# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1270 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1271 --- ## [Multiple concatenation in ruby file filter](https://discuss.elastic.co/t/multiple-concatenation-in-ruby-file-filter/282101)
**Author:** [@LuigiDelavega](https://discuss.elastic.co/u/LuigiDelavega)\ **Replies:** 1\ **Last updated:** [August 23, 2021, 3:13pm UTC](https://discuss.elastic.co/t/multiple-concatenation-in-ruby-file-filter/282101 "2021-08-23T15:13:29Z")
Hello, I would like to concatenate 5 fields which can exist or not and i would like to do it in my ruby file filter because we already have others working filters in it. my fields looks like this, they can have a value… --- ## [Include multiline and non-multiline events](https://discuss.elastic.co/t/include-multiline-and-non-multiline-events/282249)
**Author:** [@tecbox41](https://discuss.elastic.co/u/tecbox41)\ **Replies:** 0\ **Last updated:** [August 23, 2021, 2:56pm UTC](https://discuss.elastic.co/t/include-multiline-and-non-multiline-events/282249 "2021-08-23T14:56:22Z")
{"sub-4.0": { "level":"WARN","timestamp":"2021-02-12 13:01:25,047","thread":"Mapper","file":"filemapper.java","line":"732","message":"no data found"}} {"sub-4.0": { "level":"WARN","timestamp":"2021-02-12 13:01:26,047",… --- ## [Single index or multiple index](https://discuss.elastic.co/t/single-index-or-multiple-index/282139)
**Author:** [@selin](https://discuss.elastic.co/u/selin)\ **Replies:** 3\ **Last updated:** [August 23, 2021, 2:09pm UTC](https://discuss.elastic.co/t/single-index-or-multiple-index/282139 "2021-08-23T14:09:41Z")
My environment architecture is I have 15 server. The details as below Group 1 (Standalone) server 1 (2 app) server 2 3 app) server 3 (2 app) server 4 (3 app) Group 2 (master and slave) server 5 master (2 app) serve… --- ## [Elasticsearch after upgrade on 7.7.0 starts CircuitBreakingExceptions and nodes leaves/rejoin cluster](https://discuss.elastic.co/t/elasticsearch-after-upgrade-on-7-7-0-starts-circuitbreakingexceptions-and-nodes-leaves-rejoin-cluster/282071)
**Author:** [@Jiri\_Petak](https://discuss.elastic.co/u/Jiri_Petak)\ **Replies:** 8\ **Last updated:** [August 23, 2021, 1:45pm UTC](https://discuss.elastic.co/t/elasticsearch-after-upgrade-on-7-7-0-starts-circuitbreakingexceptions-and-nodes-leaves-rejoin-cluster/282071 "2021-08-23T13:45:41Z")
Hi, we have an issue when performing an upgrade on one of our clusters. We are upgrading elasticsearch from version 6.8.1 to 7.7.0 (we have other clusters on this version). The cluster has 3 master nodes, 5 data nodes a… --- ## [How to execute dynamic queries with visualisations](https://discuss.elastic.co/t/how-to-execute-dynamic-queries-with-visualisations/281640)
**Author:** [@akashk](https://discuss.elastic.co/u/akashk)\ **Replies:** 8\ **Last updated:** [August 23, 2021, 1:13pm UTC](https://discuss.elastic.co/t/how-to-execute-dynamic-queries-with-visualisations/281640 "2021-08-23T13:13:58Z")
Hi, I am new to ELK and I am facing one issue in creating visualisations. So we have two different sources(log files) from where we are reading the logs and storing triggeredTime and pickedTime of application event in … --- ## [Cant ship big log from filebeat or logstash to elastic](https://discuss.elastic.co/t/cant-ship-big-log-from-filebeat-or-logstash-to-elastic/282152)
**Author:** [@hagaluly](https://discuss.elastic.co/u/hagaluly)\ **Replies:** 3\ **Last updated:** [August 23, 2021, 1:01pm UTC](https://discuss.elastic.co/t/cant-ship-big-log-from-filebeat-or-logstash-to-elastic/282152 "2021-08-23T13:01:15Z")
i have a 3 nodes cluster with 1 master and 2 data nodes each is set for 1TB i have increased both -Xms24g -Xmx24g to half my ram (48GB total) i than successfully upload 140mb file from Kibana to elk from the GUI after i… --- ## [Tracking multiple records by unique value from json.rest](https://discuss.elastic.co/t/tracking-multiple-records-by-unique-value-from-json-rest/282225)
**Author:** [@Olga\_Drakonen](https://discuss.elastic.co/u/Olga_Drakonen)\ **Replies:** 0\ **Last updated:** [August 23, 2021, 12:57pm UTC](https://discuss.elastic.co/t/tracking-multiple-records-by-unique-value-from-json-rest/282225 "2021-08-23T12:57:55Z")
I have a huge array of records, each with a unique value in json.rest. Each entry with its own zson.rest key value is first displayed in one record from the first service, then in the next record from the second service.… --- ## [Scripted fields for Kibana alerting not showing](https://discuss.elastic.co/t/scripted-fields-for-kibana-alerting-not-showing/281913)
**Author:** [@aniket.sonavane](https://discuss.elastic.co/u/aniket.sonavane)\ **Replies:** 5\ **Last updated:** [August 23, 2021, 12:54pm UTC](https://discuss.elastic.co/t/scripted-fields-for-kibana-alerting-not-showing/281913 "2021-08-23T12:54:32Z")
The objective is to setup an email alert on heap\_utilization where heap\_utilization% is greater than 85% group by jvm\_name for production enviroment. I am working on elastic stack version 7.13.0 where I also set up APM … --- ## [Can't edit Widget after rename Index Pattern](https://discuss.elastic.co/t/cant-edit-widget-after-rename-index-pattern/281514)
**Author:** [@Arethusa](https://discuss.elastic.co/u/Arethusa)\ **Replies:** 1\ **Last updated:** [August 23, 2021, 12:47pm UTC](https://discuss.elastic.co/t/cant-edit-widget-after-rename-index-pattern/281514 "2021-08-23T12:47:24Z")
Hello, I am on v 7.12.0. I observe a bug, maybe it was fix with new version but we never know. Some one have rename one Index Pattern, and after that, I can't edit my widget to update it, I have to create new widget. … --- ## [Kibana Alerts accessing fields](https://discuss.elastic.co/t/kibana-alerts-accessing-fields/280789)
**Author:** [@bevano](https://discuss.elastic.co/u/bevano)\ **Replies:** 1\ **Last updated:** [August 23, 2021, 12:39pm UTC](https://discuss.elastic.co/t/kibana-alerts-accessing-fields/280789 "2021-08-23T12:39:41Z")
Hi All, Is it possible to access specific fields within Action boxes under Alerts in Kibana. For example, I want to alert when the field "host.status" equals down. This is easy using the Elasticsearch Query. After this… --- ## [Having hard time to extract day of week in scripted field](https://discuss.elastic.co/t/having-hard-time-to-extract-day-of-week-in-scripted-field/281690)
**Author:** [@Mojahid\_Ahmad](https://discuss.elastic.co/u/Mojahid_Ahmad)\ **Replies:** 6\ **Last updated:** [August 23, 2021, 10:41am UTC](https://discuss.elastic.co/t/having-hard-time-to-extract-day-of-week-in-scripted-field/281690 "2021-08-23T10:41:00Z")
I am able to extract hour of day using the below script format. But facing the issue while extracting the day of week because of timezone. I used this script. \["","Mon","Tue","Wed","Thu","Fri","Sat","Sun"\]doc\['event\_ti… --- ## [Error Fleet Server - Error - x509: cannot validate certificate for x.x.x.x because it doesn't contain any IP SANs](https://discuss.elastic.co/t/error-fleet-server-error-x509-cannot-validate-certificate-for-x-x-x-x-because-it-doesnt-contain-any-ip-sans/282170)
**Author:** [@Carlos\_Velasquez](https://discuss.elastic.co/u/Carlos_Velasquez)\ **Replies:** 1\ **Last updated:** [August 23, 2021, 10:36am UTC](https://discuss.elastic.co/t/error-fleet-server-error-x509-cannot-validate-certificate-for-x-x-x-x-because-it-doesnt-contain-any-ip-sans/282170 "2021-08-23T10:36:41Z")
hello I am trying to connect to Fleet but I get the following error, I have created the certificates but I can't solve the problem 2021-08-20T21:50:53.027-0500 ERROR status/reporter.go:236 Elastic Agent status cha… --- ## [Elasticsearch 7.13 unassigned shard problem](https://discuss.elastic.co/t/elasticsearch-7-13-unassigned-shard-problem/282204)
**Author:** [@mug3n451](https://discuss.elastic.co/u/mug3n451)\ **Replies:** 4\ **Last updated:** [August 23, 2021, 10:26am UTC](https://discuss.elastic.co/t/elasticsearch-7-13-unassigned-shard-problem/282204 "2021-08-23T10:26:07Z")
Hi, i have i weird problem on elasticsearc 7.13 deployed on kubernetes. Here my configuration: 3 master node 2 date node with heap 8gb and 100gb storage 2 shard and 1 replica index size: eventsched n° doc 3178640… --- ## [Kafka consumergroup metricset & TSVB interval](https://discuss.elastic.co/t/kafka-consumergroup-metricset-tsvb-interval/279964)
**Author:** [@Malec](https://discuss.elastic.co/u/Malec)\ **Replies:** 2\ **Last updated:** [August 23, 2021, 10:25am UTC](https://discuss.elastic.co/t/kafka-consumergroup-metricset-tsvb-interval/279964 "2021-08-23T10:25:08Z")
Hi, I'm trying to use the Kafka consumergroup metricset to report global lag per consumer group. For simplicity's sake let's say that 1 consumergroup == one topic. The problem is the lag is reported per partition so if… --- ## [ELK data/shard allocation is not happening properly](https://discuss.elastic.co/t/elk-data-shard-allocation-is-not-happening-properly/281784)
**Author:** [@karthik\_kiccha](https://discuss.elastic.co/u/karthik_kiccha)\ **Replies:** 8\ **Last updated:** [August 23, 2021, 10:09am UTC](https://discuss.elastic.co/t/elk-data-shard-allocation-is-not-happening-properly/281784 "2021-08-23T10:09:38Z")
Hello Team, We have 6 node ELK cluster and all of them are configured to act as master and data node. Out of 6 nodes two nodes are consuming more disk space which is at 93%, other nodes are at 70% to 80%. We have tried … --- ## [In which order are config loaded?](https://discuss.elastic.co/t/in-which-order-are-config-loaded/281014)
**Author:** [@colttt](https://discuss.elastic.co/u/colttt)\ **Replies:** 2\ **Last updated:** [August 23, 2021, 9:51am UTC](https://discuss.elastic.co/t/in-which-order-are-config-loaded/281014 "2021-08-23T09:51:38Z")
Hi, so far as I can see, there is a path.config which pont to /etc/filebeat (on debian systems). when I put a config file in this dir, lets say custom\_conf.yml. will it be load after the filebeat.yml and overwrite the se… --- ## [Elasticsearch index and clustering](https://discuss.elastic.co/t/elasticsearch-index-and-clustering/282025)
**Author:** [@selin](https://discuss.elastic.co/u/selin)\ **Replies:** 9\ **Last updated:** [August 23, 2021, 9:43am UTC](https://discuss.elastic.co/t/elasticsearch-index-and-clustering/282025 "2021-08-23T09:43:40Z")
Hi friends, Can i know is it good to have a single index per environment or 1 environment to have 5 index based on team. based on each team they have multiple logs. Besides that i have 3 Elasticsearch cluster, will the … --- ## [Filebeat shows unexpected error while setup](https://discuss.elastic.co/t/filebeat-shows-unexpected-error-while-setup/282203)
**Author:** [@Shubh\_Garg](https://discuss.elastic.co/u/Shubh_Garg)\ **Replies:** 0\ **Last updated:** [August 23, 2021, 8:58am UTC](https://discuss.elastic.co/t/filebeat-shows-unexpected-error-while-setup/282203 "2021-08-23T08:58:50Z")
I get the following error while running the command sudo filebeat setup on my centos7 linux ec2 instance. I have two modules nginx and System enabled. The error above only comes when i enable the system module. The … --- ## [Logstash aggregate filter sum incorrect](https://discuss.elastic.co/t/logstash-aggregate-filter-sum-incorrect/282199)
**Author:** [@zhyp](https://discuss.elastic.co/u/zhyp)\ **Replies:** 0\ **Last updated:** [August 23, 2021, 8:40am UTC](https://discuss.elastic.co/t/logstash-aggregate-filter-sum-incorrect/282199 "2021-08-23T08:40:29Z")
Hi, :slightly\_smiling\_face: Here is my es data.I can query them correctly. {"count":1,"time":"2021-08-10T00:15:00.000+08:00"} {"count":2,"time":"2021-08-10T00:30:00.000+08:00"} I want to sum the count by day. Here … --- ## [Rollup-Jobs - How to visualize Raw and Rolledup-Data](https://discuss.elastic.co/t/rollup-jobs-how-to-visualize-raw-and-rolledup-data/282065)
**Author:** [@cwiechmann](https://discuss.elastic.co/u/cwiechmann)\ **Replies:** 4\ **Last updated:** [August 23, 2021, 9:08am UTC](https://discuss.elastic.co/t/rollup-jobs-how-to-visualize-raw-and-rolledup-data/282065 "2021-08-23T09:08:34Z")
Hi Experts, I'm using the Elasticstack version 7.14.0 and have started to use Rollup-Jobs. Based on the documentation is seems, that rolled-up query results should include Raw-Data (as long as available) and automatical… --- ## [Unstructured Tomcat Logs](https://discuss.elastic.co/t/unstructured-tomcat-logs/282190)
**Author:** [@dipinsugathan](https://discuss.elastic.co/u/dipinsugathan)\ **Replies:** 1\ **Last updated:** [August 23, 2021, 8:28am UTC](https://discuss.elastic.co/t/unstructured-tomcat-logs/282190 "2021-08-23T08:28:18Z")
Hi All, Need help in ingesting tomcat unstructured logs to ELK. While ingesting via filebeat -\>logstash-\>elasticsearch -\> kibana everything is coming in one message field. I was trying to split it with mutate filter pl… --- ## [Built in alerts fail to run](https://discuss.elastic.co/t/built-in-alerts-fail-to-run/281207)
**Author:** [@radovan](https://discuss.elastic.co/u/radovan)\ **Replies:** 5\ **Last updated:** [August 23, 2021, 8:16am UTC](https://discuss.elastic.co/t/built-in-alerts-fail-to-run/281207 "2021-08-23T08:16:03Z")
Hi, I decided to create a monitoring cluster and after a few problems at the start all is running now. There are metricbeat clients on the elastic nodes with only elastic/logstash/kibana modules enabled, logs are flowin… --- ## [Logstash GeoIP filter with words](https://discuss.elastic.co/t/logstash-geoip-filter-with-words/281638)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 3\ **Last updated:** [August 23, 2021, 7:01am UTC](https://discuss.elastic.co/t/logstash-geoip-filter-with-words/281638 "2021-08-23T07:01:21Z")
hello! I have a log with countries but it does not have an IP field and I would like to make a map in kibana giving a latitude and longitude to that field. If I had an IP I would know how to do it with geoip. Can this… --- ## [Indexes are keep increasing after traffic towards elastic has stoped](https://discuss.elastic.co/t/indexes-are-keep-increasing-after-traffic-towards-elastic-has-stoped/281183)
**Author:** [@John\_Xanthopoulos](https://discuss.elastic.co/u/John_Xanthopoulos)\ **Replies:** 19\ **Last updated:** [August 23, 2021, 6:40am UTC](https://discuss.elastic.co/t/indexes-are-keep-increasing-after-traffic-towards-elastic-has-stoped/281183 "2021-08-23T06:40:31Z")
After having performed a test with indexing rate of ~30000/sec for couple of hours we noticed the following behavior. After Fluentd has stopped sending data to elasticsearch, four some time there is an ammount of documen… --- ## [Security Features](https://discuss.elastic.co/t/security-features/282179)
**Author:** [@Yazan\_Mostafa](https://discuss.elastic.co/u/Yazan_Mostafa)\ **Replies:** 1\ **Last updated:** [August 23, 2021, 4:25am UTC](https://discuss.elastic.co/t/security-features/282179 "2021-08-23T04:25:35Z")
Hi everyone I am new to ELK Stack, I am trying to upload data for elastic, but unfortunately I can't because of security features... Can any one help me hot to give privilege and set roles to solve the problem it is u… --- ## [Fiebeat test output error (Java heap size)](https://discuss.elastic.co/t/fiebeat-test-output-error-java-heap-size/280483)
**Author:** [@Ahmed2021](https://discuss.elastic.co/u/Ahmed2021)\ **Replies:** 10\ **Last updated:** [August 23, 2021, 2:50am UTC](https://discuss.elastic.co/t/fiebeat-test-output-error-java-heap-size/280483 "2021-08-23T02:50:38Z")
Hi All Can anyone help one the below error ? the file beat fails the test and we unable to access the Wazuh's dashboard \[root@ELS01 conf\]# filebeat test output elasticsearch: http://1.1.1.1:9200... parse url... OK c… --- ## [Searchable snapshots - cold phase - not working as expected](https://discuss.elastic.co/t/searchable-snapshots-cold-phase-not-working-as-expected/282143)
**Author:** [@Kannappan\_Somu](https://discuss.elastic.co/u/Kannappan_Somu)\ **Replies:** 1\ **Last updated:** [August 23, 2021, 1:44am UTC](https://discuss.elastic.co/t/searchable-snapshots-cold-phase-not-working-as-expected/282143 "2021-08-23T01:44:10Z")
INDEX TEMPLATE PUT \_template/cold-demo { "index\_patterns": \["cold-demo\*"\], "settings": { "index" : { "lifecycle" : { "name" : "cold\_retention\_prod", "rollover\_alias" : "… --- ## [I think in elasticsearch it shows the size of 10 by default but instead of 10 i want to set the size to total hits value that i am getting after running the query. I am attaching my query Please help me out](https://discuss.elastic.co/t/i-think-in-elasticsearch-it-shows-the-size-of-10-by-default-but-instead-of-10-i-want-to-set-the-size-to-total-hits-value-that-i-am-getting-after-running-the-query-i-am-attaching-my-query-please-help-me-out/282157)
**Author:** [@ashurajchandra](https://discuss.elastic.co/u/ashurajchandra)\ **Replies:** 1\ **Last updated:** [August 23, 2021, 1:39am UTC](https://discuss.elastic.co/t/i-think-in-elasticsearch-it-shows-the-size-of-10-by-default-but-instead-of-10-i-want-to-set-the-size-to-total-hits-value-that-i-am-getting-after-running-the-query-i-am-attaching-my-query-please-help-me-out/282157 "2021-08-23T01:39:40Z")
GET /\_search { "sort": \[{ "date": { "order": "desc" } }\], "track\_total\_hits": true, "query": { "bool": { "must": \[ { … --- ## [TOO\_MANY\_REQUESTS/12/disk usage exceeded](https://discuss.elastic.co/t/too-many-requests-12-disk-usage-exceeded/280753)
**Author:** [@mfisher](https://discuss.elastic.co/u/mfisher)\ **Replies:** 3\ **Last updated:** [August 23, 2021, 1:29am UTC](https://discuss.elastic.co/t/too-many-requests-12-disk-usage-exceeded/280753 "2021-08-23T01:29:42Z")
Recently credentials are failing in the Kibana web interface. Checking the logs there is an error indicating disk usage is exceeded. {"type":"log","@timestamp":"2021-08-08T20:41:52-05:00","tags":\["error","plugins","apm… --- ## [Having 0 shard for cluster elastisearch](https://discuss.elastic.co/t/having-0-shard-for-cluster-elastisearch/282150)
**Author:** [@selin](https://discuss.elastic.co/u/selin)\ **Replies:** 3\ **Last updated:** [August 23, 2021, 1:24am UTC](https://discuss.elastic.co/t/having-0-shard-for-cluster-elastisearch/282150 "2021-08-23T01:24:25Z")
Hi friend, i have 3 container elasticsearch. I am assuming it should crete 5 shard for each container as 1 index in each container and each container have multiple shard/ When I fired shards api, i getting 0. Please advi… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1269) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1271)