# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1508 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1509 --- ## [Logstash avro codec multiple hostnames under schema\_uri](https://discuss.elastic.co/t/logstash-avro-codec-multiple-hostnames-under-schema-uri/267278)
**Author:** [@Sebastian\_Rodak](https://discuss.elastic.co/u/Sebastian_Rodak)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 2:42pm UTC](https://discuss.elastic.co/t/logstash-avro-codec-multiple-hostnames-under-schema-uri/267278 "2021-03-15T14:42:26Z")
Hi, We are checking avro schema for the required information / format of the event. I'd like to know because I couldn't found how to setup multiple schema\_uri for avro schema e.g output{ codec =\> avro { schema\_uri… --- ## [How to format number in logstash?](https://discuss.elastic.co/t/how-to-format-number-in-logstash/267182)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 3\ **Last updated:** [March 15, 2021, 2:21pm UTC](https://discuss.elastic.co/t/how-to-format-number-in-logstash/267182 "2021-03-15T14:21:30Z")
Suppose I want to sum field its sum range 1 to 10000 then shows like 10k, sum range from 10000 to million it shows in million and sum range more than millions then it shows in billions. Is it possible to perform such … --- ## [Elastic Agent healthy, but no data streams](https://discuss.elastic.co/t/elastic-agent-healthy-but-no-data-streams/265699)
**Author:** [@finbarr996](https://discuss.elastic.co/u/finbarr996)\ **Replies:** 9\ **Last updated:** [March 15, 2021, 2:20pm UTC](https://discuss.elastic.co/t/elastic-agent-healthy-but-no-data-streams/265699 "2021-03-15T14:20:10Z")
The Elastic Agent (7.11.1) is installed on a single Windows 10 test system and showing as 'Healthy' in Fleet, but I have no data appearing in streams. I have xpack security working with self generated certs - I have l… --- ## [Configure module Auditd with Kubectl \[Auditbeat 7.9.2\]](https://discuss.elastic.co/t/configure-module-auditd-with-kubectl-auditbeat-7-9-2/267048)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 1\ **Last updated:** [March 15, 2021, 2:19pm UTC](https://discuss.elastic.co/t/configure-module-auditd-with-kubectl-auditbeat-7-9-2/267048 "2021-03-15T14:19:27Z")
Hi, everyone I have been working with module Audit Module in order to log any execution of kubectl. Here you are my config: auditbeat.modules: - module: auditd audit\_rules: | -a always,exit -F exe=/usr/bin/kubec… --- ## [I have hypen separated in one column and i want to use that column in elastic search. Mapping created with type. Need to escape the hypen and get the whole value](https://discuss.elastic.co/t/i-have-hypen-separated-in-one-column-and-i-want-to-use-that-column-in-elastic-search-mapping-created-with-type-need-to-escape-the-hypen-and-get-the-whole-value/266998)
**Author:** [@Sreenath\_G](https://discuss.elastic.co/u/Sreenath_G)\ **Replies:** 3\ **Last updated:** [March 15, 2021, 2:15pm UTC](https://discuss.elastic.co/t/i-have-hypen-separated-in-one-column-and-i-want-to-use-that-column-in-elastic-search-mapping-created-with-type-need-to-escape-the-hypen-and-get-the-whole-value/266998 "2021-03-15T14:15:03Z")
Below is mapping: "TestID" : { "type" : "text", "fielddata" : true Example value of ID is "12333-1arerd-2333d-rrrrrwwqq" In the scripted field of the Index pattern i have given the below Script: if (doc\['TestID'\] … --- ## [Kibana not working](https://discuss.elastic.co/t/kibana-not-working/264907)
**Author:** [@realtech2338](https://discuss.elastic.co/u/realtech2338)\ **Replies:** 2\ **Last updated:** [March 15, 2021, 2:13pm UTC](https://discuss.elastic.co/t/kibana-not-working/264907 "2021-03-15T14:13:52Z")
i have installed elasticsearch and it is running but kibana is throwing below error: log \[00:40:42.667\] \[warning\]\[savedobjects-service\] Unable to connect to Elasticsearch. Error: resource\_already\_exists\_exception log… --- ## [Add a field starting from a substring of the file name](https://discuss.elastic.co/t/add-a-field-starting-from-a-substring-of-the-file-name/266337)
**Author:** [@JuanLuis\_Santiago\_de](https://discuss.elastic.co/u/JuanLuis_Santiago_de)\ **Replies:** 2\ **Last updated:** [March 15, 2021, 2:10pm UTC](https://discuss.elastic.co/t/add-a-field-starting-from-a-substring-of-the-file-name/266337 "2021-03-15T14:10:50Z")
Hello. I have several logs with the following names, where \[E-1\].\[P-28\], \[E-1\].\[P-45\] and \[E-1\].\[P-51\] are operators that generate these logs (I only can identify them by obtaining from the file name) p2sajava131.srv.g… --- ## [Painless: bug using for loops and vector functions](https://discuss.elastic.co/t/painless-bug-using-for-loops-and-vector-functions/267263)
**Author:** [@coreation](https://discuss.elastic.co/u/coreation)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 12:34pm UTC](https://discuss.elastic.co/t/painless-bug-using-for-loops-and-vector-functions/267263 "2021-03-15T12:34:17Z")
Hello everyone, I ran into what seems to be a bug in Painless where if a vector function is used, say l2norm(), the outcome remains the same outcome as the first iteration. I'm using the painless script in a function sc… --- ## [Combining (grouping) two records as one in Kibana Discover](https://discuss.elastic.co/t/combining-grouping-two-records-as-one-in-kibana-discover/266937)
**Author:** [@usman1](https://discuss.elastic.co/u/usman1)\ **Replies:** 2\ **Last updated:** [March 15, 2021, 12:13pm UTC](https://discuss.elastic.co/t/combining-grouping-two-records-as-one-in-kibana-discover/266937 "2021-03-15T12:13:00Z")
Hi, I want to group (aggregate) records on the basis of a specific ID. At the moment, my data has an event START and END record identified by the IDs. START and END record have different fields in them which I want to c… --- ## [Issue about Invalid stemmer class specified CJK](https://discuss.elastic.co/t/issue-about-invalid-stemmer-class-specified-cjk/267254)
**Author:** [@omaquaire](https://discuss.elastic.co/u/omaquaire)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 11:59am UTC](https://discuss.elastic.co/t/issue-about-invalid-stemmer-class-specified-cjk/267254 "2021-03-15T11:59:21Z")
Dear all, I know there is another topic that was created, but I could not find any usable solutions, and since I have been looking for the solution for hours, I resolute myself to post here. Overall, I know that I use … --- ## [IP reputation ELK integration](https://discuss.elastic.co/t/ip-reputation-elk-integration/265959)
**Author:** [@tarekilani](https://discuss.elastic.co/u/tarekilani)\ **Replies:** 2\ **Last updated:** [March 15, 2021, 11:57am UTC](https://discuss.elastic.co/t/ip-reputation-elk-integration/265959 "2021-03-15T11:57:21Z")
Hello, Please i'm trying to integrate abuseipdb API to elasticsearch so i can have a reputation score of the IP adressess. When i searched on the internet i only found tutorials talking about integrating abuseipdb with … --- ## [Implementing utf-8-sig in Logstash conf file](https://discuss.elastic.co/t/implementing-utf-8-sig-in-logstash-conf-file/267251)
**Author:** [@shafeeka](https://discuss.elastic.co/u/shafeeka)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 11:45am UTC](https://discuss.elastic.co/t/implementing-utf-8-sig-in-logstash-conf-file/267251 "2021-03-15T11:45:50Z")
Hi everyone, I was trying to implement skip\_header within my Csv filter plugin. However, I'm unsuccessful as my first column's header has this invisible \\ufeff character and hence it does not match the name I specified i… --- ## [Metricbeat - no counter paths were found](https://discuss.elastic.co/t/metricbeat-no-counter-paths-were-found/267224)
**Author:** [@Inammathe\_Inna](https://discuss.elastic.co/u/Inammathe_Inna)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 7:02am UTC](https://discuss.elastic.co/t/metricbeat-no-counter-paths-were-found/267224 "2021-03-15T07:02:19Z")
Hi, Periodically, we are finding our Windows servers stop sending perfmon metrics (other metrics e.g. cpu from the system module) continue just fine. The current workaround that gets them going again is restarting the … --- ## [Kibana discover not showing data](https://discuss.elastic.co/t/kibana-discover-not-showing-data/265918)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 9\ **Last updated:** [March 15, 2021, 10:00am UTC](https://discuss.elastic.co/t/kibana-discover-not-showing-data/265918 "2021-03-15T10:00:25Z")
i have the following indices log-pb-flow-2021.02.22-000001 log-pb-flow-2021.02.22-000002 health status index uuid pri rep docs.count docs.deleted store.size pri.store.size gre… --- ## [Search Issue with Long Text keyword](https://discuss.elastic.co/t/search-issue-with-long-text-keyword/266513)
**Author:** [@sdubey472](https://discuss.elastic.co/u/sdubey472)\ **Replies:** 6\ **Last updated:** [March 15, 2021, 9:30am UTC](https://discuss.elastic.co/t/search-issue-with-long-text-keyword/266513 "2021-03-15T09:30:34Z")
I'm facing the issue with elastic Search, Actually I've search query given bellow and By using this search query I'm facing the issue with long text, whenever I type long text to search then search isn't giving proper r… --- ## [FATAL Port 5601 is already in use. Another instance of Kibana may be running!](https://discuss.elastic.co/t/fatal-port-5601-is-already-in-use-another-instance-of-kibana-may-be-running/267108)
**Author:** [@Prasanth\_V](https://discuss.elastic.co/u/Prasanth_V)\ **Replies:** 2\ **Last updated:** [March 15, 2021, 9:26am UTC](https://discuss.elastic.co/t/fatal-port-5601-is-already-in-use-another-instance-of-kibana-may-be-running/267108 "2021-03-15T09:26:20Z")
Kibana is not running...Could anyone please help on this case? --- ## [Logstash S3 input plugin prefix with full path is ignored](https://discuss.elastic.co/t/logstash-s3-input-plugin-prefix-with-full-path-is-ignored/267236)
**Author:** [@noako](https://discuss.elastic.co/u/noako)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 9:17am UTC](https://discuss.elastic.co/t/logstash-s3-input-plugin-prefix-with-full-path-is-ignored/267236 "2021-03-15T09:17:48Z")
I am using logstash docker image with s3 input plugin for input, the issue I am having is: if I set the prefix to the full file path, then the file is ignored, with this log: 2021-03-14T11:43:56,233\]\[DEBUG\]\[logstash.i… --- ## [Caching query results](https://discuss.elastic.co/t/caching-query-results/267232)
**Author:** [@zegulas](https://discuss.elastic.co/u/zegulas)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 9:08am UTC](https://discuss.elastic.co/t/caching-query-results/267232 "2021-03-15T09:08:21Z")
Hello, I am trying to cache the query results, by sending ?request\_cache=true also i can see that the cache size is increasing, but i don't see any improvement in response time. Basically what is happening is, when we… --- ## [Elasticsearch single node is occasionally loaded very high](https://discuss.elastic.co/t/elasticsearch-single-node-is-occasionally-loaded-very-high/266904)
**Author:** [@bxl](https://discuss.elastic.co/u/bxl)\ **Replies:** 6\ **Last updated:** [March 15, 2021, 8:15am UTC](https://discuss.elastic.co/t/elasticsearch-single-node-is-occasionally-loaded-very-high/266904 "2021-03-15T08:15:15Z")
Hi, My ES cluster is used to store logs. When writing data in graylog, I found that occasionally the load of a node would suddenly increase, affecting the data written to the whole cluster. The node did not have gc, and… --- ## [How can resume logstash pipeline after terminated or crashed?](https://discuss.elastic.co/t/how-can-resume-logstash-pipeline-after-terminated-or-crashed/267029)
**Author:** [@Sage](https://discuss.elastic.co/u/Sage)\ **Replies:** 2\ **Last updated:** [March 15, 2021, 7:22am UTC](https://discuss.elastic.co/t/how-can-resume-logstash-pipeline-after-terminated-or-crashed/267029 "2021-03-15T07:22:35Z")
I designed a pipeline with elasticsearch as a input plugin and s3 as a output plugin. In my case, pipeline started successfully and push the data on s3 bucket but in case of termination or crash it does not start from wh… --- ## [Filebeat with a combination of netflow and iis](https://discuss.elastic.co/t/filebeat-with-a-combination-of-netflow-and-iis/267131)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 2\ **Last updated:** [March 15, 2021, 7:21am UTC](https://discuss.elastic.co/t/filebeat-with-a-combination-of-netflow-and-iis/267131 "2021-03-15T07:21:22Z")
Hi everyone, I have an ELK stack running on Ubuntu 20.04 server which is currently ingesting Filebeat IIS logs from a Windows machine. When I run the filebeat setup command from the Linux server to install the dashboar… --- ## [I have servers data im visulaizing them in kibana. I used Top hit as the aggregation metric for last updated time. In the buckets i have other fields to look at the data like a table. But im getting duplicates how do i get rid of this](https://discuss.elastic.co/t/i-have-servers-data-im-visulaizing-them-in-kibana-i-used-top-hit-as-the-aggregation-metric-for-last-updated-time-in-the-buckets-i-have-other-fields-to-look-at-the-data-like-a-table-but-im-getting-duplicates-how-do-i-get-rid-of-this/267094)
**Author:** [@sagar\_rao](https://discuss.elastic.co/u/sagar_rao)\ **Replies:** 2\ **Last updated:** [March 15, 2021, 6:47am UTC](https://discuss.elastic.co/t/i-have-servers-data-im-visulaizing-them-in-kibana-i-used-top-hit-as-the-aggregation-metric-for-last-updated-time-in-the-buckets-i-have-other-fields-to-look-at-the-data-like-a-table-but-im-getting-duplicates-how-do-i-get-rid-of-this/267094 "2021-03-15T06:47:08Z")
--- ## [java.lang.RuntimeException - I/O reactor status: STOPPED](https://discuss.elastic.co/t/java-lang-runtimeexception-i-o-reactor-status-stopped/267222)
**Author:** [@Sriram8894](https://discuss.elastic.co/u/Sriram8894)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 6:35am UTC](https://discuss.elastic.co/t/java-lang-runtimeexception-i-o-reactor-status-stopped/267222 "2021-03-15T06:35:30Z")
We are getting the below error while executing the search requests. We are using ElasticSearch 7.6v java.lang.RuntimeException: Request cannot be executed; I/O reactor status: STOPPED We are only using sync method to … --- ## [Configuration of elastic search using organisation specific certificates](https://discuss.elastic.co/t/configuration-of-elastic-search-using-organisation-specific-certificates/267223)
**Author:** [@Srinivas1602](https://discuss.elastic.co/u/Srinivas1602)\ **Replies:** 0\ **Last updated:** [March 15, 2021, 6:36am UTC](https://discuss.elastic.co/t/configuration-of-elastic-search-using-organisation-specific-certificates/267223 "2021-03-15T06:36:38Z")
Hi. I have a 3 node cluster setup with 2 data nodes and 1 master node setup running with tls/ssl/https enabled with the help of Elasticsearch offical documentation. However I would like to use our internal organisation… --- ## [Cluster Nodes are not reflecting](https://discuss.elastic.co/t/cluster-nodes-are-not-reflecting/267194)
**Author:** [@roh689](https://discuss.elastic.co/u/roh689)\ **Replies:** 4\ **Last updated:** [March 15, 2021, 5:07am UTC](https://discuss.elastic.co/t/cluster-nodes-are-not-reflecting/267194 "2021-03-15T05:07:43Z")
We were using elasticsearch with only 1 node i.e. ES01 which also have log data of almost 2 weeks. Now we are trying to expand to 3 nodes with additional 2 servers i.e. ES02 & ES03, configured yml files on these 2 server… --- ## [License for SSO option alone](https://discuss.elastic.co/t/license-for-sso-option-alone/267049)
**Author:** [@raja.parameswaran](https://discuss.elastic.co/u/raja.parameswaran)\ **Replies:** 4\ **Last updated:** [March 15, 2021, 3:39am UTC](https://discuss.elastic.co/t/license-for-sso-option-alone/267049 "2021-03-15T03:39:31Z")
Hi, I am new to Elastic Stack. We are looking at embedding Kibana dashboard inside our application. We are planning to go with the Basic version of Elastic stack(free version) to begin with. However, we want to have the… --- ## [Can we have default filter?](https://discuss.elastic.co/t/can-we-have-default-filter/266205)
**Author:** [@Abhishek\_Vyas1](https://discuss.elastic.co/u/Abhishek_Vyas1)\ **Replies:** 2\ **Last updated:** [March 15, 2021, 3:33am UTC](https://discuss.elastic.co/t/can-we-have-default-filter/266205 "2021-03-15T03:33:40Z")
Is it possible to have a default filter that is hidden from dash board. Mainly the need is as follows :- we have key name area which have 4 different values (as A,B,C,D). So whenever user choose a given area in front e… --- ## [3 nodes in the cluster, 2 data and 1 master - why if one fails it takes the whole cluster down?](https://discuss.elastic.co/t/3-nodes-in-the-cluster-2-data-and-1-master-why-if-one-fails-it-takes-the-whole-cluster-down/267165)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 14\ **Last updated:** [March 15, 2021, 3:27am UTC](https://discuss.elastic.co/t/3-nodes-in-the-cluster-2-data-and-1-master-why-if-one-fails-it-takes-the-whole-cluster-down/267165 "2021-03-15T03:27:24Z")
Hello, I have 3 nodes; 2 data nodes and 1 master node. When one of the data nodes fails, the whole cluster stops processing data, nothing is shown in Kibana anymore, even though a data node is working and receiving data… --- ## [ES 7.7.0 / LS 7.7.0 - Logstash not writing to a green index when some data nodes are down](https://discuss.elastic.co/t/es-7-7-0-ls-7-7-0-logstash-not-writing-to-a-green-index-when-some-data-nodes-are-down/267205)
**Author:** [@ld\_pvl](https://discuss.elastic.co/u/ld_pvl)\ **Replies:** 0\ **Last updated:** [March 14, 2021, 11:49pm UTC](https://discuss.elastic.co/t/es-7-7-0-ls-7-7-0-logstash-not-writing-to-a-green-index-when-some-data-nodes-are-down/267205 "2021-03-14T23:49:55Z")
Hi Team, I had a strange problem the other day and could not figure out what was happening. In my cluster, about 30% of my data nodes were brought down (intentionally). The cluster became red as expected but still had … --- ## [Minimum grants required for application user to manipulate indices data](https://discuss.elastic.co/t/minimum-grants-required-for-application-user-to-manipulate-indices-data/267201)
**Author:** [@raulk89](https://discuss.elastic.co/u/raulk89)\ **Replies:** 0\ **Last updated:** [March 14, 2021, 8:08pm UTC](https://discuss.elastic.co/t/minimum-grants-required-for-application-user-to-manipulate-indices-data/267201 "2021-03-14T20:08:55Z")
Hi Elastic 7.11.1 When enable-ing security on my elastic cluster. Then applications that access data, need to have an user for these operations. My question is, what would be the minimum roles/grants that need to be a… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1507) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1509)