# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1923 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1924 --- ## [Logstash sFlow Codec Input Syntax :: Implement "optional\_removed\_field"?](https://discuss.elastic.co/t/logstash-sflow-codec-input-syntax-implement-optional-removed-field/241527)
**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Replies:** 2\ **Last updated:** [July 16, 2020, 7:25pm UTC](https://discuss.elastic.co/t/logstash-sflow-codec-input-syntax-implement-optional-removed-field/241527 "2020-07-16T19:25:41Z")
Hi Logstash Megaminds, I'm using my Logstash instance as an sFlow collector, and it works great. When I read the documentation on the sFlow Codec, I see this: By default \[some sFlow\] fields are removed from \[every\] e… --- ## [Logstash date filter match timestamp issue](https://discuss.elastic.co/t/logstash-date-filter-match-timestamp-issue/241506)
**Author:** [@rahulnama](https://discuss.elastic.co/u/rahulnama)\ **Replies:** 5\ **Last updated:** [July 16, 2020, 7:24pm UTC](https://discuss.elastic.co/t/logstash-date-filter-match-timestamp-issue/241506 "2020-07-16T19:24:08Z")
Hi Team I want to match the timestamp with date from logs. But in kibana I see different time for timestamp and logdate. why is this happening and how to resolve this ? Kibana data Logstash.conf Any suggestions w… --- ## [Logstash pipeline workers and imap input plugin](https://discuss.elastic.co/t/logstash-pipeline-workers-and-imap-input-plugin/241534)
**Author:** [@Diptee](https://discuss.elastic.co/u/Diptee)\ **Replies:** 1\ **Last updated:** [July 16, 2020, 7:20pm UTC](https://discuss.elastic.co/t/logstash-pipeline-workers-and-imap-input-plugin/241534 "2020-07-16T19:20:34Z")
Hi, We have configured logstash(using default pipeline configuration). We have just one pipeline running. When I start logstash I see it has 4 pipeline workers and batch size of 125. I am using IMAP input plugin to pro… --- ## [Few worker threads keep running even after logstash is shutdown](https://discuss.elastic.co/t/few-worker-threads-keep-running-even-after-logstash-is-shutdown/241535)
**Author:** [@Diptee](https://discuss.elastic.co/u/Diptee)\ **Replies:** 0\ **Last updated:** [July 16, 2020, 7:14pm UTC](https://discuss.elastic.co/t/few-worker-threads-keep-running-even-after-logstash-is-shutdown/241535 "2020-07-16T19:14:34Z")
Hi, We have configured logstash(using default pipeline configuration). We have just one pipeline running. When I start logstash I see it has 4 pipeline workers and batch size of 125. I am using IMAP input plugin to pro… --- ## [Filter Ratio not displaying data](https://discuss.elastic.co/t/filter-ratio-not-displaying-data/241490)
**Author:** [@franco-martin](https://discuss.elastic.co/u/franco-martin)\ **Replies:** 7\ **Last updated:** [July 16, 2020, 6:55pm UTC](https://discuss.elastic.co/t/filter-ratio-not-displaying-data/241490 "2020-07-16T18:55:37Z")
Hi, im indexing some data and I want to know the ratio of documents that have isCompliant as True. I visualized the data as count over time and I see documents. Then I moved to gauge and applied the filter as grouping … --- ## [Logstash multiple inputs parallel](https://discuss.elastic.co/t/logstash-multiple-inputs-parallel/241523)
**Author:** [@dbargo](https://discuss.elastic.co/u/dbargo)\ **Replies:** 1\ **Last updated:** [July 16, 2020, 6:10pm UTC](https://discuss.elastic.co/t/logstash-multiple-inputs-parallel/241523 "2020-07-16T18:10:51Z")
If I have multiple inputs in my logstash and one output does it collects the logs from the inputs in serial way ( one by one ) or in parallel way ( all of them in the same time) ? Couldn't find an answer to it --- ## [GeoIP lookup failed](https://discuss.elastic.co/t/geoip-lookup-failed/241414)
**Author:** [@Alex\_Liu](https://discuss.elastic.co/u/Alex_Liu)\ **Replies:** 3\ **Last updated:** [July 16, 2020, 5:51pm UTC](https://discuss.elastic.co/t/geoip-lookup-failed/241414 "2020-07-16T17:51:01Z")
Hi, how to debug GeoIP lookup failure? For below attached screenshot, why the first clientIP: 123.58.60.5 lookup failed, but the second one 112.85.231.147 succeed? the configuration is simple, and the GeoLIte2-city.m… --- ## [Logstash on k8s - high memory usage](https://discuss.elastic.co/t/logstash-on-k8s-high-memory-usage/241299)
**Author:** [@zachshani](https://discuss.elastic.co/u/zachshani)\ **Replies:** 4\ **Last updated:** [July 16, 2020, 5:45pm UTC](https://discuss.elastic.co/t/logstash-on-k8s-high-memory-usage/241299 "2020-07-16T17:45:24Z")
Hi, I'm implementing logstash as a deployment (pod) on k8s. I've noticed that it consumes high memory - even when no data is being send to it. I've tried setting jvm.options (Xms4g & Xmx4g), but I got same results - h… --- ## [\[parent\] Data too large (for agg or reused\_arrays)](https://discuss.elastic.co/t/parent-data-too-large-for-agg-or-reused-arrays/241517)
**Author:** [@duttad](https://discuss.elastic.co/u/duttad)\ **Replies:** 0\ **Last updated:** [July 16, 2020, 5:44pm UTC](https://discuss.elastic.co/t/parent-data-too-large-for-agg-or-reused-arrays/241517 "2020-07-16T17:44:14Z")
I am doing nested aggregation over fields with large cardinality - so, probably the large number of buckets is tripping the circuit breakers. Trying to understand the following circuit breaker exception thoroughly. shar… --- ## [Kibana canvas gauges](https://discuss.elastic.co/t/kibana-canvas-gauges/241480)
**Author:** [@Hugo\_Pires](https://discuss.elastic.co/u/Hugo_Pires)\ **Replies:** 2\ **Last updated:** [July 16, 2020, 4:53pm UTC](https://discuss.elastic.co/t/kibana-canvas-gauges/241480 "2020-07-16T16:53:07Z")
Hello Is it possible to create a dynamic gauge in Canvas, just like on visualisation dashboard, setting a goal from data? Thank you Hugo --- ## [Decode\_json\_fields not processing nested array?](https://discuss.elastic.co/t/decode-json-fields-not-processing-nested-array/241367)
**Author:** [@adamparmelee](https://discuss.elastic.co/u/adamparmelee)\ **Replies:** 2\ **Last updated:** [July 16, 2020, 4:22pm UTC](https://discuss.elastic.co/t/decode-json-fields-not-processing-nested-array/241367 "2020-07-16T16:22:42Z")
Hi. I've been struggling with this for a bit now. Nothing I've tried from forum scouring has done the trick. here's a log entry: {"transaction":{"client\_ip":"x.x.x.x","time\_stamp":"Wed Jul 15 19:08:29 2020","server\_id"… --- ## [Out-of-the-box fail with metricbeat 7.8](https://discuss.elastic.co/t/out-of-the-box-fail-with-metricbeat-7-8/241499)
**Author:** [@Sushimaster](https://discuss.elastic.co/u/Sushimaster)\ **Replies:** 0\ **Last updated:** [July 16, 2020, 4:03pm UTC](https://discuss.elastic.co/t/out-of-the-box-fail-with-metricbeat-7-8/241499 "2020-07-16T16:03:55Z")
Hi there, just installed metricbeat 7.8 on a client and just changed ip to elasticsearch server, nothing more. Cannot connect to server: Connection marked as failed because the onConnect callback failed: resource 'met… --- ## [How logstash read multiline data line by line](https://discuss.elastic.co/t/how-logstash-read-multiline-data-line-by-line/241498)
**Author:** [@ashish2](https://discuss.elastic.co/u/ashish2)\ **Replies:** 0\ **Last updated:** [July 16, 2020, 3:58pm UTC](https://discuss.elastic.co/t/how-logstash-read-multiline-data-line-by-line/241498 "2020-07-16T15:58:53Z")
i am new to elk .am phasing some problem about logstash ,tell me that i can solve this problem with logstash or not? i have a csv file like this. a: rajat b: 123,321a,543, 123a....... a: ashish b: 878, 543, 321, 123… --- ## [Logstash multiple pipelines in k8s](https://discuss.elastic.co/t/logstash-multiple-pipelines-in-k8s/241497)
**Author:** [@digma89](https://discuss.elastic.co/u/digma89)\ **Replies:** 0\ **Last updated:** [July 16, 2020, 3:57pm UTC](https://discuss.elastic.co/t/logstash-multiple-pipelines-in-k8s/241497 "2020-07-16T15:57:32Z")
I'm trying to run multiple pipelines on my custom docker image in k8s, but doesn't seems to be working. On the config map in k8s I have: apiVersion: v1 kind: ConfigMap metadata: name: logstashffs-${trigger.resolvedEx… --- ## [Shipping with FileBeats to Azure Marketplace Offering](https://discuss.elastic.co/t/shipping-with-filebeats-to-azure-marketplace-offering/241195)
**Author:** [@JakeWickLB](https://discuss.elastic.co/u/JakeWickLB)\ **Replies:** 4\ **Last updated:** [July 16, 2020, 3:48pm UTC](https://discuss.elastic.co/t/shipping-with-filebeats-to-azure-marketplace-offering/241195 "2020-07-16T15:48:09Z")
I have deployed the Azure Marketplace ElasticSearch cluster, and am trying to configure my FileBeat to ship to it. I am confused about how to ship logs to LogStash. My filebeat is on a separate network from the logstash… --- ## [Filter on custom plugin](https://discuss.elastic.co/t/filter-on-custom-plugin/237771)
**Author:** [@bard0x](https://discuss.elastic.co/u/bard0x)\ **Replies:** 1\ **Last updated:** [July 16, 2020, 3:41pm UTC](https://discuss.elastic.co/t/filter-on-custom-plugin/237771 "2020-07-16T15:41:22Z")
Hi, I wrote an angularJS plugin with a clickable image. How can I apply a filter on image click? Which module I have to import to do this feature? Thank's in advance --- ## [Boosting specific documents to be at the top of the results](https://discuss.elastic.co/t/boosting-specific-documents-to-be-at-the-top-of-the-results/240970)
**Author:** [@droplet](https://discuss.elastic.co/u/droplet)\ **Replies:** 6\ **Last updated:** [July 16, 2020, 3:24pm UTC](https://discuss.elastic.co/t/boosting-specific-documents-to-be-at-the-top-of-the-results/240970 "2020-07-16T15:24:50Z")
Hi there, I don't know how to best describe the topic, excuse the vague title. I'm having some issue with the search results coming from an index. The index contains about 1M+ documents (various products), but doing a… --- ## [Kafka input codec JSON parse error](https://discuss.elastic.co/t/kafka-input-codec-json-parse-error/240726)
**Author:** [@dikkini](https://discuss.elastic.co/u/dikkini)\ **Replies:** 4\ **Last updated:** [July 16, 2020, 3:16pm UTC](https://discuss.elastic.co/t/kafka-input-codec-json-parse-error/240726 "2020-07-16T15:16:30Z")
Hello! Telegraf send JSON to Kafka and logstash retrieve it. ES gives me parse error, but i can't understand what's wrong with my data. JSON from Telegraf: {"fields":{"created":1594396144981,"value":"{\\"id\\": 1, \\"ty… --- ## [Script\_score with multiline code](https://discuss.elastic.co/t/script-score-with-multiline-code/241468)
**Author:** [@ClubberLang](https://discuss.elastic.co/u/ClubberLang)\ **Replies:** 1\ **Last updated:** [July 16, 2020, 2:42pm UTC](https://discuss.elastic.co/t/script-score-with-multiline-code/241468 "2020-07-16T14:42:41Z")
Hi, I have a query, this one compute a score with painless. I try to use multiline painless, using """, but the parser seems to unlike this. From what I understand, it should work, right ? Here is my query for review. … --- ## [Elasticsearch for correlation](https://discuss.elastic.co/t/elasticsearch-for-correlation/241479)
**Author:** [@Suat\_Bey](https://discuss.elastic.co/u/Suat_Bey)\ **Replies:** 5\ **Last updated:** [July 16, 2020, 2:40pm UTC](https://discuss.elastic.co/t/elasticsearch-for-correlation/241479 "2020-07-16T14:40:26Z")
Is it possible to write a query for elacticsearch something like this: If same IP and same username generates 3 different rule.id within 15 min. --- ## [Print Current date time in kibana watcher webhook body](https://discuss.elastic.co/t/print-current-date-time-in-kibana-watcher-webhook-body/238639)
**Author:** [@Nord](https://discuss.elastic.co/u/Nord)\ **Replies:** 1\ **Last updated:** [July 16, 2020, 2:33pm UTC](https://discuss.elastic.co/t/print-current-date-time-in-kibana-watcher-webhook-body/238639 "2020-07-16T14:33:22Z")
Hi i have alert and i want to print current time/watcher trigger time in webhook body of a kibana watcher? i have tried to add ctx.trigger.scheduled\_time or ctx.trigger.current\_time but nothing appear! --- ## [Elasticsearch unassigned shards](https://discuss.elastic.co/t/elasticsearch-unassigned-shards/241296)
**Author:** [@apintilie](https://discuss.elastic.co/u/apintilie)\ **Replies:** 13\ **Last updated:** [July 16, 2020, 2:30pm UTC](https://discuss.elastic.co/t/elasticsearch-unassigned-shards/241296 "2020-07-16T14:30:16Z")
Hi all, I have an ES cluster, made from 3 nodes, all are master/ingest/data. The cluster is configured with 5 shards and 1 replica, so 5 primary shards and 5 replica shards. After a restart of the cluster, I have a lot… --- ## [Timelion by default its enable in kibana, what is impact if timelion.enable is false in kibana.yaml](https://discuss.elastic.co/t/timelion-by-default-its-enable-in-kibana-what-is-impact-if-timelion-enable-is-false-in-kibana-yaml/238613)
**Author:** [@Mayank\_Srivastava](https://discuss.elastic.co/u/Mayank_Srivastava)\ **Replies:** 1\ **Last updated:** [July 16, 2020, 2:23pm UTC](https://discuss.elastic.co/t/timelion-by-default-its-enable-in-kibana-what-is-impact-if-timelion-enable-is-false-in-kibana-yaml/238613 "2020-07-16T14:23:52Z")
timelion by default its enable in kibana?what is impact if timelion.enable is false in kibana.yaml. --- ## [All shards failed even after tuning](https://discuss.elastic.co/t/all-shards-failed-even-after-tuning/241080)
**Author:** [@gzucca](https://discuss.elastic.co/u/gzucca)\ **Replies:** 9\ **Last updated:** [July 16, 2020, 2:14pm UTC](https://discuss.elastic.co/t/all-shards-failed-even-after-tuning/241080 "2020-07-16T14:14:31Z")
Hi all, I took a look into lots of open thread related to the error I'm getting. In my company we are using ELK 7.5.1 for a development enviroment. Both ELK and Kibana stay on the same machine with 8GB of RAM. The JVM… --- ## [Elasticsearch-7.8.0 user authentication implementation](https://discuss.elastic.co/t/elasticsearch-7-8-0-user-authentication-implementation/241456)
**Author:** [@Ashok\_Reddy](https://discuss.elastic.co/u/Ashok_Reddy)\ **Replies:** 4\ **Last updated:** [July 16, 2020, 2:11pm UTC](https://discuss.elastic.co/t/elasticsearch-7-8-0-user-authentication-implementation/241456 "2020-07-16T14:11:40Z")
Hello There, I am using elasticsearch 7.8.0, I want to implement the user authentication . is it possible to implement only user authentication without SSL enabled ( I don't want to enable ssl transport layer) ? --- ## [Exiting: error unpacking config data: more than one namespace configured accessing 'output' (source:'filebeat.yml')](https://discuss.elastic.co/t/exiting-error-unpacking-config-data-more-than-one-namespace-configured-accessing-output-source-filebeat-yml/240640)
**Author:** [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\ **Replies:** 7\ **Last updated:** [July 16, 2020, 2:04pm UTC](https://discuss.elastic.co/t/exiting-error-unpacking-config-data-more-than-one-namespace-configured-accessing-output-source-filebeat-yml/240640 "2020-07-16T14:04:00Z")
when i enable elasticsearch output and logstash output in filebeat.yml i get this error. Exiting: error unpacking config data: more than one namespace configured accessing 'output' (source:'filebeat.yml') please give m… --- ## [Parameter is missing in config for application/json content-type file Filebeat S3](https://discuss.elastic.co/t/parameter-is-missing-in-config-for-application-json-content-type-file-filebeat-s3/241427)
**Author:** [@Scrubsboy](https://discuss.elastic.co/u/Scrubsboy)\ **Replies:** 1\ **Last updated:** [July 16, 2020, 1:54pm UTC](https://discuss.elastic.co/t/parameter-is-missing-in-config-for-application-json-content-type-file-filebeat-s3/241427 "2020-07-16T13:54:30Z")
Hello, I face some issues with Filebeat, I installed it et and configure the Filebeat.yml but when i run filbeat with the command : ./filebeat -e i have this errors and no results are found in Kibana \*\*2020-07-16T11:09… --- ## [Canvas conditional text](https://discuss.elastic.co/t/canvas-conditional-text/241432)
**Author:** [@Hugo\_Pires](https://discuss.elastic.co/u/Hugo_Pires)\ **Replies:** 1\ **Last updated:** [July 16, 2020, 1:50pm UTC](https://discuss.elastic.co/t/canvas-conditional-text/241432 "2020-07-16T13:50:21Z")
Hello I've been working with conditional formatting of metrics. But I would like also to conditional show an up or down arrow according to the sign of variation. Is that possible? Thank you Hugo --- ## [Nested geo\_shape's only stores the first shape](https://discuss.elastic.co/t/nested-geo-shapes-only-stores-the-first-shape/241448)
**Author:** [@aes](https://discuss.elastic.co/u/aes)\ **Replies:** 1\ **Last updated:** [July 16, 2020, 1:46pm UTC](https://discuss.elastic.co/t/nested-geo-shapes-only-stores-the-first-shape/241448 "2020-07-16T13:46:57Z")
Given a mapping of: ... "polygons": { - "type": "nested", "properties": { - "polygon": { - "type": "geo\_shape" }, "name": { - "type… --- ## [How to restrict the panels of dashboard to not to use the global filters applied on?](https://discuss.elastic.co/t/how-to-restrict-the-panels-of-dashboard-to-not-to-use-the-global-filters-applied-on/241396)
**Author:** [@mohammadawaisjavaid](https://discuss.elastic.co/u/mohammadawaisjavaid)\ **Replies:** 1\ **Last updated:** [July 16, 2020, 1:35pm UTC](https://discuss.elastic.co/t/how-to-restrict-the-panels-of-dashboard-to-not-to-use-the-global-filters-applied-on/241396 "2020-07-16T13:35:31Z")
I'm using Kibana 7.8.I have a dashboard where I have different visualizations. When I select a filter, it ends up being applied to all the visualizations on the dashboard. I want the filter to be applied to only certain … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1922) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1924)