# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1079 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1080 --- ## [How to increase query speed on search engine?](https://discuss.elastic.co/t/how-to-increase-query-speed-on-search-engine/295361)
**Author:** [@can.ozdemir](https://discuss.elastic.co/u/can.ozdemir)\ **Replies:** 3\ **Last updated:** [January 26, 2022, 5:36am UTC](https://discuss.elastic.co/t/how-to-increase-query-speed-on-search-engine/295361 "2022-01-26T05:36:35Z")
Hello there, We would like to improve the query response time of a search query on the cluster, you may ask what kind of query but I cannot share that information. The query does some full-text searches, then function\_… --- ## [Calculate time difference between two different time values excluding weekends](https://discuss.elastic.co/t/calculate-time-difference-between-two-different-time-values-excluding-weekends/295413)
**Author:** [@ryann](https://discuss.elastic.co/u/ryann)\ **Replies:** 2\ **Last updated:** [January 26, 2022, 5:10am UTC](https://discuss.elastic.co/t/calculate-time-difference-between-two-different-time-values-excluding-weekends/295413 "2022-01-26T05:10:53Z")
Currently have a logstash conf file that is gathering events with two time fields, createdDate and closedDate. Have a ruby code that calculates the time difference which is working as intended but looking for a way to ex… --- ## [Ingest Json data into Elastic Search using filebeat](https://discuss.elastic.co/t/ingest-json-data-into-elastic-search-using-filebeat/293510)
**Author:** [@Magesh\_02](https://discuss.elastic.co/u/Magesh_02)\ **Replies:** 1\ **Last updated:** [January 26, 2022, 3:06am UTC](https://discuss.elastic.co/t/ingest-json-data-into-elastic-search-using-filebeat/293510 "2022-01-26T03:06:57Z")
I attempted to import data from a json file into Elasticsearch, but my filebeat had a configuration issue in filebeat.yml or an issue with the input Because my json is regular json, but filebeat only supports ndjson, Fi… --- ## [Logstash error info : A plugin had an unrecoverable error. Will restart this plugin](https://discuss.elastic.co/t/logstash-error-info-a-plugin-had-an-unrecoverable-error-will-restart-this-plugin/295414)
**Author:** [@seth\_qiang](https://discuss.elastic.co/u/seth_qiang)\ **Replies:** 0\ **Last updated:** [January 26, 2022, 2:52am UTC](https://discuss.elastic.co/t/logstash-error-info-a-plugin-had-an-unrecoverable-error-will-restart-this-plugin/295414 "2022-01-26T02:52:40Z")
hi, everyone my logstash have some errors in my logstash. as follows keywords A plugin had an unrecoverable error. Will restart this plugin. Pipeline\_id:main Error: event executor terminated Exception: Java::JavaUt… --- ## [Date histogram error](https://discuss.elastic.co/t/date-histogram-error/295155)
**Author:** [@EnJay](https://discuss.elastic.co/u/EnJay)\ **Replies:** 11\ **Last updated:** [January 26, 2022, 1:11am UTC](https://discuss.elastic.co/t/date-histogram-error/295155 "2022-01-26T01:11:54Z")
Hello, dear community. Have an error with date histogram. I have a cryptocurrency price base with a 5 minute interval (4 million records). Fields: { "\_source": { "time":… --- ## [Fleet - selfhosted production mode 7.16.3](https://discuss.elastic.co/t/fleet-selfhosted-production-mode-7-16-3/294381)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 3\ **Last updated:** [January 26, 2022, 12:11am UTC](https://discuss.elastic.co/t/fleet-selfhosted-production-mode-7-16-3/294381 "2022-01-26T00:11:27Z")
Hello wonderful people, I'm looking into setting up fleet. So far I have a test server ready and I have generated the certificates using elasticsearch-certutil elasticsearch CA /etc/elasticsearch/certs/elastic-stack-c… --- ## [Fail to start Kibana 7.16.2](https://discuss.elastic.co/t/fail-to-start-kibana-7-16-2/293698)
**Author:** [@chilo](https://discuss.elastic.co/u/chilo)\ **Replies:** 10\ **Last updated:** [January 26, 2022, 12:08am UTC](https://discuss.elastic.co/t/fail-to-start-kibana-7-16-2/293698 "2022-01-26T00:08:28Z")
I have Elasticsearch and kibana running on version 7.9.2 for a very long time without issues. Lately, when I started to deploy Elasticsearch and kibana 7.16.2, I see the 403 error below: {"type":"log","@timestamp":"20… --- ## [ECS Quality Dashboard - ECS Coverage of LogSources](https://discuss.elastic.co/t/ecs-quality-dashboard-ecs-coverage-of-logsources/294806)
**Author:** [@zangero98](https://discuss.elastic.co/u/zangero98)\ **Replies:** 1\ **Last updated:** [January 25, 2022, 10:39pm UTC](https://discuss.elastic.co/t/ecs-quality-dashboard-ecs-coverage-of-logsources/294806 "2022-01-25T22:39:56Z")
Hello :slight\_smile: I'm searching for an ECS Dashboard Template to check if LogSources are sending the Logs right in view of ECS conditions (ECS coverage - Elastic Security ECS field reference | Elastic Security Soluti… --- ## [Logstash TCP Zero Window - Palo Alto logs](https://discuss.elastic.co/t/logstash-tcp-zero-window-palo-alto-logs/295396)
**Author:** [@groth](https://discuss.elastic.co/u/groth)\ **Replies:** 3\ **Last updated:** [January 25, 2022, 10:36pm UTC](https://discuss.elastic.co/t/logstash-tcp-zero-window-palo-alto-logs/295396 "2022-01-25T22:36:06Z")
New to troubleshooting Logstash performance issues. I have a cluster of 3 load balanced virtual servers running Logstash that forward on to Elasticsearch in the cloud. We've noticed that we're not getting all of our logs… --- ## [Kibana service will not start Exit 126](https://discuss.elastic.co/t/kibana-service-will-not-start-exit-126/295286)
**Author:** [@craigothy](https://discuss.elastic.co/u/craigothy)\ **Replies:** 6\ **Last updated:** [January 25, 2022, 10:11pm UTC](https://discuss.elastic.co/t/kibana-service-will-not-start-exit-126/295286 "2022-01-25T22:11:12Z")
Upon trying to start kibana 7.16.3 after a fresh successful install on rhel 8, I am getting the following errors. Any ideas on what the cause could be. Thank you so much for any help. \> \[root@attack-range-elastic-server… --- ## [Differences in PUT requests in ES versions](https://discuss.elastic.co/t/differences-in-put-requests-in-es-versions/295171)
**Author:** [@EnJay](https://discuss.elastic.co/u/EnJay)\ **Replies:** 10\ **Last updated:** [January 25, 2022, 9:53pm UTC](https://discuss.elastic.co/t/differences-in-put-requests-in-es-versions/295171 "2022-01-25T21:53:50Z")
Hello everyone :hatched\_chick: I actively study Elasticsearch. I had to update my version ES to the latest from 5. But here I ran into a problem, the answer to which I could not find in the documentation. I used ES 5 … --- ## [Sorting a field on the view mode](https://discuss.elastic.co/t/sorting-a-field-on-the-view-mode/295251)
**Author:** [@dash5000](https://discuss.elastic.co/u/dash5000)\ **Replies:** 5\ **Last updated:** [January 25, 2022, 9:15pm UTC](https://discuss.elastic.co/t/sorting-a-field-on-the-view-mode/295251 "2022-01-25T21:15:11Z")
Hello Everyone, I was checking the sorting on the table visualization using the lens. I can sort the fields on the table in the edit mode, but i don't see the same option in the view mode. This is the drop down i see i… --- ## [Search templates {{#toJson}} with arrays: unexpected character](https://discuss.elastic.co/t/search-templates-tojson-with-arrays-unexpected-character/295398)
**Author:** [@Tristan2](https://discuss.elastic.co/u/Tristan2)\ **Replies:** 0\ **Last updated:** [January 25, 2022, 8:58pm UTC](https://discuss.elastic.co/t/search-templates-tojson-with-arrays-unexpected-character/295398 "2022-01-25T20:58:29Z")
I'm trying to parameterize \_source in a search template but I'm encountering an error. This is my template: PUT \_scripts/stored-script { "script": { "lang": "mustache", "source": { "\_source": "{{#toJson… --- ## [CPU usage metric via CAT API misbehaving after upgrading to 7.16.3 (running in LXD)](https://discuss.elastic.co/t/cpu-usage-metric-via-cat-api-misbehaving-after-upgrading-to-7-16-3-running-in-lxd/294620)
**Author:** [@juan.domenech](https://discuss.elastic.co/u/juan.domenech)\ **Replies:** 9\ **Last updated:** [January 25, 2022, 8:43pm UTC](https://discuss.elastic.co/t/cpu-usage-metric-via-cat-api-misbehaving-after-upgrading-to-7-16-3-running-in-lxd/294620 "2022-01-25T20:43:01Z")
Problem: In a 10 core CPU, 64GB RAM system, Centos 7.9 under LXD container virtualisation Elasticsearch reports wrong CPU usage after upgrading to 7.16.3 This issue wasn't present on 7.15.1 We use this metric to track … --- ## [Could not determine ID for filter/useragent](https://discuss.elastic.co/t/could-not-determine-id-for-filter-useragent/294270)
**Author:** [@Chris\_Andrews](https://discuss.elastic.co/u/Chris_Andrews)\ **Replies:** 4\ **Last updated:** [January 25, 2022, 8:39pm UTC](https://discuss.elastic.co/t/could-not-determine-id-for-filter-useragent/294270 "2022-01-25T20:39:21Z")
We have upgraded logstash from 7.5.2 to 7.16.2 on three separate instances. The first two upgraded with no issues whatsoever, however the final upgrade encountered this problem and now logstash crashes: Stack trace: \[2… --- ## [Date fields not being treated as timestamp fields in Kibana index patterns](https://discuss.elastic.co/t/date-fields-not-being-treated-as-timestamp-fields-in-kibana-index-patterns/295310)
**Author:** [@abhinav\_chourasia](https://discuss.elastic.co/u/abhinav_chourasia)\ **Replies:** 2\ **Last updated:** [January 25, 2022, 8:17pm UTC](https://discuss.elastic.co/t/date-fields-not-being-treated-as-timestamp-fields-in-kibana-index-patterns/295310 "2022-01-25T20:17:44Z")
I have been trying to get the mapping correct for my date values in my documents. I have come down to doing a lot of hit and trial now with it. Every time and no matter what option I try, I am not getting the date field … --- ## [Ingest Pipeline for Message Field](https://discuss.elastic.co/t/ingest-pipeline-for-message-field/295393)
**Author:** [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Replies:** 0\ **Last updated:** [January 25, 2022, 7:38pm UTC](https://discuss.elastic.co/t/ingest-pipeline-for-message-field/295393 "2022-01-25T19:38:33Z")
We are using the Custom UDP Integration within Fleet. When it collects logs, it throws all the log data into a message field. I'm not very familiar with ingest pipelines and whether or not Grok or Json would be the best … --- ## [Automation test stability trend over time](https://discuss.elastic.co/t/automation-test-stability-trend-over-time/295391)
**Author:** [@Ahsun\_Qureshi](https://discuss.elastic.co/u/Ahsun_Qureshi)\ **Replies:** 0\ **Last updated:** [January 25, 2022, 7:30pm UTC](https://discuss.elastic.co/t/automation-test-stability-trend-over-time/295391 "2022-01-25T19:30:10Z")
Disclaimer: Fairly new to Kibana I am trying to analyse test automation results over time to understand test failures for individual tests. The relevant fields include: test.name (string) test.result (string) As an o… --- ## [Setup lifecycle of "infra" plugin wasn't completed in 10sec. Consider disabling the plugin and re-start](https://discuss.elastic.co/t/setup-lifecycle-of-infra-plugin-wasnt-completed-in-10sec-consider-disabling-the-plugin-and-re-start/294679)
**Author:** [@abhijeet\_k](https://discuss.elastic.co/u/abhijeet_k)\ **Replies:** 2\ **Last updated:** [January 25, 2022, 6:46pm UTC](https://discuss.elastic.co/t/setup-lifecycle-of-infra-plugin-wasnt-completed-in-10sec-consider-disabling-the-plugin-and-re-start/294679 "2022-01-25T18:46:35Z")
I have integrated kibana charts in react web app using an iframe tag, I want to render multiple charts on the same page of my react app. I am facing the issue if I render multiple charts, please refer to the attached ima… --- ## [Yarn kbn bootstrap](https://discuss.elastic.co/t/yarn-kbn-bootstrap/295261)
**Author:** [@Ernesto\_Rodolfo\_Cast](https://discuss.elastic.co/u/Ernesto_Rodolfo_Cast)\ **Replies:** 1\ **Last updated:** [January 25, 2022, 6:33pm UTC](https://discuss.elastic.co/t/yarn-kbn-bootstrap/295261 "2022-01-25T18:33:55Z")
I am trying to run this command: yarn kbn bootstrap and I get this error: ERROR: \[Errno 2\] No such file or directory: 'kbn' I am using Elasticsearch 7.10 Some help please --- ## [Multiple visualization charts are not loading using iframe on web page](https://discuss.elastic.co/t/multiple-visualization-charts-are-not-loading-using-iframe-on-web-page/295029)
**Author:** [@abhijeet\_k](https://discuss.elastic.co/u/abhijeet_k)\ **Replies:** 1\ **Last updated:** [January 25, 2022, 6:17pm UTC](https://discuss.elastic.co/t/multiple-visualization-charts-are-not-loading-using-iframe-on-web-page/295029 "2022-01-25T18:17:30Z")
Hi Folks, I am integrating the visualization charts on react js app using iframe, but if I create multiple charts and load them on the same page then I am getting the following error. Setup lifecycle of "infra" plugin … --- ## [Start over with snapshots](https://discuss.elastic.co/t/start-over-with-snapshots/295376)
**Author:** [@mwise29](https://discuss.elastic.co/u/mwise29)\ **Replies:** 1\ **Last updated:** [January 25, 2022, 6:12pm UTC](https://discuss.elastic.co/t/start-over-with-snapshots/295376 "2022-01-25T18:12:47Z")
We experienced some failed snapshots in one of our non-prod environments and now the snapshots aren't being fired on the configured schedule. We'd like to completely start over with the snapshots in this environment (de… --- ## [The Ingest Pipeline for 365 Defender doesn't populate hostname](https://discuss.elastic.co/t/the-ingest-pipeline-for-365-defender-doesnt-populate-hostname/294312)
**Author:** [@hinchliff](https://discuss.elastic.co/u/hinchliff)\ **Replies:** 1\ **Last updated:** [January 25, 2022, 5:39pm UTC](https://discuss.elastic.co/t/the-ingest-pipeline-for-365-defender-doesnt-populate-hostname/294312 "2022-01-25T17:39:51Z")
We're using the "Microsoft" module in Filebeat to collect data from Microsoft Defender -- both the "defender\_atp" and the "m365\_defender". We're also using the Ingest Pipelines provided via Filebeat to parse and process… --- ## [LogStash V7.16.3 file plugin failed to load](https://discuss.elastic.co/t/logstash-v7-16-3-file-plugin-failed-to-load/295332)
**Author:** [@Landong.Zuo](https://discuss.elastic.co/u/Landong.Zuo)\ **Replies:** 2\ **Last updated:** [January 25, 2022, 5:13pm UTC](https://discuss.elastic.co/t/logstash-v7-16-3-file-plugin-failed-to-load/295332 "2022-01-25T17:13:35Z")
Hi , I've installed Logstash V7.16.3 on Windows 10, and I am struggling to load log files using the following configuration even after deleting the sinceDB input { file { path =\> "C:\\software\\EL… --- ## [Facing problem to break this log in grok pattern](https://discuss.elastic.co/t/facing-problem-to-break-this-log-in-grok-pattern/295305)
**Author:** [@jannatnishat](https://discuss.elastic.co/u/jannatnishat)\ **Replies:** 1\ **Last updated:** [January 25, 2022, 5:02pm UTC](https://discuss.elastic.co/t/facing-problem-to-break-this-log-in-grok-pattern/295305 "2022-01-25T17:02:29Z")
=================== Start: 2022-01-23-16:44:04 ====================== URL:https://www.siikoytto.com/siikoytto/api/v5/selfcare/dpdp/get\_subscriptions Request:{"msisdn":"880139919"} Response:{"status":true,"message":"Su… --- ## [Missing documents in scroll when there is GC on server](https://discuss.elastic.co/t/missing-documents-in-scroll-when-there-is-gc-on-server/295073)
**Author:** [@EtienneMiret](https://discuss.elastic.co/u/EtienneMiret)\ **Replies:** 4\ **Last updated:** [January 25, 2022, 4:52pm UTC](https://discuss.elastic.co/t/missing-documents-in-scroll-when-there-is-gc-on-server/295073 "2022-01-25T16:52:45Z")
When using the scroll API to retrieve large number of documents for batch processing, there are sometimes a number of documents missing. Usually a full page (exactly 10k). When looking at the timestamps of those failing … --- ## [How to paas null in bulk action when updating using helpers in python](https://discuss.elastic.co/t/how-to-paas-null-in-bulk-action-when-updating-using-helpers-in-python/294526)
**Author:** [@bipin\_kumar2](https://discuss.elastic.co/u/bipin_kumar2)\ **Replies:** 2\ **Last updated:** [January 25, 2022, 4:49pm UTC](https://discuss.elastic.co/t/how-to-paas-null-in-bulk-action-when-updating-using-helpers-in-python/294526 "2022-01-25T16:49:57Z")
how to paas null in bulk action when updating using helpers in python , i am passing assing in helpers to update a field as null nut it throws error . action is as below actions = \[ { '\_op\_type': 'update', '\_index':… --- ## [Curator is not deleting ES snapshots](https://discuss.elastic.co/t/curator-is-not-deleting-es-snapshots/293774)
**Author:** [@hudar01](https://discuss.elastic.co/u/hudar01)\ **Replies:** 5\ **Last updated:** [January 25, 2022, 4:27pm UTC](https://discuss.elastic.co/t/curator-is-not-deleting-es-snapshots/293774 "2022-01-25T16:27:00Z")
Hello, Curator is not deleting 7 day old snapshots, even though they're there. I'm using python virtual environment where I've the following installed: (es-curator) \[ec2-user@im es-curator\]$ pip list Package … --- ## [Pubsub input stopped - context deadline exceeded](https://discuss.elastic.co/t/pubsub-input-stopped-context-deadline-exceeded/293585)
**Author:** [@nitzang1](https://discuss.elastic.co/u/nitzang1)\ **Replies:** 1\ **Last updated:** [January 25, 2022, 4:25pm UTC](https://discuss.elastic.co/t/pubsub-input-stopped-context-deadline-exceeded/293585 "2022-01-25T16:25:00Z")
Hi all, I'm facing an issue where filebeat pubsub input stop pulling events just after throwing this error: 2022-01-05T15:30:24.404Z ERROR \[gcp.pubsub\] gcppubsub/input.go:141 context deadline exceeded {"pubsub\_project"… --- ## [Logstash on prem - Kubernetes or not](https://discuss.elastic.co/t/logstash-on-prem-kubernetes-or-not/295372)
**Author:** [@Soren\_vdc](https://discuss.elastic.co/u/Soren_vdc)\ **Replies:** 0\ **Last updated:** [January 25, 2022, 4:15pm UTC](https://discuss.elastic.co/t/logstash-on-prem-kubernetes-or-not/295372 "2022-01-25T16:15:47Z")
Hi, I'm checking for the advantages/disadvantages to install logstash on openshift (On Prem) or VMWare. Someone has some tips/advice/.. ? thanks in advance. [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1078) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1080)