# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1212 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1213 --- ## [Export has limited columns](https://discuss.elastic.co/t/export-has-limited-columns/285584)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 11\ **Last updated:** [October 6, 2021, 4:08pm UTC](https://discuss.elastic.co/t/export-has-limited-columns/285584 "2021-10-06T16:08:21Z")
Hello, I hope this message finds the community members safe and healthy. I'm having incomplete data when exporting via Kibana & the output is erratic. I am carrying out the searches on the same index Total documents… --- ## [Remove from json](https://discuss.elastic.co/t/remove-from-json/286047)
**Author:** [@ANISH\_VERMA](https://discuss.elastic.co/u/ANISH_VERMA)\ **Replies:** 4\ **Last updated:** [October 6, 2021, 4:04pm UTC](https://discuss.elastic.co/t/remove-from-json/286047 "2021-10-06T16:04:25Z")
Hi I am using logstash so when I am doing the multi-line thing I am getting \\n \\t \\r like character in json is there away to remove these in Json message without compromising with the message layout . And even if it is h… --- ## [Ruby Filter for Compressed Binary OID Table](https://discuss.elastic.co/t/ruby-filter-for-compressed-binary-oid-table/285691)
**Author:** [@bennrtc](https://discuss.elastic.co/u/bennrtc)\ **Replies:** 1\ **Last updated:** [October 6, 2021, 3:40pm UTC](https://discuss.elastic.co/t/ruby-filter-for-compressed-binary-oid-table/285691 "2021-10-06T15:40:16Z")
Hello all, I'm working within an OID that returns values in compressed binary. I've been able to successfully come up with a config (below) that polls a single SNMP OID with compressed binary value using 'get' and then… --- ## [Monitoring Request Failed - Saved object not found](https://discuss.elastic.co/t/monitoring-request-failed-saved-object-not-found/280952)
**Author:** [@surphix](https://discuss.elastic.co/u/surphix)\ **Replies:** 5\ **Last updated:** [October 6, 2021, 3:36pm UTC](https://discuss.elastic.co/t/monitoring-request-failed-saved-object-not-found/280952 "2021-10-06T15:36:44Z")
Hi, I'm having issues with Kibana & Monitoring. Every time I navigate to the monitoring page I receive the following error, "Monitoring Request Failed Saved object \[task/{UUID}\] not found HTTP 404" { "type": "log",… --- ## [Config files](https://discuss.elastic.co/t/config-files/286045)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 2\ **Last updated:** [October 6, 2021, 3:34pm UTC](https://discuss.elastic.co/t/config-files/286045 "2021-10-06T15:34:44Z")
I am trying to understand how to set up logstash .conf files to see what is required. I am considering a separate .conf files for each index/type of metric being captured. On the web it suggests that even if they are s… --- ## [Logstash JDBC\_last \_ not updating](https://discuss.elastic.co/t/logstash-jdbc-last-not-updating/285993)
**Author:** [@Akshaya](https://discuss.elastic.co/u/Akshaya)\ **Replies:** 2\ **Last updated:** [October 6, 2021, 3:11pm UTC](https://discuss.elastic.co/t/logstash-jdbc-last-not-updating/285993 "2021-10-06T15:11:01Z")
Hi , I'm new to Elasticsearch and Logstash, trying to implement JDBC plugin. I'm not sure why .logstash\_last\_run file is not getting updated. The values inside the file remains the same even after several runs. value … --- ## [Metricbeat with Zookeper module](https://discuss.elastic.co/t/metricbeat-with-zookeper-module/285487)
**Author:** [@Lidya\_Aguero](https://discuss.elastic.co/u/Lidya_Aguero)\ **Replies:** 1\ **Last updated:** [October 6, 2021, 2:48pm UTC](https://discuss.elastic.co/t/metricbeat-with-zookeper-module/285487 "2021-10-06T14:48:39Z")
I try use Metricbeat 7.15.0 with Zookeeper module and receive this messages in Elasticsearch: error.message: error obtaining serverid: no 'serverId' found in 'conf' response zookeeper.yml: - module: zookeeper enable… --- ## [Persistent Queues with multiple logstash processes in 2021](https://discuss.elastic.co/t/persistent-queues-with-multiple-logstash-processes-in-2021/286044)
**Author:** [@ab017i0](https://discuss.elastic.co/u/ab017i0)\ **Replies:** 0\ **Last updated:** [October 6, 2021, 2:45pm UTC](https://discuss.elastic.co/t/persistent-queues-with-multiple-logstash-processes-in-2021/286044 "2021-10-06T14:45:14Z")
Hello, our team is solving same problem. Persistent Queues with multiple logstash processes The output is "Logstash persistent queues are not shared. Nd configured per instance." as for 2019. Is the answer is still va… --- ## [High I/O usage on large Elasticsearch Instance](https://discuss.elastic.co/t/high-i-o-usage-on-large-elasticsearch-instance/283813)
**Author:** [@Nisar\_Adappadathil1](https://discuss.elastic.co/u/Nisar_Adappadathil1)\ **Replies:** 8\ **Last updated:** [October 6, 2021, 2:42pm UTC](https://discuss.elastic.co/t/high-i-o-usage-on-large-elasticsearch-instance/283813 "2021-10-06T14:42:24Z")
Hi We have a elasticsearch-6.4 cluster with 100 nodes we were using AWS instances of type (8 core CPU & 15 GB memory), now we are migrating to (48 core 384 GB memory) The issue here is that now we have half number of… --- ## [How can I make my Grok filter match a file extension or blank (if no extension)?](https://discuss.elastic.co/t/how-can-i-make-my-grok-filter-match-a-file-extension-or-blank-if-no-extension/286011)
**Author:** [@nsouth](https://discuss.elastic.co/u/nsouth)\ **Replies:** 2\ **Last updated:** [October 6, 2021, 1:30pm UTC](https://discuss.elastic.co/t/how-can-i-make-my-grok-filter-match-a-file-extension-or-blank-if-no-extension/286011 "2021-10-06T13:30:01Z")
I have the following grok filter which extracts the file\_extension from a field. It works except fine for files which have no extension, which generate a \_grokparsefailure tag. For files with no extension, I would like t… --- ## [Updating config file](https://discuss.elastic.co/t/updating-config-file/286021)
**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\ **Replies:** 5\ **Last updated:** [October 6, 2021, 1:23pm UTC](https://discuss.elastic.co/t/updating-config-file/286021 "2021-10-06T13:23:33Z")
I have been trial and error technique to solve problems with the logstash I have been updating the config file input filter and output settings time to time. so I want to index already present files but at first time i… --- ## ["fields" ignored on MLT query with artificial document](https://discuss.elastic.co/t/fields-ignored-on-mlt-query-with-artificial-document/285933)
**Author:** [@mirco\_romagnoli](https://discuss.elastic.co/u/mirco_romagnoli)\ **Replies:** 0\ **Last updated:** [October 5, 2021, 2:05pm UTC](https://discuss.elastic.co/t/fields-ignored-on-mlt-query-with-artificial-document/285933 "2021-10-05T14:05:42Z")
Hi everyone! When I execute an MLT query with an artificial document the "fields" field is ignored and all the fields from the artificial document are used for scoring. For instance I built an index with these settings… --- ## [Logstash input JDBC - Oracle wallet support](https://discuss.elastic.co/t/logstash-input-jdbc-oracle-wallet-support/286023)
**Author:** [@Prashant\_Achari](https://discuss.elastic.co/u/Prashant_Achari)\ **Replies:** 0\ **Last updated:** [October 6, 2021, 12:20pm UTC](https://discuss.elastic.co/t/logstash-input-jdbc-oracle-wallet-support/286023 "2021-10-06T12:20:10Z")
I am trying to setup Logstah to work with Oracle wallet. I am unable get any configuration that supports wallet. I cannot keep open passwords in config files that is against the security policy. I am getting below error … --- ## [Detect when a Logstash pipeline is ready for input?](https://discuss.elastic.co/t/detect-when-a-logstash-pipeline-is-ready-for-input/285813)
**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\ **Replies:** 5\ **Last updated:** [October 6, 2021, 11:57am UTC](https://discuss.elastic.co/t/detect-when-a-logstash-pipeline-is-ready-for-input/285813 "2021-10-06T11:57:52Z")
Until recently, using Elastic 7.11.2, I've been using the following curl command line, in a Linux shell script, to detect whether Logstash is ready to ingest data: curl localhost:9600 2\> /dev/null (In a previous edit o… --- ## [Blocked by: \[FORBIDDEN/8/index write (api)\]; Reindex](https://discuss.elastic.co/t/blocked-by-forbidden-8-index-write-api-reindex/285799)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 10\ **Last updated:** [October 6, 2021, 11:01am UTC](https://discuss.elastic.co/t/blocked-by-forbidden-8-index-write-api-reindex/285799 "2021-10-06T11:01:44Z")
Hey team, I was reindexing one of my index but suddenly it stopped because shard size reaches to 60gb and it rollover to new index.I am getting an error now i cannot write after index get rollover "cause" : { … --- ## [Filebeat 6.8.18 - output to logstash instead of direct to elastic](https://discuss.elastic.co/t/filebeat-6-8-18-output-to-logstash-instead-of-direct-to-elastic/286012)
**Author:** [@Heebie](https://discuss.elastic.co/u/Heebie)\ **Replies:** 0\ **Last updated:** [October 6, 2021, 10:38am UTC](https://discuss.elastic.co/t/filebeat-6-8-18-output-to-logstash-instead-of-direct-to-elastic/286012 "2021-10-06T10:38:43Z")
Hello, I'm trying to deploy filebeats using the "Official Elastic helm chart for Filebeat" from github.com/elastic/helm-charts... and it seems to only have the ability to output to Elasticsearch directly, but I need to … --- ## [Dropped Netflow packets in filebeat](https://discuss.elastic.co/t/dropped-netflow-packets-in-filebeat/283837)
**Author:** [@hjazz6](https://discuss.elastic.co/u/hjazz6)\ **Replies:** 1\ **Last updated:** [October 6, 2021, 10:28am UTC](https://discuss.elastic.co/t/dropped-netflow-packets-in-filebeat/283837 "2021-10-06T10:28:08Z")
Hi, I'm ingesting Netflow traffic using filebeat's netflow module (for the first time), and I think there are dropped packets. I'm wondering if there is anything I can do to reduce or eliminate dropped packets. I start… --- ## [Running multiple filebeat instances to handle netflow load](https://discuss.elastic.co/t/running-multiple-filebeat-instances-to-handle-netflow-load/284237)
**Author:** [@hjazz6](https://discuss.elastic.co/u/hjazz6)\ **Replies:** 2\ **Last updated:** [October 6, 2021, 10:21am UTC](https://discuss.elastic.co/t/running-multiple-filebeat-instances-to-handle-netflow-load/284237 "2021-10-06T10:21:37Z")
Hi, I'm currently running Filebeat v7.14 with the Netflow module to send Netflow traffic directly into Elasticsearch. However, when I look at the Filebeat monitoring stats, it appears that I'm dropping packets. I'm thin… --- ## [Performanceissue with Filebeat and Netflow Input](https://discuss.elastic.co/t/performanceissue-with-filebeat-and-netflow-input/284268)
**Author:** [@tomx1](https://discuss.elastic.co/u/tomx1)\ **Replies:** 6\ **Last updated:** [October 6, 2021, 10:20am UTC](https://discuss.elastic.co/t/performanceissue-with-filebeat-and-netflow-input/284268 "2021-10-06T10:20:09Z")
Hi folks, we are importing flow data into our 10 Node Elasticsearch cluster via Filebeat netflow Input. The Stack is running on 7.14.0. Unfortunately I am witnessing performance pressure and after all the debugging and … --- ## [How to avoid daily creation of .monitoring system indices (v7.14)](https://discuss.elastic.co/t/how-to-avoid-daily-creation-of-monitoring-system-indices-v7-14/285998)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 2\ **Last updated:** [October 6, 2021, 10:12am UTC](https://discuss.elastic.co/t/how-to-avoid-daily-creation-of-monitoring-system-indices-v7-14/285998 "2021-10-06T10:12:09Z")
Hi All, I see daily system indices (.monitoring...) getting created. How can we avoid creation of these indices daily and instead create them on monthly basis. I am aware of ILM and using it for application indices to … --- ## [Why .monitoring-es-7-mb-\* size is increasing?](https://discuss.elastic.co/t/why-monitoring-es-7-mb-size-is-increasing/285988)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 4\ **Last updated:** [October 6, 2021, 10:08am UTC](https://discuss.elastic.co/t/why-monitoring-es-7-mb-size-is-increasing/285988 "2021-10-06T10:08:38Z")
Using metricbeat version 7.13.2 and elk version 7.13.2 I've installed and setup metricbeat in master nodes only Here is metricbeat.yml file ###################### Metricbeat Configuration Example #####################… --- ## [Help installing ElastiFlow](https://discuss.elastic.co/t/help-installing-elastiflow/285695)
**Author:** [@g0nz0](https://discuss.elastic.co/u/g0nz0)\ **Replies:** 1\ **Last updated:** [October 6, 2021, 9:58am UTC](https://discuss.elastic.co/t/help-installing-elastiflow/285695 "2021-10-06T09:58:34Z")
Hello, I've spent the afternoon running through this Ubuntu guide to installing ELK https://kifarunix.com/install-elastic-elk-stack-on-ubuntu-20-04/ It seems like it's all working, but by next step is to add ElastiFlow… --- ## [Elastic Agent TLS Auth Handshake Failed - Internal Error](https://discuss.elastic.co/t/elastic-agent-tls-auth-handshake-failed-internal-error/285816)
**Author:** [@millap](https://discuss.elastic.co/u/millap)\ **Replies:** 1\ **Last updated:** [October 6, 2021, 9:35am UTC](https://discuss.elastic.co/t/elastic-agent-tls-auth-handshake-failed-internal-error/285816 "2021-10-06T09:35:37Z")
Hi all, I wonder if anyone's able to offer some advice, or pointers on troubleshooting an issue we have with a number of clients managed by Fleet. We're running 7.13.0, and have just started deploying to Windows endpoi… --- ## [Data Visualizer won't accept dd/mm/yyyy format when importing data](https://discuss.elastic.co/t/data-visualizer-wont-accept-dd-mm-yyyy-format-when-importing-data/285732)
**Author:** [@Stud21](https://discuss.elastic.co/u/Stud21)\ **Replies:** 5\ **Last updated:** [October 6, 2021, 9:22am UTC](https://discuss.elastic.co/t/data-visualizer-wont-accept-dd-mm-yyyy-format-when-importing-data/285732 "2021-10-06T09:22:58Z")
I'm trying to import the films.csv file in Data Visualizer and it gives me a 'date\_time\_exception' error. Trying to import the data by 'Apply override settings' link it just does not accept the format, 'dd/mm/yyyy'' Ho… --- ## [Kibana 7.11.1 failing on Docker 7 Raspberry PI4 (arm7)](https://discuss.elastic.co/t/kibana-7-11-1-failing-on-docker-7-raspberry-pi4-arm7/264984)
**Author:** [@ssddgreg](https://discuss.elastic.co/u/ssddgreg)\ **Replies:** 3\ **Last updated:** [October 6, 2021, 8:55am UTC](https://discuss.elastic.co/t/kibana-7-11-1-failing-on-docker-7-raspberry-pi4-arm7/264984 "2021-10-06T08:55:23Z")
Hi, I am trying to run Kibana 7.11.1 as a Docker container on Raspberry Pi 4. I can build the image, however I hit the following error on docker run: {"type":"log","@timestamp":"2021-02-21T13:02:58+00:00","tags":\["… --- ## [How to search for mulitable queries (values) in the same field](https://discuss.elastic.co/t/how-to-search-for-mulitable-queries-values-in-the-same-field/285994)
**Author:** [@Drsaud](https://discuss.elastic.co/u/Drsaud)\ **Replies:** 0\ **Last updated:** [October 6, 2021, 8:37am UTC](https://discuss.elastic.co/t/how-to-search-for-mulitable-queries-values-in-the-same-field/285994 "2021-10-06T08:37:20Z")
Hello, I'm new to Elasticsearch and I want to know how I can search for multi queries or values that are in the same field, for example here I want search for mulit usernames in the username field My Post request: { … --- ## [Canvas line-chart with multiple lines](https://discuss.elastic.co/t/canvas-line-chart-with-multiple-lines/285924)
**Author:** [@marcw](https://discuss.elastic.co/u/marcw)\ **Replies:** 2\ **Last updated:** [October 6, 2021, 8:24am UTC](https://discuss.elastic.co/t/canvas-line-chart-with-multiple-lines/285924 "2021-10-06T08:24:51Z")
I'm new to Kibana. I have the following data: DateTime Temperature1 Temperature2 Temparature3 2021-10-05 09:00:00 5 2 9 2021-10-05 10:00:00 6 1 7 I want to create on a canvas a line-chart, x-axis is the Dat… --- ## [Error: Invalid snapshot name snapshot with the same name already in-progress](https://discuss.elastic.co/t/error-invalid-snapshot-name-snapshot-with-the-same-name-already-in-progress/283661)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 13\ **Last updated:** [October 6, 2021, 8:02am UTC](https://discuss.elastic.co/t/error-invalid-snapshot-name-snapshot-with-the-same-name-already-in-progress/283661 "2021-10-06T08:02:11Z")
Hello dear friends I have a problem. I want to store an index that is in elasticsearch. I created a new repository for this and this repository does not have any snapshots. But when I ran the code blog below, it returne… --- ## [Metricbeat beat module](https://discuss.elastic.co/t/metricbeat-beat-module/285991)
**Author:** [@alaine](https://discuss.elastic.co/u/alaine)\ **Replies:** 0\ **Last updated:** [October 6, 2021, 7:57am UTC](https://discuss.elastic.co/t/metricbeat-beat-module/285991 "2021-10-06T07:57:48Z")
Good Morning, I have enabled metricbeats on a few of our network sensors that are running filebeat. I am able to run metricbeat with the system module without a problem. When I try to run the beat module I start getting… --- ## [Filebeat won't start the service. Data path already locked by another beat](https://discuss.elastic.co/t/filebeat-wont-start-the-service-data-path-already-locked-by-another-beat/285989)
**Author:** [@dhody\_rhmd](https://discuss.elastic.co/u/dhody_rhmd)\ **Replies:** 0\ **Last updated:** [October 6, 2021, 7:49am UTC](https://discuss.elastic.co/t/filebeat-wont-start-the-service-data-path-already-locked-by-another-beat/285989 "2021-10-06T07:49:44Z")
Hello, This is my first time to setup logging stack. My problem is the Filebeat service wont start. filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch. Loaded: loaded (/lib/systemd… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1211) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1213)