# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1440 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1441 --- ## [Logstash stop to output when one kafka node is down](https://discuss.elastic.co/t/logstash-stop-to-output-when-one-kafka-node-is-down/271412)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 11\ **Last updated:** [April 28, 2021, 4:08pm UTC](https://discuss.elastic.co/t/logstash-stop-to-output-when-one-kafka-node-is-down/271412 "2021-04-28T16:08:22Z")
Hello everybody, I have a 3 kafka nodes cluster Logstash has a kafka input and output to elasticsearch and syslog (I'm using logstash output isolator pattern). When one kafka node is down (kafka3 in this case), logstas… --- ## [GCP module - Add cluster\_name for GKE / k8s.io logs](https://discuss.elastic.co/t/gcp-module-add-cluster-name-for-gke-k8s-io-logs/271278)
**Author:** [@aryon](https://discuss.elastic.co/u/aryon)\ **Replies:** 8\ **Last updated:** [April 28, 2021, 4:05pm UTC](https://discuss.elastic.co/t/gcp-module-add-cluster-name-for-gke-k8s-io-logs/271278 "2021-04-28T16:05:05Z")
Hello, I am using the GCP module to collect GCP audit logs. I noticed that for GKE / k8s.io logs, we do not have the cluster\_name in the ingested event. The field is present in the original event collected in Pub/Sub, … --- ## [Using esrally eql track to test es7.5 with error](https://discuss.elastic.co/t/using-esrally-eql-track-to-test-es7-5-with-error/270548)
**Author:** [@alittlejoy](https://discuss.elastic.co/u/alittlejoy)\ **Replies:** 5\ **Last updated:** [April 28, 2021, 3:39pm UTC](https://discuss.elastic.co/t/using-esrally-eql-track-to-test-es7-5-with-error/270548 "2021-04-28T15:39:52Z")
hello I am using esrally eql track to test ES7.5.1 But I met an error ,does anyone has any idea? \[ERROR\] Cannot race. Error in load generator \[4\] ("Request returned an error. Error type: transport, Description: illeg… --- ## [Configuring and better understanding index.refresh\_interval for an index updated twice a day](https://discuss.elastic.co/t/configuring-and-better-understanding-index-refresh-interval-for-an-index-updated-twice-a-day/271535)
**Author:** [@Catalin](https://discuss.elastic.co/u/Catalin)\ **Replies:** 1\ **Last updated:** [April 28, 2021, 3:33pm UTC](https://discuss.elastic.co/t/configuring-and-better-understanding-index-refresh-interval-for-an-index-updated-twice-a-day/271535 "2021-04-28T15:33:27Z")
How exactly does index.refresh\_interval affect search performance ? I have an index that is updated for 10 mins twice a day. Is it sufficient to refresh it 1 time, once the updating process finishes and disable index.re… --- ## [Http curl queries. is possible?](https://discuss.elastic.co/t/http-curl-queries-is-possible/271422)
**Author:** [@sylvani](https://discuss.elastic.co/u/sylvani)\ **Replies:** 4\ **Last updated:** [April 28, 2021, 3:28pm UTC](https://discuss.elastic.co/t/http-curl-queries-is-possible/271422 "2021-04-28T15:28:37Z")
Hello, I need to ask a question, maybe a little stupid ... Is it possible to query the kibana web console by http and curl? Is there a way for this to return the data from the query? Thanks --- ## [Input on UDP converting to default UTF-8 but want Hex Strings](https://discuss.elastic.co/t/input-on-udp-converting-to-default-utf-8-but-want-hex-strings/271513)
**Author:** [@Yasho](https://discuss.elastic.co/u/Yasho)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 12:52pm UTC](https://discuss.elastic.co/t/input-on-udp-converting-to-default-utf-8-but-want-hex-strings/271513 "2021-04-28T12:52:43Z")
Why is logstash converting input stream by default to UTF-8, ASCII, Unsigned Char, I want the data either converted full or do not touch it.. There is no codec to format the received data on UDP port. Example: This i… --- ## [Kibana table question](https://discuss.elastic.co/t/kibana-table-question/271514)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 1\ **Last updated:** [April 28, 2021, 3:00pm UTC](https://discuss.elastic.co/t/kibana-table-question/271514 "2021-04-28T15:00:35Z")
Hi there. I have a dashboard with some tables like this. My idea is to set an URL on each of these entries that redirects to the "Discover" tab with the filter applied, for example, click on "ET POLICY TEAMVIEWER DYN… --- ## [Maps delayed loading of cluster circle icon](https://discuss.elastic.co/t/maps-delayed-loading-of-cluster-circle-icon/271444)
**Author:** [@DMinovski](https://discuss.elastic.co/u/DMinovski)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 2:41pm UTC](https://discuss.elastic.co/t/maps-delayed-loading-of-cluster-circle-icon/271444 "2021-04-28T14:41:53Z")
I'm using Maps in Kibana 7.11.1. The maps have a field filter in the cluster settings menu, and the dashboard has one or two global filters in the top menu. Sometimes, there is a delay of the cluster circle icon if it's … --- ## [Fleet Beta Risks](https://discuss.elastic.co/t/fleet-beta-risks/271467)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 2\ **Last updated:** [April 28, 2021, 1:57pm UTC](https://discuss.elastic.co/t/fleet-beta-risks/271467 "2021-04-28T13:57:53Z")
Can someone from Elastic tell us what the risks of running Fleet are? when you run Fleet it says : Fleet is under active development and is not intended for use in production environments. This beta release is designed … --- ## [ElasticsearchRestTemplate After not using it for a period of time: Java.io.ioException: The remote host forced closure of an existing connection](https://discuss.elastic.co/t/elasticsearchresttemplate-after-not-using-it-for-a-period-of-time-java-io-ioexception-the-remote-host-forced-closure-of-an-existing-connection/271172)
**Author:** [@canye666](https://discuss.elastic.co/u/canye666)\ **Replies:** 7\ **Last updated:** [April 28, 2021, 1:57pm UTC](https://discuss.elastic.co/t/elasticsearchresttemplate-after-not-using-it-for-a-period-of-time-java-io-ioexception-the-remote-host-forced-closure-of-an-existing-connection/271172 "2021-04-28T13:57:23Z")
远程主机强迫关闭了一个现有的连接。; nested exception is java.lang.RuntimeException: 远程主机强迫关闭了一个现有的连接。 org.springframework.dao.DataAccessResourceFailureException: 远程主机强迫关闭了一个现有的连接。 at org.springframework.data.elasticsearch.cor… --- ## [Logstash Ouptut to Elasticsearch when one node is down](https://discuss.elastic.co/t/logstash-ouptut-to-elasticsearch-when-one-node-is-down/270876)
**Author:** [@linfordwoode](https://discuss.elastic.co/u/linfordwoode)\ **Replies:** 6\ **Last updated:** [April 28, 2021, 1:52pm UTC](https://discuss.elastic.co/t/logstash-ouptut-to-elasticsearch-when-one-node-is-down/270876 "2021-04-28T13:52:52Z")
Logstash sending output to three ES nodes. When one ES node is down, Logstash doesn't forward specific outputs to other nodes, probably because the dead node was receiving the output. For example, in the Logstash conf be… --- ## [Filebeat .csv file is not updating on Kibana](https://discuss.elastic.co/t/filebeat-csv-file-is-not-updating-on-kibana/270393)
**Author:** [@SHUBHAM\_SALUNKHE](https://discuss.elastic.co/u/SHUBHAM_SALUNKHE)\ **Replies:** 11\ **Last updated:** [April 28, 2021, 1:38pm UTC](https://discuss.elastic.co/t/filebeat-csv-file-is-not-updating-on-kibana/270393 "2021-04-28T13:38:34Z")
Hi, there are 2 .conf files under conf.d on server where ELK is hosted. one .conf file for jenkins logs & another one for filebeat. filebeat is hosted on another server. So, which .conf file is taken as config file? Al… --- ## [Kibana filter issues on embedded dashboards](https://discuss.elastic.co/t/kibana-filter-issues-on-embedded-dashboards/268898)
**Author:** [@a.deharo](https://discuss.elastic.co/u/a.deharo)\ **Replies:** 7\ **Last updated:** [April 28, 2021, 1:16pm UTC](https://discuss.elastic.co/t/kibana-filter-issues-on-embedded-dashboards/268898 "2021-04-28T13:16:35Z")
Hi everyone, I recently upgraded my Elastic stack version from v7.11.2 to v7.12.0, and I'm starting to see some weird behavior on both filters and controls visualizations on embedded dashboards from Kibana. I guess the … --- ## [Try to add a new field with timestamp in logstash](https://discuss.elastic.co/t/try-to-add-a-new-field-with-timestamp-in-logstash/271512)
**Author:** [@David\_Barat](https://discuss.elastic.co/u/David_Barat)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 12:52pm UTC](https://discuss.elastic.co/t/try-to-add-a-new-field-with-timestamp-in-logstash/271512 "2021-04-28T12:52:39Z")
Hi everyone, I am pretty new in ELK world and I would like to parse csv file with logstash. I have tried to add a time field with timestamp (YYYY MM DD format), but I think there is an issue in the format I have made … --- ## [\[Bug\] Visualizations: Data table with image](https://discuss.elastic.co/t/bug-visualizations-data-table-with-image/271427)
**Author:** [@cceyda](https://discuss.elastic.co/u/cceyda)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 12:48pm UTC](https://discuss.elastic.co/t/bug-visualizations-data-table-with-image/271427 "2021-04-28T12:48:51Z")
I opened an issue : \[Bug\] Visualizations: Data table image weirdness · Issue #98257 · elastic/kibana · GitHub but no one replied so posting here too Kibana version: 7.12.0 Elasticsearch version: 7.12.0 Server OS vers… --- ## [Query for anomaly explorer visualization](https://discuss.elastic.co/t/query-for-anomaly-explorer-visualization/270784)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [April 28, 2021, 11:42am UTC](https://discuss.elastic.co/t/query-for-anomaly-explorer-visualization/270784 "2021-04-28T11:42:17Z")
Hi Im trying to emulate the anomaly explorer in a vega visualization, at first I think that a top hit agreggation will get me similar results, like this query: POST /.ml-anomalies-\*/\_search { "size": 0, "aggs": { … --- ## [UI\_actions\_explorer as a Plugin](https://discuss.elastic.co/t/ui-actions-explorer-as-a-plugin/271258)
**Author:** [@Noobmaster](https://discuss.elastic.co/u/Noobmaster)\ **Replies:** 1\ **Last updated:** [April 28, 2021, 11:39am UTC](https://discuss.elastic.co/t/ui-actions-explorer-as-a-plugin/271258 "2021-04-28T11:39:35Z")
Hi. I am new to ELK. Can anyone tell me how can I use certain part of the actions in UI\_actions\_explorer examples as a plugin. Example: I want to create a datagrid of 3\*3 data . And I want to have edit option as sho… --- ## [ES index goes read-only without the node reaching the disk watermark](https://discuss.elastic.co/t/es-index-goes-read-only-without-the-node-reaching-the-disk-watermark/271502)
**Author:** [@Bence\_Ver](https://discuss.elastic.co/u/Bence_Ver)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 11:24am UTC](https://discuss.elastic.co/t/es-index-goes-read-only-without-the-node-reaching-the-disk-watermark/271502 "2021-04-28T11:24:30Z")
We are running an ELK cluster (v7.11.2) in kubernetes, and we noticed that the cluster went read-only without the underlying node reaching the disk watermark. We don't see any trace of error in the ES logs, and neither a… --- ## [Editing date time filed in json filter output](https://discuss.elastic.co/t/editing-date-time-filed-in-json-filter-output/271136)
**Author:** [@sahere37](https://discuss.elastic.co/u/sahere37)\ **Replies:** 7\ **Last updated:** [April 28, 2021, 10:52am UTC](https://discuss.elastic.co/t/editing-date-time-filed-in-json-filter-output/271136 "2021-04-28T10:52:27Z")
Hi all I am using filebeat 7.8 which sends log to logstash 7.8. Each line of log is as following: {"req": { "service": ser1,"re\_date": "2020-09-10T09:14:38.479"}} and my logstash filter is as following: inpu… --- ## [Is there a way in Kibana to group, aggregate and report frequently occurring exceptions and errors?](https://discuss.elastic.co/t/is-there-a-way-in-kibana-to-group-aggregate-and-report-frequently-occurring-exceptions-and-errors/269243)
**Author:** [@suresh123](https://discuss.elastic.co/u/suresh123)\ **Replies:** 1\ **Last updated:** [April 28, 2021, 10:43am UTC](https://discuss.elastic.co/t/is-there-a-way-in-kibana-to-group-aggregate-and-report-frequently-occurring-exceptions-and-errors/269243 "2021-04-28T10:43:19Z")
Hello Experts, We have application and web logs. We would like to group group, aggregate and report frequently occurring exceptions and errors using API. How to get report errors with their frequency of occurrence? E… --- ## [Elasticsearch 7.12 cluster 3 node installation](https://discuss.elastic.co/t/elasticsearch-7-12-cluster-3-node-installation/271480)
**Author:** [@cuongnp](https://discuss.elastic.co/u/cuongnp)\ **Replies:** 2\ **Last updated:** [April 28, 2021, 10:37am UTC](https://discuss.elastic.co/t/elasticsearch-7-12-cluster-3-node-installation/271480 "2021-04-28T10:37:49Z")
Hi all, I tried to setup 3 Elasticsearch nodes with configuration below file /etc/hosts (on 3 nodes) elasticsearch.yml NODE 1 (master-1) cluster.name: es-cluster node.name: "master-1" node.master: true node.d… --- ## [Esrally test results, I want to see the test results about the query, thank you](https://discuss.elastic.co/t/esrally-test-results-i-want-to-see-the-test-results-about-the-query-thank-you/271496)
**Author:** [@rui.chen](https://discuss.elastic.co/u/rui.chen)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 10:19am UTC](https://discuss.elastic.co/t/esrally-test-results-i-want-to-see-the-test-results-about-the-query-thank-you/271496 "2021-04-28T10:19:29Z")
this is test command esrally race --track=geonames --challenge=append-no-conflicts --offline --pipeline=benchmark-only --target-hosts=172.31.1.21:9200,172.31.1.30:9200,172.31.1.249:9200 test result | … --- ## [Filebeat Setup error: error loading index pattern: returned 408 to import file](https://discuss.elastic.co/t/filebeat-setup-error-error-loading-index-pattern-returned-408-to-import-file/271400)
**Author:** [@radu990](https://discuss.elastic.co/u/radu990)\ **Replies:** 1\ **Last updated:** [April 28, 2021, 9:25am UTC](https://discuss.elastic.co/t/filebeat-setup-error-error-loading-index-pattern-returned-408-to-import-file/271400 "2021-04-28T09:25:21Z")
While running filebeat setup, I'm getting the following error: PS C:\\Program Files\\Filebeat\> .\\filebeat.exe setup Overwriting ILM policy is disabled. Set \`setup.ilm.overwrite: true\` for enabling. Index setup finished. … --- ## [Can we use aggregate filter to get the total no of times an IP appears in the logs?](https://discuss.elastic.co/t/can-we-use-aggregate-filter-to-get-the-total-no-of-times-an-ip-appears-in-the-logs/271486)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 9:02am UTC](https://discuss.elastic.co/t/can-we-use-aggregate-filter-to-get-the-total-no-of-times-an-ip-appears-in-the-logs/271486 "2021-04-28T09:02:37Z")
I have a requirement , where an IP or hostname appears frequently in logs , can we use aggregate filter to get this count of IP /Hostnames ? --- ## [Multiply 2 variables in Datatable](https://discuss.elastic.co/t/multiply-2-variables-in-datatable/271341)
**Author:** [@NightWalker](https://discuss.elastic.co/u/NightWalker)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 9:24am UTC](https://discuss.elastic.co/t/multiply-2-variables-in-datatable/271341 "2021-04-28T09:24:57Z")
Hi, I'm trying to do something pretty simple but have a hard time to get it work. I've an global variable {custom\_price} and want to multiply it with each column value. I've tried every combination which came in my min… --- ## [Index pattern creation fails in 7.9.2](https://discuss.elastic.co/t/index-pattern-creation-fails-in-7-9-2/271367)
**Author:** [@Lieven\_Merckx](https://discuss.elastic.co/u/Lieven_Merckx)\ **Replies:** 4\ **Last updated:** [April 28, 2021, 8:56am UTC](https://discuss.elastic.co/t/index-pattern-creation-fails-in-7-9-2/271367 "2021-04-28T08:56:07Z")
When we installed Elastic and Kibana on ou Kubernetes environment we have the recurrent issue that on a restart the index-pattern creation fails. It's an old issue that doesn't get solved in the latest release of Elastic… --- ## [Version conflict while restarting cluster node](https://discuss.elastic.co/t/version-conflict-while-restarting-cluster-node/271484)
**Author:** [@thomasixo](https://discuss.elastic.co/u/thomasixo)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 8:44am UTC](https://discuss.elastic.co/t/version-conflict-while-restarting-cluster-node/271484 "2021-04-28T08:44:20Z")
Hi, i have an elasticsearch cluster with 4 nodes. I have a datastream with the name "log\_data", which have configured 2 shards and 1 replica. I have a test script, which creates in an endless loop new documents to thi… --- ## [Ilm in elstic cloud does not move the indexes from hot nodes to warm nodes](https://discuss.elastic.co/t/ilm-in-elstic-cloud-does-not-move-the-indexes-from-hot-nodes-to-warm-nodes/271076)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 8:50am UTC](https://discuss.elastic.co/t/ilm-in-elstic-cloud-does-not-move-the-indexes-from-hot-nodes-to-warm-nodes/271076 "2021-04-28T08:50:28Z")
Hello, I have set ilm rules to move hot indexes to warm indexes and move them into warm node. Now all my indexes are located on the hot nodes and eate up all my disk while the warm node are free and not doing anything h… --- ## [Avoid index ballooning by updates and deletes](https://discuss.elastic.co/t/avoid-index-ballooning-by-updates-and-deletes/271233)
**Author:** [@YvorL](https://discuss.elastic.co/u/YvorL)\ **Replies:** 6\ **Last updated:** [April 28, 2021, 8:43am UTC](https://discuss.elastic.co/t/avoid-index-ballooning-by-updates-and-deletes/271233 "2021-04-28T08:43:48Z")
Hi, I'm struggling with having an index that has some fields that are frequently updated and documents that are deleted. I want to avoid ballooning the index for obvious reasons. I tried to go with freezing the index a… --- ## [Send log filebeat, auditbeat, and winlogbeat](https://discuss.elastic.co/t/send-log-filebeat-auditbeat-and-winlogbeat/271226)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 8\ **Last updated:** [April 28, 2021, 8:42am UTC](https://discuss.elastic.co/t/send-log-filebeat-auditbeat-and-winlogbeat/271226 "2021-04-28T08:42:50Z")
hi guys, since i setting my elk stack with elastic security. and now they have ssl/tls and https but my beats family can't send log again. help me how to config beats so they can send log again. [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1439) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1441)