# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1050 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1051 --- ## [Get lines in one line logstash filter](https://discuss.elastic.co/t/get-lines-in-one-line-logstash-filter/297263)
**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\ **Replies:** 3\ **Last updated:** [February 16, 2022, 6:32pm UTC](https://discuss.elastic.co/t/get-lines-in-one-line-logstash-filter/297263 "2022-02-16T18:32:32Z")
Hi, log file example: 0101-15:17:39:012|aze|exp|id|aa|bb|ee|rr|zz|tt|jj 0101-15:17:39:012|aze|exp|id....|ERR exception nom du para: sss à System... à Web.............|Ref|lev|15|Code\_Status = 50 0101-15:17:39:0… --- ## [Logstsh parce grok add teg \_grokparsefailure](https://discuss.elastic.co/t/logstsh-parce-grok-add-teg-grokparsefailure/297251)
**Author:** [@bsilsy](https://discuss.elastic.co/u/bsilsy)\ **Replies:** 3\ **Last updated:** [February 16, 2022, 6:30pm UTC](https://discuss.elastic.co/t/logstsh-parce-grok-add-teg-grokparsefailure/297251 "2022-02-16T18:30:27Z")
good day everyone! I'm trying to parse field "message" with grock but, i get \_grokparsefailure tag on 100% of documents send data using filebeat message log example "message": "10.10.10.10 - text \[15/Feb/2022:15:27:2… --- ## [Filebeat issue with json logs from ES audit](https://discuss.elastic.co/t/filebeat-issue-with-json-logs-from-es-audit/297404)
**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Replies:** 0\ **Last updated:** [February 16, 2022, 6:29pm UTC](https://discuss.elastic.co/t/filebeat-issue-with-json-logs-from-es-audit/297404 "2022-02-16T18:29:25Z")
Hello, I have following issue. I created on latest Elasticsearch audit logs (ES ver 7.16.3) with json format, and tried to impement filebeat to sending logs to ES. My audit logs looks like as below: {"type":"audit",… --- ## [Java Client API data indexed but not available in a search, works in debug mode](https://discuss.elastic.co/t/java-client-api-data-indexed-but-not-available-in-a-search-works-in-debug-mode/297399)
**Author:** [@vmassol](https://discuss.elastic.co/u/vmassol)\ **Replies:** 2\ **Last updated:** [February 16, 2022, 5:56pm UTC](https://discuss.elastic.co/t/java-client-api-data-indexed-but-not-available-in-a-search-works-in-debug-mode/297399 "2022-02-16T17:56:02Z")
Hi guys, I'm a bit stuck on a problem I don't understand. I'm basically doing the following, using the Java Client API in ES 7.17: RestClient restClient = RestClient.builder("...some url...") … --- ## [Latest Transform questions](https://discuss.elastic.co/t/latest-transform-questions/297293)
**Author:** [@iamtheschmitzer](https://discuss.elastic.co/u/iamtheschmitzer)\ **Replies:** 6\ **Last updated:** [February 16, 2022, 5:25pm UTC](https://discuss.elastic.co/t/latest-transform-questions/297293 "2022-02-16T17:25:06Z")
Creating a latest transform using the API, I need to provide a set of unique\_keys, which can be a list of field names. Some questions: How do I reference a field in a sub object? Like within foo there is a key bar th… --- ## [Filebeat: Bug: Processor "decode\_json\_fields" with usage of "target"](https://discuss.elastic.co/t/filebeat-bug-processor-decode-json-fields-with-usage-of-target/296972)
**Author:** [@fwetzler](https://discuss.elastic.co/u/fwetzler)\ **Replies:** 13\ **Last updated:** [February 16, 2022, 5:07pm UTC](https://discuss.elastic.co/t/filebeat-bug-processor-decode-json-fields-with-usage-of-target/296972 "2022-02-16T17:07:17Z")
OS: SLES12, CentOS 7.9 Filebeat Versions: 7.8.0, 7.16.2 After using processor "decode\_json\_fields" WITH "target: 'sometarget' it's impossible to access some extracted json fields with following processors. If you le… --- ## [Mapping Json Object and Array under the same field](https://discuss.elastic.co/t/mapping-json-object-and-array-under-the-same-field/294853)
**Author:** [@Remi\_Czternasty](https://discuss.elastic.co/u/Remi_Czternasty)\ **Replies:** 2\ **Last updated:** [February 16, 2022, 4:38pm UTC](https://discuss.elastic.co/t/mapping-json-object-and-array-under-the-same-field/294853 "2022-02-16T16:38:23Z")
Hello, I'm trying to ingests logs that are json documents. As I don't know the structure of each possible logs, I'm looking into dynamic templates. And I encounter an issue because I have a case where a field is an obje… --- ## [Metricbeat dashboard setup fails](https://discuss.elastic.co/t/metricbeat-dashboard-setup-fails/296788)
**Author:** [@satherev](https://discuss.elastic.co/u/satherev)\ **Replies:** 3\ **Last updated:** [February 16, 2022, 4:27pm UTC](https://discuss.elastic.co/t/metricbeat-dashboard-setup-fails/296788 "2022-02-16T16:27:30Z")
Good afternoon, I am unable to set up Metricbeats dashboards. Here is the error I receive: \[root@redacted metricbeat\]# metricbeat setup --dashboards Loading dashboards (Kibana must be running and reachable) Exiting: e… --- ## [My experiences setting up Metricbeat for monitoring an Elastic cluster](https://discuss.elastic.co/t/my-experiences-setting-up-metricbeat-for-monitoring-an-elastic-cluster/297395)
**Author:** [@jacknl](https://discuss.elastic.co/u/jacknl)\ **Replies:** 0\ **Last updated:** [February 16, 2022, 4:21pm UTC](https://discuss.elastic.co/t/my-experiences-setting-up-metricbeat-for-monitoring-an-elastic-cluster/297395 "2022-02-16T16:21:26Z")
For those who are interested here is my experience deploying Metricbeat with a monitoring cluster ("Stack Monitoring"). In a nutshell: When you monitor a non-trivial Elasticsearch cluster, be sure to add scope: cluste… --- ## [Problem with filebeat](https://discuss.elastic.co/t/problem-with-filebeat/296317)
**Author:** [@San9](https://discuss.elastic.co/u/San9)\ **Replies:** 3\ **Last updated:** [February 16, 2022, 3:59pm UTC](https://discuss.elastic.co/t/problem-with-filebeat/296317 "2022-02-16T15:59:11Z")
Hello, I have a problem c filebeat 7.12. The filebeat agent is not working correctly. Initially, 2 sources of logs were configured, data is received from one source, but the second one worked for a month and the data was… --- ## [Logstash runner error](https://discuss.elastic.co/t/logstash-runner-error/297378)
**Author:** [@Bigboy0706](https://discuss.elastic.co/u/Bigboy0706)\ **Replies:** 3\ **Last updated:** [February 16, 2022, 3:41pm UTC](https://discuss.elastic.co/t/logstash-runner-error/297378 "2022-02-16T15:41:43Z")
\[2022-02-16T14:02:47,966\]\[INFO \]\[logstash.runner \] Log4j configuration path used is: /etc/logstash/log4j2.properties \[2022-02-16T14:02:47,980\]\[INFO \]\[logstash.runner \] Starting Logstash {"logstash.versi… --- ## [ILM Error duration cannot be negative](https://discuss.elastic.co/t/ilm-error-duration-cannot-be-negative/297222)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 4\ **Last updated:** [February 16, 2022, 3:30pm UTC](https://discuss.elastic.co/t/ilm-error-duration-cannot-be-negative/297222 "2022-02-16T15:30:39Z")
running elk stack version 7.16.2. GET .siem-signals-default-000010/\_ilm/explain { "error" : { "root\_cause" : \[ { "type" : "illegal\_argument\_exception", "reason" : "duration cannot be negativ… --- ## [Kibana -\> interactive controls](https://discuss.elastic.co/t/kibana-interactive-controls/297172)
**Author:** [@lupolo](https://discuss.elastic.co/u/lupolo)\ **Replies:** 2\ **Last updated:** [February 16, 2022, 3:22pm UTC](https://discuss.elastic.co/t/kibana-interactive-controls/297172 "2022-02-16T15:22:33Z")
Interactive controls in Kibana are great but I have not figured out a way to pass a variable from an interactive control to a visualization widget. For example: Let's say we have a pull down menu interactive control lab… --- ## [Drop ipv6 from metricbeat data](https://discuss.elastic.co/t/drop-ipv6-from-metricbeat-data/297158)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 1\ **Last updated:** [February 16, 2022, 3:18pm UTC](https://discuss.elastic.co/t/drop-ipv6-from-metricbeat-data/297158 "2022-02-16T15:18:01Z")
Hello, I want to drop ipv6 address from metricbeat host.ip document values. How can I do that? I am on 7.16-2 --- ## [Metricbeat runtime error: slice bounds out of range](https://discuss.elastic.co/t/metricbeat-runtime-error-slice-bounds-out-of-range/297113)
**Author:** [@tperrot](https://discuss.elastic.co/u/tperrot)\ **Replies:** 1\ **Last updated:** [February 16, 2022, 2:45pm UTC](https://discuss.elastic.co/t/metricbeat-runtime-error-slice-bounds-out-of-range/297113 "2022-02-16T14:45:45Z")
Hello, I’m currently integrating metricbeat 7.10 on a Linux distribution using Golang 1.14. But a “runtime error: slice bounds out of range” is raised, only on ARMv7 targets, see below. In addition, I integrated fileb… --- ## [Error loading integration details on Fleet Integrations Page](https://discuss.elastic.co/t/error-loading-integration-details-on-fleet-integrations-page/297313)
**Author:** [@alfkonee](https://discuss.elastic.co/u/alfkonee)\ **Replies:** 1\ **Last updated:** [February 16, 2022, 2:09pm UTC](https://discuss.elastic.co/t/error-loading-integration-details-on-fleet-integrations-page/297313 "2022-02-16T14:09:57Z")
Hello there Please on the integrations Page in the ECK k8s deployment of Kibana I'm getting this Error Error connecting to package registry: request to https://epr.elastic.co/search?package=osquery\_manager&experimental… --- ## [Logstash ingest and export to elasticsearch files twice](https://discuss.elastic.co/t/logstash-ingest-and-export-to-elasticsearch-files-twice/297247)
**Author:** [@Greninja\_San](https://discuss.elastic.co/u/Greninja_San)\ **Replies:** 15\ **Last updated:** [February 16, 2022, 2:06pm UTC](https://discuss.elastic.co/t/logstash-ingest-and-export-to-elasticsearch-files-twice/297247 "2022-02-16T14:06:26Z")
Hello! I have a logstash config that gather lines from CSVs and then send them to Elasticsearch. However, for some unknown reason, lines are duplicated in Elasticsearch, taking twice the storage space, and making statis… --- ## [Double to long conversion](https://discuss.elastic.co/t/double-to-long-conversion/297179)
**Author:** [@makudu](https://discuss.elastic.co/u/makudu)\ **Replies:** 7\ **Last updated:** [February 16, 2022, 1:38pm UTC](https://discuss.elastic.co/t/double-to-long-conversion/297179 "2022-02-16T13:38:51Z")
Hi, How to convert (default) double type value returned by aggregation( Sum). I am receiving this exception while trying to explicitly convert to long type. Appreciate any advice. thank you. ==========================… --- ## [Question About Null Conditional](https://discuss.elastic.co/t/question-about-null-conditional/297187)
**Author:** [@msr1716](https://discuss.elastic.co/u/msr1716)\ **Replies:** 1\ **Last updated:** [February 16, 2022, 1:31pm UTC](https://discuss.elastic.co/t/question-about-null-conditional/297187 "2022-02-16T13:31:23Z")
I am using an Elasticsearch ingest pipeline in a Filebeat module, and I see the statement of: if: 'ctx.json?.userIdentity?.userName == null' When json.userIdentity.userName is equal to null, what would the key/value pai… --- ## [Obtain UTC Offset with location](https://discuss.elastic.co/t/obtain-utc-offset-with-location/297359)
**Author:** [@meyer1](https://discuss.elastic.co/u/meyer1)\ **Replies:** 1\ **Last updated:** [February 16, 2022, 1:25pm UTC](https://discuss.elastic.co/t/obtain-utc-offset-with-location/297359 "2022-02-16T13:25:44Z")
Hello everyone. I would like to know if it was possible to obtain the time difference (compared to utc time) if we have a location. I have for example a residencyTimezone: America/Los\_Angeles I would like as a result:… --- ## [Passing variables form changes to operations](https://discuss.elastic.co/t/passing-variables-form-changes-to-operations/297353)
**Author:** [@marek\_duciuc](https://discuss.elastic.co/u/marek_duciuc)\ **Replies:** 0\ **Last updated:** [February 16, 2022, 10:32am UTC](https://discuss.elastic.co/t/passing-variables-form-changes-to-operations/297353 "2022-02-16T10:32:08Z")
My operation file looks like: { "name": "match-all-query\_id", "operation-type": "search", "body": { "query": { "match\_all": {} }, "\_source": false } }, { "name": "match-all-quer… --- ## [Filebeat doesn't load logs into ElasticSearch (Windows)](https://discuss.elastic.co/t/filebeat-doesnt-load-logs-into-elasticsearch-windows/297319)
**Author:** [@Pixelixir](https://discuss.elastic.co/u/Pixelixir)\ **Replies:** 1\ **Last updated:** [February 16, 2022, 10:28am UTC](https://discuss.elastic.co/t/filebeat-doesnt-load-logs-into-elasticsearch-windows/297319 "2022-02-16T10:28:03Z")
I've read all the setup instructions over and over again but I still don't know how to transfer logs into Elasticsearch (localhost) via Filebeat. Here is my Elasticsearch.yml and Filebeat inputs: --- ## [Aggregation based visualization metric percentage](https://discuss.elastic.co/t/aggregation-based-visualization-metric-percentage/297145)
**Author:** [@skyrudi](https://discuss.elastic.co/u/skyrudi)\ **Replies:** 6\ **Last updated:** [February 16, 2022, 10:27am UTC](https://discuss.elastic.co/t/aggregation-based-visualization-metric-percentage/297145 "2022-02-16T10:27:40Z")
Hi any idea why aggregation based visualization metric percentage is not multiplied by by 100 but divided by 100 ? --- ## ["mapper\_parsing\_exception" Geo Point](https://discuss.elastic.co/t/mapper-parsing-exception-geo-point/296160)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 3\ **Last updated:** [February 16, 2022, 10:08am UTC](https://discuss.elastic.co/t/mapper-parsing-exception-geo-point/296160 "2022-02-16T10:08:50Z")
Hi, Can anyone tell why I'm getting an error here? P.S: I'm Running latest ELK stack 7.17 This is what i'm pasting in dev's console PUT /\_template/storms { "order": 0, "template": "storms\*", "mappings": { "… --- ## [Change template and ILM policy from an existing Datastream](https://discuss.elastic.co/t/change-template-and-ilm-policy-from-an-existing-datastream/296608)
**Author:** [@Angelos](https://discuss.elastic.co/u/Angelos)\ **Replies:** 8\ **Last updated:** [February 16, 2022, 9:56am UTC](https://discuss.elastic.co/t/change-template-and-ilm-policy-from-an-existing-datastream/296608 "2022-02-16T09:56:38Z")
Hey! In our Elasticsearch we use Datastreams which split our data to several streams like bellow. So all the Datastreams have the same template and ILM policy. Since one of them has increased a lot I want to apply diff… --- ## [Index Lifecycle Policy Not Deleting Indices](https://discuss.elastic.co/t/index-lifecycle-policy-not-deleting-indices/294880)
**Author:** [@Brandon\_Dooley](https://discuss.elastic.co/u/Brandon_Dooley)\ **Replies:** 5\ **Last updated:** [February 16, 2022, 9:54am UTC](https://discuss.elastic.co/t/index-lifecycle-policy-not-deleting-indices/294880 "2022-02-16T09:54:44Z")
I have an index lifecycle policy set up which I want to delete indices after 30 days. In order to achieve this the policy has two phases: Hot Phase (with 'Delete data after this phase' selected) Delete Phase (in… --- ## [Switching policies for an index](https://discuss.elastic.co/t/switching-policies-for-an-index/296200)
**Author:** [@Angelos](https://discuss.elastic.co/u/Angelos)\ **Replies:** 5\ **Last updated:** [February 16, 2022, 9:51am UTC](https://discuss.elastic.co/t/switching-policies-for-an-index/296200 "2022-02-16T09:51:39Z")
Hey! Is there any documentation on switching ilm policies for 7.10.0. I could find only for other versions like here: Switching policies for an index | Elasticsearch Guide \[7.4\] | Elastic My question is: Can I switch … --- ## [Stop elasticsearch cluster safely](https://discuss.elastic.co/t/stop-elasticsearch-cluster-safely/297327)
**Author:** [@vikia.4293ok](https://discuss.elastic.co/u/vikia.4293ok)\ **Replies:** 6\ **Last updated:** [February 16, 2022, 8:42am UTC](https://discuss.elastic.co/t/stop-elasticsearch-cluster-safely/297327 "2022-02-16T08:42:34Z")
Hello, there. If anyone has faced a similar problem, I would really appreciate your advice. We stop/start Elasticsearch cluster in develop envrionment everyday to reduce costs. But, sometimes, we find that some index\`… --- ## [Getting "master not discovered or elected yet, an election requires at least 2 nodes" after enabling SSL/HTTPS](https://discuss.elastic.co/t/getting-master-not-discovered-or-elected-yet-an-election-requires-at-least-2-nodes-after-enabling-ssl-https/296950)
**Author:** [@cgnusr01](https://discuss.elastic.co/u/cgnusr01)\ **Replies:** 10\ **Last updated:** [February 16, 2022, 8:11am UTC](https://discuss.elastic.co/t/getting-master-not-discovered-or-elected-yet-an-election-requires-at-least-2-nodes-after-enabling-ssl-https/296950 "2022-02-16T08:11:54Z")
I recently upgraded Elastic from version: 7.2 to version 7.16.1 with a rolling update and there were no problems. After some time and after following the instructions here: Set up basic security for the Elastic Stack | E… --- ## [I set it to niofs but the performance was too poor](https://discuss.elastic.co/t/i-set-it-to-niofs-but-the-performance-was-too-poor/297091)
**Author:** [@slowup](https://discuss.elastic.co/u/slowup)\ **Replies:** 4\ **Last updated:** [February 16, 2022, 8:02am UTC](https://discuss.elastic.co/t/i-set-it-to-niofs-but-the-performance-was-too-poor/297091 "2022-02-16T08:02:05Z")
Performance tests were conducted with niofs and hybridfs, but in the case of niofs, 100 TPS hybridfs came out 680 TPS. Why is that? Do you have any documentation that goes deeper into niofs, mmapfs, and hybridfs? Help m… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1049) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1051)