# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1819 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1820 --- ## [Force Filebeat to re process a file](https://discuss.elastic.co/t/force-filebeat-to-re-process-a-file/247901)
**Author:** [@Jackson](https://discuss.elastic.co/u/Jackson)\ **Replies:** 0\ **Last updated:** [September 8, 2020, 1:59pm UTC](https://discuss.elastic.co/t/force-filebeat-to-re-process-a-file/247901 "2020-09-08T13:59:08Z")
Hello, I added a new file on the filebeat.yml. It went into elastic but some of the fields were not parsed correctly. This file is only updated once per day at 9AM. I modified the filebeat.yml to properly parse the fil… --- ## [Wrong Kibana timestamp](https://discuss.elastic.co/t/wrong-kibana-timestamp/247174)
**Author:** [@bornatalebi](https://discuss.elastic.co/u/bornatalebi)\ **Replies:** 6\ **Last updated:** [September 8, 2020, 2:07pm UTC](https://discuss.elastic.co/t/wrong-kibana-timestamp/247174 "2020-09-08T14:07:18Z")
Hello, I have a filebeat running on the same node as my ELK (single node cluster) and the timestamp shown in discover tab is +4:30 which is same as my timezone. for example this doc timestamp is : but when i querry… --- ## [Kibana 7.9 - loops back to default space selection](https://discuss.elastic.co/t/kibana-7-9-loops-back-to-default-space-selection/246996)
**Author:** [@Avinash\_D\_Silva](https://discuss.elastic.co/u/Avinash_D_Silva)\ **Replies:** 3\ **Last updated:** [September 8, 2020, 2:03pm UTC](https://discuss.elastic.co/t/kibana-7-9-loops-back-to-default-space-selection/246996 "2020-09-08T14:03:14Z")
I have installed elasticsearch by extracting the latest 7.9 version tar.gz method, I feel this is by the simplest method out there then install kibana using yum install, both are version 7.9 this is the issue: https://… --- ## [How to replace field value when it equals "-"](https://discuss.elastic.co/t/how-to-replace-field-value-when-it-equals/247899)
**Author:** [@gbasic](https://discuss.elastic.co/u/gbasic)\ **Replies:** 0\ **Last updated:** [September 8, 2020, 1:29pm UTC](https://discuss.elastic.co/t/how-to-replace-field-value-when-it-equals/247899 "2020-09-08T13:29:51Z")
How to check if fields in "Data" are equal to "-" and if so change them to something else. This is my data (There are multiple cities in this JSON file with the same fields): { "@version" =\> "1", "@timestamp" … --- ## [Kibana 7.9 keystore permissions error](https://discuss.elastic.co/t/kibana-7-9-keystore-permissions-error/247854)
**Author:** [@AleksandrN](https://discuss.elastic.co/u/AleksandrN)\ **Replies:** 0\ **Last updated:** [September 8, 2020, 9:13am UTC](https://discuss.elastic.co/t/kibana-7-9-keystore-permissions-error/247854 "2020-09-08T09:13:38Z")
I have installed a fresh kibana on CentOS 7 via yum (rpm) and when I'm trying to add entity to a keystore, I get an error: /usr/share/kibana/bin/kibana-keystore add server.ssl.keyPassphrase Enter value for serve… --- ## [Meteicbeat socket\_summary metricset not reult syn\_sent, fin\_wait](https://discuss.elastic.co/t/meteicbeat-socket-summary-metricset-not-reult-syn-sent-fin-wait/247892)
**Author:** [@ryanda\_pratama](https://discuss.elastic.co/u/ryanda_pratama)\ **Replies:** 0\ **Last updated:** [September 8, 2020, 12:32pm UTC](https://discuss.elastic.co/t/meteicbeat-socket-summary-metricset-not-reult-syn-sent-fin-wait/247892 "2020-09-08T12:32:38Z")
Hello, How to get more result of tcp state connection with metricbeat. Now the result just listen, established, close\_wait, time\_wait. As i see on github, the socket summary.go able to get syn\_sent, fin\_wait etc. Thank… --- ## [Java stack trace - Multiline config](https://discuss.elastic.co/t/java-stack-trace-multiline-config/247889)
**Author:** [@sidiney.crescencio](https://discuss.elastic.co/u/sidiney.crescencio)\ **Replies:** 0\ **Last updated:** [September 8, 2020, 12:22pm UTC](https://discuss.elastic.co/t/java-stack-trace-multiline-config/247889 "2020-09-08T12:22:26Z")
Hello, I'm trying to configure a multiline pattern to get any exceptions in my application logs, unfortunately I haven't been able yet to find a good pattern. Sample logs 2020-09-08 13:24:13.406 INFO 17739 --- \[ \] c… --- ## [Elasticsearch CURL Query](https://discuss.elastic.co/t/elasticsearch-curl-query/247537)
**Author:** [@Cyril\_Guiet](https://discuss.elastic.co/u/Cyril_Guiet)\ **Replies:** 6\ **Last updated:** [September 8, 2020, 12:19pm UTC](https://discuss.elastic.co/t/elasticsearch-curl-query/247537 "2020-09-08T12:19:52Z")
Hi all ! I'm trying to merge multiple search query in ES but the result had no enough informations to match searched objects with results. How can I do that ? Thanks :slight\_smile: query sample: curl -X GET "localho… --- ## [Does not contain a definition for 'Type' in ASP.NET MVC Elasticsearch](https://discuss.elastic.co/t/does-not-contain-a-definition-for-type-in-asp-net-mvc-elasticsearch/247830)
**Author:** [@Zylne](https://discuss.elastic.co/u/Zylne)\ **Replies:** 1\ **Last updated:** [September 8, 2020, 12:10pm UTC](https://discuss.elastic.co/t/does-not-contain-a-definition-for-type-in-asp-net-mvc-elasticsearch/247830 "2020-09-08T12:10:09Z")
I want to create a search on "user" index with ASP.NET MVC. DataSearch Action Method: public JsonResult DataSearch(string name) { var responsedata = \_connectionToEs.EsClient().Search\(s =\> s … --- ## [How to check whether user authorized or not when onChange of route event in kibana 7.8 OSS version](https://discuss.elastic.co/t/how-to-check-whether-user-authorized-or-not-when-onchange-of-route-event-in-kibana-7-8-oss-version/247265)
**Author:** [@Jayanth\_Mogadampalli](https://discuss.elastic.co/u/Jayanth_Mogadampalli)\ **Replies:** 6\ **Last updated:** [September 8, 2020, 11:45am UTC](https://discuss.elastic.co/t/how-to-check-whether-user-authorized-or-not-when-onchange-of-route-event-in-kibana-7-8-oss-version/247265 "2020-09-08T11:45:23Z")
Right now, I am using elastic/kibana 7.8 OSS version code I am trying to implement authentication using Google auth by developing a plugin. Now for protecting routes, how to listen to route changes in kibana from a plu… --- ## [Field boost changes in ElasticSearch version7.6.2](https://discuss.elastic.co/t/field-boost-changes-in-elasticsearch-version7-6-2/247882)
**Author:** [@Barkha\_Jain](https://discuss.elastic.co/u/Barkha_Jain)\ **Replies:** 0\ **Last updated:** [September 8, 2020, 11:39am UTC](https://discuss.elastic.co/t/field-boost-changes-in-elasticsearch-version7-6-2/247882 "2020-09-08T11:39:49Z")
We recently moved to ElasticSearch version 7.6.2 from version 6.2.3 The search query that we use has field boosts applied in different match queries. I was looking into the changes related to scoring of docs in the new … --- ## [Logstash is restarting automatucally with high CPU usage](https://discuss.elastic.co/t/logstash-is-restarting-automatucally-with-high-cpu-usage/246617)
**Author:** [@Tirtharaj\_Karbotkar](https://discuss.elastic.co/u/Tirtharaj_Karbotkar)\ **Replies:** 5\ **Last updated:** [September 8, 2020, 10:39am UTC](https://discuss.elastic.co/t/logstash-is-restarting-automatucally-with-high-cpu-usage/246617 "2020-09-08T10:39:50Z")
Hi, i am trying to run logstash using the below command. sudo systemctl start logstash.service From below logs we can see that logstash service is started than it is stopped and restarted again. \[2020-08-27T11:56:24… --- ## [Region Map OR Map in Kibana doesn't show India Region correctly](https://discuss.elastic.co/t/region-map-or-map-in-kibana-doesnt-show-india-region-correctly/247532)
**Author:** [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)\ **Replies:** 3\ **Last updated:** [September 8, 2020, 10:07am UTC](https://discuss.elastic.co/t/region-map-or-map-in-kibana-doesnt-show-india-region-correctly/247532 "2020-09-08T10:07:54Z")
Hi Team, I have created a visualization to show the number of hits coming from different regions using Maps visualization available in Kibana. Map is not showing India correctly, it has POK(Pakistan occupied Kashmir) … --- ## [Match nested and search another value inside with more data](https://discuss.elastic.co/t/match-nested-and-search-another-value-inside-with-more-data/246743)
**Author:** [@pkly](https://discuss.elastic.co/u/pkly)\ **Replies:** 1\ **Last updated:** [September 8, 2020, 10:07am UTC](https://discuss.elastic.co/t/match-nested-and-search-another-value-inside-with-more-data/246743 "2020-09-08T10:07:46Z")
Hi, sorry if you get this question a lot but I don't think my queries are working the way I'd expect them to. I have a nested object (let's call it tags) that looks like this: \[{"index":"en", "data": "tag\_1"}, {"index"… --- ## [Build logstash deb-package manually from source](https://discuss.elastic.co/t/build-logstash-deb-package-manually-from-source/247867)
**Author:** [@Maxim\_Lavrovichev](https://discuss.elastic.co/u/Maxim_Lavrovichev)\ **Replies:** 0\ **Last updated:** [September 8, 2020, 10:03am UTC](https://discuss.elastic.co/t/build-logstash-deb-package-manually-from-source/247867 "2020-09-08T10:03:07Z")
Hello, I need to build a deb-package from source code of logstash (https://artifacts.elastic.co/downloads/logstash/logstash-oss-6.7.2.tar.gz). Have you any official instructions for packaging and actual debian scripts(d… --- ## [Optimal configuration of the ES cluster](https://discuss.elastic.co/t/optimal-configuration-of-the-es-cluster/247825)
**Author:** [@IliaIsakhin](https://discuss.elastic.co/u/IliaIsakhin)\ **Replies:** 7\ **Last updated:** [September 8, 2020, 9:36am UTC](https://discuss.elastic.co/t/optimal-configuration-of-the-es-cluster/247825 "2020-09-08T09:36:40Z")
Hello! My ES 7.8.0 cluster contains 5 nodes with 120 GB heap memory and 32 CPU in it. Also, I have pretty large index with 6.6kk docs and, according to \_cat/indices/ API, with store.size 59.8gb and pri.store.size 30.1gb… --- ## [Email reporting Attachment](https://discuss.elastic.co/t/email-reporting-attachment/247676)
**Author:** [@Kirtash](https://discuss.elastic.co/u/Kirtash)\ **Replies:** 4\ **Last updated:** [September 8, 2020, 9:32am UTC](https://discuss.elastic.co/t/email-reporting-attachment/247676 "2020-09-08T09:32:36Z")
Hi everyone!!! I'm working with elasticCloud and I have been created alerts but in the documentation appears that I can attach a report from Kibana, but in the email action not appears the option, is normal? I can modi… --- ## [Increased heap usage after updating from 7.2.0 =\> 7.8.0](https://discuss.elastic.co/t/increased-heap-usage-after-updating-from-7-2-0-7-8-0/247510)
**Author:** [@7ca884569f2642e2c488](https://discuss.elastic.co/u/7ca884569f2642e2c488)\ **Replies:** 2\ **Last updated:** [September 8, 2020, 8:53am UTC](https://discuss.elastic.co/t/increased-heap-usage-after-updating-from-7-2-0-7-8-0/247510 "2020-09-08T08:53:31Z")
We updated our elastic (5 servers, two nodes each) from 7.2.0 to 7.8.0 and noticed that from this moment some new errors of type CircuitBreakingException started to occure and heap size can touch now 90-100% of available… --- ## [Metricbeat 6.8.12 xpack.enabled for Logstash module](https://discuss.elastic.co/t/metricbeat-6-8-12-xpack-enabled-for-logstash-module/247849)
**Author:** [@Di\_Croatiano](https://discuss.elastic.co/u/Di_Croatiano)\ **Replies:** 0\ **Last updated:** [September 8, 2020, 8:43am UTC](https://discuss.elastic.co/t/metricbeat-6-8-12-xpack-enabled-for-logstash-module/247849 "2020-09-08T08:43:05Z")
Greetings! I was reading a docs about Metricbeat modules, searching for ELK modules configuration. Finding an option for Elasticsearch and Kibana and how easy is to collect and show metric data in Elastic Stack monitori… --- ## [Can't see data from rollup index on visualizations](https://discuss.elastic.co/t/cant-see-data-from-rollup-index-on-visualizations/247060)
**Author:** [@Danylo](https://discuss.elastic.co/u/Danylo)\ **Replies:** 2\ **Last updated:** [September 8, 2020, 8:41am UTC](https://discuss.elastic.co/t/cant-see-data-from-rollup-index-on-visualizations/247060 "2020-09-08T08:41:48Z")
Hi. I have elastic and kibana 7.8.0. I created few rollup jobs for get my old data more smaller and that jobs seems to b working in correct way. I can see this data on Discover page, but once I go to create any visualiza… --- ## [Multiple inputs for Filebeat](https://discuss.elastic.co/t/multiple-inputs-for-filebeat/247519)
**Author:** [@Sid](https://discuss.elastic.co/u/Sid)\ **Replies:** 2\ **Last updated:** [September 8, 2020, 8:33am UTC](https://discuss.elastic.co/t/multiple-inputs-for-filebeat/247519 "2020-09-08T08:33:47Z")
Is it possible in Filebeat to have multiple log sources as inputs and indexed into different Elasticsearch indices? Suppose I have apache access logs & mysql logs. How to enable filebeat modules for apache and mysql ava… --- ## [Query String with Fuzzy search using ~ operator](https://discuss.elastic.co/t/query-string-with-fuzzy-search-using-operator/247844)
**Author:** [@learning21](https://discuss.elastic.co/u/learning21)\ **Replies:** 0\ **Last updated:** [September 8, 2020, 8:20am UTC](https://discuss.elastic.co/t/query-string-with-fuzzy-search-using-operator/247844 "2020-09-08T08:20:08Z")
Hi, I am referring to this and am able to perform a fuzzy search with query\_string in kibana. In kibana "salry~" is being searched and it returns results with "salary" due to ~ operator for fuzziness. GET help/\_se… --- ## [Modify Beats Output](https://discuss.elastic.co/t/modify-beats-output/247841)
**Author:** [@ajesh](https://discuss.elastic.co/u/ajesh)\ **Replies:** 0\ **Last updated:** [September 8, 2020, 8:06am UTC](https://discuss.elastic.co/t/modify-beats-output/247841 "2020-09-08T08:06:36Z")
Hi There, I have two queries regarding the beats event output If i install winlobeat and auditbeat on the same machine , In the SIEM host table i am getting two hosts as below (one with Just hostname and other with fq… --- ## [Multiple lines and more than one scale in one graph. How?](https://discuss.elastic.co/t/multiple-lines-and-more-than-one-scale-in-one-graph-how/247828)
**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\ **Replies:** 1\ **Last updated:** [September 8, 2020, 7:34am UTC](https://discuss.elastic.co/t/multiple-lines-and-more-than-one-scale-in-one-graph-how/247828 "2020-09-08T07:34:39Z")
Hi, is it possible with Kibana to achieve a chart like this: Requirements: Multiple lines of different sources More than one Y-Scale Is it possible to display data from different indices in one chart? Thanks de… --- ## [Keep order of xml in Logstash](https://discuss.elastic.co/t/keep-order-of-xml-in-logstash/247831)
**Author:** [@\_Louw](https://discuss.elastic.co/u/_Louw)\ **Replies:** 0\ **Last updated:** [September 8, 2020, 7:25am UTC](https://discuss.elastic.co/t/keep-order-of-xml-in-logstash/247831 "2020-09-08T07:25:03Z")
I am parsing XML-input in Logstash, and I need to keep the sorting of it, as it is relevant. Example xml: \ \ \ \ **Author:** [@Fred59](https://discuss.elastic.co/u/Fred59)\ **Replies:** 2\ **Last updated:** [September 8, 2020, 6:46am UTC](https://discuss.elastic.co/t/replace-string-by-another-in-a-field/247780 "2020-09-08T06:46:37Z") Hello, On Kibana 6.8.12 I want to replace a string in a field by another string. This string to replace appears many times. I want make this query 5 times for the 5 changes : But i have this result with the query … --- ## [ClassCastException MappingMetaData - Java](https://discuss.elastic.co/t/classcastexception-mappingmetadata-java/247747)
**Author:** [@dinit](https://discuss.elastic.co/u/dinit)\ **Replies:** 1\ **Last updated:** [September 8, 2020, 6:17am UTC](https://discuss.elastic.co/t/classcastexception-mappingmetadata-java/247747 "2020-09-08T06:17:20Z")
Hey, I'm writing a Java application wicht reads all fields from my index at startup. Since I updated to EL 7.6.1 I get the following error: java.lang.ClassCastException: org.elasticsearch.cluster.metadata.MappingMetad… --- ## [Security configuration](https://discuss.elastic.co/t/security-configuration/247821)
**Author:** [@pjanzen](https://discuss.elastic.co/u/pjanzen)\ **Replies:** 2\ **Last updated:** [September 8, 2020, 6:06am UTC](https://discuss.elastic.co/t/security-configuration/247821 "2020-09-08T06:06:43Z")
Hi All, I have enabled security (premium license) wich is working fine. My cluster consists of: 2 kibana nodes 3 master nodes 4 coordinator nodes 20 data nodes Current I have the same security configuration deploye… --- ## [How to prevent shards of new index from assigning on only a few nodes and spread it?](https://discuss.elastic.co/t/how-to-prevent-shards-of-new-index-from-assigning-on-only-a-few-nodes-and-spread-it/247816)
**Author:** [@Lee\_Sun\_Ro](https://discuss.elastic.co/u/Lee_Sun_Ro)\ **Replies:** 6\ **Last updated:** [September 8, 2020, 5:52am UTC](https://discuss.elastic.co/t/how-to-prevent-shards-of-new-index-from-assigning-on-only-a-few-nodes-and-spread-it/247816 "2020-09-08T05:52:01Z")
When a new daily index is created, shards tend to be allocated only to a few nodes with sufficient capacity. It occurs rejected operation because these nodes take every incoming request. I want to prevent shards from… --- ## [Logs duplication](https://discuss.elastic.co/t/logs-duplication/247795)
**Author:** [@KOTOXJle6](https://discuss.elastic.co/u/KOTOXJle6)\ **Replies:** 2\ **Last updated:** [September 8, 2020, 5:12am UTC](https://discuss.elastic.co/t/logs-duplication/247795 "2020-09-08T05:12:42Z")
Hello everyone! Suddenly, the elastic began to double logs. Each log falls into its own index and the duplicate falls into the unkown\_messages index. It seems that this started after adding new indexes, but rolling back… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1818) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1820)