# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1695 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1696 --- ## [Logstash error after updating to 7.9.1](https://discuss.elastic.co/t/logstash-error-after-updating-to-7-9-1/255366)
**Author:** [@noobman2logstash](https://discuss.elastic.co/u/noobman2logstash)\ **Replies:** 8\ **Last updated:** [November 16, 2020, 6:46pm UTC](https://discuss.elastic.co/t/logstash-error-after-updating-to-7-9-1/255366 "2020-11-16T18:46:07Z")
\[2020-11-13T16:36:21,302\]\[ERROR\]\[logstash.agent \] Failed to execute action {:id=\>:default, :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Could not execute action: PipelineAction::Create, acti… --- ## [Checking ReIndex Status - Seems wrong, why?](https://discuss.elastic.co/t/checking-reindex-status-seems-wrong-why/255582)
**Author:** [@21908](https://discuss.elastic.co/u/21908)\ **Replies:** 1\ **Last updated:** [November 16, 2020, 6:34pm UTC](https://discuss.elastic.co/t/checking-reindex-status-seems-wrong-why/255582 "2020-11-16T18:34:23Z")
I'm going off of Kibana document page at: https://www.elastic.co/guide/en/kibana/current/check-reindex-status.html I ran the "reindex status" command and am seeing this result in the browser: This result appears wro… --- ## [Scripted fields in vega visualization - Getting Bad request as error](https://discuss.elastic.co/t/scripted-fields-in-vega-visualization-getting-bad-request-as-error/254395)
**Author:** [@Pranusha119](https://discuss.elastic.co/u/Pranusha119)\ **Replies:** 6\ **Last updated:** [November 16, 2020, 6:29pm UTC](https://discuss.elastic.co/t/scripted-fields-in-vega-visualization-getting-bad-request-as-error/254395 "2020-11-16T18:29:47Z")
{ $schema: "https://vega.github.io/schema/vega-lite/v2.json" data: { url: { %context%: true index: index\_ssd\_2 body: { size: 10000, \_source: \["mediatype","pred\_comp\_sem","Gender","PhotoOfP… --- ## [Elasticsearch Node Segregation](https://discuss.elastic.co/t/elasticsearch-node-segregation/255537)
**Author:** [@ajesh](https://discuss.elastic.co/u/ajesh)\ **Replies:** 4\ **Last updated:** [November 16, 2020, 5:41pm UTC](https://discuss.elastic.co/t/elasticsearch-node-segregation/255537 "2020-11-16T17:41:39Z")
Hi Team, I am planning to have one more node to my Elasticsearch cluster, but only for a specific use case. I need that node to be used only for ingesting logs from our Cisco ASA using filebeat. How can i restrict this… --- ## [In Scripted fields no option to select lucene expression language - kibana version 7.9](https://discuss.elastic.co/t/in-scripted-fields-no-option-to-select-lucene-expression-language-kibana-version-7-9/253528)
**Author:** [@Pranusha119](https://discuss.elastic.co/u/Pranusha119)\ **Replies:** 4\ **Last updated:** [November 16, 2020, 5:41pm UTC](https://discuss.elastic.co/t/in-scripted-fields-no-option-to-select-lucene-expression-language-kibana-version-7-9/253528 "2020-11-16T17:41:38Z")
--- ## [Bettering response time by using lesser number of bigger-sized shards](https://discuss.elastic.co/t/bettering-response-time-by-using-lesser-number-of-bigger-sized-shards/254475)
**Author:** [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Replies:** 10\ **Last updated:** [November 16, 2020, 4:34pm UTC](https://discuss.elastic.co/t/bettering-response-time-by-using-lesser-number-of-bigger-sized-shards/254475 "2020-11-16T16:34:23Z")
I have an ES 6.8.6 cluster containing about 1200 day-wise indices. Today indexing happens only on today's day-wise index. There are no updates. This cluster contains about 45 TB data including preserving historical data … --- ## [Display date without time in Elasticsearch](https://discuss.elastic.co/t/display-date-without-time-in-elasticsearch/255266)
**Author:** [@VeeT](https://discuss.elastic.co/u/VeeT)\ **Replies:** 5\ **Last updated:** [November 16, 2020, 4:33pm UTC](https://discuss.elastic.co/t/display-date-without-time-in-elasticsearch/255266 "2020-11-16T16:33:46Z")
Hi, I have the following input in a "Date" field: Date=2020.11.12 Currently, it's displaying as this in Kibana: Date Nov 12, 2020 @ 00:00:00.000 I would like to display this as is in Kibana, i.e., Date: 2020.11.12. … --- ## [Kibana don't start visTypeTimeseries plugin](https://discuss.elastic.co/t/kibana-dont-start-vistypetimeseries-plugin/255258)
**Author:** [@16318a22907f3cbfa04b](https://discuss.elastic.co/u/16318a22907f3cbfa04b)\ **Replies:** 3\ **Last updated:** [November 16, 2020, 4:31pm UTC](https://discuss.elastic.co/t/kibana-dont-start-vistypetimeseries-plugin/255258 "2020-11-16T16:31:23Z")
Kibana development environment v7.9.1 yarn kbn bootstrap yarn start --oss np bld log \[23:25:19.560\] \[error\]\[@kbn/optimizer\] webpack compile errors │np bld log \[23:25:19.561\] \[error\]\[@kbn/optimizer\] \[visTy… --- ## [Split string in scripted fields, using \_ as a delimiter](https://discuss.elastic.co/t/split-string-in-scripted-fields-using-as-a-delimiter/253803)
**Author:** [@goncalobsantos](https://discuss.elastic.co/u/goncalobsantos)\ **Replies:** 6\ **Last updated:** [November 16, 2020, 4:25pm UTC](https://discuss.elastic.co/t/split-string-in-scripted-fields-using-as-a-delimiter/253803 "2020-11-16T16:25:03Z")
I have a string field "myfield.keyword", where each entry has the following format: AAA\_BBBB\_CC DDD\_EEE\_F I am trying to create a scripted field that outputs the substring before the first \_, a scripted field that out… --- ## [Active\_primary\_shards \> 1 when you have more than 1 data node](https://discuss.elastic.co/t/active-primary-shards-1-when-you-have-more-than-1-data-node/255545)
**Author:** [@21908](https://discuss.elastic.co/u/21908)\ **Replies:** 3\ **Last updated:** [November 16, 2020, 4:22pm UTC](https://discuss.elastic.co/t/active-primary-shards-1-when-you-have-more-than-1-data-node/255545 "2020-11-16T16:22:13Z")
I have a 3 node Elasticsearch cluster. All nodes are data bearing nodes. If active\_primary\_shards is set to 1 my data would not be distributed among the 3 nodes, is that a correct understanding? My single shard would … --- ## [Script field not returning value](https://discuss.elastic.co/t/script-field-not-returning-value/255549)
**Author:** [@pmo](https://discuss.elastic.co/u/pmo)\ **Replies:** 5\ **Last updated:** [November 16, 2020, 4:15pm UTC](https://discuss.elastic.co/t/script-field-not-returning-value/255549 "2020-11-16T16:15:15Z")
Hi support, I've created this Script Field in Kibana index pattern, but I've an issue, nothing is return... Each time I have a field name : category\_name that match "Router", I should have a value (netflow value), But … --- ## [Closed+hot index or warm+hot index](https://discuss.elastic.co/t/closed-hot-index-or-warm-hot-index/255078)
**Author:** [@nyquillus](https://discuss.elastic.co/u/nyquillus)\ **Replies:** 3\ **Last updated:** [November 16, 2020, 4:02pm UTC](https://discuss.elastic.co/t/closed-hot-index-or-warm-hot-index/255078 "2020-11-16T16:02:49Z")
Hello, I'm administrating an elastic stack at the moment and my current method right now is closing indexes older than 2 weeks and keeping the last 2 weeks in hot state. If people need to check logs older than 2 weeks t… --- ## [Indices.breaker.request advice](https://discuss.elastic.co/t/indices-breaker-request-advice/255568)
**Author:** [@lechuck](https://discuss.elastic.co/u/lechuck)\ **Replies:** 0\ **Last updated:** [November 16, 2020, 3:59pm UTC](https://discuss.elastic.co/t/indices-breaker-request-advice/255568 "2020-11-16T15:59:47Z")
Hello - a quick one hopefully! Occasionally we experience issues when end users run heavy aggregations - the parent circuit breaker is tripped and this causes issues for other clients which may be performing lighter unr… --- ## [Solution for Logstash json file input - solution pour injecter un fichier json formaté comme ci dessous](https://discuss.elastic.co/t/solution-for-logstash-json-file-input-solution-pour-injecter-un-fichier-json-formate-comme-ci-dessous/255564)
**Author:** [@pmo](https://discuss.elastic.co/u/pmo)\ **Replies:** 0\ **Last updated:** [November 16, 2020, 3:37pm UTC](https://discuss.elastic.co/t/solution-for-logstash-json-file-input-solution-pour-injecter-un-fichier-json-formate-comme-ci-dessous/255564 "2020-11-16T15:37:53Z")
I've json file that are formated like this (j'ai des fichiers json formatés comme ci dessous - les données ont été changées) \[ { "crossConnectVlanRanges": "", "productAndRelease": "FX-I.2.0", "role": "", … --- ## [Filebeat module to see system logins](https://discuss.elastic.co/t/filebeat-module-to-see-system-logins/255519)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 4\ **Last updated:** [November 16, 2020, 12:21pm UTC](https://discuss.elastic.co/t/filebeat-module-to-see-system-logins/255519 "2020-11-16T12:21:16Z")
I have to keep track of system logins with filebeat. Filebeat has a default dashboard called \[Filebeat System\] SSH login attempts ECS which seems perfect. So to use that, I went to one of the machines, stopped filebeat, … --- ## [Apache module custom index is ignored](https://discuss.elastic.co/t/apache-module-custom-index-is-ignored/255560)
**Author:** [@JohanT](https://discuss.elastic.co/u/JohanT)\ **Replies:** 0\ **Last updated:** [November 16, 2020, 2:57pm UTC](https://discuss.elastic.co/t/apache-module-custom-index-is-ignored/255560 "2020-11-16T14:57:14Z")
Hi there, We've upgraded from filebeats 6.8.2 to 7.9.2, and all our logs are getting to ElasticSearch, yet the Apache logs are getting through with the default index (filebeat-version-date type setup) instead of the cus… --- ## [Droping log when missing time entry](https://discuss.elastic.co/t/droping-log-when-missing-time-entry/255521)
**Author:** [@iccMe](https://discuss.elastic.co/u/iccMe)\ **Replies:** 2\ **Last updated:** [November 16, 2020, 3:10pm UTC](https://discuss.elastic.co/t/droping-log-when-missing-time-entry/255521 "2020-11-16T15:10:42Z")
Hi, I was wondering if anyone could advise the best way to drop a log when the actual time is missing from the logged event. Normally the majority of the logs look like: \[19/10/2020 00:00:01\] servername - Processor… --- ## [Filebeat-\* status of 413 "cannot read property 'get' of undefined"](https://discuss.elastic.co/t/filebeat-status-of-413-cannot-read-property-get-of-undefined/254939)
**Author:** [@datawrangler](https://discuss.elastic.co/u/datawrangler)\ **Replies:** 2\ **Last updated:** [November 16, 2020, 3:04pm UTC](https://discuss.elastic.co/t/filebeat-status-of-413-cannot-read-property-get-of-undefined/254939 "2020-11-16T15:04:29Z")
Hello All, I have a very strange issue where I can't even go to: http://:5601/app/management/kibana/indexPatterns/patterns/filebeat-\* ... the screen is blank and when I press F12 I get the error messages in the subjec… --- ## [Logstash Validation Failed: 1: no requests](https://discuss.elastic.co/t/logstash-validation-failed-1-no-requests/255379)
**Author:** [@Tosh](https://discuss.elastic.co/u/Tosh)\ **Replies:** 3\ **Last updated:** [November 16, 2020, 3:04pm UTC](https://discuss.elastic.co/t/logstash-validation-failed-1-no-requests/255379 "2020-11-16T15:04:11Z")
Hi , Logstash gives below error intermittently and then stops processing data after a while . Logstash version : 7.0.1 Elastic version : 7.0.1 Java : JDK8 Could it be due to malformed requests ? We do see some malfo… --- ## [Proper configuration of "server.host", "elasticsearch.host", and "network.host" settings on multinode cluster in production](https://discuss.elastic.co/t/proper-configuration-of-server-host-elasticsearch-host-and-network-host-settings-on-multinode-cluster-in-production/255378)
**Author:** [@Dennis1](https://discuss.elastic.co/u/Dennis1)\ **Replies:** 2\ **Last updated:** [November 16, 2020, 2:56pm UTC](https://discuss.elastic.co/t/proper-configuration-of-server-host-elasticsearch-host-and-network-host-settings-on-multinode-cluster-in-production/255378 "2020-11-16T14:56:55Z")
Hello, I'm building a multi-node elastic stack cluster with the following nodes: 3 master-eligible nodes (with all default roles) 1 coordinating-only node with Kibana additional data/ingest-dedicated nodes as needed A… --- ## [Logstash monitoring not showing one pipeline](https://discuss.elastic.co/t/logstash-monitoring-not-showing-one-pipeline/255559)
**Author:** [@mtudisco](https://discuss.elastic.co/u/mtudisco)\ **Replies:** 0\ **Last updated:** [November 16, 2020, 2:56pm UTC](https://discuss.elastic.co/t/logstash-monitoring-not-showing-one-pipeline/255559 "2020-11-16T14:56:12Z")
Hi, I have two machines with logstash Machine 1: only logstash 7.7 with 4 pipelines, one of them called "main" Machine 2: logstash 7.3, kibana 7.3 and elasticsearch 7.3. Logstash only one pipeline called "main" On bo… --- ## [Reindex / Consolidate Indizes](https://discuss.elastic.co/t/reindex-consolidate-indizes/255544)
**Author:** [@ksremo](https://discuss.elastic.co/u/ksremo)\ **Replies:** 4\ **Last updated:** [November 16, 2020, 2:53pm UTC](https://discuss.elastic.co/t/reindex-consolidate-indizes/255544 "2020-11-16T14:53:12Z")
How to migrate from multiple timebased indizes \-\ to a single \ index without losing data? --- ## ["Migrating .kibana\_3 saved objects to .kibana\_4" - 7.9.3 upgrade to 7.10](https://discuss.elastic.co/t/migrating-kibana-3-saved-objects-to-kibana-4-7-9-3-upgrade-to-7-10/255259)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 3\ **Last updated:** [November 16, 2020, 2:51pm UTC](https://discuss.elastic.co/t/migrating-kibana-3-saved-objects-to-kibana-4-7-9-3-upgrade-to-7-10/255259 "2020-11-16T14:51:52Z")
Deleting the .kibana\_4 and restarting the kibana instance leaves me in a permanent death loop. This will run for 3+ hours and do nothing. Nothing happens checking the journlctl logs this is what always shows up "Migratin… --- ## [CPU and Load Average high after enabling filebeat Apache module](https://discuss.elastic.co/t/cpu-and-load-average-high-after-enabling-filebeat-apache-module/254651)
**Author:** [@ajesh](https://discuss.elastic.co/u/ajesh)\ **Replies:** 1\ **Last updated:** [November 16, 2020, 2:45pm UTC](https://discuss.elastic.co/t/cpu-and-load-average-high-after-enabling-filebeat-apache-module/254651 "2020-11-16T14:45:54Z")
Hi There, Our elasticsearch (Ver 7.9) consist of 4 Nodes (2 Hot and 2 Warm ) . We are using auditbeat ,winlogbeat and filebeat for sending data to the nodes. We recently started integrating apache access and error logs … --- ## [Configure Kibana to use proxy](https://discuss.elastic.co/t/configure-kibana-to-use-proxy/253419)
**Author:** [@Yustas](https://discuss.elastic.co/u/Yustas)\ **Replies:** 4\ **Last updated:** [November 16, 2020, 2:45pm UTC](https://discuss.elastic.co/t/configure-kibana-to-use-proxy/253419 "2020-11-16T14:45:41Z")
Hello I have fresh cluster installation from docker images. Docker images version's - 7.9.3 Server work in isolated network. When i try look available plugins from kibana, application try connect directly to https://… --- ## [Transasctions per second, how to present data to users using formats they are familiar with](https://discuss.elastic.co/t/transasctions-per-second-how-to-present-data-to-users-using-formats-they-are-familiar-with/255252)
**Author:** [@asenecal2keys](https://discuss.elastic.co/u/asenecal2keys)\ **Replies:** 2\ **Last updated:** [November 16, 2020, 2:17pm UTC](https://discuss.elastic.co/t/transasctions-per-second-how-to-present-data-to-users-using-formats-they-are-familiar-with/255252 "2020-11-16T14:17:12Z")
Throughout our design documents we refer to transaction per seconds but when it comes time to view dashboards and visualizations I can't seem to find an easy way to display that information. With the interval selection t… --- ## [Where is the docker image of the 7.10?](https://discuss.elastic.co/t/where-is-the-docker-image-of-the-7-10/255477)
**Author:** [@flavienbwk](https://discuss.elastic.co/u/flavienbwk)\ **Replies:** 1\ **Last updated:** [November 16, 2020, 9:23am UTC](https://discuss.elastic.co/t/where-is-the-docker-image-of-the-7-10/255477 "2020-11-16T09:23:44Z")
Hi, Does anybody know why the docker image of the 7.10 has not been released yet on the Docker hub ? Is it planned ? Thank you, --- ## [Fleet integration Suggestions](https://discuss.elastic.co/t/fleet-integration-suggestions/255270)
**Author:** [@pixelsquared](https://discuss.elastic.co/u/pixelsquared)\ **Replies:** 1\ **Last updated:** [November 16, 2020, 12:56pm UTC](https://discuss.elastic.co/t/fleet-integration-suggestions/255270 "2020-11-16T12:56:42Z")
Hi, I have some Ideas for fleet integrations: Winlogbeat Heartbeat OSquery Docker AuditBeat OPNsense Firewall Logs Thanks --- ## [Filebeat missing container k8 metadata](https://discuss.elastic.co/t/filebeat-missing-container-k8-metadata/255530)
**Author:** [@mo\_ct](https://discuss.elastic.co/u/mo_ct)\ **Replies:** 0\ **Last updated:** [November 16, 2020, 12:52pm UTC](https://discuss.elastic.co/t/filebeat-missing-container-k8-metadata/255530 "2020-11-16T12:52:42Z")
When running batch of short-lived containers (which are same docker images), on some (random) occasions k8 metadata tags are missing from some of them Also there are no errors on the Filebeat service itself when filebea… --- ## [Heartbeat url monitor](https://discuss.elastic.co/t/heartbeat-url-monitor/255524)
**Author:** [@psganeshk](https://discuss.elastic.co/u/psganeshk)\ **Replies:** 1\ **Last updated:** [November 16, 2020, 12:39pm UTC](https://discuss.elastic.co/t/heartbeat-url-monitor/255524 "2020-11-16T12:39:33Z")
Error 401 Unauthorized Response Body Body size is 381B. {"error":{"root\_cause":\[{"type":"security\_exception","reason":"missing authentication credentials for REST request \[/\]","header":{"WWW-Authenticate":"Basic real… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1694) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1696)