# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1287 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1288 --- ## [DLQ not enabled for logstasha](https://discuss.elastic.co/t/dlq-not-enabled-for-logstasha/280940)
**Author:** [@Krrish\_Raj1](https://discuss.elastic.co/u/Krrish_Raj1)\ **Replies:** 9\ **Last updated:** [August 10, 2021, 9:33pm UTC](https://discuss.elastic.co/t/dlq-not-enabled-for-logstasha/280940 "2021-08-10T21:33:28Z")
I have two events: test\_start and test\_end When I receive test\_start event, I clone one more event from it test\_attempt and index it in elasticsearch. Then when test\_end event arrives, I extract document id and index … --- ## [Help with an if statement in a drop processor](https://discuss.elastic.co/t/help-with-an-if-statement-in-a-drop-processor/280824)
**Author:** [@jjammin92](https://discuss.elastic.co/u/jjammin92)\ **Replies:** 2\ **Last updated:** [August 10, 2021, 9:25pm UTC](https://discuss.elastic.co/t/help-with-an-if-statement-in-a-drop-processor/280824 "2021-08-10T21:25:16Z")
Hello, I am looking to create a conditional in an elasticsearch drop processor and running into some trouble. This should be rather simple I think, I'm just missing something obvious. I would like to accept all documen… --- ## [Kibana Setup](https://discuss.elastic.co/t/kibana-setup/280955)
**Author:** [@prithvirajsivarajan](https://discuss.elastic.co/u/prithvirajsivarajan)\ **Replies:** 1\ **Last updated:** [August 10, 2021, 8:40pm UTC](https://discuss.elastic.co/t/kibana-setup/280955 "2021-08-10T20:40:47Z")
I'm working on an elasticsearch cluster with two nodes. I have setup SSL on both of them. Now want to install kibana. Is it necessary to install kibana on both nodes? --- ## [Kibana search case sensitive](https://discuss.elastic.co/t/kibana-search-case-sensitive/280536)
**Author:** [@PraveenKT](https://discuss.elastic.co/u/PraveenKT)\ **Replies:** 1\ **Last updated:** [August 10, 2021, 8:39pm UTC](https://discuss.elastic.co/t/kibana-search-case-sensitive/280536 "2021-08-10T20:39:56Z")
Few hostnames are in capital and few other are small. How do I do a case insensitive search in kibana? --- ## [Dashboards: No default time filter](https://discuss.elastic.co/t/dashboards-no-default-time-filter/280958)
**Author:** [@Kyle\_Waid](https://discuss.elastic.co/u/Kyle_Waid)\ **Replies:** 1\ **Last updated:** [August 10, 2021, 8:34pm UTC](https://discuss.elastic.co/t/dashboards-no-default-time-filter/280958 "2021-08-10T20:34:50Z")
Noob here. In Kibana Dashboards, you can create lens visualizations. Each one has customizable filters. We have created a dashboard with several visualizations. We noticed at the top of the dashboard is a search bar. I… --- ## [Metricbeat daemonset modules fails](https://discuss.elastic.co/t/metricbeat-daemonset-modules-fails/280960)
**Author:** [@rp346](https://discuss.elastic.co/u/rp346)\ **Replies:** 0\ **Last updated:** [August 10, 2021, 7:00pm UTC](https://discuss.elastic.co/t/metricbeat-daemonset-modules-fails/280960 "2021-08-10T19:00:55Z")
I have configured following modules for metricbeat daemonset in AWS EKS modulessystem.yml: |- - module: system period: 10s metricsets: - cpu - load - memory - network … --- ## [Unable to create a script field](https://discuss.elastic.co/t/unable-to-create-a-script-field/280512)
**Author:** [@Rammohan](https://discuss.elastic.co/u/Rammohan)\ **Replies:** 1\ **Last updated:** [August 10, 2021, 5:46pm UTC](https://discuss.elastic.co/t/unable-to-create-a-script-field/280512 "2021-08-10T17:46:54Z")
Hello, I am trying to create a simple script field to display the key size of the SSL certificate, the key size value differs between 256 to 270 bytes, so I created the below script field. if (doc\['ssl\_certificate\_subj… --- ## [Warnings on logstash's config execution - "A gauge metric of an unknown type (org.jruby.RubySymbol) has been created for key: status"](https://discuss.elastic.co/t/warnings-on-logstashs-config-execution-a-gauge-metric-of-an-unknown-type-org-jruby-rubysymbol-has-been-created-for-key-status/280954)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 0\ **Last updated:** [August 10, 2021, 5:31pm UTC](https://discuss.elastic.co/t/warnings-on-logstashs-config-execution-a-gauge-metric-of-an-unknown-type-org-jruby-rubysymbol-has-been-created-for-key-status/280954 "2021-08-10T17:31:33Z")
Hello, I see the below warnings on logstash , only when a particular config is used. The warning is as below \[2021-08-10T17:26:22,581\]\[WARN \]\[org.logstash.instrument.metrics.gauge.LazyDelegatingGauge\]\[main\] A gauge m… --- ## [Ingest Pipeline that extracts metadata fields into new field](https://discuss.elastic.co/t/ingest-pipeline-that-extracts-metadata-fields-into-new-field/280950)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 1\ **Last updated:** [August 10, 2021, 5:07pm UTC](https://discuss.elastic.co/t/ingest-pipeline-that-extracts-metadata-fields-into-new-field/280950 "2021-08-10T17:07:53Z")
I'm trying to create an Ingest Pipeline in Elasticsearch 7.4 that will allow me to to take the value of the "\_id" metadata field and copy it into a new field. I've tried using the "set" processor to do this, but I'm unab… --- ## [How to setup two different output (index, pipeline) with Filebeat](https://discuss.elastic.co/t/how-to-setup-two-different-output-index-pipeline-with-filebeat/280951)
**Author:** [@chriselk](https://discuss.elastic.co/u/chriselk)\ **Replies:** 0\ **Last updated:** [August 10, 2021, 5:06pm UTC](https://discuss.elastic.co/t/how-to-setup-two-different-output-index-pipeline-with-filebeat/280951 "2021-08-10T17:06:09Z")
I'm trying to setup with one filebeat instance the apache module and the Tomcat module because we have done customisation in the pipeline and would like to have two separate indices I try the following configuration: o… --- ## [Is there any way to monitor elastic search application?](https://discuss.elastic.co/t/is-there-any-way-to-monitor-elastic-search-application/280652)
**Author:** [@Rajdeep\_Sahoo](https://discuss.elastic.co/u/Rajdeep_Sahoo)\ **Replies:** 5\ **Last updated:** [August 10, 2021, 4:43pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-monitor-elastic-search-application/280652 "2021-08-10T16:43:25Z")
I am trying to monitor elastic search application and I have found the below ways, and none of them is working for me , please suggest if there is any way to monitor. As part of elastic search application monitoring I wa… --- ## [Logstash execute enrich processor](https://discuss.elastic.co/t/logstash-execute-enrich-processor/280949)
**Author:** [@Bigbad](https://discuss.elastic.co/u/Bigbad)\ **Replies:** 0\ **Last updated:** [August 10, 2021, 4:14pm UTC](https://discuss.elastic.co/t/logstash-execute-enrich-processor/280949 "2021-08-10T16:14:25Z")
Hello, I have a logstash pipeline which use ingest pipeline and enrich policy from elasticsearch. But the main problem is to execute \_enrich index everyday. It's possible to figure out kind of scenario? --- ## [Difference between elastic node down and only elasticprocess down](https://discuss.elastic.co/t/difference-between-elastic-node-down-and-only-elasticprocess-down/280913)
**Author:** [@lecko](https://discuss.elastic.co/u/lecko)\ **Replies:** 1\ **Last updated:** [August 10, 2021, 4:06pm UTC](https://discuss.elastic.co/t/difference-between-elastic-node-down-and-only-elasticprocess-down/280913 "2021-08-10T16:06:07Z")
Hello, Short summary: I noticed this difference in elasticsearch behavior in 2 scenarios: If elastic cluster is green and elasticproces goes down on one node , elastic cluster starts process of reallocting in after som… --- ## [Searching by value in field](https://discuss.elastic.co/t/searching-by-value-in-field/280926)
**Author:** [@newbie5](https://discuss.elastic.co/u/newbie5)\ **Replies:** 1\ **Last updated:** [August 10, 2021, 3:42pm UTC](https://discuss.elastic.co/t/searching-by-value-in-field/280926 "2021-08-10T15:42:49Z")
Hi, I have field "message" which includes "error 404" or "error 506" etc. is there any option to search in Kibana by value? In this case by value "error" no matter what's more this field include. I want to create dashb… --- ## [Logstash aggregate not working as expected](https://discuss.elastic.co/t/logstash-aggregate-not-working-as-expected/280943)
**Author:** [@emad101](https://discuss.elastic.co/u/emad101)\ **Replies:** 0\ **Last updated:** [August 10, 2021, 3:31pm UTC](https://discuss.elastic.co/t/logstash-aggregate-not-working-as-expected/280943 "2021-08-10T15:31:58Z")
Hello, I am trying to send an entire txt file line in one single field to elastic. I am trying to do this using logstash aggregate, but it seems that it is no longer working, each line is being sent as a separate field … --- ## [Elasticsearch Shard distribution size differs enormously](https://discuss.elastic.co/t/elasticsearch-shard-distribution-size-differs-enormously/280845)
**Author:** [@sauasmast](https://discuss.elastic.co/u/sauasmast)\ **Replies:** 2\ **Last updated:** [August 10, 2021, 3:09pm UTC](https://discuss.elastic.co/t/elasticsearch-shard-distribution-size-differs-enormously/280845 "2021-08-10T15:09:44Z")
I need to load 1.2 billion documents in the elasticsearch. As of today we have 6 nodes in the cluster. To equally distribute the shards among the 6 nodes I have mentioned the number of shards to be 42. I use spark and it… --- ## [Having problem Parsing Message via ingest pipeline](https://discuss.elastic.co/t/having-problem-parsing-message-via-ingest-pipeline/280827)
**Author:** [@Alaxwora](https://discuss.elastic.co/u/Alaxwora)\ **Replies:** 6\ **Last updated:** [August 10, 2021, 2:51pm UTC](https://discuss.elastic.co/t/having-problem-parsing-message-via-ingest-pipeline/280827 "2021-08-10T14:51:17Z")
Hello, I was trying to parse CSV files of Message Tracking Logs with filebeat and elasticsearch ingest pipeline, so I used Grok Debugger to create a pattern that matches the message and I had no error then I added the l… --- ## [Cannot view ingested data in discover after index-template creation](https://discuss.elastic.co/t/cannot-view-ingested-data-in-discover-after-index-template-creation/280907)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 1\ **Last updated:** [August 10, 2021, 1:52pm UTC](https://discuss.elastic.co/t/cannot-view-ingested-data-in-discover-after-index-template-creation/280907 "2021-08-10T13:52:26Z")
Hello, I had created an index template , so that mappings are added automatically when an index of specific pattern is created. However i can't seem to find the data on discover tab ? Here;s the output section : outpu… --- ## [Kibana weird fail after upgrade to 7.14.0](https://discuss.elastic.co/t/kibana-weird-fail-after-upgrade-to-7-14-0/280686)
**Author:** [@kleckns](https://discuss.elastic.co/u/kleckns)\ **Replies:** 25\ **Last updated:** [August 10, 2021, 1:42pm UTC](https://discuss.elastic.co/t/kibana-weird-fail-after-upgrade-to-7-14-0/280686 "2021-08-10T13:42:16Z")
Today I upgraded my ES stack from 7.9.3 to 7.14.0. ES and filebeats upgraded with no issues. I have kibana installed on one of the master ES nodes. After upgrading kibana I received the output in the UI. Kibana doesn't a… --- ## [Search by runtime fields using wildcards](https://discuss.elastic.co/t/search-by-runtime-fields-using-wildcards/280933)
**Author:** [@Mark\_Hulevsky](https://discuss.elastic.co/u/Mark_Hulevsky)\ **Replies:** 0\ **Last updated:** [August 10, 2021, 1:37pm UTC](https://discuss.elastic.co/t/search-by-runtime-fields-using-wildcards/280933 "2021-08-10T13:37:10Z")
Hi, I'm trying to search by runtime field using wildcards. Here is my mapping. "mappings": { "runtime": { "totalCostRounded": { "type": "keyword", "sc… --- ## [Need help on creating Logstash\_FILTER](https://discuss.elastic.co/t/need-help-on-creating-logstash-filter/277928)
**Author:** [@sumit\_n](https://discuss.elastic.co/u/sumit_n)\ **Replies:** 10\ **Last updated:** [August 10, 2021, 12:52pm UTC](https://discuss.elastic.co/t/need-help-on-creating-logstash-filter/277928 "2021-08-10T12:52:28Z")
log:{​​​​​​​​"time\_stamp":"2021-06-11T04:58:32.22154414Z","labels":{​​​​​​​​"vm\_index":0,"session\_docker\_id":"12d333","tenant\_id":"21a64d4","user\_id":"bob","session\_uuid":"2a30"}​​​​​​​​,"event":{​​​​​​​​"kind":"Metric",… --- ## [Watcher Automated Reporting; Custom Report Window](https://discuss.elastic.co/t/watcher-automated-reporting-custom-report-window/280930)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 0\ **Last updated:** [August 10, 2021, 12:50pm UTC](https://discuss.elastic.co/t/watcher-automated-reporting-custom-report-window/280930 "2021-08-10T12:50:37Z")
Hi All, I'm creating an automated report following Automatically generate reports | Kibana Guide \[7.14\] | Elastic. However, I'm having a bit of trouble coming up with a way to query the data I want for it to generate th… --- ## [ELK Upgrade Error from 7.9.3 to 7.13.4 Using Ansible](https://discuss.elastic.co/t/elk-upgrade-error-from-7-9-3-to-7-13-4-using-ansible/280929)
**Author:** [@BlessingEzeama](https://discuss.elastic.co/u/BlessingEzeama)\ **Replies:** 0\ **Last updated:** [August 10, 2021, 12:50pm UTC](https://discuss.elastic.co/t/elk-upgrade-error-from-7-9-3-to-7-13-4-using-ansible/280929 "2021-08-10T12:50:31Z")
FAILED! =\> {"msg": "The conditional check 'redhat\_elasticsearch\_install\_from\_repo.rc == 0' failed. The error was: error while evaluating conditional (redhat\_elasticsearch\_install\_from\_repo.rc == 0): 'dict object' has no … --- ## [Unable to start logstash service on Ubuntu server](https://discuss.elastic.co/t/unable-to-start-logstash-service-on-ubuntu-server/280883)
**Author:** [@hiruni.insyncit.net](https://discuss.elastic.co/u/hiruni.insyncit.net)\ **Replies:** 1\ **Last updated:** [August 10, 2021, 12:15pm UTC](https://discuss.elastic.co/t/unable-to-start-logstash-service-on-ubuntu-server/280883 "2021-08-10T12:15:23Z")
I'm using Elasticseach and logstash 7.10.1 on ubuntu 18.04 Logstash service was working properly, few days ago. Suddenly it didn't work. I tried to restart logstash service. But unable to start the service. What can … --- ## [Kibana unable to revive connection to Elasticsearch in Kubernetes](https://discuss.elastic.co/t/kibana-unable-to-revive-connection-to-elasticsearch-in-kubernetes/280927)
**Author:** [@rtemotfuorco123](https://discuss.elastic.co/u/rtemotfuorco123)\ **Replies:** 0\ **Last updated:** [August 10, 2021, 12:10pm UTC](https://discuss.elastic.co/t/kibana-unable-to-revive-connection-to-elasticsearch-in-kubernetes/280927 "2021-08-10T12:10:35Z")
Hi, I am getting Unable to revive connection: http://elasticsearch:9200/ in Kibana service logs in Kubernetes. What I don't understand is that, I am explicitly setting the Kibana env vars as listed below (commented out … --- ## [Logstash converts singleton array to string](https://discuss.elastic.co/t/logstash-converts-singleton-array-to-string/280900)
**Author:** [@GitSpree23](https://discuss.elastic.co/u/GitSpree23)\ **Replies:** 1\ **Last updated:** [August 10, 2021, 11:37am UTC](https://discuss.elastic.co/t/logstash-converts-singleton-array-to-string/280900 "2021-08-10T11:37:46Z")
I'm using mutate { add\_field =\> { "new\_field" =\> \["X"\] } } to create an array of integers which can be appended to downstream. But logstash output reads as "new\_field" =\> "X". --- ## [Kibana 7.12.0 add Enrich pipeline](https://discuss.elastic.co/t/kibana-7-12-0-add-enrich-pipeline/280796)
**Author:** [@zhyp](https://discuss.elastic.co/u/zhyp)\ **Replies:** 6\ **Last updated:** [August 10, 2021, 11:32am UTC](https://discuss.elastic.co/t/kibana-7-12-0-add-enrich-pipeline/280796 "2021-08-10T11:32:00Z")
Hi, I want to calculate the value of a field in index A. Its data comes from two other index fields, index B and index C. Calculation formula: index A.count = index B.count - index C.count. Condition: index A… --- ## [org.elasticsearch.bootstrap.StartupException: ElasticsearchException \[Failure running machine learning native code](https://discuss.elastic.co/t/org-elasticsearch-bootstrap-startupexception-elasticsearchexception-failure-running-machine-learning-native-code/280865)
**Author:** [@Logenleedev](https://discuss.elastic.co/u/Logenleedev)\ **Replies:** 3\ **Last updated:** [August 10, 2021, 11:11am UTC](https://discuss.elastic.co/t/org-elasticsearch-bootstrap-startupexception-elasticsearchexception-failure-running-machine-learning-native-code/280865 "2021-08-10T11:11:05Z")
Hi I am new to elastic search. Currently, I am doing a project that requires machine learning functionality in elasticsearch. Here is the error I get: \[2021-08-10T12:09:08,266\]\[ERROR\]\[o.e.b.ElasticsearchUncaughtExceptio… --- ## [Cluster cannot find nodes](https://discuss.elastic.co/t/cluster-cannot-find-nodes/280507)
**Author:** [@smam](https://discuss.elastic.co/u/smam)\ **Replies:** 2\ **Last updated:** [August 10, 2021, 9:56am UTC](https://discuss.elastic.co/t/cluster-cannot-find-nodes/280507 "2021-08-10T09:56:58Z")
Hello! I read a lot of Internet Guides on how to set-up an elasticsearch cluster. Yet I was not successful. I will paste one elasticsearch.yml file, so you can maybe tell me what is wrong with it. # ==================… --- ## [Extended bounds on auto-interval date histogram](https://discuss.elastic.co/t/extended-bounds-on-auto-interval-date-histogram/280904)
**Author:** [@rooch](https://discuss.elastic.co/u/rooch)\ **Replies:** 0\ **Last updated:** [August 10, 2021, 9:41am UTC](https://discuss.elastic.co/t/extended-bounds-on-auto-interval-date-histogram/280904 "2021-08-10T09:41:43Z")
I need to be able to run a query with a set of filters and an auto-interval date histogram aggregation to retrieve a set of bins. I then need to be able to rerun that query but with additional filters, and receive exact… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1286) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1288)