# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1588 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1589 --- ## [Logstash: Persistent Queue Behaviour](https://discuss.elastic.co/t/logstash-persistent-queue-behaviour/262141)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 3\ **Last updated:** [January 25, 2021, 5:03pm UTC](https://discuss.elastic.co/t/logstash-persistent-queue-behaviour/262141 "2021-01-25T17:03:15Z")
Hi, I've seen some behaviour with persistent queues that surprises me.I noticed this when throughput was capped on a logstash node when the EBS Burst Balance was exceeded for the volume of the logstash node in question.… --- ## [Ingest the same file multiple times](https://discuss.elastic.co/t/ingest-the-same-file-multiple-times/262142)
**Author:** [@Emiliano\_De\_Angelis](https://discuss.elastic.co/u/Emiliano_De_Angelis)\ **Replies:** 0\ **Last updated:** [January 25, 2021, 4:42pm UTC](https://discuss.elastic.co/t/ingest-the-same-file-multiple-times/262142 "2021-01-25T16:42:33Z")
hello, I would need to read and forward the same file to elastic twice, duplicating the information within elastic but on which to add a different field. how can i parse the same file twice? thanks --- ## [Elastic does not perform rollover automatically](https://discuss.elastic.co/t/elastic-does-not-perform-rollover-automatically/261395)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 13\ **Last updated:** [January 25, 2021, 4:34pm UTC](https://discuss.elastic.co/t/elastic-does-not-perform-rollover-automatically/261395 "2021-01-25T16:34:08Z")
Hi folks I have following setup: filebeat sends logs from kubernetes cluster to logstash. Logstash sends them to elastic. These are the configurations of important components: Index template: "filebeat-k8s-logs" : { … --- ## [Does dissect processor in beats support greedy/lazy match?](https://discuss.elastic.co/t/does-dissect-processor-in-beats-support-greedy-lazy-match/261616)
**Author:** [@cy-zheng](https://discuss.elastic.co/u/cy-zheng)\ **Replies:** 3\ **Last updated:** [January 25, 2021, 4:33pm UTC](https://discuss.elastic.co/t/does-dissect-processor-in-beats-support-greedy-lazy-match/261616 "2021-01-25T16:33:17Z")
I'm using dissect processor to parse a value like /var/log/containers/calico-node-ltx4t\_kube-system\_calico-node-21e03abb29adcec39f69e3f76c16eb2b3ed4dd1a51675279de5cedc59bdce56b.log using tokenizer:/var/log/containers/%… --- ## [Moving my first logs to ECS](https://discuss.elastic.co/t/moving-my-first-logs-to-ecs/261567)
**Author:** [@leostereo](https://discuss.elastic.co/u/leostereo)\ **Replies:** 5\ **Last updated:** [January 25, 2021, 4:29pm UTC](https://discuss.elastic.co/t/moving-my-first-logs-to-ecs/261567 "2021-01-25T16:29:41Z")
Hi friends. After succesing submiting my custom events into elk and visalize ok kibana, I would like to improve my event login format. After googlin about creating custom ecs index and indexing its documents , I did no… --- ## [Debuging a watcher](https://discuss.elastic.co/t/debuging-a-watcher/262138)
**Author:** [@Bastien\_SANDER](https://discuss.elastic.co/u/Bastien_SANDER)\ **Replies:** 0\ **Last updated:** [January 25, 2021, 4:23pm UTC](https://discuss.elastic.co/t/debuging-a-watcher/262138 "2021-01-25T16:23:31Z")
I want to update all document of a collection, and setting a boolean to false if the documents are returned by a query. I would like to create the following watcher : { "trigger": { "schedule": { … --- ## [Logstash throws \[message=\>“undefined method \`update' for nil:NilClass”\] when Elasticsearch index template defined in logstash](https://discuss.elastic.co/t/logstash-throws-message-undefined-method-update-for-nil-nilclass-when-elasticsearch-index-template-defined-in-logstash/262135)
**Author:** [@nadyahmed123](https://discuss.elastic.co/u/nadyahmed123)\ **Replies:** 0\ **Last updated:** [January 25, 2021, 4:19pm UTC](https://discuss.elastic.co/t/logstash-throws-message-undefined-method-update-for-nil-nilclass-when-elasticsearch-index-template-defined-in-logstash/262135 "2021-01-25T16:19:52Z")
I am trying to load data from sql server to Elasticsearch using logstash. For index creation i am using index template that is specified in the config file of logstash. Output field of logstash.config : output{ st… --- ## [How to push a mobile logs to ELK](https://discuss.elastic.co/t/how-to-push-a-mobile-logs-to-elk/262130)
**Author:** [@fio](https://discuss.elastic.co/u/fio)\ **Replies:** 0\ **Last updated:** [January 25, 2021, 3:59pm UTC](https://discuss.elastic.co/t/how-to-push-a-mobile-logs-to-elk/262130 "2021-01-25T15:59:33Z")
Hello, Is it possible to send the logs from my mobile app (Kotlin, Swift) to Kibana? How can I do it? There is an API or something like that --- ## [Monitor transforms](https://discuss.elastic.co/t/monitor-transforms/261538)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 3\ **Last updated:** [January 25, 2021, 3:50pm UTC](https://discuss.elastic.co/t/monitor-transforms/261538 "2021-01-25T15:50:05Z")
Hello, Any recommendation about monitoring transforms/ ML jobs performance ? I have lots of them, and I'm not sure which one is causing this issue every hour at about XX:35: I've tried the hot threads, but it's chang… --- ## [Install traffic light plugin on kibana 7.9 version](https://discuss.elastic.co/t/install-traffic-light-plugin-on-kibana-7-9-version/262061)
**Author:** [@Jordi](https://discuss.elastic.co/u/Jordi)\ **Replies:** 3\ **Last updated:** [January 25, 2021, 3:24pm UTC](https://discuss.elastic.co/t/install-traffic-light-plugin-on-kibana-7-9-version/262061 "2021-01-25T15:24:52Z")
Hi, i've a problems to install \[TrafficLightVisKibana6\] or a official plugin on kibana plugin page "traffic" https://www.elastic.co/guide/en/kibana/7.9/kibana-plugins.html . Not recognize the plugin. I installed with a … --- ## [Timestamp update](https://discuss.elastic.co/t/timestamp-update/262110)
**Author:** [@Makss39](https://discuss.elastic.co/u/Makss39)\ **Replies:** 2\ **Last updated:** [January 25, 2021, 3:21pm UTC](https://discuss.elastic.co/t/timestamp-update/262110 "2021-01-25T15:21:15Z")
Hello ! I would like to update my timestamp field, but all the info that i've found are not working... Probably a synthax error but i'm not able to figure out where it stucks... I already tried several option... POST … --- ## [Attempted to send event to pipeline](https://discuss.elastic.co/t/attempted-to-send-event-to-pipeline/262124)
**Author:** [@gose](https://discuss.elastic.co/u/gose)\ **Replies:** 0\ **Last updated:** [January 25, 2021, 3:13pm UTC](https://discuss.elastic.co/t/attempted-to-send-event-to-pipeline/262124 "2021-01-25T15:13:08Z")
I'm using Centralized Pipeline Management. I updated a pipeline (pipeline-1) that started sending events to another pipeline (pipeline-2). I didn't have pipeline-2 in my logstash.yml file, so Logstash didn't know about… --- ## [Usage of Cisco module's "asa" fileset usage in Logstash pipeline bypassing filebeat](https://discuss.elastic.co/t/usage-of-cisco-modules-asa-fileset-usage-in-logstash-pipeline-bypassing-filebeat/261945)
**Author:** [@mguttula](https://discuss.elastic.co/u/mguttula)\ **Replies:** 1\ **Last updated:** [January 25, 2021, 3:11pm UTC](https://discuss.elastic.co/t/usage-of-cisco-modules-asa-fileset-usage-in-logstash-pipeline-bypassing-filebeat/261945 "2021-01-25T15:11:59Z")
The current architecture of my set up is as follows: Cisco VPN --\> Logstash pipeline ---\> Elasticsearch I would like to use Cisco module asa fileset directly in the pipeline somehow so that I don't have to write the l… --- ## [Logstash to Logstash communication issue with domain based SSL signed certification](https://discuss.elastic.co/t/logstash-to-logstash-communication-issue-with-domain-based-ssl-signed-certification/260796)
**Author:** [@alexbennet](https://discuss.elastic.co/u/alexbennet)\ **Replies:** 1\ **Last updated:** [January 25, 2021, 3:09pm UTC](https://discuss.elastic.co/t/logstash-to-logstash-communication-issue-with-domain-based-ssl-signed-certification/260796 "2021-01-25T15:09:16Z")
We are implementing application log monitoring on ELK flow from filebeat (logstash output) -\> on-prem logstash server(beats input & lumberjack output) -\> aws logstash server (beats input & elastic output) -\> elasticear… --- ## [Convert seconds into minutes after sum aggregation](https://discuss.elastic.co/t/convert-seconds-into-minutes-after-sum-aggregation/261927)
**Author:** [@albie.morken](https://discuss.elastic.co/u/albie.morken)\ **Replies:** 3\ **Last updated:** [January 25, 2021, 2:42pm UTC](https://discuss.elastic.co/t/convert-seconds-into-minutes-after-sum-aggregation/261927 "2021-01-25T14:42:08Z")
I have an es index which contains the documents to indicate the time spent in seconds by an user in an activity like the one below { "UserName" : "User1", "Activity" : "Interacting", "TimeSpent" : 5… --- ## [Unable to create a Kibana Index pattern](https://discuss.elastic.co/t/unable-to-create-a-kibana-index-pattern/262005)
**Author:** [@Maria\_Elle](https://discuss.elastic.co/u/Maria_Elle)\ **Replies:** 9\ **Last updated:** [January 25, 2021, 2:38pm UTC](https://discuss.elastic.co/t/unable-to-create-a-kibana-index-pattern/262005 "2021-01-25T14:38:50Z")
I am using an Ubuntu machine, and I have just finished downloading all of ELK onto it, I now want to create a Kibana Index pattern with Filebeat but it is not allowing me to do so. How can I fix this issue or find out wh… --- ## [Packetbeat "hanging" on high speed network](https://discuss.elastic.co/t/packetbeat-hanging-on-high-speed-network/262117)
**Author:** [@Antonio\_Augusto\_Sant](https://discuss.elastic.co/u/Antonio_Augusto_Sant)\ **Replies:** 0\ **Last updated:** [January 25, 2021, 1:56pm UTC](https://discuss.elastic.co/t/packetbeat-hanging-on-high-speed-network/262117 "2021-01-25T13:56:50Z")
Gentlemen, I've configured packetbeat on a machine with plenty resources (72GB RAM, 24 cores Intel Xeon X5670), and its listening on two 10gb interfaces, that combined are reaching about 1gbps during peak hours. On this… --- ## [Nodes crashed and kNN questions](https://discuss.elastic.co/t/nodes-crashed-and-knn-questions/262097)
**Author:** [@doc113](https://discuss.elastic.co/u/doc113)\ **Replies:** 2\ **Last updated:** [January 25, 2021, 1:44pm UTC](https://discuss.elastic.co/t/nodes-crashed-and-knn-questions/262097 "2021-01-25T13:44:00Z")
Good time of day! Faced with an inexplicable thing - during the kNN search, the servers fall (in different order and not always (e.g. two success searches, one fail etc). Cluster: master 4cpu, 4gb coordinator 8cpu, 8… --- ## [Mapping defined in templates merges incorrectly ( multi-fields )](https://discuss.elastic.co/t/mapping-defined-in-templates-merges-incorrectly-multi-fields/262109)
**Author:** [@korali](https://discuss.elastic.co/u/korali)\ **Replies:** 0\ **Last updated:** [January 25, 2021, 1:23pm UTC](https://discuss.elastic.co/t/mapping-defined-in-templates-merges-incorrectly-multi-fields/262109 "2021-01-25T13:23:34Z")
Elasticsearch version : 7.10.0 When I create an index that matched two templates(templates -\> index patterns) (A field in a mapping defined in the two templates that have a multi-fields defined) and trying to insert a d… --- ## [Kibana: Kibana's service started but Kibana not launched (Kibana multiple instances configuration)](https://discuss.elastic.co/t/kibana-kibanas-service-started-but-kibana-not-launched-kibana-multiple-instances-configuration/262021)
**Author:** [@ade.syseng](https://discuss.elastic.co/u/ade.syseng)\ **Replies:** 3\ **Last updated:** [January 25, 2021, 1:12pm UTC](https://discuss.elastic.co/t/kibana-kibanas-service-started-but-kibana-not-launched-kibana-multiple-instances-configuration/262021 "2021-01-25T13:12:36Z")
Hi, I'm just learning to implement Elastic Stack on Docker swarm configuration with global mode. My issue is Kibana's service started but Kibana not launched (not working). PS I have followed this guidance. My global … --- ## [How to make custom template out of default Filebeat template](https://discuss.elastic.co/t/how-to-make-custom-template-out-of-default-filebeat-template/262075)
**Author:** [@ORich](https://discuss.elastic.co/u/ORich)\ **Replies:** 0\ **Last updated:** [January 25, 2021, 10:06am UTC](https://discuss.elastic.co/t/how-to-make-custom-template-out-of-default-filebeat-template/262075 "2021-01-25T10:06:15Z")
Dear all, I setup a new template as follow to distinguish filebeat file names. The problem I have is that this new template has no mapping configured ... how can I make this new index template inherit from default fileb… --- ## [Doc\_as\_upsert along with script in Elasticsearch output plugin](https://discuss.elastic.co/t/doc-as-upsert-along-with-script-in-elasticsearch-output-plugin/262106)
**Author:** [@Ahmed\_Sharara](https://discuss.elastic.co/u/Ahmed_Sharara)\ **Replies:** 0\ **Last updated:** [January 25, 2021, 12:55pm UTC](https://discuss.elastic.co/t/doc-as-upsert-along-with-script-in-elasticsearch-output-plugin/262106 "2021-01-25T12:55:57Z")
Hello, I'm using logstash to index data from Kafka to Elasticsearch. There are multiple events with the same id. I'm using doc\_as\_upsert in logstash to update existing documents with the new values based on the \_id. sa… --- ## [Logs mixed - same path on different servers](https://discuss.elastic.co/t/logs-mixed-same-path-on-different-servers/261799)
**Author:** [@yodog](https://discuss.elastic.co/u/yodog)\ **Replies:** 1\ **Last updated:** [January 25, 2021, 12:44pm UTC](https://discuss.elastic.co/t/logs-mixed-same-path-on-different-servers/261799 "2021-01-25T12:44:09Z")
i have 2 services running on apache: mail + drive the logs are getting mixed because they are on the same path (but on different servers). - type: log tags: \['drive'\] fields\_under\_root: true fields: '@metadat… --- ## [Import filebeat ingest pipeline](https://discuss.elastic.co/t/import-filebeat-ingest-pipeline/262104)
**Author:** [@Thomas74](https://discuss.elastic.co/u/Thomas74)\ **Replies:** 0\ **Last updated:** [January 25, 2021, 12:36pm UTC](https://discuss.elastic.co/t/import-filebeat-ingest-pipeline/262104 "2021-01-25T12:36:02Z")
Hi, I'm upgrading my cluster from version 7.4.0 to 7.10.2. I noticed that there's grok pattern warning, I think due to old filebeat pipeline : Terraform is used to push pipeline in our cluster but no json versions … --- ## [Data Type changes after Lifecycle creation](https://discuss.elastic.co/t/data-type-changes-after-lifecycle-creation/262103)
**Author:** [@hermlam](https://discuss.elastic.co/u/hermlam)\ **Replies:** 0\ **Last updated:** [January 25, 2021, 12:33pm UTC](https://discuss.elastic.co/t/data-type-changes-after-lifecycle-creation/262103 "2021-01-25T12:33:22Z")
Good morning, I have syslog with special fields. These logs are being processed by Elastic-Agent (Filebeat). I created some extra fields in the datastream with numeric data type. These fields are being filled by a KV-pr… --- ## [Drill down Dashboard](https://discuss.elastic.co/t/drill-down-dashboard/261782)
**Author:** [@mohamed.farhan](https://discuss.elastic.co/u/mohamed.farhan)\ **Replies:** 4\ **Last updated:** [January 25, 2021, 12:29pm UTC](https://discuss.elastic.co/t/drill-down-dashboard/261782 "2021-01-25T12:29:50Z")
Can we drill-down the data-table dashboard? I have tried with a pie chart, works fine. The thing is, i would like to know can we drill-down in data-table? --- ## [Strange index size](https://discuss.elastic.co/t/strange-index-size/261703)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 14\ **Last updated:** [January 25, 2021, 12:18pm UTC](https://discuss.elastic.co/t/strange-index-size/261703 "2021-01-25T12:18:31Z")
Hi, I have 2 clusters, running, 7.10 on different locations. They index the same kind of logging so are set up identically. I conduct searches via kibana on local as well as remote indices in those 2 clusters. Now here… --- ## [Logstash Upgrade](https://discuss.elastic.co/t/logstash-upgrade/262100)
**Author:** [@Rithesh\_Subramanian](https://discuss.elastic.co/u/Rithesh_Subramanian)\ **Replies:** 0\ **Last updated:** [January 25, 2021, 11:56am UTC](https://discuss.elastic.co/t/logstash-upgrade/262100 "2021-01-25T11:56:44Z")
Hi, I had used logstash-6.2.2 and now i hadupgraded to logstash-7.10.1. I am using logstash package for linux. I am using filebeat as a log shipper. Both the filebeat version and logstash version are same. But after up… --- ## [Sophos log configuration](https://discuss.elastic.co/t/sophos-log-configuration/262099)
**Author:** [@santosh](https://discuss.elastic.co/u/santosh)\ **Replies:** 0\ **Last updated:** [January 25, 2021, 11:52am UTC](https://discuss.elastic.co/t/sophos-log-configuration/262099 "2021-01-25T11:52:48Z")
I have been trying to pull the logs from Sophos device with the following configuration but looks like something is wrong in the configuration as I can't see any log messages in the Kibana dashboard. Any pointers? I have… --- ## [SSL certificate reload](https://discuss.elastic.co/t/ssl-certificate-reload/262090)
**Author:** [@raivis.krumins](https://discuss.elastic.co/u/raivis.krumins)\ **Replies:** 0\ **Last updated:** [January 25, 2021, 11:34am UTC](https://discuss.elastic.co/t/ssl-certificate-reload/262090 "2021-01-25T11:34:22Z")
I want to use hashicorp vault to manage logstash ssl certs on kubernetes. I am using logstash helm chart --version 7.10.1 These pod annotations work as expected: podAnnotations: vault.hashicorp.com/agent-inject: "tr… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1587) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1589)