# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=723 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 724 --- ## [Filebeat.yml and logstash.conf are not getting loaded automatically](https://discuss.elastic.co/t/filebeat-yml-and-logstash-conf-are-not-getting-loaded-automatically/319573)
**Author:** [@Manjiri](https://discuss.elastic.co/u/Manjiri)\ **Replies:** 1\ **Last updated:** [November 22, 2022, 6:53pm UTC](https://discuss.elastic.co/t/filebeat-yml-and-logstash-conf-are-not-getting-loaded-automatically/319573 "2022-11-22T18:53:18Z")
When we starting the filebeat and logstash services through services.msc , filebeat.yml and logstash.conf is not getting loaded automatically. Everytime we need to load 2 files manually through command prompt using below… --- ## [Defender for Endpoint to Azure Event Hub to Elasticsearch?](https://discuss.elastic.co/t/defender-for-endpoint-to-azure-event-hub-to-elasticsearch/319578)
**Author:** [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Replies:** 0\ **Last updated:** [November 22, 2022, 5:53pm UTC](https://discuss.elastic.co/t/defender-for-endpoint-to-azure-event-hub-to-elasticsearch/319578 "2022-11-22T17:53:31Z")
Our Defender for Endpoint Device tables are around 1TB a day, I'll never get the money to use Sentinel so I'm looking for an alternative. Is there no way to use Azure Event Hubs with Elasticsearch? Stream the events fr… --- ## [I want to have a button kind of visualization in the KIBANA dashboard, Can anyone please provide any information on this?](https://discuss.elastic.co/t/i-want-to-have-a-button-kind-of-visualization-in-the-kibana-dashboard-can-anyone-please-provide-any-information-on-this/316733)
**Author:** [@abhinay\_nalla](https://discuss.elastic.co/u/abhinay_nalla)\ **Replies:** 6\ **Last updated:** [October 26, 2022, 6:56am UTC](https://discuss.elastic.co/t/i-want-to-have-a-button-kind-of-visualization-in-the-kibana-dashboard-can-anyone-please-provide-any-information-on-this/316733 "2022-10-26T06:56:13Z")
I want to create one button which shows this kind of information in it. If anyone has this kind of solution or information please do help me. Thank you Regards Abhi --- ## [Output isolator pattern, not working as expected when one pipeline is down](https://discuss.elastic.co/t/output-isolator-pattern-not-working-as-expected-when-one-pipeline-is-down/319329)
**Author:** [@rravitech](https://discuss.elastic.co/u/rravitech)\ **Replies:** 9\ **Last updated:** [November 22, 2022, 5:28pm UTC](https://discuss.elastic.co/t/output-isolator-pattern-not-working-as-expected-when-one-pipeline-is-down/319329 "2022-11-22T17:28:16Z")
All the outputs stop when one goes down here, i am trying to implement the output isolator pattern. In the below configuration when hosts =\> \["ext-se:9200"\] goes down the other host "es-host1" { hosts =\> \["eric-data-se… --- ## [Discover gives error from Kibana](https://discuss.elastic.co/t/discover-gives-error-from-kibana/319371)
**Author:** [@mpniel](https://discuss.elastic.co/u/mpniel)\ **Replies:** 4\ **Last updated:** [November 22, 2022, 5:25pm UTC](https://discuss.elastic.co/t/discover-gives-error-from-kibana/319371 "2022-11-22T17:25:36Z")
Hi, Click on discover icon from kibana gives the following error: Error: Request to Elasticsearch failed: ("error": {"root\_cause": \[{"reason': 'forbidden' due to \["OPERATION NOT ALLOWED"\]}\], "reason": "forbidden", "du… --- ## [Can I edit the query or inspector of a metricbeat lens?](https://discuss.elastic.co/t/can-i-edit-the-query-or-inspector-of-a-metricbeat-lens/319567)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 1\ **Last updated:** [November 22, 2022, 5:00pm UTC](https://discuss.elastic.co/t/can-i-edit-the-query-or-inspector-of-a-metricbeat-lens/319567 "2022-11-22T17:00:03Z")
I am learning to use MetricBeat and dashboards. I'm really enjoying it so far but I want to be able to edit one of the lens. This image below shows two lens that I really like, but I want to modify: So what I did w… --- ## [mTLS only setup for Elasticsearch](https://discuss.elastic.co/t/mtls-only-setup-for-elasticsearch/319576)
**Author:** [@Rohit\_Shrivastava](https://discuss.elastic.co/u/Rohit_Shrivastava)\ **Replies:** 0\ **Last updated:** [November 22, 2022, 4:59pm UTC](https://discuss.elastic.co/t/mtls-only-setup-for-elasticsearch/319576 "2022-11-22T16:59:20Z")
Is it possible to only use mTLS i.e. only authentication via PKI realm. I almost have the cluster working (using open source helm charts and 7.1.7 images). One issue I have is the pod readiness doesn't succeed as the \_c… --- ## [Drill down to different Dashboards in Maps for Elasticsearch 8.3.3](https://discuss.elastic.co/t/drill-down-to-different-dashboards-in-maps-for-elasticsearch-8-3-3/319450)
**Author:** [@Abj\_Ins](https://discuss.elastic.co/u/Abj_Ins)\ **Replies:** 3\ **Last updated:** [November 22, 2022, 3:39pm UTC](https://discuss.elastic.co/t/drill-down-to-different-dashboards-in-maps-for-elasticsearch-8-3-3/319450 "2022-11-22T15:39:50Z")
Hi Everyone, It would be really helpful if anyone can provide some solution. so, we are aware of drilldown options in Maps in Kibana and was trying to use it in our requirement where using filter option from the "… --- ## [Unable to output container password details when using ansible with podman](https://discuss.elastic.co/t/unable-to-output-container-password-details-when-using-ansible-with-podman/319563)
**Author:** [@millerthegorilla](https://discuss.elastic.co/u/millerthegorilla)\ **Replies:** 0\ **Last updated:** [November 22, 2022, 3:21pm UTC](https://discuss.elastic.co/t/unable-to-output-container-password-details-when-using-ansible-with-podman/319563 "2022-11-22T15:21:28Z")
Hi, when using ansible-podman, I am unable to output the std-out of the container run command as I might do when using the command line. This means that I don't get to see the automatically generated password and keysto… --- ## [Dropdown filter kibana canvas](https://discuss.elastic.co/t/dropdown-filter-kibana-canvas/319315)
**Author:** [@Gianluca\_De\_Pasquale](https://discuss.elastic.co/u/Gianluca_De_Pasquale)\ **Replies:** 5\ **Last updated:** [November 22, 2022, 2:36pm UTC](https://discuss.elastic.co/t/dropdown-filter-kibana-canvas/319315 "2022-11-22T14:36:08Z")
Hi all, following the topic Dropdown filter kibana canvas - Elastic Stack / Kibana - Discuss the Elastic Stack I tried to filter data on a table by using dropdown list element, but I did not succeed. I attach the code u… --- ## [Weekly Index Delete Automatically from Elasticsearch Cluster](https://discuss.elastic.co/t/weekly-index-delete-automatically-from-elasticsearch-cluster/319552)
**Author:** [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\ **Replies:** 5\ **Last updated:** [November 22, 2022, 2:36pm UTC](https://discuss.elastic.co/t/weekly-index-delete-automatically-from-elasticsearch-cluster/319552 "2022-11-22T14:36:02Z")
Hello Guys I am using Elasticsearch 7.10.2 I have 6 Data node Cluster in this Cluster I am Facing Space Issue so I set Index Policy for Daily Index but I am having Monthly and Weekly Index I want setup Automatically De… --- ## [Logstash connection with Oracle wallet](https://discuss.elastic.co/t/logstash-connection-with-oracle-wallet/319300)
**Author:** [@Num](https://discuss.elastic.co/u/Num)\ **Replies:** 3\ **Last updated:** [November 22, 2022, 2:31pm UTC](https://discuss.elastic.co/t/logstash-connection-with-oracle-wallet/319300 "2022-11-22T14:31:17Z")
Hello, I'm having issues connecting Logstash using Oracle wallet. I am getting an invalid login/password even though I am trying to connect through the wallet, without using said login/password. \[ERROR\]\[logstash.input… --- ## [Elasticsearch PHP Client implementation for a webshop](https://discuss.elastic.co/t/elasticsearch-php-client-implementation-for-a-webshop/319557)
**Author:** [@Thymen](https://discuss.elastic.co/u/Thymen)\ **Replies:** 0\ **Last updated:** [November 22, 2022, 2:26pm UTC](https://discuss.elastic.co/t/elasticsearch-php-client-implementation-for-a-webshop/319557 "2022-11-22T14:26:03Z")
Hello there, I am using the Elasticsearch PHP client (8.3), as can be found on: github I've used several types of queries to find and filter through results on several indices to find relevant/popular. Some more comple… --- ## [Elasticsearch-certutil parameters](https://discuss.elastic.co/t/elasticsearch-certutil-parameters/319529)
**Author:** [@adrien\_moreau](https://discuss.elastic.co/u/adrien_moreau)\ **Replies:** 1\ **Last updated:** [November 22, 2022, 1:47pm UTC](https://discuss.elastic.co/t/elasticsearch-certutil-parameters/319529 "2022-11-22T13:47:45Z")
Hello, I am using Elasticsearch on a self managed cluster and I had to use the "elasticsearch-certutil" tool to manage my cluster certificates. The help menu from the tool only lists the following options Simplifies c… --- ## [Not breaking down Embeded json field and instead keep it in a single field](https://discuss.elastic.co/t/not-breaking-down-embeded-json-field-and-instead-keep-it-in-a-single-field/319505)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 2\ **Last updated:** [November 22, 2022, 1:42pm UTC](https://discuss.elastic.co/t/not-breaking-down-embeded-json-field-and-instead-keep-it-in-a-single-field/319505 "2022-11-22T13:42:34Z")
Hi All, I use json filter plugin to parse log entries in json format such as the below {"actor\_ip":"xxx","from":"Api::ActionsRunnerRegistration#POST","actor":"xxx","actor\_id":2480,"org":"xxx","org\_id":13,"action":"org.… --- ## [Dumping requests](https://discuss.elastic.co/t/dumping-requests/319462)
**Author:** [@Georgi\_Danov](https://discuss.elastic.co/u/Georgi_Danov)\ **Replies:** 4\ **Last updated:** [November 22, 2022, 1:39pm UTC](https://discuss.elastic.co/t/dumping-requests/319462 "2022-11-22T13:39:03Z")
I'm reverse engineering and optimizing ES instance. One of the things that would help me enormously is to understand what operations (updates and queries) are coming in. What's the best way do dump & analyze the operat… --- ## [The content length (938946807) is bigger than the maximum allowed string (536870888) sending logstash-plain.log to elasticsearch](https://discuss.elastic.co/t/the-content-length-938946807-is-bigger-than-the-maximum-allowed-string-536870888-sending-logstash-plain-log-to-elasticsearch/319533)
**Author:** [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\ **Replies:** 8\ **Last updated:** [November 22, 2022, 1:00pm UTC](https://discuss.elastic.co/t/the-content-length-938946807-is-bigger-than-the-maximum-allowed-string-536870888-sending-logstash-plain-log-to-elasticsearch/319533 "2022-11-22T13:00:00Z")
Hi I have setup filebeat to send logstash logs to logstah then elasticsearch. Getting this error when trying to access it on discover page Search Error The content length (938946807) is bigger than the maximum allowed s… --- ## [How to join/combine data from 2 indices using a common/join field in Elastic?](https://discuss.elastic.co/t/how-to-join-combine-data-from-2-indices-using-a-common-join-field-in-elastic/317195)
**Author:** [@AshwiniPrabhu](https://discuss.elastic.co/u/AshwiniPrabhu)\ **Replies:** 6\ **Last updated:** [October 26, 2022, 6:10am UTC](https://discuss.elastic.co/t/how-to-join-combine-data-from-2-indices-using-a-common-join-field-in-elastic/317195 "2022-10-26T06:10:10Z")
Hi, Thank you for your time for reading the question. I have 2 indices: Index 1 (Activation) - Order Id, Activation Date Index 2 (Identity) - Order Id, Identity Date. The join field/common field is Order id. I have t… --- ## [How to include the timestamp filter value in the dropdown filter?](https://discuss.elastic.co/t/how-to-include-the-timestamp-filter-value-in-the-dropdown-filter/317380)
**Author:** [@drizzt\_yin](https://discuss.elastic.co/u/drizzt_yin)\ **Replies:** 2\ **Last updated:** [November 22, 2022, 12:10pm UTC](https://discuss.elastic.co/t/how-to-include-the-timestamp-filter-value-in-the-dropdown-filter/317380 "2022-11-22T12:10:36Z")
Hi, In the drop-down filter, I want to reference the ts field value from the timestamp filter. How to do this? Thanks, Eason --- ## [Index lost the alias rollover](https://discuss.elastic.co/t/index-lost-the-alias-rollover/319396)
**Author:** [@artax\_sb](https://discuss.elastic.co/u/artax_sb)\ **Replies:** 5\ **Last updated:** [November 22, 2022, 11:56am UTC](https://discuss.elastic.co/t/index-lost-the-alias-rollover/319396 "2022-11-22T11:56:50Z")
Hi, when the index make de rollover and delete step, index-000001 is deleted, but then fluentd creates a new index-000001 (instead write in index-000002) and de alias is deleted so appears the error illegal\_argument\_ex… --- ## [Alias error , with rollover next step index-0002](https://discuss.elastic.co/t/alias-error-with-rollover-next-step-index-0002/319192)
**Author:** [@artax\_sb](https://discuss.elastic.co/u/artax_sb)\ **Replies:** 3\ **Last updated:** [November 22, 2022, 11:55am UTC](https://discuss.elastic.co/t/alias-error-with-rollover-next-step-index-0002/319192 "2022-11-22T11:55:02Z")
Hi, I have a lifecycle policy with template/alias/index with 5gb and 3 days indextest-00001 good works when the rollover step, close de indextest-00001 and creates a new indextest-00002 but the new index dont write an… --- ## [Encountered a retryable error. Will Retry with exponential backoff](https://discuss.elastic.co/t/encountered-a-retryable-error-will-retry-with-exponential-backoff/319547)
**Author:** [@pubudu.a](https://discuss.elastic.co/u/pubudu.a)\ **Replies:** 1\ **Last updated:** [November 22, 2022, 11:53am UTC](https://discuss.elastic.co/t/encountered-a-retryable-error-will-retry-with-exponential-backoff/319547 "2022-11-22T11:53:20Z")
Hi All, I encountered the following error in the logstash server after updating Opensearh 1.3 to OpenSearch 2.3 in the AWS Kibana dashboard. The current configuration worked fine with 1.3 but after updating it to 2.3 it… --- ## [Match queries and ASCII folding](https://discuss.elastic.co/t/match-queries-and-ascii-folding/319544)
**Author:** [@babolivier](https://discuss.elastic.co/u/babolivier)\ **Replies:** 1\ **Last updated:** [November 22, 2022, 11:44am UTC](https://discuss.elastic.co/t/match-queries-and-ascii-folding/319544 "2022-11-22T11:44:25Z")
Hi all, I have an index that was created with the following configuration: { "settings": { "analysis": { "analyzer": { "std\_asciifolding": { "tokenizer": "standard", "filter": \[ … --- ## [Set ip on http monitors like curl resolve command](https://discuss.elastic.co/t/set-ip-on-http-monitors-like-curl-resolve-command/319346)
**Author:** [@oofbird](https://discuss.elastic.co/u/oofbird)\ **Replies:** 3\ **Last updated:** [November 22, 2022, 11:05am UTC](https://discuss.elastic.co/t/set-ip-on-http-monitors-like-curl-resolve-command/319346 "2022-11-22T11:05:32Z")
I want to monitor https service. (domain - VIP - webserver) testing domain(VIP) is clear. just call "https://domain". but testing webserver has a problem, guessing from SNI(Server Name Indication). Calling "https://we… --- ## [Server Kibana I want to stopped](https://discuss.elastic.co/t/server-kibana-i-want-to-stopped/319420)
**Author:** [@m3bgwad](https://discuss.elastic.co/u/m3bgwad)\ **Replies:** 2\ **Last updated:** [November 22, 2022, 10:29am UTC](https://discuss.elastic.co/t/server-kibana-i-want-to-stopped/319420 "2022-11-22T10:29:43Z")
Hello, I have two servers the first in it Kibana, GrafanaI and the second server in it Elasticsearch and Logstash pipeline is running, I want to reboot the server that in it kibana and Grafana, what is happens to the … --- ## [Issue generating token after adding PV](https://discuss.elastic.co/t/issue-generating-token-after-adding-pv/319537)
**Author:** [@lkurczy](https://discuss.elastic.co/u/lkurczy)\ **Replies:** 0\ **Last updated:** [November 22, 2022, 10:18am UTC](https://discuss.elastic.co/t/issue-generating-token-after-adding-pv/319537 "2022-11-22T10:18:05Z")
Hello, Im trying to configure a new instance of elasticsearch and kibana in docker. When i run it with the following commands, everything runs smoothly and im able to run kibana with security enabled: docker run --nam… --- ## [Postgres integration Fleet](https://discuss.elastic.co/t/postgres-integration-fleet/317649)
**Author:** [@Gaston\_Beltramelli](https://discuss.elastic.co/u/Gaston_Beltramelli)\ **Replies:** 1\ **Last updated:** [November 22, 2022, 10:12am UTC](https://discuss.elastic.co/t/postgres-integration-fleet/317649 "2022-11-22T10:12:33Z")
Hello! I'm trying to install the Postgres integration to get metrics via Fleet, but when I get to the configuration I don't have the option to add the database from the UI, no matter how I add the database in the conne… --- ## [System integration VS Windows Integration](https://discuss.elastic.co/t/system-integration-vs-windows-integration/317701)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 1\ **Last updated:** [November 22, 2022, 10:02am UTC](https://discuss.elastic.co/t/system-integration-vs-windows-integration/317701 "2022-11-22T10:02:26Z")
Hello, if I add both integrations (system and windows) in Fleet, for the same policy, will there be duplication of logs? Here;s what System collects: Here's what Windows integration collects: Is Sysmon included … --- ## [Query configuration in annotation in TSVB visual](https://discuss.elastic.co/t/query-configuration-in-annotation-in-tsvb-visual/319511)
**Author:** [@Seemant\_Bind](https://discuss.elastic.co/u/Seemant_Bind)\ **Replies:** 1\ **Last updated:** [November 22, 2022, 9:22am UTC](https://discuss.elastic.co/t/query-configuration-in-annotation-in-tsvb-visual/319511 "2022-11-22T09:22:56Z")
Hi, I wanted to create a visual in TSVB to display Bell icon when total count of category exceeds particular threshold. I have tried category.keyword.count\>10 (referring to this creating a trend graph based on tsvb + a… --- ## [Is it possible to add condition in elasticsearch logstash jdbc input plugin](https://discuss.elastic.co/t/is-it-possible-to-add-condition-in-elasticsearch-logstash-jdbc-input-plugin/319195)
**Author:** [@niveditakathal](https://discuss.elastic.co/u/niveditakathal)\ **Replies:** 7\ **Last updated:** [November 22, 2022, 9:07am UTC](https://discuss.elastic.co/t/is-it-possible-to-add-condition-in-elasticsearch-logstash-jdbc-input-plugin/319195 "2022-11-22T09:07:50Z")
Hi Experts, Is it possible to add condition in elasticsearch logstash jdbc input plugin for the use case mentioned below - Usecase - Select data from table1 If datetime (refer elapseTime in code mentioned below) fetc… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=722) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=724)