# Latest **URL:** https://discuss.elastic.co/latest.md?page=1418 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1419 --- ## [Customize graphs in canvas](https://discuss.elastic.co/t/customize-graphs-in-canvas/285614)
**Author:** [@Mira\_9](https://discuss.elastic.co/u/Mira_9)\ **Replies:** 1\ **Last updated:** [October 25, 2021, 6:59pm UTC](https://discuss.elastic.co/t/customize-graphs-in-canvas/285614 "2021-10-25T18:59:33Z")
Hi , i'm wondering if i can add some changes in my graph's y-axis before being displayed ( i want to set a subtraction ( 100 - value Y) how is that possible? . Another thing i want to skip the "NULL" how can i delete it … --- ## [Filebeat setup dont load because kibana version](https://discuss.elastic.co/t/filebeat-setup-dont-load-because-kibana-version/285712)
**Author:** [@Francisca\_Olave](https://discuss.elastic.co/u/Francisca_Olave)\ **Replies:** 0\ **Last updated:** [October 1, 2021, 7:24pm UTC](https://discuss.elastic.co/t/filebeat-setup-dont-load-because-kibana-version/285712 "2021-10-01T19:24:30Z")
Hi, I have a single node server with a basic license in ELK and I want to monitor a machine with filebeat but the following error appears: # filebeat setup Overwriting ILM policy is disabled. Set \`setup.ilm.overwrite: … --- ## [SIEM Detection Alert during kibana downtime](https://discuss.elastic.co/t/siem-detection-alert-during-kibana-downtime/286007)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 0\ **Last updated:** [October 6, 2021, 10:19am UTC](https://discuss.elastic.co/t/siem-detection-alert-during-kibana-downtime/286007 "2021-10-06T10:19:16Z")
Hi, Is there any work around to overcome the missing detection alert during the kibana downtime if its more than the alert loobback time? Thanks --- ## [Installation aborted, plugin 'logstash-input-jdbc' is already provided by 'logstash-integration-jdbc'](https://discuss.elastic.co/t/installation-aborted-plugin-logstash-input-jdbc-is-already-provided-by-logstash-integration-jdbc/287562)
**Author:** [@Kumar\_Reddy](https://discuss.elastic.co/u/Kumar_Reddy)\ **Replies:** 4\ **Last updated:** [October 25, 2021, 6:17pm UTC](https://discuss.elastic.co/t/installation-aborted-plugin-logstash-input-jdbc-is-already-provided-by-logstash-integration-jdbc/287562 "2021-10-25T18:17:45Z")
I am facing this issue when i try to run command from docker-compose.yml file. version: '3.7' services: Elasticsearch: image: docker.elastic.co/elasticsearch/elasticsearch:7.15.1 ports: - '9200:9200' environment: … --- ## [Authentication issue between kafka(OpenShift Operator deployed) and Logstash](https://discuss.elastic.co/t/authentication-issue-between-kafka-openshift-operator-deployed-and-logstash/287614)
**Author:** [@karanjit.rai](https://discuss.elastic.co/u/karanjit.rai)\ **Replies:** 0\ **Last updated:** [October 25, 2021, 6:02pm UTC](https://discuss.elastic.co/t/authentication-issue-between-kafka-openshift-operator-deployed-and-logstash/287614 "2021-10-25T18:02:47Z")
Hello, I have installed Kafka through the OpenShift operator and now I am trying to connect it to Logstash (running in a OpenShift cluster). I do not see anyway to connect through authentication between the two or where… --- ## [Physically Moving Indices To New Drive](https://discuss.elastic.co/t/physically-moving-indices-to-new-drive/287611)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 1\ **Last updated:** [October 25, 2021, 5:46pm UTC](https://discuss.elastic.co/t/physically-moving-indices-to-new-drive/287611 "2021-10-25T17:46:02Z")
I have a need to move where indices are stored to a new drive. How do I go about migrating to the new drive? Change Elasticsearch.yml to the new drive and then reindex all the existing data? I'd hate to do that with t… --- ## [Logstash JDBC output](https://discuss.elastic.co/t/logstash-jdbc-output/287605)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 1\ **Last updated:** [October 25, 2021, 5:44pm UTC](https://discuss.elastic.co/t/logstash-jdbc-output/287605 "2021-10-25T17:44:32Z")
Do we have the JDBC output plugin in logstash to write to the database? --- ## [RUM dashboard showing same data for all environments](https://discuss.elastic.co/t/rum-dashboard-showing-same-data-for-all-environments/285768)
**Author:** [@sonowaan](https://discuss.elastic.co/u/sonowaan)\ **Replies:** 1\ **Last updated:** [October 25, 2021, 5:27pm UTC](https://discuss.elastic.co/t/rum-dashboard-showing-same-data-for-all-environments/285768 "2021-10-25T17:27:16Z")
Hello, I've setup RUM agent in Rails application and data is correctly getting to Kibana. I can see updates on the User Experience dashboard as activities happen in the application. I'm using the same APM server for mult… --- ## [Kibana watcher : Send message field in if log level is ERROR](https://discuss.elastic.co/t/kibana-watcher-send-message-field-in-if-log-level-is-error/286529)
**Author:** [@Chandrakant\_Naik](https://discuss.elastic.co/u/Chandrakant_Naik)\ **Replies:** 1\ **Last updated:** [October 25, 2021, 5:04pm UTC](https://discuss.elastic.co/t/kibana-watcher-send-message-field-in-if-log-level-is-error/286529 "2021-10-25T17:04:31Z")
i have configure watcher in kibana to notify me via email if there are ERROR in log level. for couple indices. input": { "search": { "request": { "search\_type": "query\_then\_fetch", "indices": \[ "xxxx.-\*" \], "types": \[\],… --- ## [Logstash exits after successfully installing plugin with docker-compose exited with code 0](https://discuss.elastic.co/t/logstash-exits-after-successfully-installing-plugin-with-docker-compose-exited-with-code-0/287607)
**Author:** [@Kumar\_Reddy](https://discuss.elastic.co/u/Kumar_Reddy)\ **Replies:** 0\ **Last updated:** [October 25, 2021, 4:43pm UTC](https://discuss.elastic.co/t/logstash-exits-after-successfully-installing-plugin-with-docker-compose-exited-with-code-0/287607 "2021-10-25T16:43:43Z")
I am trying to run an Elastic stack and I am trying to install a logstash plugin within the docker compose file. I am getting the message that the plugin is installed successful and right after that the container exits w… --- ## [Elasticsearch Postgresql Module Ingest Pipeline Not Parsing Postgresql 10](https://discuss.elastic.co/t/elasticsearch-postgresql-module-ingest-pipeline-not-parsing-postgresql-10/287604)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 0\ **Last updated:** [October 25, 2021, 4:09pm UTC](https://discuss.elastic.co/t/elasticsearch-postgresql-module-ingest-pipeline-not-parsing-postgresql-10/287604 "2021-10-25T16:09:02Z")
Elasticsearch ingest pipeline for postgresql module doesn't appear to parse postgresql 10 logs. This is with filebeat-7.15.0 and associated ingest pipelines under elasticsearch-7.14.1. We're using Postgresql 10. The fol… --- ## [APM nodejs agent Errors not Showing in Kibana](https://discuss.elastic.co/t/apm-nodejs-agent-errors-not-showing-in-kibana/287332)
**Author:** [@vamshi31](https://discuss.elastic.co/u/vamshi31)\ **Replies:** 4\ **Last updated:** [October 25, 2021, 4:04pm UTC](https://discuss.elastic.co/t/apm-nodejs-agent-errors-not-showing-in-kibana/287332 "2021-10-25T16:04:51Z")
// Add this to the VERY top of the first file loaded in your app var apm = require('elastic-apm-node').start({ // Override service name from package.json // Allowed characters: a-z, A-Z, 0-9, -, \_, and space serviceN… --- ## [Пагинация и производительность](https://discuss.elastic.co/t/topic/287329)
**Author:** [@korvin](https://discuss.elastic.co/u/korvin)\ **Replies:** 3\ **Last updated:** [October 25, 2021, 4:03pm UTC](https://discuss.elastic.co/t/topic/287329 "2021-10-25T16:03:39Z")
Добрый день есть тестовый индекс на 5 млн документов требуется пагинация. Причем хочется именно все 5 млн разбить на страницы. В документации рекомендуют избегать пагинации т.к. это большая нагрузка особенно если кластер… --- ## [Possible to Script Values in Synthetics?](https://discuss.elastic.co/t/possible-to-script-values-in-synthetics/287602)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 2\ **Last updated:** [October 25, 2021, 4:02pm UTC](https://discuss.elastic.co/t/possible-to-script-values-in-synthetics/287602 "2021-10-25T16:02:30Z")
Hi All, I have a use case where I want to use synthetics to monitor a page, however this page has a URL which requires it to be updated daily with the days date. Kind of like: http://url/\. Since… --- ## [Elasticsearch high level java client mock test](https://discuss.elastic.co/t/elasticsearch-high-level-java-client-mock-test/287571)
**Author:** [@111505](https://discuss.elastic.co/u/111505)\ **Replies:** 1\ **Last updated:** [October 25, 2021, 3:39pm UTC](https://discuss.elastic.co/t/elasticsearch-high-level-java-client-mock-test/287571 "2021-10-25T15:39:41Z")
I am using a RestHighlevelclient in the Spring Boot environment. I want to create a JUnit Test Code, but I can not find a way. Is there no test method to officially provide? I want to test the normal operation of basi… --- ## [Term query wrong behaviour?](https://discuss.elastic.co/t/term-query-wrong-behaviour/287530)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 4\ **Last updated:** [October 25, 2021, 3:11pm UTC](https://discuss.elastic.co/t/term-query-wrong-behaviour/287530 "2021-10-25T15:11:12Z")
Hi, according to the documentation a term query search for the exact match. but when I do the below search I get results and when I look for the exact match in uppercase I dont get any results This should not hap… --- ## [Kibana удаление полей из index pattern](https://discuss.elastic.co/t/kibana-index-pattern/287586)
**Author:** [@hellotty](https://discuss.elastic.co/u/hellotty)\ **Replies:** 0\ **Last updated:** [October 25, 2021, 2:25pm UTC](https://discuss.elastic.co/t/kibana-index-pattern/287586 "2021-10-25T14:25:04Z")
Добрый день. Во время теста, я создал множество полей которые сейчас неактуальны и мешают при поиске. Можно ли удалить поля которые мне не нужны? --- ## [Snmp network traffic and trends](https://discuss.elastic.co/t/snmp-network-traffic-and-trends/287585)
**Author:** [@leostereo](https://discuss.elastic.co/u/leostereo)\ **Replies:** 0\ **Last updated:** [October 25, 2021, 2:22pm UTC](https://discuss.elastic.co/t/snmp-network-traffic-and-trends/287585 "2021-10-25T14:22:21Z")
Hi guys. I have same experience using elk with neflow beat. Now im looking for some way to bring traffic from my router , create graphs , similar than librenms , cacti , an so. But I would also add some intelligence t… --- ## [Stack trace parsing issue](https://discuss.elastic.co/t/stack-trace-parsing-issue/287573)
**Author:** [@Divya\_Bansal](https://discuss.elastic.co/u/Divya_Bansal)\ **Replies:** 9\ **Last updated:** [October 25, 2021, 2:15pm UTC](https://discuss.elastic.co/t/stack-trace-parsing-issue/287573 "2021-10-25T14:15:57Z")
I am having a json data in the following manne:- {"@timestamp":"2021-06-04T09:57:25.141Z","@metadata":{"beat":"filebeat","type":"\_doc","version":"7.6.3"},"log":{"offset":10413931,"file":{"path":""}},"message":"\[ERROR\] 2… --- ## [ELK set up for creating a SIEM Solution\_Upwork Request](https://discuss.elastic.co/t/elk-set-up-for-creating-a-siem-solution-upwork-request/286299)
**Author:** [@Codedestiny1](https://discuss.elastic.co/u/Codedestiny1)\ **Replies:** 2\ **Last updated:** [October 25, 2021, 2:09pm UTC](https://discuss.elastic.co/t/elk-set-up-for-creating-a-siem-solution-upwork-request/286299 "2021-10-25T14:09:12Z")
Hi everyone, I have previously set up an ELK server using Microsoft Azure (I'm open to doing it on AWS). Is anyone available on Upwork to be hired to architect and set up scripts (using ansible playbook or other docker c… --- ## [Filebeat - Datastreams?](https://discuss.elastic.co/t/filebeat-datastreams/287442)
**Author:** [@scott\_stash](https://discuss.elastic.co/u/scott_stash)\ **Replies:** 1\ **Last updated:** [October 25, 2021, 2:08pm UTC](https://discuss.elastic.co/t/filebeat-datastreams/287442 "2021-10-25T14:08:17Z")
Currently we have configured data streams in our environment and its working as expected with Logstash. For Filebeat do we just use the datastream name as the index value? Or do we create an alias to the datastream and… --- ## [Logstash file input plugin: missing first lines after log rotation](https://discuss.elastic.co/t/logstash-file-input-plugin-missing-first-lines-after-log-rotation/287112)
**Author:** [@adminunix](https://discuss.elastic.co/u/adminunix)\ **Replies:** 2\ **Last updated:** [October 25, 2021, 1:56pm UTC](https://discuss.elastic.co/t/logstash-file-input-plugin-missing-first-lines-after-log-rotation/287112 "2021-10-25T13:56:26Z")
Hello, I´m using logstash with a pipeline that collects logs with the file input plugin. Everything works fine, but when log files are rotated, logstash doesn´t collect some of the first few lines of the new log file. T… --- ## [Help with query in CLI](https://discuss.elastic.co/t/help-with-query-in-cli/287584)
**Author:** [@Nick\_Hatfield](https://discuss.elastic.co/u/Nick_Hatfield)\ **Replies:** 0\ **Last updated:** [October 25, 2021, 1:52pm UTC](https://discuss.elastic.co/t/help-with-query-in-cli/287584 "2021-10-25T13:52:11Z")
Hi guys, please help me understand how to make a query work from the cli. I either match too much or nothing at all... So here's the payload sample: { "took": 3, "timed\_out": false, "\_shards": { "total": 5, … --- ## [Problem in adding two range facets with the same options names but for different filters](https://discuss.elastic.co/t/problem-in-adding-two-range-facets-with-the-same-options-names-but-for-different-filters/287202)
**Author:** [@AhmedTohamy01](https://discuss.elastic.co/u/AhmedTohamy01)\ **Replies:** 6\ **Last updated:** [October 25, 2021, 1:05pm UTC](https://discuss.elastic.co/t/problem-in-adding-two-range-facets-with-the-same-options-names-but-for-different-filters/287202 "2021-10-25T13:05:52Z")
Hi, I'm trying to add two range facets, the options in both of them are the same but it's for different filters. something like this: const installs = { type: 'range', ranges: \[ { from: 0, to: 101, name: '\<=… --- ## [Removing elastic-user Secret from K8s Secrets](https://discuss.elastic.co/t/removing-elastic-user-secret-from-k8s-secrets/287544)
**Author:** [@x00m](https://discuss.elastic.co/u/x00m)\ **Replies:** 2\ **Last updated:** [October 25, 2021, 12:29pm UTC](https://discuss.elastic.co/t/removing-elastic-user-secret-from-k8s-secrets/287544 "2021-10-25T12:29:08Z")
When we create an Elasticsearch resource, the credentials for the "elastic" user are created and stored in the kubernetes secrets, with the name "-es-elastic-user" Is it safe to delete this k8s secret? Does the system h… --- ## [Calculate transaction duration](https://discuss.elastic.co/t/calculate-transaction-duration/287210)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 3\ **Last updated:** [October 25, 2021, 12:22pm UTC](https://discuss.elastic.co/t/calculate-transaction-duration/287210 "2021-10-25T12:22:51Z")
Hi I'm struggling with one interesting case: we have some data within some patterns. But we don't have any tags: start or end in these documents. How I can calculate transaction duration? I'm also see great article Ca… --- ## [Suddenly pipeline got stuck with error couldn't find any output plugin named http](https://discuss.elastic.co/t/suddenly-pipeline-got-stuck-with-error-couldnt-find-any-output-plugin-named-http/287376)
**Author:** [@michael.l](https://discuss.elastic.co/u/michael.l)\ **Replies:** 3\ **Last updated:** [October 25, 2021, 11:55am UTC](https://discuss.elastic.co/t/suddenly-pipeline-got-stuck-with-error-couldnt-find-any-output-plugin-named-http/287376 "2021-10-25T11:55:41Z")
We have a simple pipeline that has been running fine for weeks without any errors, and then suddenly stopped outputting events while repeatedly printing this error: {"level":"ERROR","loggerName":"logstash.agent","timeMi… --- ## [Max spans happened in Hikari-pool connection addr thred](https://discuss.elastic.co/t/max-spans-happened-in-hikari-pool-connection-addr-thred/287145)
**Author:** [@fido](https://discuss.elastic.co/u/fido)\ **Replies:** 13\ **Last updated:** [October 25, 2021, 11:04am UTC](https://discuss.elastic.co/t/max-spans-happened-in-hikari-pool-connection-addr-thred/287145 "2021-10-25T11:04:50Z")
Hi，I am having trouble using Hikari connection pool with java APM agent. I meet Transaction Max spans warnning, when it happend at a transaction has more than spanLimited spans, which i set is 500. Then i found it happe… --- ## [Doc\_as\_upsert but don't deleted nested](https://discuss.elastic.co/t/doc-as-upsert-but-dont-deleted-nested/287564)
**Author:** [@Grant\_Donovan1](https://discuss.elastic.co/u/Grant_Donovan1)\ **Replies:** 0\ **Last updated:** [October 25, 2021, 10:51am UTC](https://discuss.elastic.co/t/doc-as-upsert-but-dont-deleted-nested/287564 "2021-10-25T10:51:16Z")
I am using the doc\_as\_upsert to update my document if it already exists, for example { "doc": { "apple": "new\_name", "test\_list": \[ { "value": "first value group 1", "value\_set": {… --- ## [Is my data stream not rolling over to a new index like it's supposed to?](https://discuss.elastic.co/t/is-my-data-stream-not-rolling-over-to-a-new-index-like-its-supposed-to/287515)
**Author:** [@nsouth](https://discuss.elastic.co/u/nsouth)\ **Replies:** 2\ **Last updated:** [October 25, 2021, 10:30am UTC](https://discuss.elastic.co/t/is-my-data-stream-not-rolling-over-to-a-new-index-like-its-supposed-to/287515 "2021-10-25T10:30:56Z")
We have a data stream created by Logstash and it's using the default index template and ILM policy. My understanding is that the data stream should roll over to a new index once the initial index has 50 GB of data or is … [Previous page](https://discuss.elastic.co/latest.md?page=1417) [Next page](https://discuss.elastic.co/latest.md?page=1419)