# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1259 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1260 --- ## [Monitoring Data Deleted After 7 Days](https://discuss.elastic.co/t/monitoring-data-deleted-after-7-days/280661)
**Author:** [@jouellette](https://discuss.elastic.co/u/jouellette)\ **Replies:** 5\ **Last updated:** [August 31, 2021, 2:51pm UTC](https://discuss.elastic.co/t/monitoring-data-deleted-after-7-days/280661 "2021-08-31T14:51:16Z")
I've recently upgraded to ES 7.13.x from 6.8. I currently have two clusters a production cluster and a monitoring cluster. The production cluster sends monitoring data to the monitoring cluster via HTTP exporter. On vers… --- ## [Elastic can not start because of memory issue](https://discuss.elastic.co/t/elastic-can-not-start-because-of-memory-issue/282711)
**Author:** [@Vladimir](https://discuss.elastic.co/u/Vladimir)\ **Replies:** 15\ **Last updated:** [August 31, 2021, 1:41pm UTC](https://discuss.elastic.co/t/elastic-can-not-start-because-of-memory-issue/282711 "2021-08-31T13:41:57Z")
Hi there, can somebody tell me please why my Elastic installation dont want to start? Log says it is out of memory. But it should contains only one index with about one million items. The server params are: 6vCPU, 16G RA… --- ## [Metricbeat on Openshift not really supported?](https://discuss.elastic.co/t/metricbeat-on-openshift-not-really-supported/282054)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 5\ **Last updated:** [August 31, 2021, 1:41pm UTC](https://discuss.elastic.co/t/metricbeat-on-openshift-not-really-supported/282054 "2021-08-31T13:41:16Z")
Hi folks, any of you running metricbeat on openshift to collect state metrics? It looks like it is not supported to collect state metrics of DeploymentConfigs and ReplicationContollers. Anyone ran into this issue? How … --- ## [Tried to load a plugin's code, but failed. path=\>"logstash/filters/\"](https://discuss.elastic.co/t/tried-to-load-a-plugins-code-but-failed-path-logstash-filters-filter-name/282923)
**Author:** [@raiz](https://discuss.elastic.co/u/raiz)\ **Replies:** 0\ **Last updated:** [August 31, 2021, 12:57pm UTC](https://discuss.elastic.co/t/tried-to-load-a-plugins-code-but-failed-path-logstash-filters-filter-name/282923 "2021-08-31T12:57:51Z")
Hello, I'm trying to use my filter plugin in a conf file. It's being properly installed via an offline plugin pack, but errors when running logstash: ERROR registry:123 - Tried to load a plugin's code, but failed. {:ex… --- ## [Query to get percentiles of a calculated sum value](https://discuss.elastic.co/t/query-to-get-percentiles-of-a-calculated-sum-value/282800)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 1\ **Last updated:** [August 31, 2021, 12:43pm UTC](https://discuss.elastic.co/t/query-to-get-percentiles-of-a-calculated-sum-value/282800 "2021-08-31T12:43:39Z")
Based on the query below, I want to find percentile bucket of the values I am getting from date\_histogram aggregation. Below is my working query to find the day-wise total for the last 7 days, I am not sure where should… --- ## [Is the document ID likely to change in Machine Learning result index](https://discuss.elastic.co/t/is-the-document-id-likely-to-change-in-machine-learning-result-index/282892)
**Author:** [@OmarDacca](https://discuss.elastic.co/u/OmarDacca)\ **Replies:** 4\ **Last updated:** [August 31, 2021, 12:16pm UTC](https://discuss.elastic.co/t/is-the-document-id-likely-to-change-in-machine-learning-result-index/282892 "2021-08-31T12:16:58Z")
Hi, Is the document ID likely to change in Machine Learning result index ? we have an anomaly alerting system, in the alerts I see document id that I can't find in the result index. so I guess I'm right ? if so then … --- ## [Restoring selected indexes from a snapshot using regex in Curator?](https://discuss.elastic.co/t/restoring-selected-indexes-from-a-snapshot-using-regex-in-curator/281951)
**Author:** [@pradeepgm](https://discuss.elastic.co/u/pradeepgm)\ **Replies:** 2\ **Last updated:** [August 31, 2021, 11:43am UTC](https://discuss.elastic.co/t/restoring-selected-indexes-from-a-snapshot-using-regex-in-curator/281951 "2021-08-31T11:43:53Z")
Hi, I would like to restore selected indexes based on regex from ElasticSearch Snapshot using Curator. For example while taking a snapshot of selected indexes we can mention the regex in filtertype as below filters: … --- ## [Overwriting Record in Logstash Using document\_id?](https://discuss.elastic.co/t/overwriting-record-in-logstash-using-document-id/282908)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 0\ **Last updated:** [August 31, 2021, 11:18am UTC](https://discuss.elastic.co/t/overwriting-record-in-logstash-using-document-id/282908 "2021-08-31T11:18:20Z")
I have data in which every record comes a three-time with attached unique referencedID. I am using document\_id=\>"referencedID". Currently, It is overwriting the record comes seconds time but It is not overwriting the rec… --- ## [Date Convert](https://discuss.elastic.co/t/date-convert/281664)
**Author:** [@graimato](https://discuss.elastic.co/u/graimato)\ **Replies:** 3\ **Last updated:** [August 31, 2021, 11:06am UTC](https://discuss.elastic.co/t/date-convert/281664 "2021-08-31T11:06:06Z")
Hello, I created a pipeline to parse log file I want to parse datetime as follow 17/08/2021:12:14:50 +0200 Or 17/Aug/2021:12:14:50 +0200 I wrote pipeline "patterns" : \[ "%{HTTPDATE:time} .... { "… --- ## [Question on Elasticsearch upgrade using Ansible](https://discuss.elastic.co/t/question-on-elasticsearch-upgrade-using-ansible/282519)
**Author:** [@Arunlal\_A](https://discuss.elastic.co/u/Arunlal_A)\ **Replies:** 4\ **Last updated:** [August 31, 2021, 10:49am UTC](https://discuss.elastic.co/t/question-on-elasticsearch-upgrade-using-ansible/282519 "2021-08-31T10:49:47Z")
Hi, A quick basic question to the community. I have one three node Elasticsearch cluster (version 7.6.2) which was setup using the official Ansible role GitHub - elastic/ansible-elasticsearch: Ansible playbook for Elas… --- ## [\[Functionbeat\] Logstash output not uploading logs](https://discuss.elastic.co/t/functionbeat-logstash-output-not-uploading-logs/282900)
**Author:** [@BaronWhite](https://discuss.elastic.co/u/BaronWhite)\ **Replies:** 0\ **Last updated:** [August 31, 2021, 10:24am UTC](https://discuss.elastic.co/t/functionbeat-logstash-output-not-uploading-logs/282900 "2021-08-31T10:24:13Z")
Hello, I'm trying to configure the logstash output on Functionbeat 1.14.0, I found this thread saying this is not supported, however it's two years old and the docs don't mention it: The lambda was setup with .\\functi… --- ## [Update previosuly indexed data](https://discuss.elastic.co/t/update-previosuly-indexed-data/282765)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 8\ **Last updated:** [August 31, 2021, 9:46am UTC](https://discuss.elastic.co/t/update-previosuly-indexed-data/282765 "2021-08-31T09:46:47Z")
Hello ! Is there any way to detect with logstash jdbc if some previously indexed field value has been modified and if so, replace the old value with the new modified one in the next scheduled execution? Thanks in advan… --- ## [How to set up a role level security with oidc](https://discuss.elastic.co/t/how-to-set-up-a-role-level-security-with-oidc/282580)
**Author:** [@SRIGURU\_VEL](https://discuss.elastic.co/u/SRIGURU_VEL)\ **Replies:** 3\ **Last updated:** [August 31, 2021, 9:35am UTC](https://discuss.elastic.co/t/how-to-set-up-a-role-level-security-with-oidc/282580 "2021-08-31T09:35:03Z")
HI Experts, I have configured and Integrated Elasticsearch and Keycloak via Xpack. Previously I used Searchguard Instead of Xpack. In that We used role level security and it was working fine till now. But in Xpack I don… --- ## [Metricbeat Error event](https://discuss.elastic.co/t/metricbeat-error-event/282896)
**Author:** [@Yash\_Agrawal](https://discuss.elastic.co/u/Yash_Agrawal)\ **Replies:** 0\ **Last updated:** [August 31, 2021, 9:21am UTC](https://discuss.elastic.co/t/metricbeat-error-event/282896 "2021-08-31T09:21:29Z")
Metricbeat sends an error event when the service is not reachable. How can i configure my metricbeat so that it gives me an update everytime a process is down. (A "process" not a service in the system module) --- ## [Elasticsearch worked and then stopped](https://discuss.elastic.co/t/elasticsearch-worked-and-then-stopped/282795)
**Author:** [@sasha198407](https://discuss.elastic.co/u/sasha198407)\ **Replies:** 11\ **Last updated:** [August 31, 2021, 9:20am UTC](https://discuss.elastic.co/t/elasticsearch-worked-and-then-stopped/282795 "2021-08-31T09:20:30Z")
Elasticsearch worked and then stopped. It starts, runs for a minute and falls. In the logs, this is what. "at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1130) ~\[?:?\]", "at java.util.concur… --- ## [Wrong details parsing - Windows event-log](https://discuss.elastic.co/t/wrong-details-parsing-windows-event-log/282841)
**Author:** [@Go0La](https://discuss.elastic.co/u/Go0La)\ **Replies:** 0\ **Last updated:** [August 30, 2021, 4:21pm UTC](https://discuss.elastic.co/t/wrong-details-parsing-windows-event-log/282841 "2021-08-30T16:21:48Z")
Hello friends, In some alerts Elastic shows the full log but in others i get for example not the user name but the user SID (not as the eventViewer log). Suggestions to fix? Uploaded a picture. --- ## [Is Rally a good choice to create data lake?](https://discuss.elastic.co/t/is-rally-a-good-choice-to-create-data-lake/282826)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 8\ **Last updated:** [August 31, 2021, 8:49am UTC](https://discuss.elastic.co/t/is-rally-a-good-choice-to-create-data-lake/282826 "2021-08-31T08:49:10Z")
hey there, regularly I have to create a clusters from scratch and test their performances when indices contain data at least from 20 days. The possibility to have a data lake will give me the chance to avoid to wait for… --- ## [Script syntax help](https://discuss.elastic.co/t/script-syntax-help/282855)
**Author:** [@Vester](https://discuss.elastic.co/u/Vester)\ **Replies:** 2\ **Last updated:** [August 31, 2021, 8:32am UTC](https://discuss.elastic.co/t/script-syntax-help/282855 "2021-08-31T08:32:42Z")
Hi, I'm trying to run a script query to get all docs with a boolean AND condition and I could not found and examples on how to do this. I have this script working: GET indexX/\_search?size=1000 { "query": { … --- ## [Elastic not indexing any more filebeat data but metricbeat data after a Full filesystem](https://discuss.elastic.co/t/elastic-not-indexing-any-more-filebeat-data-but-metricbeat-data-after-a-full-filesystem/282783)
**Author:** [@zebu14](https://discuss.elastic.co/u/zebu14)\ **Replies:** 2\ **Last updated:** [August 31, 2021, 7:24am UTC](https://discuss.elastic.co/t/elastic-not-indexing-any-more-filebeat-data-but-metricbeat-data-after-a-full-filesystem/282783 "2021-08-31T07:24:33Z")
Hello, I encountered a filesystem full on one of my nodes that caused a cluster stop. I solved the disk space problem by deleting a too big metricbeat index and restarted the cluster. I used the following method (as u… --- ## [Multiline logs](https://discuss.elastic.co/t/multiline-logs/282835)
**Author:** [@111360](https://discuss.elastic.co/u/111360)\ **Replies:** 2\ **Last updated:** [August 31, 2021, 7:19am UTC](https://discuss.elastic.co/t/multiline-logs/282835 "2021-08-31T07:19:34Z")
In filebeat config: multiline.type: pattern multiline.pattern: '^\[' multiline.negate: true multiline.match: after From Manage multiline messages | Filebeat Reference \[7.14\] | Elastic and test log ''' \[beat-logstas… --- ## [Logstash not creating index in secure(https) kibana](https://discuss.elastic.co/t/logstash-not-creating-index-in-secure-https-kibana/282444)
**Author:** [@kiran80511](https://discuss.elastic.co/u/kiran80511)\ **Replies:** 9\ **Last updated:** [August 31, 2021, 4:57am UTC](https://discuss.elastic.co/t/logstash-not-creating-index-in-secure-https-kibana/282444 "2021-08-31T04:57:45Z")
This is my logstash log using journalctl -b 0 -r Aug 25 11:33:18 elastic.sys systemd\[1\]: Started logstash. Aug 25 11:33:18 elastic.sys systemd\[1\]: Stopped logstash. Aug 25 11:33:18 elastic.sys systemd\[1\]: logstash.serv… --- ## [How to show custom data in alerts messages in Kibana](https://discuss.elastic.co/t/how-to-show-custom-data-in-alerts-messages-in-kibana/282777)
**Author:** [@abhinav3](https://discuss.elastic.co/u/abhinav3)\ **Replies:** 6\ **Last updated:** [August 31, 2021, 4:57am UTC](https://discuss.elastic.co/t/how-to-show-custom-data-in-alerts-messages-in-kibana/282777 "2021-08-31T04:57:09Z")
Hi I have a below data coming to elasticsearch: { "Data": { "WiFiIP": "N/A", "signal\_strength": "N/A", "signal\_percent": 0, "signal\_level": "N/A", "CPU": 10, "cpu\_temp": 47.0, "Internet": true, "Publis… --- ## [Logstash using vulnerable JDK](https://discuss.elastic.co/t/logstash-using-vulnerable-jdk/282623)
**Author:** [@Aditya931](https://discuss.elastic.co/u/Aditya931)\ **Replies:** 6\ **Last updated:** [August 31, 2021, 4:50am UTC](https://discuss.elastic.co/t/logstash-using-vulnerable-jdk/282623 "2021-08-31T04:50:14Z")
Hi, The latest logstash (7.14.0) is using a vulnerable jdk, and we've got number of security issues because of that. Below is the version of logstash and the jdk used by it. Any update on when will this be resolved? an… --- ## [Question regarding file and folder permissions when it comes to File output plugin](https://discuss.elastic.co/t/question-regarding-file-and-folder-permissions-when-it-comes-to-file-output-plugin/282873)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 0\ **Last updated:** [August 31, 2021, 4:19am UTC](https://discuss.elastic.co/t/question-regarding-file-and-folder-permissions-when-it-comes-to-file-output-plugin/282873 "2021-08-31T04:19:42Z")
Problem In my Output plugin I want to write all grok parse failures to a file else if "\_grokparsefailure" in \[tags\] { file { path =\> "/home/anotherAccount/testfolder/grokfailures" … --- ## [In logstash, I want to save logs to different outputs for each k8s namespace](https://discuss.elastic.co/t/in-logstash-i-want-to-save-logs-to-different-outputs-for-each-k8s-namespace/282867)
**Author:** [@Suyong](https://discuss.elastic.co/u/Suyong)\ **Replies:** 3\ **Last updated:** [August 31, 2021, 2:57am UTC](https://discuss.elastic.co/t/in-logstash-i-want-to-save-logs-to-different-outputs-for-each-k8s-namespace/282867 "2021-08-31T02:57:08Z")
Hello everyone!! I'm recently struggling with filebeat and logstash log handling in a kubernetes env. But my problem is that when the log below is left as logstash, I want to save it in a separate ES for each namespace… --- ## [Heartbeat uptime service sample dashboard](https://discuss.elastic.co/t/heartbeat-uptime-service-sample-dashboard/282759)
**Author:** [@Sherabu](https://discuss.elastic.co/u/Sherabu)\ **Replies:** 7\ **Last updated:** [August 31, 2021, 2:48am UTC](https://discuss.elastic.co/t/heartbeat-uptime-service-sample-dashboard/282759 "2021-08-31T02:48:43Z")
Hi friends I really need your help. I have few service for few instances. I need visualize 1 instance how many service is up and how many was down. U can use table. But I wish to have like graph but I really no idea how… --- ## [Heartbeat dashboard in Kibana visualizing not showing expected](https://discuss.elastic.co/t/heartbeat-dashboard-in-kibana-visualizing-not-showing-expected/282840)
**Author:** [@selin](https://discuss.elastic.co/u/selin)\ **Replies:** 6\ **Last updated:** [August 31, 2021, 1:45am UTC](https://discuss.elastic.co/t/heartbeat-dashboard-in-kibana-visualizing-not-showing-expected/282840 "2021-08-31T01:45:51Z")
Hi guys, i started 1 application and another is down. Can I know why my graph not showing equal. It showing both green greater than red. Anything i did wrong? Please advice --- ## [Kibana visualization showing data as "Other"](https://discuss.elastic.co/t/kibana-visualization-showing-data-as-other/282636)
**Author:** [@online](https://discuss.elastic.co/u/online)\ **Replies:** 6\ **Last updated:** [August 31, 2021, 1:01am UTC](https://discuss.elastic.co/t/kibana-visualization-showing-data-as-other/282636 "2021-08-31T01:01:11Z")
Hello Guys, I am having an issue where some of the data on visualizations including in tables/dashboards appear as "Other". The index that holds this data have no data with that particular word. What could be the reason… --- ## [Elastic Central -](https://discuss.elastic.co/t/elastic-central/282810)
**Author:** [@alanreboucas](https://discuss.elastic.co/u/alanreboucas)\ **Replies:** 1\ **Last updated:** [August 30, 2021, 11:49pm UTC](https://discuss.elastic.co/t/elastic-central/282810 "2021-08-30T23:49:11Z")
First, sorry for the lack of knowledge. I'm new to the ElasticSearch world. I've already read a lot of the documentation, but some things weren't clear. I'm implementing a Central lasticsearch cluster and the idea is to… --- ## [Reindex API - failed reindex task response example](https://discuss.elastic.co/t/reindex-api-failed-reindex-task-response-example/282821)
**Author:** [@janesch97](https://discuss.elastic.co/u/janesch97)\ **Replies:** 0\ **Last updated:** [August 30, 2021, 1:29pm UTC](https://discuss.elastic.co/t/reindex-api-failed-reindex-task-response-example/282821 "2021-08-30T13:29:32Z")
Hello, I've been trying to implement a 'reindex complete' notification system using Watcher APIs. Reindex is triggered with wait\_for\_completion=true query parameter, so the reindex task is saved to .tasks index, that is… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1258) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1260)