# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1729 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1730 --- ## [Filebeat not starting properly after host start](https://discuss.elastic.co/t/filebeat-not-starting-properly-after-host-start/253410)
**Author:** [@adsr](https://discuss.elastic.co/u/adsr)\ **Replies:** 4\ **Last updated:** [October 28, 2020, 7:58am UTC](https://discuss.elastic.co/t/filebeat-not-starting-properly-after-host-start/253410 "2020-10-28T07:58:08Z")
Hi everyone, I am running filebeat 7.5.0 on centos with systemd and everything works fine except when I restart the host (the filebeat service is enabled). According to systemd the service is running fine, yet it does n… --- ## [Unable to start Filebeat 7.9.2 , Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch](https://discuss.elastic.co/t/unable-to-start-filebeat-7-9-2-failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/252928)
**Author:** [@a\_ssuresh](https://discuss.elastic.co/u/a_ssuresh)\ **Replies:** 10\ **Last updated:** [October 28, 2020, 6:58am UTC](https://discuss.elastic.co/t/unable-to-start-filebeat-7-9-2-failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/252928 "2020-10-28T06:58:59Z")
Hi , I just installed ELK on a server, filebeat agent (ver 7.9.2) on another, OS- CentOS 7 Started elastic, logstash & kibana on a server, but unable to start filebeat agent from another server, where im trying to s… --- ## [Pipeline aborted due to error - exception=\>java.lang.ClassCastException - Error while fetching data using Salesforce plugin](https://discuss.elastic.co/t/pipeline-aborted-due-to-error-exception-java-lang-classcastexception-error-while-fetching-data-using-salesforce-plugin/253439)
**Author:** [@Pavitra\_Poojary](https://discuss.elastic.co/u/Pavitra_Poojary)\ **Replies:** 6\ **Last updated:** [October 28, 2020, 6:35am UTC](https://discuss.elastic.co/t/pipeline-aborted-due-to-error-exception-java-lang-classcastexception-error-while-fetching-data-using-salesforce-plugin/253439 "2020-10-28T06:35:47Z")
Hi, I am trying to pull the Salesforce data using the salesforce plugin available in Logstash. Below is my configuration. ELK Version : 7.4 input { salesforce { use\_test\_sandbox =\> true client\_id =\> 'xxx' … --- ## [Maximum Heap Size for Server with 192GB RAM](https://discuss.elastic.co/t/maximum-heap-size-for-server-with-192gb-ram/253277)
**Author:** [@gnome](https://discuss.elastic.co/u/gnome)\ **Replies:** 5\ **Last updated:** [October 28, 2020, 5:57am UTC](https://discuss.elastic.co/t/maximum-heap-size-for-server-with-192gb-ram/253277 "2020-10-28T05:57:18Z")
Good day everyone. I spend some time read up the maximum heap size can be allocated for ElasticSearch Server, most of it said recommend maximum of 32GB or 1/2 of your physical memory. I have a server with 192GB of Ram, … --- ## [Update by query don't accept user-defined param in java high level client](https://discuss.elastic.co/t/update-by-query-dont-accept-user-defined-param-in-java-high-level-client/226927)
**Author:** [@tnarita](https://discuss.elastic.co/u/tnarita)\ **Replies:** 8\ **Last updated:** [October 28, 2020, 3:49am UTC](https://discuss.elastic.co/t/update-by-query-dont-accept-user-defined-param-in-java-high-level-client/226927 "2020-10-28T03:49:01Z")
Hi, I'm using REST High Level Client in v7.5 I'm getting error when I tried to update all document by UpdateByQueryRequest. Error message : cannot write xcontent for unknown value of type class entity.Navigation Belo… --- ## [java.net.ConnectException: Connection timed out: no further information](https://discuss.elastic.co/t/java-net-connectexception-connection-timed-out-no-further-information/253513)
**Author:** [@carolcoral](https://discuss.elastic.co/u/carolcoral)\ **Replies:** 0\ **Last updated:** [October 28, 2020, 3:22am UTC](https://discuss.elastic.co/t/java-net-connectexception-connection-timed-out-no-further-information/253513 "2020-10-28T03:22:50Z")
Java version:1.8 Es version:7.9.2 Es java maven: \ \org.elasticsearch.client\ \elasticsearch-rest-high-level-client\ \7.9.3\ \… --- ## [Authenticated Kibana Iframe with the Authorization header](https://discuss.elastic.co/t/authenticated-kibana-iframe-with-the-authorization-header/251521)
**Author:** [@Ali\_Nazemian](https://discuss.elastic.co/u/Ali_Nazemian)\ **Replies:** 4\ **Last updated:** [October 28, 2020, 2:22am UTC](https://discuss.elastic.co/t/authenticated-kibana-iframe-with-the-authorization-header/251521 "2020-10-28T02:22:35Z")
Hi, I am trying to embed a Kibana dashboard in my React app. To address security concerns, I am trying to add an authorization header to all requests that are being sent to Kibana so that a proxy service can intercept t… --- ## [\[bug\] big decimal value losed precision](https://discuss.elastic.co/t/bug-big-decimal-value-losed-precision/253105)
**Author:** [@vpzlin](https://discuss.elastic.co/u/vpzlin)\ **Replies:** 10\ **Last updated:** [October 28, 2020, 2:09am UTC](https://discuss.elastic.co/t/bug-big-decimal-value-losed-precision/253105 "2020-10-28T02:09:56Z")
Hello, ES team! There is a precision losing problem when I'm using java client of ElasticSearch. Will you fix this bug recently? We do need a big decimal in developing financial system. Thanks very much! \[Development… --- ## [Cluster eventually starts giving absurdly wrong counts on search](https://discuss.elastic.co/t/cluster-eventually-starts-giving-absurdly-wrong-counts-on-search/252096)
**Author:** [@caarlos0](https://discuss.elastic.co/u/caarlos0)\ **Replies:** 3\ **Last updated:** [October 28, 2020, 2:06am UTC](https://discuss.elastic.co/t/cluster-eventually-starts-giving-absurdly-wrong-counts-on-search/252096 "2020-10-28T02:06:05Z")
We have a cluster running version 5.6.16. It has ~5.7k primary shards, ~2k indices and 28 nodes (3 masters, 3 coordinators and 22 data nodes): { "cluster\_name": "foo", "status": "green", "timed\_out": false, "num… --- ## [Creating dynamic watcher](https://discuss.elastic.co/t/creating-dynamic-watcher/252473)
**Author:** [@Wilbert\_Silverio](https://discuss.elastic.co/u/Wilbert_Silverio)\ **Replies:** 6\ **Last updated:** [October 28, 2020, 1:02am UTC](https://discuss.elastic.co/t/creating-dynamic-watcher/252473 "2020-10-28T01:02:28Z")
Hi All, we had a watcher wherein it sends us a notification when the transactions are going in per hour. we wanted to create a dynamic watcher wherein it checks for the peak hours and checks during off-peak hours. Can s… --- ## [K8s Elasticsearch with filebeat is keeping 'not ready' after rebooting](https://discuss.elastic.co/t/k8s-elasticsearch-with-filebeat-is-keeping-not-ready-after-rebooting/253376)
**Author:** [@klaude416](https://discuss.elastic.co/u/klaude416)\ **Replies:** 1\ **Last updated:** [October 28, 2020, 12:42am UTC](https://discuss.elastic.co/t/k8s-elasticsearch-with-filebeat-is-keeping-not-ready-after-rebooting/253376 "2020-10-28T00:42:41Z")
I'm going through a not very understandable situation. Environment Two dedicated nodes with azure centos 8.2 (2vcpu, 16G ram), not AKS 1 master node, 1 worker node. kubernetes v1.19.3 helm v2.16.12 Helm charts Elasti… --- ## [Dynamically move nested fields to the top level](https://discuss.elastic.co/t/dynamically-move-nested-fields-to-the-top-level/253504)
**Author:** [@jiacob](https://discuss.elastic.co/u/jiacob)\ **Replies:** 0\ **Last updated:** [October 28, 2020, 12:02am UTC](https://discuss.elastic.co/t/dynamically-move-nested-fields-to-the-top-level/253504 "2020-10-28T00:02:44Z")
Hello, I am trying to parse an XML message with lots of nested fields. I am using the XML filter to parse the data and send it to Elasticsearch. The issue that I am having is that the XML path to the value is too large. … --- ## [Filebeat Cisco Module to Logstash not working as expected](https://discuss.elastic.co/t/filebeat-cisco-module-to-logstash-not-working-as-expected/249885)
**Author:** [@asaravanan](https://discuss.elastic.co/u/asaravanan)\ **Replies:** 4\ **Last updated:** [October 27, 2020, 10:35pm UTC](https://discuss.elastic.co/t/filebeat-cisco-module-to-logstash-not-working-as-expected/249885 "2020-10-27T22:35:15Z")
I have configured Filebeat with Cisco Module enabled as per https://www.elastic.co/guide/en/beats/filebeat/7.9/filebeat-installation-configuration.html & https://www.elastic.co/guide/en/logstash/7.9/use-ingest-pipelines.… --- ## [Filebeat module with logstash not parsing with IDFW enabled](https://discuss.elastic.co/t/filebeat-module-with-logstash-not-parsing-with-idfw-enabled/249896)
**Author:** [@asaravanan](https://discuss.elastic.co/u/asaravanan)\ **Replies:** 4\ **Last updated:** [October 27, 2020, 10:34pm UTC](https://discuss.elastic.co/t/filebeat-module-with-logstash-not-parsing-with-idfw-enabled/249896 "2020-10-27T22:34:56Z")
I am not getting any "Built" message ID "302013" with Identity Firewall enabled on Cisco ASA. I think pipeline configuration doesnt have this field to parse it and sending it to Elastic. Error Message \[2020-09-25T02:07… --- ## [Logstash \[7.8\] problem with an elastic update doc](https://discuss.elastic.co/t/logstash-7-8-problem-with-an-elastic-update-doc/253370)
**Author:** [@unknown\_user](https://discuss.elastic.co/u/unknown_user)\ **Replies:** 2\ **Last updated:** [October 27, 2020, 10:27pm UTC](https://discuss.elastic.co/t/logstash-7-8-problem-with-an-elastic-update-doc/253370 "2020-10-27T22:27:34Z")
Hi Guys, Running into a bit of an issue that I am trying to overcome. I have a index that only updates documents, specifically I am monitoring devices that are either in an UP or DOWN status and the doc\_id is the name … --- ## [Geo\_shape field for document index not showing on map for polygons](https://discuss.elastic.co/t/geo-shape-field-for-document-index-not-showing-on-map-for-polygons/253343)
**Author:** [@MarkCarroll](https://discuss.elastic.co/u/MarkCarroll)\ **Replies:** 1\ **Last updated:** [October 27, 2020, 10:20pm UTC](https://discuss.elastic.co/t/geo-shape-field-for-document-index-not-showing-on-map-for-polygons/253343 "2020-10-27T22:20:10Z")
Hello. I am trying to display geo\_shape polygon data on a Kibana map, using a document index. The map seems to be loading successfully as it zooms to where the polygon should be but there is no polygon drawn. I have cr… --- ## [Masking password in logstash config file](https://discuss.elastic.co/t/masking-password-in-logstash-config-file/253368)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 3\ **Last updated:** [October 27, 2020, 9:03pm UTC](https://discuss.elastic.co/t/masking-password-in-logstash-config-file/253368 "2020-10-27T21:03:53Z")
Hello all, As logstash config file is not centrally controlled, I want to mask the elasticsearch password in logstash.conf file so that it is not visible to all. Also user with what "security role" should suffice for m… --- ## [Documents version getting set to -1](https://discuss.elastic.co/t/documents-version-getting-set-to-1/253492)
**Author:** [@natasha\_adewar](https://discuss.elastic.co/u/natasha_adewar)\ **Replies:** 0\ **Last updated:** [October 27, 2020, 8:50pm UTC](https://discuss.elastic.co/t/documents-version-getting-set-to-1/253492 "2020-10-27T20:50:38Z")
We are migrating ES from 2.4 to 5.6. Before migrating we copy all the documents from Index A to Index B. After migrating to 5.6 we are seeing many of the documents version on Index B is getting set to -1, hence the dele… --- ## [Invalid index name \[\_security\], must not start with '\_', '-', or '+'](https://discuss.elastic.co/t/invalid-index-name-security-must-not-start-with-or/253448)
**Author:** [@mr\_searchng](https://discuss.elastic.co/u/mr_searchng)\ **Replies:** 10\ **Last updated:** [October 27, 2020, 8:41pm UTC](https://discuss.elastic.co/t/invalid-index-name-security-must-not-start-with-or/253448 "2020-10-27T20:41:19Z")
Elasticsearch version :6.3.0 --- ## [Logstash to Logstash (Lumberjack) host details](https://discuss.elastic.co/t/logstash-to-logstash-lumberjack-host-details/253390)
**Author:** [@cliff.wakefield](https://discuss.elastic.co/u/cliff.wakefield)\ **Replies:** 3\ **Last updated:** [October 27, 2020, 8:36pm UTC](https://discuss.elastic.co/t/logstash-to-logstash-lumberjack-host-details/253390 "2020-10-27T20:36:30Z")
I am setting up a two-tier Logstash setup for our customers. On-premises servers running syslog and beats will connect to 1 or more on-premises Logstash servers, which will be running syslog and beats pipelines configur… --- ## [List server hostname and disk usage](https://discuss.elastic.co/t/list-server-hostname-and-disk-usage/253451)
**Author:** [@plegault](https://discuss.elastic.co/u/plegault)\ **Replies:** 2\ **Last updated:** [October 27, 2020, 6:19pm UTC](https://discuss.elastic.co/t/list-server-hostname-and-disk-usage/253451 "2020-10-27T18:19:47Z")
There is a Host overview page for each host that I have the system monitor enabled on. On each Host overview page there are all the system graphs etc. I want to be able to take the host name and Disk Usage graph and crea… --- ## [S3 Input Plugin Does Not Delete The Temporary Files](https://discuss.elastic.co/t/s3-input-plugin-does-not-delete-the-temporary-files/253483)
**Author:** [@Rahul\_Kumar4](https://discuss.elastic.co/u/Rahul_Kumar4)\ **Replies:** 3\ **Last updated:** [October 27, 2020, 8:12pm UTC](https://discuss.elastic.co/t/s3-input-plugin-does-not-delete-the-temporary-files/253483 "2020-10-27T20:12:45Z")
The S3 input plugin does not delete the temporary files that it creates from the downloaded objects from S3 bucket even after processing and indexing it to Elasticsearch. Is there a work around/setting to automate this? … --- ## [Shorten\_url api does not return urlId](https://discuss.elastic.co/t/shorten-url-api-does-not-return-urlid/253342)
**Author:** [@tshayan](https://discuss.elastic.co/u/tshayan)\ **Replies:** 2\ **Last updated:** [October 27, 2020, 7:54pm UTC](https://discuss.elastic.co/t/shorten-url-api-does-not-return-urlid/253342 "2020-10-27T19:54:17Z")
Hello, I have followed the shorten\_url api documentation to create a new shortened URL, however in response I am only getting a confirmation and not the urlID as per the documentation. I am doing this via Kibana's dev-… --- ## [How add field using apache module in filebeat](https://discuss.elastic.co/t/how-add-field-using-apache-module-in-filebeat/253477)
**Author:** [@randoran](https://discuss.elastic.co/u/randoran)\ **Replies:** 1\ **Last updated:** [October 27, 2020, 7:35pm UTC](https://discuss.elastic.co/t/how-add-field-using-apache-module-in-filebeat/253477 "2020-10-27T19:35:42Z")
I am using the apache module in filebeat to send logs to elasticsearch. How can I add a field to what gets sent? When I was using type: log I did something like this to get a field added but not sure how to do it when us… --- ## [Is winlogbeat able to ingore events before specific time?](https://discuss.elastic.co/t/is-winlogbeat-able-to-ingore-events-before-specific-time/253486)
**Author:** [@Louis\_Zhang](https://discuss.elastic.co/u/Louis_Zhang)\ **Replies:** 0\ **Last updated:** [October 27, 2020, 7:19pm UTC](https://discuss.elastic.co/t/is-winlogbeat-able-to-ingore-events-before-specific-time/253486 "2020-10-27T19:19:16Z")
I found winlogbeat is able to configured to ignore events older since now. winlogbeat.event\_logs: - name: Application ignore\_older: 72h - name: Security - name: System Woundering if it's possible to configure… --- ## [Non-zero metrics in the last 30s- Filebeat](https://discuss.elastic.co/t/non-zero-metrics-in-the-last-30s-filebeat/253482)
**Author:** [@Mauricio\_Alejandro\_V](https://discuss.elastic.co/u/Mauricio_Alejandro_V)\ **Replies:** 1\ **Last updated:** [October 27, 2020, 6:53pm UTC](https://discuss.elastic.co/t/non-zero-metrics-in-the-last-30s-filebeat/253482 "2020-10-27T18:53:19Z")
hello, I am trying to pass some logs to logstash using filebeat, however the filebeat logs continiously show this message: Help Loaded: loaded (/usr/lib/systemd/system/filebeat.service; enabled; vendor preset: disable… --- ## [Ingest Pipeline with Grok Processor cannot index all files](https://discuss.elastic.co/t/ingest-pipeline-with-grok-processor-cannot-index-all-files/252594)
**Author:** [@morningkaren](https://discuss.elastic.co/u/morningkaren)\ **Replies:** 5\ **Last updated:** [October 27, 2020, 6:22pm UTC](https://discuss.elastic.co/t/ingest-pipeline-with-grok-processor-cannot-index-all-files/252594 "2020-10-27T18:22:28Z")
Hello, In Python, I created an ingest pipeline with a grok processor to look for names in the file.filename field like so : body = { "description" : "name\_search\_test pipeline", "processors" : \[ … --- ## [ES Sorting on datetimestamp](https://discuss.elastic.co/t/es-sorting-on-datetimestamp/253476)
**Author:** [@Amit-Singh](https://discuss.elastic.co/u/Amit-Singh)\ **Replies:** 1\ **Last updated:** [October 27, 2020, 6:14pm UTC](https://discuss.elastic.co/t/es-sorting-on-datetimestamp/253476 "2020-10-27T18:14:02Z")
Hi Elasticsearch community, I have a doubt/ask, I need to get the latest record from the hits based on a date timestamp column. The format of date time column i.e. 'time': 'Mon Oct 26 20:04:11 2020' Kindly help me out … --- ## [Create a weekly report](https://discuss.elastic.co/t/create-a-weekly-report/253457)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 0\ **Last updated:** [October 27, 2020, 3:23pm UTC](https://discuss.elastic.co/t/create-a-weekly-report/253457 "2020-10-27T15:23:52Z")
I've created a dashboard per bossman's requested and now he asks it to be delivered by mail every week. Unfortunately with a zero budget, I'm looking for an alternative for the paid subscription provided in kibana. Does… --- ## [Filebeat adds drive letter to path](https://discuss.elastic.co/t/filebeat-adds-drive-letter-to-path/253470)
**Author:** [@jimmyvalmer19](https://discuss.elastic.co/u/jimmyvalmer19)\ **Replies:** 0\ **Last updated:** [October 27, 2020, 4:23pm UTC](https://discuss.elastic.co/t/filebeat-adds-drive-letter-to-path/253470 "2020-10-27T16:23:26Z")
Hi, since I always get help here, i try next one. This may be something very obvious, but i spent already few hours on this. It's about filebeat (7.3.0) running on Windows server I'm using shared drive in my Filebeat … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1728) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1730)