# Kibana not able to filter beat.hostname after certain day **URL:** \ **Category:** Kibana\ **Created:** [April 24, 2018, 2:39pm UTC](https://discuss.elastic.co/t/kibana-not-able-to-filter-beat-hostname-after-certain-day/129325 "2018-04-24T14:39:19Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![kko](https://avatars.discourse-cdn.com/v4/letter/k/ed8c4c/32.png) [@kko](https://discuss.elastic.co/u/kko)\ **Post date:** [April 24, 2018, 2:39pm UTC](https://discuss.elastic.co/t/kibana-not-able-to-filter-beat-hostname-after-certain-day/129325/1 "2018-04-24T14:39:19Z")
Hi, I encountered a problem with Kibana. I have a series of indices in Elasticsearch created from metricbeat. In Kibana I created an index pattern for the series of indices. I am able to create a Timelion with .es(metric=avg:system.cpu.user.pct, index=Metricbeat-6.2.3\*) up to the current time. However, when I try putting in a split query, it only show graph up to a certain date. Thanks, Kayson ---
**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\ **Post date:** [April 24, 2018, 4:24pm UTC](https://discuss.elastic.co/t/kibana-not-able-to-filter-beat-hostname-after-certain-day/129325/2 "2018-04-24T16:24:54Z")
Hello, Can you be more specific on the split query? How does it look? ---
**Author:** ![kko](https://avatars.discourse-cdn.com/v4/letter/k/ed8c4c/32.png) [@kko](https://discuss.elastic.co/u/kko)\ **Post date:** [April 24, 2018, 4:50pm UTC](https://discuss.elastic.co/t/kibana-not-able-to-filter-beat-hostname-after-certain-day/129325/3 "2018-04-24T16:50:54Z")
Hi Marius, Thank you for your reply. I created an index from metricbeat feed from 3 hosts. When I do the following timelion. It give me graph up to now ![](https://us1.discourse-cdn.com/elastic/original/3X/7/7/7753999d50ef86b071b0d665b4b8f4f926bab893.jpg) But if I split on beat.hostname.keyword, it give me this ![](https://us1.discourse-cdn.com/elastic/original/3X/4/a/4a9fdf9af6416966d5ad91275cf9b214423fb82b.jpg) It’s missing the graph from April 22. Thanks, Kayson ---
**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\ **Post date:** [April 26, 2018, 2:12pm UTC](https://discuss.elastic.co/t/kibana-not-able-to-filter-beat-hostname-after-certain-day/129325/4 "2018-04-26T14:12:45Z")
The split in timelion always sorts by the absolut count of documents so this split will cause the top 4 hostnames by count to be shown. It can be that these hostnames have just been shutdown in the end of the graph and the documents from the first chart are from other hostnames and thus not in the second one. In order to check this, can you draw? .`es(q=beat.name.keyword:SE123376), .es(q=beat.name.keyword:SE123376, metric=avg:system.cpu.user.pct)` ---
**Author:** ![kko](https://avatars.discourse-cdn.com/v4/letter/k/ed8c4c/32.png) [@kko](https://discuss.elastic.co/u/kko)\ **Post date:** [April 26, 2018, 4:21pm UTC](https://discuss.elastic.co/t/kibana-not-able-to-filter-beat-hostname-after-certain-day/129325/5 "2018-04-26T16:21:01Z")
Hi Marius, Yes, one host stopped at some point in time and that’s where the split graph stopped. I am able to draw all host in separate .es series, e.g. `.es(q=beat.name.keyword:SE123376, metric=avg:system.cpu.user.pct), .es(q=beat.name.keyword:SE123377, metric=avg:system.cpu.user.pct), etc.` `` `So, is this the only way to visualize all hosts? I can’t use the split keyword, right?` `` `Thanks,` `kayson` ---
**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\ **Post date:** [May 3, 2018, 12:36pm UTC](https://discuss.elastic.co/t/kibana-not-able-to-filter-beat-hostname-after-certain-day/129325/6 "2018-05-03T12:36:01Z")
Yep, this is pretty much the best way to get the info that you need. ---
**Author:** ![kko](https://avatars.discourse-cdn.com/v4/letter/k/ed8c4c/32.png) [@kko](https://discuss.elastic.co/u/kko)\ **Post date:** [May 7, 2018, 2:34pm UTC](https://discuss.elastic.co/t/kibana-not-able-to-filter-beat-hostname-after-certain-day/129325/7 "2018-05-07T14:34:13Z")
Hi Marius, We are setting up our Logstash server to send log to our secure Enterprise Elasticsearch server. However, I encountered some issue and seems like we need to setup the certificate for Logstash to connect ssl with our Enterprise ES server. Is there anyway to configure logstash to ignore the ssl certificate configuration and run as insecure mode? Below is the error log for logstash: [2018-05-07T10:25:59,467][INFO][logstash.inputs.beats] Beats inputs: Starting input listener {:address=\>"0.0.0.0:5045"} [2018-05-07T10:25:59,515][INFO][logstash.inputs.beats] Beats inputs: Starting input listener {:address=\>"0.0.0.0:5043"} [2018-05-07T10:25:59,685][INFO][logstash.pipeline] Pipeline started {"pipeline.id"=\>"main"} [2018-05-07T10:25:59,700][INFO][org.logstash.beats.Server] Starting server on port: 5043 [2018-05-07T10:25:59,700][INFO][org.logstash.beats.Server] Starting server on port: 5045 [2018-05-07T10:25:59,704][INFO][logstash.agent] Pipelines running {:count=\>1, :pipelines=\>["main"]} [2018-05-07T10:26:03,761][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[https://SRBL0SRVIMSSKibana:xxxxxx@d154888bca74484e9097b3893b2018ed.ece.saifg.rbc.com:9243/](https://SRBL0SRVIMSSKibana:xxxxxx@d154888bca74484e9097b3893b2018ed.ece.saifg.rbc.com:9243/), :path=\>"/"} [2018-05-07T10:26:03,795][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>"[https://SRBL0SRVIMSSKibana:xxxxxx@d154888bca74484e9097b3893b2018ed.ece.saifg.rbc.com:9243/](https://SRBL0SRVIMSSKibana:xxxxxx@d154888bca74484e9097b3893b2018ed.ece.saifg.rbc.com:9243/)", :error\_type=\>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=\>"Elasticsearch Unreachable: [[https://SRBL0SRVIMSSKibana:xxxxxx@d154888bca74484e9097b3893b2018ed.ece.saifg.rbc.com:9243/](https://SRBL0SRVIMSSKibana:xxxxxx@d154888bca74484e9097b3893b2018ed.ece.saifg.rbc.com:9243/)][Manticore::ClientProtocolException] PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"} [2018-05-07T10:26:08,804][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[https://SRBL0SRVIMSSKibana:xxxxxx@d154888bca74484e9097b3893b2018ed.ece.saifg.rbc.com:9243/](https://SRBL0SRVIMSSKibana:xxxxxx@d154888bca74484e9097b3893b2018ed.ece.saifg.rbc.com:9243/), :path=\>"/"} [2018-05-07T10:26:08,821][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>"[https://SRBL0SRVIMSSKibana:xxxxxx@d154888bca74484e9097b3893b2018ed.ece.saifg.rbc.com:9243/](https://SRBL0SRVIMSSKibana:xxxxxx@d154888bca74484e9097b3893b2018ed.ece.saifg.rbc.com:9243/)", :error\_type=\>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=\>"Elasticsearch Unreachable: [[https://SRBL0SRVIMSSKibana:xxxxxx@d154888bca74484e9097b3893b2018ed.ece.saifg.rbc.com:9243/](https://SRBL0SRVIMSSKibana:xxxxxx@d154888bca74484e9097b3893b2018ed.ece.saifg.rbc.com:9243/)][Manticore::ClientProtocolException] PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"} [2018-05-07T10:26:13,827][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[https://SRBL0SRVIMSSKibana:xxxxxx@d154888bca74484e9097b3893b2018ed.ece.saifg.rbc.com:9243/](https://SRBL0SRVIMSSKibana:xxxxxx@d154888bca74484e9097b3893b2018ed.ece.saifg.rbc.com:9243/), :path=\>"/"} [2018-05-07T10:26:13,851][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>"[https://SRBL0SRVIMSSKibana:xxxxxx@d154888bca74484e9097b3893b2018ed.ece.saifg.rbc.com:9243/](https://SRBL0SRVIMSSKibana:xxxxxx@d154888bca74484e9097b3893b2018ed.ece.saifg.rbc.com:9243/)", :error\_type=\>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=\>"Elasticsearch Unreachable: [[https://SRBL0SRVIMSSKibana:xxxxxx@d154888bca74484e9097b3893b2018ed.ece.saifg.rbc.com:9243/](https://SRBL0SRVIMSSKibana:xxxxxx@d154888bca74484e9097b3893b2018ed.ece.saifg.rbc.com:9243/)][Manticore::ClientProtocolException] PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"} [2018-05-07T10:26:18,859][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[https://SRBL0SRVIMSSKibana:xxxxxx@d154888bca74484e9097b3893b2018ed.ece.saifg.rbc.com:9243/](https://SRBL0SRVIMSSKibana:xxxxxx@d154888bca74484e9097b3893b2018ed.ece.saifg.rbc.com:9243/), :path=\>"/"} [2018-05-07T10:26:18,871][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>"[https://SRBL0SRVIMSSKibana:xxxxxx@d154888bca74484e9097b3893b2018ed.ece.saifg.rbc.com:9243/](https://SRBL0SRVIMSSKibana:xxxxxx@d154888bca74484e9097b3893b2018ed.ece.saifg.rbc.com:9243/)", :error\_type=\>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=\>"Elasticsearch Unreachable: [[https://SRBL0SRVIMSSKibana:xxxxxx@d154888bca74484e9097b3893b2018ed.ece.saifg.rbc.com:9243/](https://SRBL0SRVIMSSKibana:xxxxxx@d154888bca74484e9097b3893b2018ed.ece.saifg.rbc.com:9243/)][Manticore::ClientProtocolException] PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"} Thanks, Kayson ---
**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\ **Post date:** [May 7, 2018, 6:07pm UTC](https://discuss.elastic.co/t/kibana-not-able-to-filter-beat-hostname-after-certain-day/129325/8 "2018-05-07T18:07:56Z")
Hello, you ask this in the Logstash forums here: [https://discuss.elastic.co/c/logstash](https://discuss.elastic.co/c/logstash) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 4, 2018, 6:08pm UTC](https://discuss.elastic.co/t/kibana-not-able-to-filter-beat-hostname-after-certain-day/129325/9 "2018-06-04T18:08:04Z")
Closed on June 4, 2018, 6:08pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.