# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1106 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1107 --- ## [Cloudwatch Metric stream to Elastic search](https://discuss.elastic.co/t/cloudwatch-metric-stream-to-elastic-search/293506)
**Author:** [@akb\_2021](https://discuss.elastic.co/u/akb_2021)\ **Replies:** 1\ **Last updated:** [January 5, 2022, 8:53am UTC](https://discuss.elastic.co/t/cloudwatch-metric-stream-to-elastic-search/293506 "2022-01-05T08:53:00Z")
My Objective is to build a monitoring system for RDS databases. So I am trying to create Cloudwatch metric stream to Elasticsearch(open search AWS) using kinesis firehose & lambda. The RDS metrics are appearing but Datab… --- ## [System load too high](https://discuss.elastic.co/t/system-load-too-high/293436)
**Author:** [@Davide89](https://discuss.elastic.co/u/Davide89)\ **Replies:** 5\ **Last updated:** [January 5, 2022, 8:41am UTC](https://discuss.elastic.co/t/system-load-too-high/293436 "2022-01-05T08:41:19Z")
I'm working on a VM with a single-node instance of Elasticsearch and I registered a lot of alerts about system load for many days. Indeed the overall system load is always higher then 1. Below a Grafana chart that shows… --- ## [Unable to install logstash-input-azureblob with logstash 7.16.2](https://discuss.elastic.co/t/unable-to-install-logstash-input-azureblob-with-logstash-7-16-2/293504)
**Author:** [@Natarajan](https://discuss.elastic.co/u/Natarajan)\ **Replies:** 0\ **Last updated:** [January 5, 2022, 8:20am UTC](https://discuss.elastic.co/t/unable-to-install-logstash-input-azureblob-with-logstash-7-16-2/293504 "2022-01-05T08:20:29Z")
I am trying to install logstash-input-azureblob with logstash 7.16.2. But getting the below error. I am running the logstash as docker. ERROR: Installation Aborted, message: Bundler could not find compatible versions … --- ## [Failed to open TCP connection to ES while trying to connect from fluentd](https://discuss.elastic.co/t/failed-to-open-tcp-connection-to-es-while-trying-to-connect-from-fluentd/293502)
**Author:** [@subha1](https://discuss.elastic.co/u/subha1)\ **Replies:** 0\ **Last updated:** [January 5, 2022, 6:53am UTC](https://discuss.elastic.co/t/failed-to-open-tcp-connection-to-es-while-trying-to-connect-from-fluentd/293502 "2022-01-05T06:53:35Z")
Failed to open TCP connection to ES while trying to connect from fluentd. In the cluster, there are 5 clients , 5 masters & 5 data pods are running with 155 fluentd daemonsets. some of the fluentd pods are getting res… --- ## [ILM isn't deleting searchable snapshots](https://discuss.elastic.co/t/ilm-isnt-deleting-searchable-snapshots/293388)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 1\ **Last updated:** [January 5, 2022, 6:22am UTC](https://discuss.elastic.co/t/ilm-isnt-deleting-searchable-snapshots/293388 "2022-01-05T06:22:04Z")
I'm trying to figure out why my old data that is currently a searchable snapshot isn't being deleted from my ILM policy: Here's the \_ilm/explain output: { "indices" : { "restored-.ds-dev-metricbeat-datastream-202… --- ## [Can we use elasticsearch analyzer for kibana](https://discuss.elastic.co/t/can-we-use-elasticsearch-analyzer-for-kibana/293310)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [January 5, 2022, 5:27am UTC](https://discuss.elastic.co/t/can-we-use-elasticsearch-analyzer-for-kibana/293310 "2022-01-05T05:27:00Z")
Hi team, I am learning Elasticsearch analyzer and now i have to test this analyzer for my new index. There is a question strucking in my mind that if made analyzer and we are searching our text in kibana discover. Beca… --- ## [\[ES v6.7.2\] Speed up snapshot restore from GCS Snapshot Repository](https://discuss.elastic.co/t/es-v6-7-2-speed-up-snapshot-restore-from-gcs-snapshot-repository/293343)
**Author:** [@Akshay\_KN](https://discuss.elastic.co/u/Akshay_KN)\ **Replies:** 2\ **Last updated:** [January 5, 2022, 5:19am UTC](https://discuss.elastic.co/t/es-v6-7-2-speed-up-snapshot-restore-from-gcs-snapshot-repository/293343 "2022-01-05T05:19:58Z")
Hello Team, We are trying to speed up our snapshot restoration speed in our ES cluster hosted on GCP Compute instances. TL;DR : Current Performance: 50 MBps per data node Infra Capable of 500 MBps We want to improve … --- ## [Logstash Exception in posting data to Azure Loganalytics](https://discuss.elastic.co/t/logstash-exception-in-posting-data-to-azure-loganalytics/293497)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 0\ **Last updated:** [January 5, 2022, 4:53am UTC](https://discuss.elastic.co/t/logstash-exception-in-posting-data-to-azure-loganalytics/293497 "2022-01-05T04:53:17Z")
Hi All, I've a server on which Logstash is installed and sending logs to Azure Sentinel. It works just fine but lately any other week I'd see the below entry in the logstash-plain.log file and it seems that the connect… --- ## [kibana.autocompleteTerminateAfter': is not allowed](https://discuss.elastic.co/t/kibana-autocompleteterminateafter-is-not-allowed/291279)
**Author:** [@lifeowl](https://discuss.elastic.co/u/lifeowl)\ **Replies:** 5\ **Last updated:** [January 5, 2022, 2:34am UTC](https://discuss.elastic.co/t/kibana-autocompleteterminateafter-is-not-allowed/291279 "2022-01-05T02:34:04Z")
Hi there, Have there been any recent changes or deprecations with kibana.autocompleteTerminateAfter? I recently had this value configured in my kibana.yml file (using 7.14 on Elastic Cloud) but now, when I try to update… --- ## [Lost data:The successfully written data is missing](https://discuss.elastic.co/t/lost-data-the-successfully-written-data-is-missing/293486)
**Author:** [@51pwn](https://discuss.elastic.co/u/51pwn)\ **Replies:** 3\ **Last updated:** [January 5, 2022, 1:34am UTC](https://discuss.elastic.co/t/lost-data-the-successfully-written-data-is-missing/293486 "2022-01-05T01:34:34Z")
Docker 7.16.2 official image I successfully wrote 177393 pieces of data, each of which returned: {"total": 1, "successful": 1, "failed": 0}, but passed http://127.0.0.1:9200/\_cat/indices?v See docs The count is 147840… --- ## [Osquery causing policy to go unhealthy](https://discuss.elastic.co/t/osquery-causing-policy-to-go-unhealthy/293482)
**Author:** [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Replies:** 0\ **Last updated:** [January 4, 2022, 11:15pm UTC](https://discuss.elastic.co/t/osquery-causing-policy-to-go-unhealthy/293482 "2022-01-04T23:15:49Z")
Currently running stack version 7.16.2 and am constantly having issues with the osquery manager integration. It keeps causing my agents to go unhealthy. Any reason why it is causing these issues? --- ## [Elastic Query for alerts Windows](https://discuss.elastic.co/t/elastic-query-for-alerts-windows/293481)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 0\ **Last updated:** [January 4, 2022, 10:42pm UTC](https://discuss.elastic.co/t/elastic-query-for-alerts-windows/293481 "2022-01-04T22:42:14Z")
I know this is going to be simple but it's just not coming to me at all today. GET /logs-\*/\_eql/search { "query": """ winlog where winlog.event\_id == "4625" and stringContains(message, "The specified account's pas… --- ## [Filebeat - avoid data duplication during switch over](https://discuss.elastic.co/t/filebeat-avoid-data-duplication-during-switch-over/293319)
**Author:** [@sandeepmuthathi](https://discuss.elastic.co/u/sandeepmuthathi)\ **Replies:** 1\ **Last updated:** [January 4, 2022, 10:11pm UTC](https://discuss.elastic.co/t/filebeat-avoid-data-duplication-during-switch-over/293319 "2022-01-04T22:11:54Z")
I've a scenario where I need to read the file contents from an NFS mount point using filebeat. Also, I need to install another filebeat instance on another system incase the first machine (where i installed filebeat) goe… --- ## [Trying to divide the cardinality of a string/hash field by the numeric value of another field](https://discuss.elastic.co/t/trying-to-divide-the-cardinality-of-a-string-hash-field-by-the-numeric-value-of-another-field/293374)
**Author:** [@jjammin92](https://discuss.elastic.co/u/jjammin92)\ **Replies:** 1\ **Last updated:** [January 4, 2022, 9:10pm UTC](https://discuss.elastic.co/t/trying-to-divide-the-cardinality-of-a-string-hash-field-by-the-numeric-value-of-another-field/293374 "2022-01-04T21:10:07Z")
I'm trying to create a runtime field within an index template. I can easily divide the values of two integers like this: emit(doc\['bounce\_time'\].value / doc\['session'\].value) EG bounce\_time: 100 / session: 25 = 4 Ho… --- ## [Filebeat parsing long log](https://discuss.elastic.co/t/filebeat-parsing-long-log/293438)
**Author:** [@Milad\_Akhlaghi](https://discuss.elastic.co/u/Milad_Akhlaghi)\ **Replies:** 0\ **Last updated:** [January 4, 2022, 11:49am UTC](https://discuss.elastic.co/t/filebeat-parsing-long-log/293438 "2022-01-04T11:49:01Z")
Hi Friends, i have a long log and i'm trying to parse it with javascript this is the filebeat config that i have: filebeat.inputs: - type: log enabled: true paths: - /root/logtest/test.log # clean\_removed: tr… --- ## [Host availability](https://discuss.elastic.co/t/host-availability/293479)
**Author:** [@Kirill\_Gofman](https://discuss.elastic.co/u/Kirill_Gofman)\ **Replies:** 0\ **Last updated:** [January 4, 2022, 8:41pm UTC](https://discuss.elastic.co/t/host-availability/293479 "2022-01-04T20:41:56Z")
Hey, we are trying to configure SAML auth with adfs. How can we verify that security rules are configured correctly on AWS/host and that it's available from elastic ? Any option to ping/trace destination host from the el… --- ## [Logstash multiline codec plugin won't keep blank lines](https://discuss.elastic.co/t/logstash-multiline-codec-plugin-wont-keep-blank-lines/293429)
**Author:** [@saprof](https://discuss.elastic.co/u/saprof)\ **Replies:** 2\ **Last updated:** [January 4, 2022, 7:26pm UTC](https://discuss.elastic.co/t/logstash-multiline-codec-plugin-wont-keep-blank-lines/293429 "2022-01-04T19:26:57Z")
Hi, I am working on the correct settings for the multiline codec plugin. I want to join all lines between two \\r\\n into a single event and it works well, except that blank lines are dropped. I'm running Logstash v7.16.… --- ## [Merge different index in function two fields and paste eleement of fields](https://discuss.elastic.co/t/merge-different-index-in-function-two-fields-and-paste-eleement-of-fields/293363)
**Author:** [@Vivian](https://discuss.elastic.co/u/Vivian)\ **Replies:** 8\ **Last updated:** [January 4, 2022, 7:06pm UTC](https://discuss.elastic.co/t/merge-different-index-in-function-two-fields-and-paste-eleement-of-fields/293363 "2022-01-04T19:06:46Z")
Hello, I have an index of this shape : { "\_index": "df\_extrait", "\_type": "\_doc", "\_id": "27685", "\_version": 1, "\_seq\_no": 0, "\_primary\_term": 1, "\_score": 1, "\_source": { "source": "avatar", "… --- ## [Internal Server Error on Kibana Index Management Screen](https://discuss.elastic.co/t/internal-server-error-on-kibana-index-management-screen/293470)
**Author:** [@Mrizzi](https://discuss.elastic.co/u/Mrizzi)\ **Replies:** 2\ **Last updated:** [January 4, 2022, 6:47pm UTC](https://discuss.elastic.co/t/internal-server-error-on-kibana-index-management-screen/293470 "2022-01-04T18:47:48Z")
Hey everyone, I'm suddenly facing this error: Whenever I try to look into the index page on my installation It constantly throws out the following error in the kibana.log file: \[2022-01-04T15:24:05.114-03:00\]\[ERRO… --- ## [ElasticSearch Upgrade to 5.6](https://discuss.elastic.co/t/elasticsearch-upgrade-to-5-6/293469)
**Author:** [@mario12](https://discuss.elastic.co/u/mario12)\ **Replies:** 3\ **Last updated:** [January 4, 2022, 6:20pm UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-to-5-6/293469 "2022-01-04T18:20:51Z")
We are currently running Elasticsearch version 2.4. We are planning to upgrade to ES 5.6. We ran the upgrade advisor and we took care of the issues. We are planning to upgrade by setting up a new cluster and restoring th… --- ## [Disable java security policies in elasticsearch:5.6.9 docker image](https://discuss.elastic.co/t/disable-java-security-policies-in-elasticsearch-5-6-9-docker-image/293460)
**Author:** [@curioususer](https://discuss.elastic.co/u/curioususer)\ **Replies:** 0\ **Last updated:** [January 4, 2022, 3:25pm UTC](https://discuss.elastic.co/t/disable-java-security-policies-in-elasticsearch-5-6-9-docker-image/293460 "2022-01-04T15:25:53Z")
Hi, I'm trying to exploit the log4j vulnerability in Elasticsearch 5.6.9 for an academic project. I was able to get a RCE (a simple print), but when it comes to executing a shell, I get this error: java.security.Access… --- ## [Logstash prune blacklist\_values](https://discuss.elastic.co/t/logstash-prune-blacklist-values/293266)
**Author:** [@4art4](https://discuss.elastic.co/u/4art4)\ **Replies:** 6\ **Last updated:** [January 4, 2022, 5:38pm UTC](https://discuss.elastic.co/t/logstash-prune-blacklist-values/293266 "2022-01-04T17:38:05Z")
So the json inputs are not always consistent. For example, one field is usually true/false, but the source occasionally tosses in a "not\_supported" just to be fun. So after some digging, I thought that I could just do: … --- ## [Logstash is running but not sending logs to elasticsearch](https://discuss.elastic.co/t/logstash-is-running-but-not-sending-logs-to-elasticsearch/293433)
**Author:** [@Othmane\_CHHAIBI](https://discuss.elastic.co/u/Othmane_CHHAIBI)\ **Replies:** 1\ **Last updated:** [January 4, 2022, 4:48pm UTC](https://discuss.elastic.co/t/logstash-is-running-but-not-sending-logs-to-elasticsearch/293433 "2022-01-04T16:48:42Z")
Hello everyone, after the upgrade of logstash from version 6.8 to 7.16.2, the status of logstash is running but it isn't sending logs to Elasticsearch. this is the logstash log file in the image below :slight\_smile: … --- ## [Bar chart single color and bar for Others bucket](https://discuss.elastic.co/t/bar-chart-single-color-and-bar-for-others-bucket/293136)
**Author:** [@Michael\_Ubry](https://discuss.elastic.co/u/Michael_Ubry)\ **Replies:** 3\ **Last updated:** [January 4, 2022, 4:21pm UTC](https://discuss.elastic.co/t/bar-chart-single-color-and-bar-for-others-bucket/293136 "2022-01-04T16:21:29Z")
Hi, Lets say I have table of countries and their GDP. I would like to have bar chart splitted on X-Axis by terms (countries) and be also colored by terms. I wanna show TOP 10 and Others buckets. I saw this is possible… --- ## [Delete JndiLookup.class](https://discuss.elastic.co/t/delete-jndilookup-class/291507)
**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Replies:** 16\ **Last updated:** [January 4, 2022, 2:49pm UTC](https://discuss.elastic.co/t/delete-jndilookup-class/291507 "2022-01-04T14:49:58Z")
Dear Team, I am unable to find the file zip -q -d \/logstash-core/lib/jars/log4j-core-2.\* org/apache/logging/log4j/core/lookup/JndiLookup.class Can someone please help me or guide me. Regards --- ## [Parse Exchange Message tracking logs via Dissect filebeat processor](https://discuss.elastic.co/t/parse-exchange-message-tracking-logs-via-dissect-filebeat-processor/293445)
**Author:** [@a.gavric](https://discuss.elastic.co/u/a.gavric)\ **Replies:** 8\ **Last updated:** [January 4, 2022, 2:06pm UTC](https://discuss.elastic.co/t/parse-exchange-message-tracking-logs-via-dissect-filebeat-processor/293445 "2022-01-04T14:06:47Z")
Hello everyone i have been trying to ingest and parse Exchange message tracking logs via filebeat dissect processor to generate fields i need from the log rather than the beat dumping the entire log into the message fiel… --- ## [How to whitelist NULL values?](https://discuss.elastic.co/t/how-to-whitelist-null-values/293449)
**Author:** [@Wooden\_tree](https://discuss.elastic.co/u/Wooden_tree)\ **Replies:** 0\ **Last updated:** [January 4, 2022, 1:55pm UTC](https://discuss.elastic.co/t/how-to-whitelist-null-values/293449 "2022-01-04T13:55:57Z")
Hello, I’m a quite new in Elastic world and I’d like to know if it’s possible to whitelist a NULL value. We have a rule that detects the authentications of our privileges accounts on unauthorized assets which is based … --- ## [Force saved object URL when accessing Kibana](https://discuss.elastic.co/t/force-saved-object-url-when-accessing-kibana/292694)
**Author:** [@Bustencio](https://discuss.elastic.co/u/Bustencio)\ **Replies:** 2\ **Last updated:** [January 4, 2022, 1:18pm UTC](https://discuss.elastic.co/t/force-saved-object-url-when-accessing-kibana/292694 "2022-01-04T13:18:00Z")
Hi, Currently a lot of our users are accessing old snapshots of our dashboards because they saved them as markers by copying the URL that the browser showed in the search bar. I was wondering if there is any way to for… --- ## [I'm trying to move my elastic stack to 7.16.2 (from 6.8.22) in docker-compose - but fails to get certificates generated](https://discuss.elastic.co/t/im-trying-to-move-my-elastic-stack-to-7-16-2-from-6-8-22-in-docker-compose-but-fails-to-get-certificates-generated/292675)
**Author:** [@fribse](https://discuss.elastic.co/u/fribse)\ **Replies:** 5\ **Last updated:** [January 4, 2022, 1:06pm UTC](https://discuss.elastic.co/t/im-trying-to-move-my-elastic-stack-to-7-16-2-from-6-8-22-in-docker-compose-but-fails-to-get-certificates-generated/292675 "2022-01-04T13:06:49Z")
With the Log4J vulnerability I've been tasked to update our quite dated Elasticsearch stack. We were on 6.5.1, which I moved to 6.8.22 without issues. Now I want to move it to 7.16.2. There isn't that much with rollin… --- ## [Elastic life cycle management](https://discuss.elastic.co/t/elastic-life-cycle-management/293392)
**Author:** [@bargb](https://discuss.elastic.co/u/bargb)\ **Replies:** 3\ **Last updated:** [January 4, 2022, 12:49pm UTC](https://discuss.elastic.co/t/elastic-life-cycle-management/293392 "2022-01-04T12:49:33Z")
Hello All. I am relatively new to elastic and trying to configure elastic policy for life cycle management on a Kubernetes env. I see that we can configure using curl request. Is there are corresponding CLI? I want… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1105) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1107)