# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1165 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1166 --- ## [Shard waiting for node even though the node is back](https://discuss.elastic.co/t/shard-waiting-for-node-even-though-the-node-is-back/289108)
**Author:** [@jthoni](https://discuss.elastic.co/u/jthoni)\ **Replies:** 3\ **Last updated:** [November 14, 2021, 9:35am UTC](https://discuss.elastic.co/t/shard-waiting-for-node-even-though-the-node-is-back/289108 "2021-11-14T09:35:44Z")
We have a patching run that is hitting our servers. I don't want relocation to happen during the patching, so I set the delay to a window longer than the patching takes. This generally works as the node goes down, then a… --- ## [Filter messages that contains some specific text](https://discuss.elastic.co/t/filter-messages-that-contains-some-specific-text/288853)
**Author:** [@dardar4](https://discuss.elastic.co/u/dardar4)\ **Replies:** 4\ **Last updated:** [November 14, 2021, 7:51am UTC](https://discuss.elastic.co/t/filter-messages-that-contains-some-specific-text/288853 "2021-11-14T07:51:47Z")
Hi all we got a lot of logs that look like that: "Health check took 00:00:00.0057867 and resulted with status: Healthy" "Health check took 00:00:00.0035042 and resulted with status: Healthy" Is there a way to tell ki… --- ## [ES Cluster status with no data nodes](https://discuss.elastic.co/t/es-cluster-status-with-no-data-nodes/289089)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 13\ **Last updated:** [November 13, 2021, 7:31am UTC](https://discuss.elastic.co/t/es-cluster-status-with-no-data-nodes/289089 "2021-11-13T07:31:23Z")
Hey there, if I start a cluster with 3 nodes from scratch without any DATA nodes, is there a way to mark immediately it with YELLOW status? --- ## [Is there a way to determine the timestamp of index consistency](https://discuss.elastic.co/t/is-there-a-way-to-determine-the-timestamp-of-index-consistency/289025)
**Author:** [@Richard\_Ney](https://discuss.elastic.co/u/Richard_Ney)\ **Replies:** 5\ **Last updated:** [November 12, 2021, 10:21pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-determine-the-timestamp-of-index-consistency/289025 "2021-11-12T22:21:37Z")
We're designing a system where we are indexing a large number of document and we want the ability to determine a time watermark where we can claim all documents in an index inserted/update before a certain timestamp are … --- ## [Mapbox vector tile with elasticsearch 7.15](https://discuss.elastic.co/t/mapbox-vector-tile-with-elasticsearch-7-15/289092)
**Author:** [@tleduong](https://discuss.elastic.co/u/tleduong)\ **Replies:** 1\ **Last updated:** [November 12, 2021, 10:14pm UTC](https://discuss.elastic.co/t/mapbox-vector-tile-with-elasticsearch-7-15/289092 "2021-11-12T22:14:40Z")
Anyone have experience enabling mapbox vector tile for Elastic? I have a v7.15 docker container of Elasticsearch running with basic authentication but getting this error when I try to access to index/\_mvt/spatial\_field/:… --- ## [How to use different indices for a single dashboard](https://discuss.elastic.co/t/how-to-use-different-indices-for-a-single-dashboard/289081)
**Author:** [@Sergio\_Ferreyra](https://discuss.elastic.co/u/Sergio_Ferreyra)\ **Replies:** 1\ **Last updated:** [November 12, 2021, 8:42pm UTC](https://discuss.elastic.co/t/how-to-use-different-indices-for-a-single-dashboard/289081 "2021-11-12T20:42:15Z")
Hey team, I need a particular doubt or issue about how to create different visualizations from different indices. I mean, we have a dashboard to monitor our application, Into that dashboard, we have different visualizati… --- ## [Filter does not work properly](https://discuss.elastic.co/t/filter-does-not-work-properly/289039)
**Author:** [@111435](https://discuss.elastic.co/u/111435)\ **Replies:** 1\ **Last updated:** [November 12, 2021, 5:47pm UTC](https://discuss.elastic.co/t/filter-does-not-work-properly/289039 "2021-11-12T17:47:43Z")
I have this filter: filter { mutate { convert =\> {"ticket\_fields" =\> "string" "tags" =\> "string"} } mutate { rename =\> { "tags" =\> "category" } } if "неактивность" in \[category\] { if "Диалог не состоя… --- ## [Elasticsearch schedule not working](https://discuss.elastic.co/t/elasticsearch-schedule-not-working/289088)
**Author:** [@SANDRA\_ROY\_ARICATT](https://discuss.elastic.co/u/SANDRA_ROY_ARICATT)\ **Replies:** 1\ **Last updated:** [November 12, 2021, 4:57pm UTC](https://discuss.elastic.co/t/elasticsearch-schedule-not-working/289088 "2021-11-12T16:57:57Z")
Even when I provided the schedule option, logstash is getting records from MySQL every second. I wanted logstash to poll MySQL only in every 30 minutes. logstash db.conf file #file : db.conf input{ jdbc { #connecti… --- ## [Logstash connection with oracle wallet](https://discuss.elastic.co/t/logstash-connection-with-oracle-wallet/289086)
**Author:** [@rodolfo\_pedra](https://discuss.elastic.co/u/rodolfo_pedra)\ **Replies:** 0\ **Last updated:** [November 12, 2021, 3:47pm UTC](https://discuss.elastic.co/t/logstash-connection-with-oracle-wallet/289086 "2021-11-12T15:47:55Z")
Hello I'm trying to make a connection to oracle database that uses wallet. I didn't find enough information to do it, so I decided to do it according to my knowledge, but I'm not successful. If anyone can help me. inpu… --- ## [Filebeat ssl not working](https://discuss.elastic.co/t/filebeat-ssl-not-working/289077)
**Author:** [@dessy53](https://discuss.elastic.co/u/dessy53)\ **Replies:** 0\ **Last updated:** [November 12, 2021, 2:36pm UTC](https://discuss.elastic.co/t/filebeat-ssl-not-working/289077 "2021-11-12T14:36:26Z")
Continuing the discussion from Filebeat not fowarding to Logstash: filebeat not working after configuring ssl. below is my filebeat.yml file --- ## [Hide "Look inside document" from saved search](https://discuss.elastic.co/t/hide-look-inside-document-from-saved-search/288651)
**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\ **Replies:** 2\ **Last updated:** [November 12, 2021, 12:56pm UTC](https://discuss.elastic.co/t/hide-look-inside-document-from-saved-search/288651 "2021-11-12T12:56:58Z")
Hello, I need a simple visualization to show the last records of an index, but only show certain fields. I'm able to do it using "Save search" but I want to disable the button to "look inside the document" because I do… --- ## [Does elasticsearch provide technical help through any call apps?](https://discuss.elastic.co/t/does-elasticsearch-provide-technical-help-through-any-call-apps/288758)
**Author:** [@MinwooKim](https://discuss.elastic.co/u/MinwooKim)\ **Replies:** 3\ **Last updated:** [November 12, 2021, 12:34pm UTC](https://discuss.elastic.co/t/does-elasticsearch-provide-technical-help-through-any-call-apps/288758 "2021-11-12T12:34:43Z")
I am an amateur that has to cover any problem with Elasticsearch.... I have troubles covering the management in this system.... Is there any way I could get checkup for the status of our system in realtime like phone … --- ## [Viewing the most recent data](https://discuss.elastic.co/t/viewing-the-most-recent-data/286965)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 3\ **Last updated:** [November 12, 2021, 11:35am UTC](https://discuss.elastic.co/t/viewing-the-most-recent-data/286965 "2021-11-12T11:35:21Z")
So I am capturing data in elastic. It happens to be status of our scheduled tasks. What I cannot work out is how to display that data on a kibana dashboard. I have set up a search and can show the raw data, but that's… --- ## [Grok pattern for a unique value inside a field](https://discuss.elastic.co/t/grok-pattern-for-a-unique-value-inside-a-field/288890)
**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\ **Replies:** 2\ **Last updated:** [November 12, 2021, 9:35am UTC](https://discuss.elastic.co/t/grok-pattern-for-a-unique-value-inside-a-field/288890 "2021-11-12T09:35:20Z")
need to create a new field status\_code with value-successful by using ingest pipeline when status inside message field has 200 and when status inside message field is 502,404,402 it muse create status\_code with value fai… --- ## [Detect when the setup command was already executed on a machine](https://discuss.elastic.co/t/detect-when-the-setup-command-was-already-executed-on-a-machine/288983)
**Author:** [@VirtualEvan](https://discuss.elastic.co/u/VirtualEvan)\ **Replies:** 3\ **Last updated:** [November 12, 2021, 9:18am UTC](https://discuss.elastic.co/t/detect-when-the-setup-command-was-already-executed-on-a-machine/288983 "2021-11-12T09:18:32Z")
Hi there. I am working on some PowerShell DSC configurations which include installation and setup of Filebeat. In general everything works fine, but I am struggling to find a way to detect if the setup command was alrea… --- ## [Filebeat published syslogs aren't showing up in Kibana](https://discuss.elastic.co/t/filebeat-published-syslogs-arent-showing-up-in-kibana/289050)
**Author:** [@dahe](https://discuss.elastic.co/u/dahe)\ **Replies:** 1\ **Last updated:** [November 12, 2021, 9:00am UTC](https://discuss.elastic.co/t/filebeat-published-syslogs-arent-showing-up-in-kibana/289050 "2021-11-12T09:00:31Z")
I'm sending generated syslogs from kiwi syslog generator from one machine to another. Filebeat is expecting syslog input and receives them successfully. Filebeat log clearly states that events are being published. But I… --- ## [Kibana shows documents from different indices in one index, why?](https://discuss.elastic.co/t/kibana-shows-documents-from-different-indices-in-one-index-why/288962)
**Author:** [@My\_Google\_Account](https://discuss.elastic.co/u/My_Google_Account)\ **Replies:** 9\ **Last updated:** [November 12, 2021, 7:12am UTC](https://discuss.elastic.co/t/kibana-shows-documents-from-different-indices-in-one-index-why/288962 "2021-11-12T07:12:18Z")
Hello! ELK stack is 7.15 and i have one problem, we have a pipeline in logstash and two different configs with different ports 5000 and 6000 in input section, then filter where we set a field for cassandra logs: \[fields\]… --- ## [Parsing logs using Regex pattern in logstash filter](https://discuss.elastic.co/t/parsing-logs-using-regex-pattern-in-logstash-filter/288117)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 2\ **Last updated:** [November 12, 2021, 6:53am UTC](https://discuss.elastic.co/t/parsing-logs-using-regex-pattern-in-logstash-filter/288117 "2021-11-12T06:53:22Z")
Hi, I am using logstash to ingest data into the Elasticsearch using a txt file. I build a regex query to extract msg-id field from the logs, but msg-id field is not getting extracted though the regex query is working f… --- ## [Odd swap metric values with Metricbeat 7.15.2 in Windows](https://discuss.elastic.co/t/odd-swap-metric-values-with-metricbeat-7-15-2-in-windows/288956)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 0\ **Last updated:** [November 11, 2021, 7:00am UTC](https://discuss.elastic.co/t/odd-swap-metric-values-with-metricbeat-7-15-2-in-windows/288956 "2021-11-11T07:00:57Z")
Hi, everyone I have installed a Metricbeat 7.15.1 in Windows Server 2019. Here you are a screenshot about memory: Metricbeat: Are these values right? I don't understand very well swap metrics. Thanks in advanc… --- ## [Constant GC warnings with small indexes](https://discuss.elastic.co/t/constant-gc-warnings-with-small-indexes/288433)
**Author:** [@lesleyr1](https://discuss.elastic.co/u/lesleyr1)\ **Replies:** 3\ **Last updated:** [November 12, 2021, 6:15am UTC](https://discuss.elastic.co/t/constant-gc-warnings-with-small-indexes/288433 "2021-11-12T06:15:10Z")
Hello everyone, My team is getting constant GC overhead warnings on our production Elasticsearch cluster for our Liferay application, at least 5 times each minute. This occurs any time, not just when reindexing. "mess… --- ## [Some vulnerabilities in Elasticsearch v7.10.0](https://discuss.elastic.co/t/some-vulnerabilities-in-elasticsearch-v7-10-0/289030)
**Author:** [@Sagarika\_Mahalik](https://discuss.elastic.co/u/Sagarika_Mahalik)\ **Replies:** 2\ **Last updated:** [November 12, 2021, 5:12am UTC](https://discuss.elastic.co/t/some-vulnerabilities-in-elasticsearch-v7-10-0/289030 "2021-11-12T05:12:40Z")
There are few vulnerabilities coming from Elasticsearch 7.10.0 Can you have a look into these issues? Are they false positive issues? If not how can we mitigate these issues? NVD - CVE-2021-22147 NVD - CVE-2021-22145 … --- ## [Cross Cluster Search Configuration for Basic Auth / RBAC](https://discuss.elastic.co/t/cross-cluster-search-configuration-for-basic-auth-rbac/288533)
**Author:** [@ss\_22](https://discuss.elastic.co/u/ss_22)\ **Replies:** 2\ **Last updated:** [November 12, 2021, 2:19am UTC](https://discuss.elastic.co/t/cross-cluster-search-configuration-for-basic-auth-rbac/288533 "2021-11-12T02:19:46Z")
Hello, I am struggling to set up two separate Elasticsearch clusters and perform cross cluster search using Kibana and its remote indexes. I have seen a few examples outlining the process but not explicitly for cluster… --- ## [How to Improve throughput of Azure EventHub input plugin](https://discuss.elastic.co/t/how-to-improve-throughput-of-azure-eventhub-input-plugin/288871)
**Author:** [@menha](https://discuss.elastic.co/u/menha)\ **Replies:** 1\ **Last updated:** [November 12, 2021, 1:56am UTC](https://discuss.elastic.co/t/how-to-improve-throughput-of-azure-eventhub-input-plugin/288871 "2021-11-12T01:56:53Z")
Hi Experts, I am using Azure EventHub plugin as input in Logstash, but the event receiving rate is at most around 1.2k/s, it cannot be improved by any methods i tried. Currently the events being ingested to EventHub wou… --- ## [Filter json parse is replacing tags set from the input](https://discuss.elastic.co/t/filter-json-parse-is-replacing-tags-set-from-the-input/289032)
**Author:** [@teebu](https://discuss.elastic.co/u/teebu)\ **Replies:** 2\ **Last updated:** [November 12, 2021, 1:21am UTC](https://discuss.elastic.co/t/filter-json-parse-is-replacing-tags-set-from-the-input/289032 "2021-11-12T01:21:36Z")
I have input that sets tags input { ... tags =\> \["a"\] } But in the filter, I do a json parse: filter { json { source =\> "i" } } And part of that parse, includes tags. However, the tags it has replace the … --- ## [Deployment considerations for beats containing dashboards](https://discuss.elastic.co/t/deployment-considerations-for-beats-containing-dashboards/289021)
**Author:** [@jhettich](https://discuss.elastic.co/u/jhettich)\ **Replies:** 0\ **Last updated:** [November 11, 2021, 9:49pm UTC](https://discuss.elastic.co/t/deployment-considerations-for-beats-containing-dashboards/289021 "2021-11-11T21:49:39Z")
Beats often contain dashboards, which can be imported into Kibana by running the "setup" command. However, beats are typically data shippers that you install as agents on your servers. Since, from a deployment perspect… --- ## [How can I use a proxy as gateway of my logstash to controll my elasticsearch cluster users?](https://discuss.elastic.co/t/how-can-i-use-a-proxy-as-gateway-of-my-logstash-to-controll-my-elasticsearch-cluster-users/288965)
**Author:** [@skylogs](https://discuss.elastic.co/u/skylogs)\ **Replies:** 0\ **Last updated:** [November 11, 2021, 8:16am UTC](https://discuss.elastic.co/t/how-can-i-use-a-proxy-as-gateway-of-my-logstash-to-controll-my-elasticsearch-cluster-users/288965 "2021-11-11T08:16:36Z")
Hi, I'm trying to design Elasticsearch as a service platform and I want to control my user in size of logs that they can send to my cluster. how can drop some user's log in logstash input or using a gateway before logst… --- ## [Cannot use database\_file in ingest-geoip, please send help every thread here is a dead end](https://discuss.elastic.co/t/cannot-use-database-file-in-ingest-geoip-please-send-help-every-thread-here-is-a-dead-end/289016)
**Author:** [@reyjrar](https://discuss.elastic.co/u/reyjrar)\ **Replies:** 2\ **Last updated:** [November 11, 2021, 8:58pm UTC](https://discuss.elastic.co/t/cannot-use-database-file-in-ingest-geoip-please-send-help-every-thread-here-is-a-dead-end/289016 "2021-11-11T20:58:18Z")
Hi, I've been trying to setup ingest-geoip with our paid MaxMind databases. I cannot get them to work, regardless of where I put these files, I get "reason" : "\[database\_file\] database file \[GeoIP2-City.mmdb\] … --- ## [Filebeat source field missing in 7.8](https://discuss.elastic.co/t/filebeat-source-field-missing-in-7-8/289005)
**Author:** [@PMDubuc](https://discuss.elastic.co/u/PMDubuc)\ **Replies:** 5\ **Last updated:** [November 11, 2021, 8:48pm UTC](https://discuss.elastic.co/t/filebeat-source-field-missing-in-7-8/289005 "2021-11-11T20:48:31Z")
We've recently upgraded our elastic stack and have upgraded our Filebeat version from 5.6.14 to 7.8.1. The old version used to provide a "source" field that contained the path name of the log file. This field is missin… --- ## [Shipping log from an unmanagable folder structure using filebeat](https://discuss.elastic.co/t/shipping-log-from-an-unmanagable-folder-structure-using-filebeat/289014)
**Author:** [@luka.klaric](https://discuss.elastic.co/u/luka.klaric)\ **Replies:** 0\ **Last updated:** [November 11, 2021, 6:46pm UTC](https://discuss.elastic.co/t/shipping-log-from-an-unmanagable-folder-structure-using-filebeat/289014 "2021-11-11T18:46:09Z")
I am trying to ship log files to logstash using filebeat. The folder structure of the input path is currently very branchy and very big. We have a following structure: \/\/\/\/\ **Author:** [@dmitryyankowski](https://discuss.elastic.co/u/dmitryyankowski)\ **Replies:** 1\ **Last updated:** [November 11, 2021, 5:34pm UTC](https://discuss.elastic.co/t/fleet-server-installation-issue/287741 "2021-11-11T17:34:50Z") Note: OS is Ubuntu 20.04 and running Elastic Agent v7.15.1 I'm trying to setup a Fleet Server on my server and Elastic-Agent doesn't seem to be respecting the option for specifying my Fleet Server URL endpoint via the K… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1164) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1166)