# Latest **URL:** https://discuss.elastic.co/latest.md?page=1664 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1665 --- ## [Monitoring.ui.logs.index not working on docker?](https://discuss.elastic.co/t/monitoring-ui-logs-index-not-working-on-docker/273186)
**Author:** [@Flavio\_Pompermaier](https://discuss.elastic.co/u/Flavio_Pompermaier)\ **Replies:** 2\ **Last updated:** [May 24, 2021, 8:17am UTC](https://discuss.elastic.co/t/monitoring-ui-logs-index-not-working-on-docker/273186 "2021-05-24T08:17:07Z")
Hi to all, I've setup a working Kibana using docker-compose and I use journalbeat to collect elasticsearch logs of my docker container (that use journald as logging option). I've tried to change monitoring.ui.logs.index … --- ## [Adding static legend in Kibana dashboards](https://discuss.elastic.co/t/adding-static-legend-in-kibana-dashboards/273759)
**Author:** [@Roy\_Levy](https://discuss.elastic.co/u/Roy_Levy)\ **Replies:** 3\ **Last updated:** [May 24, 2021, 8:01am UTC](https://discuss.elastic.co/t/adding-static-legend-in-kibana-dashboards/273759 "2021-05-24T08:01:44Z")
I'm trying to add a static legend to my Kibana dashboard in order to mark things in TSVB visualization. I'm using color in the TSVB visualization and am trying to explain the colors in a static legend: I want it to b… --- ## [Filebeat gcp module keeps getting hash config error when setting up](https://discuss.elastic.co/t/filebeat-gcp-module-keeps-getting-hash-config-error-when-setting-up/273643)
**Author:** [@stevensim226](https://discuss.elastic.co/u/stevensim226)\ **Replies:** 1\ **Last updated:** [May 24, 2021, 8:00am UTC](https://discuss.elastic.co/t/filebeat-gcp-module-keeps-getting-hash-config-error-when-setting-up/273643 "2021-05-24T08:00:39Z")
According to this docs, I have set up the gcp.yml file as written with the settings intact (firewall and vpcflow is enable: false) But i keep getting this error whenever I run sudo filebeat setup -e 2021-05-21T09:02:25… --- ## [What happens when logstash can't access to elasticsearch](https://discuss.elastic.co/t/what-happens-when-logstash-cant-access-to-elasticsearch/273783)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 1\ **Last updated:** [May 24, 2021, 7:54am UTC](https://discuss.elastic.co/t/what-happens-when-logstash-cant-access-to-elasticsearch/273783 "2021-05-24T07:54:12Z")
I want to ask that, I have logstash pipelines. Output filter only goes elasticsearch. when elasticsearch stops while logstash is running, logstash service stops with an error but what about sincedb ? When i restart ela… --- ## [Elasticsearch - added LDAP authentication, error "Invalid username or password"](https://discuss.elastic.co/t/elasticsearch-added-ldap-authentication-error-invalid-username-or-password/273509)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 1\ **Last updated:** [May 24, 2021, 7:12am UTC](https://discuss.elastic.co/t/elasticsearch-added-ldap-authentication-error-invalid-username-or-password/273509 "2021-05-24T07:12:52Z")
Dears, ELK 7.7.0 When I trying to login to Kibana through domain account I've got an error "Invalid username or password". No message errors in elasticsearchlog files. Built-in/internal accounts works well. This is co… --- ## [Removing zeros from a Timelion metric](https://discuss.elastic.co/t/removing-zeros-from-a-timelion-metric/273638)
**Author:** [@InesCM](https://discuss.elastic.co/u/InesCM)\ **Replies:** 2\ **Last updated:** [May 24, 2021, 7:12am UTC](https://discuss.elastic.co/t/removing-zeros-from-a-timelion-metric/273638 "2021-05-24T07:12:51Z")
Hi all! I'm trying to display the average CPU temperature of a set of devices, but I need to remove the zeros, as they (obviously because devices are not in the freezer :smile: ) mean that the temperature sensor is jus… --- ## [Out of memory error in elasticsearch](https://discuss.elastic.co/t/out-of-memory-error-in-elasticsearch/273785)
**Author:** [@jake\_JJ](https://discuss.elastic.co/u/jake_JJ)\ **Replies:** 1\ **Last updated:** [May 24, 2021, 6:39am UTC](https://discuss.elastic.co/t/out-of-memory-error-in-elasticsearch/273785 "2021-05-24T06:39:05Z")
jvm.options ################################################################ ## ## JVM configuration ## ################################################################ ## ## WARNING: DO NOT EDIT THIS FILE. If you wa… --- ## [Elasticsearch-net Use the least-privileged account](https://discuss.elastic.co/t/elasticsearch-net-use-the-least-privileged-account/273227)
**Author:** [@yt\_h](https://discuss.elastic.co/u/yt_h)\ **Replies:** 3\ **Last updated:** [May 24, 2021, 6:06am UTC](https://discuss.elastic.co/t/elasticsearch-net-use-the-least-privileged-account/273227 "2021-05-24T06:06:53Z")
NEST version: 7.10.0 elasticsearch version：7.5.1 My elasticsearch has enabled x-pack authentication, how to use the minimum permission configuration， This is my permission configuration I don’t know how to grant u… --- ## [Getting Error - ORA-00000: DPI-1047: Cannot locate a 64-bit Oracle Client library: "libclntsh.so: cannot open shared object file: No such file or directory elastc](https://discuss.elastic.co/t/getting-error-ora-00000-dpi-1047-cannot-locate-a-64-bit-oracle-client-library-libclntsh-so-cannot-open-shared-object-file-no-such-file-or-directory-elastc/273754)
**Author:** [@mrunalini](https://discuss.elastic.co/u/mrunalini)\ **Replies:** 0\ **Last updated:** [May 23, 2021, 7:58am UTC](https://discuss.elastic.co/t/getting-error-ora-00000-dpi-1047-cannot-locate-a-64-bit-oracle-client-library-libclntsh-so-cannot-open-shared-object-file-no-such-file-or-directory-elastc/273754 "2021-05-23T07:58:59Z")
HI Everyone, I am trying to connect Oracle DB via Metricbeat ,but getting error- ORA-00000: DPI-1047: Cannot locate a 64-bit Oracle Client library: "libclntsh.so: cannot open shared object file: No such file or directo… --- ## [Constant score + Fuzzy query issue](https://discuss.elastic.co/t/constant-score-fuzzy-query-issue/273779)
**Author:** [@jihyun\_ahn](https://discuss.elastic.co/u/jihyun_ahn)\ **Replies:** 0\ **Last updated:** [May 24, 2021, 3:52am UTC](https://discuss.elastic.co/t/constant-score-fuzzy-query-issue/273779 "2021-05-24T03:52:13Z")
We are using a constant score to ignore the distance score while using the Fuzzy Query. The result is successful. However, the difference between the CPU usage of Elasticsearch and the one used with the Constant score i… --- ## [Get Users API in CSV format?](https://discuss.elastic.co/t/get-users-api-in-csv-format/273773)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 2\ **Last updated:** [May 24, 2021, 3:51am UTC](https://discuss.elastic.co/t/get-users-api-in-csv-format/273773 "2021-05-24T03:51:05Z")
Hi All, Is there a way o get users list in a nicer format than JSON? CSV maybe? GET /\_security/user Cheers! --- ## [Convert Epoch to Date Histogram format on Kibana Dashboard](https://discuss.elastic.co/t/convert-epoch-to-date-histogram-format-on-kibana-dashboard/273743)
**Author:** [@singyuentang](https://discuss.elastic.co/u/singyuentang)\ **Replies:** 1\ **Last updated:** [May 24, 2021, 3:32am UTC](https://discuss.elastic.co/t/convert-epoch-to-date-histogram-format-on-kibana-dashboard/273743 "2021-05-24T03:32:13Z")
Hi, My input data into the ElasticSearch database is limited to epoch time. I need to display the data on the X-axis as date histogram format. Does anyone know how we can make this format conversion on the Kibana dashb… --- ## [\[Filebeat\]\[Fortinet Module\] Failed to parse field](https://discuss.elastic.co/t/filebeat-fortinet-module-failed-to-parse-field/273437)
**Author:** [@Danilo\_PC](https://discuss.elastic.co/u/Danilo_PC)\ **Replies:** 2\ **Last updated:** [May 24, 2021, 2:16am UTC](https://discuss.elastic.co/t/filebeat-fortinet-module-failed-to-parse-field/273437 "2021-05-24T02:16:25Z")
Hi, I'm running filebeat 7.12.1 receiving data from my Fortigate (FortiOS v6.4.1 build1637). Looking at filebeat log files, I can see that there is happening and parse error on "fortinet.firewall.cat" field: May 19 12:… --- ## [filebeat+logstash,The number of output events per second cannot break the hard limit (CPU and memory are sufficient)](https://discuss.elastic.co/t/filebeat-logstash-the-number-of-output-events-per-second-cannot-break-the-hard-limit-cpu-and-memory-are-sufficient/273596)
**Author:** [@liuliugang](https://discuss.elastic.co/u/liuliugang)\ **Replies:** 3\ **Last updated:** [May 24, 2021, 1:13am UTC](https://discuss.elastic.co/t/filebeat-logstash-the-number-of-output-events-per-second-cannot-break-the-hard-limit-cpu-and-memory-are-sufficient/273596 "2021-05-24T01:13:59Z")
FileBeat configuration :2 core 8G Logstahs configuration :8 core 8G FileBeat version and Logstash version 7.10.0 Single node FileBeat sends log to Logstash. The number of data per second is fixed and cannot break the 6… --- ## [Logstash Regex](https://discuss.elastic.co/t/logstash-regex/273700)
**Author:** [@pmorenosi](https://discuss.elastic.co/u/pmorenosi)\ **Replies:** 1\ **Last updated:** [May 21, 2021, 10:05pm UTC](https://discuss.elastic.co/t/logstash-regex/273700 "2021-05-21T22:05:36Z")
Hello everybody, in a logstash pipeline I am doing the following "if" if \[message\] = ~ /^postfix.\*/anvil$/ { match =\> \["message", "% {POSTFIX\_ANVIL} $"\] } LOG May 11 05:49:37 smtp postfix / anvil \[27651\]: statistics… --- ## [Stashing your first event assistance](https://discuss.elastic.co/t/stashing-your-first-event-assistance/273769)
**Author:** [@jasieltego](https://discuss.elastic.co/u/jasieltego)\ **Replies:** 2\ **Last updated:** [May 23, 2021, 7:34pm UTC](https://discuss.elastic.co/t/stashing-your-first-event-assistance/273769 "2021-05-23T19:34:22Z")
Hi All, I'm following the guide to stash first event, but I'm getting an error message in the command line when verifying logstash installation. I can CD to logstash directory but it's when I specify configuration from … --- ## [Logstash not working in docker](https://discuss.elastic.co/t/logstash-not-working-in-docker/273748)
**Author:** [@Shubham\_Pachpande](https://discuss.elastic.co/u/Shubham_Pachpande)\ **Replies:** 1\ **Last updated:** [May 23, 2021, 7:15pm UTC](https://discuss.elastic.co/t/logstash-not-working-in-docker/273748 "2021-05-23T19:15:09Z")
Using bundled JDK: /usr/share/logstash/jdk OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release. Sending Logstash logs to /usr/share/l… --- ## [Additional Variable adding in Detection EMAIL body](https://discuss.elastic.co/t/additional-variable-adding-in-detection-email-body/273290)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 4\ **Last updated:** [May 23, 2021, 10:14am UTC](https://discuss.elastic.co/t/additional-variable-adding-in-detection-email-body/273290 "2021-05-23T10:14:25Z")
Hi, I am trying to add additional fields in EMAIL message in my detection email alert action. {{#context.alerts}} Message : {{message}} port: {{port}} URL Host : {{url.host}} Http Connect: {{http.connect.host}} {… --- ## [Trace id and Transaction id getting inserted but Nothing shown in Stream tab](https://discuss.elastic.co/t/trace-id-and-transaction-id-getting-inserted-but-nothing-shown-in-stream-tab/273739)
**Author:** [@gaurav9620](https://discuss.elastic.co/u/gaurav9620)\ **Replies:** 1\ **Last updated:** [May 23, 2021, 3:38pm UTC](https://discuss.elastic.co/t/trace-id-and-transaction-id-getting-inserted-but-nothing-shown-in-stream-tab/273739 "2021-05-23T15:38:15Z")
If you are asking about a problem you are experiencing, please use the following template, as it will help us help you. If you have a different problem, please delete all of this text :slight\_smile: TIP 1: select at lea… --- ## [How to send ingest pipeline output to a index alias name](https://discuss.elastic.co/t/how-to-send-ingest-pipeline-output-to-a-index-alias-name/273697)
**Author:** [@Kannappan\_Somu](https://discuss.elastic.co/u/Kannappan_Somu)\ **Replies:** 11\ **Last updated:** [May 23, 2021, 2:26pm UTC](https://discuss.elastic.co/t/how-to-send-ingest-pipeline-output-to-a-index-alias-name/273697 "2021-05-23T14:26:15Z")
Hi , I am trying to send ingest pipeline output to a index alias name , so that the index rollovers correctly. what is the required processor or how do we do this ? --- ## [Is it possible to use field exists Canvas essql?](https://discuss.elastic.co/t/is-it-possible-to-use-field-exists-canvas-essql/273624)
**Author:** [@thirukumaran09](https://discuss.elastic.co/u/thirukumaran09)\ **Replies:** 2\ **Last updated:** [May 23, 2021, 2:02pm UTC](https://discuss.elastic.co/t/is-it-possible-to-use-field-exists-canvas-essql/273624 "2021-05-23T14:02:46Z")
Hi! I am trying to use Canvas to build a Dashboard to show the Metrics based on certain field availability. Is it possible to use the exists function in essql? Or is there any alternative functions available to execut… --- ## [Where does the documents and segments are present in the system](https://discuss.elastic.co/t/where-does-the-documents-and-segments-are-present-in-the-system/273756)
**Author:** [@surya3](https://discuss.elastic.co/u/surya3)\ **Replies:** 1\ **Last updated:** [May 23, 2021, 1:50pm UTC](https://discuss.elastic.co/t/where-does-the-documents-and-segments-are-present-in-the-system/273756 "2021-05-23T13:50:22Z")
Hi team, I got one doubt while I was exploring on how documents are retrieved based on the search query. Then I came to know that the search query will be given to the shards in the cluster of the nodes by the one of th… --- ## [Visual Builder \> Removing Axis Min and Axis Max sets min=0 max=1](https://discuss.elastic.co/t/visual-builder-removing-axis-min-and-axis-max-sets-min-0-max-1/273647)
**Author:** [@Ludek\_Sanda](https://discuss.elastic.co/u/Ludek_Sanda)\ **Replies:** 2\ **Last updated:** [May 23, 2021, 9:46am UTC](https://discuss.elastic.co/t/visual-builder-removing-axis-min-and-axis-max-sets-min-0-max-1/273647 "2021-05-23T09:46:41Z")
There seems to be a bug that when you remove the Axis Min and Axis Max in VB it's set to 0-1. After setting the Separate axis = F the min/max is set based on the data correctly, but setting Separate axis = T back will b… --- ## [What is the need of installing Nginix while installing elastic search and kibana](https://discuss.elastic.co/t/what-is-the-need-of-installing-nginix-while-installing-elastic-search-and-kibana/272486)
**Author:** [@surya3](https://discuss.elastic.co/u/surya3)\ **Replies:** 3\ **Last updated:** [May 23, 2021, 8:00am UTC](https://discuss.elastic.co/t/what-is-the-need-of-installing-nginix-while-installing-elastic-search-and-kibana/272486 "2021-05-23T08:00:56Z")
Hi Team, Recently i followed some tutorials on the installation of elastic search and kibana. Some of them are installing Nginx along with elastic search and kibana. What is the need for installing Nginx? How does it … --- ## [What is the difference between fields pass by filebeat and fields in logstash?](https://discuss.elastic.co/t/what-is-the-difference-between-fields-pass-by-filebeat-and-fields-in-logstash/273727)
**Author:** [@stille](https://discuss.elastic.co/u/stille)\ **Replies:** 5\ **Last updated:** [May 23, 2021, 3:37am UTC](https://discuss.elastic.co/t/what-is-the-difference-between-fields-pass-by-filebeat-and-fields-in-logstash/273727 "2021-05-23T03:37:35Z")
I'm a new guy about elk. i'm trying use logstash filter instead of filebeat processors. There are some fields passed by filebeat in logstash , for example: i had set some fields in filebeat: "fields.app"="nginx" or "do… --- ## [Parse subdomain from fqdn in logstash](https://discuss.elastic.co/t/parse-subdomain-from-fqdn-in-logstash/273535)
**Author:** [@tushar.bansal](https://discuss.elastic.co/u/tushar.bansal)\ **Replies:** 6\ **Last updated:** [May 22, 2021, 11:45pm UTC](https://discuss.elastic.co/t/parse-subdomain-from-fqdn-in-logstash/273535 "2021-05-22T23:45:16Z")
Hi, I have several events coming in logstash with info of web link accessed. example: DNS query is called for the name crl.sectigo.com, type 28 DNS query is called for the name repo.maven.apache.org, type 2 DNS quer… --- ## [How to use if condition to filter spider event gracefully in logstash](https://discuss.elastic.co/t/how-to-use-if-condition-to-filter-spider-event-gracefully-in-logstash/273606)
**Author:** [@stille](https://discuss.elastic.co/u/stille)\ **Replies:** 6\ **Last updated:** [May 22, 2021, 11:39pm UTC](https://discuss.elastic.co/t/how-to-use-if-condition-to-filter-spider-event-gracefully-in-logstash/273606 "2021-05-22T23:39:29Z")
I can use drop event in filebeat to filter spider logs , just like following: - drop\_event: when: or: - contains: message: FacebookBot - contains: message… --- ## [Failed to start elastic search](https://discuss.elastic.co/t/failed-to-start-elastic-search/273323)
**Author:** [@cedler](https://discuss.elastic.co/u/cedler)\ **Replies:** 18\ **Last updated:** [May 22, 2021, 10:27pm UTC](https://discuss.elastic.co/t/failed-to-start-elastic-search/273323 "2021-05-22T22:27:36Z")
Good evening, all seems ok, I have installed java 11, etc... But when I want to start the service I have somes errors... I put you the commandes and answers in putty : \[root@ortie-bio ~\]# systemctl start elasticsearch… --- ## [Could not locate that index-pattern-field (id: @timestamp)](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-timestamp/273737)
**Author:** [@majidbarz](https://discuss.elastic.co/u/majidbarz)\ **Replies:** 3\ **Last updated:** [May 22, 2021, 6:43pm UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-timestamp/273737 "2021-05-22T18:43:14Z")
anyone can help me? Error: Could not locate that index-pattern-field (id: @timestamp) at FieldParamType.deserialize (http://192.168.226.11:5601/39457/bundles/plugin/data/data.plugin.js:1:535357) at http://192.168.226.… --- ## [Detection Rule Key Value Reference Url's](https://discuss.elastic.co/t/detection-rule-key-value-reference-urls/272466)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 5\ **Last updated:** [May 22, 2021, 5:23pm UTC](https://discuss.elastic.co/t/detection-rule-key-value-reference-urls/272466 "2021-05-22T17:23:17Z")
Hello, After working intensively with Elastic Detections and alerting etc, I wanted to suggest that imho it would be an improvement if the reference url's were key / value instead of only the url's. Sometimes the url's … [Previous page](https://discuss.elastic.co/latest.md?page=1663) [Next page](https://discuss.elastic.co/latest.md?page=1665)