# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1706 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1707 --- ## [Bug Metricbeat -\> Logstash](https://discuss.elastic.co/t/bug-metricbeat-logstash/254916)
**Author:** [@Vlad\_Piratov](https://discuss.elastic.co/u/Vlad_Piratov)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 1:26pm UTC](https://discuss.elastic.co/t/bug-metricbeat-logstash/254916 "2020-11-10T13:26:25Z")
Version stack = 7.6.2 Errors \[2020-11-10T16:26:23,295\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main\] Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>nil, :\_index=\>"metricbeat-7.6.2-202… --- ## [Lens fields limited to 257 char](https://discuss.elastic.co/t/lens-fields-limited-to-257-char/254904)
**Author:** [@QwerFact](https://discuss.elastic.co/u/QwerFact)\ **Replies:** 2\ **Last updated:** [November 10, 2020, 1:01pm UTC](https://discuss.elastic.co/t/lens-fields-limited-to-257-char/254904 "2020-11-10T13:01:55Z")
Hello, I'm experiencing limitations with Lens visualization. I created a table with long string fields. After 258 char the field disappears: With 257 char my field is displayed correctly: Do you know if there is … --- ## [Get Logs From SAP Cloud Plateform Cockpit](https://discuss.elastic.co/t/get-logs-from-sap-cloud-plateform-cockpit/254910)
**Author:** [@med1](https://discuss.elastic.co/u/med1)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 12:54pm UTC](https://discuss.elastic.co/t/get-logs-from-sap-cloud-plateform-cockpit/254910 "2020-11-10T12:54:37Z")
Hello Colleagues , I would like to extract logs from SAP cloud plateform cockpit using open source logging platform Elasticsearch, Logstash, Kibana . Did someone has any idea regarding this topic . Thanks . Mohamed … --- ## [Elasticsearch 7.9.3 on Mac dies when inserting documents fast](https://discuss.elastic.co/t/elasticsearch-7-9-3-on-mac-dies-when-inserting-documents-fast/254809)
**Author:** [@Toontje](https://discuss.elastic.co/u/Toontje)\ **Replies:** 7\ **Last updated:** [November 10, 2020, 12:41pm UTC](https://discuss.elastic.co/t/elasticsearch-7-9-3-on-mac-dies-when-inserting-documents-fast/254809 "2020-11-10T12:41:53Z")
I use node-red to transform an existing JSON document and insert individual small JSON document using the POST command. Apparently i do this too fast because after a few seconds port 9200 stops responding. What is best … --- ## [Elasticsearch is not started in server](https://discuss.elastic.co/t/elasticsearch-is-not-started-in-server/254888)
**Author:** [@nagaraju.sbd](https://discuss.elastic.co/u/nagaraju.sbd)\ **Replies:** 8\ **Last updated:** [November 10, 2020, 11:32am UTC](https://discuss.elastic.co/t/elasticsearch-is-not-started-in-server/254888 "2020-11-10T11:32:34Z")
elasticsearch.service: main process exited, code=exited, status=78/n/a Failed to start Elasticsearch. --- ## [Delete old documents](https://discuss.elastic.co/t/delete-old-documents/254591)
**Author:** [@smruthip](https://discuss.elastic.co/u/smruthip)\ **Replies:** 3\ **Last updated:** [November 10, 2020, 11:23am UTC](https://discuss.elastic.co/t/delete-old-documents/254591 "2020-11-10T11:23:46Z")
Is there a way to delete old documents based on a filed which has timestamp? What I want to do is just keep the latest document per id example id. timestamp 1 1pm 1 2pm 1 3pm 1 4pm 2. 3pm 2. 4pm 2. 6pm … --- ## [Kibana Timelion Offset](https://discuss.elastic.co/t/kibana-timelion-offset/254891)
**Author:** [@PRODIPTO](https://discuss.elastic.co/u/PRODIPTO)\ **Replies:** 1\ **Last updated:** [November 10, 2020, 11:22am UTC](https://discuss.elastic.co/t/kibana-timelion-offset/254891 "2020-11-10T11:22:20Z")
Hi .. I am trying to build a Kibana Timelion Vizualization to compare data between two different dates .. However the current Timelion feature only allows me to put specific offset values which essentially means that my… --- ## [Missing Elasticsearch menu in Kibana](https://discuss.elastic.co/t/missing-elasticsearch-menu-in-kibana/254799)
**Author:** [@Lorenzo\_Allori](https://discuss.elastic.co/u/Lorenzo_Allori)\ **Replies:** 5\ **Last updated:** [November 10, 2020, 10:29am UTC](https://discuss.elastic.co/t/missing-elasticsearch-menu-in-kibana/254799 "2020-11-10T10:29:58Z")
Hello I created a new installation from docker using: elasticsearch:7.8.0 kibana:7.8.0 these two docker images. But when i use kibana I cannot see the Elasticsearch menu (access to index patterns etc.=). Is it possi… --- ## [Create custom \_id for events uploaded via file from data visualizer option in ML (Kibana)](https://discuss.elastic.co/t/create-custom-id-for-events-uploaded-via-file-from-data-visualizer-option-in-ml-kibana/254791)
**Author:** [@Aditya\_Srivastava1](https://discuss.elastic.co/u/Aditya_Srivastava1)\ **Replies:** 1\ **Last updated:** [November 10, 2020, 9:58am UTC](https://discuss.elastic.co/t/create-custom-id-for-events-uploaded-via-file-from-data-visualizer-option-in-ml-kibana/254791 "2020-11-10T09:58:27Z")
Hi Team, I have a simple csv file with 4 columns that I want to upload and push in ES. For that I am using the data visualizer option in ML (on Kibana). I click on import file, select the file, enter index name and done… --- ## [Express logs are parsed as nginx.access logs](https://discuss.elastic.co/t/express-logs-are-parsed-as-nginx-access-logs/254886)
**Author:** [@Djiit](https://discuss.elastic.co/u/Djiit)\ **Replies:** 2\ **Last updated:** [November 10, 2020, 9:37am UTC](https://discuss.elastic.co/t/express-logs-are-parsed-as-nginx-access-logs/254886 "2020-11-10T09:37:58Z")
Hi there, I'm tuning my logs display/parsing in Kibana and I'm not sure how to instruct Kibana to display correctly logs from an Express app (NodeJS). The app uses Pino logger + @elastic/pino-ecs-format. Every time I s… --- ## [Filebeat high disk usage when reboot server. How fix it?](https://discuss.elastic.co/t/filebeat-high-disk-usage-when-reboot-server-how-fix-it/254884)
**Author:** [@Andrew\_Foxis](https://discuss.elastic.co/u/Andrew_Foxis)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 9:25am UTC](https://discuss.elastic.co/t/filebeat-high-disk-usage-when-reboot-server-how-fix-it/254884 "2020-11-10T09:25:13Z")
Hi all! Filebeat on server send csv logs of exchange (windows) server to logstash. When we reboot server filebeat make high disk usage. Other services can't load for a long time. How can i fix it? Thank you --- ## [\_async\_search thowing access denieds in elasticsearch audit logs](https://discuss.elastic.co/t/async-search-thowing-access-denieds-in-elasticsearch-audit-logs/254811)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [November 10, 2020, 8:38am UTC](https://discuss.elastic.co/t/async-search-thowing-access-denieds-in-elasticsearch-audit-logs/254811 "2020-11-10T08:38:36Z")
Hello, So I made a SIEM rule which triggers on access\_denied in event.action on Elastic audit logs. And so I discovered the user \_async\_search triggers this rule. I guess I can safely exclude this, but I'm curious… --- ## [Search analyser + preserve special characters](https://discuss.elastic.co/t/search-analyser-preserve-special-characters/254883)
**Author:** [@Liam\_Aird](https://discuss.elastic.co/u/Liam_Aird)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 9:19am UTC](https://discuss.elastic.co/t/search-analyser-preserve-special-characters/254883 "2020-11-10T09:19:07Z")
Hi, I am having somewhat of an issue here that I cannot seem to solve after a few different attempts and days worth of googling. I am using the synonyms filter - and read that it would be better to do so search time in… --- ## [Filebeat is not send enough log to elasticsearch](https://discuss.elastic.co/t/filebeat-is-not-send-enough-log-to-elasticsearch/254196)
**Author:** [@AkatsukiPain](https://discuss.elastic.co/u/AkatsukiPain)\ **Replies:** 8\ **Last updated:** [November 10, 2020, 9:17am UTC](https://discuss.elastic.co/t/filebeat-is-not-send-enough-log-to-elasticsearch/254196 "2020-11-10T09:17:08Z")
My filebeat sending not enough logs to elasticsearch. Graph suddenly went down This is filebeat.yml filebeat.inputs: #============================= Filebeat modules =============================== filebeat.conf… --- ## [Logstash conf for parsing ignored](https://discuss.elastic.co/t/logstash-conf-for-parsing-ignored/254879)
**Author:** [@Andex](https://discuss.elastic.co/u/Andex)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 9:08am UTC](https://discuss.elastic.co/t/logstash-conf-for-parsing-ignored/254879 "2020-11-10T09:08:52Z")
Hi , i have a problem with logstash. I receive filebeat jboss log but these don't go trough the conf (with grok filter) but they go on elasticsearch without parsing. I don't know why my conf is ignored. I try to chang… --- ## [Ingest nodes don't load balance the pipeline load](https://discuss.elastic.co/t/ingest-nodes-dont-load-balance-the-pipeline-load/254876)
**Author:** [@keshara](https://discuss.elastic.co/u/keshara)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 9:01am UTC](https://discuss.elastic.co/t/ingest-nodes-dont-load-balance-the-pipeline-load/254876 "2020-11-10T09:01:46Z")
Hi, I have a ECK cluster where maintaining dedicated two ingest nodes, specially to isolate and get my pipelines working across them. While it is running I noticed only one node being utilized 100% cpu where the other o… --- ## [Delete by query](https://discuss.elastic.co/t/delete-by-query/254847)
**Author:** [@vikramaddagulla](https://discuss.elastic.co/u/vikramaddagulla)\ **Replies:** 1\ **Last updated:** [November 10, 2020, 8:40am UTC](https://discuss.elastic.co/t/delete-by-query/254847 "2020-11-10T08:40:34Z")
Hello, I would like to delete some data in the index older than a certain time... I am trying to use the delete by query index...However, before trying to delete the data, I am trying to view the data older than the ti… --- ## [Custom log file - Kibana](https://discuss.elastic.co/t/custom-log-file-kibana/254866)
**Author:** [@mrdebian](https://discuss.elastic.co/u/mrdebian)\ **Replies:** 1\ **Last updated:** [November 10, 2020, 8:37am UTC](https://discuss.elastic.co/t/custom-log-file-kibana/254866 "2020-11-10T08:37:50Z")
Hi all, I'm new to ELK setup and trying to figure out what is the problem with one particular log file. When I run filebeat in debug mode it seems that it parses the file fine (see output below) but when I search on Ki… --- ## [Why logstash generator input generated elasticsearch index size remains constant?](https://discuss.elastic.co/t/why-logstash-generator-input-generated-elasticsearch-index-size-remains-constant/254870)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 8:35am UTC](https://discuss.elastic.co/t/why-logstash-generator-input-generated-elasticsearch-index-size-remains-constant/254870 "2020-11-10T08:35:47Z")
Hi, I have the latest elastic stack and I am using Logstash's generator input plugin to generate dummy data and I am pushing it to an elasticsearch index testindex. I have ILM policy and template configured for testinde… --- ## [Filebeat use default port instead of my port](https://discuss.elastic.co/t/filebeat-use-default-port-instead-of-my-port/254756)
**Author:** [@rony](https://discuss.elastic.co/u/rony)\ **Replies:** 2\ **Last updated:** [November 10, 2020, 8:25am UTC](https://discuss.elastic.co/t/filebeat-use-default-port-instead-of-my-port/254756 "2020-11-10T08:25:11Z")
my filebeat.yml looks like this: filebeat.inputs: - type: log enabled: true paths: - /var/logs/mylog.log #============================= Filebeat modules =============================== filebeat.config.modules… --- ## [Limit the age of documents in a rollup job](https://discuss.elastic.co/t/limit-the-age-of-documents-in-a-rollup-job/254865)
**Author:** [@Culme](https://discuss.elastic.co/u/Culme)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 8:18am UTC](https://discuss.elastic.co/t/limit-the-age-of-documents-in-a-rollup-job/254865 "2020-11-10T08:18:15Z")
Hi Forum. Is it possible to limit the age of documents being included in a rollup? I have been experimenting a bit with rollups, and there's one thing I'm missing. When you create a new rollup job and schedule it to r… --- ## [Filebeat Setup error: error loading index pattern: returned 408 to import file](https://discuss.elastic.co/t/filebeat-setup-error-error-loading-index-pattern-returned-408-to-import-file/254855)
**Author:** [@jaydeepk](https://discuss.elastic.co/u/jaydeepk)\ **Replies:** 2\ **Last updated:** [November 10, 2020, 8:03am UTC](https://discuss.elastic.co/t/filebeat-setup-error-error-loading-index-pattern-returned-408-to-import-file/254855 "2020-11-10T08:03:20Z")
Hi I'm currently using a 14-day free trial of elastic cloud. I was trying to get my local apache logs shipped to the hosted elastic cluster. So I decided to setup a Filebeat on my local machine ( Mac OS Catalina) acc… --- ## [Error retrieving collection totals from Mongo module metric beat](https://discuss.elastic.co/t/error-retrieving-collection-totals-from-mongo-module-metric-beat/254861)
**Author:** [@tarund](https://discuss.elastic.co/u/tarund)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 7:54am UTC](https://discuss.elastic.co/t/error-retrieving-collection-totals-from-mongo-module-metric-beat/254861 "2020-11-10T07:54:34Z")
Hi, I have configured metric beat on mongodb sending data to Elasticsearch. I am getting data except for collstats. I am 2000+ databases in mongo. So, probably the number of metrics of collstats is large. I am getting … --- ## [Logstash Elapsed filter](https://discuss.elastic.co/t/logstash-elapsed-filter/254858)
**Author:** [@melorium](https://discuss.elastic.co/u/melorium)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 7:26am UTC](https://discuss.elastic.co/t/logstash-elapsed-filter/254858 "2020-11-10T07:26:42Z")
Hi. I have problem with elapsed filter il tried everything but it random miss events. It matches around 75% of all events only and different everytime I sent the log in. Starting Logstash with one worker also. Can I … --- ## [How to create Index Template & ILM Policy for Logstash output in Filebeat](https://discuss.elastic.co/t/how-to-create-index-template-ilm-policy-for-logstash-output-in-filebeat/254857)
**Author:** [@ksaha](https://discuss.elastic.co/u/ksaha)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 7:25am UTC](https://discuss.elastic.co/t/how-to-create-index-template-ilm-policy-for-logstash-output-in-filebeat/254857 "2020-11-10T07:25:45Z")
Hi, If I set the filebeat output to Logstash and give customize name to the index in the output section of Logstash pipeline code, in that case how to create the index template and ILM policy (For Elasticsearch output i… --- ## [Can i use notification for logstash's error or warn logs?](https://discuss.elastic.co/t/can-i-use-notification-for-logstashs-error-or-warn-logs/254742)
**Author:** [@talbehat](https://discuss.elastic.co/u/talbehat)\ **Replies:** 5\ **Last updated:** [November 10, 2020, 7:14am UTC](https://discuss.elastic.co/t/can-i-use-notification-for-logstashs-error-or-warn-logs/254742 "2020-11-10T07:14:40Z")
for example : \[2020-11-09T16:30:46,039\]\[WARN \]\[org.logstash.instrument.metrics.gauge.LazyDelegatingGauge\]\[main\] A gauge metric of an unknown type (org.jruby.specialized.RubyArrayOneObject) has been create for key: clust… --- ## [Elasticsearch moving node out of cluster](https://discuss.elastic.co/t/elasticsearch-moving-node-out-of-cluster/254653)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 18\ **Last updated:** [November 10, 2020, 7:13am UTC](https://discuss.elastic.co/t/elasticsearch-moving-node-out-of-cluster/254653 "2020-11-10T07:13:08Z")
Hi I have a cluster by name "as\_elasticsearch" and I have deleted a node from that cluster as below curl -XPUT P.P.P.P:9200/\_cluster/settings -H 'Content-Type: application/json' -d '{ "transient" :{ "cluster.routing.… --- ## [Primary shard size higher than replicas](https://discuss.elastic.co/t/primary-shard-size-higher-than-replicas/254852)
**Author:** [@Susheem\_Koul](https://discuss.elastic.co/u/Susheem_Koul)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 6:48am UTC](https://discuss.elastic.co/t/primary-shard-size-higher-than-replicas/254852 "2020-11-10T06:48:14Z")
Hi, We've been observing some strange behaviour on our ES Cluster for the last few weeks with the primary for a shard having a much higher size than the replica. Here's the output for shard details API. Notice shard 2 … --- ## [Logstash Integration with Azure](https://discuss.elastic.co/t/logstash-integration-with-azure/254851)
**Author:** [@manish9](https://discuss.elastic.co/u/manish9)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 6:21am UTC](https://discuss.elastic.co/t/logstash-integration-with-azure/254851 "2020-11-10T06:21:59Z")
Can you please help me in finding a way to integrate the logs from different services in Azure to Logstash? --- ## [Logstash-input-file read all txt data](https://discuss.elastic.co/t/logstash-input-file-read-all-txt-data/254845)
**Author:** [@xiaoping1993](https://discuss.elastic.co/u/xiaoping1993)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 3:59am UTC](https://discuss.elastic.co/t/logstash-input-file-read-all-txt-data/254845 "2020-11-10T03:59:10Z")
I want to read all txt data,so I set configuration: codec =\> multiline { pattern =\> "EOF" negate =\> true what =\> "previous" auto\_flush\_interval =\> 1 charset=\>"GBK" } but I can get all txt data except the Last lin… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1705) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1707)