# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1038 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1039 --- ## [Filebeat is not recognized on kibana](https://discuss.elastic.co/t/filebeat-is-not-recognized-on-kibana/296484)
**Author:** [@sulfred](https://discuss.elastic.co/u/sulfred)\ **Replies:** 0\ **Last updated:** [February 7, 2022, 2:47pm UTC](https://discuss.elastic.co/t/filebeat-is-not-recognized-on-kibana/296484 "2022-02-07T14:47:08Z")
I am running my elk stack through docker containers. The Elasticsearch and kibana are running normally. I have a filebeat receiving syslog and netflow on 2 different port. The problem is that the connection is refused wh… --- ## [Event risk score (Filebeat Checkpoint)](https://discuss.elastic.co/t/event-risk-score-filebeat-checkpoint/296576)
**Author:** [@elasticfran](https://discuss.elastic.co/u/elasticfran)\ **Replies:** 0\ **Last updated:** [February 8, 2022, 10:40am UTC](https://discuss.elastic.co/t/event-risk-score-filebeat-checkpoint/296576 "2022-02-08T10:40:51Z")
Hey there, I am wondering how the risk score works in the filebeat checkpoint index. I see a risk score spanning from 0 to 5, does anyone know how this index was designed ? I guess 5 is critical and 0 is kind of "beni… --- ## [Unassigned Shards after Master node restart](https://discuss.elastic.co/t/unassigned-shards-after-master-node-restart/297929)
**Author:** [@krishnav1](https://discuss.elastic.co/u/krishnav1)\ **Replies:** 3\ **Last updated:** [February 24, 2022, 11:37am UTC](https://discuss.elastic.co/t/unassigned-shards-after-master-node-restart/297929 "2022-02-24T11:37:35Z")
Hello, I am new to elastic cluster, sorry for the long post and I am looking for help to revive some unassigned shards which are a result of me abruptly shutting the master node. This has an impact on Kibana as it has pr… --- ## [Index disk size issue](https://discuss.elastic.co/t/index-disk-size-issue/297805)
**Author:** [@Nisarg\_Pandya](https://discuss.elastic.co/u/Nisarg_Pandya)\ **Replies:** 3\ **Last updated:** [February 24, 2022, 11:10am UTC](https://discuss.elastic.co/t/index-disk-size-issue/297805 "2022-02-24T11:10:55Z")
Hi, We are using the Elasticsearch version 7.9.3 We have two Elasticsearch cluster with the same configuration. Which is storing some data. We are periodically updating the data in both clusters. e.g. adding newdata, r… --- ## [Logstash 7.17 on Windows - Pipeline running but logs are not present in Elasticsearch](https://discuss.elastic.co/t/logstash-7-17-on-windows-pipeline-running-but-logs-are-not-present-in-elasticsearch/297519)
**Author:** [@bianca6](https://discuss.elastic.co/u/bianca6)\ **Replies:** 5\ **Last updated:** [February 24, 2022, 10:56am UTC](https://discuss.elastic.co/t/logstash-7-17-on-windows-pipeline-running-but-logs-are-not-present-in-elasticsearch/297519 "2022-02-24T10:56:03Z")
Hi, I'm on Windows 10. I'm building a pipeline with Filebeat / Logstash / Elasticsearch / Kibana. Each one of them is at the latest version (downloaded thie previous week). I'm trying to ship a simple log file (ndjson… --- ## [Could not write file \[/usr/share/elasticsearch/config/users\] bind mounted using docker-compose](https://discuss.elastic.co/t/could-not-write-file-usr-share-elasticsearch-config-users-bind-mounted-using-docker-compose/298046)
**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Replies:** 2\ **Last updated:** [February 24, 2022, 10:35am UTC](https://discuss.elastic.co/t/could-not-write-file-usr-share-elasticsearch-config-users-bind-mounted-using-docker-compose/298046 "2022-02-24T10:35:51Z")
Continuing the discussion from "Device or resource busy" when adding to keystore in Docker Compose: I received a similar exception trying to execute a bin/elasticsearch-users useradd command: Exception in thread "main"… --- ## [KQL and Lucene range query issue](https://discuss.elastic.co/t/kql-and-lucene-range-query-issue/298140)
**Author:** [@Sivarama](https://discuss.elastic.co/u/Sivarama)\ **Replies:** 2\ **Last updated:** [February 24, 2022, 10:31am UTC](https://discuss.elastic.co/t/kql-and-lucene-range-query-issue/298140 "2022-02-24T10:31:27Z")
I have tried to search for a request delay greater than 6000 using KQL as well as lucene queries , but in result i'm getting the greater value along with the smaller one . How to filter out the values less than 6000 . Ki… --- ## [Pipeline number of arguments error](https://discuss.elastic.co/t/pipeline-number-of-arguments-error/297367)
**Author:** [@Michael\_Bailey](https://discuss.elastic.co/u/Michael_Bailey)\ **Replies:** 4\ **Last updated:** [February 24, 2022, 10:13am UTC](https://discuss.elastic.co/t/pipeline-number-of-arguments-error/297367 "2022-02-24T10:13:14Z")
Hi, For some reason I have started to get the following fatal error with logstash 8.0.0. \[LogStash::Runner\] runner - An unexpected error occurred! {:error=\>#\ **Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 0\ **Last updated:** [February 24, 2022, 10:11am UTC](https://discuss.elastic.co/t/install-elasticsearch-stack-tls-ssl-through-docker-swarm/298146 "2022-02-24T10:11:54Z") Would anyone like to join a session on teams to install the Elasticsearch and kibana stacks today? I would love if someone could help me with my first attempt. --- ## [Using the Java Client API to perform a query using JSON?](https://discuss.elastic.co/t/using-the-java-client-api-to-perform-a-query-using-json/297872)
**Author:** [@vmassol](https://discuss.elastic.co/u/vmassol)\ **Replies:** 9\ **Last updated:** [February 24, 2022, 10:11am UTC](https://discuss.elastic.co/t/using-the-java-client-api-to-perform-a-query-using-json/297872 "2022-02-24T10:11:36Z")
Hi guys, I'm slowly learning the new Java Client API and I got good results. I'm now implementing some code where the use of the API is passing the JSON for the search request. So far I cannot figure out how to pass th… --- ## [ILM question](https://discuss.elastic.co/t/ilm-question/298042)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 2\ **Last updated:** [February 24, 2022, 10:00am UTC](https://discuss.elastic.co/t/ilm-question/298042 "2022-02-24T10:00:33Z")
Hi! I'm new to this kind of solutions and, therefore, I need help trying to configure what I want. I intend to rollover an index after 30 days. From my understanding, the cold phase is counted after the rollover date. … --- ## [Where is the index saved on disk?](https://discuss.elastic.co/t/where-is-the-index-saved-on-disk/297968)
**Author:** [@jordane95](https://discuss.elastic.co/u/jordane95)\ **Replies:** 5\ **Last updated:** [February 24, 2022, 9:26am UTC](https://discuss.elastic.co/t/where-is-the-index-saved-on-disk/297968 "2022-02-24T09:26:08Z")
Hello, I recently used the python toolkit elasticsearch to build a IR system on my server. May I know the path where the index is saved on my disk? Thank you! --- ## [Trying to search for '$'](https://discuss.elastic.co/t/trying-to-search-for/298064)
**Author:** [@joneswac](https://discuss.elastic.co/u/joneswac)\ **Replies:** 1\ **Last updated:** [February 24, 2022, 9:25am UTC](https://discuss.elastic.co/t/trying-to-search-for/298064 "2022-02-24T09:25:12Z")
I'm attempting to search for a '$' in a string field. I've tried all of the types of queries listed in the documentation, as well as the analyzers too. I can get a regex match for things like this: { "query": { "q… --- ## [Sorting events with identical millis timestamps by order events were recorded](https://discuss.elastic.co/t/sorting-events-with-identical-millis-timestamps-by-order-events-were-recorded/297758)
**Author:** [@bublik-hpt](https://discuss.elastic.co/u/bublik-hpt)\ **Replies:** 1\ **Last updated:** [February 24, 2022, 9:19am UTC](https://discuss.elastic.co/t/sorting-events-with-identical-millis-timestamps-by-order-events-were-recorded/297758 "2022-02-24T09:19:00Z")
Hi i have logs where multiple lines have the same timestamp. In Kibana discover they are in opposite order (if i follow the timestamp) then in the logfile, but when I check surrounding documents they are in correct order… --- ## [Windows Security Logs Winlogbeat](https://discuss.elastic.co/t/windows-security-logs-winlogbeat/297387)
**Author:** [@Nicat\_A](https://discuss.elastic.co/u/Nicat_A)\ **Replies:** 2\ **Last updated:** [February 23, 2022, 1:36pm UTC](https://discuss.elastic.co/t/windows-security-logs-winlogbeat/297387 "2022-02-23T13:36:15Z")
I am using winlogbeat to send windows logs but i can\`t see security logst except 4624 what can i do? --- ## [Structure for query with multiple sub queries with the same structure but different parameters](https://discuss.elastic.co/t/structure-for-query-with-multiple-sub-queries-with-the-same-structure-but-different-parameters/297939)
**Author:** [@GavinBeattie](https://discuss.elastic.co/u/GavinBeattie)\ **Replies:** 3\ **Last updated:** [February 24, 2022, 8:50am UTC](https://discuss.elastic.co/t/structure-for-query-with-multiple-sub-queries-with-the-same-structure-but-different-parameters/297939 "2022-02-24T08:50:13Z")
I am trying to analyse speed exceedances along a route, and what I would like is a query that returns all results together (all speed exceedances), which is the result of individual section by section queries (because ea… --- ## [Logstash error : rejected excution exeption](https://discuss.elastic.co/t/logstash-error-rejected-excution-exeption/298117)
**Author:** [@priyanka\_mundhe](https://discuss.elastic.co/u/priyanka_mundhe)\ **Replies:** 1\ **Last updated:** [February 24, 2022, 8:24am UTC](https://discuss.elastic.co/t/logstash-error-rejected-excution-exeption/298117 "2022-02-24T08:24:39Z")
cluster is going into red state continously. Please help --- ## [Index and search node(s) (multinode cluster)](https://discuss.elastic.co/t/index-and-search-node-s-multinode-cluster/298032)
**Author:** [@dev\_test](https://discuss.elastic.co/u/dev_test)\ **Replies:** 4\ **Last updated:** [February 24, 2022, 8:22am UTC](https://discuss.elastic.co/t/index-and-search-node-s-multinode-cluster/298032 "2022-02-24T08:22:32Z")
Hi, I'm creating a cluster for Elasticsearch having 3 nodes (one acting as master) I was to ask that while indexing or searching (considering we have a single index) will i be providing the IP-Address of same node for … --- ## [Add fields with same format but different value problem with grok logstash](https://discuss.elastic.co/t/add-fields-with-same-format-but-different-value-problem-with-grok-logstash/298043)
**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\ **Replies:** 1\ **Last updated:** [February 23, 2022, 7:51pm UTC](https://discuss.elastic.co/t/add-fields-with-same-format-but-different-value-problem-with-grok-logstash/298043 "2022-02-23T19:51:31Z")
Hi, log file example: 2021-01-01 11:15:02 - it is a f.... 2021-01-01 11:15:04 - format is =\> 000000: 00 11 22 a5 12 12 23 2a 55 12 00 22 33 44 | ?1451202000 . . . 00114: 00 11 55 77 9a 11 0 2021-12-23 10:14:22 … --- ## [Connection Error (NodejsClient 8.0)](https://discuss.elastic.co/t/connection-error-nodejsclient-8-0/298028)
**Author:** [@dev\_test](https://discuss.elastic.co/u/dev_test)\ **Replies:** 4\ **Last updated:** [February 24, 2022, 7:35am UTC](https://discuss.elastic.co/t/connection-error-nodejsclient-8-0/298028 "2022-02-24T07:35:36Z")
Hi, I am trying to connect to my Elasticsearch 8.0 cluster through a Javascript client 8.0 and I am having this error ConnectionError: other side closed - Local: 172.31.0.1:60684, Remote: 172.31.0.4:9200 at Sniffin… --- ## [Logstash won't start pipeline after moving to 7.6.13 from 6.5.x](https://discuss.elastic.co/t/logstash-wont-start-pipeline-after-moving-to-7-6-13-from-6-5-x/298035)
**Author:** [@fribse](https://discuss.elastic.co/u/fribse)\ **Replies:** 2\ **Last updated:** [February 24, 2022, 6:45am UTC](https://discuss.elastic.co/t/logstash-wont-start-pipeline-after-moving-to-7-6-13-from-6-5-x/298035 "2022-02-24T06:45:09Z")
Hi All, I've gotten a problem with my old logstash pipeline. My config looks like this (everything is commented out during debugging): \[root@ALPHA00035 pipeline\]# cat logstash.conf input { beats { … --- ## [Kibana SAML SSO Issue with spaces - "unauthorized to GetAll spaces"](https://discuss.elastic.co/t/kibana-saml-sso-issue-with-spaces-unauthorized-to-getall-spaces/297199)
**Author:** [@techguy20](https://discuss.elastic.co/u/techguy20)\ **Replies:** 3\ **Last updated:** [February 24, 2022, 6:25am UTC](https://discuss.elastic.co/t/kibana-saml-sso-issue-with-spaces-unauthorized-to-getall-spaces/297199 "2022-02-24T06:25:51Z")
Kibana 7.17 - self managed instance We have SAML SSL working well Azure. We have 3 roles defined kibana. user, superuser, restricted\_spaces\_user, Within the Enterprise App, the values are all assigned to the different… --- ## [How to fill area between 2 point with Kibana](https://discuss.elastic.co/t/how-to-fill-area-between-2-point-with-kibana/297883)
**Author:** [@alparslan](https://discuss.elastic.co/u/alparslan)\ **Replies:** 3\ **Last updated:** [February 24, 2022, 6:25am UTC](https://discuss.elastic.co/t/how-to-fill-area-between-2-point-with-kibana/297883 "2022-02-24T06:25:19Z")
Hi, I need to visualize "busy | available" graph for my data. Sample data and sketchy graph here is below. What is best approach to catch something like this graph? I tried something with also TSVB. But i just wonder… --- ## [Filebeat 7.10 aws cloudtrail is not parsing the output as shown in documentation](https://discuss.elastic.co/t/filebeat-7-10-aws-cloudtrail-is-not-parsing-the-output-as-shown-in-documentation/298111)
**Author:** [@Anwar](https://discuss.elastic.co/u/Anwar)\ **Replies:** 1\ **Last updated:** [February 24, 2022, 5:21am UTC](https://discuss.elastic.co/t/filebeat-7-10-aws-cloudtrail-is-not-parsing-the-output-as-shown-in-documentation/298111 "2022-02-24T05:21:19Z")
Hi, I have configured aws clodutrail module using filebeat to push the logs to Elasticsearch. Logs are pushed to the elk. But am facing two issues. Messages are showing in string instead of json If i used processor an… --- ## [Kibana Portal not loading when configured to a 3 node ES cluster](https://discuss.elastic.co/t/kibana-portal-not-loading-when-configured-to-a-3-node-es-cluster/297969)
**Author:** [@Aditya93](https://discuss.elastic.co/u/Aditya93)\ **Replies:** 4\ **Last updated:** [February 24, 2022, 4:13am UTC](https://discuss.elastic.co/t/kibana-portal-not-loading-when-configured-to-a-3-node-es-cluster/297969 "2022-02-24T04:13:21Z")
I've configured a 3 node ES cluster and installed kibana and made it point to the cluster. Both ES an Kibana services are up, but the kibana portal is still not loading. I dont see any errors in ES logs, on error log in… --- ## [Whole data from db not updated in elastic index](https://discuss.elastic.co/t/whole-data-from-db-not-updated-in-elastic-index/298030)
**Author:** [@Akhil\_Chandran](https://discuss.elastic.co/u/Akhil_Chandran)\ **Replies:** 3\ **Last updated:** [February 24, 2022, 3:53am UTC](https://discuss.elastic.co/t/whole-data-from-db-not-updated-in-elastic-index/298030 "2022-02-24T03:53:17Z")
input { jdbc { tags =\> "staff" jdbc\_connection\_string =\> "jdbc:postgresql://${DB\_HOST}:${DB\_PORT}/${DB\_NAME}" jdbc\_user =\> "${DB\_USER}" jdbc\_password =\> "${DB\_PASSWORD}" schedule =\> "\* \* \* \* \*" … --- ## [I want to rebuild the old runtime environment](https://discuss.elastic.co/t/i-want-to-rebuild-the-old-runtime-environment/297829)
**Author:** [@TANIGUCHIK](https://discuss.elastic.co/u/TANIGUCHIK)\ **Replies:** 5\ **Last updated:** [February 24, 2022, 1:49am UTC](https://discuss.elastic.co/t/i-want-to-rebuild-the-old-runtime-environment/297829 "2022-02-24T01:49:20Z")
I want to install an old plugin for 1.5.x to reproduce an old validation environment, but I could not install the plugin from the command line. Are there any pre-built plugin URLs left? Elasticsearch-cloud-aws 2.5.x E… --- ## [Elasticsearch 8.0 RPM Install error when adding new node](https://discuss.elastic.co/t/elasticsearch-8-0-rpm-install-error-when-adding-new-node/297967)
**Author:** [@soarendev](https://discuss.elastic.co/u/soarendev)\ **Replies:** 4\ **Last updated:** [February 24, 2022, 1:46am UTC](https://discuss.elastic.co/t/elasticsearch-8-0-rpm-install-error-when-adding-new-node/297967 "2022-02-24T01:46:02Z")
I'm installing Elasticsearch 8.0 on a new 3-node cluster on Amazon Linux 2. I have Elasticsearch running on the first node. I created a new enrollment key on this node. When I try to enroll the 2nd node I get the follow… --- ## [Metricbeat Custom Module Registration issue](https://discuss.elastic.co/t/metricbeat-custom-module-registration-issue/298101)
**Author:** [@tweet2santosh86](https://discuss.elastic.co/u/tweet2santosh86)\ **Replies:** 0\ **Last updated:** [February 24, 2022, 1:02am UTC](https://discuss.elastic.co/t/metricbeat-custom-module-registration-issue/298101 "2022-02-24T01:02:55Z")
Hello Team, We are trying to create custom metricbeat module by following the link Creating a Metricset | Beats Developer Guide \[master\] | Elastic.. but it seems the new module is not getting registered. We are not get… --- ## [Large amounts of bulk data sent from Logstash to Elasticsearch after using pipelines](https://discuss.elastic.co/t/large-amounts-of-bulk-data-sent-from-logstash-to-elasticsearch-after-using-pipelines/298092)
**Author:** [@userR](https://discuss.elastic.co/u/userR)\ **Replies:** 3\ **Last updated:** [February 24, 2022, 1:18am UTC](https://discuss.elastic.co/t/large-amounts-of-bulk-data-sent-from-logstash-to-elasticsearch-after-using-pipelines/298092 "2022-02-24T01:18:41Z")
I recently changed my configuration from one logstash.config file to pipelines to make it easier. My pipelines.yml (replaced actual names with letters, main re-routes data to correct pipeline based on tag): - pipeline.… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1037) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1039)