# Latest **URL:** https://discuss.elastic.co/latest.md?page=1926 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1927 --- ## [Retrieving keys from logstash-keystore externally](https://discuss.elastic.co/t/retrieving-keys-from-logstash-keystore-externally/259342)
**Author:** [@mahi2](https://discuss.elastic.co/u/mahi2)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 7:51am UTC](https://discuss.elastic.co/t/retrieving-keys-from-logstash-keystore-externally/259342 "2020-12-22T07:51:55Z")
Hi I need to retrieve keys in logstash-keystore externally. Currently it only allows to retrieve it from logstash using config file. I'd like to know if there is a way to get it from cmd line or maybe any way other th… --- ## [Creating alert for custom dashboard](https://discuss.elastic.co/t/creating-alert-for-custom-dashboard/259105)
**Author:** [@lokeshbabloo](https://discuss.elastic.co/u/lokeshbabloo)\ **Replies:** 2\ **Last updated:** [December 22, 2020, 7:49am UTC](https://discuss.elastic.co/t/creating-alert-for-custom-dashboard/259105 "2020-12-22T07:49:41Z")
Hi I am having a dashboard like this I want to create an alert for the partcular panel " Log messages with error" , so that i can get an email alert if the "Error " occurs in that panel. is there any way to do that? --- ## [My cluster stopped ingesting due to low disk space but beats did not seem to recover all missed events](https://discuss.elastic.co/t/my-cluster-stopped-ingesting-due-to-low-disk-space-but-beats-did-not-seem-to-recover-all-missed-events/258210)
**Author:** [@netfire](https://discuss.elastic.co/u/netfire)\ **Replies:** 1\ **Last updated:** [December 22, 2020, 6:52am UTC](https://discuss.elastic.co/t/my-cluster-stopped-ingesting-due-to-low-disk-space-but-beats-did-not-seem-to-recover-all-missed-events/258210 "2020-12-22T06:52:51Z")
Newbie here. I had an event the other day due to not minding my index lifecycle policies. The cluster went yellow as there were unallocated shards (seemed like shards had moved completely off the first node to hit the di… --- ## [Filebeat IBMMQ module logs](https://discuss.elastic.co/t/filebeat-ibmmq-module-logs/257499)
**Author:** [@ajesh](https://discuss.elastic.co/u/ajesh)\ **Replies:** 6\ **Last updated:** [December 22, 2020, 6:28am UTC](https://discuss.elastic.co/t/filebeat-ibmmq-module-logs/257499 "2020-12-22T06:28:49Z")
Hi Team, We are trying to integrate IBMMQ logs to elasticsearch using filebeat and its default ibmmq module. We are able to see the logs getting send to the elasticsearch from the filebeat debug logs. But we are unable… --- ## [ElasticSearch \`Search\` Usage Metrics and total queries count](https://discuss.elastic.co/t/elasticsearch-search-usage-metrics-and-total-queries-count/259335)
**Author:** [@sb\_chat\_v1](https://discuss.elastic.co/u/sb_chat_v1)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 6:28am UTC](https://discuss.elastic.co/t/elasticsearch-search-usage-metrics-and-total-queries-count/259335 "2020-12-22T06:28:20Z")
We have a use-case which requires us to maintain count of total search queries. We need to do this on an index or index-alias basis and for this we are passing in a custom stats-group (as part of the \_search request). No… --- ## [Last value is not advancing after manual modification of the file](https://discuss.elastic.co/t/last-value-is-not-advancing-after-manual-modification-of-the-file/259333)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 6:21am UTC](https://discuss.elastic.co/t/last-value-is-not-advancing-after-manual-modification-of-the-file/259333 "2020-12-22T06:21:11Z")
Hi, after manipulating the last value file, its not moving forward in time anymore, this is my last value file --- !ruby/object:DateTime '2020-12-18 20:39:46.000000000 Z' and it seems that is writing duplicates every t… --- ## [Canvas kibana](https://discuss.elastic.co/t/canvas-kibana/259230)
**Author:** [@salma\_widiarti](https://discuss.elastic.co/u/salma_widiarti)\ **Replies:** 4\ **Last updated:** [December 22, 2020, 5:52am UTC](https://discuss.elastic.co/t/canvas-kibana/259230 "2020-12-22T05:52:25Z")
Hi all, I want to create data like this in canvas kibana And this is my query essql SELECT (labels.money::int) as a FROM "apm-\*" WHERE labels.status = 'PAID' When I preview the result the data type is already numer… --- ## [Search rejection when a shard relocation is complete](https://discuss.elastic.co/t/search-rejection-when-a-shard-relocation-is-complete/258829)
**Author:** [@wangxr1985](https://discuss.elastic.co/u/wangxr1985)\ **Replies:** 2\ **Last updated:** [December 22, 2020, 3:44am UTC](https://discuss.elastic.co/t/search-rejection-when-a-shard-relocation-is-complete/258829 "2020-12-22T03:44:22Z")
There was a rare issue when I tried to add several data nodes to my online ES cluster yesterday. When the new data nodes joined to the cluster, it began to rebalance shards to these new data nodes. Most of the shard re… --- ## [GeoIP processing of detections](https://discuss.elastic.co/t/geoip-processing-of-detections/259319)
**Author:** [@p\_ansell](https://discuss.elastic.co/u/p_ansell)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 1:34am UTC](https://discuss.elastic.co/t/geoip-processing-of-detections/259319 "2020-12-22T01:34:45Z")
Compared to non-Threshold results that inherit the previously processed fields, Threshold Detection events only include the single field that is being aggregated. I would like to perform GeoIP processing of Threshold Det… --- ## [Elastic agent fleet enrollment with Nginx authentication help](https://discuss.elastic.co/t/elastic-agent-fleet-enrollment-with-nginx-authentication-help/259311)
**Author:** [@jgarcia](https://discuss.elastic.co/u/jgarcia)\ **Replies:** 6\ **Last updated:** [December 22, 2020, 1:13am UTC](https://discuss.elastic.co/t/elastic-agent-fleet-enrollment-with-nginx-authentication-help/259311 "2020-12-22T01:13:17Z")
I setup an ELK stack server along with Nginx. I am trying to make use of the Elastic Agent Fleet enrollment so that I can utilize the endpoint security and do some digging. However, I noticed that if I try to enroll an a… --- ## [Dynamically update a target index after completion of indexing (When combining two indexes)](https://discuss.elastic.co/t/dynamically-update-a-target-index-after-completion-of-indexing-when-combining-two-indexes/259290)
**Author:** [@Alfar](https://discuss.elastic.co/u/Alfar)\ **Replies:** 0\ **Last updated:** [December 21, 2020, 4:52pm UTC](https://discuss.elastic.co/t/dynamically-update-a-target-index-after-completion-of-indexing-when-combining-two-indexes/259290 "2020-12-21T16:52:11Z")
Hi, I have used enrich index (addresses) to ingest to incoming documents(customers) in order to combine both indexes(customers and addresses). The indexes have fields as below Customers : name, age, email, address\_id … --- ## [Why does Elastic App Search Cloud version gives different search results in comparison with local app search installation?](https://discuss.elastic.co/t/why-does-elastic-app-search-cloud-version-gives-different-search-results-in-comparison-with-local-app-search-installation/259118)
**Author:** [@basan4ik](https://discuss.elastic.co/u/basan4ik)\ **Replies:** 1\ **Last updated:** [December 21, 2020, 11:15pm UTC](https://discuss.elastic.co/t/why-does-elastic-app-search-cloud-version-gives-different-search-results-in-comparison-with-local-app-search-installation/259118 "2020-12-21T23:15:30Z")
I installed Elastic app search locally (vers. 7.10) and also created an account on Cloud App search, then downloaded the same json file with products to both versions. But the search results are a little bit different as… --- ## [Exception running enterprise-search for first time](https://discuss.elastic.co/t/exception-running-enterprise-search-for-first-time/259062)
**Author:** [@spetri](https://discuss.elastic.co/u/spetri)\ **Replies:** 1\ **Last updated:** [December 21, 2020, 11:05pm UTC](https://discuss.elastic.co/t/exception-running-enterprise-search-for-first-time/259062 "2020-12-21T23:05:44Z")
Hi all - I have a local elasticsearch server running and have followed all the steps when installing enterprise-search. My config is as follows: ent\_search.auth.source: standard elasticsearch.username: elastic elasticse… --- ## [Filebeat Event Hub Beat - Stuck on Blob already exists](https://discuss.elastic.co/t/filebeat-event-hub-beat-stuck-on-blob-already-exists/259307)
**Author:** [@jkaufmanlr](https://discuss.elastic.co/u/jkaufmanlr)\ **Replies:** 2\ **Last updated:** [December 21, 2020, 10:58pm UTC](https://discuss.elastic.co/t/filebeat-event-hub-beat-stuck-on-blob-already-exists/259307 "2020-12-21T22:58:14Z")
I know I have another topic open but this I am kind of stuck on: PUT https://storageName.blob.core.windows.net/hubName/0?timeout=61 Authorization: REDACTED RESPONSE Status: 409 The specified blob already exists. ERRO… --- ## [Filebeats issue](https://discuss.elastic.co/t/filebeats-issue/258255)
**Author:** [@egS](https://discuss.elastic.co/u/egS)\ **Replies:** 1\ **Last updated:** [December 21, 2020, 10:38pm UTC](https://discuss.elastic.co/t/filebeats-issue/258255 "2020-12-21T22:38:45Z")
Trying to get IBM MQ logs. Have success with the following commands and actions: curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.10.1-x86\_64.rpm sudo rpm -vi filebeat-7.10.1-x86\_64.rpm Modif… --- ## [Copy Watcher Rules from Production cluster to DR cluster](https://discuss.elastic.co/t/copy-watcher-rules-from-production-cluster-to-dr-cluster/258712)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 1\ **Last updated:** [December 21, 2020, 10:03pm UTC](https://discuss.elastic.co/t/copy-watcher-rules-from-production-cluster-to-dr-cluster/258712 "2020-12-21T22:03:52Z")
Hi, Please help me to copy the watcher rules from prod cluster to DR cluster. Thanks in advance --- ## [Make Beats listen on localhost AND external IPs?](https://discuss.elastic.co/t/make-beats-listen-on-localhost-and-external-ips/259278)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 2\ **Last updated:** [December 21, 2020, 10:01pm UTC](https://discuss.elastic.co/t/make-beats-listen-on-localhost-and-external-ips/259278 "2020-12-21T22:01:43Z")
Hello I want to able to make Beats all listen on the localhost AND on the external IP (or at least bind it to a IP) All I see is creating a reverse proxy with Nginx and its something I rather avoid. How can I do this? … --- ## [Run two winlogbeat instances on the same machine](https://discuss.elastic.co/t/run-two-winlogbeat-instances-on-the-same-machine/259238)
**Author:** [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Replies:** 3\ **Last updated:** [December 21, 2020, 9:58pm UTC](https://discuss.elastic.co/t/run-two-winlogbeat-instances-on-the-same-machine/259238 "2020-12-21T21:58:56Z")
Hi, I want to send my winlogbeat data to two different ES clusters. As far as I know, winlogbeat can't have several outputs. Is there a way to run two winlogbeat instances with different configs on the same machine? --- ## [Bool Queries - Filtering double negatives](https://discuss.elastic.co/t/bool-queries-filtering-double-negatives/258217)
**Author:** [@Stephen\_Kneubuehl](https://discuss.elastic.co/u/Stephen_Kneubuehl)\ **Replies:** 1\ **Last updated:** [December 21, 2020, 9:51pm UTC](https://discuss.elastic.co/t/bool-queries-filtering-double-negatives/258217 "2020-12-21T21:51:01Z")
Hey everyone, I need help with query syntax! I'm trying to build a compound bool query that filters out documents that do not match a certain criteria, essentially a double negative. I want to return relevant events f… --- ## [Make Kibana listen on localhost AND external IPs?](https://discuss.elastic.co/t/make-kibana-listen-on-localhost-and-external-ips/259277)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 1\ **Last updated:** [December 21, 2020, 9:49pm UTC](https://discuss.elastic.co/t/make-kibana-listen-on-localhost-and-external-ips/259277 "2020-12-21T21:49:04Z")
Hello I want to able to make my Elastic Stack (Elasticsearch, Logstash, Kibana, and Beats) all listen on the localhost AND on the external IP (or at least bind it to a IP) All I see is creating a reverse proxy with Ngi… --- ## [Make Logstash listen on localhost AND external IPs?](https://discuss.elastic.co/t/make-logstash-listen-on-localhost-and-external-ips/259276)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 1\ **Last updated:** [December 21, 2020, 9:48pm UTC](https://discuss.elastic.co/t/make-logstash-listen-on-localhost-and-external-ips/259276 "2020-12-21T21:48:04Z")
Hello I want to able to make my Elastic Stack (Elasticsearch, Logstash, Kibana, and Beats) all listen on the localhost AND on the external IP (or at least bind it to a IP) All I see is creating a reverse proxy with Ngi… --- ## [Make Elastic Stack listen on localhost AND external IPs?](https://discuss.elastic.co/t/make-elastic-stack-listen-on-localhost-and-external-ips/259275)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 3\ **Last updated:** [December 21, 2020, 9:47pm UTC](https://discuss.elastic.co/t/make-elastic-stack-listen-on-localhost-and-external-ips/259275 "2020-12-21T21:47:37Z")
Hello I want to able to make my Elastic Stack (Elasticsearch, Logstash, Kibana, and Beats) all listen on the localhost AND on the external IP (or at least bind it to a IP) All I see is creating a reverse proxy with Ngi… --- ## [Elasticsearch curl error](https://discuss.elastic.co/t/elasticsearch-curl-error/259297)
**Author:** [@hassan.rana](https://discuss.elastic.co/u/hassan.rana)\ **Replies:** 1\ **Last updated:** [December 21, 2020, 9:46pm UTC](https://discuss.elastic.co/t/elasticsearch-curl-error/259297 "2020-12-21T21:46:34Z")
I am trying to curl some fields/information out of elasticsearch ( to run as zabbix external checks) but can not see the output from any other machine. Blockquote curl -v -XGET "http://10.100.0.0:9200/filebeat\*/\_sea… --- ## [X-pack security enable for tribe node](https://discuss.elastic.co/t/x-pack-security-enable-for-tribe-node/259129)
**Author:** [@prashanth\_sri](https://discuss.elastic.co/u/prashanth_sri)\ **Replies:** 4\ **Last updated:** [December 21, 2020, 9:45pm UTC](https://discuss.elastic.co/t/x-pack-security-enable-for-tribe-node/259129 "2020-12-21T21:45:26Z")
tribe: t1: cluster.name: Data1 discovery.zen.ping.unicast.hosts: \["x.x.x.x:9300"\] xpack.security.transport.ssl.verification\_mode: certificate xpack.security.transport.ssl.keystore.path: certs/estribe.p12 xpack.sec… --- ## [Need to visualize consistently failing tests](https://discuss.elastic.co/t/need-to-visualize-consistently-failing-tests/259299)
**Author:** [@larrya](https://discuss.elastic.co/u/larrya)\ **Replies:** 2\ **Last updated:** [December 21, 2020, 9:45pm UTC](https://discuss.elastic.co/t/need-to-visualize-consistently-failing-tests/259299 "2020-12-21T21:45:12Z")
I am trying to calculate consistently failing tests over the past 48 hours. For my index I have test results with two significant fields: test\_identifier (string) and test\_result\_status (pass or fail). I would like to d… --- ## [Visualize Amount of Data written to elastic in the last 24h per Index](https://discuss.elastic.co/t/visualize-amount-of-data-written-to-elastic-in-the-last-24h-per-index/258988)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 3\ **Last updated:** [December 21, 2020, 9:44pm UTC](https://discuss.elastic.co/t/visualize-amount-of-data-written-to-elastic-in-the-last-24h-per-index/258988 "2020-12-21T21:44:00Z")
Hi folks, I have following use case: I want to have a visualization (lets say a gauge) which indicates how much data customer writes to an index in the last 24h Can you help me about how I can achive this? So far in … --- ## [Kibana does not show timeframe in discover](https://discuss.elastic.co/t/kibana-does-not-show-timeframe-in-discover/259303)
**Author:** [@snolfi](https://discuss.elastic.co/u/snolfi)\ **Replies:** 1\ **Last updated:** [December 21, 2020, 9:25pm UTC](https://discuss.elastic.co/t/kibana-does-not-show-timeframe-in-discover/259303 "2020-12-21T21:25:34Z")
Hello, we are working on kibana 6. It's a SaaS on AWS. We noticed that in discover section there is not the timeframe option to select data, neither the graph the shows how documents are arriving from beats. What co… --- ## [Datastream does not rollover properly](https://discuss.elastic.co/t/datastream-does-not-rollover-properly/259295)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 3\ **Last updated:** [December 21, 2020, 7:37pm UTC](https://discuss.elastic.co/t/datastream-does-not-rollover-properly/259295 "2020-12-21T19:37:43Z")
I have a data stream that I am writing to and which has reached its rollover point -- current actions says rollover but there is no 000002 index. Time given for the rollover is 8 hours ago: definition: { "policy"… --- ## [Add date{} config make logstash not working](https://discuss.elastic.co/t/add-date-config-make-logstash-not-working/259213)
**Author:** [@azteker](https://discuss.elastic.co/u/azteker)\ **Replies:** 5\ **Last updated:** [December 21, 2020, 7:36pm UTC](https://discuss.elastic.co/t/add-date-config-make-logstash-not-working/259213 "2020-12-21T19:36:13Z")
I add date{} config into filter {}, but then the log is not passed to elasticseatch(cannot see new log in kibana). Logs are back if I removed the date config. This is the date config I added: date { match =\> \["ts"… --- ## [Elastic SIEM Fields Populate to JIRA Custom Fields](https://discuss.elastic.co/t/elastic-siem-fields-populate-to-jira-custom-fields/259291)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 1\ **Last updated:** [December 21, 2020, 5:51pm UTC](https://discuss.elastic.co/t/elastic-siem-fields-populate-to-jira-custom-fields/259291 "2020-12-21T17:51:47Z")
Is it possible to populate fields to customer fields in JIRA for a ticket. Like my current set up that I have for AlienVault? [Previous page](https://discuss.elastic.co/latest.md?page=1925) [Next page](https://discuss.elastic.co/latest.md?page=1927)