# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1981

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1982

---

## [Metricbeat not working when It is upgraded from 7.4.0 to 7.8.0](https://discuss.elastic.co/t/metricbeat-not-working-when-it-is-upgraded-from-7-4-0-to-7-8-0/238042)

<div class="topic-metadata">

**Author:** [@hadi\_farzipour](https://discuss.elastic.co/u/hadi_farzipour)\
**Replies:** 1\
**Last updated:** [June 23, 2020, 9:09am UTC](https://discuss.elastic.co/t/metricbeat-not-working-when-it-is-upgraded-from-7-4-0-to-7-8-0/238042 "2020-06-23T09:09:15Z")

</div>

Hello Metricbeat not working when It is upgraded from 7.4.0 to 7.8.0 and I can not find relating indices in Kibana. Metricbeat had been working before upgrading the Metricbeat. My metricbeat config file contains follow…

---

## [Integrate ElasticSearch, Logstash and fscrawler](https://discuss.elastic.co/t/integrate-elasticsearch-logstash-and-fscrawler/238185)

<div class="topic-metadata">

**Author:** [@akshaybhuradia](https://discuss.elastic.co/u/akshaybhuradia)\
**Replies:** 3\
**Last updated:** [June 23, 2020, 9:00am UTC](https://discuss.elastic.co/t/integrate-elasticsearch-logstash-and-fscrawler/238185 "2020-06-23T09:00:04Z")

</div>

I have meta data for document in database. Example : filename, file description, file\_tags and etc Earlier i was using this data for search. elasticsearch--for search and logstash--for accessing data source(db --\> tabl…

---

## [Metric using too much disk space -need optimization help](https://discuss.elastic.co/t/metric-using-too-much-disk-space-need-optimization-help/238177)

<div class="topic-metadata">

**Author:** [@cbeprem](https://discuss.elastic.co/u/cbeprem)\
**Replies:** 1\
**Last updated:** [June 23, 2020, 8:58am UTC](https://discuss.elastic.co/t/metric-using-too-much-disk-space-need-optimization-help/238177 "2020-06-23T08:58:03Z")

</div>

Hi Team , I am using metricbeat for a couple of days for monitor system metrics, like CPU, ram, disk and network. It is working fine. I am monitoring for 10 Linux system. I have enabled only the default system modul…

---

## [Getting PacketBeat Raw TCP Payloads 2](https://discuss.elastic.co/t/getting-packetbeat-raw-tcp-payloads-2/238198)

<div class="topic-metadata">

**Author:** [@alpayk](https://discuss.elastic.co/u/alpayk)\
**Replies:** 1\
**Last updated:** [June 23, 2020, 8:45am UTC](https://discuss.elastic.co/t/getting-packetbeat-raw-tcp-payloads-2/238198 "2020-06-23T08:45:29Z")

</div>

I am asking this question again because my first attempt was left unanswered Is it possible to extract and send the network traffic to logstash as a byte array using PacketBeat? I want to post-process the raw network tr…

---

## [I need to show a catalog containing only the latest version of each app, sorted by app title](https://discuss.elastic.co/t/i-need-to-show-a-catalog-containing-only-the-latest-version-of-each-app-sorted-by-app-title/237989)

<div class="topic-metadata">

**Author:** [@RNA](https://discuss.elastic.co/u/RNA)\
**Replies:** 2\
**Last updated:** [June 23, 2020, 8:44am UTC](https://discuss.elastic.co/t/i-need-to-show-a-catalog-containing-only-the-latest-version-of-each-app-sorted-by-app-title/237989 "2020-06-23T08:44:35Z")

</div>

Dear Community, Please help me out. I have an app catalogue page running with ES query. Each app has a semantic version and title in multiple language, and the app title can be different per version, then finally, I n…

---

## [How to update synonyms for an indexing index](https://discuss.elastic.co/t/how-to-update-synonyms-for-an-indexing-index/237221)

<div class="topic-metadata">

**Author:** [@ravinder](https://discuss.elastic.co/u/ravinder)\
**Replies:** 3\
**Last updated:** [June 23, 2020, 8:43am UTC](https://discuss.elastic.co/t/how-to-update-synonyms-for-an-indexing-index/237221 "2020-06-23T08:43:58Z")

</div>

we have an index "testsynonyms" mapped to a synonym file "synonyms.txt", we want to provision user with a utility of updating synonyms from the User Interface of our application. is there any way that we can update t…

---

## [How to change .security-6 index to read-write](https://discuss.elastic.co/t/how-to-change-security-6-index-to-read-write/237141)

<div class="topic-metadata">

**Author:** [@cgricb](https://discuss.elastic.co/u/cgricb)\
**Replies:** 2\
**Last updated:** [June 23, 2020, 8:29am UTC](https://discuss.elastic.co/t/how-to-change-security-6-index-to-read-write/237141 "2020-06-23T08:29:12Z")

</div>

My ES nodes were out of space and ES decided to take all indices read-only. After i ve added space and altered all indices to read-write i was successfull. But i could not alter the .security-6 index to read-write. Can y…

---

## [MONTH Interval conversion to use in DATE CLAUSE](https://discuss.elastic.co/t/month-interval-conversion-to-use-in-date-clause/233567)

<div class="topic-metadata">

**Author:** [@vaclav1](https://discuss.elastic.co/u/vaclav1)\
**Replies:** 10\
**Last updated:** [June 23, 2020, 8:13am UTC](https://discuss.elastic.co/t/month-interval-conversion-to-use-in-date-clause/233567 "2020-06-23T08:13:38Z")

</div>

Hello, I have tried to use following SQL in kibana internal index: SELECT dashboard.title FROM ".kibana\*" WHERE updated\_at \> TODAY() - INTERVAL CAST(MONTH\_OF\_YEAR(TODAY()) AS interval\_month) MONTHS Unfortunately I get…

---

## [Grok filter not working on logstash](https://discuss.elastic.co/t/grok-filter-not-working-on-logstash/238092)

<div class="topic-metadata">

**Author:** [@Abdur\_Raqeeb2](https://discuss.elastic.co/u/Abdur_Raqeeb2)\
**Replies:** 3\
**Last updated:** [June 23, 2020, 7:42am UTC](https://discuss.elastic.co/t/grok-filter-not-working-on-logstash/238092 "2020-06-23T07:42:04Z")

</div>

For my below filebeat config im not able to filter the logs based on tags in logstash Filebeat Config filebeat.inputs: - type: log enabled: true fields: env: xyz-production app\_name: xyz tags: \["nginx"\]…

---

## [Dockerize Custom Beat](https://discuss.elastic.co/t/dockerize-custom-beat/237021)

<div class="topic-metadata">

**Author:** [@Dev-Flo](https://discuss.elastic.co/u/Dev-Flo)\
**Replies:** 9\
**Last updated:** [June 23, 2020, 7:32am UTC](https://discuss.elastic.co/t/dockerize-custom-beat/237021 "2020-06-23T07:32:27Z")

</div>

Hi :smiley: I created a custom beat thanks to your Developer Guide , and would like to package it into a Docker Image. However, I did not find any information regarding that. Are there any instructions on how to do th…

---

## [Can not get Kibana-\>Management-\> Security section](https://discuss.elastic.co/t/can-not-get-kibana-management-security-section/236179)

<div class="topic-metadata">

**Author:** [@Gvantsa](https://discuss.elastic.co/u/Gvantsa)\
**Replies:** 3\
**Last updated:** [June 23, 2020, 7:23am UTC](https://discuss.elastic.co/t/can-not-get-kibana-management-security-section/236179 "2020-06-23T07:23:32Z")

</div>

I am just starting with ELK. I have basic license on prem and elastic search and kibana versions is 7.6.1 I performed the flowing steps: Enable security in elasticseach.yml --\> xpack.security.enabled: true Generate t…

---

## [Courier fetch: response is null](https://discuss.elastic.co/t/courier-fetch-response-is-null/235566)

<div class="topic-metadata">

**Author:** [@DanielVZ96](https://discuss.elastic.co/u/DanielVZ96)\
**Replies:** 10\
**Last updated:** [June 23, 2020, 7:13am UTC](https://discuss.elastic.co/t/courier-fetch-response-is-null/235566 "2020-06-23T07:13:06Z")

</div>

Hi, Whenever I try to use a visualization, dashboard or the discovery tab I get the following error: Courier fetch: response is null Version: 7.5.1 Build: 27610 Error: response is null No one else in my team is getti…

---

## [Resolving Coordinating Node Error - Elastic Cloud](https://discuss.elastic.co/t/resolving-coordinating-node-error-elastic-cloud/238125)

<div class="topic-metadata">

**Author:** [@Benjamin\_Igbeka](https://discuss.elastic.co/u/Benjamin_Igbeka)\
**Replies:** 2\
**Last updated:** [June 23, 2020, 7:05am UTC](https://discuss.elastic.co/t/resolving-coordinating-node-error-elastic-cloud/238125 "2020-06-23T07:05:47Z")

</div>

I have this error message in the cluster deployment page. How can I resolve it?

---

## [Stack-trace issue](https://discuss.elastic.co/t/stack-trace-issue/238016)

<div class="topic-metadata">

**Author:** [@vshivare](https://discuss.elastic.co/u/vshivare)\
**Replies:** 7\
**Last updated:** [June 23, 2020, 6:51am UTC](https://discuss.elastic.co/t/stack-trace-issue/238016 "2020-06-23T06:51:32Z")

</div>

This is my json message: { "module":"MODULE", "timeStamp":"Jun 22 12:20:46.785", "containerId":INDLT1534", "correlationId":"", "level":"ERROR", "logger":"c.m.r.HelloWorldService", "message":"This is due to java.la…

---

## [Is ELK itself capable of keeping track of certain events & alerting?](https://discuss.elastic.co/t/is-elk-itself-capable-of-keeping-track-of-certain-events-alerting/238188)

<div class="topic-metadata">

**Author:** [@Aj\_t](https://discuss.elastic.co/u/Aj_t)\
**Replies:** 4\
**Last updated:** [June 23, 2020, 6:25am UTC](https://discuss.elastic.co/t/is-elk-itself-capable-of-keeping-track-of-certain-events-alerting/238188 "2020-06-23T06:25:57Z")

</div>

I realize that the question is super vague, but here's what I am trying to do. I've already set up ELK and am sending some logs via Filebeat to the ELK server. What I ultimately want to do is a proof of concept system t…

---

## [Kibana - Visualisation aggregation on Nested Object Issue](https://discuss.elastic.co/t/kibana-visualisation-aggregation-on-nested-object-issue/233097)

<div class="topic-metadata">

**Author:** [@charlz](https://discuss.elastic.co/u/charlz)\
**Replies:** 6\
**Last updated:** [June 23, 2020, 6:00am UTC](https://discuss.elastic.co/t/kibana-visualisation-aggregation-on-nested-object-issue/233097 "2020-06-23T06:00:21Z")

</div>

On creating Visualisation Aggregation of sum on property 'item.count' facing issue grouping on quote.created\_at Result Date ------------Count 2020-05-10 ----- 1 2020-03-05 ----- 2 { "id":50, "c…

---

## [Date filter plugin error](https://discuss.elastic.co/t/date-filter-plugin-error/238176)

<div class="topic-metadata">

**Author:** [@mhinds](https://discuss.elastic.co/u/mhinds)\
**Replies:** 1\
**Last updated:** [June 23, 2020, 5:34am UTC](https://discuss.elastic.co/t/date-filter-plugin-error/238176 "2020-06-23T05:34:38Z")

</div>

The date filter plugin is incorrectly overwriting the month of my date with January, see example output below and configuration. Logstash Conf File input { stdin {} } filter { date { tar…

---

## [\[CheckPoint\] \[Filebeat 7.8\] Provided Grok expressions do not match field value](https://discuss.elastic.co/t/checkpoint-filebeat-7-8-provided-grok-expressions-do-not-match-field-value/238186)

<div class="topic-metadata">

**Author:** [@julianksanchez](https://discuss.elastic.co/u/julianksanchez)\
**Replies:** 0\
**Last updated:** [June 23, 2020, 5:29am UTC](https://discuss.elastic.co/t/checkpoint-filebeat-7-8-provided-grok-expressions-do-not-match-field-value/238186 "2020-06-23T05:29:00Z")

</div>

Hello all, I want to send logs directly to Elastic from my CheckPoint Management. This is my checkpoint.yml configuration : module: checkpoint firewall: enabled: true var.syslog\_host: 10.10.10.1 var.syslog\_port: 514 o…

---

## [What Is Lower And Upper Std Deviation?](https://discuss.elastic.co/t/what-is-lower-and-upper-std-deviation/238175)

<div class="topic-metadata">

**Author:** [@Ethan777100](https://discuss.elastic.co/u/Ethan777100)\
**Replies:** 3\
**Last updated:** [June 23, 2020, 5:16am UTC](https://discuss.elastic.co/t/what-is-lower-and-upper-std-deviation/238175 "2020-06-23T05:16:33Z")

</div>

Hi, I wanted to show the spread of data about the zero mark wrt to the positive side and negative side. So i tried with standard deviation - i get 2 indices - lower and upper standard deviation. What do they mean exac…

---

## [Kibana not started](https://discuss.elastic.co/t/kibana-not-started/237908)

<div class="topic-metadata">

**Author:** [@ronics](https://discuss.elastic.co/u/ronics)\
**Replies:** 4\
**Last updated:** [June 23, 2020, 5:15am UTC](https://discuss.elastic.co/t/kibana-not-started/237908 "2020-06-23T05:15:44Z")

</div>

I recently upgraded elk from 7.7.0 to 7.8.0 The elasticsearch is working fine but when I try to start kibana it shows following error. Please help FATAL Error: \[config validation of \[xpack.reporting\].enabled\]: definit…

---

## ["terminated\_early":true](https://discuss.elastic.co/t/terminated-early-true/238179)

<div class="topic-metadata">

**Author:** [@Voula\_Mikr](https://discuss.elastic.co/u/Voula_Mikr)\
**Replies:** 0\
**Last updated:** [June 23, 2020, 4:37am UTC](https://discuss.elastic.co/t/terminated-early-true/238179 "2020-06-23T04:37:30Z")

</div>

Hi, I make some term aggregations through Kibana and the response from ElasticSearch contains the "terminated\_early":true . What is the impact of these? Does this means that fewer results come from ElasticSearch? Ca…

---

## [Which version did the rbac security become free?](https://discuss.elastic.co/t/which-version-did-the-rbac-security-become-free/238167)

<div class="topic-metadata">

**Author:** [@Jerry\_Hoffmeister](https://discuss.elastic.co/u/Jerry_Hoffmeister)\
**Replies:** 4\
**Last updated:** [June 23, 2020, 3:08am UTC](https://discuss.elastic.co/t/which-version-did-the-rbac-security-become-free/238167 "2020-06-23T03:08:56Z")

</div>

Which version did the core security stuff become part of the basic / free subscription?

---

## [Logstash error "there are no living connections in the connection pool"](https://discuss.elastic.co/t/logstash-error-there-are-no-living-connections-in-the-connection-pool/238171)

<div class="topic-metadata">

**Author:** [@SNJY](https://discuss.elastic.co/u/SNJY)\
**Replies:** 0\
**Last updated:** [June 23, 2020, 2:51am UTC](https://discuss.elastic.co/t/logstash-error-there-are-no-living-connections-in-the-connection-pool/238171 "2020-06-23T02:51:29Z")

</div>

Logstash instance is connected to an ES cluster behind a load balancer. The load balancer has an idle timeout of 5 minutes. Logstash is configured with the ES url corresponding to the loadbalancer ip. There are random…

---

## [Extract search string in Kibana Discover for custom plugin usage](https://discuss.elastic.co/t/extract-search-string-in-kibana-discover-for-custom-plugin-usage/238169)

<div class="topic-metadata">

**Author:** [@jl1705](https://discuss.elastic.co/u/jl1705)\
**Replies:** 0\
**Last updated:** [June 23, 2020, 2:42am UTC](https://discuss.elastic.co/t/extract-search-string-in-kibana-discover-for-custom-plugin-usage/238169 "2020-06-23T02:42:50Z")

</div>

Hello, I have a custom Kibana plugin which currently allows me to access locally stored PDF files via API routing. For my use case, I want to access documents listed in an index after a search on the Kibana Discover pag…

---

## [How to upgrade Vega version 4.3.0 to 5.13.0?](https://discuss.elastic.co/t/how-to-upgrade-vega-version-4-3-0-to-5-13-0/237429)

<div class="topic-metadata">

**Author:** [@m-amano](https://discuss.elastic.co/u/m-amano)\
**Replies:** 5\
**Last updated:** [June 23, 2020, 1:56am UTC](https://discuss.elastic.co/t/how-to-upgrade-vega-version-4-3-0-to-5-13-0/237429 "2020-06-23T01:56:32Z")

</div>

I'm using Elasticsearch and Kibana version 7.6.1 which we just upgraded from v.7.6.0 last month. At that time, Vega version was still v.4.3.0 but v.5.13.0 has been released earlier this month. So I want to use the lates…

---

## [Data query issues with elasticsearch 6.8](https://discuss.elastic.co/t/data-query-issues-with-elasticsearch-6-8/237637)

<div class="topic-metadata">

**Author:** [@sammi](https://discuss.elastic.co/u/sammi)\
**Replies:** 4\
**Last updated:** [June 23, 2020, 1:29am UTC](https://discuss.elastic.co/t/data-query-issues-with-elasticsearch-6-8/237637 "2020-06-23T01:29:48Z")

</div>

we have 5 node cassandra and 3 node elasticsearch for indexes in a cluster , For smaller count data retrieval is working with queries but when there are large count query is failing with below error. method \[POST\], hos…

---

## [Pipeline does not work](https://discuss.elastic.co/t/pipeline-does-not-work/238142)

<div class="topic-metadata">

**Author:** [@impkos](https://discuss.elastic.co/u/impkos)\
**Replies:** 5\
**Last updated:** [June 23, 2020, 12:57am UTC](https://discuss.elastic.co/t/pipeline-does-not-work/238142 "2020-06-23T00:57:54Z")

</div>

Help understand why it does not work pipeline pipelines.yml - pipeline.id: main path.config: "/usr/share/logstash/config/conf.d/\*.conf" - pipeline.id: ms001-backup01 path.config: "/usr/share/logstash/config/conf.d…

---

## [Logstash csv / First Line Index](https://discuss.elastic.co/t/logstash-csv-first-line-index/237755)

<div class="topic-metadata">

**Author:** [@xennn](https://discuss.elastic.co/u/xennn)\
**Replies:** 1\
**Last updated:** [June 22, 2020, 11:03pm UTC](https://discuss.elastic.co/t/logstash-csv-first-line-index/237755 "2020-06-22T23:03:56Z")

</div>

Hello, I use Logstash CSV Filter Plugin to index data using Powershell scripts. I want the first line not to be indexed as a record. Do you know how to do that?

---

## [What index tracks index & search rate in the monitoring section of kibana?](https://discuss.elastic.co/t/what-index-tracks-index-search-rate-in-the-monitoring-section-of-kibana/237662)

<div class="topic-metadata">

**Author:** [@slmingol](https://discuss.elastic.co/u/slmingol)\
**Replies:** 1\
**Last updated:** [June 22, 2020, 10:59pm UTC](https://discuss.elastic.co/t/what-index-tracks-index-search-rate-in-the-monitoring-section-of-kibana/237662 "2020-06-22T22:59:09Z")

</div>

I'm trying to track down where the metrics are kept that back the monitoring section of the cluster in Kibana. I'm interested in showing these statistics from the CLI in addition to being able to see them in Kibana.

---

## [Testing queries and list of query logs, using rally result metrics of http logs or other tracks](https://discuss.elastic.co/t/testing-queries-and-list-of-query-logs-using-rally-result-metrics-of-http-logs-or-other-tracks/237702)

<div class="topic-metadata">

**Author:** [@Rajesh\_pleti1](https://discuss.elastic.co/u/Rajesh_pleti1)\
**Replies:** 0\
**Last updated:** [June 18, 2020, 9:00pm UTC](https://discuss.elastic.co/t/testing-queries-and-list-of-query-logs-using-rally-result-metrics-of-http-logs-or-other-tracks/237702 "2020-06-18T21:00:50Z")

</div>

Respected, i have tested http logs using rally , i got different metrics in terms of Index append, default, term, range , but where can i get for what queries and list of query logs, i got rally result metrics or of htt…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1980)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1982)
