# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1929 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1930 --- ## [Custom column names for Discover tab columns](https://discuss.elastic.co/t/custom-column-names-for-discover-tab-columns/241175)
**Author:** [@nielarshi](https://discuss.elastic.co/u/nielarshi)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 5:37pm UTC](https://discuss.elastic.co/t/custom-column-names-for-discover-tab-columns/241175 "2020-07-14T17:37:24Z")
I am adding Discover tab in a dashboard. However, by default it takes field name as header. Can that be modified to have a custom name to make it more readable? I am following Scripted field approach but I have concerns… --- ## [Can't connect filebeat to logstash on the separate instances](https://discuss.elastic.co/t/cant-connect-filebeat-to-logstash-on-the-separate-instances/241132)
**Author:** [@Denis\_Denis](https://discuss.elastic.co/u/Denis_Denis)\ **Replies:** 2\ **Last updated:** [July 14, 2020, 5:28pm UTC](https://discuss.elastic.co/t/cant-connect-filebeat-to-logstash-on-the-separate-instances/241132 "2020-07-14T17:28:31Z")
Hello, I'm new with Elastic Stack and currently trying to build logging system with infrastructure type filebeat -\> logstash -\> elastic search -\> kibana. I'm using the separate AWS EC2 instance for logstash, elastic sea… --- ## [Logstash Worker Threads Blocked by Pipeline](https://discuss.elastic.co/t/logstash-worker-threads-blocked-by-pipeline/241165)
**Author:** [@mattb1](https://discuss.elastic.co/u/mattb1)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 4:44pm UTC](https://discuss.elastic.co/t/logstash-worker-threads-blocked-by-pipeline/241165 "2020-07-14T16:44:56Z")
Hi, Im using the 7.4.2 Version of the elastic Stack. One of my Logstash Pipelines Keeps blocking the Worker Threads after a While. Essentialy grinding all of the ingestion to a halt. As no other Pipelines can be execu… --- ## [Seperate dynamic comma seperated field into multiple fields](https://discuss.elastic.co/t/seperate-dynamic-comma-seperated-field-into-multiple-fields/241103)
**Author:** [@sz5ps5](https://discuss.elastic.co/u/sz5ps5)\ **Replies:** 1\ **Last updated:** [July 14, 2020, 4:30pm UTC](https://discuss.elastic.co/t/seperate-dynamic-comma-seperated-field-into-multiple-fields/241103 "2020-07-14T16:30:18Z")
Apologies I am new to ELK and Logstash so this may be a simple solution. I have a field that is currently in the elk stack, it is passing through Logstash. The field is dynamic in that is can have any number of values. … --- ## [Metricbeat 7.8 AWS/RDS | Events missing db\_instance.identifier, cluster\_identifier, etc](https://discuss.elastic.co/t/metricbeat-7-8-aws-rds-events-missing-db-instance-identifier-cluster-identifier-etc/240769)
**Author:** [@william.shipman](https://discuss.elastic.co/u/william.shipman)\ **Replies:** 2\ **Last updated:** [July 14, 2020, 4:21pm UTC](https://discuss.elastic.co/t/metricbeat-7-8-aws-rds-events-missing-db-instance-identifier-cluster-identifier-etc/240769 "2020-07-14T16:21:55Z")
The events I'm receiving from AWS/RDS do not match the shape I expect after reviewing the docs, so I'm requesting some clarification about the expected behavior. In particular, is it expected that some events will be gen… --- ## [Adding additional fields for Logstash Kinesis Input](https://discuss.elastic.co/t/adding-additional-fields-for-logstash-kinesis-input/240542)
**Author:** [@beyondcompare](https://discuss.elastic.co/u/beyondcompare)\ **Replies:** 5\ **Last updated:** [July 14, 2020, 4:19pm UTC](https://discuss.elastic.co/t/adding-additional-fields-for-logstash-kinesis-input/240542 "2020-07-14T16:19:04Z")
Hi everyone, I'd like to ask for some help from you please about adding additional fields to Logstash Kinesis Input. I have three logstash servers consuming a Kinesis Stream using Kinesis Input Plugin. Example like th… --- ## [Search for a negative value](https://discuss.elastic.co/t/search-for-a-negative-value/241159)
**Author:** [@Katia](https://discuss.elastic.co/u/Katia)\ **Replies:** 1\ **Last updated:** [July 14, 2020, 4:18pm UTC](https://discuss.elastic.co/t/search-for-a-negative-value/241159 "2020-07-14T16:18:39Z")
I have indexed fields containing character codes such as 3 1 1 and 3 1 -1. But when I search 3 1 -1 it seems that the "-" is not supported! could you please help me? GET /\_search { "query": { "match\_phra… --- ## [Active directory Authentication Problem](https://discuss.elastic.co/t/active-directory-authentication-problem/240838)
**Author:** [@Mahmoud\_Shash](https://discuss.elastic.co/u/Mahmoud_Shash)\ **Replies:** 4\ **Last updated:** [July 14, 2020, 4:16pm UTC](https://discuss.elastic.co/t/active-directory-authentication-problem/240838 "2020-07-14T16:16:34Z")
Hello Gents, I'm a newbie in the elastic World, actually, I'm counting on you to solve my problem. I've elastic search cluster and I need to do the Active directory integration I followed the https://www.elastic.co/gu… --- ## [Splitting nested /hierarchal documents in Logstash](https://discuss.elastic.co/t/splitting-nested-hierarchal-documents-in-logstash/241156)
**Author:** [@Ahmed\_Adly](https://discuss.elastic.co/u/Ahmed_Adly)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 3:33pm UTC](https://discuss.elastic.co/t/splitting-nested-hierarchal-documents-in-logstash/241156 "2020-07-14T15:33:58Z")
Hello, I'm using Logstash to read external REST API and feed elastic search. the API data looks like this: { ArrayOfParent: \[ Parent: { ArrayOfChildTypeOne: \[ {ID: 1, Name: child1} \], ArrayOfChil… --- ## [Logstash unable to parse with kv filter](https://discuss.elastic.co/t/logstash-unable-to-parse-with-kv-filter/240820)
**Author:** [@msk\_76](https://discuss.elastic.co/u/msk_76)\ **Replies:** 17\ **Last updated:** [July 14, 2020, 3:13pm UTC](https://discuss.elastic.co/t/logstash-unable-to-parse-with-kv-filter/240820 "2020-07-14T15:13:30Z")
My logstash configuration is working fine for most of the log cases but below exceptions are not working. My log has following format The json part consist of usual format "" "" both have space separator. In normal… --- ## [Vega, How to draw 2 Threshold/Limit lines](https://discuss.elastic.co/t/vega-how-to-draw-2-threshold-limit-lines/240337)
**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\ **Replies:** 12\ **Last updated:** [July 14, 2020, 3:10pm UTC](https://discuss.elastic.co/t/vega-how-to-draw-2-threshold-limit-lines/240337 "2020-07-14T15:10:41Z")
Hi, I currently have this vega visualiation (example): { "$schema": "https://vega.github.io/schema/vega/v4.3.json", "description": "A basic line chart example.", "padding": 5, data: \[ { name:"table" ur… --- ## [How to install Elasticsearch windows service on server with different versions of Java?](https://discuss.elastic.co/t/how-to-install-elasticsearch-windows-service-on-server-with-different-versions-of-java/240854)
**Author:** [@Gosforth](https://discuss.elastic.co/u/Gosforth)\ **Replies:** 1\ **Last updated:** [July 14, 2020, 3:05pm UTC](https://discuss.elastic.co/t/how-to-install-elasticsearch-windows-service-on-server-with-different-versions-of-java/240854 "2020-07-14T15:05:25Z")
I have at least two versions of Java on server so JAVA\_HOME points to version 8 not 11. To start manually start ES I just modified elasticsearch-env.bat: if "%JAVA\_HOME%" == "" ( set JAVA="%ES\_HOME%\\jdk\\bin\\java.exe"… --- ## [Filebeat Fortinet Module + Kibana SIEM](https://discuss.elastic.co/t/filebeat-fortinet-module-kibana-siem/236457)
**Author:** [@tjfred](https://discuss.elastic.co/u/tjfred)\ **Replies:** 10\ **Last updated:** [July 14, 2020, 2:31pm UTC](https://discuss.elastic.co/t/filebeat-fortinet-module-kibana-siem/236457 "2020-07-14T14:31:14Z")
Hello, I'm using the Fortinet module with Filebeat on Linux, logs are flowing and making their way into Elastic. Is there something I need to do to have these show in SIEM? The Fortinet module docs https://www.elastic.c… --- ## [Filebeat Fortinet Default Ingest Pipeline fails](https://discuss.elastic.co/t/filebeat-fortinet-default-ingest-pipeline-fails/238893)
**Author:** [@Mercwri](https://discuss.elastic.co/u/Mercwri)\ **Replies:** 5\ **Last updated:** [July 14, 2020, 2:28pm UTC](https://discuss.elastic.co/t/filebeat-fortinet-default-ingest-pipeline-fails/238893 "2020-07-14T14:28:45Z")
I have multiple Fortinet devices pushing logs to a collector running Filebeat 7.8.0 with the Fortinet module enabled. All of the logs are being ingested but the pipeline fails at decoding/normalizing the timestamps. I g… --- ## [Wrong result in Bool Query](https://discuss.elastic.co/t/wrong-result-in-bool-query/241136)
**Author:** [@buka\_bidzina](https://discuss.elastic.co/u/buka_bidzina)\ **Replies:** 11\ **Last updated:** [July 14, 2020, 2:19pm UTC](https://discuss.elastic.co/t/wrong-result-in-bool-query/241136 "2020-07-14T14:19:02Z")
Mapping PUT index PUT /index/\_mapping { "properties": { "categories": { "type": "nested", "properties": { "id": { "type": "integer" } } }, "deleted": { "… --- ## [Make the elasticsearch-input return only one hit](https://discuss.elastic.co/t/make-the-elasticsearch-input-return-only-one-hit/241146)
**Author:** [@Alessio\_Creo](https://discuss.elastic.co/u/Alessio_Creo)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 2:10pm UTC](https://discuss.elastic.co/t/make-the-elasticsearch-input-return-only-one-hit/241146 "2020-07-14T14:10:20Z")
Hi, I'm trying to use Logstash to ingest just one hit from an Elasticsearch index. This is my input configuration input{ elasticsearch{ hosts=\>\["logmgrappa.risorse.int:9200","logmgrappb.risorse.int:9200","logmgr… --- ## [Options List (Control) Default Value Issue/Question](https://discuss.elastic.co/t/options-list-control-default-value-issue-question/241144)
**Author:** [@tenet\_testuser1](https://discuss.elastic.co/u/tenet_testuser1)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 2:10pm UTC](https://discuss.elastic.co/t/options-list-control-default-value-issue-question/241144 "2020-07-14T14:10:14Z")
Hello, Using kibana 7.8. I created a drop down list control to use in a Dashboard. The drop down is for dates. I would like the default to be the most recent date in the dropdown. However, I am unable to make this work… --- ## [Rejected execution](https://discuss.elastic.co/t/rejected-execution/240984)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 8\ **Last updated:** [July 14, 2020, 2:05pm UTC](https://discuss.elastic.co/t/rejected-execution/240984 "2020-07-14T14:05:58Z")
Hello World! I'm using Elasticsearch 6.8.10 and trying to run a query, yet running into following issue: { "shard" : 3, "node" : "koEOgkkDBhOVfKHA7QXBjj", "reason" : { "reason" : "rejected execution of o… --- ## [Target node question](https://discuss.elastic.co/t/target-node-question/241105)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 2\ **Last updated:** [July 14, 2020, 1:55pm UTC](https://discuss.elastic.co/t/target-node-question/241105 "2020-07-14T13:55:06Z")
Hi, Just a question. The amount of data my old (6.7 / 6.8) platform needs to process explodes. So I'm busy tuning that until my new (7.x) platform is ready. Now I have a bunch of indexes of which 2 or 3 are large and … --- ## [Internal metric collection ends up in "Standalone Cluster" regardless cluster\_uuid setting](https://discuss.elastic.co/t/internal-metric-collection-ends-up-in-standalone-cluster-regardless-cluster-uuid-setting/240320)
**Author:** [@YvorL](https://discuss.elastic.co/u/YvorL)\ **Replies:** 12\ **Last updated:** [July 14, 2020, 1:17pm UTC](https://discuss.elastic.co/t/internal-metric-collection-ends-up-in-standalone-cluster-regardless-cluster-uuid-setting/240320 "2020-07-14T13:17:32Z")
Hi, ES, APM version: 7.2.1 I've seen this before with Filebeat but it wasn't important at the time but now that I added an APM server to the cluster it's frustrating. ES, Kibana, and Logstash are correctly grouped so I… --- ## [Kibana Export to CSV Date Period Problem](https://discuss.elastic.co/t/kibana-export-to-csv-date-period-problem/239557)
**Author:** [@aglush](https://discuss.elastic.co/u/aglush)\ **Replies:** 5\ **Last updated:** [July 14, 2020, 1:14pm UTC](https://discuss.elastic.co/t/kibana-export-to-csv-date-period-problem/239557 "2020-07-14T13:14:58Z")
I have noticed the following anomaly (defect?) in Kibana's export Query Results to CSV behavior: Export to CSV does not correspond to selection criteria and returned results by the query. For example search for the last … --- ## [Adding script\_fields to transform index using painless scripts](https://discuss.elastic.co/t/adding-script-fields-to-transform-index-using-painless-scripts/240601)
**Author:** [@InfiniteDreamer](https://discuss.elastic.co/u/InfiniteDreamer)\ **Replies:** 2\ **Last updated:** [July 14, 2020, 1:02pm UTC](https://discuss.elastic.co/t/adding-script-fields-to-transform-index-using-painless-scripts/240601 "2020-07-14T13:02:50Z")
we have fields like hour of day, week of month,quarter of year.. derived from @timestamp field using scripted field in kibana. We want to create a transform index to summarize our operational data, we want to store thos… --- ## [Anomaly Detection: Stop alerting on one of the Partitioned value](https://discuss.elastic.co/t/anomaly-detection-stop-alerting-on-one-of-the-partitioned-value/241036)
**Author:** [@alexisdrnt](https://discuss.elastic.co/u/alexisdrnt)\ **Replies:** 2\ **Last updated:** [July 14, 2020, 12:41pm UTC](https://discuss.elastic.co/t/anomaly-detection-stop-alerting-on-one-of-the-partitioned-value/241036 "2020-07-14T12:41:46Z")
Hey, I'm running a machine learning job using a partition key. I want to stop alerting on one of the partition key, or even better if I could remove all the data for this particular partition value and not alert anymor… --- ## [TSVB Markdown](https://discuss.elastic.co/t/tsvb-markdown/239514)
**Author:** [@ahadi](https://discuss.elastic.co/u/ahadi)\ **Replies:** 5\ **Last updated:** [July 14, 2020, 12:32pm UTC](https://discuss.elastic.co/t/tsvb-markdown/239514 "2020-07-14T12:32:34Z")
Hi, Do you know how to create a scroll to top button with tsvb markdown in kibana using CSS ? --- ## [Logstash date filter and Timestamp](https://discuss.elastic.co/t/logstash-date-filter-and-timestamp/241110)
**Author:** [@Nikita\_Shetty](https://discuss.elastic.co/u/Nikita_Shetty)\ **Replies:** 3\ **Last updated:** [July 14, 2020, 12:29pm UTC](https://discuss.elastic.co/t/logstash-date-filter-and-timestamp/241110 "2020-07-14T12:29:06Z")
I have field called created\_date in my table and the data is in the format - 2020-07-14 10:41:24.879884 +05:30. Want to parse this data and map it to the timestamp field in logstash. Used the below log pattern in the con… --- ## [Client certificate selection by metricbeat](https://discuss.elastic.co/t/client-certificate-selection-by-metricbeat/241123)
**Author:** [@goromorotolo](https://discuss.elastic.co/u/goromorotolo)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 11:49am UTC](https://discuss.elastic.co/t/client-certificate-selection-by-metricbeat/241123 "2020-07-14T11:49:50Z")
Hi, I have configured elasticsearch to request a client certificate from clients. This has been configured in addition to username and password. The truststore configured in elasticsearch only holds one "server certifi… --- ## [RestHighLevelClient - Unable to parse response body](https://discuss.elastic.co/t/resthighlevelclient-unable-to-parse-response-body/240809)
**Author:** [@drouinc](https://discuss.elastic.co/u/drouinc)\ **Replies:** 1\ **Last updated:** [July 14, 2020, 12:04pm UTC](https://discuss.elastic.co/t/resthighlevelclient-unable-to-parse-response-body/240809 "2020-07-14T12:04:46Z")
I'm new to ES and wiring up my first sample in a Java Spring Boot app. I'm using the pure RestHighLevelClient approach but seem to keep getting a Unable to parse response body message when I call the client. I'm a bi… --- ## [Filebeat ignore log entries with certain size](https://discuss.elastic.co/t/filebeat-ignore-log-entries-with-certain-size/241009)
**Author:** [@sfenman](https://discuss.elastic.co/u/sfenman)\ **Replies:** 2\ **Last updated:** [July 14, 2020, 11:45am UTC](https://discuss.elastic.co/t/filebeat-ignore-log-entries-with-certain-size/241009 "2020-07-14T11:45:08Z")
Hello, I am using filebeat to parse logs from my server directly to Elastic cloud. Sometimes there are some inconsistent logs entries with hundreds of log lines which I don't want to harvest them. Is there any way I can… --- ## [Filterrows using a subquery](https://discuss.elastic.co/t/filterrows-using-a-subquery/241122)
**Author:** [@Ayden](https://discuss.elastic.co/u/Ayden)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 11:45am UTC](https://discuss.elastic.co/t/filterrows-using-a-subquery/241122 "2020-07-14T11:45:16Z")
Hello, I'm trying to filter the result of a query using a subquery. Since elastic sql does not support it, I'm trying to do this using a canvas function. Is this possible using canvas function? Is there any other way? H… --- ## [Creating a TSVB table with multiple fields displayed in the table](https://discuss.elastic.co/t/creating-a-tsvb-table-with-multiple-fields-displayed-in-the-table/241121)
**Author:** [@EdH](https://discuss.elastic.co/u/EdH)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 11:37am UTC](https://discuss.elastic.co/t/creating-a-tsvb-table-with-multiple-fields-displayed-in-the-table/241121 "2020-07-14T11:37:13Z")
Hi, I am looking to create TSVB tables in Kibana with multiple fields displayed in the table to avoid switching between multiple dashboards. I'd like to have a table with 3 fields to display computer name (host.geoname)… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1928) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1930)