. https://github.com/elastic/beats/issues/17347 auditbeat seems to be identifying file integrity changes wh… --- ## [Custom/Derived Metric?](https://discuss.elastic.co/t/custom-derived-metric/235625)
**Author:** [@mpn17](https://discuss.elastic.co/u/mpn17)\ **Replies:** 3\ **Last updated:** [July 17, 2020, 1:54pm UTC](https://discuss.elastic.co/t/custom-derived-metric/235625 "2020-07-17T13:54:18Z")
Hi All! I'm new to Elasticsearch and Kibana and trying to figure out the best way to create a custom metric that takes into account the current value of other metrics. For example lets say I want to create a custom str… --- ## [Exclude Include options syntax in Kibana visualization](https://discuss.elastic.co/t/exclude-include-options-syntax-in-kibana-visualization/241609)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 3\ **Last updated:** [July 17, 2020, 1:32pm UTC](https://discuss.elastic.co/t/exclude-include-options-syntax-in-kibana-visualization/241609 "2020-07-17T13:32:46Z")
I am creating a visualization. On x-axis I am doing a terms aggregation. What is the right way for provide a series of values to be included. This works. This does not. As per the documentation, a series of terms… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1919) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1921)