# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1481 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1482 --- ## [ZonedDateTime.parse function not working for custom DateTimeFormatter](https://discuss.elastic.co/t/zoneddatetime-parse-function-not-working-for-custom-datetimeformatter/268819)
**Author:** [@rahulkothanath](https://discuss.elastic.co/u/rahulkothanath)\ **Replies:** 6\ **Last updated:** [April 1, 2021, 1:36pm UTC](https://discuss.elastic.co/t/zoneddatetime-parse-function-not-working-for-custom-datetimeformatter/268819 "2021-04-01T13:36:04Z")
Below string to date time code is not working for me and it is returning empty array. script1: String datetime = '2021-03-25 08:41:22.011'; DateTimeFormatter dtf = DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss.SSS… --- ## [Logstash](https://discuss.elastic.co/t/logstash/269018)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 6\ **Last updated:** [April 1, 2021, 1:06pm UTC](https://discuss.elastic.co/t/logstash/269018 "2021-04-01T13:06:58Z")
Hi i hope this message find you well , how could to send filtred logs to elasticsearch and in the same time send raw logs to another server (I need this logs for investigation and forensics task) regards and thanks --- ## [How to monitor restore from snapshot - failure case?](https://discuss.elastic.co/t/how-to-monitor-restore-from-snapshot-failure-case/269012)
**Author:** [@Lavanya](https://discuss.elastic.co/u/Lavanya)\ **Replies:** 5\ **Last updated:** [April 1, 2021, 1:00pm UTC](https://discuss.elastic.co/t/how-to-monitor-restore-from-snapshot-failure-case/269012 "2021-04-01T13:00:06Z")
I found that /\_cat/recovery API gives information about ongoing and completed snapshot recovery activity. In this response body, there is an attribute called stage whose possible values are { init, index, start, translo… --- ## [\[Filebeat CEF\] Microsoft DNS Overview on Filebeat 7.12](https://discuss.elastic.co/t/filebeat-cef-microsoft-dns-overview-on-filebeat-7-12/268891)
**Author:** [@numpty-boy](https://discuss.elastic.co/u/numpty-boy)\ **Replies:** 2\ **Last updated:** [April 1, 2021, 11:44am UTC](https://discuss.elastic.co/t/filebeat-cef-microsoft-dns-overview-on-filebeat-7-12/268891 "2021-04-01T11:44:43Z")
Hi Team, I'm hoping one of you can get me out of this misery ... I have packetbeat set up on my M$ DNS servers and is collecting some really helpful info. My elasticSearch cluster is running separately and seems to be… --- ## [Rollover is taking time](https://discuss.elastic.co/t/rollover-is-taking-time/268927)
**Author:** [@Narayan\_Banik](https://discuss.elastic.co/u/Narayan_Banik)\ **Replies:** 1\ **Last updated:** [April 1, 2021, 10:58am UTC](https://discuss.elastic.co/t/rollover-is-taking-time/268927 "2021-04-01T10:58:23Z")
My Policy is supposed to roll over indices if size reaches to 500mb like below: GET \_ilm/policy/my-policy { "my-policy" : { "version" : 4, "modified\_date" : "2021-03-31T14:34:45.932Z", "policy" : { "… --- ## [Metricbeats output.redis excessiv DNS Querries when redis down](https://discuss.elastic.co/t/metricbeats-output-redis-excessiv-dns-querries-when-redis-down/269021)
**Author:** [@brockp](https://discuss.elastic.co/u/brockp)\ **Replies:** 0\ **Last updated:** [April 1, 2021, 10:56am UTC](https://discuss.elastic.co/t/metricbeats-output-redis-excessiv-dns-querries-when-redis-down/269021 "2021-04-01T10:56:48Z")
We have metricbeats sending data to redis and on to ES. When redis is down metricbeats CPU jumps to 100% and 4 hosts easily create 20,000 DNS requests/second for the list of hosts running redis. Kinda odd it's not cac… --- ## [How do I run multiple filebeat.yml files on Windows?](https://discuss.elastic.co/t/how-do-i-run-multiple-filebeat-yml-files-on-windows/269003)
**Author:** [@pradeep\_gadkari](https://discuss.elastic.co/u/pradeep_gadkari)\ **Replies:** 1\ **Last updated:** [April 1, 2021, 10:05am UTC](https://discuss.elastic.co/t/how-do-i-run-multiple-filebeat-yml-files-on-windows/269003 "2021-04-01T10:05:58Z")
I have to make a centralized log monitoring system. I have to read logs from multiple locations and parse the logs differently in logstash. All these logs need to be sent to one index to Kibana at the output of logstash. … --- ## [Auditbeat \[7.11.2 and 7.12.0\] memory issue](https://discuss.elastic.co/t/auditbeat-7-11-2-and-7-12-0-memory-issue/268830)
**Author:** [@mareckii](https://discuss.elastic.co/u/mareckii)\ **Replies:** 7\ **Last updated:** [April 1, 2021, 9:38am UTC](https://discuss.elastic.co/t/auditbeat-7-11-2-and-7-12-0-memory-issue/268830 "2021-04-01T09:38:38Z")
Hi, I see memory issue when i'm using add\_process\_metadata processor. Memory usage is growing until OOM when i remove this processor from my config: I have dump, but I can't upload here. --- ## [How to solve hard and soft limit machine learning jobs](https://discuss.elastic.co/t/how-to-solve-hard-and-soft-limit-machine-learning-jobs/268933)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 2\ **Last updated:** [April 1, 2021, 9:28am UTC](https://discuss.elastic.co/t/how-to-solve-hard-and-soft-limit-machine-learning-jobs/268933 "2021-04-01T09:28:18Z")
Hello; I have created a machine learning job to detect port scanner using the packetbeat-\* index. type of job: Population Population field: destination.ip metric: distinct count(destination port) influencers: destin… --- ## [Execute aggs query for each unqiue value?](https://discuss.elastic.co/t/execute-aggs-query-for-each-unqiue-value/268997)
**Author:** [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Replies:** 0\ **Last updated:** [April 1, 2021, 8:38am UTC](https://discuss.elastic.co/t/execute-aggs-query-for-each-unqiue-value/268997 "2021-04-01T08:38:49Z")
Hi, I have the following script which gives me the 10 most used applications. I want to expand this by getting the top 10 applications for each unique value in the customers field. Is this possible? The goal is to appl… --- ## [ElasticSearch Kibana Fields with "keyword"](https://discuss.elastic.co/t/elasticsearch-kibana-fields-with-keyword/268202)
**Author:** [@miklin](https://discuss.elastic.co/u/miklin)\ **Replies:** 2\ **Last updated:** [April 1, 2021, 8:36am UTC](https://discuss.elastic.co/t/elasticsearch-kibana-fields-with-keyword/268202 "2021-04-01T08:36:43Z")
Hi, I had some questions about Kibana Data Analysis training, mainly in fields with "keyword". Why the search (occupation: "Sales") got a result of "Sales Engineer"? I thought it should be exact match for this search? … --- ## [Can't index a special word in Nest!](https://discuss.elastic.co/t/cant-index-a-special-word-in-nest/266457)
**Author:** [@ehsan\_kabiri\_33](https://discuss.elastic.co/u/ehsan_kabiri_33)\ **Replies:** 1\ **Last updated:** [April 1, 2021, 8:35am UTC](https://discuss.elastic.co/t/cant-index-a-special-word-in-nest/266457 "2021-04-01T08:35:20Z")
Let's look at the built in analyzer named "persian" var analyzeResponse = client.Indices.Analyze(a =\> a .Analyzer("persian") .Text("word1 words2 ManyWord3 LargeWOrds4 Sma… --- ## [Find values inside parenthesees and put it into an array](https://discuss.elastic.co/t/find-values-inside-parenthesees-and-put-it-into-an-array/268935)
**Author:** [@Roberto\_B](https://discuss.elastic.co/u/Roberto_B)\ **Replies:** 2\ **Last updated:** [April 1, 2021, 8:26am UTC](https://discuss.elastic.co/t/find-values-inside-parenthesees-and-put-it-into-an-array/268935 "2021-04-01T08:26:06Z")
Hi all, i have this problem , i have this kind of value into a field: Update for Windows Server 2012 R2 (KB3013410)"", Update for Windows Server 2012 R2 (KB3033446), Update for Windows Server 2012 R2 (KB3024751), Updat… --- ## [Kibana - How to do customized sort to saved objects API](https://discuss.elastic.co/t/kibana-how-to-do-customized-sort-to-saved-objects-api/266681)
**Author:** [@saifabusaleh](https://discuss.elastic.co/u/saifabusaleh)\ **Replies:** 2\ **Last updated:** [April 1, 2021, 7:27am UTC](https://discuss.elastic.co/t/kibana-how-to-do-customized-sort-to-saved-objects-api/266681 "2021-04-01T07:27:52Z")
Hi, We use: Kibana 7.10.0 Elastic 7.10.2 We use Kibana Saved Objects Find API to get all dashboards (https://www.elastic.co/guide/en/kibana/master/saved-objects-api-find.html) We want to get this dashboard data sort… --- ## [Elasticsearch load is low, batch write latency is high, how to check the problem](https://discuss.elastic.co/t/elasticsearch-load-is-low-batch-write-latency-is-high-how-to-check-the-problem/268975)
**Author:** [@bxl](https://discuss.elastic.co/u/bxl)\ **Replies:** 1\ **Last updated:** [April 1, 2021, 7:09am UTC](https://discuss.elastic.co/t/elasticsearch-load-is-low-batch-write-latency-is-high-how-to-check-the-problem/268975 "2021-04-01T07:09:43Z")
elasticsearch load is low, batch write latency is high, how to check the problem , thanks 13:24:27 22.6s{ "completed" : false, "task" : { "node" : "6nPgzz7\_Q96pQzAompMFUQ", "id" : 470791605, "type" : "tr… --- ## [Unique count two fields combined](https://discuss.elastic.co/t/unique-count-two-fields-combined/268987)
**Author:** [@kasun](https://discuss.elastic.co/u/kasun)\ **Replies:** 1\ **Last updated:** [April 1, 2021, 6:59am UTC](https://discuss.elastic.co/t/unique-count-two-fields-combined/268987 "2021-04-01T06:59:49Z")
Hi all, For a pie chart, I am using unique count aggregation as the metric. However, I need to get the unique count when two fields combined. Is this possible using the advanced option in kibana visualizations? As an e… --- ## [Best design for managing 'likes' on each comment?](https://discuss.elastic.co/t/best-design-for-managing-likes-on-each-comment/267607)
**Author:** [@Jenny1](https://discuss.elastic.co/u/Jenny1)\ **Replies:** 9\ **Last updated:** [April 1, 2021, 6:59am UTC](https://discuss.elastic.co/t/best-design-for-managing-likes-on-each-comment/267607 "2021-04-01T06:59:46Z")
Hi, I'm new to Elasticsearch and struggling with the design. I have 2 indices. One is 'comment' index which contains comments users wrote, the other is 'ex\_comment' which also contains comments but crawling data. What … --- ## [Kibana maximum results capped at 10000](https://discuss.elastic.co/t/kibana-maximum-results-capped-at-10000/267196)
**Author:** [@shamzeer](https://discuss.elastic.co/u/shamzeer)\ **Replies:** 6\ **Last updated:** [April 1, 2021, 6:58am UTC](https://discuss.elastic.co/t/kibana-maximum-results-capped-at-10000/267196 "2021-04-01T06:58:37Z")
We are using Elastic and Kibana version on 7.10. As per the documentations, the maximum results returned would be 10000. However this causes a real issue for us in the metric visualization where we use visualization to … --- ## [Elasticsearch failed to start on Ubuntu 18.04](https://discuss.elastic.co/t/elasticsearch-failed-to-start-on-ubuntu-18-04/268262)
**Author:** [@Sebastian\_F](https://discuss.elastic.co/u/Sebastian_F)\ **Replies:** 21\ **Last updated:** [April 1, 2021, 6:54am UTC](https://discuss.elastic.co/t/elasticsearch-failed-to-start-on-ubuntu-18-04/268262 "2021-04-01T06:54:29Z")
Hi folks, I am an elastic noob and I am stuck with running elasticsearch on an Ubuntu 18.04 V-Server with 4 Cores, 8Gb Ram and a 100GB Hard drive. I followed the instructions from this post: Installieren und Konfigurier… --- ## [Changing the index pattern that a visualisation is based on](https://discuss.elastic.co/t/changing-the-index-pattern-that-a-visualisation-is-based-on/268290)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 6\ **Last updated:** [April 1, 2021, 6:49am UTC](https://discuss.elastic.co/t/changing-the-index-pattern-that-a-visualisation-is-based-on/268290 "2021-04-01T06:49:57Z")
I have found a set of visualisation on github that I want to use. But they are build around a different pattern of index name to what I have even though the mapping are the same (or at least mostly). I have the ndjson … --- ## [Is the dependent jars can be upgraded](https://discuss.elastic.co/t/is-the-dependent-jars-can-be-upgraded/268866)
**Author:** [@mohammed\_rizwan](https://discuss.elastic.co/u/mohammed_rizwan)\ **Replies:** 3\ **Last updated:** [April 1, 2021, 6:43am UTC](https://discuss.elastic.co/t/is-the-dependent-jars-can-be-upgraded/268866 "2021-04-01T06:43:54Z")
Hi team, We are using the elastic search 7.2.0 which depends on snakeyaml version 1.17. Snakeyaml 1.17 has security vulnerabilities and we plan to upgrade it to the latest version 1.28. Is upgrading the dependant snak… --- ## [How to create a search saved object with kibana API](https://discuss.elastic.co/t/how-to-create-a-search-saved-object-with-kibana-api/268963)
**Author:** [@BhavyaSree](https://discuss.elastic.co/u/BhavyaSree)\ **Replies:** 1\ **Last updated:** [April 1, 2021, 5:41am UTC](https://discuss.elastic.co/t/how-to-create-a-search-saved-object-with-kibana-api/268963 "2021-04-01T05:41:00Z")
I tried to create a search saved object with kibana API. I could able to create the object with selected columns and sort, but I am unable to add filters to the search. Below is the body of POST call I used. { "attri… --- ## [Filter Logstash based on field from Filebeat tags](https://discuss.elastic.co/t/filter-logstash-based-on-field-from-filebeat-tags/268965)
**Author:** [@Automation\_Scripts](https://discuss.elastic.co/u/Automation_Scripts)\ **Replies:** 2\ **Last updated:** [April 1, 2021, 5:33am UTC](https://discuss.elastic.co/t/filter-logstash-based-on-field-from-filebeat-tags/268965 "2021-04-01T05:33:09Z")
Hi guys, I need some help filtering some data from Filebeat in Logstash. My original filebeat log looks liks this: \*\*\* This is the log from docker from filebeat container ssl.log "@timestamp": "2021-03-31T23:14:55.7… --- ## [Node disconnecting randomly](https://discuss.elastic.co/t/node-disconnecting-randomly/265085)
**Author:** [@DENMODSupport](https://discuss.elastic.co/u/DENMODSupport)\ **Replies:** 27\ **Last updated:** [April 1, 2021, 5:20am UTC](https://discuss.elastic.co/t/node-disconnecting-randomly/265085 "2021-04-01T05:20:07Z")
Hi, We could see that nodes are disconnecting frequently from cluster. Below are the errors from Master and data nodes. We are using ELK version 5.3.1. Could you please help us to prevent the node disconnection issue? \*… --- ## [Processor not dropping events Beats Winlogbeat](https://discuss.elastic.co/t/processor-not-dropping-events-beats-winlogbeat/268873)
**Author:** [@stinkfly](https://discuss.elastic.co/u/stinkfly)\ **Replies:** 2\ **Last updated:** [April 1, 2021, 2:50am UTC](https://discuss.elastic.co/t/processor-not-dropping-events-beats-winlogbeat/268873 "2021-04-01T02:50:56Z")
Hi there, V7.11.2 This topic has been addressed before and I've read other people's solutions, no luck. Have tried multiple combinations of and/or to drop windows event logs 4624 or 4634 with LogonType 0,3 or 5. Howe… --- ## [Upload logfile in the kibana](https://discuss.elastic.co/t/upload-logfile-in-the-kibana/268972)
**Author:** [@Son\_Vu\_Bao](https://discuss.elastic.co/u/Son_Vu_Bao)\ **Replies:** 6\ **Last updated:** [April 1, 2021, 3:22am UTC](https://discuss.elastic.co/t/upload-logfile-in-the-kibana/268972 "2021-04-01T03:22:01Z")
Hi, I am new in Elasticsearch. I am trying to upload a log file into elasticsearch by using data visualizer. However, I ran to some error like below: --- ## [Kibana : Internal Server Error](https://discuss.elastic.co/t/kibana-internal-server-error/268938)
**Author:** [@sanju\_timsina](https://discuss.elastic.co/u/sanju_timsina)\ **Replies:** 5\ **Last updated:** [April 1, 2021, 2:29am UTC](https://discuss.elastic.co/t/kibana-internal-server-error/268938 "2021-04-01T02:29:29Z")
Hi, I am running Kibana 7.11 and I am getting this Internal Server Error when I try to get logs on the Kibana Portal. log \[11:09:04.725\] \[info\]\[listening\] Server running at http://0.0.0.0:5601 log \[11:09:05.303… --- ## [How to get the realtime data based on aggrgations](https://discuss.elastic.co/t/how-to-get-the-realtime-data-based-on-aggrgations/268787)
**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\ **Replies:** 3\ **Last updated:** [March 31, 2021, 10:08pm UTC](https://discuss.elastic.co/t/how-to-get-the-realtime-data-based-on-aggrgations/268787 "2021-03-31T22:08:53Z")
Hi, With the below data, want to measure the time series graph with 30 sec resolution, how many are logged in and how many are Ready and how many are Busy. how to group by agent and find the status and sum the agents ba… --- ## [Make a pie chart based on one field where value is x, y, and z?](https://discuss.elastic.co/t/make-a-pie-chart-based-on-one-field-where-value-is-x-y-and-z/268828)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 3\ **Last updated:** [March 31, 2021, 10:06pm UTC](https://discuss.elastic.co/t/make-a-pie-chart-based-on-one-field-where-value-is-x-y-and-z/268828 "2021-03-31T22:06:28Z")
Hello I have a index pattern called my-index-x with entries and a text field that says Results. What I want to do is in a pie chart for example, make three or more slices: One slices would represent the number that "Su… --- ## [Split filebeat log with a variable length into several new events](https://discuss.elastic.co/t/split-filebeat-log-with-a-variable-length-into-several-new-events/268957)
**Author:** [@rmartinez.rv](https://discuss.elastic.co/u/rmartinez.rv)\ **Replies:** 2\ **Last updated:** [March 31, 2021, 9:49pm UTC](https://discuss.elastic.co/t/split-filebeat-log-with-a-variable-length-into-several-new-events/268957 "2021-03-31T21:49:48Z")
Hi. I'm fairly new with ELK, and i been struggling a lot trying to make this work, with no luck, so i'm asking for a way to solve this... I'm using Filebeat to get logs into my elasticsearc server and, the line logs ar… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1480) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1482)