# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1403 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1404 --- ## [Getting Error - ORA-00000: DPI-1047: Cannot locate a 64-bit Oracle Client library: "libclntsh.so: cannot open shared object file: No such file or directory elastc](https://discuss.elastic.co/t/getting-error-ora-00000-dpi-1047-cannot-locate-a-64-bit-oracle-client-library-libclntsh-so-cannot-open-shared-object-file-no-such-file-or-directory-elastc/273754)
**Author:** [@mrunalini](https://discuss.elastic.co/u/mrunalini)\ **Replies:** 0\ **Last updated:** [May 23, 2021, 7:58am UTC](https://discuss.elastic.co/t/getting-error-ora-00000-dpi-1047-cannot-locate-a-64-bit-oracle-client-library-libclntsh-so-cannot-open-shared-object-file-no-such-file-or-directory-elastc/273754 "2021-05-23T07:58:59Z")
HI Everyone, I am trying to connect Oracle DB via Metricbeat ,but getting error- ORA-00000: DPI-1047: Cannot locate a 64-bit Oracle Client library: "libclntsh.so: cannot open shared object file: No such file or directo… --- ## [Constant score + Fuzzy query issue](https://discuss.elastic.co/t/constant-score-fuzzy-query-issue/273779)
**Author:** [@jihyun\_ahn](https://discuss.elastic.co/u/jihyun_ahn)\ **Replies:** 0\ **Last updated:** [May 24, 2021, 3:52am UTC](https://discuss.elastic.co/t/constant-score-fuzzy-query-issue/273779 "2021-05-24T03:52:13Z")
We are using a constant score to ignore the distance score while using the Fuzzy Query. The result is successful. However, the difference between the CPU usage of Elasticsearch and the one used with the Constant score i… --- ## [Get Users API in CSV format?](https://discuss.elastic.co/t/get-users-api-in-csv-format/273773)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 2\ **Last updated:** [May 24, 2021, 3:51am UTC](https://discuss.elastic.co/t/get-users-api-in-csv-format/273773 "2021-05-24T03:51:05Z")
Hi All, Is there a way o get users list in a nicer format than JSON? CSV maybe? GET /\_security/user Cheers! --- ## [Convert Epoch to Date Histogram format on Kibana Dashboard](https://discuss.elastic.co/t/convert-epoch-to-date-histogram-format-on-kibana-dashboard/273743)
**Author:** [@singyuentang](https://discuss.elastic.co/u/singyuentang)\ **Replies:** 1\ **Last updated:** [May 24, 2021, 3:32am UTC](https://discuss.elastic.co/t/convert-epoch-to-date-histogram-format-on-kibana-dashboard/273743 "2021-05-24T03:32:13Z")
Hi, My input data into the ElasticSearch database is limited to epoch time. I need to display the data on the X-axis as date histogram format. Does anyone know how we can make this format conversion on the Kibana dashb… --- ## [\[Filebeat\]\[Fortinet Module\] Failed to parse field](https://discuss.elastic.co/t/filebeat-fortinet-module-failed-to-parse-field/273437)
**Author:** [@Danilo\_PC](https://discuss.elastic.co/u/Danilo_PC)\ **Replies:** 2\ **Last updated:** [May 24, 2021, 2:16am UTC](https://discuss.elastic.co/t/filebeat-fortinet-module-failed-to-parse-field/273437 "2021-05-24T02:16:25Z")
Hi, I'm running filebeat 7.12.1 receiving data from my Fortigate (FortiOS v6.4.1 build1637). Looking at filebeat log files, I can see that there is happening and parse error on "fortinet.firewall.cat" field: May 19 12:… --- ## [filebeat+logstash,The number of output events per second cannot break the hard limit (CPU and memory are sufficient)](https://discuss.elastic.co/t/filebeat-logstash-the-number-of-output-events-per-second-cannot-break-the-hard-limit-cpu-and-memory-are-sufficient/273596)
**Author:** [@liuliugang](https://discuss.elastic.co/u/liuliugang)\ **Replies:** 3\ **Last updated:** [May 24, 2021, 1:13am UTC](https://discuss.elastic.co/t/filebeat-logstash-the-number-of-output-events-per-second-cannot-break-the-hard-limit-cpu-and-memory-are-sufficient/273596 "2021-05-24T01:13:59Z")
FileBeat configuration :2 core 8G Logstahs configuration :8 core 8G FileBeat version and Logstash version 7.10.0 Single node FileBeat sends log to Logstash. The number of data per second is fixed and cannot break the 6… --- ## [Logstash Regex](https://discuss.elastic.co/t/logstash-regex/273700)
**Author:** [@pmorenosi](https://discuss.elastic.co/u/pmorenosi)\ **Replies:** 1\ **Last updated:** [May 21, 2021, 10:05pm UTC](https://discuss.elastic.co/t/logstash-regex/273700 "2021-05-21T22:05:36Z")
Hello everybody, in a logstash pipeline I am doing the following "if" if \[message\] = ~ /^postfix.\*/anvil$/ { match =\> \["message", "% {POSTFIX\_ANVIL} $"\] } LOG May 11 05:49:37 smtp postfix / anvil \[27651\]: statistics… --- ## [Stashing your first event assistance](https://discuss.elastic.co/t/stashing-your-first-event-assistance/273769)
**Author:** [@jasieltego](https://discuss.elastic.co/u/jasieltego)\ **Replies:** 2\ **Last updated:** [May 23, 2021, 7:34pm UTC](https://discuss.elastic.co/t/stashing-your-first-event-assistance/273769 "2021-05-23T19:34:22Z")
Hi All, I'm following the guide to stash first event, but I'm getting an error message in the command line when verifying logstash installation. I can CD to logstash directory but it's when I specify configuration from … --- ## [Logstash not working in docker](https://discuss.elastic.co/t/logstash-not-working-in-docker/273748)
**Author:** [@Shubham\_Pachpande](https://discuss.elastic.co/u/Shubham_Pachpande)\ **Replies:** 1\ **Last updated:** [May 23, 2021, 7:15pm UTC](https://discuss.elastic.co/t/logstash-not-working-in-docker/273748 "2021-05-23T19:15:09Z")
Using bundled JDK: /usr/share/logstash/jdk OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release. Sending Logstash logs to /usr/share/l… --- ## [How to send ingest pipeline output to a index alias name](https://discuss.elastic.co/t/how-to-send-ingest-pipeline-output-to-a-index-alias-name/273697)
**Author:** [@Kannappan\_Somu](https://discuss.elastic.co/u/Kannappan_Somu)\ **Replies:** 11\ **Last updated:** [May 23, 2021, 2:26pm UTC](https://discuss.elastic.co/t/how-to-send-ingest-pipeline-output-to-a-index-alias-name/273697 "2021-05-23T14:26:15Z")
Hi , I am trying to send ingest pipeline output to a index alias name , so that the index rollovers correctly. what is the required processor or how do we do this ? --- ## [Is it possible to use field exists Canvas essql?](https://discuss.elastic.co/t/is-it-possible-to-use-field-exists-canvas-essql/273624)
**Author:** [@thirukumaran09](https://discuss.elastic.co/u/thirukumaran09)\ **Replies:** 2\ **Last updated:** [May 23, 2021, 2:02pm UTC](https://discuss.elastic.co/t/is-it-possible-to-use-field-exists-canvas-essql/273624 "2021-05-23T14:02:46Z")
Hi! I am trying to use Canvas to build a Dashboard to show the Metrics based on certain field availability. Is it possible to use the exists function in essql? Or is there any alternative functions available to execut… --- ## [Where does the documents and segments are present in the system](https://discuss.elastic.co/t/where-does-the-documents-and-segments-are-present-in-the-system/273756)
**Author:** [@surya3](https://discuss.elastic.co/u/surya3)\ **Replies:** 1\ **Last updated:** [May 23, 2021, 1:50pm UTC](https://discuss.elastic.co/t/where-does-the-documents-and-segments-are-present-in-the-system/273756 "2021-05-23T13:50:22Z")
Hi team, I got one doubt while I was exploring on how documents are retrieved based on the search query. Then I came to know that the search query will be given to the shards in the cluster of the nodes by the one of th… --- ## [Visual Builder \> Removing Axis Min and Axis Max sets min=0 max=1](https://discuss.elastic.co/t/visual-builder-removing-axis-min-and-axis-max-sets-min-0-max-1/273647)
**Author:** [@Ludek\_Sanda](https://discuss.elastic.co/u/Ludek_Sanda)\ **Replies:** 2\ **Last updated:** [May 23, 2021, 9:46am UTC](https://discuss.elastic.co/t/visual-builder-removing-axis-min-and-axis-max-sets-min-0-max-1/273647 "2021-05-23T09:46:41Z")
There seems to be a bug that when you remove the Axis Min and Axis Max in VB it's set to 0-1. After setting the Separate axis = F the min/max is set based on the data correctly, but setting Separate axis = T back will b… --- ## [What is the need of installing Nginix while installing elastic search and kibana](https://discuss.elastic.co/t/what-is-the-need-of-installing-nginix-while-installing-elastic-search-and-kibana/272486)
**Author:** [@surya3](https://discuss.elastic.co/u/surya3)\ **Replies:** 3\ **Last updated:** [May 23, 2021, 8:00am UTC](https://discuss.elastic.co/t/what-is-the-need-of-installing-nginix-while-installing-elastic-search-and-kibana/272486 "2021-05-23T08:00:56Z")
Hi Team, Recently i followed some tutorials on the installation of elastic search and kibana. Some of them are installing Nginx along with elastic search and kibana. What is the need for installing Nginx? How does it … --- ## [What is the difference between fields pass by filebeat and fields in logstash?](https://discuss.elastic.co/t/what-is-the-difference-between-fields-pass-by-filebeat-and-fields-in-logstash/273727)
**Author:** [@stille](https://discuss.elastic.co/u/stille)\ **Replies:** 5\ **Last updated:** [May 23, 2021, 3:37am UTC](https://discuss.elastic.co/t/what-is-the-difference-between-fields-pass-by-filebeat-and-fields-in-logstash/273727 "2021-05-23T03:37:35Z")
I'm a new guy about elk. i'm trying use logstash filter instead of filebeat processors. There are some fields passed by filebeat in logstash , for example: i had set some fields in filebeat: "fields.app"="nginx" or "do… --- ## [Parse subdomain from fqdn in logstash](https://discuss.elastic.co/t/parse-subdomain-from-fqdn-in-logstash/273535)
**Author:** [@tushar.bansal](https://discuss.elastic.co/u/tushar.bansal)\ **Replies:** 6\ **Last updated:** [May 22, 2021, 11:45pm UTC](https://discuss.elastic.co/t/parse-subdomain-from-fqdn-in-logstash/273535 "2021-05-22T23:45:16Z")
Hi, I have several events coming in logstash with info of web link accessed. example: DNS query is called for the name crl.sectigo.com, type 28 DNS query is called for the name repo.maven.apache.org, type 2 DNS quer… --- ## [How to use if condition to filter spider event gracefully in logstash](https://discuss.elastic.co/t/how-to-use-if-condition-to-filter-spider-event-gracefully-in-logstash/273606)
**Author:** [@stille](https://discuss.elastic.co/u/stille)\ **Replies:** 6\ **Last updated:** [May 22, 2021, 11:39pm UTC](https://discuss.elastic.co/t/how-to-use-if-condition-to-filter-spider-event-gracefully-in-logstash/273606 "2021-05-22T23:39:29Z")
I can use drop event in filebeat to filter spider logs , just like following: - drop\_event: when: or: - contains: message: FacebookBot - contains: message… --- ## [Failed to start elastic search](https://discuss.elastic.co/t/failed-to-start-elastic-search/273323)
**Author:** [@cedler](https://discuss.elastic.co/u/cedler)\ **Replies:** 18\ **Last updated:** [May 22, 2021, 10:27pm UTC](https://discuss.elastic.co/t/failed-to-start-elastic-search/273323 "2021-05-22T22:27:36Z")
Good evening, all seems ok, I have installed java 11, etc... But when I want to start the service I have somes errors... I put you the commandes and answers in putty : \[root@ortie-bio ~\]# systemctl start elasticsearch… --- ## [Could not locate that index-pattern-field (id: @timestamp)](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-timestamp/273737)
**Author:** [@majidbarz](https://discuss.elastic.co/u/majidbarz)\ **Replies:** 3\ **Last updated:** [May 22, 2021, 6:43pm UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-timestamp/273737 "2021-05-22T18:43:14Z")
anyone can help me? Error: Could not locate that index-pattern-field (id: @timestamp) at FieldParamType.deserialize (http://192.168.226.11:5601/39457/bundles/plugin/data/data.plugin.js:1:535357) at http://192.168.226.… --- ## [Can't got actual data size and documents](https://discuss.elastic.co/t/cant-got-actual-data-size-and-documents/273714)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 5\ **Last updated:** [May 22, 2021, 3:02pm UTC](https://discuss.elastic.co/t/cant-got-actual-data-size-and-documents/273714 "2021-05-22T15:02:33Z")
I was reindexing one index but while using the reindex api the size of the previous index and new index is not same. source index GET /\_cat/indices/log-test1?v&pretty health status index uuid pri… --- ## [Logstash input/ouput elasticsearch plugin capped performances](https://discuss.elastic.co/t/logstash-input-ouput-elasticsearch-plugin-capped-performances/273686)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 5\ **Last updated:** [May 22, 2021, 11:55am UTC](https://discuss.elastic.co/t/logstash-input-ouput-elasticsearch-plugin-capped-performances/273686 "2021-05-22T11:55:22Z")
Hey There, inside a Logstash pipeline I was using both input and output elasticsearch plugin. Taking a look to Stack monitoring I saw that Event Received Rate (/s) and Event Emitted Rate (/s) are capped to 4000 events/… --- ## [Gradually introducing a portion of traffic to a new logstash configuration](https://discuss.elastic.co/t/gradually-introducing-a-portion-of-traffic-to-a-new-logstash-configuration/273603)
**Author:** [@cknz](https://discuss.elastic.co/u/cknz)\ **Replies:** 2\ **Last updated:** [May 22, 2021, 10:35am UTC](https://discuss.elastic.co/t/gradually-introducing-a-portion-of-traffic-to-a-new-logstash-configuration/273603 "2021-05-22T10:35:04Z")
Hi all, my colleague and I have been working on using the memcached filter plugin. We've got memcached fed with a inventory data about our various network equipment. The goal: I want to label all syslog traffic from our… --- ## [XMLHttpRequest error for flutter web requests (chrome)?](https://discuss.elastic.co/t/xmlhttprequest-error-for-flutter-web-requests-chrome/273715)
**Author:** [@sabetai](https://discuss.elastic.co/u/sabetai)\ **Replies:** 0\ **Last updated:** [May 22, 2021, 5:09am UTC](https://discuss.elastic.co/t/xmlhttprequest-error-for-flutter-web-requests-chrome/273715 "2021-05-22T05:09:07Z")
http requests to elasticsearch work when I debug my app for android/ios, but not for web (through chrome). Are there headers or server-side permissions I'm missing to make http requests through a browser? --- ## [LogStash conf file help](https://discuss.elastic.co/t/logstash-conf-file-help/273705)
**Author:** [@jasieltego](https://discuss.elastic.co/u/jasieltego)\ **Replies:** 6\ **Last updated:** [May 22, 2021, 1:19am UTC](https://discuss.elastic.co/t/logstash-conf-file-help/273705 "2021-05-22T01:19:43Z")
Hi, I have created a logstash conf file. It's just bare bones, trying to get the service up and running so I can practice on my PC. This is what's in the file. \`input { \`stdin {} \`} \`output{ \`elasticsearch { hosts… --- ## [ERROR instance/beat.go:971 Exiting: error initializing processors: unexpected expand\_keys option in processors.1.decode\_json\_fields](https://discuss.elastic.co/t/error-instance-beat-go-971-exiting-error-initializing-processors-unexpected-expand-keys-option-in-processors-1-decode-json-fields/271986)
**Author:** [@NiamhAsura](https://discuss.elastic.co/u/NiamhAsura)\ **Replies:** 4\ **Last updated:** [May 22, 2021, 12:35am UTC](https://discuss.elastic.co/t/error-instance-beat-go-971-exiting-error-initializing-processors-unexpected-expand-keys-option-in-processors-1-decode-json-fields/271986 "2021-05-22T00:35:57Z")
Hi, I am trying to use the expand\_keys option as specified in the configuration for decode\_json\_fields. I am getting the following error: ERROR instance/beat.go:971 Exiting: error initializing processors: unexpec… --- ## [Unable to escape special character ""](https://discuss.elastic.co/t/unable-to-escape-special-character/273474)
**Author:** [@ravi-shanker](https://discuss.elastic.co/u/ravi-shanker)\ **Replies:** 9\ **Last updated:** [May 22, 2021, 12:03am UTC](https://discuss.elastic.co/t/unable-to-escape-special-character/273474 "2021-05-22T00:03:32Z")
I am trying to index my data into elasticsearch cluster through logstash. Currently my data is in aws postgres and i have to move data from postgres to elasticsearch. Below is my logstash config file: input { jdbc { … --- ## [Indexing after merging data from 2 tables from 2 different postgres db](https://discuss.elastic.co/t/indexing-after-merging-data-from-2-tables-from-2-different-postgres-db/273658)
**Author:** [@ravi-shanker](https://discuss.elastic.co/u/ravi-shanker)\ **Replies:** 0\ **Last updated:** [May 21, 2021, 11:48am UTC](https://discuss.elastic.co/t/indexing-after-merging-data-from-2-tables-from-2-different-postgres-db/273658 "2021-05-21T11:48:12Z")
Dear ELK User's Could you please guide me on how to approach the below requirement. -- There are two tables in two different postgres db say db1 (table1) and db2 (table2). -- There is one column in table1 which has 14… --- ## [Heatmap is hiding empty rows](https://discuss.elastic.co/t/heatmap-is-hiding-empty-rows/272938)
**Author:** [@gelfert](https://discuss.elastic.co/u/gelfert)\ **Replies:** 4\ **Last updated:** [May 21, 2021, 10:59pm UTC](https://discuss.elastic.co/t/heatmap-is-hiding-empty-rows/272938 "2021-05-21T22:59:48Z")
I am trying to create a heatmap on a numeric field over some time period, using the aggregation based tool. After selecting "Value: count", I create the y-axis histogram. I select "show empty buckets" and I get a bunch … --- ## [Updated field using mapping API does not show in index pattern](https://discuss.elastic.co/t/updated-field-using-mapping-api-does-not-show-in-index-pattern/273708)
**Author:** [@Terry\_Tuna](https://discuss.elastic.co/u/Terry_Tuna)\ **Replies:** 0\ **Last updated:** [May 21, 2021, 10:35pm UTC](https://discuss.elastic.co/t/updated-field-using-mapping-api-does-not-show-in-index-pattern/273708 "2021-05-21T22:35:56Z")
Hi, I'm using the mapping API to add a field onto my functionbeat index, named message\_visual, which is shown when I made a GET request of the mapping. But the index doesn't show up when I try to look for it on my i… --- ## [Parse logs](https://discuss.elastic.co/t/parse-logs/273706)
**Author:** [@sergio\_junior](https://discuss.elastic.co/u/sergio_junior)\ **Replies:** 1\ **Last updated:** [May 21, 2021, 10:06pm UTC](https://discuss.elastic.co/t/parse-logs/273706 "2021-05-21T22:06:12Z")
hello guys, i need help. I am trying to separate these values ​​from within the message {"message": "File accessed: \\" / Photos / Readme.md \\ "", "@ version": "1", "tags": \["beats\_input\_codec\_plain\_applied", "\_ jsonpar… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1402) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1404)