# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1388 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1389 --- ## [Elasticsearch 7.13 | Error deleting field mapping script, cluster return red state](https://discuss.elastic.co/t/elasticsearch-7-13-error-deleting-field-mapping-script-cluster-return-red-state/274655)
**Author:** [@joao](https://discuss.elastic.co/u/joao)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 2:48pm UTC](https://discuss.elastic.co/t/elasticsearch-7-13-error-deleting-field-mapping-script-cluster-return-red-state/274655 "2021-06-01T14:48:33Z")
Hi, I've been testing the new features in the Elasticsearch 7.13, and I have a problem to deleting a field mapping script. This is my mapping: PUT runtime\_2\_indexed\_field { "mappings": { "propert… --- ## [Add a field depending on first log](https://discuss.elastic.co/t/add-a-field-depending-on-first-log/274653)
**Author:** [@A\_Chichi](https://discuss.elastic.co/u/A_Chichi)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 2:37pm UTC](https://discuss.elastic.co/t/add-a-field-depending-on-first-log/274653 "2021-06-01T14:37:14Z")
Hello, I would like to add a field in my logstash pipeline. But this field would be a dynamic field. Here is a sample of my file : date\_log;job\_id;service\_id;name;progress;status;duration 2021-06-01 16:16:03;nJzP4g;7… --- ## [Elasticsearch seems not to receive logs from logstash](https://discuss.elastic.co/t/elasticsearch-seems-not-to-receive-logs-from-logstash/274648)
**Author:** [@gisellecarballo](https://discuss.elastic.co/u/gisellecarballo)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 2:20pm UTC](https://discuss.elastic.co/t/elasticsearch-seems-not-to-receive-logs-from-logstash/274648 "2021-06-01T14:20:59Z")
Hi, anyone help me sort out why elasticsearch seems not to receive logs from logstash. I am new to ELK. here is my config so far. TIA /etc/elasticsearch/elasticsearch.yml network.host: 0.0.0.0 transport.host: localhos… --- ## [Json data ingested contains unicode data (xml)](https://discuss.elastic.co/t/json-data-ingested-contains-unicode-data-xml/274647)
**Author:** [@justroll](https://discuss.elastic.co/u/justroll)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 2:20pm UTC](https://discuss.elastic.co/t/json-data-ingested-contains-unicode-data-xml/274647 "2021-06-01T14:20:15Z")
Hi I'm a little bit puzzled .. We got logging coming from a k8s , it is logging in json to our elastic , the logging exposes a xml file in the message field, this is encoded in unicode like \ \ \ **Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 2:13pm UTC](https://discuss.elastic.co/t/could-i-get-per-process-read-write-diskio-using-metricbeat/274365 "2021-06-01T14:13:41Z") Currently metricbeat is only giving me this information "cgroup" =\> { "blkio" =\> { "id" =\> "ssh.service", "path" =\> "/system.slice/ssh.service", … --- ## [Unable to find valid certification path to requested target while trying to implement HTTPS](https://discuss.elastic.co/t/unable-to-find-valid-certification-path-to-requested-target-while-trying-to-implement-https/274644)
**Author:** [@riccardo\_centropaghe](https://discuss.elastic.co/u/riccardo_centropaghe)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 2:10pm UTC](https://discuss.elastic.co/t/unable-to-find-valid-certification-path-to-requested-target-while-trying-to-implement-https/274644 "2021-06-01T14:10:44Z")
Hi, I am using a ELK stack in docker for pfSense, from here GitHub - pfelk/docker: Deploy pfelk with docker-compose All went fine, I even implement https with my own domain certificate. Navigating on the KIBANA dashboar… --- ## [How to update the GeoIP Databases for Elastic Ingest Pipelines](https://discuss.elastic.co/t/how-to-update-the-geoip-databases-for-elastic-ingest-pipelines/274259)
**Author:** [@nverrill](https://discuss.elastic.co/u/nverrill)\ **Replies:** 4\ **Last updated:** [June 1, 2021, 2:05pm UTC](https://discuss.elastic.co/t/how-to-update-the-geoip-databases-for-elastic-ingest-pipelines/274259 "2021-06-01T14:05:44Z")
I've read up on the docs and current topics and haven't found how to properly update the GeoIP Databases that come with Elasticsearch for the Ingest Pipelines. I have downloaded the latest GeoLite2-Country.mmdb from Ma… --- ## [How to use mutate filter plugin in output](https://discuss.elastic.co/t/how-to-use-mutate-filter-plugin-in-output/274578)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 1:40pm UTC](https://discuss.elastic.co/t/how-to-use-mutate-filter-plugin-in-output/274578 "2021-06-01T13:40:36Z")
I have a logstash configuration. With that configuration logstash do some operation in filter and send outputs. Everything works well. I want one more elasticsearch output in same configuration file. I mean after parsin… --- ## [Ingest plugin context data](https://discuss.elastic.co/t/ingest-plugin-context-data/273788)
**Author:** [@nmalocic](https://discuss.elastic.co/u/nmalocic)\ **Replies:** 7\ **Last updated:** [June 1, 2021, 1:29pm UTC](https://discuss.elastic.co/t/ingest-plugin-context-data/273788 "2021-06-01T13:29:16Z")
Hi everyone, I am building ingest plugin, and I was wondering if there is any way to know index, or pipeline name from plugin? My idea is to enable users to have multiple configurations so this seems like easy solution… --- ## [Deliberately fail event in logstash to requeue it](https://discuss.elastic.co/t/deliberately-fail-event-in-logstash-to-requeue-it/274635)
**Author:** [@tumbledwyer](https://discuss.elastic.co/u/tumbledwyer)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 1:19pm UTC](https://discuss.elastic.co/t/deliberately-fail-event-in-logstash-to-requeue-it/274635 "2021-06-01T13:19:09Z")
Hi Is there a way to fail an event so that it can be requeued for processing later? Let's take this conf for example: input { pipeline { address =\> "previous-pipe" } } filter { elasticsearch { hosts =\> \[… --- ## [Logstash one to one mapping of two lines](https://discuss.elastic.co/t/logstash-one-to-one-mapping-of-two-lines/274634)
**Author:** [@Muhammad\_Faisal](https://discuss.elastic.co/u/Muhammad_Faisal)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 1:17pm UTC](https://discuss.elastic.co/t/logstash-one-to-one-mapping-of-two-lines/274634 "2021-06-01T13:17:15Z")
hi guys, how to do one to one mapping of below two lines - number of comma separated values in message and header fields can be dynamic but number of items in both fields will be same "message" =\> "error\_count,10,20,3… --- ## [Prefix field with specific index name while searching on multiple indices](https://discuss.elastic.co/t/prefix-field-with-specific-index-name-while-searching-on-multiple-indices/274628)
**Author:** [@Dgame](https://discuss.elastic.co/u/Dgame)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 12:14pm UTC](https://discuss.elastic.co/t/prefix-field-with-specific-index-name-while-searching-on-multiple-indices/274628 "2021-06-01T12:14:39Z")
Let's say I have two different indices (index\_a and index\_b) which both have different fields. For example index\_a has the field title and body and index\_b has only the field body. Now I'm searching like this: { "quer… --- ## [Splunk data to elasticsearch migration](https://discuss.elastic.co/t/splunk-data-to-elasticsearch-migration/274623)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 2\ **Last updated:** [June 1, 2021, 12:08pm UTC](https://discuss.elastic.co/t/splunk-data-to-elasticsearch-migration/274623 "2021-06-01T12:08:54Z")
Is there a way data from Splunk can be indexed into elasticserach considering few tens of TB of data? Is there any utility program which can be used to export data from splunk? Thanks. --- ## [Problem running logstash:7.13.0 on docker](https://discuss.elastic.co/t/problem-running-logstash-7-13-0-on-docker/274627)
**Author:** [@Jonas\_Forte](https://discuss.elastic.co/u/Jonas_Forte)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 12:05pm UTC](https://discuss.elastic.co/t/problem-running-logstash-7-13-0-on-docker/274627 "2021-06-01T12:05:34Z")
Hello everyone, I am having an error when running the logstash on the docker. I'm trying to run logstash on the docker with the following command: command: docker run --rm -it -v /usr/share/logstash/pipeline/logstash.… --- ## [Upgrade hardware size - Any downtime?](https://discuss.elastic.co/t/upgrade-hardware-size-any-downtime/274613)
**Author:** [@Cesidio\_DiBenedetto](https://discuss.elastic.co/u/Cesidio_DiBenedetto)\ **Replies:** 5\ **Last updated:** [June 1, 2021, 12:03pm UTC](https://discuss.elastic.co/t/upgrade-hardware-size-any-downtime/274613 "2021-06-01T12:03:38Z")
Will an upgrade in hardware size cause any downtime? --- ## [ILM: index not showing in Cold phase and Delete phase](https://discuss.elastic.co/t/ilm-index-not-showing-in-cold-phase-and-delete-phase/272289)
**Author:** [@neko](https://discuss.elastic.co/u/neko)\ **Replies:** 4\ **Last updated:** [June 1, 2021, 11:42am UTC](https://discuss.elastic.co/t/ilm-index-not-showing-in-cold-phase-and-delete-phase/272289 "2021-06-01T11:42:48Z")
Hi, I'm using Winlogbeat and i've defined a lifecycle with the following phases: Hot, Warm, Cold and Delete. In Index Management i have indices only for Hot and Warm phases. Could someone tell me what is wrong? Any he… --- ## [Packetbeat Service Stop Automatically Everyday](https://discuss.elastic.co/t/packetbeat-service-stop-automatically-everyday/274621)
**Author:** [@vivek2219](https://discuss.elastic.co/u/vivek2219)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 11:14am UTC](https://discuss.elastic.co/t/packetbeat-service-stop-automatically-everyday/274621 "2021-06-01T11:14:24Z")
Dear Team, As we check packetbeat service auto stop every day and we need to start it manually. There is no any issue it's working fine after restart/start. Not able to find any issue. please help to resolve this why… --- ## [Performance issues when returning many ids](https://discuss.elastic.co/t/performance-issues-when-returning-many-ids/274618)
**Author:** [@Kristian\_Andersen](https://discuss.elastic.co/u/Kristian_Andersen)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 10:52am UTC](https://discuss.elastic.co/t/performance-issues-when-returning-many-ids/274618 "2021-06-01T10:52:46Z")
Hello, I have a search index with 200.000 documents, and experience bad performance when performing searches that returns multiple results. Each document consists of 1040 fields all mapped as keywords. See filemapping … --- ## [Row encoding and autosize makes chart not appear](https://discuss.elastic.co/t/row-encoding-and-autosize-makes-chart-not-appear/274229)
**Author:** [@es\_net](https://discuss.elastic.co/u/es_net)\ **Replies:** 4\ **Last updated:** [June 1, 2021, 10:39am UTC](https://discuss.elastic.co/t/row-encoding-and-autosize-makes-chart-not-appear/274229 "2021-06-01T10:39:12Z")
Hi, I am attempting to make charts similar to Faceting a Plot into a Trellis Plot | Vega-Lite with multiple rows of charts, split using the row encoding. (The link above should go to the section titled ' Row Facet (with… --- ## [Could not find the logstash.yml](https://discuss.elastic.co/t/could-not-find-the-logstash-yml/274614)
**Author:** [@Kanishk\_Madan](https://discuss.elastic.co/u/Kanishk_Madan)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 10:35am UTC](https://discuss.elastic.co/t/could-not-find-the-logstash-yml/274614 "2021-06-01T10:35:53Z")
I have a problem when i run a file using this command :sudo /usr/share/logstash/bin/logstash -f /etc/logstash/logstash.conf It shows:- Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/… --- ## [Filebeat module system don't parse auth log](https://discuss.elastic.co/t/filebeat-module-system-dont-parse-auth-log/272801)
**Author:** [@beci](https://discuss.elastic.co/u/beci)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 10:04am UTC](https://discuss.elastic.co/t/filebeat-module-system-dont-parse-auth-log/272801 "2021-06-01T10:04:50Z")
Hello all, I am using Filebeat 7.12.1 with the system module The logs send in Elastic without problem, but some failed authentication logs from pam\_unix(sshd:auth) are not parsed. Do you know why? Thank you very m… --- ## [Remove drive letter from file path GROK pattern](https://discuss.elastic.co/t/remove-drive-letter-from-file-path-grok-pattern/274609)
**Author:** [@sam3546](https://discuss.elastic.co/u/sam3546)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 9:57am UTC](https://discuss.elastic.co/t/remove-drive-letter-from-file-path-grok-pattern/274609 "2021-06-01T09:57:00Z")
Im trying to remove the drive letter from file paths as they are ingested through the pipeline, my input is something like C:\\folder1\\folder2\\file.ext (This is just an example the file could be many more folders deep) … --- ## [Identify event fom JDBC input](https://discuss.elastic.co/t/identify-event-fom-jdbc-input/274607)
**Author:** [@Dzious](https://discuss.elastic.co/u/Dzious)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 9:36am UTC](https://discuss.elastic.co/t/identify-event-fom-jdbc-input/274607 "2021-06-01T09:36:08Z")
Hi, I'm currently having issues to identify my JDBC input from my beat input and all others. I'm quite new to using jdbc as input in logstash. I actually have a workflow where data from my beats go through a bunch of f… --- ## [Change value of @timestamp](https://discuss.elastic.co/t/change-value-of-timestamp/274343)
**Author:** [@mar-ro](https://discuss.elastic.co/u/mar-ro)\ **Replies:** 2\ **Last updated:** [June 1, 2021, 9:33am UTC](https://discuss.elastic.co/t/change-value-of-timestamp/274343 "2021-06-01T09:33:29Z")
Hello! How can I remplace the value of @timestamp with the value that I get with a regular expresion? I need change the value of @timestamp because when the data is indexed in elasticsearch it shows in this field the v… --- ## [Vega Visualization with nested Hashes](https://discuss.elastic.co/t/vega-visualization-with-nested-hashes/274604)
**Author:** [@etot94](https://discuss.elastic.co/u/etot94)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 9:28am UTC](https://discuss.elastic.co/t/vega-visualization-with-nested-hashes/274604 "2021-06-01T09:28:46Z")
Hello ES Team. :slight\_smile: I would like to visualize my data from ES with Vega-lite. My fields are: data\_field which is an array of nested hashes. data\_number which is just a number representing each of the data\_f… --- ## [Creating a pipeline which runs with particular interval on same index](https://discuss.elastic.co/t/creating-a-pipeline-which-runs-with-particular-interval-on-same-index/274584)
**Author:** [@aswanth\_jabba](https://discuss.elastic.co/u/aswanth_jabba)\ **Replies:** 6\ **Last updated:** [June 1, 2021, 9:22am UTC](https://discuss.elastic.co/t/creating-a-pipeline-which-runs-with-particular-interval-on-same-index/274584 "2021-06-01T09:22:45Z")
Can anyone please tell me, if this is possible ? I am trying to create a pipeline but I want it to run in particular intervals on the same index For example : { "description":"Find the Progress", "processors":\[ … --- ## [Count query is returning inaccurate results](https://discuss.elastic.co/t/count-query-is-returning-inaccurate-results/274436)
**Author:** [@kapso](https://discuss.elastic.co/u/kapso)\ **Replies:** 13\ **Last updated:** [June 1, 2021, 9:12am UTC](https://discuss.elastic.co/t/count-query-is-returning-inaccurate-results/274436 "2021-06-01T09:12:47Z")
Count query (filter term) is returning inaccurate results - \*/\_count We have tried to get the count using a regular search query using this approach - "size":0,"track\_total\_hits":true and the count is still inaccurate. … --- ## [Setting for alerts in elk](https://discuss.elastic.co/t/setting-for-alerts-in-elk/274489)
**Author:** [@varunbsgaur](https://discuss.elastic.co/u/varunbsgaur)\ **Replies:** 2\ **Last updated:** [June 1, 2021, 9:06am UTC](https://discuss.elastic.co/t/setting-for-alerts-in-elk/274489 "2021-06-01T09:06:31Z")
How to setup kibana and elasticsearch for alerts , involving the certificates and ca? --- ## [Kibana result machine learning job contain negative values](https://discuss.elastic.co/t/kibana-result-machine-learning-job-contain-negative-values/274525)
**Author:** [@Oskr](https://discuss.elastic.co/u/Oskr)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 8:52am UTC](https://discuss.elastic.co/t/kibana-result-machine-learning-job-contain-negative-values/274525 "2021-06-01T08:52:06Z")
Hi, I have a question about the results obtained when I run my machine learning job, when I check the anomalies I find that in typical values there are negative values but in my index I don't have negative values. Why … --- ## [Filter and return only specific fields using elasticsearch plugin with logstash](https://discuss.elastic.co/t/filter-and-return-only-specific-fields-using-elasticsearch-plugin-with-logstash/274599)
**Author:** [@Nico3](https://discuss.elastic.co/u/Nico3)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 8:51am UTC](https://discuss.elastic.co/t/filter-and-return-only-specific-fields-using-elasticsearch-plugin-with-logstash/274599 "2021-06-01T08:51:14Z")
Hello, I'm trying to create a pipeline with logstash in order to "extract" a specific metric from Elasticsearch (window\_cpu\_time\_total). Here is my pipeline: input { elasticsearch { hosts =\> \["http://localhos… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1387) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1389)