# Latest **URL:** https://discuss.elastic.co/latest.md?page=1957 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1958 --- ## [Temp downtimes, OptionalDataException (500) on ALL APIs (AWS)](https://discuss.elastic.co/t/temp-downtimes-optionaldataexception-500-on-all-apis-aws/257571)
**Author:** [@aviau](https://discuss.elastic.co/u/aviau)\ **Replies:** 9\ **Last updated:** [December 5, 2020, 4:41am UTC](https://discuss.elastic.co/t/temp-downtimes-optionaldataexception-500-on-all-apis-aws/257571 "2020-12-05T04:41:59Z")
Hello! I am currently running ElasticSearch 7.9.1 on the AWS ElasticSerach service. I have successfully restored a snapshot that I have made on my self-managed 7.2 instance. The cluster works well, can easily ingest t… --- ## [TSVB annotation row template field error](https://discuss.elastic.co/t/tsvb-annotation-row-template-field-error/257158)
**Author:** [@pingz](https://discuss.elastic.co/u/pingz)\ **Replies:** 2\ **Last updated:** [December 5, 2020, 3:50am UTC](https://discuss.elastic.co/t/tsvb-annotation-row-template-field-error/257158 "2020-12-05T03:50:26Z")
Hi, there: My fields value is set to log.message and I set row template to {{log.message}} Clicking the annotated line showed value {{log.message}}. Not the actual message from index Kibana 7.9.1 is used How shal… --- ## [Metrics -\> Inventory tab shows all zero's, but Metrics -\> Explorer shows data](https://discuss.elastic.co/t/metrics-inventory-tab-shows-all-zeros-but-metrics-explorer-shows-data/254451)
**Author:** [@jmcclelland](https://discuss.elastic.co/u/jmcclelland)\ **Replies:** 6\ **Last updated:** [December 5, 2020, 3:08am UTC](https://discuss.elastic.co/t/metrics-inventory-tab-shows-all-zeros-but-metrics-explorer-shows-data/254451 "2020-12-05T03:08:38Z")
I'm collecting metrics via metricbeat. The inventory shows all 27 servers as boxes, but with 0 as the value for each server and each indicator. However, when I click on the Explorer tab I can create a graph showing data… --- ## [ILM Hot, Warm, Cold?](https://discuss.elastic.co/t/ilm-hot-warm-cold/256958)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 8\ **Last updated:** [December 4, 2020, 11:41pm UTC](https://discuss.elastic.co/t/ilm-hot-warm-cold/256958 "2020-12-04T23:41:09Z")
Hello, When I try to setup ILM to make an index to become "Warm" after 30 days, then "Cold" after 60 days, and deleted after 90 days, I get the following: You can't control shard allocation without node attributes. Ca… --- ## [Creating a watcher](https://discuss.elastic.co/t/creating-a-watcher/257247)
**Author:** [@ChristianOelsner](https://discuss.elastic.co/u/ChristianOelsner)\ **Replies:** 2\ **Last updated:** [December 4, 2020, 11:28pm UTC](https://discuss.elastic.co/t/creating-a-watcher/257247 "2020-12-04T23:28:26Z")
Hello guys. I am still very much in a learning process when it comes to the elastic stack. Now i am trying to set up a watcher that can be user for some sort of allerting/notification, be it slack or mail. We have a l… --- ## [Event Correlation/Deviation](https://discuss.elastic.co/t/event-correlation-deviation/257572)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 4\ **Last updated:** [December 4, 2020, 9:48pm UTC](https://discuss.elastic.co/t/event-correlation-deviation/257572 "2020-12-04T21:48:56Z")
I have a series of endpoints that have hourly readings as well as a set of event times. A specific subset of the endpoints' readings are expected to drop during the events. I am trying to figure out a visualization tha… --- ## [Elastic don´t start after set xpack.security.enabled to true](https://discuss.elastic.co/t/elastic-don-t-start-after-set-xpack-security-enabled-to-true/257596)
**Author:** [@jh0mil](https://discuss.elastic.co/u/jh0mil)\ **Replies:** 19\ **Last updated:** [December 4, 2020, 9:14pm UTC](https://discuss.elastic.co/t/elastic-don-t-start-after-set-xpack-security-enabled-to-true/257596 "2020-12-04T21:14:01Z")
I tried activate elastic security, but when i add the line xpack.security.enabled: true if send command systemctl restart elasticsearch this crashes. --- ## [Filebeat does not harvest inactive files](https://discuss.elastic.co/t/filebeat-does-not-harvest-inactive-files/257700)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 0\ **Last updated:** [December 4, 2020, 9:06pm UTC](https://discuss.elastic.co/t/filebeat-does-not-harvest-inactive-files/257700 "2020-12-04T21:06:18Z")
Hi All, I am using filebeat 7.6.2. On starting up, it does not harvest a file which has time stamp of today but not actively being written into. Is there some parameter that I could introduce in filebeat.yml to make i… --- ## [Filebeat cisco/asa module not working](https://discuss.elastic.co/t/filebeat-cisco-asa-module-not-working/257088)
**Author:** [@Rafal\_Radziejewski](https://discuss.elastic.co/u/Rafal_Radziejewski)\ **Replies:** 7\ **Last updated:** [December 4, 2020, 8:10pm UTC](https://discuss.elastic.co/t/filebeat-cisco-asa-module-not-working/257088 "2020-12-04T20:10:41Z")
Elasticsearch 7.9.2 Filebeat 7.10 Running command: sudo filebeat setup -e --dashboards --pipelines --template Produces: 2020-11-30T16:04:16.488+0100 ERROR \[load\] cfgfile/list.go:99 Error creating runner from config:… --- ## [Visualize a time counter](https://discuss.elastic.co/t/visualize-a-time-counter/257225)
**Author:** [@fastxl](https://discuss.elastic.co/u/fastxl)\ **Replies:** 4\ **Last updated:** [December 4, 2020, 7:47pm UTC](https://discuss.elastic.co/t/visualize-a-time-counter/257225 "2020-12-04T19:47:03Z")
I am new to the ELK stack and trying to learn how to visualize some things. I have data coming in from one of our machine tools and I would like to make a simple counter that show the amount of time the machine has been … --- ## [Access denied stack monitoring под пользователем elastic](https://discuss.elastic.co/t/access-denied-stack-monitoring-elastic/257622)
**Author:** [@es7x](https://discuss.elastic.co/u/es7x)\ **Replies:** 8\ **Last updated:** [December 4, 2020, 7:22pm UTC](https://discuss.elastic.co/t/access-denied-stack-monitoring-elastic/257622 "2020-12-04T19:22:43Z")
Столкнулся с проблемой, под пользователем elastic не пускает в stack monitoring хотя до этого все работало. в логах кибаны такое "{ Error: \[security\_exception\] action \[indices:data/read/search\[can\_match\]\] is unauthor… --- ## [Set all nested fields value into master field](https://discuss.elastic.co/t/set-all-nested-fields-value-into-master-field/257676)
**Author:** [@Raynald](https://discuss.elastic.co/u/Raynald)\ **Replies:** 3\ **Last updated:** [December 4, 2020, 6:01pm UTC](https://discuss.elastic.co/t/set-all-nested-fields-value-into-master-field/257676 "2020-12-04T18:01:42Z")
Hi everyone, I have an index that can growth with many nested fileds, and we want to limit nested field to one sub-level for identified fields. But we want to keep value of this nested fields into the master field Exam… --- ## [Custom Logo Kibana 7.10.0 (guide)](https://discuss.elastic.co/t/custom-logo-kibana-7-10-0-guide/257686)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 0\ **Last updated:** [December 4, 2020, 5:31pm UTC](https://discuss.elastic.co/t/custom-logo-kibana-7-10-0-guide/257686 "2020-12-04T17:31:08Z")
Verified on Kibana 7.10.0, running on Debian 10 (Buster). Applies for the same version in Windows. Hello, For all users like me, that need to customize the logos in Kibana, I share this guide that I have been creating … --- ## [Cannot display Logstash pipeline in Monitoring UI](https://discuss.elastic.co/t/cannot-display-logstash-pipeline-in-monitoring-ui/256894)
**Author:** [@glenacota](https://discuss.elastic.co/u/glenacota)\ **Replies:** 1\ **Last updated:** [December 4, 2020, 7:01pm UTC](https://discuss.elastic.co/t/cannot-display-logstash-pipeline-in-monitoring-ui/256894 "2020-12-04T19:01:07Z")
Hi, I've enabled monitoring of my Logstash instance by following the instructions here: Collect Logstash monitoring data with Metricbeatedit. I can see all the collected metrics in the Kibana Stack Monitoring UI, except … --- ## [Dec 4th, 2020: \[EN\] Validate Elastic Common Schema (ECS) fields using Security Detection Rules](https://discuss.elastic.co/t/dec-4th-2020-en-validate-elastic-common-schema-ecs-fields-using-security-detection-rules/254805)
**Author:** [@ebeahan](https://discuss.elastic.co/u/ebeahan)\ **Replies:** 0\ **Last updated:** [December 4, 2020, 8:00am UTC](https://discuss.elastic.co/t/dec-4th-2020-en-validate-elastic-common-schema-ecs-fields-using-security-detection-rules/254805 "2020-12-04T08:00:00Z")
Introduction The Elastic Common Schema (ECS) provides an open, consistent model for structuring your data in the Elastic Stack. By normalizing data to a single common model, you can uniformly examine your data using int… --- ## [Unable to see apm data in kibana](https://discuss.elastic.co/t/unable-to-see-apm-data-in-kibana/256548)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 17\ **Last updated:** [December 4, 2020, 6:48pm UTC](https://discuss.elastic.co/t/unable-to-see-apm-data-in-kibana/256548 "2020-12-04T18:48:15Z")
Hi Team, I am unable to see apm data in kibana dashboard. Can someone please help. Getting the error as attached. this is single standalone server (dev env) where components of elk is installed. also i am getting error… --- ## [Variance/Deviation Visualization](https://discuss.elastic.co/t/variance-deviation-visualization/257690)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 0\ **Last updated:** [December 4, 2020, 6:39pm UTC](https://discuss.elastic.co/t/variance-deviation-visualization/257690 "2020-12-04T18:39:51Z")
I have a dataset with readings every 30m. I want to set a start time and an end time at a single interval (eg 1:00 - 1:30) and rank the devices based on the amount they changed. I've been using the Top N feature in TSV… --- ## [Stderr log format](https://discuss.elastic.co/t/stderr-log-format/257689)
**Author:** [@Andrii](https://discuss.elastic.co/u/Andrii)\ **Replies:** 0\ **Last updated:** [December 4, 2020, 6:39pm UTC](https://discuss.elastic.co/t/stderr-log-format/257689 "2020-12-04T18:39:46Z")
Hello, I noticed that filebeat stderr has a different format than stdout. That makes it impossible to parse filebeat logs with the same rule: here is an example: {"log":"{\\"level\\":\\"debug\\",\\"timestamp\\":\\"2020-12-04… --- ## [Error in Discovery and vizualize when creating a script field](https://discuss.elastic.co/t/error-in-discovery-and-vizualize-when-creating-a-script-field/254818)
**Author:** [@JinLauter](https://discuss.elastic.co/u/JinLauter)\ **Replies:** 8\ **Last updated:** [December 4, 2020, 5:40pm UTC](https://discuss.elastic.co/t/error-in-discovery-and-vizualize-when-creating-a-script-field/254818 "2020-12-04T17:40:08Z")
Hi, We created a simple string script field, and we are getting a error in discovery and when we try to use that script field in any vizualization. I belive the images will explain it better: The script field: Usin… --- ## [Can I update existing dashboard using UPDATE api?](https://discuss.elastic.co/t/can-i-update-existing-dashboard-using-update-api/257682)
**Author:** [@jhagen92](https://discuss.elastic.co/u/jhagen92)\ **Replies:** 3\ **Last updated:** [December 4, 2020, 5:39pm UTC](https://discuss.elastic.co/t/can-i-update-existing-dashboard-using-update-api/257682 "2020-12-04T17:39:09Z")
Hi, I am wondering if I can update existing dashboard using UPDATE api with saved json file. I am trying to see if I can revert my old changes back on dashboard back to Kibana. I am designing a way to have version contr… --- ## [Duplicates in ES Index](https://discuss.elastic.co/t/duplicates-in-es-index/256736)
**Author:** [@jafri6](https://discuss.elastic.co/u/jafri6)\ **Replies:** 1\ **Last updated:** [December 4, 2020, 5:28pm UTC](https://discuss.elastic.co/t/duplicates-in-es-index/256736 "2020-12-04T17:28:55Z")
My ELK Stack is running a process which collects logs from 5-6 different PCs. The only issue I am facing at the moment is, my ES index is logging multiple entries for the same timestamp. Any suggestions on how I can fi… --- ## [Cannot create Data Stream](https://discuss.elastic.co/t/cannot-create-data-stream/256621)
**Author:** [@Angelos](https://discuss.elastic.co/u/Angelos)\ **Replies:** 4\ **Last updated:** [December 4, 2020, 5:25pm UTC](https://discuss.elastic.co/t/cannot-create-data-stream/256621 "2020-12-04T17:25:52Z")
Hi, I am trying to create Data Streams by issuing: PUT \_data\_stream/test-index-pattern but I have this error: "error" : { "root\_cause" : \[ { "type" : "security\_exception", "reason" : "acti… --- ## [Control visualization issue in Dashboard](https://discuss.elastic.co/t/control-visualization-issue-in-dashboard/256645)
**Author:** [@sarthaksahu](https://discuss.elastic.co/u/sarthaksahu)\ **Replies:** 4\ **Last updated:** [December 4, 2020, 5:23pm UTC](https://discuss.elastic.co/t/control-visualization-issue-in-dashboard/256645 "2020-12-04T17:23:33Z")
We are upgrading kibana from 7.0.1 to 7.8.0 We had created Control Visualization in Kibana with 3 level parental control and using this in Dashboard. This was working as expected in 7.0.1 Issue: When we upgraded to 7.8… --- ## [Geohash Aggregation Question](https://discuss.elastic.co/t/geohash-aggregation-question/257681)
**Author:** [@johnrodey](https://discuss.elastic.co/u/johnrodey)\ **Replies:** 1\ **Last updated:** [December 4, 2020, 5:08pm UTC](https://discuss.elastic.co/t/geohash-aggregation-question/257681 "2020-12-04T17:08:11Z")
Is there a way to create a geohash aggregation with counts for subtypes/numeric ranges within that geohash. For example if I have a collection of buildings and I want to know for each geohash, what is the count of offic… --- ## [Validation Failed: 1: this action would add \[2\] total shards, but this cluster currently has \[2122\]/\[2000\] maximum shards open](https://discuss.elastic.co/t/validation-failed-1-this-action-would-add-2-total-shards-but-this-cluster-currently-has-2122-2000-maximum-shards-open/257678)
**Author:** [@Cristiane\_Marcarini](https://discuss.elastic.co/u/Cristiane_Marcarini)\ **Replies:** 1\ **Last updated:** [December 4, 2020, 4:59pm UTC](https://discuss.elastic.co/t/validation-failed-1-this-action-would-add-2-total-shards-but-this-cluster-currently-has-2122-2000-maximum-shards-open/257678 "2020-12-04T16:59:27Z")
How can I solve this problem? \[2020-12-04T10:10:41,540\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main\] Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>"e45d58acd2b072154d7ac57ceb05491db728… --- ## [Logstash](https://discuss.elastic.co/t/logstash/257661)
**Author:** [@bhuvaneswari](https://discuss.elastic.co/u/bhuvaneswari)\ **Replies:** 0\ **Last updated:** [December 4, 2020, 2:12pm UTC](https://discuss.elastic.co/t/logstash/257661 "2020-12-04T14:12:52Z")
Is there any possibility to add logstash configuration to uberagent configuration file? --- ## [Error after upgrading filebeat to 7.10](https://discuss.elastic.co/t/error-after-upgrading-filebeat-to-7-10/255402)
**Author:** [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Replies:** 11\ **Last updated:** [December 4, 2020, 4:43pm UTC](https://discuss.elastic.co/t/error-after-upgrading-filebeat-to-7-10/255402 "2020-12-04T16:43:47Z")
Hi, after I upgraded my stack to 7.10(from 7.9.3), I tried to upgrade my filebeat. But I'm getting this error: Nov 14 14:41:54 XXXXXXX filebeat\[13184\]: 2020-11-14T14:41:54.462+0330 INFO instance/beat.go:46… --- ## [Change Login Page Logo - Kibana 7.9.1 Docker](https://discuss.elastic.co/t/change-login-page-logo-kibana-7-9-1-docker/257647)
**Author:** [@Ayakashi97](https://discuss.elastic.co/u/Ayakashi97)\ **Replies:** 11\ **Last updated:** [December 4, 2020, 4:31pm UTC](https://discuss.elastic.co/t/change-login-page-logo-kibana-7-9-1-docker/257647 "2020-12-04T16:31:48Z")
Hi threre, i am on Version 7.9.1 and want to change the login page logo. I found this thread: Custom Logo Kibana 7.9.2 (guide) All is working fine in docker-container, but i cannot use this command in the kibana docker… --- ## [How to filter empty objects in Logstash?](https://discuss.elastic.co/t/how-to-filter-empty-objects-in-logstash/257456)
**Author:** [@ppuschmann](https://discuss.elastic.co/u/ppuschmann)\ **Replies:** 1\ **Last updated:** [December 4, 2020, 4:27pm UTC](https://discuss.elastic.co/t/how-to-filter-empty-objects-in-logstash/257456 "2020-12-04T16:27:30Z")
Hi, given you get the following access-log: { "container\_id": "b62946591d90f24", "service": "slash", "bytes\_received": 0, "input": {}, "type": "filebeat", "protocol": "HTTP/1.1", "bytes\_sent": 8236, "ho… --- ## [How can I automate version control Kibana Saved Object?](https://discuss.elastic.co/t/how-can-i-automate-version-control-kibana-saved-object/257677)
**Author:** [@jhagen92](https://discuss.elastic.co/u/jhagen92)\ **Replies:** 1\ **Last updated:** [December 4, 2020, 4:23pm UTC](https://discuss.elastic.co/t/how-can-i-automate-version-control-kibana-saved-object/257677 "2020-12-04T16:23:22Z")
Hi, I am very new to Kibana. I create Dashboard using Kibana and found that I can save it by using Saved Object. I was thinking I can version control these json file in my Azure DevOps repo. Instead of export-\>saving i… [Previous page](https://discuss.elastic.co/latest.md?page=1956) [Next page](https://discuss.elastic.co/latest.md?page=1958)