# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=835 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 836 --- ## [Where is logstash.service file?](https://discuss.elastic.co/t/where-is-logstash-service-file/311784)
**Author:** [@hellocomputer](https://discuss.elastic.co/u/hellocomputer)\ **Replies:** 0\ **Last updated:** [August 10, 2022, 3:47am UTC](https://discuss.elastic.co/t/where-is-logstash-service-file/311784 "2022-08-10T03:47:00Z")
Hello I'm using ubuntu20.04 and logstash 8.3.2 version. I want to set TimeoutStopSec=300 this command! but I couldn't find logstash.service file in /etc/systemd/system/logstash.service in this location. so, wh… --- ## [How to filter json object field class, java.lang.ClassCastException: class org.jruby.RubyHash cannot be cast to class org.jruby.RubyIO](https://discuss.elastic.co/t/how-to-filter-json-object-field-class-java-lang-classcastexception-class-org-jruby-rubyhash-cannot-be-cast-to-class-org-jruby-rubyio/311779)
**Author:** [@HeChuanXUPT](https://discuss.elastic.co/u/HeChuanXUPT)\ **Replies:** 0\ **Last updated:** [August 10, 2022, 1:20am UTC](https://discuss.elastic.co/t/how-to-filter-json-object-field-class-java-lang-classcastexception-class-org-jruby-rubyhash-cannot-be-cast-to-class-org-jruby-rubyio/311779 "2022-08-10T01:20:45Z")
input file content: {"\_source": {"timestamp": 1612256372000, "date": "2021-02-02 16:59:32", "ip": "127.175.208.130"}} logstash.conf: input { file { path =\> \["/tmp/test\_file"\] start\_position =\> "beginning" … --- ## [Missing authentication credentials for REST request](https://discuss.elastic.co/t/missing-authentication-credentials-for-rest-request/311338)
**Author:** [@Medel](https://discuss.elastic.co/u/Medel)\ **Replies:** 4\ **Last updated:** [August 10, 2022, 12:53am UTC](https://discuss.elastic.co/t/missing-authentication-credentials-for-rest-request/311338 "2022-08-10T00:53:33Z")
Hello Elastic Users, I am trying to check if my Elasticsearch is working fine and I got the following problem: and Im trying to change elastic super-user password, I got this error : root@Master-node:/usr/share/ela… --- ## [Remove elasticSearch 6.5.4. in docker](https://discuss.elastic.co/t/remove-elasticsearch-6-5-4-in-docker/311776)
**Author:** [@Boodle](https://discuss.elastic.co/u/Boodle)\ **Replies:** 2\ **Last updated:** [August 9, 2022, 10:18pm UTC](https://discuss.elastic.co/t/remove-elasticsearch-6-5-4-in-docker/311776 "2022-08-09T22:18:45Z")
Would like to remove Elasticsearch 6.5.4 containers (installed by a vendor many years ago) but stopping or killing these container/s using stop/kill commands doesn’t exits its status, hence can't remove. There seems to b… --- ## [Dashboard MISP](https://discuss.elastic.co/t/dashboard-misp/311760)
**Author:** [@VitorBarroso](https://discuss.elastic.co/u/VitorBarroso)\ **Replies:** 0\ **Last updated:** [August 9, 2022, 4:31pm UTC](https://discuss.elastic.co/t/dashboard-misp/311760 "2022-08-09T16:31:50Z")
The Dashboard \[Filebeat Threat Intel\] MISP only appears what is on my network? For example, MISP Indicators \[Filebeat Threat Intel\] only appears the number 24 and the MISP Tags \[Filebeat Threat Intel\] and the tags are m… --- ## [Alerting on index aggregation with filter](https://discuss.elastic.co/t/alerting-on-index-aggregation-with-filter/311763)
**Author:** [@lmoore2210](https://discuss.elastic.co/u/lmoore2210)\ **Replies:** 1\ **Last updated:** [August 9, 2022, 9:13pm UTC](https://discuss.elastic.co/t/alerting-on-index-aggregation-with-filter/311763 "2022-08-09T21:13:38Z")
I'm working on some alerting functionality that I'd like some help with. The end goal is to return the count and field to our email connector that is the result of a query with aggregations/filters. In SQL, it would be … --- ## [Metricbeat Overlogging](https://discuss.elastic.co/t/metricbeat-overlogging/311775)
**Author:** [@daniel.talbot](https://discuss.elastic.co/u/daniel.talbot)\ **Replies:** 0\ **Last updated:** [August 9, 2022, 8:48pm UTC](https://discuss.elastic.co/t/metricbeat-overlogging/311775 "2022-08-09T20:48:07Z")
Currently we are running Elastic fleet agent to pick up on all logs as you can see in the picture attached. The problem is on our database nodes we would like to skip it from looking at the postgres process so that it d… --- ## [How to set start and end point of a prebuild grok pattern](https://discuss.elastic.co/t/how-to-set-start-and-end-point-of-a-prebuild-grok-pattern/311749)
**Author:** [@cihady](https://discuss.elastic.co/u/cihady)\ **Replies:** 6\ **Last updated:** [August 9, 2022, 8:43pm UTC](https://discuss.elastic.co/t/how-to-set-start-and-end-point-of-a-prebuild-grok-pattern/311749 "2022-08-09T20:43:59Z")
My grok patter broken when there is a |(pipe) in my data . here is my log \> 16:29:52.143 \[kafka-producer-network-thread | producer-1\] INFO c.h.h.d.e.ApiMessageProducer - ===============================================… --- ## [ES filter composite aggregation result by doc\_count](https://discuss.elastic.co/t/es-filter-composite-aggregation-result-by-doc-count/311727)
**Author:** [@mirokrastev](https://discuss.elastic.co/u/mirokrastev)\ **Replies:** 3\ **Last updated:** [August 9, 2022, 7:29pm UTC](https://discuss.elastic.co/t/es-filter-composite-aggregation-result-by-doc-count/311727 "2022-08-09T19:29:28Z")
I have the following ES query: GET my-index/\_search { "size": 0, "aggs": { "my\_bucket": { "composite": { "size": 10000, "sources": \[ { "stk1": { "terms":… --- ## [Data node calculation based on "Number of shards per node below 20 per GB heap it has configured"](https://discuss.elastic.co/t/data-node-calculation-based-on-number-of-shards-per-node-below-20-per-gb-heap-it-has-configured/311534)
**Author:** [@sree\_sk](https://discuss.elastic.co/u/sree_sk)\ **Replies:** 7\ **Last updated:** [August 9, 2022, 7:17pm UTC](https://discuss.elastic.co/t/data-node-calculation-based-on-number-of-shards-per-node-below-20-per-gb-heap-it-has-configured/311534 "2022-08-09T19:17:46Z")
I have the following scenario where, Data volume of an index is 85GB/day with a daily index rotation and retention of 90 days. Similarly I have 14 other indices with the same data volume per day. I have a system which… --- ## [Elastic Agent Doesn't Seem To Be Collecting Winlogbeat Data](https://discuss.elastic.co/t/elastic-agent-doesnt-seem-to-be-collecting-winlogbeat-data/311761)
**Author:** [@Jared9922](https://discuss.elastic.co/u/Jared9922)\ **Replies:** 0\ **Last updated:** [August 9, 2022, 4:56pm UTC](https://discuss.elastic.co/t/elastic-agent-doesnt-seem-to-be-collecting-winlogbeat-data/311761 "2022-08-09T16:56:09Z")
I am working on getting elastic security setup. I am using a self-managed elastic stack. I have successfully added a fleet server and an elastic agent. The elastic agent is added to a Windows machine. The agent is sendin… --- ## [RBAC in Kibana](https://discuss.elastic.co/t/rbac-in-kibana/311745)
**Author:** [@g.le](https://discuss.elastic.co/u/g.le)\ **Replies:** 3\ **Last updated:** [August 9, 2022, 3:25pm UTC](https://discuss.elastic.co/t/rbac-in-kibana/311745 "2022-08-09T15:25:10Z")
Hello! We 've been using ELK v7.10 and according to the documentation, we should be able to enable RBAC features. See: Securing access to Kibana | Kibana Guide \[7.10\] | Elastic Nevertheless, there's no Security option… --- ## [Logstash deletes log files after processing](https://discuss.elastic.co/t/logstash-deletes-log-files-after-processing/311743)
**Author:** [@Indrajit](https://discuss.elastic.co/u/Indrajit)\ **Replies:** 1\ **Last updated:** [August 9, 2022, 3:23pm UTC](https://discuss.elastic.co/t/logstash-deletes-log-files-after-processing/311743 "2022-08-09T15:23:34Z")
logstash delete log files after processing. My input follows below. Is there a way to force logstash not to delete files after processing? input { file { path =\> "/sftpshare/dplogs/dplogs/prod/ext01/… --- ## [Wirting Filter](https://discuss.elastic.co/t/wirting-filter/311752)
**Author:** [@AbdulRahman\_Mahmoud](https://discuss.elastic.co/u/AbdulRahman_Mahmoud)\ **Replies:** 0\ **Last updated:** [August 9, 2022, 3:02pm UTC](https://discuss.elastic.co/t/wirting-filter/311752 "2022-08-09T15:02:45Z")
Hi, I have tried to use following repo to create a custom filter, for the step of "Package and Deploy" I see it is written that the snippet of "plugin info" - that contatins"group, version, description and pluginInfo.\*"… --- ## [Elasticsearch/client.go:405 Cannot index event publisher.Event](https://discuss.elastic.co/t/elasticsearch-client-go-405-cannot-index-event-publisher-event/311744)
**Author:** [@maviles](https://discuss.elastic.co/u/maviles)\ **Replies:** 0\ **Last updated:** [August 9, 2022, 2:08pm UTC](https://discuss.elastic.co/t/elasticsearch-client-go-405-cannot-index-event-publisher-event/311744 "2022-08-09T14:08:04Z")
Hello, I'm trying to change my index name. I made some modifications to my .yml file including: change index name change index template change index pattern change index ilm related settings. However, the following … --- ## [How to redirect an application to a session of a specific index on Kibana](https://discuss.elastic.co/t/how-to-redirect-an-application-to-a-session-of-a-specific-index-on-kibana/311133)
**Author:** [@Vincent92](https://discuss.elastic.co/u/Vincent92)\ **Replies:** 2\ **Last updated:** [August 9, 2022, 8:26am UTC](https://discuss.elastic.co/t/how-to-redirect-an-application-to-a-session-of-a-specific-index-on-kibana/311133 "2022-08-09T08:26:23Z")
Hello, I am developing a javascript application that will complete my use of Kibana. In my application I display a table that shows all the sessions that have been requested by the user. I would like to add a button i… --- ## [Create alert for long running query from the logs in Kibana alert](https://discuss.elastic.co/t/create-alert-for-long-running-query-from-the-logs-in-kibana-alert/311736)
**Author:** [@skathir29](https://discuss.elastic.co/u/skathir29)\ **Replies:** 0\ **Last updated:** [August 9, 2022, 1:30pm UTC](https://discuss.elastic.co/t/create-alert-for-long-running-query-from-the-logs-in-kibana-alert/311736 "2022-08-09T13:30:17Z")
Need to get alerted if the time difference between these below two log event is more than 10 mins, Kindly provide some hint to do this Alerts / watcher in Kibana. @timestamp DatabaseName UserName ServerName Duration … --- ## [Docker elastic-logging-plugin disable SSL certificate validation](https://discuss.elastic.co/t/docker-elastic-logging-plugin-disable-ssl-certificate-validation/311690)
**Author:** [@amandradzhiyski](https://discuss.elastic.co/u/amandradzhiyski)\ **Replies:** 0\ **Last updated:** [August 9, 2022, 7:38am UTC](https://discuss.elastic.co/t/docker-elastic-logging-plugin-disable-ssl-certificate-validation/311690 "2022-08-09T07:38:46Z")
Hello, Is it possible to disable SSL certificate validation when elastic-logging-plugin docker plugin communicate with elasticsearch by HTTPS and server's certificate is selfsigned or untrusted? Or is it possible to tr… --- ## [Writing OR-Query with Wildcards using Query DSL](https://discuss.elastic.co/t/writing-or-query-with-wildcards-using-query-dsl/311726)
**Author:** [@MStrauch](https://discuss.elastic.co/u/MStrauch)\ **Replies:** 1\ **Last updated:** [August 9, 2022, 1:07pm UTC](https://discuss.elastic.co/t/writing-or-query-with-wildcards-using-query-dsl/311726 "2022-08-09T13:07:48Z")
Hi, I want to create a DSL query that applies wildcard syntax for multiple values that are OR connected. How can I do this in ES? By using a terms query I can connect different values as OR for the same field. By using… --- ## [Logstash filter add new calculated float value](https://discuss.elastic.co/t/logstash-filter-add-new-calculated-float-value/311724)
**Author:** [@azeiner](https://discuss.elastic.co/u/azeiner)\ **Replies:** 3\ **Last updated:** [August 9, 2022, 1:07pm UTC](https://discuss.elastic.co/t/logstash-filter-add-new-calculated-float-value/311724 "2022-08-09T13:07:21Z")
I've got Data from a Json Object and what i want is to calculate some Values of the same Object e.g. filter { json { source =\> "message" } mutate { add\_field =\> { "xxx1" =\> "Float(%{\[… --- ## [Use nested field names in Grok custom patterns](https://discuss.elastic.co/t/use-nested-field-names-in-grok-custom-patterns/311728)
**Author:** [@vilman](https://discuss.elastic.co/u/vilman)\ **Replies:** 1\ **Last updated:** [August 9, 2022, 12:49pm UTC](https://discuss.elastic.co/t/use-nested-field-names-in-grok-custom-patterns/311728 "2022-08-09T12:49:40Z")
Hi, I'm trying to map a nested field from a custom grok expression. So, instead of using: (?=.\*?Message Type: (?\\[^;\]+))? I would like to map test1 to \[event\]\[name\]. Tried things like: (?=.\*?Message Type: (?\<\[… --- ## [Terraform - Elasticstack provider features and roadmap](https://discuss.elastic.co/t/terraform-elasticstack-provider-features-and-roadmap/309623)
**Author:** [@Swissmountain](https://discuss.elastic.co/u/Swissmountain)\ **Replies:** 3\ **Last updated:** [August 9, 2022, 12:10pm UTC](https://discuss.elastic.co/t/terraform-elasticstack-provider-features-and-roadmap/309623 "2022-08-09T12:10:19Z")
We are managing our assets using the terraform elastickstack provider for multiple stacks deployed on elastic cloud: Releases · elastic/terraform-provider-elasticstack · GitHub. We are expecting many new features to be… --- ## [Elasticsearch discovery issues kubernetes](https://discuss.elastic.co/t/elasticsearch-discovery-issues-kubernetes/311465)
**Author:** [@willsc](https://discuss.elastic.co/u/willsc)\ **Replies:** 17\ **Last updated:** [August 9, 2022, 10:43am UTC](https://discuss.elastic.co/t/elasticsearch-discovery-issues-kubernetes/311465 "2022-08-09T10:43:58Z")
Deploying elasticsearch 7.17.4 into kubernetes {rancher}, and have noticed that elastic doesn't form a cluster, it partitions into 3 separate master nodes. How do i increase the level of debugging on the masters, as all… --- ## [Multiple ilm and template for multiple index in filebeat directly to elasticsearch](https://discuss.elastic.co/t/multiple-ilm-and-template-for-multiple-index-in-filebeat-directly-to-elasticsearch/311716)
**Author:** [@Zahraa\_Dehghan](https://discuss.elastic.co/u/Zahraa_Dehghan)\ **Replies:** 0\ **Last updated:** [August 9, 2022, 11:17am UTC](https://discuss.elastic.co/t/multiple-ilm-and-template-for-multiple-index-in-filebeat-directly-to-elasticsearch/311716 "2022-08-09T11:17:33Z")
Hi , I am gathering log from multiple containers and I want to send them to multiple index with multiple ilm and template , here is my config: filebeat.autodiscover: providers: - type: kubernete… --- ## [Ingress controller logs directly from filebeat to elasticsearch](https://discuss.elastic.co/t/ingress-controller-logs-directly-from-filebeat-to-elasticsearch/310675)
**Author:** [@Zahraa\_Dehghan](https://discuss.elastic.co/u/Zahraa_Dehghan)\ **Replies:** 2\ **Last updated:** [August 9, 2022, 11:09am UTC](https://discuss.elastic.co/t/ingress-controller-logs-directly-from-filebeat-to-elasticsearch/310675 "2022-08-09T11:09:08Z")
hi , I want to ship ingress controllers log directly to elasticsearch via filebeat. Here is my log format for ingress {\\"remote\_ip\\": \\"%{GREEDYDATA:remote\_ip}\\",\\"method\\": \\"%{GREEDYDATA:method}\\", \\"host\\": \\"%{GREE… --- ## [ElasticSearch Query containing equal and not equal](https://discuss.elastic.co/t/elasticsearch-query-containing-equal-and-not-equal/311713)
**Author:** [@usman1](https://discuss.elastic.co/u/usman1)\ **Replies:** 0\ **Last updated:** [August 9, 2022, 10:53am UTC](https://discuss.elastic.co/t/elasticsearch-query-containing-equal-and-not-equal/311713 "2022-08-09T10:53:17Z")
Hi, Is there a way to use equal and not equal in a query for Elasticsearch? My data looks something like this: ID = 2 FLAG = ""Start" Date = 2022-08-08 Data = \<\> ID = 2 FLAG = "End" Date = 2022-08-08 Data = \<\> ID = 4… --- ## [Kibana Canvas: Comparing current month Event counts to previous month counts and result to be in a form of string "increase" or "Decrease"](https://discuss.elastic.co/t/kibana-canvas-comparing-current-month-event-counts-to-previous-month-counts-and-result-to-be-in-a-form-of-string-increase-or-decrease/311641)
**Author:** [@Solomon\_k](https://discuss.elastic.co/u/Solomon_k)\ **Replies:** 3\ **Last updated:** [August 9, 2022, 10:49am UTC](https://discuss.elastic.co/t/kibana-canvas-comparing-current-month-event-counts-to-previous-month-counts-and-result-to-be-in-a-form-of-string-increase-or-decrease/311641 "2022-08-09T10:49:58Z")
Hi Guys, I am trying to create a Canvas page for Data Findings for the current month which compares Data records from the Previous Month and outputs the Result as "Increase" if the number of counts are greater then the… --- ## [Does logstash support mips?](https://discuss.elastic.co/t/does-logstash-support-mips/311709)
**Author:** [@xsky](https://discuss.elastic.co/u/xsky)\ **Replies:** 0\ **Last updated:** [August 9, 2022, 10:16am UTC](https://discuss.elastic.co/t/does-logstash-support-mips/311709 "2022-08-09T10:16:21Z")
logstash versoin: 7.17.5 java version: OpenJDK 11.0.15 cpu: mips64el I use the logstash-7.17.5-linux-aarch64.tar.gz installation package, replace the jdk directory in logstash with mips jdk, and start logstahs, the … --- ## [Elastic transform](https://discuss.elastic.co/t/elastic-transform/311701)
**Author:** [@Amol](https://discuss.elastic.co/u/Amol)\ **Replies:** 1\ **Last updated:** [August 9, 2022, 10:15am UTC](https://discuss.elastic.co/t/elastic-transform/311701 "2022-08-09T10:15:34Z")
Hello Team, I'm able to create index through Transform with the help of Dev tool. But to avoid or over-write documents with same unique ID, I need to pass Document ID in transform, but I'm not able to add it. Kindly a… --- ## [Facing an \`SSLHandshakeException\` when first ran elasticsearch after installation](https://discuss.elastic.co/t/facing-an-sslhandshakeexception-when-first-ran-elasticsearch-after-installation/311706)
**Author:** [@hend](https://discuss.elastic.co/u/hend)\ **Replies:** 0\ **Last updated:** [August 9, 2022, 10:02am UTC](https://discuss.elastic.co/t/facing-an-sslhandshakeexception-when-first-ran-elasticsearch-after-installation/311706 "2022-08-09T10:02:11Z")
Hey, I'm very new to Elasticsearch and was following the installation steps, when I tried running it I get this error. not sure which certificate is missing and where/how to get it. Any help? \[2022-08-09T12:45:29,496\]\[… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=834) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=836)