# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1058 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1059 --- ## [Java regex matcher in painless seems not to be working](https://discuss.elastic.co/t/java-regex-matcher-in-painless-seems-not-to-be-working/296904)
**Author:** [@PascalThalmann](https://discuss.elastic.co/u/PascalThalmann)\ **Replies:** 0\ **Last updated:** [February 10, 2022, 9:42pm UTC](https://discuss.elastic.co/t/java-regex-matcher-in-painless-seems-not-to-be-working/296904 "2022-02-10T21:42:51Z")
Hi i try to match a simple pattern from a string, like this: GET testindex/\_search { "query": { "match\_all": {} }, "script\_fields": { "free\_float": { "script": { "source": """ def m… --- ## [Create multiple logstash configurations for different Filebeat instances](https://discuss.elastic.co/t/create-multiple-logstash-configurations-for-different-filebeat-instances/296781)
**Author:** [@userR](https://discuss.elastic.co/u/userR)\ **Replies:** 9\ **Last updated:** [February 10, 2022, 7:51pm UTC](https://discuss.elastic.co/t/create-multiple-logstash-configurations-for-different-filebeat-instances/296781 "2022-02-10T19:51:49Z")
As of now, I am using Docker compose to set up an image of Logstash. Here is my use case: I have Filebeat installed on 5 machines, each with different log paths and log formats. Instead of having one logstash.conf file … --- ## [Logging configuration issues in Kibana 7.16](https://discuss.elastic.co/t/logging-configuration-issues-in-kibana-7-16/295517)
**Author:** [@quality](https://discuss.elastic.co/u/quality)\ **Replies:** 2\ **Last updated:** [February 10, 2022, 6:58pm UTC](https://discuss.elastic.co/t/logging-configuration-issues-in-kibana-7-16/295517 "2022-02-10T18:58:59Z")
Kibana 7.16 END GOAL: All Kibana logging options can be configured from kibana.yml All Kibana logs should be visible with journalctl. (they stream to journald) BACKGROUND: The below issues were discovered after … --- ## [How to automatically set the server date/time when adding data?](https://discuss.elastic.co/t/how-to-automatically-set-the-server-date-time-when-adding-data/296708)
**Author:** [@vmassol](https://discuss.elastic.co/u/vmassol)\ **Replies:** 15\ **Last updated:** [February 10, 2022, 6:14pm UTC](https://discuss.elastic.co/t/how-to-automatically-set-the-server-date-time-when-adding-data/296708 "2022-02-10T18:14:13Z")
Hi there, In old ES versions, I was using the \_timestamp field but it's been removed and it's now recommended to set the date on the client side. However, I'm surprised to not find any easy way to continue to set it on … --- ## [Query using Runtime Field](https://discuss.elastic.co/t/query-using-runtime-field/296864)
**Author:** [@jkulcsar](https://discuss.elastic.co/u/jkulcsar)\ **Replies:** 1\ **Last updated:** [February 10, 2022, 5:24pm UTC](https://discuss.elastic.co/t/query-using-runtime-field/296864 "2022-02-10T17:24:43Z")
Hello all I've added a runtime field to my logstash indexes to concatenate two fields on the fly (in this context: the Model and Serial Number of a product): PUT logstash-\*/\_mapping { "runtime": { "m\_s\_unique\_id"… --- ## [Any issue store integer values in text field](https://discuss.elastic.co/t/any-issue-store-integer-values-in-text-field/296143)
**Author:** [@jsjs2](https://discuss.elastic.co/u/jsjs2)\ **Replies:** 6\ **Last updated:** [February 10, 2022, 5:21pm UTC](https://discuss.elastic.co/t/any-issue-store-integer-values-in-text-field/296143 "2022-02-10T17:21:26Z")
Hi, I have type text field, the value for this field sometimes comes in as integer, it is store in ES as integer. any issue when querying this field later on? will the integer value be indexed as string value by ES? th… --- ## [Set indices based on (sub) module name](https://discuss.elastic.co/t/set-indices-based-on-sub-module-name/296850)
**Author:** [@tartaarsap](https://discuss.elastic.co/u/tartaarsap)\ **Replies:** 3\ **Last updated:** [February 10, 2022, 5:20pm UTC](https://discuss.elastic.co/t/set-indices-based-on-sub-module-name/296850 "2022-02-10T17:20:24Z")
I'm trying to send my log files into multiple indices based on a sub (module) value. With the code below it works for the main module. output.elasticsearch: # Array of hosts to connect to. hosts: \["localhost:9200"\] … --- ## [Metricbeat unable to start](https://discuss.elastic.co/t/metricbeat-unable-to-start/295399)
**Author:** [@mmmguy](https://discuss.elastic.co/u/mmmguy)\ **Replies:** 4\ **Last updated:** [February 10, 2022, 3:57pm UTC](https://discuss.elastic.co/t/metricbeat-unable-to-start/295399 "2022-02-10T15:57:30Z")
Anyone ever have issues getting the metricbeat service to start on a 2012 R2 server where the filebeat log says Exiting: can not convert 'object' into 'string' accessing '0.hosts.0' (source:'C:\\ProgramData\\Elastic\\Beats\\… --- ## [Using an aggregation to create histogram in Kibana?](https://discuss.elastic.co/t/using-an-aggregation-to-create-histogram-in-kibana/296697)
**Author:** [@saurab](https://discuss.elastic.co/u/saurab)\ **Replies:** 1\ **Last updated:** [February 10, 2022, 3:57pm UTC](https://discuss.elastic.co/t/using-an-aggregation-to-create-histogram-in-kibana/296697 "2022-02-10T15:57:14Z")
I have an aggregation on a packetbeat index as follows: GET packetbeat-7.16.3-2022.02.07-000001/\_search?size=0 { "query": { "term": { "destination.port": 9200 } }, "aggs": { "myagg1": { "t… --- ## [Set default zoom on a canvas in a map](https://discuss.elastic.co/t/set-default-zoom-on-a-canvas-in-a-map/296632)
**Author:** [@Angad\_Panesar1](https://discuss.elastic.co/u/Angad_Panesar1)\ **Replies:** 3\ **Last updated:** [February 10, 2022, 3:13pm UTC](https://discuss.elastic.co/t/set-default-zoom-on-a-canvas-in-a-map/296632 "2022-02-10T15:13:25Z")
How would you set the map on a canvas to a default zoom like 4.99 if you refresh the page? Is there anything I have to put in the expression editor? Also, whenever I click on an ID in the dropdown menu, the map vanishes… --- ## [Data Table with changeable bucket interval](https://discuss.elastic.co/t/data-table-with-changeable-bucket-interval/296659)
**Author:** [@jspalti](https://discuss.elastic.co/u/jspalti)\ **Replies:** 1\ **Last updated:** [February 10, 2022, 3:02pm UTC](https://discuss.elastic.co/t/data-table-with-changeable-bucket-interval/296659 "2022-02-10T15:02:29Z")
I have a data table visualization that currently has a bucket date histogram with an interval of Month and another table with an interval of Day. I would like to have a single visualization with a control that can toggl… --- ## [DB sessions | logstash](https://discuss.elastic.co/t/db-sessions-logstash/296845)
**Author:** [@Nasser](https://discuss.elastic.co/u/Nasser)\ **Replies:** 1\ **Last updated:** [February 10, 2022, 2:44pm UTC](https://discuss.elastic.co/t/db-sessions-logstash/296845 "2022-02-10T14:44:34Z")
Hi i have 20 sql query, 2 query in each jdbc.conf file my question is how many sessions will jdbc open with DB to execute the query ? will open one session and execute 10 query or one session for each query ? my con… --- ## [Unable to deploy Functionbeat 7.16.3](https://discuss.elastic.co/t/unable-to-deploy-functionbeat-7-16-3/296857)
**Author:** [@Bhavani\_Ananth](https://discuss.elastic.co/u/Bhavani_Ananth)\ **Replies:** 0\ **Last updated:** [February 10, 2022, 2:38pm UTC](https://discuss.elastic.co/t/unable-to-deploy-functionbeat-7-16-3/296857 "2022-02-10T14:38:25Z")
Elasticsearch version : 7.16.3 Functionbeat: 7.16.3 OS : Ubuntu 20.04.3 LTS a. When I try to deploy functionbeat (version 7.16.3) in S3 bucket, I get the following exception Function: cloudwatch, could not deploy, er… --- ## [Does Filebeat plan to support Data Streams?](https://discuss.elastic.co/t/does-filebeat-plan-to-support-data-streams/296851)
**Author:** [@brsolomon](https://discuss.elastic.co/u/brsolomon)\ **Replies:** 3\ **Last updated:** [February 10, 2022, 2:33pm UTC](https://discuss.elastic.co/t/does-filebeat-plan-to-support-data-streams/296851 "2022-02-10T14:33:20Z")
Does Filebeat plan to support Data Streams, and if so, what is the expected development timeline? Per docs, Prior to Elasticsearch 7.9, you’d typically use an index alias with a write index to manage time series data.… --- ## [Logstash output email](https://discuss.elastic.co/t/logstash-output-email/296856)
**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\ **Replies:** 0\ **Last updated:** [February 10, 2022, 2:32pm UTC](https://discuss.elastic.co/t/logstash-output-email/296856 "2022-02-10T14:32:54Z")
Hi, I have log file contains more than one exception so i want for this file when i found a word "EXCEPTION" just sending me one email. logstash.conf: output{ stdout { codec =\> rubydebug } if ("EXCEPTION… --- ## [Connection marked as failed because the onConnect callback failed](https://discuss.elastic.co/t/connection-marked-as-failed-because-the-onconnect-callback-failed/296834)
**Author:** [@abhi.logs](https://discuss.elastic.co/u/abhi.logs)\ **Replies:** 1\ **Last updated:** [February 10, 2022, 2:20pm UTC](https://discuss.elastic.co/t/connection-marked-as-failed-because-the-onconnect-callback-failed/296834 "2022-02-10T14:20:29Z")
Getting this error when I enabled envoy module. Connection marked as failed because the onConnect callback failed: 1 error: error loading pipeline for fileset envoyproxy/log: couldn't load pipeline: couldn't load json. … --- ## [How you connected Filebeat with Logstash in your Kubernetes Cluster using beats input?](https://discuss.elastic.co/t/how-you-connected-filebeat-with-logstash-in-your-kubernetes-cluster-using-beats-input/296847)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 0\ **Last updated:** [February 10, 2022, 1:50pm UTC](https://discuss.elastic.co/t/how-you-connected-filebeat-with-logstash-in-your-kubernetes-cluster-using-beats-input/296847 "2022-02-10T13:50:04Z")
Hi folks, when I try to send logs from filebeat via output.logstash: hosts: \["logstash-service:5044"\] to my logtash pod with: input { beats { port =\> 5044 } } without any security settings for … --- ## [Store Path Data to Multiple Location FIle](https://discuss.elastic.co/t/store-path-data-to-multiple-location-file/296538)
**Author:** [@Xenial](https://discuss.elastic.co/u/Xenial)\ **Replies:** 7\ **Last updated:** [February 10, 2022, 1:00pm UTC](https://discuss.elastic.co/t/store-path-data-to-multiple-location-file/296538 "2022-02-10T13:00:58Z")
Hello, i've Elasticsearch server, but the storage is full. My server run on vmware, i want to add new disk, and i want to mount on /backup location. When i add to /etc/Elasticsearch/Elasticsearch.yml and add line Path.… --- ## [Change Default Discover Visualization](https://discuss.elastic.co/t/change-default-discover-visualization/294531)
**Author:** [@DrBees](https://discuss.elastic.co/u/DrBees)\ **Replies:** 1\ **Last updated:** [February 10, 2022, 12:10pm UTC](https://discuss.elastic.co/t/change-default-discover-visualization/294531 "2022-02-10T12:10:11Z")
Is it possible to change the default visualization from a histogram to a table? I know in the advanced settings you can change the number of terms for the histogram but I want a different visualization preferable a tabl… --- ## [Multiline pattern for javaserver log not working](https://discuss.elastic.co/t/multiline-pattern-for-javaserver-log-not-working/296803)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 2\ **Last updated:** [February 10, 2022, 12:05pm UTC](https://discuss.elastic.co/t/multiline-pattern-for-javaserver-log-not-working/296803 "2022-02-10T12:05:55Z")
Hello team, I am trying to write multline pattern for below log line. But it is not working. It is displaying seperate line for each "at" record. Can you please help me on this to write multiline pattern Log line: \[2… --- ## [Error for scripted\_metric aggregation on auto\_date\_histogram aggregation](https://discuss.elastic.co/t/error-for-scripted-metric-aggregation-on-auto-date-histogram-aggregation/296741)
**Author:** [@saurab](https://discuss.elastic.co/u/saurab)\ **Replies:** 3\ **Last updated:** [February 10, 2022, 11:18am UTC](https://discuss.elastic.co/t/error-for-scripted-metric-aggregation-on-auto-date-histogram-aggregation/296741 "2022-02-10T11:18:03Z")
I am working with the sample log dataset. Here is what it looks like: "hits" : \[ { "\_index" : "kibana\_sample\_data\_logs", "\_type" : "\_doc", "\_id" : "nfvc3X4BKbUZuD5M4wWJ", "\_score" :… --- ## [Splunk to ELK Migration](https://discuss.elastic.co/t/splunk-to-elk-migration/296801)
**Author:** [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\ **Replies:** 2\ **Last updated:** [February 10, 2022, 11:09am UTC](https://discuss.elastic.co/t/splunk-to-elk-migration/296801 "2022-02-10T11:09:20Z")
There are 2000 dashboards in Splunk. Out of which, some are used and some are not. How to check that?How to migrate it to ELK by filtering out unused or junk dashboards. --- ## [Delete all docs that have duplicate field values](https://discuss.elastic.co/t/delete-all-docs-that-have-duplicate-field-values/296702)
**Author:** [@alfianaf](https://discuss.elastic.co/u/alfianaf)\ **Replies:** 4\ **Last updated:** [February 10, 2022, 10:48am UTC](https://discuss.elastic.co/t/delete-all-docs-that-have-duplicate-field-values/296702 "2022-02-10T10:48:57Z")
Hello, I ingest some data into my cluster, and turned out some of my data has been ingested twice, so some of the data is doubled. My index has unique field, because some of it is doubled, I'm trying to search for dupli… --- ## [Rejected execution of replica operation](https://discuss.elastic.co/t/rejected-execution-of-replica-operation/296818)
**Author:** [@Ariel\_Benichou](https://discuss.elastic.co/u/Ariel_Benichou)\ **Replies:** 0\ **Last updated:** [February 10, 2022, 9:16am UTC](https://discuss.elastic.co/t/rejected-execution-of-replica-operation/296818 "2022-02-10T09:16:50Z")
Can someone explain what this error means? rejected execution of replica operation \[replica\_bytes=1032693097, replica\_operation\_bytes=370889441, max\_replica\_bytes=1288490188\] Info This log has been retrieved from DATA\_… --- ## [Kibana discover search download](https://discuss.elastic.co/t/kibana-discover-search-download/296802)
**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\ **Replies:** 1\ **Last updated:** [February 10, 2022, 9:13am UTC](https://discuss.elastic.co/t/kibana-discover-search-download/296802 "2022-02-10T09:13:08Z")
I know we can download or export discover search results as csv but I want to know in which version and how? I am currently using 7.4.0 --- ## [How to set-up Hot, Warm and cold for single node Elasticsearch?](https://discuss.elastic.co/t/how-to-set-up-hot-warm-and-cold-for-single-node-elasticsearch/296797)
**Author:** [@Ramesh\_balasubramani](https://discuss.elastic.co/u/Ramesh_balasubramani)\ **Replies:** 8\ **Last updated:** [February 10, 2022, 9:02am UTC](https://discuss.elastic.co/t/how-to-set-up-hot-warm-and-cold-for-single-node-elasticsearch/296797 "2022-02-10T09:02:21Z")
How to set up Hot, Warm and cold for single node Elasticsearch? --- ## [Monthly query performance on too many shards](https://discuss.elastic.co/t/monthly-query-performance-on-too-many-shards/296429)
**Author:** [@alissan](https://discuss.elastic.co/u/alissan)\ **Replies:** 10\ **Last updated:** [February 10, 2022, 8:48am UTC](https://discuss.elastic.co/t/monthly-query-performance-on-too-many-shards/296429 "2022-02-10T08:48:03Z")
Hello, I have an Elasticsearch cluster on 5 nodes. I use Elasticsearch for log management and 3 indexes are created every hour (1 shard, 0 replica) Every log line have 20-70 fields, like IP, port, hostname, user agent… --- ## [Create an index that includes aggs](https://discuss.elastic.co/t/create-an-index-that-includes-aggs/296813)
**Author:** [@b.kaliuzhnyi](https://discuss.elastic.co/u/b.kaliuzhnyi)\ **Replies:** 2\ **Last updated:** [February 10, 2022, 8:39am UTC](https://discuss.elastic.co/t/create-an-index-that-includes-aggs/296813 "2022-02-10T08:39:00Z")
Can I create an index with data obtained with bucket aggregation from another index? For example: old\_index: fox; dog; dog; fox; fox; new\_index: fox, 3; dog, 2; Is it possible to do this for some indexes within ILM… --- ## [Auditbeat collects old data on Linux system](https://discuss.elastic.co/t/auditbeat-collects-old-data-on-linux-system/296814)
**Author:** [@Bo\_Pham\_Nguyen](https://discuss.elastic.co/u/Bo_Pham_Nguyen)\ **Replies:** 0\ **Last updated:** [February 10, 2022, 8:29am UTC](https://discuss.elastic.co/t/auditbeat-collects-old-data-on-linux-system/296814 "2022-02-10T08:29:12Z")
Hi team, we are facing an issue when installing Auditbeat on a new machine that collects historical data 2020 2021. Any way to fix this? This is the configuration for Auditbeat auditbeat.modules: - module: system d… --- ## [Creating alert using API heartbeat endpoint](https://discuss.elastic.co/t/creating-alert-using-api-heartbeat-endpoint/296693)
**Author:** [@eddieyee](https://discuss.elastic.co/u/eddieyee)\ **Replies:** 3\ **Last updated:** [February 10, 2022, 8:27am UTC](https://discuss.elastic.co/t/creating-alert-using-api-heartbeat-endpoint/296693 "2022-02-10T08:27:26Z")
Hi I have a few API heartbeat endpoint to check the API service is running fine. Is it possible to create alerts on these heartbeat? [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1057) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1059)