# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1078 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1079 --- ## [Specifics around local store recovery and out-of-sync shards](https://discuss.elastic.co/t/specifics-around-local-store-recovery-and-out-of-sync-shards/295401)
**Author:** [@Bryan\_Warner](https://discuss.elastic.co/u/Bryan_Warner)\ **Replies:** 4\ **Last updated:** [January 26, 2022, 5:42pm UTC](https://discuss.elastic.co/t/specifics-around-local-store-recovery-and-out-of-sync-shards/295401 "2022-01-26T17:42:51Z")
Hello, I'm trying to understand better how local shard data is recovered after a node comes back online (e.g. after a crash). I believe this recovery is called a "local store recovery" as stated in Index recovery API | … --- ## [Elastic Agent installed on Elastic Servers](https://discuss.elastic.co/t/elastic-agent-installed-on-elastic-servers/295489)
**Author:** [@bob.newell](https://discuss.elastic.co/u/bob.newell)\ **Replies:** 0\ **Last updated:** [January 26, 2022, 4:43pm UTC](https://discuss.elastic.co/t/elastic-agent-installed-on-elastic-servers/295489 "2022-01-26T16:43:41Z")
Is it possible to install the elastic agent on the elastic servers so that they can be included in the log data? --- ## [Importing existing index from one server to other](https://discuss.elastic.co/t/importing-existing-index-from-one-server-to-other/295487)
**Author:** [@ac123](https://discuss.elastic.co/u/ac123)\ **Replies:** 1\ **Last updated:** [January 26, 2022, 4:38pm UTC](https://discuss.elastic.co/t/importing-existing-index-from-one-server-to-other/295487 "2022-01-26T16:38:47Z")
Hello all, I was wondering the method of importing a single index from one server to another. Currently using restore from backup but one of the indexes are not populating on the main server but is working fine on our d… --- ## [CentOS Yum Repo Issues](https://discuss.elastic.co/t/centos-yum-repo-issues/294619)
**Author:** [@dgoldsmith](https://discuss.elastic.co/u/dgoldsmith)\ **Replies:** 2\ **Last updated:** [January 26, 2022, 4:34pm UTC](https://discuss.elastic.co/t/centos-yum-repo-issues/294619 "2022-01-26T16:34:58Z")
If I simply point a server to the Elastic Yum repo at https://artifacts.elastic.co/packages/7.x/yum/ using a copy of the Yum repo config file provided from the elastic web site, it is able to reach out and retrieve the Y… --- ## [Creating a new pipeline in Logstash](https://discuss.elastic.co/t/creating-a-new-pipeline-in-logstash/295478)
**Author:** [@goncalobsantos](https://discuss.elastic.co/u/goncalobsantos)\ **Replies:** 1\ **Last updated:** [January 26, 2022, 4:16pm UTC](https://discuss.elastic.co/t/creating-a-new-pipeline-in-logstash/295478 "2022-01-26T16:16:58Z")
Step 1. I have edited the pipelines.yml file, adding a third pipeline to the two already existing. Step 2. The corresponding configuration file is placed in the /conf.d folder. Step 3. I stoped and started logstash, ex… --- ## [Logstash with many config files vs one config with many files](https://discuss.elastic.co/t/logstash-with-many-config-files-vs-one-config-with-many-files/295473)
**Author:** [@nikssssss](https://discuss.elastic.co/u/nikssssss)\ **Replies:** 2\ **Last updated:** [January 26, 2022, 3:44pm UTC](https://discuss.elastic.co/t/logstash-with-many-config-files-vs-one-config-with-many-files/295473 "2022-01-26T15:44:46Z")
hello everybody, i have not understand what is the best solution if you have many input files. Should you use one config file with the configuration of input files or create one config file per input file. (ex. 5-10 fil… --- ## [Metricbeat Index pattern](https://discuss.elastic.co/t/metricbeat-index-pattern/295340)
**Author:** [@Christer\_Palmen](https://discuss.elastic.co/u/Christer_Palmen)\ **Replies:** 2\ **Last updated:** [January 26, 2022, 3:41pm UTC](https://discuss.elastic.co/t/metricbeat-index-pattern/295340 "2022-01-26T15:41:32Z")
Hello. I have noticed some issues with my metricbeat dashboard. I installed metricbeat 7.14 in 57 hosts before Christmas and the dashboard worked fine. Went to Christmas holidays and came back with noticing an error m… --- ## [The logstash container crashes the network of the host machine and then exit with OOM killer](https://discuss.elastic.co/t/the-logstash-container-crashes-the-network-of-the-host-machine-and-then-exit-with-oom-killer/295477)
**Author:** [@Ahmad\_BenMaallem](https://discuss.elastic.co/u/Ahmad_BenMaallem)\ **Replies:** 0\ **Last updated:** [January 26, 2022, 3:36pm UTC](https://discuss.elastic.co/t/the-logstash-container-crashes-the-network-of-the-host-machine-and-then-exit-with-oom-killer/295477 "2022-01-26T15:36:51Z")
Hello, I am trying to run a logstash 7.14.1 with docker-compose to collect logs from multiple files and write them to a remote Elasticsearch. After starting, logstash manages to send my logs to Elasticsearch without pr… --- ## [ElasticSearch Read/Write performance issue on Peak Load](https://discuss.elastic.co/t/elasticsearch-read-write-performance-issue-on-peak-load/295216)
**Author:** [@sahil441](https://discuss.elastic.co/u/sahil441)\ **Replies:** 3\ **Last updated:** [January 26, 2022, 3:26pm UTC](https://discuss.elastic.co/t/elasticsearch-read-write-performance-issue-on-peak-load/295216 "2022-01-26T15:26:21Z")
Context: We are running ES Cluster (ES Version - "7.9.1") with 3 Master-Nodes & 8 data-nodes (AWS-"r5.2xlarge") We are using the default ES thread pool configuration There are 2 indices having 5 shards each (used by th… --- ## [Logs are not received on the Fleet server](https://discuss.elastic.co/t/logs-are-not-received-on-the-fleet-server/295345)
**Author:** [@b.kaliuzhnyi](https://discuss.elastic.co/u/b.kaliuzhnyi)\ **Replies:** 4\ **Last updated:** [January 26, 2022, 3:02pm UTC](https://discuss.elastic.co/t/logs-are-not-received-on-the-fleet-server/295345 "2022-01-26T15:02:53Z")
The situation is similar to that of the link: https://discuss.elastic.co/t/elastic-agent-error/282706 I have installed two Elastic Agents, one of them as a Fleet server. Their status is Healthy. The fleet server policy… --- ## [Pipe to pipe with multiline codec on the second pipe](https://discuss.elastic.co/t/pipe-to-pipe-with-multiline-codec-on-the-second-pipe/295456)
**Author:** [@John\_Smith1](https://discuss.elastic.co/u/John_Smith1)\ **Replies:** 4\ **Last updated:** [January 26, 2022, 2:51pm UTC](https://discuss.elastic.co/t/pipe-to-pipe-with-multiline-codec-on-the-second-pipe/295456 "2022-01-26T14:51:33Z")
It's seems impossible, but just in case want to ask, is there some way to apply multiline code plugin in the second pipe, that receive logs from first pipe. first pipe pipe\_01.conf output: pipeline { send\_to =\>… --- ## [Watcher - Use field data from input to condition script calc](https://discuss.elastic.co/t/watcher-use-field-data-from-input-to-condition-script-calc/295427)
**Author:** [@gerardgorrion](https://discuss.elastic.co/u/gerardgorrion)\ **Replies:** 1\ **Last updated:** [January 26, 2022, 2:49pm UTC](https://discuss.elastic.co/t/watcher-use-field-data-from-input-to-condition-script-calc/295427 "2022-01-26T14:49:55Z")
We are triying to deploy a watcher alert to compare values into a field of some logs The problem is: we need to compare 2 fields loaded in input: 1- metricbeat logs with some specific field 2- metricbeat logs with so… --- ## [Documentation issue for elastic version 8 breaking changes](https://discuss.elastic.co/t/documentation-issue-for-elastic-version-8-breaking-changes/294416)
**Author:** [@raulk89](https://discuss.elastic.co/u/raulk89)\ **Replies:** 1\ **Last updated:** [January 26, 2022, 2:48pm UTC](https://discuss.elastic.co/t/documentation-issue-for-elastic-version-8-breaking-changes/294416 "2022-01-26T14:48:53Z")
Hi https://www.elastic.co/guide/en/elasticsearch/reference/8.0/migrating-8.0.html#breaking-changes-8.0 How one should understand this, seems like contrary sentences..? Regards Raul --- ## [Logstash LogStash::Error: Don’t know how to handle \`Java::JavaLang::IllegalArgumentException\` for \`PipelineAction::Create\\`](https://discuss.elastic.co/t/logstash-logstash-don-t-know-how-to-handle-java-illegalargumentexception-for-pipelineaction-create-main/295468)
**Author:** [@Faisal\_Malik](https://discuss.elastic.co/u/Faisal_Malik)\ **Replies:** 0\ **Last updated:** [January 26, 2022, 2:44pm UTC](https://discuss.elastic.co/t/logstash-logstash-don-t-know-how-to-handle-java-illegalargumentexception-for-pipelineaction-create-main/295468 "2022-01-26T14:44:43Z")
My logstash was working fine through the Helm chart in Kubernetes stateful set. I updated the logstash version from 7.9 to 7.16.2 but its don't work so I revert to the previous version 7.9 After reverting it also gives … --- ## [Creating a Custom Beat](https://discuss.elastic.co/t/creating-a-custom-beat/295366)
**Author:** [@Markus\_Lindner](https://discuss.elastic.co/u/Markus_Lindner)\ **Replies:** 1\ **Last updated:** [January 26, 2022, 2:43pm UTC](https://discuss.elastic.co/t/creating-a-custom-beat/295366 "2022-01-26T14:43:36Z")
Hi, does someone have a current ( 2021 + ) documentation for creating a custom beat? Or an idea how I can deliver custom data to my elastic database? When i try to change a community beat, i cant make (make setup) it. … --- ## [Metricbeats can't recognize kubernetes dns](https://discuss.elastic.co/t/metricbeats-cant-recognize-kubernetes-dns/295389)
**Author:** [@Sebastian\_Randoll\_Le](https://discuss.elastic.co/u/Sebastian_Randoll_Le)\ **Replies:** 1\ **Last updated:** [January 26, 2022, 2:38pm UTC](https://discuss.elastic.co/t/metricbeats-cant-recognize-kubernetes-dns/295389 "2022-01-26T14:38:19Z")
Hello I'm using ECK 1.19 and I'm implementing monitoring with beat use the following: --- apiVersion: beat.k8s.elastic.co/v1beta1 kind: Beat metadata: name: metricbeat spec: type: metricbeat version: 7.16.2 ela… --- ## [\[PLEASE\_HELP\] Consistent searching with search\_after](https://discuss.elastic.co/t/please-help-consistent-searching-with-search-after/294033)
**Author:** [@Juan\_Longo](https://discuss.elastic.co/u/Juan_Longo)\ **Replies:** 2\ **Last updated:** [January 26, 2022, 2:13pm UTC](https://discuss.elastic.co/t/please-help-consistent-searching-with-search-after/294033 "2022-01-26T14:13:50Z")
Hello, I need help making one of our queries consistent. We currently make a query that handles a big amount of documents. The problem I'm having is with an index that have documents that literally have the same properti… --- ## [Broken Grok filter since V7.10.0](https://discuss.elastic.co/t/broken-grok-filter-since-v7-10-0/295379)
**Author:** [@Landong.Zuo](https://discuss.elastic.co/u/Landong.Zuo)\ **Replies:** 2\ **Last updated:** [January 26, 2022, 2:09pm UTC](https://discuss.elastic.co/t/broken-grok-filter-since-v7-10-0/295379 "2022-01-26T14:09:22Z")
Hi , I've recently upgraded logstash from V7.6.0 to V7.16.3. and have seen some odd behaviors of Grok filter since then. filter { grok { patterns\_dir =\> "C:\\software\\ELK\\config\\patterns" … --- ## [Painless error](https://discuss.elastic.co/t/painless-error/295335)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 3\ **Last updated:** [January 25, 2022, 4:24pm UTC](https://discuss.elastic.co/t/painless-error/295335 "2022-01-25T16:24:54Z")
Question is easy (and yes I am new to this painfull stuff), what am I doing wrong? { "docs": \[ { "error": { "root\_cause": \[ { "type": "script\_exception", "reason": "… --- ## [All beats have missing documents or timestamp not accurate](https://discuss.elastic.co/t/all-beats-have-missing-documents-or-timestamp-not-accurate/295065)
**Author:** [@cctk](https://discuss.elastic.co/u/cctk)\ **Replies:** 6\ **Last updated:** [January 26, 2022, 1:38pm UTC](https://discuss.elastic.co/t/all-beats-have-missing-documents-or-timestamp-not-accurate/295065 "2022-01-26T13:38:51Z")
I am experiencing several documents missing after the upgrade to 7.0. Metricbeat dashboard used to show a regular update of the cpu and memory , however now it now shows a dash (-) for 1m before showing update. this make… --- ## [Extracting key pair Values using nested Json Paths](https://discuss.elastic.co/t/extracting-key-pair-values-using-nested-json-paths/295419)
**Author:** [@vaseemQA](https://discuss.elastic.co/u/vaseemQA)\ **Replies:** 4\ **Last updated:** [January 26, 2022, 1:35pm UTC](https://discuss.elastic.co/t/extracting-key-pair-values-using-nested-json-paths/295419 "2022-01-26T13:35:26Z")
Hi Guys, I'm Using Json plugin in filter and trying to fetch a value which resides in below json path. parsedJson.query.bool.filter\[0\].bool.must\[0\].bool.must\[2\].term\["list\_attributes.orderId.long"\].value and actually … --- ## [org.elasticsearch.ElasticsearchException: Failed to parse info response. Check logs for detailed information - Unsupported Content-Type: text/html](https://discuss.elastic.co/t/org-elasticsearch-elasticsearchexception-failed-to-parse-info-response-check-logs-for-detailed-information-unsupported-content-type-text-html/295417)
**Author:** [@Sumit\_Jha1](https://discuss.elastic.co/u/Sumit_Jha1)\ **Replies:** 5\ **Last updated:** [January 26, 2022, 11:22am UTC](https://discuss.elastic.co/t/org-elasticsearch-elasticsearchexception-failed-to-parse-info-response-check-logs-for-detailed-information-unsupported-content-type-text-html/295417 "2022-01-26T11:22:58Z")
I am using Elastic Search High Level REST API 7.15.0 (Java) and the version of ES deployed on elastic.co is 7.15.2 When making any request using the client, in the logs I can see, the client first makes call to cluster … --- ## [Duplicate Documents](https://discuss.elastic.co/t/duplicate-documents/295343)
**Author:** [@driveirk](https://discuss.elastic.co/u/driveirk)\ **Replies:** 2\ **Last updated:** [January 26, 2022, 10:15am UTC](https://discuss.elastic.co/t/duplicate-documents/295343 "2022-01-26T10:15:07Z")
If there are communication problems, then in some cases the logs come 2 or 3 times, all the logs of one call are duplicated. Functionbeat config: functionbeat: provider: aws: deploy\_bucket: functionbeat-dep… --- ## [Logstash-plugin.bat fails to find bundled Java in 7.16.1](https://discuss.elastic.co/t/logstash-plugin-bat-fails-to-find-bundled-java-in-7-16-1/295358)
**Author:** [@stevedearl](https://discuss.elastic.co/u/stevedearl)\ **Replies:** 3\ **Last updated:** [January 26, 2022, 9:54am UTC](https://discuss.elastic.co/t/logstash-plugin-bat-fails-to-find-bundled-java-in-7-16-1/295358 "2022-01-26T09:54:07Z")
Hi All, I upgraded to 7.16.1 a little while back and noticed today that when I try to list the installed plugins I get the following error: C:\\APPS\\ELASTIC\\logstash-7.16.1\\bin\>logstash-plugin.bat list "Using bundled JD… --- ## [New installation - unable to start Elastic search on our harden RHEL8 image](https://discuss.elastic.co/t/new-installation-unable-to-start-elastic-search-on-our-harden-rhel8-image/295440)
**Author:** [@jokem48](https://discuss.elastic.co/u/jokem48)\ **Replies:** 0\ **Last updated:** [January 26, 2022, 9:38am UTC](https://discuss.elastic.co/t/new-installation-unable-to-start-elastic-search-on-our-harden-rhel8-image/295440 "2022-01-26T09:38:53Z")
Fresh install in our newly created RHEL8 vm. When we download and try to start Elasticsearch for the first time, we encounter an error. systemctl status ● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/l… --- ## [Elastic driver](https://discuss.elastic.co/t/elastic-driver/295425)
**Author:** [@bertvervaele](https://discuss.elastic.co/u/bertvervaele)\ **Replies:** 0\ **Last updated:** [January 26, 2022, 7:13am UTC](https://discuss.elastic.co/t/elastic-driver/295425 "2022-01-26T07:13:26Z")
Hi everyone, I encountered a wierd issue with the http encoding of the Elastic driver. In some of my projects it translates the '/' to '%2f' as it should and in others it doesn't. Any ideas are welcome :slight\_smile: … --- ## [Can't login in Kibana with any of the built-in users](https://discuss.elastic.co/t/cant-login-in-kibana-with-any-of-the-built-in-users/295248)
**Author:** [@Penchev](https://discuss.elastic.co/u/Penchev)\ **Replies:** 2\ **Last updated:** [January 26, 2022, 7:07am UTC](https://discuss.elastic.co/t/cant-login-in-kibana-with-any-of-the-built-in-users/295248 "2022-01-26T07:07:50Z")
Hi folks, I've just recently updated from 6.8.22 to 7.14.2. I configured the username and password of Kibana in the kibana keystore. My Elasticsearch cluster is up and running I can send requests via curl. I try to a… --- ## [Use global field](https://discuss.elastic.co/t/use-global-field/295420)
**Author:** [@ratseba](https://discuss.elastic.co/u/ratseba)\ **Replies:** 0\ **Last updated:** [January 26, 2022, 6:40am UTC](https://discuss.elastic.co/t/use-global-field/295420 "2022-01-26T06:40:07Z")
Hi, I have several environments with beats and logstash who write to one Elasticsearch. Each of them have properties like: customer, environmnet type ( production, test) and type (depending on what they are for). In ea… --- ## [Filebeats for configuration file](https://discuss.elastic.co/t/filebeats-for-configuration-file/295142)
**Author:** [@ratseba](https://discuss.elastic.co/u/ratseba)\ **Replies:** 4\ **Last updated:** [January 26, 2022, 6:16am UTC](https://discuss.elastic.co/t/filebeats-for-configuration-file/295142 "2022-01-26T06:16:21Z")
Hi, I need send content of config file from some service to Elasticsearch. This file not change often (max ten times a year). This file have structure like: version=77.1.2 ActiveModule=monitoring, tts, asr LicenseNumbe… --- ## [ML: count vs low/high-count detector functions](https://discuss.elastic.co/t/ml-count-vs-low-high-count-detector-functions/293329)
**Author:** [@shabnam](https://discuss.elastic.co/u/shabnam)\ **Replies:** 2\ **Last updated:** [January 26, 2022, 6:03am UTC](https://discuss.elastic.co/t/ml-count-vs-low-high-count-detector-functions/293329 "2022-01-26T06:03:26Z")
Hello I would like to know what is the difference between “count”, “low count”, and “high count”. I assume that “count” function includes the results from “low count”, "high count" and more ever. Please correct me if I… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1077) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1079)