# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1458 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1459 --- ## [Dissect message playground](https://discuss.elastic.co/t/dissect-message-playground/268207)
**Author:** [@Catalin\_Dinuta](https://discuss.elastic.co/u/Catalin_Dinuta)\ **Replies:** 1\ **Last updated:** [April 17, 2021, 11:57pm UTC](https://discuss.elastic.co/t/dissect-message-playground/268207 "2021-04-17T23:57:14Z")
Hi community, I searched some playground for dissecting a log message but I was unable to find it, and so I always receive dissect error. The filebeat configuration is: filebeat.inputs: - type: log paths: … --- ## [Calculate query weight. Is it possible?](https://discuss.elastic.co/t/calculate-query-weight-is-it-possible/270428)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 1\ **Last updated:** [April 17, 2021, 9:24pm UTC](https://discuss.elastic.co/t/calculate-query-weight-is-it-possible/270428 "2021-04-17T21:24:43Z")
Hey there, is it possible to calculate the query weight? I mean, I would like to start to optimize how I use use \_search and the nested query object. So, I would like to test different approach and use different query to… --- ## [Getting Data from Syslog into Elasticsearch/Kibana](https://discuss.elastic.co/t/getting-data-from-syslog-into-elasticsearch-kibana/270464)
**Author:** [@bryonadams](https://discuss.elastic.co/u/bryonadams)\ **Replies:** 0\ **Last updated:** [April 17, 2021, 8:33pm UTC](https://discuss.elastic.co/t/getting-data-from-syslog-into-elasticsearch-kibana/270464 "2021-04-17T20:33:49Z")
I've just gotten my first Filebeats agent running and sending data into Elasticsearch, though I'm not sure why the messages are so long. I'm guessing everything after this @timestamp field is something from Beats or Elas… --- ## [Question about PageCacheRecycler's designe](https://discuss.elastic.co/t/question-about-pagecacherecyclers-designe/270460)
**Author:** [@rpgmakervx](https://discuss.elastic.co/u/rpgmakervx)\ **Replies:** 0\ **Last updated:** [April 17, 2021, 7:42pm UTC](https://discuss.elastic.co/t/question-about-pagecacherecyclers-designe/270460 "2021-04-17T19:42:36Z")
When I see PageCacheRecycler, I found the concurrent type's slot count up to avaliable processor count. but in fact thread count always exceeds processors count, so why not use more dynamic count that rely on current t… --- ## [Spark SQL types are not handled through basic RDD saveToEs() calls](https://discuss.elastic.co/t/spark-sql-types-are-not-handled-through-basic-rdd-savetoes-calls/270458)
**Author:** [@roypiyali92](https://discuss.elastic.co/u/roypiyali92)\ **Replies:** 0\ **Last updated:** [April 17, 2021, 6:56pm UTC](https://discuss.elastic.co/t/spark-sql-types-are-not-handled-through-basic-rdd-savetoes-calls/270458 "2021-04-17T18:56:50Z")
I am trying to a simple operation wherein I am running a Spark job to persist a DataFrame to ElasticSearch. ElasticSearch Version : 5.3.0 Scala Version - 2.12 Spark Version - 3.0.0 On Trying this code, I get an error … --- ## [Querying for null values](https://discuss.elastic.co/t/querying-for-null-values/270455)
**Author:** [@Ruth\_Smith](https://discuss.elastic.co/u/Ruth_Smith)\ **Replies:** 0\ **Last updated:** [April 17, 2021, 4:55pm UTC](https://discuss.elastic.co/t/querying-for-null-values/270455 "2021-04-17T16:55:45Z")
I'm new to Elasticsearch, using version 7.1.2. I am setting up an index which contains time-stamped records for users. I would like to find out how to search for all users who are not active (i.e. have no records) ove… --- ## [Can I Reduce FileBeat Executeable File Size By Config Something or Comment Something Before build?](https://discuss.elastic.co/t/can-i-reduce-filebeat-executeable-file-size-by-config-something-or-comment-something-before-build/270453)
**Author:** [@yulei](https://discuss.elastic.co/u/yulei)\ **Replies:** 0\ **Last updated:** [April 17, 2021, 4:23pm UTC](https://discuss.elastic.co/t/can-i-reduce-filebeat-executeable-file-size-by-config-something-or-comment-something-before-build/270453 "2021-04-17T16:23:49Z")
I unpack all versions of the filebeat-${version}-x86\_64.rpm and stats the size of Executeable Files. I found that after some break changes in version 6.0.0, the size of the Executeable File Jump to 45M from 16M(size … --- ## [My\_index/\_stats/indexing (high number of "index\_failed" operations)](https://discuss.elastic.co/t/my-index-stats-indexing-high-number-of-index-failed-operations/270152)
**Author:** [@Logan\_H](https://discuss.elastic.co/u/Logan_H)\ **Replies:** 4\ **Last updated:** [April 17, 2021, 4:16pm UTC](https://discuss.elastic.co/t/my-index-stats-indexing-high-number-of-index-failed-operations/270152 "2021-04-17T16:16:44Z")
I'm supporting a cluster with an index that is seeing a high number in "indexed\_failed" operations as shown by the indexing stats. I'm trying to understand what type of scenarios would cause this counter to increment up.… --- ## [Issue using http\_poller to connect to streaming http api](https://discuss.elastic.co/t/issue-using-http-poller-to-connect-to-streaming-http-api/270434)
**Author:** [@metalshanked](https://discuss.elastic.co/u/metalshanked)\ **Replies:** 4\ **Last updated:** [April 17, 2021, 4:12pm UTC](https://discuss.elastic.co/t/issue-using-http-poller-to-connect-to-streaming-http-api/270434 "2021-04-17T16:12:22Z")
Hi Is there a way to implement a setting similar to Python requests "stream=True" setting in the Logstash http\_poller plugin. I am trying to pull streaming data from Shodan using logstash and get "no upstream" errors. … --- ## [Can't get kibana to display filebeat logs with docker auto discovery](https://discuss.elastic.co/t/cant-get-kibana-to-display-filebeat-logs-with-docker-auto-discovery/269810)
**Author:** [@LongBeachHXC](https://discuss.elastic.co/u/LongBeachHXC)\ **Replies:** 3\ **Last updated:** [April 17, 2021, 2:11pm UTC](https://discuss.elastic.co/t/cant-get-kibana-to-display-filebeat-logs-with-docker-auto-discovery/269810 "2021-04-17T14:11:39Z")
I am trying to leverage the docker auto discovery provider. I followed every tutorial I could find regarding filebeat and I still cannot get Kibana to display the logs. I am trying to get this working with the Elastic Se… --- ## [Configuring Kibana darkMode via API Call](https://discuss.elastic.co/t/configuring-kibana-darkmode-via-api-call/270430)
**Author:** [@carlcauchi](https://discuss.elastic.co/u/carlcauchi)\ **Replies:** 2\ **Last updated:** [April 17, 2021, 12:18pm UTC](https://discuss.elastic.co/t/configuring-kibana-darkmode-via-api-call/270430 "2021-04-17T12:18:58Z")
Is there an API call you can do against the Kibana endpoint to setup the darkMode to the default space? The following POST command gives an error status code 409: curl -w '%%{http\_code}\\n' -u "${elasticadmin\_user}:${el… --- ## [Elasticsearch fuzziness global setting](https://discuss.elastic.co/t/elasticsearch-fuzziness-global-setting/270445)
**Author:** [@mohamad\_shalodi](https://discuss.elastic.co/u/mohamad_shalodi)\ **Replies:** 0\ **Last updated:** [April 17, 2021, 10:49am UTC](https://discuss.elastic.co/t/elasticsearch-fuzziness-global-setting/270445 "2021-04-17T10:49:45Z")
Hi Regarding fuzzy in elasticsearch queries, i wanted to ask if i can configure the fuzziness property in "fuzzy" and "query\_string" queries as a global setting for all queries instead of putting it in every query writt… --- ## [Creating App Search with Terraform?](https://discuss.elastic.co/t/creating-app-search-with-terraform/269234)
**Author:** [@Chanonry](https://discuss.elastic.co/u/Chanonry)\ **Replies:** 2\ **Last updated:** [April 17, 2021, 8:53am UTC](https://discuss.elastic.co/t/creating-app-search-with-terraform/269234 "2021-04-17T08:53:41Z")
We are in the early stages of exploring App Search and really like the abstraction on Elasticsearch as it gets up going much faster, the console lets us get a feel for the available parameters and autoscaling promises mu… --- ## [Implementation of ELK stack in large company with huge data](https://discuss.elastic.co/t/implementation-of-elk-stack-in-large-company-with-huge-data/269887)
**Author:** [@xirehat](https://discuss.elastic.co/u/xirehat)\ **Replies:** 9\ **Last updated:** [April 17, 2021, 6:49am UTC](https://discuss.elastic.co/t/implementation-of-elk-stack-in-large-company-with-huge-data/269887 "2021-04-17T06:49:21Z")
Hello We want to change implementation of ELK stack in our company, we having some challenge at this time: Kibana is too slow (sometimes getting response from Elasticsearch take time more than 5 minutes) Our service's … --- ## [Nginx access and error logs show incorroct value in kibana dashboard](https://discuss.elastic.co/t/nginx-access-and-error-logs-show-incorroct-value-in-kibana-dashboard/269453)
**Author:** [@fati](https://discuss.elastic.co/u/fati)\ **Replies:** 22\ **Last updated:** [April 17, 2021, 6:46am UTC](https://discuss.elastic.co/t/nginx-access-and-error-logs-show-incorroct-value-in-kibana-dashboard/269453 "2021-04-17T06:46:42Z")
I am new in ELK. I have ELK stack 7.12.0 (filebeat -\> logstash -\> elasticsearch cluster -\> kibana) I installed filebeat on nginx server and enabled nginx module. these are my configuration files: filebeat.yml fi… --- ## [Why is the logstash time difference of 5 minutes and 43 seconds before January 1, 1901？](https://discuss.elastic.co/t/why-is-the-logstash-time-difference-of-5-minutes-and-43-seconds-before-january-1-1901/270439)
**Author:** [@Fei1](https://discuss.elastic.co/u/Fei1)\ **Replies:** 0\ **Last updated:** [April 17, 2021, 6:39am UTC](https://discuss.elastic.co/t/why-is-the-logstash-time-difference-of-5-minutes-and-43-seconds-before-january-1-1901/270439 "2021-04-17T06:39:27Z")
Hello everyone, I am an ELK beginner, Background: Area: GMT+ 8 Time Zone Linux: CentOS Linux release 8.1.1911 (Core) Database：mysql Ver 15.1 Distrib 10.3.27-MariaDB, for Linux (x86\_64) using readline 5.1 logstash && … --- ## [How can I skip recording an event with these conditions](https://discuss.elastic.co/t/how-can-i-skip-recording-an-event-with-these-conditions/270422)
**Author:** [@jftuga](https://discuss.elastic.co/u/jftuga)\ **Replies:** 1\ **Last updated:** [April 17, 2021, 6:29am UTC](https://discuss.elastic.co/t/how-can-i-skip-recording-an-event-with-these-conditions/270422 "2021-04-17T06:29:07Z")
I am using winlogbeat. How can I exclude events that meet the following criteria: event\_id = 4670 only when the "related": "user" value ends with a $ (alternatively) the "user": "name" ends with a $ Values that end in… --- ## [Querying log.file.path returns no results](https://discuss.elastic.co/t/querying-log-file-path-returns-no-results/269794)
**Author:** [@strshp\_419](https://discuss.elastic.co/u/strshp_419)\ **Replies:** 15\ **Last updated:** [April 17, 2021, 5:19am UTC](https://discuss.elastic.co/t/querying-log-file-path-returns-no-results/269794 "2021-04-17T05:19:24Z")
Elasticsearch, Filebeat, and Kibana versions are 7.12.0 on Windows Server 2016 In Kibana, querying on log.file.path returns no results in certain scenarios. Example: In Kibana, I go to Observability \> Logs and submit … --- ## [Cluster Rerouting - Moving Primaries](https://discuss.elastic.co/t/cluster-rerouting-moving-primaries/270396)
**Author:** [@Eduardo\_Iglesias](https://discuss.elastic.co/u/Eduardo_Iglesias)\ **Replies:** 1\ **Last updated:** [April 17, 2021, 4:32am UTC](https://discuss.elastic.co/t/cluster-rerouting-moving-primaries/270396 "2021-04-17T04:32:15Z")
Hello Community, I'm trying to move my primary from Node-C to Node-D but I'm not able to perform this task. Is there any way to accomplish this? PUT rr\_index2 { "settings": { "number\_of\_shards": 1, "number\_of\_r… --- ## [Elasticsearch will not start with xpack.security.enabled: true running latest 7.12 version and basic license](https://discuss.elastic.co/t/elasticsearch-will-not-start-with-xpack-security-enabled-true-running-latest-7-12-version-and-basic-license/270307)
**Author:** [@Reedler](https://discuss.elastic.co/u/Reedler)\ **Replies:** 3\ **Last updated:** [April 17, 2021, 3:46am UTC](https://discuss.elastic.co/t/elasticsearch-will-not-start-with-xpack-security-enabled-true-running-latest-7-12-version-and-basic-license/270307 "2021-04-17T03:46:15Z")
Output of license "type" : "basic", Running small 3 node cluster with same elasticsearch.xml configs xpack.security.enabled: true --- ## [Can ruby code be a speed bottleneck in logstash config file?](https://discuss.elastic.co/t/can-ruby-code-be-a-speed-bottleneck-in-logstash-config-file/270395)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 4\ **Last updated:** [April 17, 2021, 3:21am UTC](https://discuss.elastic.co/t/can-ruby-code-be-a-speed-bottleneck-in-logstash-config-file/270395 "2021-04-17T03:21:09Z")
I m trying to get as much throughput as possible from my setup. I am using the http input. The client sometimes sends a collection of events instead of a single event for efficiency sake. Here is the relevant thread with… --- ## [Metricset:state\_container slow to ingest and missing configured 10s sample intervals](https://discuss.elastic.co/t/metricset-state-container-slow-to-ingest-and-missing-configured-10s-sample-intervals/269534)
**Author:** [@MnrGreg](https://discuss.elastic.co/u/MnrGreg)\ **Replies:** 4\ **Last updated:** [April 17, 2021, 12:37am UTC](https://discuss.elastic.co/t/metricset-state-container-slow-to-ingest-and-missing-configured-10s-sample-intervals/269534 "2021-04-17T00:37:19Z")
Observing slow sample rate for module:kubernetes metricset: state\_container on cluster with +-2000 containers. Documents are ingested roughly every 13 seconds. - Versions: metricbeat: 7.12.0 & 6.8.2 kubernetes: 1.19.2 … --- ## [How to download data from an elasticsearch cloud index with elasticdump](https://discuss.elastic.co/t/how-to-download-data-from-an-elasticsearch-cloud-index-with-elasticdump/270431)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 9\ **Last updated:** [April 17, 2021, 12:20am UTC](https://discuss.elastic.co/t/how-to-download-data-from-an-elasticsearch-cloud-index-with-elasticdump/270431 "2021-04-17T00:20:51Z")
Hi, I am trying to download the data of an index with the elasticdump tool from the elasticsearch cloud but I get the following error : root@srvefevmmar:~# elasticdump \\ \> --input=https://elastic:secret@72dfe17217744236… --- ## [Trying to run the 'Get duration by using bucket script' but not working](https://discuss.elastic.co/t/trying-to-run-the-get-duration-by-using-bucket-script-but-not-working/269648)
**Author:** [@gentle\_ghost](https://discuss.elastic.co/u/gentle_ghost)\ **Replies:** 5\ **Last updated:** [April 16, 2021, 9:52pm UTC](https://discuss.elastic.co/t/trying-to-run-the-get-duration-by-using-bucket-script-but-not-working/269648 "2021-04-16T21:52:38Z")
Hello, I'm attempting to calculate Session Duration by using the provided example here: I even followed this users successful implementation: Computing session durations from timestamps scattered over two documents - … --- ## [Problem in importing csv with logstrash](https://discuss.elastic.co/t/problem-in-importing-csv-with-logstrash/270332)
**Author:** [@Fady\_Hany](https://discuss.elastic.co/u/Fady_Hany)\ **Replies:** 8\ **Last updated:** [April 16, 2021, 9:51pm UTC](https://discuss.elastic.co/t/problem-in-importing-csv-with-logstrash/270332 "2021-04-16T21:51:38Z")
i have read a lot of similar problems in this nice forum , but non of them fit my situation my .conf file : input { file { path =\> "E:/test/\*.csv" start\_position =\> "beginning" sincedb\_pat… --- ## [Convert Packetbeat Field Contents to Lowercase](https://discuss.elastic.co/t/convert-packetbeat-field-contents-to-lowercase/270402)
**Author:** [@John\_Collins](https://discuss.elastic.co/u/John_Collins)\ **Replies:** 8\ **Last updated:** [April 16, 2021, 8:31pm UTC](https://discuss.elastic.co/t/convert-packetbeat-field-contents-to-lowercase/270402 "2021-04-16T20:31:58Z")
I am sending DNS queries from a windows DNS server to Logstash via Packetbeat. When I view the contents of the field dns.question.name in Kibana, some entries contain capitalizations. I have tried the following in a Lo… --- ## [How to download data from an elasticsearch index](https://discuss.elastic.co/t/how-to-download-data-from-an-elasticsearch-index/269354)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 12\ **Last updated:** [April 16, 2021, 8:29pm UTC](https://discuss.elastic.co/t/how-to-download-data-from-an-elasticsearch-index/269354 "2021-04-16T20:29:12Z")
Hi, guy's How can i download all the data of an index in elasticsearch? it downloads the CSV but it does not show all the data, I need to download the whole index, please help me? --- ## [Ingest ASN.1 binary files](https://discuss.elastic.co/t/ingest-asn-1-binary-files/270411)
**Author:** [@fformoso](https://discuss.elastic.co/u/fformoso)\ **Replies:** 1\ **Last updated:** [April 16, 2021, 7:07pm UTC](https://discuss.elastic.co/t/ingest-asn-1-binary-files/270411 "2021-04-16T19:07:33Z")
Hello! I'm trying to setup an ingest pipeline of CDR files encoded in ASN.1 binary format and load the data in the elastic cluster I've been reading and trying to determine if we have built in tools in Elastic to accom… --- ## [Unknown key for a START\_OBJECT in \[runtime\_mappings\]](https://discuss.elastic.co/t/unknown-key-for-a-start-object-in-runtime-mappings/270317)
**Author:** [@plm](https://discuss.elastic.co/u/plm)\ **Replies:** 2\ **Last updated:** [April 16, 2021, 6:20pm UTC](https://discuss.elastic.co/t/unknown-key-for-a-start-object-in-runtime-mappings/270317 "2021-04-16T18:20:05Z")
Hi, I am getting the following error: upload completely sent off: 426 out of 426 bytes \< HTTP/1.1 400 Bad Request \< content-type: application/json; charset=UTF-8 \< content-length: 374 \< { “error” : { “ro… --- ## [Logstash monitoring with Metricbeat and cluster\_uuid](https://discuss.elastic.co/t/logstash-monitoring-with-metricbeat-and-cluster-uuid/270410)
**Author:** [@jasenj1](https://discuss.elastic.co/u/jasenj1)\ **Replies:** 0\ **Last updated:** [April 16, 2021, 5:34pm UTC](https://discuss.elastic.co/t/logstash-monitoring-with-metricbeat-and-cluster-uuid/270410 "2021-04-16T17:34:04Z")
When configuring Logstash monitoring, the Elastic recommended best practice is to create a cluster dedicated to log and metrics collection. One then configures Metricbeat to collect the monitoring data from Logstash us… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1457) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1459)