# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1151 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1152 --- ## [Spark/ES on kubernetes, co-location ok?](https://discuss.elastic.co/t/spark-es-on-kubernetes-co-location-ok/290153)
**Author:** [@rzrucher](https://discuss.elastic.co/u/rzrucher)\ **Replies:** 0\ **Last updated:** [November 25, 2021, 9:53am UTC](https://discuss.elastic.co/t/spark-es-on-kubernetes-co-location-ok/290153 "2021-11-25T09:53:35Z")
Hi all, I've a question related to architecture. As anyone experienced a deployment of Elasticsearch and spark on a kubernetes cluster ? My main concern is how to es-hadoop connector works in this situation in regards … --- ## [Waiting for a Fleet Server to connect](https://discuss.elastic.co/t/waiting-for-a-fleet-server-to-connect/290069)
**Author:** [@TarasP](https://discuss.elastic.co/u/TarasP)\ **Replies:** 0\ **Last updated:** [November 24, 2021, 1:10pm UTC](https://discuss.elastic.co/t/waiting-for-a-fleet-server-to-connect/290069 "2021-11-24T13:10:01Z")
Hello I have started Cloud Trial and seeing the same as Waiting for a Fleet Server to connect… error I can see Fleet and APM server is running. I tried restarting it but it doesn't help Can someone please point me w… --- ## [Build fails with "Invalid version format: '20.10.8+dfsg1'. Should be major.minor.revision\[-extra\]"](https://discuss.elastic.co/t/build-fails-with-invalid-version-format-20-10-8-dfsg1-should-be-major-minor-revision-extra/288018)
**Author:** [@TimRuehsen](https://discuss.elastic.co/u/TimRuehsen)\ **Replies:** 1\ **Last updated:** [November 25, 2021, 9:11am UTC](https://discuss.elastic.co/t/build-fails-with-invalid-version-format-20-10-8-dfsg1-should-be-major-minor-revision-extra/288018 "2021-11-25T09:11:48Z")
Just cloned the repository from GH (commit e5251bc5a0d5382c64e3751953e4f38fb67633e1) and the build fails with the above mentioned error. I am on Debian testing amd64. The command and output is $ ./gradlew assemble ===… --- ## [Persistance Queue Logstash](https://discuss.elastic.co/t/persistance-queue-logstash/290146)
**Author:** [@ahmed\_charafouddine](https://discuss.elastic.co/u/ahmed_charafouddine)\ **Replies:** 0\ **Last updated:** [November 25, 2021, 9:07am UTC](https://discuss.elastic.co/t/persistance-queue-logstash/290146 "2021-11-25T09:07:51Z")
Hello, To better understand logstash queue persistence, we would like to know if there would be a ratio of how much (bytes) between theoretical volume (incoming volume) and practical volume (stored volume) in logstash q… --- ## [Alerts/Rules - Elasticsearch query grouped on hostname](https://discuss.elastic.co/t/alerts-rules-elasticsearch-query-grouped-on-hostname/290145)
**Author:** [@Garry](https://discuss.elastic.co/u/Garry)\ **Replies:** 0\ **Last updated:** [November 25, 2021, 9:03am UTC](https://discuss.elastic.co/t/alerts-rules-elasticsearch-query-grouped-on-hostname/290145 "2021-11-25T09:03:25Z")
I have an Elasticsearch query which emails out on an specific Windows Event Log event id. This is a basic query... { "query":{ "query\_string" : { "query" : "10028", "fields": \["event.code"\] } } } What I woul… --- ## [Connect to Elasticsearch remotely](https://discuss.elastic.co/t/connect-to-elasticsearch-remotely/289919)
**Author:** [@AlexM566](https://discuss.elastic.co/u/AlexM566)\ **Replies:** 14\ **Last updated:** [November 24, 2021, 9:26am UTC](https://discuss.elastic.co/t/connect-to-elasticsearch-remotely/289919 "2021-11-24T09:26:37Z")
Hello community, I have a problem. I have installed on ubuntu 20.04 an ELK stack 7.15.2. My goal is to connect remotely to Elasticsearch to ingest data from a web form into Elasticsearch and my problem is that I cannot … --- ## [Long running uncancellable transport task](https://discuss.elastic.co/t/long-running-uncancellable-transport-task/290138)
**Author:** [@hunsw](https://discuss.elastic.co/u/hunsw)\ **Replies:** 0\ **Last updated:** [November 25, 2021, 8:10am UTC](https://discuss.elastic.co/t/long-running-uncancellable-transport-task/290138 "2021-11-25T08:10:23Z")
I have a transport task that cannot be cancelled, but has been running for 60+ days. I have 2 questions: Is there anything I can do to make this task disappear OTHER than restarting the node? (E.g. should I try to cl… --- ## [How to guarantee exact retention time for logs?](https://discuss.elastic.co/t/how-to-guarantee-exact-retention-time-for-logs/290056)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 2\ **Last updated:** [November 25, 2021, 6:04am UTC](https://discuss.elastic.co/t/how-to-guarantee-exact-retention-time-for-logs/290056 "2021-11-25T06:04:35Z")
Hi folks, I have following question: I store logs in Elasticsearch cluster and want to guarantee the promised retention time of 30 days to the developer. I have configured my Lifecycle policy to rollover after 30 days… --- ## [How to disable SSL or pass certifacte in metricbeat](https://discuss.elastic.co/t/how-to-disable-ssl-or-pass-certifacte-in-metricbeat/290124)
**Author:** [@pratik\_jain163](https://discuss.elastic.co/u/pratik_jain163)\ **Replies:** 0\ **Last updated:** [November 25, 2021, 5:52am UTC](https://discuss.elastic.co/t/how-to-disable-ssl-or-pass-certifacte-in-metricbeat/290124 "2021-11-25T05:52:12Z")
Hi, i am trying to install metricbeat on k8s where in its values file i am passing ES details as below. and i am getting x509: certificate signed by unknown authority and in ES doc i can see this but where i need to… --- ## [Anomaly detection in Machine learning kibana](https://discuss.elastic.co/t/anomaly-detection-in-machine-learning-kibana/290018)
**Author:** [@MAHALAKSHMI\_S](https://discuss.elastic.co/u/MAHALAKSHMI_S)\ **Replies:** 6\ **Last updated:** [November 25, 2021, 5:28am UTC](https://discuss.elastic.co/t/anomaly-detection-in-machine-learning-kibana/290018 "2021-11-25T05:28:57Z")
I created a "Categorization" based anomaly detection job and explored the job results in Kibana. I have used "Payload"(i.e String) field for categorization. Here I'm not sure what does "typical" value in anomaly explor… --- ## [Logstash to handle multiline input from Filebeat](https://discuss.elastic.co/t/logstash-to-handle-multiline-input-from-filebeat/290116)
**Author:** [@grazia0912](https://discuss.elastic.co/u/grazia0912)\ **Replies:** 4\ **Last updated:** [November 25, 2021, 5:25am UTC](https://discuss.elastic.co/t/logstash-to-handle-multiline-input-from-filebeat/290116 "2021-11-25T05:25:28Z")
Hi, Would just like to ask how can Logstash handle multiline from input Filebeat. My filebeat already handles the multiline however the logstash still outputs only the first line. after the \\n all the rest are ignored … --- ## [Object mapping errors](https://discuss.elastic.co/t/object-mapping-errors/290032)
**Author:** [@Sconic](https://discuss.elastic.co/u/Sconic)\ **Replies:** 6\ **Last updated:** [November 25, 2021, 4:27am UTC](https://discuss.elastic.co/t/object-mapping-errors/290032 "2021-11-25T04:27:44Z")
Hi All, We've run into an issue with Logstash (or could be Filebeat) where it's not sending some log entries to ES. We're currently running version 7.15.2 of all the Elastic Components, although I haven't been able to … --- ## [How to create index-pattern for a specific tenant in Elasticsearch Kibana using API?](https://discuss.elastic.co/t/how-to-create-index-pattern-for-a-specific-tenant-in-elasticsearch-kibana-using-api/290087)
**Author:** [@triptesh1212](https://discuss.elastic.co/u/triptesh1212)\ **Replies:** 3\ **Last updated:** [November 25, 2021, 4:27am UTC](https://discuss.elastic.co/t/how-to-create-index-pattern-for-a-specific-tenant-in-elasticsearch-kibana-using-api/290087 "2021-11-25T04:27:16Z")
Hi I am following this API - Open Distro for Elasticsearch Documentation documentation to create tenant at Elasticsearch. We can also create an index using index API Create index API | Elasticsearch Guide \[7.15\] | Elast… --- ## [Near Realtime Threat Intel enrichment using custom external sources stored on enrichment indexes](https://discuss.elastic.co/t/near-realtime-threat-intel-enrichment-using-custom-external-sources-stored-on-enrichment-indexes/289525)
**Author:** [@claudio.rifo](https://discuss.elastic.co/u/claudio.rifo)\ **Replies:** 1\ **Last updated:** [November 25, 2021, 3:05am UTC](https://discuss.elastic.co/t/near-realtime-threat-intel-enrichment-using-custom-external-sources-stored-on-enrichment-indexes/289525 "2021-11-25T03:05:13Z")
Hi There. First Ill try to explain my general idea (that I already have implemented and is working) then the problems I have and a few questions. The general idea is to have a Logstash ingest pipeline, lets call it Pip… --- ## [Unpack a list of hashes into new fields](https://discuss.elastic.co/t/unpack-a-list-of-hashes-into-new-fields/290107)
**Author:** [@antonisnyc94](https://discuss.elastic.co/u/antonisnyc94)\ **Replies:** 4\ **Last updated:** [November 25, 2021, 2:39am UTC](https://discuss.elastic.co/t/unpack-a-list-of-hashes-into-new-fields/290107 "2021-11-25T02:39:02Z")
Hello, I am having a field data.aws.httpRequest.headers , and it has a list of hashes as seen below. { "name": "host", "value": "testwebsite.com" }, { "name": "authorization", "value": "token hidden" }, { "na… --- ## [How to Create Login failed Rule](https://discuss.elastic.co/t/how-to-create-login-failed-rule/287862)
**Author:** [@Renz\_Aguilar](https://discuss.elastic.co/u/Renz_Aguilar)\ **Replies:** 2\ **Last updated:** [November 25, 2021, 1:46am UTC](https://discuss.elastic.co/t/how-to-create-login-failed-rule/287862 "2021-11-25T01:46:22Z")
Hi Team can i ask how to create a login failed rule on kibana? i want to monitor the users who failed logging in into their computer. --- ## [Add multiple host on xpack.monitoring.elasticsearch.hosts with enviroment variable](https://discuss.elastic.co/t/add-multiple-host-on-xpack-monitoring-elasticsearch-hosts-with-enviroment-variable/289514)
**Author:** [@IsraelPerales](https://discuss.elastic.co/u/IsraelPerales)\ **Replies:** 2\ **Last updated:** [November 25, 2021, 1:02am UTC](https://discuss.elastic.co/t/add-multiple-host-on-xpack-monitoring-elasticsearch-hosts-with-enviroment-variable/289514 "2021-11-25T01:02:51Z")
Hi i try monitoring logstash for detect why i have delay on the logs ingest. But when i try put multiple hosts in the property xpack.monitoring.elasticsearch.hosts this fails . The value is injected with the envirome… --- ## [Mapping conflict!](https://discuss.elastic.co/t/mapping-conflict/290084)
**Author:** [@Skeldren](https://discuss.elastic.co/u/Skeldren)\ **Replies:** 1\ **Last updated:** [November 24, 2021, 11:30pm UTC](https://discuss.elastic.co/t/mapping-conflict/290084 "2021-11-24T23:30:04Z")
Hey Guys! I have a question regarding a problem of Mapping conflict! I had to change one field type from string to integer. Due to the Index pattern include include both old indexes and new indexes, there are now confl… --- ## [Issues generating custom Beat](https://discuss.elastic.co/t/issues-generating-custom-beat/290111)
**Author:** [@mbhakta](https://discuss.elastic.co/u/mbhakta)\ **Replies:** 0\ **Last updated:** [November 24, 2021, 11:21pm UTC](https://discuss.elastic.co/t/issues-generating-custom-beat/290111 "2021-11-24T23:21:05Z")
Hello! I'm attempting to create a custom beat using the instructions here: https://www.elastic.co/guide/en/beats/devguide/7.15/newbeat-generate.html and I'm having issues when running mage GenerateCustomBeat I'm run… --- ## [Elasticsearch unreachable from service declared in docker-compose](https://discuss.elastic.co/t/elasticsearch-unreachable-from-service-declared-in-docker-compose/290110)
**Author:** [@ray2](https://discuss.elastic.co/u/ray2)\ **Replies:** 0\ **Last updated:** [November 24, 2021, 10:01pm UTC](https://discuss.elastic.co/t/elasticsearch-unreachable-from-service-declared-in-docker-compose/290110 "2021-11-24T22:01:11Z")
Hello everyone ! I have a problem to reach the Elasticsearch container from a service inside the docker network. So I'm running a single node instance and If I try to reach from localhost:9202 everything looks good but … --- ## [Filter is removed when visualisation is saved](https://discuss.elastic.co/t/filter-is-removed-when-visualisation-is-saved/289655)
**Author:** [@Matt.Wash](https://discuss.elastic.co/u/Matt.Wash)\ **Replies:** 2\ **Last updated:** [November 24, 2021, 9:39pm UTC](https://discuss.elastic.co/t/filter-is-removed-when-visualisation-is-saved/289655 "2021-11-24T21:39:04Z")
when trying to save a lens visualisation after adding a filter, the filter is instantly removed. See attached gif. Anyone know what might be the cause? --- ## [Sametimes logs are not parsed](https://discuss.elastic.co/t/sametimes-logs-are-not-parsed/289940)
**Author:** [@gabrielfsousa](https://discuss.elastic.co/u/gabrielfsousa)\ **Replies:** 1\ **Last updated:** [November 24, 2021, 9:04pm UTC](https://discuss.elastic.co/t/sametimes-logs-are-not-parsed/289940 "2021-11-24T21:04:18Z")
Using filebeat 7.10.2 and sending to ES 7.10.2 , same times are logs not parsed, with no errors, exemple of a log not parsed {"type":"log","@timestamp":"2021-10-26T14:04:32Z","tags":\["info","plugins","security","audit",… --- ## [Generating node certificate](https://discuss.elastic.co/t/generating-node-certificate/290055)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [November 24, 2021, 8:17pm UTC](https://discuss.elastic.co/t/generating-node-certificate/290055 "2021-11-24T20:17:46Z")
Using elk 7.15 i just have small doubt that in earlier 7.10 elasticsearch documentation https://www.elastic.co/guide/en/elasticsearch/reference/7.10/configuring-tls.html#tls-transport Encrypting communications between… --- ## [Create index for kube-system and rest of the namespaces another index](https://discuss.elastic.co/t/create-index-for-kube-system-and-rest-of-the-namespaces-another-index/290058)
**Author:** [@Murali\_Thumalapalli](https://discuss.elastic.co/u/Murali_Thumalapalli)\ **Replies:** 0\ **Last updated:** [November 24, 2021, 12:13pm UTC](https://discuss.elastic.co/t/create-index-for-kube-system-and-rest-of-the-namespaces-another-index/290058 "2021-11-24T12:13:02Z")
Hi Team, we are trying to create a new index for Kube-system namespace related logs as one index and rest of the system as another index. as part of that we have below spec read and deployed but we are not seeing any in… --- ## [Elasticsearch with non-root user - Backup restore is not working](https://discuss.elastic.co/t/elasticsearch-with-non-root-user-backup-restore-is-not-working/288177)
**Author:** [@Sagarika\_Mahalik](https://discuss.elastic.co/u/Sagarika_Mahalik)\ **Replies:** 2\ **Last updated:** [November 24, 2021, 7:46pm UTC](https://discuss.elastic.co/t/elasticsearch-with-non-root-user-backup-restore-is-not-working/288177 "2021-11-24T19:46:32Z")
We have a docker image for Elasticsearch where I added. a non-root user as it is required to fix some vulnerabilities. After adding non-root user, we are facing with the backup-restore functionalities. I am getting error… --- ## [Logs contains different format of same field name while parsing in logstash](https://discuss.elastic.co/t/logs-contains-different-format-of-same-field-name-while-parsing-in-logstash/290103)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 1\ **Last updated:** [November 24, 2021, 7:00pm UTC](https://discuss.elastic.co/t/logs-contains-different-format-of-same-field-name-while-parsing-in-logstash/290103 "2021-11-24T19:00:16Z")
Hi, I am using logstash to parse logs from txt file.I am having field "mstrGateway" and "MstrGateway" in two different logs, how to parse this field in single "mstrGateway" field. If I make two different fields such as… --- ## [Getting illegal\_state\_exception error while pushing logs to elasticsearch](https://discuss.elastic.co/t/getting-illegal-state-exception-error-while-pushing-logs-to-elasticsearch/290029)
**Author:** [@Chitrank\_Tyagi](https://discuss.elastic.co/u/Chitrank_Tyagi)\ **Replies:** 1\ **Last updated:** [November 24, 2021, 6:38pm UTC](https://discuss.elastic.co/t/getting-illegal-state-exception-error-while-pushing-logs-to-elasticsearch/290029 "2021-11-24T18:38:10Z")
I'm getting illegal\_state\_exception error, Can someone please help me this? mapping\_template.json : error: "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse field \[message\] of type \[text\] in do… --- ## [Get the @timestamp of the document that has the max of a value](https://discuss.elastic.co/t/get-the-timestamp-of-the-document-that-has-the-max-of-a-value/290093)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 3\ **Last updated:** [November 24, 2021, 6:31pm UTC](https://discuss.elastic.co/t/get-the-timestamp-of-the-document-that-has-the-max-of-a-value/290093 "2021-11-24T18:31:00Z")
Hi I need to get the max of memory usage per host in a time range, I think I can do this with the query below, but I also need the @timestamp of the document when the max memory usage happens. how can I do this? GET me… --- ## [Logstash concatinates topics](https://discuss.elastic.co/t/logstash-concatinates-topics/290033)
**Author:** [@Mamol27](https://discuss.elastic.co/u/Mamol27)\ **Replies:** 1\ **Last updated:** [November 24, 2021, 5:38pm UTC](https://discuss.elastic.co/t/logstash-concatinates-topics/290033 "2021-11-24T17:38:09Z")
Hi! I have pipeline kafka→logstash→Elasticsearch I created two topics in kafka: test-1 and test-2 Write manually to these topics messages: 67 into test-1 and 67 into test-2. I wrote two logstash workers test1.conf i… --- ## [Pagination, slice vs search\_after](https://discuss.elastic.co/t/pagination-slice-vs-search-after/290098)
**Author:** [@tamis-laan](https://discuss.elastic.co/u/tamis-laan)\ **Replies:** 0\ **Last updated:** [November 24, 2021, 5:37pm UTC](https://discuss.elastic.co/t/pagination-slice-vs-search-after/290098 "2021-11-24T17:37:49Z")
When looking at the documentation two methods are used for skipping pages namely search\_after and slice: What are the pro's and con's? Are they both equally efficient? Slice looks easier to use but is never mentioned… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1150) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1152)