# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1328 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1329 --- ## [Starting Elasticsearch fails](https://discuss.elastic.co/t/starting-elasticsearch-fails/278318)
**Author:** [@maof97](https://discuss.elastic.co/u/maof97)\ **Replies:** 2\ **Last updated:** [July 10, 2021, 8:42am UTC](https://discuss.elastic.co/t/starting-elasticsearch-fails/278318 "2021-07-10T08:42:05Z")
Hi, I had an outage at my Server (self-hosted) and now every time I want to start ES this error appears: Jul 10 08:15:44 pelk logstash\[720\]: \[2021-07-10T08:15:44,162\]\[WARN \]\[logstash.outputs.elasticsearch\]\[pfelk\] Attemp… --- ## [Cannot compute used swap when total swap is 0 and free swap is 0](https://discuss.elastic.co/t/cannot-compute-used-swap-when-total-swap-is-0-and-free-swap-is-0/277128)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 2\ **Last updated:** [June 28, 2021, 12:35am UTC](https://discuss.elastic.co/t/cannot-compute-used-swap-when-total-swap-is-0-and-free-swap-is-0/277128 "2021-06-28T00:35:12Z")
Hello World! My logs are getting flooded with following message: cannot compute used swap when total swap is 0 and free swap is 0 I assume it's safe to ignore since it's not recommended to have swap enabled anyways,… --- ## [Heartbeat: Locking-Down Heartbeat and Beats when "HTTP Endpoint" is Enabled on the Beats?](https://discuss.elastic.co/t/heartbeat-locking-down-heartbeat-and-beats-when-http-endpoint-is-enabled-on-the-beats/278292)
**Author:** [@Log\_Gobbler](https://discuss.elastic.co/u/Log_Gobbler)\ **Replies:** 0\ **Last updated:** [July 9, 2021, 4:29pm UTC](https://discuss.elastic.co/t/heartbeat-locking-down-heartbeat-and-beats-when-http-endpoint-is-enabled-on-the-beats/278292 "2021-07-09T16:29:59Z")
I have a test Heartbeat and test Filebeat (with "HTTP Endpoint" enabled) set-up and working (via Uptime) but they do not have security features enabled/configured between them. I've stored the credentials in the Heartbe… --- ## [Extracting @timestamp from Source within Hits](https://discuss.elastic.co/t/extracting-timestamp-from-source-within-hits/278306)
**Author:** [@NoviceESCoder](https://discuss.elastic.co/u/NoviceESCoder)\ **Replies:** 0\ **Last updated:** [July 9, 2021, 8:22pm UTC](https://discuss.elastic.co/t/extracting-timestamp-from-source-within-hits/278306 "2021-07-09T20:22:56Z")
I am trying to extract @timestamp from .Source but whenever I type a dot after the word Source I do not get any options that Source can contain where I can grab @timestamp. Is there a specific way I can grab @timestamp f… --- ## [Add\_process\_metadata cannot parse pid in integer](https://discuss.elastic.co/t/add-process-metadata-cannot-parse-pid-in-integer/263380)
**Author:** [@Yin\_Zhang](https://discuss.elastic.co/u/Yin_Zhang)\ **Replies:** 3\ **Last updated:** [July 9, 2021, 8:40pm UTC](https://discuss.elastic.co/t/add-process-metadata-cannot-parse-pid-in-integer/263380 "2021-07-09T20:40:03Z")
Hi all, I got some weird error when using add\_process\_metadata in filebeat 7.10.2. It doesn't seem to like integer value. Given following json input: { "level": "info", "pid": 1, "message": "test1", "tags": \["tag1", "… --- ## [Custom scoring based on number of matches](https://discuss.elastic.co/t/custom-scoring-based-on-number-of-matches/278305)
**Author:** [@Viktor\_Krasynskyy](https://discuss.elastic.co/u/Viktor_Krasynskyy)\ **Replies:** 0\ **Last updated:** [July 9, 2021, 7:15pm UTC](https://discuss.elastic.co/t/custom-scoring-based-on-number-of-matches/278305 "2021-07-09T19:15:49Z")
My question is somewhat similar to an old feature request Add match count scoring option · Issue #13806 · elastic/elasticsearch · GitHub but some options suggested there are already deprecated. I'm trying to create a cu… --- ## [Winlogbeat winlog.event\_data.AccessList process](https://discuss.elastic.co/t/winlogbeat-winlog-event-data-accesslist-process/278303)
**Author:** [@MarceloSamoilenko](https://discuss.elastic.co/u/MarceloSamoilenko)\ **Replies:** 0\ **Last updated:** [July 9, 2021, 6:49pm UTC](https://discuss.elastic.co/t/winlogbeat-winlog-event-data-accesslist-process/278303 "2021-07-09T18:49:08Z")
Hello everyone, I want to have control of log events using Winlogbeat with parsing event with id 4663, winlog.event\_data.AccessMask's and winlog.event\_data.AccessList's winlog.event\_data.AccessMask: "0x10000" winlog.e… --- ## [Removing item from array based on string value from another field](https://discuss.elastic.co/t/removing-item-from-array-based-on-string-value-from-another-field/278279)
**Author:** [@mad\_dog](https://discuss.elastic.co/u/mad_dog)\ **Replies:** 6\ **Last updated:** [July 9, 2021, 6:27pm UTC](https://discuss.elastic.co/t/removing-item-from-array-based-on-string-value-from-another-field/278279 "2021-07-09T18:27:00Z")
I have a ruby filter that puts all mac addresses (access points and stations macs) in a log to mac\_addresses field and this works fine. I also have another grok filter which puts only station mac addresses to station\_ma… --- ## [Elasticsearch访问权限xpack](https://discuss.elastic.co/t/elasticsearch-xpack/276736)
**Author:** [@peng-elasticsearch](https://discuss.elastic.co/u/peng-elasticsearch)\ **Replies:** 5\ **Last updated:** [July 9, 2021, 5:30pm UTC](https://discuss.elastic.co/t/elasticsearch-xpack/276736 "2021-07-09T17:30:25Z")
elasticsearch6.3.1版本申请免费基础版license证书，上传导入证书报错问题； 上传导入命令： curl -XPOST -u elastic:123456 http://127.0.0.1:9200/\_xpack/license/start\_basic?acknowledge=true -H "Content-Type: application/json" -d @license.json 执行结果返回：{"ac… --- ## [Create KV-pairs for field not in key:value format and use ruby filter on KV pairs](https://discuss.elastic.co/t/create-kv-pairs-for-field-not-in-key-value-format-and-use-ruby-filter-on-kv-pairs/278220)
**Author:** [@parinitha.nagaraja](https://discuss.elastic.co/u/parinitha.nagaraja)\ **Replies:** 3\ **Last updated:** [July 9, 2021, 4:44pm UTC](https://discuss.elastic.co/t/create-kv-pairs-for-field-not-in-key-value-format-and-use-ruby-filter-on-kv-pairs/278220 "2021-07-09T16:44:39Z")
Hello, I am trying to apply KV filter to a field that does not have "key:value key:value" format. The format is "value(key) value(key) ...". Below are the details. 2021-06-28 19:06:15.848 \[0000-XYZ\] \[appLog … --- ## [Importing text from text files and merging to existing documents](https://discuss.elastic.co/t/importing-text-from-text-files-and-merging-to-existing-documents/278269)
**Author:** [@stashing\_logs](https://discuss.elastic.co/u/stashing_logs)\ **Replies:** 1\ **Last updated:** [July 9, 2021, 4:43pm UTC](https://discuss.elastic.co/t/importing-text-from-text-files-and-merging-to-existing-documents/278269 "2021-07-09T16:43:39Z")
I have an existing elastic engine containing documents with an ID and some metadata (date, original file path, author etc.). I now have the text files which have the extracted text for these documents. The text files ar… --- ## [Does the lumberjack output plugin do the loadbalacing](https://discuss.elastic.co/t/does-the-lumberjack-output-plugin-do-the-loadbalacing/278252)
**Author:** [@lemahdois](https://discuss.elastic.co/u/lemahdois)\ **Replies:** 1\ **Last updated:** [July 9, 2021, 4:40pm UTC](https://discuss.elastic.co/t/does-the-lumberjack-output-plugin-do-the-loadbalacing/278252 "2021-07-09T16:40:07Z")
Dear all, I am using lumberjack output plugin to send logs from logstash to logstash. I use this code lumberjack { codec =\> json hosts =\> \["XXX","YYY"\] port =\> ZZZ … --- ## [Convert string to integer](https://discuss.elastic.co/t/convert-string-to-integer/277915)
**Author:** [@ANKITA\_SAHA](https://discuss.elastic.co/u/ANKITA_SAHA)\ **Replies:** 3\ **Last updated:** [July 9, 2021, 4:31pm UTC](https://discuss.elastic.co/t/convert-string-to-integer/277915 "2021-07-09T16:31:07Z")
Hello everyone! I need help for converting a string data to integer value. I have an 'Hours' column which consist of numeric data but kibana is reading as string as a result when i try to sort the axis it does not sort… --- ## [Troubles with JVM Heap](https://discuss.elastic.co/t/troubles-with-jvm-heap/278290)
**Author:** [@Di\_Croatiano](https://discuss.elastic.co/u/Di_Croatiano)\ **Replies:** 1\ **Last updated:** [July 9, 2021, 4:25pm UTC](https://discuss.elastic.co/t/troubles-with-jvm-heap/278290 "2021-07-09T16:25:54Z")
Hello there! After a considerable time optimizing and testing different configurations, I have no idea why my ES nodes uses so much of a JVM heap, with not so many shards in a cluster. I’m definitely missing something, … --- ## [How do I reference a field name that contains a dot in watcher logging action](https://discuss.elastic.co/t/how-do-i-reference-a-field-name-that-contains-a-dot-in-watcher-logging-action/266614)
**Author:** [@Emilio\_Vega](https://discuss.elastic.co/u/Emilio_Vega)\ **Replies:** 3\ **Last updated:** [July 9, 2021, 3:19pm UTC](https://discuss.elastic.co/t/how-do-i-reference-a-field-name-that-contains-a-dot-in-watcher-logging-action/266614 "2021-07-09T15:19:41Z")
An elastic template index got field names using dots ("property.name") and I am wondering if it is possible reference them using "ctx.payload.hits.hits.0.\_source" object. I did some different attempts without success. I… --- ## [Filebeat threatintel module error](https://discuss.elastic.co/t/filebeat-threatintel-module-error/278287)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 0\ **Last updated:** [July 9, 2021, 2:42pm UTC](https://discuss.elastic.co/t/filebeat-threatintel-module-error/278287 "2021-07-09T14:42:19Z")
Hello, I am trying the new threat intel module, I am having an error in the otx 2021-07-09T16:33:12.322+0200 ERROR \[input.httpjson-cursor.retryablehttp\] go-retryablehttp@v0.6.6/client.go:553 request failed%!(EXTRA stri… --- ## [Logstash .Conf file](https://discuss.elastic.co/t/logstash-conf-file/278194)
**Author:** [@Ashwin\_Patil1](https://discuss.elastic.co/u/Ashwin_Patil1)\ **Replies:** 9\ **Last updated:** [July 9, 2021, 2:40pm UTC](https://discuss.elastic.co/t/logstash-conf-file/278194 "2021-07-09T14:40:33Z")
I am trying to collect logs from multiple inputs and write them into 2 indices. Please refer the below conf file, am able to create a index called syslog but am not able to create index called winlog. All the logs are g… --- ## [Scripted field calculation with division](https://discuss.elastic.co/t/scripted-field-calculation-with-division/278284)
**Author:** [@jogabonito](https://discuss.elastic.co/u/jogabonito)\ **Replies:** 1\ **Last updated:** [July 9, 2021, 2:34pm UTC](https://discuss.elastic.co/t/scripted-field-calculation-with-division/278284 "2021-07-09T14:34:38Z")
Hi I want to make a scripted field using a simple calculation by using summation and dividing, but I just keep getting 0 and the error-message: "Unable to write index pattern! Refresh the page to get the most up to dat… --- ## [Pipeline continues when stopping Logstash service](https://discuss.elastic.co/t/pipeline-continues-when-stopping-logstash-service/277936)
**Author:** [@chris\_ts24](https://discuss.elastic.co/u/chris_ts24)\ **Replies:** 2\ **Last updated:** [July 9, 2021, 1:58pm UTC](https://discuss.elastic.co/t/pipeline-continues-when-stopping-logstash-service/277936 "2021-07-09T13:58:26Z")
Logstash v.7.13.2 Hi all, I'm successfully running 3 logstash instances via the following pipelines.yml file to keep an elasticsearch index up-to-date with changes to Oracle database records and windows logs: - pipeli… --- ## [Misleading Sum Date Histogram chart with Split Series](https://discuss.elastic.co/t/misleading-sum-date-histogram-chart-with-split-series/278264)
**Author:** [@Quim\_Fornaguera](https://discuss.elastic.co/u/Quim_Fornaguera)\ **Replies:** 6\ **Last updated:** [July 9, 2021, 1:40pm UTC](https://discuss.elastic.co/t/misleading-sum-date-histogram-chart-with-split-series/278264 "2021-07-09T13:40:55Z")
Hello y'all! When I Create a Sum chart with date histogram and Split Series by Significant Terms (where should be no specific order), I get the series sorted anyway independently of the value of the SUM calculation. … --- ## [SSL Handshake error while adding node to elasticsearch](https://discuss.elastic.co/t/ssl-handshake-error-while-adding-node-to-elasticsearch/278283)
**Author:** [@rohan0018](https://discuss.elastic.co/u/rohan0018)\ **Replies:** 0\ **Last updated:** [July 9, 2021, 1:18pm UTC](https://discuss.elastic.co/t/ssl-handshake-error-while-adding-node-to-elasticsearch/278283 "2021-07-09T13:18:26Z")
Hello I am trying to add node in elasticsearch cluster, when I restart elasticsearch service on data node it give below error. "\[2021-07-09T18:14:25,561\]\[WARN \]\[o.e.t.TcpTransport \] \[NODE2\] exception caught on transpor… --- ## [Illegal\_argument\_exception error](https://discuss.elastic.co/t/illegal-argument-exception-error/277816)
**Author:** [@keyofstarrysky973](https://discuss.elastic.co/u/keyofstarrysky973)\ **Replies:** 2\ **Last updated:** [July 9, 2021, 1:15pm UTC](https://discuss.elastic.co/t/illegal-argument-exception-error/277816 "2021-07-09T13:15:40Z")
Hello Team. I'm trying to implement a basic lifecycle policy, in order to delete an index after X hours (this lifecycle policy is just for testing). In my setup, I'm using to beats agents (Winlogbeat and Metricbeat). I … --- ## [From Splunk to ELK: how to perform statistic searches?](https://discuss.elastic.co/t/from-splunk-to-elk-how-to-perform-statistic-searches/277644)
**Author:** [@Wooden\_tree](https://discuss.elastic.co/u/Wooden_tree)\ **Replies:** 2\ **Last updated:** [July 9, 2021, 1:13pm UTC](https://discuss.elastic.co/t/from-splunk-to-elk-how-to-perform-statistic-searches/277644 "2021-07-09T13:13:59Z")
Hi, I spent last few years with Splunk and now I’m an ELK user. I’d like to know if there is a way to perform a statistical search in ELK. Let’s say, I have some firewall logs and I’d like to use it to detect a port sc… --- ## [Automate export of Kibana dashboard CSV](https://discuss.elastic.co/t/automate-export-of-kibana-dashboard-csv/278260)
**Author:** [@Core\_Sec](https://discuss.elastic.co/u/Core_Sec)\ **Replies:** 3\ **Last updated:** [July 9, 2021, 12:21pm UTC](https://discuss.elastic.co/t/automate-export-of-kibana-dashboard-csv/278260 "2021-07-09T12:21:05Z")
Hi All, I need to download the CSV data that generated by Kibana dashboard. I'm struggling with selenium to automate the manual download without much luck But it seems like very not generic and robust way to do that… --- ## [Getting Error in kibana while using xpach](https://discuss.elastic.co/t/getting-error-in-kibana-while-using-xpach/278245)
**Author:** [@SRIGURU\_VEL](https://discuss.elastic.co/u/SRIGURU_VEL)\ **Replies:** 4\ **Last updated:** [July 9, 2021, 12:14pm UTC](https://discuss.elastic.co/t/getting-error-in-kibana-while-using-xpach/278245 "2021-07-09T12:14:57Z")
Hi experts, I am using ELK version 7.12.0. I have secure my Elasticsearch With Xpack. so that i created http.p12 and elasticsearch-ca.pem certificates . And I configured it. In that Elasticsearch is working fine. But … --- ## [Ensuring master election in elastic search cluster is among desired nodes](https://discuss.elastic.co/t/ensuring-master-election-in-elastic-search-cluster-is-among-desired-nodes/277664)
**Author:** [@mahudees](https://discuss.elastic.co/u/mahudees)\ **Replies:** 3\ **Last updated:** [July 9, 2021, 12:00pm UTC](https://discuss.elastic.co/t/ensuring-master-election-in-elastic-search-cluster-is-among-desired-nodes/277664 "2021-07-09T12:00:25Z")
Hi, We have a 3 node elastic cluster running as part of our application. All the 3 are master eligible nodes. We also have mongodb cluster and our application cluster also running in the same node. Design is, master of… --- ## [Filebeat: Incorrect HTTP method after upgrade to 7.13](https://discuss.elastic.co/t/filebeat-incorrect-http-method-after-upgrade-to-7-13/277964)
**Author:** [@PascalTurbo](https://discuss.elastic.co/u/PascalTurbo)\ **Replies:** 3\ **Last updated:** [July 9, 2021, 11:52am UTC](https://discuss.elastic.co/t/filebeat-incorrect-http-method-after-upgrade-to-7-13/277964 "2021-07-09T11:52:07Z")
Hi There, I'm using filebeat on a windows server with iis module enabled. After upgrading from 7.10 to 7.13 it starts writing this error. I don't understand why, because the documentation lists PUT method and I don't th… --- ## [Install pulgin in kibana](https://discuss.elastic.co/t/install-pulgin-in-kibana/278165)
**Author:** [@vikramdayma](https://discuss.elastic.co/u/vikramdayma)\ **Replies:** 3\ **Last updated:** [July 9, 2021, 11:47am UTC](https://discuss.elastic.co/t/install-pulgin-in-kibana/278165 "2021-07-09T11:47:42Z")
Hi, I am trying to install plugin on centos 7.x in kibana 7.12.0 by command sudo bin/kibana-plugin install file:///home/mykibanaplugin/ai\_analyst-7.12.0.zip It is giving error Plugin installation was unsuccessful du… --- ## [Keystore Issue on Suse and windows](https://discuss.elastic.co/t/keystore-issue-on-suse-and-windows/278275)
**Author:** [@Ashwin\_Patil1](https://discuss.elastic.co/u/Ashwin_Patil1)\ **Replies:** 0\ **Last updated:** [July 9, 2021, 11:21am UTC](https://discuss.elastic.co/t/keystore-issue-on-suse-and-windows/278275 "2021-07-09T11:21:55Z")
I am trying to create logstash keystore and winlogbeat keystore, but I am getting the below error. However I was able to create filebeat keystore. Below is the error for logstash on Suse linux, localhost:/usr/share/lo… --- ## [Filebeat stops working with error message UDP Package size to large](https://discuss.elastic.co/t/filebeat-stops-working-with-error-message-udp-package-size-to-large/278151)
**Author:** [@rolandmueller](https://discuss.elastic.co/u/rolandmueller)\ **Replies:** 2\ **Last updated:** [July 9, 2021, 11:21am UTC](https://discuss.elastic.co/t/filebeat-stops-working-with-error-message-udp-package-size-to-large/278151 "2021-07-09T11:21:17Z")
Hello As in the log files it's recommeded to report this I would like todo so. I have Filebeat installed (7.13.2) on Windows Server 2019 (1809). We have Air Watch Cloud Connector (19.12) configured for sending Syslog da… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1327) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1329)