# Latest **URL:** https://discuss.elastic.co/latest.md?page=1843 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1844 --- ## [\[SOLVED\] I can't use winlogbeat with Kibana](https://discuss.elastic.co/t/solved-i-cant-use-winlogbeat-with-kibana/263908)
**Author:** [@Christian\_SG](https://discuss.elastic.co/u/Christian_SG)\ **Replies:** 4\ **Last updated:** [February 11, 2021, 2:12pm UTC](https://discuss.elastic.co/t/solved-i-cant-use-winlogbeat-with-kibana/263908 "2021-02-11T14:12:41Z")
Hi everyone, I'm running elasticsearch and Kibana in a Debian10 machine, everything was working perfectly. Then I tried intalling winlogbeat in a Windows10 machine and here comes my problem, I've been searching for many … --- ## [Grok by beats agent](https://discuss.elastic.co/t/grok-by-beats-agent/264008)
**Author:** [@hugoboubou](https://discuss.elastic.co/u/hugoboubou)\ **Replies:** 2\ **Last updated:** [February 11, 2021, 2:12pm UTC](https://discuss.elastic.co/t/grok-by-beats-agent/264008 "2021-02-11T14:12:27Z")
Hello :smiley: I have several beats entries on my logstash, but the logs I process are different, so I would like to do a grok by beat. example log lines : 2017/07/27 18:02:37 VCS ERROR V-16-1-54031 Resource XXXXXXXXX… --- ## [Elastic cloud search service console \[trial expired for my account\]](https://discuss.elastic.co/t/elastic-cloud-search-service-console-trial-expired-for-my-account/263133)
**Author:** [@amitv-elasticsearch](https://discuss.elastic.co/u/amitv-elasticsearch)\ **Replies:** 3\ **Last updated:** [February 11, 2021, 1:41pm UTC](https://discuss.elastic.co/t/elastic-cloud-search-service-console-trial-expired-for-my-account/263133 "2021-02-11T13:41:55Z")
Hi Team, I have been enrolled/subscribed in the training session for the elastic search and my subscription is valid till 1st Oct 20221. When I try access the elastic cloud search service console with my credential… --- ## [Snapshot performance with ES 7.10](https://discuss.elastic.co/t/snapshot-performance-with-es-7-10/260739)
**Author:** [@karunelas](https://discuss.elastic.co/u/karunelas)\ **Replies:** 16\ **Last updated:** [February 11, 2021, 1:34pm UTC](https://discuss.elastic.co/t/snapshot-performance-with-es-7-10/260739 "2021-02-11T13:34:35Z")
Hi all: We have upgraded to ES 7.10 from 6.8. After the upgrade, we are observing that the time taken for the Snapshot on 7.10 is around 3 times slower compared to the snapshots with 6.8. These are snapshots of the ES c… --- ## [Проблемы с ram](https://discuss.elastic.co/t/ram/263593)
**Author:** [@maiklLen](https://discuss.elastic.co/u/maiklLen)\ **Replies:** 34\ **Last updated:** [February 11, 2021, 1:23pm UTC](https://discuss.elastic.co/t/ram/263593 "2021-02-11T13:23:59Z")
Elastic полностью съедает всю оперативную память на 15,5 ГБ После это перестаёт работать программы. Операционная система Windows 7 Пытались уменьшить размер, но все равно рабочий набор памяти постоянно растет и съеда… --- ## [FIRST/FIRST\_VALUE function returning empty value](https://discuss.elastic.co/t/first-first-value-function-returning-empty-value/263963)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 1\ **Last updated:** [February 11, 2021, 1:23pm UTC](https://discuss.elastic.co/t/first-first-value-function-returning-empty-value/263963 "2021-02-11T13:23:26Z")
Hi All, I have to select records from an index, and have to select the latest values for a Mobile number. There can be more than one record for each mobile number. I am using FIrst function for the same and it is retur… --- ## [Error migrating after upgrading to 7.11](https://discuss.elastic.co/t/error-migrating-after-upgrading-to-7-11/263928)
**Author:** [@stephan13360](https://discuss.elastic.co/u/stephan13360)\ **Replies:** 6\ **Last updated:** [February 11, 2021, 1:22pm UTC](https://discuss.elastic.co/t/error-migrating-after-upgrading-to-7-11/263928 "2021-02-11T13:22:57Z")
I just upgraded my Elasticsearch / Kibana from 7.10.2 to 7.11 and now Kibana logs the following error when trying to run the migration: { "type": "log", "@timestamp": "2021-02-10T20:11:18+01:00", "tags": \["fatal",… --- ## [Show graph on Number of Lines instead of Number of Bytes](https://discuss.elastic.co/t/show-graph-on-number-of-lines-instead-of-number-of-bytes/263939)
**Author:** [@homius](https://discuss.elastic.co/u/homius)\ **Replies:** 1\ **Last updated:** [February 11, 2021, 1:14pm UTC](https://discuss.elastic.co/t/show-graph-on-number-of-lines-instead-of-number-of-bytes/263939 "2021-02-11T13:14:43Z")
Hi All, I am totally new in Kibana so my question might be dumb. In my Kibana Dashboard I see graph of my http requests/responses (Users, Total Processed, Request Rate,...). It also shows "Processed Prediction Bytes". Ho… --- ## [All shards failed for phase: \[query\]](https://discuss.elastic.co/t/all-shards-failed-for-phase-query/264020)
**Author:** [@Tabriz](https://discuss.elastic.co/u/Tabriz)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 1:09pm UTC](https://discuss.elastic.co/t/all-shards-failed-for-phase-query/264020 "2021-02-11T13:09:19Z")
There is a such problem.What can be reason? --- ## [Elastic cluster upgrading order for nodes](https://discuss.elastic.co/t/elastic-cluster-upgrading-order-for-nodes/263508)
**Author:** [@testsemd\_email](https://discuss.elastic.co/u/testsemd_email)\ **Replies:** 2\ **Last updated:** [February 11, 2021, 12:38pm UTC](https://discuss.elastic.co/t/elastic-cluster-upgrading-order-for-nodes/263508 "2021-02-11T12:38:30Z")
I have elastic 5 nodes cluster, node1-master only node2-master only node3-data\_ingest node4-data+ingest node5-master+data+ingest Can upgrade node1 before upgrade node5? Thank you! --- ## [Multiple problems with Kibana Dashboards (Metricbeat/Winlogbeat)](https://discuss.elastic.co/t/multiple-problems-with-kibana-dashboards-metricbeat-winlogbeat/263424)
**Author:** [@keyofstarrysky973](https://discuss.elastic.co/u/keyofstarrysky973)\ **Replies:** 5\ **Last updated:** [February 11, 2021, 12:29pm UTC](https://discuss.elastic.co/t/multiple-problems-with-kibana-dashboards-metricbeat-winlogbeat/263424 "2021-02-11T12:29:40Z")
Hey Everyone. I have followed a basic implementation of ELK Stack (version 7.10) on a Windows 10 machine. Now though, I'm having problems with the visualisation of data from two Beats agents (Metricbeat and Winlogbeat). … --- ## [Ho to make the URL Drill downs automatic as part of docker image or k8s configmap?](https://discuss.elastic.co/t/ho-to-make-the-url-drill-downs-automatic-as-part-of-docker-image-or-k8s-configmap/263957)
**Author:** [@Rajesh\_Reddy\_N](https://discuss.elastic.co/u/Rajesh_Reddy_N)\ **Replies:** 1\ **Last updated:** [February 11, 2021, 12:16pm UTC](https://discuss.elastic.co/t/ho-to-make-the-url-drill-downs-automatic-as-part-of-docker-image-or-k8s-configmap/263957 "2021-02-11T12:16:31Z")
Hi, we have ingested lots of data to elastic search and visualizing through the Kibana 7.7. We are able to do create drill-down charts but the URL mapping needs to be done manually. eg: loglevel.keyword -\> enable it as… --- ## [FSCrawler 7.2.7, Windows service, debug and trace logs](https://discuss.elastic.co/t/fscrawler-7-2-7-windows-service-debug-and-trace-logs/263092)
**Author:** [@newschapmj1](https://discuss.elastic.co/u/newschapmj1)\ **Replies:** 4\ **Last updated:** [February 11, 2021, 12:01pm UTC](https://discuss.elastic.co/t/fscrawler-7-2-7-windows-service-debug-and-trace-logs/263092 "2021-02-11T12:01:12Z")
When running fscrawler 7.2.7 as a service (Windows server 2016) should it be possible to see debug or trace logs by adding the --debug or --trace flag? We are using nssm v2.24 to generate the service. I successfully ad… --- ## [Convert Lucene BooleanQuery to ES BoolQueryBuilder](https://discuss.elastic.co/t/convert-lucene-booleanquery-to-es-boolquerybuilder/263993)
**Author:** [@Mladen\_Rusev](https://discuss.elastic.co/u/Mladen_Rusev)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 10:40am UTC](https://discuss.elastic.co/t/convert-lucene-booleanquery-to-es-boolquerybuilder/263993 "2021-02-11T10:40:48Z")
Hello, I'm porting some indices from lucene to ES. I've managed to use QueryBuilders.queryStringQuery(queryString); to parse old lucene string queries to elastic. However I can't seem to find a way to use Lucene's B… --- ## [Filebeat Pipelines](https://discuss.elastic.co/t/filebeat-pipelines/264005)
**Author:** [@st1988](https://discuss.elastic.co/u/st1988)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 11:14am UTC](https://discuss.elastic.co/t/filebeat-pipelines/264005 "2021-02-11T11:14:01Z")
Hi, I have generated some filebeat configurations using the Machine learning in Kibana which has been amazing. This has given me several configuration files that I can add to Filebeat. The issue I have is that all the i… --- ## [Fortinet module processor fail](https://discuss.elastic.co/t/fortinet-module-processor-fail/264003)
**Author:** [@Thomas74](https://discuss.elastic.co/u/Thomas74)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 11:04am UTC](https://discuss.elastic.co/t/fortinet-module-processor-fail/264003 "2021-02-11T11:04:51Z")
Hi, I'm configuring Fortinet module but processor condition added doesn't work and I don't understand why. Here you have config module : - module: fortinet firewall: enabled: true var.input: udp … --- ## [Coordination Only node and how does it affect cluster](https://discuss.elastic.co/t/coordination-only-node-and-how-does-it-affect-cluster/263769)
**Author:** [@vatsoo](https://discuss.elastic.co/u/vatsoo)\ **Replies:** 1\ **Last updated:** [February 11, 2021, 10:55am UTC](https://discuss.elastic.co/t/coordination-only-node-and-how-does-it-affect-cluster/263769 "2021-02-11T10:55:00Z")
Hi everyone, I did not find precise information about the topic so asking here. I want to add Coordination only node to the cluster running it on same machine as Kibana is running. Then update Kibana config by setting … --- ## [Custom Visualizations, How to pass in plugin start lifecycle](https://discuss.elastic.co/t/custom-visualizations-how-to-pass-in-plugin-start-lifecycle/263927)
**Author:** [@sdeck51](https://discuss.elastic.co/u/sdeck51)\ **Replies:** 1\ **Last updated:** [February 11, 2021, 10:50am UTC](https://discuss.elastic.co/t/custom-visualizations-how-to-pass-in-plugin-start-lifecycle/263927 "2021-02-11T10:50:27Z")
Hi, I was looking at the following example to see how a custom kibana viz is set up. From what I see we can create a react/base visualization in the setup lifecycle function of the plugin. This means we could pass set… --- ## [Using kv and Grok Pattern in Ingest Pipelines](https://discuss.elastic.co/t/using-kv-and-grok-pattern-in-ingest-pipelines/263997)
**Author:** [@geek876](https://discuss.elastic.co/u/geek876)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 10:50am UTC](https://discuss.elastic.co/t/using-kv-and-grok-pattern-in-ingest-pipelines/263997 "2021-02-11T10:50:22Z")
I am trying to extract a log-pattern \[LEVEL\] (COMPONENT) MESSAGE \[msgid: MESSAGE ID\] example message: \[INFO \] (core.workflow) Start scan, workflow\_id='lms::workflow::WorkflowExecutor(0x259c99f94b0, name = "WF-127.0.… --- ## [Starting elasticsearch in kubernetes](https://discuss.elastic.co/t/starting-elasticsearch-in-kubernetes/263996)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 10:46am UTC](https://discuss.elastic.co/t/starting-elasticsearch-in-kubernetes/263996 "2021-02-11T10:46:59Z")
I am trying to start elasticsearch in kubernetes. I have used the quick starting guide therefore my manifest file looks like this: kind: Elasticsearch metadata: name: elasticsearch namespace: rcc … --- ## [Not able change type of a field string to date using index template](https://discuss.elastic.co/t/not-able-change-type-of-a-field-string-to-date-using-index-template/263995)
**Author:** [@amp](https://discuss.elastic.co/u/amp)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 10:44am UTC](https://discuss.elastic.co/t/not-able-change-type-of-a-field-string-to-date-using-index-template/263995 "2021-02-11T10:44:49Z")
In elasticsearch 6.3 indexing windows log using Nxlog(3.7). Without any template all the fields indexed as strings. To get a date field we tried to change the Eventdate field as date. But getting parsing error. the be… --- ## [Progress of 7.10.0 to 7.11.0 upgrade status](https://discuss.elastic.co/t/progress-of-7-10-0-to-7-11-0-upgrade-status/263977)
**Author:** [@Elitlogik](https://discuss.elastic.co/u/Elitlogik)\ **Replies:** 2\ **Last updated:** [February 11, 2021, 10:37am UTC](https://discuss.elastic.co/t/progress-of-7-10-0-to-7-11-0-upgrade-status/263977 "2021-02-11T10:37:36Z")
I run single node https://github.com/deviantony/docker-elk dockerized E, L and K. I upgraded the stack with docker-compose build and docker-compose up -d . Now the startup seems to be stuck at: {"type":"log","@timesta… --- ## [Can't really change "cron schedule for retaining snapshots"](https://discuss.elastic.co/t/cant-really-change-cron-schedule-for-retaining-snapshots/263985)
**Author:** [@NejcK](https://discuss.elastic.co/u/NejcK)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 10:23am UTC](https://discuss.elastic.co/t/cant-really-change-cron-schedule-for-retaining-snapshots/263985 "2021-02-11T10:23:34Z")
Going to Stack Management -\> Snapshot and Restore -\> Policies you see the "The cron schedule for retaining snapshots is: 0 20,50 \* \* \* ?. I can change the cron schedule (via UI or console, doesn't matter) to a differe… --- ## [Purpose of TSVB Aggregation feature under Options tab for TSVB table](https://discuss.elastic.co/t/purpose-of-tsvb-aggregation-feature-under-options-tab-for-tsvb-table/263854)
**Author:** [@BitBucketUser\_user](https://discuss.elastic.co/u/BitBucketUser_user)\ **Replies:** 2\ **Last updated:** [February 11, 2021, 9:56am UTC](https://discuss.elastic.co/t/purpose-of-tsvb-aggregation-feature-under-options-tab-for-tsvb-table/263854 "2021-02-11T09:56:45Z")
Hello All, In the TSVB panel for Table, I can find choices to aggregate under two different places.. Under the metrics tab Under the options tab There is some special reason/ use of having two aggregation choice… --- ## [Filebeat compatibality](https://discuss.elastic.co/t/filebeat-compatibality/263965)
**Author:** [@kvtang](https://discuss.elastic.co/u/kvtang)\ **Replies:** 1\ **Last updated:** [February 11, 2021, 9:10am UTC](https://discuss.elastic.co/t/filebeat-compatibality/263965 "2021-02-11T09:10:25Z")
Hi all, Can I install and run filebeat on Windows Embedded Standard PC? I think it is 2010 version. Thank you. --- ## [Share only the dasboard](https://discuss.elastic.co/t/share-only-the-dasboard/263959)
**Author:** [@albie.morken](https://discuss.elastic.co/u/albie.morken)\ **Replies:** 1\ **Last updated:** [February 11, 2021, 9:05am UTC](https://discuss.elastic.co/t/share-only-the-dasboard/263959 "2021-02-11T09:05:22Z")
I am trying to display the kibana dashboard in one of the html page. I use the share option provided in the dashboard But instead of getting only that particular dashboard, with this link, I am able to see whole kiban… --- ## [Not able to install "logstash-filter-environment" in linux server : handshake\_failure](https://discuss.elastic.co/t/not-able-to-install-logstash-filter-environment-in-linux-server-handshake-failure/263968)
**Author:** [@sureshkk252](https://discuss.elastic.co/u/sureshkk252)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 8:49am UTC](https://discuss.elastic.co/t/not-able-to-install-logstash-filter-environment-in-linux-server-handshake-failure/263968 "2021-02-11T08:49:05Z")
Hello, i am trying to install "logstash-filter-environment" plugin in a linux server, where i got this error. "Unable to download data from https://rubygems.org - Received fatal alert: handshake\_failure (https://api.rub… --- ## [How should I configure the number of node, shard and replica?](https://discuss.elastic.co/t/how-should-i-configure-the-number-of-node-shard-and-replica/263840)
**Author:** [@rider9581](https://discuss.elastic.co/u/rider9581)\ **Replies:** 17\ **Last updated:** [February 11, 2021, 8:38am UTC](https://discuss.elastic.co/t/how-should-i-configure-the-number-of-node-shard-and-replica/263840 "2021-02-11T08:38:10Z")
I have one server of the following spec: RAM: 128 GB HDD: 10TB \* 2 SSD: 256 GB CPU: 32 cores and I am going to manage up to 10TB of text data using Elasticsearch 7.9.3. Also, I plan to use Docker for the deployment o… --- ## [API Secret key token](https://discuss.elastic.co/t/api-secret-key-token/263900)
**Author:** [@lnitin](https://discuss.elastic.co/u/lnitin)\ **Replies:** 3\ **Last updated:** [February 11, 2021, 8:24am UTC](https://discuss.elastic.co/t/api-secret-key-token/263900 "2021-02-11T08:24:27Z")
Elastic apm-server and agent configuration, what is a secret\_token for java agent is it an API key from elasticsearch.? Will it be a security issue if we have the api key as a part of java code.? --- ## [Appending Random number in csv file name](https://discuss.elastic.co/t/appending-random-number-in-csv-file-name/263575)
**Author:** [@ritusingh](https://discuss.elastic.co/u/ritusingh)\ **Replies:** 7\ **Last updated:** [February 11, 2021, 8:19am UTC](https://discuss.elastic.co/t/appending-random-number-in-csv-file-name/263575 "2021-02-11T08:19:59Z")
Hi, I want to append random number after the file name. output { stdout { codec =\> rubydebug } csv { # elastic field name fields =\> \["@timestamp","requestid","ngnix.responsebytes","ngnix.cpu.usage"\] #… [Previous page](https://discuss.elastic.co/latest.md?page=1842) [Next page](https://discuss.elastic.co/latest.md?page=1844)