# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=707 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 708 --- ## [What privileges does the metricbeat api key need?](https://discuss.elastic.co/t/what-privileges-does-the-metricbeat-api-key-need/320727)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 0\ **Last updated:** [December 8, 2022, 2:28am UTC](https://discuss.elastic.co/t/what-privileges-does-the-metricbeat-api-key-need/320727 "2022-12-08T02:28:55Z")
Setting up monitoring and following the instruction https://www.elastic.co/guide/en/beats/metricbeat/7.17/metricbeat-installation-configuration.html I world rather not use Elastic... --- ## [Nodes stats API CPU usage value is -1](https://discuss.elastic.co/t/nodes-stats-api-cpu-usage-value-is-1/319782)
**Author:** [@ysk8830](https://discuss.elastic.co/u/ysk8830)\ **Replies:** 1\ **Last updated:** [December 8, 2022, 1:13am UTC](https://discuss.elastic.co/t/nodes-stats-api-cpu-usage-value-is-1/319782 "2022-12-08T01:13:40Z")
Hello, I have a question. I have installed elasticsearch on azure. OS is Ubuntu. And look up the cpu usage. I ran '\_cat/nodes?format=json' , and the cpu value is -1. can not understand. I browsed the documentation (G… --- ## [Deletion of existing index data when threshold reached](https://discuss.elastic.co/t/deletion-of-existing-index-data-when-threshold-reached/320598)
**Author:** [@atpr](https://discuss.elastic.co/u/atpr)\ **Replies:** 5\ **Last updated:** [December 7, 2022, 10:48pm UTC](https://discuss.elastic.co/t/deletion-of-existing-index-data-when-threshold-reached/320598 "2022-12-07T22:48:05Z")
Hi Expert, We are looking to support the customer use case where they are buying the license as per the GB of data they use or no of records they store or no of days data stored. As per license they can either buy more… --- ## [Convert text field to date](https://discuss.elastic.co/t/convert-text-field-to-date/320721)
**Author:** [@stefanocog](https://discuss.elastic.co/u/stefanocog)\ **Replies:** 2\ **Last updated:** [December 7, 2022, 10:36pm UTC](https://discuss.elastic.co/t/convert-text-field-to-date/320721 "2022-12-07T22:36:21Z")
Hello, I need convert a field in text format into date, i need to have another date field besides @timestamp, the @timestamp field identifies the arrival time of the log, instead the dataRisposta field (in case of respo… --- ## [Reproduce App search "Top queries with no clicks" in Kibana](https://discuss.elastic.co/t/reproduce-app-search-top-queries-with-no-clicks-in-kibana/318595)
**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\ **Replies:** 0\ **Last updated:** [November 9, 2022, 11:26pm UTC](https://discuss.elastic.co/t/reproduce-app-search-top-queries-with-no-clicks-in-kibana/318595 "2022-11-09T23:26:32Z")
Hello, I'm trying to reproduce the App Search analytics dashboard in Kibana to have more flexibility. I could reproduce everything but the "Top queries with no clicks" dashboard because combines two document types a… --- ## [How to integrate kibana dashboards as a widget to other javascript based native UI](https://discuss.elastic.co/t/how-to-integrate-kibana-dashboards-as-a-widget-to-other-javascript-based-native-ui/320265)
**Author:** [@Tukaram](https://discuss.elastic.co/u/Tukaram)\ **Replies:** 6\ **Last updated:** [December 7, 2022, 10:03pm UTC](https://discuss.elastic.co/t/how-to-integrate-kibana-dashboards-as-a-widget-to-other-javascript-based-native-ui/320265 "2022-12-07T22:03:39Z")
Is there any easy way to integrate Kibana dashboard / panel as a widget to third party UI(developed using the react js etc ). We dont want user to navigate to kibana from our native apps and instead show the dashboards … --- ## [Filebeat running as a container not displaying logs in Kibana](https://discuss.elastic.co/t/filebeat-running-as-a-container-not-displaying-logs-in-kibana/320626)
**Author:** [@Anagha\_nambiar](https://discuss.elastic.co/u/Anagha_nambiar)\ **Replies:** 11\ **Last updated:** [December 7, 2022, 9:55pm UTC](https://discuss.elastic.co/t/filebeat-running-as-a-container-not-displaying-logs-in-kibana/320626 "2022-12-07T21:55:39Z")
We are running filebeat:8.1.3 as a docker container using docker-compose file in Linux RHEL machine. We have provided the input type as filestream and provided the path for log files , but still it is not injecting any … --- ## [Elasticsearch docker container 8.5.2 startup ERROR: Elasticsearch did not exit normally](https://discuss.elastic.co/t/elasticsearch-docker-container-8-5-2-startup-error-elasticsearch-did-not-exit-normally/320634)
**Author:** [@khteh](https://discuss.elastic.co/u/khteh)\ **Replies:** 4\ **Last updated:** [December 7, 2022, 9:30pm UTC](https://discuss.elastic.co/t/elasticsearch-docker-container-8-5-2-startup-error-elasticsearch-did-not-exit-normally/320634 "2022-12-07T21:30:13Z")
Elasticsearch docker container 8.5.2 startup with this error: ERROR: Elasticsearch did not exit normally - check the logs at /usr/share/elasticsearch/logs/elasticsearch.log 2022-12-07 02:08:06,247 process reaper (pid 11… --- ## [Re-installing elasticsearch](https://discuss.elastic.co/t/re-installing-elasticsearch/320602)
**Author:** [@ericmalta](https://discuss.elastic.co/u/ericmalta)\ **Replies:** 4\ **Last updated:** [December 7, 2022, 9:20pm UTC](https://discuss.elastic.co/t/re-installing-elasticsearch/320602 "2022-12-07T21:20:32Z")
Hello team I have a quick question. If I re-install my elasticsearch cluster via apt like this: sudo apt install --reinstall -o Dpkg::Options::="--force-confask,confnew,confmiss" elasticsearch Will I lose my cluster da… --- ## [USB Detection Using Elastic-agent or some other beat](https://discuss.elastic.co/t/usb-detection-using-elastic-agent-or-some-other-beat/320710)
**Author:** [@Mohsin\_Ashraf](https://discuss.elastic.co/u/Mohsin_Ashraf)\ **Replies:** 0\ **Last updated:** [December 7, 2022, 6:25pm UTC](https://discuss.elastic.co/t/usb-detection-using-elastic-agent-or-some-other-beat/320710 "2022-12-07T18:25:57Z")
Hi, Can we detect USB when it plugs into the system on windows or Linux using elastic-agent or some other beats? --- ## [Cannot give custom plugin permission org.elasticsearch.secure\_sm.ThreadPermission "modifyArbitraryThreadGroup"](https://discuss.elastic.co/t/cannot-give-custom-plugin-permission-org-elasticsearch-secure-sm-threadpermission-modifyarbitrarythreadgroup/320720)
**Author:** [@smillies](https://discuss.elastic.co/u/smillies)\ **Replies:** 0\ **Last updated:** [December 7, 2022, 8:40pm UTC](https://discuss.elastic.co/t/cannot-give-custom-plugin-permission-org-elasticsearch-secure-sm-threadpermission-modifyarbitrarythreadgroup/320720 "2022-12-07T20:40:26Z")
I have written a custom plugin that includes some third-party jars that do magic stuff requiring certain permissions. So I have added them to my plugin-security.policy like this grant { permission java.lang.reflect.Re… --- ## [Creating alerts with aggregation and query filter](https://discuss.elastic.co/t/creating-alerts-with-aggregation-and-query-filter/319842)
**Author:** [@solange.sonaglio](https://discuss.elastic.co/u/solange.sonaglio)\ **Replies:** 2\ **Last updated:** [December 7, 2022, 8:03pm UTC](https://discuss.elastic.co/t/creating-alerts-with-aggregation-and-query-filter/319842 "2022-12-07T20:03:13Z")
With the current data that we have in APM, we felt the need to create an alert based on an aggregated value, as the "Index threshold" type allows, however, we needed to include some filters in the data, as the "Elasticse… --- ## [SearchResponse as JSON](https://discuss.elastic.co/t/searchresponse-as-json/320475)
**Author:** [@divadpoc](https://discuss.elastic.co/u/divadpoc)\ **Replies:** 19\ **Last updated:** [December 7, 2022, 7:29pm UTC](https://discuss.elastic.co/t/searchresponse-as-json/320475 "2022-12-07T19:29:07Z")
Hi, I'm using version 8.5.1 w/ the Java client. I'm looking for a way to get the SearchResponse as JSON, or at least the same output I'd get when executing the query in Kibana. Thanks for any hints. --- ## [Kibana runtime fields in elastic 8.4.0](https://discuss.elastic.co/t/kibana-runtime-fields-in-elastic-8-4-0/320704)
**Author:** [@Ajmal\_Khalil](https://discuss.elastic.co/u/Ajmal_Khalil)\ **Replies:** 1\ **Last updated:** [December 7, 2022, 5:32pm UTC](https://discuss.elastic.co/t/kibana-runtime-fields-in-elastic-8-4-0/320704 "2022-12-07T17:32:21Z")
Hi, I'm trying to create a runtime field but getting errors with my syntax also after creating the field not getting that under discover in fields. I hope you can help me in this. Actuall i have logs like this "No tr… --- ## [Ingest Pipeline for custom logs](https://discuss.elastic.co/t/ingest-pipeline-for-custom-logs/320380)
**Author:** [@shuuny-matrix](https://discuss.elastic.co/u/shuuny-matrix)\ **Replies:** 6\ **Last updated:** [December 7, 2022, 5:42pm UTC](https://discuss.elastic.co/t/ingest-pipeline-for-custom-logs/320380 "2022-12-07T17:42:37Z")
Hi, I am ingesting the standards syslogs using the elastic agent "custom logs" integration. I am trying to parse the logs before indexing and for that I am using ingest pipeline. I have two processors for that: Grok an… --- ## [Count the latest records in Kibana visualization?](https://discuss.elastic.co/t/count-the-latest-records-in-kibana-visualization/320669)
**Author:** [@Maruthappan\_Muthu](https://discuss.elastic.co/u/Maruthappan_Muthu)\ **Replies:** 6\ **Last updated:** [December 7, 2022, 6:28pm UTC](https://discuss.elastic.co/t/count-the-latest-records-in-kibana-visualization/320669 "2022-12-07T18:28:04Z")
I have document like as below Every two minutes once the "status" field records will get change and I want to count only the recent status records in Kibana visualization. Ex., The total count of status value 1 is 3 & … --- ## [Missed Events](https://discuss.elastic.co/t/missed-events/320702)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 0\ **Last updated:** [December 7, 2022, 4:25pm UTC](https://discuss.elastic.co/t/missed-events/320702 "2022-12-07T16:25:52Z")
I have a situation where we are receiving Windows Event ID 3000 sometimes but not other times. This is very problematic, as the event is used to troubleshoot process exits. The endpoint uses Windows Event Forwarding (WEF… --- ## [Rule not trigger](https://discuss.elastic.co/t/rule-not-trigger/318585)
**Author:** [@zvazquez](https://discuss.elastic.co/u/zvazquez)\ **Replies:** 0\ **Last updated:** [November 9, 2022, 7:12pm UTC](https://discuss.elastic.co/t/rule-not-trigger/318585 "2022-11-09T19:12:21Z")
Hi, We have an index which stores data around every 10 minutes. We have added this index to the metric indexes to create alerts/rules. We are trying to create alerts from properties with float data type. For some reaso… --- ## [What stops Alerting from working?](https://discuss.elastic.co/t/what-stops-alerting-from-working/320705)
**Author:** [@TXBigDawg1836](https://discuss.elastic.co/u/TXBigDawg1836)\ **Replies:** 2\ **Last updated:** [December 7, 2022, 4:56pm UTC](https://discuss.elastic.co/t/what-stops-alerting-from-working/320705 "2022-12-07T16:56:56Z")
Attempting to put together a flowchart of our ELK workflow for troubleshooting. At what point does Alerting possibly break or stop working? Will alerts stop if the Kibana GUI or service is down? Or, does the Elasticse… --- ## [Multi-host docker-compose setup woes](https://discuss.elastic.co/t/multi-host-docker-compose-setup-woes/320692)
**Author:** [@bobus](https://discuss.elastic.co/u/bobus)\ **Replies:** 3\ **Last updated:** [December 7, 2022, 4:56pm UTC](https://discuss.elastic.co/t/multi-host-docker-compose-setup-woes/320692 "2022-12-07T16:56:35Z")
On three hosts A, B, and C, where a v5 cluster is already running, I need to setup a new v7 cluster, so that at some point I can migrate to v7 and drop the v5. This means I have to map ports 9200 & 9300 to different po… --- ## [New Logstash Grok add\_field](https://discuss.elastic.co/t/new-logstash-grok-add-field/320659)
**Author:** [@anon74213320](https://discuss.elastic.co/u/anon74213320)\ **Replies:** 2\ **Last updated:** [December 7, 2022, 3:14pm UTC](https://discuss.elastic.co/t/new-logstash-grok-add-field/320659 "2022-12-07T15:14:14Z")
Hi everyone I am trying to add a new field for pick up a hostname from a logfile like this format: Source : \\\\abc123 I tried with setting patterns file and add\_filed in grok and mutate but it is not added, it seems is… --- ## [Elasticsearch](https://discuss.elastic.co/t/elasticsearch/320691)
**Author:** [@manikanta](https://discuss.elastic.co/u/manikanta)\ **Replies:** 1\ **Last updated:** [December 7, 2022, 2:36pm UTC](https://discuss.elastic.co/t/elasticsearch/320691 "2022-12-07T14:36:40Z")
Can you write if - else type based queries in Elasticsearch? --- ## [Logstash: Optional fields in grok](https://discuss.elastic.co/t/logstash-optional-fields-in-grok/320604)
**Author:** [@anon99430464](https://discuss.elastic.co/u/anon99430464)\ **Replies:** 2\ **Last updated:** [December 7, 2022, 2:35pm UTC](https://discuss.elastic.co/t/logstash-optional-fields-in-grok/320604 "2022-12-07T14:35:34Z")
Hi there I'm trying to create a logstash for our logs. Our log files can look like the following 2022-11-22 10:43:59,061 INFO \[SERVER1.Subscription\] |\>\> | \[ctx:0ecaa086-f9b7-4d0e-bce4-1b8513238745\] \[req:facdaf2c-b8e6… --- ## [How to enable sql in elastic 7.3](https://discuss.elastic.co/t/how-to-enable-sql-in-elastic-7-3/320447)
**Author:** [@Bhanuji\_paluri](https://discuss.elastic.co/u/Bhanuji_paluri)\ **Replies:** 3\ **Last updated:** [December 7, 2022, 1:48pm UTC](https://discuss.elastic.co/t/how-to-enable-sql-in-elastic-7-3/320447 "2022-12-07T13:48:04Z")
can you please let me know how to run the sql queries in devtool? how to enable the sql , how to test it? --- ## [Docker filebeat installation error](https://discuss.elastic.co/t/docker-filebeat-installation-error/320686)
**Author:** [@AnkurYogi](https://discuss.elastic.co/u/AnkurYogi)\ **Replies:** 0\ **Last updated:** [December 7, 2022, 1:27pm UTC](https://discuss.elastic.co/t/docker-filebeat-installation-error/320686 "2022-12-07T13:27:59Z")
\ **Author:** [@yarons](https://discuss.elastic.co/u/yarons)\ **Replies:** 1\ **Last updated:** [December 7, 2022, 1:25pm UTC](https://discuss.elastic.co/t/ilm-policy-interval-is-later-than-configured/320682 "2022-12-07T13:25:34Z") Hi, I have created the following ILM Policy for testing: { "test-1-m": { "version": 6, "modified\_date": "2022-12-07T11:27:55.648Z", "policy": { "phases": { "hot": { "min\_age": "0ms"… --- ## [Insert Events with Changed Status Only using Logstash](https://discuss.elastic.co/t/insert-events-with-changed-status-only-using-logstash/319196)
**Author:** [@sajid](https://discuss.elastic.co/u/sajid)\ **Replies:** 2\ **Last updated:** [December 7, 2022, 1:17pm UTC](https://discuss.elastic.co/t/insert-events-with-changed-status-only-using-logstash/319196 "2022-12-07T13:17:56Z")
Hi All, Need your help to solve an issue. Below are the details: Pipeline1 : Polls multiple http endpoints every minute using http\_poller and insert the response to index1 in ES. Below is the sample response of one of… --- ## [Java elasticsearch-java-8.5.1 error on deserialisation of Instant Field](https://discuss.elastic.co/t/java-elasticsearch-java-8-5-1-error-on-deserialisation-of-instant-field/320681)
**Author:** [@Philip\_Bannon](https://discuss.elastic.co/u/Philip_Bannon)\ **Replies:** 1\ **Last updated:** [December 7, 2022, 12:36pm UTC](https://discuss.elastic.co/t/java-elasticsearch-java-8-5-1-error-on-deserialisation-of-instant-field/320681 "2022-12-07T12:36:17Z")
Hi, I have a Spring Boot app (Version 2.7.6) and I'm using the java API client elasticsearch-java-8.5.1. I'm doing a basic query but my object in ES contains an INSTANT value (see POJO below). When I perform the query I… --- ## [Open a non-http link](https://discuss.elastic.co/t/open-a-non-http-link/320674)
**Author:** [@GinkoLucas](https://discuss.elastic.co/u/GinkoLucas)\ **Replies:** 1\ **Last updated:** [December 7, 2022, 11:39am UTC](https://discuss.elastic.co/t/open-a-non-http-link/320674 "2022-12-07T11:39:59Z")
Hello, In my data i have some ip adress. I would like to open a teamviewer connection with this IP adress. So, for this, i have modified the data view. I change the field's type in "Link", and i put this in the URL tem… --- ## [/usr/share/elasticsearch/bin/elasticsearch](https://discuss.elastic.co/t/usr-share-elasticsearch-bin-elasticsearch/320640)
**Author:** [@Alejandro\_Abeijon](https://discuss.elastic.co/u/Alejandro_Abeijon)\ **Replies:** 2\ **Last updated:** [December 7, 2022, 11:27am UTC](https://discuss.elastic.co/t/usr-share-elasticsearch-bin-elasticsearch/320640 "2022-12-07T11:27:58Z")
Hi, thanks in advance for the help. I installed Elasticsearch in a thousand ways and I always get the same error. Can someone guide me where to start exploring? Thank you very much! elasticsearch@test:~$ /usr/share/el… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=706) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=708)