# Latest **URL:** https://discuss.elastic.co/latest.md?page=1447 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1448 --- ## [Canvas line-chart with multiple lines](https://discuss.elastic.co/t/canvas-line-chart-with-multiple-lines/285924)
**Author:** [@marcw](https://discuss.elastic.co/u/marcw)\ **Replies:** 2\ **Last updated:** [October 6, 2021, 8:24am UTC](https://discuss.elastic.co/t/canvas-line-chart-with-multiple-lines/285924 "2021-10-06T08:24:51Z")
I'm new to Kibana. I have the following data: DateTime Temperature1 Temperature2 Temparature3 2021-10-05 09:00:00 5 2 9 2021-10-05 10:00:00 6 1 7 I want to create on a canvas a line-chart, x-axis is the Dat… --- ## [Error: Invalid snapshot name snapshot with the same name already in-progress](https://discuss.elastic.co/t/error-invalid-snapshot-name-snapshot-with-the-same-name-already-in-progress/283661)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 13\ **Last updated:** [October 6, 2021, 8:02am UTC](https://discuss.elastic.co/t/error-invalid-snapshot-name-snapshot-with-the-same-name-already-in-progress/283661 "2021-10-06T08:02:11Z")
Hello dear friends I have a problem. I want to store an index that is in elasticsearch. I created a new repository for this and this repository does not have any snapshots. But when I ran the code blog below, it returne… --- ## [Metricbeat beat module](https://discuss.elastic.co/t/metricbeat-beat-module/285991)
**Author:** [@alaine](https://discuss.elastic.co/u/alaine)\ **Replies:** 0\ **Last updated:** [October 6, 2021, 7:57am UTC](https://discuss.elastic.co/t/metricbeat-beat-module/285991 "2021-10-06T07:57:48Z")
Good Morning, I have enabled metricbeats on a few of our network sensors that are running filebeat. I am able to run metricbeat with the system module without a problem. When I try to run the beat module I start getting… --- ## [Filebeat won't start the service. Data path already locked by another beat](https://discuss.elastic.co/t/filebeat-wont-start-the-service-data-path-already-locked-by-another-beat/285989)
**Author:** [@dhody\_rhmd](https://discuss.elastic.co/u/dhody_rhmd)\ **Replies:** 0\ **Last updated:** [October 6, 2021, 7:49am UTC](https://discuss.elastic.co/t/filebeat-wont-start-the-service-data-path-already-locked-by-another-beat/285989 "2021-10-06T07:49:44Z")
Hello, This is my first time to setup logging stack. My problem is the Filebeat service wont start. filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch. Loaded: loaded (/lib/systemd… --- ## [ECK follows CIS benchmark? If so can you please point me to those resource](https://discuss.elastic.co/t/eck-follows-cis-benchmark-if-so-can-you-please-point-me-to-those-resource/285965)
**Author:** [@vinodhreddyg](https://discuss.elastic.co/u/vinodhreddyg)\ **Replies:** 1\ **Last updated:** [October 6, 2021, 7:45am UTC](https://discuss.elastic.co/t/eck-follows-cis-benchmark-if-so-can-you-please-point-me-to-those-resource/285965 "2021-10-06T07:45:14Z")
Hi Team, Can you please point to the ECK CIS benchmark resources? --- ## [Rally 2.3.0 released](https://discuss.elastic.co/t/rally-2-3-0-released/285985)
**Author:** [@Quentin\_Pradet](https://discuss.elastic.co/u/Quentin_Pradet)\ **Replies:** 0\ **Last updated:** [October 6, 2021, 7:28am UTC](https://discuss.elastic.co/t/rally-2-3-0-released/285985 "2021-10-06T07:28:53Z")
We have just released Rally 2.3.0. This is a bug fix release but also adds a few enhancements. Here are some highlights: Rally now requires at least Elasticsearch 7.0.0 for the metrics store. The compare command now in… --- ## [App Search on Elastic Cloud (out of the box) seems slow: 800ms ~ 1200ms](https://discuss.elastic.co/t/app-search-on-elastic-cloud-out-of-the-box-seems-slow-800ms-1200ms/283176)
**Author:** [@markn](https://discuss.elastic.co/u/markn)\ **Replies:** 4\ **Last updated:** [October 6, 2021, 6:48am UTC](https://discuss.elastic.co/t/app-search-on-elastic-cloud-out-of-the-box-seems-slow-800ms-1200ms/283176 "2021-10-06T06:48:09Z")
Hi, We have an AppSearch deployment running on Elastic Cloud Azure Netherlands. From here we use the crawler to crawl "https://www.unive.nl". The crawler is configured to crawl by use of the sitemap with a crawl depth o… --- ## [CMS Bitrix support](https://discuss.elastic.co/t/cms-bitrix-support/285977)
**Author:** [@danilvoe](https://discuss.elastic.co/u/danilvoe)\ **Replies:** 0\ **Last updated:** [October 6, 2021, 6:30am UTC](https://discuss.elastic.co/t/cms-bitrix-support/285977 "2021-10-06T06:30:57Z")
Kibana version: 7.14.1 Elasticsearch version: 7.14.1 APM Server version: 7.14.1 APM Agent language and version: php version 1.3 I use CMS Bitrix (installed on my own server) https://www.1c-bitrix.ru/. DB MySQL 5.7 C… --- ## [Logstash-output-zabbix does not send to zabbix](https://discuss.elastic.co/t/logstash-output-zabbix-does-not-send-to-zabbix/285912)
**Author:** [@Paveltest](https://discuss.elastic.co/u/Paveltest)\ **Replies:** 3\ **Last updated:** [October 6, 2021, 5:12am UTC](https://discuss.elastic.co/t/logstash-output-zabbix-does-not-send-to-zabbix/285912 "2021-10-06T05:12:42Z")
When sending logs to zabbix, it gives an error. \[WARN \] 2021-10-05 \[\[main\]\>worker1\] zabbix - Field referenced by message is missing \[WARN \] 2021-10-05 \[\[main\]\>worker1\] zabbix - Zabbix server at monitoring-server.com … --- ## [Authorization implementation on elastic search results](https://discuss.elastic.co/t/authorization-implementation-on-elastic-search-results/285975)
**Author:** [@hafoosdev](https://discuss.elastic.co/u/hafoosdev)\ **Replies:** 0\ **Last updated:** [October 6, 2021, 4:53am UTC](https://discuss.elastic.co/t/authorization-implementation-on-elastic-search-results/285975 "2021-10-06T04:53:48Z")
We have a requirement to show/hide data to logged in User based on User permissions on each record that we have in Elasticsearch. The algorithm to check if the User has permissions on a given record requires to check mul… --- ## [Confusion on ILM policy and please help me to understand it](https://discuss.elastic.co/t/confusion-on-ilm-policy-and-please-help-me-to-understand-it/285969)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 0\ **Last updated:** [October 6, 2021, 3:37am UTC](https://discuss.elastic.co/t/confusion-on-ilm-policy-and-please-help-me-to-understand-it/285969 "2021-10-06T03:37:39Z")
Hi Team, I am working on a system where I expect daily I am going to ingest a data about 15 GB and my total retention of data should be about 365 days. However my active data would be about 1 month of indices. After 1 m… --- ## [FS Crawler appeared to work but Kibana displays 0 results](https://discuss.elastic.co/t/fs-crawler-appeared-to-work-but-kibana-displays-0-results/285936)
**Author:** [@neergttocsdivad](https://discuss.elastic.co/u/neergttocsdivad)\ **Replies:** 5\ **Last updated:** [October 6, 2021, 3:32am UTC](https://discuss.elastic.co/t/fs-crawler-appeared-to-work-but-kibana-displays-0-results/285936 "2021-10-06T03:32:11Z")
Hello I have created three document collections with which to experiment with Elastic (7.15) Each collection is stored in a separate folder. The folders are named: papers, numb3rs & novels. I have used FS Crawler 2.7… --- ## [Create a Single Rule with Multiple Thresholds with Different Actions per Threshold?](https://discuss.elastic.co/t/create-a-single-rule-with-multiple-thresholds-with-different-actions-per-threshold/285956)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 4\ **Last updated:** [October 5, 2021, 10:15pm UTC](https://discuss.elastic.co/t/create-a-single-rule-with-multiple-thresholds-with-different-actions-per-threshold/285956 "2021-10-05T22:15:22Z")
Hi All, I was wondering if anyone know if the following is possible Rules and Connectors, as I wasn't able to figure out how to do it in the GUI. Have a single rule, let's call it Disk Usage. The goal of this rule is… --- ## [How to parse the following nested json](https://discuss.elastic.co/t/how-to-parse-the-following-nested-json/285959)
**Author:** [@bvoros](https://discuss.elastic.co/u/bvoros)\ **Replies:** 1\ **Last updated:** [October 5, 2021, 6:53pm UTC](https://discuss.elastic.co/t/how-to-parse-the-following-nested-json/285959 "2021-10-05T18:53:35Z")
Hello, I would like to know how to parse the list of nested json "documents" inside a json list field. Thank you in advance, There is that list of name and value pairs in the following format: { "list": \[ { … --- ## [Parsing mongodb input fully via logstash =\> elasticsearch](https://discuss.elastic.co/t/parsing-mongodb-input-fully-via-logstash-elasticsearch/285843)
**Author:** [@diaztech](https://discuss.elastic.co/u/diaztech)\ **Replies:** 6\ **Last updated:** [October 5, 2021, 6:28pm UTC](https://discuss.elastic.co/t/parsing-mongodb-input-fully-via-logstash-elasticsearch/285843 "2021-10-05T18:28:23Z")
I'm parsing a mongodb input into logstash, the config file is as follows: input { mongodb { uri =\> "\" placeholder\_db\_dir =\> "\" collection =\> "modules" batch\_size =\> 50… --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/285402)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 6\ **Last updated:** [October 5, 2021, 5:47pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/285402 "2021-10-05T17:47:05Z")
I am slowly making headway with my installation of ELK Stack 7.13.4. I was at one point unable to connect and was showing a block, which turned out to be firewalls on the Red Hat Linux 8 operating systems. I have allow… --- ## [Kibana 7.14.2 Event Filter drop fails to drop events](https://discuss.elastic.co/t/kibana-7-14-2-event-filter-drop-fails-to-drop-events/284763)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 12\ **Last updated:** [October 5, 2021, 5:38pm UTC](https://discuss.elastic.co/t/kibana-7-14-2-event-filter-drop-fails-to-drop-events/284763 "2021-10-05T17:38:01Z")
Kibana 7.14.2 is no longer dropping events that are in the events filter drop list. This is creating massive amounts of excessive unneeded data. 30+mil events per hour. In kibana, Elastic Security, Event filters section… --- ## [Unable to see any login or failure event from windows hosts](https://discuss.elastic.co/t/unable-to-see-any-login-or-failure-event-from-windows-hosts/285725)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 2\ **Last updated:** [October 5, 2021, 5:33pm UTC](https://discuss.elastic.co/t/unable-to-see-any-login-or-failure-event-from-windows-hosts/285725 "2021-10-05T17:33:16Z")
Hi Folks, I have setup elastic SIEM 7.15 with fleet and integrations with elastic-agent and windows. I enrolled windows server in fleet and then I generated few failure events. However those are not being reflected on … --- ## [Kibana json input](https://discuss.elastic.co/t/kibana-json-input/285857)
**Author:** [@azulgrana](https://discuss.elastic.co/u/azulgrana)\ **Replies:** 1\ **Last updated:** [October 5, 2021, 1:38am UTC](https://discuss.elastic.co/t/kibana-json-input/285857 "2021-10-05T01:38:06Z")
Hi there! I have a custom visualization that reports on network traffic by protocol, source and destination. I have added to my Split rows bucket a custom JSON input to strip out the last octet and to display the commun… --- ## [How to combine data from different index in one view while viewing in kibana?](https://discuss.elastic.co/t/how-to-combine-data-from-different-index-in-one-view-while-viewing-in-kibana/284425)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 7\ **Last updated:** [October 5, 2021, 4:47pm UTC](https://discuss.elastic.co/t/how-to-combine-data-from-different-index-in-one-view-while-viewing-in-kibana/284425 "2021-10-05T16:47:22Z")
I am trying to put traffic logs to Elasticsearch. Suppose there are 100 traffic rows. Suppose there are around 25 columns for each row. Suppose 15 columns of all of the 100 traffic logs are same . rest of the columns … --- ## [KIbana Cardinality/Unique Count Metric Lens / TSVB](https://discuss.elastic.co/t/kibana-cardinality-unique-count-metric-lens-tsvb/285944)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 3\ **Last updated:** [October 5, 2021, 4:11pm UTC](https://discuss.elastic.co/t/kibana-cardinality-unique-count-metric-lens-tsvb/285944 "2021-10-05T16:11:54Z")
Hi all, Little question: When working with normal metric aggregations it is possible under "Advanced" to set this parameter {"precision\_threshold": 40000} Does exists any way to set this threshold either globally or i… --- ## [Super Helpful Feature Request regarding Elasticsearch node data](https://discuss.elastic.co/t/super-helpful-feature-request-regarding-elasticsearch-node-data/285722)
**Author:** [@pushshift](https://discuss.elastic.co/u/pushshift)\ **Replies:** 2\ **Last updated:** [October 5, 2021, 3:56pm UTC](https://discuss.elastic.co/t/super-helpful-feature-request-regarding-elasticsearch-node-data/285722 "2021-10-05T15:56:40Z")
I know as a sysadmin, it should be my responsibility to have a list somewhere that contains all the servers / server names that belong to a specific cluster. Unfortunately, sometimes when one is in a rush to meet a deadl… --- ## [Grok pattern for this syslog message for Logstash?](https://discuss.elastic.co/t/grok-pattern-for-this-syslog-message-for-logstash/285896)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 8\ **Last updated:** [October 5, 2021, 2:35pm UTC](https://discuss.elastic.co/t/grok-pattern-for-this-syslog-message-for-logstash/285896 "2021-10-05T14:35:18Z")
Hello I have this syslog message which is ALMOST like the standard RFC3164 so the default syslog plugin should pick it up: \<134\>1 2021-10-05T08:48:18Z MYSERVER iLO5 - - - XML logout: SomeUser - 1.2.3.4(DNS name not fou… --- ## [Date from DB is changed when inserted in ES](https://discuss.elastic.co/t/date-from-db-is-changed-when-inserted-in-es/285904)
**Author:** [@Blazkowicz](https://discuss.elastic.co/u/Blazkowicz)\ **Replies:** 1\ **Last updated:** [October 5, 2021, 2:27pm UTC](https://discuss.elastic.co/t/date-from-db-is-changed-when-inserted-in-es/285904 "2021-10-05T14:27:01Z")
Hi all, Having an issue with a date field when trying to insert it in ES. Searched and tried multiple modes but to no avail. Short story, my date field from Postgres ends up in ES with a timezone attached/offset, even … --- ## [How to make data table of last value](https://discuss.elastic.co/t/how-to-make-data-table-of-last-value/285921)
**Author:** [@GinkoLucas](https://discuss.elastic.co/u/GinkoLucas)\ **Replies:** 4\ **Last updated:** [October 5, 2021, 2:19pm UTC](https://discuss.elastic.co/t/how-to-make-data-table-of-last-value/285921 "2021-10-05T14:19:36Z")
Hi, Do you know how to create a data table with the laste value of every host (for example) ? And is it possible to apply a filter based on last value ? (I dont want to see all hosts) --- ## [Setup FileBeats in AZURE ACI ( Not Azure module )](https://discuss.elastic.co/t/setup-filebeats-in-azure-aci-not-azure-module/285902)
**Author:** [@mklynx](https://discuss.elastic.co/u/mklynx)\ **Replies:** 1\ **Last updated:** [October 5, 2021, 2:03pm UTC](https://discuss.elastic.co/t/setup-filebeats-in-azure-aci-not-azure-module/285902 "2021-10-05T14:03:51Z")
I am looking for some help. I have an elastic stack running in AZURE. I have an Application container running in ACI that logs to a fileshare. I want to move the logging to the elastic stack. I was thinking to add a fil… --- ## [Data tiers, searcheable snapshots and the frozen tier](https://discuss.elastic.co/t/data-tiers-searcheable-snapshots-and-the-frozen-tier/285928)
**Author:** [@ffknob](https://discuss.elastic.co/u/ffknob)\ **Replies:** 4\ **Last updated:** [October 5, 2021, 2:01pm UTC](https://discuss.elastic.co/t/data-tiers-searcheable-snapshots-and-the-frozen-tier/285928 "2021-10-05T14:01:48Z")
Hello I need some help figuring out data tiers, searcheable snapshots and the frozen tier. Consider this: GET \_cat/nodes?v&h=name,node.role&s=name name node.role es01 hms es02 mw es03 cm es04 fm POST \_snapshot/orde… --- ## [Килицица в поиске Wildcard](https://discuss.elastic.co/t/wildcard/285755)
**Author:** [@VMExpert](https://discuss.elastic.co/u/VMExpert)\ **Replies:** 3\ **Last updated:** [October 5, 2021, 1:58pm UTC](https://discuss.elastic.co/t/wildcard/285755 "2021-10-05T13:58:10Z")
Здравствуйте. Мне помогли с фильтром: { "settings": { "analysis": { "analyzer": { "default": { "tokenizer": "standard", "filter": \[ "my\_phonetic\_english", … --- ## [How 2 node elastic cluster will failover to secondary node if the primary node fails](https://discuss.elastic.co/t/how-2-node-elastic-cluster-will-failover-to-secondary-node-if-the-primary-node-fails/285919)
**Author:** [@Arcadix](https://discuss.elastic.co/u/Arcadix)\ **Replies:** 1\ **Last updated:** [October 5, 2021, 12:57pm UTC](https://discuss.elastic.co/t/how-2-node-elastic-cluster-will-failover-to-secondary-node-if-the-primary-node-fails/285919 "2021-10-05T12:57:46Z")
Hi, We have 1+1 Elasticsearch Clustering setup on windows server. we need to know which Elastic node URL should call in our application to have a proper Fail over. if one node is down how the application identify that… --- ## [Issue with server.publicBaseUrl](https://discuss.elastic.co/t/issue-with-server-publicbaseurl/285796)
**Author:** [@PhilD](https://discuss.elastic.co/u/PhilD)\ **Replies:** 4\ **Last updated:** [October 5, 2021, 12:51pm UTC](https://discuss.elastic.co/t/issue-with-server-publicbaseurl/285796 "2021-10-05T12:51:11Z")
Hello, I've deployed Kibana 7.14, behind a NGINX proxy, but keep getting a toast notification that server.publicBaseUrl has not been set; yet it has been in kibana.yml. Is there a way to dump the running configuration t… [Previous page](https://discuss.elastic.co/latest.md?page=1446) [Next page](https://discuss.elastic.co/latest.md?page=1448)