# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1013 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1014 --- ## [Cisco-module (Filebeat) to Logstash - Configuration issue- Need help!](https://discuss.elastic.co/t/cisco-module-filebeat-to-logstash-configuration-issue-need-help/299765)
**Author:** [@arunhk3](https://discuss.elastic.co/u/arunhk3)\ **Replies:** 2\ **Last updated:** [March 15, 2022, 8:08pm UTC](https://discuss.elastic.co/t/cisco-module-filebeat-to-logstash-configuration-issue-need-help/299765 "2022-03-15T20:08:13Z")
Hi All, I was able to send logs to Elasticsearch using Filebeat using the below configuration successfully. # ============================== Filebeat inputs =============================== filebeat.inputs: - type: log… --- ## [Searching on keywords that have spaces fail using simple\_query\_string](https://discuss.elastic.co/t/searching-on-keywords-that-have-spaces-fail-using-simple-query-string/298577)
**Author:** [@JJK](https://discuss.elastic.co/u/JJK)\ **Replies:** 7\ **Last updated:** [March 15, 2022, 7:30pm UTC](https://discuss.elastic.co/t/searching-on-keywords-that-have-spaces-fail-using-simple-query-string/298577 "2022-03-15T19:30:08Z")
I have a tags keyword field defined simply as: 'tags' =\> \[ 'type' =\> 'keyword' \], I have a tag field that stores: "tags" : \[ "523", "523 az" \], I have a simple search set… --- ## [Logstash stopped processing because of an error: (SystemExit) exit](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error-systemexit-exit/299747)
**Author:** [@Diego\_T](https://discuss.elastic.co/u/Diego_T)\ **Replies:** 4\ **Last updated:** [March 15, 2022, 7:22pm UTC](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error-systemexit-exit/299747 "2022-03-15T19:22:58Z")
when i run logstash on windows i get the following error C:\\logstash-8.1.0\>.\\bin\\logstash.bat -f .\\config\\syslog.conf Using LS\_JAVA\_HOME defined java: C:\\Program Files\\Java\\jdk-17.0.2 WARNING: Using LS\_JAVA\_HOME while L… --- ## [Mounted Searchable Snapshot Delay Reallocation/Recovery](https://discuss.elastic.co/t/mounted-searchable-snapshot-delay-reallocation-recovery/299757)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 13\ **Last updated:** [March 15, 2022, 7:07pm UTC](https://discuss.elastic.co/t/mounted-searchable-snapshot-delay-reallocation-recovery/299757 "2022-03-15T19:07:30Z")
Hi All, I'm using searchable snapshots on a cluster and was wondering if there is a way to delay whether a searchable snapshot gets reallocated for a period of time. Example problem, if I have a cold node which gets hi… --- ## [Unable to build logstash-input-tcp - compatible versions for gem "logstash-core"](https://discuss.elastic.co/t/unable-to-build-logstash-input-tcp-compatible-versions-for-gem-logstash-core/299671)
**Author:** [@vinodhreddyg](https://discuss.elastic.co/u/vinodhreddyg)\ **Replies:** 1\ **Last updated:** [March 15, 2022, 6:23pm UTC](https://discuss.elastic.co/t/unable-to-build-logstash-input-tcp-compatible-versions-for-gem-logstash-core/299671 "2022-03-15T18:23:11Z")
Hi Team, I'm trying to build logstash-input-tcp plugin. It is failing with the following error. Exception is showing as compatible versions for gem "logstash-core". ENV details: Centos Stream JAVA: javac 11.0.14 Jru… --- ## [Logstash Sleep Filter Plugin Not Working](https://discuss.elastic.co/t/logstash-sleep-filter-plugin-not-working/299753)
**Author:** [@mpride63](https://discuss.elastic.co/u/mpride63)\ **Replies:** 1\ **Last updated:** [March 15, 2022, 5:36pm UTC](https://discuss.elastic.co/t/logstash-sleep-filter-plugin-not-working/299753 "2022-03-15T17:36:29Z")
I am new to logstash and I’m trying to setup a logstash instance to see if we can use it as a syslog\\trap front end to some of our network nodes. I have it working at a very basic level but can’t seem to get the sleep f… --- ## [What "Cumulative Time" exactly means?](https://discuss.elastic.co/t/what-cumulative-time-exactly-means/299679)
**Author:** [@Seo](https://discuss.elastic.co/u/Seo)\ **Replies:** 2\ **Last updated:** [March 15, 2022, 4:59pm UTC](https://discuss.elastic.co/t/what-cumulative-time-exactly-means/299679 "2022-03-15T16:59:40Z")
Hello, It's my first time using Elasticsearch, and I measured the ES performance with rally. I have some quick questions about interpreting the results. My purpose is to compare the performance of ES in different envir… --- ## [Use elasticsearch requests in kibana (with double/tripple aggregation)](https://discuss.elastic.co/t/use-elasticsearch-requests-in-kibana-with-double-tripple-aggregation/299648)
**Author:** [@sebneu](https://discuss.elastic.co/u/sebneu)\ **Replies:** 2\ **Last updated:** [March 15, 2022, 4:10pm UTC](https://discuss.elastic.co/t/use-elasticsearch-requests-in-kibana-with-double-tripple-aggregation/299648 "2022-03-15T16:10:09Z")
Hi given: documents with a timestamp try: I have a working requests which first rounds the timestamps to 10 minutes (date\_histogram) and than sums up six 10 minute windows. (Rolling hour). here is the request: POST… --- ## [How to collect containerized elasticsearch logs with filebeat](https://discuss.elastic.co/t/how-to-collect-containerized-elasticsearch-logs-with-filebeat/299118)
**Author:** [@marone](https://discuss.elastic.co/u/marone)\ **Replies:** 7\ **Last updated:** [March 15, 2022, 3:10pm UTC](https://discuss.elastic.co/t/how-to-collect-containerized-elasticsearch-logs-with-filebeat/299118 "2022-03-15T15:10:19Z")
Hey I am setting up an observaiblity use case to test it with docker, and I want to collect Elasticsearch logs (gc, audit, etc.) using Filebeat. I have Elasticsearch running in a docker container, and I have filebeat ru… --- ## [Agent data gathering behaviour](https://discuss.elastic.co/t/agent-data-gathering-behaviour/299754)
**Author:** [@Sergey\_K](https://discuss.elastic.co/u/Sergey_K)\ **Replies:** 0\ **Last updated:** [March 15, 2022, 3:09pm UTC](https://discuss.elastic.co/t/agent-data-gathering-behaviour/299754 "2022-03-15T15:09:36Z")
Good Afternoon, Unfortunately couldn't find this information in other sources. Could you please update me on how do the agents (in common) treat collected data while ELK stack is unavailable? Do they drop the data or … --- ## [8.1.0 Java Client - SearchRequest example](https://discuss.elastic.co/t/8-1-0-java-client-searchrequest-example/299640)
**Author:** [@Valh](https://discuss.elastic.co/u/Valh)\ **Replies:** 2\ **Last updated:** [March 14, 2022, 6:08pm UTC](https://discuss.elastic.co/t/8-1-0-java-client-searchrequest-example/299640 "2022-03-14T18:08:40Z")
Hi, I'm struggling to understand how to do convert my code from the HLRC to the new Elasticsearch Java API Client. Could someone please give me an example? The documentation is very unclear on this subject. Fonctional … --- ## [Anomaly Score \< 1, despite a big difference between actual and typical detections](https://discuss.elastic.co/t/anomaly-score-1-despite-a-big-difference-between-actual-and-typical-detections/299743)
**Author:** [@Shahzaib\_Abid](https://discuss.elastic.co/u/Shahzaib_Abid)\ **Replies:** 1\ **Last updated:** [March 15, 2022, 2:54pm UTC](https://discuss.elastic.co/t/anomaly-score-1-despite-a-big-difference-between-actual-and-typical-detections/299743 "2022-03-15T14:54:13Z")
We have created an anomaly detection job using elastic machine learning. For this particular case, we have no detections at times where we normally have detections. The anomaly score is less than 1 here, despite havin… --- ## [Elasticsearch won't start after upgrade to 8.1.0](https://discuss.elastic.co/t/elasticsearch-wont-start-after-upgrade-to-8-1-0/299721)
**Author:** [@mralians](https://discuss.elastic.co/u/mralians)\ **Replies:** 5\ **Last updated:** [March 15, 2022, 2:52pm UTC](https://discuss.elastic.co/t/elasticsearch-wont-start-after-upgrade-to-8-1-0/299721 "2022-03-15T14:52:43Z")
I upgraded Elasticsearch from 7.17 to 8.1.0 but since then I can start Elasticsearch. When I run systemctl status Elasticsearch.service I get this error. How can I fix this? org.elasticsearch.bootstrap.StartupException:… --- ## [Different between view and edit mode on several vizualization](https://discuss.elastic.co/t/different-between-view-and-edit-mode-on-several-vizualization/299633)
**Author:** [@sylvain\_fr](https://discuss.elastic.co/u/sylvain_fr)\ **Replies:** 2\ **Last updated:** [March 15, 2022, 1:41pm UTC](https://discuss.elastic.co/t/different-between-view-and-edit-mode-on-several-vizualization/299633 "2022-03-15T13:41:07Z")
Hello, I build a dashboard about an internal website. An interesting vizualization is the purcentage of user-agent. So I created a bucket with user\_agent.name and count aggregation metrics. It's OK when i'm on edit mode… --- ## [Redis : Failed to fetch redis info for keyspaces: read tcp xxx-\>xxx i/o timeout](https://discuss.elastic.co/t/redis-failed-to-fetch-redis-info-for-keyspaces-read-tcp-xxx-xxx-i-o-timeout/299161)
**Author:** [@masyutka](https://discuss.elastic.co/u/masyutka)\ **Replies:** 1\ **Last updated:** [March 15, 2022, 1:28pm UTC](https://discuss.elastic.co/t/redis-failed-to-fetch-redis-info-for-keyspaces-read-tcp-xxx-xxx-i-o-timeout/299161 "2022-03-15T13:28:02Z")
Hi , I am trying to use metricbeat (version 7.12.1) module for Redis. Redis cluster is managed AWS ElastiCache. Here is config: module: redis metricsets: \["info", "keyspace"\] enabled: true period: 2m Redis host… --- ## [Alias applogs-team1 has more than one write index \[ applogs-team1-000001 , applogs-team1-000002\]](https://discuss.elastic.co/t/alias-applogs-team1-has-more-than-one-write-index-applogs-team1-000001-applogs-team1-000002/299737)
**Author:** [@sam7](https://discuss.elastic.co/u/sam7)\ **Replies:** 0\ **Last updated:** [March 15, 2022, 1:22pm UTC](https://discuss.elastic.co/t/alias-applogs-team1-has-more-than-one-write-index-applogs-team1-000001-applogs-team1-000002/299737 "2022-03-15T13:22:19Z")
I have created Index pattern,ILM Policies(HOT and Warm tier), templates and aliases using the following settings. PUT \_index\_template/applogs\_template { "index\_patterns": \["applogs-team1-\*"\], "template": { "settings": {… --- ## [ElasticsearchErrorhandler 400 - Validation Failed due to max shards open](https://discuss.elastic.co/t/elasticsearcherrorhandler-400-validation-failed-due-to-max-shards-open/299734)
**Author:** [@barceloniak1](https://discuss.elastic.co/u/barceloniak1)\ **Replies:** 1\ **Last updated:** [March 15, 2022, 1:07pm UTC](https://discuss.elastic.co/t/elasticsearcherrorhandler-400-validation-failed-due-to-max-shards-open/299734 "2022-03-15T13:07:24Z")
Hi Guys, Kibana 7.7.0 I would be, so grateful for advising in shaping proper configuration for Elastic. Logs are shipped through fluentd.conf. Out of sudden, stopped to fetch logs. Instance is clustered and hosted on AW… --- ## [ILM policies for multiple auto-generated indexes](https://discuss.elastic.co/t/ilm-policies-for-multiple-auto-generated-indexes/299732)
**Author:** [@sam7](https://discuss.elastic.co/u/sam7)\ **Replies:** 0\ **Last updated:** [March 15, 2022, 1:00pm UTC](https://discuss.elastic.co/t/ilm-policies-for-multiple-auto-generated-indexes/299732 "2022-03-15T13:00:07Z")
Hi Team, I have a logstash which is sending data streams to indexes created automatically in the process over Elasticsearch. We have configured Logstash output section with index configuration as index =\> "applogs-%{\[f… --- ## [How to delete all Docs count or remove the Storage Size and bring it to "Zero" for created index patterns in Kibana?](https://discuss.elastic.co/t/how-to-delete-all-docs-count-or-remove-the-storage-size-and-bring-it-to-zero-for-created-index-patterns-in-kibana/299598)
**Author:** [@hitnalli\_praveen](https://discuss.elastic.co/u/hitnalli_praveen)\ **Replies:** 4\ **Last updated:** [March 15, 2022, 12:31pm UTC](https://discuss.elastic.co/t/how-to-delete-all-docs-count-or-remove-the-storage-size-and-bring-it-to-zero-for-created-index-patterns-in-kibana/299598 "2022-03-15T12:31:04Z")
I've created an Index Pattern in Kibana - "cscsv212previousbuild-perfdata" and currently it has some content of Documents (seems to be total count of Docs 177193) and has the Storage Space - 661.9MB. I would like to del… --- ## [Making an Opaque Search Request](https://discuss.elastic.co/t/making-an-opaque-search-request/299726)
**Author:** [@Adeisbright](https://discuss.elastic.co/u/Adeisbright)\ **Replies:** 0\ **Last updated:** [March 15, 2022, 12:18pm UTC](https://discuss.elastic.co/t/making-an-opaque-search-request/299726 "2022-03-15T12:18:32Z")
Hello, I am working in an environment with many services. We are introducing Elasticsearch as an after-thought; it means we need to do this in a way that does not impact on already existing service. To achieve this, we… --- ## [How to exclude repeating values while creating an Area Vizualization and using Unique Count?](https://discuss.elastic.co/t/how-to-exclude-repeating-values-while-creating-an-area-vizualization-and-using-unique-count/299718)
**Author:** [@iraidalavrovaa](https://discuss.elastic.co/u/iraidalavrovaa)\ **Replies:** 3\ **Last updated:** [March 15, 2022, 11:54am UTC](https://discuss.elastic.co/t/how-to-exclude-repeating-values-while-creating-an-area-vizualization-and-using-unique-count/299718 "2022-03-15T11:54:33Z")
Hi all! I want to visualize a trend of appearing of new users over time. Username is a text field. I decided to use Area Visualization with Cumulative Sum and Unique count of username aggregations. I specified it in Me… --- ## [Elasticsearch 404](https://discuss.elastic.co/t/elasticsearch-404/299694)
**Author:** [@Murat\_KOC](https://discuss.elastic.co/u/Murat_KOC)\ **Replies:** 11\ **Last updated:** [March 15, 2022, 11:20am UTC](https://discuss.elastic.co/t/elasticsearch-404/299694 "2022-03-15T11:20:13Z")
I am presenting the data with Elasticsearch on a system I use. The page gives 404 while the bot is pulling the data. But when I enter the link from the browser, there is no problem. I index the data in the database via E… --- ## [Deleted documents force-merge](https://discuss.elastic.co/t/deleted-documents-force-merge/299717)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [March 15, 2022, 11:08am UTC](https://discuss.elastic.co/t/deleted-documents-force-merge/299717 "2022-03-15T11:08:34Z")
Hi all, I have an index showing 1000 deleted documents. It is said that deleted documents occupy some amount of memory and we have to force merge them to empty space. Which steps or command should we use to achieve this… --- ## [Reindex Problem](https://discuss.elastic.co/t/reindex-problem/299720)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 1\ **Last updated:** [March 15, 2022, 11:06am UTC](https://discuss.elastic.co/t/reindex-problem/299720 "2022-03-15T11:06:27Z")
Hello dear friends i have a problem. While reindexing, a question occurred and data transfer was interrupted. How do I replace the missing data in the target index? (I have no chance to reindex.) --- ## [Count Each word in a text Field](https://discuss.elastic.co/t/count-each-word-in-a-text-field/299605)
**Author:** [@vishesh08](https://discuss.elastic.co/u/vishesh08)\ **Replies:** 7\ **Last updated:** [March 15, 2022, 11:02am UTC](https://discuss.elastic.co/t/count-each-word-in-a-text-field/299605 "2022-03-15T11:02:07Z")
I have tweets stored in a text field with field Data True. I want to remove the english stopwords and get a count of each word in the tweets. Data Mapping: { "tweets" : { "mappings" : { "properties" : { … --- ## [Is there any way to check the relocation progress of shards?](https://discuss.elastic.co/t/is-there-any-way-to-check-the-relocation-progress-of-shards/299719)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 2\ **Last updated:** [March 15, 2022, 10:55am UTC](https://discuss.elastic.co/t/is-there-any-way-to-check-the-relocation-progress-of-shards/299719 "2022-03-15T10:55:57Z")
I plan to migrate the data in a cluster with three nodes to another cluster. After I add the exclusion parameter (cluster.routing.allocation.exclude.\_ip) to the cluster, check the status of shards through /\_cat/shards It… --- ## [Filebeat Fortinet module - can't parse event as syslog rfc3164](https://discuss.elastic.co/t/filebeat-fortinet-module-cant-parse-event-as-syslog-rfc3164/297712)
**Author:** [@gflukas](https://discuss.elastic.co/u/gflukas)\ **Replies:** 1\ **Last updated:** [March 15, 2022, 10:20am UTC](https://discuss.elastic.co/t/filebeat-fortinet-module-cant-parse-event-as-syslog-rfc3164/297712 "2022-03-15T10:20:10Z")
Hey guys my journalctl keeps filled with errors. Filebeat Fortinet module - can't parse event as syslog rfc3164. What I can do to fix it? I'm using Ubuntu 20.04. Filebeat version filebeat:amd64/stable 7.16.1 upgradeabl… --- ## [Mapping conflict with Elastic Agent](https://discuss.elastic.co/t/mapping-conflict-with-elastic-agent/298677)
**Author:** [@ARDiver86](https://discuss.elastic.co/u/ARDiver86)\ **Replies:** 7\ **Last updated:** [March 15, 2022, 9:52am UTC](https://discuss.elastic.co/t/mapping-conflict-with-elastic-agent/298677 "2022-03-15T09:52:09Z")
I am using the Fleet server with policies/integrations but I am running into some mapping conflicts that I am unsure how to resolve. For my "logs-\*" index pattern I see I have a conflict of keyword,object on the "source"… --- ## [Hability to create daily index to metricbeat](https://discuss.elastic.co/t/hability-to-create-daily-index-to-metricbeat/299302)
**Author:** [@gerardgorrion](https://discuss.elastic.co/u/gerardgorrion)\ **Replies:** 4\ **Last updated:** [March 15, 2022, 9:31am UTC](https://discuss.elastic.co/t/hability-to-create-daily-index-to-metricbeat/299302 "2022-03-15T09:31:01Z")
Hi all, We are deploying an stack monitoring to eck: Current monitoring are working fine, to Elasticsearch and kibana resources. But we have a problem with the index creation: metricbeat create a single index with for… --- ## [Facing issue while configuring TLS](https://discuss.elastic.co/t/facing-issue-while-configuring-tls/299691)
**Author:** [@shivendra95](https://discuss.elastic.co/u/shivendra95)\ **Replies:** 3\ **Last updated:** [March 15, 2022, 9:29am UTC](https://discuss.elastic.co/t/facing-issue-while-configuring-tls/299691 "2022-03-15T09:29:40Z")
Hi, I'm, configuring Elasticsearch with TLS but facing error when I restart the Elasticsearch server This is my Elasticsearch.yml configuration for security xpack.security.enabled: true xpack.security.transport.ssl.en… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1012) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1014)