# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1777 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1778 --- ## [Strange problem finding any documents/logs, other than from a specific container (Kubernetes)](https://discuss.elastic.co/t/strange-problem-finding-any-documents-logs-other-than-from-a-specific-container-kubernetes/250160)
**Author:** [@Christos\_Gitsis](https://discuss.elastic.co/u/Christos_Gitsis)\ **Replies:** 1\ **Last updated:** [September 30, 2020, 3:26pm UTC](https://discuss.elastic.co/t/strange-problem-finding-any-documents-logs-other-than-from-a-specific-container-kubernetes/250160 "2020-09-30T15:26:27Z")
Hello, I am using Elasticsearch to index logs from Kubernetes. I have the problem, that in Kibana (6.8.6) discover, visualize, etc. I can only see the logs coming from one pod, namely the kibana pod itself, in namespace … --- ## [Logstash parsing in JSON](https://discuss.elastic.co/t/logstash-parsing-in-json/249659)
**Author:** [@Sivajanani](https://discuss.elastic.co/u/Sivajanani)\ **Replies:** 11\ **Last updated:** [September 30, 2020, 3:14pm UTC](https://discuss.elastic.co/t/logstash-parsing-in-json/249659 "2020-09-30T15:14:56Z")
Hello, I have a json in the following format. {"group" : \[{"name":"group1","tag":\[{"name":"tag1"},{"name":"tag2"},{"name":"tag3"},{"name":"tag4"}\]}\],"association" : } Using Logstash config I have to parse tag field an… --- ## [Where can I find an exhaustive list of search exceptions thrown by ES?](https://discuss.elastic.co/t/where-can-i-find-an-exhaustive-list-of-search-exceptions-thrown-by-es/250522)
**Author:** [@michele\_crudele](https://discuss.elastic.co/u/michele_crudele)\ **Replies:** 0\ **Last updated:** [September 30, 2020, 2:31pm UTC](https://discuss.elastic.co/t/where-can-i-find-an-exhaustive-list-of-search-exceptions-thrown-by-es/250522 "2020-09-30T14:31:47Z")
There are users sending bad queries. Some examples are queries with offending characters like /, : \\ and so on; queries with more than 1024 clauses; queries with syntax errors. We'd like to discriminate these cases fro… --- ## [Datastream gets no data](https://discuss.elastic.co/t/datastream-gets-no-data/250516)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 2\ **Last updated:** [September 30, 2020, 2:22pm UTC](https://discuss.elastic.co/t/datastream-gets-no-data/250516 "2020-09-30T14:22:18Z")
Hi, Being new to the datastream subject, I tried setting up a datastream using the documentation here: https://www.elastic.co/guide/en/elasticsearch/reference/current/set-up-a-data-stream.html and index towards it. … --- ## [Set authentification on elasticsearch using ansible](https://discuss.elastic.co/t/set-authentification-on-elasticsearch-using-ansible/248561)
**Author:** [@smutel](https://discuss.elastic.co/u/smutel)\ **Replies:** 5\ **Last updated:** [September 30, 2020, 1:41pm UTC](https://discuss.elastic.co/t/set-authentification-on-elasticsearch-using-ansible/248561 "2020-09-30T13:41:38Z")
Hello, I would like to setup TLS and basic authentification for elasticsearch 6.8. To deploy elasticsearch I used the official ansible playbook. I followed also this documentation: https://github.com/elastic/ansible-e… --- ## [Import script from file](https://discuss.elastic.co/t/import-script-from-file/250501)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 1\ **Last updated:** [September 30, 2020, 1:16pm UTC](https://discuss.elastic.co/t/import-script-from-file/250501 "2020-09-30T13:16:27Z")
"script": { "source": " very big script code", "lang":"painless" } i have a script with huge source code! is there any way to import script from external file? i want to write script cod… --- ## [Terms Aggregation Bucket Sort when doc\_count is equal](https://discuss.elastic.co/t/terms-aggregation-bucket-sort-when-doc-count-is-equal/250509)
**Author:** [@aan](https://discuss.elastic.co/u/aan)\ **Replies:** 0\ **Last updated:** [September 30, 2020, 1:13pm UTC](https://discuss.elastic.co/t/terms-aggregation-bucket-sort-when-doc-count-is-equal/250509 "2020-09-30T13:13:10Z")
Hey. The documentation states that: By default, the terms aggregation will return the buckets for the top ten terms ordered by the doc\_count I was just wondering what happens, when the doc\_count of several buckets i… --- ## [Update indexed docs based on a value from a new doc still does not indexed](https://discuss.elastic.co/t/update-indexed-docs-based-on-a-value-from-a-new-doc-still-does-not-indexed/250478)
**Author:** [@Marcelo\_Lavor](https://discuss.elastic.co/u/Marcelo_Lavor)\ **Replies:** 1\ **Last updated:** [September 30, 2020, 1:11pm UTC](https://discuss.elastic.co/t/update-indexed-docs-based-on-a-value-from-a-new-doc-still-does-not-indexed/250478 "2020-09-30T13:11:56Z")
Hello! I need to update several docs into an old index based on a value of new records still do not indexed? Is there any way to implement it with Logstash? This table below describes my index with old docs. The yellow … --- ## [Iterate parsing json in Logstash](https://discuss.elastic.co/t/iterate-parsing-json-in-logstash/249749)
**Author:** [@Sivajanani](https://discuss.elastic.co/u/Sivajanani)\ **Replies:** 11\ **Last updated:** [September 30, 2020, 1:02pm UTC](https://discuss.elastic.co/t/iterate-parsing-json-in-logstash/249749 "2020-09-30T13:02:16Z")
Hello All, My Json field looks like below, {"group" : \[{"name":"group1","tag":\[{"name":"tag1"},{"name":"tag2"},{"name":"tag3"},{"name":"tag4"}\]}\],"association" : } And my config file having mutate filter is as follows… --- ## [Logstash index format interpreted literally](https://discuss.elastic.co/t/logstash-index-format-interpreted-literally/250461)
**Author:** [@vinci](https://discuss.elastic.co/u/vinci)\ **Replies:** 3\ **Last updated:** [September 30, 2020, 12:41pm UTC](https://discuss.elastic.co/t/logstash-index-format-interpreted-literally/250461 "2020-09-30T12:41:02Z")
Hello, I've created several indices with logstash using the following settings: output { stdout { codec =\> dots } elasticsearch { hosts =\> \["http://192.168.99.18… --- ## [How tell metricbeat to create custom indices?](https://discuss.elastic.co/t/how-tell-metricbeat-to-create-custom-indices/250297)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 11\ **Last updated:** [September 30, 2020, 12:35pm UTC](https://discuss.elastic.co/t/how-tell-metricbeat-to-create-custom-indices/250297 "2020-09-30T12:35:27Z")
Hi there, how can I tell metricbeat to direct the ingested data into a custom index? What I tried so far did not work. cheers Ste --- ## [ES query to match all elements in array](https://discuss.elastic.co/t/es-query-to-match-all-elements-in-array/250364)
**Author:** [@GeorgetaPojoga](https://discuss.elastic.co/u/GeorgetaPojoga)\ **Replies:** 1\ **Last updated:** [September 30, 2020, 12:03pm UTC](https://discuss.elastic.co/t/es-query-to-match-all-elements-in-array/250364 "2020-09-30T12:03:24Z")
So I got this document with a nested array that I want to filter with this query. I want ES to return all documents where all items have changes = 0 and that only. If document has even a single item in the list with a c… --- ## [Unable to install Kibana - Ubuntu 18.04.5 LTS Bionic - unable to locate package kibana](https://discuss.elastic.co/t/unable-to-install-kibana-ubuntu-18-04-5-lts-bionic-unable-to-locate-package-kibana/250247)
**Author:** [@eliteharbinger42](https://discuss.elastic.co/u/eliteharbinger42)\ **Replies:** 3\ **Last updated:** [September 30, 2020, 11:59am UTC](https://discuss.elastic.co/t/unable-to-install-kibana-ubuntu-18-04-5-lts-bionic-unable-to-locate-package-kibana/250247 "2020-09-30T11:59:50Z")
Hi, Am trying to install Kibana but i get the inable to locate package kibana. I was able to install elasticsearch without any issue and followed the notes on adding the repository etc but it fails for Kibana. Ubuntu … --- ## [Why do the greater than comparison and the greater than equal comparsion not return the same count of documents](https://discuss.elastic.co/t/why-do-the-greater-than-comparison-and-the-greater-than-equal-comparsion-not-return-the-same-count-of-documents/250497)
**Author:** [@Florian1](https://discuss.elastic.co/u/Florian1)\ **Replies:** 0\ **Last updated:** [September 30, 2020, 11:35am UTC](https://discuss.elastic.co/t/why-do-the-greater-than-comparison-and-the-greater-than-equal-comparsion-not-return-the-same-count-of-documents/250497 "2020-09-30T11:35:40Z")
I have create a new Index and then added two documents to it. PUT test\_index PUT /test\_index/\_doc/1 { "A" : "5" } PUT /test\_index/\_doc/2 { "B" : "5" } After that I searched for every document with A greater than … --- ## [Gc - allocation failure](https://discuss.elastic.co/t/gc-allocation-failure/250495)
**Author:** [@zen.xen](https://discuss.elastic.co/u/zen.xen)\ **Replies:** 0\ **Last updated:** [September 30, 2020, 11:33am UTC](https://discuss.elastic.co/t/gc-allocation-failure/250495 "2020-09-30T11:33:21Z")
Hello, I found something in gc.log. I try to find any info in the Internet what it means but I didn't. What should I do to fix it and where set proper value(s)? Entering safepoint region: GenCollectForAllocation GC(1) … --- ## [Kubernetes metrics](https://discuss.elastic.co/t/kubernetes-metrics/250486)
**Author:** [@wadhah](https://discuss.elastic.co/u/wadhah)\ **Replies:** 0\ **Last updated:** [September 30, 2020, 10:53am UTC](https://discuss.elastic.co/t/kubernetes-metrics/250486 "2020-09-30T10:53:35Z")
Hello, I hope you are doing well! I am running ELK stack alongside metricbeat (version 7.9) on an Azure kubernetes cluster. Metricbeat is running as a daemonset. I was trying to fetch scheduler and controllermanger m… --- ## [FileBeat not harvesting new logs in the provided path](https://discuss.elastic.co/t/filebeat-not-harvesting-new-logs-in-the-provided-path/250485)
**Author:** [@BTH.S3](https://discuss.elastic.co/u/BTH.S3)\ **Replies:** 0\ **Last updated:** [September 30, 2020, 10:49am UTC](https://discuss.elastic.co/t/filebeat-not-harvesting-new-logs-in-the-provided-path/250485 "2020-09-30T10:49:50Z")
FileBeat has been running as a docker container started by docker-compose file and already mapped the volume for filebeat.yml. I've updated the configuration in filebeat.yml by setting input and output as Elasticsearch. … --- ## [100% CPU after the upgrade from 7.6.1 to 7.8.1](https://discuss.elastic.co/t/100-cpu-after-the-upgrade-from-7-6-1-to-7-8-1/244822)
**Author:** [@Jehu\_T](https://discuss.elastic.co/u/Jehu_T)\ **Replies:** 5\ **Last updated:** [September 30, 2020, 10:29am UTC](https://discuss.elastic.co/t/100-cpu-after-the-upgrade-from-7-6-1-to-7-8-1/244822 "2020-09-30T10:29:57Z")
Hi, After upgrading to Elasticsearch 7.8.1 from 7.6.1, the CPU usage is reaching 100% most of the time on all 4 nodes. We didn't have this issue before the upgrade. The GC is almost 0% after the upgrade. It was noticed… --- ## [How to add a column that includes a mathematical operation](https://discuss.elastic.co/t/how-to-add-a-column-that-includes-a-mathematical-operation/250370)
**Author:** [@Max\_Handle](https://discuss.elastic.co/u/Max_Handle)\ **Replies:** 1\ **Last updated:** [September 30, 2020, 10:27am UTC](https://discuss.elastic.co/t/how-to-add-a-column-that-includes-a-mathematical-operation/250370 "2020-09-30T10:27:35Z")
Hi, I am trying to create a column that calculates the average Session Percentage. The operation is quite simple: take the session Total of each row and divide it by the overall session total. So in this case the "Sessi… --- ## [Script sorting](https://discuss.elastic.co/t/script-sorting/250338)
**Author:** [@flatmap101](https://discuss.elastic.co/u/flatmap101)\ **Replies:** 4\ **Last updated:** [September 30, 2020, 10:19am UTC](https://discuss.elastic.co/t/script-sorting/250338 "2020-09-30T10:19:20Z")
hi all! i am getting some very strange behavior while using scripted sorting. the script itself looks approximately like that: if (doc\['fieldName1'\].size() != 0 && doc\['fieldName2'\].size() != 0) { // 1 - might not be … --- ## [Use Script to Autogenerate Reports is not working](https://discuss.elastic.co/t/use-script-to-autogenerate-reports-is-not-working/250462)
**Author:** [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)\ **Replies:** 6\ **Last updated:** [September 30, 2020, 10:09am UTC](https://discuss.elastic.co/t/use-script-to-autogenerate-reports-is-not-working/250462 "2020-09-30T10:09:45Z")
Hi Team, As per the steps given in the documentation using Curl user should be able to generate reports using custom script. I tried the below curl command by following the steps given in the document , it's throwing … --- ## [Logstash.conf filter doesn't work](https://discuss.elastic.co/t/logstash-conf-filter-doesnt-work/250091)
**Author:** [@zen.xen](https://discuss.elastic.co/u/zen.xen)\ **Replies:** 14\ **Last updated:** [September 30, 2020, 9:58am UTC](https://discuss.elastic.co/t/logstash-conf-filter-doesnt-work/250091 "2020-09-30T09:58:03Z")
Hello, I want to send events from my .log file with filebeat. I have created such filter but it doesn't work. input { beats { port =\> "5044" } } filter { grok { match =\> { "message" =\> "(%{TIMESTA… --- ## [Logs sent repeatedly to Elastic Search when updated from host machine of filebeat container!](https://discuss.elastic.co/t/logs-sent-repeatedly-to-elastic-search-when-updated-from-host-machine-of-filebeat-container/250409)
**Author:** [@jaraws](https://discuss.elastic.co/u/jaraws)\ **Replies:** 1\ **Last updated:** [September 30, 2020, 9:42am UTC](https://discuss.elastic.co/t/logs-sent-repeatedly-to-elastic-search-when-updated-from-host-machine-of-filebeat-container/250409 "2020-09-30T09:42:41Z")
Hi, I am running filebeat container using the following command: docker run -d \\ --name=filebeat \\ --user=root \\ --volume="$(pwd)/filebeat-file.yml:/usr/share/filebeat/filebeat.yml:ro" \\ --volume="$(pwd)/apps/l… --- ## [Update indexed data based on a value from a new record still does not indexed](https://discuss.elastic.co/t/update-indexed-data-based-on-a-value-from-a-new-record-still-does-not-indexed/250429)
**Author:** [@Marcelo\_Lavor](https://discuss.elastic.co/u/Marcelo_Lavor)\ **Replies:** 2\ **Last updated:** [September 30, 2020, 9:34am UTC](https://discuss.elastic.co/t/update-indexed-data-based-on-a-value-from-a-new-record-still-does-not-indexed/250429 "2020-09-30T09:34:08Z")
Hello! I need to update a field of several records already indexed based on a value from a new record still not indexed? Is there any way to implement it? Thanks Marcelo --- ## [Case Heavy load : How we can search all search request cancellable to cancellation](https://discuss.elastic.co/t/case-heavy-load-how-we-can-search-all-search-request-cancellable-to-cancellation/250472)
**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\ **Replies:** 3\ **Last updated:** [September 30, 2020, 9:38am UTC](https://discuss.elastic.co/t/case-heavy-load-how-we-can-search-all-search-request-cancellable-to-cancellation/250472 "2020-09-30T09:38:17Z")
Hello, Maybe our cluster become unreacheable or with high latency. I personally believe that tasks cancellation can be help to decrease load in cluster ? I try this : GET /\_cat/thread\_pool/search?v&h=node\_name,name,a… --- ## [How to Cleanup Full Disk on Elasticsearch Node while Elasticsearch is not running](https://discuss.elastic.co/t/how-to-cleanup-full-disk-on-elasticsearch-node-while-elasticsearch-is-not-running/249640)
**Author:** [@Rohail\_Abbas](https://discuss.elastic.co/u/Rohail_Abbas)\ **Replies:** 5\ **Last updated:** [September 30, 2020, 9:36am UTC](https://discuss.elastic.co/t/how-to-cleanup-full-disk-on-elasticsearch-node-while-elasticsearch-is-not-running/249640 "2020-09-30T09:36:06Z")
I have Elasticsearch 7.4 with 1 master and 5 data nodes (Amazon ec2 instances). I have cluster.routing.allocation.disk.threshold\_enabled setting = false Now one of the disk in a node became full and elasticsearch stopped… --- ## [Failed to hash executable](https://discuss.elastic.co/t/failed-to-hash-executable/250469)
**Author:** [@Burga](https://discuss.elastic.co/u/Burga)\ **Replies:** 0\ **Last updated:** [September 30, 2020, 8:36am UTC](https://discuss.elastic.co/t/failed-to-hash-executable/250469 "2020-09-30T08:36:32Z")
Hi , I installed auditbeat where oracle DB is existing, now I'm getting a warning message : failed to hash executable /oracle/12.2/home/bin/oracle for PID 32167: failed to hash file /oracle/12.2/home/bin/oracle: hashe… --- ## [Elasticsearch maintenance procedure](https://discuss.elastic.co/t/elasticsearch-maintenance-procedure/250465)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 1\ **Last updated:** [September 30, 2020, 8:25am UTC](https://discuss.elastic.co/t/elasticsearch-maintenance-procedure/250465 "2020-09-30T08:25:08Z")
hi all, I'm starting to think about the correct procedure to apply security patches on the ES nodes (OS: CentOS). I have several clusters with different purpose but I focused on the most important; this cluster is comp… --- ## [Custom variables in Kibana Alerts](https://discuss.elastic.co/t/custom-variables-in-kibana-alerts/249986)
**Author:** [@Ankur\_Mahajan](https://discuss.elastic.co/u/Ankur_Mahajan)\ **Replies:** 15\ **Last updated:** [September 30, 2020, 7:35am UTC](https://discuss.elastic.co/t/custom-variables-in-kibana-alerts/249986 "2020-09-30T07:35:31Z")
I am exploring alerts and connectors in Kibana. I can configure and test them perfectly but I am unable to use the custom variable present in metricbeat, filebeat or any other beat module index. Let me explain this by an… --- ## [Unable to initialize Ingest Manager behind proxy](https://discuss.elastic.co/t/unable-to-initialize-ingest-manager-behind-proxy/246255)
**Author:** [@iorfix](https://discuss.elastic.co/u/iorfix)\ **Replies:** 4\ **Last updated:** [September 30, 2020, 7:11am UTC](https://discuss.elastic.co/t/unable-to-initialize-ingest-manager-behind-proxy/246255 "2020-09-30T07:11:13Z")
Hi, I tried to use new beta Ingest Manager functionality. However, I got this error in Kibana when launching it: Unable to initialize Ingest Manager Error connecting to package registry at https://epr-7-9.elastic.co/s… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1776) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1778)