# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1392 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1393 --- ## [Fleet Server installation options](https://discuss.elastic.co/t/fleet-server-installation-options/274261)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 4\ **Last updated:** [May 31, 2021, 6:29am UTC](https://discuss.elastic.co/t/fleet-server-installation-options/274261 "2021-05-31T06:29:59Z")
Hey, currently, the only way to install fleet server is using a subprocess of elastic agent. This is very weird to me - Elastic Agent is a client component, and Fleet Server is an infrastructure component. I typically … --- ## [All fields should at least contain one term and all terms should be present](https://discuss.elastic.co/t/all-fields-should-at-least-contain-one-term-and-all-terms-should-be-present/272426)
**Author:** [@My-project-repositor](https://discuss.elastic.co/u/My-project-repositor)\ **Replies:** 6\ **Last updated:** [May 31, 2021, 5:43am UTC](https://discuss.elastic.co/t/all-fields-should-at-least-contain-one-term-and-all-terms-should-be-present/272426 "2021-05-31T05:43:47Z")
Hello, How can I query documents where all fields should at least contain one term and all terms should be present ? Suppose I have this index PUT /test\_query { "mappings": { "properties": { "firstname": { … --- ## [I want to save all \_grokparsefailure entries in a file to review them later, however](https://discuss.elastic.co/t/i-want-to-save-all-grokparsefailure-entries-in-a-file-to-review-them-later-however/273477)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 5\ **Last updated:** [May 31, 2021, 5:22am UTC](https://discuss.elastic.co/t/i-want-to-save-all-grokparsefailure-entries-in-a-file-to-review-them-later-however/273477 "2021-05-31T05:22:17Z")
My output configuration portion: if "\_grokparsefailure" in \[tags\] { file { path =\> "/home/myaccount/testfolder/grokfailures" file\_mode =\> 0600 } } else { file { path =\> "/home/myaccount/testfolder/groksuccess" … --- ## [Kibana is not acessible locally](https://discuss.elastic.co/t/kibana-is-not-acessible-locally/274397)
**Author:** [@hulkbuster](https://discuss.elastic.co/u/hulkbuster)\ **Replies:** 2\ **Last updated:** [May 30, 2021, 11:34pm UTC](https://discuss.elastic.co/t/kibana-is-not-acessible-locally/274397 "2021-05-30T23:34:03Z")
Hello! I'm new to Kibana and trying to setup Elastic Stack locally following this tutorial: https://www.rosehosting.com/blog/how-to-install-elk-stack-on-ubuntu-20-04/ All systemd services are running, but Kibana is not… --- ## [Updating from 7.10 to 7.13](https://discuss.elastic.co/t/updating-from-7-10-to-7-13/274163)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 3\ **Last updated:** [May 30, 2021, 10:11pm UTC](https://discuss.elastic.co/t/updating-from-7-10-to-7-13/274163 "2021-05-30T22:11:18Z")
Hi, I have a single node environment: On Server: Elasticsearch 7.10 Kibana 7.10 logstash 7.10 On Clients: packetbeat and winlogbeat both 7.10 versions. 1- How can I update to the latest version? Is there a single w… --- ## [Is there a way to exclude unwanted lines into one event with logstash](https://discuss.elastic.co/t/is-there-a-way-to-exclude-unwanted-lines-into-one-event-with-logstash/274309)
**Author:** [@syrine\_chelly](https://discuss.elastic.co/u/syrine_chelly)\ **Replies:** 3\ **Last updated:** [May 30, 2021, 5:13pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-exclude-unwanted-lines-into-one-event-with-logstash/274309 "2021-05-30T17:13:58Z")
i want to delete certain lines in the messsage field using logstash .I don't want to drop the field just extra lines in the field. is it possible ? --- ## [Filebeat dissect processor does nothing](https://discuss.elastic.co/t/filebeat-dissect-processor-does-nothing/274438)
**Author:** [@IvanovOleg](https://discuss.elastic.co/u/IvanovOleg)\ **Replies:** 0\ **Last updated:** [May 30, 2021, 3:52pm UTC](https://discuss.elastic.co/t/filebeat-dissect-processor-does-nothing/274438 "2021-05-30T15:52:11Z")
Hello. I want to parse logs from the java app running in the kubernetes pod. I have a filebeat configuration like this: filebeat.autodiscover: providers: - type: kubernetes templates: - condition.or:… --- ## [Aggregation on time series data (metricbeat and TSVB)](https://discuss.elastic.co/t/aggregation-on-time-series-data-metricbeat-and-tsvb/273455)
**Author:** [@zvazquez](https://discuss.elastic.co/u/zvazquez)\ **Replies:** 4\ **Last updated:** [May 30, 2021, 2:27pm UTC](https://discuss.elastic.co/t/aggregation-on-time-series-data-metricbeat-and-tsvb/273455 "2021-05-30T14:27:54Z")
Hi all, The scenarios is as follow: We are using metricbeat to capture metrics from multiple Kubernetes clusters into a single Elasticsearch cluster, we have enriched the data by adding a label using the processor, by … --- ## [Reindex API for split a field](https://discuss.elastic.co/t/reindex-api-for-split-a-field/274012)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 3\ **Last updated:** [May 30, 2021, 6:29am UTC](https://discuss.elastic.co/t/reindex-api-for-split-a-field/274012 "2021-05-30T06:29:15Z")
Hi I've created an index template, and now trying to reindex my logs according to that index template. This is a log just for instance: "\_score": null, "\_source": { "@timestamp": "2021-05-25T08:38:36", "ho… --- ## [File structure cannot be determined. illegal\_argument\_exception](https://discuss.elastic.co/t/file-structure-cannot-be-determined-illegal-argument-exception/273858)
**Author:** [@Muhammad\_Uxman](https://discuss.elastic.co/u/Muhammad_Uxman)\ **Replies:** 2\ **Last updated:** [May 30, 2021, 6:01am UTC](https://discuss.elastic.co/t/file-structure-cannot-be-determined-illegal-argument-exception/273858 "2021-05-30T06:01:08Z")
Hi Elastic Community, I am new to Kibana and Elastic. I am following the official Elastic tutorial. In the demonstration, a file was uploaded to Data Visualizer, which was analyzed successfully, but I got the following… --- ## [I am Trying to use logstash oss 7.9.1 to push csv files into Open Distro Elasticsearch 1.13.2](https://discuss.elastic.co/t/i-am-trying-to-use-logstash-oss-7-9-1-to-push-csv-files-into-open-distro-elasticsearch-1-13-2/274411)
**Author:** [@aswanth\_jabba](https://discuss.elastic.co/u/aswanth_jabba)\ **Replies:** 1\ **Last updated:** [May 30, 2021, 4:06am UTC](https://discuss.elastic.co/t/i-am-trying-to-use-logstash-oss-7-9-1-to-push-csv-files-into-open-distro-elasticsearch-1-13-2/274411 "2021-05-30T04:06:06Z")
Please suggest me with version combabilities, I am not sure if thats the case of my errors When I try to run logstash i get these errors \[2021-05-30T03:34:51,112\]\[WARN \]\[logstash.config.source.multilocal\] Ignoring the … --- ## ["Key" and "docCount" are missing when serializing BucketAggregate to string with Nest client](https://discuss.elastic.co/t/key-and-doccount-are-missing-when-serializing-bucketaggregate-to-string-with-nest-client/274389)
**Author:** [@jthoni](https://discuss.elastic.co/u/jthoni)\ **Replies:** 3\ **Last updated:** [May 30, 2021, 3:42am UTC](https://discuss.elastic.co/t/key-and-doccount-are-missing-when-serializing-bucketaggregate-to-string-with-nest-client/274389 "2021-05-30T03:42:57Z")
I am working on upgrading a service from ES 5.0 to 6.8. I have a bucket aggregate that in v5 serializes to this: "items": \[ { "key": "random+topic", "docCount": 27919, "aggreg… --- ## [Qradar Logs to Logstash/Elastic?](https://discuss.elastic.co/t/qradar-logs-to-logstash-elastic/274385)
**Author:** [@mohamed\_el\_mannouti](https://discuss.elastic.co/u/mohamed_el_mannouti)\ **Replies:** 3\ **Last updated:** [May 30, 2021, 12:58am UTC](https://discuss.elastic.co/t/qradar-logs-to-logstash-elastic/274385 "2021-05-30T00:58:02Z")
we have a Qradar SIEM which we plan to extend to Elastic for threat hunting(Log Forwarding from Qradar to Elastic) Has anyone found any success with it. Any known shortcomings/pitfalls from the setup. --- ## [Kibana | FATAL Error: HELP](https://discuss.elastic.co/t/kibana-fatal-error-help/274274)
**Author:** [@LombardoAndrea195](https://discuss.elastic.co/u/LombardoAndrea195)\ **Replies:** 6\ **Last updated:** [May 30, 2021, 12:09am UTC](https://discuss.elastic.co/t/kibana-fatal-error-help/274274 "2021-05-30T00:09:33Z")
Hi all I've obtained this error: I've created some plot through vega lite and when I execute again the script used for kibana I've this error but until some time before everthing works well. I've a node of kibana and a… --- ## [Filebeat not working](https://discuss.elastic.co/t/filebeat-not-working/274316)
**Author:** [@Drupad\_Soni](https://discuss.elastic.co/u/Drupad_Soni)\ **Replies:** 4\ **Last updated:** [May 29, 2021, 8:32pm UTC](https://discuss.elastic.co/t/filebeat-not-working/274316 "2021-05-29T20:32:24Z")
Filebeat not working ● filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch. Loaded: loaded (/lib/systemd/system/filebeat.service; disabled; vendor preset: enabled) Active: failed (Resu… --- ## [Configuration to process certain logs with pipeline using Autodiscover](https://discuss.elastic.co/t/configuration-to-process-certain-logs-with-pipeline-using-autodiscover/274407)
**Author:** [@zvazquez](https://discuss.elastic.co/u/zvazquez)\ **Replies:** 1\ **Last updated:** [May 29, 2021, 6:51pm UTC](https://discuss.elastic.co/t/configuration-to-process-certain-logs-with-pipeline-using-autodiscover/274407 "2021-05-29T18:51:49Z")
Hi, I have filebeats running on Kubernetes with the autodiscover option, I have Ambassador running on the K8 cluster among several other application and I am trying to process the logs for the Ambassador containers diff… --- ## [Backup (snapshot) strategy for a two data node cluster](https://discuss.elastic.co/t/backup-snapshot-strategy-for-a-two-data-node-cluster/274404)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 4\ **Last updated:** [May 29, 2021, 5:15pm UTC](https://discuss.elastic.co/t/backup-snapshot-strategy-for-a-two-data-node-cluster/274404 "2021-05-29T17:15:26Z")
Hello, I hope you and your loved ones are safe and healthy. I have a three node cluster with 2 data nodes and 1 voting node running Elastic Stack 7.13 on Ubuntu 20.04.2. All of the node are on a single physical worksta… --- ## [GROK errors](https://discuss.elastic.co/t/grok-errors/273973)
**Author:** [@NogNeetMachinaal](https://discuss.elastic.co/u/NogNeetMachinaal)\ **Replies:** 2\ **Last updated:** [May 29, 2021, 4:36pm UTC](https://discuss.elastic.co/t/grok-errors/273973 "2021-05-29T16:36:50Z")
Everyone, Below 2 lines of syslog messages: 2021-05-15T14:24:35.235Z - Omada\[Controller\] \[client:A6-09-A2-5A-31-E3\] was disconnected from network "LAN (default)" on \[osg:90-9A-4A-FD-0D-A5\](connected t\> 2021-05-15T14:24… --- ## [Duplication of data due to logstash configuration](https://discuss.elastic.co/t/duplication-of-data-due-to-logstash-configuration/274382)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 6\ **Last updated:** [May 29, 2021, 4:15pm UTC](https://discuss.elastic.co/t/duplication-of-data-due-to-logstash-configuration/274382 "2021-05-29T16:15:49Z")
Hello, I hope you and your loved ones are safe and healthy. I am suspecting multiple copies of the same data being created due to faulty logstash configuration. Here is the ingestion pipeline: Log files in JSON file … --- ## [NEST API for Snapshot and Restore](https://discuss.elastic.co/t/nest-api-for-snapshot-and-restore/273586)
**Author:** [@Abhishek\_Shinde](https://discuss.elastic.co/u/Abhishek_Shinde)\ **Replies:** 1\ **Last updated:** [May 29, 2021, 1:40pm UTC](https://discuss.elastic.co/t/nest-api-for-snapshot-and-restore/273586 "2021-05-29T13:40:56Z")
Hi Team, We are planning to integrate Elasticsearch in one of our Enterprise product for indexing and search purpose. Our application is on-prem software gets deployed at customer end on the windows machine. We are plan… --- ## [Snapshot](https://discuss.elastic.co/t/snapshot/273692)
**Author:** [@Abhishek\_Shinde](https://discuss.elastic.co/u/Abhishek_Shinde)\ **Replies:** 5\ **Last updated:** [May 29, 2021, 12:46pm UTC](https://discuss.elastic.co/t/snapshot/273692 "2021-05-29T12:46:26Z")
Hi team, is there any sizing guidelines for snapshots and restore? If I wanted take snapshot of upto 10 TB of indexing data. Is there any limitations on the number of CPU and memory for better performance? --- ## [Machine Configuration for elasticsearch as a database](https://discuss.elastic.co/t/machine-configuration-for-elasticsearch-as-a-database/273735)
**Author:** [@Anirudhan](https://discuss.elastic.co/u/Anirudhan)\ **Replies:** 2\ **Last updated:** [May 29, 2021, 11:33am UTC](https://discuss.elastic.co/t/machine-configuration-for-elasticsearch-as-a-database/273735 "2021-05-29T11:33:59Z")
Hi I am trying to move the SQL database into elasticsearch. Successfully flattened the data from SQL into elasticsearch. These is the details of the index which was created from SQL to elastic Doc'sCount : 49201833, S… --- ## [Logstash not starting with the error "error: jvm options parser failed; exiting"](https://discuss.elastic.co/t/logstash-not-starting-with-the-error-error-jvm-options-parser-failed-exiting/274393)
**Author:** [@Swaroop\_S](https://discuss.elastic.co/u/Swaroop_S)\ **Replies:** 1\ **Last updated:** [May 29, 2021, 8:44am UTC](https://discuss.elastic.co/t/logstash-not-starting-with-the-error-error-jvm-options-parser-failed-exiting/274393 "2021-05-29T08:44:51Z")
Hi All, I downloaded the logstash file and created the config file and I am trying to start the logstash with the command "logstash -f simple-config.conf" after navigating to bin folder in logstash. But I am getting err… --- ## [Index rotation](https://discuss.elastic.co/t/index-rotation/274150)
**Author:** [@humartinez](https://discuss.elastic.co/u/humartinez)\ **Replies:** 2\ **Last updated:** [May 29, 2021, 8:41am UTC](https://discuss.elastic.co/t/index-rotation/274150 "2021-05-29T08:41:54Z")
Hello, I would like to know if there is a way to rotate an index for a period of time. I have an app that writes to a fix ES index name and I need to to rotate the index lets say after one day "app-index-0001", the next… --- ## [Update API - Async on server-side](https://discuss.elastic.co/t/update-api-async-on-server-side/274388)
**Author:** [@Leuteris](https://discuss.elastic.co/u/Leuteris)\ **Replies:** 3\ **Last updated:** [May 29, 2021, 8:03am UTC](https://discuss.elastic.co/t/update-api-async-on-server-side/274388 "2021-05-29T08:03:23Z")
Is it possible to execute the following request asynchronously on the server side? POST test/\_update/1 { "script" : "ctx.\_source.new\_field = 'value\_of\_new\_field'" } By "server side", I mean server should write the re… --- ## [Calculs statistiques en pourcentage (turnover)](https://discuss.elastic.co/t/calculs-statistiques-en-pourcentage-turnover/273289)
**Author:** [@crigastel](https://discuss.elastic.co/u/crigastel)\ **Replies:** 4\ **Last updated:** [May 28, 2021, 10:34pm UTC](https://discuss.elastic.co/t/calculs-statistiques-en-pourcentage-turnover/273289 "2021-05-28T22:34:59Z")
Bonjour, Nous utilisons Kibana avec des données salariés (nom, prénom, date d'entrée, date de sortie, statut actif/inactif...). J'ai réussi à réaliser des indicateurs RH (répartition H/F, effectif par site, service, âg… --- ## [Search by all variants of a value](https://discuss.elastic.co/t/search-by-all-variants-of-a-value/274023)
**Author:** [@Carina\_Sirbu](https://discuss.elastic.co/u/Carina_Sirbu)\ **Replies:** 1\ **Last updated:** [May 28, 2021, 9:33pm UTC](https://discuss.elastic.co/t/search-by-all-variants-of-a-value/274023 "2021-05-28T21:33:49Z")
Hello, I have an application where the user can search for beauty products. Let's say the user wants to find all products from L'Oréal company. So when he goes to the search, he might type: LOREAL, L'OREAL, L'oreal, L'o… --- ## [Problem with fuction\_score and field\_value\_factor](https://discuss.elastic.co/t/problem-with-fuction-score-and-field-value-factor/274330)
**Author:** [@Biiru](https://discuss.elastic.co/u/Biiru)\ **Replies:** 1\ **Last updated:** [May 28, 2021, 9:17pm UTC](https://discuss.elastic.co/t/problem-with-fuction-score-and-field-value-factor/274330 "2021-05-28T21:17:49Z")
Hi all, I have a problem with a query GET score-score-score/\_search { "query": { "function\_score": { "query": { "bool": { "must": \[ {"term": { "validity": true }}, … --- ## [Metricbeat is not sending cluster\_stats for elasticsearch module](https://discuss.elastic.co/t/metricbeat-is-not-sending-cluster-stats-for-elasticsearch-module/274378)
**Author:** [@Cousin\_John](https://discuss.elastic.co/u/Cousin_John)\ **Replies:** 0\ **Last updated:** [May 28, 2021, 8:30pm UTC](https://discuss.elastic.co/t/metricbeat-is-not-sending-cluster-stats-for-elasticsearch-module/274378 "2021-05-28T20:30:57Z")
I am having the same issue as this closed post: I am trying to monitor our Elasticsearch cluster 2.x with metricbeat 7.7.1. Metricbeat is sending over the data for node, node\_stats but for some reason it's not sending … --- ## [Histogram hard\_bounds not working with min\_doc\_count=0 Kibana 7.10.2](https://discuss.elastic.co/t/histogram-hard-bounds-not-working-with-min-doc-count-0-kibana-7-10-2/274375)
**Author:** [@ssimmons](https://discuss.elastic.co/u/ssimmons)\ **Replies:** 1\ **Last updated:** [May 28, 2021, 8:18pm UTC](https://discuss.elastic.co/t/histogram-hard-bounds-not-working-with-min-doc-count-0-kibana-7-10-2/274375 "2021-05-28T20:18:37Z")
I'm creating a histogram and running into issues where extended\_bounds is pulling back a lot more buckets than it should. The upper and low bounds of the histogram can vary dramatically in my plugin and the interval size… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1391) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1393)