# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1396 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1397 --- ## [Filter by field for specific index on multi index query](https://discuss.elastic.co/t/filter-by-field-for-specific-index-on-multi-index-query/236545)
**Author:** [@alex-1](https://discuss.elastic.co/u/alex-1)\ **Replies:** 0\ **Last updated:** [June 10, 2020, 4:09pm UTC](https://discuss.elastic.co/t/filter-by-field-for-specific-index-on-multi-index-query/236545 "2020-06-10T16:09:22Z")
I've got two indexes which i can search on but wan't to filter by a field on one index and not the other. e.g. Index1 Index2 content content parent parent ... ... They share some common mappings. I want… --- ## [Auditbeat OSS fails to start](https://discuss.elastic.co/t/auditbeat-oss-fails-to-start/236261)
**Author:** [@Khasim\_Soudagar](https://discuss.elastic.co/u/Khasim_Soudagar)\ **Replies:** 2\ **Last updated:** [June 10, 2020, 4:07pm UTC](https://discuss.elastic.co/t/auditbeat-oss-fails-to-start/236261 "2020-06-10T16:07:56Z")
Please find the error message below, i have installed auditbeat and ELK stack from OSS repository. But failed to start auditbeat, can anyone please help me on this. \`\[khasim@vm1\] ~\]$ sudo systemctl status -l auditbeat.s… --- ## [Creating roles with limited Kibana permissions](https://discuss.elastic.co/t/creating-roles-with-limited-kibana-permissions/236502)
**Author:** [@maxdanilov](https://discuss.elastic.co/u/maxdanilov)\ **Replies:** 2\ **Last updated:** [June 10, 2020, 4:01pm UTC](https://discuss.elastic.co/t/creating-roles-with-limited-kibana-permissions/236502 "2020-06-10T16:01:57Z")
Hi, I'm following this tutorial to create users with eck: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-users-and-roles.html The examples there specify roles with Elasticsearch capabilities only, but can I d… --- ## [Unable to update timezone for date formatting in kibana](https://discuss.elastic.co/t/unable-to-update-timezone-for-date-formatting-in-kibana/235894)
**Author:** [@falconpurple](https://discuss.elastic.co/u/falconpurple)\ **Replies:** 1\ **Last updated:** [June 10, 2020, 3:57pm UTC](https://discuss.elastic.co/t/unable-to-update-timezone-for-date-formatting-in-kibana/235894 "2020-06-10T15:57:25Z")
Hi, I am not able to change the timezone from Browser to CET in the advanced settings of kibana. It gives this error: "Unable to update UI setting Request failed with status code: 503 " Any help would be really appr… --- ## [Indes not visible in maps tab](https://discuss.elastic.co/t/indes-not-visible-in-maps-tab/235408)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 8\ **Last updated:** [June 10, 2020, 3:36pm UTC](https://discuss.elastic.co/t/indes-not-visible-in-maps-tab/235408 "2020-06-10T15:36:31Z")
I am trying to plot data that has been enriched in a logstash pipieline with GeoMind DB. I am however unable to see this index in the maps tab of Kibana. Data from this index is visible and searchable in the discover tab… --- ## [Join two log files using aggregate filter of logstash to enter combined event in kibana](https://discuss.elastic.co/t/join-two-log-files-using-aggregate-filter-of-logstash-to-enter-combined-event-in-kibana/236536)
**Author:** [@Rushabh\_Doshi](https://discuss.elastic.co/u/Rushabh_Doshi)\ **Replies:** 0\ **Last updated:** [June 10, 2020, 3:34pm UTC](https://discuss.elastic.co/t/join-two-log-files-using-aggregate-filter-of-logstash-to-enter-combined-event-in-kibana/236536 "2020-06-10T15:34:53Z")
I have used the below aggregate plugin for logstash to join two log files: Log1: PAGE,PAGEDESCRIPTION Log 2: PAGE,HTTPAGENT I WANT THE FINAL OUTPUT in kibana as: PAGE,PAGEDESCRIPTION,HTTPAGENT. The aggregate plugin sni… --- ## [Generated index with malformed mappings and ignores number of shards](https://discuss.elastic.co/t/generated-index-with-malformed-mappings-and-ignores-number-of-shards/236462)
**Author:** [@Hoda\_Shirzad](https://discuss.elastic.co/u/Hoda_Shirzad)\ **Replies:** 9\ **Last updated:** [June 10, 2020, 3:03pm UTC](https://discuss.elastic.co/t/generated-index-with-malformed-mappings-and-ignores-number-of-shards/236462 "2020-06-10T15:03:15Z")
Hello there, I am trying to move my indexing code from an old code base to a new one, the elasticsearch server that I am using is 6.6.0 and I have tried the following parameters for create index using the official php c… --- ## [Rollup of apm indices](https://discuss.elastic.co/t/rollup-of-apm-indices/236327)
**Author:** [@A\_B](https://discuss.elastic.co/u/A_B)\ **Replies:** 4\ **Last updated:** [June 10, 2020, 2:51pm UTC](https://discuss.elastic.co/t/rollup-of-apm-indices/236327 "2020-06-10T14:51:42Z")
Hello! Has anyone tried to rollup APM indices? Is it even possible? Thank you in advance for any feedback :slight\_smile: --- ## [Run ELK in production](https://discuss.elastic.co/t/run-elk-in-production/236509)
**Author:** [@sathish28695](https://discuss.elastic.co/u/sathish28695)\ **Replies:** 1\ **Last updated:** [June 10, 2020, 2:48pm UTC](https://discuss.elastic.co/t/run-elk-in-production/236509 "2020-06-10T14:48:35Z")
How to configure kibana.yml and elasticsearch.yml to run ELK in production. Domain name: mydomainname Server: Apache --- ## [Deploy elasticsearch role based security using helm charts](https://discuss.elastic.co/t/deploy-elasticsearch-role-based-security-using-helm-charts/236496)
**Author:** [@a3984](https://discuss.elastic.co/u/a3984)\ **Replies:** 7\ **Last updated:** [June 10, 2020, 2:47pm UTC](https://discuss.elastic.co/t/deploy-elasticsearch-role-based-security-using-helm-charts/236496 "2020-06-10T14:47:11Z")
I am trying to configure elasticsearch in our kubernetes cluster using helm charts and values.yaml as we use Azure DevOps pipelines for our deployment strategy into Azure Kubernetes clusters. However, I am struggling to… --- ## [Poll: What Java version do you use with Logstash?](https://discuss.elastic.co/t/poll-what-java-version-do-you-use-with-logstash/236523)
**Author:** [@roaksoax](https://discuss.elastic.co/u/roaksoax)\ **Replies:** 0\ **Last updated:** [June 10, 2020, 2:25pm UTC](https://discuss.elastic.co/t/poll-what-java-version-do-you-use-with-logstash/236523 "2020-06-10T14:25:13Z")
Hi All, The Logstash team is looking at the future of our JDK support and we were wondering what JDK (whether that's OpenJDK, AdoptOpenJDK or Zulu) version you are using. poll --- ## [Node seems not to be discovered on EC2 network](https://discuss.elastic.co/t/node-seems-not-to-be-discovered-on-ec2-network/236193)
**Author:** [@Hayato](https://discuss.elastic.co/u/Hayato)\ **Replies:** 3\ **Last updated:** [June 10, 2020, 2:13pm UTC](https://discuss.elastic.co/t/node-seems-not-to-be-discovered-on-ec2-network/236193 "2020-06-10T14:13:34Z")
Hi all. Now I’m trying to form a two-nodes cluster on AWS EC2. I’m using Elasticsearch Ver. 7.3. “discovery-ec2” is installed in both two nodes for a cluster. The followings are elasticsearch.yml on each node-1 and no… --- ## [Cannot update plugin logstash-filter-grok](https://discuss.elastic.co/t/cannot-update-plugin-logstash-filter-grok/236388)
**Author:** [@nhnicwaller](https://discuss.elastic.co/u/nhnicwaller)\ **Replies:** 1\ **Last updated:** [June 10, 2020, 1:50pm UTC](https://discuss.elastic.co/t/cannot-update-plugin-logstash-filter-grok/236388 "2020-06-10T13:50:55Z")
I have this command as part of my process to build a docker image for Logstash. It worked fine a month ago, and today it is failing. logstash-plugin update logstash-filter-grok Here's the exact error message: An error… --- ## [ECK - Internal Load Balancer unable to create](https://discuss.elastic.co/t/eck-internal-load-balancer-unable-to-create/236491)
**Author:** [@aman26ps](https://discuss.elastic.co/u/aman26ps)\ **Replies:** 2\ **Last updated:** [June 10, 2020, 1:50pm UTC](https://discuss.elastic.co/t/eck-internal-load-balancer-unable-to-create/236491 "2020-06-10T13:50:33Z")
Hi Team, I am following the below document to add internal load balancer for routing the traffic from data proc, but i am unable to create one: please find the config i applied: spec: http: service: spec: … --- ## [Grant permission on a single dashboard for each user](https://discuss.elastic.co/t/grant-permission-on-a-single-dashboard-for-each-user/236284)
**Author:** [@elisavet](https://discuss.elastic.co/u/elisavet)\ **Replies:** 4\ **Last updated:** [June 10, 2020, 1:42pm UTC](https://discuss.elastic.co/t/grant-permission-on-a-single-dashboard-for-each-user/236284 "2020-06-10T13:42:44Z")
Hello! I want to create dashboard1, dashboard2 from the same index. But I want user1 to have access only to dashboard1 and user2 only to dashboard2. How can I achieve this? Thank you, Elisavet --- ## [ElasticSearch not able to discover Master nodes](https://discuss.elastic.co/t/elasticsearch-not-able-to-discover-master-nodes/236516)
**Author:** [@taseer94](https://discuss.elastic.co/u/taseer94)\ **Replies:** 2\ **Last updated:** [June 10, 2020, 1:33pm UTC](https://discuss.elastic.co/t/elasticsearch-not-able-to-discover-master-nodes/236516 "2020-06-10T13:33:26Z")
Hi all, We were running an HA Elastic cluster. 3 nodes to be precise. However, this morning, without me being aware, Kubernetes was upgraded and that nodes were restarted, resulting in the cluster being in in-consistent… --- ## [Create scripted field error](https://discuss.elastic.co/t/create-scripted-field-error/236471)
**Author:** [@inchirah](https://discuss.elastic.co/u/inchirah)\ **Replies:** 8\ **Last updated:** [June 10, 2020, 1:35pm UTC](https://discuss.elastic.co/t/create-scripted-field-error/236471 "2020-06-10T13:35:10Z")
Hello, I created a script field "attempt complaint" which takes the values \>= -78 from another field "Contrainte" Can anyone tell how I can fixe that? --- ## [How to make a document update without Logstash](https://discuss.elastic.co/t/how-to-make-a-document-update-without-logstash/236518)
**Author:** [@Julien1](https://discuss.elastic.co/u/Julien1)\ **Replies:** 0\ **Last updated:** [June 10, 2020, 1:32pm UTC](https://discuss.elastic.co/t/how-to-make-a-document-update-without-logstash/236518 "2020-06-10T13:32:00Z")
Hello, in order to put document in elasticsearch, I actually use Filebeat and Logstash : Filebeat read logs and put then to logstash which reformats and puts data to Elasticsearch. Actually I use the logstash options "… --- ## [Filtering out "managed service accounts"](https://discuss.elastic.co/t/filtering-out-managed-service-accounts/234586)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 2\ **Last updated:** [June 10, 2020, 1:26pm UTC](https://discuss.elastic.co/t/filtering-out-managed-service-accounts/234586 "2020-06-10T13:26:26Z")
Hi, Running ELK 6.8.9 on premises I am trying to add a filter for a visualization that removes events containing "managed service accounts" (accounts ending in $ ) like "GKDG0C3$". Solution provided in the following … --- ## [Winlogbeat event file system logstash](https://discuss.elastic.co/t/winlogbeat-event-file-system-logstash/236512)
**Author:** [@Renato\_Santos](https://discuss.elastic.co/u/Renato_Santos)\ **Replies:** 0\ **Last updated:** [June 10, 2020, 12:56pm UTC](https://discuss.elastic.co/t/winlogbeat-event-file-system-logstash/236512 "2020-06-10T12:56:03Z")
Hi guys, I have a question about winlogbeat along with logstash where I need to use the translate for hexadecimal codes. KQL example winlog.event\_data.AccessMask: "0x10080" and event.code: "4656" returns me that the ev… --- ## [Hyphen-minus with a new line](https://discuss.elastic.co/t/hyphen-minus-with-a-new-line/236477)
**Author:** [@Burga](https://discuss.elastic.co/u/Burga)\ **Replies:** 1\ **Last updated:** [June 10, 2020, 11:57am UTC](https://discuss.elastic.co/t/hyphen-minus-with-a-new-line/236477 "2020-06-10T11:57:02Z")
Hi , I'm trying to grok log with a multiple lines and Hyphen-minus and got stuck 2020-06-10 10:06:59,821 WARN \[ImageFilterEffect:thread-1\] \[confluence.image.effects.ImageFilterTask\] rotateWhenExifExist Could not retrie… --- ## [Elastic and Kibana on Different port](https://discuss.elastic.co/t/elastic-and-kibana-on-different-port/235347)
**Author:** [@mastermind](https://discuss.elastic.co/u/mastermind)\ **Replies:** 5\ **Last updated:** [June 10, 2020, 11:49am UTC](https://discuss.elastic.co/t/elastic-and-kibana-on-different-port/235347 "2020-06-10T11:49:20Z")
Hi I am trying to deploy 2 elastic and 2 Kibana on Kubernetes 1- 1st cluster Elastic and Kibana on the default ports (Elastic=9200 and Kibana=5601) configured without any problem. 2- 2nd cluster Elastic2 and Kibana2 on… --- ## [Recommended approach to detach a data node](https://discuss.elastic.co/t/recommended-approach-to-detach-a-data-node/236035)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 2\ **Last updated:** [June 10, 2020, 11:45am UTC](https://discuss.elastic.co/t/recommended-approach-to-detach-a-data-node/236035 "2020-06-10T11:45:41Z")
My ELK deployment is in a distributed format. An always on VM on a NAS that is ingesting data via elasticsearch. A Raspberry Pi running logstash with 5 pipelines. 9 log sources sending data to the 5 pipelines. A laptop… --- ## [Logstash pipeline systax errors after upgrading from 7.1.1. to 7.7.0](https://discuss.elastic.co/t/logstash-pipeline-systax-errors-after-upgrading-from-7-1-1-to-7-7-0/236479)
**Author:** [@bhavesh.vasoya](https://discuss.elastic.co/u/bhavesh.vasoya)\ **Replies:** 6\ **Last updated:** [June 10, 2020, 11:40am UTC](https://discuss.elastic.co/t/logstash-pipeline-systax-errors-after-upgrading-from-7-1-1-to-7-7-0/236479 "2020-06-10T11:40:28Z")
\------------------- Some information ------------------- we have running ELK stack 7.1.1. logstash parser written in multiple files under "/etc/logstash/conf.d" directory Now i have upgrade ELK stack 7.1.1 to 7.7.0 and… --- ## [How to delete old /var/log/elasticsearch](https://discuss.elastic.co/t/how-to-delete-old-var-log-elasticsearch/236501)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 0\ **Last updated:** [June 10, 2020, 11:18am UTC](https://discuss.elastic.co/t/how-to-delete-old-var-log-elasticsearch/236501 "2020-06-10T11:18:19Z")
Hi there, I am running Elasticsearch 7.6.2. I want to cleanup my logs in /var/log/elasticsearch. By default elasticsearch is rotating its logs. But they stay there forever. What is the easiest way to delete logs after… --- ## [Cluster goes yellow during force merge](https://discuss.elastic.co/t/cluster-goes-yellow-during-force-merge/236495)
**Author:** [@hprotzek](https://discuss.elastic.co/u/hprotzek)\ **Replies:** 0\ **Last updated:** [June 10, 2020, 10:56am UTC](https://discuss.elastic.co/t/cluster-goes-yellow-during-force-merge/236495 "2020-06-10T10:56:57Z")
We are using following ILM policy: "policy": { "phases": { "hot": { "min\_age": "0ms", "actions": { "rollover": { "max\_age": "1d", … --- ## [Multiline events based on identical fields](https://discuss.elastic.co/t/multiline-events-based-on-identical-fields/235564)
**Author:** [@WDK](https://discuss.elastic.co/u/WDK)\ **Replies:** 4\ **Last updated:** [June 10, 2020, 10:44am UTC](https://discuss.elastic.co/t/multiline-events-based-on-identical-fields/235564 "2020-06-10T10:44:55Z")
Hi all, I have a not so straight forward request of a user to process progress logfiles. The catch is that the want the log files multilined in a specific pattern. All lines that have the exact same timestamp, P-id and… --- ## [Logstash throws error INVALID\_FETCH\_SESSION\_EPOCH after upgrading from 6.5 to 6.8.8](https://discuss.elastic.co/t/logstash-throws-error-invalid-fetch-session-epoch-after-upgrading-from-6-5-to-6-8-8/236482)
**Author:** [@vijay\_kaali](https://discuss.elastic.co/u/vijay_kaali)\ **Replies:** 0\ **Last updated:** [June 10, 2020, 10:07am UTC](https://discuss.elastic.co/t/logstash-throws-error-invalid-fetch-session-epoch-after-upgrading-from-6-5-to-6-8-8/236482 "2020-06-10T10:07:49Z")
We get \[org.apache.kafka.clients.FetchSessionHandler\] \[Consumer clientId=logstash-0, groupId=logstash\] Node 0 was unable to process the fetch request with (sessionId=1844422694, epoch=11343): INVALID\_FETCH\_SESSION\_EPOCH … --- ## [Xml attribute parsing through Logstash + file beat](https://discuss.elastic.co/t/xml-attribute-parsing-through-logstash-file-beat/236435)
**Author:** [@Puneeth\_S\_B\_Gowda1](https://discuss.elastic.co/u/Puneeth_S_B_Gowda1)\ **Replies:** 1\ **Last updated:** [June 10, 2020, 9:34am UTC](https://discuss.elastic.co/t/xml-attribute-parsing-through-logstash-file-beat/236435 "2020-06-10T09:34:23Z")
This is my xml \M1S\ from above one i need M2S attribute value as new column in Kibana Can you share sample conf which will help for my above xml please My xml is from text file in… --- ## [Show Kibana UI login users](https://discuss.elastic.co/t/show-kibana-ui-login-users/236069)
**Author:** [@bdn](https://discuss.elastic.co/u/bdn)\ **Replies:** 3\ **Last updated:** [June 10, 2020, 9:22am UTC](https://discuss.elastic.co/t/show-kibana-ui-login-users/236069 "2020-06-10T09:22:34Z")
How can we find the currently Kibana login users? Is there any log file maintain by Kibana for this or some query can provide the user login details? [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1395) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1397)