# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=932 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 933 --- ## [Filtered Logstash for desired part](https://discuss.elastic.co/t/filtered-logstash-for-desired-part/305142)
**Author:** [@Zerra\_Triani](https://discuss.elastic.co/u/Zerra_Triani)\ **Replies:** 2\ **Last updated:** [May 20, 2022, 7:55am UTC](https://discuss.elastic.co/t/filtered-logstash-for-desired-part/305142 "2022-05-20T07:55:24Z")
0 I have a log, and I only want to retrieve the ones I have marked in red boxes. I've tried putting it in Elasticsearch but it inserts it every row in that log. How do you take the data that I have marked and combine it… --- ## [Logstash with 'ecs-compatibility' unable to accept particular CEF Extension field](https://discuss.elastic.co/t/logstash-with-ecs-compatibility-unable-to-accept-particular-cef-extension-field/305246)
**Author:** [@wii](https://discuss.elastic.co/u/wii)\ **Replies:** 2\ **Last updated:** [May 20, 2022, 7:38am UTC](https://discuss.elastic.co/t/logstash-with-ecs-compatibility-unable-to-accept-particular-cef-extension-field/305246 "2022-05-20T07:38:57Z")
Hi, I am still new with Elastic Stack. I have a problem with Logstash configuration which I have found no answer to for days. I have two Logstash configuration, 'ecs.conf' and 'cef.conf'. These two configs are created fo… --- ## [Canvas - Use control in a reusable element](https://discuss.elastic.co/t/canvas-use-control-in-a-reusable-element/304800)
**Author:** [@Rick\_V](https://discuss.elastic.co/u/Rick_V)\ **Replies:** 2\ **Last updated:** [May 20, 2022, 7:26am UTC](https://discuss.elastic.co/t/canvas-use-control-in-a-reusable-element/304800 "2022-05-20T07:26:06Z")
My Canvas consists of a single block of metrics which is placed multiple times on the canvas. I want to be able to add a blocks so I made an element (which is shown in the picture) out of it to be able to add them easily… --- ## [Negative time shift for moving average?](https://discuss.elastic.co/t/negative-time-shift-for-moving-average/305073)
**Author:** [@rusLukasRath](https://discuss.elastic.co/u/rusLukasRath)\ **Replies:** 3\ **Last updated:** [May 20, 2022, 7:07am UTC](https://discuss.elastic.co/t/negative-time-shift-for-moving-average/305073 "2022-05-20T07:07:04Z")
Hello together, I'm having a little problem with one of the panels I have created. On this panel I am showing a line with an daily availability percentage (green line). Additionally I have created an moving average (bl… --- ## [Plug in kibana](https://discuss.elastic.co/t/plug-in-kibana/304808)
**Author:** [@meyer1](https://discuss.elastic.co/u/meyer1)\ **Replies:** 3\ **Last updated:** [May 20, 2022, 7:05am UTC](https://discuss.elastic.co/t/plug-in-kibana/304808 "2022-05-20T07:05:28Z")
Hello everyone ! I need help, I would like someone to explain to me step by step how to install a plugin for sankey visualization Thank you to the future person who will help me! --- ## [Unassigned shards/indexes](https://discuss.elastic.co/t/unassigned-shards-indexes/305159)
**Author:** [@Jan\_Engelbrecht](https://discuss.elastic.co/u/Jan_Engelbrecht)\ **Replies:** 3\ **Last updated:** [May 20, 2022, 6:55am UTC](https://discuss.elastic.co/t/unassigned-shards-indexes/305159 "2022-05-20T06:55:43Z")
Hi, I'm quite new to Elastic, we're running 7.15.1 (Centos 7)on our production servers. We have 3 nodes currently and the following happened when I added a 4th one. After the 4th Node joined the cluster replication st… --- ## [LDAP Authentication Case Sensitive](https://discuss.elastic.co/t/ldap-authentication-case-sensitive/305224)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 2\ **Last updated:** [May 20, 2022, 6:50am UTC](https://discuss.elastic.co/t/ldap-authentication-case-sensitive/305224 "2022-05-20T06:50:35Z")
I've recently enabled LDAP authentication and used the Kibana GUI to configure role mappings. Unfortunately, it appears usernames are case sensitive. So if I enter a role mapping for user example123, and the user enter… --- ## [Failure to backup ElasticSearch Using Velero](https://discuss.elastic.co/t/failure-to-backup-elasticsearch-using-velero/305212)
**Author:** [@decipher27](https://discuss.elastic.co/u/decipher27)\ **Replies:** 3\ **Last updated:** [May 20, 2022, 6:24am UTC](https://discuss.elastic.co/t/failure-to-backup-elasticsearch-using-velero/305212 "2022-05-20T06:24:42Z")
Hi Folks! We are running Elasticsearch cluster on our EKS cluster and using Velero to backup Elasticsearch. Elasticsearch version: 7.16.2 Number of ES Nodes: 3 We noticed that Velero partially fails to fetch the inde… --- ## [Create ssl certs and place them inside elasticsearch yml](https://discuss.elastic.co/t/create-ssl-certs-and-place-them-inside-elasticsearch-yml/305204)
**Author:** [@Nikos\_Kostis](https://discuss.elastic.co/u/Nikos_Kostis)\ **Replies:** 0\ **Last updated:** [May 19, 2022, 2:50pm UTC](https://discuss.elastic.co/t/create-ssl-certs-and-place-them-inside-elasticsearch-yml/305204 "2022-05-19T14:50:52Z")
Hi I have created an es cluster inside an existing k8s cluster. Cluster is up but when i try login initially to the page of kibana it asks for the "enrolment token" that i have to create with ... --scope kibana. For t… --- ## [Metricbeat-credential alternatives](https://discuss.elastic.co/t/metricbeat-credential-alternatives/305255)
**Author:** [@sadik](https://discuss.elastic.co/u/sadik)\ **Replies:** 0\ **Last updated:** [May 20, 2022, 6:16am UTC](https://discuss.elastic.co/t/metricbeat-credential-alternatives/305255 "2022-05-20T06:16:53Z")
Hi Team, In "metricbeat.modules:" session we are using the "AWS\_ACCESS\_KEY\_ID" and "AWS\_SECRET\_ACCESS\_KEY" to estrablish the connection from AWS module(metricset:"lambda") to connecting to kubernetes cluster and getti… --- ## [Help needed with ingesting custom log data](https://discuss.elastic.co/t/help-needed-with-ingesting-custom-log-data/305075)
**Author:** [@Sakis](https://discuss.elastic.co/u/Sakis)\ **Replies:** 1\ **Last updated:** [May 20, 2022, 5:15am UTC](https://discuss.elastic.co/t/help-needed-with-ingesting-custom-log-data/305075 "2022-05-20T05:15:14Z")
Hey there! I'm new to Elastic Stack (currently using the 14-day cloud trial) and I have a few questions about parsing log data. I work at an web development company and we provide customers with shop systems from Shopwa… --- ## [Elasticsearch - nested field with geo\_point type returns unsupported symbol in search](https://discuss.elastic.co/t/elasticsearch-nested-field-with-geo-point-type-returns-unsupported-symbol-in-search/304415)
**Author:** [@Pazhaniyappan](https://discuss.elastic.co/u/Pazhaniyappan)\ **Replies:** 7\ **Last updated:** [May 20, 2022, 5:14am UTC](https://discuss.elastic.co/t/elasticsearch-nested-field-with-geo-point-type-returns-unsupported-symbol-in-search/304415 "2022-05-20T05:14:13Z")
Mapping for the index: PUT /my\_locations { "mappings": { "properties": { "pin": { "type":"nested", "properties": { "location": { "type": "geo\_point" } … --- ## [Local Login and Active Directory Login](https://discuss.elastic.co/t/local-login-and-active-directory-login/304844)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 5\ **Last updated:** [May 20, 2022, 4:43am UTC](https://discuss.elastic.co/t/local-login-and-active-directory-login/304844 "2022-05-20T04:43:35Z")
I've recently activated gold licensing for our Elasticsearch 7.16.1 instance. I'm trying to implement Active Directory authentication. I've successfully added the needed configuration for Elasticsearch, but when I add … --- ## [I want to send this log in json without logstash](https://discuss.elastic.co/t/i-want-to-send-this-log-in-json-without-logstash/305188)
**Author:** [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\ **Replies:** 5\ **Last updated:** [May 20, 2022, 4:27am UTC](https://discuss.elastic.co/t/i-want-to-send-this-log-in-json-without-logstash/305188 "2022-05-20T04:27:59Z")
Hello Everyone I have following log sample data I want send this log as json in Elasticsearch without using logstash any one having Idea ? sample logs "TableName": "CouponProducts","SchemaName": "dbo","RowCounts": … --- ## [How to set the Time Zone in filebeat logstash and apm config](https://discuss.elastic.co/t/how-to-set-the-time-zone-in-filebeat-logstash-and-apm-config/305251)
**Author:** [@zhanghao116560](https://discuss.elastic.co/u/zhanghao116560)\ **Replies:** 1\ **Last updated:** [May 20, 2022, 4:22am UTC](https://discuss.elastic.co/t/how-to-set-the-time-zone-in-filebeat-logstash-and-apm-config/305251 "2022-05-20T04:22:19Z")
hi all: How to Set the Time Zone in filebeat, logstash, apm config file like '%{+yyyy.MM.dd}' like that I want to set the time zone for '%{+yyyy.MM.dd}' index: "apm-%{\[observer.version\]}-%{+yyyy.MM.dd}" indices: … --- ## [Why should I add integrations in Kibana when there are indices in the relative Elastic search](https://discuss.elastic.co/t/why-should-i-add-integrations-in-kibana-when-there-are-indices-in-the-relative-elastic-search/304231)
**Author:** [@phantomsee](https://discuss.elastic.co/u/phantomsee)\ **Replies:** 2\ **Last updated:** [May 20, 2022, 2:39am UTC](https://discuss.elastic.co/t/why-should-i-add-integrations-in-kibana-when-there-are-indices-in-the-relative-elastic-search/304231 "2022-05-20T02:39:12Z")
I've already have some java log data in my Elasticsearch. But when I open Kibana, it tells me to add integrations first. I'm confused. --- ## [Netflow fields not showing in Discovery](https://discuss.elastic.co/t/netflow-fields-not-showing-in-discovery/305234)
**Author:** [@PraveenKT](https://discuss.elastic.co/u/PraveenKT)\ **Replies:** 3\ **Last updated:** [May 20, 2022, 2:37am UTC](https://discuss.elastic.co/t/netflow-fields-not-showing-in-discovery/305234 "2022-05-20T02:37:18Z")
Filebeat 8.2 is using. I am unable to see the netflow fields in the Discovery. But i am seeeing in "data views". What is the reason? --- ## [Filebeat run at startup](https://discuss.elastic.co/t/filebeat-run-at-startup/304802)
**Author:** [@Bigboy0706](https://discuss.elastic.co/u/Bigboy0706)\ **Replies:** 5\ **Last updated:** [May 20, 2022, 1:52am UTC](https://discuss.elastic.co/t/filebeat-run-at-startup/304802 "2022-05-20T01:52:20Z")
Hi, I am trying to set up a Filebeat to collect the MacOS endpoint logs. May I know any command or general setting I could set to autostart the Filebeat after rebooting the MacOS? Thanks. Best Regards, Leo Yeung --- ## [Filebeat modules Threatintel "Exiting: module threatintel is configured but has no enabled filesets"](https://discuss.elastic.co/t/filebeat-modules-threatintel-exiting-module-threatintel-is-configured-but-has-no-enabled-filesets/304100)
**Author:** [@Silver137](https://discuss.elastic.co/u/Silver137)\ **Replies:** 5\ **Last updated:** [May 20, 2022, 12:47am UTC](https://discuss.elastic.co/t/filebeat-modules-threatintel-exiting-module-threatintel-is-configured-but-has-no-enabled-filesets/304100 "2022-05-20T00:47:25Z")
I'm trying to activate the threatintel filebeat module for mining some data of otx alienvault, my module configuration looks like: - module: threatintel otx: enabled: true var.input: httpjson var.url: http… --- ## [\_update\_by\_query for non-refreshed documents](https://discuss.elastic.co/t/update-by-query-for-non-refreshed-documents/305210)
**Author:** [@grzyboo](https://discuss.elastic.co/u/grzyboo)\ **Replies:** 1\ **Last updated:** [May 19, 2022, 11:49pm UTC](https://discuss.elastic.co/t/update-by-query-for-non-refreshed-documents/305210 "2022-05-19T23:49:38Z")
Hi! I have an index products. What I need is to update categoryDisplayName for all products with given categoryName. Whenever my application gets an event to update categoryName the app saves it and fills it into newly … --- ## [ElasticSearch keeps restarting in kubernetes](https://discuss.elastic.co/t/elasticsearch-keeps-restarting-in-kubernetes/305148)
**Author:** [@EngineerDollery](https://discuss.elastic.co/u/EngineerDollery)\ **Replies:** 1\ **Last updated:** [May 19, 2022, 11:10pm UTC](https://discuss.elastic.co/t/elasticsearch-keeps-restarting-in-kubernetes/305148 "2022-05-19T23:10:39Z")
Elasticsearch keeps restarting, despite being in a ready state. I've installed it using the official Elasticsearch chart, with default settings. I raised this question on the chart's github project and have been redirect… --- ## [How to take backup from snapshot repositories and policies?](https://discuss.elastic.co/t/how-to-take-backup-from-snapshot-repositories-and-policies/305028)
**Author:** [@Siavash\_Fazli](https://discuss.elastic.co/u/Siavash_Fazli)\ **Replies:** 1\ **Last updated:** [May 19, 2022, 11:09pm UTC](https://discuss.elastic.co/t/how-to-take-backup-from-snapshot-repositories-and-policies/305028 "2022-05-19T23:09:24Z")
Hi guys, is there any way to save snapshot repositories and policies?? when I run a new ELK stack I should insert snapshot repositories and policies manually. My question is a little funny :smile: : How to create a … --- ## [Cross Cluster Search - port 9300 - need to open flow in bidirectional way](https://discuss.elastic.co/t/cross-cluster-search-port-9300-need-to-open-flow-in-bidirectional-way/305168)
**Author:** [@federica.forti](https://discuss.elastic.co/u/federica.forti)\ **Replies:** 3\ **Last updated:** [May 19, 2022, 11:03pm UTC](https://discuss.elastic.co/t/cross-cluster-search-port-9300-need-to-open-flow-in-bidirectional-way/305168 "2022-05-19T23:03:02Z")
Hi, i'd like to use Cross Cluster Search between two clusters (ES version: 5.6). For example i'd like to see data from cluster A to cluster B; I'd like to know if there is the need to open the flow in bidirectional way… --- ## [Filter Indices Syntax in ILM policy](https://discuss.elastic.co/t/filter-indices-syntax-in-ilm-policy/305020)
**Author:** [@Siavash\_Fazli](https://discuss.elastic.co/u/Siavash_Fazli)\ **Replies:** 1\ **Last updated:** [May 19, 2022, 10:54pm UTC](https://discuss.elastic.co/t/filter-indices-syntax-in-ilm-policy/305020 "2022-05-19T22:54:00Z")
Hi all, I defined some policies to take snapshots in time intervals, now I need to create a policy that takes a snapshot from all indices except selected indices in previous policies, for example, this is my policy: P… --- ## [Elastic Maximum Amount of Date Fields in an Index](https://discuss.elastic.co/t/elastic-maximum-amount-of-date-fields-in-an-index/305181)
**Author:** [@rmarchman](https://discuss.elastic.co/u/rmarchman)\ **Replies:** 2\ **Last updated:** [May 19, 2022, 10:52pm UTC](https://discuss.elastic.co/t/elastic-maximum-amount-of-date-fields-in-an-index/305181 "2022-05-19T22:52:31Z")
Hi, I am looking for assistance regarding date fields in Elastic. I have a CSV file with 5 separate date columns, all formatted as ISO 8601 dates. After importing the file into Kibana, only the first 2 date columns were… --- ## [Is a rolling update to enable security possible?](https://discuss.elastic.co/t/is-a-rolling-update-to-enable-security-possible/305001)
**Author:** [@erik\_n](https://discuss.elastic.co/u/erik_n)\ **Replies:** 5\ **Last updated:** [May 19, 2022, 10:47pm UTC](https://discuss.elastic.co/t/is-a-rolling-update-to-enable-security-possible/305001 "2022-05-19T22:47:33Z")
I'm nearly positive the answer is "no", but I wanted to ask! I have several clusters currently at v7.17 that do not have authentication/tls/etc enabled. I would like to enable it, for obvious reasons, but they cannot be… --- ## [Parsing date in logstsh](https://discuss.elastic.co/t/parsing-date-in-logstsh/305118)
**Author:** [@jaikunwar](https://discuss.elastic.co/u/jaikunwar)\ **Replies:** 3\ **Last updated:** [May 19, 2022, 7:40pm UTC](https://discuss.elastic.co/t/parsing-date-in-logstsh/305118 "2022-05-19T19:40:39Z")
Hi team, I havee csv file with following data: name,age,gender,country,logtime John,34,male,China,2019-05-12 08:10 Basil,43,male,Taiwan,2020-05-13 8:10 Bella,25,female,USA,2018-05-14 8:10 I am using date parser as: … --- ## [Elastic Cloud](https://discuss.elastic.co/t/elastic-cloud/305213)
**Author:** [@SebastianMrtnz](https://discuss.elastic.co/u/SebastianMrtnz)\ **Replies:** 3\ **Last updated:** [May 19, 2022, 7:11pm UTC](https://discuss.elastic.co/t/elastic-cloud/305213 "2022-05-19T19:11:23Z")
Hello there! I'm new a this forum and I want to learn which is the best approach to set up a new Elastic stack for my Azure subscription. I chose to create my ES from cloud.elastic.co using Azure Single Sign-On (SSO). … --- ## [Logstash error](https://discuss.elastic.co/t/logstash-error/305217)
**Author:** [@Naga\_Prudhvi](https://discuss.elastic.co/u/Naga_Prudhvi)\ **Replies:** 1\ **Last updated:** [May 19, 2022, 6:52pm UTC](https://discuss.elastic.co/t/logstash-error/305217 "2022-05-19T18:52:34Z")
I am getting below error, while loading data into old index. \[2022-05-19T23:38:51,354\]\[ERROR\]\[logstash.filters.ruby \]\[main\]\[0c9121c6ce91a23303b26f6c1387d90c28a872d644b33037968422ec670a60c1\] Ruby exception occurred: u… --- ## [Idempotency elastic search when use dot net core with CreateIndexDescriptor](https://discuss.elastic.co/t/idempotency-elastic-search-when-use-dot-net-core-with-createindexdescriptor/305225)
**Author:** [@Mahmood\_Palangi](https://discuss.elastic.co/u/Mahmood_Palangi)\ **Replies:** 0\ **Last updated:** [May 19, 2022, 6:49pm UTC](https://discuss.elastic.co/t/idempotency-elastic-search-when-use-dot-net-core-with-createindexdescriptor/305225 "2022-05-19T18:49:31Z")
Elasticsearch 8.1.3: NEST 7.17.2: we have a rest api for persist and index data in Elasticsearch db and we want if Index don't exist create index but don't use automap() for mapping and setting because we use char filt… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=931) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=933)