# Latest **URL:** https://discuss.elastic.co/latest.md?page=1646 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1647 --- ## [Logstash not showing generated output](https://discuss.elastic.co/t/logstash-not-showing-generated-output/274677)
**Author:** [@Ashwani\_Shukla](https://discuss.elastic.co/u/Ashwani_Shukla)\ **Replies:** 2\ **Last updated:** [June 2, 2021, 3:50am UTC](https://discuss.elastic.co/t/logstash-not-showing-generated-output/274677 "2021-06-02T03:50:50Z")
The pipeline file name is newstash.conf input{ file{ path =\> \[ "/etc/logstash/sample.txt" \] } } output { stdout{ } } The sample.txt file has some string only. The output is l… --- ## [Secure settings kibana](https://discuss.elastic.co/t/secure-settings-kibana/274684)
**Author:** [@mohamed\_el\_mannouti](https://discuss.elastic.co/u/mohamed_el_mannouti)\ **Replies:** 6\ **Last updated:** [June 2, 2021, 2:44am UTC](https://discuss.elastic.co/t/secure-settings-kibana/274684 "2021-06-02T02:44:31Z")
How can I hide the password in kibana.yml --- ## [Date in runtime fields](https://discuss.elastic.co/t/date-in-runtime-fields/274692)
**Author:** [@IGB042](https://discuss.elastic.co/u/IGB042)\ **Replies:** 0\ **Last updated:** [June 2, 2021, 1:16am UTC](https://discuss.elastic.co/t/date-in-runtime-fields/274692 "2021-06-02T01:16:34Z")
I currently have an issue with calculating the day of week in a runtime field. My time field is stored in UTC "isotimestamp": \["2021-06-01T23:55:38.726Z"\] and displays correctly according to my TZ (UTC+10) isotimesta… --- ## [How to join two index](https://discuss.elastic.co/t/how-to-join-two-index/274572)
**Author:** [@jium](https://discuss.elastic.co/u/jium)\ **Replies:** 3\ **Last updated:** [June 2, 2021, 2:21am UTC](https://discuss.elastic.co/t/how-to-join-two-index/274572 "2021-06-02T02:21:34Z")
Hi, I want to join two indexes or merge them into one index. One index is being collected from the apache log and the other from mysql. I have to join the data through common key in two indexes and visualize it thro… --- ## [Watcher alerts issue with weekly date histogram](https://discuss.elastic.co/t/watcher-alerts-issue-with-weekly-date-histogram/274642)
**Author:** [@Roy\_Levy](https://discuss.elastic.co/u/Roy_Levy)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 2:05pm UTC](https://discuss.elastic.co/t/watcher-alerts-issue-with-weekly-date-histogram/274642 "2021-06-01T14:05:57Z")
Hey, I'm trying to simulate a custom watcher alert on an index - it creates index with some aggregations on the given index in order to add only those that pass some threshold. The watcher uses date histogram on the key… --- ## [Logstashのs3-sns-sqs input pluguinを使用した場合のlogstashで保持するキュー情報](https://discuss.elastic.co/t/logstash-s3-sns-sqs-input-pluguin-logstash/274284)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 1\ **Last updated:** [June 2, 2021, 2:04am UTC](https://discuss.elastic.co/t/logstash-s3-sns-sqs-input-pluguin-logstash/274284 "2021-06-02T02:04:02Z")
logstashのinput pluguinとして、S3-SNS-SQS pluginを使用しているのですが、その場合logstashのキュー情報として保持する内容としては何になりますでしょうか。(S3内にあるファイル内容をメモリに持つイメージなのか、SQSから取得したキュー情報をメモリにもつイメージなのか) --- ## [「Cloudwatch input plugin」によるログの読込み状況保持/引継ぎについて](https://discuss.elastic.co/t/cloudwatch-input-plugin/272670)
**Author:** [@Nishisaka](https://discuss.elastic.co/u/Nishisaka)\ **Replies:** 1\ **Last updated:** [June 2, 2021, 1:52am UTC](https://discuss.elastic.co/t/cloudwatch-input-plugin/272670 "2021-06-02T01:52:20Z")
AWSのCloudWatchメトリクスを収集するため、 EC2インスタンス(Linux)にLogstash(7.11)をインストールし、 「Cloudwatch input plugin」を利用してメトリクスの収集を行おうとしております。 現状、Logstashサーバ2台を現用/待機構成(コールドスタンバイ)としており、 障害時に待機系に切替わった際は、待機系にはフェールオーバ以降に発生したメトリクスから収集することになります。 … --- ## [Broad Permissions on Operator in Restricted mode](https://discuss.elastic.co/t/broad-permissions-on-operator-in-restricted-mode/274690)
**Author:** [@TheRealDwright](https://discuss.elastic.co/u/TheRealDwright)\ **Replies:** 0\ **Last updated:** [June 2, 2021, 12:37am UTC](https://discuss.elastic.co/t/broad-permissions-on-operator-in-restricted-mode/274690 "2021-06-02T00:37:53Z")
I've recently set up ECK using the restricted installation and I wanted to ask if anyone has validated the very broad permissions provided to the operator in the operator namespace are necessary before filing a GitHub is… --- ## [Correct way to use the mutate rename filter](https://discuss.elastic.co/t/correct-way-to-use-the-mutate-rename-filter/274683)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 4\ **Last updated:** [June 2, 2021, 12:23am UTC](https://discuss.elastic.co/t/correct-way-to-use-the-mutate-rename-filter/274683 "2021-06-02T00:23:25Z")
Hello, this is weird, For the last couple of years I've been using the mutate rename filter in the following way, with one rename option for every field inside the same mutate block. mutate { rename =\> { "field1" =\>… --- ## [Problem with SQL query when using RLIKE or LIKE function](https://discuss.elastic.co/t/problem-with-sql-query-when-using-rlike-or-like-function/274689)
**Author:** [@simran96](https://discuss.elastic.co/u/simran96)\ **Replies:** 5\ **Last updated:** [June 1, 2021, 11:48pm UTC](https://discuss.elastic.co/t/problem-with-sql-query-when-using-rlike-or-like-function/274689 "2021-06-01T23:48:27Z")
Hi I'm trying to write a query where i want to search for a particular pattern but i'm getting errors. I have used the \\ escape as well but still its of no use. My query: curl -XPOST "http://xxxx/\_sql?format=csv" -H 'C… --- ## [Using Kibana to detect DDOS attacks for Analysis - Home Lab](https://discuss.elastic.co/t/using-kibana-to-detect-ddos-attacks-for-analysis-home-lab/274363)
**Author:** [@momo1104](https://discuss.elastic.co/u/momo1104)\ **Replies:** 3\ **Last updated:** [June 1, 2021, 10:17pm UTC](https://discuss.elastic.co/t/using-kibana-to-detect-ddos-attacks-for-analysis-home-lab/274363 "2021-06-01T22:17:24Z")
Hello everyone, i'm new to Infosec and very new to ELK stack. I am running a home lab inside a VM. I've downloaded a sample DDos dataset from kaggle.com and ingested that data into elk stack, but not really sure what to… --- ## [Watcher alert for matching multiple fields in same index](https://discuss.elastic.co/t/watcher-alert-for-matching-multiple-fields-in-same-index/273690)
**Author:** [@Patr123](https://discuss.elastic.co/u/Patr123)\ **Replies:** 2\ **Last updated:** [June 1, 2021, 9:17pm UTC](https://discuss.elastic.co/t/watcher-alert-for-matching-multiple-fields-in-same-index/273690 "2021-06-01T21:17:32Z")
Hello, I am trying to match multiple fields in a single index for my watcher alert and having some difficulties doing that. My watcher looks like: { "trigger": { "schedule": { "interval": "15m" } }, … --- ## [Is it ok to have a more then one tie breaker node for less then couple of hours](https://discuss.elastic.co/t/is-it-ok-to-have-a-more-then-one-tie-breaker-node-for-less-then-couple-of-hours/274685)
**Author:** [@Sanjay1](https://discuss.elastic.co/u/Sanjay1)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 9:10pm UTC](https://discuss.elastic.co/t/is-it-ok-to-have-a-more-then-one-tie-breaker-node-for-less-then-couple-of-hours/274685 "2021-06-01T21:10:09Z")
We like to add 2nd tie breaker node along with our existing tiebreaker node. Once the new tie breaker node start working then like to decommission the existing tiebreaker node. For some time less the couple of hours it… --- ## [X of Y shards failed in 7.12](https://discuss.elastic.co/t/x-of-y-shards-failed-in-7-12/271052)
**Author:** [@d4nnyx](https://discuss.elastic.co/u/d4nnyx)\ **Replies:** 4\ **Last updated:** [June 1, 2021, 8:27pm UTC](https://discuss.elastic.co/t/x-of-y-shards-failed-in-7-12/271052 "2021-06-01T20:27:42Z")
Hello there, after upgrade Elastic Stack from 7.10 to 7.12 a lot of dasboards, visualization and searches in discover shows the error message X of Y shards failed. In most cases, reason is that the specific field is not… --- ## [Metricbeat to logstash problem](https://discuss.elastic.co/t/metricbeat-to-logstash-problem/274672)
**Author:** [@farciarz121](https://discuss.elastic.co/u/farciarz121)\ **Replies:** 4\ **Last updated:** [June 1, 2021, 7:58pm UTC](https://discuss.elastic.co/t/metricbeat-to-logstash-problem/274672 "2021-06-01T19:58:59Z")
Instruction provided on the elastic website show how to configure meatricbeats to monitor stack. My setup however is slightly different. I have metricbeats insalled on VM, it passes logs to logstash and logstash talks t… --- ## [Sort by array values](https://discuss.elastic.co/t/sort-by-array-values/274681)
**Author:** [@romina](https://discuss.elastic.co/u/romina)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 7:29pm UTC](https://discuss.elastic.co/t/sort-by-array-values/274681 "2021-06-01T19:29:36Z")
Hi! I need help with this use case Documents { "values": \["value1", "value3"\], "price": 3 } { "values": \["value1", "value2", "value3"\], "price": 1 } { "values": \["value3"\], … --- ## [V7.13.0 breaks OSS distributions](https://discuss.elastic.co/t/v7-13-0-breaks-oss-distributions/274568)
**Author:** [@Dan\_Bason](https://discuss.elastic.co/u/Dan_Bason)\ **Replies:** 3\ **Last updated:** [June 1, 2021, 7:26pm UTC](https://discuss.elastic.co/t/v7-13-0-breaks-oss-distributions/274568 "2021-06-01T19:26:40Z")
I've only tested with Metricbeat, but I assume most of the beats will be affected in v7.13.0. Connections to OSS distributions of Elasticsearch now fail due to a new license check introduced in libbeat (they throw an er… --- ## [Setting for alerts in elk](https://discuss.elastic.co/t/setting-for-alerts-in-elk/274199)
**Author:** [@varunbsgaur](https://discuss.elastic.co/u/varunbsgaur)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 7:05pm UTC](https://discuss.elastic.co/t/setting-for-alerts-in-elk/274199 "2021-06-01T19:05:32Z")
In order to use alerts in ELK I followed the mentioned steps but always found some error while starting up the local elasticsearch and kibana servers. Kindly help me know where I went wrong . step 1 :creating certifica… --- ## [Mustache Split String](https://discuss.elastic.co/t/mustache-split-string/274347)
**Author:** [@Dzious](https://discuss.elastic.co/u/Dzious)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 7:01pm UTC](https://discuss.elastic.co/t/mustache-split-string/274347 "2021-06-01T19:01:43Z")
Hi, I'm currently struggling with kibana alerting. I've made a Log threshold alert that's working fine but i would need, in my final document, to have values from context.group split in multiples fields (split char wou… --- ## [A single log is getting divided into multiple logs in Kibana](https://discuss.elastic.co/t/a-single-log-is-getting-divided-into-multiple-logs-in-kibana/274161)
**Author:** [@prajwalgmpp](https://discuss.elastic.co/u/prajwalgmpp)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 6:46pm UTC](https://discuss.elastic.co/t/a-single-log-is-getting-divided-into-multiple-logs-in-kibana/274161 "2021-06-01T18:46:12Z")
May 27, 2021 @ 12:06:33.318 {"log":{"timestamp":"2021-05-27 08:36:33,317","level":"INFO","transactionId":"","category":"InfoLogger","type":"trace","message":"\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* May 27, 2021 … --- ## [Reading data from winlogbeats](https://discuss.elastic.co/t/reading-data-from-winlogbeats/274673)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 6:27pm UTC](https://discuss.elastic.co/t/reading-data-from-winlogbeats/274673 "2021-06-01T18:27:54Z")
I have been using a single system install of Elastic Stack and have been able to see information come in through my Kibana. I currently have FileBeats, WinlogBeats and MetricBeats installed and working. I am getting in… --- ## [Dashboards with non-uniform indexes in Kibana](https://discuss.elastic.co/t/dashboards-with-non-uniform-indexes-in-kibana/274669)
**Author:** [@obnkf](https://discuss.elastic.co/u/obnkf)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 5:52pm UTC](https://discuss.elastic.co/t/dashboards-with-non-uniform-indexes-in-kibana/274669 "2021-06-01T17:52:35Z")
Here's my problem: I have two indexes that share an ID field of the same name and type (source\_location), but no other fields: Index M contains the source's metadata (e.g. who created the source, digital signature info… --- ## [Elastic APM .NET Agent 1.10.0 Security Update](https://discuss.elastic.co/t/elastic-apm-net-agent-1-10-0-security-update/274668)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 5:42pm UTC](https://discuss.elastic.co/t/elastic-apm-net-agent-1-10-0-security-update/274668 "2021-06-01T17:42:39Z")
Elastic APM .NET Agent information disclosure (ESA-2021-14) The Elastic APM .NET Agent can leak sensitive HTTP header information when logging the details during an application error. Normally, the APM agent will saniti… --- ## [Looking for documentation on plugin development](https://discuss.elastic.co/t/looking-for-documentation-on-plugin-development/274250)
**Author:** [@mnickerson](https://discuss.elastic.co/u/mnickerson)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 5:39pm UTC](https://discuss.elastic.co/t/looking-for-documentation-on-plugin-development/274250 "2021-06-01T17:39:33Z")
This is for Elasticsearch and Kibana 7.10.2 I'm currently trying to create a plugin in Kibana that will give a user a form, take the data from there as arguments to use in a transform. Then to create a vega visualizatio… --- ## [Parse line error: parsing CRI timestamp with filebeat 7.9.3](https://discuss.elastic.co/t/parse-line-error-parsing-cri-timestamp-with-filebeat-7-9-3/274666)
**Author:** [@Usman18](https://discuss.elastic.co/u/Usman18)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 5:14pm UTC](https://discuss.elastic.co/t/parse-line-error-parsing-cri-timestamp-with-filebeat-7-9-3/274666 "2021-06-01T17:14:14Z")
I am using filebeat 7.9.3. The logs are being transferred to kafka. But I see an error in the logs inside docker container of filebeat. The error details are given below: filebeat\_1 | 2021-06-01T17:10:2… --- ## [Unable to access Enterprise Search on a cloud VM](https://discuss.elastic.co/t/unable-to-access-enterprise-search-on-a-cloud-vm/274432)
**Author:** [@kristang91](https://discuss.elastic.co/u/kristang91)\ **Replies:** 2\ **Last updated:** [June 1, 2021, 5:11pm UTC](https://discuss.elastic.co/t/unable-to-access-enterprise-search-on-a-cloud-vm/274432 "2021-06-01T17:11:00Z")
Hi there, only posting because I've really tried reading all documentation and googling, but found no solution. I've gotten a docker-compose consisting of 3 ES nodes, kibana, enterprise search, a React front-end (Elastic… --- ## [Not able to configure Alerts in Kibana](https://discuss.elastic.co/t/not-able-to-configure-alerts-in-kibana/274533)
**Author:** [@Akanksha\_Pandey](https://discuss.elastic.co/u/Akanksha_Pandey)\ **Replies:** 19\ **Last updated:** [June 1, 2021, 5:00pm UTC](https://discuss.elastic.co/t/not-able-to-configure-alerts-in-kibana/274533 "2021-06-01T17:00:22Z")
Hi, I'm using a docker compose file for ELK setup and using the latest version (above 7) for kibana. Now I set the xpack.encryptedSavedObjects.encryptionKey parameter in the kibana.yml so that i can use the alert and a… --- ## [Thread\_pool write change size of queue](https://discuss.elastic.co/t/thread-pool-write-change-size-of-queue/274470)
**Author:** [@Cristian1988](https://discuss.elastic.co/u/Cristian1988)\ **Replies:** 2\ **Last updated:** [June 1, 2021, 4:53pm UTC](https://discuss.elastic.co/t/thread-pool-write-change-size-of-queue/274470 "2021-06-01T16:53:07Z")
Hi, We have a clúster running with elastic version 7.8.2, that by default the write queue\_size of thread\_pool is 200 In the lastest versions of elasticsearch this queue\_size by default is 10000. My question is can i up… --- ## [Canvas maps section fullscreen](https://discuss.elastic.co/t/canvas-maps-section-fullscreen/274591)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 2\ **Last updated:** [June 1, 2021, 4:33pm UTC](https://discuss.elastic.co/t/canvas-maps-section-fullscreen/274591 "2021-06-01T16:33:43Z")
Hi, I added Maps in my canvas page but when I go in fullscreen mode the click on Maps doesn't work... If I return in "normal mode" the Maps works correctly... why? thanks --- ## [Comparing Two Aggregate Buckets](https://discuss.elastic.co/t/comparing-two-aggregate-buckets/274663)
**Author:** [@gshanklin](https://discuss.elastic.co/u/gshanklin)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 3:59pm UTC](https://discuss.elastic.co/t/comparing-two-aggregate-buckets/274663 "2021-06-01T15:59:42Z")
Hello, I am having a difficult time trying to compare the results of two aggerates. More specifically, I want to find unique "keys" between two aggerate buckets. For example, I have the two aggregates on the sample web … [Previous page](https://discuss.elastic.co/latest.md?page=1645) [Next page](https://discuss.elastic.co/latest.md?page=1647)