# Latest **URL:** https://discuss.elastic.co/latest.md?page=1858 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1859 --- ## [Filebeats not sending logs to Logstash to be viewed in stdout](https://discuss.elastic.co/t/filebeats-not-sending-logs-to-logstash-to-be-viewed-in-stdout/263051)
**Author:** [@Juunis](https://discuss.elastic.co/u/Juunis)\ **Replies:** 7\ **Last updated:** [February 3, 2021, 9:31pm UTC](https://discuss.elastic.co/t/filebeats-not-sending-logs-to-logstash-to-be-viewed-in-stdout/263051 "2021-02-03T21:31:48Z")
Hi guys I'm new to the Elastic stack and I'm currently trying to setup a quick and easy pipeline between Logstash and Filebeats where filebeat will send a test log file and logstash will display it on stdout. Currently n… --- ## [Cluster 3 noeud et load balancer](https://discuss.elastic.co/t/cluster-3-noeud-et-load-balancer/263114)
**Author:** [@Corben\_Dallas](https://discuss.elastic.co/u/Corben_Dallas)\ **Replies:** 2\ **Last updated:** [February 3, 2021, 9:14pm UTC](https://discuss.elastic.co/t/cluster-3-noeud-et-load-balancer/263114 "2021-02-03T21:14:00Z")
Bonjour, Petite question, j'ai monté un cluster elasticsearch 7.9 licence basic avec 3 noeuds. Mais pour éviter de taper toujours sur le même noeud, j'ai mis en place un bon vieux haproxy pour gérer le load balancing… --- ## [Elasticsearch query - Most recent log for each user, for field logtype='x'](https://discuss.elastic.co/t/elasticsearch-query-most-recent-log-for-each-user-for-field-logtype-x/263170)
**Author:** [@brennan](https://discuss.elastic.co/u/brennan)\ **Replies:** 0\ **Last updated:** [February 3, 2021, 9:24pm UTC](https://discuss.elastic.co/t/elasticsearch-query-most-recent-log-for-each-user-for-field-logtype-x/263170 "2021-02-03T21:24:31Z")
I am trying to query elasticsearch to get the most recent log for all userIDs where we only include one log per user with field logtype='x' if logtype='x' then get 1 log per userID where the date of this log is the most… --- ## [Socket, REST, or WebSocket API into Elastic?](https://discuss.elastic.co/t/socket-rest-or-websocket-api-into-elastic/263167)
**Author:** [@kmiklas](https://discuss.elastic.co/u/kmiklas)\ **Replies:** 1\ **Last updated:** [February 3, 2021, 8:58pm UTC](https://discuss.elastic.co/t/socket-rest-or-websocket-api-into-elastic/263167 "2021-02-03T20:58:08Z")
Hello All, Is there a way to push logs/metrics directly into Elastic without FB and LS? Imagine a process where I have a metric called "Price" for a NASDAQ security. I want to push the {"ticker": "MSFT", "price", 250.6… --- ## [Microsoft Graph Security API integration](https://discuss.elastic.co/t/microsoft-graph-security-api-integration/263074)
**Author:** [@opiedrah](https://discuss.elastic.co/u/opiedrah)\ **Replies:** 0\ **Last updated:** [February 3, 2021, 6:35am UTC](https://discuss.elastic.co/t/microsoft-graph-security-api-integration/263074 "2021-02-03T06:35:33Z")
Filebeat has an o365 module that connects to the Microsoft Management API. Does anyone if there are working or is there a connector available for the Microsoft Graph Security API Microsoft Graph Security API overview - … --- ## [App\_insights data configuration \[AZURE \]](https://discuss.elastic.co/t/app-insights-data-configuration-azure/263166)
**Author:** [@miki\_haiat](https://discuss.elastic.co/u/miki_haiat)\ **Replies:** 0\ **Last updated:** [February 3, 2021, 8:22pm UTC](https://discuss.elastic.co/t/app-insights-data-configuration-azure/263166 "2021-02-03T20:22:42Z")
Im trying to configure and ingest data from azure to elastic cloud I generated an API key as the docs suggested and setup the metrics list as you can see below. I can see that Azure dashboards have been loaded successf… --- ## [Cant' import Machine Learning Anomaly Jobs - I have Enterprise Cloud Subscription](https://discuss.elastic.co/t/cant-import-machine-learning-anomaly-jobs-i-have-enterprise-cloud-subscription/261970)
**Author:** [@opiedrah](https://discuss.elastic.co/u/opiedrah)\ **Replies:** 7\ **Last updated:** [February 3, 2021, 7:41pm UTC](https://discuss.elastic.co/t/cant-import-machine-learning-anomaly-jobs-i-have-enterprise-cloud-subscription/261970 "2021-02-03T19:41:35Z")
Hi, We are an Elastic Cloud Enterprise customer. The machine learning jobs that are to be prebuilt are missing. I have a ML node assigned to the cluster, i can't find where to import them. Cluster is running 7.10… --- ## [Saved field "engines.time" is invalid for use with the "Date Histogram" aggregation. Please select a new field](https://discuss.elastic.co/t/saved-field-engines-time-is-invalid-for-use-with-the-date-histogram-aggregation-please-select-a-new-field/263160)
**Author:** [@Ankit4](https://discuss.elastic.co/u/Ankit4)\ **Replies:** 0\ **Last updated:** [February 3, 2021, 6:26pm UTC](https://discuss.elastic.co/t/saved-field-engines-time-is-invalid-for-use-with-the-date-histogram-aggregation-please-select-a-new-field/263160 "2021-02-03T18:26:42Z")
I am getting this error, while creating index pattern in kibana; Error: Saved field "engines.time" is invalid for use with the "Date Histogram" aggregation. Please select a new field. at FieldParamType.\_this.deseria… --- ## [How to set SameSite='None' in Kibana 7.6.2](https://discuss.elastic.co/t/how-to-set-samesite-none-in-kibana-7-6-2/262633)
**Author:** [@gaetano](https://discuss.elastic.co/u/gaetano)\ **Replies:** 17\ **Last updated:** [February 3, 2021, 6:25pm UTC](https://discuss.elastic.co/t/how-to-set-samesite-none-in-kibana-7-6-2/262633 "2021-02-03T18:25:15Z")
I'm using kibana 7.6.2 version and I tried to execute a cross-site domain access to Kibana bypassing login page. After I launched http post call to Kibana login endpoint, attaching username and password, I obtain a war… --- ## [Maximize Panel by default](https://discuss.elastic.co/t/maximize-panel-by-default/263149)
**Author:** [@advanced4](https://discuss.elastic.co/u/advanced4)\ **Replies:** 1\ **Last updated:** [February 3, 2021, 6:08pm UTC](https://discuss.elastic.co/t/maximize-panel-by-default/263149 "2021-02-03T18:08:09Z")
On an embedded dashboard, in the top right under the 3 dot menu, there's the option to "Maximize Panel". Is there a way to do this by default? I cannot find any reference to this feature anywhere. I assume a hack is all… --- ## [Logstash - How can i get the data from a key-value pair?](https://discuss.elastic.co/t/logstash-how-can-i-get-the-data-from-a-key-value-pair/263134)
**Author:** [@vinodhini](https://discuss.elastic.co/u/vinodhini)\ **Replies:** 2\ **Last updated:** [February 3, 2021, 6:00pm UTC](https://discuss.elastic.co/t/logstash-how-can-i-get-the-data-from-a-key-value-pair/263134 "2021-02-03T18:00:38Z")
I have a field which is like "host":{"name":"abcdef"}, How can i get the value "abcdef" alone from the host field? gsub is not allowing me to remove the {} or "name": I tried to get the value by referencing as %{host}{n… --- ## [Ruby code to add entry into an array?](https://discuss.elastic.co/t/ruby-code-to-add-entry-into-an-array/263046)
**Author:** [@aidanoc15](https://discuss.elastic.co/u/aidanoc15)\ **Replies:** 3\ **Last updated:** [February 3, 2021, 5:37pm UTC](https://discuss.elastic.co/t/ruby-code-to-add-entry-into-an-array/263046 "2021-02-03T17:37:10Z")
Hi, I'm using logstash as a method posting tickets into our ticketing system using data from an elasticsearch index. The API for out ticketing system expects all of the custom fields for our ticket to come through as an … --- ## [ECK Statefulset currentRevision not updated](https://discuss.elastic.co/t/eck-statefulset-currentrevision-not-updated/263155)
**Author:** [@Simon\_Apen-Sadler](https://discuss.elastic.co/u/Simon_Apen-Sadler)\ **Replies:** 0\ **Last updated:** [February 3, 2021, 5:29pm UTC](https://discuss.elastic.co/t/eck-statefulset-currentrevision-not-updated/263155 "2021-02-03T17:29:46Z")
I'm currently using a prometheus statefulset down rule to monitor our statefulsets and have noticed the alert is firing incorrectly for the elasticsearch statefulsets managed by ECK. It seems to be caused by updates. The… --- ## [Visualisation with unique values](https://discuss.elastic.co/t/visualisation-with-unique-values/263111)
**Author:** [@Deny7](https://discuss.elastic.co/u/Deny7)\ **Replies:** 2\ **Last updated:** [February 3, 2021, 4:31pm UTC](https://discuss.elastic.co/t/visualisation-with-unique-values/263111 "2021-02-03T16:31:57Z")
I have emails in my logs and I parse them like this: "email:" "user1@gmail.com" "name:" "user1" "provider:" "gmail.com" Now I want to make visualiation that will reflect unique providers in given timeframe, for example… --- ## [Elasticsearch: ('search\_phase\_execution\_exception', 'compile error')](https://discuss.elastic.co/t/elasticsearch-search-phase-execution-exception-compile-error/263146)
**Author:** [@Nikkie](https://discuss.elastic.co/u/Nikkie)\ **Replies:** 0\ **Last updated:** [February 3, 2021, 4:09pm UTC](https://discuss.elastic.co/t/elasticsearch-search-phase-execution-exception-compile-error/263146 "2021-02-03T16:09:40Z")
I am executing script\_query with cosineSimilarity using tensorflow embedding. The embeddings are obtained from tensorflow-hub. model which is loaded using the url: "https://tfhub.dev/google/universal-sentence-encoder/4" … --- ## [Disable gray coloring when refreshing dashboard](https://discuss.elastic.co/t/disable-gray-coloring-when-refreshing-dashboard/263127)
**Author:** [@jalzacs](https://discuss.elastic.co/u/jalzacs)\ **Replies:** 2\ **Last updated:** [February 3, 2021, 3:45pm UTC](https://discuss.elastic.co/t/disable-gray-coloring-when-refreshing-dashboard/263127 "2021-02-03T15:45:47Z")
I use Kibana dashboards to see real time data, updating them every 5 seconds. I have updated the ELK stack from 7.5 to 7.10 and now when the dashboard is refreshing data all dashboard goes gray. It is very annoying to se… --- ## [Elastic Agent 7.10.1 : javax.net.ssl.SSLHandshakeException: Received fatal alert: bad\_certificate](https://discuss.elastic.co/t/elastic-agent-7-10-1-javax-net-ssl-sslhandshakeexception-received-fatal-alert-bad-certificate/260607)
**Author:** [@hilo21](https://discuss.elastic.co/u/hilo21)\ **Replies:** 2\ **Last updated:** [February 3, 2021, 3:42pm UTC](https://discuss.elastic.co/t/elastic-agent-7-10-1-javax-net-ssl-sslhandshakeexception-received-fatal-alert-bad-certificate/260607 "2021-02-03T15:42:36Z")
Hello, I was testing the latest version of Elastic Stack 7.10.1. So far, so far following the documentation I managed setup an test environment and setup a small lab. I am interested in testing (Simulating Attacks) on … --- ## [Machine Learning - Import LOG file](https://discuss.elastic.co/t/machine-learning-import-log-file/262466)
**Author:** [@mariannoem-eltras](https://discuss.elastic.co/u/mariannoem-eltras)\ **Replies:** 11\ **Last updated:** [February 3, 2021, 3:20pm UTC](https://discuss.elastic.co/t/machine-learning-import-log-file/262466 "2021-02-03T15:20:23Z")
Hi there, would anyone be able to help with Importing Log file into Kibana? I am trying to import \*.log file from server through kibana/app/home - Import log file. However, in process of analyzing I keep getting error… --- ## [Xpack enabled elastic stack Cluster](https://discuss.elastic.co/t/xpack-enabled-elastic-stack-cluster/262808)
**Author:** [@Sagar\_Mandal](https://discuss.elastic.co/u/Sagar_Mandal)\ **Replies:** 7\ **Last updated:** [February 3, 2021, 3:04pm UTC](https://discuss.elastic.co/t/xpack-enabled-elastic-stack-cluster/262808 "2021-02-03T15:04:31Z")
Hi Team, I have a fedora distribution environment setup where I have 1 master node and 2 data node for Elasticsearch and single kibana and logstash in total I've 4 servers where logstash and kibana are in a single serve… --- ## [Kibana Dashboard read only](https://discuss.elastic.co/t/kibana-dashboard-read-only/262977)
**Author:** [@alfredo.deluca](https://discuss.elastic.co/u/alfredo.deluca)\ **Replies:** 2\ **Last updated:** [February 3, 2021, 2:56pm UTC](https://discuss.elastic.co/t/kibana-dashboard-read-only/262977 "2021-02-03T14:56:48Z")
Hi all. We have elastic cloud 7.10.2 and I'd like to create users with only access Kibana dashboards and in read only mode Also the dashboards that I create/update as an admin must be the same the read only users in Ki… --- ## [Detection Rules: Time Frame Based Exceptions](https://discuss.elastic.co/t/detection-rules-time-frame-based-exceptions/263036)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 4\ **Last updated:** [February 3, 2021, 2:46pm UTC](https://discuss.elastic.co/t/detection-rules-time-frame-based-exceptions/263036 "2021-02-03T14:46:25Z")
Hi All, I was wondering if it's possible to added time based exceptions to detection rules? An example would be with some of the current detection rules, they get triggered during system patching. Ideally it would be ni… --- ## [S3 backup configuration error](https://discuss.elastic.co/t/s3-backup-configuration-error/262795)
**Author:** [@Lior\_Yakobov](https://discuss.elastic.co/u/Lior_Yakobov)\ **Replies:** 12\ **Last updated:** [February 3, 2021, 2:42pm UTC](https://discuss.elastic.co/t/s3-backup-configuration-error/262795 "2021-02-03T14:42:39Z")
Hello, I'm trying to configure AWS S3 repository for backups but facing access issues to the S3 bucket. I did the following steps: Installed repository-s3 plugin on all cluster nodes restarted all nodes after the plu… --- ## [Recently rolled index does process data (0 docs)](https://discuss.elastic.co/t/recently-rolled-index-does-process-data-0-docs/261242)
**Author:** [@Zeroc0pter](https://discuss.elastic.co/u/Zeroc0pter)\ **Replies:** 8\ **Last updated:** [February 3, 2021, 2:33pm UTC](https://discuss.elastic.co/t/recently-rolled-index-does-process-data-0-docs/261242 "2021-02-03T14:33:03Z")
Hi People, I'm having an issue with our ILM set up. Well, I think it's related to our ILM policy. We use ElasticSearch 7. The policy rolled from 00001 to 00002 and suddenly it stopped processing data from our applicati… --- ## [Filebeat keystore permissions](https://discuss.elastic.co/t/filebeat-keystore-permissions/262962)
**Author:** [@Coyz](https://discuss.elastic.co/u/Coyz)\ **Replies:** 0\ **Last updated:** [February 2, 2021, 10:58am UTC](https://discuss.elastic.co/t/filebeat-keystore-permissions/262962 "2021-02-02T10:58:12Z")
Hello, i'm trying to setup filebeat as non root user. Here the service file ; \[Unit\] Description=Filebeat sends log files to Logstash or directly to Elasticsearch. Documentation=https://www.elastic.co/products/beats/f… --- ## [Elastic search indices](https://discuss.elastic.co/t/elastic-search-indices/262971)
**Author:** [@geomario](https://discuss.elastic.co/u/geomario)\ **Replies:** 3\ **Last updated:** [February 3, 2021, 2:22pm UTC](https://discuss.elastic.co/t/elastic-search-indices/262971 "2021-02-03T14:22:48Z")
Hello, I am a new user of Kibana and Elastic search. I am trying to load my elastic indices into my Kibana without success. I already created an index pattern which comes into mind that the information is there. In the … --- ## [How to create ingest pipeline for elasticsearch in kubernetes context?](https://discuss.elastic.co/t/how-to-create-ingest-pipeline-for-elasticsearch-in-kubernetes-context/263130)
**Author:** [@eeijlar](https://discuss.elastic.co/u/eeijlar)\ **Replies:** 0\ **Last updated:** [February 3, 2021, 2:15pm UTC](https://discuss.elastic.co/t/how-to-create-ingest-pipeline-for-elasticsearch-in-kubernetes-context/263130 "2021-02-03T14:15:55Z")
I am shipping a csv file from filebeat to elasticsearch. I understand that I need to use an ingest pipeline to parse the csv data prior to it being stored in elastic, similar to what is described in this answer From wha… --- ## [Recovered from panic while fetching 'azure/app\_insights' for host ''. \[AZURE\]](https://discuss.elastic.co/t/recovered-from-panic-while-fetching-azure-app-insights-for-host-azure/263113)
**Author:** [@miki\_haiat](https://discuss.elastic.co/u/miki_haiat)\ **Replies:** 0\ **Last updated:** [February 3, 2021, 11:19am UTC](https://discuss.elastic.co/t/recovered-from-panic-while-fetching-azure-app-insights-for-host-azure/263113 "2021-02-03T11:19:06Z")
Hey, I'm trying to send app\_insights metric via metric beat to elastic. I can't see any reference to 'host' in the app\_insight docs Any suggestion on how to solve this panic error I found the cause of the error, wh… --- ## [Kibana 7.10.0 pageNavigation style](https://discuss.elastic.co/t/kibana-7-10-0-pagenavigation-style/262957)
**Author:** [@Rollup\_eval](https://discuss.elastic.co/u/Rollup_eval)\ **Replies:** 5\ **Last updated:** [February 3, 2021, 2:09pm UTC](https://discuss.elastic.co/t/kibana-7-10-0-pagenavigation-style/262957 "2021-02-03T14:09:26Z")
Using kibana 7.10.0 with elasticsearch 7.10.0. Switching from modern mode (menu) to legacy mode(buttons) in advanced settings: pageNavigation style not working Modern mode is always displayed. --- ## [Using App Search on a website interface](https://discuss.elastic.co/t/using-app-search-on-a-website-interface/262979)
**Author:** [@nicksource](https://discuss.elastic.co/u/nicksource)\ **Replies:** 3\ **Last updated:** [February 3, 2021, 1:32pm UTC](https://discuss.elastic.co/t/using-app-search-on-a-website-interface/262979 "2021-02-03T13:32:35Z")
Hi there, firstly, thank you for your patience with what I'm about to ask! I've setup an engine/index on App Search, all is okay there, I now want to implement a search into my website, with either PHP or Javascript (pr… --- ## [Use NGINX with Logstash](https://discuss.elastic.co/t/use-nginx-with-logstash/263126)
**Author:** [@carmine.fabrizio](https://discuss.elastic.co/u/carmine.fabrizio)\ **Replies:** 0\ **Last updated:** [February 3, 2021, 1:25pm UTC](https://discuss.elastic.co/t/use-nginx-with-logstash/263126 "2021-02-03T13:25:37Z")
Do we have any kind of benefit or improvement if I configure an NGINX on top of LS? The only one that I can see is that I'll just configure one entry in my output.logstash and having a load balancer with a few helthchec… [Previous page](https://discuss.elastic.co/latest.md?page=1857) [Next page](https://discuss.elastic.co/latest.md?page=1859)