# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1320 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1321 --- ## [Convert Long to Strings](https://discuss.elastic.co/t/convert-long-to-strings/278831)
**Author:** [@valleram](https://discuss.elastic.co/u/valleram)\ **Replies:** 1\ **Last updated:** [July 15, 2021, 10:28pm UTC](https://discuss.elastic.co/t/convert-long-to-strings/278831 "2021-07-15T22:28:03Z")
Hi There, I have a field of type Long (i.e 4,277,534,720 ) which is a representation of memory heap usage in bytes, of one application. I've created a visualization using this field, but I need to convert that field in… --- ## [Lumberjack with Filebeat pipelines not working](https://discuss.elastic.co/t/lumberjack-with-filebeat-pipelines-not-working/278304)
**Author:** [@PraveenKT](https://discuss.elastic.co/u/PraveenKT)\ **Replies:** 9\ **Last updated:** [July 15, 2021, 10:27pm UTC](https://discuss.elastic.co/t/lumberjack-with-filebeat-pipelines-not-working/278304 "2021-07-15T22:27:26Z")
I am testing a setup which is Filebeat --\> Logstash(1) --\> logstash(2) --\> Elasticsearch with custom indices. In logstash-2 i am using below config file (simplified). For logstash to logstash communication i am using Lu… --- ## [Delete document from index based on log type](https://discuss.elastic.co/t/delete-document-from-index-based-on-log-type/278832)
**Author:** [@srk1](https://discuss.elastic.co/u/srk1)\ **Replies:** 2\ **Last updated:** [July 15, 2021, 9:06pm UTC](https://discuss.elastic.co/t/delete-document-from-index-based-on-log-type/278832 "2021-07-15T21:06:32Z")
Hello ES users, I am trying to explore an option to delete certain type of logs from ES index without deleting the whole index. For example, DEBUG type logs doesn't need to be retained for longer period compared to IN… --- ## [Action \[indices:admin/auto\_create\] is unauthorized for API key id \[-#########\] of user \[elastic/fleet-server\] on indices \[metricbeat-#######\]](https://discuss.elastic.co/t/action-indices-admin-auto-create-is-unauthorized-for-api-key-id-of-user-elastic-fleet-server-on-indices-metricbeat/278825)
**Author:** [@tcaudill](https://discuss.elastic.co/u/tcaudill)\ **Replies:** 2\ **Last updated:** [July 15, 2021, 8:08pm UTC](https://discuss.elastic.co/t/action-indices-admin-auto-create-is-unauthorized-for-api-key-id-of-user-elastic-fleet-server-on-indices-metricbeat/278825 "2021-07-15T20:08:01Z")
I'm seeing errors like this one in the logs of some of my fleet managed elastic-agents. After doing some testing, it looks like I'm not getting all of the log data that I should be getting. For example, on my Windows D… --- ## [Testing Match query to fail, but returns docs, although they do not match](https://discuss.elastic.co/t/testing-match-query-to-fail-but-returns-docs-although-they-do-not-match/278780)
**Author:** [@tesh](https://discuss.elastic.co/u/tesh)\ **Replies:** 3\ **Last updated:** [July 15, 2021, 7:36pm UTC](https://discuss.elastic.co/t/testing-match-query-to-fail-but-returns-docs-although-they-do-not-match/278780 "2021-07-15T19:36:30Z")
Hi Team, first post here and hope you guys can help me stop going round and round! :wink: It's java code using elastic libs/methods I'm trying to look for a string in a field - eg, ":21:test123blah" and expecting it to… --- ## [Is it possible to detect a specific file that enters inside a folder by type with logstash?](https://discuss.elastic.co/t/is-it-possible-to-detect-a-specific-file-that-enters-inside-a-folder-by-type-with-logstash/278829)
**Author:** [@raylight](https://discuss.elastic.co/u/raylight)\ **Replies:** 1\ **Last updated:** [July 15, 2021, 7:09pm UTC](https://discuss.elastic.co/t/is-it-possible-to-detect-a-specific-file-that-enters-inside-a-folder-by-type-with-logstash/278829 "2021-07-15T19:09:53Z")
I know I can watch files entering in a folder with logstash using the following syntax: input { file { type =\> "mytype" path =\> "/home/user/watchedFolder" start\_position =\> "beginning" … --- ## [Unable to view elastic-agent logs in Fleet](https://discuss.elastic.co/t/unable-to-view-elastic-agent-logs-in-fleet/278117)
**Author:** [@tcaudill](https://discuss.elastic.co/u/tcaudill)\ **Replies:** 5\ **Last updated:** [July 15, 2021, 6:44pm UTC](https://discuss.elastic.co/t/unable-to-view-elastic-agent-logs-in-fleet/278117 "2021-07-15T18:44:21Z")
I have successfully configured Fleet and have deployed a few elastic-agents in my infrastructure. When I go to Management - Fleet - Agents, select an agent, and then select logs, nothing shows. However, if I go to Kiba… --- ## [Kibana dashboards disapper after elastic restart and new cert creation](https://discuss.elastic.co/t/kibana-dashboards-disapper-after-elastic-restart-and-new-cert-creation/278644)
**Author:** [@Bhavani\_Ananth](https://discuss.elastic.co/u/Bhavani_Ananth)\ **Replies:** 3\ **Last updated:** [July 15, 2021, 6:01pm UTC](https://discuss.elastic.co/t/kibana-dashboards-disapper-after-elastic-restart-and-new-cert-creation/278644 "2021-07-15T18:01:30Z")
Hello Team, We are using elasticsearch 7.11.2 and Kibana version 7.11.2 Our older self signed certificate expired today. (after 90d) We created again following steps given in - Set up basic security for the Elastic S… --- ## [Data node with high os cpu usage but low process cpu usage in aws kubernetes](https://discuss.elastic.co/t/data-node-with-high-os-cpu-usage-but-low-process-cpu-usage-in-aws-kubernetes/278733)
**Author:** [@junhuangli](https://discuss.elastic.co/u/junhuangli)\ **Replies:** 6\ **Last updated:** [July 15, 2021, 5:52pm UTC](https://discuss.elastic.co/t/data-node-with-high-os-cpu-usage-but-low-process-cpu-usage-in-aws-kubernetes/278733 "2021-07-15T17:52:48Z")
We are hosting elasticsearch cluster on the aws kubernetes. The cluster has 5 master nodes, 37 data nodes and 10 coordinate nodes. We request/limit \[memory: 64G\]\[cpu: 25\]for the kubernete container and give 30G memory t… --- ## [Yarn es snapshot command fails](https://discuss.elastic.co/t/yarn-es-snapshot-command-fails/278819)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 2\ **Last updated:** [July 15, 2021, 5:30pm UTC](https://discuss.elastic.co/t/yarn-es-snapshot-command-fails/278819 "2021-07-15T17:30:40Z")
Hello all, I have been struggling with setting up dev environment from a long time. Right now, I am behind corporate proxy. I have set up proxy settings for Yarn, NPM and Git but when I run yarn es snapshot, it gives me… --- ## [Date/time automatically +7 hours](https://discuss.elastic.co/t/date-time-automatically-7-hours/278635)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 3\ **Last updated:** [July 15, 2021, 3:32pm UTC](https://discuss.elastic.co/t/date-time-automatically-7-hours/278635 "2021-07-15T15:32:19Z")
hi everyone, why does my log date when I upload it to machine learning automatically add 7 hours. for example in the original log: field: logontime: 14.57 after i upload to machine and import from there it becomes, f… --- ## [Kibana cannot perform migrations due to validation error](https://discuss.elastic.co/t/kibana-cannot-perform-migrations-due-to-validation-error/278678)
**Author:** [@dbernard](https://discuss.elastic.co/u/dbernard)\ **Replies:** 4\ **Last updated:** [July 15, 2021, 3:13pm UTC](https://discuss.elastic.co/t/kibana-cannot-perform-migrations-due-to-validation-error/278678 "2021-07-15T15:13:26Z")
Kibana is unable to perform migrations and then reports it cannot connect to elastic search. elasticsearch is running locally. Upgrading to 7.11.2 elasticsearch and kibana. "type":"log","@timestamp":"2021-07-14T14:02:… --- ## [Kibana not starting](https://discuss.elastic.co/t/kibana-not-starting/278516)
**Author:** [@123451](https://discuss.elastic.co/u/123451)\ **Replies:** 4\ **Last updated:** [July 15, 2021, 3:02pm UTC](https://discuss.elastic.co/t/kibana-not-starting/278516 "2021-07-15T15:02:05Z")
Good morning all, My kibana is not starting, when I run the command systemctl status kibana. this is what I get. I don't know what seems to be the issue --- ## [JDBC Timestamp doesn't refresh, leads to large queues](https://discuss.elastic.co/t/jdbc-timestamp-doesnt-refresh-leads-to-large-queues/278393)
**Author:** [@chris\_ts24](https://discuss.elastic.co/u/chris_ts24)\ **Replies:** 5\ **Last updated:** [July 15, 2021, 3:00pm UTC](https://discuss.elastic.co/t/jdbc-timestamp-doesnt-refresh-leads-to-large-queues/278393 "2021-07-15T15:00:11Z")
Hi all, I am using the jdbc plugin with LS 7.13.2 to retrieve records from an Oracle DB. When users make changes to their info, I record the timestamp of the change in the dateChanged column of the DB. Through the jdbc … --- ## [ELasticsearch 7.9.1 won't start](https://discuss.elastic.co/t/elasticsearch-7-9-1-wont-start/278808)
**Author:** [@Barry\_Dupont](https://discuss.elastic.co/u/Barry_Dupont)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 2:39pm UTC](https://discuss.elastic.co/t/elasticsearch-7-9-1-wont-start/278808 "2021-07-15T14:39:29Z")
My problem is that ELasticsearch won't start, so i checked log /var/log/elasticsearch/elasticsearch.log and I Got an error concerning 'Lucene\_87 missing' Caused by: java.lang.IllegalArgumentException: An SPI class of … --- ## [How to create a watcher alert if a specific service goes down on a system which is monitored using metricbeat agent?](https://discuss.elastic.co/t/how-to-create-a-watcher-alert-if-a-specific-service-goes-down-on-a-system-which-is-monitored-using-metricbeat-agent/278464)
**Author:** [@Patr123](https://discuss.elastic.co/u/Patr123)\ **Replies:** 4\ **Last updated:** [July 15, 2021, 2:34pm UTC](https://discuss.elastic.co/t/how-to-create-a-watcher-alert-if-a-specific-service-goes-down-on-a-system-which-is-monitored-using-metricbeat-agent/278464 "2021-07-15T14:34:31Z")
I have few systems on which I have metricbeat v7.12.1 installed. How can I configure the watcher alert to send me an email if the service called testservice.exe goes down on server A? --- ## [Kibana Dashboard align all visualiazations to left](https://discuss.elastic.co/t/kibana-dashboard-align-all-visualiazations-to-left/278659)
**Author:** [@sandy13sharma2006](https://discuss.elastic.co/u/sandy13sharma2006)\ **Replies:** 3\ **Last updated:** [July 15, 2021, 2:34pm UTC](https://discuss.elastic.co/t/kibana-dashboard-align-all-visualiazations-to-left/278659 "2021-07-15T14:34:05Z")
Hi Team, I'm using Elasticsearch 7.11.2 and Kibana 7.11.2 docker image when I trying to access the Dashboard, all visualizations are getting align to left side as per image. All respective visualizations and index-patte… --- ## [Change distribution version number](https://discuss.elastic.co/t/change-distribution-version-number/278719)
**Author:** [@prandelicious](https://discuss.elastic.co/u/prandelicious)\ **Replies:** 2\ **Last updated:** [July 15, 2021, 2:32pm UTC](https://discuss.elastic.co/t/change-distribution-version-number/278719 "2021-07-15T14:32:44Z")
Every time I run make release, it always creates beats-8.0.0-platform.tar.gz. Is there a way to change the version number? --- ## [Aggregate combinations of nested documents](https://discuss.elastic.co/t/aggregate-combinations-of-nested-documents/278796)
**Author:** [@Andy\_Gout](https://discuss.elastic.co/u/Andy_Gout)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 1:52pm UTC](https://discuss.elastic.co/t/aggregate-combinations-of-nested-documents/278796 "2021-07-15T13:52:49Z")
Using Elasticsearch, I would like to aggregate combinations of nested documents. Take a hypothetical index of movie data with these mappings: { mappings: { properties: { title: { type: 'keyword' }, peop… --- ## [Same level script aggregation](https://discuss.elastic.co/t/same-level-script-aggregation/278631)
**Author:** [@Ivan\_Janev](https://discuss.elastic.co/u/Ivan_Janev)\ **Replies:** 2\ **Last updated:** [July 15, 2021, 1:16pm UTC](https://discuss.elastic.co/t/same-level-script-aggregation/278631 "2021-07-15T13:16:15Z")
I'm wondering if it is possible to do a same level script aggregation in ES. Let's say I have 2 fields in my documents sales and spend. This is the result I want to achieve: { "size": 0, "query": { "match\_all": … --- ## [Error on parsing gzip files "Unexpected end of ZLIB input stream"](https://discuss.elastic.co/t/error-on-parsing-gzip-files-unexpected-end-of-zlib-input-stream/278789)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 1:09pm UTC](https://discuss.elastic.co/t/error-on-parsing-gzip-files-unexpected-end-of-zlib-input-stream/278789 "2021-07-15T13:09:31Z")
I have a gzip file about ~600MB that seems to be running into a plugin error mentioned below . \[2021-07-15T13:00:29,121\]\[ERROR\]\[logstash.javapipeline \]\[main\]\[4ea2794871220248b7ea22dd607e71d79bddbc1bff243a66da02aa3b… --- ## [Issues in performance](https://discuss.elastic.co/t/issues-in-performance/278788)
**Author:** [@Arthi\_Jaiswal](https://discuss.elastic.co/u/Arthi_Jaiswal)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 1:07pm UTC](https://discuss.elastic.co/t/issues-in-performance/278788 "2021-07-15T13:07:18Z")
I have a case where I am ingesting over 5 MN log lines / minute into logstash hosted on an Azure . The performance is really sluggish Any recommendations on how I can improve the performance --- ## [Data redundancy with a single nested level vs multilevel nested document](https://discuss.elastic.co/t/data-redundancy-with-a-single-nested-level-vs-multilevel-nested-document/278471)
**Author:** [@sai\_Yeluri](https://discuss.elastic.co/u/sai_Yeluri)\ **Replies:** 5\ **Last updated:** [July 15, 2021, 1:04pm UTC](https://discuss.elastic.co/t/data-redundancy-with-a-single-nested-level-vs-multilevel-nested-document/278471 "2021-07-15T13:04:10Z")
Is it better to have a data redundancy with single nested object or maintain multilevel nested document? There are performance concerns when nested types are used, as per elasticsearch documentation Nested field type | … --- ## [Kibana service start failed](https://discuss.elastic.co/t/kibana-service-start-failed/278566)
**Author:** [@swarali\_vartak](https://discuss.elastic.co/u/swarali_vartak)\ **Replies:** 2\ **Last updated:** [July 15, 2021, 12:55pm UTC](https://discuss.elastic.co/t/kibana-service-start-failed/278566 "2021-07-15T12:55:32Z")
Hi Team, I have standalone server where I downloaded elastic and kibana 7.12.1 in RPM on cent os server After downloading i have install elastic and kibana from below command rpm -i elasticseach-7.12.1-x86\_64.rpm Aft… --- ## [Kafka output dropping single message every time connection to kafka is lost](https://discuss.elastic.co/t/kafka-output-dropping-single-message-every-time-connection-to-kafka-is-lost/278632)
**Author:** [@tporeba](https://discuss.elastic.co/u/tporeba)\ **Replies:** 2\ **Last updated:** [July 15, 2021, 12:43pm UTC](https://discuss.elastic.co/t/kafka-output-dropping-single-message-every-time-connection-to-kafka-is-lost/278632 "2021-07-15T12:43:18Z")
I tested the behaviour of filebeat kafka output when connection to kafka is lost and recovered. Events are correctly redelivered even if the connection is down for a few minutes, but I observe a single event (probably fi… --- ## [Running ELK Services as Root](https://discuss.elastic.co/t/running-elk-services-as-root/278673)
**Author:** [@6igwig](https://discuss.elastic.co/u/6igwig)\ **Replies:** 1\ **Last updated:** [July 15, 2021, 12:38pm UTC](https://discuss.elastic.co/t/running-elk-services-as-root/278673 "2021-07-15T12:38:14Z")
I am utilizing the full ELK stack in Linux including beats and logstash. I have found a few posts online that recommend not running these services as root such as this discussion post. I tried to find some more informat… --- ## [How to calculate read/write throughput at cluster level?](https://discuss.elastic.co/t/how-to-calculate-read-write-throughput-at-cluster-level/278775)
**Author:** [@Bhagwati\_Malav](https://discuss.elastic.co/u/Bhagwati_Malav)\ **Replies:** 2\ **Last updated:** [July 15, 2021, 12:35pm UTC](https://discuss.elastic.co/t/how-to-calculate-read-write-throughput-at-cluster-level/278775 "2021-07-15T12:35:44Z")
I am working on designing es cluster with below given setup master nodes 3 (m5.a large) 2vcpu, 8gb data nodes 2 (m5.ax large) 4vcpu, 16 gb Keeping default elastic configuration currently. read thread pool - 7 write … --- ## [Indices in delete phase are actually not being deleted](https://discuss.elastic.co/t/indices-in-delete-phase-are-actually-not-being-deleted/278764)
**Author:** [@jfs1](https://discuss.elastic.co/u/jfs1)\ **Replies:** 1\ **Last updated:** [July 15, 2021, 12:22pm UTC](https://discuss.elastic.co/t/indices-in-delete-phase-are-actually-not-being-deleted/278764 "2021-07-15T12:22:34Z")
Actually, a duplicate subject, but this one is no longer an issue related to the kibana bug. I just upgrade my cluster to 7.13 and the issue remains. My indices are not deleted in the "delete" phase of ilm. The ILM sett… --- ## [Kibana throws error in chrome version 91.0.4472.124](https://discuss.elastic.co/t/kibana-throws-error-in-chrome-version-91-0-4472-124/278760)
**Author:** [@Bhavani\_Ananth](https://discuss.elastic.co/u/Bhavani_Ananth)\ **Replies:** 1\ **Last updated:** [July 15, 2021, 12:07pm UTC](https://discuss.elastic.co/t/kibana-throws-error-in-chrome-version-91-0-4472-124/278760 "2021-07-15T12:07:48Z")
I am unable to load kibana 7.8.1 in Google Chrome Version 91.0.4472.124 (Official Build) (64-bit) Build: 32141 It takes the pages ages to load and when it does, the following error is displayed. This works fine in Mic… --- ## [Convert String to Date](https://discuss.elastic.co/t/convert-string-to-date/278782)
**Author:** [@Meryem\_BS](https://discuss.elastic.co/u/Meryem_BS)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 12:01pm UTC](https://discuss.elastic.co/t/convert-string-to-date/278782 "2021-07-15T12:01:33Z")
Hello, In the logs I upload to Kibana have a "mytimestamp" field, supposedly of type Date but when I inject the logs and parsed it in json, my timestamp is converted to type string. Do you know how can I convert my tim… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1319) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1321)