# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1160 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1161 --- ## [Rabbit MQ file beat unable to install in ubuntu](https://discuss.elastic.co/t/rabbit-mq-file-beat-unable-to-install-in-ubuntu/289443)
**Author:** [@Anupam\_Mishra](https://discuss.elastic.co/u/Anupam_Mishra)\ **Replies:** 0\ **Last updated:** [November 17, 2021, 12:06pm UTC](https://discuss.elastic.co/t/rabbit-mq-file-beat-unable-to-install-in-ubuntu/289443 "2021-11-17T12:06:32Z")
curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.15.2-linux-x86\_64.tar.gz tar xzvf filebeat-7.15.2-linux-x86\_64.tar.gz Post execution it does create a folder with filebeat-7.15.2-linux-x86\_6… --- ## [Ingest Attachment Plugin update index](https://discuss.elastic.co/t/ingest-attachment-plugin-update-index/289346)
**Author:** [@fribeiro-keep](https://discuss.elastic.co/u/fribeiro-keep)\ **Replies:** 6\ **Last updated:** [November 17, 2021, 4:00pm UTC](https://discuss.elastic.co/t/ingest-attachment-plugin-update-index/289346 "2021-11-17T16:00:56Z")
Hey there, I'm trying to implement the Ingest Attachment plugin on Elasticsearch 6.8 My goal is to append the document text to an existing index. This is a sample of my current index { "\_index": "koha\_biblios", "\_typ… --- ## [Sort on multiple fields not working](https://discuss.elastic.co/t/sort-on-multiple-fields-not-working/289478)
**Author:** [@Karthikeyan\_Amaresan](https://discuss.elastic.co/u/Karthikeyan_Amaresan)\ **Replies:** 0\ **Last updated:** [November 17, 2021, 3:56pm UTC](https://discuss.elastic.co/t/sort-on-multiple-fields-not-working/289478 "2021-11-17T15:56:22Z")
Query { "size": 20, "query": { "match\_all": {} }, "\_source": \["INBOUND\_CALL\_mod\_date", "OUTBOUND\_CALL\_mod\_date"\], "sort": \[ { "INBOUND\_CALL\_mod\_date": { "order": "desc" } }, … --- ## [Add Data Is Broken?](https://discuss.elastic.co/t/add-data-is-broken/289031)
**Author:** [@corndog](https://discuss.elastic.co/u/corndog)\ **Replies:** 2\ **Last updated:** [November 17, 2021, 3:51pm UTC](https://discuss.elastic.co/t/add-data-is-broken/289031 "2021-11-17T15:51:41Z")
I am at http://localhost:5601/app/home#/tutorial\_directory Specifically Add Data / Upload File. When I Upload my newline delimited JSON file, it is correctly formatted as ndjson. HOWEVER THERE ARE ABSOLUTELY NO ITEMS … --- ## [FILEBEAT: hostname inside message not parsed](https://discuss.elastic.co/t/filebeat-hostname-inside-message-not-parsed/288850)
**Author:** [@Sederfo](https://discuss.elastic.co/u/Sederfo)\ **Replies:** 2\ **Last updated:** [November 17, 2021, 3:50pm UTC](https://discuss.elastic.co/t/filebeat-hostname-inside-message-not-parsed/288850 "2021-11-17T15:50:06Z")
We are using Filebeat for processing Syslog messages sent from switches. We know that the raw Syslog messages contain the hostname of the device (we tested it with RSyslog). The problem is that Filebeat does not read th… --- ## [Adapting ECS process field set for a process tree?](https://discuss.elastic.co/t/adapting-ecs-process-field-set-for-a-process-tree/289374)
**Author:** [@Gerry7](https://discuss.elastic.co/u/Gerry7)\ **Replies:** 1\ **Last updated:** [November 17, 2021, 3:15pm UTC](https://discuss.elastic.co/t/adapting-ecs-process-field-set-for-a-process-tree/289374 "2021-11-17T15:15:06Z")
We have a system sending alerts on process activity. The alert contains an entire process tree related to the offending process - the parent process, grand parent proces, etc. The ECS process field set has a parent node… --- ## [ILM - Delete beat data after 30 days](https://discuss.elastic.co/t/ilm-delete-beat-data-after-30-days/288992)
**Author:** [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\ **Replies:** 12\ **Last updated:** [November 16, 2021, 1:14pm UTC](https://discuss.elastic.co/t/ilm-delete-beat-data-after-30-days/288992 "2021-11-16T13:14:31Z")
Hello Elastic We are ingesting a lot of data into Elastic. We are using index templates. But our servers are filling up. I want to automate the cleaning of old data, instead of having to manually watch when they're fi… --- ## [Elastic Search Not Starting](https://discuss.elastic.co/t/elastic-search-not-starting/289422)
**Author:** [@gang\_giz](https://discuss.elastic.co/u/gang_giz)\ **Replies:** 9\ **Last updated:** [November 17, 2021, 1:37pm UTC](https://discuss.elastic.co/t/elastic-search-not-starting/289422 "2021-11-17T13:37:37Z")
Hi, We have to install Elasticsearch 7.9 to my Cpanel Server and we have done the install and started to Start the Elasticsearch it is failed when I check the log I see this. Im pasting the Entire log in multiple threds … --- ## [RestHighLevelClient request time out not worked](https://discuss.elastic.co/t/resthighlevelclient-request-time-out-not-worked/289458)
**Author:** [@ertugrul.gamgam](https://discuss.elastic.co/u/ertugrul.gamgam)\ **Replies:** 0\ **Last updated:** [November 17, 2021, 1:35pm UTC](https://discuss.elastic.co/t/resthighlevelclient-request-time-out-not-worked/289458 "2021-11-17T13:35:10Z")
Hello I am using RestHighLevelClient 7.4.2 . I set time outs like below to test: @Bean public RestHighLevelClient restHighLevelClient() { HttpHost\[\] hosts = elasticsearchEnvironmentConfig.getNodes().stre… --- ## [How to parse long numbers?](https://discuss.elastic.co/t/how-to-parse-long-numbers/288783)
**Author:** [@rachelyang](https://discuss.elastic.co/u/rachelyang)\ **Replies:** 1\ **Last updated:** [November 17, 2021, 1:29pm UTC](https://discuss.elastic.co/t/how-to-parse-long-numbers/288783 "2021-11-17T13:29:46Z")
I have set up NUMBER type for item duration in the pattern of Logstash configuration as %{NUMBER:Duration} It can parse most of the numbers in the log files, like 9994568.872 , 20903.23, etc.. But it cannot parse the… --- ## [Logstash not sending data into kibana](https://discuss.elastic.co/t/logstash-not-sending-data-into-kibana/289004)
**Author:** [@sai92](https://discuss.elastic.co/u/sai92)\ **Replies:** 1\ **Last updated:** [November 17, 2021, 1:21pm UTC](https://discuss.elastic.co/t/logstash-not-sending-data-into-kibana/289004 "2021-11-17T13:21:19Z")
Hello everyone I use logstash to read the json file and ingest data into index in Elasticsearch. But it works fine when run the command of /bin/logstash -f /etc/logstash/conf.d/log.test. But when I start it as service wi… --- ## [Import only delta (differences) from csv into mysql](https://discuss.elastic.co/t/import-only-delta-differences-from-csv-into-mysql/289283)
**Author:** [@Mihai\_Stuparu](https://discuss.elastic.co/u/Mihai_Stuparu)\ **Replies:** 1\ **Last updated:** [November 17, 2021, 1:19pm UTC](https://discuss.elastic.co/t/import-only-delta-differences-from-csv-into-mysql/289283 "2021-11-17T13:19:45Z")
Hello, I am using logstash to call an API (input), save it as .csv (filter) and upload it into a mysql table (output). All is good. But I need to do it each day (or each night rather): call that API, get the .csv and u… --- ## [Logstash http\_poller input / http filter design question](https://discuss.elastic.co/t/logstash-http-poller-input-http-filter-design-question/289012)
**Author:** [@byoungman](https://discuss.elastic.co/u/byoungman)\ **Replies:** 1\ **Last updated:** [November 17, 2021, 1:16pm UTC](https://discuss.elastic.co/t/logstash-http-poller-input-http-filter-design-question/289012 "2021-11-17T13:16:52Z")
Good Afternoon, I am starting to pull in AppDynamics metric information into our Elastic stack for persistence purposes. I have 5 metrics from each of 13 servers that I need to capture and my design in my Stage environ… --- ## [Parse one line as two lines](https://discuss.elastic.co/t/parse-one-line-as-two-lines/289073)
**Author:** [@Sjap1](https://discuss.elastic.co/u/Sjap1)\ **Replies:** 1\ **Last updated:** [November 17, 2021, 1:10pm UTC](https://discuss.elastic.co/t/parse-one-line-as-two-lines/289073 "2021-11-17T13:10:04Z")
Hello, I'm trying to parse multiple items in one line. My grok pattens match but logstash are outputting the data as arrays; How can i make the output look the where are two lines? input data: 2021-11-01 14:09:34 CET … --- ## [How am I supposed to understand why the field is confusing?](https://discuss.elastic.co/t/how-am-i-supposed-to-understand-why-the-field-is-confusing/289132)
**Author:** [@mrchile](https://discuss.elastic.co/u/mrchile)\ **Replies:** 2\ **Last updated:** [November 17, 2021, 1:07pm UTC](https://discuss.elastic.co/t/how-am-i-supposed-to-understand-why-the-field-is-confusing/289132 "2021-11-17T13:07:49Z")
Good afternoon, colleagues. I have been playing for several hours with this incomprehensible error, how can this be - someone can explain the dependencies of fields between different products, you can link to the documen… --- ## [New field in Weblogic access\_log , Logstash and Kibana](https://discuss.elastic.co/t/new-field-in-weblogic-access-log-logstash-and-kibana/288810)
**Author:** [@raultada](https://discuss.elastic.co/u/raultada)\ **Replies:** 1\ **Last updated:** [November 17, 2021, 1:02pm UTC](https://discuss.elastic.co/t/new-field-in-weblogic-access-log-logstash-and-kibana/288810 "2021-11-17T13:02:57Z")
Hello everyone, I´m new in ELK and there is a request to insert a new information came from weblogic access log ==\> "database name" This is the current weblogic log format (logging/tab http/advanced/Extended Logging Fo… --- ## [Trying to fetch documents from Mongodb using jdbc input plugin in logstash but getting this error messages](https://discuss.elastic.co/t/trying-to-fetch-documents-from-mongodb-using-jdbc-input-plugin-in-logstash-but-getting-this-error-messages/289133)
**Author:** [@Husnain](https://discuss.elastic.co/u/Husnain)\ **Replies:** 2\ **Last updated:** [November 17, 2021, 11:36am UTC](https://discuss.elastic.co/t/trying-to-fetch-documents-from-mongodb-using-jdbc-input-plugin-in-logstash-but-getting-this-error-messages/289133 "2021-11-17T11:36:58Z")
Hi All.There are documents in my Mongodb which I am trying to fetch out using logstash input jdbc plugin.I am using mongodb version 4.2.15 and logstash version is 7.10.1.When I run the logstash configuration pipeline I g… --- ## [Do ILM life time policies get reapplied to existing indexes?](https://discuss.elastic.co/t/do-ilm-life-time-policies-get-reapplied-to-existing-indexes/288801)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 5\ **Last updated:** [November 17, 2021, 11:21am UTC](https://discuss.elastic.co/t/do-ilm-life-time-policies-get-reapplied-to-existing-indexes/288801 "2021-11-17T11:21:54Z")
Hello I was using daily named indexes (yyyy.mm.dd) with a 180 day retention period but in august I changed to a monthy (yyyy.mm) and adjusted the retention period to 210ish days in order to keep the 180 retention period… --- ## [Timeout and slow responses](https://discuss.elastic.co/t/timeout-and-slow-responses/289418)
**Author:** [@ook](https://discuss.elastic.co/u/ook)\ **Replies:** 5\ **Last updated:** [November 17, 2021, 11:18am UTC](https://discuss.elastic.co/t/timeout-and-slow-responses/289418 "2021-11-17T11:18:05Z")
Hi, I have a Elasticsearch cluster in my k8s cluster to handle a unique small (451k docs) index (here the stats: ES Cluster stats as at 20211117 · GitHub ), so small (2gb) that I use 1 shard. All 5 nodes pods have 1CPU,… --- ## [Why aren't "flattened" fields usable via SQL?](https://discuss.elastic.co/t/why-arent-flattened-fields-usable-via-sql/288520)
**Author:** [@Jamshid](https://discuss.elastic.co/u/Jamshid)\ **Replies:** 2\ **Last updated:** [November 17, 2021, 10:31am UTC](https://discuss.elastic.co/t/why-arent-flattened-fields-usable-via-sql/288520 "2021-11-17T10:31:06Z")
Are flattened type fields really not usable with SQL queries? They're not mentioned in: I have an index with these fields: ... "mappings" : { "properties" : { "name" : { "type" : "keyword"… --- ## [Reporting timeout](https://discuss.elastic.co/t/reporting-timeout/289180)
**Author:** [@millie123](https://discuss.elastic.co/u/millie123)\ **Replies:** 3\ **Last updated:** [November 17, 2021, 10:26am UTC](https://discuss.elastic.co/t/reporting-timeout/289180 "2021-11-17T10:26:31Z")
Generating a PDF report in canvas fails when the report is too big. Tried increasing timeout without success. Any suggestions greatly appreciated. --- ## [Can NEST index multiple documents to a data stream?](https://discuss.elastic.co/t/can-nest-index-multiple-documents-to-a-data-stream/288949)
**Author:** [@buaaytt](https://discuss.elastic.co/u/buaaytt)\ **Replies:** 2\ **Last updated:** [November 17, 2021, 10:20am UTC](https://discuss.elastic.co/t/can-nest-index-multiple-documents-to-a-data-stream/288949 "2021-11-17T10:20:46Z")
The IndexMany method has no way to specify the op\_type. And the Bulk method doesn't seem to provide any configuration for op\_type either. --- ## [Lens - show values on histogram visualisation](https://discuss.elastic.co/t/lens-show-values-on-histogram-visualisation/289371)
**Author:** [@cpu](https://discuss.elastic.co/u/cpu)\ **Replies:** 2\ **Last updated:** [November 17, 2021, 10:10am UTC](https://discuss.elastic.co/t/lens-show-values-on-histogram-visualisation/289371 "2021-11-17T10:10:06Z")
Hi All, I'm trying to show values on histogram visualisation created with lens. I can't find the option to get this results... I'm missing something? Could anyone point me to the solution? Thanks in advance! --- ## [How to run logstash on WSL (Ubuntu 20.04.3 LTS)](https://discuss.elastic.co/t/how-to-run-logstash-on-wsl-ubuntu-20-04-3-lts/289414)
**Author:** [@Stephy\_Jacob](https://discuss.elastic.co/u/Stephy_Jacob)\ **Replies:** 1\ **Last updated:** [November 17, 2021, 9:43am UTC](https://discuss.elastic.co/t/how-to-run-logstash-on-wsl-ubuntu-20-04-3-lts/289414 "2021-11-17T09:43:39Z")
Hi, Could you please help with running logstash as a service in WSL (Ubuntu 20.04.3 LTS) As of now I get below error message sudo systemctl start logstash.service System has not been booted with systemd as init system… --- ## ["ignore\_missing": true from geoip processor is not working](https://discuss.elastic.co/t/ignore-missing-true-from-geoip-processor-is-not-working/289420)
**Author:** [@f4d0](https://discuss.elastic.co/u/f4d0)\ **Replies:** 0\ **Last updated:** [November 17, 2021, 9:24am UTC](https://discuss.elastic.co/t/ignore-missing-true-from-geoip-processor-is-not-working/289420 "2021-11-17T09:24:06Z")
Hi Everyone, I am using Elasticsearch 7.15, and python to ingest data into Elasticsearch. Before I start the ingestion, I define a pipeline and a mapping. Everything works very smoothly without the geoip processor. Wh… --- ## [Metric Beats Filesystem metric](https://discuss.elastic.co/t/metric-beats-filesystem-metric/289331)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 2\ **Last updated:** [November 17, 2021, 9:04am UTC](https://discuss.elastic.co/t/metric-beats-filesystem-metric/289331 "2021-11-17T09:04:45Z")
System filesystem metricset | Metricbeat Reference \[7.15\] | Elastic says that filesystem data is captured in windows however when trying I get INFO module/wrapper.go:259 Error fetching data for metricbeat system.file… --- ## [Elasticsearch reached the limit of ongoing initial primary recoveries](https://discuss.elastic.co/t/elasticsearch-reached-the-limit-of-ongoing-initial-primary-recoveries/289390)
**Author:** [@alfianaf](https://discuss.elastic.co/u/alfianaf)\ **Replies:** 8\ **Last updated:** [November 17, 2021, 8:58am UTC](https://discuss.elastic.co/t/elasticsearch-reached-the-limit-of-ongoing-initial-primary-recoveries/289390 "2021-11-17T08:58:40Z")
Hello, I've been monitoring my cluster performance and I found my cluster health turned into red when I check with GET \_cluster/allocation/explain?pretty I got this result "node\_allocation\_decisions" : \[ { "n… --- ## [Dashboard \[Filebeat Apache\] Access and error logs ECS](https://discuss.elastic.co/t/dashboard-filebeat-apache-access-and-error-logs-ecs/288993)
**Author:** [@Alphonse\_Kambo](https://discuss.elastic.co/u/Alphonse_Kambo)\ **Replies:** 2\ **Last updated:** [November 17, 2021, 8:28am UTC](https://discuss.elastic.co/t/dashboard-filebeat-apache-access-and-error-logs-ecs/288993 "2021-11-17T08:28:06Z")
Hi Everyone, Can you please tell me the meaning of the unique count of source.address range in this dashboard? --- ## [Share Canvas on website](https://discuss.elastic.co/t/share-canvas-on-website/288480)
**Author:** [@AlexM566](https://discuss.elastic.co/u/AlexM566)\ **Replies:** 2\ **Last updated:** [November 17, 2021, 8:19am UTC](https://discuss.elastic.co/t/share-canvas-on-website/288480 "2021-11-17T08:19:10Z")
Hello everyone, I have a problem. I want to share a canvas in static website, and I follow every step from the documentation and it really show the workpad, BUT without my panels. I inserted in my canvas presentation s… --- ## [Elasticsearch shows "master not discovered yet, this node has not previously joined a bootstrapped (v7+) cluster"](https://discuss.elastic.co/t/elasticsearch-shows-master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster/289406)
**Author:** [@Shaiju\_Sam](https://discuss.elastic.co/u/Shaiju_Sam)\ **Replies:** 0\ **Last updated:** [November 17, 2021, 8:02am UTC](https://discuss.elastic.co/t/elasticsearch-shows-master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster/289406 "2021-11-17T08:02:39Z")
Hello Team, Im setting up a single node cluster and below is my Elasticsearch.yml file cluster.name: my-application node.name: node-1 node.master: true node.data: true bootstrap.memory\_lock: true network.host: CZASM… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1159) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1161)