# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1962 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1963 --- ## [Filebeat and Logstash are running but no output on logstash](https://discuss.elastic.co/t/filebeat-and-logstash-are-running-but-no-output-on-logstash/239255)
**Author:** [@falconpurple](https://discuss.elastic.co/u/falconpurple)\ **Replies:** 1\ **Last updated:** [June 30, 2020, 11:42am UTC](https://discuss.elastic.co/t/filebeat-and-logstash-are-running-but-no-output-on-logstash/239255 "2020-06-30T11:42:31Z")
I have configured elk stack with filebeat. I am standing logs from filebeat to logstash but it's not running. The configuration in filebeat.yml : filebeat.inputs: - type: log enabled: true -C:/Users/mohnadik/… --- ## [Index pattern created not visible until Kibana restart](https://discuss.elastic.co/t/index-pattern-created-not-visible-until-kibana-restart/239282)
**Author:** [@LievenMerckx](https://discuss.elastic.co/u/LievenMerckx)\ **Replies:** 0\ **Last updated:** [June 30, 2020, 11:27am UTC](https://discuss.elastic.co/t/index-pattern-created-not-visible-until-kibana-restart/239282 "2020-06-30T11:27:38Z")
See https://discuss.elastic.co/t/problems-to-create-an-index-pattern/179787 I got the same behaviour as the above issue. You create an index pattern but when switching to Discovery , it's not there. Also in the "Index … --- ## [Metricbeat service don't start (Win2019)](https://discuss.elastic.co/t/metricbeat-service-dont-start-win2019/237972)
**Author:** [@DucretJe](https://discuss.elastic.co/u/DucretJe)\ **Replies:** 1\ **Last updated:** [June 30, 2020, 11:31am UTC](https://discuss.elastic.co/t/metricbeat-service-dont-start-win2019/237972 "2020-06-30T11:31:42Z")
Hello, I'm trying to install metricbeat on a Windows Server 2019. I'm using Elastic Metricbeat 7.8.0 installed with the .msi package. I begin with: .\\metricbeat.exe setup Overwritng ILM policy is disabled. Set \`setup… --- ## [Newline characters in syslog output](https://discuss.elastic.co/t/newline-characters-in-syslog-output/239279)
**Author:** [@brandonstark](https://discuss.elastic.co/u/brandonstark)\ **Replies:** 0\ **Last updated:** [June 30, 2020, 11:18am UTC](https://discuss.elastic.co/t/newline-characters-in-syslog-output/239279 "2020-06-30T11:18:41Z")
My incoming syslog has newline characters. In Kibana I see the messages as multiline text. The outgoing syslog messages change the newlines to literal "\\n". For example, the incoming message: incoming message app… --- ## [How to plot (raw) data, Using Vega](https://discuss.elastic.co/t/how-to-plot-raw-data-using-vega/238259)
**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\ **Replies:** 22\ **Last updated:** [June 30, 2020, 11:14am UTC](https://discuss.elastic.co/t/how-to-plot-raw-data-using-vega/238259 "2020-06-30T11:14:29Z")
Hi, I want to plot my raw time series data. As far as I know this is not possible with normal visualizations. This is why I am currently looking into Vega-Lite. The data structure looks like this: { "\_index": "index\_… --- ## [Winlogbeat Failed to publish events caused by: lumberjack protocol error](https://discuss.elastic.co/t/winlogbeat-failed-to-publish-events-caused-by-lumberjack-protocol-error/238469)
**Author:** [@Phillip](https://discuss.elastic.co/u/Phillip)\ **Replies:** 1\ **Last updated:** [June 30, 2020, 11:14am UTC](https://discuss.elastic.co/t/winlogbeat-failed-to-publish-events-caused-by-lumberjack-protocol-error/238469 "2020-06-30T11:14:20Z")
Hi, I wanted to install winloagbeat on an Windows Server to get his informations. I forwarded the logs to lagstash, but after starting the service, the following problems are appearing: 2020-06-24T14:41:32.573+0200 ERR… --- ## [How to format or delete typical bold "filters" field in a visualization](https://discuss.elastic.co/t/how-to-format-or-delete-typical-bold-filters-field-in-a-visualization/239276)
**Author:** [@Juanjo\_Herrero\_Berme](https://discuss.elastic.co/u/Juanjo_Herrero_Berme)\ **Replies:** 0\ **Last updated:** [June 30, 2020, 11:03am UTC](https://discuss.elastic.co/t/how-to-format-or-delete-typical-bold-filters-field-in-a-visualization/239276 "2020-06-30T11:03:15Z")
Hi, im looking for a way to delete or format the typical "filters" field (in bold default) in many visualizations in order to make a presentation more beautiful visually. I'm working in Kibana 7.3.0 now. Some examples: … --- ## [Kibana control Logstash](https://discuss.elastic.co/t/kibana-control-logstash/239275)
**Author:** [@Jasmin](https://discuss.elastic.co/u/Jasmin)\ **Replies:** 0\ **Last updated:** [June 30, 2020, 11:00am UTC](https://discuss.elastic.co/t/kibana-control-logstash/239275 "2020-06-30T11:00:16Z")
Hi , i want when kibana user specify exact date this date is writing to logstash : select \* from Tables where date = "variable" if this date does'nt exist on elasticsearch , so the logstash only select information wan… --- ## [So seriously, what permissions do beats need?](https://discuss.elastic.co/t/so-seriously-what-permissions-do-beats-need/238958)
**Author:** [@sej7278](https://discuss.elastic.co/u/sej7278)\ **Replies:** 8\ **Last updated:** [June 30, 2020, 10:31am UTC](https://discuss.elastic.co/t/so-seriously-what-permissions-do-beats-need/238958 "2020-06-30T10:31:42Z")
So contrary to the docs even this lot doesn't work: POST /\_security/api\_key { "name": "{beat\_default\_index\_prefix}\_localhost", "role\_descriptors": { "{beat\_default\_index\_prefix}\_writer": { "cluster": \["mon… --- ## [Select Only new entries from Mssql](https://discuss.elastic.co/t/select-only-new-entries-from-mssql/239268)
**Author:** [@Jasmin](https://discuss.elastic.co/u/Jasmin)\ **Replies:** 1\ **Last updated:** [June 30, 2020, 10:13am UTC](https://discuss.elastic.co/t/select-only-new-entries-from-mssql/239268 "2020-06-30T10:13:01Z")
Hi, Logstash is listening to MSSQL using JBCD connector , i want to make logstash select only new entires because i have millions of Tables , and select them all every time gonna make MSSQL so Slow . so How can i mak… --- ## [Flag a result based on a ES "sub" query](https://discuss.elastic.co/t/flag-a-result-based-on-a-es-sub-query/239269)
**Author:** [@PeteAllison](https://discuss.elastic.co/u/PeteAllison)\ **Replies:** 0\ **Last updated:** [June 30, 2020, 10:06am UTC](https://discuss.elastic.co/t/flag-a-result-based-on-a-es-sub-query/239269 "2020-06-30T10:06:54Z")
Hi all! Hopefully somebody is able to assist or point me in the right direction with this. I look after an online store and we use Elasticsearch (v 5.5) for all of our product lookups. We want to implement functionali… --- ## [Integrate kibana watcher alerts for trigger & resolve status in pagerduty](https://discuss.elastic.co/t/integrate-kibana-watcher-alerts-for-trigger-resolve-status-in-pagerduty/236972)
**Author:** [@ravielast](https://discuss.elastic.co/u/ravielast)\ **Replies:** 4\ **Last updated:** [June 30, 2020, 9:45am UTC](https://discuss.elastic.co/t/integrate-kibana-watcher-alerts-for-trigger-resolve-status-in-pagerduty/236972 "2020-06-30T09:45:00Z")
Is there any watcher code & configuration on kibana watcher code to verify the status of trigger & resolve in Pagerduty. --- ## [Querying syslog data to fetch unique error messages](https://discuss.elastic.co/t/querying-syslog-data-to-fetch-unique-error-messages/239259)
**Author:** [@N220](https://discuss.elastic.co/u/N220)\ **Replies:** 0\ **Last updated:** [June 30, 2020, 9:07am UTC](https://discuss.elastic.co/t/querying-syslog-data-to-fetch-unique-error-messages/239259 "2020-06-30T09:07:35Z")
Here is the query I have tried.... Although I have kept filter\_duplicate\_text as true still I get messages of the form {"............June 3 time stamp ...log message.............."} I want to filter out all these duplica… --- ## [Elastsicsearch: Odd Behaviour on Index Deletion](https://discuss.elastic.co/t/elastsicsearch-odd-behaviour-on-index-deletion/237747)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 7\ **Last updated:** [June 30, 2020, 9:04am UTC](https://discuss.elastic.co/t/elastsicsearch-odd-behaviour-on-index-deletion/237747 "2020-06-30T09:04:50Z")
Hi, I'm running elasticsearch 6.8.6 and am seeing this odd behaviour on deleting an old filebeat index. Here is the log from the master node which shows what's happening: \[2020-06-19T07:06:30,899\]\[INFO \]\[o.e.c.m.MetaDa… --- ## [Beat doesn't take in count index template configuration](https://discuss.elastic.co/t/beat-doesnt-take-in-count-index-template-configuration/239258)
**Author:** [@NeitoFR](https://discuss.elastic.co/u/NeitoFR)\ **Replies:** 0\ **Last updated:** [June 30, 2020, 9:04am UTC](https://discuss.elastic.co/t/beat-doesnt-take-in-count-index-template-configuration/239258 "2020-06-30T09:04:15Z")
I'm using the ELK Stack in version 7.5.2 in Docker container on a CentOS7 AWS Machine. My goal is to load filebeat Kibana dashboards with custom index pattern set (to replace the filebeat-\* default). Here is the beginn… --- ## [Highlights not returned for multiple queries on the same JSON object field](https://discuss.elastic.co/t/highlights-not-returned-for-multiple-queries-on-the-same-json-object-field/239140)
**Author:** [@CPot](https://discuss.elastic.co/u/CPot)\ **Replies:** 2\ **Last updated:** [June 30, 2020, 9:00am UTC](https://discuss.elastic.co/t/highlights-not-returned-for-multiple-queries-on-the-same-json-object-field/239140 "2020-06-30T09:00:09Z")
Hi all, I have the following query: With ES 7.5 "query": { "bool": { "must": \[ { "term": { "siren": "493754261" } } \], "should": \[ { … --- ## [Configuring Packetbeat with Logstash and GeoIP](https://discuss.elastic.co/t/configuring-packetbeat-with-logstash-and-geoip/239208)
**Author:** [@chancewwr](https://discuss.elastic.co/u/chancewwr)\ **Replies:** 3\ **Last updated:** [June 30, 2020, 8:29am UTC](https://discuss.elastic.co/t/configuring-packetbeat-with-logstash-and-geoip/239208 "2020-06-30T08:29:53Z")
First, hello all! I am a bit new to the elastic stack as a whole but am learning quickly thanks to the great documentation available. One piece of documentation I've found lacking is how exactly to configure packetbeat t… --- ## [How can I show average by 2 month from TSVB?](https://discuss.elastic.co/t/how-can-i-show-average-by-2-month-from-tsvb/234675)
**Author:** [@Ethonwu](https://discuss.elastic.co/u/Ethonwu)\ **Replies:** 2\ **Last updated:** [June 30, 2020, 8:26am UTC](https://discuss.elastic.co/t/how-can-i-show-average-by-2-month-from-tsvb/234675 "2020-06-30T08:26:44Z")
Hello , I am ELK rookie I have a small question wanna ask here How can I show average by 2 month from TSVB ? Here is sample data like this : date Execution Time Job Name 20200102 … --- ## [Iterate watcher hits and perform action on each hit](https://discuss.elastic.co/t/iterate-watcher-hits-and-perform-action-on-each-hit/236702)
**Author:** [@Jeroen2](https://discuss.elastic.co/u/Jeroen2)\ **Replies:** 1\ **Last updated:** [June 30, 2020, 8:13am UTC](https://discuss.elastic.co/t/iterate-watcher-hits-and-perform-action-on-each-hit/236702 "2020-06-30T08:13:35Z")
Hi, in the example below I have a condition where I send an alert if the first hit contains the query 'some\_query'. Is it possible to iterate all hits and sent/stack all hits in an action? "condition": { "script": … --- ## [About the installed plugins when upgrade Java (8 - \> 11)](https://discuss.elastic.co/t/about-the-installed-plugins-when-upgrade-java-8-11/239236)
**Author:** [@Hyunsoo\_Shim](https://discuss.elastic.co/u/Hyunsoo_Shim)\ **Replies:** 1\ **Last updated:** [June 30, 2020, 8:11am UTC](https://discuss.elastic.co/t/about-the-installed-plugins-when-upgrade-java-8-11/239236 "2020-06-30T08:11:01Z")
Hello, We are using Elasticsearch 6.5.2 on Java 8 currently, and have a plan to upgrade Java 11 for using G1GC safely. But, we have already installed many custom plugins made of Java 8. Do we need to install them aga… --- ## [Watcher sometimes input-search hits.total return 0](https://discuss.elastic.co/t/watcher-sometimes-input-search-hits-total-return-0/236677)
**Author:** [@fenggao11](https://discuss.elastic.co/u/fenggao11)\ **Replies:** 1\ **Last updated:** [June 30, 2020, 8:10am UTC](https://discuss.elastic.co/t/watcher-sometimes-input-search-hits-total-return-0/236677 "2020-06-30T08:10:01Z")
my watcher json { "trigger": { "schedule": { "interval": "30m" } }, "input": { "search": { "request": { "search\_type": "query\_t… --- ## [Watcher only fires with single character matching](https://discuss.elastic.co/t/watcher-only-fires-with-single-character-matching/236660)
**Author:** [@medal](https://discuss.elastic.co/u/medal)\ **Replies:** 1\ **Last updated:** [June 30, 2020, 8:08am UTC](https://discuss.elastic.co/t/watcher-only-fires-with-single-character-matching/236660 "2020-06-30T08:08:55Z")
Hello, I am currently creating a watcher, which should trigger everytime a specific action (Azure NSG change) is detected within the logs. My watcher is never fired if I try to use the value provided by Azure to detect… --- ## [Two different email IDs with two different BODY in a single watcher code](https://discuss.elastic.co/t/two-different-email-ids-with-two-different-body-in-a-single-watcher-code/236286)
**Author:** [@sai\_krishna\_bsk](https://discuss.elastic.co/u/sai_krishna_bsk)\ **Replies:** 1\ **Last updated:** [June 30, 2020, 8:05am UTC](https://discuss.elastic.co/t/two-different-email-ids-with-two-different-body-in-a-single-watcher-code/236286 "2020-06-30T08:05:32Z")
Hi All, I want to send alert to two different email ids with two different text as a BODY from a single watcher code. so basically email id one will receive full customer details and email id two will get only limited i… --- ## [I have issues with "ctx.payload.hits.total": null](https://discuss.elastic.co/t/i-have-issues-with-ctx-payload-hits-total-null/236118)
**Author:** [@gelvismo](https://discuss.elastic.co/u/gelvismo)\ **Replies:** 1\ **Last updated:** [June 30, 2020, 8:02am UTC](https://discuss.elastic.co/t/i-have-issues-with-ctx-payload-hits-total-null/236118 "2020-06-30T08:02:04Z")
"My Watcher results is the next, i dont know what does it mean." "condition": { "type": "compare", "status": "success", "met": false, "compare": { "resolved\_values": { "ctx.payload.hits.total": null } } }, "ac… --- ## [Is it possible to add threshold line on Lens in Kibana 7.6?](https://discuss.elastic.co/t/is-it-possible-to-add-threshold-line-on-lens-in-kibana-7-6/238213)
**Author:** [@mmk1995](https://discuss.elastic.co/u/mmk1995)\ **Replies:** 3\ **Last updated:** [June 30, 2020, 7:56am UTC](https://discuss.elastic.co/t/is-it-possible-to-add-threshold-line-on-lens-in-kibana-7-6/238213 "2020-06-30T07:56:56Z")
There is no metrics and axes option in Lens visualization. Is it possible to add threshold line on Lens in Kibana 7.6? Thank you. --- ## [Watcher basics Looping into the bucket and processing its values](https://discuss.elastic.co/t/watcher-basics-looping-into-the-bucket-and-processing-its-values/235849)
**Author:** [@Rolf\_Nufable](https://discuss.elastic.co/u/Rolf_Nufable)\ **Replies:** 1\ **Last updated:** [June 30, 2020, 7:56am UTC](https://discuss.elastic.co/t/watcher-basics-looping-into-the-bucket-and-processing-its-values/235849 "2020-06-30T07:56:46Z")
Hi All, I'm fairly new to watchers (just started to learn about it yesterday, and I'm quite in a problem here wherein I want to know if the value of the doc\_count is greater than 10 ( for example ) and would hopefully a… --- ## [Query about cluster metadata file - global.sts](https://discuss.elastic.co/t/query-about-cluster-metadata-file-global-sts/239128)
**Author:** [@chaitra\_hegde](https://discuss.elastic.co/u/chaitra_hegde)\ **Replies:** 3\ **Last updated:** [June 30, 2020, 7:36am UTC](https://discuss.elastic.co/t/query-about-cluster-metadata-file-global-sts/239128 "2020-06-30T07:36:04Z")
Hi, I have an Elasticsearch cluster with version 6.6.1. I have 14 data nodes, 3 master nodes, 3 client nodes. When I check in the above elasticsearch nodes under data/nodes/0/\_state folder I can see different version o… --- ## [Create users in kibana basic license](https://discuss.elastic.co/t/create-users-in-kibana-basic-license/239240)
**Author:** [@igarci](https://discuss.elastic.co/u/igarci)\ **Replies:** 0\ **Last updated:** [June 30, 2020, 7:32am UTC](https://discuss.elastic.co/t/create-users-in-kibana-basic-license/239240 "2020-06-30T07:32:45Z")
Hi everyone I would like to create different users in kibana 7.1. With different permissions in the basic license, I have read the documentation to do it, but could not understand how to do it step by step, there is a l… --- ## [Cannot set up script\_score for dense\_vector using Java REST API](https://discuss.elastic.co/t/cannot-set-up-script-score-for-dense-vector-using-java-rest-api/238849)
**Author:** [@ivanqwam](https://discuss.elastic.co/u/ivanqwam)\ **Replies:** 2\ **Last updated:** [June 29, 2020, 4:34pm UTC](https://discuss.elastic.co/t/cannot-set-up-script-score-for-dense-vector-using-java-rest-api/238849 "2020-06-29T16:34:25Z")
I want to search similar sentences using dense vectors calculated by BERT. I am following this great paper in french or english I indexed sentences with each having a dense\_vector calculated by BERT. I ran this query … --- ## [If else Painless Script on a Painless Scripted Field](https://discuss.elastic.co/t/if-else-painless-script-on-a-painless-scripted-field/238615)
**Author:** [@edbautista](https://discuss.elastic.co/u/edbautista)\ **Replies:** 4\ **Last updated:** [June 30, 2020, 4:08am UTC](https://discuss.elastic.co/t/if-else-painless-script-on-a-painless-scripted-field/238615 "2020-06-30T04:08:54Z")
Hi. Our team made a scripted field for time difference called "time". We have a new use case where if the value in "time" is greater than 8hours, it will return as 'Yes' and if not 'No'. The value for 'time' is set to mi… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1961) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1963)