# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1992 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1993 --- ## [Trust two different certs on two nodes](https://discuss.elastic.co/t/trust-two-different-certs-on-two-nodes/235642)
**Author:** [@jthoni](https://discuss.elastic.co/u/jthoni)\ **Replies:** 11\ **Last updated:** [June 17, 2020, 6:04pm UTC](https://discuss.elastic.co/t/trust-two-different-certs-on-two-nodes/235642 "2020-06-17T18:04:55Z")
We are trying to add TLS security to our cluster. For compliance, all certs need to be generated via a in-house tool (they are signed by a 3rd party entity). I am currently testing with two nodes on my local box. The ce… --- ## [Kibana 6.4.2 to Kibana 7.0 simple scripted field issue](https://discuss.elastic.co/t/kibana-6-4-2-to-kibana-7-0-simple-scripted-field-issue/237367)
**Author:** [@chowpay](https://discuss.elastic.co/u/chowpay)\ **Replies:** 0\ **Last updated:** [June 16, 2020, 10:03pm UTC](https://discuss.elastic.co/t/kibana-6-4-2-to-kibana-7-0-simple-scripted-field-issue/237367 "2020-06-16T22:03:05Z")
Porting over my stuff from 6.4.2 I had a very simple scripted field that looks like this (all values are in format Number: doc\['ADN-KR'\].value+doc\['ADN-SSL-KR'\].value+doc\['LF-KR'.value\]+doc\['LF-SSL-KR'\].value... about 1… --- ## [Need help Parsing json with grok](https://discuss.elastic.co/t/need-help-parsing-json-with-grok/237518)
**Author:** [@some\_IT\_guy](https://discuss.elastic.co/u/some_IT_guy)\ **Replies:** 0\ **Last updated:** [June 17, 2020, 5:22pm UTC](https://discuss.elastic.co/t/need-help-parsing-json-with-grok/237518 "2020-06-17T17:22:53Z")
I am trying to use grok to parse down json, I am new and have the following filter { if \[syslog5424\_app\] == "nginx-access" { json { source =\> "syslog5424\_msg" skip\_on\_invalid\_json =\> … --- ## [Kibana 7.7.0 (docker container ) inaccessible after enabling SSL. Times out](https://discuss.elastic.co/t/kibana-7-7-0-docker-container-inaccessible-after-enabling-ssl-times-out/234439)
**Author:** [@tenet\_testuser1](https://discuss.elastic.co/u/tenet_testuser1)\ **Replies:** 2\ **Last updated:** [June 17, 2020, 5:01pm UTC](https://discuss.elastic.co/t/kibana-7-7-0-docker-container-inaccessible-after-enabling-ssl-times-out/234439 "2020-06-17T17:01:55Z")
Hello, What I've done so far. Followed - https://www.elastic.co/guide/en/kibana/7.7/configuring-tls.html I followed the certutil route to generate (ca first and then cert). elasticsearch-certutil cert --ca /kiban… --- ## [Call URL with invalid SSL certificate from custom plugin](https://discuss.elastic.co/t/call-url-with-invalid-ssl-certificate-from-custom-plugin/237350)
**Author:** [@nplatis](https://discuss.elastic.co/u/nplatis)\ **Replies:** 4\ **Last updated:** [June 17, 2020, 4:48pm UTC](https://discuss.elastic.co/t/call-url-with-invalid-ssl-certificate-from-custom-plugin/237350 "2020-06-17T16:48:30Z")
We have developed a custom Kibana plugin, and it needs to call a REST API endpoint at another internal server of ours. We run Kibana on https since we need authentication, but we use a self-signed certificate since this … --- ## [Scripted Field in Kibana to extract from a nested document structure](https://discuss.elastic.co/t/scripted-field-in-kibana-to-extract-from-a-nested-document-structure/237380)
**Author:** [@sanjaysubramanian](https://discuss.elastic.co/u/sanjaysubramanian)\ **Replies:** 1\ **Last updated:** [June 17, 2020, 3:30pm UTC](https://discuss.elastic.co/t/scripted-field-in-kibana-to-extract-from-a-nested-document-structure/237380 "2020-06-17T15:30:43Z")
Hi all Kibana and ES 7.7.0 My doc structure is like this: { "key1": "value1", "key2": "value3", "key3": { "key4": { "key5": "value5", "key6": "val6/val7/val8/val9.html" }, "key7": "val10" }, "key8": "val11", … --- ## [Is it good to use NIOFS in hot data node?](https://discuss.elastic.co/t/is-it-good-to-use-niofs-in-hot-data-node/237500)
**Author:** [@KellyK313](https://discuss.elastic.co/u/KellyK313)\ **Replies:** 0\ **Last updated:** [June 17, 2020, 3:21pm UTC](https://discuss.elastic.co/t/is-it-good-to-use-niofs-in-hot-data-node/237500 "2020-06-17T15:21:10Z")
When our es cluster upgrade to v7.7,a big change is that the term index(.tip) is not in jvm heap but managed by mmap in pagecache. Our es cluster have hot data node and cold data node,hot data node used to storage last … --- ## [If-Else in an Index Template, and How Smart is the IP Field?](https://discuss.elastic.co/t/if-else-in-an-index-template-and-how-smart-is-the-ip-field/237496)
**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Replies:** 0\ **Last updated:** [June 17, 2020, 3:07pm UTC](https://discuss.elastic.co/t/if-else-in-an-index-template-and-how-smart-is-the-ip-field/237496 "2020-06-17T15:07:15Z")
Hi Elasticsearch Jedi Masters, I have an Elasticsearch instance (ver 7.7.1) that is archiving network data. I also have an index template transforming the data type of the “IP.host” field from text string to IP address… --- ## [Logstash and ILM rollover](https://discuss.elastic.co/t/logstash-and-ilm-rollover/237450)
**Author:** [@nikita2206](https://discuss.elastic.co/u/nikita2206)\ **Replies:** 1\ **Last updated:** [June 17, 2020, 2:46pm UTC](https://discuss.elastic.co/t/logstash-and-ilm-rollover/237450 "2020-06-17T14:46:01Z")
Every tutorial or manual out there talks about integrating Filebeat with ILM rollover. We're not using Filebeat (it doesn't really make sense to send logs through actual files when we could do that without involving file… --- ## [Reading JSON data from logstash](https://discuss.elastic.co/t/reading-json-data-from-logstash/237465)
**Author:** [@TUSHAR\_Sinha](https://discuss.elastic.co/u/TUSHAR_Sinha)\ **Replies:** 2\ **Last updated:** [June 17, 2020, 2:28pm UTC](https://discuss.elastic.co/t/reading-json-data-from-logstash/237465 "2020-06-17T14:28:39Z")
Hi all, I have a lot of JSON data and I want to visualize it. I have seen the POST\_bulk method in Kibana, but it is not dynamic. We can not update the data whenever it is being generated. So, I thought of using logstash… --- ## [Kibana painless script](https://discuss.elastic.co/t/kibana-painless-script/236643)
**Author:** [@mugil1988](https://discuss.elastic.co/u/mugil1988)\ **Replies:** 1\ **Last updated:** [June 17, 2020, 2:23pm UTC](https://discuss.elastic.co/t/kibana-painless-script/236643 "2020-06-17T14:23:35Z")
Hi Team, I am trying to write painless script to calculate Average CPU usage. Script: (doc\['system.cpu.user.pct'\].value + doc\['system.cpu.system.pct'\].value) / doc\['system.cpu.cores'\].value Getting below error when r… --- ## [Kibana Options List Visualization Not Showing All Values](https://discuss.elastic.co/t/kibana-options-list-visualization-not-showing-all-values/237360)
**Author:** [@uklipse](https://discuss.elastic.co/u/uklipse)\ **Replies:** 0\ **Last updated:** [June 16, 2020, 8:45pm UTC](https://discuss.elastic.co/t/kibana-options-list-visualization-not-showing-all-values/237360 "2020-06-16T20:45:45Z")
I have a new index for metricbeat logs to go into but when I try to create a Options List control visualization to filter on each specific host I only see any values for the first host that was added (not sure if that's … --- ## [Filebeat IIS Access logs not parsing but Error logs are](https://discuss.elastic.co/t/filebeat-iis-access-logs-not-parsing-but-error-logs-are/237345)
**Author:** [@uklipse](https://discuss.elastic.co/u/uklipse)\ **Replies:** 3\ **Last updated:** [June 17, 2020, 2:08pm UTC](https://discuss.elastic.co/t/filebeat-iis-access-logs-not-parsing-but-error-logs-are/237345 "2020-06-17T14:08:26Z")
I have enabled Filebeat module for IIS logging for IIS 7.5 but I'm not seeing the access logs parsed. The error logs are getting parsed just fine but the access log don't and give me an error.message of "Provided Grok ex… --- ## [Repository verification exception when registering new ES snapshot](https://discuss.elastic.co/t/repository-verification-exception-when-registering-new-es-snapshot/237473)
**Author:** [@cpb14pk](https://discuss.elastic.co/u/cpb14pk)\ **Replies:** 4\ **Last updated:** [June 17, 2020, 1:53pm UTC](https://discuss.elastic.co/t/repository-verification-exception-when-registering-new-es-snapshot/237473 "2020-06-17T13:53:00Z")
Hi, I am trying to snapshot an elasticsearch repository. I have three different nodes across three different centos servers, e.g. 10.212.145.10, 10.212.145.20, 10.212.145.30. I have added the path.repo field in my ela… --- ## [Transform on fields of a nested object](https://discuss.elastic.co/t/transform-on-fields-of-a-nested-object/236986)
**Author:** [@sharad\_khandelwal1](https://discuss.elastic.co/u/sharad_khandelwal1)\ **Replies:** 5\ **Last updated:** [June 17, 2020, 1:45pm UTC](https://discuss.elastic.co/t/transform-on-fields-of-a-nested-object/236986 "2020-06-17T13:45:47Z")
Does transform support group by on nested fields? I was trying to group by on a field of a nested object but no results appear in the preview. --- ## [Retrieve password from keystore key](https://discuss.elastic.co/t/retrieve-password-from-keystore-key/237409)
**Author:** [@Bikash\_Swain](https://discuss.elastic.co/u/Bikash_Swain)\ **Replies:** 2\ **Last updated:** [June 17, 2020, 1:42pm UTC](https://discuss.elastic.co/t/retrieve-password-from-keystore-key/237409 "2020-06-17T13:42:43Z")
We have different keystore keys for elasticsearch , logstash , kibana and filebeat and all the processes read passwords from their key. Is there a way to retrieve password from that key in linux prompt or through any AP… --- ## [Node does not match global include filters](https://discuss.elastic.co/t/node-does-not-match-global-include-filters/237303)
**Author:** [@secumind](https://discuss.elastic.co/u/secumind)\ **Replies:** 5\ **Last updated:** [June 17, 2020, 1:18pm UTC](https://discuss.elastic.co/t/node-does-not-match-global-include-filters/237303 "2020-06-17T13:18:02Z")
I have a cluster of albeit older 2.4.6 Elasticsearch. We're upgrading soon but for right now we need to keep this version running. We have 3 master nodes, 1 search node, 6 data nodes. There are a couple of billion docum… --- ## [Kibana Visualize - Calculate difference between two metrics](https://discuss.elastic.co/t/kibana-visualize-calculate-difference-between-two-metrics/237466)
**Author:** [@Mayestro\_PW](https://discuss.elastic.co/u/Mayestro_PW)\ **Replies:** 2\ **Last updated:** [June 17, 2020, 12:50pm UTC](https://discuss.elastic.co/t/kibana-visualize-calculate-difference-between-two-metrics/237466 "2020-06-17T12:50:47Z")
Hello, I'm in the process of making a new data table, which consists of a date bucket and 3 metrics. First metric(A) is Count, second metric(B) is Unique Count, and third(C) I need to be the difference between A and B. … --- ## [What does socket.include\_localhost in auditbeat do?](https://discuss.elastic.co/t/what-does-socket-include-localhost-in-auditbeat-do/237432)
**Author:** [@j91321](https://discuss.elastic.co/u/j91321)\ **Replies:** 1\ **Last updated:** [June 17, 2020, 12:41pm UTC](https://discuss.elastic.co/t/what-does-socket-include-localhost-in-auditbeat-do/237432 "2020-06-17T12:41:56Z")
Hello, I was deploying Auditbeat on several servers and noticed that our couchdb server was having some performance issues after deployment. It turned out that there were way too many localhost socket connections being t… --- ## [Metricbeat MongoDB SCRAM-SHA-256 authentication](https://discuss.elastic.co/t/metricbeat-mongodb-scram-sha-256-authentication/237471)
**Author:** [@drjackal](https://discuss.elastic.co/u/drjackal)\ **Replies:** 0\ **Last updated:** [June 17, 2020, 12:20pm UTC](https://discuss.elastic.co/t/metricbeat-mongodb-scram-sha-256-authentication/237471 "2020-06-17T12:20:55Z")
I am looking into using the metricbeat mongodb module. Our MongoDB Enterprise deployment uses SCRAM-SHA-256 authentication and I have not been able to get metricbeat to use this authentication schema. Does anybody know i… --- ## [kibanaRemoveFilter is not working](https://discuss.elastic.co/t/kibanaremovefilter-is-not-working/237439)
**Author:** [@m-amano](https://discuss.elastic.co/u/m-amano)\ **Replies:** 1\ **Last updated:** [June 17, 2020, 11:36am UTC](https://discuss.elastic.co/t/kibanaremovefilter-is-not-working/237439 "2020-06-17T11:36:50Z")
I'm using Kibana version 7.6.1 and Vega version 4.3.0. I could not remove the filter with kibanaRemoveFilter function and don't know why. --- ## [Customizing message field for Ecs logging method of java applications](https://discuss.elastic.co/t/customizing-message-field-for-ecs-logging-method-of-java-applications/237133)
**Author:** [@Mohan\_vel](https://discuss.elastic.co/u/Mohan_vel)\ **Replies:** 2\ **Last updated:** [June 17, 2020, 10:51am UTC](https://discuss.elastic.co/t/customizing-message-field-for-ecs-logging-method-of-java-applications/237133 "2020-06-17T10:51:41Z")
Hi Team, I am using the filebeat latest version 7.7.1 to ship the data of my java application from my logfile to elasticsearch ecs logging method. Data is available in elasticsearch and i am able to track down the logs… --- ## [How properly rollover indices](https://discuss.elastic.co/t/how-properly-rollover-indices/237309)
**Author:** [@dorinand](https://discuss.elastic.co/u/dorinand)\ **Replies:** 2\ **Last updated:** [June 17, 2020, 11:16am UTC](https://discuss.elastic.co/t/how-properly-rollover-indices/237309 "2020-06-17T11:16:40Z")
I harvest logs with filebeat from all docker containers, sending them to logstash and from logstash are forwarded to elasticsearch. I would like to rollover my indices, that are automatically created, if they are too big… --- ## [Issues while installing Logstash 7.7.1 on Windows 10](https://discuss.elastic.co/t/issues-while-installing-logstash-7-7-1-on-windows-10/237458)
**Author:** [@Inshu](https://discuss.elastic.co/u/Inshu)\ **Replies:** 0\ **Last updated:** [June 17, 2020, 11:09am UTC](https://discuss.elastic.co/t/issues-while-installing-logstash-7-7-1-on-windows-10/237458 "2020-06-17T11:09:44Z")
I was installing Logstash 7.7.1 on Windows 10. When I tried to configure it with the command bin/logstash -f logstash.conf it is showing following error ignoring JAVA\_OPTS= -Xms1g -Xmx1g -XX:+UseConcMarkSweepGC -XX:CM… --- ## [Simple query string: minus (-) doesn't work if WHITESPACE not specified in flags](https://discuss.elastic.co/t/simple-query-string-minus-doesnt-work-if-whitespace-not-specified-in-flags/237347)
**Author:** [@pilo](https://discuss.elastic.co/u/pilo)\ **Replies:** 0\ **Last updated:** [June 16, 2020, 5:15pm UTC](https://discuss.elastic.co/t/simple-query-string-minus-doesnt-work-if-whitespace-not-specified-in-flags/237347 "2020-06-16T17:15:05Z")
Hi everyone, like mentionned in the title, i'm facing the problem with simple query string when WHITESPACE is not specified in flags. I'm using docker.elastic.co/elasticsearch/elasticsearch:7.4.1 I have a mapping like … --- ## ["having count" in bar/pie/table chart](https://discuss.elastic.co/t/having-count-in-bar-pie-table-chart/237190)
**Author:** [@gofbor](https://discuss.elastic.co/u/gofbor)\ **Replies:** 1\ **Last updated:** [June 17, 2020, 10:42am UTC](https://discuss.elastic.co/t/having-count-in-bar-pie-table-chart/237190 "2020-06-17T10:42:45Z")
Hi, Is it possible to make a chart with aggregation(avg or min) per filed\_bucket where count of field\_bucket \> 100 ? It's like having count in SQL. BR. --- ## [Unable to use the ODBC driver as a SQL Server Linked Server](https://discuss.elastic.co/t/unable-to-use-the-odbc-driver-as-a-sql-server-linked-server/230660)
**Author:** [@rgelb](https://discuss.elastic.co/u/rgelb)\ **Replies:** 15\ **Last updated:** [June 17, 2020, 10:39am UTC](https://discuss.elastic.co/t/unable-to-use-the-odbc-driver-as-a-sql-server-linked-server/230660 "2020-06-17T10:39:53Z")
I've setup an ODBC 64-bit driver on a server that runs SQL Server 2017. I picked the ODBC version to match the ElasticSearch installation (6.0.6). The installation of the ODBC driver and creation of a Linked Server wen… --- ## [How to take word order into account in match\_phrase query](https://discuss.elastic.co/t/how-to-take-word-order-into-account-in-match-phrase-query/237448)
**Author:** [@mehdi89](https://discuss.elastic.co/u/mehdi89)\ **Replies:** 0\ **Last updated:** [June 17, 2020, 10:08am UTC](https://discuss.elastic.co/t/how-to-take-word-order-into-account-in-match-phrase-query/237448 "2020-06-17T10:08:52Z")
Suppose that my index have two documents: "get my money" "my money get here" When I do a regular match query for "get my money", both documents match correctly but they get equal scores. However, I want the order of w… --- ## [Multiline log parsing - Filebeat, Logstash](https://discuss.elastic.co/t/multiline-log-parsing-filebeat-logstash/237132)
**Author:** [@Gyanprakash\_Mishra](https://discuss.elastic.co/u/Gyanprakash_Mishra)\ **Replies:** 1\ **Last updated:** [June 17, 2020, 10:35am UTC](https://discuss.elastic.co/t/multiline-log-parsing-filebeat-logstash/237132 "2020-06-17T10:35:20Z")
Hi All, I am using filebeat to stash data into logstash. Need help in parsing log of following format: 11-Jun-2020 18:31:51.900 SEVERE \[http-nio-8080-exec-24\] org.apache.catalina.core.StandardWrapperValve.invoke Servl… --- ## [Response data from text file multiple folder to multiple index](https://discuss.elastic.co/t/response-data-from-text-file-multiple-folder-to-multiple-index/236694)
**Author:** [@Puneeth\_S\_B\_Gowda1](https://discuss.elastic.co/u/Puneeth_S_B_Gowda1)\ **Replies:** 2\ **Last updated:** [June 17, 2020, 10:33am UTC](https://discuss.elastic.co/t/response-data-from-text-file-multiple-folder-to-multiple-index/236694 "2020-06-17T10:33:42Z")
My logstash configuration is this input { beats { port =\> 5044 } } filter { xml { store\_xml =\> "false" source =\> "message" xpath =\>\["/propertyAvailability/hotelRates/hotel\[2\]/bookingChannel\[4\]/ratePlan\[3\]/miscInfo/tex… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1991) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1993)