# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1243 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1244 --- ## [Filebeat config error: Exiting: 1 error: error loading config file: invalid config: yaml: line 87: could not find expected ':'](https://discuss.elastic.co/t/filebeat-config-error-exiting-1-error-error-loading-config-file-invalid-config-yaml-line-87-could-not-find-expected/283969)
**Author:** [@pheempon](https://discuss.elastic.co/u/pheempon)\ **Replies:** 4\ **Last updated:** [September 13, 2021, 4:48am UTC](https://discuss.elastic.co/t/filebeat-config-error-exiting-1-error-error-loading-config-file-invalid-config-yaml-line-87-could-not-find-expected/283969 "2021-09-13T04:48:01Z")
I keep on getting this error when I try to configure Filebeat. ERROR instance/beat.go:989 Exiting: 1 error: error loading config file: invalid config: yaml: line 87: could not find expected ':' Exiting: 1 error: er… --- ## [Elastic user not authenticate properly (Kibana Login)](https://discuss.elastic.co/t/elastic-user-not-authenticate-properly-kibana-login/282301)
**Author:** [@yasith1994](https://discuss.elastic.co/u/yasith1994)\ **Replies:** 2\ **Last updated:** [September 13, 2021, 3:50am UTC](https://discuss.elastic.co/t/elastic-user-not-authenticate-properly-kibana-login/282301 "2021-09-13T03:50:42Z")
Hi, We have elastic cluster with 7 nodes. Because of some misconfiguration right now we can not log in to the kibana GUI. It shows username or password wrong. Then we did below steps, Try to create new super user /… --- ## [Es index segmentation question](https://discuss.elastic.co/t/es-index-segmentation-question/283997)
**Author:** [@shenjiayu](https://discuss.elastic.co/u/shenjiayu)\ **Replies:** 5\ **Last updated:** [September 13, 2021, 2:47am UTC](https://discuss.elastic.co/t/es-index-segmentation-question/283997 "2021-09-13T02:47:53Z")
Hey, I have a question. I stay at UTC+8, and I use filebeat to collect logs from k8s, then sending to es.But the default index segmentation is decided by UTC, not UTC+8. So I will find logs of 2021.9.1(UTC+8) in filebeat… --- ## [Error login](https://discuss.elastic.co/t/error-login/283597)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 4\ **Last updated:** [September 13, 2021, 2:45am UTC](https://discuss.elastic.co/t/error-login/283597 "2021-09-13T02:45:52Z")
hi everyone, i have a kibana. Yesterday I was still able to login, but today I can't. it only says "oops! Error. Try again" the username and password are all correct and the elsticsearch and kibana services are running p… --- ## [Error after launching elastic stack](https://discuss.elastic.co/t/error-after-launching-elastic-stack/283991)
**Author:** [@DaniloBatistaQueiroz](https://discuss.elastic.co/u/DaniloBatistaQueiroz)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 2:03am UTC](https://discuss.elastic.co/t/error-after-launching-elastic-stack/283991 "2021-09-13T02:03:20Z")
I'm using docker compose, logstash has ip 172.23.0.4, kibana has 172.23.0.3, elasticsearch 172.23.0.2. { "type": "response", "@timestamp": "2021-09-12T22:53:33+00:00", "tags": \[\], "pid": 1216, "metho… --- ## [What is this java\_pid%pid\_number%.hprof and can it be deleted](https://discuss.elastic.co/t/what-is-this-java-pid-pid-number-hprof-and-can-it-be-deleted/283907)
**Author:** [@cis4life](https://discuss.elastic.co/u/cis4life)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 1:50am UTC](https://discuss.elastic.co/t/what-is-this-java-pid-pid-number-hprof-and-can-it-be-deleted/283907 "2021-09-13T01:50:29Z")
I have my ES data and ES Logs going to another location, but in my /var/lib/elasticsearch I have a file named java\_pid%pid\_number%.hprof that has cause my OS drive to be out of space. which is now causing me issues. Wha… --- ## ['More than one write index' errors still occurring in version 7.13.4](https://discuss.elastic.co/t/more-than-one-write-index-errors-still-occurring-in-version-7-13-4/283993)
**Author:** [@bvilnis](https://discuss.elastic.co/u/bvilnis)\ **Replies:** 0\ **Last updated:** [September 13, 2021, 12:18am UTC](https://discuss.elastic.co/t/more-than-one-write-index-errors-still-occurring-in-version-7-13-4/283993 "2021-09-13T00:18:00Z")
This issue has previously been raised here, but to summarise our current issue: We are currently seeing our APM stack (Elastic APM, Elasticsearch, Kibana) produce the following error: alias \[apm-7.13.4-metric\] has mor… --- ## [Expanding non-LVM Disk with Elasticsearch indicies stored on](https://discuss.elastic.co/t/expanding-non-lvm-disk-with-elasticsearch-indicies-stored-on/283779)
**Author:** [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)\ **Replies:** 3\ **Last updated:** [September 13, 2021, 1:03am UTC](https://discuss.elastic.co/t/expanding-non-lvm-disk-with-elasticsearch-indicies-stored-on/283779 "2021-09-13T01:03:26Z")
We have a capacity problem with our worker nodes (ELK stack) oot@xxx03:/elkdata# yum list | grep elasticsearch | grep \\.12 apm-server.i686 7.12.0-1 elasticsearch-7.x apm-s… --- ## [Comment added to case or event](https://discuss.elastic.co/t/comment-added-to-case-or-event/283694)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 3\ **Last updated:** [September 13, 2021, 12:59am UTC](https://discuss.elastic.co/t/comment-added-to-case-or-event/283694 "2021-09-13T00:59:24Z")
Hello every body, I have a question about the notes added by the user in ELK, it is possible to have the visibility of them in ONE place? Best regards, --- ## [Can't connect to http-input of Logstash on Elastic Cloud](https://discuss.elastic.co/t/cant-connect-to-http-input-of-logstash-on-elastic-cloud/283822)
**Author:** [@Samuel\_Wehrli](https://discuss.elastic.co/u/Samuel_Wehrli)\ **Replies:** 5\ **Last updated:** [September 13, 2021, 12:44am UTC](https://discuss.elastic.co/t/cant-connect-to-http-input-of-logstash-on-elastic-cloud/283822 "2021-09-13T00:44:25Z")
Hi, i just deployed an elastic cloud instance on google cloud. I want to use the http input plugin of Logstash to receive sensor data (from "the things network") via webhook requests. I configured the Logstash pipeline o… --- ## [Issue with AWS backup and restore process](https://discuss.elastic.co/t/issue-with-aws-backup-and-restore-process/283814)
**Author:** [@cctk](https://discuss.elastic.co/u/cctk)\ **Replies:** 3\ **Last updated:** [September 13, 2021, 12:44am UTC](https://discuss.elastic.co/t/issue-with-aws-backup-and-restore-process/283814 "2021-09-13T00:44:02Z")
I am having an issue with the snapshot and restore process for ES. I have created two nodes to test my snapshot and restore. I can't seem to make it work. I have created a bucket in AWS , added plugin for s3 and I have… --- ## [Send .evtx files to elastic cloud using winlogbeat](https://discuss.elastic.co/t/send-evtx-files-to-elastic-cloud-using-winlogbeat/281779)
**Author:** [@msszafar](https://discuss.elastic.co/u/msszafar)\ **Replies:** 3\ **Last updated:** [September 12, 2021, 8:39pm UTC](https://discuss.elastic.co/t/send-evtx-files-to-elastic-cloud-using-winlogbeat/281779 "2021-09-12T20:39:22Z")
Hi everyone, I've more than 100 .evtx files that have to be sent to elastic cloud using winlogbeat. I know the method to send files one by one using this post But this is a hectic process to provide the path of each fil… --- ## [Watcher error 404 webhook](https://discuss.elastic.co/t/watcher-error-404-webhook/283983)
**Author:** [@Juliana\_Sabino](https://discuss.elastic.co/u/Juliana_Sabino)\ **Replies:** 2\ **Last updated:** [September 12, 2021, 7:38pm UTC](https://discuss.elastic.co/t/watcher-error-404-webhook/283983 "2021-09-12T19:38:13Z")
Hi guys! I'm getting the error 404 on a watcher. This is my webhook action: "actions": { "my\_webhook": { "webhook": { "scheme": "https", "host": "chat.googleapis.com", "port": 443, … --- ## [Elasticsearch enable watcher - email notifications](https://discuss.elastic.co/t/elasticsearch-enable-watcher-email-notifications/283794)
**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Replies:** 9\ **Last updated:** [September 12, 2021, 6:30pm UTC](https://discuss.elastic.co/t/elasticsearch-enable-watcher-email-notifications/283794 "2021-09-12T18:30:02Z")
Hello, I would like to ask You for help, I have one-node elasticsearch with kibana on kubernetes. I need to have on kibana watcher email notifications enabled but don't know how to do from elasticsearch yml file. Rig… --- ## [How to calculate elapsed Time between Timestamps in a given Timerange?](https://discuss.elastic.co/t/how-to-calculate-elapsed-time-between-timestamps-in-a-given-timerange/283449)
**Author:** [@Elastomer](https://discuss.elastic.co/u/Elastomer)\ **Replies:** 2\ **Last updated:** [September 12, 2021, 5:25pm UTC](https://discuss.elastic.co/t/how-to-calculate-elapsed-time-between-timestamps-in-a-given-timerange/283449 "2021-09-12T17:25:24Z")
Hallo fellow Users. I would like to know how i can get the Time difference from the "First" to the"Last" Document within a specific Time Range. Question: How much distance did i travel in a specific Time Range. Situat… --- ## [Vega Visualization Kibana](https://discuss.elastic.co/t/vega-visualization-kibana/283942)
**Author:** [@Ankita\_Pachauri](https://discuss.elastic.co/u/Ankita_Pachauri)\ **Replies:** 1\ **Last updated:** [September 12, 2021, 5:14pm UTC](https://discuss.elastic.co/t/vega-visualization-kibana/283942 "2021-09-12T17:14:00Z")
Hi All, Is there any step-by-step documentation/site to learn about Vega Visualization Kibana? Please support. //Ankita --- ## [Significant Text Aggregation always returning zero buckets](https://discuss.elastic.co/t/significant-text-aggregation-always-returning-zero-buckets/283976)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 2\ **Last updated:** [September 12, 2021, 5:09pm UTC](https://discuss.elastic.co/t/significant-text-aggregation-always-returning-zero-buckets/283976 "2021-09-12T17:09:31Z")
Hi All, I'm attempting to use the significant\_text aggregation with a field that is stored as a text field and analyzed via the english analyzer but I'm having an issue where no buckets are being returned. I'm essentia… --- ## [IOPS for a Data node is extremely high while other not](https://discuss.elastic.co/t/iops-for-a-data-node-is-extremely-high-while-other-not/282772)
**Author:** [@bugb](https://discuss.elastic.co/u/bugb)\ **Replies:** 8\ **Last updated:** [September 12, 2021, 4:57pm UTC](https://discuss.elastic.co/t/iops-for-a-data-node-is-extremely-high-while-other-not/282772 "2021-09-12T16:57:45Z")
Version: Elastic Search 7.13 I am running 3 master nodes, 2 client nodes and 10 data nodes (199-399 Gb each node) And one day I have seen the IOPS for a Data node is extremely high while other not Could you please … --- ## [Visualizing systemd services using Metricbeat (Please help)](https://discuss.elastic.co/t/visualizing-systemd-services-using-metricbeat-please-help/283982)
**Author:** [@josh12](https://discuss.elastic.co/u/josh12)\ **Replies:** 0\ **Last updated:** [September 12, 2021, 4:25pm UTC](https://discuss.elastic.co/t/visualizing-systemd-services-using-metricbeat-please-help/283982 "2021-09-12T16:25:25Z")
Hi friends, i would like to visualize systemd process. Please advice The below having issue whereby sometimes it spikes sometimes it dont. I am quite confuse --- ## [Pulling data from two different DB with Logstash JDBC Input and merging input events data](https://discuss.elastic.co/t/pulling-data-from-two-different-db-with-logstash-jdbc-input-and-merging-input-events-data/283973)
**Author:** [@e-fo](https://discuss.elastic.co/u/e-fo)\ **Replies:** 1\ **Last updated:** [September 12, 2021, 3:46pm UTC](https://discuss.elastic.co/t/pulling-data-from-two-different-db-with-logstash-jdbc-input-and-merging-input-events-data/283973 "2021-09-12T15:46:14Z")
Hi and thanks for your great community. I have two database that I want configuring a pipeline with Logstash that pulling data from these two database and merging the input events based on one same field in these events… --- ## [Primary shard](https://discuss.elastic.co/t/primary-shard/283964)
**Author:** [@Lixing\_Yi](https://discuss.elastic.co/u/Lixing_Yi)\ **Replies:** 1\ **Last updated:** [September 12, 2021, 12:35pm UTC](https://discuss.elastic.co/t/primary-shard/283964 "2021-09-12T12:35:09Z")
situaiton: In the case that the primary itself fails, the node hosting the primary will send a message to the master about it. The indexing operation will wait (up to 1 minute) for the master to promote one of the repli… --- ## [Logstash error to finding tracking\_column in jdbc input for mongodb](https://discuss.elastic.co/t/logstash-error-to-finding-tracking-column-in-jdbc-input-for-mongodb/283329)
**Author:** [@e-fo](https://discuss.elastic.co/u/e-fo)\ **Replies:** 1\ **Last updated:** [September 12, 2021, 9:35am UTC](https://discuss.elastic.co/t/logstash-error-to-finding-tracking-column-in-jdbc-input-for-mongodb/283329 "2021-09-12T09:35:44Z")
Hello, I using logstash jdbc for pulling data from mongodb and pushing to elasticsearch. I using this pipeline configuration for logstash: input { jdbc { type =\> "bb\_purchaselog" jdbc\_driver\_library =\> "/usr/… --- ## [Address plugin for Kibana Maps](https://discuss.elastic.co/t/address-plugin-for-kibana-maps/283374)
**Author:** [@Roy\_Levy](https://discuss.elastic.co/u/Roy_Levy)\ **Replies:** 4\ **Last updated:** [September 12, 2021, 7:22am UTC](https://discuss.elastic.co/t/address-plugin-for-kibana-maps/283374 "2021-09-12T07:22:43Z")
Hey, I've searched and did not find a plugin or some method for Kibana to put an address instead of lat lon coordinates in the 'Maps' visualization in Kibana: Is there any way to add this option for filtering the ma… --- ## [Update nested array in existing document](https://discuss.elastic.co/t/update-nested-array-in-existing-document/283957)
**Author:** [@zeoiioze](https://discuss.elastic.co/u/zeoiioze)\ **Replies:** 0\ **Last updated:** [September 11, 2021, 8:08pm UTC](https://discuss.elastic.co/t/update-nested-array-in-existing-document/283957 "2021-09-11T20:08:01Z")
Hello ! I have documents with fields like that : doc.site containing a string like "paris" doc.ips.values containing a list of strings \["10.0.0.1", "10.0.0.2"\], or which can sometimes be empty \[\] doc.ips.last\_che… --- ## [ELASTIC SEARCH 7.9.3 not able to start on OPEN JDK](https://discuss.elastic.co/t/elastic-search-7-9-3-not-able-to-start-on-open-jdk/283940)
**Author:** [@devin](https://discuss.elastic.co/u/devin)\ **Replies:** 2\ **Last updated:** [September 11, 2021, 4:16pm UTC](https://discuss.elastic.co/t/elastic-search-7-9-3-not-able-to-start-on-open-jdk/283940 "2021-09-11T16:16:34Z")
I want to use open jdk for my elastic search rather than bundled jdk. I have set up .bash\_profile variables as below but Elastic search keeps on failing to start up with below error.PLEASE HELP !! could not find java in… --- ## [Match error grok filter](https://discuss.elastic.co/t/match-error-grok-filter/283851)
**Author:** [@mar-ro](https://discuss.elastic.co/u/mar-ro)\ **Replies:** 3\ **Last updated:** [September 11, 2021, 3:24pm UTC](https://discuss.elastic.co/t/match-error-grok-filter/283851 "2021-09-11T15:24:43Z")
Good morning! I'm trying to set up a grok filter to a pipeline which receives the following text: 09/10/2021, 8:30:00 AM \[Message\] therefore the date format is: Month/Day/Year, Hour:Minutes:Seconds The grok filter lo… --- ## [Data restore with elasticdump](https://discuss.elastic.co/t/data-restore-with-elasticdump/283945)
**Author:** [@Ravi\_Gusain](https://discuss.elastic.co/u/Ravi_Gusain)\ **Replies:** 0\ **Last updated:** [September 11, 2021, 3:15pm UTC](https://discuss.elastic.co/t/data-restore-with-elasticdump/283945 "2021-09-11T15:15:10Z")
Hi, I am making use of elasticdump to restore data from one Elastic cluster to another Elastic cluster. I have restored all the data of previous day till midnight with the help of snapshots and now need to restore all t… --- ## [Can I attach Kibana controls to a specific viz](https://discuss.elastic.co/t/can-i-attach-kibana-controls-to-a-specific-viz/282870)
**Author:** [@prkd](https://discuss.elastic.co/u/prkd)\ **Replies:** 3\ **Last updated:** [September 11, 2021, 2:24pm UTC](https://discuss.elastic.co/t/can-i-attach-kibana-controls-to-a-specific-viz/282870 "2021-09-11T14:24:41Z")
My dashboard contains multiple graphs from same indexes filtered for different types of data within the index. Now I want to attach a control (dropdown) for each of this graph, so the user can view a single type of data… --- ## [Filebeat unble set filed name with error](https://discuss.elastic.co/t/filebeat-unble-set-filed-name-with-error/283938)
**Author:** [@josh12](https://discuss.elastic.co/u/josh12)\ **Replies:** 0\ **Last updated:** [September 11, 2021, 2:15pm UTC](https://discuss.elastic.co/t/filebeat-unble-set-filed-name-with-error/283938 "2021-09-11T14:15:25Z")
Hi experts, I trying to change fields value. But it not working. Any idea? OLD VALUE fields: pattern: my\_error \`\` NEW VALUE fields: pattern: error \`\` --- ## [Can I use x-pack features on a self-hosted cluster?](https://discuss.elastic.co/t/can-i-use-x-pack-features-on-a-self-hosted-cluster/283928)
**Author:** [@blunckr](https://discuss.elastic.co/u/blunckr)\ **Replies:** 2\ **Last updated:** [September 11, 2021, 6:34am UTC](https://discuss.elastic.co/t/can-i-use-x-pack-features-on-a-self-hosted-cluster/283928 "2021-09-11T06:34:25Z")
Hi there, I'm looking into using the wildcard field type, I noticed it was part of 'x-pack' which I was not familiar with previously. After reading a bit about it, I'm quite confused. It seems to me that parts of x-pack… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1242) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1244)