# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1277 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1278 --- ## [Change indices.memory.index\_buffer\_size on a working elasticsearch cluster](https://discuss.elastic.co/t/change-indices-memory-index-buffer-size-on-a-working-elasticsearch-cluster/281737)
**Author:** [@Voula\_Mikr](https://discuss.elastic.co/u/Voula_Mikr)\ **Replies:** 3\ **Last updated:** [August 17, 2021, 6:43pm UTC](https://discuss.elastic.co/t/change-indices-memory-index-buffer-size-on-a-working-elasticsearch-cluster/281737 "2021-08-17T18:43:42Z")
Hi, Is there any way to change indices.memory.index\_buffer\_size on a working elasticsearch cluster? Is that possible through an API? Thank you in advance. --- ## [Fleet-server and filebeats in one elastic-agent](https://discuss.elastic.co/t/fleet-server-and-filebeats-in-one-elastic-agent/281355)
**Author:** [@tkarczewski](https://discuss.elastic.co/u/tkarczewski)\ **Replies:** 11\ **Last updated:** [August 17, 2021, 6:42pm UTC](https://discuss.elastic.co/t/fleet-server-and-filebeats-in-one-elastic-agent/281355 "2021-08-17T18:42:39Z")
Hi, How to use one elastic-agent on host where elastic stack is deployed to be as fleet server and filebeat collecting udp syslog messages? I red that elastic agent can be use for fleet server and data collection simult… --- ## [Filebeat input types log and filestream metadata for file path/name differ](https://discuss.elastic.co/t/filebeat-input-types-log-and-filestream-metadata-for-file-path-name-differ/281713)
**Author:** [@Michael\_Savettiere](https://discuss.elastic.co/u/Michael_Savettiere)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 3:21pm UTC](https://discuss.elastic.co/t/filebeat-input-types-log-and-filestream-metadata-for-file-path-name-differ/281713 "2021-08-17T15:21:41Z")
I have been using beats input type log, but with the 7.14.0 release I noticed that the filestream input type is supposed to be an improvement to the log input type. I noticed that the event meta data differs between the … --- ## [Esrally failing with \[ERROR\] Cannot race. Error in race control (NotFoundError(404, 'Not Found', 'Not Found'))](https://discuss.elastic.co/t/esrally-failing-with-error-cannot-race-error-in-race-control-notfounderror-404-not-found-not-found/281731)
**Author:** [@sadhana.durge](https://discuss.elastic.co/u/sadhana.durge)\ **Replies:** 3\ **Last updated:** [August 17, 2021, 5:54pm UTC](https://discuss.elastic.co/t/esrally-failing-with-error-cannot-race-error-in-race-control-notfounderror-404-not-found-not-found/281731 "2021-08-17T17:54:35Z")
Trying to run esrally race --track=pmc --target-hosts=\*\*\*\*\*\*\*.kb.us-west1.gcp.cloud.es.io:9243 --p ipeline=benchmark-only --client-options="timeout:60,use\_ssl:true,verify\_certs:true,basic\_auth\_user:'elastic',basic \_aut… --- ## [Run in Docker with TLS enabled - does not successfully launch, fix found](https://discuss.elastic.co/t/run-in-docker-with-tls-enabled-does-not-successfully-launch-fix-found/281728)
**Author:** [@newschapmj1](https://discuss.elastic.co/u/newschapmj1)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 4:55pm UTC](https://discuss.elastic.co/t/run-in-docker-with-tls-enabled-does-not-successfully-launch-fix-found/281728 "2021-08-17T16:55:49Z")
Hope this helps someone, or me when I forget! I was running this on Docker Desktop, on Win 11 Part II, Run in Docker with TLS enabled Step 3 worked normally Step 4 \`docker-compose -f elastic-docker-tls.yml up -d C… --- ## [Get task ids after executing search query](https://discuss.elastic.co/t/get-task-ids-after-executing-search-query/281719)
**Author:** [@NLSVTN](https://discuss.elastic.co/u/NLSVTN)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 4:46pm UTC](https://discuss.elastic.co/t/get-task-ids-after-executing-search-query/281719 "2021-08-17T16:46:37Z")
I need to give a user an ability to terminate a query initiated by Elasticsearch-DSL or Elasticsearch-py. I know how to get a list of tasks running on the server but I can't just terminate all of them since there is a ch… --- ## [Logstash forwarding MSFT Server logs into Azure](https://discuss.elastic.co/t/logstash-forwarding-msft-server-logs-into-azure/281708)
**Author:** [@JBHuber](https://discuss.elastic.co/u/JBHuber)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 4:45pm UTC](https://discuss.elastic.co/t/logstash-forwarding-msft-server-logs-into-azure/281708 "2021-08-17T16:45:54Z")
Hoping someone here has tried to do this same thing. We are using Logstash as a forwarder of linux & windows logs into MSFT Azure Sentinel. We do segregate (or TAG) the logs as "windows" and "linux". Linux is fine and … --- ## [Changing / Modifying / Customizing Visualize Library](https://discuss.elastic.co/t/changing-modifying-customizing-visualize-library/281115)
**Author:** [@bailarch](https://discuss.elastic.co/u/bailarch)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 4:02pm UTC](https://discuss.elastic.co/t/changing-modifying-customizing-visualize-library/281115 "2021-08-17T16:02:17Z")
Hello everyone, I would like to create a set of dataset from Visualize Library since some of the templates that I see can be more powerful than Lens / Dashboard since you can set infinite about of data/values to show - … --- ## [Elasticsearch pods are not ready when xpack.security.enabled is configured](https://discuss.elastic.co/t/elasticsearch-pods-are-not-ready-when-xpack-security-enabled-is-configured/281709)
**Author:** [@etrpchevska](https://discuss.elastic.co/u/etrpchevska)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 2:58pm UTC](https://discuss.elastic.co/t/elasticsearch-pods-are-not-ready-when-xpack-security-enabled-is-configured/281709 "2021-08-17T14:58:56Z")
Hello, I am trying to enable minimal and then basic security on our Elasticsearch cluster following these guidelines: This is the Elasticsearch config file: elasticsearch.yml: | cluster.name: dev-observability … --- ## [XML filter - processing of an array of values](https://discuss.elastic.co/t/xml-filter-processing-of-an-array-of-values/281601)
**Author:** [@Robo](https://discuss.elastic.co/u/Robo)\ **Replies:** 4\ **Last updated:** [August 17, 2021, 2:55pm UTC](https://discuss.elastic.co/t/xml-filter-processing-of-an-array-of-values/281601 "2021-08-17T14:55:23Z")
We're processing some xml events using the xml filter. The filter setup it's quite simple: filter { xml { source =\> "message" target =\> "xml" } } This filter generates two fields with an array of v… --- ## [Filter out the same event and send to different outputs](https://discuss.elastic.co/t/filter-out-the-same-event-and-send-to-different-outputs/281611)
**Author:** [@panagiss](https://discuss.elastic.co/u/panagiss)\ **Replies:** 4\ **Last updated:** [August 17, 2021, 2:40pm UTC](https://discuss.elastic.co/t/filter-out-the-same-event-and-send-to-different-outputs/281611 "2021-08-17T14:40:24Z")
What I want is, the event i get from the Beats by listening to the port 5044, to send a filtered version of the event to one output and send a differently filtered version to the other output. That is the general questi… --- ## [Compare float value generated from Glok Pattern](https://discuss.elastic.co/t/compare-float-value-generated-from-glok-pattern/281616)
**Author:** [@Athul\_Devkar](https://discuss.elastic.co/u/Athul_Devkar)\ **Replies:** 4\ **Last updated:** [August 17, 2021, 2:38pm UTC](https://discuss.elastic.co/t/compare-float-value-generated-from-glok-pattern/281616 "2021-08-17T14:38:26Z")
Dear All, I am trying to compare 2 float fields, which are created from Grok patterns match. But this is crashing the pipeline. Not able to figure out what is missing here! Kindly help. if \[message\] =~ "Customer Type … --- ## [Pipelines.yml failed to read with Pipeline to Pipeline model](https://discuss.elastic.co/t/pipelines-yml-failed-to-read-with-pipeline-to-pipeline-model/281659)
**Author:** [@panagiss](https://discuss.elastic.co/u/panagiss)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 2:32pm UTC](https://discuss.elastic.co/t/pipelines-yml-failed-to-read-with-pipeline-to-pipeline-model/281659 "2021-08-17T14:32:44Z")
I had previously multiple pipelines and i added Pipeline to Pipeline model in my pipelines.yml But since then i get this error: ERROR: Failed to read pipelines yaml file. Location: /usr/share/logstash/config/pipelines.… --- ## [Unable to remove "timestamp" field (not "@timestamp"!)](https://discuss.elastic.co/t/unable-to-remove-timestamp-field-not-timestamp/281654)
**Author:** [@jze1](https://discuss.elastic.co/u/jze1)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 2:25pm UTC](https://discuss.elastic.co/t/unable-to-remove-timestamp-field-not-timestamp/281654 "2021-08-17T14:25:18Z")
I am seeing the error below in logstash log. So I'm trying to parse the string further but after that mutate { remove\_field =\> \[ "timestamp" \] } does NOTHING. WTF? "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"… --- ## [Double Scripted Field gets fetched as string when filtering in a Dashboard](https://discuss.elastic.co/t/double-scripted-field-gets-fetched-as-string-when-filtering-in-a-dashboard/281357)
**Author:** [@DavidBrosIvent](https://discuss.elastic.co/u/DavidBrosIvent)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 2:24pm UTC](https://discuss.elastic.co/t/double-scripted-field-gets-fetched-as-string-when-filtering-in-a-dashboard/281357 "2021-08-17T14:24:13Z")
Hey guys, I have a scripted field which returns a percentage value based on 2 keys in my documents. The scripted field is set to return 0 when the keys return a NaN value due to one of them being missing. The script an… --- ## [Docker-compose -f elastic-docker-tls.yml up -d](https://discuss.elastic.co/t/docker-compose-f-elastic-docker-tls-yml-up-d/281695)
**Author:** [@newschapmj1](https://discuss.elastic.co/u/newschapmj1)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 2:05pm UTC](https://discuss.elastic.co/t/docker-compose-f-elastic-docker-tls-yml-up-d/281695 "2021-08-17T14:05:18Z")
Docs 7.14 "Running the Elastic Stack on Docker" In step 4 Docker-compose -f elastic-docker-tls.yml up -d What does the -d parameter mean? --- ## [How can I configure logstash in this way?](https://discuss.elastic.co/t/how-can-i-configure-logstash-in-this-way/281561)
**Author:** [@xemyleex](https://discuss.elastic.co/u/xemyleex)\ **Replies:** 5\ **Last updated:** [August 17, 2021, 1:53pm UTC](https://discuss.elastic.co/t/how-can-i-configure-logstash-in-this-way/281561 "2021-08-17T13:53:31Z")
I need a way to configure a logstash instance to work as load balancer for other 5 logstash instances. How can I do that? and what are the advantages and the disavantages to use multiple instances instead of only one? … --- ## [Need to get any help in parsing a complicated logs](https://discuss.elastic.co/t/need-to-get-any-help-in-parsing-a-complicated-logs/281671)
**Author:** [@MT2021](https://discuss.elastic.co/u/MT2021)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 1:49pm UTC](https://discuss.elastic.co/t/need-to-get-any-help-in-parsing-a-complicated-logs/281671 "2021-08-17T13:49:27Z")
Hi team, I am very new in Grok. I am struggling at this point. I cannot make a parser for below log file. The issue comes in \[17/Aug/2021:16:46:33 +0700\]. I cannot pass it. 192.168.40.100 - - \[17/Aug/2021:16:46:33 +0… --- ## [Sort not works on string field](https://discuss.elastic.co/t/sort-not-works-on-string-field/281685)
**Author:** [@rahmatzadeh\_mofid](https://discuss.elastic.co/u/rahmatzadeh_mofid)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 1:26pm UTC](https://discuss.elastic.co/t/sort-not-works-on-string-field/281685 "2021-08-17T13:26:45Z")
Sort() function not working on string fields of the document. this is my query: (I use the latest version of Nest client in c# dotnet 5) var res = await elasticClient.SearchAsync\(s =\> s.Index("customers"… --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/280518)
**Author:** [@smam](https://discuss.elastic.co/u/smam)\ **Replies:** 16\ **Last updated:** [August 17, 2021, 1:15pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/280518 "2021-08-17T13:15:25Z")
I am confronting the above error while trying to set up minimalistic security for elasticsearch. I know there are multiple forum contributions, but none of them helped me. elasticsearch.yml: # ======================== … --- ## [Need help to figure out what functionality is free](https://discuss.elastic.co/t/need-help-to-figure-out-what-functionality-is-free/281683)
**Author:** [@Maria\_Mikhalska](https://discuss.elastic.co/u/Maria_Mikhalska)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 1:01pm UTC](https://discuss.elastic.co/t/need-help-to-figure-out-what-functionality-is-free/281683 "2021-08-17T13:01:19Z")
Hi! I'm confused a lot that there are oss version &. non-oss version of elasticsearch (v. 7.10). I understand that one is open source version. But what does it change for me? For example, can it be situation that I use f… --- ## [High cpu usage (90-100%) on elastic search servers](https://discuss.elastic.co/t/high-cpu-usage-90-100-on-elastic-search-servers/12268)
**Author:** [@Han\_2](https://discuss.elastic.co/u/Han_2)\ **Replies:** 21\ **Last updated:** [August 17, 2021, 12:36pm UTC](https://discuss.elastic.co/t/high-cpu-usage-90-100-on-elastic-search-servers/12268 "2021-08-17T12:36:25Z")
we are going live with elasticsearch and as soon as we put production load cpu spikes to 90-100%.. wondering whats causing the issue. here is cluster info: es version: 0.90.0 5 nodes each with following config: … --- ## [When i am running this query without filter then it is running fine but when i am putting the filter context with time range of 10 minute i am not getting any value in hits. I have to filter and get the events of last 10 minutes](https://discuss.elastic.co/t/when-i-am-running-this-query-without-filter-then-it-is-running-fine-but-when-i-am-putting-the-filter-context-with-time-range-of-10-minute-i-am-not-getting-any-value-in-hits-i-have-to-filter-and-get-the-events-of-last-10-minutes/281679)
**Author:** [@ashurajchandra](https://discuss.elastic.co/u/ashurajchandra)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 12:08pm UTC](https://discuss.elastic.co/t/when-i-am-running-this-query-without-filter-then-it-is-running-fine-but-when-i-am-putting-the-filter-context-with-time-range-of-10-minute-i-am-not-getting-any-value-in-hits-i-have-to-filter-and-get-the-events-of-last-10-minutes/281679 "2021-08-17T12:08:03Z")
{ "sort": \[{ "date": { "order": "desc" } }\], "from": 0, "size": 3, "track\_total\_hits": true, "query": { "bool": { "must": \[ … --- ## [Decode\_json\_fields and array](https://discuss.elastic.co/t/decode-json-fields-and-array/281530)
**Author:** [@s17n](https://discuss.elastic.co/u/s17n)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 12:11pm UTC](https://discuss.elastic.co/t/decode-json-fields-and-array/281530 "2021-08-17T12:11:49Z")
Hello, It seems decode\_json\_fields can't decode array. This is my log : {"level":"panic","application":"command","stack":\[{"func":"main.func1","line":"51","source":"main.go"},{"func":"gopanic","line":"965","source":"p… --- ## [Filter data using HttpRequest](https://discuss.elastic.co/t/filter-data-using-httprequest/281508)
**Author:** [@fed](https://discuss.elastic.co/u/fed)\ **Replies:** 6\ **Last updated:** [August 17, 2021, 12:02pm UTC](https://discuss.elastic.co/t/filter-data-using-httprequest/281508 "2021-08-17T12:02:12Z")
Hi! I'm new to the ELK stack and I'd like to know if there's a way to filter the logs in filebeat using a processor that checks some values from an external REST API, and based on the response, it drops or sends the eve… --- ## [Creating index name as per log file name](https://discuss.elastic.co/t/creating-index-name-as-per-log-file-name/281677)
**Author:** [@mangesh\_shinde](https://discuss.elastic.co/u/mangesh_shinde)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 11:52am UTC](https://discuss.elastic.co/t/creating-index-name-as-per-log-file-name/281677 "2021-08-17T11:52:04Z")
Hi, I have use beat to get log files and location specified .log files are there. I am sending this log through logstash to elastic search. in conf file what to do to have index name as file name --- ## [Get Windows Defender logs in Logstash using Winlogbeat](https://discuss.elastic.co/t/get-windows-defender-logs-in-logstash-using-winlogbeat/281538)
**Author:** [@Logstash\_logs](https://discuss.elastic.co/u/Logstash_logs)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 11:39am UTC](https://discuss.elastic.co/t/get-windows-defender-logs-in-logstash-using-winlogbeat/281538 "2021-08-17T11:39:43Z")
Hi, I'm trying to send windows defender logs to logstash using winlogbeat. I added name: Microsoft-Windows-Windows Defender/Operational in winlogbeat.yml file but not getting any logs related to defender only Microsoft… --- ## [Help reindexing one domain to another](https://discuss.elastic.co/t/help-reindexing-one-domain-to-another/281603)
**Author:** [@ViniciusSPaiva](https://discuss.elastic.co/u/ViniciusSPaiva)\ **Replies:** 3\ **Last updated:** [August 17, 2021, 11:39am UTC](https://discuss.elastic.co/t/help-reindexing-one-domain-to-another/281603 "2021-08-17T11:39:38Z")
Hello, I am trying to reindex one domain that has almost 10 million documents to another. The reason I am doing that is that I made a change in the analyzer, to split the dots, ignore leading zeroes and so forth. I'm g… --- ## [Filebeat modules need better documentation (e.g. docker local logging, traefik json logging)](https://discuss.elastic.co/t/filebeat-modules-need-better-documentation-e-g-docker-local-logging-traefik-json-logging/281675)
**Author:** [@bluepuma77](https://discuss.elastic.co/u/bluepuma77)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 11:38am UTC](https://discuss.elastic.co/t/filebeat-modules-need-better-documentation-e-g-docker-local-logging-traefik-json-logging/281675 "2021-08-17T11:38:51Z")
Hi all, I would like to use filebeat to monitor my container infrastructure. I am wondering why some of the filebeat modules seem so insufficient documented about any details that are beyond the most standard configurat… --- ## [Beats output to Logstash AND Elastic?](https://discuss.elastic.co/t/beats-output-to-logstash-and-elastic/281597)
**Author:** [@panagiss](https://discuss.elastic.co/u/panagiss)\ **Replies:** 6\ **Last updated:** [August 17, 2021, 11:36am UTC](https://discuss.elastic.co/t/beats-output-to-logstash-and-elastic/281597 "2021-08-17T11:36:17Z")
Is it possible to Output to Elasticsearch AND Logstash at the same time from a Beat? [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1276) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1278)