# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1545 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1546 --- ## [AuditBeat and PacketBeat generated data size for elasticsearch sizing](https://discuss.elastic.co/t/auditbeat-and-packetbeat-generated-data-size-for-elasticsearch-sizing/265000)
**Author:** [@0x90](https://discuss.elastic.co/u/0x90)\ **Replies:** 1\ **Last updated:** [February 21, 2021, 8:22pm UTC](https://discuss.elastic.co/t/auditbeat-and-packetbeat-generated-data-size-for-elasticsearch-sizing/265000 "2021-02-21T20:22:25Z")
In order for me to plan my elasticsearch cluster volume size needs I calculated EPS and EDS values for filebeat , and winlogbeat by checking the number of lines in the logs. But I can't seem to find a way to calculate ho… --- ## [Hot warm architecture elasticsearch](https://discuss.elastic.co/t/hot-warm-architecture-elasticsearch/264935)
**Author:** [@testsemd\_email](https://discuss.elastic.co/u/testsemd_email)\ **Replies:** 5\ **Last updated:** [February 21, 2021, 6:49pm UTC](https://discuss.elastic.co/t/hot-warm-architecture-elasticsearch/264935 "2021-02-21T18:49:11Z")
Hi, I have 7 node cluster, master nodes - 3 hot nodes -2 warm nodes-2 An application creates daily indexes and sends indexes to a cluster. I want to use hot warm architecture for this cluster. I want to know how t… --- ## [Machine Lerning Tab giving error](https://discuss.elastic.co/t/machine-lerning-tab-giving-error/264990)
**Author:** [@Tombal](https://discuss.elastic.co/u/Tombal)\ **Replies:** 4\ **Last updated:** [February 21, 2021, 6:25pm UTC](https://discuss.elastic.co/t/machine-lerning-tab-giving-error/264990 "2021-02-21T18:25:29Z")
Hello, After i seperated my ml nodes, i realised my machine learning tab at kibana not working as expected. Probably it is about some other reason but couldn't find out how to fix this. I don't know whether something i… --- ## [New to Elastic/LogStash and have a few questions](https://discuss.elastic.co/t/new-to-elastic-logstash-and-have-a-few-questions/264322)
**Author:** [@Skatman](https://discuss.elastic.co/u/Skatman)\ **Replies:** 6\ **Last updated:** [February 21, 2021, 5:37pm UTC](https://discuss.elastic.co/t/new-to-elastic-logstash-and-have-a-few-questions/264322 "2021-02-21T17:37:44Z")
Hi all, Just started using Elastic Stack after hearing rave reviews from friends in the security industry. I used the free trial thing just to have a prod around the interface before setting my own instance up. Got a f… --- ## [Connection error to a secured Elasticsearch: unable to authenticate user](https://discuss.elastic.co/t/connection-error-to-a-secured-elasticsearch-unable-to-authenticate-user/264919)
**Author:** [@oferbar00](https://discuss.elastic.co/u/oferbar00)\ **Replies:** 4\ **Last updated:** [February 21, 2021, 4:07pm UTC](https://discuss.elastic.co/t/connection-error-to-a-secured-elasticsearch-unable-to-authenticate-user/264919 "2021-02-21T16:07:24Z")
Hello, I am trying to create a track from an Elasticsearch node (v7.5.2) that is running on a Windows server 2019 VM and using TLS with basic authentication. From the rally (v2.0.4) machine I am able to curl to it jus… --- ## [HTTP request failure on using the logstash-filter-http](https://discuss.elastic.co/t/http-request-failure-on-using-the-logstash-filter-http/264985)
**Author:** [@pratz](https://discuss.elastic.co/u/pratz)\ **Replies:** 0\ **Last updated:** [February 21, 2021, 2:11pm UTC](https://discuss.elastic.co/t/http-request-failure-on-using-the-logstash-filter-http/264985 "2021-02-21T14:11:45Z")
I'm using http filter to fetch some json data from a server. Below is my conf file input { file { path =\> "/opt/data/dum.txt" start\_position =\> "beginning" } } filter { http { url =\> "ht… --- ## [How to combine the complete data in a csv/txt file in to a single column in message field](https://discuss.elastic.co/t/how-to-combine-the-complete-data-in-a-csv-txt-file-in-to-a-single-column-in-message-field/264550)
**Author:** [@nikhilesh](https://discuss.elastic.co/u/nikhilesh)\ **Replies:** 4\ **Last updated:** [February 21, 2021, 2:16pm UTC](https://discuss.elastic.co/t/how-to-combine-the-complete-data-in-a-csv-txt-file-in-to-a-single-column-in-message-field/264550 "2021-02-21T14:16:07Z")
Hi all, I have a below kind of data in the file of csv format. when I try to pull the logs to kibana. its showing as a multiple lines in the kibana console(PFA) I want the complete data in the file to come as a single … --- ## [Filebeat 7.11.1 registry log.json growing wild](https://discuss.elastic.co/t/filebeat-7-11-1-registry-log-json-growing-wild/264982)
**Author:** [@thesn](https://discuss.elastic.co/u/thesn)\ **Replies:** 0\ **Last updated:** [February 21, 2021, 12:27pm UTC](https://discuss.elastic.co/t/filebeat-7-11-1-registry-log-json-growing-wild/264982 "2021-02-21T12:27:31Z")
Hi, I just migrate from filebeat 7.8 (installed in host os) to filebeat 7.11 (installed in docker). I bind the volume in docker-compose for the registry and log files to be processed: version: "2.2" services: fi… --- ## [Scripted field to calculate](https://discuss.elastic.co/t/scripted-field-to-calculate/264754)
**Author:** [@ITchandj](https://discuss.elastic.co/u/ITchandj)\ **Replies:** 2\ **Last updated:** [February 21, 2021, 9:25am UTC](https://discuss.elastic.co/t/scripted-field-to-calculate/264754 "2021-02-21T09:25:21Z")
Hello community!! please how can i write a Scripted fields that calculed in follow operation. thanks for your advice Lifetime = ProcStartTimeRelativeMs + ";" + ProcLifetimeMs + ";" + TotalBootDurationMs + ";" + ProcNa… --- ## [Recover Elastic Cluster password](https://discuss.elastic.co/t/recover-elastic-cluster-password/264669)
**Author:** [@thewasta](https://discuss.elastic.co/u/thewasta)\ **Replies:** 6\ **Last updated:** [February 21, 2021, 6:20am UTC](https://discuss.elastic.co/t/recover-elastic-cluster-password/264669 "2021-02-21T06:20:35Z")
Hello! For some reason, password/user doesn't work on my cluster, it used to work but now it doesn't. I don't know if it is because I had to reboot all servers (working with 3 servers). Now I would like to reset all pas… --- ## [Is it possible to connect Elasticsearch with App Engine with flexible environment via VPC Connector in Google Cloud Platform?](https://discuss.elastic.co/t/is-it-possible-to-connect-elasticsearch-with-app-engine-with-flexible-environment-via-vpc-connector-in-google-cloud-platform/264961)
**Author:** [@white\_rabbit](https://discuss.elastic.co/u/white_rabbit)\ **Replies:** 3\ **Last updated:** [February 21, 2021, 1:31am UTC](https://discuss.elastic.co/t/is-it-possible-to-connect-elasticsearch-with-app-engine-with-flexible-environment-via-vpc-connector-in-google-cloud-platform/264961 "2021-02-21T01:31:57Z")
I have deployed my Django API in the App Engine with flexible environment. I have also created PostgreSQL instance in the Virtual Private Cloud and I connected my database with my Django App deployed in the App Engine us… --- ## [Percolator: Best Practice for Boost/Customizing Relevance Scoring](https://discuss.elastic.co/t/percolator-best-practice-for-boost-customizing-relevance-scoring/262164)
**Author:** [@jordannb](https://discuss.elastic.co/u/jordannb)\ **Replies:** 1\ **Last updated:** [February 21, 2021, 12:38am UTC](https://discuss.elastic.co/t/percolator-best-practice-for-boost-customizing-relevance-scoring/262164 "2021-02-21T00:38:45Z")
Per documentation, index-time boosting was replaced with query-time boosting in a previous release. This makes sense - here an explanation is given which explains that index time boost requires re-indexing, so it's bette… --- ## [Unrecognized VM option 'UseConcMarkSweepGC'](https://discuss.elastic.co/t/unrecognized-vm-option-useconcmarksweepgc/264960)
**Author:** [@realtech2338](https://discuss.elastic.co/u/realtech2338)\ **Replies:** 10\ **Last updated:** [February 20, 2021, 11:26pm UTC](https://discuss.elastic.co/t/unrecognized-vm-option-useconcmarksweepgc/264960 "2021-02-20T23:26:55Z")
C:\\elastic\_stack\\logstash-7.11.1-windows-x86\_64\\logstash-7.11.1\\bin\>logstash -f logstash-simple.conf Using JAVA\_HOME defined java: C:\\Program Files\\Java\\jdk-15.0.2 WARNING, using JAVA\_HOME while Logstash distribution c… --- ## [How to use Ruby to preprocess k,v -pairs value](https://discuss.elastic.co/t/how-to-use-ruby-to-preprocess-k-v-pairs-value/263684)
**Author:** [@GL\_Choong](https://discuss.elastic.co/u/GL_Choong)\ **Replies:** 5\ **Last updated:** [February 20, 2021, 8:46pm UTC](https://discuss.elastic.co/t/how-to-use-ruby-to-preprocess-k-v-pairs-value/263684 "2021-02-20T20:46:07Z")
Hi, I\`m new to Logstash and Ruby. Would like to get help. Currently I have a data as below test:result testcase: #TEMP\_BTWLAN:ok; loop:24;Temperature:28; My initial target is by using ruby to generate as below Outpu… --- ## [How to get rid of nested field and other issues](https://discuss.elastic.co/t/how-to-get-rid-of-nested-field-and-other-issues/264945)
**Author:** [@jkost](https://discuss.elastic.co/u/jkost)\ **Replies:** 6\ **Last updated:** [February 20, 2021, 6:17pm UTC](https://discuss.elastic.co/t/how-to-get-rid-of-nested-field-and-other-issues/264945 "2021-02-20T18:17:25Z")
Hallo, I 'm using logstash 7.11 and my data have the following format: { field1: ..., field2: ..., aList: \[ { Id ... }, { fielda1 ... }, { fielda2 ... }, { fielda2 ... }, … --- ## [Kibana Authentication from AWS cognito](https://discuss.elastic.co/t/kibana-authentication-from-aws-cognito/264956)
**Author:** [@Dhamodharan](https://discuss.elastic.co/u/Dhamodharan)\ **Replies:** 0\ **Last updated:** [February 20, 2021, 5:54pm UTC](https://discuss.elastic.co/t/kibana-authentication-from-aws-cognito/264956 "2021-02-20T17:54:59Z")
Hi All, I am trying to authenticate kibana from AWS cognito user pool, I have got the procedure to connect AWS elasticsearch service from cognito. But my kibana is running on my own ec2 server. Can someone help me to co… --- ## [Issue with elasticsearch query - dot in field values](https://discuss.elastic.co/t/issue-with-elasticsearch-query-dot-in-field-values/264943)
**Author:** [@Sampson\_Light](https://discuss.elastic.co/u/Sampson_Light)\ **Replies:** 5\ **Last updated:** [February 20, 2021, 5:11pm UTC](https://discuss.elastic.co/t/issue-with-elasticsearch-query-dot-in-field-values/264943 "2021-02-20T17:11:45Z")
Hello, There's an issue with the use of . in my field value. The sample below is a 'valid' query that returns some hits Copy to clipboard { "query": { "bool": { "must": \[ { "wildcard": {… --- ## [Unable to create filebeat-\* index pattern in kibana 7.11 after running filebeat](https://discuss.elastic.co/t/unable-to-create-filebeat-index-pattern-in-kibana-7-11-after-running-filebeat/264781)
**Author:** [@Malcolm\_Haak](https://discuss.elastic.co/u/Malcolm_Haak)\ **Replies:** 17\ **Last updated:** [February 20, 2021, 3:53pm UTC](https://discuss.elastic.co/t/unable-to-create-filebeat-index-pattern-in-kibana-7-11-after-running-filebeat/264781 "2021-02-20T15:53:41Z")
I can see the filebeat index. I go to make an index pattern with @timestamp and it just won't complete. The logs are clean on ES and Kibana. So yeah I click Create Index pattern and It just goes to the spinny thing an… --- ## [Python ElasticSearch - How to increase query size limit](https://discuss.elastic.co/t/python-elasticsearch-how-to-increase-query-size-limit/264944)
**Author:** [@test\_tester](https://discuss.elastic.co/u/test_tester)\ **Replies:** 4\ **Last updated:** [February 20, 2021, 1:54pm UTC](https://discuss.elastic.co/t/python-elasticsearch-how-to-increase-query-size-limit/264944 "2021-02-20T13:54:31Z")
Hi, I'm currently writing a python script to extract out my elasticsearch documents and the following are my ES parameters that involves the sizing Copy to clipboard response = es.search(index= es\_index\_list,scroll='5… --- ## [Can we setup TLS encryption on an existing cluster without losing index data](https://discuss.elastic.co/t/can-we-setup-tls-encryption-on-an-existing-cluster-without-losing-index-data/264848)
**Author:** [@Arvind\_Ks](https://discuss.elastic.co/u/Arvind_Ks)\ **Replies:** 2\ **Last updated:** [February 20, 2021, 11:43am UTC](https://discuss.elastic.co/t/can-we-setup-tls-encryption-on-an-existing-cluster-without-losing-index-data/264848 "2021-02-20T11:43:52Z")
Hi Team, Can we setup TLS encryption on existing cluster with data, without losing it? I have a 40 node cluster with lots of indices. I see that to setup TLS we need to disable "cluster.initial\_master\_nodes" in elasti… --- ## [Unable to replace my log\_timestamp with @timestamp](https://discuss.elastic.co/t/unable-to-replace-my-log-timestamp-with-timestamp/264796)
**Author:** [@sanath\_ind](https://discuss.elastic.co/u/sanath_ind)\ **Replies:** 4\ **Last updated:** [February 20, 2021, 10:08am UTC](https://discuss.elastic.co/t/unable-to-replace-my-log-timestamp-with-timestamp/264796 "2021-02-20T10:08:07Z")
Hi, I am facing an issue while trying to set my log\_timestamp to @timestamp. I have tried many combinations from various date filter topics from here. But it is not giving me any positive result. My original logstash.c… --- ## [Filebeat in a docker container](https://discuss.elastic.co/t/filebeat-in-a-docker-container/264864)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 2\ **Last updated:** [February 20, 2021, 8:42am UTC](https://discuss.elastic.co/t/filebeat-in-a-docker-container/264864 "2021-02-20T08:42:31Z")
Dear community, I have a server on openstack. This target I can reach from everywhere else beside from inside the filebeat docker on my laptop. If I make an ip add on my laptop I get a bunch of IPs. All these IPs I can… --- ## [Metricbeat not showing info on Kibana](https://discuss.elastic.co/t/metricbeat-not-showing-info-on-kibana/264839)
**Author:** [@gpalazov](https://discuss.elastic.co/u/gpalazov)\ **Replies:** 2\ **Last updated:** [February 20, 2021, 7:58am UTC](https://discuss.elastic.co/t/metricbeat-not-showing-info-on-kibana/264839 "2021-02-20T07:58:43Z")
Hello everyone:), Metricbeat not showing info on Kibana for me. I have Packetbeat configured and everything there is running as it should. Probably i'm missing some info on the conf side of metricbeat. Please tell me wh… --- ## [Metricbeat AWS module error while using credentials\_profile\_name](https://discuss.elastic.co/t/metricbeat-aws-module-error-while-using-credentials-profile-name/264807)
**Author:** [@atharvak](https://discuss.elastic.co/u/atharvak)\ **Replies:** 4\ **Last updated:** [February 20, 2021, 7:45am UTC](https://discuss.elastic.co/t/metricbeat-aws-module-error-while-using-credentials-profile-name/264807 "2021-02-20T07:45:31Z")
Hello guys, I am trying to configure AWS metrics for multiple AWS accounts of mine. I have already configured the profiles using AWS CLI and they are working. But when the same profile name is put in the modules.d/aws.y… --- ## [Cost of searchable fields](https://discuss.elastic.co/t/cost-of-searchable-fields/264913)
**Author:** [@abhishekc92](https://discuss.elastic.co/u/abhishekc92)\ **Replies:** 1\ **Last updated:** [February 20, 2021, 3:06am UTC](https://discuss.elastic.co/t/cost-of-searchable-fields/264913 "2021-02-20T03:06:46Z")
I'm very new to Elastic. I am thinking of a document structure of a reasonable size, with quite a few fields, which I don't necessarily need to be able to search on. What I could not find in the documentation is the exac… --- ## [Grok Filter on Spring Logs](https://discuss.elastic.co/t/grok-filter-on-spring-logs/264930)
**Author:** [@seshu\_rao](https://discuss.elastic.co/u/seshu_rao)\ **Replies:** 0\ **Last updated:** [February 20, 2021, 2:57am UTC](https://discuss.elastic.co/t/grok-filter-on-spring-logs/264930 "2021-02-20T02:57:03Z")
i was trying to apply grok pattern on below log and couldn't make it successfully. some one please help me on this. this is the log file pattern coming to kibana. {"@timestamp":"2021-02-19T10:27:42.275+00:00","severity… --- ## [Skip to end of filter if the grok pattern does not match](https://discuss.elastic.co/t/skip-to-end-of-filter-if-the-grok-pattern-does-not-match/264925)
**Author:** [@newmember](https://discuss.elastic.co/u/newmember)\ **Replies:** 2\ **Last updated:** [February 20, 2021, 2:50am UTC](https://discuss.elastic.co/t/skip-to-end-of-filter-if-the-grok-pattern-does-not-match/264925 "2021-02-20T02:50:21Z")
Is there a option for a filter so that when the grok pattern does not match skip all the other filter plugins and leave the filter? Ideal situation is if the grok pattern does not match skip the rest of the filter plu… --- ## [Kibana, unique or distinct count alerting](https://discuss.elastic.co/t/kibana-unique-or-distinct-count-alerting/263803)
**Author:** [@earlsanchez](https://discuss.elastic.co/u/earlsanchez)\ **Replies:** 5\ **Last updated:** [February 20, 2021, 2:04am UTC](https://discuss.elastic.co/t/kibana-unique-or-distinct-count-alerting/263803 "2021-02-20T02:04:39Z")
Hello, Using Kibana Discovery and then Alerting is it possible to create an alert based on the count of a unique field value during a particular time period? For instance, in Splunk I can alarm a query such as this: in… --- ## [Config file is not processed by logstash](https://discuss.elastic.co/t/config-file-is-not-processed-by-logstash/264903)
**Author:** [@Antonis\_Michael](https://discuss.elastic.co/u/Antonis_Michael)\ **Replies:** 15\ **Last updated:** [February 20, 2021, 1:13am UTC](https://discuss.elastic.co/t/config-file-is-not-processed-by-logstash/264903 "2021-02-20T01:13:15Z")
Hello, I am having my pipeline set to look for .conf files under /etc/logstash/conf.d/, there i have multiple config files and I make sure to tag each one for filtering indices. Everything works fine for all the other c… --- ## [Why elk requires a privilege container permission in Openshift](https://discuss.elastic.co/t/why-elk-requires-a-privilege-container-permission-in-openshift/264923)
**Author:** [@Roberto\_Ramirez](https://discuss.elastic.co/u/Roberto_Ramirez)\ **Replies:** 0\ **Last updated:** [February 19, 2021, 11:26pm UTC](https://discuss.elastic.co/t/why-elk-requires-a-privilege-container-permission-in-openshift/264923 "2021-02-19T23:26:14Z")
I am trying to deploy elk in openshift 4.6 and i am getting the following error create Pod elksaastest-master-0 in StatefulSet elktest-master failed error: pods elkstest-master-0 is forbidden: unable to validate against… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1544) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1546)