# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=854 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 855 --- ## [Shard Configuration](https://discuss.elastic.co/t/shard-configuration/310406)
**Author:** [@shinobu](https://discuss.elastic.co/u/shinobu)\ **Replies:** 1\ **Last updated:** [July 22, 2022, 4:51pm UTC](https://discuss.elastic.co/t/shard-configuration/310406 "2022-07-22T16:51:03Z")
Hello, i'm using ILM for managing my indexes. Currently I have set the max size for shards to 30gb til the next index is written. Since ILM is automatically creating new Indexes with 1 shard of up to 30gb properly size… --- ## [Sort with limiting consecutive amount of hits by field value](https://discuss.elastic.co/t/sort-with-limiting-consecutive-amount-of-hits-by-field-value/310154)
**Author:** [@vitalyiegorov](https://discuss.elastic.co/u/vitalyiegorov)\ **Replies:** 1\ **Last updated:** [July 22, 2022, 4:09pm UTC](https://discuss.elastic.co/t/sort-with-limiting-consecutive-amount-of-hits-by-field-value/310154 "2022-07-22T16:09:36Z")
We have an ecommerce products index, which has Brand field(keyword) and a PublishDate field(date). We need a New items sort, which should sort results by returning no more than 5 consecutive products of each brand sort… --- ## [Document for filebeat configuration](https://discuss.elastic.co/t/document-for-filebeat-configuration/310396)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 8\ **Last updated:** [July 22, 2022, 3:43pm UTC](https://discuss.elastic.co/t/document-for-filebeat-configuration/310396 "2022-07-22T15:43:52Z")
Is there a link anywhere that details a full filebeat configuration file? I want to know all of the configuration options that are possible. I have searched but not found anything. --- ## [Cisco integrations fields naming convention](https://discuss.elastic.co/t/cisco-integrations-fields-naming-convention/310413)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 0\ **Last updated:** [July 22, 2022, 2:56pm UTC](https://discuss.elastic.co/t/cisco-integrations-fields-naming-convention/310413 "2022-07-22T14:56:27Z")
Hello, Currently in our company we are using Logstash to collect and parse logs from a couple of cisco devices (asa, ise, ftd and also duo and umbrella). To make our data integrate better with the builtin dashboards an… --- ## [Error in elasticsearch Backup via HMAC](https://discuss.elastic.co/t/error-in-elasticsearch-backup-via-hmac/310297)
**Author:** [@Sagar\_Shivani](https://discuss.elastic.co/u/Sagar_Shivani)\ **Replies:** 1\ **Last updated:** [July 22, 2022, 2:44pm UTC](https://discuss.elastic.co/t/error-in-elasticsearch-backup-via-hmac/310297 "2022-07-22T14:44:54Z")
I was trying using s3 for uploading to data on to GCP via HMAC keys..I am getting this error Register Repository Response: {"error":{"root\_cause":\[{"type":"repository\_verification\_exception","reason":"\[dev--110425--elas… --- ## [Ingest pipeline date processor - text could not be parsed at index 0](https://discuss.elastic.co/t/ingest-pipeline-date-processor-text-could-not-be-parsed-at-index-0/310374)
**Author:** [@Vladi](https://discuss.elastic.co/u/Vladi)\ **Replies:** 4\ **Last updated:** [July 22, 2022, 2:17pm UTC](https://discuss.elastic.co/t/ingest-pipeline-date-processor-text-could-not-be-parsed-at-index-0/310374 "2022-07-22T14:17:09Z")
Hi, I am trying to parse the 5 digits date 2022611 with a pattern yyyyMdd. POST /\_ingest/pipeline/\_simulate { "pipeline" : { "description": "\_description", "processors": \[ { "date" : { … --- ## [Fleet-server: dial tcp x.x.x.x:8220: connect: connection refused](https://discuss.elastic.co/t/fleet-server-dial-tcp-x-x-x-x-connect-connection-refused/309768)
**Author:** [@thiavs](https://discuss.elastic.co/u/thiavs)\ **Replies:** 5\ **Last updated:** [July 19, 2022, 3:49pm UTC](https://discuss.elastic.co/t/fleet-server-dial-tcp-x-x-x-x-connect-connection-refused/309768 "2022-07-19T15:49:33Z")
Guys, how are you? Good afternoon!! I'm having a little problem here setting for TLS stack, Elastic-Agent, Fleet and Elasticsearch, I can't close the connection with the fleet, I also see that the port is not listed in k… --- ## [Elastic Agent : AWS CloudWatch Fleet Integration Fail with RequestCanceledError](https://discuss.elastic.co/t/elastic-agent-aws-cloudwatch-fleet-integration-fail-with-requestcancelederror/310380)
**Author:** [@davide.lilliu](https://discuss.elastic.co/u/davide.lilliu)\ **Replies:** 2\ **Last updated:** [July 22, 2022, 1:30pm UTC](https://discuss.elastic.co/t/elastic-agent-aws-cloudwatch-fleet-integration-fail-with-requestcancelederror/310380 "2022-07-22T13:30:19Z")
Hi, i'm trying to set up an AWS integration to bring Lambda log group. I'm already using the AWS integration to have some metrics, so a don't think is a credential problem. I followed this guide AWS | Elastic Documenta… --- ## [Changing fleet settings installs two endpoint security instances](https://discuss.elastic.co/t/changing-fleet-settings-installs-two-endpoint-security-instances/310404)
**Author:** [@tmahany419](https://discuss.elastic.co/u/tmahany419)\ **Replies:** 0\ **Last updated:** [July 22, 2022, 1:16pm UTC](https://discuss.elastic.co/t/changing-fleet-settings-installs-two-endpoint-security-instances/310404 "2022-07-22T13:16:09Z")
Here's a vm I have running endpoint security: I changed the Default output for Agent integrations and for Agent monitoring , which should not affect this policy. It even gave me a warning that the change woul… --- ## [Visualize in a graph the match value from multiple indexes](https://discuss.elastic.co/t/visualize-in-a-graph-the-match-value-from-multiple-indexes/310402)
**Author:** [@mrestrepo](https://discuss.elastic.co/u/mrestrepo)\ **Replies:** 2\ **Last updated:** [July 22, 2022, 1:01pm UTC](https://discuss.elastic.co/t/visualize-in-a-graph-the-match-value-from-multiple-indexes/310402 "2022-07-22T13:01:16Z")
Hi all. I have 2 different indexes in kibana, first one is an early alert from something and the other one is when the user report the event, so i need to visualize when the alert and the user report match. So i can ha… --- ## [Problem with Kibana timestamp format](https://discuss.elastic.co/t/problem-with-kibana-timestamp-format/310366)
**Author:** [@bobus](https://discuss.elastic.co/u/bobus)\ **Replies:** 6\ **Last updated:** [July 22, 2022, 12:51pm UTC](https://discuss.elastic.co/t/problem-with-kibana-timestamp-format/310366 "2022-07-22T12:51:38Z")
A newbie question for you: On my Kibana "discover" page, timestamps appear as "2022-07-Th 18:21:00.234" (Th for Thursday rather than 21st of the month). Under Stack Mgmt --\> advance settings, the format is DD.MM.YY @ H… --- ## [Elasticsearch logs params](https://discuss.elastic.co/t/elasticsearch-logs-params/310403)
**Author:** [@mirisu2](https://discuss.elastic.co/u/mirisu2)\ **Replies:** 0\ **Last updated:** [July 22, 2022, 12:47pm UTC](https://discuss.elastic.co/t/elasticsearch-logs-params/310403 "2022-07-22T12:47:38Z")
Hi, elasticsearch logs settings have many params like "logger.org.elasticsearch.index.reindex" : "logger.org.elasticsearch.transport": "logger.org.elasticsearch.discovery": I would like to find all possible params l… --- ## [Filebeat Configuration](https://discuss.elastic.co/t/filebeat-configuration/310399)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 0\ **Last updated:** [July 22, 2022, 12:42pm UTC](https://discuss.elastic.co/t/filebeat-configuration/310399 "2022-07-22T12:42:30Z")
I am trying to configure filebeat to write logs to elastic. I have got the logs to go into elastic, but want know to set up ilm. I have setup.ilm: enabled: true policy\_name: "My\_Policy" And when looking in elastic … --- ## [Elastic cluster destroyes SSD's?](https://discuss.elastic.co/t/elastic-cluster-destroyes-ssds/308985)
**Author:** [@azeiner](https://discuss.elastic.co/u/azeiner)\ **Replies:** 12\ **Last updated:** [July 22, 2022, 12:11pm UTC](https://discuss.elastic.co/t/elastic-cluster-destroyes-ssds/308985 "2022-07-22T12:11:49Z")
I'm using Elastic 7.17.3 in a 3 Node Cluster on Windows - we have Redis as a ingest and cache database and running logstash to transfer daten from redis to the cluster - so far so good. Now i'm encoutering issues like … --- ## [Mutate add\_field attribute accidently become duplicate when using multiple logstash](https://discuss.elastic.co/t/mutate-add-field-attribute-accidently-become-duplicate-when-using-multiple-logstash/309536)
**Author:** [@mahendrapratitos](https://discuss.elastic.co/u/mahendrapratitos)\ **Replies:** 2\ **Last updated:** [July 22, 2022, 11:23am UTC](https://discuss.elastic.co/t/mutate-add-field-attribute-accidently-become-duplicate-when-using-multiple-logstash/309536 "2022-07-22T11:23:48Z")
I tried to execute 8 logstash that accept different port and different filebeat. I run this logstash on Linux environment. when I run the logstash, turns out some attribute that I create by using script mutate add\_fiel… --- ## [SentinelOne Integration](https://discuss.elastic.co/t/sentinelone-integration/310378)
**Author:** [@Medel](https://discuss.elastic.co/u/Medel)\ **Replies:** 3\ **Last updated:** [July 22, 2022, 11:20am UTC](https://discuss.elastic.co/t/sentinelone-integration/310378 "2022-07-22T11:20:21Z")
Hello , I'm trying to integrate SentinelOne API to Elastic for the purpose of collecting logs but unfortunatly i can't find any tutorial or information on how to use the API token generated from the used and integrate i… --- ## [Elasticsearch cluster security permission for logstash](https://discuss.elastic.co/t/elasticsearch-cluster-security-permission-for-logstash/310388)
**Author:** [@ciaroda](https://discuss.elastic.co/u/ciaroda)\ **Replies:** 0\ **Last updated:** [July 22, 2022, 11:16am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-security-permission-for-logstash/310388 "2022-07-22T11:16:06Z")
Hi all, playing further with elasticsearch and logstash security (view this post), I received other errors regarding cluster permissions. The configuration is the same as per the previous post. I configured the logsta… --- ## [How to manage multiple users with different indexes in kibana](https://discuss.elastic.co/t/how-to-manage-multiple-users-with-different-indexes-in-kibana/310259)
**Author:** [@alexander2](https://discuss.elastic.co/u/alexander2)\ **Replies:** 2\ **Last updated:** [July 22, 2022, 11:13am UTC](https://discuss.elastic.co/t/how-to-manage-multiple-users-with-different-indexes-in-kibana/310259 "2022-07-22T11:13:58Z")
Hello everyone. I have deployed ELK on a k8s cluster using ECK. What i'm trying to do is to create for each kibana user a space for him and assign him a role where he can only see his own metrics( i'm using metricbeat … --- ## [Kibana TSVB doesn't display all annotations that has the same timestamp](https://discuss.elastic.co/t/kibana-tsvb-doesnt-display-all-annotations-that-has-the-same-timestamp/310312)
**Author:** [@Henry\_Le](https://discuss.elastic.co/u/Henry_Le)\ **Replies:** 1\ **Last updated:** [July 22, 2022, 9:51am UTC](https://discuss.elastic.co/t/kibana-tsvb-doesnt-display-all-annotations-that-has-the-same-timestamp/310312 "2022-07-22T09:51:21Z")
I have a use case to show annotations of all events that have the same timestamp on the time series visualization of Kibana. The field name in interest is sale\_event. When creating the annotations, I put {{sale\_event}} i… --- ## [Theory question: How to recover data from 3 node cluster after 2 nodes failed](https://discuss.elastic.co/t/theory-question-how-to-recover-data-from-3-node-cluster-after-2-nodes-failed/310262)
**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\ **Replies:** 3\ **Last updated:** [July 22, 2022, 8:07am UTC](https://discuss.elastic.co/t/theory-question-how-to-recover-data-from-3-node-cluster-after-2-nodes-failed/310262 "2022-07-22T08:07:54Z")
Long time no see, but hello again. We had a 3 Node cluster running very well till it stopped running very well. The SSD's of 2 Nodes failed in a timespan of 4 hours. This was in the middle of the night so no actions cou… --- ## [\[Filebeat\]\[Checkpoint module\] data stream timestamp field \[@timestamp\] is missing](https://discuss.elastic.co/t/filebeat-checkpoint-module-data-stream-timestamp-field-timestamp-is-missing/309802)
**Author:** [@bbs2web](https://discuss.elastic.co/u/bbs2web)\ **Replies:** 7\ **Last updated:** [July 22, 2022, 9:25am UTC](https://discuss.elastic.co/t/filebeat-checkpoint-module-data-stream-timestamp-field-timestamp-is-missing/309802 "2022-07-22T09:25:49Z")
Hi, I'm trying to ingest CheckPoint native Syslog exports of security gateway (firewall) logs. My understanding is that integration was previously via CEF, which did not pass through sufficient detail, but that the nati… --- ## [The content of the field is not shown in alert](https://discuss.elastic.co/t/the-content-of-the-field-is-not-shown-in-alert/309637)
**Author:** [@csaba.g](https://discuss.elastic.co/u/csaba.g)\ **Replies:** 10\ **Last updated:** [July 22, 2022, 9:21am UTC](https://discuss.elastic.co/t/the-content-of-the-field-is-not-shown-in-alert/309637 "2022-07-22T09:21:50Z")
Hello, I defined an Alert Rule with Connector email. I would like to have in the received email the particular message, for which we defined the condition. The field which I would like to see is message. I tried differe… --- ## [Kibana panels using filters show very low performance](https://discuss.elastic.co/t/kibana-panels-using-filters-show-very-low-performance/310269)
**Author:** [@Adso\_4](https://discuss.elastic.co/u/Adso_4)\ **Replies:** 3\ **Last updated:** [July 22, 2022, 8:28am UTC](https://discuss.elastic.co/t/kibana-panels-using-filters-show-very-low-performance/310269 "2022-07-22T08:28:30Z")
We have a Kibana dashboard with several panels. On these panels, we use filters through kql or just with the "Add filter" option. The issue is that, when searching a given index pattern, it takes just seconds to load ev… --- ## [Value 'none' is not among the allowed options for argument](https://discuss.elastic.co/t/value-none-is-not-among-the-allowed-options-for-argument/310316)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 1\ **Last updated:** [July 22, 2022, 8:26am UTC](https://discuss.elastic.co/t/value-none-is-not-among-the-allowed-options-for-argument/310316 "2022-07-22T08:26:28Z")
\[layeredXyVis\] \> \[referenceLineLayer\] \> \[extendedYConfig\] \> Value 'none' is not among the allowed options for argument 'icon': 'empty', 'asterisk', 'alert', 'bell', 'bolt', 'bug', 'circle', 'editorComment', 'flag', 'hear… --- ## [Logstash exec input and sdtout](https://discuss.elastic.co/t/logstash-exec-input-and-sdtout/310369)
**Author:** [@Silver137](https://discuss.elastic.co/u/Silver137)\ **Replies:** 0\ **Last updated:** [July 22, 2022, 7:30am UTC](https://discuss.elastic.co/t/logstash-exec-input-and-sdtout/310369 "2022-07-22T07:30:44Z")
I'm trying to execute a custom 5 minutes duration bash script in logstash using exec input plugin. but imposible to get output. Trying things, i realized that redirecting the script stdout to stderr the script makes ou… --- ## [Prevent nested json from appearing in elasticsaerch field](https://discuss.elastic.co/t/prevent-nested-json-from-appearing-in-elasticsaerch-field/310328)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 6\ **Last updated:** [July 22, 2022, 4:04am UTC](https://discuss.elastic.co/t/prevent-nested-json-from-appearing-in-elasticsaerch-field/310328 "2022-07-22T04:04:11Z")
Hello, i'm using http filter to do api call to a rest api server. The data returned is json. it looks like this example: { a:{ b:{ c:{} d:{} e:{} } } } I want… --- ## [Drop Field - Meta data value](https://discuss.elastic.co/t/drop-field-meta-data-value/310045)
**Author:** [@yasar](https://discuss.elastic.co/u/yasar)\ **Replies:** 3\ **Last updated:** [July 22, 2022, 6:40am UTC](https://discuss.elastic.co/t/drop-field-meta-data-value/310045 "2022-07-22T06:40:38Z")
Hi team, We would like to know more on drop fields from Filebeat and Metricbeat data, As we implemented in Dev environment and we able to see the dropped field in dev Kibana. so we need to implement in same as in test … --- ## [Where does Metricbeat get its system.diskio data?](https://discuss.elastic.co/t/where-does-metricbeat-get-its-system-diskio-data/310303)
**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\ **Replies:** 2\ **Last updated:** [July 22, 2022, 6:27am UTC](https://discuss.elastic.co/t/where-does-metricbeat-get-its-system-diskio-data/310303 "2022-07-22T06:27:56Z")
Hello, this is more of a technical question. Where does Metricbeat get its data about system.diskio? I had problems with my disks in my cluster so I want to accurately track my total disk writes. I installed Metricbeat … --- ## [Monitoring process status](https://discuss.elastic.co/t/monitoring-process-status/310298)
**Author:** [@alytkowski](https://discuss.elastic.co/u/alytkowski)\ **Replies:** 3\ **Last updated:** [July 22, 2022, 6:16am UTC](https://discuss.elastic.co/t/monitoring-process-status/310298 "2022-07-22T06:16:37Z")
Hi, is there a way to monitor just the process status (up/down), just like Heartbeat monitors do? In the documentation for Heartbeat, there's no such possibility. I can use Metricbeat to collect metrics of the processes… --- ## [Heartbeat HTTP method OPTIONS](https://discuss.elastic.co/t/heartbeat-http-method-options/310280)
**Author:** [@alytkowski](https://discuss.elastic.co/u/alytkowski)\ **Replies:** 2\ **Last updated:** [July 22, 2022, 6:09am UTC](https://discuss.elastic.co/t/heartbeat-http-method-options/310280 "2022-07-22T06:09:17Z")
Hi, in the documentation of Heartbeat 8.3.2 the listed methods available are: "HEAD", "GET" and "POST". For my use case, I require the "OPTIONS" method, as GET generates an unwanted null message in our system. Is there… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=853) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=855)