# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1747 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1748 --- ## [ES busy : Hot thread and xpack.monitoring.exporter full errors](https://discuss.elastic.co/t/es-busy-hot-thread-and-xpack-monitoring-exporter-full-errors/252090)
**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\ **Replies:** 9\ **Last updated:** [October 16, 2020, 8:27am UTC](https://discuss.elastic.co/t/es-busy-hot-thread-and-xpack-monitoring-exporter-full-errors/252090 "2020-10-16T08:27:32Z")
Hello, I see many errors in hot thread API. Overview Version: 5.5.1 Uptime: 13 days Nodes: 60 Disk Available: 247TB / 413TB (59.74%) JVM Heap: 68.38% (1TB / 2TB) Indices: 2,857 Documents: 24,414,223,409 Disk Usage:… --- ## [Kibana field preview size](https://discuss.elastic.co/t/kibana-field-preview-size/252216)
**Author:** [@gborg](https://discuss.elastic.co/u/gborg)\ **Replies:** 3\ **Last updated:** [October 16, 2020, 8:11am UTC](https://discuss.elastic.co/t/kibana-field-preview-size/252216 "2020-10-16T08:11:28Z")
I am using elasticsearch and Kibana for log management, one developer asked me if I could make a field "larger", a field they look at all day is quite large and they need to hit the "toggle field details" to get to see t… --- ## [Slow force merge after 7.5.0 -\> 7.9.1 upgrade](https://discuss.elastic.co/t/slow-force-merge-after-7-5-0-7-9-1-upgrade/252311)
**Author:** [@Dmitry1](https://discuss.elastic.co/u/Dmitry1)\ **Replies:** 0\ **Last updated:** [October 16, 2020, 7:30am UTC](https://discuss.elastic.co/t/slow-force-merge-after-7-5-0-7-9-1-upgrade/252311 "2020-10-16T07:30:29Z")
Hello, I've upgraded elastic from 7.5.0 -\> 7.9.1 and notice, that force merge time for my daily index increased more than twice! I don't change any setting. Script do force merge like this : set this index parameters: … --- ## [\[Filebeat\] Panic in K8s autodiscover](https://discuss.elastic.co/t/filebeat-panic-in-k8s-autodiscover/252144)
**Author:** [@boernd](https://discuss.elastic.co/u/boernd)\ **Replies:** 3\ **Last updated:** [October 16, 2020, 7:25am UTC](https://discuss.elastic.co/t/filebeat-panic-in-k8s-autodiscover/252144 "2020-10-16T07:25:08Z")
Hi, after upgrading from 7.5.2 to 7.9.2 I observe sporadic container crashes with the following stacktrace: fatal error: concurrent map read and map write goroutine 5766 \[running\]: runtime.throw(0x3d8cd28, 0x21) /usr… --- ## [Feature request kibana highlight off for a field](https://discuss.elastic.co/t/feature-request-kibana-highlight-off-for-a-field/252231)
**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Replies:** 2\ **Last updated:** [October 16, 2020, 6:38am UTC](https://discuss.elastic.co/t/feature-request-kibana-highlight-off-for-a-field/252231 "2020-10-16T06:38:38Z")
Can there be option to disable highlight for a specific field of a index. Kibana gives a option to disable highlighting using doc table highlights off but it then applies to all the indexes. Atleast there should be an op… --- ## [Geo Distance Search on Geo Shape with distance returned](https://discuss.elastic.co/t/geo-distance-search-on-geo-shape-with-distance-returned/252212)
**Author:** [@DavidBokor](https://discuss.elastic.co/u/DavidBokor)\ **Replies:** 5\ **Last updated:** [October 16, 2020, 6:21am UTC](https://discuss.elastic.co/t/geo-distance-search-on-geo-shape-with-distance-returned/252212 "2020-10-16T06:21:26Z")
Based on the discussion here it looks like searching by distance on a geo shape field is supported as of v7.7.0. I'm using 7.9 and getting an error. I have two indices, one points and one polygons. I have no problem doi… --- ## [Error stacktrace not showing on the linux server](https://discuss.elastic.co/t/error-stacktrace-not-showing-on-the-linux-server/252303)
**Author:** [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\ **Replies:** 0\ **Last updated:** [October 16, 2020, 5:59am UTC](https://discuss.elastic.co/t/error-stacktrace-not-showing-on-the-linux-server/252303 "2020-10-16T05:59:53Z")
I've installed kibana,elasticsearch and logstash version 7.9.2 on the linux server. In local windows machine it working fine and showing error stracktrace of message. but over the linux it's not showing error stracktra… --- ## [What is the grok pattern for find userid from message?](https://discuss.elastic.co/t/what-is-the-grok-pattern-for-find-userid-from-message/252301)
**Author:** [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\ **Replies:** 0\ **Last updated:** [October 16, 2020, 5:50am UTC](https://discuss.elastic.co/t/what-is-the-grok-pattern-for-find-userid-from-message/252301 "2020-10-16T05:50:49Z")
I've two layouts one is error layout.in this layout have two additional fields like.requestUrl and requestmethod. the second one is common layout which is for warn,debug,info log levels. i've also added userId which is… --- ## [Kibana 7.9 won't start](https://discuss.elastic.co/t/kibana-7-9-wont-start/252177)
**Author:** [@wittrue](https://discuss.elastic.co/u/wittrue)\ **Replies:** 2\ **Last updated:** [October 16, 2020, 5:25am UTC](https://discuss.elastic.co/t/kibana-7-9-wont-start/252177 "2020-10-16T05:25:26Z")
Hi, last week I updated our elasticsearch server, but from then kibana refuses to start. Here is its log: Oct 15 12:26:55 sub.server.com systemd\[1\]: Started Kibana. Oct 15 12:27:05 sub.server.com kibana\[26328\]… --- ## [Timelion in canvas throws error \[mapColumn\] \> \[getCell\] \> Column not found](https://discuss.elastic.co/t/timelion-in-canvas-throws-error-mapcolumn-getcell-column-not-found/251831)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 4\ **Last updated:** [October 16, 2020, 4:43am UTC](https://discuss.elastic.co/t/timelion-in-canvas-throws-error-mapcolumn-getcell-column-not-found/251831 "2020-10-16T04:43:13Z")
Hi, Trying to create timelion in canvas workpad. Getting an error ESQL code: timelion query=".es(index=my-index-\*, timefield='timestamp', metric=cardinality:field1.keyword, q='field2.keyword:xxx A… --- ## [6-nodes cluster with uneven disk space](https://discuss.elastic.co/t/6-nodes-cluster-with-uneven-disk-space/252290)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 0\ **Last updated:** [October 16, 2020, 3:42am UTC](https://discuss.elastic.co/t/6-nodes-cluster-with-uneven-disk-space/252290 "2020-10-16T03:42:34Z")
Hello, I have 6 nodes in my cluster as follows: 2x 10TB disk space (masters + data nodes) 4x 100TB disk space (data nodes only) Most of my data is sent to the 2 masters with 10TB, will Elasticsearch make use of the re… --- ## [Kafka output throughput is slow or not fast enough](https://discuss.elastic.co/t/kafka-output-throughput-is-slow-or-not-fast-enough/252117)
**Author:** [@jkyamog](https://discuss.elastic.co/u/jkyamog)\ **Replies:** 1\ **Last updated:** [October 16, 2020, 3:26am UTC](https://discuss.elastic.co/t/kafka-output-throughput-is-slow-or-not-fast-enough/252117 "2020-10-16T03:26:38Z")
We are ingesting logs of zscaler, we have come up with a bottle neck likely on the filebeat kafka output. Deployment A: \[\[ Zscaler NSS \]\] -- syslog input --\> \[\[ filebeat \]\] -- kafka output --\> \[\[ Event Hub \]\] ... \[\[ El… --- ## [Configuration of logstash for forwarding winlogbeats to a syslog server](https://discuss.elastic.co/t/configuration-of-logstash-for-forwarding-winlogbeats-to-a-syslog-server/252195)
**Author:** [@jjoseph8008](https://discuss.elastic.co/u/jjoseph8008)\ **Replies:** 2\ **Last updated:** [October 16, 2020, 2:54am UTC](https://discuss.elastic.co/t/configuration-of-logstash-for-forwarding-winlogbeats-to-a-syslog-server/252195 "2020-10-16T02:54:07Z")
I am using winlogbeats to send log files from a windows box to logstash. My logstash is collecting Linux syslogs over port 514,forwarding them to a local NGINX service that will then forward it to our SIEM syslog server … --- ## [Upgrade Elasticsearch](https://discuss.elastic.co/t/upgrade-elasticsearch/250491)
**Author:** [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\ **Replies:** 9\ **Last updated:** [October 16, 2020, 1:33am UTC](https://discuss.elastic.co/t/upgrade-elasticsearch/250491 "2020-10-16T01:33:28Z")
Hello Team, Currently we are using Elasticsaerch 6.4 and all the other stack part like kibana, logstash and beats also have versio 6.4 But now we want to use the some security feature like Role-based access control for… --- ## [Custom Logstash pipeline configuration file](https://discuss.elastic.co/t/custom-logstash-pipeline-configuration-file/252277)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 5\ **Last updated:** [October 16, 2020, 12:29am UTC](https://discuss.elastic.co/t/custom-logstash-pipeline-configuration-file/252277 "2020-10-16T00:29:08Z")
Hi, I want to make a custom pipeline using SNMP walk plugin. I need some help in the first steps to properly understand syntax. So far I have something like this filter { mutate { add\_field =\> … --- ## [Perform mathematical functions from two index in Kibana](https://discuss.elastic.co/t/perform-mathematical-functions-from-two-index-in-kibana/251972)
**Author:** [@ibras](https://discuss.elastic.co/u/ibras)\ **Replies:** 5\ **Last updated:** [October 15, 2020, 11:33pm UTC](https://discuss.elastic.co/t/perform-mathematical-functions-from-two-index-in-kibana/251972 "2020-10-15T23:33:33Z")
Hello, I am trying to perform a multiplication functions between two fields in different index in Kibana. My first index looks like : My first index : { "\_index": "first\_index", "\_type": "type… --- ## [Watcher, Transform UTC timestamp on the payload to local time](https://discuss.elastic.co/t/watcher-transform-utc-timestamp-on-the-payload-to-local-time/252281)
**Author:** [@victor.vera](https://discuss.elastic.co/u/victor.vera)\ **Replies:** 0\ **Last updated:** [October 15, 2020, 10:23pm UTC](https://discuss.elastic.co/t/watcher-transform-utc-timestamp-on-the-payload-to-local-time/252281 "2020-10-15T22:23:46Z")
I'm trying to convert the time to my local time, but I get an error, I need to send to the mail the real time which is GMT-5 America/Bogota { "trigger": { "schedule": { "interval": "1h" } }, "input":… --- ## [Watcher, Transform UTC timestamp on the payload to local time](https://discuss.elastic.co/t/watcher-transform-utc-timestamp-on-the-payload-to-local-time/252279)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 0\ **Last updated:** [October 15, 2020, 10:12pm UTC](https://discuss.elastic.co/t/watcher-transform-utc-timestamp-on-the-payload-to-local-time/252279 "2020-10-15T22:12:38Z")
I'm trying to convert the time to my local time, but I get an error, I need to send to the mail the real time which is GMT-5 America/Bogota { "trigger": { "schedule": { "interval": "1h" } }, "input":… --- ## [How to modify date/time in timelion canvas workpad?](https://discuss.elastic.co/t/how-to-modify-date-time-in-timelion-canvas-workpad/251975)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 4\ **Last updated:** [October 15, 2020, 10:04pm UTC](https://discuss.elastic.co/t/how-to-modify-date-time-in-timelion-canvas-workpad/251975 "2020-10-15T22:04:59Z")
Hello Due to a bug in canvas workpads, date/time are showing in UTC. There is a workaround for ESQL. More details - https://discuss.elastic.co/t/wrong-canvas-timezone/190221 Is there a workaround for timelion visuali… --- ## [How to set default autoplay parameters in canvas workpad?](https://discuss.elastic.co/t/how-to-set-default-autoplay-parameters-in-canvas-workpad/251826)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 1\ **Last updated:** [October 15, 2020, 10:01pm UTC](https://discuss.elastic.co/t/how-to-set-default-autoplay-parameters-in-canvas-workpad/251826 "2020-10-15T22:01:26Z")
Hello, I give users the following URL https://my-domain/app/canvas#/workpad/workpad-82573394-f86b-499b-ada9-37de6cb78f31/page/1?\_\_autoplayInterval=30s&\_\_refreshInterval=5m Then it changes automatically to 1?\_\_fullscr… --- ## [Sort Results in Discovery Kibana (KQL)](https://discuss.elastic.co/t/sort-results-in-discovery-kibana-kql/252151)
**Author:** [@Jesus\_Moyano\_Dona](https://discuss.elastic.co/u/Jesus_Moyano_Dona)\ **Replies:** 1\ **Last updated:** [October 15, 2020, 9:15pm UTC](https://discuss.elastic.co/t/sort-results-in-discovery-kibana-kql/252151 "2020-10-15T21:15:04Z")
Hello, I have a database about flights and I want to create a coordinate map, so I need the last entry of each flight. I'm new to Elastic and Kibana, I don't know about how to do it. In this example, I filtered by the … --- ## [Changing Elasticsearch + Fscrawler tokenizing methods to recognize Social Security Numbers/Passport Machine Readable Zones](https://discuss.elastic.co/t/changing-elasticsearch-fscrawler-tokenizing-methods-to-recognize-social-security-numbers-passport-machine-readable-zones/251502)
**Author:** [@morningkaren](https://discuss.elastic.co/u/morningkaren)\ **Replies:** 4\ **Last updated:** [October 15, 2020, 8:34pm UTC](https://discuss.elastic.co/t/changing-elasticsearch-fscrawler-tokenizing-methods-to-recognize-social-security-numbers-passport-machine-readable-zones/251502 "2020-10-15T20:34:09Z")
Hello, I have used fscrawler to index some files that have social security numbers in the format of XXX-XX-XXXX and also the machine readable zones of passports such as \<\<\<\<\<\ **Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 0\ **Last updated:** [October 15, 2020, 8:31pm UTC](https://discuss.elastic.co/t/watchers-condition-summary-down-0-and-1/252269 "2020-10-15T20:31:34Z") Hi, I need help in a watcher's condition: I don't know if a for or a while is useful: I need the following: I have a variable "summary.down" with two values 0 and 1, so I need it to be executed infinitely and when it ch… --- ## [More shards = more throughput?](https://discuss.elastic.co/t/more-shards-more-throughput/252223)
**Author:** [@David\_Hopkins](https://discuss.elastic.co/u/David_Hopkins)\ **Replies:** 8\ **Last updated:** [October 15, 2020, 8:15pm UTC](https://discuss.elastic.co/t/more-shards-more-throughput/252223 "2020-10-15T20:15:16Z")
I've been trying to better understand the effect sharing has on performance but the theory doesn't seem to match the reality so clearly one of those things must be wrong :wink: After watching this video on Quantitative … --- ## [How do i create field Types such as geo\_point in a logstash conf file?](https://discuss.elastic.co/t/how-do-i-create-field-types-such-as-geo-point-in-a-logstash-conf-file/251922)
**Author:** [@fallenreaper](https://discuss.elastic.co/u/fallenreaper)\ **Replies:** 5\ **Last updated:** [October 15, 2020, 7:17pm UTC](https://discuss.elastic.co/t/how-do-i-create-field-types-such-as-geo-point-in-a-logstash-conf-file/251922 "2020-10-15T19:17:58Z")
I have location data I have been testing with various formats related to geo\_point in order for the machine to say "this is a geo\_point" but it doesnt. I said to myself "logstash handles parsing and should take the burd… --- ## [Increment field value when event occur in logstash output](https://discuss.elastic.co/t/increment-field-value-when-event-occur-in-logstash-output/252259)
**Author:** [@anja1](https://discuss.elastic.co/u/anja1)\ **Replies:** 0\ **Last updated:** [October 15, 2020, 7:16pm UTC](https://discuss.elastic.co/t/increment-field-value-when-event-occur-in-logstash-output/252259 "2020-10-15T19:16:16Z")
Is it possible to increment a field value everytime an event occur? Inputs are received from a filebeat and i want to store the values in elasticsearch I have following in my logstash pipeline: \> filter \> { \> … --- ## [@timestamp field in a datastream](https://discuss.elastic.co/t/timestamp-field-in-a-datastream/252258)
**Author:** [@MichaelKopaniov](https://discuss.elastic.co/u/MichaelKopaniov)\ **Replies:** 0\ **Last updated:** [October 15, 2020, 7:15pm UTC](https://discuss.elastic.co/t/timestamp-field-in-a-datastream/252258 "2020-10-15T19:15:41Z")
Hi, I'm currently examining the migration of an old ES cluster into an ILM managed https://www.elastic.co/guide/en/elasticsearch/reference/master/data-streams.html. I do not fully understand the role of the required @t… --- ## [Event based trigger of watcher](https://discuss.elastic.co/t/event-based-trigger-of-watcher/251989)
**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\ **Replies:** 3\ **Last updated:** [October 15, 2020, 7:08pm UTC](https://discuss.elastic.co/t/event-based-trigger-of-watcher/251989 "2020-10-15T19:08:21Z")
Kibana version : 7.9 Elasticsearch version : 7.9 APM Server version : 7.9 APM Agent language and version : java 1.8 Fresh install or upgraded from other version? fresh install Is there anything special in your … --- ## [How to gather journald logs from coreos hosts in an Openshift cluster?](https://discuss.elastic.co/t/how-to-gather-journald-logs-from-coreos-hosts-in-an-openshift-cluster/247553)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 4\ **Last updated:** [October 15, 2020, 6:51pm UTC](https://discuss.elastic.co/t/how-to-gather-journald-logs-from-coreos-hosts-in-an-openshift-cluster/247553 "2020-10-15T18:51:39Z")
Hello, We are in the process of migrating from Openshift 3.11 to Openshift 4.5. We managed to get the Filebeat daemonset working to ship pod logs, but we also need to index the journalctl logs from the coreos hosts. Wha… --- ## [Parse log using logstash and make ecs format](https://discuss.elastic.co/t/parse-log-using-logstash-and-make-ecs-format/251980)
**Author:** [@111387](https://discuss.elastic.co/u/111387)\ **Replies:** 4\ **Last updated:** [October 15, 2020, 6:36pm UTC](https://discuss.elastic.co/t/parse-log-using-logstash-and-make-ecs-format/251980 "2020-10-15T18:36:37Z")
i Receiving WAF(Web Application FireWall) log, Network Scan Result log file(xml) And try to send this log to ElasticSearch using logstash i want to parse this log according to ECS Format. but, "https://github.com/elas… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1746) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1748)