# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1197 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1198 --- ## [Logstash in Kubernetes Not Using ServiceAccount with IAM Role](https://discuss.elastic.co/t/logstash-in-kubernetes-not-using-serviceaccount-with-iam-role/286081)
**Author:** [@xzxpurple2017](https://discuss.elastic.co/u/xzxpurple2017)\ **Replies:** 3\ **Last updated:** [October 18, 2021, 7:02pm UTC](https://discuss.elastic.co/t/logstash-in-kubernetes-not-using-serviceaccount-with-iam-role/286081 "2021-10-18T19:02:59Z")
I have a Logstash input to pull logs from S3. I attached a serviceaccount with IAM role to interact with S3 to the Logstash stateful set. I checked that the env variables on the container have AWS\_ROLE\_ARN and AWS\_WEB\_… --- ## [Parsing logs from text file using using logstash](https://discuss.elastic.co/t/parsing-logs-from-text-file-using-using-logstash/286995)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 6:08pm UTC](https://discuss.elastic.co/t/parsing-logs-from-text-file-using-using-logstash/286995 "2021-10-18T18:08:29Z")
Hi, I am having logs in the txt file.I checked with kv, grok and dissect filter to ingest logs using logstash, but as logs format is not the same. Maybe I need to assign field and particular value as this is unstructure… --- ## [Add field if based on another timestamps-field value](https://discuss.elastic.co/t/add-field-if-based-on-another-timestamps-field-value/286985)
**Author:** [@Cibot](https://discuss.elastic.co/u/Cibot)\ **Replies:** 2\ **Last updated:** [October 18, 2021, 5:44pm UTC](https://discuss.elastic.co/t/add-field-if-based-on-another-timestamps-field-value/286985 "2021-10-18T17:44:08Z")
I've been trying to add a field describing the status of the current rpm. Basically I've been using execbeats to execute a command which returns all the currently installed rpms. Now we have an internal tool which basi… --- ## [Uptime Monitors not working](https://discuss.elastic.co/t/uptime-monitors-not-working/286887)
**Author:** [@Peter\_Schlafmann](https://discuss.elastic.co/u/Peter_Schlafmann)\ **Replies:** 11\ **Last updated:** [October 18, 2021, 5:40pm UTC](https://discuss.elastic.co/t/uptime-monitors-not-working/286887 "2021-10-18T17:40:09Z")
Hi Community, I am using latest version of ES+Kibana+Heartbeat - I want to setup icmp uptime monitors for some of my hosts in my private network. Struggling with the configuration. Please see my heartbeat .yml and my o… --- ## [Monitoring Cluster stopped receiving data from Production Cluster](https://discuss.elastic.co/t/monitoring-cluster-stopped-receiving-data-from-production-cluster/286876)
**Author:** [@TonyLuc](https://discuss.elastic.co/u/TonyLuc)\ **Replies:** 2\ **Last updated:** [October 18, 2021, 5:03pm UTC](https://discuss.elastic.co/t/monitoring-cluster-stopped-receiving-data-from-production-cluster/286876 "2021-10-18T17:03:59Z")
Observations OS: Windows Sever 2019 Observations are based on: Metricbeat Version 7.15.0 (amd64), libbeat 7.15.0 \[9023152025ec6251bc6b6c38009b309157f10f17 built 2021-09-16 03:28:25 +0000 UTC\] When MetricBeat A… --- ## [Table with Sum of Last values grouped by kubernetes.pod.uuid](https://discuss.elastic.co/t/table-with-sum-of-last-values-grouped-by-kubernetes-pod-uuid/286992)
**Author:** [@milanvdm](https://discuss.elastic.co/u/milanvdm)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 4:52pm UTC](https://discuss.elastic.co/t/table-with-sum-of-last-values-grouped-by-kubernetes-pod-uuid/286992 "2021-10-18T16:52:34Z")
Ive got a counter on each running kubernetes pod: { name: foo, counter: 5, pod.uuid: 111, timestamp: 1 } and { name: foo, counter: 10, pod.uuid: 111, timestamp: 2 } { name: foo, counter: 5, pod.uuid: 222, timestamp: 1 … --- ## [New in Elastic 7.13.1](https://discuss.elastic.co/t/new-in-elastic-7-13-1/285534)
**Author:** [@tsahoo43](https://discuss.elastic.co/u/tsahoo43)\ **Replies:** 5\ **Last updated:** [October 18, 2021, 4:42pm UTC](https://discuss.elastic.co/t/new-in-elastic-7-13-1/285534 "2021-10-18T16:42:02Z")
Hi Team, I am new to Elasticsearch . I have installed Elastic 7.13.1 and perform some security enabled setting to get the Login page for accessing the Elastic . Could you please help here on " How can I disable the show… --- ## [Cardinality of 1 vs. 0](https://discuss.elastic.co/t/cardinality-of-1-vs-0/287010)
**Author:** [@wolfhoundjesse](https://discuss.elastic.co/u/wolfhoundjesse)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 3:17pm UTC](https://discuss.elastic.co/t/cardinality-of-1-vs-0/287010 "2021-10-18T15:17:51Z")
I'm curious, if cardinality returns the count of distinct values, what does 0 mean? If there are two distinct values, you get 2. If they're all the same, you get 1. My best guess is that a zero means there was nothing to… --- ## [Calculating EPS? events.filtered / duration\_in\_millis is incorrect](https://discuss.elastic.co/t/calculating-eps-events-filtered-duration-in-millis-is-incorrect/286936)
**Author:** [@CamTheMan](https://discuss.elastic.co/u/CamTheMan)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 3:10pm UTC](https://discuss.elastic.co/t/calculating-eps-events-filtered-duration-in-millis-is-incorrect/286936 "2021-10-18T15:10:01Z")
Hello All, I would like to calculate my events per second for logstash. Currently I'm grabbing data via the logstash API but when I calculate the EPS it doesn't match up to what the 'metrics' logstash filter is reporti… --- ## [Search Error The content length (897957165) is bigger than the maximum allowed string (536870888)](https://discuss.elastic.co/t/search-error-the-content-length-897957165-is-bigger-than-the-maximum-allowed-string-536870888/285100)
**Author:** [@vikas1389](https://discuss.elastic.co/u/vikas1389)\ **Replies:** 3\ **Last updated:** [October 18, 2021, 2:31pm UTC](https://discuss.elastic.co/t/search-error-the-content-length-897957165-is-bigger-than-the-maximum-allowed-string-536870888/285100 "2021-10-18T14:31:39Z")
While filtering through logs we getting error: where it mentions content length is bigger. Where is maximum allowed string (536870888) is set- any suggestions to fix this error. --- ## [Logstash CIDR Plugin not working](https://discuss.elastic.co/t/logstash-cidr-plugin-not-working/286267)
**Author:** [@mrodriguez](https://discuss.elastic.co/u/mrodriguez)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 2:25pm UTC](https://discuss.elastic.co/t/logstash-cidr-plugin-not-working/286267 "2021-10-18T14:25:28Z")
Hi, I need to filter events by IP addresses. I would like to use CIDR plugin but it is not working for me. This is my code: filter { if \[type\] == "mytype" { kv{} cidr{ address =\> \[ "%{srcip}" \] network =\>… --- ## [Regex query in 7.13.4](https://discuss.elastic.co/t/regex-query-in-7-13-4/286884)
**Author:** [@junhuangli](https://discuss.elastic.co/u/junhuangli)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 2:24pm UTC](https://discuss.elastic.co/t/regex-query-in-7-13-4/286884 "2021-10-18T14:24:57Z")
After upgrading Elasticsearch from 6.6.2 to 7.13.4, we found the regex query is much slower(10 times slower). We are doing a pretty expensive regex search like ".(\["\]fieldName\["\]:\["\]my-value-\[A-Za-z\]\[A-Za-z\]\[A-Za-z0-9\]\[… --- ## [Best practices to handle jdbc (Postgresql) contents?](https://discuss.elastic.co/t/best-practices-to-handle-jdbc-postgresql-contents/286506)
**Author:** [@lucien.guillermin](https://discuss.elastic.co/u/lucien.guillermin)\ **Replies:** 6\ **Last updated:** [October 18, 2021, 2:24pm UTC](https://discuss.elastic.co/t/best-practices-to-handle-jdbc-postgresql-contents/286506 "2021-10-18T14:24:46Z")
Hello Everyone, I have a beginner question regarding a context in which we have to index a PostgreSQL database with Elastic. Is it required to use an intermediary solution between PostgreSQL and Elastic ? If so what ar… --- ## [Logstash cpu usage blocked at 50%](https://discuss.elastic.co/t/logstash-cpu-usage-blocked-at-50/286465)
**Author:** [@thomastatin](https://discuss.elastic.co/u/thomastatin)\ **Replies:** 2\ **Last updated:** [October 18, 2021, 2:13pm UTC](https://discuss.elastic.co/t/logstash-cpu-usage-blocked-at-50/286465 "2021-10-18T14:13:15Z")
Hi everybody ! I have a logstash pipeline which can receive about 10k e/s in event peaks My logstash usual CPU usage is in "nice" priority with an average 30-40% CPU consumption and without data delay in the data store… --- ## [Log forwarding issue after upgrading logstash](https://discuss.elastic.co/t/log-forwarding-issue-after-upgrading-logstash/286859)
**Author:** [@yankeesfan01x](https://discuss.elastic.co/u/yankeesfan01x)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 2:01pm UTC](https://discuss.elastic.co/t/log-forwarding-issue-after-upgrading-logstash/286859 "2021-10-18T14:01:23Z")
I upgraded the logstash version from 7.12.1 to 7.15.1 and I'm not seeing logs in Kibana from the source host I'm testing with. Is this too much of a jump in versions or did something change in 7.15.1 that I need to upda… --- ## [Event.duration bug](https://discuss.elastic.co/t/event-duration-bug/286733)
**Author:** [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\ **Replies:** 4\ **Last updated:** [October 18, 2021, 1:45pm UTC](https://discuss.elastic.co/t/event-duration-bug/286733 "2021-10-18T13:45:53Z")
I have a field as a double in milliseconds. I want to turn it into nanoseconds and apply it to the event.duration field in logstash, so I can monitor how long certain events take for my machines to process. Here is the … --- ## [Alert when no data on an index](https://discuss.elastic.co/t/alert-when-no-data-on-an-index/286977)
**Author:** [@ansarpalakottal](https://discuss.elastic.co/u/ansarpalakottal)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 1:28pm UTC](https://discuss.elastic.co/t/alert-when-no-data-on-an-index/286977 "2021-10-18T13:28:58Z")
How can I create alerts when no data is there on an index/index pattern ? The Kibana version which I am using is 7.12.1 and having Platinum License. --- ## [How can I match on all log files except ones containing a string](https://discuss.elastic.co/t/how-can-i-match-on-all-log-files-except-ones-containing-a-string/286415)
**Author:** [@dsdameron](https://discuss.elastic.co/u/dsdameron)\ **Replies:** 2\ **Last updated:** [October 18, 2021, 1:20pm UTC](https://discuss.elastic.co/t/how-can-i-match-on-all-log-files-except-ones-containing-a-string/286415 "2021-10-18T13:20:35Z")
We are ingesting the our CPanel system's Apache logs with Filebeat's handy apache module. Our configuration is as follows: var.paths: - "/var/log/apache2/domlogs/\*" However, I've hit a snag. I need to grab a… --- ## [Logs from different sources in single txt file, to be stored in different indices using logstash](https://discuss.elastic.co/t/logs-from-different-sources-in-single-txt-file-to-be-stored-in-different-indices-using-logstash/286694)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 3\ **Last updated:** [October 18, 2021, 1:19pm UTC](https://discuss.elastic.co/t/logs-from-different-sources-in-single-txt-file-to-be-stored-in-different-indices-using-logstash/286694 "2021-10-18T13:19:35Z")
Hi, I am having txt file consist of 3 different logs coming from 3 sources collated into single text file. I want to separate out logs and stored them in a respective index. Sample Logs- 10/12/2021 8:54:00 AM,MSGID: \<… --- ## [Clarification on Output Supported by Elastic Agents - Is Output to Logstash Supported?](https://discuss.elastic.co/t/clarification-on-output-supported-by-elastic-agents-is-output-to-logstash-supported/286777)
**Author:** [@Log\_Gobbler](https://discuss.elastic.co/u/Log_Gobbler)\ **Replies:** 5\ **Last updated:** [October 18, 2021, 1:08pm UTC](https://discuss.elastic.co/t/clarification-on-output-supported-by-elastic-agents-is-output-to-logstash-supported/286777 "2021-10-18T13:08:07Z")
I apologize ahead of time for posting this in the Beats sub, but it appears there isn't a sub for Elastic Agent. Near the top of this page, it states that "Beats and Elastic Agent can both send data directly to Elastics… --- ## [Unable to setup kibana](https://discuss.elastic.co/t/unable-to-setup-kibana/286983)
**Author:** [@mohammed.sabil](https://discuss.elastic.co/u/mohammed.sabil)\ **Replies:** 4\ **Last updated:** [October 18, 2021, 1:00pm UTC](https://discuss.elastic.co/t/unable-to-setup-kibana/286983 "2021-10-18T13:00:52Z")
Hello Team, I am using ansible playbook to run all three Elasticsearch, Kibana and logstash containers in one go. After running the ansible playbook I can see all three containers are up and running. Following is the … --- ## [Why is 7.15 not available in docker hub yet?](https://discuss.elastic.co/t/why-is-7-15-not-available-in-docker-hub-yet/286930)
**Author:** [@blueren](https://discuss.elastic.co/u/blueren)\ **Replies:** 6\ **Last updated:** [October 18, 2021, 12:53pm UTC](https://discuss.elastic.co/t/why-is-7-15-not-available-in-docker-hub-yet/286930 "2021-10-18T12:53:08Z")
Why is 7.15 of Elasticsearch / kibana not available in dockerhub yet? When is it likely to be made available? At the moment, I only see 7.14.2 as the latest available tag. https://hub.docker.com/\_/elasticsearch --- ## [How to get score aggregations on the scores after rescore phase?](https://discuss.elastic.co/t/how-to-get-score-aggregations-on-the-scores-after-rescore-phase/286984)
**Author:** [@Igor\_L](https://discuss.elastic.co/u/Igor_L)\ **Replies:** 0\ **Last updated:** [October 18, 2021, 11:32am UTC](https://discuss.elastic.co/t/how-to-get-score-aggregations-on-the-scores-after-rescore-phase/286984 "2021-10-18T11:32:53Z")
org/Elasticsearch/search/query/QueryPhase.java: // Pre-process aggregations as late as possible. In the case of a DFS\_Q\_T\_F // request, preProcess is called on the DFS phase phase, this is why we pre-process them // her… --- ## [Substract 2 fields from different indexes and plot on Kibana](https://discuss.elastic.co/t/substract-2-fields-from-different-indexes-and-plot-on-kibana/286572)
**Author:** [@pr1yadarshan](https://discuss.elastic.co/u/pr1yadarshan)\ **Replies:** 2\ **Last updated:** [October 18, 2021, 11:02am UTC](https://discuss.elastic.co/t/substract-2-fields-from-different-indexes-and-plot-on-kibana/286572 "2021-10-18T11:02:35Z")
I have 2 indexes (sys-1-logs, sys-2-logs), I want to get the difference of count of both and plot on Kibana. Is this possible to do ? If yes then how to do it ? --- ## [Show records based on last modified date in Kibana](https://discuss.elastic.co/t/show-records-based-on-last-modified-date-in-kibana/286959)
**Author:** [@Farah\_Zaidi](https://discuss.elastic.co/u/Farah_Zaidi)\ **Replies:** 10\ **Last updated:** [October 18, 2021, 10:34am UTC](https://discuss.elastic.co/t/show-records-based-on-last-modified-date-in-kibana/286959 "2021-10-18T10:34:46Z")
Hi All , I have a requirement where we have same ids with different status but we need to show only the last status of the id based on last modified date . For Example {id : 123, status:validated, modifiedAt:Oct… --- ## [Elastic watcher webhook - lack of retry mechanism](https://discuss.elastic.co/t/elastic-watcher-webhook-lack-of-retry-mechanism/286973)
**Author:** [@hcdmonitor](https://discuss.elastic.co/u/hcdmonitor)\ **Replies:** 0\ **Last updated:** [October 18, 2021, 10:27am UTC](https://discuss.elastic.co/t/elastic-watcher-webhook-lack-of-retry-mechanism/286973 "2021-10-18T10:27:36Z")
We use Elastic watcher webhook actions to post event information to an external system using an API. This works fine most of the time but there are occasions when the action fails, seemingly due to the endpoint not respo… --- ## [Kibana POD is in not ready after enabling the https traffic from Kiabna to Elasticsearch](https://discuss.elastic.co/t/kibana-pod-is-in-not-ready-after-enabling-the-https-traffic-from-kiabna-to-elasticsearch/285118)
**Author:** [@ls4074](https://discuss.elastic.co/u/ls4074)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 10:19am UTC](https://discuss.elastic.co/t/kibana-pod-is-in-not-ready-after-enabling-the-https-traffic-from-kiabna-to-elasticsearch/285118 "2021-10-18T10:19:35Z")
Hello, I have enabled the http layer and transport layer (security basic setup plus https) on Elasticsearch. the ES master and data pods are all running fine. I then configured the values.yaml in Kibana helm chart with… --- ## [Memory usage grows in (short-ish) time](https://discuss.elastic.co/t/memory-usage-grows-in-short-ish-time/286817)
**Author:** [@depesz](https://discuss.elastic.co/u/depesz)\ **Replies:** 4\ **Last updated:** [October 18, 2021, 10:15am UTC](https://discuss.elastic.co/t/memory-usage-grows-in-short-ish-time/286817 "2021-10-18T10:15:52Z")
We just recently started trying to use logstash. The problem is that memory usage grows, at least within first 2 days, to the point that we can't use it. I tried reducing Xms and Xmx from default of 1G to 512M. restarte… --- ## [Use logged in users metadata username value in visualisations?](https://discuss.elastic.co/t/use-logged-in-users-metadata-username-value-in-visualisations/285831)
**Author:** [@sam3546](https://discuss.elastic.co/u/sam3546)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 10:12am UTC](https://discuss.elastic.co/t/use-logged-in-users-metadata-username-value-in-visualisations/285831 "2021-10-18T10:12:38Z")
As part of a visualisation i want to show a visualisation that is the number of entries with a specific fields value that is the same as the username of the logged in user to doc that have a different value. Is it possi… --- ## [Logstash can't collected logs of the current day](https://discuss.elastic.co/t/logstash-cant-collected-logs-of-the-current-day/286968)
**Author:** [@lisiyu](https://discuss.elastic.co/u/lisiyu)\ **Replies:** 0\ **Last updated:** [October 18, 2021, 10:10am UTC](https://discuss.elastic.co/t/logstash-cant-collected-logs-of-the-current-day/286968 "2021-10-18T10:10:34Z")
I set FileBeat to pull the log and LogStash to process the log format to es.But today's log does not collect the index. The logs from the last two days are here. filebeat.yaml filebeat.inputs: - type: container … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1196) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1198)