# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1289 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1290 --- ## [Cannot delete winlogbeat indices using curator](https://discuss.elastic.co/t/cannot-delete-winlogbeat-indices-using-curator/280679)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 2\ **Last updated:** [August 9, 2021, 2:48pm UTC](https://discuss.elastic.co/t/cannot-delete-winlogbeat-indices-using-curator/280679 "2021-08-09T14:48:03Z")
Hi there, I´m trying to use curator but something is not right. Can someone try to help me?? Following the config that I have: config.yml client: hosts: - XX.XX.XX.XX port: 9200 url\_prefix: use\_ssl: true … --- ## [Elasticsearch wont start with FIPS Mode Enabled](https://discuss.elastic.co/t/elasticsearch-wont-start-with-fips-mode-enabled/280758)
**Author:** [@Zoheb\_Khan](https://discuss.elastic.co/u/Zoheb_Khan)\ **Replies:** 2\ **Last updated:** [August 9, 2021, 2:44pm UTC](https://discuss.elastic.co/t/elasticsearch-wont-start-with-fips-mode-enabled/280758 "2021-08-09T14:44:37Z")
I am not able to bring-up elasticsearch service in FIPS mode 140-2. I keep getting exception : org.elasticsearch.bootstrap.StartupException: org.elasticsearch.common.ssl.SslConfigException: failed to find a X509Extende… --- ## [Size of an index is very less than the raw document size when ingested via logstash](https://discuss.elastic.co/t/size-of-an-index-is-very-less-than-the-raw-document-size-when-ingested-via-logstash/280812)
**Author:** [@madhanbaskar](https://discuss.elastic.co/u/madhanbaskar)\ **Replies:** 3\ **Last updated:** [August 9, 2021, 2:23pm UTC](https://discuss.elastic.co/t/size-of-an-index-is-very-less-than-the-raw-document-size-when-ingested-via-logstash/280812 "2021-08-09T14:23:23Z")
I have a JSON file which has 93k records in it. The size of the JSON file is 413MB. When Indexed via logstash it is just 88MB in the index. I could see all the records ingested. Index setting : I have 50 fields for ind… --- ## [ElasticSearch/Kibana install on CENT/REHL](https://discuss.elastic.co/t/elasticsearch-kibana-install-on-cent-rehl/280583)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 11\ **Last updated:** [August 9, 2021, 2:03pm UTC](https://discuss.elastic.co/t/elasticsearch-kibana-install-on-cent-rehl/280583 "2021-08-09T14:03:55Z")
Good Afternoon; I have been working with ELK now for 3.5 months and as I am going to be deploying this in RHEL in the near future it was time to move away from the Windows deployment that I have been testing with. So I… --- ## [Yarn start error: Permission denied](https://discuss.elastic.co/t/yarn-start-error-permission-denied/280501)
**Author:** [@wenqi73](https://discuss.elastic.co/u/wenqi73)\ **Replies:** 1\ **Last updated:** [August 9, 2021, 1:12pm UTC](https://discuss.elastic.co/t/yarn-start-error-permission-denied/280501 "2021-08-09T13:12:02Z")
I tried to develop kibana and run the commands in Getting started | Kibana Guide \[7.14\] | Elastic, when I run yarn start --run-examples the terminal threw an error: user/git/kibana/node\_modules/lmdb-store/index.js:77 … --- ## [Gsub doesn't replace the given char](https://discuss.elastic.co/t/gsub-doesnt-replace-the-given-char/280783)
**Author:** [@vaseemQA](https://discuss.elastic.co/u/vaseemQA)\ **Replies:** 1\ **Last updated:** [August 9, 2021, 1:02pm UTC](https://discuss.elastic.co/t/gsub-doesnt-replace-the-given-char/280783 "2021-08-09T13:02:43Z")
Hi Team, I'm trying to replace a char with another char in a string field, but it doesn't looks like it is doing the job, please is there anyone to help me in correcting this. Here is an example of what I'm doing , "s… --- ## [Parsing data in Kibana](https://discuss.elastic.co/t/parsing-data-in-kibana/280791)
**Author:** [@salma\_widiarti](https://discuss.elastic.co/u/salma_widiarti)\ **Replies:** 1\ **Last updated:** [August 9, 2021, 12:33pm UTC](https://discuss.elastic.co/t/parsing-data-in-kibana/280791 "2021-08-09T12:33:55Z")
Hi all, i have data like this, How do i parsing this data? I need data id or data amount to have its own labels. --- ## [Inconsistent completion suggester results size](https://discuss.elastic.co/t/inconsistent-completion-suggester-results-size/280807)
**Author:** [@abido](https://discuss.elastic.co/u/abido)\ **Replies:** 0\ **Last updated:** [August 9, 2021, 12:05pm UTC](https://discuss.elastic.co/t/inconsistent-completion-suggester-results-size/280807 "2021-08-09T12:05:09Z")
Hello, I am getting weird behaviour with the number of results returned by the Completion Suggester. I have the following request body for example: "suggest": { "title": { "prefix": "ja", "completion": { … --- ## [Elastic Agent with Synthetics Integration- Adding TCP monitor break the Agent](https://discuss.elastic.co/t/elastic-agent-with-synthetics-integration-adding-tcp-monitor-break-the-agent/280651)
**Author:** [@nugroho-expereo](https://discuss.elastic.co/u/nugroho-expereo)\ **Replies:** 6\ **Last updated:** [August 9, 2021, 11:31am UTC](https://discuss.elastic.co/t/elastic-agent-with-synthetics-integration-adding-tcp-monitor-break-the-agent/280651 "2021-08-09T11:31:50Z")
Hi All, I have an Elastic Agent Installed with synthetic integration (heartbeat). Adding HTTP and ICMP monitors work fine but when I tried adding a TCP monitor with the correct host:port format the agent become unhealth… --- ## [How to scrape a page with logstash](https://discuss.elastic.co/t/how-to-scrape-a-page-with-logstash/279892)
**Author:** [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\ **Replies:** 3\ **Last updated:** [August 9, 2021, 11:26am UTC](https://discuss.elastic.co/t/how-to-scrape-a-page-with-logstash/279892 "2021-08-09T11:26:11Z")
We have an application that does not save to the database in real time, however it has a page that has some information in real time, I would like to access and scrape this information and put it inside elasticseach. ob… --- ## [Gem/Bundler errors while installing a new logstash filter](https://discuss.elastic.co/t/gem-bundler-errors-while-installing-a-new-logstash-filter/280797)
**Author:** [@lionaneesh](https://discuss.elastic.co/u/lionaneesh)\ **Replies:** 0\ **Last updated:** [August 9, 2021, 11:23am UTC](https://discuss.elastic.co/t/gem-bundler-errors-while-installing-a-new-logstash-filter/280797 "2021-08-09T11:23:01Z")
I am trying to install the logstash-filter-goaudit plugin on my kubernetes pod running logstash image: docker.elastic.co/logstash/logstash-oss:6.4.1 . We are still on ES 6.6 and am currently trying to onboard goaudit log… --- ## [Phrase\_prefix with cross\_fields](https://discuss.elastic.co/t/phrase-prefix-with-cross-fields/280792)
**Author:** [@Razvan\_Todea](https://discuss.elastic.co/u/Razvan_Todea)\ **Replies:** 0\ **Last updated:** [August 9, 2021, 10:48am UTC](https://discuss.elastic.co/t/phrase-prefix-with-cross-fields/280792 "2021-08-09T10:48:02Z")
We want the following use case, if a record is saved in the database with the following fields. { "id": 1, "name": "Benefit", "address": "Supersonic" } Queries such as these should match: ben benefit super ben… --- ## [Filebeat setup command receives timeout form kibana](https://discuss.elastic.co/t/filebeat-setup-command-receives-timeout-form-kibana/280795)
**Author:** [@azxqw](https://discuss.elastic.co/u/azxqw)\ **Replies:** 0\ **Last updated:** [August 9, 2021, 11:04am UTC](https://discuss.elastic.co/t/filebeat-setup-command-receives-timeout-form-kibana/280795 "2021-08-09T11:04:42Z")
Hi, I have filebeat installed, and whenever i try to tun the setup command to load dashboards to kibana(from the f5 module) i recieve a timeout error. Kibana is up and running and reacheable, so I dont really understan… --- ## [Incorrect shard allocation](https://discuss.elastic.co/t/incorrect-shard-allocation/280359)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 3\ **Last updated:** [August 9, 2021, 10:32am UTC](https://discuss.elastic.co/t/incorrect-shard-allocation/280359 "2021-08-09T10:32:19Z")
i have 15nodes cluster with various mix of datasources 8% is larger shards 10-30GB size. 30% is smaller shards 1-15GB. And majority is very small shards megabites 60%. The reason of having small shards is having lot of … --- ## [The ES index does not generate fields parsed by logstash](https://discuss.elastic.co/t/the-es-index-does-not-generate-fields-parsed-by-logstash/280786)
**Author:** [@ktpktr0](https://discuss.elastic.co/u/ktpktr0)\ **Replies:** 0\ **Last updated:** [August 9, 2021, 9:55am UTC](https://discuss.elastic.co/t/the-es-index-does-not-generate-fields-parsed-by-logstash/280786 "2021-08-09T09:55:17Z")
I used logstash to parse the JSON log, but the ES index did not generate the corresponding fields logstash config: filter { if \[service\] == "roomtest" { grok { match =\> { "messag… --- ## [Load balancing data from Filebeat to Logstash using Nginx](https://discuss.elastic.co/t/load-balancing-data-from-filebeat-to-logstash-using-nginx/179473)
**Author:** [@Nikhil04](https://discuss.elastic.co/u/Nikhil04)\ **Replies:** 8\ **Last updated:** [August 9, 2021, 9:35am UTC](https://discuss.elastic.co/t/load-balancing-data-from-filebeat-to-logstash-using-nginx/179473 "2021-08-09T09:35:16Z")
Hello, I have ELK cluster with 3 nodes for elasticsearch(master+data) , 2 nodes for logstash(Active and Passive) and 2 for kibana.I have to utilize both the logstash nodes. I am using filebeat to parse logs and send da… --- ## [Cannot update field mapping with custom normalizer](https://discuss.elastic.co/t/cannot-update-field-mapping-with-custom-normalizer/280782)
**Author:** [@Rammi22](https://discuss.elastic.co/u/Rammi22)\ **Replies:** 0\ **Last updated:** [August 9, 2021, 9:14am UTC](https://discuss.elastic.co/t/cannot-update-field-mapping-with-custom-normalizer/280782 "2021-08-09T09:14:25Z")
Trying to extends a field mapper returns exception... The field: ... "detail.data.myfield": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore\_above": 256 … --- ## [Make Elasticsearch running as a service?](https://discuss.elastic.co/t/make-elasticsearch-running-as-a-service/280510)
**Author:** [@Veak](https://discuss.elastic.co/u/Veak)\ **Replies:** 2\ **Last updated:** [August 9, 2021, 9:11am UTC](https://discuss.elastic.co/t/make-elasticsearch-running-as-a-service/280510 "2021-08-09T09:11:16Z")
Hello, i've installed the elasticsearch 7.x on a raspberry PI 4B on ubuntu 20.04. I've installed it manually with the .tgz. It's working fine when i launch it manually with the command : ./elasticsearch -d (in the di… --- ## [The number of indexes is increasing day by day, and the kibana dashboard shows that indexes are getting slower and slower](https://discuss.elastic.co/t/the-number-of-indexes-is-increasing-day-by-day-and-the-kibana-dashboard-shows-that-indexes-are-getting-slower-and-slower/280618)
**Author:** [@yt\_h](https://discuss.elastic.co/u/yt_h)\ **Replies:** 3\ **Last updated:** [August 9, 2021, 8:49am UTC](https://discuss.elastic.co/t/the-number-of-indexes-is-increasing-day-by-day-and-the-kibana-dashboard-shows-that-indexes-are-getting-slower-and-slower/280618 "2021-08-09T08:49:53Z")
elastic search version：7.5.1 kibana：7.5.1 3 master roles, 3 data roles, 6 nodes in total. It takes a few minutes to query the index, this is the fragmentation state. GET \_cluster/health { "cluster\_name": "elastics… --- ## [Get the raw log which can't index to elastic search](https://discuss.elastic.co/t/get-the-raw-log-which-cant-index-to-elastic-search/280693)
**Author:** [@jamecollins](https://discuss.elastic.co/u/jamecollins)\ **Replies:** 1\ **Last updated:** [August 9, 2021, 8:40am UTC](https://discuss.elastic.co/t/get-the-raw-log-which-cant-index-to-elastic-search/280693 "2021-08-09T08:40:21Z")
I have error on logstash: \[2021-08-07T00:24:08,330\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>nil, :\_index=\>"logstash-2021.08.07", :\_type=\>"… --- ## [Painless: Any easy way to define dates like now-1d, now-2d](https://discuss.elastic.co/t/painless-any-easy-way-to-define-dates-like-now-1d-now-2d/280773)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 0\ **Last updated:** [August 9, 2021, 8:21am UTC](https://discuss.elastic.co/t/painless-any-easy-way-to-define-dates-like-now-1d-now-2d/280773 "2021-08-09T08:21:56Z")
We have a painless script to compare a logic before a date. Currently the user have to enter epoch value into the params, but was checking if you guys already have a script or logic, so we can use the "range" notations i… --- ## [Elastic agent in a docker container TLS error](https://discuss.elastic.co/t/elastic-agent-in-a-docker-container-tls-error/280534)
**Author:** [@NatSav](https://discuss.elastic.co/u/NatSav)\ **Replies:** 2\ **Last updated:** [August 9, 2021, 8:19am UTC](https://discuss.elastic.co/t/elastic-agent-in-a-docker-container-tls-error/280534 "2021-08-09T08:19:20Z")
Good afternoon, I am trying to make a docker container with elastic-agent, packetbeat and metricbeat. I am going to add other components later however I want to get these working first. When I try to install elastic-agen… --- ## [Setup logstash module netflow](https://discuss.elastic.co/t/setup-logstash-module-netflow/279528)
**Author:** [@Muhammed\_Ibrahim](https://discuss.elastic.co/u/Muhammed_Ibrahim)\ **Replies:** 1\ **Last updated:** [August 9, 2021, 8:16am UTC](https://discuss.elastic.co/t/setup-logstash-module-netflow/279528 "2021-08-09T08:16:46Z")
Dears, I need to install netflow dashboard as it's shown in elastic guide by this command : sudo bin/logstash --modules netflow --setup --path.settings /etc/logstash/ but appears this error below : Using bundled JDK… --- ## [Synchronize whole files (mostly PDFs) to ES from directory and e-mails](https://discuss.elastic.co/t/synchronize-whole-files-mostly-pdfs-to-es-from-directory-and-e-mails/279962)
**Author:** [@jporzelt](https://discuss.elastic.co/u/jporzelt)\ **Replies:** 3\ **Last updated:** [August 9, 2021, 8:08am UTC](https://discuss.elastic.co/t/synchronize-whole-files-mostly-pdfs-to-es-from-directory-and-e-mails/279962 "2021-08-09T08:08:54Z")
Hi all, we would like to setup a document synchronization from a file directory and from a e-mail imap folder to elasticsearch. For the e-mails we are interested in the attachments. Here the imap input plugin looks pro… --- ## [Logstash stopped to treat the incoming logs](https://discuss.elastic.co/t/logstash-stopped-to-treat-the-incoming-logs/280402)
**Author:** [@tarekilani](https://discuss.elastic.co/u/tarekilani)\ **Replies:** 1\ **Last updated:** [August 9, 2021, 7:59am UTC](https://discuss.elastic.co/t/logstash-stopped-to-treat-the-incoming-logs/280402 "2021-08-09T07:59:15Z")
Hello, I'm using ELK stack to correlate logs of network devices. The stack was perfectly working for a long period of time. But today logstash stopped treating the incoming logs. When i did an investigation i found thi… --- ## [Watcher action index](https://discuss.elastic.co/t/watcher-action-index/280078)
**Author:** [@bilel\_meddeb](https://discuss.elastic.co/u/bilel_meddeb)\ **Replies:** 3\ **Last updated:** [August 9, 2021, 7:54am UTC](https://discuss.elastic.co/t/watcher-action-index/280078 "2021-08-09T07:54:34Z")
hello i create a watcher with this action i want to store the result in index --- ## [How can I ...Compare two indices fields if data matches then create new index and store the matched data into it](https://discuss.elastic.co/t/how-can-i-compare-two-indices-fields-if-data-matches-then-create-new-index-and-store-the-matched-data-into-it/280130)
**Author:** [@sneha\_gupta](https://discuss.elastic.co/u/sneha_gupta)\ **Replies:** 2\ **Last updated:** [August 9, 2021, 7:52am UTC](https://discuss.elastic.co/t/how-can-i-compare-two-indices-fields-if-data-matches-then-create-new-index-and-store-the-matched-data-into-it/280130 "2021-08-09T07:52:52Z")
Was thinking if I can use sub queries either "union" but left with nothing as above is not supported --- ## [Logstash geoip databasemanager with outgoing proxy](https://discuss.elastic.co/t/logstash-geoip-databasemanager-with-outgoing-proxy/280751)
**Author:** [@cknz](https://discuss.elastic.co/u/cknz)\ **Replies:** 2\ **Last updated:** [August 9, 2021, 7:47am UTC](https://discuss.elastic.co/t/logstash-geoip-databasemanager-with-outgoing-proxy/280751 "2021-08-09T07:47:32Z")
Hi all, I've upgraded to Logstash 7.14 from 7.11, and now I'm having to deal with the geoip databasemanager. My servers do not have direct database access and need to go out via proxy. Current observed behaviour is that… --- ## [How logstash uses add\_field to add a JSON array](https://discuss.elastic.co/t/how-logstash-uses-add-field-to-add-a-json-array/280640)
**Author:** [@ktpktr0](https://discuss.elastic.co/u/ktpktr0)\ **Replies:** 2\ **Last updated:** [August 9, 2021, 7:27am UTC](https://discuss.elastic.co/t/how-logstash-uses-add-field-to-add-a-json-array/280640 "2021-08-09T07:27:11Z")
The raw data are as follows "money快照" =\> \[ \[0\] "money:14683689,value:15105589,time:2021-07-27 23:50:54", \[1\] "money:14683689,value:15105589,time:2021-07-27 23:50:56" \], The confi… --- ## [Script field .. shards failed](https://discuss.elastic.co/t/script-field-shards-failed/280290)
**Author:** [@djikon](https://discuss.elastic.co/u/djikon)\ **Replies:** 6\ **Last updated:** [August 9, 2021, 7:26am UTC](https://discuss.elastic.co/t/script-field-shards-failed/280290 "2021-08-09T07:26:24Z")
Hi, I create a script field and i have a lot of shards failed. my script field is just : doc\['evenement.@timestamp'\].value.getMillis() - doc\['debutSejour'\].value.getMillis() shards failed exist too fort : if(doc\['ev… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1288) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1290)