# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1096 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1097 --- ## [Metricbeat error while enabling windows metrics](https://discuss.elastic.co/t/metricbeat-error-while-enabling-windows-metrics/294245)
**Author:** [@inmar](https://discuss.elastic.co/u/inmar)\ **Replies:** 0\ **Last updated:** [January 13, 2022, 8:41am UTC](https://discuss.elastic.co/t/metricbeat-error-while-enabling-windows-metrics/294245 "2022-01-13T08:41:06Z")
Hi I am running ES stack on linux ubuntu inside windows hyper-v VM. I installed metricbeat with deb package, enabled system metrics everything worked well. I want to add windows metrics to be collected in the ES. Whe… --- ## [Cannot group using alias columns](https://discuss.elastic.co/t/cannot-group-using-alias-columns/294241)
**Author:** [@yanghao](https://discuss.elastic.co/u/yanghao)\ **Replies:** 0\ **Last updated:** [January 13, 2022, 7:31am UTC](https://discuss.elastic.co/t/cannot-group-using-alias-columns/294241 "2022-01-13T07:31:30Z")
This sql query could get result POST /\_sql?format=txt { "query": "select dt,sum(pay\_order\_cnt\_1d) from (select dt,pay\_order\_cnt\_1d from sol\_t\_order\_home)t1 group by dt" } but when executing this sql query POST /\_sql… --- ## [How to combine prefix query with synonym filter in Elasticsearch?](https://discuss.elastic.co/t/how-to-combine-prefix-query-with-synonym-filter-in-elasticsearch/294235)
**Author:** [@learningmore](https://discuss.elastic.co/u/learningmore)\ **Replies:** 1\ **Last updated:** [January 13, 2022, 7:26am UTC](https://discuss.elastic.co/t/how-to-combine-prefix-query-with-synonym-filter-in-elasticsearch/294235 "2022-01-13T07:26:18Z")
I'm currently using Elasticsearch 7.16 and came across an issue. Assume that we have the following data: horse mouse chicken rooster duck cow Let's assume the synonym file has the following entries (i.e. rooster and c… --- ## [Can we create a Index life cycle policy with Hot, Warm and Cold phase in a two node cluster(1 data node, 1 master)?](https://discuss.elastic.co/t/can-we-create-a-index-life-cycle-policy-with-hot-warm-and-cold-phase-in-a-two-node-cluster-1-data-node-1-master/294133)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 4\ **Last updated:** [January 13, 2022, 6:04am UTC](https://discuss.elastic.co/t/can-we-create-a-index-life-cycle-policy-with-hot-warm-and-cold-phase-in-a-two-node-cluster-1-data-node-1-master/294133 "2022-01-13T06:04:58Z")
Can we create an Index life cycle policy with Hot, Warm, and Cold phases in a two-node cluster(1 data node, 1 master)? what can be the architecture of policy and what configurations are required for both Elastic nodes? --- ## [Terrible low performance search despite enough resources](https://discuss.elastic.co/t/terrible-low-performance-search-despite-enough-resources/293992)
**Author:** [@zarmci](https://discuss.elastic.co/u/zarmci)\ **Replies:** 3\ **Last updated:** [January 13, 2022, 5:48am UTC](https://discuss.elastic.co/t/terrible-low-performance-search-despite-enough-resources/293992 "2022-01-13T05:48:18Z")
We have two 3-nodes Elasticsearch cluster. Despite these clusters have approximately similar resources and the indices are quite similar, the speed of search in one of them is tenfold slower than another. We spent a lot … --- ## [I can't ingest time longer than 24 hours](https://discuss.elastic.co/t/i-cant-ingest-time-longer-than-24-hours/294168)
**Author:** [@Eric\_Barreto](https://discuss.elastic.co/u/Eric_Barreto)\ **Replies:** 2\ **Last updated:** [January 13, 2022, 5:44am UTC](https://discuss.elastic.co/t/i-cant-ingest-time-longer-than-24-hours/294168 "2022-01-13T05:44:24Z")
I need to create a dashboard based on a json that will be ingested repeatedly, this json has 2 fields of type time the first field is TA and the second is TT. The value of these fields is represented by HH:mm:ss, but th… --- ## [Missing replica shards](https://discuss.elastic.co/t/missing-replica-shards/294164)
**Author:** [@Latifa\_MASMOUDI](https://discuss.elastic.co/u/Latifa_MASMOUDI)\ **Replies:** 1\ **Last updated:** [January 13, 2022, 5:34am UTC](https://discuss.elastic.co/t/missing-replica-shards/294164 "2022-01-13T05:34:46Z")
hi community i'm a beginner in ELK, so i can't resolve this problem. the Elasticsearch overview show me that are Missing replica shards, also the health is yellow. Also, i uploaded a file to kibana, but it can't vis… --- ## [Data Integration between Hadoop - Hive and Elastic Search](https://discuss.elastic.co/t/data-integration-between-hadoop-hive-and-elastic-search/294037)
**Author:** [@Kishanu\_Bhattacharya](https://discuss.elastic.co/u/Kishanu_Bhattacharya)\ **Replies:** 2\ **Last updated:** [January 13, 2022, 4:41am UTC](https://discuss.elastic.co/t/data-integration-between-hadoop-hive-and-elastic-search/294037 "2022-01-13T04:41:56Z")
There are a few questions about a use case in which I am presently working, This is related to establishing a data pipeline(Data Integration) from Hadoop to Elasticsearch. I did a few quick POCs by creating the indices … --- ## [Percentage in Kibana visualization](https://discuss.elastic.co/t/percentage-in-kibana-visualization/294015)
**Author:** [@Tzlil](https://discuss.elastic.co/u/Tzlil)\ **Replies:** 2\ **Last updated:** [January 13, 2022, 4:19am UTC](https://discuss.elastic.co/t/percentage-in-kibana-visualization/294015 "2022-01-13T04:19:12Z")
i want to calculate the percentage of "pass" tests i have a scripted filed that return 1 when a test is "pass" at the moment i have a graph that shows the number of tests that ran( pass/fail/warning) how can i change … --- ## [How to calculate the percentage of a metric through JSON?](https://discuss.elastic.co/t/how-to-calculate-the-percentage-of-a-metric-through-json/294157)
**Author:** [@rcmv](https://discuss.elastic.co/u/rcmv)\ **Replies:** 2\ **Last updated:** [January 13, 2022, 4:09am UTC](https://discuss.elastic.co/t/how-to-calculate-the-percentage-of-a-metric-through-json/294157 "2022-01-13T04:09:47Z")
Hi! I'm new with Elastic so this is most probably an easy question but I would appreciate some help here. I have a dashboard on Kibana where I want to add a vertical bar chart which presents me the results of the tests… --- ## ["Azure Data Explorer" output plugin error](https://discuss.elastic.co/t/azure-data-explorer-output-plugin-error/294197)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 4\ **Last updated:** [January 13, 2022, 2:45am UTC](https://discuss.elastic.co/t/azure-data-explorer-output-plugin-error/294197 "2022-01-13T02:45:11Z")
Hello All, Using the kusto output plugin for Azure Data explorer I did a successful test with the example as per the documentation below References: Ingest data from Logstash to Azure Data Explorer | Microsoft Docs G… --- ## [How to run script query on logstash](https://discuss.elastic.co/t/how-to-run-script-query-on-logstash/294227)
**Author:** [@mzinboy](https://discuss.elastic.co/u/mzinboy)\ **Replies:** 0\ **Last updated:** [January 13, 2022, 2:24am UTC](https://discuss.elastic.co/t/how-to-run-script-query-on-logstash/294227 "2022-01-13T02:24:13Z")
It doesn't work(logstash 7.15.1). I can't escape single quotes in query field. Elasticsearch input value : input { elasticsearch { hosts =\> \["..."\] index =\> "..." query =\> '{ "query": { "bool": { "… --- ## [Data stream vs index](https://discuss.elastic.co/t/data-stream-vs-index/294202)
**Author:** [@Rahul\_Dey](https://discuss.elastic.co/u/Rahul_Dey)\ **Replies:** 1\ **Last updated:** [January 12, 2022, 10:40pm UTC](https://discuss.elastic.co/t/data-stream-vs-index/294202 "2022-01-12T22:40:45Z")
What are the benefits of using data stream instead of using index for storing data in Elasticsearch. I would like to store continuously generated data. --- ## [Log4j security vulnerability for logstash 6.2.2](https://discuss.elastic.co/t/log4j-security-vulnerability-for-logstash-6-2-2/294205)
**Author:** [@ellje](https://discuss.elastic.co/u/ellje)\ **Replies:** 0\ **Last updated:** [January 12, 2022, 8:46pm UTC](https://discuss.elastic.co/t/log4j-security-vulnerability-for-logstash-6-2-2/294205 "2022-01-12T20:46:46Z")
Hi, I'm using an older version of Logstash (6.2.2) and I cannot migrate it just yet. In the meantime, I read that to remediate the log4j issue, we should be removing the jndi class as noted in Apache Log4j2 Remote Code … --- ## [Can you manually curl geoip.elastic.co to get geo data?](https://discuss.elastic.co/t/can-you-manually-curl-geoip-elastic-co-to-get-geo-data/294206)
**Author:** [@spuder](https://discuss.elastic.co/u/spuder)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 10:07pm UTC](https://discuss.elastic.co/t/can-you-manually-curl-geoip-elastic-co-to-get-geo-data/294206 "2022-01-12T22:07:15Z")
I have an Elasticsearch cluster that does not have internet access for security. According to the documentaiton it is possible to mirror your own geoip endpoint I have a mirror setup, however I'm unable to test if the… --- ## [Logstash with log4j 2.17.1 patch release](https://discuss.elastic.co/t/logstash-with-log4j-2-17-1-patch-release/294195)
**Author:** [@ld\_pvl](https://discuss.elastic.co/u/ld_pvl)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 9:09pm UTC](https://discuss.elastic.co/t/logstash-with-log4j-2-17-1-patch-release/294195 "2022-01-12T21:09:49Z")
Hi Logstash team, The current latest logstash version 7.16.2 is bundled with log4j 2.17.0. Are there any plans to release a new patch version with log4j 2.17.1? Many thanks, --- ## [(another) Custome Index Name for Filebeat](https://discuss.elastic.co/t/another-custome-index-name-for-filebeat/293283)
**Author:** [@mhare](https://discuss.elastic.co/u/mhare)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 8:44pm UTC](https://discuss.elastic.co/t/another-custome-index-name-for-filebeat/293283 "2022-01-12T20:44:44Z")
First: Happy New Year! Second: I have seen various other posts on this topic, but they always seem to timeout before getting to an answer. I an running ELK 7.13.4 I have an Elasticsearch that ingests data from multipl… --- ## [Does Heartbeat have feature like Logstash pipeline?](https://discuss.elastic.co/t/does-heartbeat-have-feature-like-logstash-pipeline/292793)
**Author:** [@Ray\_Lin](https://discuss.elastic.co/u/Ray_Lin)\ **Replies:** 3\ **Last updated:** [January 12, 2022, 8:30pm UTC](https://discuss.elastic.co/t/does-heartbeat-have-feature-like-logstash-pipeline/292793 "2022-01-12T20:30:19Z")
Hi, I am trying to monitor a healthcheck url but it has to first call a token API to get the token then pass the token value to the next healthcheck API which I actually want to monitor. In the past, I'm using Logstash… --- ## [Wrong response code sent by heartbeat](https://discuss.elastic.co/t/wrong-response-code-sent-by-heartbeat/294132)
**Author:** [@Fosco](https://discuss.elastic.co/u/Fosco)\ **Replies:** 1\ **Last updated:** [January 12, 2022, 8:29pm UTC](https://discuss.elastic.co/t/wrong-response-code-sent-by-heartbeat/294132 "2022-01-12T20:29:03Z")
Hello, I am using heartbeat to retrieve the code 200 from a website, but for the moment the website is returning a 500 code. But heartbeat is returning 200.. I am using the 7.10.2 version of heartbeat (on the 7.9.2 it'… --- ## [Create Parent-Child relationship with Logstash](https://discuss.elastic.co/t/create-parent-child-relationship-with-logstash/294198)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 3\ **Last updated:** [January 12, 2022, 8:22pm UTC](https://discuss.elastic.co/t/create-parent-child-relationship-with-logstash/294198 "2022-01-12T20:22:19Z")
Hi Everyone; I need to create a Parent-Chield relationship with Logstash. I created index like this. Here is the mapping I try to create relationship using filter mutate as below picture But I am getting this… --- ## [Auto Refresh Kibana Dashboards](https://discuss.elastic.co/t/auto-refresh-kibana-dashboards/294185)
**Author:** [@Rahul\_Dey](https://discuss.elastic.co/u/Rahul_Dey)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 7:11pm UTC](https://discuss.elastic.co/t/auto-refresh-kibana-dashboards/294185 "2022-01-12T19:11:17Z")
We have 30-40 Dashboard in Kibana which we use to monitor different applications. The problem is we have to refresh the dashboard frequently to see the latest results. Is there any global settings through which we can au… --- ## [Logstash pipeline filter](https://discuss.elastic.co/t/logstash-pipeline-filter/294018)
**Author:** [@max\_cyril](https://discuss.elastic.co/u/max_cyril)\ **Replies:** 7\ **Last updated:** [January 12, 2022, 6:36pm UTC](https://discuss.elastic.co/t/logstash-pipeline-filter/294018 "2022-01-12T18:36:47Z")
Hi, I am new to ELK and struggling to write my first logstash pipeline. Can anyone help me to write the filter section? Thanks in advance. i want to filter and only output the maximum of completion per users fo… --- ## [I'm seeing too many requests for a write operation on a node when I query it with the thread pool API](https://discuss.elastic.co/t/im-seeing-too-many-requests-for-a-write-operation-on-a-node-when-i-query-it-with-the-thread-pool-api/293208)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 6:18pm UTC](https://discuss.elastic.co/t/im-seeing-too-many-requests-for-a-write-operation-on-a-node-when-i-query-it-with-the-thread-pool-api/293208 "2022-01-12T18:18:42Z")
Hi everyone, I'm seeing too many requests for a write operation on a node when I query it with the thread pool API. On other nodes, this status appears as 0. It seems like write requests come to only one node. How can I… --- ## [Elasticsearch java api client](https://discuss.elastic.co/t/elasticsearch-java-api-client/294042)
**Author:** [@Arun\_Nath](https://discuss.elastic.co/u/Arun_Nath)\ **Replies:** 8\ **Last updated:** [January 12, 2022, 5:28pm UTC](https://discuss.elastic.co/t/elasticsearch-java-api-client/294042 "2022-01-12T17:28:43Z")
{ "aggs": { "my-agg-name": { "terms": { "field": "my-field" }, "aggs": { "my-sub-agg-name": { "avg": { "field": "my-other-field" } } }… --- ## [Best practice for logging in an microservice-based architecture](https://discuss.elastic.co/t/best-practice-for-logging-in-an-microservice-based-architecture/294023)
**Author:** [@peoh](https://discuss.elastic.co/u/peoh)\ **Replies:** 1\ **Last updated:** [January 12, 2022, 5:16pm UTC](https://discuss.elastic.co/t/best-practice-for-logging-in-an-microservice-based-architecture/294023 "2022-01-12T17:16:46Z")
Hi! My current environment has multiple applications on multiple servers that logs to a local file and then uses Filebeat to send logs to Logstash for processing. This works fine and I like that the logs will show up ev… --- ## [Hyphenation decompounder token filter seems to ignore the \`only\_longest\_match\` option](https://discuss.elastic.co/t/hyphenation-decompounder-token-filter-seems-to-ignore-the-only-longest-match-option/294047)
**Author:** [@Jelena\_Malinovic](https://discuss.elastic.co/u/Jelena_Malinovic)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 5:12pm UTC](https://discuss.elastic.co/t/hyphenation-decompounder-token-filter-seems-to-ignore-the-only-longest-match-option/294047 "2022-01-12T17:12:53Z")
Hi everyone, We are trying to improve searches on our website which include compounds words. For that purpose, we are using the token filter hyphenation\_decompounder. During testing, we found out that only\_longest\_match … --- ## [Docker Swarm - Internode Communication Issue](https://discuss.elastic.co/t/docker-swarm-internode-communication-issue/294176)
**Author:** [@Darryl\_Idle](https://discuss.elastic.co/u/Darryl_Idle)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 4:31pm UTC](https://discuss.elastic.co/t/docker-swarm-internode-communication-issue/294176 "2022-01-12T16:31:14Z")
Hi, My environment for ELK is a Docker Swarm setup. Three containers on three individual hosts to utilize distributed storage. I'm using Swarmpit as my orchestrator to compose the stack as follows: version: '3.3' servi… --- ## [Run multiple queries to MySQL](https://discuss.elastic.co/t/run-multiple-queries-to-mysql/293154)
**Author:** [@vPilot](https://discuss.elastic.co/u/vPilot)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 4:12pm UTC](https://discuss.elastic.co/t/run-multiple-queries-to-mysql/293154 "2022-01-12T16:12:04Z")
I have my mysql.yml file configured to run two separate queries for collecting both processlist details and replication details: - module: mysql metricsets: - status - query queries: - query: … --- ## [Metricbeat on Fleet 20-30% CPU](https://discuss.elastic.co/t/metricbeat-on-fleet-20-30-cpu/293972)
**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\ **Replies:** 4\ **Last updated:** [January 12, 2022, 4:09pm UTC](https://discuss.elastic.co/t/metricbeat-on-fleet-20-30-cpu/293972 "2022-01-12T16:09:24Z")
Hello, I'm having 20% of CPU usage in a brand fresh Ubuntu installation. I'm running under Fleet so I'm not sure where to start/debug. Any advice? Thanks! --- ## [Heap space error (Changes not reflecting even after changes in jvm.options file)](https://discuss.elastic.co/t/heap-space-error-changes-not-reflecting-even-after-changes-in-jvm-options-file/294172)
**Author:** [@Anilkumar061988](https://discuss.elastic.co/u/Anilkumar061988)\ **Replies:** 5\ **Last updated:** [January 12, 2022, 3:48pm UTC](https://discuss.elastic.co/t/heap-space-error-changes-not-reflecting-even-after-changes-in-jvm-options-file/294172 "2022-01-12T15:48:14Z")
Hi Everyone, I am using elastic search 5.1.2 in my application which has 1 node 5 indexes. I am running elastic on a windows machine with 4 core and 14 GB RAM. Java heap space configured was 3G with initial setup, … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1095) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1097)