# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1715 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1716 --- ## [Stackoverflow on Elasticsearch file indexation with ingest-attachment](https://discuss.elastic.co/t/stackoverflow-on-elasticsearch-file-indexation-with-ingest-attachment/253455)
**Author:** [@Mathulbrich](https://discuss.elastic.co/u/Mathulbrich)\ **Replies:** 7\ **Last updated:** [November 4, 2020, 8:11pm UTC](https://discuss.elastic.co/t/stackoverflow-on-elasticsearch-file-indexation-with-ingest-attachment/253455 "2020-11-04T20:11:59Z")
Hi, Our company recently had some connectivity issues with Elasticsearch. Suddenly, on some days of the week the cluster had RED status and in the logs the only information found was that the node had been disconnected. … --- ## [Get documents for Kibana visualizations/dashboard](https://discuss.elastic.co/t/get-documents-for-kibana-visualizations-dashboard/254319)
**Author:** [@Agenobarb](https://discuss.elastic.co/u/Agenobarb)\ **Replies:** 1\ **Last updated:** [November 4, 2020, 7:47pm UTC](https://discuss.elastic.co/t/get-documents-for-kibana-visualizations-dashboard/254319 "2020-11-04T19:47:59Z")
Hi! I created a dashboard containg a couple of visualizations (Line, Timelion) where I can check how my web app perofrms. However, when I see the problem in the dashboard, I'd like to locate it further, i.e. I need to ge… --- ## [Searches from Kinbana Consle return all results and ignoring filtering](https://discuss.elastic.co/t/searches-from-kinbana-consle-return-all-results-and-ignoring-filtering/253858)
**Author:** [@Ofir\_Edi](https://discuss.elastic.co/u/Ofir_Edi)\ **Replies:** 3\ **Last updated:** [November 4, 2020, 6:09pm UTC](https://discuss.elastic.co/t/searches-from-kinbana-consle-return-all-results-and-ignoring-filtering/253858 "2020-11-04T18:09:49Z")
Hi, i have been using Elasticsearch for a while and recently started to use Kibana. I have a strange issue when using the Kibana console. it seems like no matter what i do i always get all the results from an index reg… --- ## [Upgrade Assistant showing critical message](https://discuss.elastic.co/t/upgrade-assistant-showing-critical-message/254301)
**Author:** [@rudraram](https://discuss.elastic.co/u/rudraram)\ **Replies:** 1\ **Last updated:** [November 4, 2020, 5:41pm UTC](https://discuss.elastic.co/t/upgrade-assistant-showing-critical-message/254301 "2020-11-04T17:41:20Z")
Hi Team, Wondering how to resolve this critical warning in Upgrade Assitant currently we are on elasticsearch 6.8 version and planning to upgrade to Elastic 7.9 I see following message tagged as critical " Bulk threa… --- ## [ECS field for application data and payloads](https://discuss.elastic.co/t/ecs-field-for-application-data-and-payloads/254131)
**Author:** [@strokirk](https://discuss.elastic.co/u/strokirk)\ **Replies:** 3\ **Last updated:** [November 4, 2020, 5:04pm UTC](https://discuss.elastic.co/t/ecs-field-for-application-data-and-payloads/254131 "2020-11-04T17:04:47Z")
Hi, I'd like to hear if there are any suggestions in the ECS framework on how to provide app-specific fields. Do you use your own namespace for that, or just put it in the global namespace? Any recommendations for field… --- ## [How do I add a lifecycle policy to an index via the API?](https://discuss.elastic.co/t/how-do-i-add-a-lifecycle-policy-to-an-index-via-the-api/254295)
**Author:** [@jmcclelland](https://discuss.elastic.co/u/jmcclelland)\ **Replies:** 4\ **Last updated:** [November 4, 2020, 4:56pm UTC](https://discuss.elastic.co/t/how-do-i-add-a-lifecycle-policy-to-an-index-via-the-api/254295 "2020-11-04T16:56:12Z")
In Kibana, if I click on an index, and then click the Manage button, I have the option to "Add lifecycle policy" to that existing index - I'm asked for the policy to add and the rollover index. How do I do this via the … --- ## [Syslog Filter Plugin](https://discuss.elastic.co/t/syslog-filter-plugin/254187)
**Author:** [@Clay\_Curtis](https://discuss.elastic.co/u/Clay_Curtis)\ **Replies:** 1\ **Last updated:** [November 4, 2020, 4:53pm UTC](https://discuss.elastic.co/t/syslog-filter-plugin/254187 "2020-11-04T16:53:27Z")
I am building a logging pipeline and there is a syslog collector that is depositing raw syslog messages into a Kafka topic. I would usually accept syslog off the wire by using the Logstash syslog input plugin which handl… --- ## [How to send application log to a Solace queue](https://discuss.elastic.co/t/how-to-send-application-log-to-a-solace-queue/254291)
**Author:** [@suhelrizvi](https://discuss.elastic.co/u/suhelrizvi)\ **Replies:** 4\ **Last updated:** [November 4, 2020, 4:18pm UTC](https://discuss.elastic.co/t/how-to-send-application-log-to-a-solace-queue/254291 "2020-11-04T16:18:45Z")
We need to send log file contents on a linux server to a remote queue in Solace. Can we use filebeat to do this and how? --- ## [How to drop events only from specific module](https://discuss.elastic.co/t/how-to-drop-events-only-from-specific-module/254175)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 8\ **Last updated:** [November 4, 2020, 4:04pm UTC](https://discuss.elastic.co/t/how-to-drop-events-only-from-specific-module/254175 "2020-11-04T16:04:41Z")
Hello, I want to drop all events that filebeat was unable to parse. I tried a few things my last attempt looks like this. processors: - drop\_event: when: and: - equals.event.module: cisco… --- ## [Metricbeat memory usage](https://discuss.elastic.co/t/metricbeat-memory-usage/254217)
**Author:** [@tarophin403](https://discuss.elastic.co/u/tarophin403)\ **Replies:** 1\ **Last updated:** [November 4, 2020, 3:43pm UTC](https://discuss.elastic.co/t/metricbeat-memory-usage/254217 "2020-11-04T15:43:04Z")
Is it normal for a metricbeat process thats runnning as a docker container to record "docker.memory.usage.pct" (one of the data fields collected by metricbeat) with values higher than 100%(1.00067, 1.00044...)? metricbe… --- ## [Unable to harvest log files with glob](https://discuss.elastic.co/t/unable-to-harvest-log-files-with-glob/253849)
**Author:** [@Arvind\_Ks](https://discuss.elastic.co/u/Arvind_Ks)\ **Replies:** 2\ **Last updated:** [November 4, 2020, 3:28pm UTC](https://discuss.elastic.co/t/unable-to-harvest-log-files-with-glob/253849 "2020-11-04T15:28:10Z")
Hi Team, I am trying to parse jenkins build logs using filebeat. There are several subdirectories that it needs to traverse to. I can also see in the filebeat log what all locations filebeat is checking. However when i … --- ## [File Input from directory with 100K files](https://discuss.elastic.co/t/file-input-from-directory-with-100k-files/254195)
**Author:** [@surphix](https://discuss.elastic.co/u/surphix)\ **Replies:** 4\ **Last updated:** [November 4, 2020, 2:40pm UTC](https://discuss.elastic.co/t/file-input-from-directory-with-100k-files/254195 "2020-11-04T14:40:19Z")
Hey first time posting here and looking for some understandings. I have a logstash config that is trying to read a directory containing over 100,000 files. I've ran trace logs and even with sincedb\_path set to /dev/null… --- ## [Combining proximity with min number of words](https://discuss.elastic.co/t/combining-proximity-with-min-number-of-words/254283)
**Author:** [@flm](https://discuss.elastic.co/u/flm)\ **Replies:** 0\ **Last updated:** [November 4, 2020, 2:18pm UTC](https://discuss.elastic.co/t/combining-proximity-with-min-number-of-words/254283 "2020-11-04T14:18:33Z")
Is there a way to create a query to match a minimum number of words from a sentence, with the additional condition that the matching words must be at a maximum total distance from each other? Here's an example: Searchi… --- ## [Kubernetes autodiscovery for ephemeral containers](https://discuss.elastic.co/t/kubernetes-autodiscovery-for-ephemeral-containers/253840)
**Author:** [@marqc](https://discuss.elastic.co/u/marqc)\ **Replies:** 1\ **Last updated:** [November 4, 2020, 1:57pm UTC](https://discuss.elastic.co/t/kubernetes-autodiscovery-for-ephemeral-containers/253840 "2020-11-04T13:57:53Z")
Quick question for maintainers. How do you think filebeat should consider ephemeral containers. Should they be scrapped by default? Optionally when some additional autodiscovery flag is set? Or should they never be scrap… --- ## [ELK integration with Service now](https://discuss.elastic.co/t/elk-integration-with-service-now/251770)
**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Replies:** 2\ **Last updated:** [November 4, 2020, 1:40pm UTC](https://discuss.elastic.co/t/elk-integration-with-service-now/251770 "2020-11-04T13:40:38Z")
HI Team, I hope everyone safe on this pandemic situation. My question is how to integrate ELK with ServiceNow. Currently, we are using version 6.4 and task is if any error code in logs get indexed in ES or logs are fa… --- ## [How to Handle Index Template Changes with Data Streams](https://discuss.elastic.co/t/how-to-handle-index-template-changes-with-data-streams/254273)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 0\ **Last updated:** [November 4, 2020, 1:35pm UTC](https://discuss.elastic.co/t/how-to-handle-index-template-changes-with-data-streams/254273 "2020-11-04T13:35:49Z")
Hi All, I was wondering if there is any guidance on handle index template changes with data streams. Currently with regular indexes the guidance seems to be add a version number to part of the index name (ie: 7.9.3 or x… --- ## [Elasticsearch Hight used CPU](https://discuss.elastic.co/t/elasticsearch-hight-used-cpu/254181)
**Author:** [@ASRLO](https://discuss.elastic.co/u/ASRLO)\ **Replies:** 2\ **Last updated:** [November 4, 2020, 12:50pm UTC](https://discuss.elastic.co/t/elasticsearch-hight-used-cpu/254181 "2020-11-04T12:50:10Z")
Hello everybody, I have a question about elasticsearch and logstash. At the resource levels I find that elasticsearch and logtash use too much CPU and I wonder if like filebeat and its max\_procs: it is possible to do t… --- ## [If there are 2 replicas do they need to be in 2 seperate nodes](https://discuss.elastic.co/t/if-there-are-2-replicas-do-they-need-to-be-in-2-seperate-nodes/254268)
**Author:** [@tkumark](https://discuss.elastic.co/u/tkumark)\ **Replies:** 1\ **Last updated:** [November 4, 2020, 12:41pm UTC](https://discuss.elastic.co/t/if-there-are-2-replicas-do-they-need-to-be-in-2-seperate-nodes/254268 "2020-11-04T12:41:17Z")
The health is yellow. I have a 2 node cluster for Elastic search and the health is in yellow. It looks like there are 10 primary shards and 2 replicas (i.e 2 reaplicas per primary shard so that mean 20 replica shards). I… --- ## [Shards unassigned for .kibana\_task\_manager index in cluster](https://discuss.elastic.co/t/shards-unassigned-for-kibana-task-manager-index-in-cluster/254147)
**Author:** [@guest123](https://discuss.elastic.co/u/guest123)\ **Replies:** 3\ **Last updated:** [November 4, 2020, 12:26pm UTC](https://discuss.elastic.co/t/shards-unassigned-for-kibana-task-manager-index-in-cluster/254147 "2020-11-04T12:26:58Z")
Hi, running 3 nodes cluster in prod workload, having problem with .kibana\_task\_manager index in red state, ran cluster/allocation api came to know 2 of the shards unassigned here is the response. for workaround this ca… --- ## [Logstash - JDBC ERROR](https://discuss.elastic.co/t/logstash-jdbc-error/254160)
**Author:** [@peledev](https://discuss.elastic.co/u/peledev)\ **Replies:** 4\ **Last updated:** [November 4, 2020, 12:07pm UTC](https://discuss.elastic.co/t/logstash-jdbc-error/254160 "2020-11-04T12:07:18Z")
Hello , Im using logstash in a linux server I have installed the latest update for logstash on my server And also jdbc installed Ever since the update im unable to run jdbc output I get an error in the log : 'Prefo… --- ## [Decoding base64 logs when input is in JSON format?](https://discuss.elastic.co/t/decoding-base64-logs-when-input-is-in-json-format/254042)
**Author:** [@Mudabbir](https://discuss.elastic.co/u/Mudabbir)\ **Replies:** 3\ **Last updated:** [November 4, 2020, 11:52am UTC](https://discuss.elastic.co/t/decoding-base64-logs-when-input-is-in-json-format/254042 "2020-11-04T11:52:38Z")
Greetings ! I am unable to decode my base64 logs that are coming from nxlog server. Here is my logstash configuration. The error i am getting is shown below The log field is in base64 I have tried cipher filt… --- ## [Kibana 7.7.1 custom plugin privileges](https://discuss.elastic.co/t/kibana-7-7-1-custom-plugin-privileges/237272)
**Author:** [@Digl1](https://discuss.elastic.co/u/Digl1)\ **Replies:** 4\ **Last updated:** [November 4, 2020, 11:59am UTC](https://discuss.elastic.co/t/kibana-7-7-1-custom-plugin-privileges/237272 "2020-11-04T11:59:12Z")
Hello! After updating to 7.7.1 I get the following error message: FATAL Error: Feature xxxxxxxxx specifies app entries which are not granted to any privileges... btw.: xpack security is disabled. How can I add the r… --- ## [Query "-" on fieldname problem](https://discuss.elastic.co/t/query-on-fieldname-problem/254255)
**Author:** [@Eurosom](https://discuss.elastic.co/u/Eurosom)\ **Replies:** 1\ **Last updated:** [November 4, 2020, 11:46am UTC](https://discuss.elastic.co/t/query-on-fieldname-problem/254255 "2020-11-04T11:46:15Z")
Hi Support, We have problem querying file name with "-" for example sts-empId. It is complaining - character. Could you please help how to query this? GET /\_sql?format=txt { "query":" SELECT sts-empId FROM "sts-amsgu… --- ## [Logstash not generating any output: "Class path contains multiple SLF4J bindings." error](https://discuss.elastic.co/t/logstash-not-generating-any-output-class-path-contains-multiple-slf4j-bindings-error/254262)
**Author:** [@Silvia\_Koleva](https://discuss.elastic.co/u/Silvia_Koleva)\ **Replies:** 0\ **Last updated:** [November 4, 2020, 11:34am UTC](https://discuss.elastic.co/t/logstash-not-generating-any-output-class-path-contains-multiple-slf4j-bindings-error/254262 "2020-11-04T11:34:17Z")
Hello, I am trying to configure Logstash to collect data from filebeat, where itgets some SharePoint ULS logs and then push them to Elasticsearch with applying some filters. The issue I have is when I run the logstash s… --- ## [Creating a Logstash Module](https://discuss.elastic.co/t/creating-a-logstash-module/254261)
**Author:** [@Avarjana](https://discuss.elastic.co/u/Avarjana)\ **Replies:** 0\ **Last updated:** [November 4, 2020, 11:31am UTC](https://discuss.elastic.co/t/creating-a-logstash-module/254261 "2020-11-04T11:31:56Z")
I need to create a Logstash module like : these. I want to know, Is that possible and if so, where can I find a guide? If not possible, what are the workarounds to bundle my ELK project to be available as an integratio… --- ## [How to work with event "message" in Java filter plugin?](https://discuss.elastic.co/t/how-to-work-with-event-message-in-java-filter-plugin/254258)
**Author:** [@toni1](https://discuss.elastic.co/u/toni1)\ **Replies:** 0\ **Last updated:** [November 4, 2020, 11:17am UTC](https://discuss.elastic.co/t/how-to-work-with-event-message-in-java-filter-plugin/254258 "2020-11-04T11:17:18Z")
Hi, I am developing a Java Filter Plugin to merge different CSVs, and as I'm trying to process them, I need to extract the message field (which contains the whole CSV line). How am I supposed to do so using Java langua… --- ## [Custom sorting with an Elasticsearch query?](https://discuss.elastic.co/t/custom-sorting-with-an-elasticsearch-query/254229)
**Author:** [@kumar.kapil](https://discuss.elastic.co/u/kumar.kapil)\ **Replies:** 1\ **Last updated:** [November 4, 2020, 11:16am UTC](https://discuss.elastic.co/t/custom-sorting-with-an-elasticsearch-query/254229 "2020-11-04T11:16:20Z")
I have some documents indexed on Elasticsearch, looking like these samples: {'id': 1, 'user\_group\_id': 1, 'is\_popular': false, 'added\_at': '2020-10-05T10:27:59.214Z'} {'id': 2, 'user\_group\_id': 2, 'is\_popular': false, '… --- ## [Filebeat does not correctly merge multiline events](https://discuss.elastic.co/t/filebeat-does-not-correctly-merge-multiline-events/253907)
**Author:** [@Sebastian\_Kenter](https://discuss.elastic.co/u/Sebastian_Kenter)\ **Replies:** 3\ **Last updated:** [November 4, 2020, 11:09am UTC](https://discuss.elastic.co/t/filebeat-does-not-correctly-merge-multiline-events/253907 "2020-11-04T11:09:44Z")
I have the following problem: This is my logfile 11:30:00,909 9=DEB BswTcpTskComSrv::passTele() 11:30:00,909 12=EVT | TELEGRAMM SEND comsrv-\>TskEvm: |TskBrm|TskEvm|TeleDb| 11:30:00,909 12=EVT | BswTcpTskComSrv::send… --- ## [Replication to DR site, without CCR](https://discuss.elastic.co/t/replication-to-dr-site-without-ccr/253316)
**Author:** [@AndySw](https://discuss.elastic.co/u/AndySw)\ **Replies:** 3\ **Last updated:** [November 4, 2020, 11:07am UTC](https://discuss.elastic.co/t/replication-to-dr-site-without-ccr/253316 "2020-11-04T11:07:10Z")
Hi all. I was trying to find out which options exist if you want to synchronise a primary site with a DR site, both running seperate Elasticsearch clusters. I'm aware of CCR, but it is cost prohibitive. What is the art … --- ## [Find Dates with offset](https://discuss.elastic.co/t/find-dates-with-offset/254244)
**Author:** [@Aquilino\_Viveiros](https://discuss.elastic.co/u/Aquilino_Viveiros)\ **Replies:** 2\ **Last updated:** [November 4, 2020, 10:45am UTC](https://discuss.elastic.co/t/find-dates-with-offset/254244 "2020-11-04T10:45:42Z")
Hello, hopefully someone can help me on this. Consider the following mapping { "dateOfBirth": { "properties": { "value": { "type": "date", "format": "dateOptionalTime" } } } } A… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1714) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1716)