# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1518 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1519 --- ## [Logstash Grok Pattern for Timestamp with Timezone](https://discuss.elastic.co/t/logstash-grok-pattern-for-timestamp-with-timezone/266268)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 3\ **Last updated:** [March 8, 2021, 4:59pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern-for-timestamp-with-timezone/266268 "2021-03-08T16:59:35Z")
Hi, I am trying to match following logs for icinga2 using grok filter: \[2021-03-04 17:03:27 +0100\] warning/GraphiteWriter: Ignoring invalid perfdata for checkable 'host!service' and command 'by\_ssh' with value: /foo/ba… --- ## [Ruby syntax error only in logstash](https://discuss.elastic.co/t/ruby-syntax-error-only-in-logstash/266488)
**Author:** [@tangkalo](https://discuss.elastic.co/u/tangkalo)\ **Replies:** 3\ **Last updated:** [March 8, 2021, 4:57pm UTC](https://discuss.elastic.co/t/ruby-syntax-error-only-in-logstash/266488 "2021-03-08T16:57:10Z")
Hi, I am trying to use the ruby plugin to parse a field of array type and then generate new fields out of some of elements. However, I encountered the following error. Similar ruby codes(i.e. the statement to set event)… --- ## [What is the difference a between "system.memory.used.bytes" and "vsphere.virtualmachine.memory.used.guest.bytes"?](https://discuss.elastic.co/t/what-is-the-difference-a-between-system-memory-used-bytes-and-vsphere-virtualmachine-memory-used-guest-bytes/266591)
**Author:** [@Ishaan](https://discuss.elastic.co/u/Ishaan)\ **Replies:** 0\ **Last updated:** [March 8, 2021, 4:48pm UTC](https://discuss.elastic.co/t/what-is-the-difference-a-between-system-memory-used-bytes-and-vsphere-virtualmachine-memory-used-guest-bytes/266591 "2021-03-08T16:48:36Z")
Hello, I have installed metricbeat agent on one of my linux virtual machines, and I'm also collecting metrics using vSphere module from vCenter. So the above virtual machine where the metricbeat agent is installed is a… --- ## [Query get error when using serial\_diff with bucket\_selector](https://discuss.elastic.co/t/query-get-error-when-using-serial-diff-with-bucket-selector/263716)
**Author:** [@pablocp](https://discuss.elastic.co/u/pablocp)\ **Replies:** 2\ **Last updated:** [March 8, 2021, 4:47pm UTC](https://discuss.elastic.co/t/query-get-error-when-using-serial-diff-with-bucket-selector/263716 "2021-03-08T16:47:35Z")
I have a set of products, and each product has a price that varies in time. I want to find those products that comparing to week -1 have decreased its average value a %. I thought it would be fine to make a query and to … --- ## [Time line visualisation](https://discuss.elastic.co/t/time-line-visualisation/266564)
**Author:** [@bab](https://discuss.elastic.co/u/bab)\ **Replies:** 1\ **Last updated:** [March 8, 2021, 4:06pm UTC](https://discuss.elastic.co/t/time-line-visualisation/266564 "2021-03-08T16:06:46Z")
Hi all, i'm trying to build a time line visualization on kibana using Date field on X axis and Terms field on y Aces, but i see that all Kibana visualization must have a metric on y-axis, which is a count or avg and so … --- ## [Java heap space issues](https://discuss.elastic.co/t/java-heap-space-issues/266407)
**Author:** [@vee](https://discuss.elastic.co/u/vee)\ **Replies:** 1\ **Last updated:** [March 8, 2021, 3:36pm UTC](https://discuss.elastic.co/t/java-heap-space-issues/266407 "2021-03-08T15:36:57Z")
Hi - we have seen a couple of times since yesterday where some of the elastic nodes are crashing due to java.lang.Exception: java.lang.OutOfMemoryError: Java heap space error. This happened on the client node, ingest no… --- ## [Filebeat i/o timeout error](https://discuss.elastic.co/t/filebeat-i-o-timeout-error/266581)
**Author:** [@iammanmale](https://discuss.elastic.co/u/iammanmale)\ **Replies:** 0\ **Last updated:** [March 8, 2021, 3:36pm UTC](https://discuss.elastic.co/t/filebeat-i-o-timeout-error/266581 "2021-03-08T15:36:46Z")
We are using filebeat on aws windows machines to push their log to local logstash and then local ES. Recently, some error occurs when I enter the command to test the output status on those AWS machines. The command is… --- ## [Refresh Fields Button not available in the Latest Version of Kibana](https://discuss.elastic.co/t/refresh-fields-button-not-available-in-the-latest-version-of-kibana/266571)
**Author:** [@antony\_kavin](https://discuss.elastic.co/u/antony_kavin)\ **Replies:** 1\ **Last updated:** [March 8, 2021, 3:32pm UTC](https://discuss.elastic.co/t/refresh-fields-button-not-available-in-the-latest-version-of-kibana/266571 "2021-03-08T15:32:44Z")
Hi Team, I am using Kibana version 7.11.1. I have added some new fields to my existing index. And when I tried to refresh the fields by selecting the index patterns in Kibana, I was not able to see the Refresh fields … --- ## [Kibana bucket selector aggregation usage](https://discuss.elastic.co/t/kibana-bucket-selector-aggregation-usage/266516)
**Author:** [@Muhammad\_Faisal](https://discuss.elastic.co/u/Muhammad_Faisal)\ **Replies:** 1\ **Last updated:** [March 8, 2021, 3:24pm UTC](https://discuss.elastic.co/t/kibana-bucket-selector-aggregation-usage/266516 "2021-03-08T15:24:32Z")
hi all, i am doing "serial difference" metric aggregation on a field "value"...this gives me delta(difference in values) on the value field over time...i need to drop those buckets whole value did not change i.e. its ze… --- ## [Any efficient way to perform shards reduction of the original index? Need to do shards rebalancing after shards reduction?](https://discuss.elastic.co/t/any-efficient-way-to-perform-shards-reduction-of-the-original-index-need-to-do-shards-rebalancing-after-shards-reduction/266574)
**Author:** [@qub123](https://discuss.elastic.co/u/qub123)\ **Replies:** 0\ **Last updated:** [March 8, 2021, 3:08pm UTC](https://discuss.elastic.co/t/any-efficient-way-to-perform-shards-reduction-of-the-original-index-need-to-do-shards-rebalancing-after-shards-reduction/266574 "2021-03-08T15:08:33Z")
Hi, we are trying to reduce number of primary shards, from 5 shards and one replica shard of each primary, to 2 primary shards and one replica of each primary shard. The process we are going to do as follow. Wondering i… --- ## [CSV file of System Metrics](https://discuss.elastic.co/t/csv-file-of-system-metrics/266573)
**Author:** [@efweber](https://discuss.elastic.co/u/efweber)\ **Replies:** 0\ **Last updated:** [March 8, 2021, 3:06pm UTC](https://discuss.elastic.co/t/csv-file-of-system-metrics/266573 "2021-03-08T15:06:22Z")
I'm a new elasticsearch user. What I'd like to do is capture a csv file of system metrics. I want to use this data in parallel with captured application data to analyze and then optimize system configuration and make app… --- ## [Multiplication of series in Kibana](https://discuss.elastic.co/t/multiplication-of-series-in-kibana/266006)
**Author:** [@Shailendra\_Chauhan](https://discuss.elastic.co/u/Shailendra_Chauhan)\ **Replies:** 2\ **Last updated:** [March 8, 2021, 1:25pm UTC](https://discuss.elastic.co/t/multiplication-of-series-in-kibana/266006 "2021-03-08T13:25:08Z")
Hi, Background: For application monitoring I have various monitors that pings several component periodically that makes up a complete application/system. Each of these individual ping in inserted into elasticsearch with… --- ## [org.elasticsearch.common.breaker.CircuitBreakingException](https://discuss.elastic.co/t/org-elasticsearch-common-breaker-circuitbreakingexception/266559)
**Author:** [@mandeep](https://discuss.elastic.co/u/mandeep)\ **Replies:** 0\ **Last updated:** [March 8, 2021, 1:09pm UTC](https://discuss.elastic.co/t/org-elasticsearch-common-breaker-circuitbreakingexception/266559 "2021-03-08T13:09:25Z")
Hi while indexing document in the ES7.x we are getting this error. Any suggestions :pray:: logs: org.elasticsearch.common.breaker.CircuitBreakingException: \[parent\] Data too large, data for \[\\] would … --- ## [Contains condition on multiple index - Filebeat](https://discuss.elastic.co/t/contains-condition-on-multiple-index-filebeat/266128)
**Author:** [@graimato](https://discuss.elastic.co/u/graimato)\ **Replies:** 2\ **Last updated:** [March 8, 2021, 12:59pm UTC](https://discuss.elastic.co/t/contains-condition-on-multiple-index-filebeat/266128 "2021-03-08T12:59:28Z")
Hello, I'm using filebeat to collect information from log but I need to slip them on different Indexes. To do this I'm using indices: - index: "filebeat-%{\[agent.version\]}-api-%{+yyyy.MM.dd}" when.contains: … --- ## [Elasticsearch Ingest node restart with "java.lang.OutOfMemoryError: Java heap space"](https://discuss.elastic.co/t/elasticsearch-ingest-node-restart-with-java-lang-outofmemoryerror-java-heap-space/266085)
**Author:** [@sarthaksahu](https://discuss.elastic.co/u/sarthaksahu)\ **Replies:** 5\ **Last updated:** [March 8, 2021, 12:57pm UTC](https://discuss.elastic.co/t/elasticsearch-ingest-node-restart-with-java-lang-outofmemoryerror-java-heap-space/266085 "2021-03-08T12:57:46Z")
Elastic Version: 6.5.4 ES cluster has 16 ingest nodes with -Xms8g -Xmx8g. We have around 120 fluentd pushing the data to ES cluster. The ingest nodes are getting restarted with java.lang.OutOfMemoryError: Java heap sp… --- ## [Get notified when some documents appeared in a saved search](https://discuss.elastic.co/t/get-notified-when-some-documents-appeared-in-a-saved-search/266546)
**Author:** [@arcturuscom](https://discuss.elastic.co/u/arcturuscom)\ **Replies:** 1\ **Last updated:** [March 8, 2021, 12:53pm UTC](https://discuss.elastic.co/t/get-notified-when-some-documents-appeared-in-a-saved-search/266546 "2021-03-08T12:53:31Z")
Hello, i'm asking if it's possible to save a search made by an end users & get notified when there's some new documents appeared related to that search and placed on the Top 10. real use case : In the most Rental Houses… --- ## [Elasticsearch delete snapshot, 504 timeout](https://discuss.elastic.co/t/elasticsearch-delete-snapshot-504-timeout/266532)
**Author:** [@Norman\_Khine](https://discuss.elastic.co/u/Norman_Khine)\ **Replies:** 3\ **Last updated:** [March 8, 2021, 12:37pm UTC](https://discuss.elastic.co/t/elasticsearch-delete-snapshot-504-timeout/266532 "2021-03-08T12:37:26Z")
Hello, I am taking snapshots and saving these to AWS S3, when I try to delete old snapshots, I get curl -X DELETE "http://localhost:9300/\_snapshot/backup-prod/20200123031645?pretty"  ✔  10089  … --- ## [Scripted field return value on same order than original](https://discuss.elastic.co/t/scripted-field-return-value-on-same-order-than-original/265950)
**Author:** [@Jose\_Manuel\_Tirado](https://discuss.elastic.co/u/Jose_Manuel_Tirado)\ **Replies:** 14\ **Last updated:** [March 8, 2021, 12:33pm UTC](https://discuss.elastic.co/t/scripted-field-return-value-on-same-order-than-original/265950 "2021-03-08T12:33:34Z")
I am trying to create a scripted field to be able to fetch me the first value of a certain field. I find the problem in that when it returns the values ​​of the field, and I save them in path, it sorts them alphabetical… --- ## [Filebeat fields missing](https://discuss.elastic.co/t/filebeat-fields-missing/266375)
**Author:** [@bzak](https://discuss.elastic.co/u/bzak)\ **Replies:** 1\ **Last updated:** [March 8, 2021, 12:32pm UTC](https://discuss.elastic.co/t/filebeat-fields-missing/266375 "2021-03-08T12:32:45Z")
When I installed filebeat in a linux server I enabled nginx module. In Discover, I can see all the nginx fields but they are ALL empty. My configuration is as follows: input { beats:... } filter { ... } output { … --- ## [Elasticsearch failing](https://discuss.elastic.co/t/elasticsearch-failing/266547)
**Author:** [@amazonas\_ecommerce](https://discuss.elastic.co/u/amazonas_ecommerce)\ **Replies:** 0\ **Last updated:** [March 8, 2021, 11:55am UTC](https://discuss.elastic.co/t/elasticsearch-failing/266547 "2021-03-08T11:55:07Z")
elasticsearch failing. I don't know what could be happening I start it in a few hours it stops working. Then restart it works. When repeating this operation a few times it locks my Centos Estou usando Magento 2.4, n… --- ## [Help improving this query before it explodes!](https://discuss.elastic.co/t/help-improving-this-query-before-it-explodes/266544)
**Author:** [@doctor](https://discuss.elastic.co/u/doctor)\ **Replies:** 0\ **Last updated:** [March 8, 2021, 11:38am UTC](https://discuss.elastic.co/t/help-improving-this-query-before-it-explodes/266544 "2021-03-08T11:38:16Z")
Hey, I made a working request but it kinda sucks ! Was wondering if a pleasing soul could help me get to something better... The problem Lets say I have 2 types of documents for simplicty's sake. The type square and… --- ## [Nasty feedback loop for syslog, if filebeat index is unavailable](https://discuss.elastic.co/t/nasty-feedback-loop-for-syslog-if-filebeat-index-is-unavailable/266537)
**Author:** [@hbogert](https://discuss.elastic.co/u/hbogert)\ **Replies:** 0\ **Last updated:** [March 8, 2021, 10:39am UTC](https://discuss.elastic.co/t/nasty-feedback-loop-for-syslog-if-filebeat-index-is-unavailable/266537 "2021-03-08T10:39:27Z")
I've been hit hard by this. Multiple machines have filebeat installed with the syslog module. By some other cirumstances, the filebeat index was unavailable this causes filebeat to log to journalctl and thus indirectly … --- ## [Google-like exact match using multi\_match](https://discuss.elastic.co/t/google-like-exact-match-using-multi-match/266540)
**Author:** [@alimci](https://discuss.elastic.co/u/alimci)\ **Replies:** 0\ **Last updated:** [March 8, 2021, 10:56am UTC](https://discuss.elastic.co/t/google-like-exact-match-using-multi-match/266540 "2021-03-08T10:56:52Z")
Hi there, I wanna to create google-like exact match query by multi\_match query. My desired result is followed by this query. "bool": { "should": \[ { "query\_string": { "query": "string \\"exact match… --- ## [Integrate Jira-Cloud with Elasticsearch](https://discuss.elastic.co/t/integrate-jira-cloud-with-elasticsearch/266539)
**Author:** [@vishakh](https://discuss.elastic.co/u/vishakh)\ **Replies:** 0\ **Last updated:** [March 8, 2021, 10:55am UTC](https://discuss.elastic.co/t/integrate-jira-cloud-with-elasticsearch/266539 "2021-03-08T10:55:16Z")
ELK-Stack: 7.10 I'm planning to integrate Jira-Cloud with ELK Stack where I can ingest logs/events into Elasticsearch and visualize the same with Kibana I did go through an option in using Elasticsearch Enterprise-Sear… --- ## [Exception during establishing a SSL connection: HttpRequestOnTransportException\[This is not an HTTP port\]](https://discuss.elastic.co/t/exception-during-establishing-a-ssl-connection-httprequestontransportexception-this-is-not-an-http-port/266536)
**Author:** [@sarthaksahu](https://discuss.elastic.co/u/sarthaksahu)\ **Replies:** 1\ **Last updated:** [March 8, 2021, 10:45am UTC](https://discuss.elastic.co/t/exception-during-establishing-a-ssl-connection-httprequestontransportexception-this-is-not-an-http-port/266536 "2021-03-08T10:45:42Z")
We are continuously getting below error. Please let me know the reason of this error, and what is the corrective action will help to get rid of this error. Exception during establishing a SSL connection: HttpRequestOnTr… --- ## [I have to view only apache access by operating system mac and windows ,apache access by browser only chrome and safari](https://discuss.elastic.co/t/i-have-to-view-only-apache-access-by-operating-system-mac-and-windows-apache-access-by-browser-only-chrome-and-safari/266234)
**Author:** [@psganeshk](https://discuss.elastic.co/u/psganeshk)\ **Replies:** 3\ **Last updated:** [March 8, 2021, 10:36am UTC](https://discuss.elastic.co/t/i-have-to-view-only-apache-access-by-operating-system-mac-and-windows-apache-access-by-browser-only-chrome-and-safari/266234 "2021-03-08T10:36:32Z")
i have to view only apache access by operating system mac and windows i have to view only apache access by browser chrome and safari --- ## [Time from merge to Elastic release?](https://discuss.elastic.co/t/time-from-merge-to-elastic-release/266527)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 3\ **Last updated:** [March 8, 2021, 10:22am UTC](https://discuss.elastic.co/t/time-from-merge-to-elastic-release/266527 "2021-03-08T10:22:05Z")
Dear all =) Does anyone know the the typical time frame from when a feature is merged till it ends up in a release? It is this particular one I am interested in =) It got merged on the 22th of Januar 2021. Hugs, Sa… --- ## [Read text from pdf file](https://discuss.elastic.co/t/read-text-from-pdf-file/266530)
**Author:** [@arefin](https://discuss.elastic.co/u/arefin)\ **Replies:** 1\ **Last updated:** [March 8, 2021, 10:16am UTC](https://discuss.elastic.co/t/read-text-from-pdf-file/266530 "2021-03-08T10:16:00Z")
String filePath = "C://x.pdf"; String encodedfile = null; RestHighLevelClient restHighLevelClient = null; File file = new File(filePath); try { FileInputStream fileInputStreamReader = new FileInputStream(file); … --- ## [How to know whether elastic is down or not](https://discuss.elastic.co/t/how-to-know-whether-elastic-is-down-or-not/266523)
**Author:** [@Rinku\_Gulia](https://discuss.elastic.co/u/Rinku_Gulia)\ **Replies:** 7\ **Last updated:** [March 8, 2021, 10:09am UTC](https://discuss.elastic.co/t/how-to-know-whether-elastic-is-down-or-not/266523 "2021-03-08T10:09:06Z")
I have a requirement where i need to apply patches, create indices through resthighlevelclient and use elastic if elastic is up , otherwise switch to postgres. let's suppose elastic service is down. when i try to apply… --- ## [Detector field "clientIP.keyword" is not an aggregatable field](https://discuss.elastic.co/t/detector-field-clientip-keyword-is-not-an-aggregatable-field/266465)
**Author:** [@Ingram\_Gultom](https://discuss.elastic.co/u/Ingram_Gultom)\ **Replies:** 8\ **Last updated:** [March 8, 2021, 10:07am UTC](https://discuss.elastic.co/t/detector-field-clientip-keyword-is-not-an-aggregatable-field/266465 "2021-03-08T10:07:00Z")
Hello, Stack version : 7.9.3 I found issue when I tried to create a machine learning job in kibana The error : Detector field "clientIP.keyword" is not an aggregatable field The data looks like this in kibana { "\_… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1517) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1519)