# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1677 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1678 --- ## [CPU usage for logstash hits over 300%](https://discuss.elastic.co/t/cpu-usage-for-logstash-hits-over-300/255174)
**Author:** [@powerinside](https://discuss.elastic.co/u/powerinside)\ **Replies:** 5\ **Last updated:** [November 25, 2020, 2:28pm UTC](https://discuss.elastic.co/t/cpu-usage-for-logstash-hits-over-300/255174 "2020-11-25T14:28:00Z")
Hello everybody, I am trying to parse logs using multiple grok filters. I have noticed that if i add following pattern, CPU usage for logstash hits over 300%. I have a couple of grok patterns for nginx logs as well wit… --- ## [Control Visualization alternative](https://discuss.elastic.co/t/control-visualization-alternative/256660)
**Author:** [@mrudrego](https://discuss.elastic.co/u/mrudrego)\ **Replies:** 1\ **Last updated:** [November 25, 2020, 2:25pm UTC](https://discuss.elastic.co/t/control-visualization-alternative/256660 "2020-11-25T14:25:24Z")
Hi, We want to add interactive inputs to kibana dashboard, the feature that Control Visualization provides. But there is a warning which says this is Experimental(which states can be removed and its not stable as other … --- ## [User\_agent filter regexes.yaml location](https://discuss.elastic.co/t/user-agent-filter-regexes-yaml-location/256625)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 2\ **Last updated:** [November 25, 2020, 2:11pm UTC](https://discuss.elastic.co/t/user-agent-filter-regexes-yaml-location/256625 "2020-11-25T14:11:21Z")
Hi, I am looking to use the user\_agent filter in logstash. In the guide (https://www.elastic.co/guide/en/logstash/current/plugins-filters-useragent.html#plugins-filters-useragent-regexes) it states If not specified, t… --- ## [Transform: Sum doesn't add up](https://discuss.elastic.co/t/transform-sum-doesnt-add-up/256622)
**Author:** [@kaijun](https://discuss.elastic.co/u/kaijun)\ **Replies:** 15\ **Last updated:** [November 25, 2020, 2:09pm UTC](https://discuss.elastic.co/t/transform-sum-doesnt-add-up/256622 "2020-11-25T14:09:20Z")
I have an existing index datalog.gl\_sep20 and I want to transform to a new index based on some fields and do a sum aggregation based on "count" field. This is how I do it: curl -X PUT "localhost:9200/\_transform/transfor… --- ## [Client requested protocol tlsv1 is not enabled or supported in server context](https://discuss.elastic.co/t/client-requested-protocol-tlsv1-is-not-enabled-or-supported-in-server-context/256610)
**Author:** [@adnanahmed](https://discuss.elastic.co/u/adnanahmed)\ **Replies:** 4\ **Last updated:** [November 25, 2020, 1:54pm UTC](https://discuss.elastic.co/t/client-requested-protocol-tlsv1-is-not-enabled-or-supported-in-server-context/256610 "2020-11-25T13:54:42Z")
Hi, we are using ELK stack version 7.9.0 , when we try to connect logstash with elastic it give us error . 'client requested protocol tlsv1 is not enabled or supported in server context' when we specify following … --- ## [Suggester not returning and hits](https://discuss.elastic.co/t/suggester-not-returning-and-hits/255231)
**Author:** [@Bart\_de\_Man](https://discuss.elastic.co/u/Bart_de_Man)\ **Replies:** 1\ **Last updated:** [November 25, 2020, 1:49pm UTC](https://discuss.elastic.co/t/suggester-not-returning-and-hits/255231 "2020-11-25T13:49:28Z")
Elasticsearch version ( bin/elasticsearch --version ): 5.6.11 Plugins installed : JVM version ( java -version ): openjdk version "1.8.0\_222" OpenJDK Runtime Environment (build 1.8.0\_222-8u222-b10-1ubuntu1~16.04.1-b1… --- ## [Using Collapse in elastic low level client with Hibernate Search](https://discuss.elastic.co/t/using-collapse-in-elastic-low-level-client-with-hibernate-search/256616)
**Author:** [@daviddavid](https://discuss.elastic.co/u/daviddavid)\ **Replies:** 5\ **Last updated:** [November 25, 2020, 1:47pm UTC](https://discuss.elastic.co/t/using-collapse-in-elastic-low-level-client-with-hibernate-search/256616 "2020-11-25T13:47:00Z")
Using Collapse in elastic low level client with Hibernate Search. How to use Collapse in Java Code as it is working in query search in browser with Collapse on field but with elastic low level client with Hibernate Sear… --- ## [Logstash remove after split](https://discuss.elastic.co/t/logstash-remove-after-split/256608)
**Author:** [@tamilarasanbravo](https://discuss.elastic.co/u/tamilarasanbravo)\ **Replies:** 1\ **Last updated:** [November 25, 2020, 1:45pm UTC](https://discuss.elastic.co/t/logstash-remove-after-split/256608 "2020-11-25T13:45:40Z")
Hi Team, I have configured a logstash http which receives JSON data. As part of the logstash filter I split a json field/value of array into 5 different key values. i.e., original Field commits : { author : TJ email… --- ## [Logstash with multiple conf files](https://discuss.elastic.co/t/logstash-with-multiple-conf-files/255664)
**Author:** [@Kfiro](https://discuss.elastic.co/u/Kfiro)\ **Replies:** 6\ **Last updated:** [November 25, 2020, 1:37pm UTC](https://discuss.elastic.co/t/logstash-with-multiple-conf-files/255664 "2020-11-25T13:37:41Z")
Hi ELK, I'm trying to configure my Logstash to run with 2 "conf" files, First: winlogbeat.conf input { beats { port =\> 5044 } } output { elasticsearch { hosts=\>\["https://elk01:9200"\] index=\>"logstas… --- ## [Filebeat drop\_event module input](https://discuss.elastic.co/t/filebeat-drop-event-module-input/238610)
**Author:** [@Mischa\_Diehm](https://discuss.elastic.co/u/Mischa_Diehm)\ **Replies:** 3\ **Last updated:** [November 25, 2020, 1:28pm UTC](https://discuss.elastic.co/t/filebeat-drop-event-module-input/238610 "2020-11-25T13:28:19Z")
Hi, I try to filter messages in the filebeat module section to parse a single logstream into system and iptables parsed logs. Syslog is received from our linux based (openwrt to be specific) devices over the network an… --- ## [Elastic cloud cpu scaling](https://discuss.elastic.co/t/elastic-cloud-cpu-scaling/256401)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 4\ **Last updated:** [November 25, 2020, 12:50pm UTC](https://discuss.elastic.co/t/elastic-cloud-cpu-scaling/256401 "2020-11-25T12:50:42Z")
When increasing the ram on an instance in elastic cloud, does this increase the cpu cores to that instances as well as increase the credit? --- ## [Logstash logging](https://discuss.elastic.co/t/logstash-logging/256655)
**Author:** [@hzarrabi](https://discuss.elastic.co/u/hzarrabi)\ **Replies:** 0\ **Last updated:** [November 25, 2020, 12:10pm UTC](https://discuss.elastic.co/t/logstash-logging/256655 "2020-11-25T12:10:26Z")
Hi Guys, I would like to configure logstash log4j2.properties in order to fix the log size to 10M and to delete those older then 7 days. Could you please tell me which parameters to set log4j2.properties. Thanks, Bes… --- ## [Aggregate multiple events based on file](https://discuss.elastic.co/t/aggregate-multiple-events-based-on-file/256650)
**Author:** [@Muhammad\_Faisal](https://discuss.elastic.co/u/Muhammad_Faisal)\ **Replies:** 0\ **Last updated:** [November 25, 2020, 11:50am UTC](https://discuss.elastic.co/t/aggregate-multiple-events-based-on-file/256650 "2020-11-25T11:50:21Z")
hi , i have below directory structure and each subnode contains multiple log files which are generated daily and closed and then next day or some time after couple of days another file is generated and closed....i am ca… --- ## [Unable to save the array of json object in elasticsearch. Need to save it as string](https://discuss.elastic.co/t/unable-to-save-the-array-of-json-object-in-elasticsearch-need-to-save-it-as-string/256557)
**Author:** [@Saumya\_Mishra](https://discuss.elastic.co/u/Saumya_Mishra)\ **Replies:** 0\ **Last updated:** [November 24, 2020, 6:30pm UTC](https://discuss.elastic.co/t/unable-to-save-the-array-of-json-object-in-elasticsearch-need-to-save-it-as-string/256557 "2020-11-24T18:30:46Z")
I want to save this kind of data as a string in elasticsearch, but it fails to save \[{"flag":0,"amt":0,"code":1,"start":0,"end":0,"phrase":"they "},{"flag":0,"amt":0,"code":1,"start":0,"end":0,"phrase":"they qwe "},{"fl… --- ## [Winlogbeat dashboard incomplete/missing fields](https://discuss.elastic.co/t/winlogbeat-dashboard-incomplete-missing-fields/256375)
**Author:** [@bohm](https://discuss.elastic.co/u/bohm)\ **Replies:** 9\ **Last updated:** [November 25, 2020, 11:25am UTC](https://discuss.elastic.co/t/winlogbeat-dashboard-incomplete-missing-fields/256375 "2020-11-25T11:25:01Z")
Hello, Winlogbeat and ELK 7.10.0 Trying to show a college of mine that visualisation is much easier with Kibana then Splunk, I'm trying to build a use case with Active Directory security logging. But is looks like some… --- ## [Map serivce url to service/operation](https://discuss.elastic.co/t/map-serivce-url-to-service-operation/256642)
**Author:** [@rmrfchik](https://discuss.elastic.co/u/rmrfchik)\ **Replies:** 0\ **Last updated:** [November 25, 2020, 11:05am UTC](https://discuss.elastic.co/t/map-serivce-url-to-service-operation/256642 "2020-11-25T11:05:34Z")
I have a number of services across servers, each service serves urls like /service1/operation1 /service1/operation2?data /service2/path/operation3/data1 /service2/path/operation3/data2 I need to measure metrics for gi… --- ## [Elasticsearch output for Elastic Agent - adding an ingest pipeline](https://discuss.elastic.co/t/elasticsearch-output-for-elastic-agent-adding-an-ingest-pipeline/256398)
**Author:** [@bsanderRMG](https://discuss.elastic.co/u/bsanderRMG)\ **Replies:** 4\ **Last updated:** [November 25, 2020, 10:56am UTC](https://discuss.elastic.co/t/elasticsearch-output-for-elastic-agent-adding-an-ingest-pipeline/256398 "2020-11-25T10:56:37Z")
Hello. Is it possible to assign an ingest pipeline for the Elastic Agent? ideally we'd like to push this out to the entire fleet as well. I've tried below and it does not seem to have any effect. Let me know if you h… --- ## [\[Query DSL\] Get documents which don't have a sepcific value (in array, object/nested)](https://discuss.elastic.co/t/query-dsl-get-documents-which-dont-have-a-sepcific-value-in-array-object-nested/256637)
**Author:** [@ThibautSF](https://discuss.elastic.co/u/ThibautSF)\ **Replies:** 0\ **Last updated:** [November 25, 2020, 10:38am UTC](https://discuss.elastic.co/t/query-dsl-get-documents-which-dont-have-a-sepcific-value-in-array-object-nested/256637 "2020-11-25T10:38:31Z")
I will explain with examples, it should be better. I have 3 documents A, B and C (to be precise, in fact it's 3 type of document, there is more documents) Each document has a nested field of objects (with some fields),… --- ## [ES node find master, but can't join the cluster](https://discuss.elastic.co/t/es-node-find-master-but-cant-join-the-cluster/256591)
**Author:** [@Todd](https://discuss.elastic.co/u/Todd)\ **Replies:** 4\ **Last updated:** [November 25, 2020, 10:37am UTC](https://discuss.elastic.co/t/es-node-find-master-but-cant-join-the-cluster/256591 "2020-11-25T10:37:04Z")
Hi, These days I have found such a situation: one data node of the cluster has discoveried three master nodes, but it can't join the cluster. However, when I restart it, the data node joins successful !!! ES version: 7… --- ## [High refresh time in cluster nodes](https://discuss.elastic.co/t/high-refresh-time-in-cluster-nodes/256635)
**Author:** [@sahere37](https://discuss.elastic.co/u/sahere37)\ **Replies:** 0\ **Last updated:** [November 25, 2020, 10:28am UTC](https://discuss.elastic.co/t/high-refresh-time-in-cluster-nodes/256635 "2020-11-25T10:28:17Z")
Hi all, I have a three node cluster elasticsearch version 6.5.4. Some times data in visualize and dashboard falling behind and it takes hours to back. Based on monitoring dashboard of elasticsearch, index latency incre… --- ## [Kibana time-out errors](https://discuss.elastic.co/t/kibana-time-out-errors/255479)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 5\ **Last updated:** [November 25, 2020, 9:45am UTC](https://discuss.elastic.co/t/kibana-time-out-errors/255479 "2020-11-25T09:45:29Z")
Hello, I am testing ELasticsearch to deploy it in production cluster. The first days it was working perfectly, and then I began having trouble when I try to search logs using Kibana, and the response was taking a long t… --- ## [Transforms updates fields from data that exists from before even a filter condition was not met](https://discuss.elastic.co/t/transforms-updates-fields-from-data-that-exists-from-before-even-a-filter-condition-was-not-met/256020)
**Author:** [@syunusic](https://discuss.elastic.co/u/syunusic)\ **Replies:** 3\ **Last updated:** [November 25, 2020, 10:03am UTC](https://discuss.elastic.co/t/transforms-updates-fields-from-data-that-exists-from-before-even-a-filter-condition-was-not-met/256020 "2020-11-25T10:03:58Z")
I have an index (client\_index) that has three fields: @timestamp, user, ip. I have a transform like this: { "id": "my\_transform", "source": { "index": \[ "client\_index" \], "query": { "match\_al… --- ## [Using field name other than "message" in grok match](https://discuss.elastic.co/t/using-field-name-other-than-message-in-grok-match/256563)
**Author:** [@Muhammad\_Faisal](https://discuss.elastic.co/u/Muhammad_Faisal)\ **Replies:** 5\ **Last updated:** [November 25, 2020, 10:03am UTC](https://discuss.elastic.co/t/using-field-name-other-than-message-in-grok-match/256563 "2020-11-25T10:03:40Z")
i have log like below, in line 2 , i have stored custom filter value in field "method"...in line 3 , i want to use "method" field and apply it another custom filter and store this result in method 2...i don't want to cha… --- ## [Indexing best practice](https://discuss.elastic.co/t/indexing-best-practice/256564)
**Author:** [@Elitlogik](https://discuss.elastic.co/u/Elitlogik)\ **Replies:** 3\ **Last updated:** [November 25, 2020, 9:52am UTC](https://discuss.elastic.co/t/indexing-best-practice/256564 "2020-11-25T09:52:19Z")
Just finished my first ELK deployment. On a HP EliteDesk i5, 8 GB, 120 GB SSD for $90. It was done with CentOS 8 Minimal, Docker, Docker Compose, Cockpit, Portainer and Deviantony/Docker-ELK. A few tweaks, adding Beats … --- ## [Error without origin](https://discuss.elastic.co/t/error-without-origin/256630)
**Author:** [@Tim\_Stoop](https://discuss.elastic.co/u/Tim_Stoop)\ **Replies:** 0\ **Last updated:** [November 25, 2020, 9:49am UTC](https://discuss.elastic.co/t/error-without-origin/256630 "2020-11-25T09:49:50Z")
Hi, We're running ECK and our 7.9.3 Filebeat are logging a lot of messages like these: {"log.level":"error","@timestamp":"2020-11-25T09:43:39.424Z","log.logger":"reader\_json","log.origin":{"file.name":"readjson/json.go… --- ## [Net::ReadTimeout, how to avoid going to artifacts.elastic.co/downloads for customizedlogstash java-plugin](https://discuss.elastic.co/t/net-readtimeout-how-to-avoid-going-to-artifacts-elastic-co-downloads-for-customizedlogstash-java-plugin/256626)
**Author:** [@hellopcz](https://discuss.elastic.co/u/hellopcz)\ **Replies:** 1\ **Last updated:** [November 25, 2020, 9:40am UTC](https://discuss.elastic.co/t/net-readtimeout-how-to-avoid-going-to-artifacts-elastic-co-downloads-for-customizedlogstash-java-plugin/256626 "2020-11-25T09:40:13Z")
I developed some logstash java plugin and it run well under good network condition. But under some bad network condition, I have to use proxy for internet surfing, the plugin shows the Net::ReadTimeout. --- ## [Scripted terms always returns stringified values](https://discuss.elastic.co/t/scripted-terms-always-returns-stringified-values/256623)
**Author:** [@APic](https://discuss.elastic.co/u/APic)\ **Replies:** 0\ **Last updated:** [November 25, 2020, 9:17am UTC](https://discuss.elastic.co/t/scripted-terms-always-returns-stringified-values/256623 "2020-11-25T09:17:01Z")
Hello, we are using script to execute terms on fields that are run-time created by source and we don't know their name in advance. Source documents: { "@timestamp": "2020-11-24T06:06:14.0058521+01:00"… --- ## [BadRequirementError, Illformed requirement, fail to install offline logstash java plugin for the version reason or others?](https://discuss.elastic.co/t/badrequirementerror-illformed-requirement-fail-to-install-offline-logstash-java-plugin-for-the-version-reason-or-others/256619)
**Author:** [@hellopcz](https://discuss.elastic.co/u/hellopcz)\ **Replies:** 1\ **Last updated:** [November 25, 2020, 9:01am UTC](https://discuss.elastic.co/t/badrequirementerror-illformed-requirement-fail-to-install-offline-logstash-java-plugin-for-the-version-reason-or-others/256619 "2020-11-25T09:01:13Z")
I've packed logstash offline java plugin but the plugin can not be well installed. it may be caused by wrong version. The offline plugin was built by prepare-offline-pack command but plugin name has to be set to logstas… --- ## [Filebeat PaloAlto Modules for virtual system field](https://discuss.elastic.co/t/filebeat-paloalto-modules-for-virtual-system-field/255987)
**Author:** [@fadjar340](https://discuss.elastic.co/u/fadjar340)\ **Replies:** 2\ **Last updated:** [November 25, 2020, 9:00am UTC](https://discuss.elastic.co/t/filebeat-paloalto-modules-for-virtual-system-field/255987 "2020-11-25T09:00:39Z")
This is my little modification to get the paloalto vsys field. In the file /usr/share/filebeat/module/panw/panos/config/input.yml i add 2 lines to make vsys visible in the index, as follow: {{ if eq .input "syslog" }}… --- ## [Panic: runtime error: index out of range goroutine 1 \[running\]: while running metricbeat setup](https://discuss.elastic.co/t/panic-runtime-error-index-out-of-range-goroutine-1-running-while-running-metricbeat-setup/256220)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 11\ **Last updated:** [November 25, 2020, 8:48am UTC](https://discuss.elastic.co/t/panic-runtime-error-index-out-of-range-goroutine-1-running-while-running-metricbeat-setup/256220 "2020-11-25T08:48:37Z")
running metricbeat setup command through ansible but getting below error. Can someone please sugesst where to check to fix this issue. After 2nd playbook run can see this host is skipped or ignored (may be due to when co… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1676) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1678)