# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1463 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1464 --- ## [Multiple Pipelines - filebeat fails](https://discuss.elastic.co/t/multiple-pipelines-filebeat-fails/270094)
**Author:** [@Peque](https://discuss.elastic.co/u/Peque)\ **Replies:** 0\ **Last updated:** [April 14, 2021, 9:37am UTC](https://discuss.elastic.co/t/multiple-pipelines-filebeat-fails/270094 "2021-04-14T09:37:31Z")
Hi Forum. Been struggling with my ELK setup, but cannot make it work as I intend - and not sure where I'm going wrong. Using Elasticsearch,Kibana, Logstash and filebeat --\> from this guide: How To Install Elasticsearch… --- ## [Memory problems / Circuit breaking exception with small data](https://discuss.elastic.co/t/memory-problems-circuit-breaking-exception-with-small-data/270091)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 9\ **Last updated:** [April 14, 2021, 8:57am UTC](https://discuss.elastic.co/t/memory-problems-circuit-breaking-exception-with-small-data/270091 "2021-04-14T08:57:04Z")
I am experiencing an odd situation. I have 3 node cluster (two data nodes, one master node) with the following resources node1 24GB RAM, 12CPU node2 16GB RAM, 8CPU master 8GB RAM, 4CPU I am ingesting firewall logs wit… --- ## [Elasticsearch SQL ODBC taking more time than previous version](https://discuss.elastic.co/t/elasticsearch-sql-odbc-taking-more-time-than-previous-version/269442)
**Author:** [@onkark](https://discuss.elastic.co/u/onkark)\ **Replies:** 8\ **Last updated:** [April 14, 2021, 8:39am UTC](https://discuss.elastic.co/t/elasticsearch-sql-odbc-taking-more-time-than-previous-version/269442 "2021-04-14T08:39:29Z")
I'm using SQL ODBC driver to fetch the results from elastic. I'm getting problem while fetching the documents from elastic. The query is as simple as 'select empno, name, address from emp'. In Elasticsearch version 7.6.2… --- ## [Assign Master and ML both roles to same node?](https://discuss.elastic.co/t/assign-master-and-ml-both-roles-to-same-node/270041)
**Author:** [@bharat1](https://discuss.elastic.co/u/bharat1)\ **Replies:** 6\ **Last updated:** [April 14, 2021, 8:36am UTC](https://discuss.elastic.co/t/assign-master-and-ml-both-roles-to-same-node/270041 "2021-04-14T08:36:40Z")
Hi Team, We plan to use Platinum license Can I assign ML and Master both roles on single/same node? From license count perspective, if I use 3 master and 3 ML both roles assigned to those 3 master nodes, will that be … --- ## [Understand "enable: false" mapping setting](https://discuss.elastic.co/t/understand-enable-false-mapping-setting/270084)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 6\ **Last updated:** [April 14, 2021, 8:34am UTC](https://discuss.elastic.co/t/understand-enable-false-mapping-setting/270084 "2021-04-14T08:34:55Z")
Hello all ! I'm trying to understand "enable: false" mapping setting I don't want to index a specific field : syslog\_timestamp To achieve this, I mapped this field with "enabled: false" like this (extract of Index man… --- ## [RegEx in Painless illegal expression](https://discuss.elastic.co/t/regex-in-painless-illegal-expression/270040)
**Author:** [@jamesm1](https://discuss.elastic.co/u/jamesm1)\ **Replies:** 5\ **Last updated:** [April 14, 2021, 8:34am UTC](https://discuss.elastic.co/t/regex-in-painless-illegal-expression/270040 "2021-04-14T08:34:41Z")
Hello - I am using the Dev Tool for painless and i am trying to get a RegEx statement to work. The statement is : def path = "/v3/api/users/stuff./games"; if (path =~ /^\\/v3\\/api\\/users\\/(\[^\\/\]+)$/) { path = "bob"; … --- ## [Check if Elasticsearch index is SEARCHABLE](https://discuss.elastic.co/t/check-if-elasticsearch-index-is-searchable/270000)
**Author:** [@Daniel\_Jankech](https://discuss.elastic.co/u/Daniel_Jankech)\ **Replies:** 4\ **Last updated:** [April 14, 2021, 8:21am UTC](https://discuss.elastic.co/t/check-if-elasticsearch-index-is-searchable/270000 "2021-04-14T08:21:41Z")
Hello everyone, once again I ran into a wall with ELK stack that I'm unable to overcome by myself so I came here to ask for your help. In my project , I'm creating new index , putting data into it via logstash and then … --- ## [Parsing multiple time series into Elasticsearch](https://discuss.elastic.co/t/parsing-multiple-time-series-into-elasticsearch/270082)
**Author:** [@tkkchan](https://discuss.elastic.co/u/tkkchan)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 8:18am UTC](https://discuss.elastic.co/t/parsing-multiple-time-series-into-elasticsearch/270082 "2021-04-14T08:18:01Z")
Dear all, I am not sure if this belongs to logstash... please correct me if not. I have some data that contains a field which is a time series, of interval 60sec. Should I map it into a single ES document, or should I … --- ## [Adding processed fields with metricbeat processors](https://discuss.elastic.co/t/adding-processed-fields-with-metricbeat-processors/270012)
**Author:** [@m\_x](https://discuss.elastic.co/u/m_x)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 8:12am UTC](https://discuss.elastic.co/t/adding-processed-fields-with-metricbeat-processors/270012 "2021-04-14T08:12:35Z")
I would like to add some fields to the data sent by Metricbeat. My machines have a hostname like this AA-BBB-CCXX where A, B, C are letters and X numbers. I would like to have : host.group: "AA-BBB-CC" host.number: "X… --- ## [Vega tree layout error](https://discuss.elastic.co/t/vega-tree-layout-error/270077)
**Author:** [@Ashvin\_Bhutekar](https://discuss.elastic.co/u/Ashvin_Bhutekar)\ **Replies:** 2\ **Last updated:** [April 14, 2021, 7:53am UTC](https://discuss.elastic.co/t/vega-tree-layout-error/270077 "2021-04-14T07:53:12Z")
what is the reason behind this error "Infinite extent for field "depth": \[Infinity, -Infinity\]" in vega tree layout? --- ## [Elastic search](https://discuss.elastic.co/t/elastic-search/270081)
**Author:** [@Daud\_Ahmed1](https://discuss.elastic.co/u/Daud_Ahmed1)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 7:19am UTC](https://discuss.elastic.co/t/elastic-search/270081 "2021-04-14T07:19:55Z")
I am not really able to find anything about this topic. Can anyone help with me will be really appreciated. --- ## [Elasticsearch doesn't display data in the graphs after a certain date](https://discuss.elastic.co/t/elasticsearch-doesnt-display-data-in-the-graphs-after-a-certain-date/270006)
**Author:** [@Borchart](https://discuss.elastic.co/u/Borchart)\ **Replies:** 2\ **Last updated:** [April 14, 2021, 7:11am UTC](https://discuss.elastic.co/t/elasticsearch-doesnt-display-data-in-the-graphs-after-a-certain-date/270006 "2021-04-14T07:11:57Z")
Hello everyone, I am new to using Elasticsearch. I have a server with Wazuh, Elasticsearch and Kibana installed, so I only have one node. When I look at the graphs for Wazuh I don't see the data until I put the data of … --- ## [Elasticsearch Multiple terms count filters](https://discuss.elastic.co/t/elasticsearch-multiple-terms-count-filters/270080)
**Author:** [@vkothari](https://discuss.elastic.co/u/vkothari)\ **Replies:** 0\ **Last updated:** [April 14, 2021, 6:32am UTC](https://discuss.elastic.co/t/elasticsearch-multiple-terms-count-filters/270080 "2021-04-14T06:32:03Z")
We are using Elasticsearch to search multiple terms and filter the records based on different filter terms. We are using multiple Keywords to search and filter the records, so I need some other details along with the re… --- ## [Updates on time based indexes](https://discuss.elastic.co/t/updates-on-time-based-indexes/270051)
**Author:** [@abhishekc92](https://discuss.elastic.co/u/abhishekc92)\ **Replies:** 2\ **Last updated:** [April 14, 2021, 6:42am UTC](https://discuss.elastic.co/t/updates-on-time-based-indexes/270051 "2021-04-14T06:42:28Z")
I am thinking of a time based index where we manage the lifecycle of a certain type of documents. The rollover API is one of the options vs spawning a new index at a cadence(say monthly). The nature of our documents are … --- ## [Reading Wazuh data from kafka, write to Elasticsearch using Filebeat and pipeline](https://discuss.elastic.co/t/reading-wazuh-data-from-kafka-write-to-elasticsearch-using-filebeat-and-pipeline/270078)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 0\ **Last updated:** [April 14, 2021, 6:24am UTC](https://discuss.elastic.co/t/reading-wazuh-data-from-kafka-write-to-elasticsearch-using-filebeat-and-pipeline/270078 "2021-04-14T06:24:50Z")
Hi, community. I want to read Wazuh data from kafka and write it to Elasticsearch. All way looks like: wazuh-manager-\>filebeat-\>logstash-\>nifi-\>kafka\_\>filebeat-\>elasticsearch. I try to write to elasticsearch using nati… --- ## [Logstash not parsing dynamic updates happening on the files present under the configured input path](https://discuss.elastic.co/t/logstash-not-parsing-dynamic-updates-happening-on-the-files-present-under-the-configured-input-path/269852)
**Author:** [@harish\_92](https://discuss.elastic.co/u/harish_92)\ **Replies:** 4\ **Last updated:** [April 14, 2021, 5:51am UTC](https://discuss.elastic.co/t/logstash-not-parsing-dynamic-updates-happening-on-the-files-present-under-the-configured-input-path/269852 "2021-04-14T05:51:21Z")
Hi Guys, I have configured a folder containing files which will be dynamically updated with some data which needs to be parsed by logstash and pushed into ES. Here, whenever new data is written into any one of the inpu… --- ## [“No processor type exists with name \[attachment\]”](https://discuss.elastic.co/t/no-processor-type-exists-with-name-attachment/270076)
**Author:** [@judy369](https://discuss.elastic.co/u/judy369)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 3:43am UTC](https://discuss.elastic.co/t/no-processor-type-exists-with-name-attachment/270076 "2021-04-14T03:43:02Z")
when i create pipline, curl --user elastic:ny123456 -H 'Content-Type: application/json' -XPUT 'http://192.168.250.49:9200/\_ingest/pipeline/attachment' -d' { "description" : "Extract attachment information", "… --- ## [Filebeat can't keep up with the logs](https://discuss.elastic.co/t/filebeat-cant-keep-up-with-the-logs/269621)
**Author:** [@grazia0912](https://discuss.elastic.co/u/grazia0912)\ **Replies:** 2\ **Last updated:** [April 14, 2021, 3:25am UTC](https://discuss.elastic.co/t/filebeat-cant-keep-up-with-the-logs/269621 "2021-04-14T03:25:51Z")
I'm using Filebeat 7.4.2 and it seems to not get all events on my log file. The log file is updating at a high speed cause of huge messages being logged and Filebeat couldn't seem to keep up and send all messages to Logs… --- ## [503 Service Unavailable at search](https://discuss.elastic.co/t/503-service-unavailable-at-search/270070)
**Author:** [@Francisco\_Gomez1](https://discuss.elastic.co/u/Francisco_Gomez1)\ **Replies:** 10\ **Last updated:** [April 14, 2021, 1:54am UTC](https://discuss.elastic.co/t/503-service-unavailable-at-search/270070 "2021-04-14T01:54:13Z")
Hi, Im trying to access my cluster from the web to be able to show my index using flexmonster, at this point all goes great. I manage to connect and access all my information, the problem is that... for example i can acc… --- ## [Is there any way to reduce the size of data before indexing into elasticserch](https://discuss.elastic.co/t/is-there-any-way-to-reduce-the-size-of-data-before-indexing-into-elasticserch/270072)
**Author:** [@iammanmale](https://discuss.elastic.co/u/iammanmale)\ **Replies:** 4\ **Last updated:** [April 14, 2021, 1:49am UTC](https://discuss.elastic.co/t/is-there-any-way-to-reduce-the-size-of-data-before-indexing-into-elasticserch/270072 "2021-04-14T01:49:34Z")
As our data size is quite big, we wish to reduce the size of the record. Is it possible to do some kind of aggregation before indexing into ES in logstash? For example, it is possible to put only the record of the max va… --- ## [Systemd\[1\]: Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch](https://discuss.elastic.co/t/systemd-1-failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/269634)
**Author:** [@Elam](https://discuss.elastic.co/u/Elam)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 1:00am UTC](https://discuss.elastic.co/t/systemd-1-failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/269634 "2021-04-14T01:00:59Z")
Please some one have an idea how to start filebeats to read data from log and send it to elasticsearch. I have this issues: systemd\[1\]: Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch.… --- ## [ES data redundancy VS Kibana visualizations](https://discuss.elastic.co/t/es-data-redundancy-vs-kibana-visualizations/270022)
**Author:** [@MartinKolar](https://discuss.elastic.co/u/MartinKolar)\ **Replies:** 2\ **Last updated:** [April 14, 2021, 12:41am UTC](https://discuss.elastic.co/t/es-data-redundancy-vs-kibana-visualizations/270022 "2021-04-14T00:41:05Z")
Hi everyone, I would love to hear some tips on how to avoid data redundancy in ES and Kibana. We are using ES and Kibana to collect and visualize videogame analytics. The game client indexes an "event" - a document with… --- ## [Elasticsearch (Docker) - failed to set monitoring pipeline](https://discuss.elastic.co/t/elasticsearch-docker-failed-to-set-monitoring-pipeline/269904)
**Author:** [@chainhead](https://discuss.elastic.co/u/chainhead)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 12:25am UTC](https://discuss.elastic.co/t/elasticsearch-docker-failed-to-set-monitoring-pipeline/269904 "2021-04-14T00:25:16Z")
I am using Elasticsearch with Docker elasticsearch/elasticsearch:7.12.0 and this is what I see in the logs. It is probably for these blogs, Kibana never gets to connect to Elasticsearch rendering my EFK stack unusable. C… --- ## [Creating ingest node pipeline with if condition](https://discuss.elastic.co/t/creating-ingest-node-pipeline-with-if-condition/269991)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 3\ **Last updated:** [April 14, 2021, 12:20am UTC](https://discuss.elastic.co/t/creating-ingest-node-pipeline-with-if-condition/269991 "2021-04-14T00:20:27Z")
Hello, I need to create ingest node pipeline that will tag every document with a specific field based on IP. I need to make it for 4 different groups with over 200 IP addresses. So far I have tried something like this … --- ## [Tenant](https://discuss.elastic.co/t/tenant/269696)
**Author:** [@Skander\_Harrabi](https://discuss.elastic.co/u/Skander_Harrabi)\ **Replies:** 3\ **Last updated:** [April 14, 2021, 12:05am UTC](https://discuss.elastic.co/t/tenant/269696 "2021-04-14T00:05:06Z")
Hello guys, Can i change tenant from code ?? like is there any Api or something that allow me to change tenant from a function or anywhere Like i want do a button, and when i click on that button i want change to a spe… --- ## [Yaml: found character that cannot start any token when value starts with "@"](https://discuss.elastic.co/t/yaml-found-character-that-cannot-start-any-token-when-value-starts-with/269778)
**Author:** [@joecullin.skout](https://discuss.elastic.co/u/joecullin.skout)\ **Replies:** 1\ **Last updated:** [April 13, 2021, 11:56pm UTC](https://discuss.elastic.co/t/yaml-found-character-that-cannot-start-any-token-when-value-starts-with/269778 "2021-04-13T23:56:12Z")
Using o365 filebeat module. Getting this error: cfgfile/list.go:99 Error creating runner from config: Error getting config for fileset o365/audit: Error reading input config: yaml: line 12: found character that ca… --- ## [MongoDB 4.4.4 compatibility with Filebeat 7.12.0](https://discuss.elastic.co/t/mongodb-4-4-4-compatibility-with-filebeat-7-12-0/270013)
**Author:** [@Cihan\_Tunali](https://discuss.elastic.co/u/Cihan_Tunali)\ **Replies:** 1\ **Last updated:** [April 13, 2021, 11:51pm UTC](https://discuss.elastic.co/t/mongodb-4-4-4-compatibility-with-filebeat-7-12-0/270013 "2021-04-13T23:51:42Z")
Hi there, I was using MongoDB 4.2.4 with Filebeat 7.9.0 without any problem. After updating MongoDB to 4.4.4 I got GROK problems. I also updated Filebeat to 7.12.0 as well but still got GROK error so that I can not pars… --- ## [Feature Request: Enforce consistent position\_increment\_gap in multi-fields for multi-values](https://discuss.elastic.co/t/feature-request-enforce-consistent-position-increment-gap-in-multi-fields-for-multi-values/270067)
**Author:** [@Michael\_Sander](https://discuss.elastic.co/u/Michael_Sander)\ **Replies:** 3\ **Last updated:** [April 13, 2021, 10:55pm UTC](https://discuss.elastic.co/t/feature-request-enforce-consistent-position-increment-gap-in-multi-fields-for-multi-values/270067 "2021-04-13T22:55:47Z")
Hi ES Community, I recently found some confusing behavior with a mapping and multi-fields, and it would be nice if Elasticsearch would prevent you from shooting yourself in the foot (like I did). The issue arises when … --- ## [Moving disk to another data node](https://discuss.elastic.co/t/moving-disk-to-another-data-node/270020)
**Author:** [@Feedy](https://discuss.elastic.co/u/Feedy)\ **Replies:** 2\ **Last updated:** [April 13, 2021, 10:46pm UTC](https://discuss.elastic.co/t/moving-disk-to-another-data-node/270020 "2021-04-13T22:46:13Z")
Running out of space with current 4 node cluster w/replica. I would like to install new larger disk drives but it may require moving disk drives from one data node to another. Does the master node have the ability to rec… --- ## [Elastic operator TLS self-signed certificates](https://discuss.elastic.co/t/elastic-operator-tls-self-signed-certificates/270049)
**Author:** [@ewolfman](https://discuss.elastic.co/u/ewolfman)\ **Replies:** 0\ **Last updated:** [April 13, 2021, 6:15pm UTC](https://discuss.elastic.co/t/elastic-operator-tls-self-signed-certificates/270049 "2021-04-13T18:15:09Z")
Hi, Using ECK we have set up a cluster with a self-signed certificate. However the documentation (TLS certificates | Elastic Cloud on Kubernetes \[1.5\] | Elastic) is not clear how to set/install this certificate in the … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1462) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1464)