# Latest **URL:** https://discuss.elastic.co/latest.md?page=1784 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1785 --- ## [Log viewing Elastic stack](https://discuss.elastic.co/t/log-viewing-elastic-stack/266598)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 5\ **Last updated:** [March 15, 2021, 7:53pm UTC](https://discuss.elastic.co/t/log-viewing-elastic-stack/266598 "2021-03-15T19:53:07Z")
Hello there, I would like to explore the possibility of log viewing through Elastic stack. I understand that I can use filebeat in order to do that but I already have logs that I would like to view in kibana dashboard … --- ## [How to index null values/ empty array thru Ingest Pipeline](https://discuss.elastic.co/t/how-to-index-null-values-empty-array-thru-ingest-pipeline/267256)
**Author:** [@sravankayitha](https://discuss.elastic.co/u/sravankayitha)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 12:07pm UTC](https://discuss.elastic.co/t/how-to-index-null-values-empty-array-thru-ingest-pipeline/267256 "2021-03-15T12:07:40Z")
Hello, I'm new to ES, Can any one suggest me How to resolve this issue: Pipeline name: cpqtest2602 Actual default index: cpqtest26\* Unformatted index: unformatted2602\* I'm trying to index the null values/empty array… --- ## [Field added by Logstash Grok can't be used in Kibana filters](https://discuss.elastic.co/t/field-added-by-logstash-grok-cant-be-used-in-kibana-filters/267122)
**Author:** [@b133](https://discuss.elastic.co/u/b133)\ **Replies:** 4\ **Last updated:** [March 15, 2021, 7:46pm UTC](https://discuss.elastic.co/t/field-added-by-logstash-grok-cant-be-used-in-kibana-filters/267122 "2021-03-15T19:46:48Z")
I added a hostname field to my index using Logstash Grok: grok { match =\> { "originsicname" =\> "CN=%{HOSTNAME:hostname}," } ... For some reason I cannot use this hostname field as a filter on my dashboards. … --- ## [Elasticsearch indexing strategy for searching multiple entities](https://discuss.elastic.co/t/elasticsearch-indexing-strategy-for-searching-multiple-entities/267300)
**Author:** [@Pravesh\_Jain](https://discuss.elastic.co/u/Pravesh_Jain)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 7:25pm UTC](https://discuss.elastic.co/t/elasticsearch-indexing-strategy-for-searching-multiple-entities/267300 "2021-03-15T19:25:33Z")
My application deals with multiple entities, each having different fields. New entities can be added. New fields may be added in existing entities. I want to search over all of these entities, together, using elasticsea… --- ## [How to upload ".toml" rules from github to Kibana](https://discuss.elastic.co/t/how-to-upload-toml-rules-from-github-to-kibana/267274)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 1\ **Last updated:** [March 15, 2021, 7:24pm UTC](https://discuss.elastic.co/t/how-to-upload-toml-rules-from-github-to-kibana/267274 "2021-03-15T19:24:39Z")
Hello, I would like to upload this rule: https://github.com/elastic/detection-rules/blob/a0e86e20d6ad039dfe4446b28f3c29642b50385c/rules/windows/credential\_access\_cmdline\_dump\_tool.toml to my Cluster The problem is in K… --- ## [After changing the server ip address , Kibana does not work](https://discuss.elastic.co/t/after-changing-the-server-ip-address-kibana-does-not-work/265840)
**Author:** [@John\_biryon](https://discuss.elastic.co/u/John_biryon)\ **Replies:** 9\ **Last updated:** [March 15, 2021, 7:15pm UTC](https://discuss.elastic.co/t/after-changing-the-server-ip-address-kibana-does-not-work/265840 "2021-03-15T19:15:47Z")
Where do i go about to update the Kibana for the new IP address ? the ip address of the server had to be changed . Microsoft Windows 2012 r2, was working nicly before the change. many thanks John --- ## [Setup filebeat custom nginx access logs path inside docker container](https://discuss.elastic.co/t/setup-filebeat-custom-nginx-access-logs-path-inside-docker-container/267189)
**Author:** [@cdalexndr](https://discuss.elastic.co/u/cdalexndr)\ **Replies:** 1\ **Last updated:** [March 15, 2021, 7:13pm UTC](https://discuss.elastic.co/t/setup-filebeat-custom-nginx-access-logs-path-inside-docker-container/267189 "2021-03-15T19:13:05Z")
How to configure a filebeat running inside a docker container to get access logs from nginx running in another container? Nginx access logs are not in default location so the paths must be configured. I've tried using … --- ## [Set order of filebeat inputs](https://discuss.elastic.co/t/set-order-of-filebeat-inputs/267157)
**Author:** [@SKiD](https://discuss.elastic.co/u/SKiD)\ **Replies:** 1\ **Last updated:** [March 15, 2021, 6:26pm UTC](https://discuss.elastic.co/t/set-order-of-filebeat-inputs/267157 "2021-03-15T18:26:09Z")
Hey, I want to ship lines from Filebeat to Logstash in a specific input order. The reason I want to do that is that the documents of the second input are basing on the documents of the second input. This means I update … --- ## [Nested fields in syslog output plugin](https://discuss.elastic.co/t/nested-fields-in-syslog-output-plugin/267268)
**Author:** [@dsv](https://discuss.elastic.co/u/dsv)\ **Replies:** 2\ **Last updated:** [March 15, 2021, 4:54pm UTC](https://discuss.elastic.co/t/nested-fields-in-syslog-output-plugin/267268 "2021-03-15T16:54:33Z")
Hey guys, i'm not able to send a nested field in the syslog output plugin. syslog { host =\> "1.7.3.9" rfc =\> "rfc5424" codec =\> cef … --- ## [Filebeat error during install](https://discuss.elastic.co/t/filebeat-error-during-install/267257)
**Author:** [@Liliana\_Novais](https://discuss.elastic.co/u/Liliana_Novais)\ **Replies:** 5\ **Last updated:** [March 15, 2021, 4:29pm UTC](https://discuss.elastic.co/t/filebeat-error-during-install/267257 "2021-03-15T16:29:00Z")
Hello, I am trying to configure Filebeat. When I input this command: .\\filebeat.exe modules list I am having the following error: Error initializing beat: error loading config file: yaml: line 157: did not find expec… --- ## [Unable to ignore @timestamp in logs](https://discuss.elastic.co/t/unable-to-ignore-timestamp-in-logs/267141)
**Author:** [@Rakesh\_B](https://discuss.elastic.co/u/Rakesh_B)\ **Replies:** 6\ **Last updated:** [March 15, 2021, 4:22pm UTC](https://discuss.elastic.co/t/unable-to-ignore-timestamp-in-logs/267141 "2021-03-15T16:22:59Z")
Hi, We send multiple types of logs to Logstash and one of them uploaded JSON logs with an "@timestamp" field. Logstash tries to parse that field and when it fails it copies the value into "\_@timestamp" and throws a warn… --- ## [Can fields in the mapping be made non sortable](https://discuss.elastic.co/t/can-fields-in-the-mapping-be-made-non-sortable/266461)
**Author:** [@Deepti](https://discuss.elastic.co/u/Deepti)\ **Replies:** 3\ **Last updated:** [March 15, 2021, 3:57pm UTC](https://discuss.elastic.co/t/can-fields-in-the-mapping-be-made-non-sortable/266461 "2021-03-15T15:57:21Z")
Can we make a field in the mapping as non sortable? The way we can make a field unsearchable by setting the mapping parameter "index:false" ,is there a way to make fields non sortable? Is there any mapping parameter t… --- ## [Error Parsing JSON data in Logstash](https://discuss.elastic.co/t/error-parsing-json-data-in-logstash/267249)
**Author:** [@atharvak](https://discuss.elastic.co/u/atharvak)\ **Replies:** 3\ **Last updated:** [March 15, 2021, 3:16pm UTC](https://discuss.elastic.co/t/error-parsing-json-data-in-logstash/267249 "2021-03-15T15:16:18Z")
Hello guys, I am trying to debug this issue showing up related to Json Parsing. When my filebeat sends data to logstash, following error is showing up. My Logstash Filter filter { if "cost\_management" in \[tags\] { f… --- ## [Kibana Tag Description on Hover](https://discuss.elastic.co/t/kibana-tag-description-on-hover/267125)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [March 15, 2021, 3:02pm UTC](https://discuss.elastic.co/t/kibana-tag-description-on-hover/267125 "2021-03-15T15:02:14Z")
Hello, Nice work with the Kibana tags in 7.11, that will be useful. :slight\_smile: But I was thinking that it would be nice if the description was shown when hovering over the tag. For example: In the above screens… --- ## [Unknown health status](https://discuss.elastic.co/t/unknown-health-status/266792)
**Author:** [@Harm](https://discuss.elastic.co/u/Harm)\ **Replies:** 3\ **Last updated:** [March 15, 2021, 2:43pm UTC](https://discuss.elastic.co/t/unknown-health-status/266792 "2021-03-15T14:43:58Z")
Kibana version: 7.10.0 Elasticsearch version: 7.10.0 APM Server version: 7.10.0 APM Agent language and version: dotnet 1.5.1 Browser version: Chrome 89 Original install method (e.g. download page, yum, deb, from sou… --- ## [Logstash avro codec multiple hostnames under schema\_uri](https://discuss.elastic.co/t/logstash-avro-codec-multiple-hostnames-under-schema-uri/267278)
**Author:** [@Sebastian\_Rodak](https://discuss.elastic.co/u/Sebastian_Rodak)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 2:42pm UTC](https://discuss.elastic.co/t/logstash-avro-codec-multiple-hostnames-under-schema-uri/267278 "2021-03-15T14:42:26Z")
Hi, We are checking avro schema for the required information / format of the event. I'd like to know because I couldn't found how to setup multiple schema\_uri for avro schema e.g output{ codec =\> avro { schema\_uri… --- ## [Вычисляемые поля в Kibana](https://discuss.elastic.co/t/kibana/266898)
**Author:** [@iNNerScream](https://discuss.elastic.co/u/iNNerScream)\ **Replies:** 1\ **Last updated:** [March 15, 2021, 2:41pm UTC](https://discuss.elastic.co/t/kibana/266898 "2021-03-15T14:41:21Z")
Добрый день! У меня есть данные состава: timestamp field1 field2 При помощи scripted fields я смог добиться получения доли одного поля от другого (doc\['field1'\].value / doc\['field2'\].value). Однако данный расчет прои… --- ## [How to format number in logstash?](https://discuss.elastic.co/t/how-to-format-number-in-logstash/267182)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 3\ **Last updated:** [March 15, 2021, 2:21pm UTC](https://discuss.elastic.co/t/how-to-format-number-in-logstash/267182 "2021-03-15T14:21:30Z")
Suppose I want to sum field its sum range 1 to 10000 then shows like 10k, sum range from 10000 to million it shows in million and sum range more than millions then it shows in billions. Is it possible to perform such … --- ## [Elastic Agent healthy, but no data streams](https://discuss.elastic.co/t/elastic-agent-healthy-but-no-data-streams/265699)
**Author:** [@finbarr996](https://discuss.elastic.co/u/finbarr996)\ **Replies:** 9\ **Last updated:** [March 15, 2021, 2:20pm UTC](https://discuss.elastic.co/t/elastic-agent-healthy-but-no-data-streams/265699 "2021-03-15T14:20:10Z")
The Elastic Agent (7.11.1) is installed on a single Windows 10 test system and showing as 'Healthy' in Fleet, but I have no data appearing in streams. I have xpack security working with self generated certs - I have l… --- ## [Configure module Auditd with Kubectl \[Auditbeat 7.9.2\]](https://discuss.elastic.co/t/configure-module-auditd-with-kubectl-auditbeat-7-9-2/267048)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 1\ **Last updated:** [March 15, 2021, 2:19pm UTC](https://discuss.elastic.co/t/configure-module-auditd-with-kubectl-auditbeat-7-9-2/267048 "2021-03-15T14:19:27Z")
Hi, everyone I have been working with module Audit Module in order to log any execution of kubectl. Here you are my config: auditbeat.modules: - module: auditd audit\_rules: | -a always,exit -F exe=/usr/bin/kubec… --- ## [I have hypen separated in one column and i want to use that column in elastic search. Mapping created with type. Need to escape the hypen and get the whole value](https://discuss.elastic.co/t/i-have-hypen-separated-in-one-column-and-i-want-to-use-that-column-in-elastic-search-mapping-created-with-type-need-to-escape-the-hypen-and-get-the-whole-value/266998)
**Author:** [@Sreenath\_G](https://discuss.elastic.co/u/Sreenath_G)\ **Replies:** 3\ **Last updated:** [March 15, 2021, 2:15pm UTC](https://discuss.elastic.co/t/i-have-hypen-separated-in-one-column-and-i-want-to-use-that-column-in-elastic-search-mapping-created-with-type-need-to-escape-the-hypen-and-get-the-whole-value/266998 "2021-03-15T14:15:03Z")
Below is mapping: "TestID" : { "type" : "text", "fielddata" : true Example value of ID is "12333-1arerd-2333d-rrrrrwwqq" In the scripted field of the Index pattern i have given the below Script: if (doc\['TestID'\] … --- ## [Kibana not working](https://discuss.elastic.co/t/kibana-not-working/264907)
**Author:** [@realtech2338](https://discuss.elastic.co/u/realtech2338)\ **Replies:** 2\ **Last updated:** [March 15, 2021, 2:13pm UTC](https://discuss.elastic.co/t/kibana-not-working/264907 "2021-03-15T14:13:52Z")
i have installed elasticsearch and it is running but kibana is throwing below error: log \[00:40:42.667\] \[warning\]\[savedobjects-service\] Unable to connect to Elasticsearch. Error: resource\_already\_exists\_exception log… --- ## [Add a field starting from a substring of the file name](https://discuss.elastic.co/t/add-a-field-starting-from-a-substring-of-the-file-name/266337)
**Author:** [@JuanLuis\_Santiago\_de](https://discuss.elastic.co/u/JuanLuis_Santiago_de)\ **Replies:** 2\ **Last updated:** [March 15, 2021, 2:10pm UTC](https://discuss.elastic.co/t/add-a-field-starting-from-a-substring-of-the-file-name/266337 "2021-03-15T14:10:50Z")
Hello. I have several logs with the following names, where \[E-1\].\[P-28\], \[E-1\].\[P-45\] and \[E-1\].\[P-51\] are operators that generate these logs (I only can identify them by obtaining from the file name) p2sajava131.srv.g… --- ## [Painless: bug using for loops and vector functions](https://discuss.elastic.co/t/painless-bug-using-for-loops-and-vector-functions/267263)
**Author:** [@coreation](https://discuss.elastic.co/u/coreation)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 12:34pm UTC](https://discuss.elastic.co/t/painless-bug-using-for-loops-and-vector-functions/267263 "2021-03-15T12:34:17Z")
Hello everyone, I ran into what seems to be a bug in Painless where if a vector function is used, say l2norm(), the outcome remains the same outcome as the first iteration. I'm using the painless script in a function sc… --- ## [Is there an Elastic Agent configuration on K8s can send pod logs?](https://discuss.elastic.co/t/is-there-an-elastic-agent-configuration-on-k8s-can-send-pod-logs/267259)
**Author:** [@djmcgreal-cc](https://discuss.elastic.co/u/djmcgreal-cc)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 12:15pm UTC](https://discuss.elastic.co/t/is-there-an-elastic-agent-configuration-on-k8s-can-send-pod-logs/267259 "2021-03-15T12:15:39Z")
Hi, I've had success deploying elastic-agent to K8s using https://raw.githubusercontent.com/elastic/cloud-on-k8s/1.4/config/recipes/elastic-agent/kubernetes-integration.yaml This configuration doesn't include the collec… --- ## [Combining (grouping) two records as one in Kibana Discover](https://discuss.elastic.co/t/combining-grouping-two-records-as-one-in-kibana-discover/266937)
**Author:** [@usman1](https://discuss.elastic.co/u/usman1)\ **Replies:** 2\ **Last updated:** [March 15, 2021, 12:13pm UTC](https://discuss.elastic.co/t/combining-grouping-two-records-as-one-in-kibana-discover/266937 "2021-03-15T12:13:00Z")
Hi, I want to group (aggregate) records on the basis of a specific ID. At the moment, my data has an event START and END record identified by the IDs. START and END record have different fields in them which I want to c… --- ## [Issue about Invalid stemmer class specified CJK](https://discuss.elastic.co/t/issue-about-invalid-stemmer-class-specified-cjk/267254)
**Author:** [@omaquaire](https://discuss.elastic.co/u/omaquaire)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 11:59am UTC](https://discuss.elastic.co/t/issue-about-invalid-stemmer-class-specified-cjk/267254 "2021-03-15T11:59:21Z")
Dear all, I know there is another topic that was created, but I could not find any usable solutions, and since I have been looking for the solution for hours, I resolute myself to post here. Overall, I know that I use … --- ## [IP reputation ELK integration](https://discuss.elastic.co/t/ip-reputation-elk-integration/265959)
**Author:** [@tarekilani](https://discuss.elastic.co/u/tarekilani)\ **Replies:** 2\ **Last updated:** [March 15, 2021, 11:57am UTC](https://discuss.elastic.co/t/ip-reputation-elk-integration/265959 "2021-03-15T11:57:21Z")
Hello, Please i'm trying to integrate abuseipdb API to elasticsearch so i can have a reputation score of the IP adressess. When i searched on the internet i only found tutorials talking about integrating abuseipdb with … --- ## [Implementing utf-8-sig in Logstash conf file](https://discuss.elastic.co/t/implementing-utf-8-sig-in-logstash-conf-file/267251)
**Author:** [@shafeeka](https://discuss.elastic.co/u/shafeeka)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 11:45am UTC](https://discuss.elastic.co/t/implementing-utf-8-sig-in-logstash-conf-file/267251 "2021-03-15T11:45:50Z")
Hi everyone, I was trying to implement skip\_header within my Csv filter plugin. However, I'm unsuccessful as my first column's header has this invisible \\ufeff character and hence it does not match the name I specified i… --- ## [Metricbeat - no counter paths were found](https://discuss.elastic.co/t/metricbeat-no-counter-paths-were-found/267224)
**Author:** [@Inammathe\_Inna](https://discuss.elastic.co/u/Inammathe_Inna)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 7:02am UTC](https://discuss.elastic.co/t/metricbeat-no-counter-paths-were-found/267224 "2021-03-15T07:02:19Z")
Hi, Periodically, we are finding our Windows servers stop sending perfmon metrics (other metrics e.g. cpu from the system module) continue just fine. The current workaround that gets them going again is restarting the … [Previous page](https://discuss.elastic.co/latest.md?page=1783) [Next page](https://discuss.elastic.co/latest.md?page=1785)