# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1363 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1364 --- ## [Constant Garbage Collecting](https://discuss.elastic.co/t/constant-garbage-collecting/276180)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 4\ **Last updated:** [June 16, 2021, 8:43pm UTC](https://discuss.elastic.co/t/constant-garbage-collecting/276180 "2021-06-16T20:43:22Z")
I am getting a constant stream of garbage collection logs in my cluster.log of the type shown below: \[2021-06-16T13:33:31,031\]\[WARN\] \[o.e.m.j.JvmGcMonitorService\] \[hot-data.domain.com\] \[gc\] \[255\] overhead, spent \[1.8s… --- ## [How to parse dir command output from txt file and append filenames to directory](https://discuss.elastic.co/t/how-to-parse-dir-command-output-from-txt-file-and-append-filenames-to-directory/276185)
**Author:** [@baileys20055](https://discuss.elastic.co/u/baileys20055)\ **Replies:** 4\ **Last updated:** [June 16, 2021, 8:33pm UTC](https://discuss.elastic.co/t/how-to-parse-dir-command-output-from-txt-file-and-append-filenames-to-directory/276185 "2021-06-16T20:33:46Z")
Hello, I am trying to parse dir command txt files that are formatted as follows: Directory of C:\\Windows\\addins 09/15/2018 02:33 AM \ . 09/15/2018 02:33 AM \ .. 09/15/2018 02:29 AM… --- ## [Establish connection to Filebeat from Logstash](https://discuss.elastic.co/t/establish-connection-to-filebeat-from-logstash/275547)
**Author:** [@cwiechmann](https://discuss.elastic.co/u/cwiechmann)\ **Replies:** 5\ **Last updated:** [June 16, 2021, 8:29pm UTC](https://discuss.elastic.co/t/establish-connection-to-filebeat-from-logstash/275547 "2021-06-16T20:29:18Z")
Hi All, Let's assume an application I would like to monitor is running in a Security-Network-Zone (e.g. DMZ). It should be integrated via Filebeat into the Logstash & Elasticsearch platform running in the internal netwo… --- ## [How to update index in Elasticsearch](https://discuss.elastic.co/t/how-to-update-index-in-elasticsearch/275773)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 6\ **Last updated:** [June 16, 2021, 7:14pm UTC](https://discuss.elastic.co/t/how-to-update-index-in-elasticsearch/275773 "2021-06-16T19:14:37Z")
Hi All, I have an ELK 7.6.2 stack running in the environment. In my setup logstash is set to ingest file as an input and performs certain operations on it and creates an index in ES. First few lines of the logstash co… --- ## [Monitoring Logstash With Metricbeat](https://discuss.elastic.co/t/monitoring-logstash-with-metricbeat/275637)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 3\ **Last updated:** [June 16, 2021, 7:12pm UTC](https://discuss.elastic.co/t/monitoring-logstash-with-metricbeat/275637 "2021-06-16T19:12:00Z")
Recently upgraded my Elastic Stack to 7.13 and have installed metricbeat 7.13.1 on the logstash server for monitoring, but I can get this thing to send monitoring data. The logs indicate a successful connection to my mo… --- ## [Kibana Scripted Field URL Template](https://discuss.elastic.co/t/kibana-scripted-field-url-template/275417)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 1\ **Last updated:** [June 16, 2021, 6:56pm UTC](https://discuss.elastic.co/t/kibana-scripted-field-url-template/275417 "2021-06-16T18:56:05Z")
I was using KIbana 7.4.2. At that time I use to fetch scripted field images as below /bundles/src/legacy/ui/public/field\_editor/components/field\_format\_editor/editors/url/icons/{{value}}.png"}. Now we upgraded Kibana t… --- ## [How to reset Fleet / Get a new Service Token?](https://discuss.elastic.co/t/how-to-reset-fleet-get-a-new-service-token/276159)
**Author:** [@maof97](https://discuss.elastic.co/u/maof97)\ **Replies:** 2\ **Last updated:** [June 16, 2021, 6:50pm UTC](https://discuss.elastic.co/t/how-to-reset-fleet-get-a-new-service-token/276159 "2021-06-16T18:50:29Z")
Hello, I kind of crashed my fleet setup and needed to remove all agents (including the one providing the fleet "server"). But now I can't create a new Fleet server like in the beginning where it asked me to enter an IP… --- ## [Painless script arrays](https://discuss.elastic.co/t/painless-script-arrays/276162)
**Author:** [@nickgregz](https://discuss.elastic.co/u/nickgregz)\ **Replies:** 1\ **Last updated:** [June 16, 2021, 6:46pm UTC](https://discuss.elastic.co/t/painless-script-arrays/276162 "2021-06-16T18:46:06Z")
Hello, Is there a way to easily create and empty string array in Painless script, than add a string to it if it doesn't already exist in the array. I can't seem to find proper examples of arrays for Painless script any… --- ## [Jest server API testing](https://discuss.elastic.co/t/jest-server-api-testing/275943)
**Author:** [@adityaPsl](https://discuss.elastic.co/u/adityaPsl)\ **Replies:** 1\ **Last updated:** [June 16, 2021, 5:56pm UTC](https://discuss.elastic.co/t/jest-server-api-testing/275943 "2021-06-16T17:56:47Z")
Hello Team, I am new to the Javascript and Kibana. Based on the discussion on Sonarqube topic, i am trying to write a test case for basic hello-world plugin (generated by plugin generator) I want to achieve something … --- ## [Configure Metricbeat not to report process arguments](https://discuss.elastic.co/t/configure-metricbeat-not-to-report-process-arguments/276047)
**Author:** [@spatar](https://discuss.elastic.co/u/spatar)\ **Replies:** 1\ **Last updated:** [June 16, 2021, 5:27pm UTC](https://discuss.elastic.co/t/configure-metricbeat-not-to-report-process-arguments/276047 "2021-06-16T17:27:49Z")
Is it possible to configure Metricbeat not to include process arguments in the metrics but only process names? --- ## [Self monitoring won't enable 7.13](https://discuss.elastic.co/t/self-monitoring-wont-enable-7-13/276018)
**Author:** [@P\_Larsen](https://discuss.elastic.co/u/P_Larsen)\ **Replies:** 2\ **Last updated:** [June 16, 2021, 5:24pm UTC](https://discuss.elastic.co/t/self-monitoring-wont-enable-7-13/276018 "2021-06-16T17:24:50Z")
Trying to activate Self Monitoring in 7.13. The message logged to Kibana is 2021-06-15T14:16:46+00:00","tags":\["warning","plugins","monitoring","monitoring","kibana-monitoring"\],"pid":128991,"message":"Unable to bulk … --- ## [Modjk log monitoring with filebeat](https://discuss.elastic.co/t/modjk-log-monitoring-with-filebeat/276118)
**Author:** [@venkatesh\_prasanth](https://discuss.elastic.co/u/venkatesh_prasanth)\ **Replies:** 1\ **Last updated:** [June 16, 2021, 5:22pm UTC](https://discuss.elastic.co/t/modjk-log-monitoring-with-filebeat/276118 "2021-06-16T17:22:02Z")
Hi, I want to monitor the modjk log. From Which module i can give the log path for modjk and where should i mention grok filter --- ## [Creating a premade dashboard for my custom beat](https://discuss.elastic.co/t/creating-a-premade-dashboard-for-my-custom-beat/276154)
**Author:** [@blackberrySherbet](https://discuss.elastic.co/u/blackberrySherbet)\ **Replies:** 1\ **Last updated:** [June 16, 2021, 5:20pm UTC](https://discuss.elastic.co/t/creating-a-premade-dashboard-for-my-custom-beat/276154 "2021-06-16T17:20:15Z")
I have created my own custom beat (by following Creating a New Beat | Beats Developer Guide \[master\] | Elastic). I would like to create a new custom dashboard on Kibana every time a user uploads a new file using this cu… --- ## [Index variable substitution not working](https://discuss.elastic.co/t/index-variable-substitution-not-working/276169)
**Author:** [@devopscanada](https://discuss.elastic.co/u/devopscanada)\ **Replies:** 0\ **Last updated:** [June 16, 2021, 4:51pm UTC](https://discuss.elastic.co/t/index-variable-substitution-not-working/276169 "2021-06-16T16:51:13Z")
I'm trying in Logstash to write different indices (see documentation) but Logtash wont' substitute the variables. My Logstash configuraiton: output { elasticsearch { hosts =\> \["http://elasticsearch-ma… --- ## [From FileBeat to Logstash](https://discuss.elastic.co/t/from-filebeat-to-logstash/276095)
**Author:** [@Michael\_Dylan\_McAloo](https://discuss.elastic.co/u/Michael_Dylan_McAloo)\ **Replies:** 1\ **Last updated:** [June 16, 2021, 4:44pm UTC](https://discuss.elastic.co/t/from-filebeat-to-logstash/276095 "2021-06-16T16:44:46Z")
I have a dissect with filebeat, functional, but I need to pass it to logstash and I don't know how to use that same function in Logstash. Code: processors: - dissect: tokenizer: '%{timestamp} \[%{trash}\] \[… --- ## [How to migrate .kibana index from kibana 6.8 to 7.10?](https://discuss.elastic.co/t/how-to-migrate-kibana-index-from-kibana-6-8-to-7-10/276093)
**Author:** [@hardik.rapidops](https://discuss.elastic.co/u/hardik.rapidops)\ **Replies:** 1\ **Last updated:** [June 16, 2021, 4:23pm UTC](https://discuss.elastic.co/t/how-to-migrate-kibana-index-from-kibana-6-8-to-7-10/276093 "2021-06-16T16:23:46Z")
Hello I am using kibana 6.8 and I have following mappings of .kibana index as described in this link: Migrating Kibana index to 6.0 | Kibana User Guide \[6.0\] | Elastic I want to upgrade .kibana index from 6.8 to 7.10 ma… --- ## [Dashboard filter does not find index fields](https://discuss.elastic.co/t/dashboard-filter-does-not-find-index-fields/276156)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 4\ **Last updated:** [June 16, 2021, 4:07pm UTC](https://discuss.elastic.co/t/dashboard-filter-does-not-find-index-fields/276156 "2021-06-16T16:07:26Z")
Hello good, I have a question, I am monitoring equipment and in the dashboard I made I have data from several indexes, what arises here is a problem, as I will filter by the (sysname) of a team and I do not get the field… --- ## [Nested Query Filter](https://discuss.elastic.co/t/nested-query-filter/276160)
**Author:** [@SAMBUDDHA\_CHAUDHURI](https://discuss.elastic.co/u/SAMBUDDHA_CHAUDHURI)\ **Replies:** 0\ **Last updated:** [June 16, 2021, 3:37pm UTC](https://discuss.elastic.co/t/nested-query-filter/276160 "2021-06-16T15:37:23Z")
Currently I am trying to search/filter a nested Document in Elastic Search Spring Data. The Current Document Structure is: { "id": 1, "customername": "Cust@123", "policydetails": { "address": { "city": … --- ## [Winlogbeat not writing logs to extract path](https://discuss.elastic.co/t/winlogbeat-not-writing-logs-to-extract-path/276157)
**Author:** [@rudraram](https://discuss.elastic.co/u/rudraram)\ **Replies:** 1\ **Last updated:** [June 16, 2021, 3:28pm UTC](https://discuss.elastic.co/t/winlogbeat-not-writing-logs-to-extract-path/276157 "2021-06-16T15:28:41Z")
I extracted winlogbeat to the following location C:\\Program Files (x86)\\winlogbeat-7.11.1-windows-x86\_64 when I install the service and start the service, i dont see any logs witten to logpath C:\\Program Files (x86)\\w… --- ## [Change colors for each result on stacked bar?](https://discuss.elastic.co/t/change-colors-for-each-result-on-stacked-bar/275598)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 7\ **Last updated:** [June 16, 2021, 3:24pm UTC](https://discuss.elastic.co/t/change-colors-for-each-result-on-stacked-bar/275598 "2021-06-16T15:24:20Z")
Hello I have stacked bar that is showing me success logons and failed logons. I want them to be different colors than the default but I dont see where I can change that. How do I do it? --- ## [Fleet: Override Elasticsearch URL at policy level](https://discuss.elastic.co/t/fleet-override-elasticsearch-url-at-policy-level/275982)
**Author:** [@nugroho-expereo](https://discuss.elastic.co/u/nugroho-expereo)\ **Replies:** 2\ **Last updated:** [June 16, 2021, 3:04pm UTC](https://discuss.elastic.co/t/fleet-override-elasticsearch-url-at-policy-level/275982 "2021-06-16T15:04:00Z")
Hi All, Is it possible to override Elasticsearch URL for fleet on policy Level? I see in the UI we only have global setting. We use Elastic Cloud service. Use Case: For on premise agent it should connect to the publi… --- ## [Logstash Extract Elasticsearch Nested Fields](https://discuss.elastic.co/t/logstash-extract-elasticsearch-nested-fields/275451)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 28\ **Last updated:** [June 16, 2021, 2:13pm UTC](https://discuss.elastic.co/t/logstash-extract-elasticsearch-nested-fields/275451 "2021-06-16T14:13:37Z")
Hello Team I am using Elasticsearch version 7.8.0 and Logstash version 7.8.0 I am having ES Index having following mappings : "mappings" : { "properties" : { "appEvents" : { "properties" : … --- ## [Convert a legacy template into a composable template?](https://discuss.elastic.co/t/convert-a-legacy-template-into-a-composable-template/276145)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 0\ **Last updated:** [June 16, 2021, 1:06pm UTC](https://discuss.elastic.co/t/convert-a-legacy-template-into-a-composable-template/276145 "2021-06-16T13:06:07Z")
Hello There is a legacy template with a lot of good default mappings that I want to use as a base (a base template, even though it is rudundent) That being said, I want to use it as a composable template. Is there a wa… --- ## [Check whether document returned is from a read or a write index](https://discuss.elastic.co/t/check-whether-document-returned-is-from-a-read-or-a-write-index/276133)
**Author:** [@Deepti](https://discuss.elastic.co/u/Deepti)\ **Replies:** 3\ **Last updated:** [June 16, 2021, 12:48pm UTC](https://discuss.elastic.co/t/check-whether-document-returned-is-from-a-read-or-a-write-index/276133 "2021-06-16T12:48:58Z")
I have a requirement where I want to delete the documents which match the query but only if they are in the read index , if it is in a write index I don't want the documents to be deleted. Below query deletes irrespecti… --- ## [Higher CPU vs Higher Memory. Which helps in what cases?](https://discuss.elastic.co/t/higher-cpu-vs-higher-memory-which-helps-in-what-cases/272798)
**Author:** [@Aurel\_Drejta](https://discuss.elastic.co/u/Aurel_Drejta)\ **Replies:** 23\ **Last updated:** [June 16, 2021, 12:33pm UTC](https://discuss.elastic.co/t/higher-cpu-vs-higher-memory-which-helps-in-what-cases/272798 "2021-06-16T12:33:32Z")
Hi everyone, What are the cases where a higher CPU and/or faster CPU benefits the cluster more than higher memory? I am currently running on 3 Nodes that are 8 CPU 16GB RAM configurations. I will scale the cluster fir… --- ## [Highlighting | Fragments | Order:Score --- is it possible to get the score of every fragment?](https://discuss.elastic.co/t/highlighting-fragments-order-score-is-it-possible-to-get-the-score-of-every-fragment/276137)
**Author:** [@edyas](https://discuss.elastic.co/u/edyas)\ **Replies:** 0\ **Last updated:** [June 16, 2021, 12:20pm UTC](https://discuss.elastic.co/t/highlighting-fragments-order-score-is-it-possible-to-get-the-score-of-every-fragment/276137 "2021-06-16T12:20:11Z")
When using Highlighting, fragments can be sorted by their respective score, which is a very useful feature. But is there any way to get their individual score (which must be calculated in the background for the sorting)… --- ## [Date Logstash](https://discuss.elastic.co/t/date-logstash/275816)
**Author:** [@Krunal](https://discuss.elastic.co/u/Krunal)\ **Replies:** 1\ **Last updated:** [June 16, 2021, 12:07pm UTC](https://discuss.elastic.co/t/date-logstash/275816 "2021-06-16T12:07:21Z")
Hello Expert, I would like convert date into timestamp which is mention below.. I dont have any column with reference to date but I have just 1 line in which date is mention. what changes I can do in config file of logs… --- ## [Problem with data merging](https://discuss.elastic.co/t/problem-with-data-merging/274425)
**Author:** [@ravi-shanker](https://discuss.elastic.co/u/ravi-shanker)\ **Replies:** 14\ **Last updated:** [June 16, 2021, 12:02pm UTC](https://discuss.elastic.co/t/problem-with-data-merging/274425 "2021-06-16T12:02:05Z")
Hello All, I am using jdbc input and jdbc\_streaming section in my logstash config to bring data from two different table into the same index. My logstash config is below. input { jdbc { jdbc\_connection\_str… --- ## [Can i connect two different (not clustered) elasticsearch hosts to single kibana?](https://discuss.elastic.co/t/can-i-connect-two-different-not-clustered-elasticsearch-hosts-to-single-kibana/275626)
**Author:** [@Kamil\_Siraliyev](https://discuss.elastic.co/u/Kamil_Siraliyev)\ **Replies:** 4\ **Last updated:** [June 16, 2021, 11:20am UTC](https://discuss.elastic.co/t/can-i-connect-two-different-not-clustered-elasticsearch-hosts-to-single-kibana/275626 "2021-06-16T11:20:19Z")
I have 2 different not clustered elasticsearch hosts 192.168.1.10 and 192.168.1.85. The 192.168.1.10 server also has kibana. Question: can i connect both of them to a single kibana? Thanks. --- ## [Is it possible to choose the fields from the event before passing it for analysis?](https://discuss.elastic.co/t/is-it-possible-to-choose-the-fields-from-the-event-before-passing-it-for-analysis/276086)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 2\ **Last updated:** [June 16, 2021, 11:05am UTC](https://discuss.elastic.co/t/is-it-possible-to-choose-the-fields-from-the-event-before-passing-it-for-analysis/276086 "2021-06-16T11:05:02Z")
Is it possible to limit the number of fields we process? In anomaly detection-\>Configure datafeed the elasticsearch query is : { "bool": { "must": \[ { "match\_all": {} } \] } } I tried to… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1362) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1364)