# Latest **URL:** https://discuss.elastic.co/latest.md?page=1730 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1731 --- ## [Broken grok after the update to Logstash 7.12](https://discuss.elastic.co/t/broken-grok-after-the-update-to-logstash-7-12/269863)
**Author:** [@aviadhaham](https://discuss.elastic.co/u/aviadhaham)\ **Replies:** 3\ **Last updated:** [April 15, 2021, 3:03pm UTC](https://discuss.elastic.co/t/broken-grok-after-the-update-to-logstash-7-12/269863 "2021-04-15T15:03:51Z")
Hello, In my company, after upgrading our cluster to the latest version 7.12, we noticed that one of our grok patterns stopped working. Important things to mention: The pipeline is functioning correctly, logs are com… --- ## [Multiple pipelines](https://discuss.elastic.co/t/multiple-pipelines/270238)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 3:02pm UTC](https://discuss.elastic.co/t/multiple-pipelines/270238 "2021-04-15T15:02:05Z")
can somebody helps me 4.29} \[INFO \] 2021-04-15 07:55:35.481 \[\[beats-server\]-pipeline-manager\] beats - Starting input listener {:address=\>"0.0.0.0:5044"} \[INFO \] 2021-04-15 07:55:35.666 \[\[auth\]-pipeline-manager\] javapi… --- ## [Mapping a Data in a log to another Field](https://discuss.elastic.co/t/mapping-a-data-in-a-log-to-another-field/270250)
**Author:** [@Wilks](https://discuss.elastic.co/u/Wilks)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 2:54pm UTC](https://discuss.elastic.co/t/mapping-a-data-in-a-log-to-another-field/270250 "2021-04-15T14:54:10Z")
Hey Everyone, How do you map a field from the logs to another field. So for example if I have the following log message":"03-MAR-21 00:30:46|142.122.217.10 |1| I want to parse out |1| but also then map it to an index … --- ## [Elasticsearch can't login https://localhost:9200 after setting ssl](https://discuss.elastic.co/t/elasticsearch-cant-login-https-localhost-9200-after-setting-ssl/270169)
**Author:** [@gricn](https://discuss.elastic.co/u/gricn)\ **Replies:** 10\ **Last updated:** [April 15, 2021, 2:50pm UTC](https://discuss.elastic.co/t/elasticsearch-cant-login-https-localhost-9200-after-setting-ssl/270169 "2021-04-15T14:50:25Z")
Environment: Win10 WLS2 Ubuntu 20.04, Docker version 20.10.5, Docker-compose version 1.29.0, ELK 7.12.0, nginx version 1.18.0 I have enabled xpack in the last version docker-compose.yml setting and use ./bin/elasticsear… --- ## [TSVB Table Sorted by timestamp](https://discuss.elastic.co/t/tsvb-table-sorted-by-timestamp/267271)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 6\ **Last updated:** [April 15, 2021, 2:27pm UTC](https://discuss.elastic.co/t/tsvb-table-sorted-by-timestamp/267271 "2021-04-15T14:27:20Z")
Hello, I have a nice TSVB graph and I'm trying to get a table out of it sorted by timestamp. Should be simple, but it doesn't show any value: I want a time-based table like the other Table graph, but needs to be TSVB… --- ## [ERROR instance/beat.go:971 Exiting: resource 'filebeat-7.12.0' exists, but it is not an alias](https://discuss.elastic.co/t/error-instance-beat-go-971-exiting-resource-filebeat-7-12-0-exists-but-it-is-not-an-alias/270139)
**Author:** [@thrak](https://discuss.elastic.co/u/thrak)\ **Replies:** 4\ **Last updated:** [April 15, 2021, 2:17pm UTC](https://discuss.elastic.co/t/error-instance-beat-go-971-exiting-resource-filebeat-7-12-0-exists-but-it-is-not-an-alias/270139 "2021-04-15T14:17:05Z")
Hello, I am in the process of installing filebeats 7.12 on some elastic cluster nodes in my dev environment and when I run: sudo filebeat setup -e On one of my nodes, I receive this error. ERROR instance/beat.go:971… --- ## [Filebeat systemd not writing logs to log directory](https://discuss.elastic.co/t/filebeat-systemd-not-writing-logs-to-log-directory/270247)
**Author:** [@madhan\_dhanikachalam](https://discuss.elastic.co/u/madhan_dhanikachalam)\ **Replies:** 0\ **Last updated:** [April 15, 2021, 2:04pm UTC](https://discuss.elastic.co/t/filebeat-systemd-not-writing-logs-to-log-directory/270247 "2021-04-15T14:04:48Z")
I have filebeat 7.12 and have the below systemd service \[Unit\] Description=Filebeat sends log files to Logstash or directly to Elasticsearch. Documentation=https://www.elastic.co/products/beats/filebeat Wants=network-on… --- ## [Filebeat to kafka failure](https://discuss.elastic.co/t/filebeat-to-kafka-failure/270163)
**Author:** [@madhan\_dhanikachalam](https://discuss.elastic.co/u/madhan_dhanikachalam)\ **Replies:** 4\ **Last updated:** [April 15, 2021, 1:57pm UTC](https://discuss.elastic.co/t/filebeat-to-kafka-failure/270163 "2021-04-15T13:57:56Z")
filebeat on server 1 seems to send log data to kafka perfectly, no issues.. set up filebeat on server2 to send log data to kafka and get the below error 2021-04-14T20:46:28.475-0400 INFO \[publisher\] pipeline/… --- ## [When to separate data nodes and master node roles](https://discuss.elastic.co/t/when-to-separate-data-nodes-and-master-node-roles/270127)
**Author:** [@bharat1](https://discuss.elastic.co/u/bharat1)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 1:49pm UTC](https://discuss.elastic.co/t/when-to-separate-data-nodes-and-master-node-roles/270127 "2021-04-15T13:49:39Z")
Hi All, Is there any criteria that should be followed to decide on separating Master nodes and Data nodes? --- ## [GCP Discovert Plugi installation](https://discuss.elastic.co/t/gcp-discovert-plugi-installation/270220)
**Author:** [@marcin.wizgird](https://discuss.elastic.co/u/marcin.wizgird)\ **Replies:** 5\ **Last updated:** [April 15, 2021, 1:45pm UTC](https://discuss.elastic.co/t/gcp-discovert-plugi-installation/270220 "2021-04-15T13:45:47Z")
Hi, I encountered challenge with GCP Discovery Plugin installation. ElasticSearch version which is installed is 6.8.4. whereas plugin accessible on the website is for version 6.8.15. During the installation I encounter … --- ## [Dynamic fetch data from index to generate TreeFlow](https://discuss.elastic.co/t/dynamic-fetch-data-from-index-to-generate-treeflow/268993)
**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\ **Replies:** 30\ **Last updated:** [April 15, 2021, 1:28pm UTC](https://discuss.elastic.co/t/dynamic-fetch-data-from-index-to-generate-treeflow/268993 "2021-04-15T13:28:00Z")
Kibana version : 7.9 Elasticsearch version : 7.9 APM Server version : 7.9 APM Agent language and version : java 1.8 Fresh install or upgraded from other version? fresh install Is there anything special in your setup… --- ## [Does ElasticSearch itself have access logs?](https://discuss.elastic.co/t/does-elasticsearch-itself-have-access-logs/270236)
**Author:** [@asasas234](https://discuss.elastic.co/u/asasas234)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 1:25pm UTC](https://discuss.elastic.co/t/does-elasticsearch-itself-have-access-logs/270236 "2021-04-15T13:25:23Z")
Does ElasticSearch have a feature similar to Tomcat access logs? So that I can see the history of requests at a specific time --- ## [Creating Dashbard and visualisation with python](https://discuss.elastic.co/t/creating-dashbard-and-visualisation-with-python/270235)
**Author:** [@rockiram](https://discuss.elastic.co/u/rockiram)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 1:24pm UTC](https://discuss.elastic.co/t/creating-dashbard-and-visualisation-with-python/270235 "2021-04-15T13:24:02Z")
Hi, I am new to kibana. Is it possible to create kibana visualisation and dashboard using python? If so, Please suggest me some references to start Thanks in Advance!!! --- ## [How to run rally against an existing on-premise cluster](https://discuss.elastic.co/t/how-to-run-rally-against-an-existing-on-premise-cluster/270228)
**Author:** [@anoopkv](https://discuss.elastic.co/u/anoopkv)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 1:17pm UTC](https://discuss.elastic.co/t/how-to-run-rally-against-an-existing-on-premise-cluster/270228 "2021-04-15T13:17:11Z")
I am running my elasticsearch (version 7.11) cluster on an on-premise kubernetes cluster. security is enabled in the cluster. to run rally i have created a separate pod --chart.yaml-- apiVersion: v1 kind: Pod … --- ## [\[Elasticsearch cluster status red\] : path: /.apm-agent-configuration/\_search, params: {index=.apm-agent-configuration} org.elasticsearch.action.search.SearchPhaseExecutionException: all shards failed](https://discuss.elastic.co/t/elasticsearch-cluster-status-red-path-apm-agent-configuration-search-params-index-apm-agent-configuration-org-elasticsearch-action-search-searchphaseexecutionexception-all-shards-failed/270215)
**Author:** [@abi.mc](https://discuss.elastic.co/u/abi.mc)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 12:49pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-status-red-path-apm-agent-configuration-search-params-index-apm-agent-configuration-org-elasticsearch-action-search-searchphaseexecutionexception-all-shards-failed/270215 "2021-04-15T12:49:34Z")
Our two node elasticsearch cluster status shows red. The cluster is configured with HTTP and TLS encryption. Please find below the error from elasticsearch logs. Could you please let us know how the cluster status can be… --- ## [Visualize / Search Date more than X days ago](https://discuss.elastic.co/t/visualize-search-date-more-than-x-days-ago/269905)
**Author:** [@csatola](https://discuss.elastic.co/u/csatola)\ **Replies:** 13\ **Last updated:** [April 15, 2021, 12:47pm UTC](https://discuss.elastic.co/t/visualize-search-date-more-than-x-days-ago/269905 "2021-04-15T12:47:49Z")
In my scenario, I'm logging server vulnerability data. @timestamp is when the document was added (and that's fine), but I also have a "PatchReleasedDate" field. What I would like to do is build visualizations for # of do… --- ## [Count map in kibana new version](https://discuss.elastic.co/t/count-map-in-kibana-new-version/270200)
**Author:** [@Priyanka\_chauhan](https://discuss.elastic.co/u/Priyanka_chauhan)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 12:10pm UTC](https://discuss.elastic.co/t/count-map-in-kibana-new-version/270200 "2021-04-15T12:10:13Z")
hi, I am unable to create count map in new version kibana because there is missing metric section in layer setting. I have attached image also. please anyone knows how to do it? --- ## [Extract value from Nested message field - LogStash Kibana Grok Mutate](https://discuss.elastic.co/t/extract-value-from-nested-message-field-logstash-kibana-grok-mutate/269368)
**Author:** [@Sandun\_Akalanka](https://discuss.elastic.co/u/Sandun_Akalanka)\ **Replies:** 4\ **Last updated:** [April 15, 2021, 11:39am UTC](https://discuss.elastic.co/t/extract-value-from-nested-message-field-logstash-kibana-grok-mutate/269368 "2021-04-15T11:39:58Z")
I've configured a FileBeat service to send logs to Kibana via LogStash. FileBeat and LogStash are in different servers while Kibana is inside an AWS ElasticSearch domain. The logs are visible in the Kibana dashboard. In … --- ## [Docker container to build plugins](https://discuss.elastic.co/t/docker-container-to-build-plugins/270159)
**Author:** [@padakwaak](https://discuss.elastic.co/u/padakwaak)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 11:37am UTC](https://discuss.elastic.co/t/docker-container-to-build-plugins/270159 "2021-04-15T11:37:41Z")
Hi, I'm not a Ruby/JRuby programmer and I find it quite difficult to get all the necessary build tools in place to build and test my modifications that I'm doing to some of the existing Logstash plugins. Another user c… --- ## [Rename field name in saved search](https://discuss.elastic.co/t/rename-field-name-in-saved-search/270205)
**Author:** [@thenoobert](https://discuss.elastic.co/u/thenoobert)\ **Replies:** 3\ **Last updated:** [April 15, 2021, 11:37am UTC](https://discuss.elastic.co/t/rename-field-name-in-saved-search/270205 "2021-04-15T11:37:20Z")
Hi, I am currently trying to visualize a result based on saved search. However, the result field name is too distracting/displeasing so would like to rename it to something simple. I know this can be achieved through da… --- ## [Logstash Avro Codec non-base64 support](https://discuss.elastic.co/t/logstash-avro-codec-non-base64-support/270225)
**Author:** [@th0ger](https://discuss.elastic.co/u/th0ger)\ **Replies:** 0\ **Last updated:** [April 15, 2021, 11:36am UTC](https://discuss.elastic.co/t/logstash-avro-codec-non-base64-support/270225 "2021-04-15T11:36:30Z")
We would like to input non-base64 encoded avro data with the avro codec. Similar to output syntax Optional base64 encoding by johanvanderkuijl · Pull Request #29 · logstash-plugins/logstash-codec-avro · GitHub code… --- ## [Multi-tenant design](https://discuss.elastic.co/t/multi-tenant-design/268278)
**Author:** [@abhishekc92](https://discuss.elastic.co/u/abhishekc92)\ **Replies:** 7\ **Last updated:** [March 25, 2021, 5:07am UTC](https://discuss.elastic.co/t/multi-tenant-design/268278 "2021-03-25T05:07:20Z")
Hi, I'm currently in the process of designing a multi-tenant indexing strategy for my system. I'm generally aware of the approaches commonly used in such cases - Index per tenant Shared index across tenants Some variat… --- ## [Negative Kafka partition bug](https://discuss.elastic.co/t/negative-kafka-partition-bug/270046)
**Author:** [@cbrown184](https://discuss.elastic.co/u/cbrown184)\ **Replies:** 1\ **Last updated:** [April 13, 2021, 11:38pm UTC](https://discuss.elastic.co/t/negative-kafka-partition-bug/270046 "2021-04-13T23:38:01Z")
Hi - we use Filebeat to output our logs to Kafka. We got hit by a nasty bug in prod where Filebeat gets stuck in an endless loop. It was previously documented on this thread Filebeat kafka output hash.hash get negative … --- ## [Better define Kibana Watchers for unavailable Pod](https://discuss.elastic.co/t/better-define-kibana-watchers-for-unavailable-pod/270213)
**Author:** [@es-gabriele](https://discuss.elastic.co/u/es-gabriele)\ **Replies:** 0\ **Last updated:** [April 15, 2021, 10:16am UTC](https://discuss.elastic.co/t/better-define-kibana-watchers-for-unavailable-pod/270213 "2021-04-15T10:16:30Z")
(topic withdrawn by author, will be automatically deleted in 24 hours unless flagged) --- ## [Is it possible to do a write operation on indices which are on warm nodes in elastic search](https://discuss.elastic.co/t/is-it-possible-to-do-a-write-operation-on-indices-which-are-on-warm-nodes-in-elastic-search/270212)
**Author:** [@sagar7645](https://discuss.elastic.co/u/sagar7645)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 10:24am UTC](https://discuss.elastic.co/t/is-it-possible-to-do-a-write-operation-on-indices-which-are-on-warm-nodes-in-elastic-search/270212 "2021-04-15T10:24:16Z")
is it possible to do a write operation on indices which are on warm nodes in elastic search --- ## [Session expiration](https://discuss.elastic.co/t/session-expiration/270131)
**Author:** [@alaine](https://discuss.elastic.co/u/alaine)\ **Replies:** 4\ **Last updated:** [April 15, 2021, 10:21am UTC](https://discuss.elastic.co/t/session-expiration/270131 "2021-04-15T10:21:59Z")
Hi there, my team is responsible for a few clusters and the users are running into two different errors fairly frequently. At the moment we are focusing on two issues that seem to have similar causes. The first log entr… --- ## [ECK SSO with google cloud OpenID: Error \[security\_exception\] unable to authenticate user \[\\]](https://discuss.elastic.co/t/eck-sso-with-google-cloud-openid-error-security-exception-unable-to-authenticate-user-oidc-token/270101)
**Author:** [@lmes3oud](https://discuss.elastic.co/u/lmes3oud)\ **Replies:** 5\ **Last updated:** [April 15, 2021, 10:17am UTC](https://discuss.elastic.co/t/eck-sso-with-google-cloud-openid-error-security-exception-unable-to-authenticate-user-oidc-token/270101 "2021-04-15T10:17:56Z")
Hi all, I'm trying to enable SSO to Kibana version 7.11.0 created using ECK version 1.4.1. I followed this tutorial for Setup with Google Cloud OAuth Credential. token.enabled: true realms.oidc: oi… --- ## [Activate x-pack](https://discuss.elastic.co/t/activate-x-pack/269829)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 26\ **Last updated:** [April 15, 2021, 10:15am UTC](https://discuss.elastic.co/t/activate-x-pack/269829 "2021-04-15T10:15:39Z")
how to activate the x-pack? and where i should access to activate the x-pack? --- ## [Query terms search miss content depending on what is searched](https://discuss.elastic.co/t/query-terms-search-miss-content-depending-on-what-is-searched/270193)
**Author:** [@pyrovoice](https://discuss.elastic.co/u/pyrovoice)\ **Replies:** 3\ **Last updated:** [April 15, 2021, 9:18am UTC](https://discuss.elastic.co/t/query-terms-search-miss-content-depending-on-what-is-searched/270193 "2021-04-15T09:18:27Z")
Hello, I have a strange issue with the ES query search: When searching for an array of ID, some of them will be skipped, but looking for those IDs individually of in a different array will return the skipped IDs correctl… --- ## [How do i view host metrics and host logs, container logs from within APM transaction actions](https://discuss.elastic.co/t/how-do-i-view-host-metrics-and-host-logs-container-logs-from-within-apm-transaction-actions/270207)
**Author:** [@BigM1](https://discuss.elastic.co/u/BigM1)\ **Replies:** 0\ **Last updated:** [April 15, 2021, 9:05am UTC](https://discuss.elastic.co/t/how-do-i-view-host-metrics-and-host-logs-container-logs-from-within-apm-transaction-actions/270207 "2021-04-15T09:05:06Z")
Hi all, How do i view host metrics and host logs, container logs from within APM transaction actions ? [Previous page](https://discuss.elastic.co/latest.md?page=1729) [Next page](https://discuss.elastic.co/latest.md?page=1731)