# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1726 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1727 --- ## [Metricsets being created two times at the start of the beat](https://discuss.elastic.co/t/metricsets-being-created-two-times-at-the-start-of-the-beat/253621)
**Author:** [@Thiago\_Ruiz](https://discuss.elastic.co/u/Thiago_Ruiz)\ **Replies:** 2\ **Last updated:** [October 29, 2020, 6:43pm UTC](https://discuss.elastic.co/t/metricsets-being-created-two-times-at-the-start-of-the-beat/253621 "2020-10-29T18:43:40Z")
Hello there! I'm creating some new modules and metricsets and saw something odd, maybe a bug, or at least a possibility of an improvement :slight\_smile: The possible problem: When we use the config "reload.enabled: fal… --- ## [Elastic Feature isn't exist at kibana 7.9.0](https://discuss.elastic.co/t/elastic-feature-isnt-exist-at-kibana-7-9-0/253398)
**Author:** [@psanggabuana](https://discuss.elastic.co/u/psanggabuana)\ **Replies:** 1\ **Last updated:** [October 29, 2020, 6:32pm UTC](https://discuss.elastic.co/t/elastic-feature-isnt-exist-at-kibana-7-9-0/253398 "2020-10-29T18:32:26Z")
Hi all, I have problem with my kibana. I dont know why elastic feature isnt exist in there, like as: This my log: initialized to green - Ready log \[12:44:17.934\] \[info\]\[status\]\[plugin:elasticsearch@7.9.0\] Status… --- ## [Storage quantity required for an Elastic SIEM solution](https://discuss.elastic.co/t/storage-quantity-required-for-an-elastic-siem-solution/253582)
**Author:** [@jelocabral](https://discuss.elastic.co/u/jelocabral)\ **Replies:** 4\ **Last updated:** [October 29, 2020, 6:22pm UTC](https://discuss.elastic.co/t/storage-quantity-required-for-an-elastic-siem-solution/253582 "2020-10-29T18:22:03Z")
Hi people, we have an ELK stack for a SIEM solution in our company. We need to ingest data from 10 devices aproximately, and we need to maintan the data for 3 months. We have one firewall which is a heavy log sender. C… --- ## [Snapshots do not list when restoring a backup](https://discuss.elastic.co/t/snapshots-do-not-list-when-restoring-a-backup/253737)
**Author:** [@alexporto](https://discuss.elastic.co/u/alexporto)\ **Replies:** 0\ **Last updated:** [October 29, 2020, 6:15pm UTC](https://discuss.elastic.co/t/snapshots-do-not-list-when-restoring-a-backup/253737 "2020-10-29T18:15:29Z")
I need to restore a backup of elasticsearch on another server, however snapshots do not appear on the system. My folder backup root@ixcgWfFZinUSKI:/var/lib/elasticsearch\_backup# ls -lh total 232K -rw-r--r--… --- ## [Proxyconnect tcp: tls: first record does not look like a TLS handshake metricbeat monitoring elasticsearch](https://discuss.elastic.co/t/proxyconnect-tcp-tls-first-record-does-not-look-like-a-tls-handshake-metricbeat-monitoring-elasticsearch/253567)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 3\ **Last updated:** [October 29, 2020, 5:54pm UTC](https://discuss.elastic.co/t/proxyconnect-tcp-tls-first-record-does-not-look-like-a-tls-handshake-metricbeat-monitoring-elasticsearch/253567 "2020-10-29T17:54:34Z")
Hello, I wanted to set up beats monitoring for my enviroment. But it does not work and I see this error in the logs. 2020-10-28T14:25:23.636+0100 INFO \[monitoring\] elasticsearch/elasticsearch.go:245 Failed to connect t… --- ## [Filebeat, elasticsearch,kibana](https://discuss.elastic.co/t/filebeat-elasticsearch-kibana/253086)
**Author:** [@Guhan\_S](https://discuss.elastic.co/u/Guhan_S)\ **Replies:** 1\ **Last updated:** [October 29, 2020, 5:51pm UTC](https://discuss.elastic.co/t/filebeat-elasticsearch-kibana/253086 "2020-10-29T17:51:53Z")
i am using filebeat in one aws instance where our application is running as docker container, elasticsearch and kibana are running on another aws instance. i can see the logs in kibana, here we are having three types… --- ## [Date field generated with field value change](https://discuss.elastic.co/t/date-field-generated-with-field-value-change/253059)
**Author:** [@osmosis](https://discuss.elastic.co/u/osmosis)\ **Replies:** 1\ **Last updated:** [October 29, 2020, 5:44pm UTC](https://discuss.elastic.co/t/date-field-generated-with-field-value-change/253059 "2020-10-29T17:44:12Z")
I am a beginner to elastic so beware. I am attempting to create a date field that will update based on a certain value in another field. For example: Field------------Value Complete: No Complete\_Date: - A change is … --- ## [Kibana Visualizatiom](https://discuss.elastic.co/t/kibana-visualizatiom/253554)
**Author:** [@srigayathri](https://discuss.elastic.co/u/srigayathri)\ **Replies:** 1\ **Last updated:** [October 29, 2020, 5:23pm UTC](https://discuss.elastic.co/t/kibana-visualizatiom/253554 "2020-10-29T17:23:50Z")
Is it possible to represent count, max, min in a single graph, such that, when we hover over the graph, we should be able to see all the 3 values. Max, min and count. --- ## [Index with geo\_point entry doe not show up in Maps/Heatmap](https://discuss.elastic.co/t/index-with-geo-point-entry-doe-not-show-up-in-maps-heatmap/252458)
**Author:** [@Poltsi](https://discuss.elastic.co/u/Poltsi)\ **Replies:** 2\ **Last updated:** [October 29, 2020, 5:19pm UTC](https://discuss.elastic.co/t/index-with-geo-point-entry-doe-not-show-up-in-maps-heatmap/252458 "2020-10-29T17:19:44Z")
I'm importing some old apache logs through logstash to ES, and one step is converting the ip address to coordinates. Originally I did not update the index template of logstash to use geo\_point for the coordinates-field … --- ## [Date parse error on only one record](https://discuss.elastic.co/t/date-parse-error-on-only-one-record/253653)
**Author:** [@Evan\_Vujcec](https://discuss.elastic.co/u/Evan_Vujcec)\ **Replies:** 7\ **Last updated:** [October 29, 2020, 5:19pm UTC](https://discuss.elastic.co/t/date-parse-error-on-only-one-record/253653 "2020-10-29T17:19:25Z")
I'm trying to import data from a csv into an ES index using logstash. In the CSV I have seperate date and time columns that I'm combining and then parsing it with the date filter plugin so it can use it as the @timestamp.… --- ## [Change index patterns export/import](https://discuss.elastic.co/t/change-index-patterns-export-import/253726)
**Author:** [@cjabrantes](https://discuss.elastic.co/u/cjabrantes)\ **Replies:** 1\ **Last updated:** [October 29, 2020, 4:55pm UTC](https://discuss.elastic.co/t/change-index-patterns-export-import/253726 "2020-10-29T16:55:53Z")
Hi all, I m trying to change a few index patterns. Since there are already a few visualizations i want to avoid having to change all visualizations. So my idea was export the index pattern, change, import it again, sh… --- ## [Rename Terms Aggregation Buckets](https://discuss.elastic.co/t/rename-terms-aggregation-buckets/253432)
**Author:** [@Smirra](https://discuss.elastic.co/u/Smirra)\ **Replies:** 1\ **Last updated:** [October 29, 2020, 4:47pm UTC](https://discuss.elastic.co/t/rename-terms-aggregation-buckets/253432 "2020-10-29T16:47:27Z")
I would like to apply a common renaming rule to the aggregated terms buckets (such as using regex) that removes part of the names shown in red below: The dream would be to add a regex somewhere (doing something like /… --- ## [Using spaCy lemmatizers with ElasticSearch](https://discuss.elastic.co/t/using-spacy-lemmatizers-with-elasticsearch/253721)
**Author:** [@aquarian\_14](https://discuss.elastic.co/u/aquarian_14)\ **Replies:** 0\ **Last updated:** [October 29, 2020, 3:35pm UTC](https://discuss.elastic.co/t/using-spacy-lemmatizers-with-elasticsearch/253721 "2020-10-29T15:35:30Z")
Has anyone attempted to do lemmatization outside of elasticsearch on content, and fed the pre-analyzed tokens in document field and then ingested the document? I would like to use spaCy lemmatization for content that I … --- ## [Elasticsearch Schema (Mapping) Analyzer](https://discuss.elastic.co/t/elasticsearch-schema-mapping-analyzer/253719)
**Author:** [@vorapoap](https://discuss.elastic.co/u/vorapoap)\ **Replies:** 0\ **Last updated:** [October 29, 2020, 3:27pm UTC](https://discuss.elastic.co/t/elasticsearch-schema-mapping-analyzer/253719 "2020-10-29T15:27:37Z")
In MongoDB there are tools that can do like Schema Analyzer. For example we can set to analyze first thousand documents to identify how is each field used by each document and how big they are. I am curious if we have … --- ## [New event not inserted](https://discuss.elastic.co/t/new-event-not-inserted/253411)
**Author:** [@micobarac](https://discuss.elastic.co/u/micobarac)\ **Replies:** 7\ **Last updated:** [October 29, 2020, 3:24pm UTC](https://discuss.elastic.co/t/new-event-not-inserted/253411 "2020-10-29T15:24:49Z")
I have a problem with an event not getting inserted on timeout. This is my configuration: filter { if !\[messageid\] { drop {} } aggregate { task\_id =\> "%{messageid}" code =\> " map\['avamis\_status… --- ## [Watcher Alert on Agent Log Halt](https://discuss.elastic.co/t/watcher-alert-on-agent-log-halt/253633)
**Author:** [@vishakh](https://discuss.elastic.co/u/vishakh)\ **Replies:** 4\ **Last updated:** [October 29, 2020, 3:16pm UTC](https://discuss.elastic.co/t/watcher-alert-on-agent-log-halt/253633 "2020-10-29T15:16:39Z")
I would request a suggestion on Kibana Watcher script to set alert trigger when a specific server's filebeat agent stops/halts ingesting logs to index. Brief: Trigger alarm when we don't receive logs from a specific fi… --- ## [Getting error while trying to take snapshot using curator](https://discuss.elastic.co/t/getting-error-while-trying-to-take-snapshot-using-curator/251429)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 1\ **Last updated:** [October 29, 2020, 2:43pm UTC](https://discuss.elastic.co/t/getting-error-while-trying-to-take-snapshot-using-curator/251429 "2020-10-29T14:43:03Z")
I am getting the below error, while taking snapshot using Curator: Failed to complete action: snapshot. \: Cannot snapshot indices to missing repository: xxxx Here I am using GCS… --- ## [Issue with Weird spaces with Filebeat in windows Log](https://discuss.elastic.co/t/issue-with-weird-spaces-with-filebeat-in-windows-log/253415)
**Author:** [@enrique.villar](https://discuss.elastic.co/u/enrique.villar)\ **Replies:** 5\ **Last updated:** [October 29, 2020, 2:36pm UTC](https://discuss.elastic.co/t/issue-with-weird-spaces-with-filebeat-in-windows-log/253415 "2020-10-29T14:36:31Z")
Good day. I try to index some windows (MSSQL) logs. This logs are in plain text. Some logs are multiline So, in Filebeat is configure: - type: log enabled: true paths: - D:\\logs\\\*.log #example path multi… --- ## [Readfile - buffer\_extract error: a delimiter can't be found](https://discuss.elastic.co/t/readfile-buffer-extract-error-a-delimiter-cant-be-found/253709)
**Author:** [@eddy](https://discuss.elastic.co/u/eddy)\ **Replies:** 0\ **Last updated:** [October 29, 2020, 2:18pm UTC](https://discuss.elastic.co/t/readfile-buffer-extract-error-a-delimiter-cant-be-found/253709 "2020-10-29T14:18:05Z")
Hi everyone, I'm currently dealing with an error in logstash. Sometimes when I launch Logstash , It doesn't process some data and this error appears : \[INFO \] 2020-10-25 13:48:52.328 \[\[main\]\ **Author:** [@Eon](https://discuss.elastic.co/u/Eon)\ **Replies:** 2\ **Last updated:** [October 29, 2020, 2:11pm UTC](https://discuss.elastic.co/t/remote-winlogbeat/253668 "2020-10-29T14:11:16Z") Hi All, I would like to know, would it be possible to setup a winlogbeat to collect WEF events on a remote WEF server? I know you can install the winlogbeat on a WEF server and grab the forwarded events, but we have a r… --- ## [LogStash Poll messages](https://discuss.elastic.co/t/logstash-poll-messages/253382)
**Author:** [@dfoot](https://discuss.elastic.co/u/dfoot)\ **Replies:** 3\ **Last updated:** [October 29, 2020, 2:09pm UTC](https://discuss.elastic.co/t/logstash-poll-messages/253382 "2020-10-29T14:09:22Z")
I am getting below logstash log message that stopping data flow for some reason I had to restart logstash and then re-occur. Please advise. \[org.apache.kafka.clients.consumer.internals.AbstractCoordinator\] \[Consumer cli… --- ## [Filebeat autodiscover doesn't pick-up inputs](https://discuss.elastic.co/t/filebeat-autodiscover-doesnt-pick-up-inputs/253341)
**Author:** [@CatalinM](https://discuss.elastic.co/u/CatalinM)\ **Replies:** 7\ **Last updated:** [October 29, 2020, 1:58pm UTC](https://discuss.elastic.co/t/filebeat-autodiscover-doesnt-pick-up-inputs/253341 "2020-10-29T13:58:10Z")
Hi there! I've deployed Filebeat in the "observability" namespace (with all roles, bindings being set to observability - not sure if this is ok). It starts without issues, but it doesn't discover any inputs. This is my… --- ## [Data loss in Filebeat to Kafka pipeline](https://discuss.elastic.co/t/data-loss-in-filebeat-to-kafka-pipeline/253704)
**Author:** [@Hreidar\_Joelsson](https://discuss.elastic.co/u/Hreidar_Joelsson)\ **Replies:** 0\ **Last updated:** [October 29, 2020, 1:51pm UTC](https://discuss.elastic.co/t/data-loss-in-filebeat-to-kafka-pipeline/253704 "2020-10-29T13:51:00Z")
Hi, I've been running a data pipeline for a few weeks now which uses Filebeat (V7.9.2) as a log harvester and publishes the data into Kafka. This new pipeline is a replacement for an older one based on Filebeat and Logst… --- ## [Getting error while restoring snapshots using curator](https://discuss.elastic.co/t/getting-error-while-restoring-snapshots-using-curator/251849)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 11\ **Last updated:** [October 29, 2020, 1:47pm UTC](https://discuss.elastic.co/t/getting-error-while-restoring-snapshots-using-curator/251849 "2020-10-29T13:47:46Z")
Hi Team, I am taking snapshots using curator through GCS bucket and trying to restore it . But, I am getting error as below: 2020-10-13 06:08:35,293 INFO Preparing Action ID: 1, "restore" 2020-10-13 06:08:35,293 … --- ## [Spliting and increasing timestamp](https://discuss.elastic.co/t/spliting-and-increasing-timestamp/253094)
**Author:** [@iEMH](https://discuss.elastic.co/u/iEMH)\ **Replies:** 2\ **Last updated:** [October 29, 2020, 1:02pm UTC](https://discuss.elastic.co/t/spliting-and-increasing-timestamp/253094 "2020-10-29T13:02:12Z")
Hello, I am trying to do the following: I have a json message with a consolidated array of values from a sensor (every x minutes). {"id":"C2","timestamp":"2020-10-20T17:07:57.260Z","gap\_in\_ms":20,"array\_of\_values":{"x… --- ## [Index boost with completion suggester](https://discuss.elastic.co/t/index-boost-with-completion-suggester/253691)
**Author:** [@anupam](https://discuss.elastic.co/u/anupam)\ **Replies:** 0\ **Last updated:** [October 29, 2020, 12:43pm UTC](https://discuss.elastic.co/t/index-boost-with-completion-suggester/253691 "2020-10-29T12:43:24Z")
Is it possible to use index boost when using completion suggester in Elasticsearch? I have tried many different ways but doesn't seem to work. Haven't found any reference in the documentation claiming that it does not wo… --- ## [XML multiline files](https://discuss.elastic.co/t/xml-multiline-files/253577)
**Author:** [@Matias\_Aguero\_Escoba](https://discuss.elastic.co/u/Matias_Aguero_Escoba)\ **Replies:** 6\ **Last updated:** [October 29, 2020, 12:43pm UTC](https://discuss.elastic.co/t/xml-multiline-files/253577 "2020-10-29T12:43:49Z")
Hi everyone! my name is Matias Aguero. and i need ingest a lot XML files in elasticsearch, but i can't do it. My XMLs files then this structure: \ \ **Author:** [@sjne](https://discuss.elastic.co/u/sjne)\ **Replies:** 5\ **Last updated:** [October 29, 2020, 12:35pm UTC](https://discuss.elastic.co/t/grok-pattern-to-match-filebeat-multiline-input-up-to-the-first-new-line-character/253575 "2020-10-29T12:35:57Z") Logstash 6.8.10 Filebeat 6.8.9 Filebeat config: filebeat.inputs: - type: log enabled: true paths: - '/path/to/file' tags: - 'app' fields: app\_id: some\_app multiline.pattern: '^\\\[\[0-9\]{4}\\-\[0-9\]{2}-\[… --- ## [java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit](https://discuss.elastic.co/t/java-lang-illegalstateexception-logstash-stopped-processing-because-of-an-error-systemexit-exit/253614)
**Author:** [@Michael25](https://discuss.elastic.co/u/Michael25)\ **Replies:** 2\ **Last updated:** [October 29, 2020, 12:20pm UTC](https://discuss.elastic.co/t/java-lang-illegalstateexception-logstash-stopped-processing-because-of-an-error-systemexit-exit/253614 "2020-10-29T12:20:17Z")
Hi there, I know this error may have been solved before but tried implementing the solutions that I've seen but nothing seems to be working for me. I've been stuck on this problem for 2 days now. I was wondering if you g… --- ## [I want to pseudonymize a specific field with a beat](https://discuss.elastic.co/t/i-want-to-pseudonymize-a-specific-field-with-a-beat/253671)
**Author:** [@elk51211](https://discuss.elastic.co/u/elk51211)\ **Replies:** 2\ **Last updated:** [October 29, 2020, 12:02pm UTC](https://discuss.elastic.co/t/i-want-to-pseudonymize-a-specific-field-with-a-beat/253671 "2020-10-29T12:02:39Z")
What is the recommended approach to deal with logs to be as GDPR compliant as possible? I need to pseudonymize user data. The only resource I found is dated back to march of 2018 in this blog post: https://www.elastic.c… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1725) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1727)