# Latest **URL:** https://discuss.elastic.co/latest.md?page=1641 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1642 --- ## [Creating visualization using static data](https://discuss.elastic.co/t/creating-visualization-using-static-data/274921)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 4\ **Last updated:** [June 4, 2021, 1:21pm UTC](https://discuss.elastic.co/t/creating-visualization-using-static-data/274921 "2021-06-04T13:21:20Z")
Hello, I have ELK stack 7.6.2 running. Logstash was configured to parse a file which gets generated once every 24 hours and display data as follows (few fields shown below): # totalCalls.BServer 3,105,489 # totalC… --- ## [The file update has not been detected, but the file has been updated and the ES index has not been written](https://discuss.elastic.co/t/the-file-update-has-not-been-detected-but-the-file-has-been-updated-and-the-es-index-has-not-been-written/274983)
**Author:** [@sacher](https://discuss.elastic.co/u/sacher)\ **Replies:** 0\ **Last updated:** [June 4, 2021, 1:00pm UTC](https://discuss.elastic.co/t/the-file-update-has-not-been-detected-but-the-file-has-been-updated-and-the-es-index-has-not-been-written/274983 "2021-06-04T13:00:55Z")
log 2021-06-04T12:39:30.519Z INFO instance/beat.go:304 Setup Beat: filebeat; Version: 7.12.1 2021-06-04T12:39:30.519Z INFO eslegclient/connection.go:99 elasticsearch url: http://xxx:19200 2021-06-04T12:39:30.520Z INFO \[… --- ## [Labels on visualizations](https://discuss.elastic.co/t/labels-on-visualizations/274871)
**Author:** [@Jorge\_Mario\_Montes\_R](https://discuss.elastic.co/u/Jorge_Mario_Montes_R)\ **Replies:** 3\ **Last updated:** [June 4, 2021, 12:55pm UTC](https://discuss.elastic.co/t/labels-on-visualizations/274871 "2021-06-04T12:55:56Z")
Hi, After upgrading to 7.13, all values that are shown inside visualizations changed and are not readable. Is there a way to customize the font? --- ## [PostgreSQL grok problem](https://discuss.elastic.co/t/postgresql-grok-problem/273284)
**Author:** [@Cihan\_Tunali](https://discuss.elastic.co/u/Cihan_Tunali)\ **Replies:** 11\ **Last updated:** [June 4, 2021, 12:54pm UTC](https://discuss.elastic.co/t/postgresql-grok-problem/273284 "2021-06-04T12:54:15Z")
Hello, I am using PostgreSQL 12 with Filebeat 7.12. I followed (PostgreSQL module | Filebeat Reference \[8.11\] | Elastic) to configure filebeat. Right now Filebeat is sending the logs but I can see, there is a GROK failu… --- ## [Endpoint Security Not Showing Host Events](https://discuss.elastic.co/t/endpoint-security-not-showing-host-events/274918)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 3\ **Last updated:** [June 4, 2021, 12:18pm UTC](https://discuss.elastic.co/t/endpoint-security-not-showing-host-events/274918 "2021-06-04T12:18:36Z")
Hello there, I need to understand why the endpoint security is not showing even after enroll the fleet agents. Follow my screens: Endpoint log: {"@timestamp":"2021-06-03T20:11:54.0871431Z","agent":{"id":"7991… --- ## [Canvas switch images with two SQL select queries](https://discuss.elastic.co/t/canvas-switch-images-with-two-sql-select-queries/274979)
**Author:** [@martb](https://discuss.elastic.co/u/martb)\ **Replies:** 0\ **Last updated:** [June 4, 2021, 12:18pm UTC](https://discuss.elastic.co/t/canvas-switch-images-with-two-sql-select-queries/274979 "2021-06-04T12:18:16Z")
HI, I'm trying to switch the image from green to amber when there are no records in the last hour and change to red when no records in the last 2hrs. All within one indicator. I've tried various ways to-do this but all… --- ## [Metricbeat IIS Module - which IIS services does it monitor](https://discuss.elastic.co/t/metricbeat-iis-module-which-iis-services-does-it-monitor/274977)
**Author:** [@abidub](https://discuss.elastic.co/u/abidub)\ **Replies:** 0\ **Last updated:** [June 4, 2021, 11:44am UTC](https://discuss.elastic.co/t/metricbeat-iis-module-which-iis-services-does-it-monitor/274977 "2021-06-04T11:44:01Z")
Hi there, I am configuring ansible to enable IIS module in Metricbeat "if" the IIS services are installed, however, I want to understand exactly which IIS services must be running for metricbeat to be able to gather IIS… --- ## [Elastic IoT - Facing Ingest Speed "Light Barrier" at 10K docs/sec](https://discuss.elastic.co/t/elastic-iot-facing-ingest-speed-light-barrier-at-10k-docs-sec/274971)
**Author:** [@ibexit](https://discuss.elastic.co/u/ibexit)\ **Replies:** 1\ **Last updated:** [June 4, 2021, 11:28am UTC](https://discuss.elastic.co/t/elastic-iot-facing-ingest-speed-light-barrier-at-10k-docs-sec/274971 "2021-06-04T11:28:42Z")
We´ve set up a bare-metal elastic cluster with high CPU, max ram, and fast local flash storage in hot trier and followed all official preflight checklist and write optimization guides: 3 Dedicated Master Nodes, 2 Dedic… --- ## [Check filed value](https://discuss.elastic.co/t/check-filed-value/274976)
**Author:** [@royalE](https://discuss.elastic.co/u/royalE)\ **Replies:** 0\ **Last updated:** [June 4, 2021, 11:18am UTC](https://discuss.elastic.co/t/check-filed-value/274976 "2021-06-04T11:18:15Z")
I want to check the value of the field if its contain a number or string how can i do that ? --- ## [Not able to Generate CSV from Management \> Kibana \> Reporting](https://discuss.elastic.co/t/not-able-to-generate-csv-from-management-kibana-reporting/274865)
**Author:** [@Amit\_Singh4](https://discuss.elastic.co/u/Amit_Singh4)\ **Replies:** 3\ **Last updated:** [June 4, 2021, 10:46am UTC](https://discuss.elastic.co/t/not-able-to-generate-csv-from-management-kibana-reporting/274865 "2021-06-04T10:46:39Z")
After saving a search from Discover page, I am trying to Generate CSV using Share tab but its giving me below error: Could not create report for csv 'testlogs\_03May'. The reporting job failed TypeError: Cannot assign… --- ## [Proofpoint Syslog SSL](https://discuss.elastic.co/t/proofpoint-syslog-ssl/274965)
**Author:** [@Jojoke](https://discuss.elastic.co/u/Jojoke)\ **Replies:** 0\ **Last updated:** [June 4, 2021, 9:17am UTC](https://discuss.elastic.co/t/proofpoint-syslog-ssl/274965 "2021-06-04T09:17:01Z")
Hello Everyone ! I am trying to install the proofpoint module on filebeat and I have a small problem. My filebeat receives the data, but can't read it because it's encrypted. My proofpoint is the SaaS version = my sys… --- ## [Cisco ASA/FTD parsing in filebeat](https://discuss.elastic.co/t/cisco-asa-ftd-parsing-in-filebeat/274961)
**Author:** [@Andy\_Clark](https://discuss.elastic.co/u/Andy_Clark)\ **Replies:** 0\ **Last updated:** [June 4, 2021, 8:29am UTC](https://discuss.elastic.co/t/cisco-asa-ftd-parsing-in-filebeat/274961 "2021-06-04T08:29:28Z")
Is there a way within the filebeat config to get the log.source.address with just an IP address in, whenever I direct syslog traffic to the filebeat collector the sender IP address and the sending port are present within… --- ## [Logstash monitoring Encountered a retryable error. Will Retry with exponential backoff](https://discuss.elastic.co/t/logstash-monitoring-encountered-a-retryable-error-will-retry-with-exponential-backoff/274958)
**Author:** [@vaclav1](https://discuss.elastic.co/u/vaclav1)\ **Replies:** 0\ **Last updated:** [June 4, 2021, 8:18am UTC](https://discuss.elastic.co/t/logstash-monitoring-encountered-a-retryable-error-will-retry-with-exponential-backoff/274958 "2021-06-04T08:18:43Z")
Hello, I have just swapped to use TLS on http and configured api\_key as per Configuring Security in Logstash | Logstash Reference \[7.9\] | Elastic My logstash.yml file: # X-Pack Monitoring xpack.monitoring.enabled: tru… --- ## [Hash algo to use with file realm](https://discuss.elastic.co/t/hash-algo-to-use-with-file-realm/274905)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 3\ **Last updated:** [June 4, 2021, 7:49am UTC](https://discuss.elastic.co/t/hash-algo-to-use-with-file-realm/274905 "2021-06-04T07:49:56Z")
Using ES 7.13.0 , platinium licence, security enabled. Using File-based user authentication | Elasticsearch Guide \[7.13\] | Elastic. I am trying to setup "users" file, with username:password. What is exactly the hash a… --- ## [Relevancy of Old article](https://discuss.elastic.co/t/relevancy-of-old-article/274622)
**Author:** [@sj123](https://discuss.elastic.co/u/sj123)\ **Replies:** 9\ **Last updated:** [June 4, 2021, 7:35am UTC](https://discuss.elastic.co/t/relevancy-of-old-article/274622 "2021-06-04T07:35:19Z")
Hi, I am quite new to elasticsearch. I have been reading this article Elasticsearch as a NoSQL Database | Elastic Blog\[Elasticsearch as a NoSQL Database\](https://Elasticsearch as a NoSQL Database). This was posted in 201… --- ## [Error in transaction creation based on Kafka record](https://discuss.elastic.co/t/error-in-transaction-creation-based-on-kafka-record/274927)
**Author:** [@saelastic](https://discuss.elastic.co/u/saelastic)\ **Replies:** 1\ **Last updated:** [June 4, 2021, 7:07am UTC](https://discuss.elastic.co/t/error-in-transaction-creation-based-on-kafka-record/274927 "2021-06-04T07:07:06Z")
Kibana version: 7.11.2 Elasticsearch version: 7.11.2 APM Server version: 7.11.2 APM Agent language and version: java - 1.22.0 Original install method (e.g. download page, yum, deb, from source, etc.) and version: … --- ## [KIbana Installation Fails](https://discuss.elastic.co/t/kibana-installation-fails/274915)
**Author:** [@Yogesh\_Pathak](https://discuss.elastic.co/u/Yogesh_Pathak)\ **Replies:** 2\ **Last updated:** [June 4, 2021, 6:40am UTC](https://discuss.elastic.co/t/kibana-installation-fails/274915 "2021-06-04T06:40:15Z")
I am installing Kibana for the first time. I am installing on Windows 10. The installation fails. First I get the error: \> \[error\]\[savedobjects-service\] \[.kibana\] Action failed with 'Request timed out'. Retrying attemp… --- ## [Rally logs shows max\_connections=1, but the doc said at least 256? And what does max\_connections really do? it seems es client didn't support this param](https://discuss.elastic.co/t/rally-logs-shows-max-connections-1-but-the-doc-said-at-least-256-and-what-does-max-connections-really-do-it-seems-es-client-didnt-support-this-param/274818)
**Author:** [@GITnewfish](https://discuss.elastic.co/u/GITnewfish)\ **Replies:** 1\ **Last updated:** [June 4, 2021, 12:08am UTC](https://discuss.elastic.co/t/rally-logs-shows-max-connections-1-but-the-doc-said-at-least-256-and-what-does-max-connections-really-do-it-seems-es-client-didnt-support-this-param/274818 "2021-06-04T00:08:57Z")
as the title said, I'm confused what does max\_connections really do? it seems es client didn't support this param. the rally command: esrally race --pipeline=benchmark-only --track=test --target-hosts=$target\_hosts --… --- ## [Got response code '401' contacting Elasticsearch at URL](https://discuss.elastic.co/t/got-response-code-401-contacting-elasticsearch-at-url/274608)
**Author:** [@vaclav1](https://discuss.elastic.co/u/vaclav1)\ **Replies:** 5\ **Last updated:** [June 4, 2021, 6:08am UTC](https://discuss.elastic.co/t/got-response-code-401-contacting-elasticsearch-at-url/274608 "2021-06-04T06:08:19Z")
Dear team, I have enabled TLS on cluster and wanted to switch communication between logstash and Elasticsearch to secure protocol. After I set up all I received following error while starting logstash (btw. password is … --- ## [Logstash configuration- How to do dynamic mapping?](https://discuss.elastic.co/t/logstash-configuration-how-to-do-dynamic-mapping/274749)
**Author:** [@Nisha2297](https://discuss.elastic.co/u/Nisha2297)\ **Replies:** 5\ **Last updated:** [June 4, 2021, 4:16am UTC](https://discuss.elastic.co/t/logstash-configuration-how-to-do-dynamic-mapping/274749 "2021-06-04T04:16:13Z")
I have one requirement to create dynamic mapping in my Logstash configuration to map two different columns. Please find below details: - Below is the ruby code I'm using in my logstash config: !\[image|690x351\](upload:/… --- ## [Security vulnerability support in ES 6.8.8](https://discuss.elastic.co/t/security-vulnerability-support-in-es-6-8-8/274872)
**Author:** [@bhupendra.mskhatri](https://discuss.elastic.co/u/bhupendra.mskhatri)\ **Replies:** 4\ **Last updated:** [June 4, 2021, 3:49am UTC](https://discuss.elastic.co/t/security-vulnerability-support-in-es-6-8-8/274872 "2021-06-04T03:49:40Z")
We ship ES 6.8.8 zip (windows) and tar(non-windows) with our application. I understand that 6.8.8 has reached EOL (Elastic Product End of Life Dates | Elastic). If any security vulnerability is reported in 6.8.8, will i… --- ## [Esrally error executing./esrally configure command](https://discuss.elastic.co/t/esrally-error-executing-esrally-configure-command/274894)
**Author:** [@liuliugang](https://discuss.elastic.co/u/liuliugang)\ **Replies:** 2\ **Last updated:** [June 4, 2021, 3:38am UTC](https://discuss.elastic.co/t/esrally-error-executing-esrally-configure-command/274894 "2021-06-04T03:38:16Z")
Please give advice or comments,thanks \[root@xm-ls001 bin\]# ./esrally configure Traceback (most recent call last): File "./esrally", line 7, in from esrally.rally import main File "/usr/local/python3.7/lib/python3.7… --- ## [Set fielddata=true after upgrade from 6.8 to 7.12](https://discuss.elastic.co/t/set-fielddata-true-after-upgrade-from-6-8-to-7-12/274939)
**Author:** [@vijay\_kaali](https://discuss.elastic.co/u/vijay_kaali)\ **Replies:** 0\ **Last updated:** [June 4, 2021, 3:33am UTC](https://discuss.elastic.co/t/set-fielddata-true-after-upgrade-from-6-8-to-7-12/274939 "2021-06-04T03:33:50Z")
after i upgrade from 6.8 to 7.12 my dashboard says \[Set fielddata=true on fieldname\] when i try to change in template . i found . at during 6.4 to 6.8 my template got vanished. question 1 : how can i set fielddata… --- ## [Packetbeat and Wireless network cards](https://discuss.elastic.co/t/packetbeat-and-wireless-network-cards/274938)
**Author:** [@tanner8302](https://discuss.elastic.co/u/tanner8302)\ **Replies:** 0\ **Last updated:** [June 4, 2021, 3:09am UTC](https://discuss.elastic.co/t/packetbeat-and-wireless-network-cards/274938 "2021-06-04T03:09:59Z")
I am looking some help in configuring the packetbeat.yml to sniff the wireless network card. I have installed NPCAP on the windows machine, I enabled raw traffic during the install. I then opened a command prompt and e… --- ## [Set kibana to use more decimal places of millisencond of time field](https://discuss.elastic.co/t/set-kibana-to-use-more-decimal-places-of-millisencond-of-time-field/274850)
**Author:** [@sosogh](https://discuss.elastic.co/u/sosogh)\ **Replies:** 2\ **Last updated:** [June 4, 2021, 1:17am UTC](https://discuss.elastic.co/t/set-kibana-to-use-more-decimal-places-of-millisencond-of-time-field/274850 "2021-06-04T01:17:59Z")
The log record displaying order in kibana discover is from lastest to the oldest . The millisencond of time field is six decimal places , but it seems that kibana only use three ? { "\_index": "btcs-all-in-one-000004… --- ## [Match phrase prefix queryにてField値と同値で検索してもヒットしない](https://discuss.elastic.co/t/match-phrase-prefix-query-field/274703)
**Author:** [@b18bd8be4bf795b30ee7](https://discuss.elastic.co/u/b18bd8be4bf795b30ee7)\ **Replies:** 2\ **Last updated:** [June 4, 2021, 12:55am UTC](https://discuss.elastic.co/t/match-phrase-prefix-query-field/274703 "2021-06-04T00:55:06Z")
掲題のとおりです。Indexに格納済みの値と同値でMatch phrase prefix検索を行ってもヒットしないパターンがあり、現象について理解したく質問いたします。 よろしくお願いいたします。 バージョン：7.10 Mapping PUT /my\_index1 { "settings" : { "index": { "number\_of\_shards" : 1, "number\_of\_re… --- ## [Update field value based on reference variable](https://discuss.elastic.co/t/update-field-value-based-on-reference-variable/274826)
**Author:** [@san2597](https://discuss.elastic.co/u/san2597)\ **Replies:** 2\ **Last updated:** [June 4, 2021, 12:04am UTC](https://discuss.elastic.co/t/update-field-value-based-on-reference-variable/274826 "2021-06-04T00:04:40Z")
Using Logstash, I'm parsing a log file that contains a timestamp value every time a new process starts. Each process starts and logs its own run time starting from 0 to the time the process completes. I'm trying to visua… --- ## [How to convert from String to Keyword, help needed](https://discuss.elastic.co/t/how-to-convert-from-string-to-keyword-help-needed/274830)
**Author:** [@marija.timovska](https://discuss.elastic.co/u/marija.timovska)\ **Replies:** 0\ **Last updated:** [June 3, 2021, 7:50am UTC](https://discuss.elastic.co/t/how-to-convert-from-string-to-keyword-help-needed/274830 "2021-06-03T07:50:25Z")
I need all the Id fields to be a keyword so I am not getting this error. This is my Json file I tried to configure it though I am not sure how because of my lack of experience so I am in need to assistance. I am a… --- ## [Is there a way to rebalance data nodes by disk space and not shards?](https://discuss.elastic.co/t/is-there-a-way-to-rebalance-data-nodes-by-disk-space-and-not-shards/274799)
**Author:** [@danksim](https://discuss.elastic.co/u/danksim)\ **Replies:** 4\ **Last updated:** [June 3, 2021, 9:39pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-rebalance-data-nodes-by-disk-space-and-not-shards/274799 "2021-06-03T21:39:47Z")
Is there a way to rebalance data nodes by disk space and not shards? I have a cluster that has a total of 846 indices but 273 of them have KBs of data while the rest have around 7GBs each since they rollover at 7GB. Thi… --- ## [Increase logstash performance](https://discuss.elastic.co/t/increase-logstash-performance/274923)
**Author:** [@Kfiro](https://discuss.elastic.co/u/Kfiro)\ **Replies:** 0\ **Last updated:** [June 3, 2021, 8:57pm UTC](https://discuss.elastic.co/t/increase-logstash-performance/274923 "2021-06-03T20:57:38Z")
Hi, I'm sending events from my SIEM system to logstash. sending SYSLOG CEF over tcp 5000-10000 EPS (events per second) my logstash hardware: 16 Giga RAM 8 CPU 100 Giga SSD My logstash don't ingest all data and cra… [Previous page](https://discuss.elastic.co/latest.md?page=1640) [Next page](https://discuss.elastic.co/latest.md?page=1642)