# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1576 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1577 --- ## [Unable to create pipeline for nginx](https://discuss.elastic.co/t/unable-to-create-pipeline-for-nginx/262858)
**Author:** [@yukpun](https://discuss.elastic.co/u/yukpun)\ **Replies:** 3\ **Last updated:** [February 2, 2021, 9:38am UTC](https://discuss.elastic.co/t/unable-to-create-pipeline-for-nginx/262858 "2021-02-02T09:38:50Z")
For some reason, nginx logs stopped going to elastick stack. I checked status, and I see this: ERROR \[publisher\_pipeline\_output\] pipeline/output.go:154 Failed to connect to backoff(elasticsearch(http://elastic-server:92… --- ## [Unable to have data in kibana from filebeat](https://discuss.elastic.co/t/unable-to-have-data-in-kibana-from-filebeat/262534)
**Author:** [@Jean-P](https://discuss.elastic.co/u/Jean-P)\ **Replies:** 2\ **Last updated:** [February 2, 2021, 9:29am UTC](https://discuss.elastic.co/t/unable-to-have-data-in-kibana-from-filebeat/262534 "2021-02-02T09:29:50Z")
Hello, Actually, I tried to use Filebeat to transmit my logs to elastcisearch to have data in kibana. But I receive no data in Kibana. Here is my config file for Filebeat: filebeat.yml: filebeat.inputs: type: log … --- ## [Parser for LDAP logs - ECS format](https://discuss.elastic.co/t/parser-for-ldap-logs-ecs-format/262115)
**Author:** [@Logsman](https://discuss.elastic.co/u/Logsman)\ **Replies:** 1\ **Last updated:** [February 2, 2021, 9:22am UTC](https://discuss.elastic.co/t/parser-for-ldap-logs-ecs-format/262115 "2021-02-02T09:22:43Z")
Hi there ! I'm currently collecting LDAP logs (RHDS) with filebeat. As you know, there isn't any module for these type of logs. However, I would like to be able to create alert on Elastic security based on these logs. … --- ## [Using elasticsearch with SELinux](https://discuss.elastic.co/t/using-elasticsearch-with-selinux/262949)
**Author:** [@redplastic](https://discuss.elastic.co/u/redplastic)\ **Replies:** 0\ **Last updated:** [February 2, 2021, 9:14am UTC](https://discuss.elastic.co/t/using-elasticsearch-with-selinux/262949 "2021-02-02T09:14:26Z")
I'm attempting to use elasticsearch on a Centos machine with SELinux on enforced mode. However when running elasticsearch, it results in the java and controller service running as uncontrolled services. As having uncont… --- ## [Apply warm allocation after reconfigure ILM policy](https://discuss.elastic.co/t/apply-warm-allocation-after-reconfigure-ilm-policy/262250)
**Author:** [@Xavier\_Romero](https://discuss.elastic.co/u/Xavier_Romero)\ **Replies:** 1\ **Last updated:** [February 2, 2021, 8:46am UTC](https://discuss.elastic.co/t/apply-warm-allocation-after-reconfigure-ilm-policy/262250 "2021-02-02T08:46:01Z")
Hello, I've just added "highstorage" nodes to my Elastic Cloud deployment to store "warm" indexes. So, I've modified the ILM associated with my indexes to move indexes getting into warm phase to these new nodes. However… --- ## [Is the indices dir corresponded to indices I have in cluster?](https://discuss.elastic.co/t/is-the-indices-dir-corresponded-to-indices-i-have-in-cluster/262924)
**Author:** [@CHU\_XU](https://discuss.elastic.co/u/CHU_XU)\ **Replies:** 3\ **Last updated:** [February 2, 2021, 8:36am UTC](https://discuss.elastic.co/t/is-the-indices-dir-corresponded-to-indices-i-have-in-cluster/262924 "2021-02-02T08:36:26Z")
Hi experts, When I'm exploring the data dir of elasticsearch node, I found that there are some dirs in 'data/nodes/0/indices', say 'foo' and 'bar'. Are these dirs right my actual indices in cluster(foo and bar) correspo… --- ## [How to create logstash for different network device over same udp port](https://discuss.elastic.co/t/how-to-create-logstash-for-different-network-device-over-same-udp-port/262879)
**Author:** [@sajiby3k](https://discuss.elastic.co/u/sajiby3k)\ **Replies:** 3\ **Last updated:** [February 2, 2021, 8:29am UTC](https://discuss.elastic.co/t/how-to-create-logstash-for-different-network-device-over-same-udp-port/262879 "2021-02-02T08:29:54Z")
Hi, I am very new to elk stack. Trying to use logstash for Cisco routers and Fortigate firewalls. Both of these device types will use default udp port 514 to logstash to send log files. Most basic configuration looks… --- ## [Is there a tool to rebalance shards across multiple path.data paths?](https://discuss.elastic.co/t/is-there-a-tool-to-rebalance-shards-across-multiple-path-data-paths/262853)
**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Replies:** 4\ **Last updated:** [February 2, 2021, 8:24am UTC](https://discuss.elastic.co/t/is-there-a-tool-to-rebalance-shards-across-multiple-path-data-paths/262853 "2021-02-02T08:24:09Z")
I have 5 data nodes in my cluster, all of them split the data across two disks. There should be plenty of space for my data, but because elasticsearch allocates shards to disks based on shard count rather than size (and … --- ## [Filebeat System module not sending process name when using Logstash as a output](https://discuss.elastic.co/t/filebeat-system-module-not-sending-process-name-when-using-logstash-as-a-output/262844)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 5\ **Last updated:** [February 2, 2021, 8:13am UTC](https://discuss.elastic.co/t/filebeat-system-module-not-sending-process-name-when-using-logstash-as-a-output/262844 "2021-02-02T08:13:40Z")
I am using filebeat system module to send syslog data to Elasticsearch and it is working fine, even the default dashboard is also working fine. However, while I use Logstash as the output, it is not sending few fields su… --- ## [Unable to install logstash-devutils locally for offline-packaging](https://discuss.elastic.co/t/unable-to-install-logstash-devutils-locally-for-offline-packaging/262936)
**Author:** [@mastersmit](https://discuss.elastic.co/u/mastersmit)\ **Replies:** 0\ **Last updated:** [February 2, 2021, 7:36am UTC](https://discuss.elastic.co/t/unable-to-install-logstash-devutils-locally-for-offline-packaging/262936 "2021-02-02T07:36:45Z")
I am trying build a dev-env for my work-stations where i do not have access to the internet. I was hoping to install basic gem offline and transport it over to my work-station however while trying the below command: gem… --- ## [Performance issues on shared Kubernetes cluster](https://discuss.elastic.co/t/performance-issues-on-shared-kubernetes-cluster/262846)
**Author:** [@Konrad\_Moskal](https://discuss.elastic.co/u/Konrad_Moskal)\ **Replies:** 2\ **Last updated:** [February 2, 2021, 6:57am UTC](https://discuss.elastic.co/t/performance-issues-on-shared-kubernetes-cluster/262846 "2021-02-02T06:57:23Z")
Hey! I have an issue with performance on a shared K8s cluster. When there is no load on the cluster, performance is great but for reason when activity increases my ES performance declines a lot. I have 20 indices, ~ 1GB… --- ## [Kill error](https://discuss.elastic.co/t/kill-error/262786)
**Author:** [@peyman\_peymani](https://discuss.elastic.co/u/peyman_peymani)\ **Replies:** 4\ **Last updated:** [February 2, 2021, 6:30am UTC](https://discuss.elastic.co/t/kill-error/262786 "2021-02-02T06:30:10Z")
Hi dear our server after works 6 or 7 hours we have kill in process ● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendo … --- ## [How to append index level information to documents when returning search results](https://discuss.elastic.co/t/how-to-append-index-level-information-to-documents-when-returning-search-results/262923)
**Author:** [@ali\_wetrill](https://discuss.elastic.co/u/ali_wetrill)\ **Replies:** 1\ **Last updated:** [February 2, 2021, 6:12am UTC](https://discuss.elastic.co/t/how-to-append-index-level-information-to-documents-when-returning-search-results/262923 "2021-02-02T06:12:09Z")
Hi! Relatively simple question -- I want to append index-level information onto each document when returning those documents. I do not want to copy that information into each document (makes it harder to adjust that info… --- ## [Kibana scripted fields](https://discuss.elastic.co/t/kibana-scripted-fields/262739)
**Author:** [@Gokul6](https://discuss.elastic.co/u/Gokul6)\ **Replies:** 8\ **Last updated:** [February 2, 2021, 6:04am UTC](https://discuss.elastic.co/t/kibana-scripted-fields/262739 "2021-02-02T06:04:51Z")
def dayOfWeek = \["", "Mon", "Tue", "Wed", "Thu", "fri", "Sat", "Sunday"\] doc\['@timestamp'\].value.dayOfWeek; the above code will return sunday and the value will be stored in a variable called dayOfWeek in my data i ha… --- ## [Index Life cycle Policy indexes not roll overing](https://discuss.elastic.co/t/index-life-cycle-policy-indexes-not-roll-overing/262102)
**Author:** [@Anu6006](https://discuss.elastic.co/u/Anu6006)\ **Replies:** 12\ **Last updated:** [February 2, 2021, 5:22am UTC](https://discuss.elastic.co/t/index-life-cycle-policy-indexes-not-roll-overing/262102 "2021-02-02T05:22:31Z")
Hi, I'm facing some problem in Index life cycle policy in which indexes are not roll overing and delete phase is not working. Is there is a best practice to do so? --- ## [CPU Utilization not showing correct value \[ In heatmaps \]](https://discuss.elastic.co/t/cpu-utilization-not-showing-correct-value-in-heatmaps/262638)
**Author:** [@Sujithra\_S](https://discuss.elastic.co/u/Sujithra_S)\ **Replies:** 2\ **Last updated:** [February 2, 2021, 5:13am UTC](https://discuss.elastic.co/t/cpu-utilization-not-showing-correct-value-in-heatmaps/262638 "2021-02-02T05:13:06Z")
CPU Utilization is showing the wrong value in Heatmaps... In Azure portal CPU Utilization is 20% but in Heatmaps Visualization it is showing 90% and how to do Bucket script in Heatmaps. Please help me to sort out thi… --- ## [Add worker-loader into kibana](https://discuss.elastic.co/t/add-worker-loader-into-kibana/261786)
**Author:** [@phinguyen202](https://discuss.elastic.co/u/phinguyen202)\ **Replies:** 3\ **Last updated:** [February 2, 2021, 4:46am UTC](https://discuss.elastic.co/t/add-worker-loader-into-kibana/261786 "2021-02-02T04:46:22Z")
Hi there, I read 195162 and try to add worker-loader with the same solution. I ended up with nothing happen. My custom: \_\_bundleProvider\_\_(kbnServer) { console.log('\_\_bundleProvider\_\_'); const defaul… --- ## [Can I delete the source index that's been split into a new one?](https://discuss.elastic.co/t/can-i-delete-the-source-index-thats-been-split-into-a-new-one/262740)
**Author:** [@rojin](https://discuss.elastic.co/u/rojin)\ **Replies:** 2\ **Last updated:** [February 2, 2021, 4:35am UTC](https://discuss.elastic.co/t/can-i-delete-the-source-index-thats-been-split-into-a-new-one/262740 "2021-02-02T04:35:27Z")
Hello everyone! I have an index which has been split into a target index with more shards. Can I delete the source index now? Will there be any problems? I'd appreciate if anyone could explain this to me. Thanks in advan… --- ## [QueryShardException: No mapping found for \[sortOrder\] in order to sort on](https://discuss.elastic.co/t/queryshardexception-no-mapping-found-for-sortorder-in-order-to-sort-on/262927)
**Author:** [@Haunh](https://discuss.elastic.co/u/Haunh)\ **Replies:** 2\ **Last updated:** [February 2, 2021, 3:56am UTC](https://discuss.elastic.co/t/queryshardexception-no-mapping-found-for-sortorder-in-order-to-sort-on/262927 "2021-02-02T03:56:18Z")
Hi Everyone! I connect Fess to external Elastic then have error after created index of fess : QueryShardException: No mapping found for \[sortOrder\] in order to sort on Below is version of Fess & Elastic Elastic : { … --- ## [How to stop logstash schedule? and Keep the schedule function? (jdbc input)](https://discuss.elastic.co/t/how-to-stop-logstash-schedule-and-keep-the-schedule-function-jdbc-input/262919)
**Author:** [@plumy0902](https://discuss.elastic.co/u/plumy0902)\ **Replies:** 1\ **Last updated:** [February 2, 2021, 3:48am UTC](https://discuss.elastic.co/t/how-to-stop-logstash-schedule-and-keep-the-schedule-function-jdbc-input/262919 "2021-02-02T03:48:40Z")
I confirmed that the schedule is working normally. (I use the jdbc input) In the test environment, I stopped the job by using ctrl+c. How do I stop the schedule when I turn off the window that started logstash? After … --- ## [How to ship specific from date to end date from logstash](https://discuss.elastic.co/t/how-to-ship-specific-from-date-to-end-date-from-logstash/262898)
**Author:** [@Vamsi\_Krishna1](https://discuss.elastic.co/u/Vamsi_Krishna1)\ **Replies:** 1\ **Last updated:** [February 2, 2021, 2:58am UTC](https://discuss.elastic.co/t/how-to-ship-specific-from-date-to-end-date-from-logstash/262898 "2021-02-02T02:58:36Z")
Hi I need to ship data from 2020 dec to till date from one es index to another es index is there any way to do this, if any one know pls help me --- ## [Filter events by source using REGEXP](https://discuss.elastic.co/t/filter-events-by-source-using-regexp/262918)
**Author:** [@NadyLeez123](https://discuss.elastic.co/u/NadyLeez123)\ **Replies:** 0\ **Last updated:** [February 2, 2021, 1:20am UTC](https://discuss.elastic.co/t/filter-events-by-source-using-regexp/262918 "2021-02-02T01:20:52Z")
Hello, I'm working on a winlogbeat.yml. I want to filter event by events providers. I am using the REGEXP property so that all the events that would not begin as specified , would just be dropped. I'm so new to ELK. He… --- ## [Winlogbeat Filtering Issue](https://discuss.elastic.co/t/winlogbeat-filtering-issue/261695)
**Author:** [@jcor](https://discuss.elastic.co/u/jcor)\ **Replies:** 3\ **Last updated:** [February 2, 2021, 1:51am UTC](https://discuss.elastic.co/t/winlogbeat-filtering-issue/261695 "2021-02-02T01:51:01Z")
Hi folks, I've run into a weird issue. I have two separate clusters. One is my personal lab and the other is a dev lab. I'm trying to drop a specific winlogevent id as sysmon is very noisey and not required for what I a… --- ## [Snapshot Restore](https://discuss.elastic.co/t/snapshot-restore/262889)
**Author:** [@aniaks](https://discuss.elastic.co/u/aniaks)\ **Replies:** 3\ **Last updated:** [February 2, 2021, 1:37am UTC](https://discuss.elastic.co/t/snapshot-restore/262889 "2021-02-02T01:37:29Z")
when trying to do a snapshot and restore for 10 indices of each 50GB in size, the cluster gets loaded and causes lots of rejections during that time. Is there anything that needs to be configured on the cluster side? --- ## [Disallowing to specify number of shards & replicas at index creation time?](https://discuss.elastic.co/t/disallowing-to-specify-number-of-shards-replicas-at-index-creation-time/262915)
**Author:** [@mucius](https://discuss.elastic.co/u/mucius)\ **Replies:** 1\ **Last updated:** [February 2, 2021, 1:10am UTC](https://discuss.elastic.co/t/disallowing-to-specify-number-of-shards-replicas-at-index-creation-time/262915 "2021-02-02T01:10:46Z")
Good day, Is it possible to make Elasticsearch ignore number of replicas & number of shards specified by user during index creation? I'm interested to control these parameters on Elasticsearch side only (using templates… --- ## [How to set an AND logic in the Filter Transform of Vega?](https://discuss.elastic.co/t/how-to-set-an-and-logic-in-the-filter-transform-of-vega/262854)
**Author:** [@m-amano](https://discuss.elastic.co/u/m-amano)\ **Replies:** 2\ **Last updated:** [February 2, 2021, 1:07am UTC](https://discuss.elastic.co/t/how-to-set-an-and-logic-in-the-filter-transform-of-vega/262854 "2021-02-02T01:07:29Z")
I am using Elasticsearch v.7.10.2 and Vega version is v.4.3.0. I want to filter the dataset using AND logic and any of those codes below did not work. They filter out the data if y equals to 0 no matter what y1 has. 1… --- ## [Painless:Cannot invoke \\”Object.getClass()\\” because \\”callArgs\[0\]\\” is null](https://discuss.elastic.co/t/painless-cannot-invoke-object-getclass-because-callargs-0-is-null/261506)
**Author:** [@carpeDiem](https://discuss.elastic.co/u/carpeDiem)\ **Replies:** 1\ **Last updated:** [February 1, 2021, 11:44pm UTC](https://discuss.elastic.co/t/painless-cannot-invoke-object-getclass-because-callargs-0-is-null/261506 "2021-02-01T23:44:55Z")
Hello experts, I am using a painless scripting language to query,but the hit of result is empty. This is my query body. POST test\_script-0/\_search { "\_source":true, "aggs":{}, "from":0, … --- ## [How to search a keyword with spaces inside Kibana KQL?](https://discuss.elastic.co/t/how-to-search-a-keyword-with-spaces-inside-kibana-kql/262912)
**Author:** [@asp0818](https://discuss.elastic.co/u/asp0818)\ **Replies:** 1\ **Last updated:** [February 1, 2021, 11:26pm UTC](https://discuss.elastic.co/t/how-to-search-a-keyword-with-spaces-inside-kibana-kql/262912 "2021-02-01T23:26:03Z")
Hi, I'm trying to narrow down my search for the iphone with OS 14. However there is space in between. How can I extract this from the field type? Mozilla/5.0 (iPhone; CPU iPhone OS 14\_1 like Mac OS X) Thanks! --- ## [Question in elastic search to get specific records with specific date and time range](https://discuss.elastic.co/t/question-in-elastic-search-to-get-specific-records-with-specific-date-and-time-range/262804)
**Author:** [@Kin\_Wan](https://discuss.elastic.co/u/Kin_Wan)\ **Replies:** 1\ **Last updated:** [February 1, 2021, 11:11pm UTC](https://discuss.elastic.co/t/question-in-elastic-search-to-get-specific-records-with-specific-date-and-time-range/262804 "2021-02-01T23:11:39Z")
I would like to grep all the records that match "successLoginID" between 2021-01-07 to 2021-01-13 with time range from 09:00 to 18:00 but no records found with the below code. Can advise what's the problem? Thanks. GET… --- ## [Elasticsearch NEST upgrade strategies](https://discuss.elastic.co/t/elasticsearch-nest-upgrade-strategies/262873)
**Author:** [@MS\_Maverick](https://discuss.elastic.co/u/MS_Maverick)\ **Replies:** 0\ **Last updated:** [February 1, 2021, 5:35pm UTC](https://discuss.elastic.co/t/elasticsearch-nest-upgrade-strategies/262873 "2021-02-01T17:35:05Z")
Hi, We have multiple ETL jobs and multiple microservices which talk with Elasticsearch. We use NEST client to library for this. With rapid upgrades to Elasticsearch and new versions coming in rapid succession, we have t… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1575) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1577)