# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1491 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1492 --- ## [How to connect Sybase Sql Anywhere 9 with logstash](https://discuss.elastic.co/t/how-to-connect-sybase-sql-anywhere-9-with-logstash/268390)
**Author:** [@AltC](https://discuss.elastic.co/u/AltC)\ **Replies:** 1\ **Last updated:** [March 25, 2021, 5:45pm UTC](https://discuss.elastic.co/t/how-to-connect-sybase-sql-anywhere-9-with-logstash/268390 "2021-03-25T17:45:24Z")
I'm new to using Elasticsearh components, and I'm having trouble connecting the Sybase SqlAnywhere database to LogStash. Below the configuration file to connect LogStash to SqlAnywhere is showing an error, I have already… --- ## [Create a new node](https://discuss.elastic.co/t/create-a-new-node/267782)
**Author:** [@Weathmious](https://discuss.elastic.co/u/Weathmious)\ **Replies:** 7\ **Last updated:** [March 25, 2021, 4:49pm UTC](https://discuss.elastic.co/t/create-a-new-node/267782 "2021-03-25T16:49:20Z")
Hello I currently have my elasticsearch service that has only one node, and I would like to do a second one (on the same server), but I really can’t figure out how to do it. The goal would be to add a "hot" node and a … --- ## [Sleeping for \[3m\] after modifying repository](https://discuss.elastic.co/t/sleeping-for-3m-after-modifying-repository/268370)
**Author:** [@dwilches](https://discuss.elastic.co/u/dwilches)\ **Replies:** 6\ **Last updated:** [March 25, 2021, 4:41pm UTC](https://discuss.elastic.co/t/sleeping-for-3m-after-modifying-repository/268370 "2021-03-25T16:41:56Z")
We started receiving the Sleeping for \[3m\] after modifying repository .... because it contains snapshots older than version \[7.6.0\] in production after upgrading from 7.5.2 to 7.10.2, so we created new repos and started … --- ## [Can logstash parse same type of multiple log files?](https://discuss.elastic.co/t/can-logstash-parse-same-type-of-multiple-log-files/268024)
**Author:** [@sourabhjain104](https://discuss.elastic.co/u/sourabhjain104)\ **Replies:** 4\ **Last updated:** [March 25, 2021, 4:40pm UTC](https://discuss.elastic.co/t/can-logstash-parse-same-type-of-multiple-log-files/268024 "2021-03-25T16:40:11Z")
Hello, I have a question regarding the multiple log files (of similar type) parsing by logstash. Scenario :- My application generate log files every day,(2 log files in a day) by the name of intranet-YYYY-MM-DD-PORT.l… --- ## [Is there a way to export the CSV Formatted report of a dashboard (visualization) in Kibana programmatically?](https://discuss.elastic.co/t/is-there-a-way-to-export-the-csv-formatted-report-of-a-dashboard-visualization-in-kibana-programmatically/268294)
**Author:** [@suresh123](https://discuss.elastic.co/u/suresh123)\ **Replies:** 3\ **Last updated:** [March 25, 2021, 3:55pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-export-the-csv-formatted-report-of-a-dashboard-visualization-in-kibana-programmatically/268294 "2021-03-25T15:55:23Z")
Hi Experts, I have created a visualization with required fields using Data Table visualization. It gives Export: Raw and Formatted options at the left bottom. How can I export(download) using API or programmatically o… --- ## [Match all in js sdk does not return values, while curl does](https://discuss.elastic.co/t/match-all-in-js-sdk-does-not-return-values-while-curl-does/268322)
**Author:** [@yishain11](https://discuss.elastic.co/u/yishain11)\ **Replies:** 7\ **Last updated:** [March 25, 2021, 3:47pm UTC](https://discuss.elastic.co/t/match-all-in-js-sdk-does-not-return-values-while-curl-does/268322 "2021-03-25T15:47:27Z")
Hi elastic wizards. I have strange issue with elasticsearch (7.11). I have an index called "test\_index", and when I query it using curl and "match\_all" it returns a value, but when I use the node js client, it does not… --- ## [ElasticSearch Split API - excessive use of disk space](https://discuss.elastic.co/t/elasticsearch-split-api-excessive-use-of-disk-space/268326)
**Author:** [@Landong.Zuo](https://discuss.elastic.co/u/Landong.Zuo)\ **Replies:** 3\ **Last updated:** [March 25, 2021, 3:47pm UTC](https://discuss.elastic.co/t/elasticsearch-split-api-excessive-use-of-disk-space/268326 "2021-03-25T15:47:49Z")
Hello, I've installed ElasticSearch 7.11.2 on a 3 node cluster on AWS EC2 linux 2. I need to split a big index (100GB on disk, 1 primary shard and 1 replica shard) to 6 primary shards and 6 replica shards using the spl… --- ## [Log viewing - ELK](https://discuss.elastic.co/t/log-viewing-elk/268106)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 4\ **Last updated:** [March 25, 2021, 3:31pm UTC](https://discuss.elastic.co/t/log-viewing-elk/268106 "2021-03-25T15:31:54Z")
Hello there, I have set up the following configuration in filebeat config file but it is not picking up the second input. not sure why filebeat.inputs: type: log enabled: true paths: C:\\ELK7.9.2\\Logs\*.log type: … --- ## [Logstash cannot run one of the pipelines](https://discuss.elastic.co/t/logstash-cannot-run-one-of-the-pipelines/268369)
**Author:** [@Ishaan](https://discuss.elastic.co/u/Ishaan)\ **Replies:** 0\ **Last updated:** [March 25, 2021, 3:04pm UTC](https://discuss.elastic.co/t/logstash-cannot-run-one-of-the-pipelines/268369 "2021-03-25T15:04:01Z")
Hello, One of the logstash pipelines is not working and I can run the pipeline in the debug mode because it is centrally managed in kibana UI. How can debug the config? How can I look for errors? --- ## [ElasticSearch for realtime metrics/KPIs of a system](https://discuss.elastic.co/t/elasticsearch-for-realtime-metrics-kpis-of-a-system/267845)
**Author:** [@Nuno\_Centeio](https://discuss.elastic.co/u/Nuno_Centeio)\ **Replies:** 8\ **Last updated:** [March 25, 2021, 2:38pm UTC](https://discuss.elastic.co/t/elasticsearch-for-realtime-metrics-kpis-of-a-system/267845 "2021-03-25T14:38:41Z")
Hi! I need an advice. This is a very simplified version of what I have. I've developed an API that returns some metrics of things that happens on my system. For example, how many time the user is logged, the number of … --- ## [Logstash filter "if" condition to check if field exist or not](https://discuss.elastic.co/t/logstash-filter-if-condition-to-check-if-field-exist-or-not/268336)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 1\ **Last updated:** [March 25, 2021, 2:20pm UTC](https://discuss.elastic.co/t/logstash-filter-if-condition-to-check-if-field-exist-or-not/268336 "2021-03-25T14:20:14Z")
Is there any way in Logstash to check if a certain field exists or not? My use-case: I want to add a field "status: missing" when the field "httpStatus" doesn't come in the log document. --- ## [Unable to Start Elasticsearch 7.12 in Ubuntu 18.04](https://discuss.elastic.co/t/unable-to-start-elasticsearch-7-12-in-ubuntu-18-04/268330)
**Author:** [@chinkleet](https://discuss.elastic.co/u/chinkleet)\ **Replies:** 3\ **Last updated:** [March 25, 2021, 2:09pm UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-7-12-in-ubuntu-18-04/268330 "2021-03-25T14:09:05Z")
I have installed "elasticsearch" 7.12 version on Ubuntu 18.04 machine. when trying to start the "elasticsearch" service getting below error: (base) extramarks@extramarks-Latitude-3400:~/Downloads$ systemctl status ela… --- ## [Filter for each output in multiple outputs](https://discuss.elastic.co/t/filter-for-each-output-in-multiple-outputs/268358)
**Author:** [@Charith\_sattiva](https://discuss.elastic.co/u/Charith_sattiva)\ **Replies:** 0\ **Last updated:** [March 25, 2021, 2:04pm UTC](https://discuss.elastic.co/t/filter-for-each-output-in-multiple-outputs/268358 "2021-03-25T14:04:12Z")
Hello, I would like to send logs to multiple hosts in the output plugin of logstash. Is there a way I can filter logs for each output separately using the filter plugin? Thanks in advance --- ## [Elasticsearch Load Balancer Recommendation](https://discuss.elastic.co/t/elasticsearch-load-balancer-recommendation/268286)
**Author:** [@muthucse](https://discuss.elastic.co/u/muthucse)\ **Replies:** 3\ **Last updated:** [March 25, 2021, 1:53pm UTC](https://discuss.elastic.co/t/elasticsearch-load-balancer-recommendation/268286 "2021-03-25T13:53:38Z")
The cluster has 5 hot nodes, 3 warm nodes and 3 dedicated master nodes (on-premise). We process the logs from multiple applications using Beats plugin. As we have option in Beats to add array of data nodes with loadbalan… --- ## [Kibana show Images](https://discuss.elastic.co/t/kibana-show-images/268349)
**Author:** [@rildo](https://discuss.elastic.co/u/rildo)\ **Replies:** 1\ **Last updated:** [March 25, 2021, 1:33pm UTC](https://discuss.elastic.co/t/kibana-show-images/268349 "2021-03-25T13:33:56Z")
I have a doubt . I have a table x that contains a column called images (type jsonb) in my postgresql database. I migrated this data to elasticsearch, however, only the image metadata appears, I would like to know if it i… --- ## [Search IP fields](https://discuss.elastic.co/t/search-ip-fields/268223)
**Author:** [@Skeeve](https://discuss.elastic.co/u/Skeeve)\ **Replies:** 2\ **Last updated:** [March 25, 2021, 12:47pm UTC](https://discuss.elastic.co/t/search-ip-fields/268223 "2021-03-25T12:47:50Z")
I have an field called "ip" being of type "ip". When I search using the API, I can enter GET mbp\_ip/\_search { "query": { "term": { "ip": "88.198.248.0/24" } } } But I … --- ## [Logstash input file plugin feature proposal - possibility to disable file truncation detection](https://discuss.elastic.co/t/logstash-input-file-plugin-feature-proposal-possibility-to-disable-file-truncation-detection/268339)
**Author:** [@maciejfranek](https://discuss.elastic.co/u/maciejfranek)\ **Replies:** 0\ **Last updated:** [March 25, 2021, 12:34pm UTC](https://discuss.elastic.co/t/logstash-input-file-plugin-feature-proposal-possibility-to-disable-file-truncation-detection/268339 "2021-03-25T12:34:20Z")
Hello everyone, I've been using logstash with azure files, but I reached nasty problem with it - logstash produced a lot of duplicated log events in the output due to file truncation detection. I've already created iss… --- ## [Mapping conflict after upgrade filebeat to to 7.12](https://discuss.elastic.co/t/mapping-conflict-after-upgrade-filebeat-to-to-7-12/268338)
**Author:** [@molekuul](https://discuss.elastic.co/u/molekuul)\ **Replies:** 0\ **Last updated:** [March 25, 2021, 12:34pm UTC](https://discuss.elastic.co/t/mapping-conflict-after-upgrade-filebeat-to-to-7-12/268338 "2021-03-25T12:34:02Z")
Hi, After the filebeat upgrade from 7.11.1 to 7.12.0 I get an Mapping conflict for field: postgresql.log.error.code It seems like in 7.11.1 this field has a type long but in 7.12 the type is keyword How can I fix thi… --- ## [Change top left Elastic logo on opendistro kibana](https://discuss.elastic.co/t/change-top-left-elastic-logo-on-opendistro-kibana/268334)
**Author:** [@\_Tekle](https://discuss.elastic.co/u/_Tekle)\ **Replies:** 1\ **Last updated:** [March 25, 2021, 12:28pm UTC](https://discuss.elastic.co/t/change-top-left-elastic-logo-on-opendistro-kibana/268334 "2021-03-25T12:28:10Z")
hello team, how can I change the top left elasic logo in opendistro, I want to use my logo here. please help me. --- ## [Elasticsearch - JMX Exporter](https://discuss.elastic.co/t/elasticsearch-jmx-exporter/268332)
**Author:** [@Joshua3](https://discuss.elastic.co/u/Joshua3)\ **Replies:** 0\ **Last updated:** [March 25, 2021, 11:53am UTC](https://discuss.elastic.co/t/elasticsearch-jmx-exporter/268332 "2021-03-25T11:53:25Z")
Hello, i'm using JMX Exporter to get MBeans from Elasticsearch running in Docker container. This is part of Docker environment to parsing in to container to run Java JMX exporter as JavaAgent -e ES\_JAVA\_OPTS=-javaagent… --- ## [How to insert date type column of a csv file in the format "dd:MM:YYYY HH:mm:ss" into elasticsearch through logstash config](https://discuss.elastic.co/t/how-to-insert-date-type-column-of-a-csv-file-in-the-format-ddyyyy-hhss-into-elasticsearch-through-logstash-config/268189)
**Author:** [@DEEPTHI\_SONA\_G](https://discuss.elastic.co/u/DEEPTHI_SONA_G)\ **Replies:** 4\ **Last updated:** [March 25, 2021, 11:30am UTC](https://discuss.elastic.co/t/how-to-insert-date-type-column-of-a-csv-file-in-the-format-ddyyyy-hhss-into-elasticsearch-through-logstash-config/268189 "2021-03-25T11:30:11Z")
I'm trying to insert data from a csv file into elasticsearch using logstash. I have tried adding date { match =\> \["SIGHTING\_TIME", "dd-MM-YYYY HH:mm:ss"\] target =\>"SIGHTING\_TIME" } in … --- ## [How can I match multimatch with NEST in elasticsearch?](https://discuss.elastic.co/t/how-can-i-match-multimatch-with-nest-in-elasticsearch/268304)
**Author:** [@Celal\_Poyraz](https://discuss.elastic.co/u/Celal_Poyraz)\ **Replies:** 3\ **Last updated:** [March 25, 2021, 11:23am UTC](https://discuss.elastic.co/t/how-can-i-match-multimatch-with-nest-in-elasticsearch/268304 "2021-03-25T11:23:44Z")
I want to search with RegisterNumber and Title at the same time. But how can I match both at the same time? Also, when I press the space character, I cannot make calls after the space. How can I solve this? Currently sea… --- ## [Kibana 7.9 Index Patterns Do Not Pick Up Source Fields](https://discuss.elastic.co/t/kibana-7-9-index-patterns-do-not-pick-up-source-fields/268220)
**Author:** [@SKRYMr](https://discuss.elastic.co/u/SKRYMr)\ **Replies:** 8\ **Last updated:** [March 25, 2021, 11:01am UTC](https://discuss.elastic.co/t/kibana-7-9-index-patterns-do-not-pick-up-source-fields/268220 "2021-03-25T11:01:16Z")
Hello, I was trying to set up some visualizations for our data so I created an index pattern to match all our production indices. What happens is that the indices are matched correctly but only "root" fields are picked … --- ## [ERR Failed to publish events caused by: write tcp - wsasend: An existing connection was forcibly closed by the remote host](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-write-tcp-wsasend-an-existing-connection-was-forcibly-closed-by-the-remote-host/268321)
**Author:** [@My\_Google\_Account](https://discuss.elastic.co/u/My_Google_Account)\ **Replies:** 0\ **Last updated:** [March 25, 2021, 10:47am UTC](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-write-tcp-wsasend-an-existing-connection-was-forcibly-closed-by-the-remote-host/268321 "2021-03-25T10:47:59Z")
good afternoon! logstash version is 5.6.2, filebeat for windows version is 5.1.1, i have a problem with one of our filebeat agents and see in filebeat log file this: ERR Failed to publish events caused by: write tcp - w… --- ## [RabbitMQ ingest pipeline can't parse some log entries](https://discuss.elastic.co/t/rabbitmq-ingest-pipeline-cant-parse-some-log-entries/268317)
**Author:** [@amelnyk](https://discuss.elastic.co/u/amelnyk)\ **Replies:** 0\ **Last updated:** [March 25, 2021, 10:14am UTC](https://discuss.elastic.co/t/rabbitmq-ingest-pipeline-cant-parse-some-log-entries/268317 "2021-03-25T10:14:24Z")
Some logs (Erlang VM) can't be parsed by the provided grok expression, example log entries: 2019-07-29 14:14:43.032 \[error\] emulator Discarding message {'$gen\_call',{\<0.442.0\>,#Ref\<0.3746561768.1184890881.104501\>},stat}… --- ## [ECS fields not applied from index template](https://discuss.elastic.co/t/ecs-fields-not-applied-from-index-template/267056)
**Author:** [@jfs1](https://discuss.elastic.co/u/jfs1)\ **Replies:** 6\ **Last updated:** [March 25, 2021, 10:01am UTC](https://discuss.elastic.co/t/ecs-fields-not-applied-from-index-template/267056 "2021-03-25T10:01:02Z")
I'm trying to reformat my index template to migrate to ECS. I think I'm missing something because the field format for the multi-level keys is not taken into account. My index template looks like this : { "te… --- ## [Recommendation to use search after instead of scrolling](https://discuss.elastic.co/t/recommendation-to-use-search-after-instead-of-scrolling/268293)
**Author:** [@prelator](https://discuss.elastic.co/u/prelator)\ **Replies:** 4\ **Last updated:** [March 25, 2021, 9:58am UTC](https://discuss.elastic.co/t/recommendation-to-use-search-after-instead-of-scrolling/268293 "2021-03-25T09:58:20Z")
Hello everybody If you want to read an index completely, you can read in the documentation that the search after function should be used from 10,000 documents (instead of scroll). We have now tested this and unfortunat… --- ## [BulkProcessor using BulkRequest with wait\_for](https://discuss.elastic.co/t/bulkprocessor-using-bulkrequest-with-wait-for/268308)
**Author:** [@jbalaguero](https://discuss.elastic.co/u/jbalaguero)\ **Replies:** 2\ **Last updated:** [March 25, 2021, 9:49am UTC](https://discuss.elastic.co/t/bulkprocessor-using-bulkrequest-with-wait-for/268308 "2021-03-25T09:49:24Z")
Hello, We are trying to set a "wait\_for" refresh policy for every bulk request we are performing. It seems the only way is setting this policy on the 'beforeBulk' method on the bulk listener in this way: public void be… --- ## [Elastic cannot restore incremental snapshot in new cluster](https://discuss.elastic.co/t/elastic-cannot-restore-incremental-snapshot-in-new-cluster/268052)
**Author:** [@Adrian\_Birladeanu](https://discuss.elastic.co/u/Adrian_Birladeanu)\ **Replies:** 14\ **Last updated:** [March 25, 2021, 9:41am UTC](https://discuss.elastic.co/t/elastic-cannot-restore-incremental-snapshot-in-new-cluster/268052 "2021-03-25T09:41:27Z")
Hello. I have created an s3 repository and created a full snapshot and several incremental snapshots (though the data didn't change since the full snapshot was taken. I'm still working on the development infrastructure).… --- ## [Hourly rate pricing](https://discuss.elastic.co/t/hourly-rate-pricing/268231)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 5\ **Last updated:** [March 25, 2021, 9:15am UTC](https://discuss.elastic.co/t/hourly-rate-pricing/268231 "2021-03-25T09:15:39Z")
Hi, I've created a new account in Elastic Cloud, with a trial period. Out of curiosity I wanted to check the "Billing" section and I noticed a strange cost. $ 0.2714 of "hourly rate" for "Cloud Standard Data High I… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1490) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1492)