# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1944 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1945 --- ## [Import OpenVas reports into ELK](https://discuss.elastic.co/t/import-openvas-reports-into-elk/238539)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 3\ **Last updated:** [July 8, 2020, 3:36pm UTC](https://discuss.elastic.co/t/import-openvas-reports-into-elk/238539 "2020-07-08T15:36:05Z")
Hi, \*Note: Running ELK 6.8.10 Standalone Tested on two Greenbone products 1- GSM CE 6.0.7 2- Source Edition running on Debian 10, with the following components: \*gvm-libs-11.0 \*openvas-7.0 \*gvmd-9.0 \*master (ope… --- ## [Ip to internal dns netflow module filebeat](https://discuss.elastic.co/t/ip-to-internal-dns-netflow-module-filebeat/240377)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 3:17pm UTC](https://discuss.elastic.co/t/ip-to-internal-dns-netflow-module-filebeat/240377 "2020-07-08T15:17:18Z")
Hi there, I would like to know if is possible to translate private and public ip to dns using internal dns server? When was using elastiflow, we had something called iptodns which we could point the internal DNS to auto… --- ## [Metricbeat: System Call Level Is Not Correct](https://discuss.elastic.co/t/metricbeat-system-call-level-is-not-correct/240376)
**Author:** [@Guerreiro\_Sousa](https://discuss.elastic.co/u/Guerreiro_Sousa)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 3:17pm UTC](https://discuss.elastic.co/t/metricbeat-system-call-level-is-not-correct/240376 "2020-07-08T15:17:01Z")
I'm having trouble using the windows module. When trying to use the module a json with the following error message is returned: The system call level is not correct. My operating system is Windows Server 2003 (32-bit). … --- ## [Multiple ILM Policies on same index: Which one applies?](https://discuss.elastic.co/t/multiple-ilm-policies-on-same-index-which-one-applies/240269)
**Author:** [@Keff](https://discuss.elastic.co/u/Keff)\ **Replies:** 1\ **Last updated:** [July 8, 2020, 3:15pm UTC](https://discuss.elastic.co/t/multiple-ilm-policies-on-same-index-which-one-applies/240269 "2020-07-08T15:15:04Z")
If I define multiple ILM Policies on patterns that match the same index, which one applies? Does the one with the lower "min\_age" apply or the one which was created first? Or anything else? Example: If I now create the… --- ## [What will be the best way to process OAM logs](https://discuss.elastic.co/t/what-will-be-the-best-way-to-process-oam-logs/240371)
**Author:** [@Ashish\_kapoor](https://discuss.elastic.co/u/Ashish_kapoor)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 2:46pm UTC](https://discuss.elastic.co/t/what-will-be-the-best-way-to-process-oam-logs/240371 "2020-07-08T14:46:28Z")
Hi, I am trying to Process below logs. These logs look likes CSV logs. But I am not able to use CSV filter as in "NewSetting field", data is not properly formated for some logs("AUTHZ-POLICY:Policy name="Protected Reso… --- ## [Logstash filtering iterating over list](https://discuss.elastic.co/t/logstash-filtering-iterating-over-list/240364)
**Author:** [@ash2](https://discuss.elastic.co/u/ash2)\ **Replies:** 1\ **Last updated:** [July 8, 2020, 2:46pm UTC](https://discuss.elastic.co/t/logstash-filtering-iterating-over-list/240364 "2020-07-08T14:46:04Z")
I am trying to parse the following format of logs, starting value is a hostname, and the ending is timestamp always. blb12bkl4, data1 value1, data2 value2, data3 value3, 1594216629094 and the final format for output sh… --- ## [Transform error handling](https://discuss.elastic.co/t/transform-error-handling/240348)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 3\ **Last updated:** [July 8, 2020, 2:30pm UTC](https://discuss.elastic.co/t/transform-error-handling/240348 "2020-07-08T14:30:43Z")
hi there, is there a way to configure a transform to ignore errors? it seems that if it fails, it will changed the state the failed state, and stop the processing. example: imagine I define a transform for data-. da… --- ## [Using filebeat container with shared volume from another container](https://discuss.elastic.co/t/using-filebeat-container-with-shared-volume-from-another-container/239824)
**Author:** [@mzdev](https://discuss.elastic.co/u/mzdev)\ **Replies:** 4\ **Last updated:** [July 8, 2020, 2:17pm UTC](https://discuss.elastic.co/t/using-filebeat-container-with-shared-volume-from-another-container/239824 "2020-07-08T14:17:19Z")
Hello there, a quick question, we have an app that is using filebeat to ship logs, currently we're installing the filebeat package on the container itself, but due to a redesign we're toying with the idea of removing the… --- ## [Aggregation pagination and sort by document field](https://discuss.elastic.co/t/aggregation-pagination-and-sort-by-document-field/240211)
**Author:** [@nerd2000](https://discuss.elastic.co/u/nerd2000)\ **Replies:** 9\ **Last updated:** [July 8, 2020, 2:05pm UTC](https://discuss.elastic.co/t/aggregation-pagination-and-sort-by-document-field/240211 "2020-07-08T14:05:15Z")
Hi, I would like to know how to sort an aggregation result by a field in the document. My indice configuration { "id": { "type": "long" }, "film\_id": { "type": "long" }, "film\_group\_id": { "type"… --- ## [Issue with open files](https://discuss.elastic.co/t/issue-with-open-files/239300)
**Author:** [@WiseOwl](https://discuss.elastic.co/u/WiseOwl)\ **Replies:** 3\ **Last updated:** [July 8, 2020, 1:58pm UTC](https://discuss.elastic.co/t/issue-with-open-files/239300 "2020-07-08T13:58:40Z")
Hi All, I have an issue with a cluster setup. The setup has 3 nodes, all communicating via stunnel ( as per https://www.elastic.co/guide/en/cloud/current/ec-tunneling-ssl.html ). However, the link is flaky from time to… --- ## [How I can create a Discovery view with query like](https://discuss.elastic.co/t/how-i-can-create-a-discovery-view-with-query-like/240113)
**Author:** [@ksarkar](https://discuss.elastic.co/u/ksarkar)\ **Replies:** 2\ **Last updated:** [July 8, 2020, 1:44pm UTC](https://discuss.elastic.co/t/how-i-can-create-a-discovery-view-with-query-like/240113 "2020-07-08T13:44:50Z")
One of my table is getting populated by a time interval with some data from different channel with same time stamp. I wish to aggregate it w.r.t time. Sample query as below. select starttime, sum(available) as availa… --- ## [Unable to use mounted elastic-agent.yml if running in elastic-agent container](https://discuss.elastic.co/t/unable-to-use-mounted-elastic-agent-yml-if-running-in-elastic-agent-container/239202)
**Author:** [@hendry.lim](https://discuss.elastic.co/u/hendry.lim)\ **Replies:** 6\ **Last updated:** [July 8, 2020, 1:41pm UTC](https://discuss.elastic.co/t/unable-to-use-mounted-elastic-agent-yml-if-running-in-elastic-agent-container/239202 "2020-07-08T13:41:21Z")
Hi, I am using elastic-agent-7.9.0-SNAPSHOT docker image (also tested and encountered the same error with elastic-agent-8.0.0-SNAPSHOT docker image). My docker-compose.yml: version: '3.7' services: elastic-agent: … --- ## [Beats SSL Cert & Key exposure](https://discuss.elastic.co/t/beats-ssl-cert-key-exposure/240061)
**Author:** [@vishakh](https://discuss.elastic.co/u/vishakh)\ **Replies:** 2\ **Last updated:** [July 8, 2020, 1:18pm UTC](https://discuss.elastic.co/t/beats-ssl-cert-key-exposure/240061 "2020-07-08T13:18:04Z")
In every \*beat.yml file we define the output destination, In my case we use logstash for logs to be ingested from beats. Along the beats config.yml file we supply the logstash and kibana ssl cert and it's key. output.lo… --- ## [Write one query instead of four queries](https://discuss.elastic.co/t/write-one-query-instead-of-four-queries/240342)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 12:26pm UTC](https://discuss.elastic.co/t/write-one-query-instead-of-four-queries/240342 "2020-07-08T12:26:22Z")
Dears, I have a problem with write my proper query. I try to write one query which will do the same what other four queries which should: count docs which have codes 1?? or 2?? in ci.rc and count docs which have code… --- ## [Logstash windows scheduler does not stop](https://discuss.elastic.co/t/logstash-windows-scheduler-does-not-stop/240344)
**Author:** [@Kiran\_Bhadani](https://discuss.elastic.co/u/Kiran_Bhadani)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 12:28pm UTC](https://discuss.elastic.co/t/logstash-windows-scheduler-does-not-stop/240344 "2020-07-08T12:28:54Z")
I have setup windows task scheduler to run log stash, when I stop the task from task scheduler, logstash still keeps running in background --- ## [Clone visualization in Kibana](https://discuss.elastic.co/t/clone-visualization-in-kibana/240289)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 2\ **Last updated:** [July 8, 2020, 12:15pm UTC](https://discuss.elastic.co/t/clone-visualization-in-kibana/240289 "2020-07-08T12:15:34Z")
Hi, Is there a way to clone (Top pages \[Filebeat Nginx\] ECS) from visualize in order to edit the cloned version and keep the original one? I can see how can I clone dashboards but not visualizations? Any help is reall… --- ## [SlowLogs entries in both SlowLogs and Default Logs](https://discuss.elastic.co/t/slowlogs-entries-in-both-slowlogs-and-default-logs/239453)
**Author:** [@ankit2.agarwal](https://discuss.elastic.co/u/ankit2.agarwal)\ **Replies:** 1\ **Last updated:** [July 8, 2020, 12:11pm UTC](https://discuss.elastic.co/t/slowlogs-entries-in-both-slowlogs-and-default-logs/239453 "2020-07-08T12:11:54Z")
Hi, I am facing issue that my default log is full of slowlog entries. All though I have slowlogs for search and indexing getting generated separately. I have enabled slowlog in log4j.properties. I have daily indexes so … --- ## [Elasticsearch High CPU on GC and strange behaviors](https://discuss.elastic.co/t/elasticsearch-high-cpu-on-gc-and-strange-behaviors/240339)
**Author:** [@zaynkorai](https://discuss.elastic.co/u/zaynkorai)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 12:04pm UTC](https://discuss.elastic.co/t/elasticsearch-high-cpu-on-gc-and-strange-behaviors/240339 "2020-07-08T12:04:21Z")
Hello we have a elasticsearch(5.6) cluster and due to development overhead we can not upgrade our code for newer version of elasticsearch near soon. So there are some issues we are facing with it. Numbers one is high CP… --- ## [Logstash unable to connect to Redshift](https://discuss.elastic.co/t/logstash-unable-to-connect-to-redshift/240338)
**Author:** [@abhisheksimion](https://discuss.elastic.co/u/abhisheksimion)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 11:56am UTC](https://discuss.elastic.co/t/logstash-unable-to-connect-to-redshift/240338 "2020-07-08T11:56:20Z")
I am trying to load data from Amazon Redshift, but it always exists Logstash process by throwing below exception. Stacktrace \[2020-07-08T11:46:30,170\]\[INFO \]\[logstash.agent \] Pipelines running {:count=\>1, :… --- ## [Unable to create a proper processor for windows module to filter certain services](https://discuss.elastic.co/t/unable-to-create-a-proper-processor-for-windows-module-to-filter-certain-services/240330)
**Author:** [@yankun0567](https://discuss.elastic.co/u/yankun0567)\ **Replies:** 1\ **Last updated:** [July 8, 2020, 11:34am UTC](https://discuss.elastic.co/t/unable-to-create-a-proper-processor-for-windows-module-to-filter-certain-services/240330 "2020-07-08T11:34:46Z")
Hi, I'm currently evaluating metricbeat for monitoring our systems. On windows I would like to only monitor services, which are started automatically (or delayed) except a few services which are ok to be stopped, even i… --- ## [How to drop Document on FailureAction](https://discuss.elastic.co/t/how-to-drop-document-on-failureaction/240327)
**Author:** [@Bhaskar3184](https://discuss.elastic.co/u/Bhaskar3184)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 11:06am UTC](https://discuss.elastic.co/t/how-to-drop-document-on-failureaction/240327 "2020-07-08T11:06:20Z")
Hi, I am new to ELK, and trying to send the JSON data to elasticsearch, if the JSON format is given wrongly the Es is adding a document with "-". Can you please help me in avoiding the wrong input JSON. My script: i… --- ## [Aggregation terms and @timestamp](https://discuss.elastic.co/t/aggregation-terms-and-timestamp/240319)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 4\ **Last updated:** [July 8, 2020, 10:41am UTC](https://discuss.elastic.co/t/aggregation-terms-and-timestamp/240319 "2020-07-08T10:41:35Z")
Dears, Second my problem. Is there any way/method to filter doc by timestamp inside aggregation? or Is there any way/method to filter aggregated doc by timestamp? My aggregation looks like: GET /log-2020.07.07/\_sea… --- ## [After installing the security feature(Open distro) in elasticsearch, while starting server getting following error](https://discuss.elastic.co/t/after-installing-the-security-feature-open-distro-in-elasticsearch-while-starting-server-getting-following-error/240305)
**Author:** [@Rahul\_Chougule](https://discuss.elastic.co/u/Rahul_Chougule)\ **Replies:** 3\ **Last updated:** [July 8, 2020, 9:51am UTC](https://discuss.elastic.co/t/after-installing-the-security-feature-open-distro-in-elasticsearch-while-starting-server-getting-following-error/240305 "2020-07-08T09:51:34Z")
\[ERROR\]\[c.a.o.s.s.h.n.OpenDistroSecuritySSLNettyHttpServerTransport\] \[smoketestnode\] Exception during establishing a SSL connection: io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record: Please help..!! --- ## [How to use QueryBuilders for Multi-value field](https://discuss.elastic.co/t/how-to-use-querybuilders-for-multi-value-field/240325)
**Author:** [@PeterZhao](https://discuss.elastic.co/u/PeterZhao)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 10:46am UTC](https://discuss.elastic.co/t/how-to-use-querybuilders-for-multi-value-field/240325 "2020-07-08T10:46:29Z")
I am a new comer. I have a multi-value field with definition like 'docBuilder.field(FreeTextField, List )'. How could I use QueryBuilders to search matching any of the list items? --- ## [TSVB Calculated the Value Series](https://discuss.elastic.co/t/tsvb-calculated-the-value-series/240324)
**Author:** [@umay\_fb](https://discuss.elastic.co/u/umay_fb)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 10:39am UTC](https://discuss.elastic.co/t/tsvb-calculated-the-value-series/240324 "2020-07-08T10:39:08Z")
Hii All...... I had The Question,, Can we Calculated the value of Series TSVB.. ex: we create the parameter in series a, the we using the params series a in script bucket in series b.. i want using that cause i want … --- ## [Most stable version of ELK](https://discuss.elastic.co/t/most-stable-version-of-elk/240294)
**Author:** [@Feriel\_Mufti](https://discuss.elastic.co/u/Feriel_Mufti)\ **Replies:** 2\ **Last updated:** [July 8, 2020, 10:06am UTC](https://discuss.elastic.co/t/most-stable-version-of-elk/240294 "2020-07-08T10:06:53Z")
Hello , please i am new to ELK , and i want to know what is the latest stable version of ELK to use and what does it offer for free as advantages ( ps: i have used ELK 6.8.x and it seems an old version and it didn't offe… --- ## [Manage\_security cluster error](https://discuss.elastic.co/t/manage-security-cluster-error/237198)
**Author:** [@nameisnotimportant](https://discuss.elastic.co/u/nameisnotimportant)\ **Replies:** 4\ **Last updated:** [July 8, 2020, 9:54am UTC](https://discuss.elastic.co/t/manage-security-cluster-error/237198 "2020-07-08T09:54:13Z")
Hi, I created and granted a user with manage\_security cluster privileges. By right the user should be able to manage role but somehow, when the user click on role name or the Create role button, nothing happen. May i kno… --- ## [How to use dot codec in Logstash?](https://discuss.elastic.co/t/how-to-use-dot-codec-in-logstash/240291)
**Author:** [@abhisheksimion](https://discuss.elastic.co/u/abhisheksimion)\ **Replies:** 2\ **Last updated:** [July 8, 2020, 9:31am UTC](https://discuss.elastic.co/t/how-to-use-dot-codec-in-logstash/240291 "2020-07-08T09:31:51Z")
I am trying to use the dot codec in Logstash, but it gives below error \[ERROR\]\[logstash.plugins.registry\] Tried to load a plugin's code, but failed. {:exception=\>#\… --- ## [Elasticsearch GC allocation failure errors in GC.log](https://discuss.elastic.co/t/elasticsearch-gc-allocation-failure-errors-in-gc-log/240186)
**Author:** [@sammi](https://discuss.elastic.co/u/sammi)\ **Replies:** 0\ **Last updated:** [July 7, 2020, 3:40pm UTC](https://discuss.elastic.co/t/elasticsearch-gc-allocation-failure-errors-in-gc-log/240186 "2020-07-07T15:40:34Z")
Hi, I have allocated 32GB for elasticsearch heap memory and keep seeing below error in gc.log. \*\*\[2020-07-07T14:44:44.064+0000\]\[1\]\[gc,start \] GC(87) Pause Young (Allocation Failure)\*\* \*\*\[2020-07-07T14:44:44.064+0000… --- ## [Transform behavior with deleted documents](https://discuss.elastic.co/t/transform-behavior-with-deleted-documents/240172)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 4\ **Last updated:** [July 8, 2020, 9:15am UTC](https://discuss.elastic.co/t/transform-behavior-with-deleted-documents/240172 "2020-07-08T09:15:10Z")
Consider a source index that contains user authentications. I want to create a transform that contains, for each user, the oldest and newest login. It would look like this: Group by user Aggregate max(@timestamp) and m… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1943) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1945)