# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1196 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1197 --- ## [FileBeat multiline.maxLine Limit](https://discuss.elastic.co/t/filebeat-multiline-maxline-limit/287075)
**Author:** [@Anandh\_Kumar](https://discuss.elastic.co/u/Anandh_Kumar)\ **Replies:** 0\ **Last updated:** [October 19, 2021, 10:52am UTC](https://discuss.elastic.co/t/filebeat-multiline-maxline-limit/287075 "2021-10-19T10:52:41Z")
Hello All, is there a maximum limit for the max\_lines parameter for multiline messages. The lines in the file used in the application may vary and not have a defined maximum limit. In that case is it possible to do a un… --- ## [Snapshot index compatibility](https://discuss.elastic.co/t/snapshot-index-compatibility/287067)
**Author:** [@str8y](https://discuss.elastic.co/u/str8y)\ **Replies:** 1\ **Last updated:** [October 19, 2021, 10:06am UTC](https://discuss.elastic.co/t/snapshot-index-compatibility/287067 "2021-10-19T10:06:55Z")
Hi, I found in the snapshot documentation the compatibility matrix and the following hint Each snapshot can contain indices created in various versions of Elasticsearch. This includes backing indices created for data… --- ## [Filebeat httpjson cursor](https://discuss.elastic.co/t/filebeat-httpjson-cursor/287069)
**Author:** [@vladislav](https://discuss.elastic.co/u/vladislav)\ **Replies:** 0\ **Last updated:** [October 19, 2021, 9:55am UTC](https://discuss.elastic.co/t/filebeat-httpjson-cursor/287069 "2021-10-19T09:55:35Z")
Hello! How to manually clear state of cursor when using httpjson in filebeat? If I get some data using httpjson-cursor and then delete index in Kibana, containing data from it I can't get this data again. Answers from … --- ## [Metricbeat hidden indexes](https://discuss.elastic.co/t/metricbeat-hidden-indexes/287065)
**Author:** [@bm-ai](https://discuss.elastic.co/u/bm-ai)\ **Replies:** 0\ **Last updated:** [October 19, 2021, 9:14am UTC](https://discuss.elastic.co/t/metricbeat-hidden-indexes/287065 "2021-10-19T09:14:10Z")
Hi, I've been using ES and Metricbeat for a while now and I've noticed that my ES nodes capacity is getting full pretty fast even though I have ILM enabled on all Metricbeats indexes. I can see many hidden indexes from … --- ## [Saving request.url variable in filebeat httpjson](https://discuss.elastic.co/t/saving-request-url-variable-in-filebeat-httpjson/286700)
**Author:** [@vladislav](https://discuss.elastic.co/u/vladislav)\ **Replies:** 8\ **Last updated:** [October 19, 2021, 9:48am UTC](https://discuss.elastic.co/t/saving-request-url-variable-in-filebeat-httpjson/286700 "2021-10-19T09:48:14Z")
Good day! The question arose, is it possible to save the last received value of the request.url parameter and then read from it upon request? I use httpjson as an input module with the following settings: # ===========… --- ## [How to monitor cause of deletion of documents in index?](https://discuss.elastic.co/t/how-to-monitor-cause-of-deletion-of-documents-in-index/287052)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 3\ **Last updated:** [October 19, 2021, 9:36am UTC](https://discuss.elastic.co/t/how-to-monitor-cause-of-deletion-of-documents-in-index/287052 "2021-10-19T09:36:53Z")
Dears, Is there any way to monitor process of deletion of documents from index? I'm asking about it because of from few days I observed this odd behavior. Similar situation I had when doc id was the same for few docume… --- ## [Error after OS upgrade](https://discuss.elastic.co/t/error-after-os-upgrade/286966)
**Author:** [@Zincometal](https://discuss.elastic.co/u/Zincometal)\ **Replies:** 6\ **Last updated:** [October 19, 2021, 9:04am UTC](https://discuss.elastic.co/t/error-after-os-upgrade/286966 "2021-10-19T09:04:23Z")
Hello all, I'm a newbie to ELK and after many search I've not found a solution. After an OS upgrade Devuan 3 =\> Devuan 4 my filebeat doesn't work. The error in /var/log/filebeat.log is this: Preformatted text2021-10-… --- ## [Ubuntu 20.04 tar/zip installed - systemd timeout](https://discuss.elastic.co/t/ubuntu-20-04-tar-zip-installed-systemd-timeout/287000)
**Author:** [@imper86](https://discuss.elastic.co/u/imper86)\ **Replies:** 3\ **Last updated:** [October 19, 2021, 9:04am UTC](https://discuss.elastic.co/t/ubuntu-20-04-tar-zip-installed-systemd-timeout/287000 "2021-10-19T09:04:09Z")
Hello, I have a strange issue with a fresh tar/zip installation of Elasticsearch. When I use Elasticsearch v6 this way - there is no problem. Also apt installation works fine. But when I want to use systemd with Elastic… --- ## [Elastic-agent install -f](https://discuss.elastic.co/t/elastic-agent-install-f/286753)
**Author:** [@Greg\_R](https://discuss.elastic.co/u/Greg_R)\ **Replies:** 13\ **Last updated:** [October 19, 2021, 9:03am UTC](https://discuss.elastic.co/t/elastic-agent-install-f/286753 "2021-10-19T09:03:08Z")
Greetings I'm trying to set up fleet. All along the doc I see: elastic-agent install -f but the -f flag is not documented anywhere (and make the elastic-agent choke in the docker version). What is it for? My goal is … --- ## [Optimizing agg on collapse](https://discuss.elastic.co/t/optimizing-agg-on-collapse/287058)
**Author:** [@CarloKok](https://discuss.elastic.co/u/CarloKok)\ **Replies:** 0\ **Last updated:** [October 19, 2021, 8:24am UTC](https://discuss.elastic.co/t/optimizing-agg-on-collapse/287058 "2021-10-19T08:24:53Z")
I have an index with "availability" of rooms in a set of hotels. Each record has among other things: HotelCode RoomType arrival Date Departure Date Price for stay Bunch of room features to filter on The nr of records … --- ## [Coloring Metric aggregation based on String](https://discuss.elastic.co/t/coloring-metric-aggregation-based-on-string/286821)
**Author:** [@Cibot](https://discuss.elastic.co/u/Cibot)\ **Replies:** 3\ **Last updated:** [October 19, 2021, 8:14am UTC](https://discuss.elastic.co/t/coloring-metric-aggregation-based-on-string/286821 "2021-10-19T08:14:54Z")
I have been trying to create a dashboard with relevant information for a service. As such we display logs, uptime over time, errors, current state and so on. To make it easy to indicate whether a service is down, I wan… --- ## [How to apply combination of filters on array of objects?](https://discuss.elastic.co/t/how-to-apply-combination-of-filters-on-array-of-objects/286946)
**Author:** [@nsharma2412](https://discuss.elastic.co/u/nsharma2412)\ **Replies:** 3\ **Last updated:** [October 19, 2021, 7:30am UTC](https://discuss.elastic.co/t/how-to-apply-combination-of-filters-on-array-of-objects/286946 "2021-10-19T07:30:47Z")
Hi Please help me to write a suitable query for my task, I have list of products with different categories and associated attribute and tags. Here is two documents for two categories along with associated attribute list.… --- ## [Logstash Pipeline in Elastic Cloud](https://discuss.elastic.co/t/logstash-pipeline-in-elastic-cloud/287017)
**Author:** [@vladik22](https://discuss.elastic.co/u/vladik22)\ **Replies:** 3\ **Last updated:** [October 19, 2021, 6:06am UTC](https://discuss.elastic.co/t/logstash-pipeline-in-elastic-cloud/287017 "2021-10-19T06:06:11Z")
Hello I'm new on Elastic Cloud. I understood how to send data to Elasticsearch on cloud via logstash. In Kibana I saw option "Logstash Pipelines". How can I use it? I want to send files via filebeat to logstash on… --- ## [Curator failed to delete snapshot: No space left on device](https://discuss.elastic.co/t/curator-failed-to-delete-snapshot-no-space-left-on-device/285189)
**Author:** [@chaitra\_hegde](https://discuss.elastic.co/u/chaitra_hegde)\ **Replies:** 2\ **Last updated:** [October 19, 2021, 5:29am UTC](https://discuss.elastic.co/t/curator-failed-to-delete-snapshot-no-space-left-on-device/285189 "2021-10-19T05:29:09Z")
Hi, I am facing below issue in Curator snapshot deletion. Curator version- 5.8.1, ES- 7.10.2 2021-09-19 02:01:01,159 ERROR Failed to complete action: delete\_snapshots. \:… --- ## [Logstash can't read the environment variable](https://discuss.elastic.co/t/logstash-cant-read-the-environment-variable/286949)
**Author:** [@ramilbermejo](https://discuss.elastic.co/u/ramilbermejo)\ **Replies:** 2\ **Last updated:** [October 19, 2021, 4:58am UTC](https://discuss.elastic.co/t/logstash-cant-read-the-environment-variable/286949 "2021-10-19T04:58:42Z")
Good day everyone! Need some help here. On my dev environment, checking the logstash configuration will show this error. root@devlogstash:~# /usr/share/logstash/bin/logstash --path.settings /etc/logstash -t OpenJDK 64… --- ## [Ingesting JSON logs with filebeat and logstash](https://discuss.elastic.co/t/ingesting-json-logs-with-filebeat-and-logstash/286874)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 8\ **Last updated:** [October 19, 2021, 4:47am UTC](https://discuss.elastic.co/t/ingesting-json-logs-with-filebeat-and-logstash/286874 "2021-10-19T04:47:05Z")
I hope this messages finds the community member's safe and healthy. I am trying to ingest around 600 GB of logs spread across multiple JSON files. Here are few lings of logs (these are scrubbed DNS logs) {"timestamp":"… --- ## [Logstash OutOfMemoryError: Direct buffer memory](https://discuss.elastic.co/t/logstash-outofmemoryerror-direct-buffer-memory/286473)
**Author:** [@Muthu\_Ramachandran\_K](https://discuss.elastic.co/u/Muthu_Ramachandran_K)\ **Replies:** 2\ **Last updated:** [October 19, 2021, 3:41am UTC](https://discuss.elastic.co/t/logstash-outofmemoryerror-direct-buffer-memory/286473 "2021-10-19T03:41:15Z")
Hi, we are using filebeat-\> logstash -\> elastic setup. The set up was working fine without any issues, but recently we noticed that logstash is going down frequently and we could see the below error. can anyone suggest … --- ## [Filebeat \[7.15.0\] hints based discovery does nothing](https://discuss.elastic.co/t/filebeat-7-15-0-hints-based-discovery-does-nothing/287045)
**Author:** [@gwvandesteeg](https://discuss.elastic.co/u/gwvandesteeg)\ **Replies:** 0\ **Last updated:** [October 19, 2021, 3:13am UTC](https://discuss.elastic.co/t/filebeat-7-15-0-hints-based-discovery-does-nothing/287045 "2021-10-19T03:13:27Z")
Continuing the discussion from Filebeat doesn't send logs to Elasticsearch: We're having the exact same problem as the above which doesn't appear to have ever been resolved. Using filebeat 7.15.0, exact same config as … --- ## [Filebeat Fortinet Firewall Module 7.15.1](https://discuss.elastic.co/t/filebeat-fortinet-firewall-module-7-15-1/287046)
**Author:** [@unknown\_user](https://discuss.elastic.co/u/unknown_user)\ **Replies:** 0\ **Last updated:** [October 19, 2021, 3:16am UTC](https://discuss.elastic.co/t/filebeat-fortinet-firewall-module-7-15-1/287046 "2021-10-19T03:16:35Z")
I just started using filebeat fortinet module and noticed that the module failed to split the fields on a fortigate 6.4.7 I've resolved the issue by changing, field\_split: " (?=\[a-z\\\\\_\\\\-\]+=)" to field\_split: ",(?=\[a… --- ## [How we add additional information on Kibana Visualize which is queried by Buckets's X-axis result IDs?](https://discuss.elastic.co/t/how-we-add-additional-information-on-kibana-visualize-which-is-queried-by-bucketss-x-axis-result-ids/287044)
**Author:** [@matoi](https://discuss.elastic.co/u/matoi)\ **Replies:** 0\ **Last updated:** [October 19, 2021, 3:10am UTC](https://discuss.elastic.co/t/how-we-add-additional-information-on-kibana-visualize-which-is-queried-by-bucketss-x-axis-result-ids/287044 "2021-10-19T03:10:36Z")
Hello, I'd like to show the additional information on Kibana Visualize close to Buckets's X-axis. Currently, my X-axis result is document's ids. (That is parent data) These documents have children documents. (But we do… --- ## [S3-input-plugin; restart logstash on aws\_credentials\_file update](https://discuss.elastic.co/t/s3-input-plugin-restart-logstash-on-aws-credentials-file-update/287036)
**Author:** [@jnkroeker](https://discuss.elastic.co/u/jnkroeker)\ **Replies:** 2\ **Last updated:** [October 19, 2021, 2:07am UTC](https://discuss.elastic.co/t/s3-input-plugin-restart-logstash-on-aws-credentials-file-update/287036 "2021-10-19T02:07:49Z")
Hey there, How can I force logstash to restart when my aws\_credentials\_file is updated? --config.reload.automatic does not appear to work here as neither the config.yaml or pipelines.yaml files are changing. the aws\_cr… --- ## [Filebeat. How drop events with IIS module?](https://discuss.elastic.co/t/filebeat-how-drop-events-with-iis-module/286637)
**Author:** [@psyapathy](https://discuss.elastic.co/u/psyapathy)\ **Replies:** 2\ **Last updated:** [October 19, 2021, 1:43am UTC](https://discuss.elastic.co/t/filebeat-how-drop-events-with-iis-module/286637 "2021-10-19T01:43:12Z")
Hi! I use IIS module for collect IIS logs. I want drop events if field url.path contains "layouts". Where in the config should I use the processors block with drop\_events? In filebeat.yml or iis.yml? Can you show me … --- ## [Certificates between Elasticsearch/Kibana RHEL VM and certificate authority Windows server](https://discuss.elastic.co/t/certificates-between-elasticsearch-kibana-rhel-vm-and-certificate-authority-windows-server/287012)
**Author:** [@rebellionne](https://discuss.elastic.co/u/rebellionne)\ **Replies:** 1\ **Last updated:** [October 19, 2021, 1:23am UTC](https://discuss.elastic.co/t/certificates-between-elasticsearch-kibana-rhel-vm-and-certificate-authority-windows-server/287012 "2021-10-19T01:23:56Z")
Hi everybody After days of research, I finally decided to ask for help. I must precise that working with certificates is quite new to me especially on Linux environment. I run Elasticsearch and Kibana 7.15.0 on the sa… --- ## [Elasticsearch can not started：failed to find global metadata](https://discuss.elastic.co/t/elasticsearch-can-not-started-failed-to-find-global-metadata/287037)
**Author:** [@wangdwcsd](https://discuss.elastic.co/u/wangdwcsd)\ **Replies:** 9\ **Last updated:** [October 19, 2021, 1:02am UTC](https://discuss.elastic.co/t/elasticsearch-can-not-started-failed-to-find-global-metadata/287037 "2021-10-19T01:02:15Z")
After the master node is restarted, it cannot be started. The following errors are always reported in the log，Is there any way to enable the Elasticsearch instance to load metadata？ error log： \[2021-10-19T02:32:17,262\]… --- ## [All Packetbeat dashboards version 7.15.0 don't work: Invalid JSON in search source](https://discuss.elastic.co/t/all-packetbeat-dashboards-version-7-15-0-dont-work-invalid-json-in-search-source/285824)
**Author:** [@hermanator](https://discuss.elastic.co/u/hermanator)\ **Replies:** 14\ **Last updated:** [October 18, 2021, 11:15pm UTC](https://discuss.elastic.co/t/all-packetbeat-dashboards-version-7-15-0-dont-work-invalid-json-in-search-source/285824 "2021-10-18T23:15:02Z")
Hello, I can't get the dashboards for packetbeat to work. The list with packetbeat dashboards are visible in Kibana, but after clicking any of them I get the error: Invalid JSON in search source. I've setup packetbeat… --- ## [Filebeat configuration](https://discuss.elastic.co/t/filebeat-configuration/286972)
**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\ **Replies:** 0\ **Last updated:** [October 18, 2021, 10:24am UTC](https://discuss.elastic.co/t/filebeat-configuration/286972 "2021-10-18T10:24:51Z")
I have to read logs from different server so I am using filebeat for that. in filebeat yml file I have mention filebeat.inputs: - type: log enabled: true paths: - /home/3rdisearch-dev/project/mangeshs/logs/ind… --- ## [Can't connect to ElasticSearch from python API in Docker-Compose setup](https://discuss.elastic.co/t/cant-connect-to-elasticsearch-from-python-api-in-docker-compose-setup/287031)
**Author:** [@amace](https://discuss.elastic.co/u/amace)\ **Replies:** 4\ **Last updated:** [October 18, 2021, 10:33pm UTC](https://discuss.elastic.co/t/cant-connect-to-elasticsearch-from-python-api-in-docker-compose-setup/287031 "2021-10-18T22:33:36Z")
Here is how I create the ES container in Docker-Compose: db: image: docker.elastic.co/elasticsearch/elasticsearch:7.15.1 restart: always ports: - 9200:9200 - 9300:9300 ulimits: memlock:… --- ## [Receive multiple Logstash inputs with TCP, UDP and Beats](https://discuss.elastic.co/t/receive-multiple-logstash-inputs-with-tcp-udp-and-beats/287020)
**Author:** [@sakshat](https://discuss.elastic.co/u/sakshat)\ **Replies:** 6\ **Last updated:** [October 18, 2021, 9:06pm UTC](https://discuss.elastic.co/t/receive-multiple-logstash-inputs-with-tcp-udp-and-beats/287020 "2021-10-18T21:06:09Z")
Hi everyone, I am trying to get logs input into logstash using TCP, UDP and Beats. I have applications that drain syslog to logstash using tcp and udp and I also have an application that writes logs to files in a server.… --- ## [Elasticsearch s3 plugin error "repository\_verification\_exception"](https://discuss.elastic.co/t/elasticsearch-s3-plugin-error-repository-verification-exception/286781)
**Author:** [@Mark\_Laff](https://discuss.elastic.co/u/Mark_Laff)\ **Replies:** 10\ **Last updated:** [October 18, 2021, 8:24pm UTC](https://discuss.elastic.co/t/elasticsearch-s3-plugin-error-repository-verification-exception/286781 "2021-10-18T20:24:17Z")
I'm running ES 6.8 locally (on Mac OS X installed via Homebrew) $ curl -sS -XGET 127.0.0.1:9200 { "name" : "JdRGfj8", "cluster\_name" : "elasticsearch\_brew", "cluster\_uuid" : "PahjUQpJTpy40myvs-sKMg", "version" :… --- ## [Logstash stops receiving logs](https://discuss.elastic.co/t/logstash-stops-receiving-logs/286897)
**Author:** [@Hamza\_El\_Aouane](https://discuss.elastic.co/u/Hamza_El_Aouane)\ **Replies:** 7\ **Last updated:** [October 18, 2021, 7:38pm UTC](https://discuss.elastic.co/t/logstash-stops-receiving-logs/286897 "2021-10-18T19:38:42Z")
Hi everyone. I am a beginner in logstash and ELK in general. Lately I have been facing an issue with logstash. I am receiving some logs on port 3014, and this is the second time that this is happening and I identified t… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1195) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1197)