# Latest **URL:** https://discuss.elastic.co/latest.md?page=1870 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1871 --- ## [Auditbeat service is not starting in Centos](https://discuss.elastic.co/t/auditbeat-service-is-not-starting-in-centos/262531)
**Author:** [@Sivapriya](https://discuss.elastic.co/u/Sivapriya)\ **Replies:** 0\ **Last updated:** [January 28, 2021, 4:25pm UTC](https://discuss.elastic.co/t/auditbeat-service-is-not-starting-in-centos/262531 "2021-01-28T16:25:32Z")
Host Info: I am running the service as a root user {"system\_info": {"host": {"architecture":"i686","boot\_time":"2020-03-06T07:06:21Z","containerized":false,"name","kernel\_version":"2.6.32-754.27.1.el6.i686","mac":\["00:… --- ## [MSSQL metric in windows](https://discuss.elastic.co/t/mssql-metric-in-windows/260197)
**Author:** [@rohan0018](https://discuss.elastic.co/u/rohan0018)\ **Replies:** 8\ **Last updated:** [January 28, 2021, 3:25pm UTC](https://discuss.elastic.co/t/mssql-metric-in-windows/260197 "2021-01-28T15:25:16Z")
I have installed metricbeat MSSQL module in windows, but when I enable MSSQL module metricbeat service auto stop. Metricbeat service worksonly if MSSQL module is disabled. Please help --- ## [Filebeat 7.10.1 cannot write to /var/log/filebeat](https://discuss.elastic.co/t/filebeat-7-10-1-cannot-write-to-var-log-filebeat/262419)
**Author:** [@matG](https://discuss.elastic.co/u/matG)\ **Replies:** 1\ **Last updated:** [January 28, 2021, 3:12pm UTC](https://discuss.elastic.co/t/filebeat-7-10-1-cannot-write-to-var-log-filebeat/262419 "2021-01-28T15:12:34Z")
Hi :slight\_smile: I am currently having an issue with filebeat. It is running and can connect to the kafka host although it is not creating /var/log/filebeat nor writing to it. Which I believe is key to then send the be… --- ## [Logstash doesn't work on windows](https://discuss.elastic.co/t/logstash-doesnt-work-on-windows/262506)
**Author:** [@l418](https://discuss.elastic.co/u/l418)\ **Replies:** 4\ **Last updated:** [January 28, 2021, 3:03pm UTC](https://discuss.elastic.co/t/logstash-doesnt-work-on-windows/262506 "2021-01-28T15:03:52Z")
Hello. Trying to populate simple elastic cluster from demo using windows Your logstash windows implementation seems broken completely file { path =\> "/var/log/apache2/access.log" start\_position =\> "beginning" since… --- ## [DuplicateKeyError](https://discuss.elastic.co/t/duplicatekeyerror/262107)
**Author:** [@pesc](https://discuss.elastic.co/u/pesc)\ **Replies:** 6\ **Last updated:** [January 28, 2021, 2:49pm UTC](https://discuss.elastic.co/t/duplicatekeyerror/262107 "2021-01-28T14:49:21Z")
Hi I'm getting an error while adding a document by POST to documents: Exception: Unable to save document: Swiftype::Documents::DuplicateKeyError: How's that even possible? If the ID already exists, wouldn't it just u… --- ## [Custom naming the new indices from a Rollover](https://discuss.elastic.co/t/custom-naming-the-new-indices-from-a-rollover/262492)
**Author:** [@Eilon\_Reif](https://discuss.elastic.co/u/Eilon_Reif)\ **Replies:** 0\ **Last updated:** [January 28, 2021, 11:43am UTC](https://discuss.elastic.co/t/custom-naming-the-new-indices-from-a-rollover/262492 "2021-01-28T11:43:26Z")
Hi, Is there a way to name the new indices by date? something like: my-index-(now/d), instead of just an increasing number. (I'm indexing data by using the API directly, with out any ingestion server) Thanks SOLVED … --- ## [Send to different indices with filebeat modules and ILM enabled](https://discuss.elastic.co/t/send-to-different-indices-with-filebeat-modules-and-ilm-enabled/262507)
**Author:** [@nber](https://discuss.elastic.co/u/nber)\ **Replies:** 0\ **Last updated:** [January 28, 2021, 1:43pm UTC](https://discuss.elastic.co/t/send-to-different-indices-with-filebeat-modules-and-ilm-enabled/262507 "2021-01-28T13:43:36Z")
Hey there, I'd like to collect logs on a device with different modules and send them to different indices. The question itself is answered in: Though, as far as I understand, this only works when ILM is disabled. Yet… --- ## [Range in data table is not working](https://discuss.elastic.co/t/range-in-data-table-is-not-working/262490)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 4\ **Last updated:** [January 28, 2021, 1:39pm UTC](https://discuss.elastic.co/t/range-in-data-table-is-not-working/262490 "2021-01-28T13:39:42Z")
Hi, I have a ELK setup of 7.10.0v. I created a data table visualization with Range in bucket, but it is not giving the correct value. PFA of the data table with out range. Here it is givin the total U-clients "126,9… --- ## [Raw data visualization takes too much time](https://discuss.elastic.co/t/raw-data-visualization-takes-too-much-time/262479)
**Author:** [@Shalhevet](https://discuss.elastic.co/u/Shalhevet)\ **Replies:** 2\ **Last updated:** [January 28, 2021, 1:39pm UTC](https://discuss.elastic.co/t/raw-data-visualization-takes-too-much-time/262479 "2021-01-28T13:39:33Z")
Hi, I am trying to create line chart visualization of field Y vs. PatchNo field. I have more then 10K documents, but even if I limit the buckets size to 1000, it takes few minutes for the vis. to get updated. why is i… --- ## [Not able to login with a new created user into kibana](https://discuss.elastic.co/t/not-able-to-login-with-a-new-created-user-into-kibana/262454)
**Author:** [@Abhishek\_Shah](https://discuss.elastic.co/u/Abhishek_Shah)\ **Replies:** 1\ **Last updated:** [January 28, 2021, 1:32pm UTC](https://discuss.elastic.co/t/not-able-to-login-with-a-new-created-user-into-kibana/262454 "2021-01-28T13:32:29Z")
I have created a user using elasticsearch security API. But I am not able to login into kibana using the newly created user. Do I need to make any configuration changes or any other reason? ELK Stack is hosted on elasti… --- ## ['Lock' in Persistent Volumes on Openshift when deploys blue-green ELK Stack](https://discuss.elastic.co/t/lock-in-persistent-volumes-on-openshift-when-deploys-blue-green-elk-stack/262377)
**Author:** [@jonhmb](https://discuss.elastic.co/u/jonhmb)\ **Replies:** 4\ **Last updated:** [January 28, 2021, 1:17pm UTC](https://discuss.elastic.co/t/lock-in-persistent-volumes-on-openshift-when-deploys-blue-green-elk-stack/262377 "2021-01-28T13:17:57Z")
I have an ELK Stack running in a Openshift POD as 'Blue' using Persistent Volumes to storage data. When I try to deploy a second ELK Stack in a second POD using the same Persistent Volumes, i get an error because ELK Vo… --- ## [Return multiple fields when performing aggregations](https://discuss.elastic.co/t/return-multiple-fields-when-performing-aggregations/262502)
**Author:** [@ArifAlili](https://discuss.elastic.co/u/ArifAlili)\ **Replies:** 0\ **Last updated:** [January 28, 2021, 1:13pm UTC](https://discuss.elastic.co/t/return-multiple-fields-when-performing-aggregations/262502 "2021-01-28T13:13:57Z")
Hi all, Is there a way to return other fields besides "key" and "doc\_count" when performing aggregations? I don't want to do aggregation on multiple fields, I just want multiple fields to be returned in Aggregation res… --- ## [ImportError: cannot import name ‘decodestring’ from ‘base64’ (/usr/lib64/python3.9/base64.py)](https://discuss.elastic.co/t/importerror-cannot-import-name-decodestring-from-base64-usr-lib64-python3-9-base64-py/262248)
**Author:** [@Green\_Max](https://discuss.elastic.co/u/Green_Max)\ **Replies:** 4\ **Last updated:** [January 27, 2021, 12:53pm UTC](https://discuss.elastic.co/t/importerror-cannot-import-name-decodestring-from-base64-usr-lib64-python3-9-base64-py/262248 "2021-01-27T12:53:49Z")
can you help me to fix bug that says Traceback (most recent call last): File "/home/fofive/PycharmProjects/pythonProject/main.py", line 1, in \ from elasticsearch import Elasticsearch, RequestsH… --- ## [Sorting @timestamp while exporting from elasticsearch and writing into csv](https://discuss.elastic.co/t/sorting-timestamp-while-exporting-from-elasticsearch-and-writing-into-csv/262496)
**Author:** [@ritusingh](https://discuss.elastic.co/u/ritusingh)\ **Replies:** 0\ **Last updated:** [January 28, 2021, 12:35pm UTC](https://discuss.elastic.co/t/sorting-timestamp-while-exporting-from-elasticsearch-and-writing-into-csv/262496 "2021-01-28T12:35:04Z")
Hi, Problem Statement: To export the logs from elasticsearch and write into csv in timewise order(either increasing or decreasing) Solution: I am using logstash , configuration is given below, input { elasticsearch {… --- ## [Percentage in scripted fields](https://discuss.elastic.co/t/percentage-in-scripted-fields/262489)
**Author:** [@Pranusha119](https://discuss.elastic.co/u/Pranusha119)\ **Replies:** 2\ **Last updated:** [January 28, 2021, 12:38pm UTC](https://discuss.elastic.co/t/percentage-in-scripted-fields/262489 "2021-01-28T12:38:53Z")
Hi I have divided two fields using below script return doc\['StatusOpen'\].value/doc\['StatusSent'\].value for this result should be 2/31 = 0.06451 = 6.451% but it's giving 0 % As I have format as percentage and Numer… --- ## [Recommended practise for detection tuning; filters or exceptions](https://discuss.elastic.co/t/recommended-practise-for-detection-tuning-filters-or-exceptions/262218)
**Author:** [@The1WhoPrtNocks](https://discuss.elastic.co/u/The1WhoPrtNocks)\ **Replies:** 7\ **Last updated:** [January 28, 2021, 12:36pm UTC](https://discuss.elastic.co/t/recommended-practise-for-detection-tuning-filters-or-exceptions/262218 "2021-01-28T12:36:27Z")
Hi, I have given a look through the documentation but did not come across anything conclusive. What is the recommended way of tuning detection rules, as you can get the same results from filters and exceptions. Can yo… --- ## [Vega scatterplot with specific color to each value](https://discuss.elastic.co/t/vega-scatterplot-with-specific-color-to-each-value/262268)
**Author:** [@Shalhevet](https://discuss.elastic.co/u/Shalhevet)\ **Replies:** 4\ **Last updated:** [January 28, 2021, 10:59am UTC](https://discuss.elastic.co/t/vega-scatterplot-with-specific-color-to-each-value/262268 "2021-01-28T10:59:06Z")
I have an index in which each document has ‘X Location’ field, ‘Y Location’ field and ‘rgb’ field. The ‘rgb’ field contains rgb values of string format rgb(x,y,z). I would like to visualize the data, and I tried to m… --- ## [Kibana Visualization for Sensor Outage](https://discuss.elastic.co/t/kibana-visualization-for-sensor-outage/261898)
**Author:** [@kpraveeng](https://discuss.elastic.co/u/kpraveeng)\ **Replies:** 1\ **Last updated:** [January 28, 2021, 10:50am UTC](https://discuss.elastic.co/t/kibana-visualization-for-sensor-outage/261898 "2021-01-28T10:50:32Z")
I want to create Kibana Visualization for Sensor Outage. Sensor Outage means that data for a given sensor is not received for a period of 10 min. So the visualization should show the count of sensors that did not send da… --- ## [Configure TLS/SSL for elasticsearch using Letsencrypt issue](https://discuss.elastic.co/t/configure-tls-ssl-for-elasticsearch-using-letsencrypt-issue/262352)
**Author:** [@gvx3](https://discuss.elastic.co/u/gvx3)\ **Replies:** 1\ **Last updated:** [January 28, 2021, 10:21am UTC](https://discuss.elastic.co/t/configure-tls-ssl-for-elasticsearch-using-letsencrypt-issue/262352 "2021-01-28T10:21:24Z")
Hi all, I'm trying to configure TLS connection for elasticsearch using helm package, here is current configuration: protocol: https secretMounts: - name: certall secretName: certall path: /… --- ## [Data table Visualisation not showing correct result for numeric data](https://discuss.elastic.co/t/data-table-visualisation-not-showing-correct-result-for-numeric-data/261947)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 6\ **Last updated:** [January 28, 2021, 9:47am UTC](https://discuss.elastic.co/t/data-table-visualisation-not-showing-correct-result-for-numeric-data/261947 "2021-01-28T09:47:49Z")
I am working with Cloudflare analytics data and trying to create a data table visualization to show the sum of the bandwidth in descending order for fields bandwidth.ssl.encrypted, bandwidth.ssl.unencrypted, bandwidth.ss… --- ## [Problem with syslog in Fleet-Elastic agent-System Integration](https://discuss.elastic.co/t/problem-with-syslog-in-fleet-elastic-agent-system-integration/262464)
**Author:** [@bjarnej](https://discuss.elastic.co/u/bjarnej)\ **Replies:** 0\ **Last updated:** [January 28, 2021, 8:41am UTC](https://discuss.elastic.co/t/problem-with-syslog-in-fleet-elastic-agent-system-integration/262464 "2021-01-28T08:41:06Z")
I deployed an Elastic Agent 7.10.2 on Debian Linux using Fleet and the "System Integration", all metric logs disabled. Default the System integration will look in: /var/log/auth.log\* and /var/log/secure\* for "System au… --- ## [405 error when calling /\_cluster/health?level=indices from a watcher](https://discuss.elastic.co/t/405-error-when-calling-cluster-health-level-indices-from-a-watcher/262457)
**Author:** [@mkadiri](https://discuss.elastic.co/u/mkadiri)\ **Replies:** 2\ **Last updated:** [January 28, 2021, 8:30am UTC](https://discuss.elastic.co/t/405-error-when-calling-cluster-health-level-indices-from-a-watcher/262457 "2021-01-28T08:30:19Z")
I'm trying to setup a watcher to display indices health using the endpoint mentioned but keep getting a 405 error. This error goes away when I just use the following /\_cluster/health dropping the params ?level=indices, … --- ## ["failed parsing time field" + "failed using layout"](https://discuss.elastic.co/t/failed-parsing-time-field-failed-using-layout/262433)
**Author:** [@6NMgfDwZ3](https://discuss.elastic.co/u/6NMgfDwZ3)\ **Replies:** 0\ **Last updated:** [January 28, 2021, 12:23am UTC](https://discuss.elastic.co/t/failed-parsing-time-field-failed-using-layout/262433 "2021-01-28T00:23:08Z")
Hello, I am trying to convert a microseconds precision time field to @timestamp but I got error messages. A part of the Filebeat config lines, related to the issue: processors: - decode\_json\_fields: fields: \["… --- ## [APM Consuming lot of HEAP Memory](https://discuss.elastic.co/t/apm-consuming-lot-of-heap-memory/259571)
**Author:** [@Ayush\_Agrahari](https://discuss.elastic.co/u/Ayush_Agrahari)\ **Replies:** 16\ **Last updated:** [January 28, 2021, 7:29am UTC](https://discuss.elastic.co/t/apm-consuming-lot-of-heap-memory/259571 "2021-01-28T07:29:35Z")
Hello , We have deployed one java service into kubernetes with Heap Size around 4GB. We also run APM along with it using below command . java -javaagent:/home/user/elastic-apm-agent-1.18.0.RC1.jar -jar -Delastic.apm.s… --- ## [Unable to login](https://discuss.elastic.co/t/unable-to-login/257605)
**Author:** [@georgina](https://discuss.elastic.co/u/georgina)\ **Replies:** 11\ **Last updated:** [January 28, 2021, 7:23am UTC](https://discuss.elastic.co/t/unable-to-login/257605 "2021-01-28T07:23:57Z")
Hi, I've just installed Elasticsearch, Kibana and Enterprise Search via docker on desktop. It is a three node elastic cluster with Kibana and enterprise search https://www.elastic.co/guide/en/elastic-stack-get-started… --- ## [Elasticsearch python async client multiple requests](https://discuss.elastic.co/t/elasticsearch-python-async-client-multiple-requests/262460)
**Author:** [@NerdSec](https://discuss.elastic.co/u/NerdSec)\ **Replies:** 0\ **Last updated:** [January 28, 2021, 7:07am UTC](https://discuss.elastic.co/t/elasticsearch-python-async-client-multiple-requests/262460 "2021-01-28T07:07:18Z")
Hi, I was trying to use the Elasticsearch python client to make async queries to Elasticsearch. I'm trying to run aggs, and have a few partitions that I want to fetch results from. Here is my query: { 'query': { 'bo… --- ## [Trying to pass mongodb id as elasticsearch id](https://discuss.elastic.co/t/trying-to-pass-mongodb-id-as-elasticsearch-id/262449)
**Author:** [@fidsamurai](https://discuss.elastic.co/u/fidsamurai)\ **Replies:** 1\ **Last updated:** [January 28, 2021, 6:40am UTC](https://discuss.elastic.co/t/trying-to-pass-mongodb-id-as-elasticsearch-id/262449 "2021-01-28T06:40:37Z")
Logstash 7.8 We have a case where we collect logs from a mobile app using parse-sdk. The data is sent to a MongoDB replicaset. Logstash is configured using the mongoschema jdbc driver to pull the data from Mongo and p… --- ## [TSL/SSL basic license for ES Versions 7+](https://discuss.elastic.co/t/tsl-ssl-basic-license-for-es-versions-7/262445)
**Author:** [@pemfir](https://discuss.elastic.co/u/pemfir)\ **Replies:** 1\ **Last updated:** [January 28, 2021, 4:59am UTC](https://discuss.elastic.co/t/tsl-ssl-basic-license-for-es-versions-7/262445 "2021-01-28T04:59:38Z")
i tried to setup user-name and password for my single node ElasticSearch-kibana clusters using the instructions below, but it seems this is not possible without first setting up TSL/SSL, which will enable communication w… --- ## [Search based on aggregation result](https://discuss.elastic.co/t/search-based-on-aggregation-result/262431)
**Author:** [@Julian\_Ganzabal](https://discuss.elastic.co/u/Julian_Ganzabal)\ **Replies:** 2\ **Last updated:** [January 28, 2021, 1:37am UTC](https://discuss.elastic.co/t/search-based-on-aggregation-result/262431 "2021-01-28T01:37:48Z")
I am actually doing a query with an aggregation that returns a list from which I need to re-search. So, I get the aggregated data and then do a search on this aggregated data. That means 2 requests to Elasticsearch Is … --- ## [All data nodes oom down during heavily indexing periods](https://discuss.elastic.co/t/all-data-nodes-oom-down-during-heavily-indexing-periods/262376)
**Author:** [@wangxr1985](https://discuss.elastic.co/u/wangxr1985)\ **Replies:** 2\ **Last updated:** [January 28, 2021, 3:19am UTC](https://discuss.elastic.co/t/all-data-nodes-oom-down-during-heavily-indexing-periods/262376 "2021-01-28T03:19:34Z")
ES version: 7.5.2 JDK version: bundled openjdk 13 GC settings: -XX:+UseG1GC -XX:MaxGCPauseMillis=20 -XX:+UnlockExperimentalVMOptions -XX:G1NewSizePercent=2 We do heavily indexing(enable sniffing and all data node… [Previous page](https://discuss.elastic.co/latest.md?page=1869) [Next page](https://discuss.elastic.co/latest.md?page=1871)