# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=683 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 684 --- ## [Add a custom field in Kibana](https://discuss.elastic.co/t/add-a-custom-field-in-kibana/322138)
**Author:** [@jessutanto](https://discuss.elastic.co/u/jessutanto)\ **Replies:** 1\ **Last updated:** [December 29, 2022, 5:55pm UTC](https://discuss.elastic.co/t/add-a-custom-field-in-kibana/322138 "2022-12-29T17:55:14Z")
Hi, I wanted to add a field where it calculates the age of a person, thus --\> Birth date - Now I tried to implement this guide. \[see the Datetime Now Example\]. Somehow I got an error said cannot resolve symbol \[zdt\]. … --- ## [Creating Custom dashboard with grouping and math function](https://discuss.elastic.co/t/creating-custom-dashboard-with-grouping-and-math-function/322115)
**Author:** [@vamsi2](https://discuss.elastic.co/u/vamsi2)\ **Replies:** 1\ **Last updated:** [December 29, 2022, 5:11pm UTC](https://discuss.elastic.co/t/creating-custom-dashboard-with-grouping-and-math-function/322115 "2022-12-29T17:11:07Z")
Hi Is it possible to create a complex custom dashboards with grouping and math functions in elastic ? --- ## [How can I send custom logs in a specific location to filebeat running inside docker](https://discuss.elastic.co/t/how-can-i-send-custom-logs-in-a-specific-location-to-filebeat-running-inside-docker/322106)
**Author:** [@Raja\_Muneer](https://discuss.elastic.co/u/Raja_Muneer)\ **Replies:** 18\ **Last updated:** [December 29, 2022, 4:29pm UTC](https://discuss.elastic.co/t/how-can-i-send-custom-logs-in-a-specific-location-to-filebeat-running-inside-docker/322106 "2022-12-29T16:29:56Z")
I am new to filebeat and elk. I am trying to send custom logs using filebeat to Elasticsearch directly.Both the elk stack and filebeat are running inside docker containers.. The custom logs are in the folder home/usernam… --- ## [How do you handle Elastic Agent Policies and Integrations that only apply to some systems?](https://discuss.elastic.co/t/how-do-you-handle-elastic-agent-policies-and-integrations-that-only-apply-to-some-systems/322168)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 0\ **Last updated:** [December 29, 2022, 4:15pm UTC](https://discuss.elastic.co/t/how-do-you-handle-elastic-agent-policies-and-integrations-that-only-apply-to-some-systems/322168 "2022-12-29T16:15:09Z")
Hi All, This is more of a general question looking for input from others how they handle Elastic Agent policies when there is an integration that only needs to be deployed to a subset of systems. General concept of my … --- ## [Security in elasticsearch](https://discuss.elastic.co/t/security-in-elasticsearch/322119)
**Author:** [@alex\_96](https://discuss.elastic.co/u/alex_96)\ **Replies:** 4\ **Last updated:** [December 29, 2022, 3:58pm UTC](https://discuss.elastic.co/t/security-in-elasticsearch/322119 "2022-12-29T15:58:27Z")
Hello everyone, such a question, I recently set up elasticsearch 7.17, when I created certificates, I caught myself thinking that I didn’t fully understand the meaning, I hope you can help me. as I understand it, there… --- ## [Ingest-attachment not found](https://discuss.elastic.co/t/ingest-attachment-not-found/322150)
**Author:** [@WhatCouldGoWrong](https://discuss.elastic.co/u/WhatCouldGoWrong)\ **Replies:** 7\ **Last updated:** [December 29, 2022, 2:53pm UTC](https://discuss.elastic.co/t/ingest-attachment-not-found/322150 "2022-12-29T14:53:08Z")
Hi, I'm trying to install the ingest-attachment (using elasticsearch-plugin install ingest-attachment). I'm behind a proxy, so I use this line: sudo CLI\_JAVA\_OPTS="-Dhttp.proxyHost=192.168.0.1 -Dhttp.proxyPort=8080 -D… --- ## [Kibana - unknown configuration key deprecation.skip\_deprecated\_settings](https://discuss.elastic.co/t/kibana-unknown-configuration-key-deprecation-skip-deprecated-settings/321575)
**Author:** [@h0llym0lly](https://discuss.elastic.co/u/h0llym0lly)\ **Replies:** 4\ **Last updated:** [December 29, 2022, 2:19pm UTC](https://discuss.elastic.co/t/kibana-unknown-configuration-key-deprecation-skip-deprecated-settings/321575 "2022-12-29T14:19:44Z")
I have an instance of Kibana which was not installed via RPM or DEB package. Whole application was started via script and now I wanted to add it to systemd. I am facing this error when I am trying to start kibana via s… --- ## [Type: long fields show wrong values in kibana](https://discuss.elastic.co/t/type-long-fields-show-wrong-values-in-kibana/322154)
**Author:** [@nisow95612](https://discuss.elastic.co/u/nisow95612)\ **Replies:** 7\ **Last updated:** [December 29, 2022, 2:13pm UTC](https://discuss.elastic.co/t/type-long-fields-show-wrong-values-in-kibana/322154 "2022-12-29T14:13:53Z")
Hello, I have noticed a problem with Kibana. Values with "type": "long" do not display correctly. For example let's take the value "1 671 607 837 241 650 688" displayed in Discover: This is wrong. When I swith to … --- ## [It is possible to use Kibana cluster alerts with data from an external monitoring cluster?](https://discuss.elastic.co/t/it-is-possible-to-use-kibana-cluster-alerts-with-data-from-an-external-monitoring-cluster/319549)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 2\ **Last updated:** [December 1, 2022, 2:45pm UTC](https://discuss.elastic.co/t/it-is-possible-to-use-kibana-cluster-alerts-with-data-from-an-external-monitoring-cluster/319549 "2022-12-01T14:45:41Z")
Hello, Currently We have a platinum licensed cluster running on-prem, and as recommended by Elastic we use another cluster to collect the monitoring data. This monitoring cluster uses the Basic License, as it is just a… --- ## [Elasticsearch ingest large of data](https://discuss.elastic.co/t/elasticsearch-ingest-large-of-data/322099)
**Author:** [@m3bgwad](https://discuss.elastic.co/u/m3bgwad)\ **Replies:** 5\ **Last updated:** [December 29, 2022, 1:24pm UTC](https://discuss.elastic.co/t/elasticsearch-ingest-large-of-data/322099 "2022-12-29T13:24:47Z")
is there capability of Elasticsearch to ingest amount large of data at a rate of 300TB in the year after that archive data in offline storage? what is challenges facing me to ingest that much volume? --- ## [Index created via python not seen in UI and vice-versa](https://discuss.elastic.co/t/index-created-via-python-not-seen-in-ui-and-vice-versa/321923)
**Author:** [@nikhilkvn](https://discuss.elastic.co/u/nikhilkvn)\ **Replies:** 1\ **Last updated:** [December 29, 2022, 1:14pm UTC](https://discuss.elastic.co/t/index-created-via-python-not-seen-in-ui-and-vice-versa/321923 "2022-12-29T13:14:07Z")
This is weird. Index created via Dev-Console is not seen in the Python-client. Index created via Python-client is not seen on Dev-Console. Both ways I am able to write/Read data. But have to choose only one way I am … --- ## [Recurring index corruption](https://discuss.elastic.co/t/recurring-index-corruption/322144)
**Author:** [@Sebastiano](https://discuss.elastic.co/u/Sebastiano)\ **Replies:** 11\ **Last updated:** [December 29, 2022, 1:07pm UTC](https://discuss.elastic.co/t/recurring-index-corruption/322144 "2022-12-29T13:07:27Z")
Hi, we are experimenting setting up an ELK cluster using Azure Container Instances. We successfully setup the cluster and we started using it to push log entries, generated by our distributed system, using and Azure Ev… --- ## [Ruby Code Exception](https://discuss.elastic.co/t/ruby-code-exception/322155)
**Author:** [@Rohit\_Kumbhar](https://discuss.elastic.co/u/Rohit_Kumbhar)\ **Replies:** 1\ **Last updated:** [December 29, 2022, 12:26pm UTC](https://discuss.elastic.co/t/ruby-code-exception/322155 "2022-12-29T12:26:01Z")
Hi Team, I am getting Ruby exception occurred: undefined method \`length' for nil error while using the following Ruby Code ruby { code =\> ' names = event.get("\[message\]").split(".") event.set("number\_… --- ## [MYSQL Integration using elasticagent mysql performance metrics cause metricbeat crashes : Agent V8.5.0](https://discuss.elastic.co/t/mysql-integration-using-elasticagent-mysql-performance-metrics-cause-metricbeat-crashes-agent-v8-5-0/322081)
**Author:** [@Nabeel\_Ahmed\_NAK](https://discuss.elastic.co/u/Nabeel_Ahmed_NAK)\ **Replies:** 3\ **Last updated:** [December 29, 2022, 12:09pm UTC](https://discuss.elastic.co/t/mysql-integration-using-elasticagent-mysql-performance-metrics-cause-metricbeat-crashes-agent-v8-5-0/322081 "2022-12-29T12:09:12Z")
I'm using prebuild elastic integration to fetch mysql metrics and logs. I'm able to fetch mysql status metrics and agent running healthy. But when I enable MySQL performance metric it will become unhealthy and I got er… --- ## [Escape dot in mustache to access elastic query \_source field in alerts](https://discuss.elastic.co/t/escape-dot-in-mustache-to-access-elastic-query-source-field-in-alerts/321912)
**Author:** [@Nabeel\_Ahmed\_NAK](https://discuss.elastic.co/u/Nabeel_Ahmed_NAK)\ **Replies:** 7\ **Last updated:** [December 29, 2022, 9:03am UTC](https://discuss.elastic.co/t/escape-dot-in-mustache-to-access-elastic-query-source-field-in-alerts/321912 "2022-12-29T09:03:35Z")
Hi All I have enabled elastic defend and enabled rules to detect security events. Now I want to generate alerts from the Kibana rule and connector to slack. I have encountered that Elasticsearch mapping of kibana rule… --- ## [Filebeat in k8s pod cannot read log file : No such file or directory](https://discuss.elastic.co/t/filebeat-in-k8s-pod-cannot-read-log-file-no-such-file-or-directory/322074)
**Author:** [@cat-rat](https://discuss.elastic.co/u/cat-rat)\ **Replies:** 1\ **Last updated:** [December 29, 2022, 9:00am UTC](https://discuss.elastic.co/t/filebeat-in-k8s-pod-cannot-read-log-file-no-such-file-or-directory/322074 "2022-12-29T09:00:04Z")
\--- apiVersion: v1 kind: ConfigMap metadata: name: filebeat-config namespace: kube-system labels: k8s-app: filebeat data: filebeat.yml: |- filebeat.inputs: - type: container fields\_under\_root: t… --- ## [Query on Azure Module Authentication for Metricbeat](https://discuss.elastic.co/t/query-on-azure-module-authentication-for-metricbeat/322023)
**Author:** [@vin89](https://discuss.elastic.co/u/vin89)\ **Replies:** 1\ **Last updated:** [December 29, 2022, 8:36am UTC](https://discuss.elastic.co/t/query-on-azure-module-authentication-for-metricbeat/322023 "2022-12-29T08:36:02Z")
We are planning to use azure module for metricbeat for monitoring and alerting in our organization, so as per documentation we could see it uses client\_id and client\_secret for authentication. Do we have any other ways t… --- ## [Kibana on https with docker-compose](https://discuss.elastic.co/t/kibana-on-https-with-docker-compose/316069)
**Author:** [@mammodde](https://discuss.elastic.co/u/mammodde)\ **Replies:** 4\ **Last updated:** [November 3, 2022, 3:12pm UTC](https://discuss.elastic.co/t/kibana-on-https-with-docker-compose/316069 "2022-11-03T15:12:42Z")
Hi everyone, I'd like to put kibana web page on https instead of http. I did set everything came to my mind in order to do so, and this is my docker-compose.yml file. the problems I encountered are: elasticsearch is… --- ## [! i can't see kibana.yml when i use it using docker compose in ubuntu server does anyone have any idea why is this happening i want to make changes in kabana file in order use to alerting system](https://discuss.elastic.co/t/i-cant-see-kibana-yml-when-i-use-it-using-docker-compose-in-ubuntu-server-does-anyone-have-any-idea-why-is-this-happening-i-want-to-make-changes-in-kabana-file-in-order-use-to-alerting-system/318035)
**Author:** [@DIVYANSH\_SINGH](https://discuss.elastic.co/u/DIVYANSH_SINGH)\ **Replies:** 2\ **Last updated:** [November 3, 2022, 1:04pm UTC](https://discuss.elastic.co/t/i-cant-see-kibana-yml-when-i-use-it-using-docker-compose-in-ubuntu-server-does-anyone-have-any-idea-why-is-this-happening-i-want-to-make-changes-in-kabana-file-in-order-use-to-alerting-system/318035 "2022-11-03T13:04:34Z")
--- ## [Logstash pipeline worker stops processing events because of exception](https://discuss.elastic.co/t/logstash-pipeline-worker-stops-processing-events-because-of-exception/322126)
**Author:** [@tcapp24](https://discuss.elastic.co/u/tcapp24)\ **Replies:** 3\ **Last updated:** [December 29, 2022, 1:19am UTC](https://discuss.elastic.co/t/logstash-pipeline-worker-stops-processing-events-because-of-exception/322126 "2022-12-29T01:19:59Z")
Hello, Currently our beats-dead-letter-queue-processing-pipeline is causing a exception which makes events stop outputting to Elasticsearch: beats-dead-letter-queue-processing-pipeline\] Pipeline worker error, the pipe… --- ## [Kibana' Stack Monitoring is missing Logstash instance(s)](https://discuss.elastic.co/t/kibana-stack-monitoring-is-missing-logstash-instance-s/321046)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 4\ **Last updated:** [December 28, 2022, 3:41pm UTC](https://discuss.elastic.co/t/kibana-stack-monitoring-is-missing-logstash-instance-s/321046 "2022-12-28T15:41:11Z")
Hello World! I updated my Elastic stack from 7.17.7 release to 7.17.8, and now Kibana's monitoring app is missing the "Logstash" instance(s). I checked all the settings, and I didn't find any mistakes. I then double-ch… --- ## [Kibana alert rule behavior](https://discuss.elastic.co/t/kibana-alert-rule-behavior/319896)
**Author:** [@vangap](https://discuss.elastic.co/u/vangap)\ **Replies:** 1\ **Last updated:** [December 1, 2022, 12:46am UTC](https://discuss.elastic.co/t/kibana-alert-rule-behavior/319896 "2022-12-01T00:46:24Z")
Hi, I am exploring the Kibana alerts feature by creating rules and trying to index the actions in an index.. I have it working, though the behavior of it seems unexpected (atleast from where I am standing).. The rules… --- ## [Logstash Filter for Cisco ASA Source Destination and Communication](https://discuss.elastic.co/t/logstash-filter-for-cisco-asa-source-destination-and-communication/322063)
**Author:** [@Pratik\_Srivastava](https://discuss.elastic.co/u/Pratik_Srivastava)\ **Replies:** 5\ **Last updated:** [December 28, 2022, 9:41pm UTC](https://discuss.elastic.co/t/logstash-filter-for-cisco-asa-source-destination-and-communication/322063 "2022-12-28T21:41:31Z")
I want to configure logstash filter to see asa logs with communication detail. LOG Sample: Dec 27 02:48:08 Test-FW : %ASA-6-302014: Teardown TCP connection 3505833084 for Test-OUT:192.168.1.10/58538 to Mgmt-IN:192.168.1… --- ## [How to troubleshoot "undefined method \`+' for nil:NilClass"](https://discuss.elastic.co/t/how-to-troubleshoot-undefined-method-for-nil-nilclass/322121)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 3\ **Last updated:** [December 28, 2022, 8:54pm UTC](https://discuss.elastic.co/t/how-to-troubleshoot-undefined-method-for-nil-nilclass/322121 "2022-12-28T20:54:47Z")
Hi Maybe You have some idea how to troubleshoot in the long pipeline the bug referring to \[2022-12-28T19:47:41,016\]\[ERROR\]\[logstash.filters.ruby \]\[main\]\[1b91d552e5ff1ebff261eab8e51449b8aba605255321bb2b70376384a24931… --- ## [How to configure ILM hot phase, when cluster has only warm nodes](https://discuss.elastic.co/t/how-to-configure-ilm-hot-phase-when-cluster-has-only-warm-nodes/322118)
**Author:** [@hiruni.insyncit.net](https://discuss.elastic.co/u/hiruni.insyncit.net)\ **Replies:** 3\ **Last updated:** [December 28, 2022, 8:16pm UTC](https://discuss.elastic.co/t/how-to-configure-ilm-hot-phase-when-cluster-has-only-warm-nodes/322118 "2022-12-28T20:16:34Z")
Hi, Elasticsearch version: 8.1.2 It has 4 warm nodes(no hot nodes). I want to configure ILM policy in this cluster. So, how can configure hot-warm ILM policy in Elastic cluster which has only warm node. Thank you...… --- ## [Failures not displayed in kibana](https://discuss.elastic.co/t/failures-not-displayed-in-kibana/322120)
**Author:** [@ant2ne](https://discuss.elastic.co/u/ant2ne)\ **Replies:** 1\ **Last updated:** [December 28, 2022, 7:39pm UTC](https://discuss.elastic.co/t/failures-not-displayed-in-kibana/322120 "2022-12-28T19:39:01Z")
this is probably a user error. But I don't know how to google this one. cat tcp.yml |grep -v "#" |uniq id: ssh-status name: ssh-status check enabled: true hosts: \["192.168.1.139:22", "192.168.1.96:22", "8.8.8.8… --- ## [Filebeat inconsistent with date-based index name when input type is "container"](https://discuss.elastic.co/t/filebeat-inconsistent-with-date-based-index-name-when-input-type-is-container/322050)
**Author:** [@GaijinSystems](https://discuss.elastic.co/u/GaijinSystems)\ **Replies:** 3\ **Last updated:** [December 28, 2022, 7:12pm UTC](https://discuss.elastic.co/t/filebeat-inconsistent-with-date-based-index-name-when-input-type-is-container/322050 "2022-12-28T19:12:24Z")
Hello, all. I was wondering if anyone has ever stumbled across this and if there are any workarounds (I've been bashing my head against it for entirely too long now...). I have multiple servers using filebeat to ship l… --- ## [Cluster yellow b/c .security-7 index in unassigned state](https://discuss.elastic.co/t/cluster-yellow-b-c-security-7-index-in-unassigned-state/322112)
**Author:** [@Dimitry\_Feigin](https://discuss.elastic.co/u/Dimitry_Feigin)\ **Replies:** 2\ **Last updated:** [December 28, 2022, 7:06pm UTC](https://discuss.elastic.co/t/cluster-yellow-b-c-security-7-index-in-unassigned-state/322112 "2022-12-28T19:06:53Z")
We started the upgrade of the cluster that was in green state. The upgrade (through ansible) failed on node1 while it was not able to download rpm. We found the issue and fixed. Now the cluster after restart w/o any actu… --- ## [Alert based on field](https://discuss.elastic.co/t/alert-based-on-field/319582)
**Author:** [@breakingcode](https://discuss.elastic.co/u/breakingcode)\ **Replies:** 4\ **Last updated:** [November 30, 2022, 7:16pm UTC](https://discuss.elastic.co/t/alert-based-on-field/319582 "2022-11-30T19:16:59Z")
Hii, This is my scenario. I have one index named "employee" which have 3 fields name, salary and created\_at. I want to trigger an alert everytime someone index the document with salary below certain value. For example i… --- ## [API key: unable to find apikey with id](https://discuss.elastic.co/t/api-key-unable-to-find-apikey-with-id/322104)
**Author:** [@chaserb](https://discuss.elastic.co/u/chaserb)\ **Replies:** 2\ **Last updated:** [December 28, 2022, 5:20pm UTC](https://discuss.elastic.co/t/api-key-unable-to-find-apikey-with-id/322104 "2022-12-28T17:20:26Z")
I appear to be having the same issue that @inbox.ex was having here, in that I'm receiving 401 when interacting with the Elastcisearch endpoint. According to this doc, I've created an API key for my deployment, and now I… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=682) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=684)