# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=606 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 607 --- ## [Posting logs of underlying plugin libraries to Logstash log stream](https://discuss.elastic.co/t/posting-logs-of-underlying-plugin-libraries-to-logstash-log-stream/327105)
**Author:** [@alromos](https://discuss.elastic.co/u/alromos)\ **Replies:** 1\ **Last updated:** [March 13, 2023, 11:15am UTC](https://discuss.elastic.co/t/posting-logs-of-underlying-plugin-libraries-to-logstash-log-stream/327105 "2023-03-13T11:15:16Z")
Is it possible to post logs of underlying libraries to Logstash log stream? For instance, I use input JDBC plugin with MSSQL JDBC driver and I would like to see logs of the driver library for debug purposes. Is it poss… --- ## [Transport error 429](https://discuss.elastic.co/t/transport-error-429/327528)
**Author:** [@Susendiran](https://discuss.elastic.co/u/Susendiran)\ **Replies:** 5\ **Last updated:** [March 13, 2023, 10:48am UTC](https://discuss.elastic.co/t/transport-error-429/327528 "2023-03-13T10:48:31Z")
Hi Team, We are getting elasticsearch exceptions - transport error 429 while providing es.search command using python pandas for some large set of data(upto 13-15k records). It's showing the limit is more than the thres… --- ## [Adding extra field in filebeat](https://discuss.elastic.co/t/adding-extra-field-in-filebeat/327534)
**Author:** [@gyrao\_72](https://discuss.elastic.co/u/gyrao_72)\ **Replies:** 0\ **Last updated:** [March 13, 2023, 9:08am UTC](https://discuss.elastic.co/t/adding-extra-field-in-filebeat/327534 "2023-03-13T09:08:29Z")
filebeat.inputs: # Each - is an input. Most options can be set at the input level, so # you can use different inputs for various configurations. # Below are the input specific configurations. - type: log # Change to t… --- ## [NOT STRING IN ARRAY IN WATCHER](https://discuss.elastic.co/t/not-string-in-array-in-watcher/327421)
**Author:** [@Daniel\_Lopez](https://discuss.elastic.co/u/Daniel_Lopez)\ **Replies:** 1\ **Last updated:** [March 13, 2023, 10:18am UTC](https://discuss.elastic.co/t/not-string-in-array-in-watcher/327421 "2023-03-13T10:18:19Z")
Hi team! I'm trying to setup a watcher for finding a way to check if an array has not a string value, but i getting stuck, could someone have an idea? --- ## [Enabling multiple snapshot operations in ES 6.5.4](https://discuss.elastic.co/t/enabling-multiple-snapshot-operations-in-es-6-5-4/327536)
**Author:** [@Het\_Desai](https://discuss.elastic.co/u/Het_Desai)\ **Replies:** 3\ **Last updated:** [March 13, 2023, 10:16am UTC](https://discuss.elastic.co/t/enabling-multiple-snapshot-operations-in-es-6-5-4/327536 "2023-03-13T10:16:29Z")
We have ES 6.5.4 and using S3 repository in our different machines. We move data from one machine to another using snapshot/restore process. Now only 1 concurrent snapshot operation is allowed per machine. If we do some … --- ## [\[Filebeat 8.6.1 - httpjson\] chain response.transform question](https://discuss.elastic.co/t/filebeat-8-6-1-httpjson-chain-response-transform-question/326774)
**Author:** [@marrc.rousseau](https://discuss.elastic.co/u/marrc.rousseau)\ **Replies:** 2\ **Last updated:** [March 13, 2023, 8:51am UTC](https://discuss.elastic.co/t/filebeat-8-6-1-httpjson-chain-response-transform-question/326774 "2023-03-13T08:51:59Z")
Hello, I'm facing an issue with response.transform and after searching during hours I'm still not able to find a solution. I try to chain some api calls to get a list of bugs per host : Request 1: To get list of host … --- ## [Data Grid vs Table](https://discuss.elastic.co/t/data-grid-vs-table/327527)
**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\ **Replies:** 2\ **Last updated:** [March 13, 2023, 8:40am UTC](https://discuss.elastic.co/t/data-grid-vs-table/327527 "2023-03-13T08:40:50Z")
Hi, I want to display data in tabular format and also give in option to edit/input extra values giving text fields/other input controls inside cell. Is EuiDataGrid or EuiTable a better option for the same? Thanks --- ## [Error while creating Parallel coordinate in Vega - "Cannot read properties of undefined (reading 'key')"](https://discuss.elastic.co/t/error-while-creating-parallel-coordinate-in-vega-cannot-read-properties-of-undefined-reading-key/327529)
**Author:** [@Fiza](https://discuss.elastic.co/u/Fiza)\ **Replies:** 1\ **Last updated:** [March 13, 2023, 8:00am UTC](https://discuss.elastic.co/t/error-while-creating-parallel-coordinate-in-vega-cannot-read-properties-of-undefined-reading-key/327529 "2023-03-13T08:00:12Z")
Hello everyone, I am trying to create parallel coordinates for my timeseries data. I am first querying to get wanted fields and then trying to use them for scale and axis plotting. But I am receiving properties undefi… --- ## [Is it possible to recognize if dashboards changes in Kibana Spaces?](https://discuss.elastic.co/t/is-it-possible-to-recognize-if-dashboards-changes-in-kibana-spaces/327448)
**Author:** [@Flo2](https://discuss.elastic.co/u/Flo2)\ **Replies:** 2\ **Last updated:** [March 13, 2023, 7:34am UTC](https://discuss.elastic.co/t/is-it-possible-to-recognize-if-dashboards-changes-in-kibana-spaces/327448 "2023-03-13T07:34:34Z")
Hello Everyone, is it possible to automatically recognize if dashboards are added or deleted from Kibana spaces? And if so, can a notification be sent to a user based on this action? --- ## [Adding only the appended part of a file to elastic using logstash](https://discuss.elastic.co/t/adding-only-the-appended-part-of-a-file-to-elastic-using-logstash/327520)
**Author:** [@aks03](https://discuss.elastic.co/u/aks03)\ **Replies:** 1\ **Last updated:** [March 13, 2023, 4:37am UTC](https://discuss.elastic.co/t/adding-only-the-appended-part-of-a-file-to-elastic-using-logstash/327520 "2023-03-13T04:37:35Z")
Hey everyone, I am new to Elk stack but currently I want to add only the appended part of a file i.e, any extra content added to the file to elastic using logstash 6.3. The files are unstructured so even that has left … --- ## [Kibana 8.6.1 \`yarn kbn bootstrap\` Error](https://discuss.elastic.co/t/kibana-8-6-1-yarn-kbn-bootstrap-error/327519)
**Author:** [@suran\_choi](https://discuss.elastic.co/u/suran_choi)\ **Replies:** 0\ **Last updated:** [March 13, 2023, 4:35am UTC](https://discuss.elastic.co/t/kibana-8-6-1-yarn-kbn-bootstrap-error/327519 "2023-03-13T04:35:38Z")
I just wanna run Kibana 8.6.1. But I got this error. Node version : 16.18.1 yarn version : 1.22.19 ubuntu@raspberrypi:/usr/local/kibana$ bin/kibana node:internal/modules/cjs/loader:988 throw err; ^ Error: Cannot … --- ## [Convert a string field to number, but only brand new indices recognized](https://discuss.elastic.co/t/convert-a-string-field-to-number-but-only-brand-new-indices-recognized/327512)
**Author:** [@KeithTt](https://discuss.elastic.co/u/KeithTt)\ **Replies:** 0\ **Last updated:** [March 13, 2023, 3:39am UTC](https://discuss.elastic.co/t/convert-a-string-field-to-number-but-only-brand-new-indices-recognized/327512 "2023-03-13T03:39:55Z")
Logstash version: 6.3.0 Here is my config: mutate { convert =\> { "bytes\_sent" =\> "integer" } } I find that a indice which first created can recognized the config, but the others ones can not, even they created erv… --- ## [Osquery Manager integration: Settings page stuck updating](https://discuss.elastic.co/t/osquery-manager-integration-settings-page-stuck-updating/327508)
**Author:** [@ceekay](https://discuss.elastic.co/u/ceekay)\ **Replies:** 0\ **Last updated:** [March 12, 2023, 11:15pm UTC](https://discuss.elastic.co/t/osquery-manager-integration-settings-page-stuck-updating/327508 "2023-03-12T23:15:57Z")
Hi there, I have an air-gapped install using the Elastic Docker image for the integration registry. The Docker container is running on that same node as Kibana. This is all fine and integration installs and such are wor… --- ## [Filebeat custom module](https://discuss.elastic.co/t/filebeat-custom-module/327509)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 0\ **Last updated:** [March 12, 2023, 11:49pm UTC](https://discuss.elastic.co/t/filebeat-custom-module/327509 "2023-03-12T23:49:26Z")
Not finding the doc of modules sufficient to make me a custom module. Would it be possible to convert a filebeat.inputs section to a filebeat.config.modules configuration? Eg. having working filestream like this: - t… --- ## [Error: Kibana server is not ready yet](https://discuss.elastic.co/t/error-kibana-server-is-not-ready-yet/327488)
**Author:** [@Matt\_Johnston](https://discuss.elastic.co/u/Matt_Johnston)\ **Replies:** 18\ **Last updated:** [March 12, 2023, 11:29pm UTC](https://discuss.elastic.co/t/error-kibana-server-is-not-ready-yet/327488 "2023-03-12T23:29:39Z")
Hello. I'm running Elasticsearch and Kibana via docker containers, whose images I'm building from the Dockerfiles from this repository: GitHub - elastic/dockerfiles: Dockerfiles for the official Elastic Stack images. Whe… --- ## [Filebeat vs elastic putput](https://discuss.elastic.co/t/filebeat-vs-elastic-putput/327506)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 10\ **Last updated:** [March 12, 2023, 9:47pm UTC](https://discuss.elastic.co/t/filebeat-vs-elastic-putput/327506 "2023-03-12T21:47:10Z")
Hi Need a wall to play against here TIA :slight\_smile: What am I missing out on, I wonder, when trying to launch filebeat.service. I'm see these errors: ==\> /var/log/filebeat/filebeat-20230312.ndjson \<== {"log.level":… --- ## [Visualizations not working in dashboard](https://discuss.elastic.co/t/visualizations-not-working-in-dashboard/327505)
**Author:** [@Sara\_YB](https://discuss.elastic.co/u/Sara_YB)\ **Replies:** 0\ **Last updated:** [March 12, 2023, 5:12pm UTC](https://discuss.elastic.co/t/visualizations-not-working-in-dashboard/327505 "2023-03-12T17:12:27Z")
I already upgraded to Elastic 8.6, and repalced beats by Elastic Agent. The problem is that because of some visualizations built in using filebeat, they stopped showing data after the replacement. So, is there any work… --- ## [Simple question about timestamp in logs](https://discuss.elastic.co/t/simple-question-about-timestamp-in-logs/327485)
**Author:** [@Mark\_S](https://discuss.elastic.co/u/Mark_S)\ **Replies:** 3\ **Last updated:** [March 12, 2023, 4:31pm UTC](https://discuss.elastic.co/t/simple-question-about-timestamp-in-logs/327485 "2023-03-12T16:31:42Z")
When I create an index and use Logstash to send logfiles, I use the option start\_position =\> "beginning". However when viewing "discover" mode in kibana, I only see the logs after the index was created. Shouldn't there … --- ## [ILM doesn't rollover](https://discuss.elastic.co/t/ilm-doesnt-rollover/327497)
**Author:** [@m3bgwad](https://discuss.elastic.co/u/m3bgwad)\ **Replies:** 1\ **Last updated:** [March 12, 2023, 4:46pm UTC](https://discuss.elastic.co/t/ilm-doesnt-rollover/327497 "2023-03-12T16:46:56Z")
Hello all, can any one help me to get the ILM wrong, I created ILM for support the retention period so everything is well but the new rollover indices doesn't store any data (the docs count is 0), I need to move the da… --- ## [Generate image out of kibana](https://discuss.elastic.co/t/generate-image-out-of-kibana/326914)
**Author:** [@mayer](https://discuss.elastic.co/u/mayer)\ **Replies:** 4\ **Last updated:** [March 12, 2023, 3:29pm UTC](https://discuss.elastic.co/t/generate-image-out-of-kibana/326914 "2023-03-12T15:29:22Z")
Dear All, We are running ELK latest version with authentication available on Intranet but not accessible from Internet. We want to make some images public available but we do not want to give access to ELK directly for … --- ## [Help with http certs in elasticsearch](https://discuss.elastic.co/t/help-with-http-certs-in-elasticsearch/327371)
**Author:** [@Mary2022](https://discuss.elastic.co/u/Mary2022)\ **Replies:** 5\ **Last updated:** [March 12, 2023, 1:11pm UTC](https://discuss.elastic.co/t/help-with-http-certs-in-elasticsearch/327371 "2023-03-12T13:11:19Z")
I used elasticsearch-certutil with my companies CA.jks to create http certificates for my node but I am at the last step to send the output zip file to the path I give I get the following error: Exception in thread "mai… --- ## [Grok (or any alternative) to search for keywords in logs](https://discuss.elastic.co/t/grok-or-any-alternative-to-search-for-keywords-in-logs/327351)
**Author:** [@Mark\_S](https://discuss.elastic.co/u/Mark_S)\ **Replies:** 14\ **Last updated:** [March 12, 2023, 12:34pm UTC](https://discuss.elastic.co/t/grok-or-any-alternative-to-search-for-keywords-in-logs/327351 "2023-03-12T12:34:26Z")
Hello, Is it possible to create keywords in logstash, by searching for them in the message? The logs are formatted in the following way, however they are not always in the same place - they could be embedded in other m… --- ## [Curator 8 not showing all indexes](https://discuss.elastic.co/t/curator-8-not-showing-all-indexes/327381)
**Author:** [@alon\_carmelly](https://discuss.elastic.co/u/alon_carmelly)\ **Replies:** 2\ **Last updated:** [March 12, 2023, 12:17pm UTC](https://discuss.elastic.co/t/curator-8-not-showing-all-indexes/327381 "2023-03-12T12:17:07Z")
I am usining : pip install -U elasticsearch-curator to get version 8 ran: curator --dry-run --config ./curator.yml ./delete\_log\_files\_curator.yml action file :slight\_smile: actions: 1: action: delete\_indices … --- ## [Canvas: timefilter being ignored](https://discuss.elastic.co/t/canvas-timefilter-being-ignored/327376)
**Author:** [@JeroenK](https://discuss.elastic.co/u/JeroenK)\ **Replies:** 2\ **Last updated:** [March 12, 2023, 9:28am UTC](https://discuss.elastic.co/t/canvas-timefilter-being-ignored/327376 "2023-03-12T09:28:26Z")
Ok, this used to work somewhere in release 8.5 or before (I did not get around posting this for some months, at that moment I fixed the issue with a workaround, but I'm still puzzled about it) timefilter column="timesta… --- ## [How to filter buckets based on the comparison of two sub-aggregation metrics in ElasticSearch (python)?](https://discuss.elastic.co/t/how-to-filter-buckets-based-on-the-comparison-of-two-sub-aggregation-metrics-in-elasticsearch-python/327498)
**Author:** [@Ashar\_Ahmad](https://discuss.elastic.co/u/Ashar_Ahmad)\ **Replies:** 0\ **Last updated:** [March 12, 2023, 8:59am UTC](https://discuss.elastic.co/t/how-to-filter-buckets-based-on-the-comparison-of-two-sub-aggregation-metrics-in-elasticsearch-python/327498 "2023-03-12T08:59:20Z")
My index has documents with the following fields: user\_id, user\_name, post\_text, post\_sentiment where post\_sentiment is of type double, and represents the sentiment of the post. A post\_sentiment greater than 0 indicates … --- ## [Unbale to view logs but indices available](https://discuss.elastic.co/t/unbale-to-view-logs-but-indices-available/327496)
**Author:** [@Prabhakar\_D](https://discuss.elastic.co/u/Prabhakar_D)\ **Replies:** 6\ **Last updated:** [March 12, 2023, 8:20am UTC](https://discuss.elastic.co/t/unbale-to-view-logs-but-indices-available/327496 "2023-03-12T08:20:08Z")
Hi, ELK uable to view logs for specific period but indices available. Someone please suggest how to recover the indices which is already rolledup as per lifecycle --- ## [Scripted fields: text field returns null](https://discuss.elastic.co/t/scripted-fields-text-field-returns-null/327178)
**Author:** [@RonGros](https://discuss.elastic.co/u/RonGros)\ **Replies:** 5\ **Last updated:** [March 12, 2023, 6:54am UTC](https://discuss.elastic.co/t/scripted-fields-text-field-returns-null/327178 "2023-03-12T06:54:03Z")
Hi, I have an index with a lot of fields. I am trying to create a scripted field that will do some string manipulation on another field, but when I try to access it - I keep getting null What I've noticed is that if I t… --- ## [Logstash Keeps Restarting](https://discuss.elastic.co/t/logstash-keeps-restarting/327494)
**Author:** [@kirkofthefleet](https://discuss.elastic.co/u/kirkofthefleet)\ **Replies:** 1\ **Last updated:** [March 12, 2023, 3:06am UTC](https://discuss.elastic.co/t/logstash-keeps-restarting/327494 "2023-03-12T03:06:51Z")
Hello! Please forgive any "syntax errors" as I am a complete newb to all of the elastic stack. I am working on getting elasticstack working for my small IT business. I have a few servers that I am interested in monitor… --- ## [What AWS config file settings are honored?](https://discuss.elastic.co/t/what-aws-config-file-settings-are-honored/327490)
**Author:** [@marcoderama](https://discuss.elastic.co/u/marcoderama)\ **Replies:** 0\ **Last updated:** [March 11, 2023, 9:39pm UTC](https://discuss.elastic.co/t/what-aws-config-file-settings-are-honored/327490 "2023-03-11T21:39:24Z")
\[Elastic noob warning!\] Fundamentally, I'm trying to figure out how to automatically update temporary credentials for the Elastic AWS integration. I'm trying to configure my AWS Elastic Agent integration to use a shar… --- ## [Waiting for all shards copies to be active](https://discuss.elastic.co/t/waiting-for-all-shards-copies-to-be-active/327360)
**Author:** [@Gaurav\_kr](https://discuss.elastic.co/u/Gaurav_kr)\ **Replies:** 1\ **Last updated:** [March 11, 2023, 4:33pm UTC](https://discuss.elastic.co/t/waiting-for-all-shards-copies-to-be-active/327360 "2023-03-11T16:33:36Z")
Hi Team, I am using basic license version 8.0.0 of ELK, which is setup using docker. We are using ILM for hot, warm and cold phase but after completing the hot phase it is waiting in warm phase with an action "Waiting … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=605) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=607)