# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=682 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 683 --- ## [Iptables intergrations Processors](https://discuss.elastic.co/t/iptables-intergrations-processors/321289)
**Author:** [@david-a76](https://discuss.elastic.co/u/david-a76)\ **Replies:** 1\ **Last updated:** [December 30, 2022, 7:52pm UTC](https://discuss.elastic.co/t/iptables-intergrations-processors/321289 "2022-12-30T19:52:52Z")
I wourd like to add a field when source ip is one of 192.168.100.0/24 or 172.17.100.0/24 subnet So i added this precocessor in iptables integration field on my agnet policy but It's totaly ignored. That's wrong with … --- ## [Kibana not starting. \[.kibana\_task\_manager\] Action failed with 'Request timed out'](https://discuss.elastic.co/t/kibana-not-starting-kibana-task-manager-action-failed-with-request-timed-out/317898)
**Author:** [@rkimera](https://discuss.elastic.co/u/rkimera)\ **Replies:** 7\ **Last updated:** [November 5, 2022, 11:31am UTC](https://discuss.elastic.co/t/kibana-not-starting-kibana-task-manager-action-failed-with-request-timed-out/317898 "2022-11-05T11:31:58Z")
I am able to run the elasticsearch server at port 9200. But this kibana server is failing to start throwing an error. I have downgraded to version 7. x.x from 8. x.x but still get the same error. I am using a Mac os. \ **Author:** [@PzYon](https://discuss.elastic.co/u/PzYon)\ **Replies:** 2\ **Last updated:** [December 30, 2022, 6:19pm UTC](https://discuss.elastic.co/t/essinglenodetestcase-unit-tests-official-recommendations/322222 "2022-12-30T18:19:33Z") I asked this question regarding unit tests a couple of weeks ago: Best practices for automated tests Now I would like to come back to the ESSingleNodeTestCase-class. I managed to get it to start an elastic server with … --- ## [Need to apply filter to KIBANA dashboard automatically through html](https://discuss.elastic.co/t/need-to-apply-filter-to-kibana-dashboard-automatically-through-html/322122)
**Author:** [@Shashank02](https://discuss.elastic.co/u/Shashank02)\ **Replies:** 4\ **Last updated:** [December 30, 2022, 4:41pm UTC](https://discuss.elastic.co/t/need-to-apply-filter-to-kibana-dashboard-automatically-through-html/322122 "2022-12-30T16:41:59Z")
My idea is that I have 2 cards - Virat Kohli and Leo Messi. And in the dashboard, I have 1 dashboard named "main" and in that, I have a filter called "event". In the "event" I have given 2 topics - viratkohli and lionelm… --- ## [\_delete\_by\_query with timestamp](https://discuss.elastic.co/t/delete-by-query-with-timestamp/318157)
**Author:** [@Yiming\_Gong](https://discuss.elastic.co/u/Yiming_Gong)\ **Replies:** 8\ **Last updated:** [December 30, 2022, 3:46pm UTC](https://discuss.elastic.co/t/delete-by-query-with-timestamp/318157 "2022-12-30T15:46:17Z")
The data I uploaded to Elasticsearch database is like the following { "took" : 0, "timed\_out" : false, "\_shards" : { "total" : 1, "successful" : 1, "skipped" : 0, "failed" : 0 }, "hits" : { … --- ## [Login to kibana iframe using ApiKey](https://discuss.elastic.co/t/login-to-kibana-iframe-using-apikey/322147)
**Author:** [@dinesh.mandrekar](https://discuss.elastic.co/u/dinesh.mandrekar)\ **Replies:** 1\ **Last updated:** [December 30, 2022, 3:20pm UTC](https://discuss.elastic.co/t/login-to-kibana-iframe-using-apikey/322147 "2022-12-30T15:20:48Z")
We want to use Attribute-Based Access Control for accessing kibana dashboard. For this we are generating multiple ApiKeys with different set of security attributes. We want to embed the kibana iframe into our applicatio… --- ## [Best practices for automated tests](https://discuss.elastic.co/t/best-practices-for-automated-tests/320872)
**Author:** [@PzYon](https://discuss.elastic.co/u/PzYon)\ **Replies:** 3\ **Last updated:** [December 30, 2022, 2:47pm UTC](https://discuss.elastic.co/t/best-practices-for-automated-tests/320872 "2022-12-30T14:47:34Z")
In our (Java) unit tests we would like to test the integration of Elasticsearch (e.g. do queries work, can docs be indexed correctly, etc.). I'm wondering if there are any best practices or recommendations regarding this… --- ## [From Filebeat to Logstash (and next to Elasticsearch) - pipeline processing](https://discuss.elastic.co/t/from-filebeat-to-logstash-and-next-to-elasticsearch-pipeline-processing/322171)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 2\ **Last updated:** [December 30, 2022, 2:35pm UTC](https://discuss.elastic.co/t/from-filebeat-to-logstash-and-next-to-elasticsearch-pipeline-processing/322171 "2022-12-30T14:35:42Z")
Hi, I'm having trouble getting data to transfer correctly from Filebeat to Logstash (then to Elasticsearch). When I configure in filebeat.yml output directly to Elasticsearch everything is ok. However, when I configur… --- ## [Embedded code not working](https://discuss.elastic.co/t/embedded-code-not-working/320307)
**Author:** [@Akjal](https://discuss.elastic.co/u/Akjal)\ **Replies:** 1\ **Last updated:** [December 2, 2022, 5:17pm UTC](https://discuss.elastic.co/t/embedded-code-not-working/320307 "2022-12-02T17:17:21Z")
Hello there, Having some issues rendering the embedded iframe code link from kibana to other platforms. For some reason it works when I run it on a local static file, but does not work when I test it on public platfor… --- ## [Show the \_slm/status somewhere in Kibana Managment](https://discuss.elastic.co/t/show-the-slm-status-somewhere-in-kibana-managment/322216)
**Author:** [@stouch](https://discuss.elastic.co/u/stouch)\ **Replies:** 4\ **Last updated:** [December 30, 2022, 2:21pm UTC](https://discuss.elastic.co/t/show-the-slm-status-somewhere-in-kibana-managment/322216 "2022-12-30T14:21:13Z")
Like some other users, I encountered this issue : \[slm\] Snapshots are just ignored when scheduled, but manual \_execute works - #5 by stouch Even if it can look like a dummy issue, I think it would be nice to get the \_sl… --- ## [We are getting "unindexed fields or ignored values cannot be searched"](https://discuss.elastic.co/t/we-are-getting-unindexed-fields-or-ignored-values-cannot-be-searched/322148)
**Author:** [@upreddy](https://discuss.elastic.co/u/upreddy)\ **Replies:** 1\ **Last updated:** [December 30, 2022, 2:18pm UTC](https://discuss.elastic.co/t/we-are-getting-unindexed-fields-or-ignored-values-cannot-be-searched/322148 "2022-12-30T14:18:03Z")
Hi, In Kibana (7.16.2) discover there are so many fields whose format is text which is not searchable like if we hover on the field it gives below message "unindexed fields or ignored values cannot be searched". But s… --- ## [\[slm\] Snapshots are just ignored when scheduled, but manual \_execute works](https://discuss.elastic.co/t/slm-snapshots-are-just-ignored-when-scheduled-but-manual-execute-works/321429)
**Author:** [@stouch](https://discuss.elastic.co/u/stouch)\ **Replies:** 4\ **Last updated:** [December 30, 2022, 1:28pm UTC](https://discuss.elastic.co/t/slm-snapshots-are-just-ignored-when-scheduled-but-manual-execute-works/321429 "2022-12-30T13:28:18Z")
I have a got a S3 repository and a slm policy. I can execute this policy manually : Snapshot is created, last success of this manual execution appears well, no failures. So I set up the scheduled cron : After the cron t… --- ## [Failed to install template](https://discuss.elastic.co/t/failed-to-install-template/322210)
**Author:** [@camilovietnam](https://discuss.elastic.co/u/camilovietnam)\ **Replies:** 2\ **Last updated:** [December 30, 2022, 1:15pm UTC](https://discuss.elastic.co/t/failed-to-install-template/322210 "2022-12-30T13:15:43Z")
Trying to demo the Elasticsearch stack, but having trouble figuring out why aren't things working. To start with, I have the following docker-compose file for mongo, logstash and elasticsearch. version: '3' # referenc… --- ## [Not able to get Source filename in the logstash output](https://discuss.elastic.co/t/not-able-to-get-source-filename-in-the-logstash-output/322130)
**Author:** [@Ramesh\_Perumal](https://discuss.elastic.co/u/Ramesh_Perumal)\ **Replies:** 2\ **Last updated:** [December 30, 2022, 10:57am UTC](https://discuss.elastic.co/t/not-able-to-get-source-filename-in-the-logstash-output/322130 "2022-12-30T10:57:43Z")
Hi, We are using filebeat 7.10.2 and logstash 8.10.4. Filebeat transfer the files from Machine A (Filebeat) to Machine B (Logstash) and Logstash writes the same in machine B's path (/va/pm/sfile/%{hostname}/%{\[log\]\[file… --- ## [Cant access field when creating runtime field](https://discuss.elastic.co/t/cant-access-field-when-creating-runtime-field/321759)
**Author:** [@pedro123](https://discuss.elastic.co/u/pedro123)\ **Replies:** 7\ **Last updated:** [December 30, 2022, 10:02am UTC](https://discuss.elastic.co/t/cant-access-field-when-creating-runtime-field/321759 "2022-12-30T10:02:22Z")
Hello, I am new to the elastic stack and I am currently creating a runtime field based on rum data. More specifically I want to do calculations based on the field transaction.duration.us. However when I am creating a … --- ## [Add custom index in Observability/alerts section](https://discuss.elastic.co/t/add-custom-index-in-observability-alerts-section/318088)
**Author:** [@federica.forti](https://discuss.elastic.co/u/federica.forti)\ **Replies:** 2\ **Last updated:** [November 4, 2022, 12:55pm UTC](https://discuss.elastic.co/t/add-custom-index-in-observability-alerts-section/318088 "2022-11-04T12:55:45Z")
Hi, do you know if is it possible, working on Kibana's Advanced Settings (or otherwise), to consider in the Alerts (Observability) section also alerts that trigger from custom indexes, in order to have a single dashboar… --- ## [How to Show multiple project log in differnt dashborad?](https://discuss.elastic.co/t/how-to-show-multiple-project-log-in-differnt-dashborad/322191)
**Author:** [@manish2](https://discuss.elastic.co/u/manish2)\ **Replies:** 0\ **Last updated:** [December 30, 2022, 6:44am UTC](https://discuss.elastic.co/t/how-to-show-multiple-project-log-in-differnt-dashborad/322191 "2022-12-30T06:44:56Z")
please anyone help me!... in my dashboard i get all log of different project but now i am want to filter all log of multiple project in differnet dashboard......i am new in ELK . Help me ! --- ## [Vegalite Pivot with Index data](https://discuss.elastic.co/t/vegalite-pivot-with-index-data/321881)
**Author:** [@Siva\_Kumar\_Menta](https://discuss.elastic.co/u/Siva_Kumar_Menta)\ **Replies:** 2\ **Last updated:** [December 30, 2022, 9:08am UTC](https://discuss.elastic.co/t/vegalite-pivot-with-index-data/321881 "2022-12-30T09:08:35Z")
Hi All, I have data in Elasticsearch index "vegalite\_pivot". While trying to create bar chart with pivot transformation getting below error. FYI...Provided below index data & vegalite script. Please suggest required… --- ## [Your Query Is Taking While-Kibana/Report download (Aggregation on documents with unique id more than 20000)](https://discuss.elastic.co/t/your-query-is-taking-while-kibana-report-download-aggregation-on-documents-with-unique-id-more-than-20000/322156)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 1\ **Last updated:** [December 29, 2022, 4:35pm UTC](https://discuss.elastic.co/t/your-query-is-taking-while-kibana-report-download-aggregation-on-documents-with-unique-id-more-than-20000/322156 "2022-12-29T16:35:06Z")
Hello All, Issue 1: In my dashboard I've intrgrated 5 visuals,4 bar charts and 1 enhanced data table. While I select time range for 2 week,it fetches around 18000 unique documents that is visible in enhanced data tabl… --- ## [How to display only direct connections on elastic Graph](https://discuss.elastic.co/t/how-to-display-only-direct-connections-on-elastic-graph/321848)
**Author:** [@Leonardo\_Carlos](https://discuss.elastic.co/u/Leonardo_Carlos)\ **Replies:** 4\ **Last updated:** [December 30, 2022, 8:44am UTC](https://discuss.elastic.co/t/how-to-display-only-direct-connections-on-elastic-graph/321848 "2022-12-30T08:44:18Z")
Hello everyone, We would like to know how we could display only direct connections through the Elastic Graph functionality. Currently, we are only able to see all connections in a shot which is making a certain difficul… --- ## [Applying ilm to system template](https://discuss.elastic.co/t/applying-ilm-to-system-template/321751)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 2\ **Last updated:** [December 30, 2022, 7:53am UTC](https://discuss.elastic.co/t/applying-ilm-to-system-template/321751 "2022-12-30T07:53:29Z")
Hello, i enabled monitoring in stack monitoring section in kibana, and it generated indexes .monitoring-es-7-\* and .monitoring-kibana-7-\*. I wanted to apply ILM to this indexes as there's currently no ilm attached. I tri… --- ## [Filebeat netflow port 2055 bound to host](https://discuss.elastic.co/t/filebeat-netflow-port-2055-bound-to-host/322101)
**Author:** [@shaikmuzakkir](https://discuss.elastic.co/u/shaikmuzakkir)\ **Replies:** 2\ **Last updated:** [December 30, 2022, 7:16am UTC](https://discuss.elastic.co/t/filebeat-netflow-port-2055-bound-to-host/322101 "2022-12-30T07:16:45Z")
Hi We are using the filebeat image - docker.elastic.co/beats/filebeat:8.4.3 and see the netflow port 2055 is bound to the host. We are using the below config for netflow as input: - type: netflow max\_message… --- ## [About Sending Logs from External SIEM (include ArcSight, Qradar, Splunk, ELK...) to Receiver Elastic Agent or Logstash with method TCP/UDP](https://discuss.elastic.co/t/about-sending-logs-from-external-siem-include-arcsight-qradar-splunk-elk-to-receiver-elastic-agent-or-logstash-with-method-tcp-udp/322139)
**Author:** [@Louis\_Wales](https://discuss.elastic.co/u/Louis_Wales)\ **Replies:** 4\ **Last updated:** [December 30, 2022, 3:45am UTC](https://discuss.elastic.co/t/about-sending-logs-from-external-siem-include-arcsight-qradar-splunk-elk-to-receiver-elastic-agent-or-logstash-with-method-tcp-udp/322139 "2022-12-30T03:45:10Z")
Hi everyone, I have a question when should I use TCP, and when should I use UDP to forward logs? Or is it better to use TCP or UDP? The situation is about Sending Logs from External SIEM (include ArcSight, Qradar, Splun… --- ## [System test failing for Policy having variable definition outside Policy Templates](https://discuss.elastic.co/t/system-test-failing-for-policy-having-variable-definition-outside-policy-templates/322028)
**Author:** [@Alex\_R](https://discuss.elastic.co/u/Alex_R)\ **Replies:** 0\ **Last updated:** [December 27, 2022, 8:59am UTC](https://discuss.elastic.co/t/system-test-failing-for-policy-having-variable-definition-outside-policy-templates/322028 "2022-12-27T08:59:38Z")
Hi Team! I am working on one of the integrations in which I have defined one variable in the main manifest (package level) in such a fashion. vars: - name: instance\_url type: text title: Instance URL requ… --- ## [After restart Ubuntu , Elastic does not work](https://discuss.elastic.co/t/after-restart-ubuntu-elastic-does-not-work/322065)
**Author:** [@Mursel](https://discuss.elastic.co/u/Mursel)\ **Replies:** 1\ **Last updated:** [December 30, 2022, 2:20am UTC](https://discuss.elastic.co/t/after-restart-ubuntu-elastic-does-not-work/322065 "2022-12-30T02:20:17Z")
Hello. I have an issue. Elastic installed on Ubuntu (ESXI). I have restarted ubuntu, but after that, I can't see any logs in Kibana. In the terminal, I can see logs (syslog). --- ## [Advice on paging with Parent-Child relation (And grouping)](https://discuss.elastic.co/t/advice-on-paging-with-parent-child-relation-and-grouping/322180)
**Author:** [@CJohn](https://discuss.elastic.co/u/CJohn)\ **Replies:** 0\ **Last updated:** [December 29, 2022, 10:53pm UTC](https://discuss.elastic.co/t/advice-on-paging-with-parent-child-relation-and-grouping/322180 "2022-12-29T22:53:28Z")
Hi, I am having a few issues in the returning the right paged results with a parent - child relationship. There are two scenarios in which I display the data that impact the shape returning from elastic. For the momen… --- ## [Osquery in new space not working](https://discuss.elastic.co/t/osquery-in-new-space-not-working/319869)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 3\ **Last updated:** [December 2, 2022, 12:22am UTC](https://discuss.elastic.co/t/osquery-in-new-space-not-working/319869 "2022-12-02T00:22:03Z")
Why does this keep happening? Osquery packs only work from the Default space, any other space where I created a new pack, this happens: --- ## [Trying to understand a previous setup/pipeline](https://discuss.elastic.co/t/trying-to-understand-a-previous-setup-pipeline/322175)
**Author:** [@jason3](https://discuss.elastic.co/u/jason3)\ **Replies:** 1\ **Last updated:** [December 29, 2022, 9:52pm UTC](https://discuss.elastic.co/t/trying-to-understand-a-previous-setup-pipeline/322175 "2022-12-29T21:52:07Z")
Hello all, Im trying to understand and learn Elastic while working though and improving some bad setups of my predecessors. I was hoping you could help with confirming my understanding after what I have been reading. … --- ## [Minimum files needed for search only?](https://discuss.elastic.co/t/minimum-files-needed-for-search-only/322056)
**Author:** [@Cliffster](https://discuss.elastic.co/u/Cliffster)\ **Replies:** 5\ **Last updated:** [December 29, 2022, 9:22pm UTC](https://discuss.elastic.co/t/minimum-files-needed-for-search-only/322056 "2022-12-29T21:22:44Z")
Our non profit (Chipster.org) is creating offline educational collections for people who lack internet. The collections will be distributed on flash drives and designed so that a user can copy their collection freely t… --- ## [I have Kibana Running and Elasticsearch also running but I can not get to the Kibana URL](https://discuss.elastic.co/t/i-have-kibana-running-and-elasticsearch-also-running-but-i-can-not-get-to-the-kibana-url/322124)
**Author:** [@Peter\_Lilley](https://discuss.elastic.co/u/Peter_Lilley)\ **Replies:** 4\ **Last updated:** [December 29, 2022, 6:00pm UTC](https://discuss.elastic.co/t/i-have-kibana-running-and-elasticsearch-also-running-but-i-can-not-get-to-the-kibana-url/322124 "2022-12-29T18:00:28Z")
I am using an Ubuntu VM hosted in Azure, I have the ports 9200 open and 5601 open. When i go to \:9200 i get this "name" : "node-YBA", "cluster\_name" : "my-application", "cluster\_uuid" : "PIsS2fqrR62icScNqyi… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=681) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=683)