# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1429 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1430 --- ## [Mutate Convert not working as I expect](https://discuss.elastic.co/t/mutate-convert-not-working-as-i-expect/272133)
**Author:** [@lachlan.simpson](https://discuss.elastic.co/u/lachlan.simpson)\ **Replies:** 3\ **Last updated:** [May 5, 2021, 9:29am UTC](https://discuss.elastic.co/t/mutate-convert-not-working-as-i-expect/272133 "2021-05-05T09:29:15Z")
RHEL8.3, ELK 7.12.1, I am using convert as documented, but I just can't see what I've done wrong. Here's the filter, per the docs filter { if \[pbs\_accounting\] { csv { separator =\> ";" columns =\> \["da… --- ## [Default dashboard without field](https://discuss.elastic.co/t/default-dashboard-without-field/272083)
**Author:** [@graimato](https://discuss.elastic.co/u/graimato)\ **Replies:** 2\ **Last updated:** [May 5, 2021, 9:16am UTC](https://discuss.elastic.co/t/default-dashboard-without-field/272083 "2021-05-05T09:16:40Z")
Dear all, I'm collect data from Nginx, apache, linux SO, using metribeat, the data arrive in to the index and I use standard dashboard to graph the data, I'm changing the source data, as example changing the index and f… --- ## [Pipeline to pipeline communication](https://discuss.elastic.co/t/pipeline-to-pipeline-communication/272140)
**Author:** [@bdn](https://discuss.elastic.co/u/bdn)\ **Replies:** 2\ **Last updated:** [May 5, 2021, 9:12am UTC](https://discuss.elastic.co/t/pipeline-to-pipeline-communication/272140 "2021-05-05T09:12:21Z")
I have a requirement. Events will be listening on some TCP ports in Logstash. using a filter plugin I will extract the username field from the event. After that, I have to query another API server providing that username… --- ## [Does Filebeat take in logs missed when it is stopped?](https://discuss.elastic.co/t/does-filebeat-take-in-logs-missed-when-it-is-stopped/272130)
**Author:** [@shifenglim](https://discuss.elastic.co/u/shifenglim)\ **Replies:** 3\ **Last updated:** [May 5, 2021, 7:58am UTC](https://discuss.elastic.co/t/does-filebeat-take-in-logs-missed-when-it-is-stopped/272130 "2021-05-05T07:58:01Z")
I have filebeat 7.8.1 streaming logs to my elasticsearch via this setup Application -\> Logfile -\> Filebeat -\> Logstash -\> Elasticsearch The application team is concerned if Filebeat is down, it will cause logs to be mi… --- ## [Remove a key that starts with 0 to 9](https://discuss.elastic.co/t/remove-a-key-that-starts-with-0-to-9/272142)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 0\ **Last updated:** [May 5, 2021, 7:49am UTC](https://discuss.elastic.co/t/remove-a-key-that-starts-with-0-to-9/272142 "2021-05-05T07:49:54Z")
Hello team, I need to Remove a field that starts with an integer. I am using logstash & kv filter to parse this logs. Can you please help me. PFB sample log line: 2021-01-07 05:32:31,761 Method=get call SoapAction="Ri… --- ## [Slow ingestion speeds](https://discuss.elastic.co/t/slow-ingestion-speeds/271761)
**Author:** [@jamesm1](https://discuss.elastic.co/u/jamesm1)\ **Replies:** 7\ **Last updated:** [May 5, 2021, 7:48am UTC](https://discuss.elastic.co/t/slow-ingestion-speeds/271761 "2021-05-05T07:48:47Z")
Good Morning all, I have noticed that i appear to be having some ingestion speed issues... in a nut shell, if i look at historical data from a couple of hours ago and keep refreshing my screen, the amount of records inc… --- ## [Unable to authenticate user for REST request](https://discuss.elastic.co/t/unable-to-authenticate-user-for-rest-request/272116)
**Author:** [@Egid](https://discuss.elastic.co/u/Egid)\ **Replies:** 3\ **Last updated:** [May 5, 2021, 7:30am UTC](https://discuss.elastic.co/t/unable-to-authenticate-user-for-rest-request/272116 "2021-05-05T07:30:47Z")
Hi I am running the folowing comand: docker run -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" -e "ELASTICSEARCH\_USERNAME=egid" -e "ELASTICSEARCH\_PASSWORD=black" -e "xpack.security.enabled=true" docker.elast… --- ## [Directly accessing data from multiline log data](https://discuss.elastic.co/t/directly-accessing-data-from-multiline-log-data/272135)
**Author:** [@Learn\_Mulesoft\_With](https://discuss.elastic.co/u/Learn_Mulesoft_With)\ **Replies:** 0\ **Last updated:** [May 5, 2021, 5:50am UTC](https://discuss.elastic.co/t/directly-accessing-data-from-multiline-log-data/272135 "2021-05-05T05:50:52Z")
Hi Below is my sample plain text input to http input , is there any way in filter to directly jump to " Trace: " and then directly jump to "Error type" and retrieve value the part denoted by "XXX" is dynamic it will … --- ## [Logstash filter for muliple values not working](https://discuss.elastic.co/t/logstash-filter-for-muliple-values-not-working/272087)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 2\ **Last updated:** [May 5, 2021, 5:04am UTC](https://discuss.elastic.co/t/logstash-filter-for-muliple-values-not-working/272087 "2021-05-05T05:04:01Z")
Hi All, I am trying to remove message for few service tags, but I am facing below issue. Below is not working if \[SERVICE\] in \["GET", "UPDATE"\] { mutate { remove\_field =\> \["message"\] } } Below is working if "GET"… --- ## [Filebeat and Winlogbeat](https://discuss.elastic.co/t/filebeat-and-winlogbeat/271780)
**Author:** [@insurin](https://discuss.elastic.co/u/insurin)\ **Replies:** 6\ **Last updated:** [May 4, 2021, 11:48pm UTC](https://discuss.elastic.co/t/filebeat-and-winlogbeat/271780 "2021-05-04T23:48:41Z")
I am enrolling my Windows servers in Fleet on ELK 7.12. I can see lots of 'logs-\* via discover relating to these servers. Do I need to manually install winlogbeat and or filebeat in addition to what I already have. My c… --- ## [ES 7.11.2 / Kibana error : index has lifecycle error](https://discuss.elastic.co/t/es-7-11-2-kibana-error-index-has-lifecycle-error/272098)
**Author:** [@webfr](https://discuss.elastic.co/u/webfr)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 10:46pm UTC](https://discuss.elastic.co/t/es-7-11-2-kibana-error-index-has-lifecycle-error/272098 "2021-05-04T22:46:44Z")
Hello guys, could you help me please fixing this issue? Index lifecycle error illegal\_argument\_exception: setting \[index.lifecycle.rollover\_alias\] for index \[myindex\] is empty or not defined index setting: { "in… --- ## [Two nodes cluster questions](https://discuss.elastic.co/t/two-nodes-cluster-questions/272115)
**Author:** [@nuzolx](https://discuss.elastic.co/u/nuzolx)\ **Replies:** 2\ **Last updated:** [May 4, 2021, 9:06pm UTC](https://discuss.elastic.co/t/two-nodes-cluster-questions/272115 "2021-05-04T21:06:48Z")
Hi, I have a two nodes cluster in production. I know this not good but, right now, I cant afford a 3th node. I have read: Resilience in small clusters | Elasticsearch Guide \[7.12\] | Elastic For example node1 is maste… --- ## [Kibana Visualization with different database](https://discuss.elastic.co/t/kibana-visualization-with-different-database/272107)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 8:31pm UTC](https://discuss.elastic.co/t/kibana-visualization-with-different-database/272107 "2021-05-04T20:31:08Z")
Hi all, We basically use Elasticsearch as database for Kibana. Should we always import data to Elasticsearch? Is there any way in which Kibana can directly read data from a database such as MongoDB and able to visuali… --- ## [What is role of .apm index in kibana?](https://discuss.elastic.co/t/what-is-role-of-apm-index-in-kibana/272106)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 8:29pm UTC](https://discuss.elastic.co/t/what-is-role-of-apm-index-in-kibana/272106 "2021-05-04T20:29:39Z")
Hi, I see .apm index in my kibana indices list. What is .apm and what is its role? --- ## [Classes descontinuadas](https://discuss.elastic.co/t/classes-descontinuadas/272113)
**Author:** [@Jair\_Gomes](https://discuss.elastic.co/u/Jair_Gomes)\ **Replies:** 0\ **Last updated:** [May 4, 2021, 8:29pm UTC](https://discuss.elastic.co/t/classes-descontinuadas/272113 "2021-05-04T20:29:28Z")
Eu estou atualizando um antigo código de um modelo de ranqueamento que utiliza as antigas classes (Acredito que sejam classes das versões 2.X ou 5.X): import org.elasticsearch.action.fieldstats.FieldStats; import org.el… --- ## [Getting NaN in our data and its killing our C# code, but returns in Kibana?](https://discuss.elastic.co/t/getting-nan-in-our-data-and-its-killing-our-c-code-but-returns-in-kibana/272112)
**Author:** [@cis4life](https://discuss.elastic.co/u/cis4life)\ **Replies:** 0\ **Last updated:** [May 4, 2021, 8:10pm UTC](https://discuss.elastic.co/t/getting-nan-in-our-data-and-its-killing-our-c-code-but-returns-in-kibana/272112 "2021-05-04T20:10:26Z")
Good Day, Maybe you can help me with this. We have data being indexed into our system and appartantly there are times when there are sections of data that are not just there and may not be populated at certain times of… --- ## [Parsing Palo Alto System Logs with Date Filter](https://discuss.elastic.co/t/parsing-palo-alto-system-logs-with-date-filter/271836)
**Author:** [@6igwig](https://discuss.elastic.co/u/6igwig)\ **Replies:** 7\ **Last updated:** [May 4, 2021, 7:23pm UTC](https://discuss.elastic.co/t/parsing-palo-alto-system-logs-with-date-filter/271836 "2021-05-04T19:23:24Z")
I am trying to parse the Palo Alto System logs with logstash using the following dissect pattern inside a logstash filter: dissect { mapping =\> { "message" =\> '%{?date} %{?date} %{?date} %{?network} - %{?version},%{@… --- ## [Kibana 7.12 Login failure "Fleet"](https://discuss.elastic.co/t/kibana-7-12-login-failure-fleet/271285)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 2\ **Last updated:** [May 4, 2021, 7:07pm UTC](https://discuss.elastic.co/t/kibana-7-12-login-failure-fleet/271285 "2021-05-04T19:07:35Z")
Upgrading to 7.12 has been one nightmare after another. Been using fleet for "Endpoint" and so far it's been less then pleasant. Got to love Beta. Issue: Unable to login into Kibana with elastic user so you know this i… --- ## [Apply conditions in http monitor , heartbeat](https://discuss.elastic.co/t/apply-conditions-in-http-monitor-heartbeat/270587)
**Author:** [@Kartikey\_Bhatore](https://discuss.elastic.co/u/Kartikey_Bhatore)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 6:35pm UTC](https://discuss.elastic.co/t/apply-conditions-in-http-monitor-heartbeat/270587 "2021-05-04T18:35:06Z")
Hello , I am using heartbeat 6.5.3 Do we have a option to apply conditions at the time of http URL check. eg if URL1 is up then only check URL 2 , if URL2 status is also UP then only status : UP if URL1 is down then … --- ## [Nested Query: Nested document returns unmatched documents](https://discuss.elastic.co/t/nested-query-nested-document-returns-unmatched-documents/272096)
**Author:** [@tkumar](https://discuss.elastic.co/u/tkumar)\ **Replies:** 0\ **Last updated:** [May 4, 2021, 5:17pm UTC](https://discuss.elastic.co/t/nested-query-nested-document-returns-unmatched-documents/272096 "2021-05-04T17:17:23Z")
Hi - We have indexed the document using nested mapping and the document also created in nested format in the Elasticsearch. But while retrieving using nested query it also returns unmatched documents from both the datas… --- ## [Fleet Agents hitting 100% CPU usage](https://discuss.elastic.co/t/fleet-agents-hitting-100-cpu-usage/271529)
**Author:** [@MichaelHuff](https://discuss.elastic.co/u/MichaelHuff)\ **Replies:** 19\ **Last updated:** [May 4, 2021, 6:18pm UTC](https://discuss.elastic.co/t/fleet-agents-hitting-100-cpu-usage/271529 "2021-05-04T18:18:48Z")
We put the elastic-agent for fleet onto our VDI infrastructure. Each VDI machine started out with 2 vCPUs and 4 GB RAM. We installed the elastic-agent through fleet. The machine performed fine for a few hours then became… --- ## [Elasticsearch migrating from mesos container framework to K8s](https://discuss.elastic.co/t/elasticsearch-migrating-from-mesos-container-framework-to-k8s/272104)
**Author:** [@guthurti](https://discuss.elastic.co/u/guthurti)\ **Replies:** 0\ **Last updated:** [May 4, 2021, 6:15pm UTC](https://discuss.elastic.co/t/elasticsearch-migrating-from-mesos-container-framework-to-k8s/272104 "2021-05-04T18:15:54Z")
Team, Can you please someone suggest what is the best way to migrate Elasticsearch Mesos to k8s. I tried one solution but not succeeded, Mesos mount volume same as used k8s statefulset and pix-boot the nodes. I am not … --- ## [ES 7.12 - Java rest high level - multi\_terms aggregation - response error](https://discuss.elastic.co/t/es-7-12-java-rest-high-level-multi-terms-aggregation-response-error/272101)
**Author:** [@hikemachado](https://discuss.elastic.co/u/hikemachado)\ **Replies:** 0\ **Last updated:** [May 4, 2021, 5:57pm UTC](https://discuss.elastic.co/t/es-7-12-java-rest-high-level-multi-terms-aggregation-response-error/272101 "2021-05-04T17:57:01Z")
Hi there, I've a request using SearchTemplateRequest the request script uses "multi\_terms" aggregation I can see in the logs that the response comes as expected but the java rest high level throws an exception saying … --- ## [Fleet: Unable to decrypt attribute "fleet\_enroll\_username"](https://discuss.elastic.co/t/fleet-unable-to-decrypt-attribute-fleet-enroll-username/272082)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 4\ **Last updated:** [May 4, 2021, 6:05pm UTC](https://discuss.elastic.co/t/fleet-unable-to-decrypt-attribute-fleet-enroll-username/272082 "2021-05-04T18:05:57Z")
Hi All, I ran into this bug: Ingest Management: Failed to decrypt "fleet\_enroll\_username" attribute · Issue #68750 · elastic/kibana · GitHub, and was wondering if anyone knows how to fix this? The encryption key change… --- ## [Filebeat setup command can not find environment variables](https://discuss.elastic.co/t/filebeat-setup-command-can-not-find-environment-variables/271550)
**Author:** [@user8753123](https://discuss.elastic.co/u/user8753123)\ **Replies:** 2\ **Last updated:** [May 4, 2021, 5:45pm UTC](https://discuss.elastic.co/t/filebeat-setup-command-can-not-find-environment-variables/271550 "2021-05-04T17:45:48Z")
Hi there, I've read up a lot of the various posts on this topic but cannot seem to find something specific to my particular issue. I've got filebeat running on centos as a service with systemd as per the docs. I'm usin… --- ## [Logstash date filter, kibana index template warning in logs](https://discuss.elastic.co/t/logstash-date-filter-kibana-index-template-warning-in-logs/272094)
**Author:** [@wmei](https://discuss.elastic.co/u/wmei)\ **Replies:** 2\ **Last updated:** [May 4, 2021, 5:43pm UTC](https://discuss.elastic.co/t/logstash-date-filter-kibana-index-template-warning-in-logs/272094 "2021-05-04T17:43:23Z")
Hi, Original log, these dates are in the format 20210504-15:40:02.601 and I have a date filter to convert that in my logstash.yml. I am doing the same filter for both the SendingTime and the TransactTime. if \[layers\]\[f… --- ## [Failed to execute pipeline for a bulk request](https://discuss.elastic.co/t/failed-to-execute-pipeline-for-a-bulk-request/271290)
**Author:** [@lacarrillo](https://discuss.elastic.co/u/lacarrillo)\ **Replies:** 12\ **Last updated:** [May 4, 2021, 5:43pm UTC](https://discuss.elastic.co/t/failed-to-execute-pipeline-for-a-bulk-request/271290 "2021-05-04T17:43:20Z")
Hello everyone. I have a cluster with 20 data nodes with 4 CPU and 16 GB of RAM. I'm indexing in avg 300 million documents per day (500 GB avg ) into this cluster. The cluster works perfectly during most of the day but e… --- ## [Query\_string with wildcard fields sends "Can't parse boolean value"](https://discuss.elastic.co/t/query-string-with-wildcard-fields-sends-cant-parse-boolean-value/271245)
**Author:** [@CLEMENT\_CAZEAUX](https://discuss.elastic.co/u/CLEMENT_CAZEAUX)\ **Replies:** 7\ **Last updated:** [May 4, 2021, 5:40pm UTC](https://discuss.elastic.co/t/query-string-with-wildcard-fields-sends-cant-parse-boolean-value/271245 "2021-05-04T17:40:41Z")
Hello, Basic query such as the documentation here Query string query | Elasticsearch Guide \[7.9\] | Elastic results in error: I've tested with version 7.9, I'll try next with the current 7.12 GET \_search?error\_trace=… --- ## [What version of TLS used by Logstash output](https://discuss.elastic.co/t/what-version-of-tls-used-by-logstash-output/272086)
**Author:** [@Sunil\_Chadha](https://discuss.elastic.co/u/Sunil_Chadha)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 4:05pm UTC](https://discuss.elastic.co/t/what-version-of-tls-used-by-logstash-output/272086 "2021-05-04T16:05:05Z")
Hi, I was looking at Logstash documentation for output plugin, but could not find the TLS version used by it's outputs-elasticsearch output-syslog output-lumberjack If anyone knows about the TLS protocol version supp… --- ## [Date data type and time for kibana](https://discuss.elastic.co/t/date-data-type-and-time-for-kibana/272047)
**Author:** [@LombardoAndrea195](https://discuss.elastic.co/u/LombardoAndrea195)\ **Replies:** 6\ **Last updated:** [May 4, 2021, 4:10pm UTC](https://discuss.elastic.co/t/date-data-type-and-time-for-kibana/272047 "2021-05-04T16:10:30Z")
Hi all experts, I'm a beginner of this new techonolgy. I've some doubt about data type: I used the data like this and using python for interacting I manage to use this script to incorporate data+ time in order to be co… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1428) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1430)