# Latest **URL:** https://discuss.elastic.co/latest.md?page=1220 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1221 --- ## [Filebeat nginx dashboard kubernetes](https://discuss.elastic.co/t/filebeat-nginx-dashboard-kubernetes/299520)
**Author:** [@Mohsin\_Ijaz](https://discuss.elastic.co/u/Mohsin_Ijaz)\ **Replies:** 0\ **Last updated:** [March 12, 2022, 1:16pm UTC](https://discuss.elastic.co/t/filebeat-nginx-dashboard-kubernetes/299520 "2022-03-12T13:16:04Z")
Hi, I am new to ELK and IT field started as a devops recently so you can consider me being a complete noob. I am having trouble setting up the filebeat nginx dashboard. deployed the ELK on Kubernetes cluster, using th… --- ## [Question about the operator clientConfig caBundle of webhooks](https://discuss.elastic.co/t/question-about-the-operator-clientconfig-cabundle-of-webhooks/299114)
**Author:** [@Fares\_Oueslati](https://discuss.elastic.co/u/Fares_Oueslati)\ **Replies:** 2\ **Last updated:** [March 12, 2022, 10:41am UTC](https://discuss.elastic.co/t/question-about-the-operator-clientconfig-cabundle-of-webhooks/299114 "2022-03-12T10:41:25Z")
Hello! I'm trying to update a manifest of a ValidatingWebhookConfiguration deployed with our elastic operator. More precisely I want to update the caBundle field in the clientConfig webhooks. I can see that a dummy va… --- ## [Errors getting started with Kibana dev](https://discuss.elastic.co/t/errors-getting-started-with-kibana-dev/299335)
**Author:** [@drnw](https://discuss.elastic.co/u/drnw)\ **Replies:** 3\ **Last updated:** [March 12, 2022, 10:02am UTC](https://discuss.elastic.co/t/errors-getting-started-with-kibana-dev/299335 "2022-03-12T10:02:42Z")
I'm unsuccessful when following the guidance at Getting started | Kibana Guide \[master\] | Elastic I have tried with my MacBook and with a VM on Azure both end up with the same result. Kibana starts and visiting in the b… --- ## [Connect filebeat to ELK server from 2 different machines](https://discuss.elastic.co/t/connect-filebeat-to-elk-server-from-2-different-machines/298435)
**Author:** [@Dhia\_Saibi](https://discuss.elastic.co/u/Dhia_Saibi)\ **Replies:** 2\ **Last updated:** [March 12, 2022, 9:55am UTC](https://discuss.elastic.co/t/connect-filebeat-to-elk-server-from-2-different-machines/298435 "2022-03-12T09:55:34Z")
hi i'm asking how can i connect filebeat installed on one machine to ELK server on another machine..who can help me with this process? --- ## [Logstash filter loglevel info warn and error](https://discuss.elastic.co/t/logstash-filter-loglevel-info-warn-and-error/299306)
**Author:** [@waelboss](https://discuss.elastic.co/u/waelboss)\ **Replies:** 7\ **Last updated:** [March 12, 2022, 9:23am UTC](https://discuss.elastic.co/t/logstash-filter-loglevel-info-warn-and-error/299306 "2022-03-12T09:23:05Z")
i have this JSON data: "result": \[ { "payload": { "context": "default", "level": "DEBUG", "logger": "org.forgerock.opendj.ldap.CachedConnectionPool", "me… --- ## [Problems caused by creating replica shards too quickly](https://discuss.elastic.co/t/problems-caused-by-creating-replica-shards-too-quickly/299513)
**Author:** [@slowup](https://discuss.elastic.co/u/slowup)\ **Replies:** 0\ **Last updated:** [March 12, 2022, 7:07am UTC](https://discuss.elastic.co/t/problems-caused-by-creating-replica-shards-too-quickly/299513 "2022-03-12T07:07:29Z")
When we execute batch execution, if the primary shard is indexed, we are increasing the replica shard at that time, But at that time, the search engine creates replica shards, and as you can see from the metrix, a large … --- ## [Kibana error after upgrade to version 8.0 \[config validation of \[logging\].dest\]: definition for this key is missing\]](https://discuss.elastic.co/t/kibana-error-after-upgrade-to-version-8-0-config-validation-of-logging-dest-definition-for-this-key-is-missing/297948)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 3\ **Last updated:** [March 11, 2022, 11:03pm UTC](https://discuss.elastic.co/t/kibana-error-after-upgrade-to-version-8-0-config-validation-of-logging-dest-definition-for-this-key-is-missing/297948 "2022-03-11T23:03:26Z")
Hi, I had successfully upgraded to version 8.0 on ELK , while the rest of the stack works , kibana has failed to start citing dev-elk-app01 kibana\[19018\]: FATAL Error: \[config validation of \[logging\].dest\]: definitio… --- ## [Not able to create role mapping in kibana](https://discuss.elastic.co/t/not-able-to-create-role-mapping-in-kibana/299472)
**Author:** [@Amisha\_Thakkar1](https://discuss.elastic.co/u/Amisha_Thakkar1)\ **Replies:** 3\ **Last updated:** [March 11, 2022, 8:44pm UTC](https://discuss.elastic.co/t/not-able-to-create-role-mapping-in-kibana/299472 "2022-03-11T20:44:37Z")
I have assigned one user as superuser and I am trying to search for role mapping under stack management in Kibana. But I am not able to see that. Even I tried to assign role using role mapping api. Still not able to log… --- ## [Cleaning up datastreams' indexes](https://discuss.elastic.co/t/cleaning-up-datastreams-indexes/299499)
**Author:** [@hebph001](https://discuss.elastic.co/u/hebph001)\ **Replies:** 0\ **Last updated:** [March 11, 2022, 8:24pm UTC](https://discuss.elastic.co/t/cleaning-up-datastreams-indexes/299499 "2022-03-11T20:24:27Z")
Hi there Elastic community, I'm really new to Elastic and run into an architectural problem with my cloud cluster. I need to delete unneeded old indices to free up some memory. I would like to know what would be the be… --- ## [Elastic Search Failing on multi tier environment](https://discuss.elastic.co/t/elastic-search-failing-on-multi-tier-environment/299495)
**Author:** [@Ish\_Singh](https://discuss.elastic.co/u/Ish_Singh)\ **Replies:** 0\ **Last updated:** [March 11, 2022, 7:32pm UTC](https://discuss.elastic.co/t/elastic-search-failing-on-multi-tier-environment/299495 "2022-03-11T19:32:47Z")
Hi All , we currently have 2 servers for TFS and 1 server hosts the Elasticsearch but somehow the search keeps on failing while accessing and i see the error in developer tools.. i believe its trying to cluster between 2… --- ## [Search based on runtime boolean calculated from now](https://discuss.elastic.co/t/search-based-on-runtime-boolean-calculated-from-now/299488)
**Author:** [@MarkAllan](https://discuss.elastic.co/u/MarkAllan)\ **Replies:** 0\ **Last updated:** [March 11, 2022, 7:14pm UTC](https://discuss.elastic.co/t/search-based-on-runtime-boolean-calculated-from-now/299488 "2022-03-11T19:14:07Z")
I need to be able to search on a field that is not part of the stored document but is derived from a field on that document. The document field is a timestamp called expiry\_utc\_timestamp. I need to be able to filter on … --- ## [Need help with a NOT in if statement, is it "not" or "!"?](https://discuss.elastic.co/t/need-help-with-a-not-in-if-statement-is-it-not-or/299486)
**Author:** [@teebu](https://discuss.elastic.co/u/teebu)\ **Replies:** 1\ **Last updated:** [March 11, 2022, 6:58pm UTC](https://discuss.elastic.co/t/need-help-with-a-not-in-if-statement-is-it-not-or/299486 "2022-03-11T18:58:41Z")
\# filter out local ips if !(\[http\]\[request\]\[headers\]\[CF-Connecting-IP\] =~ "^10.0.\*" or \[http\]\[request\]\[headers\]\[CF-Connecting-IP\] =~ "^127.0.\*" or \[http\]\[request\]\[headers\]\[CF-Connecting-IP\] == "0.0.0.0") … --- ## [Metricbeat user privileges for data ingest?](https://discuss.elastic.co/t/metricbeat-user-privileges-for-data-ingest/299481)
**Author:** [@kmiklas](https://discuss.elastic.co/u/kmiklas)\ **Replies:** 1\ **Last updated:** [March 11, 2022, 6:08pm UTC](https://discuss.elastic.co/t/metricbeat-user-privileges-for-data-ingest/299481 "2022-03-11T18:08:05Z")
What are the privileges required for a metricbeat user to receive data? Under (Hamburger) -\> Stack Management -\> Security -\> Users, I've set up a metricbeat user. Its purpose is to receive metrics. What are its require… --- ## [Is the ELASTIC\_APM\_SERVICE\_VERSION displayed somewhere in Kibana?](https://discuss.elastic.co/t/is-the-elastic-apm-service-version-displayed-somewhere-in-kibana/299426)
**Author:** [@GreenEyed](https://discuss.elastic.co/u/GreenEyed)\ **Replies:** 2\ **Last updated:** [March 11, 2022, 5:32pm UTC](https://discuss.elastic.co/t/is-the-elastic-apm-service-version-displayed-somewhere-in-kibana/299426 "2022-03-11T17:32:34Z")
Hi there, I am moving some Java services to Openshift and I have already connected them to the APM with the agent. One of the properties that I'm passing is the ELASTIC\_APM\_SERVICE\_VERSION variable (via -Delastic.apm.se… --- ## [Saving documents in multiple indexes/Retention policy based on documents fields (Looking for ideas)](https://discuss.elastic.co/t/saving-documents-in-multiple-indexes-retention-policy-based-on-documents-fields-looking-for-ideas/299482)
**Author:** [@scott\_stash](https://discuss.elastic.co/u/scott_stash)\ **Replies:** 0\ **Last updated:** [March 11, 2022, 5:31pm UTC](https://discuss.elastic.co/t/saving-documents-in-multiple-indexes-retention-policy-based-on-documents-fields-looking-for-ideas/299482 "2022-03-11T17:31:23Z")
Using 7.17.. currently I read log files in with filebeat or filebeat/logstash saving in ES. Log lines are dissected and we have a field called loglevel, for ERROR, WARN and INFO. If the message is an ERROR a field call… --- ## [Elasticsearch 8.1 normalizer in strings error](https://discuss.elastic.co/t/elasticsearch-8-1-normalizer-in-strings-error/299476)
**Author:** [@willypol](https://discuss.elastic.co/u/willypol)\ **Replies:** 7\ **Last updated:** [March 11, 2022, 5:30pm UTC](https://discuss.elastic.co/t/elasticsearch-8-1-normalizer-in-strings-error/299476 "2022-03-11T17:30:17Z")
Hello, I've been using the next component template in elastic 7. I recently upgraded to elastic 8.1 and it won't let me create the template like before. PUT \_component\_template/keywords { "template": { "mappings":… --- ## [Snapshot - Register repository for Snapshot](https://discuss.elastic.co/t/snapshot-register-repository-for-snapshot/299388)
**Author:** [@Prabakar](https://discuss.elastic.co/u/Prabakar)\ **Replies:** 3\ **Last updated:** [March 11, 2022, 5:00pm UTC](https://discuss.elastic.co/t/snapshot-register-repository-for-snapshot/299388 "2022-03-11T17:00:51Z")
Hello Team, We are using Elastic on Kubernetes (ECK) with elastic Enterprise license. We have created on- premise elastic clusters. We are trying to create repository to take snapshots, but we are getting below error wh… --- ## [Installed logstash rpm, service keeps stopping with no clear reason](https://discuss.elastic.co/t/installed-logstash-rpm-service-keeps-stopping-with-no-clear-reason/299446)
**Author:** [@jelmew](https://discuss.elastic.co/u/jelmew)\ **Replies:** 2\ **Last updated:** [March 11, 2022, 4:56pm UTC](https://discuss.elastic.co/t/installed-logstash-rpm-service-keeps-stopping-with-no-clear-reason/299446 "2022-03-11T16:56:28Z")
Hi all, We are trying to setup logstash to connect to elastic cloud. We downloaded the rpm and installed it. But even without any configuration pointing to our elastic cloud instance, the service just stops with the mes… --- ## [Grok pattern for stashing Ansible logs](https://discuss.elastic.co/t/grok-pattern-for-stashing-ansible-logs/299227)
**Author:** [@santy1](https://discuss.elastic.co/u/santy1)\ **Replies:** 6\ **Last updated:** [March 11, 2022, 4:06pm UTC](https://discuss.elastic.co/t/grok-pattern-for-stashing-ansible-logs/299227 "2022-03-11T16:06:57Z")
Hello, I am new to Elasticsearch. I am on Elasticsearch 7.17.1. Below are the logs that I am trying to parse. 2022-03-08 14:52:50,672 p=1654827 u=ansible n=ansible | TASK \[lvm : Formatting xfs filesystem\] \*\* 2022-03-… --- ## [How to read group by buckets key values using "ctx" from below query](https://discuss.elastic.co/t/how-to-read-group-by-buckets-key-values-using-ctx-from-below-query/299383)
**Author:** [@srinivasa\_adaboina](https://discuss.elastic.co/u/srinivasa_adaboina)\ **Replies:** 2\ **Last updated:** [March 11, 2022, 4:23pm UTC](https://discuss.elastic.co/t/how-to-read-group-by-buckets-key-values-using-ctx-from-below-query/299383 "2022-03-11T16:23:48Z")
{ "\_shards": { "total": 155, "failed": 0, "successful": 155, "skipped": 0 }, "hits": { "hits": , "total": { "value": 5535, "relation": "eq" }, "max\_score": null }, "took": 44, "timed\_out": false, "aggreg… --- ## [Logstash crashes when kafka producer sends less fields than excepted](https://discuss.elastic.co/t/logstash-crashes-when-kafka-producer-sends-less-fields-than-excepted/299475)
**Author:** [@guriv](https://discuss.elastic.co/u/guriv)\ **Replies:** 0\ **Last updated:** [March 11, 2022, 3:48pm UTC](https://discuss.elastic.co/t/logstash-crashes-when-kafka-producer-sends-less-fields-than-excepted/299475 "2022-03-11T15:48:15Z")
Hello we are using logstash-kafka-integration plugin to read messages from a kafka topic using avro encoding If my logstash consumer refers to a schema registry file that defines 2 optional fields but receive a message… --- ## [Turn off sending time range filter when using drilldown](https://discuss.elastic.co/t/turn-off-sending-time-range-filter-when-using-drilldown/298632)
**Author:** [@Rick\_V](https://discuss.elastic.co/u/Rick_V)\ **Replies:** 2\ **Last updated:** [March 11, 2022, 3:58pm UTC](https://discuss.elastic.co/t/turn-off-sending-time-range-filter-when-using-drilldown/298632 "2022-03-11T15:58:27Z")
Hi, I'm using drilldowns in dashboards to give a deeper detail into the visualization. I use several visualizations like line and area graph to give an insight over time like the derivative. However when i click on a do… --- ## [Release notes link](https://discuss.elastic.co/t/release-notes-link/299425)
**Author:** [@tunichgud](https://discuss.elastic.co/u/tunichgud)\ **Replies:** 1\ **Last updated:** [March 11, 2022, 3:48pm UTC](https://discuss.elastic.co/t/release-notes-link/299425 "2022-03-11T15:48:34Z")
Hi, the release notes link at GitHub - elastic/apm-agent-java: Elastic APM Java Agent is currently pointing to a page with a 404. I realized, there is another post from 2018 mentioning the same issue, but it was closed. … --- ## [Fleet Server Fails At Start, No Reason Given](https://discuss.elastic.co/t/fleet-server-fails-at-start-no-reason-given/298854)
**Author:** [@CptElasticBand](https://discuss.elastic.co/u/CptElasticBand)\ **Replies:** 1\ **Last updated:** [March 11, 2022, 3:45pm UTC](https://discuss.elastic.co/t/fleet-server-fails-at-start-no-reason-given/298854 "2022-03-11T15:45:55Z")
Hello. I've been looking around to see if anyone else has experienced a similar issue but I haven't found anything. I've setup an Elasticsearch cluster and Kibana all using SSL certificates created following the Elastic … --- ## [Hashicorp's Nomad monitoring using metricbeat](https://discuss.elastic.co/t/hashicorps-nomad-monitoring-using-metricbeat/299162)
**Author:** [@Uzmasaman\_Chanderki](https://discuss.elastic.co/u/Uzmasaman_Chanderki)\ **Replies:** 1\ **Last updated:** [March 11, 2022, 2:43pm UTC](https://discuss.elastic.co/t/hashicorps-nomad-monitoring-using-metricbeat/299162 "2022-03-11T14:43:50Z")
I am new to this community and my resources are exhausted. I am trying to implement monitoring on Hashicorp's Nomad using metricbeat but there is no metricbeat.module available for now. Is there any alternative where t… --- ## [How to get and create users using the Kibana API](https://discuss.elastic.co/t/how-to-get-and-create-users-using-the-kibana-api/299408)
**Author:** [@Amphagory](https://discuss.elastic.co/u/Amphagory)\ **Replies:** 2\ **Last updated:** [March 11, 2022, 2:25pm UTC](https://discuss.elastic.co/t/how-to-get-and-create-users-using-the-kibana-api/299408 "2022-03-11T14:25:20Z")
Hello, I'm using the Elastic cloud service and the version I'm using is 7.16.2 I'm trying to get and create users from the following documentation using Postman and a Python script, GET user: Get users API | Elasti… --- ## [TimeValue error on XContentBuilder](https://discuss.elastic.co/t/timevalue-error-on-xcontentbuilder/299012)
**Author:** [@dancerjohn](https://discuss.elastic.co/u/dancerjohn)\ **Replies:** 7\ **Last updated:** [March 11, 2022, 2:14pm UTC](https://discuss.elastic.co/t/timevalue-error-on-xcontentbuilder/299012 "2022-03-11T14:14:47Z")
Getting IllegalArgumentException ("cannot write xcontent for unknown value of type TimeValue") even though org.Elasticsearch.common.unit.TimeValue is an elastic class and is used in org.Elasticsearch.search.builder.Point… --- ## [Create new file every 60seconds in Logstash CSV output](https://discuss.elastic.co/t/create-new-file-every-60seconds-in-logstash-csv-output/299380)
**Author:** [@gnam](https://discuss.elastic.co/u/gnam)\ **Replies:** 2\ **Last updated:** [March 11, 2022, 2:01pm UTC](https://discuss.elastic.co/t/create-new-file-every-60seconds-in-logstash-csv-output/299380 "2022-03-11T14:01:31Z")
I have following filter configuration in my logstatsh pipeline. What it does is, at the start of the event first filter creates a CSV file with header and sets the file name to metadata. Second filter writes the output … --- ## [Use of ELK to implement AI Algorithm](https://discuss.elastic.co/t/use-of-elk-to-implement-ai-algorithm/299235)
**Author:** [@bechir-jamoussi](https://discuss.elastic.co/u/bechir-jamoussi)\ **Replies:** 2\ **Last updated:** [March 11, 2022, 2:01pm UTC](https://discuss.elastic.co/t/use-of-elk-to-implement-ai-algorithm/299235 "2022-03-11T14:01:14Z")
Dear Community, I want to use only Beats + Logstash (for collecting and processing the data) and Elasticsearch(as a database) and then based on that data, I need to use AI to make a decision, it is not log analysis or a… --- ## [Filebeat Zeek module not reading all events with -once option](https://discuss.elastic.co/t/filebeat-zeek-module-not-reading-all-events-with-once-option/299459)
**Author:** [@dlohin](https://discuss.elastic.co/u/dlohin)\ **Replies:** 2\ **Last updated:** [March 11, 2022, 1:50pm UTC](https://discuss.elastic.co/t/filebeat-zeek-module-not-reading-all-events-with-once-option/299459 "2022-03-11T13:50:15Z")
I am using Filebeat 8.0.1 inside of a container and trying to utilize it to read through a bunch of Zeek logs formatted in JSON and ending the process when finished. Ending nicely with an error code is critical because … [Previous page](https://discuss.elastic.co/latest.md?page=1219) [Next page](https://discuss.elastic.co/latest.md?page=1221)