# Latest **URL:** https://discuss.elastic.co/latest.md?page=1552 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1553 --- ## [Logstash to external elasticsearch failed to connect](https://discuss.elastic.co/t/logstash-to-external-elasticsearch-failed-to-connect/279902)
**Author:** [@Aaron\_Phillips](https://discuss.elastic.co/u/Aaron_Phillips)\ **Replies:** 1\ **Last updated:** [July 28, 2021, 7:35pm UTC](https://discuss.elastic.co/t/logstash-to-external-elasticsearch-failed-to-connect/279902 "2021-07-28T19:35:37Z")
Running two separate elasticsearch one for an elk install and another for a network analysis toolset. The plan was to ship the network logs from the network tool to elk for further AI capabilities. However, the logstash… --- ## [Working with gzipped files](https://discuss.elastic.co/t/working-with-gzipped-files/279644)
**Author:** [@YvorL](https://discuss.elastic.co/u/YvorL)\ **Replies:** 1\ **Last updated:** [July 28, 2021, 7:25pm UTC](https://discuss.elastic.co/t/working-with-gzipped-files/279644 "2021-07-28T19:25:08Z")
Hi, I have to work with a lot of gzipped text files but it seems Filebeat can't read them. Is there any way to read the gzipped files in a given folder and ship those to a Kafka cluster? I saw that maybe I could work w… --- ## [Logstash workflow design - pipelines and configuration files](https://discuss.elastic.co/t/logstash-workflow-design-pipelines-and-configuration-files/279865)
**Author:** [@Icaka](https://discuss.elastic.co/u/Icaka)\ **Replies:** 1\ **Last updated:** [July 28, 2021, 7:09pm UTC](https://discuss.elastic.co/t/logstash-workflow-design-pipelines-and-configuration-files/279865 "2021-07-28T19:09:05Z")
Hi all, New to Elastic and Logstash, however my scenario is large IT environment and I would like to collect logs from various sources. First I would like to design most basic ones such as filebeat collecting syslogs, s… --- ## [How to create a report based on multiple copies of the same record in Kibana](https://discuss.elastic.co/t/how-to-create-a-report-based-on-multiple-copies-of-the-same-record-in-kibana/277970)
**Author:** [@arunavab](https://discuss.elastic.co/u/arunavab)\ **Replies:** 1\ **Last updated:** [July 28, 2021, 6:55pm UTC](https://discuss.elastic.co/t/how-to-create-a-report-based-on-multiple-copies-of-the-same-record-in-kibana/277970 "2021-07-28T18:55:25Z")
We are new to Kibana and are Collecting Data from a tool in this format and storing it in a CSV file. \[ID | Title | Status | Priority | Created Date | Resolved Date\] Now one ID will be repeated multiple times as work g… --- ## [Fleet Server only binding to IPv6](https://discuss.elastic.co/t/fleet-server-only-binding-to-ipv6/278213)
**Author:** [@omurad](https://discuss.elastic.co/u/omurad)\ **Replies:** 1\ **Last updated:** [July 28, 2021, 6:37pm UTC](https://discuss.elastic.co/t/fleet-server-only-binding-to-ipv6/278213 "2021-07-28T18:37:07Z")
I couldn't get an agent connected to the Fleet Server, so I ran netstat on the Fleet Server machine and noticed the port I configured is only bound to IPv6, not IPv4. My Fleet Server URL is set to http://0.0.0.0:8220. I… --- ## [What do you enter as the "host" while deploying a 3 node cluster and using elasticsearch\_certutil http](https://discuss.elastic.co/t/what-do-you-enter-as-the-host-while-deploying-a-3-node-cluster-and-using-elasticsearch-certutil-http/278853)
**Author:** [@Shubh\_Garg](https://discuss.elastic.co/u/Shubh_Garg)\ **Replies:** 1\ **Last updated:** [July 28, 2021, 6:19pm UTC](https://discuss.elastic.co/t/what-do-you-enter-as-the-host-while-deploying-a-3-node-cluster-and-using-elasticsearch-certutil-http/278853 "2021-07-28T18:19:00Z")
I am having trouble getting the correct http certificate. I have deployed a 3 node cluster according to the config. mentioned in this elastic article - Encrypting communications in an Elasticsearch Docker Container | Ela… --- ## [Field of nested type displayed as unindexed](https://discuss.elastic.co/t/field-of-nested-type-displayed-as-unindexed/278812)
**Author:** [@tobu](https://discuss.elastic.co/u/tobu)\ **Replies:** 1\ **Last updated:** [July 28, 2021, 5:33pm UTC](https://discuss.elastic.co/t/field-of-nested-type-displayed-as-unindexed/278812 "2021-07-28T17:33:30Z")
Hello I have created following index PUT my-index-000001 { "mappings": { "properties": { "users": { "type": "nested" } } } } PUT my-index-000001/\_doc/1 { "group" : "fans", "users" … --- ## [Feature parity between Integrations and Filebeat modules](https://discuss.elastic.co/t/feature-parity-between-integrations-and-filebeat-modules/279714)
**Author:** [@wsnet](https://discuss.elastic.co/u/wsnet)\ **Replies:** 1\ **Last updated:** [July 28, 2021, 4:13pm UTC](https://discuss.elastic.co/t/feature-parity-between-integrations-and-filebeat-modules/279714 "2021-07-28T16:13:55Z")
Hello, In the elastic/integrations repo there are lots of issues/plans and some PRs to add more data sources into Elastic, which is great! Does Elastic intend to also add these data sources as Filebeat modules, or do w… --- ## [Observability Engineer Lab 6.1 - How to validate Uptime ML job](https://discuss.elastic.co/t/observability-engineer-lab-6-1-how-to-validate-uptime-ml-job/279881)
**Author:** [@TonyY](https://discuss.elastic.co/u/TonyY)\ **Replies:** 4\ **Last updated:** [July 28, 2021, 4:13pm UTC](https://discuss.elastic.co/t/observability-engineer-lab-6-1-how-to-validate-uptime-ml-job/279881 "2021-07-28T16:13:53Z")
Hi, after creating the preconfigured Uptime ML job in Lab 6.1.6 I only got two empty views. Is this intended? In the Single Metric Viewer I'm not able to make a selection. --- ## [How to identify if filebeat has read all the logs from a specific folder?](https://discuss.elastic.co/t/how-to-identify-if-filebeat-has-read-all-the-logs-from-a-specific-folder/279857)
**Author:** [@Animesh\_Agarwal](https://discuss.elastic.co/u/Animesh_Agarwal)\ **Replies:** 1\ **Last updated:** [July 28, 2021, 4:07pm UTC](https://discuss.elastic.co/t/how-to-identify-if-filebeat-has-read-all-the-logs-from-a-specific-folder/279857 "2021-07-28T16:07:19Z")
Hi Team, Is there a way to identify if filebeat has parsed all the logs from a specific folder ? Requirement is to delete the folder automatically once filebeat has synced all the logs from that folder --- ## [Endpoint Filebeat memory 7.13.3 "rare event"](https://discuss.elastic.co/t/endpoint-filebeat-memory-7-13-3-rare-event/279759)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 1\ **Last updated:** [July 28, 2021, 3:39pm UTC](https://discuss.elastic.co/t/endpoint-filebeat-memory-7-13-3-rare-event/279759 "2021-07-28T15:39:33Z")
Minor bug with Filebeat and Endpoint. This is a rare event and only happened to 6 "known" machines out of 100. Filebeat memory utilization consumed the remaining host memory after a policy change. Steps that created t… --- ## [Kibana is active and running, but not able to access it in browser](https://discuss.elastic.co/t/kibana-is-active-and-running-but-not-able-to-access-it-in-browser/279801)
**Author:** [@ritesh.aduri45](https://discuss.elastic.co/u/ritesh.aduri45)\ **Replies:** 1\ **Last updated:** [July 28, 2021, 3:31pm UTC](https://discuss.elastic.co/t/kibana-is-active-and-running-but-not-able-to-access-it-in-browser/279801 "2021-07-28T15:31:56Z")
Kibana in browser is not accessible. --- ## [Redirect post call from kibana backend to another server using Hapi/h2o2 proxy handler in kibana plugin development](https://discuss.elastic.co/t/redirect-post-call-from-kibana-backend-to-another-server-using-hapi-h2o2-proxy-handler-in-kibana-plugin-development/278066)
**Author:** [@Disha\_Bodade](https://discuss.elastic.co/u/Disha_Bodade)\ **Replies:** 3\ **Last updated:** [July 28, 2021, 3:26pm UTC](https://discuss.elastic.co/t/redirect-post-call-from-kibana-backend-to-another-server-using-hapi-h2o2-proxy-handler-in-kibana-plugin-development/278066 "2021-07-28T15:26:03Z")
I have created a kibana plugin using the following procedure: goto kibana source directory node scripts/generate\_plugin test\_plugin build plugin with #yarn plugin-helpers build I modified UI as it has some forms in fr… --- ## [Change in Elastic 7.14 - Updates to the Uptime TLS certificate rule for alerts](https://discuss.elastic.co/t/change-in-elastic-7-14-updates-to-the-uptime-tls-certificate-rule-for-alerts/279874)
**Author:** [@Dominique\_Clarke](https://discuss.elastic.co/u/Dominique_Clarke)\ **Replies:** 0\ **Last updated:** [July 28, 2021, 2:36pm UTC](https://discuss.elastic.co/t/change-in-elastic-7-14-updates-to-the-uptime-tls-certificate-rule-for-alerts/279874 "2021-07-28T14:36:02Z")
7.14 will see a change to how the Uptime TLS certificate rule work from Uptime. With the current implementation, users receive a single alert describing all the certificates that will be expiring or are aging. From 7.14,… --- ## [Babel translations in Kibana not working?](https://discuss.elastic.co/t/babel-translations-in-kibana-not-working/279852)
**Author:** [@neil\_welling](https://discuss.elastic.co/u/neil_welling)\ **Replies:** 2\ **Last updated:** [July 28, 2021, 2:02pm UTC](https://discuss.elastic.co/t/babel-translations-in-kibana-not-working/279852 "2021-07-28T14:02:55Z")
HI. I have a local install of Kibana v7.12.1 being used on Samsung Smart TVs, who's inbuilt browser is built on top of Chromium 56 and so spread syntax for object literals isn't supported, so when the kibana home page l… --- ## [Filebeat latency while reading the data](https://discuss.elastic.co/t/filebeat-latency-while-reading-the-data/279869)
**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\ **Replies:** 0\ **Last updated:** [July 28, 2021, 2:05pm UTC](https://discuss.elastic.co/t/filebeat-latency-while-reading-the-data/279869 "2021-07-28T14:05:15Z")
Hi Team, in filebeat i have given the input section with filepath and outputsection with kafka. while reading the data from file filebeat is reading in batchwise. I have not given any flush timeout, as a default it sho… --- ## [Waiting for a Fleet Server to connect… error](https://discuss.elastic.co/t/waiting-for-a-fleet-server-to-connect-error/279500)
**Author:** [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Replies:** 4\ **Last updated:** [July 28, 2021, 1:53pm UTC](https://discuss.elastic.co/t/waiting-for-a-fleet-server-to-connect-error/279500 "2021-07-28T13:53:23Z")
We are running into an issue with Fleet, where on our Agents page, the Fleet server is stuck in what appears to be a continuous reboot cycle. We have terminated and redeployed the Fleet node and still run into this issu… --- ## [Cannot create snapshot repository](https://discuss.elastic.co/t/cannot-create-snapshot-repository/279833)
**Author:** [@Nicole\_Hirshler](https://discuss.elastic.co/u/Nicole_Hirshler)\ **Replies:** 12\ **Last updated:** [July 28, 2021, 1:47pm UTC](https://discuss.elastic.co/t/cannot-create-snapshot-repository/279833 "2021-07-28T13:47:05Z")
I have ELK running in a docker. Directory in my home dir is mounted as volume in the docker and was defined as repo\_path in elasticsearch. The permissions are set correctly and folder owner is elasticsearch. When I try… --- ## [Kibana Lens - is there a way to just count a field and not all records?](https://discuss.elastic.co/t/kibana-lens-is-there-a-way-to-just-count-a-field-and-not-all-records/279694)
**Author:** [@lorenzPowerdale2](https://discuss.elastic.co/u/lorenzPowerdale2)\ **Replies:** 3\ **Last updated:** [July 28, 2021, 1:46pm UTC](https://discuss.elastic.co/t/kibana-lens-is-there-a-way-to-just-count-a-field-and-not-all-records/279694 "2021-07-28T13:46:31Z")
I am trying to do a quick Virtualisation. The idea is to take take all values that have Errors/"Reden" and group them by the CP Communication Unit. So in theorie not very different from what we are seeing here: The p… --- ## [Aggregation filter Logstash](https://discuss.elastic.co/t/aggregation-filter-logstash/279868)
**Author:** [@Roberto\_B](https://discuss.elastic.co/u/Roberto_B)\ **Replies:** 0\ **Last updated:** [July 28, 2021, 1:44pm UTC](https://discuss.elastic.co/t/aggregation-filter-logstash/279868 "2021-07-28T13:44:37Z")
Hi all, i'm trying to use aggregation filter, i have a big result set (more than 140k rows from mySql). And the aggregation stopped always at row 53. In the log I can see this error: \[ERROR\]\[logstash.javapipeline … --- ## [Kibana is running but extremely slow](https://discuss.elastic.co/t/kibana-is-running-but-extremely-slow/279843)
**Author:** [@Mesut\_Yilmaz](https://discuss.elastic.co/u/Mesut_Yilmaz)\ **Replies:** 1\ **Last updated:** [July 28, 2021, 1:26pm UTC](https://discuss.elastic.co/t/kibana-is-running-but-extremely-slow/279843 "2021-07-28T13:26:08Z")
Hi Fellows, i am suffering with this issue. I do not know how i could fix this. I would be glad if you could give a direction to go for it. Kibana is working but extremely slow running. I have 10 nodes elasticsearch ho… --- ## [RuntimeError: Invalid FieldReference: \`\[\]\`](https://discuss.elastic.co/t/runtimeerror-invalid-fieldreference/279856)
**Author:** [@Andrew\_Harris](https://discuss.elastic.co/u/Andrew_Harris)\ **Replies:** 0\ **Last updated:** [July 28, 2021, 12:43pm UTC](https://discuss.elastic.co/t/runtimeerror-invalid-fieldreference/279856 "2021-07-28T12:43:53Z")
Hi, I have two servers running Logstash 7.10 pushing a series of CSV file into Elastic. Now I thought that both server were configured exactly the same, but it looks like they aren't as one is repeatedly giving the foll… --- ## ["Kibana server is not ready yet" (running with docker-compose)](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-running-with-docker-compose/279627)
**Author:** [@kkireyev](https://discuss.elastic.co/u/kkireyev)\ **Replies:** 6\ **Last updated:** [July 28, 2021, 11:43am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-running-with-docker-compose/279627 "2021-07-28T11:43:21Z")
Hi! I'm trying to follow the tutorial here: After running "docker-compose up", I can access: localhost:9200/\_cat/nodes?v&pretty but when I go to http://localhost:5601/ I get: Kibana server is not ready yet Run… --- ## [How do you specify the "forbidden hours" in the Detection Rule "Auditd Login Attempt at Forbidden Time"](https://discuss.elastic.co/t/how-do-you-specify-the-forbidden-hours-in-the-detection-rule-auditd-login-attempt-at-forbidden-time/279713)
**Author:** [@panagiss](https://discuss.elastic.co/u/panagiss)\ **Replies:** 2\ **Last updated:** [July 28, 2021, 11:29am UTC](https://discuss.elastic.co/t/how-do-you-specify-the-forbidden-hours-in-the-detection-rule-auditd-login-attempt-at-forbidden-time/279713 "2021-07-28T11:29:30Z")
I came across that Detection Rule but it seems unusual to me that i cannot specify the "Forbidden Times" somehow. My guess is that auditd has that event that can be triggered but the thing is that somehow you can control… --- ## [Logstash lumberjack to beats certificate unknown](https://discuss.elastic.co/t/logstash-lumberjack-to-beats-certificate-unknown/279844)
**Author:** [@muffin](https://discuss.elastic.co/u/muffin)\ **Replies:** 0\ **Last updated:** [July 28, 2021, 10:56am UTC](https://discuss.elastic.co/t/logstash-lumberjack-to-beats-certificate-unknown/279844 "2021-07-28T10:56:14Z")
Hi, We're using Logstash 7.12, we want to use the lumberjack output plugin to relay traffic to the Beats input of another Logstash instance (also 7.12). When using a self-signed certificate (identical on both sides) th… --- ## [How to mention elasticsearch credentials in logstash config?](https://discuss.elastic.co/t/how-to-mention-elasticsearch-credentials-in-logstash-config/279840)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 1\ **Last updated:** [July 28, 2021, 10:54am UTC](https://discuss.elastic.co/t/how-to-mention-elasticsearch-credentials-in-logstash-config/279840 "2021-07-28T10:54:12Z")
Hello, I recently enabled x-pack security on elasticsearch and set up passwords for built-in users successfully . However now i get an error when trying to ingest some logs \[2021-07-23T13:02:58,225\]\[WARN \]\[logstash.o… --- ## [Logstash JMS Input with Weblogic JMS server](https://discuss.elastic.co/t/logstash-jms-input-with-weblogic-jms-server/279838)
**Author:** [@AlessandroKP](https://discuss.elastic.co/u/AlessandroKP)\ **Replies:** 0\ **Last updated:** [July 28, 2021, 10:15am UTC](https://discuss.elastic.co/t/logstash-jms-input-with-weblogic-jms-server/279838 "2021-07-28T10:15:17Z")
Hi, I'm having problems configuring the Logstash JMS input plugin in order to read messages from a queue on Oracle Weblogic JMS server. I'm using Logstash v7.9.3 and the version of the jms input plugin is v3.1.2 (the o… --- ## [Getting custom filebeat module into production](https://discuss.elastic.co/t/getting-custom-filebeat-module-into-production/275740)
**Author:** [@kelvins](https://discuss.elastic.co/u/kelvins)\ **Replies:** 4\ **Last updated:** [July 28, 2021, 10:13am UTC](https://discuss.elastic.co/t/getting-custom-filebeat-module-into-production/275740 "2021-07-28T10:13:11Z")
I have created a new beats module (jde) which contain a couple of filesets. I have gone through the testing phases of the filebeat modules and all tests pass - Yeah! I am now trying to move this into production. To do… --- ## [EQL Help - Corrleation](https://discuss.elastic.co/t/eql-help-corrleation/278509)
**Author:** [@Cris\_Tian](https://discuss.elastic.co/u/Cris_Tian)\ **Replies:** 1\ **Last updated:** [July 28, 2021, 8:52am UTC](https://discuss.elastic.co/t/eql-help-corrleation/278509 "2021-07-28T08:52:02Z")
I have the following code under the correlation event tab in kibana: sequence by @timestamp \[packetbeat where http.response.body.content == "\*" and network.direction == "\*"\] \[filebeat where nginx.access.respon… --- ## [Logstash on virtualbox/docker + cisco](https://discuss.elastic.co/t/logstash-on-virtualbox-docker-cisco/279828)
**Author:** [@Margo](https://discuss.elastic.co/u/Margo)\ **Replies:** 0\ **Last updated:** [July 28, 2021, 8:40am UTC](https://discuss.elastic.co/t/logstash-on-virtualbox-docker-cisco/279828 "2021-07-28T08:40:59Z")
Hi! I've started ELK with docker-stack on virtualbox, ports has 514:5044. Pipeline input - udp/5044, output - stdout. Tcpdump catch syslog from cisco - 514/udp. But there is no stdout or index pattern in kibana. Can you… [Previous page](https://discuss.elastic.co/latest.md?page=1551) [Next page](https://discuss.elastic.co/latest.md?page=1553)