# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1006 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1007 --- ## [Kibana 7.5.2 to 7.17.0 Migration Failure - Migration of Saved Objects Failure](https://discuss.elastic.co/t/kibana-7-5-2-to-7-17-0-migration-failure-migration-of-saved-objects-failure/300126)
**Author:** [@anburethy](https://discuss.elastic.co/u/anburethy)\ **Replies:** 3\ **Last updated:** [March 21, 2022, 11:40pm UTC](https://discuss.elastic.co/t/kibana-7-5-2-to-7-17-0-migration-failure-migration-of-saved-objects-failure/300126 "2022-03-21T23:40:39Z")
Hi, I am migrating Kibana from 7.5.2 to 7.17.0 and getting the following error when doing so. Kibana isnt starting up due to this failure and hence migration fails. {"type":"log","@timestamp":"2022-03-20T12:32:03+00:00"… --- ## [Service Entry for TCP URL's](https://discuss.elastic.co/t/service-entry-for-tcp-urls/300253)
**Author:** [@Prabakar](https://discuss.elastic.co/u/Prabakar)\ **Replies:** 0\ **Last updated:** [March 21, 2022, 10:25pm UTC](https://discuss.elastic.co/t/service-entry-for-tcp-urls/300253 "2022-03-21T22:25:54Z")
We are using elastic enterprise edition. We are in the process of enabling the Cross Cluster Replication across different clusters. So we are adding service entries on gateway level (ISTION Gateway for example). Below on… --- ## [Ulimits for elasticsearch instances](https://discuss.elastic.co/t/ulimits-for-elasticsearch-instances/300189)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 7\ **Last updated:** [March 21, 2022, 10:16pm UTC](https://discuss.elastic.co/t/ulimits-for-elasticsearch-instances/300189 "2022-03-21T22:16:54Z")
Hi I'm facing with issue related to configuration with resource limits. On the host I've 18 nodes with Elasticsearch (build over docker-compose) I have taken the following into consideration setting from elastic doc (… --- ## [Setting for node.roles](https://discuss.elastic.co/t/setting-for-node-roles/298709)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 3\ **Last updated:** [March 21, 2022, 9:15pm UTC](https://discuss.elastic.co/t/setting-for-node-roles/298709 "2022-03-21T21:15:28Z")
Hi What the value should be set up for taking part for node as a coordinator ??? I saw an article about node.roles but it's not clear enough, (it should be empty field?) --- ## [Logstash processing gz file and sending logs to Elasticsearch](https://discuss.elastic.co/t/logstash-processing-gz-file-and-sending-logs-to-elasticsearch/300112)
**Author:** [@wallace84](https://discuss.elastic.co/u/wallace84)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 8:45pm UTC](https://discuss.elastic.co/t/logstash-processing-gz-file-and-sending-logs-to-elasticsearch/300112 "2022-03-21T20:45:23Z")
Hi, I am trying to do a test sending gz format logs from Logstash to Elasticsearch, do you know about a possible simple config file I could use to process the logs that use time stamps? The filter requires a bit of cus… --- ## [Filebeat keystore automation](https://discuss.elastic.co/t/filebeat-keystore-automation/300243)
**Author:** [@craign30](https://discuss.elastic.co/u/craign30)\ **Replies:** 0\ **Last updated:** [March 21, 2022, 7:10pm UTC](https://discuss.elastic.co/t/filebeat-keystore-automation/300243 "2022-03-21T19:10:03Z")
Is it possible to automate the password entry when creating a filebeat keystore via PowerShell? I'm running the command '.\\filebeat keystore add ES\_PWD', and when prompted to 'Enter value for ES\_PWD', I'd like this to a… --- ## [Unable to convert a field from string to integer that is dynamically generated in Logstash filter](https://discuss.elastic.co/t/unable-to-convert-a-field-from-string-to-integer-that-is-dynamically-generated-in-logstash-filter/300224)
**Author:** [@Usman18](https://discuss.elastic.co/u/Usman18)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 6:45pm UTC](https://discuss.elastic.co/t/unable-to-convert-a-field-from-string-to-integer-that-is-dynamically-generated-in-logstash-filter/300224 "2022-03-21T18:45:03Z")
I am adding a field in my event data point in Logstash filter. The name of the field is created dynamically based on the value of the other field. The code can be seen below which I am using to add this field mutate { … --- ## [Getting less search speed](https://discuss.elastic.co/t/getting-less-search-speed/300201)
**Author:** [@Neeraj\_Jain7483](https://discuss.elastic.co/u/Neeraj_Jain7483)\ **Replies:** 3\ **Last updated:** [March 21, 2022, 6:40pm UTC](https://discuss.elastic.co/t/getting-less-search-speed/300201 "2022-03-21T18:40:32Z")
We have a cluster consisting of 3 masters (4 core, 16 GB RAM each), 3 hot(8 core, 32 GB RAM, 300 GB SSD each), and 3 warm nodes(8 core, 32GB RAM, 1.5TB HDD each). We have one index for each month of year following the n… --- ## [Configuration: how to mix environment variable with static config in a list](https://discuss.elastic.co/t/configuration-how-to-mix-environment-variable-with-static-config-in-a-list/300240)
**Author:** [@grained](https://discuss.elastic.co/u/grained)\ **Replies:** 0\ **Last updated:** [March 21, 2022, 6:13pm UTC](https://discuss.elastic.co/t/configuration-how-to-mix-environment-variable-with-static-config-in-a-list/300240 "2022-03-21T18:13:57Z")
I'm trying to exclude\_files using a mix of environment variables and static configuration but the environment variable seems to be expanded to a list of it's own making it impossible to add to an existing list. Example: … --- ## [Setting up Index Life Management](https://discuss.elastic.co/t/setting-up-index-life-management/300077)
**Author:** [@userR](https://discuss.elastic.co/u/userR)\ **Replies:** 5\ **Last updated:** [March 21, 2022, 6:11pm UTC](https://discuss.elastic.co/t/setting-up-index-life-management/300077 "2022-03-21T18:11:00Z")
I use Logstash grok patterns to parse my logs. These logs are outputted to Elasticsearch in daily indexes. I want to create an index template to then apply to an ILM policy that will delete these logs after 60 days. Whe… --- ## [Dockershim is being deprecated in k8s 1.24](https://discuss.elastic.co/t/dockershim-is-being-deprecated-in-k8s-1-24/299808)
**Author:** [@pooch](https://discuss.elastic.co/u/pooch)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 5:35pm UTC](https://discuss.elastic.co/t/dockershim-is-being-deprecated-in-k8s-1-24/299808 "2022-03-21T17:35:44Z")
Starting with Kubernetes ver 1.24 the project is removing the dockershim that processes docker commands as the container runtime engine. I am running Filebeat and Metricbeat 7.16.2 in our clusters currently and they hav… --- ## [Packetbeat8.0 af\_packet report errors](https://discuss.elastic.co/t/packetbeat8-0-af-packet-report-errors/298180)
**Author:** [@chinaxushi](https://discuss.elastic.co/u/chinaxushi)\ **Replies:** 7\ **Last updated:** [March 21, 2022, 5:27pm UTC](https://discuss.elastic.co/t/packetbeat8-0-af-packet-report-errors/298180 "2022-03-21T17:27:29Z")
Packetbeat Version: 8.0 Operating System: Rocky Linux 8.5 After the "af\_packet" mode is enabled in the configuration file, Packetbeat will report an error and prompt "exiting: sniffer loop failed: sniffing error: packe… --- ## [Logstash oracle db jdbc plugin eeror](https://discuss.elastic.co/t/logstash-oracle-db-jdbc-plugin-eeror/300225)
**Author:** [@Hamza\_Shakeel](https://discuss.elastic.co/u/Hamza_Shakeel)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 5:16pm UTC](https://discuss.elastic.co/t/logstash-oracle-db-jdbc-plugin-eeror/300225 "2022-03-21T17:16:44Z")
I am getting the following error : Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of \[ \\t\\r\\n\], "#", \[A-Za-z0-9\_… --- ## [How to specifiy proxy with websoket input plugin](https://discuss.elastic.co/t/how-to-specifiy-proxy-with-websoket-input-plugin/300174)
**Author:** [@zid57](https://discuss.elastic.co/u/zid57)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 5:12pm UTC](https://discuss.elastic.co/t/how-to-specifiy-proxy-with-websoket-input-plugin/300174 "2022-03-21T17:12:30Z")
Hello all, I would need to use the logstash websocket as input plugin. I installed it and it works. However, I'm not able to retrieve data from the websocket URL. The case is simple. In order to reach internet, my l… --- ## [Inputs error journald](https://discuss.elastic.co/t/inputs-error-journald/299804)
**Author:** [@Gyrops](https://discuss.elastic.co/u/Gyrops)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 3:49pm UTC](https://discuss.elastic.co/t/inputs-error-journald/299804 "2022-03-21T15:49:56Z")
log Exiting: Failed to start crawler: starting input failed: Error while initializing input: Error creating input. No such input type exist: 'journald' filebeat version 8.1.0 --- ## [Dedicated Documentation for Java API Client](https://discuss.elastic.co/t/dedicated-documentation-for-java-api-client/300202)
**Author:** [@ssephillip](https://discuss.elastic.co/u/ssephillip)\ **Replies:** 2\ **Last updated:** [March 21, 2022, 3:48pm UTC](https://discuss.elastic.co/t/dedicated-documentation-for-java-api-client/300202 "2022-03-21T15:48:28Z")
Hello everyone, for the Java High Level REST Client there is a dedicated documentation providing detailed information and examples on how to use the Client. This was extremely helpful during development. My questions a… --- ## [Filebeat Apache Module - Apache Module (mod\_dumpio) Support](https://discuss.elastic.co/t/filebeat-apache-module-apache-module-mod-dumpio-support/299999)
**Author:** [@inf](https://discuss.elastic.co/u/inf)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 3:38pm UTC](https://discuss.elastic.co/t/filebeat-apache-module-apache-module-mod-dumpio-support/299999 "2022-03-21T15:38:41Z")
Hi there, I have the following use-case: Capture and parse HTTP(S) POST request information from Apache web servers. An Apache module (mod\_dumpio) is able to do the job. However, the mod\_dumpio module gives tons of inf… --- ## [Filebeat does not harvest all logs from application](https://discuss.elastic.co/t/filebeat-does-not-harvest-all-logs-from-application/300219)
**Author:** [@dorinand](https://discuss.elastic.co/u/dorinand)\ **Replies:** 0\ **Last updated:** [March 21, 2022, 3:28pm UTC](https://discuss.elastic.co/t/filebeat-does-not-harvest-all-logs-from-application/300219 "2022-03-21T15:28:33Z")
I encounter an issue, when filebeat does not harvest all logs (only small amount of them) from my app. I have filebeat that harvest logs from docker applicaitons and send them to the Logstash. Applicaiton is running in … --- ## [How to process json logs from docker container](https://discuss.elastic.co/t/how-to-process-json-logs-from-docker-container/300207)
**Author:** [@paulov](https://discuss.elastic.co/u/paulov)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 3:20pm UTC](https://discuss.elastic.co/t/how-to-process-json-logs-from-docker-container/300207 "2022-03-21T15:20:05Z")
Hi, I receive logs from docker containers, these have a field 'log' that is in itself a json message and that contains a subfield 'message' which I'm interested in. Example: "log"=\>"{"fields":{},"level":"info","@times… --- ## [Cannot connect to X.X.X.X:10514: Connection refused](https://discuss.elastic.co/t/cannot-connect-to-x-x-x-x-connection-refused/300055)
**Author:** [@Oreius](https://discuss.elastic.co/u/Oreius)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 3:16pm UTC](https://discuss.elastic.co/t/cannot-connect-to-x-x-x-x-connection-refused/300055 "2022-03-21T15:16:41Z")
Configuring a ELK stack version 8.1, based on two virtual machine which both run Oracle linux 8. I need to send logs from a VM to the other using rsyslog. On the recieving machine logs will be acquired using FileBeat. Th… --- ## [Mysql slowquery pipeline fails if schema contains a dash](https://discuss.elastic.co/t/mysql-slowquery-pipeline-fails-if-schema-contains-a-dash/300173)
**Author:** [@Rasmus\_Breinholm\_Rom](https://discuss.elastic.co/u/Rasmus_Breinholm_Rom)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 3:13pm UTC](https://discuss.elastic.co/t/mysql-slowquery-pipeline-fails-if-schema-contains-a-dash/300173 "2022-03-21T15:13:38Z")
The Grok patttern defined in the mysql slowlog ingest pipeline uses the WORD grok pattern to extract schema. This causes the pipeline to fail if schema contains a dash. Using the same pattern as USERNAME seems to fix t… --- ## [Some word should not be transmitted](https://discuss.elastic.co/t/some-word-should-not-be-transmitted/300185)
**Author:** [@peyofe](https://discuss.elastic.co/u/peyofe)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 3:12pm UTC](https://discuss.elastic.co/t/some-word-should-not-be-transmitted/300185 "2022-03-21T15:12:19Z")
Hi. I have a question. I have a log with followings fileds: User;Target;IP-Adress;PrivateCode Name1;Server1;127.0.0.1;CD4523 Name2;Server21;127.0.0.2;CD4542 Name3;Server421;127.0.0.3;CD4556 Filebeat reading the log… --- ## [Elastic Agent Installation Verification Mode Fleet Cert](https://discuss.elastic.co/t/elastic-agent-installation-verification-mode-fleet-cert/300198)
**Author:** [@beijo](https://discuss.elastic.co/u/beijo)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 3:09pm UTC](https://discuss.elastic.co/t/elastic-agent-installation-verification-mode-fleet-cert/300198 "2022-03-21T15:09:05Z")
Hi all, is it possible to define the verification\_mode used to validate the fleet server certificate when installing an elastic agent? I'm thinking about filebeat where you can set verification\_mode to certificate to on… --- ## [LDAP load while auditbeat collects event.category iam](https://discuss.elastic.co/t/ldap-load-while-auditbeat-collects-event-category-iam/300200)
**Author:** [@alchy](https://discuss.elastic.co/u/alchy)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 3:04pm UTC](https://discuss.elastic.co/t/ldap-load-while-auditbeat-collects-event-category-iam/300200 "2022-03-21T15:04:49Z")
We have been dealing with the fact that twice a day we have a heavily loaded LDAP server that manages user accounts in the Unix world. The situation occurs regularly every day around 8:30 in the morning and 8:30 in the … --- ## [Understanding a match query on a search-as-you-type index](https://discuss.elastic.co/t/understanding-a-match-query-on-a-search-as-you-type-index/300215)
**Author:** [@dlants](https://discuss.elastic.co/u/dlants)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 3:04pm UTC](https://discuss.elastic.co/t/understanding-a-match-query-on-a-search-as-you-type-index/300215 "2022-03-21T15:04:45Z")
I'm curious if there is any way to understand the lucene query that's generated for a particular Elasticsearch DSL query. For example, if I create an index: await client.indices.create({ index: 'activities', … --- ## [Filebeat: Error with the google\_workspace module](https://discuss.elastic.co/t/filebeat-error-with-the-google-workspace-module/298871)
**Author:** [@PJ\_ceSofnI\_tseT](https://discuss.elastic.co/u/PJ_ceSofnI_tseT)\ **Replies:** 6\ **Last updated:** [March 21, 2022, 2:54pm UTC](https://discuss.elastic.co/t/filebeat-error-with-the-google-workspace-module/298871 "2022-03-21T14:54:42Z")
Hi all, I find myself integrating the google\_workspace module via filebeat (filebeat-7.17.0-linux-x86\_64) on an Ubuntu 20.04 LTS. I have followed all the steps in the "Configure the module" reference (Google Workspace m… --- ## [ELK stack sizing](https://discuss.elastic.co/t/elk-stack-sizing/300214)
**Author:** [@PRASOON\_VINODAN](https://discuss.elastic.co/u/PRASOON_VINODAN)\ **Replies:** 0\ **Last updated:** [March 21, 2022, 2:43pm UTC](https://discuss.elastic.co/t/elk-stack-sizing/300214 "2022-03-21T14:43:17Z")
We are planning to use ELK stack with beats for few of our applications & OS real time monitoring. Currently I am doing some POC. I couldn't find any documentation regarding sizing when considering to build a ELK cluster… --- ## [Failed to verify all nodes have repository access](https://discuss.elastic.co/t/failed-to-verify-all-nodes-have-repository-access/299467)
**Author:** [@Caio\_Cesar](https://discuss.elastic.co/u/Caio_Cesar)\ **Replies:** 4\ **Last updated:** [March 21, 2022, 2:03pm UTC](https://discuss.elastic.co/t/failed-to-verify-all-nodes-have-repository-access/299467 "2022-03-21T14:03:48Z")
hello, I have a problem regarding backup using curator, I use version 6.3.2 of Elasticsearch and curator in version 5.7.6 , backups are stored in a google gsc bucket with all permissions but this error always appears Fa… --- ## [Uri\_parts Ingest Processor - domain field](https://discuss.elastic.co/t/uri-parts-ingest-processor-domain-field/300139)
**Author:** [@sera123k](https://discuss.elastic.co/u/sera123k)\ **Replies:** 2\ **Last updated:** [March 21, 2022, 1:51pm UTC](https://discuss.elastic.co/t/uri-parts-ingest-processor-domain-field/300139 "2022-03-21T13:51:48Z")
I'm working with the Zscaler integration and noticed that when passing the logs through the pipeline the uri\_parts ingest processor does not create url.domain out of the URL that Zscaler sends based off the test logs fro… --- ## [How create a visualization with the last date of document](https://discuss.elastic.co/t/how-create-a-visualization-with-the-last-date-of-document/299938)
**Author:** [@David\_Oceans](https://discuss.elastic.co/u/David_Oceans)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 1:01pm UTC](https://discuss.elastic.co/t/how-create-a-visualization-with-the-last-date-of-document/299938 "2022-03-21T13:01:01Z")
Hi, I would like create a dashboard / visualization with the timestamp of even better with the days from the first document in my indexes, like that Option A) First document found 13-03-2022 10:00 Option B) Retenti… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1005) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1007)