# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=814 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 815 --- ## [Filebeat -\> ElasticSearch for logrus running on k8s](https://discuss.elastic.co/t/filebeat-elasticsearch-for-logrus-running-on-k8s/312416)
**Author:** [@Austin\_ES\_Questions](https://discuss.elastic.co/u/Austin_ES_Questions)\ **Replies:** 27\ **Last updated:** [August 29, 2022, 9:41pm UTC](https://discuss.elastic.co/t/filebeat-elasticsearch-for-logrus-running-on-k8s/312416 "2022-08-29T21:41:32Z")
We are trying to get started with Elasticsearch, but can't seem to get json from filebeats into elasticsearch nicely formatted. We are using logrus in go and typescript, which writes to container log files in kubernetes.… --- ## [Logstash syncing from mongodb to elastic search null vaule](https://discuss.elastic.co/t/logstash-syncing-from-mongodb-to-elastic-search-null-vaule/313192)
**Author:** [@bindu1](https://discuss.elastic.co/u/bindu1)\ **Replies:** 0\ **Last updated:** [August 29, 2022, 7:18pm UTC](https://discuss.elastic.co/t/logstash-syncing-from-mongodb-to-elastic-search-null-vaule/313192 "2022-08-29T19:18:15Z")
Continuing the discussion from Logstash syncing from Mongodb to Elasticsearch - Null values in array data objects: --- ## [.monitoring-es indexes blow up, have no policies associated?](https://discuss.elastic.co/t/monitoring-es-indexes-blow-up-have-no-policies-associated/313186)
**Author:** [@wrobitza\_aveq](https://discuss.elastic.co/u/wrobitza_aveq)\ **Replies:** 6\ **Last updated:** [August 29, 2022, 5:55pm UTC](https://discuss.elastic.co/t/monitoring-es-indexes-blow-up-have-no-policies-associated/313186 "2022-08-29T17:55:41Z")
I've enabled Stack Monitoring in Kibana, just for the purpose of trying it out. Now, after a couple of days, I see that my stack is using a lot of disk memory. I was able to delete the individual .es-monitoring\* indices… --- ## [Grok csv+json](https://discuss.elastic.co/t/grok-csv-json/313010)
**Author:** [@exesition](https://discuss.elastic.co/u/exesition)\ **Replies:** 2\ **Last updated:** [August 29, 2022, 5:46pm UTC](https://discuss.elastic.co/t/grok-csv-json/313010 "2022-08-29T17:46:23Z")
Colleagues, good afternoon. Tell me I'm new to ELK. I have a log with the following file structure 2022-08-04T12:04:02,410|DEBUG|apg-b2p-keepr|instance\_3|http-8343-exec-5345|gtwRequestOut.com.B2pGateway|POST /trnproces… --- ## [Wrong host system info from containerized Elastic Agent](https://discuss.elastic.co/t/wrong-host-system-info-from-containerized-elastic-agent/313190)
**Author:** [@woodywoodsta](https://discuss.elastic.co/u/woodywoodsta)\ **Replies:** 0\ **Last updated:** [August 29, 2022, 5:32pm UTC](https://discuss.elastic.co/t/wrong-host-system-info-from-containerized-elastic-agent/313190 "2022-08-29T17:32:46Z")
I've got a fleet-managed elastic agent which is deployed in my k8s cluster as a Daemonset (as orchestrated by the ECK operator, resource type Agent) and it has a policy which includes the system integration. It's reporti… --- ## [How to apply the right stopwords langage depending on the field of a document?](https://discuss.elastic.co/t/how-to-apply-the-right-stopwords-langage-depending-on-the-field-of-a-document/313156)
**Author:** [@minikali](https://discuss.elastic.co/u/minikali)\ **Replies:** 1\ **Last updated:** [August 29, 2022, 4:31pm UTC](https://discuss.elastic.co/t/how-to-apply-the-right-stopwords-langage-depending-on-the-field-of-a-document/313156 "2022-08-29T16:31:16Z")
Let's say I have an index of News with many documents of different langages. Users have one search bar to look for the title they desire among the different langages. I don't know which langage the user is typing so I wo… --- ## [AWS service vpce name](https://discuss.elastic.co/t/aws-service-vpce-name/313160)
**Author:** [@Xiaoyu\_Que](https://discuss.elastic.co/u/Xiaoyu_Que)\ **Replies:** 1\ **Last updated:** [August 29, 2022, 3:43pm UTC](https://discuss.elastic.co/t/aws-service-vpce-name/313160 "2022-08-29T15:43:06Z")
Hi I'm seeing new version 8.4.0 migrating aws service domain name from aws.elastic-cloud.com to .aws.found.io. I'm quite concerned about the following things: I didn't see any related release note in #8.4.0. Any tutori… --- ## [Debugging "Failed Documents" from Data Visualizer CSV Ingestion](https://discuss.elastic.co/t/debugging-failed-documents-from-data-visualizer-csv-ingestion/313112)
**Author:** [@wpm](https://discuss.elastic.co/u/wpm)\ **Replies:** 10\ **Last updated:** [August 29, 2022, 3:22pm UTC](https://discuss.elastic.co/t/debugging-failed-documents-from-data-visualizer-csv-ingestion/313112 "2022-08-29T15:22:21Z")
I have a CSV file I'm trying to convert into an index via Kibana. I go to Machine Learning/Data Visualizer and upload my file. The "explanations" look good to me, as do all the guesses for the column types, so I hit "im… --- ## [Elastic agent - syslog cisco FTD](https://discuss.elastic.co/t/elastic-agent-syslog-cisco-ftd/313177)
**Author:** [@splitmessage88](https://discuss.elastic.co/u/splitmessage88)\ **Replies:** 0\ **Last updated:** [August 29, 2022, 2:58pm UTC](https://discuss.elastic.co/t/elastic-agent-syslog-cisco-ftd/313177 "2022-08-29T14:58:17Z")
Hello, I saw this discussion Syslog to ECK - Elastic Orchestration / Elastic Cloud on Kubernetes (ECK) - Discuss the Elastic Stack and I want to know if there is any progress in this case? The examples in your documenta… --- ## [Backup indices and data stored in ELK](https://discuss.elastic.co/t/backup-indices-and-data-stored-in-elk/313003)
**Author:** [@Clonky](https://discuss.elastic.co/u/Clonky)\ **Replies:** 8\ **Last updated:** [August 29, 2022, 2:58pm UTC](https://discuss.elastic.co/t/backup-indices-and-data-stored-in-elk/313003 "2022-08-29T14:58:03Z")
HI guys, I am rather new to ELK (7.16). So far I have registered a repository and can create now snapshots. I have used the following API command: PUT /\_snapshot/BackUpELKData/snapshot\_2?wait\_for\_completion=true { "ind… --- ## [Unassigned Shards on ELK cluster without Replicas](https://discuss.elastic.co/t/unassigned-shards-on-elk-cluster-without-replicas/312991)
**Author:** [@zenzedoon](https://discuss.elastic.co/u/zenzedoon)\ **Replies:** 3\ **Last updated:** [August 29, 2022, 2:46pm UTC](https://discuss.elastic.co/t/unassigned-shards-on-elk-cluster-without-replicas/312991 "2022-08-29T14:46:51Z")
Hello Community , i have an ELK cluster with 3 servers (1 hot - 1 warm & 1 cold) the cluster dosn't support the replicas mode, my problem is , i found some unassigned shards with multiple explanation for the same shards… --- ## [SNMP Trap listener died {:exception=\>#\ **Author:** [@bijender\_kr](https://discuss.elastic.co/u/bijender_kr)\ **Replies:** 0\ **Last updated:** [August 29, 2022, 2:22pm UTC](https://discuss.elastic.co/t/snmp-trap-listener-died-exception-errno-eaddrinuse/313175 "2022-08-29T14:22:51Z") Hi, I am getting below error while using snmptrap plugin. \[2022-08-29T10:20:54,371\]\[INFO \]\[logstash.inputs.snmptrap \]\[snmptrap\]\[aef6e9ad69b62db067a46e53d1b0e0b15b5d216cd954b6f321afcb5a16300adc\] It's a Trap! {:Port=\>106… --- ## [How to aggregate runtime\_mappings fields](https://discuss.elastic.co/t/how-to-aggregate-runtime-mappings-fields/313173)
**Author:** [@eguenou](https://discuss.elastic.co/u/eguenou)\ **Replies:** 0\ **Last updated:** [August 29, 2022, 1:52pm UTC](https://discuss.elastic.co/t/how-to-aggregate-runtime-mappings-fields/313173 "2022-08-29T13:52:32Z")
Hi, I'm trying to join two indices using the runtime\_mappings as described here. The join seems OK however the aggregation always returns 0. Can someone help ? Here is the code : POST parent\_index/\_search { "size": 0… --- ## [Anomaly detector query to find IPs that only visit a specific page?](https://discuss.elastic.co/t/anomaly-detector-query-to-find-ips-that-only-visit-a-specific-page/312647)
**Author:** [@parkerjthomas](https://discuss.elastic.co/u/parkerjthomas)\ **Replies:** 14\ **Last updated:** [August 29, 2022, 1:59pm UTC](https://discuss.elastic.co/t/anomaly-detector-query-to-find-ips-that-only-visit-a-specific-page/312647 "2022-08-29T13:59:53Z")
I am looking for a way to find IPs that are only hitting a specific page repeatedly to detect credential stuffing with an anomaly detector. I currently have a detector setup to look for 401 responses coming from visits … --- ## [Can’t send winlogbeat data to ELK/logtash](https://discuss.elastic.co/t/can-t-send-winlogbeat-data-to-elk-logtash/313172)
**Author:** [@DanyGuiZH](https://discuss.elastic.co/u/DanyGuiZH)\ **Replies:** 0\ **Last updated:** [August 29, 2022, 1:38pm UTC](https://discuss.elastic.co/t/can-t-send-winlogbeat-data-to-elk-logtash/313172 "2022-08-29T13:38:19Z")
Hello I am asking for help in setting up a Winlogbeat configuration. The final goal is: "Winlogbeat sends events to a specific ELK index \* The specific ELK index has 1 month of retention\* There is a notificati… --- ## [Required Permissions to Create Alert Rules](https://discuss.elastic.co/t/required-permissions-to-create-alert-rules/313166)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 2\ **Last updated:** [August 29, 2022, 1:36pm UTC](https://discuss.elastic.co/t/required-permissions-to-create-alert-rules/313166 "2022-08-29T13:36:02Z")
I would like to grant permissions to some users so that they can create alert rules in Kibana. According to the documentation, it appears that kibana admin permissions are required for this, however I would prefer to no… --- ## [Clarification Kibana Alerts](https://discuss.elastic.co/t/clarification-kibana-alerts/313122)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 2\ **Last updated:** [August 29, 2022, 1:32pm UTC](https://discuss.elastic.co/t/clarification-kibana-alerts/313122 "2022-08-29T13:32:48Z")
Dear all, seeking for a clarification regarding Kibana alerting I would like start offering to my internal elasticsearch customers. Right now I am using elastalert and I am running on 7.17.4 on ubuntu a central, licens… --- ## [Elastic rule throwing error when checking for preview](https://discuss.elastic.co/t/elastic-rule-throwing-error-when-checking-for-preview/312643)
**Author:** [@siemdude](https://discuss.elastic.co/u/siemdude)\ **Replies:** 8\ **Last updated:** [August 29, 2022, 1:25pm UTC](https://discuss.elastic.co/t/elastic-rule-throwing-error-when-checking-for-preview/312643 "2022-08-29T13:25:26Z")
I have built a rule in Elastic following my search keywords in Discover. However the rule throws error while checking for preview and never fires. I think logic is solid, indexing is solid as well. But not sure what is c… --- ## [Some auditd Data Corrupted After 8.4.0 Upgrade](https://discuss.elastic.co/t/some-auditd-data-corrupted-after-8-4-0-upgrade/312973)
**Author:** [@CraigHolyoak](https://discuss.elastic.co/u/CraigHolyoak)\ **Replies:** 1\ **Last updated:** [August 29, 2022, 1:07pm UTC](https://discuss.elastic.co/t/some-auditd-data-corrupted-after-8-4-0-upgrade/312973 "2022-08-29T13:07:12Z")
I'm seeing some records created from auditd including corrupt data after upgrading to 8.4.0. This are fine after downgrading back to 8.3.3. For example, with minimal config: auditbeat.modules: - module: auditd includ… --- ## [Metricbeat - error... ERROR timeout waiting for event](https://discuss.elastic.co/t/metricbeat-error-error-timeout-waiting-for-event/313165)
**Author:** [@el-jefe3](https://discuss.elastic.co/u/el-jefe3)\ **Replies:** 0\ **Last updated:** [August 29, 2022, 1:00pm UTC](https://discuss.elastic.co/t/metricbeat-error-error-timeout-waiting-for-event/313165 "2022-08-29T13:00:37Z")
I am attempting to ingest AWS data using metricbeat aws module. I am not getting configuration errors, but I am however getting timeout errors when running metricbeat test modules command. aws... cloudwatch... error.… --- ## [Error installing fleetserver 7.17.5](https://discuss.elastic.co/t/error-installing-fleetserver-7-17-5/313021)
**Author:** [@adrian.cunnelly](https://discuss.elastic.co/u/adrian.cunnelly)\ **Replies:** 2\ **Last updated:** [August 29, 2022, 7:38am UTC](https://discuss.elastic.co/t/error-installing-fleetserver-7-17-5/313021 "2022-08-29T07:38:28Z")
Installing fleet server on Ubuntu 20.04 fails with: Error: fail to enroll: fail to execute request to fleet-server: status code: 400, fleet-server returned an error: BadRequest The command i'm issuing is: ./elastic-ag… --- ## [Some values don't appear in a data table](https://discuss.elastic.co/t/some-values-dont-appear-in-a-data-table/312992)
**Author:** [@Druffle](https://discuss.elastic.co/u/Druffle)\ **Replies:** 1\ **Last updated:** [August 29, 2022, 10:08am UTC](https://discuss.elastic.co/t/some-values-dont-appear-in-a-data-table/312992 "2022-08-29T10:08:54Z")
Hi ! I'm currently doing a dashboard and I need help on this table. I don't understand why some values don't appear even though i can see them in "discovery". I made sure these documents had a value for this field. --- ## [Getting duplicate log entry in dashboard](https://discuss.elastic.co/t/getting-duplicate-log-entry-in-dashboard/311041)
**Author:** [@ssksraja](https://discuss.elastic.co/u/ssksraja)\ **Replies:** 9\ **Last updated:** [August 29, 2022, 9:46am UTC](https://discuss.elastic.co/t/getting-duplicate-log-entry-in-dashboard/311041 "2022-08-29T09:46:44Z")
Hi All , iam using filebeat for the dasbboard creation for monitoring the jobs and i find log.flags:dissect\_parsing\_error as error and can any one please help to resolve this issue. --- ## [Any plans on offering ranges for runtime\_fields?](https://discuss.elastic.co/t/any-plans-on-offering-ranges-for-runtime-fields/313125)
**Author:** [@styks90](https://discuss.elastic.co/u/styks90)\ **Replies:** 2\ **Last updated:** [August 29, 2022, 9:44am UTC](https://discuss.elastic.co/t/any-plans-on-offering-ranges-for-runtime-fields/313125 "2022-08-29T09:44:52Z")
According to the current documentation, runtime\_fields cannot be of the data type range. Are there any plans or open issues or PRs to add this functionality? We have a lot of indices that contain two fields of type date … --- ## [Kafka output not working on Filebeat ECK](https://discuss.elastic.co/t/kafka-output-not-working-on-filebeat-eck/311975)
**Author:** [@shivendra95](https://discuss.elastic.co/u/shivendra95)\ **Replies:** 7\ **Last updated:** [August 29, 2022, 9:42am UTC](https://discuss.elastic.co/t/kafka-output-not-working-on-filebeat-eck/311975 "2022-08-29T09:42:45Z")
I'm using filebeat on ECK. I have kafka output but it's not working as expected. There are no logs in filebeat to show that connection with kafka has been established. Below is my deployment file apiVersion: beat.k8s.e… --- ## [Is there a way to dump data in a file if logstash fails to dump the data in elasticsearch for a particular run](https://discuss.elastic.co/t/is-there-a-way-to-dump-data-in-a-file-if-logstash-fails-to-dump-the-data-in-elasticsearch-for-a-particular-run/313134)
**Author:** [@anand\_tripathi](https://discuss.elastic.co/u/anand_tripathi)\ **Replies:** 2\ **Last updated:** [August 29, 2022, 9:42am UTC](https://discuss.elastic.co/t/is-there-a-way-to-dump-data-in-a-file-if-logstash-fails-to-dump-the-data-in-elasticsearch-for-a-particular-run/313134 "2022-08-29T09:42:10Z")
I am using Logstash to dump my data from Postgres to Elasticsearch. So the input is JDBC that is fetching data from Postgres using tracking\_column and let's say for one run it is taking 1000 records from Postgres Output… --- ## [Kibana server is not ready yet . (Error: Failure installing common resources shared between all indices.)](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-error-failure-installing-common-resources-shared-between-all-indices/313142)
**Author:** [@bbkunbi](https://discuss.elastic.co/u/bbkunbi)\ **Replies:** 2\ **Last updated:** [August 29, 2022, 9:28am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-error-failure-installing-common-resources-shared-between-all-indices/313142 "2022-08-29T09:28:18Z")
Error: Kibana server is not ready yet, My kibana.log file is below sudo tail /var/log/kibana/kibana.log bhaveshk@linux:~$ sudo tail /var/log/kibana/kibana.log {"type":"log","@timestamp":"2022-08-29T13:12:06+05… --- ## [Closing (Connection reset by peer) keeps being logged on logstash logs](https://discuss.elastic.co/t/closing-connection-reset-by-peer-keeps-being-logged-on-logstash-logs/311992)
**Author:** [@Thuunder7](https://discuss.elastic.co/u/Thuunder7)\ **Replies:** 9\ **Last updated:** [August 29, 2022, 9:23am UTC](https://discuss.elastic.co/t/closing-connection-reset-by-peer-keeps-being-logged-on-logstash-logs/311992 "2022-08-29T09:23:37Z")
Hello, Since i upgraded my two logstash instances from 7.16.3 to 8.3.1 i am seeing the appearence of the above logs: Does someone know why this could be happening? I didnt had these INFO logs before on the previous … --- ## [How to embed kibana dashboard in html code?](https://discuss.elastic.co/t/how-to-embed-kibana-dashboard-in-html-code/312597)
**Author:** [@Ritikapawar](https://discuss.elastic.co/u/Ritikapawar)\ **Replies:** 9\ **Last updated:** [August 29, 2022, 9:14am UTC](https://discuss.elastic.co/t/how-to-embed-kibana-dashboard-in-html-code/312597 "2022-08-29T09:14:10Z")
I'm trying to embed kibana dashboard in html code I followed this forum discussion xpack.security.sameSiteCookies: None added this part in kibana.yml file and restarted the kibana service after doing this my kibana … --- ## [Is there any useful Kibana Dashboard API or Elastic API to read Dashboards/Visualizations from Kibana GUI?](https://discuss.elastic.co/t/is-there-any-useful-kibana-dashboard-api-or-elastic-api-to-read-dashboards-visualizations-from-kibana-gui/313123)
**Author:** [@Ayushi\_bhardwaj](https://discuss.elastic.co/u/Ayushi_bhardwaj)\ **Replies:** 1\ **Last updated:** [August 29, 2022, 9:10am UTC](https://discuss.elastic.co/t/is-there-any-useful-kibana-dashboard-api-or-elastic-api-to-read-dashboards-visualizations-from-kibana-gui/313123 "2022-08-29T09:10:40Z")
Is there any useful API to read Dashboards/Visualizations from Kibana GUI ? I want to read dashboards from Kibana GUI using Python for automation purpose My Kibana version is v 7.16.2 [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=813) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=815)