# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1927 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1928 --- ## [Tag \["\_parsegrokfailure"\] anyone could help me?](https://discuss.elastic.co/t/tag-parsegrokfailure-anyone-could-help-me/241190)
**Author:** [@Khaled3500](https://discuss.elastic.co/u/Khaled3500)\ **Replies:** 5\ **Last updated:** [July 15, 2020, 12:51pm UTC](https://discuss.elastic.co/t/tag-parsegrokfailure-anyone-could-help-me/241190 "2020-07-15T12:51:54Z")
Hello, I created a grok pattern and it works well on grok debugger but when i add to filter inside the pipeline it pass the restart phase for the service but on kibana it give this tag \["\_grokparsefailure"\] i tried to de… --- ## [Elasticsearch term aggregations : use case for a single field](https://discuss.elastic.co/t/elasticsearch-term-aggregations-use-case-for-a-single-field/240672)
**Author:** [@vic22](https://discuss.elastic.co/u/vic22)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 12:40pm UTC](https://discuss.elastic.co/t/elasticsearch-term-aggregations-use-case-for-a-single-field/240672 "2020-07-15T12:40:02Z")
Hello everyone, I try to understand term aggregations in Elasticsearch, and I don't know how to fix an particular use case : let me explain ! I try to catch all the element and their "key" values of a single field with… --- ## [Kibana Plugin Not working](https://discuss.elastic.co/t/kibana-plugin-not-working/241180)
**Author:** [@PRACHI\_GUPTA](https://discuss.elastic.co/u/PRACHI_GUPTA)\ **Replies:** 5\ **Last updated:** [July 15, 2020, 12:38pm UTC](https://discuss.elastic.co/t/kibana-plugin-not-working/241180 "2020-07-15T12:38:34Z")
I have integrated one custom kibana plugin but I can not find that in my kibana tool. I have setup the development environment, ran yarn kbn bootstrap and yarn start. I am not getting any issue. I checked in kibana bund… --- ## [Get specific string from field in logstash](https://discuss.elastic.co/t/get-specific-string-from-field-in-logstash/241276)
**Author:** [@tungpzostar](https://discuss.elastic.co/u/tungpzostar)\ **Replies:** 4\ **Last updated:** [July 15, 2020, 12:29pm UTC](https://discuss.elastic.co/t/get-specific-string-from-field-in-logstash/241276 "2020-07-15T12:29:45Z")
Hello, I'm new to logstash and I'm having trouble with this. I configured filebeat to receive Nginx log: This is sample input: "log": { "offset": 2234788, "file": { "path": "/nginxlogs/nginx.abc.1234.a… --- ## [Slurm Forwarding Error (anonymous user)](https://discuss.elastic.co/t/slurm-forwarding-error-anonymous-user/241292)
**Author:** [@Kerg09](https://discuss.elastic.co/u/Kerg09)\ **Replies:** 0\ **Last updated:** [July 15, 2020, 12:28pm UTC](https://discuss.elastic.co/t/slurm-forwarding-error-anonymous-user/241292 "2020-07-15T12:28:48Z")
Hello all. I am trying to set up a log forwarder from SLURM to elasticsearch using this guide https://slurm.schedmd.com/elasticsearch.html I have already run into a few snags. My Elasticsearch is encrypted using the xp… --- ## [Filebeat - Non-zero metrics in the last 30s](https://discuss.elastic.co/t/filebeat-non-zero-metrics-in-the-last-30s/241216)
**Author:** [@saravananveera](https://discuss.elastic.co/u/saravananveera)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 11:14am UTC](https://discuss.elastic.co/t/filebeat-non-zero-metrics-in-the-last-30s/241216 "2020-07-15T11:14:16Z")
Apparently logs are transferred from Filebeat to logstash, however the filebeat logs continiously show this message: 2020-07-15T01:18:20.789Z INFO \[monitoring\] log/log.go:124 Non-zero metrics in the last 30s {"monitorin… --- ## [How can I change the display of data in kibana from logstash?](https://discuss.elastic.co/t/how-can-i-change-the-display-of-data-in-kibana-from-logstash/241286)
**Author:** [@menes](https://discuss.elastic.co/u/menes)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 12:12pm UTC](https://discuss.elastic.co/t/how-can-i-change-the-display-of-data-in-kibana-from-logstash/241286 "2020-07-15T12:12:04Z")
Good afternoon. Logstash passes a numeric value in the form of 10000 to elasticsearch, but in kibana it is displayed as 10, 000 can I configure logstash to display numeric values by default without a separator in kibana… --- ## [How to make kibana UI Access secure with users with limited privileges](https://discuss.elastic.co/t/how-to-make-kibana-ui-access-secure-with-users-with-limited-privileges/240695)
**Author:** [@pankaj0172](https://discuss.elastic.co/u/pankaj0172)\ **Replies:** 5\ **Last updated:** [July 15, 2020, 12:06pm UTC](https://discuss.elastic.co/t/how-to-make-kibana-ui-access-secure-with-users-with-limited-privileges/240695 "2020-07-15T12:06:54Z")
Hi Team, How to make kibana UI Access secure with users/password with limited privileges in the basic license, like read-only access, full permission something like this, or any other suggestions? Also, I have another … --- ## [Selection based on duration?](https://discuss.elastic.co/t/selection-based-on-duration/238170)
**Author:** [@mykael](https://discuss.elastic.co/u/mykael)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 11:36am UTC](https://discuss.elastic.co/t/selection-based-on-duration/238170 "2020-07-15T11:36:08Z")
I've got some aggregate data that rolls up on a yearly basis. I've got real time data that feeds into one or more of the aggregated records to which I can add a field to indicating the yearly record it aggregates to. S… --- ## [Rss feed ingestion exception](https://discuss.elastic.co/t/rss-feed-ingestion-exception/241270)
**Author:** [@anu\_gaur](https://discuss.elastic.co/u/anu_gaur)\ **Replies:** 0\ **Last updated:** [July 15, 2020, 11:00am UTC](https://discuss.elastic.co/t/rss-feed-ingestion-exception/241270 "2020-07-15T11:00:47Z")
Hi, I am using logstash rss plugin for rss feeds ingestion in my elastic cloud. But when it try to ingest the feed, it throws exception Invalid RSS feed {:exception=\>#\} .… --- ## [Question regarding dedicated master nodes](https://discuss.elastic.co/t/question-regarding-dedicated-master-nodes/241267)
**Author:** [@Zerobot](https://discuss.elastic.co/u/Zerobot)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 10:41am UTC](https://discuss.elastic.co/t/question-regarding-dedicated-master-nodes/241267 "2020-07-15T10:41:53Z")
Hello! What will happen to elasticsearch cluster if 2 out of 3 dedicated master nodes will go down? Let's say we have replication factor 2 and basically 2/3 of our cluster went down - we still have the data because it … --- ## [Sum of Average aggregation in visualization](https://discuss.elastic.co/t/sum-of-average-aggregation-in-visualization/238533)
**Author:** [@umay\_fb](https://discuss.elastic.co/u/umay_fb)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 10:37am UTC](https://discuss.elastic.co/t/sum-of-average-aggregation-in-visualization/238533 "2020-07-15T10:37:48Z")
i using this script to get sum of average aggregation Script: { "size": 0, "aggs": { "by category": { "terms": { "field": "spv.keyword" }, "aggs": { "by user\_id": { "… --- ## [Logstash not able to create index](https://discuss.elastic.co/t/logstash-not-able-to-create-index/239941)
**Author:** [@sumitsahay](https://discuss.elastic.co/u/sumitsahay)\ **Replies:** 19\ **Last updated:** [July 15, 2020, 10:35am UTC](https://discuss.elastic.co/t/logstash-not-able-to-create-index/239941 "2020-07-15T10:35:03Z")
Hi All, My logstash file is not able to create the Index pattern in Kibana. My logstash.conf file /etc/logstash/conf.d/logstash.conf \< input { beats { port =\> 5044 type =\> syslog ssl\_certificate =\> "/etc… --- ## [Discover query with geolocation](https://discuss.elastic.co/t/discover-query-with-geolocation/241199)
**Author:** [@ClubberLang](https://discuss.elastic.co/u/ClubberLang)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 10:25am UTC](https://discuss.elastic.co/t/discover-query-with-geolocation/241199 "2020-07-15T10:25:12Z")
Hi, FYI, I'm just a newbie with ES, but so... let's start :slight\_smile: I currently have a "discovery query", imagine that I have "stores" and each store has "products". Noticed that each store is geolocalized. So, t… --- ## [Ingesting High Volume of AWS Flowlogs](https://discuss.elastic.co/t/ingesting-high-volume-of-aws-flowlogs/241151)
**Author:** [@sam6](https://discuss.elastic.co/u/sam6)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 10:16am UTC](https://discuss.elastic.co/t/ingesting-high-volume-of-aws-flowlogs/241151 "2020-07-15T10:16:10Z")
Hi, Im currently using the Logstash S3 input module to ingest flowlog data from an S3 bucket however it isn't pulling in enough data quick enough and so falling behind. I've tried upping the max batch size to 20000 in … --- ## [Logstash - Improving speed of reading data from Redis queue](https://discuss.elastic.co/t/logstash-improving-speed-of-reading-data-from-redis-queue/241260)
**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\ **Replies:** 0\ **Last updated:** [July 15, 2020, 9:56am UTC](https://discuss.elastic.co/t/logstash-improving-speed-of-reading-data-from-redis-queue/241260 "2020-07-15T09:56:09Z")
Hi, can you please help how to increase speed of reading messages from redis queue by Logstash? An application generates 100 mil. documents / day. I have 3 logstash instances. I've tried these input configuration: i… --- ## [Create data in Kibana](https://discuss.elastic.co/t/create-data-in-kibana/241249)
**Author:** [@leo.hamon](https://discuss.elastic.co/u/leo.hamon)\ **Replies:** 6\ **Last updated:** [July 15, 2020, 9:47am UTC](https://discuss.elastic.co/t/create-data-in-kibana/241249 "2020-07-15T09:47:07Z")
Hi everyone, I want to create data directly from Kibana, by making a visualization with inputs in my dashboard where the user can create data. To be a little bit more precise, let me give an example. I have some inform… --- ## [Clarifying the difference between Active shards and in-sync copies](https://discuss.elastic.co/t/clarifying-the-difference-between-active-shards-and-in-sync-copies/238716)
**Author:** [@paulcarey](https://discuss.elastic.co/u/paulcarey)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 9:06am UTC](https://discuss.elastic.co/t/clarifying-the-difference-between-active-shards-and-in-sync-copies/238716 "2020-07-15T09:06:18Z")
Hi The replication docs state a single in-sync copy is sufficient to serve read requests and then, when describing the read model, the same doc states that the basic flow Select\[s\] an active copy of each relevant … --- ## [Can we run Logstash API endpoint in HTTPS (secured)?](https://discuss.elastic.co/t/can-we-run-logstash-api-endpoint-in-https-secured/241251)
**Author:** [@Agniv\_Gon](https://discuss.elastic.co/u/Agniv_Gon)\ **Replies:** 0\ **Last updated:** [July 15, 2020, 8:36am UTC](https://discuss.elastic.co/t/can-we-run-logstash-api-endpoint-in-https-secured/241251 "2020-07-15T08:36:51Z")
In my logstash I have configured logstash.yml with below: http.host: "0.0.0.0" http.port: 9000 And it is working fine \[Api Webserver\] agent - Successfully started Logstash API endpoint {:port=\>9000} Is there a way we… --- ## [Rsyslog and Filebeats](https://discuss.elastic.co/t/rsyslog-and-filebeats/240982)
**Author:** [@srpine](https://discuss.elastic.co/u/srpine)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 8:31am UTC](https://discuss.elastic.co/t/rsyslog-and-filebeats/240982 "2020-07-15T08:31:00Z")
I am collecting logs from other serves to a syslog server using rsyslog. The result is a directory path with sub-directories under it that have the IP address of the server from where the logs came from. I have filebea… --- ## [Beats Digital Signature](https://discuss.elastic.co/t/beats-digital-signature/241186)
**Author:** [@tacomaster](https://discuss.elastic.co/u/tacomaster)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 8:22am UTC](https://discuss.elastic.co/t/beats-digital-signature/241186 "2020-07-15T08:22:13Z")
Hi, I was wondering if there are any plans on digitally signing the executables in beats on Windows? --- ## [ELK Stack on Kubernetes Architecture](https://discuss.elastic.co/t/elk-stack-on-kubernetes-architecture/241170)
**Author:** [@pulkit007](https://discuss.elastic.co/u/pulkit007)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 8:19am UTC](https://discuss.elastic.co/t/elk-stack-on-kubernetes-architecture/241170 "2020-07-15T08:19:20Z")
I want to deploy ELK stack on Kubernetes for monitoring logs stored in Persistant Volume in the Kubernetes namespace. Logs are generating from different nodes, but are stored at the same place in Persistant Volume. What … --- ## [How to import attribute from another analyzer plugin](https://discuss.elastic.co/t/how-to-import-attribute-from-another-analyzer-plugin/241013)
**Author:** [@JBo\_Shim](https://discuss.elastic.co/u/JBo_Shim)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 8:16am UTC](https://discuss.elastic.co/t/how-to-import-attribute-from-another-analyzer-plugin/241013 "2020-07-15T08:16:03Z")
Hi, I'm attempting to create custom token filter in elasticsearch (7.8.0, lucene 8.5.1). I managed to make my own plugin with filter, installed on my ES cluster. In this filter, I'm trying to use attribute from anothe… --- ## [How to ensure Lifecycle Policy is applied when redeploying Metricbeat in Kubernetes?](https://discuss.elastic.co/t/how-to-ensure-lifecycle-policy-is-applied-when-redeploying-metricbeat-in-kubernetes/241106)
**Author:** [@Mattness](https://discuss.elastic.co/u/Mattness)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 7:54am UTC](https://discuss.elastic.co/t/how-to-ensure-lifecycle-policy-is-applied-when-redeploying-metricbeat-in-kubernetes/241106 "2020-07-15T07:54:41Z")
Hello, I had a problem where my Metricbeat index would not update according to the Lifecycle Policy I had set in the config. As it turns out there was a default "metricbeat" Lifecycle Policy active which overrode my con… --- ## [Metricbeat service starts then stop when trying to use the MSSQL](https://discuss.elastic.co/t/metricbeat-service-starts-then-stop-when-trying-to-use-the-mssql/240545)
**Author:** [@jhaycraft](https://discuss.elastic.co/u/jhaycraft)\ **Replies:** 5\ **Last updated:** [July 15, 2020, 7:43am UTC](https://discuss.elastic.co/t/metricbeat-service-starts-then-stop-when-trying-to-use-the-mssql/240545 "2020-07-15T07:43:53Z")
I'm trying to log some metrics from Microsoft MSSQL and the Metricbeat service starts then stop. I'm thinking that I have something wrong in the mssql.yaml file that is causing this. Windows errors logs have not been m… --- ## [Reindex error!](https://discuss.elastic.co/t/reindex-error/241125)
**Author:** [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\ **Replies:** 5\ **Last updated:** [July 15, 2020, 7:09am UTC](https://discuss.elastic.co/t/reindex-error/241125 "2020-07-15T07:09:39Z")
Hello, I use elk version: v 7.7.1 I am using this command to reindex: POST \_reindex { "source": { "index": "logs-gelf-2020.07.06-000057" }, "dest": { "index": "tempconnect5" } } But i get that response: { "er… --- ## [Kibana scripted field (bad request error)](https://discuss.elastic.co/t/kibana-scripted-field-bad-request-error/238767)
**Author:** [@thanirin](https://discuss.elastic.co/u/thanirin)\ **Replies:** 4\ **Last updated:** [July 14, 2020, 3:45pm UTC](https://discuss.elastic.co/t/kibana-scripted-field-bad-request-error/238767 "2020-07-14T15:45:18Z")
Hi, so I added a scripted field in one of the index pattern. I am pretty sure the code should work fine. return doc\['sequence'\].value % 2 When I previewed the results, it works fine. However, when I tried to view it in… --- ## [Error in elk](https://discuss.elastic.co/t/error-in-elk/240956)
**Author:** [@Deepika\_Rawat](https://discuss.elastic.co/u/Deepika_Rawat)\ **Replies:** 11\ **Last updated:** [July 15, 2020, 6:34am UTC](https://discuss.elastic.co/t/error-in-elk/240956 "2020-07-15T06:34:45Z")
I tried to import using kv filter my logs started importing like this.. indent preformatted text by 4 spaces "authserver" =\> "a\_India RADIUS", "proto" =\> "6", "devname" =\> "FW\_1", "10:56:12\\tdate" =\> "2020-06-22\\tl… --- ## [Data Organization](https://discuss.elastic.co/t/data-organization/241178)
**Author:** [@liron\_gofberg](https://discuss.elastic.co/u/liron_gofberg)\ **Replies:** 3\ **Last updated:** [July 15, 2020, 6:29am UTC](https://discuss.elastic.co/t/data-organization/241178 "2020-07-15T06:29:57Z")
Hi, I have 150 thousands fathers and each father has 20 millions children there is only one type of document. document describes child and its father. I routed the documents by father id but I am not sure if it's a g… --- ## [Installing two heartbeat services in the same host](https://discuss.elastic.co/t/installing-two-heartbeat-services-in-the-same-host/241118)
**Author:** [@Randima\_Somathilaka](https://discuss.elastic.co/u/Randima_Somathilaka)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 5:31am UTC](https://discuss.elastic.co/t/installing-two-heartbeat-services-in-the-same-host/241118 "2020-07-15T05:31:16Z")
Hi, Is there a specific guide to install two heartbeat services inside the same host machine. These heartbeat instances are pointed to two different elastic cloud stacks. [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1926) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1928)