# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1366 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1367 --- ## [Heartbeat ask for unnecessary cluster privileges at startup](https://discuss.elastic.co/t/heartbeat-ask-for-unnecessary-cluster-privileges-at-startup/275814)
**Author:** [@iorfix](https://discuss.elastic.co/u/iorfix)\ **Replies:** 5\ **Last updated:** [June 15, 2021, 2:28pm UTC](https://discuss.elastic.co/t/heartbeat-ask-for-unnecessary-cluster-privileges-at-startup/275814 "2021-06-15T14:28:43Z")
Hi all, I'm using Heartbeat 7.13.1. I first setup templates and ILM policy with elastic superuser, and then I start heartbeat using a ristrected "apikey" user. However, I have this error at startup: {"log.level":"err… --- ## [Nested field size script](https://discuss.elastic.co/t/nested-field-size-script/276013)
**Author:** [@tfe2012](https://discuss.elastic.co/u/tfe2012)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 2:06pm UTC](https://discuss.elastic.co/t/nested-field-size-script/276013 "2021-06-15T14:06:35Z")
Hi, I try to get all documents which nested field size \> 1 my mapping: "selectStatsListNested" : { "type" : "nested", "properties" : { "isSampleSelect" : { "type" : "boolea… --- ## [I would like to concatenate date and time fields with logstash](https://discuss.elastic.co/t/i-would-like-to-concatenate-date-and-time-fields-with-logstash/275992)
**Author:** [@sudo-ranjith](https://discuss.elastic.co/u/sudo-ranjith)\ **Replies:** 2\ **Last updated:** [June 15, 2021, 2:05pm UTC](https://discuss.elastic.co/t/i-would-like-to-concatenate-date-and-time-fields-with-logstash/275992 "2021-06-15T14:05:52Z")
Hi There, I have two fields date and time("10/26/20","09:30:53"). My Grok patterns are "%{DATA:date}","%{DATA:time}" I would like to concatenate these two fields as datetime, Could you please help me on the same. --- ## [Configure logstash to recieve logs from Openshift 4 and fluentdForward](https://discuss.elastic.co/t/configure-logstash-to-recieve-logs-from-openshift-4-and-fluentdforward/276012)
**Author:** [@sudden74](https://discuss.elastic.co/u/sudden74)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 2:00pm UTC](https://discuss.elastic.co/t/configure-logstash-to-recieve-logs-from-openshift-4-and-fluentdforward/276012 "2021-06-15T14:00:41Z")
We have configured the fluentdForward on Openshift 4.7 to send logs to an external ELK stack. Logs are arriving to logstash but we are not able to decode the messages correctly. It looks like the special characters are r… --- ## [Is it necessary to give only elasticsearch master nodes in kibana config](https://discuss.elastic.co/t/is-it-necessary-to-give-only-elasticsearch-master-nodes-in-kibana-config/275543)
**Author:** [@elk11](https://discuss.elastic.co/u/elk11)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 1:57pm UTC](https://discuss.elastic.co/t/is-it-necessary-to-give-only-elasticsearch-master-nodes-in-kibana-config/275543 "2021-06-15T13:57:55Z")
Elasticsearch and Kibana version: 7.3.1 I'm deploying Elasticsearch (3 nodes) and Kibana on docker. node1: elasticsearch master(data) and kibana node2: elasticsearch (data) node3: elasticsearch (data) our kibana con… --- ## [Beats 7.13.1 Helm Charts Missing/Removed?](https://discuss.elastic.co/t/beats-7-13-1-helm-charts-missing-removed/275854)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 2\ **Last updated:** [June 15, 2021, 1:24pm UTC](https://discuss.elastic.co/t/beats-7-13-1-helm-charts-missing-removed/275854 "2021-06-15T13:24:58Z")
I was trying to upgrade a helm deployment of Filebeat and Metricbeat to 7.13.1 and noticed that only 7.13.0 is available for it. 7.13.1 was available last week. Were the 7.13.1 charts removed for a specific reason? --- ## [Error with IIS Dashboards \[ 7.10.2 \]](https://discuss.elastic.co/t/error-with-iis-dashboards-7-10-2/276007)
**Author:** [@rodrigo.gz](https://discuss.elastic.co/u/rodrigo.gz)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 1:22pm UTC](https://discuss.elastic.co/t/error-with-iis-dashboards-7-10-2/276007 "2021-06-15T13:22:11Z")
Hello! I am trying to monitor an IIS with metricbeat and filebeat. When I do the setup and start the agent, it starts collecting metrics and logs correctly but, the dashboards do not show the collected information as e… --- ## [Performance Downgrade, after upgrading from 6.4 to 7.7](https://discuss.elastic.co/t/performance-downgrade-after-upgrading-from-6-4-to-7-7/274861)
**Author:** [@chintushah46](https://discuss.elastic.co/u/chintushah46)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 12:30pm UTC](https://discuss.elastic.co/t/performance-downgrade-after-upgrading-from-6-4-to-7-7/274861 "2021-06-15T12:30:41Z")
I am seeing a huge performance downgrade after upgrading Elasticsearch from version 6.4 to 7.7. Query Sample: {"size": 1000000,"from": 0,"track\_total\_hits": true,"query": {"bool": {"filter": {"bool": {"should": \[{"boo… --- ## [Filter messages in logstash with different index](https://discuss.elastic.co/t/filter-messages-in-logstash-with-different-index/275990)
**Author:** [@learner21](https://discuss.elastic.co/u/learner21)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 11:45am UTC](https://discuss.elastic.co/t/filter-messages-in-logstash-with-different-index/275990 "2021-06-15T11:45:11Z")
I am getting 3 types of messages in logstash, based on that i need to parse and save in elasticSearch with 3 different index Message 1 =\> "2021-05-26T09:55:36.091040+00:00 10.13.14.11 \[S=294230650\] \[ID=fbf282:30:1115898… --- ## [Display Top 20 Results by Event Count](https://discuss.elastic.co/t/display-top-20-results-by-event-count/275492)
**Author:** [@nazevedo3](https://discuss.elastic.co/u/nazevedo3)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 11:32am UTC](https://discuss.elastic.co/t/display-top-20-results-by-event-count/275492 "2021-06-15T11:32:31Z")
Hi All, I have a dataset that returns data that includes a networks ASN. I'd like to be able to visualize a set of specific ASNs AND the top 20 of all other ASNs in my dataset based on event count. Any suggestions on … --- ## [Logstash multiple pipelines](https://discuss.elastic.co/t/logstash-multiple-pipelines/275984)
**Author:** [@sreedhar1](https://discuss.elastic.co/u/sreedhar1)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 11:25am UTC](https://discuss.elastic.co/t/logstash-multiple-pipelines/275984 "2021-06-15T11:25:30Z")
Hi All, I am using Logstash to populate data from sql server to Elasticsearch. I have created multiple .conf files to populate data in ES. Created pipeline to run all these .conf files. Question: do we need to create m… --- ## [Is it possible to leave the dashboard always fullscreen or hide the query part?](https://discuss.elastic.co/t/is-it-possible-to-leave-the-dashboard-always-fullscreen-or-hide-the-query-part/275702)
**Author:** [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\ **Replies:** 2\ **Last updated:** [June 15, 2021, 11:11am UTC](https://discuss.elastic.co/t/is-it-possible-to-leave-the-dashboard-always-fullscreen-or-hide-the-query-part/275702 "2021-06-15T11:11:02Z")
Is it possible to leave the dashboard always fullscreen or hide the query part? as follows in the image. --- ## [Kibana Report Error: Failed to decrypt report job data](https://discuss.elastic.co/t/kibana-report-error-failed-to-decrypt-report-job-data/275657)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 2\ **Last updated:** [June 15, 2021, 10:56am UTC](https://discuss.elastic.co/t/kibana-report-error-failed-to-decrypt-report-job-data/275657 "2021-06-15T10:56:05Z")
Hi there, I am facing following error each time I want to generate a CSV Report from Kibana Discover Module. Either immediately or after some time (like 30 seconds or so) I see following Error: Error: Failed to decryp… --- ## [Metricbeat and Logstash](https://discuss.elastic.co/t/metricbeat-and-logstash/275391)
**Author:** [@stefan0s](https://discuss.elastic.co/u/stefan0s)\ **Replies:** 3\ **Last updated:** [June 15, 2021, 10:43am UTC](https://discuss.elastic.co/t/metricbeat-and-logstash/275391 "2021-06-15T10:43:53Z")
Hello, I have installed logstash to collect logs and send to elasticsearch. Logstash is configured to keep indexes in hourly base. I need now to install metricbeat modules and also send to elasticsearch in hourly base … --- ## [How to monitor the beats using prometheus](https://discuss.elastic.co/t/how-to-monitor-the-beats-using-prometheus/275394)
**Author:** [@PeterFulier](https://discuss.elastic.co/u/PeterFulier)\ **Replies:** 2\ **Last updated:** [June 15, 2021, 10:26am UTC](https://discuss.elastic.co/t/how-to-monitor-the-beats-using-prometheus/275394 "2021-06-15T10:26:11Z")
Hello, I am trying to find a way to expose beats (especially the metricbeat) statistics to prometheus to have the option to monitor the correct functionality of metricbeat in terms of its connection to elastic. Current… --- ## [Metric value 0 breaking change (since upgrade to version 7.13)](https://discuss.elastic.co/t/metric-value-0-breaking-change-since-upgrade-to-version-7-13/275956)
**Author:** [@Chenlrv](https://discuss.elastic.co/u/Chenlrv)\ **Replies:** 5\ **Last updated:** [June 15, 2021, 10:09am UTC](https://discuss.elastic.co/t/metric-value-0-breaking-change-since-upgrade-to-version-7-13/275956 "2021-06-15T10:09:22Z")
Hello, since upgrading to version 7.13, Metric visualizations with value of 0 look like this: where before upgrade Metric visualizations showed 0. Is there any solution to this? we want to show the value 0 and not da… --- ## [Rally metrics in a single node cluster](https://discuss.elastic.co/t/rally-metrics-in-a-single-node-cluster/275808)
**Author:** [@Lasse\_Nedergaard](https://discuss.elastic.co/u/Lasse_Nedergaard)\ **Replies:** 9\ **Last updated:** [June 15, 2021, 10:05am UTC](https://discuss.elastic.co/t/rally-metrics-in-a-single-node-cluster/275808 "2021-06-15T10:05:53Z")
Hi For simplicity I want to store reporting metrics in a single node cluster. I can see the index is created with 1 replicas. Are there any way to set replicas to 0? Or is my only option to create a cluster with more n… --- ## [Update all fields containing specific string in field name by painless script](https://discuss.elastic.co/t/update-all-fields-containing-specific-string-in-field-name-by-painless-script/275973)
**Author:** [@sbienert](https://discuss.elastic.co/u/sbienert)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 9:55am UTC](https://discuss.elastic.co/t/update-all-fields-containing-specific-string-in-field-name-by-painless-script/275973 "2021-06-15T09:55:06Z")
Hi, I have a pretty simple request but I don't manage to get it working. I need to increase a datetime of multiple fields in one document. The date fields can be nested fields at different levels. Instead of having to u… --- ## [ILM Waiting for allocation on warm nodes](https://discuss.elastic.co/t/ilm-waiting-for-allocation-on-warm-nodes/275969)
**Author:** [@jamesp220291](https://discuss.elastic.co/u/jamesp220291)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 9:49am UTC](https://discuss.elastic.co/t/ilm-waiting-for-allocation-on-warm-nodes/275969 "2021-06-15T09:49:48Z")
Hi my iLM is stuck on awaiting allocation. my cluster has 2x warm nodes the warning is Action status Waiting for \[2\] shards to be allocated to nodes matching the given filters as you can see, nothing is rolling ove… --- ## [Logstash is not creating ingest pipelines](https://discuss.elastic.co/t/logstash-is-not-creating-ingest-pipelines/275953)
**Author:** [@Mocem](https://discuss.elastic.co/u/Mocem)\ **Replies:** 2\ **Last updated:** [June 15, 2021, 9:35am UTC](https://discuss.elastic.co/t/logstash-is-not-creating-ingest-pipelines/275953 "2021-06-15T09:35:42Z")
Hi All, For the past few days I'm struggling with loading the pipelines from filebeat. Basically nothing is happening. It works directly to Elastic but not when logstash is in between. Once I create the ingest pipeline … --- ## [How to write query in Dev tools to find expired date of customers by comparing current date?](https://discuss.elastic.co/t/how-to-write-query-in-dev-tools-to-find-expired-date-of-customers-by-comparing-current-date/275663)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 4\ **Last updated:** [June 15, 2021, 9:32am UTC](https://discuss.elastic.co/t/how-to-write-query-in-dev-tools-to-find-expired-date-of-customers-by-comparing-current-date/275663 "2021-06-15T09:32:08Z")
I have a index that contains date field of customers that contains date of customers to be expired. Now my task is you to compare that date with current date(dynamically) changes as current date change gives result "expi… --- ## [Metricbeat system module CPU missing fields](https://discuss.elastic.co/t/metricbeat-system-module-cpu-missing-fields/275837)
**Author:** [@phani\_akkina](https://discuss.elastic.co/u/phani_akkina)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 8:57am UTC](https://discuss.elastic.co/t/metricbeat-system-module-cpu-missing-fields/275837 "2021-06-15T08:57:09Z")
Metricbeat System module CPU missing fields of nice, iowait, softirq, irq, and others for Windows and its reporting all for Linux VMS. Earlier we used the 6.1 version and its reported all the values but after the upgrad… --- ## [Hide the Kibana Header (black/top)](https://discuss.elastic.co/t/hide-the-kibana-header-black-top/275939)
**Author:** [@Jayanth\_Palle](https://discuss.elastic.co/u/Jayanth_Palle)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 8:45am UTC](https://discuss.elastic.co/t/hide-the-kibana-header-black-top/275939 "2021-06-15T08:45:47Z")
I am new to ELK stack.The Kibana header(black/top) is good but it will be fine for us if there is an option to hide it (we aren't using it at all) so that we could use some more space.Is there a way to do so? Need to re… --- ## [I want to get Notification if Filebeat get down](https://discuss.elastic.co/t/i-want-to-get-notification-if-filebeat-get-down/275960)
**Author:** [@Rohit\_Kumbhar](https://discuss.elastic.co/u/Rohit_Kumbhar)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 8:40am UTC](https://discuss.elastic.co/t/i-want-to-get-notification-if-filebeat-get-down/275960 "2021-06-15T08:40:20Z")
Hi, I want to Uptime monitoring of Filebeat and if Filebeat gets down I should get slack notification regarding that. Is their any url for Filebeat so i can monitor it through Heartbeat? Thanks, Regards Rohit --- ## [Excessive disk usage ( ~80M/s) filebeat](https://discuss.elastic.co/t/excessive-disk-usage-80m-s-filebeat/275655)
**Author:** [@111304](https://discuss.elastic.co/u/111304)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 8:38am UTC](https://discuss.elastic.co/t/excessive-disk-usage-80m-s-filebeat/275655 "2021-06-15T08:38:51Z")
Hi, I am using filebeat 7.6.0 vesrion on each server. I have a 3 node elastic cluster 6.8.16 version and Graylog version 4.0.8-1. In one run, I found that filebeat writes to disk (~ 80 Mbps), although normal writes (~ 2… --- ## [Received an event that has a different character encoding than you configured. Log4j2 to Logstash](https://discuss.elastic.co/t/received-an-event-that-has-a-different-character-encoding-than-you-configured-log4j2-to-logstash/275952)
**Author:** [@Rashmika\_Gamage](https://discuss.elastic.co/u/Rashmika_Gamage)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 7:08am UTC](https://discuss.elastic.co/t/received-an-event-that-has-a-different-character-encoding-than-you-configured-log4j2-to-logstash/275952 "2021-06-15T07:08:21Z")
I am trying to get spark logs to logstash with custom log4j2 properties. My log4j2 properties file #Define the log4j configuration for local application #log4j.rootLogger=INFO, server #We will use socket appender log4j… --- ## [Elastic Fleet Agent Upgrade failing](https://discuss.elastic.co/t/elastic-fleet-agent-upgrade-failing/272502)
**Author:** [@The1WhoPrtNocks](https://discuss.elastic.co/u/The1WhoPrtNocks)\ **Replies:** 8\ **Last updated:** [June 15, 2021, 8:01am UTC](https://discuss.elastic.co/t/elastic-fleet-agent-upgrade-failing/272502 "2021-06-15T08:01:46Z")
Hi, Whenever I try to upgrade an agent via fleet it fails with the following; \[elastic\_agent\]\[error\] failed to dispatch actions, error: failed upgrade of agent binary: 2 errors occurred: \* package 'C:\\Program Files\\El… --- ## [Constant increase in RAM location for Elasticsearch](https://discuss.elastic.co/t/constant-increase-in-ram-location-for-elasticsearch/275128)
**Author:** [@kaerhick.networker](https://discuss.elastic.co/u/kaerhick.networker)\ **Replies:** 5\ **Last updated:** [June 15, 2021, 7:52am UTC](https://discuss.elastic.co/t/constant-increase-in-ram-location-for-elasticsearch/275128 "2021-06-15T07:52:26Z")
Initially the application stated running on 1Gig or Ram, next day we upgraded to 2Gig and then 4GB and still continues to consume more and more RAM over time. All it was indexing is just a 32.4 MB worth of data all toge… --- ## [Tryining to get float number in scripted filed](https://discuss.elastic.co/t/tryining-to-get-float-number-in-scripted-filed/275895)
**Author:** [@dontAskToAsk](https://discuss.elastic.co/u/dontAskToAsk)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 7:50am UTC](https://discuss.elastic.co/t/tryining-to-get-float-number-in-scripted-filed/275895 "2021-06-15T07:50:36Z")
hey I am tried to run this command in a scripted filed if (doc\['tunnels\_map.rx\_stats.counters.packets\_lost'\].size() != 0 && doc\['tunnels\_map.rx\_stats.counters.packets'\].size() != 0) {doc\['tunnels\_map.rx\_stats.counters.… --- ## [Vega Error](https://discuss.elastic.co/t/vega-error/275584)
**Author:** [@Krunal](https://discuss.elastic.co/u/Krunal)\ **Replies:** 5\ **Last updated:** [June 15, 2021, 7:50am UTC](https://discuss.elastic.co/t/vega-error/275584 "2021-06-15T07:50:29Z")
Hello expert, Vega Graph is working perfectly, but getting 0 at x-axis ... why 0 ? { "$schema": "https://vega.github.io/schema/vega-lite/v5.json", "title": "Difference par Jour", "data": { "url": { "… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1365) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1367)