# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1563 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1564 --- ## [Filebeat HTTP JSON with epochtime](https://discuss.elastic.co/t/filebeat-http-json-with-epochtime/263318)
**Author:** [@seefor](https://discuss.elastic.co/u/seefor)\ **Replies:** 4\ **Last updated:** [February 9, 2021, 7:06pm UTC](https://discuss.elastic.co/t/filebeat-http-json-with-epochtime/263318 "2021-02-09T19:06:21Z")
Can filebeat be configured to pass epoch time every 15 minutes? filebeat.inputs: type: httpjson url: https://api.ipify.org/?format=json&t0=epochtime-15minutes&t1=epochtimenow --- ## [Which is more efficient? KV, Dissect, Split, Grok](https://discuss.elastic.co/t/which-is-more-efficient-kv-dissect-split-grok/263789)
**Author:** [@kavierkoo](https://discuss.elastic.co/u/kavierkoo)\ **Replies:** 2\ **Last updated:** [February 9, 2021, 6:55pm UTC](https://discuss.elastic.co/t/which-is-more-efficient-kv-dissect-split-grok/263789 "2021-02-09T18:55:38Z")
Hi all, As there are many ways to achive similar goal using logstash filters, would like to discuss and compare between KV, Dissect, Split, and Grok, which is a better way of handling data? Scenario 1: Mapping & Parsi… --- ## [RestHighLevelClient Elastic Search Java Client takes more time for Search Query](https://discuss.elastic.co/t/resthighlevelclient-elastic-search-java-client-takes-more-time-for-search-query/263784)
**Author:** [@nidhi217](https://discuss.elastic.co/u/nidhi217)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 6:32pm UTC](https://discuss.elastic.co/t/resthighlevelclient-elastic-search-java-client-takes-more-time-for-search-query/263784 "2021-02-09T18:32:47Z")
RestHighLevelClient is taking more time for Search Queries and have bad performance.From direct Elastic Search Rest API it is taking less time. How can we optimise the performance for this search request This is the Co… --- ## [Received an event that has a different character encoding than you configured](https://discuss.elastic.co/t/received-an-event-that-has-a-different-character-encoding-than-you-configured/263792)
**Author:** [@MakoWish](https://discuss.elastic.co/u/MakoWish)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 6:32pm UTC](https://discuss.elastic.co/t/received-an-event-that-has-a-different-character-encoding-than-you-configured/263792 "2021-02-09T18:32:01Z")
I have seen several threads related to the same error, but none of them seem to address the issue as we are experiencing it. The messages I get this error for are from ADAudit+ reading logs from an Isilon storage applian… --- ## [Same logstash config file give different result for the same input on different machines](https://discuss.elastic.co/t/same-logstash-config-file-give-different-result-for-the-same-input-on-different-machines/263774)
**Author:** [@Aryaman\_Gupta](https://discuss.elastic.co/u/Aryaman_Gupta)\ **Replies:** 4\ **Last updated:** [February 9, 2021, 6:13pm UTC](https://discuss.elastic.co/t/same-logstash-config-file-give-different-result-for-the-same-input-on-different-machines/263774 "2021-02-09T18:13:57Z")
Hi I have created one logstash conf file but I am running the same config file on two machine, one is mac and other is ubbuntu. For the same input data on my mac I am getting the correct output where as in ubuntu I am g… --- ## [Packetbeat is not sending data to elasticsearch](https://discuss.elastic.co/t/packetbeat-is-not-sending-data-to-elasticsearch/263790)
**Author:** [@Claudio\_Ract\_Costa](https://discuss.elastic.co/u/Claudio_Ract_Costa)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 5:50pm UTC](https://discuss.elastic.co/t/packetbeat-is-not-sending-data-to-elasticsearch/263790 "2021-02-09T17:50:15Z")
Hi Guys, I have installed Packetbeat in many servers and it works fine in all of them but i tried use packetbeat in a F5 Load Balancer and it is not working. Packetbeat is not sending http requests (over 10110 port) to… --- ## [Logastash container went down - we did not monitor it](https://discuss.elastic.co/t/logastash-container-went-down-we-did-not-monitor-it/263771)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 5:48pm UTC](https://discuss.elastic.co/t/logastash-container-went-down-we-did-not-monitor-it/263771 "2021-02-09T17:48:44Z")
Hi there, I had the case that the logstash container (7.8.1) just stopped working and we did not nominitor it. What I would have liked: in the momen it crashed docker should have restarted it from the scratch. Question… --- ## [Do not update sql\_last\_value when an Elastic error is encountered](https://discuss.elastic.co/t/do-not-update-sql-last-value-when-an-elastic-error-is-encountered/263788)
**Author:** [@KSmith](https://discuss.elastic.co/u/KSmith)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 5:46pm UTC](https://discuss.elastic.co/t/do-not-update-sql-last-value-when-an-elastic-error-is-encountered/263788 "2021-02-09T17:46:26Z")
input { jdbc { jdbc\_driver\_library =\> "/usr/share/logstash/drivers/jdbc/${PG\_DRIVER}" jdbc\_driver\_class =\> "org.postgresql.Driver" jdbc\_connection\_string =\> "jdbc:postgresql://${DATABASE\_HOST}… --- ## [Color in vega map visualization](https://discuss.elastic.co/t/color-in-vega-map-visualization/263565)
**Author:** [@Pranusha119](https://discuss.elastic.co/u/Pranusha119)\ **Replies:** 6\ **Last updated:** [February 9, 2021, 5:44pm UTC](https://discuss.elastic.co/t/color-in-vega-map-visualization/263565 "2021-02-09T17:44:28Z")
{ "$schema": "https://vega.github.io/schema/vega/v5.json", "description": "A choropleth map depicting U.S. unemployment rates by county in 2009.", "width": 960, "height": 500, "autosize": "none", "data": \[ … --- ## [Logstash/Filebeat is periodically hanging (unresponsive)](https://discuss.elastic.co/t/logstash-filebeat-is-periodically-hanging-unresponsive/263199)
**Author:** [@user2416](https://discuss.elastic.co/u/user2416)\ **Replies:** 3\ **Last updated:** [February 9, 2021, 5:39pm UTC](https://discuss.elastic.co/t/logstash-filebeat-is-periodically-hanging-unresponsive/263199 "2021-02-09T17:39:17Z")
Hi, We are using filebeat as a deamonset on kubernetes nodes to collect all application logs and sending them to logstash and then to elasticsearch. we observe that logs stops working/hangs periodically from some speci… --- ## [TSVB Metric color based on text field and numeric value](https://discuss.elastic.co/t/tsvb-metric-color-based-on-text-field-and-numeric-value/263570)
**Author:** [@Chenlrv](https://discuss.elastic.co/u/Chenlrv)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 5:18pm UTC](https://discuss.elastic.co/t/tsvb-metric-color-based-on-text-field-and-numeric-value/263570 "2021-02-09T17:18:36Z")
Hi, I created a TSVB Metric widget that it's purpose is to function as a traffic light - should be red when there's an error in the system, yellow if there's a warning, and green if all is ok. The problem is, I can't… --- ## [Kibana service not running](https://discuss.elastic.co/t/kibana-service-not-running/263470)
**Author:** [@srcarter](https://discuss.elastic.co/u/srcarter)\ **Replies:** 2\ **Last updated:** [February 9, 2021, 5:18pm UTC](https://discuss.elastic.co/t/kibana-service-not-running/263470 "2021-02-09T17:18:19Z")
Hi there, I recently had our IT build me a new computer that I am dedicating for a simple elasticsearch/kibana machine. I had previously built my own machine for the same purpose and was successful, that machine was ru… --- ## [Kibana console code 44 trying to get \_souce timestamp](https://discuss.elastic.co/t/kibana-console-code-44-trying-to-get-souce-timestamp/263649)
**Author:** [@Chris6](https://discuss.elastic.co/u/Chris6)\ **Replies:** 0\ **Last updated:** [February 8, 2021, 7:10pm UTC](https://discuss.elastic.co/t/kibana-console-code-44-trying-to-get-souce-timestamp/263649 "2021-02-08T19:10:44Z")
I am getting: unexpected character (',' (code 44)): was expecting a colon to seperate field name and value\\n at \[Source: org.elasticsearch.transport. netty4.ByteBufStreamInput@249c1586; line: 3, column:28\]" I am using … --- ## [Index ".async\_search" size growing fast](https://discuss.elastic.co/t/index-async-search-size-growing-fast/261788)
**Author:** [@parallelism](https://discuss.elastic.co/u/parallelism)\ **Replies:** 2\ **Last updated:** [February 9, 2021, 5:04pm UTC](https://discuss.elastic.co/t/index-async-search-size-growing-fast/261788 "2021-02-09T17:04:17Z")
Hello everyone, On a Elasticsearch and Kibana cluster that is monitoring another Elasticsearch cluster, we found that the size of the ".async\_search" index on the monitoring cluster is growing fast (about 2GB in only on… --- ## [Time Duration difference calculation in Logstash](https://discuss.elastic.co/t/time-duration-difference-calculation-in-logstash/263599)
**Author:** [@Rebin](https://discuss.elastic.co/u/Rebin)\ **Replies:** 7\ **Last updated:** [February 9, 2021, 5:01pm UTC](https://discuss.elastic.co/t/time-duration-difference-calculation-in-logstash/263599 "2021-02-09T17:01:43Z")
Hi All, i'm trying to calculate the time difference between 2 dates. I'm capturing the data through jdbc Input "opentime" : "2020-11-01T11:42:59.000Z", "resolvedtime" : "2020-11-02T22:38:37.000Z", Code filter { date… --- ## [Uninstall Filebeat on Ubuntu](https://discuss.elastic.co/t/uninstall-filebeat-on-ubuntu/263746)
**Author:** [@Liora](https://discuss.elastic.co/u/Liora)\ **Replies:** 4\ **Last updated:** [February 9, 2021, 4:57pm UTC](https://discuss.elastic.co/t/uninstall-filebeat-on-ubuntu/263746 "2021-02-09T16:57:57Z")
Hi Team, please how can i uninstall Filebeat from my Ubuntu Server? Thank you for the reply --- ## [Not able to use insert sql query in jdbc\_streaming filter](https://discuss.elastic.co/t/not-able-to-use-insert-sql-query-in-jdbc-streaming-filter/263725)
**Author:** [@Melvin\_Shaju](https://discuss.elastic.co/u/Melvin_Shaju)\ **Replies:** 3\ **Last updated:** [February 9, 2021, 4:57pm UTC](https://discuss.elastic.co/t/not-able-to-use-insert-sql-query-in-jdbc-streaming-filter/263725 "2021-02-09T16:57:37Z")
When I tried to insert some in local mysql using jdbc\_streaming filter, it is showing following error. But no error is shown for select statements. Ruby-0-Thread-12@\[main\]\>worker6: :1\] jdbcstreaming - Exception when exe… --- ## [Split FQDN](https://discuss.elastic.co/t/split-fqdn/263773)
**Author:** [@Dan\_L](https://discuss.elastic.co/u/Dan_L)\ **Replies:** 2\ **Last updated:** [February 9, 2021, 4:54pm UTC](https://discuss.elastic.co/t/split-fqdn/263773 "2021-02-09T16:54:53Z")
I'm trying to split an FQDN to get the base server name. Currently, the FQDN is stored in "server", so I'd like to split "server" on "." and get the name. Additionally, sometimes the server may not be the FQDN, so it'd … --- ## [Filebeat K8S pod keeps restarting and Logs stop getting to Kibana](https://discuss.elastic.co/t/filebeat-k8s-pod-keeps-restarting-and-logs-stop-getting-to-kibana/263476)
**Author:** [@yimengael](https://discuss.elastic.co/u/yimengael)\ **Replies:** 3\ **Last updated:** [February 9, 2021, 4:41pm UTC](https://discuss.elastic.co/t/filebeat-k8s-pod-keeps-restarting-and-logs-stop-getting-to-kibana/263476 "2021-02-09T16:41:37Z")
Hello, I have configured Filebeat on my Kubernetes cluster and it is running in a kubernetes pod. Sometimes I noticed that Filebeat stopped collecting logs and the pods where filebeat is installed keeps restarting. I i… --- ## [Script query with nested array - is it possible?](https://discuss.elastic.co/t/script-query-with-nested-array-is-it-possible/263772)
**Author:** [@Ofir\_Edi](https://discuss.elastic.co/u/Ofir_Edi)\ **Replies:** 0\ **Last updated:** [February 9, 2021, 4:34pm UTC](https://discuss.elastic.co/t/script-query-with-nested-array-is-it-possible/263772 "2021-02-09T16:34:22Z")
Hi, i'm having issue filtering by script on a nested array. this is my sample data and mapping: { "id" : "123", "messages" : \[ { "level" : "error",… --- ## [Convert from dynamodb json to regular json on ingest](https://discuss.elastic.co/t/convert-from-dynamodb-json-to-regular-json-on-ingest/263298)
**Author:** [@ryantomaselli](https://discuss.elastic.co/u/ryantomaselli)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 3:48pm UTC](https://discuss.elastic.co/t/convert-from-dynamodb-json-to-regular-json-on-ingest/263298 "2021-02-09T15:48:52Z")
Hey guys; I'm ingesting DynamoDB stream data into Elastic using a function beat. Thing is the data ingested is all DynamoDB JSON rather than regular JSON. The AWS SDK has a method to do the conversion (see https://doc… --- ## [Providing document\_id in function beat for decode\_json\_fields results in effectively no updates to any records](https://discuss.elastic.co/t/providing-document-id-in-function-beat-for-decode-json-fields-results-in-effectively-no-updates-to-any-records/263434)
**Author:** [@ryantomaselli](https://discuss.elastic.co/u/ryantomaselli)\ **Replies:** 3\ **Last updated:** [February 9, 2021, 3:46pm UTC](https://discuss.elastic.co/t/providing-document-id-in-function-beat-for-decode-json-fields-results-in-effectively-no-updates-to-any-records/263434 "2021-02-09T15:46:49Z")
Hey guys; I'm processing records from DynamoDB via a function beat and it's working great, if I specify the source record as the "document\_id" for the "decode\_json\_fields" process Elastic correctly uses this as the ID f… --- ## [Are replicas just for disaster recovery?](https://discuss.elastic.co/t/are-replicas-just-for-disaster-recovery/263745)
**Author:** [@mahalabobis](https://discuss.elastic.co/u/mahalabobis)\ **Replies:** 5\ **Last updated:** [February 9, 2021, 3:44pm UTC](https://discuss.elastic.co/t/are-replicas-just-for-disaster-recovery/263745 "2021-02-09T15:44:50Z")
We are using Elasticsearch mainly as cache, for getting fast results. Currently, we have all the default settings which I think is 1 replica per shard. Should I change this setting to 0? Are replicas just for data recov… --- ## [Errors when enabling tls for APM and Elasticsearch kubernetes deployment](https://discuss.elastic.co/t/errors-when-enabling-tls-for-apm-and-elasticsearch-kubernetes-deployment/263758)
**Author:** [@ciarand](https://discuss.elastic.co/u/ciarand)\ **Replies:** 0\ **Last updated:** [February 9, 2021, 3:44pm UTC](https://discuss.elastic.co/t/errors-when-enabling-tls-for-apm-and-elasticsearch-kubernetes-deployment/263758 "2021-02-09T15:44:02Z")
I am trying to set up tls in my kubernetes cluster that is using the elastic operator version 1.2. I was able to set up tls with Elasticsearch but I am having issues with the APM issue and don't what is the correct confi… --- ## [Field change value](https://discuss.elastic.co/t/field-change-value/263738)
**Author:** [@paasi6666](https://discuss.elastic.co/u/paasi6666)\ **Replies:** 3\ **Last updated:** [February 9, 2021, 3:20pm UTC](https://discuss.elastic.co/t/field-change-value/263738 "2021-02-09T15:20:30Z")
I want to change the value of the field user.id , so that it only shows the username. In this example, I want to remove the "slu" so that the value only shows "AlbissR" and not "slu\\AlbissR" --- ## [Parsing Json object array](https://discuss.elastic.co/t/parsing-json-object-array/262487)
**Author:** [@jolaniya](https://discuss.elastic.co/u/jolaniya)\ **Replies:** 6\ **Last updated:** [February 9, 2021, 3:19pm UTC](https://discuss.elastic.co/t/parsing-json-object-array/262487 "2021-02-09T15:19:31Z")
Hi, I have trouble with a xml file. I have applied xml filter on that and after that i am getting 2 outputs. message.GeneralInfo message.ReportNode I guess these are json outputs but json filter is not working on th… --- ## [How to run metricbeat in background?](https://discuss.elastic.co/t/how-to-run-metricbeat-in-background/263595)
**Author:** [@shaiksubhan](https://discuss.elastic.co/u/shaiksubhan)\ **Replies:** 11\ **Last updated:** [February 9, 2021, 3:17pm UTC](https://discuss.elastic.co/t/how-to-run-metricbeat-in-background/263595 "2021-02-09T15:17:17Z")
Hi Team, I am trying to install Metricbeat 7.10.1 Linux version on my Linux machine but I am unable to run the metricbeat in the Background. Can any one help me on this so that i can run this beat in background itself … --- ## [Can I join an elasticsearch index with geojson to form one index to use as point to point map?](https://discuss.elastic.co/t/can-i-join-an-elasticsearch-index-with-geojson-to-form-one-index-to-use-as-point-to-point-map/263073)
**Author:** [@Mahlatse\_Wiwi](https://discuss.elastic.co/u/Mahlatse_Wiwi)\ **Replies:** 3\ **Last updated:** [February 9, 2021, 3:08pm UTC](https://discuss.elastic.co/t/can-i-join-an-elasticsearch-index-with-geojson-to-form-one-index-to-use-as-point-to-point-map/263073 "2021-02-09T15:08:12Z")
I have an index "index\_travels" which has a field "travel\_from" and "travel\_to". These fields are not geofields. However, I have imported a geojson file "Wards" that has a field "wardID" which is the same as "travel\_fro… --- ## [Elasticsearch 6.8 ignores my field mappings](https://discuss.elastic.co/t/elasticsearch-6-8-ignores-my-field-mappings/262816)
**Author:** [@logben](https://discuss.elastic.co/u/logben)\ **Replies:** 2\ **Last updated:** [February 9, 2021, 3:03pm UTC](https://discuss.elastic.co/t/elasticsearch-6-8-ignores-my-field-mappings/262816 "2021-02-09T15:03:57Z")
Hello! I have field mappings for an index like { "index\_patterns": \["logstash-iis2-\*"\], "version":100, "settings":{ "number\_of\_replicas":0, "number\_of\_shards":1, "index.refresh\_interval":"30s" }, "m… --- ## [Elasticstack security](https://discuss.elastic.co/t/elasticstack-security/263747)
**Author:** [@PRODIPTO](https://discuss.elastic.co/u/PRODIPTO)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 2:47pm UTC](https://discuss.elastic.co/t/elasticstack-security/263747 "2021-02-09T14:47:01Z")
Hi I am using a basic license and trying to enable security on a single node ELK cluster . to enable security i have added the below lines in elasticsearch.yml xpack.security.enabled: true discovery.type: single-node I… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1562) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1564)