# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=213 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 214 --- ## [Create Costume Plugin for Kibana](https://discuss.elastic.co/t/create-costume-plugin-for-kibana/360606)
**Author:** [@santosh\_kr\_pathak](https://discuss.elastic.co/u/santosh_kr_pathak)\ **Replies:** 2\ **Last updated:** [June 28, 2024, 7:22am UTC](https://discuss.elastic.co/t/create-costume-plugin-for-kibana/360606 "2024-06-28T07:22:50Z")
Hello Team, I am try to create the some plugin for Kibana. Pls, help me out. I am trying to create the costume Kibana plugin. follow some steps form i created the plugin by "node scripts/generate\_plugin your\_plugin\_n… --- ## [Logstash.yml overwritten by Logstash and deleting comments?](https://discuss.elastic.co/t/logstash-yml-overwritten-by-logstash-and-deleting-comments/362186)
**Author:** [@fti](https://discuss.elastic.co/u/fti)\ **Replies:** 0\ **Last updated:** [June 28, 2024, 6:56am UTC](https://discuss.elastic.co/t/logstash-yml-overwritten-by-logstash-and-deleting-comments/362186 "2024-06-28T06:56:13Z")
Greetings. I'm using the Logstash Docker image and I noticed something strange. I created a bind mount in Docker on the logstash.yml file so that I could easily edit the configuration. I also enabled automatic configur… --- ## [SSL Handshake Exception: Empty Client Certificate Chain](https://discuss.elastic.co/t/ssl-handshake-exception-empty-client-certificate-chain/362158)
**Author:** [@Teddy\_Bear](https://discuss.elastic.co/u/Teddy_Bear)\ **Replies:** 1\ **Last updated:** [June 28, 2024, 6:26am UTC](https://discuss.elastic.co/t/ssl-handshake-exception-empty-client-certificate-chain/362158 "2024-06-28T06:26:50Z")
Hello, I’m currently working on a task to test a secure connection between Archiving and Elasticsearch. Following the command: curl -k https://\:\/\_security/\_authenticate However, I’m encountering an issue wi… --- ## [Run script during external plugin installation](https://discuss.elastic.co/t/run-script-during-external-plugin-installation/360938)
**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\ **Replies:** 2\ **Last updated:** [June 28, 2024, 6:05am UTC](https://discuss.elastic.co/t/run-script-during-external-plugin-installation/360938 "2024-06-28T06:05:16Z")
Hi, I am developing a custom external plugin in Kibana using React. As far as I know, anyone can install the plugin into Kibana, given they have access to /usr/share/kibana folder I want to run a a script during my pl… --- ## [Additional Feature list from 7.11.2 to 8.14](https://discuss.elastic.co/t/additional-feature-list-from-7-11-2-to-8-14/362180)
**Author:** [@Manoilayans](https://discuss.elastic.co/u/Manoilayans)\ **Replies:** 0\ **Last updated:** [June 28, 2024, 4:22am UTC](https://discuss.elastic.co/t/additional-feature-list-from-7-11-2-to-8-14/362180 "2024-06-28T04:22:52Z")
Hi All, We are currently using the ELK stack version as 7.11.2 with Enterprise license. Planning to upgrade to 8.13 or 8.14, Pls let us know the list of feature benefits which we will get out of it. Regards, Mano --- ## [Kibana Dashboard Hide Top Query Bar for Just one dashboard in a Link](https://discuss.elastic.co/t/kibana-dashboard-hide-top-query-bar-for-just-one-dashboard-in-a-link/362178)
**Author:** [@gman9999](https://discuss.elastic.co/u/gman9999)\ **Replies:** 0\ **Last updated:** [June 28, 2024, 1:30am UTC](https://discuss.elastic.co/t/kibana-dashboard-hide-top-query-bar-for-just-one-dashboard-in-a-link/362178 "2024-06-28T01:30:34Z")
I am using a links panel, to link 5 dashboards together and I am using Dash in Python to serve this dashboard using a HTMl iframe. The problem: The first link, let's call it 1 needs the query filter bar to be hidden, th… --- ## [How to find an index that was rolled over](https://discuss.elastic.co/t/how-to-find-an-index-that-was-rolled-over/360883)
**Author:** [@soad20000](https://discuss.elastic.co/u/soad20000)\ **Replies:** 6\ **Last updated:** [June 28, 2024, 12:24am UTC](https://discuss.elastic.co/t/how-to-find-an-index-that-was-rolled-over/360883 "2024-06-28T00:24:33Z")
Hello, I am trying to query an old index but I can't seem to find it. The index I am looking for is " .ds-logs-system.security-default-2024.04.15-000010" which I have found a record of in the ILM history index. The recor… --- ## [Providing Hyphenation Files on self hosted Kubernetes cluster](https://discuss.elastic.co/t/providing-hyphenation-files-on-self-hosted-kubernetes-cluster/362176)
**Author:** [@JDev64](https://discuss.elastic.co/u/JDev64)\ **Replies:** 0\ **Last updated:** [June 27, 2024, 9:39pm UTC](https://discuss.elastic.co/t/providing-hyphenation-files-on-self-hosted-kubernetes-cluster/362176 "2024-06-27T21:39:29Z")
I'm building a multi-node elk stack which is going to use the Hyphenation decompounder token filter for multiple languages. The official documentation states, that to use the filter the hyphenation\_patterns\_path needs to… --- ## [1 node in an elasticsearch cluster getting stuck for 15 minutes and then starts working](https://discuss.elastic.co/t/1-node-in-an-elasticsearch-cluster-getting-stuck-for-15-minutes-and-then-starts-working/362137)
**Author:** [@anandgopalratnam](https://discuss.elastic.co/u/anandgopalratnam)\ **Replies:** 3\ **Last updated:** [June 27, 2024, 7:34pm UTC](https://discuss.elastic.co/t/1-node-in-an-elasticsearch-cluster-getting-stuck-for-15-minutes-and-then-starts-working/362137 "2024-06-27T19:34:13Z")
We have seen an issue since the last six months in versions 6.4.2 , 6.8.23 and 7.17.1 where a specific node gets stuck for 15 minutes resulting in timeouts for all calls to that node. We have seen this in TransportClient… --- ## [Logstash doesn’t seem to open new port for new pipeline. Filebeat error “no connection could be made because the target machine actively refused it”](https://discuss.elastic.co/t/logstash-doesn-t-seem-to-open-new-port-for-new-pipeline-filebeat-error-no-connection-could-be-made-because-the-target-machine-actively-refused-it/362140)
**Author:** [@Mhvrke](https://discuss.elastic.co/u/Mhvrke)\ **Replies:** 5\ **Last updated:** [June 27, 2024, 5:44pm UTC](https://discuss.elastic.co/t/logstash-doesn-t-seem-to-open-new-port-for-new-pipeline-filebeat-error-no-connection-could-be-made-because-the-target-machine-actively-refused-it/362140 "2024-06-27T17:44:05Z")
Hi community, I’ve been looking for some help regarding to the following scenario. The ELK in use it’s running over RKE in Red Hat. Logstash doesn’t seem to open a new port for new pipeline. Filebeat error “no connect… --- ## [Timestamp processor can not reference event field as timezone](https://discuss.elastic.co/t/timestamp-processor-can-not-reference-event-field-as-timezone/362173)
**Author:** [@Thermi](https://discuss.elastic.co/u/Thermi)\ **Replies:** 0\ **Last updated:** [June 27, 2024, 5:28pm UTC](https://discuss.elastic.co/t/timestamp-processor-can-not-reference-event-field-as-timezone/362173 "2024-06-27T17:28:17Z")
When trying to reference a field as source of the timezone in the timestamp processor, filebeat complains that it could not parse the value of the field (the verbatim %{\[foo\]}) as timezone. Neither the documentation for … --- ## [Logstash in Alpine Linux](https://discuss.elastic.co/t/logstash-in-alpine-linux/362043)
**Author:** [@Madhab\_Chandra\_Pal](https://discuss.elastic.co/u/Madhab_Chandra_Pal)\ **Replies:** 3\ **Last updated:** [June 27, 2024, 1:20pm UTC](https://discuss.elastic.co/t/logstash-in-alpine-linux/362043 "2024-06-27T13:20:27Z")
Hi, Due to blocker from CVE I posted in the following topic, I am trying to build alternative Logstash using Alpine Linux. Is there any alternative release of Logstash using Alpine Linux? --- ## [Ingest Pipelin Grok Regex](https://discuss.elastic.co/t/ingest-pipelin-grok-regex/362094)
**Author:** [@lehu](https://discuss.elastic.co/u/lehu)\ **Replies:** 5\ **Last updated:** [June 27, 2024, 1:01pm UTC](https://discuss.elastic.co/t/ingest-pipelin-grok-regex/362094 "2024-06-27T13:01:33Z")
So, I am trying to generate a Grok pattern that matches a part of a longer string. My string looks something like this: "Reason: SOME\_UPPERCASE\_INFO" and I only want to extract my SOME\_UPPERCASE\_INFO. Do you have any sug… --- ## [Making index data immutable](https://discuss.elastic.co/t/making-index-data-immutable/362157)
**Author:** [@jaykb77](https://discuss.elastic.co/u/jaykb77)\ **Replies:** 0\ **Last updated:** [June 27, 2024, 12:50pm UTC](https://discuss.elastic.co/t/making-index-data-immutable/362157 "2024-06-27T12:50:51Z")
Hi All, we have a an application that is indexing data into one index per day, say app\_index\_. We want to make sure Only data is appended/inserted - ie no data is deleted/updated at any point once indexing is complete… --- ## [How to Display Results in Table that are "Intersection" of two Queries?](https://discuss.elastic.co/t/how-to-display-results-in-table-that-are-intersection-of-two-queries/360978)
**Author:** [@bianca\_s](https://discuss.elastic.co/u/bianca_s)\ **Replies:** 3\ **Last updated:** [June 27, 2024, 11:56am UTC](https://discuss.elastic.co/t/how-to-display-results-in-table-that-are-intersection-of-two-queries/360978 "2024-06-27T11:56:55Z")
Hi all, we have the following use case: We have an index containing logs of authentications from different devices. The data looks something like this: device\_id region\_id district\_id 1234 A district-1 5678 A… --- ## [Logstash fails to aggregate documents with similar timestamps](https://discuss.elastic.co/t/logstash-fails-to-aggregate-documents-with-similar-timestamps/361943)
**Author:** [@goncalobsantos](https://discuss.elastic.co/u/goncalobsantos)\ **Replies:** 3\ **Last updated:** [June 27, 2024, 11:03am UTC](https://discuss.elastic.co/t/logstash-fails-to-aggregate-documents-with-similar-timestamps/361943 "2024-06-27T11:03:43Z")
I have Logstash running on a server, receiving its input from Filebeat and sending its output to Elasticsearch. The inputs are of two types: "data arrival" and "sent data". Each input of type "data arrival" should be pai… --- ## [What is the easiest way to create indexes for different nginx logs in logstash](https://discuss.elastic.co/t/what-is-the-easiest-way-to-create-indexes-for-different-nginx-logs-in-logstash/362031)
**Author:** [@ffamous](https://discuss.elastic.co/u/ffamous)\ **Replies:** 5\ **Last updated:** [June 27, 2024, 11:03am UTC](https://discuss.elastic.co/t/what-is-the-easiest-way-to-create-indexes-for-different-nginx-logs-in-logstash/362031 "2024-06-27T11:03:30Z")
Hello. I have more than one nginx logs in folder which filebeat send to logstash and want to make index for each of them depends of the log name. My logstash.conf looks like this: input { beats { port =\> 5044 … --- ## [Syslog processor more strict than syslog input](https://discuss.elastic.co/t/syslog-processor-more-strict-than-syslog-input/362146)
**Author:** [@Poulpatine](https://discuss.elastic.co/u/Poulpatine)\ **Replies:** 0\ **Last updated:** [June 27, 2024, 10:05am UTC](https://discuss.elastic.co/t/syslog-processor-more-strict-than-syslog-input/362146 "2024-06-27T10:05:25Z")
Hi, I'm trying to gather logs from Netgear switches using Syslog. The idea is to configure all the switches to send logs via Syslog to a single filebeat instance and this filebeat instance is then sending the logs to a… --- ## [Springdata elasticsearch 5.2 nested aggregation without subAggregation](https://discuss.elastic.co/t/springdata-elasticsearch-5-2-nested-aggregation-without-subaggregation/362052)
**Author:** [@thVlm](https://discuss.elastic.co/u/thVlm)\ **Replies:** 4\ **Last updated:** [June 27, 2024, 9:58am UTC](https://discuss.elastic.co/t/springdata-elasticsearch-5-2-nested-aggregation-without-subaggregation/362052 "2024-06-27T09:58:40Z")
Help Needed: Nested Aggregations with Java API Client v8 I'm working on a project using Elasticsearch with the Java API Client v8, and I'm struggling to correctly implement nested aggregations. I'd greatly appreciate any… --- ## [Filebeat breaks log entries when there is a colon in the value of a field](https://discuss.elastic.co/t/filebeat-breaks-log-entries-when-there-is-a-colon-in-the-value-of-a-field/362079)
**Author:** [@kkovacs](https://discuss.elastic.co/u/kkovacs)\ **Replies:** 2\ **Last updated:** [June 27, 2024, 7:40am UTC](https://discuss.elastic.co/t/filebeat-breaks-log-entries-when-there-is-a-colon-in-the-value-of-a-field/362079 "2024-06-27T07:40:32Z")
Dear Community, I would like to ask for an advice from you. I tried several methods to resolve this problem, but without a success. My problem is: If a log entry (generated by my application) contains a colon (":"), f… --- ## [Can't prepare offline plugin](https://discuss.elastic.co/t/cant-prepare-offline-plugin/362063)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 7\ **Last updated:** [June 27, 2024, 7:33am UTC](https://discuss.elastic.co/t/cant-prepare-offline-plugin/362063 "2024-06-27T07:33:22Z")
hello everyone, i have a problem about logstash right now. i'm trying to create offline plugin here but when i run the command, i got this error Gem::LoadError: You have already activated ffi 1.16.3, but your Gemfile r… --- ## [Configuring a Cluster for High Throughput](https://discuss.elastic.co/t/configuring-a-cluster-for-high-throughput/362117)
**Author:** [@jhop](https://discuss.elastic.co/u/jhop)\ **Replies:** 3\ **Last updated:** [June 26, 2024, 9:50pm UTC](https://discuss.elastic.co/t/configuring-a-cluster-for-high-throughput/362117 "2024-06-26T21:50:35Z")
I have tried to load data into Elasticsearch real-time using Python. I am new to Elasticsearch. I used a single node and a single server. Elasticsearch was not able able to keep up with the real-time data coming into the… --- ## [Elasticsearch query failing with downsampling index](https://discuss.elastic.co/t/elasticsearch-query-failing-with-downsampling-index/362122)
**Author:** [@kbujold\_wr](https://discuss.elastic.co/u/kbujold_wr)\ **Replies:** 0\ **Last updated:** [June 26, 2024, 9:01pm UTC](https://discuss.elastic.co/t/elasticsearch-query-failing-with-downsampling-index/362122 "2024-06-26T21:01:42Z")
We are using ELK 7.9.0 with downsampling turned on at 7 days. I have this query that works when the range is before the downsampling ocured. But if its in that range it gives me this exception. This is the query curl -… --- ## [500mb memory used with no data added?](https://discuss.elastic.co/t/500mb-memory-used-with-no-data-added/362108)
**Author:** [@Dedicated\_Server](https://discuss.elastic.co/u/Dedicated_Server)\ **Replies:** 2\ **Last updated:** [June 26, 2024, 5:39pm UTC](https://discuss.elastic.co/t/500mb-memory-used-with-no-data-added/362108 "2024-06-26T17:39:41Z")
I have setup Elasticsearch and Kibana locally in a docker container with one node using docker compose. I enabled self-monitoring in Kibana and see that the memory usage for Elastic is around 500mb out of 1gb and there … --- ## [Elasticsearch cluster change schema in the same index](https://discuss.elastic.co/t/elasticsearch-cluster-change-schema-in-the-same-index/362054)
**Author:** [@thatelasticguy](https://discuss.elastic.co/u/thatelasticguy)\ **Replies:** 3\ **Last updated:** [June 26, 2024, 5:32pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-change-schema-in-the-same-index/362054 "2024-06-26T17:32:03Z")
We are using elasticsearch cluster version 7.10. And have some data in an index. We have updated schema for the cluster index and wanted to migrate the data from old schema to new schema in the same index. Is there any … --- ## [Cluster Block Exception retrying failed action with response code: 403](https://discuss.elastic.co/t/cluster-block-exception-retrying-failed-action-with-response-code-403/362015)
**Author:** [@Simon\_Prinz](https://discuss.elastic.co/u/Simon_Prinz)\ **Replies:** 5\ **Last updated:** [June 26, 2024, 4:24pm UTC](https://discuss.elastic.co/t/cluster-block-exception-retrying-failed-action-with-response-code-403/362015 "2024-06-26T16:24:56Z")
Hello Dear Community, since a Couple of days out of the Blue i get more and more: retrying failed action with response code: 403 ({"type"=\>"cluster\_block\_exception", "reason"=\>"index \[Logs\] blocked by: \[FORBIDDEN/8/ind… --- ## [Deletion on fields within an index](https://discuss.elastic.co/t/deletion-on-fields-within-an-index/362093)
**Author:** [@Moni\_Hazarika](https://discuss.elastic.co/u/Moni_Hazarika)\ **Replies:** 5\ **Last updated:** [June 26, 2024, 3:28pm UTC](https://discuss.elastic.co/t/deletion-on-fields-within-an-index/362093 "2024-06-26T15:28:43Z")
We have this usecase: Create Application with fields A (text), B (text), C (text). Application is more of a UI term but we have say for each application a collection in mongoDB to store the metadata of the application. … --- ## [RabbitMQ plugin filebeat questions](https://discuss.elastic.co/t/rabbitmq-plugin-filebeat-questions/361791)
**Author:** [@robbyq92](https://discuss.elastic.co/u/robbyq92)\ **Replies:** 9\ **Last updated:** [June 26, 2024, 2:41pm UTC](https://discuss.elastic.co/t/rabbitmq-plugin-filebeat-questions/361791 "2024-06-26T14:41:28Z")
I have a filebeat configured to pull data from a Rabbitmq with its module. Now on the official website it only gives var.paths: Question, if my Rabbitmq has a username and password and is on a host (ip or url) how do I … --- ## [Snmp poller - Logstash - Query](https://discuss.elastic.co/t/snmp-poller-logstash-query/362095)
**Author:** [@vijjigani](https://discuss.elastic.co/u/vijjigani)\ **Replies:** 0\ **Last updated:** [June 26, 2024, 1:17pm UTC](https://discuss.elastic.co/t/snmp-poller-logstash-query/362095 "2024-06-26T13:17:16Z")
I have a query about the snmp plugin - (Logstash). I want to fetch the cpu and memory usage value from the network device through snmp OIDs . and i need to create the two different events(one is for CPU and another one i… --- ## [Juniper filebeat module 8.14.1 is missing junos fileset](https://discuss.elastic.co/t/juniper-filebeat-module-8-14-1-is-missing-junos-fileset/362053)
**Author:** [@tdanno](https://discuss.elastic.co/u/tdanno)\ **Replies:** 2\ **Last updated:** [June 26, 2024, 1:12pm UTC](https://discuss.elastic.co/t/juniper-filebeat-module-8-14-1-is-missing-junos-fileset/362053 "2024-06-26T13:12:46Z")
Both in the documentation and in the module itself, only the SRX fileset is now available, and the JUNOS fileset is removed. Is that permanent? It was working, and we really need it. Is there any possibility to add it b… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=212) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=214)