# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1056 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1057 --- ## [Problem in getting percentage in canvas](https://discuss.elastic.co/t/problem-in-getting-percentage-in-canvas/296927)
**Author:** [@dannie-ml](https://discuss.elastic.co/u/dannie-ml)\ **Replies:** 1\ **Last updated:** [February 11, 2022, 9:11pm UTC](https://discuss.elastic.co/t/problem-in-getting-percentage-in-canvas/296927 "2022-02-11T21:11:35Z")
Hi, im having a problem with this expression. What I have done is get the error percentage, i.e, I have for example 643 transactions with 49 errors what I want is the error percentage. The expression work well but when I… --- ## [Cant install es-termstat plugin](https://discuss.elastic.co/t/cant-install-es-termstat-plugin/297016)
**Author:** [@chbrown](https://discuss.elastic.co/u/chbrown)\ **Replies:** 1\ **Last updated:** [February 11, 2022, 9:10pm UTC](https://discuss.elastic.co/t/cant-install-es-termstat-plugin/297016 "2022-02-11T21:10:27Z")
Hi there, Im trying to install this plugin but havent been able to so far. I've tried to download the archive and then run the install with the file path, and running the install with the github url. I get this error for… --- ## [Winlogbeat repeats batches of event logs](https://discuss.elastic.co/t/winlogbeat-repeats-batches-of-event-logs/296519)
**Author:** [@dhelk](https://discuss.elastic.co/u/dhelk)\ **Replies:** 2\ **Last updated:** [February 11, 2022, 8:03pm UTC](https://discuss.elastic.co/t/winlogbeat-repeats-batches-of-event-logs/296519 "2022-02-11T20:03:12Z")
I am testing uploading Windows EVTX to Elastic using Winlogbeat and Logstash, and when opening several evtx files the Winlogbeat will not terminate the processing job, but will instead keep trying to resubmit. I original… --- ## [Logstash document id string does not get evaluated](https://discuss.elastic.co/t/logstash-document-id-string-does-not-get-evaluated/297019)
**Author:** [@Leo\_Baby\_Jacob](https://discuss.elastic.co/u/Leo_Baby_Jacob)\ **Replies:** 1\ **Last updated:** [February 11, 2022, 7:05pm UTC](https://discuss.elastic.co/t/logstash-document-id-string-does-not-get-evaluated/297019 "2022-02-11T19:05:27Z")
To prevent data duplication while injesting data from logstash I am adding a document\_id string for logstash conf with a peopleRowId column. However it does not get evaluated. So in my case I am trying to set document id… --- ## [Filebeat Not able to catch up with rotating container logs](https://discuss.elastic.co/t/filebeat-not-able-to-catch-up-with-rotating-container-logs/296935)
**Author:** [@elk\_follower](https://discuss.elastic.co/u/elk_follower)\ **Replies:** 2\ **Last updated:** [February 11, 2022, 6:17pm UTC](https://discuss.elastic.co/t/filebeat-not-able-to-catch-up-with-rotating-container-logs/296935 "2022-02-11T18:17:22Z")
We have a situation where container logs are rotated ~5 times with-in a minute and only last 5 files are kept before getting deleted. We have Filebeat running as daemon set in the K8 cluster and it is able to send th… --- ## [Remote ES node CPU only in advanced view](https://discuss.elastic.co/t/remote-es-node-cpu-only-in-advanced-view/296913)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 1\ **Last updated:** [February 11, 2022, 6:03pm UTC](https://discuss.elastic.co/t/remote-es-node-cpu-only-in-advanced-view/296913 "2022-02-11T18:03:32Z")
Hey there, I am using legacy mode to monitor remote cluster. I saw a strange behavior regarding the nodes CPU values. I can see it only if I switch to Advanced view otherwise (using standard tab) the timeseries graph wi… --- ## [Curl -x put content-type: application/json throwing error](https://discuss.elastic.co/t/curl-x-put-content-type-application-json-throwing-error/296868)
**Author:** [@byoungman](https://discuss.elastic.co/u/byoungman)\ **Replies:** 7\ **Last updated:** [February 11, 2022, 4:39pm UTC](https://discuss.elastic.co/t/curl-x-put-content-type-application-json-throwing-error/296868 "2022-02-11T16:39:02Z")
I have an Elasticsearch instance that has reached it's default max shards of 1000 and now I'm trying to increase that number using curl but am running into an issue with the -h content-type declaration. Here is my curl … --- ## [Load balancer for logstash question](https://discuss.elastic.co/t/load-balancer-for-logstash-question/296993)
**Author:** [@RajuParipelly](https://discuss.elastic.co/u/RajuParipelly)\ **Replies:** 2\ **Last updated:** [February 11, 2022, 4:33pm UTC](https://discuss.elastic.co/t/load-balancer-for-logstash-question/296993 "2022-02-11T16:33:27Z")
We have 3 logstash instances running and we are trying to create a load balancer for logstash using Big IP f5. This load balancer should distribute the logs that it receives from network devices to the 3 logstash instanc… --- ## [Error saving watch \[1:234\] \[script\] unknown field \[query\]](https://discuss.elastic.co/t/error-saving-watch-1-234-script-unknown-field-query/296989)
**Author:** [@Abhi\_Abhishek](https://discuss.elastic.co/u/Abhi_Abhishek)\ **Replies:** 2\ **Last updated:** [February 11, 2022, 4:26pm UTC](https://discuss.elastic.co/t/error-saving-watch-1-234-script-unknown-field-query/296989 "2022-02-11T16:26:32Z")
{ "trigger": { "schedule": { "interval": "10s" } }, "input": { "chain": { "inputs": \[ { "first": { "http": { "request": { "scheme": "https", "host": "", "port": , "method": "get", "path": "llm\_full\_addre… --- ## [Inconsistency between deserialization of number values in \_msearch/\_mget and \_search/\_get - elasticsearch-java client (7.16.2)](https://discuss.elastic.co/t/inconsistency-between-deserialization-of-number-values-in-msearch-mget-and-search-get-elasticsearch-java-client-7-16-2/297001)
**Author:** [@Xupi](https://discuss.elastic.co/u/Xupi)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 4:23pm UTC](https://discuss.elastic.co/t/inconsistency-between-deserialization-of-number-values-in-msearch-mget-and-search-get-elasticsearch-java-client-7-16-2/297001 "2022-02-11T16:23:04Z")
Hi, I have a problem with scientific notation numbers returned from elastic through \_search/\_get and \_msearch/\_mget. Value in elastic \_source is = 1.4778125E7. Queried through dev console is always returned the same = … --- ## [Compare message if it's similar to others](https://discuss.elastic.co/t/compare-message-if-its-similar-to-others/296826)
**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\ **Replies:** 9\ **Last updated:** [February 11, 2022, 4:08pm UTC](https://discuss.elastic.co/t/compare-message-if-its-similar-to-others/296826 "2022-02-11T16:08:42Z")
Hi, filebeat.yml configuration: multiline.pattern: \\d\\d/\\d\\d/\\d\\d\\d\\d\\s\\d\\d:\\d\\d:\\d\\d\\s\\d\\d\\d-\\sMAIN\\sEXCEPTION\\b multiline.negate: true multiline.match: after multiline.max\_lines: 7 Logstash configuration: input { … --- ## [Filebeat Lag](https://discuss.elastic.co/t/filebeat-lag/296995)
**Author:** [@Winfield\_Henry](https://discuss.elastic.co/u/Winfield_Henry)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 3:32pm UTC](https://discuss.elastic.co/t/filebeat-lag/296995 "2022-02-11T15:32:38Z")
Hello, We have recently implemented an internal IDS solution. That solution can generate somewhere in the neighborhood of ~30k logs (json format) per minute. Filebeat has a pre-canned module that we are using and it doe… --- ## [Anomali Limo using Elastic Agent](https://discuss.elastic.co/t/anomali-limo-using-elastic-agent/296965)
**Author:** [@samoz83](https://discuss.elastic.co/u/samoz83)\ **Replies:** 1\ **Last updated:** [February 11, 2022, 3:27pm UTC](https://discuss.elastic.co/t/anomali-limo-using-elastic-agent/296965 "2022-02-11T15:27:24Z")
Just updated to v8 and enabled the Anomali Limo API using the Elastic Agent, not sure if anyone else has had success using this integration but it doesn't seem to pull any data using the default settings? --- ## [Fleet CEF Processor](https://discuss.elastic.co/t/fleet-cef-processor/296790)
**Author:** [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Replies:** 6\ **Last updated:** [February 11, 2022, 3:20pm UTC](https://discuss.elastic.co/t/fleet-cef-processor/296790 "2022-02-11T15:20:51Z")
Hello, We are trying to use the CEF integration to parse syslogs sent over from SentinelOne, but are getting an error message on processing which appears to be due to the date format. Error - Text '2022-02-09 00:25:02,… --- ## [Issue in Offset Rounding in case Offset leads to change in the DST state](https://discuss.elastic.co/t/issue-in-offset-rounding-in-case-offset-leads-to-change-in-the-dst-state/296986)
**Author:** [@PRIYANSHU\_KUSHWAHA](https://discuss.elastic.co/u/PRIYANSHU_KUSHWAHA)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 2:33pm UTC](https://discuss.elastic.co/t/issue-in-offset-rounding-in-case-offset-leads-to-change-in-the-dst-state/296986 "2022-02-11T14:33:35Z")
I am using ES version 7.11. { "size": 0, "query": { "constant\_score": { "filter": { "bool": { "must": \[ { "terms": { "deleted": \[ … --- ## [Permission denied when i'm trying to use elasticsearch command](https://discuss.elastic.co/t/permission-denied-when-im-trying-to-use-elasticsearch-command/296629)
**Author:** [@Arkoos62](https://discuss.elastic.co/u/Arkoos62)\ **Replies:** 5\ **Last updated:** [February 11, 2022, 2:52pm UTC](https://discuss.elastic.co/t/permission-denied-when-im-trying-to-use-elasticsearch-command/296629 "2022-02-11T14:52:07Z")
Hello there, I am trying to configure basic security on my Elasticsearch production but i'm getting error when i try to launch a command from the path /usr/share/Elasticsearch/bin i'm getting this error ./elasticsearch… --- ## [Ingest pipeline set processor error; \[value\] required property is missing](https://discuss.elastic.co/t/ingest-pipeline-set-processor-error-value-required-property-is-missing/296798)
**Author:** [@ben5556](https://discuss.elastic.co/u/ben5556)\ **Replies:** 4\ **Last updated:** [February 11, 2022, 2:48pm UTC](https://discuss.elastic.co/t/ingest-pipeline-set-processor-error-value-required-property-is-missing/296798 "2022-02-11T14:48:13Z")
I am trying to add a field as below within one of our ingest pipelines "set": { "field": "upstream\_response\_time\_int", "copy\_from": "upstream\_response\_time" } But it gives the below error even though t… --- ## [No way to specify filebeat 8.0.0 data stream and index template pattern](https://discuss.elastic.co/t/no-way-to-specify-filebeat-8-0-0-data-stream-and-index-template-pattern/296979)
**Author:** [@rouke-broersma](https://discuss.elastic.co/u/rouke-broersma)\ **Replies:** 3\ **Last updated:** [February 11, 2022, 2:45pm UTC](https://discuss.elastic.co/t/no-way-to-specify-filebeat-8-0-0-data-stream-and-index-template-pattern/296979 "2022-02-11T14:45:18Z")
In filebeat 7.x we were able to specify custom index template and rollover\_alias for the indexes used by filebeat. We use this to split which indices different filebeats send their logs to because some filebeats collect … --- ## [Multiple paths logstash output](https://discuss.elastic.co/t/multiple-paths-logstash-output/296831)
**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\ **Replies:** 0\ **Last updated:** [February 10, 2022, 10:51am UTC](https://discuss.elastic.co/t/multiple-paths-logstash-output/296831 "2022-02-10T10:51:22Z")
Hi, filebeat config: filebeat.inputs: - type: log enabled: true paths: - D:\\elastic\_stack\\testLog\\\* - D:\\elastic\_stack\\LogWal\\\* So in logstash i want for the first path did the split of the message and add fie… --- ## [How to find docs that contain the exact specified terms](https://discuss.elastic.co/t/how-to-find-docs-that-contain-the-exact-specified-terms/295758)
**Author:** [@Cholley\_Alexandre](https://discuss.elastic.co/u/Cholley_Alexandre)\ **Replies:** 14\ **Last updated:** [February 11, 2022, 2:29pm UTC](https://discuss.elastic.co/t/how-to-find-docs-that-contain-the-exact-specified-terms/295758 "2022-02-11T14:29:10Z")
Hi, I'm trying to get docs that contain the exact specified terms. Terms query doesn't match because it also returns docs with additional terms. Create index : PUT my-index { "mappings": { "properties": { … --- ## [Two index Pattern with same name after importation](https://discuss.elastic.co/t/two-index-pattern-with-same-name-after-importation/296155)
**Author:** [@HerveSavard](https://discuss.elastic.co/u/HerveSavard)\ **Replies:** 2\ **Last updated:** [February 11, 2022, 1:58pm UTC](https://discuss.elastic.co/t/two-index-pattern-with-same-name-after-importation/296155 "2022-02-11T13:58:50Z")
Hello, I have two index pattern with the same name. I have some visualization on the second index pattern but i need move the visualization to the first Index Pattern. and delete the second index pattern after. Do yo… --- ## [Master not discovered exception](https://discuss.elastic.co/t/master-not-discovered-exception/296977)
**Author:** [@praveen\_raju](https://discuss.elastic.co/u/praveen_raju)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 1:26pm UTC](https://discuss.elastic.co/t/master-not-discovered-exception/296977 "2022-02-11T13:26:15Z")
Hello, I build a 11 node Elastic cluster (3M, 5D, 3 Ingest nodes), using ansible playbook. Which is working perfectly fine with out SSL & TLS. But when i enable SSL & TLS, i'am getting the below error message in master… --- ## [Custom component template](https://discuss.elastic.co/t/custom-component-template/296974)
**Author:** [@dabo](https://discuss.elastic.co/u/dabo)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 1:05pm UTC](https://discuss.elastic.co/t/custom-component-template/296974 "2022-02-11T13:05:21Z")
Hello, Can see now after upgrading to 7.16.2 that we have a new component template as part of logs-system.application index template. What this component template logs-system.application@custom should be used for? Sho… --- ## [Security information not being output on startup (8.0.0-rc2)](https://discuss.elastic.co/t/security-information-not-being-output-on-startup-8-0-0-rc2/296393)
**Author:** [@Andy0708](https://discuss.elastic.co/u/Andy0708)\ **Replies:** 7\ **Last updated:** [February 11, 2022, 12:53pm UTC](https://discuss.elastic.co/t/security-information-not-being-output-on-startup-8-0-0-rc2/296393 "2022-02-11T12:53:22Z")
Tried setting up Elasticsearch 8.0.0-rc2 on macOS to test the new security configuration. Despite what the documentation says, no password, enrollment token, etc. is being output on first startup. Instead, the following … --- ## [\[status\_exception\] error while executing search in Kibana](https://discuss.elastic.co/t/status-exception-error-while-executing-search-in-kibana/296942)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [February 11, 2022, 12:03pm UTC](https://discuss.elastic.co/t/status-exception-error-while-executing-search-in-kibana/296942 "2022-02-11T12:03:45Z")
Hi, I'm getting this error in discover and dashboards. \[status\_exception\] error while executing search Though it seems to be working for different time periods... It gives this error when i select for a particular ti… --- ## [Getting class not found exception when invoking logstash http input with queue type as persisted](https://discuss.elastic.co/t/getting-class-not-found-exception-when-invoking-logstash-http-input-with-queue-type-as-persisted/296970)
**Author:** [@Sivakumar\_Lakshminar](https://discuss.elastic.co/u/Sivakumar_Lakshminar)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 11:40am UTC](https://discuss.elastic.co/t/getting-class-not-found-exception-when-invoking-logstash-http-input-with-queue-type-as-persisted/296970 "2022-02-11T11:40:02Z")
Hello All, I am trying to setup ELK for internal event monitoring for our platform. Need help with the below, Using logstash-7.10.2 with bundled jdk. with setting as per below snippets. It is working fine when trying … --- ## [How to create a timeline](https://discuss.elastic.co/t/how-to-create-a-timeline/296969)
**Author:** [@Celal\_Celik](https://discuss.elastic.co/u/Celal_Celik)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 11:34am UTC](https://discuss.elastic.co/t/how-to-create-a-timeline/296969 "2022-02-11T11:34:46Z")
Hello Community, I have a question regarding updating data. I wrote a script in Python to create a random csv file. The CSV file contains: \_id, name, status and date. Now here is my Question: If I have a lane e.g. id;… --- ## [Index in elastic](https://discuss.elastic.co/t/index-in-elastic/296909)
**Author:** [@alex\_96](https://discuss.elastic.co/u/alex_96)\ **Replies:** 9\ **Last updated:** [February 11, 2022, 11:16am UTC](https://discuss.elastic.co/t/index-in-elastic/296909 "2022-02-11T11:16:05Z")
Hello, I'm new to elastic, tell me if it's possible to do such a thing, create an index pattern, for example “index-\*” without adding %{+YYYY.MM.dd} , but so that an index like this is automatically created on the onset … --- ## [Pipelines for each device source](https://discuss.elastic.co/t/pipelines-for-each-device-source/296962)
**Author:** [@jokem48](https://discuss.elastic.co/u/jokem48)\ **Replies:** 1\ **Last updated:** [February 11, 2022, 10:47am UTC](https://discuss.elastic.co/t/pipelines-for-each-device-source/296962 "2022-02-11T10:47:20Z")
Hi, new to the ELK setup. We are exploring to use ELK as our SIEM. Right now we have a log forwarder collecting syslog from various network sources, like cisco, fortinet and even juniper /f5? In order to break down thos… --- ## [Elastic Agent - error getting cgroup stats: error fetching stats for controller io](https://discuss.elastic.co/t/elastic-agent-error-getting-cgroup-stats-error-fetching-stats-for-controller-io/296906)
**Author:** [@zx8086](https://discuss.elastic.co/u/zx8086)\ **Replies:** 0\ **Last updated:** [February 10, 2022, 9:55pm UTC](https://discuss.elastic.co/t/elastic-agent-error-getting-cgroup-stats-error-fetching-stats-for-controller-io/296906 "2022-02-10T21:55:58Z")
Hi, Elastic-Agent 7.17 and getting this error for the agents on Raspberry Pi Model 4 - Debian Bullseye elastic-agent filebeat metrcbeat osquerybeat error getting cgroup stats: error fetching stats for controller io… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1055) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1057)