# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1836 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1837 --- ## [Which nodes should be provided in logstash](https://discuss.elastic.co/t/which-nodes-should-be-provided-in-logstash/246868)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 1\ **Last updated:** [August 30, 2020, 11:24am UTC](https://discuss.elastic.co/t/which-nodes-should-be-provided-in-logstash/246868 "2020-08-30T11:24:41Z")
Hi All, We have a cluster 6 nodes (1 coordinating node, 5 data node out of which 3 are master node) Can you please suggest which node needs to be provided in logstash file, should we give all the nodes of cluster or on… --- ## [Starting logstash with grok](https://discuss.elastic.co/t/starting-logstash-with-grok/246877)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 1\ **Last updated:** [August 30, 2020, 11:30am UTC](https://discuss.elastic.co/t/starting-logstash-with-grok/246877 "2020-08-30T11:30:03Z")
EDIT: Solved - had to escape " in CMD=\\"%{DATA:Command}\\ I'm trying to start logstash with a new config and it just fails. This is the line I'm trying to add: match =\> { "message" =\> "\\A%{SYSLOGTIMESTAMP:sys\_timestamp… --- ## [Elastic Aggregation: How to analyze the aggregation within an analyzed aggregation](https://discuss.elastic.co/t/elastic-aggregation-how-to-analyze-the-aggregation-within-an-analyzed-aggregation/246871)
**Author:** [@Ubeta](https://discuss.elastic.co/u/Ubeta)\ **Replies:** 0\ **Last updated:** [August 30, 2020, 10:13am UTC](https://discuss.elastic.co/t/elastic-aggregation-how-to-analyze-the-aggregation-within-an-analyzed-aggregation/246871 "2020-08-30T10:13:52Z")
I am trying to use an analyzer within a analzyer on a field and get it's aggregation if that makes sense. eg. Field1.value: 'A01/00 | A02/01 | B01/00' Field2.value: 'A01/01 | C02/01 | D01/00' Currently, I have a custo… --- ## [Metricbeat AWS module on Kubernetes error](https://discuss.elastic.co/t/metricbeat-aws-module-on-kubernetes-error/246685)
**Author:** [@fgjensen](https://discuss.elastic.co/u/fgjensen)\ **Replies:** 2\ **Last updated:** [August 30, 2020, 9:04am UTC](https://discuss.elastic.co/t/metricbeat-aws-module-on-kubernetes-error/246685 "2020-08-30T09:04:14Z")
Hello, We have enabled the AWS module on a metricbeat on Kubernetes. The beat starts, but fails with the error message 2020-08-27T18:50:39.511Z ERROR instance/beat.go:958 Exiting: 1 error: metricset 'aws/ec2' not found. … --- ## [Multiple match in one grok {}](https://discuss.elastic.co/t/multiple-match-in-one-grok/246569)
**Author:** [@shani](https://discuss.elastic.co/u/shani)\ **Replies:** 6\ **Last updated:** [August 30, 2020, 8:46am UTC](https://discuss.elastic.co/t/multiple-match-in-one-grok/246569 "2020-08-30T08:46:09Z")
Hi All, I want to match multiple different fields using GROK, this doesn't work grok { match =\> { "winlog\_subject" =\> "Subject:\\\\nSecurity ID:%{DATA:\[winlog\]\[event\_data\]\[SubjectUserSid\]}\\\\nAcc… --- ## [Table visualization to compare documents in same index](https://discuss.elastic.co/t/table-visualization-to-compare-documents-in-same-index/246379)
**Author:** [@singhabhisek](https://discuss.elastic.co/u/singhabhisek)\ **Replies:** 3\ **Last updated:** [August 30, 2020, 8:21am UTC](https://discuss.elastic.co/t/table-visualization-to-compare-documents-in-same-index/246379 "2020-08-30T08:21:05Z")
Hi Team, I have a single index in which I have multiple documents having same data structure. Basically I want to compare the two or more documents based on the application filter (or more filters) provided by the user.… --- ## [Is it safe to expose Elasticsearch to the Internet?](https://discuss.elastic.co/t/is-it-safe-to-expose-elasticsearch-to-the-internet/246862)
**Author:** [@dansei](https://discuss.elastic.co/u/dansei)\ **Replies:** 4\ **Last updated:** [August 30, 2020, 7:26am UTC](https://discuss.elastic.co/t/is-it-safe-to-expose-elasticsearch-to-the-internet/246862 "2020-08-30T07:26:55Z")
If you search the web for info on publicly-accessible Elasticsearch instances, you'll find a lot of articles about ransomware attacks in which databases were hijacked. You'll find this DZone article from 2017 that says … --- ## [Elasticsearch configuration is Failing](https://discuss.elastic.co/t/elasticsearch-configuration-is-failing/246863)
**Author:** [@Vinit\_Kumar](https://discuss.elastic.co/u/Vinit_Kumar)\ **Replies:** 0\ **Last updated:** [August 30, 2020, 5:01am UTC](https://discuss.elastic.co/t/elasticsearch-configuration-is-failing/246863 "2020-08-30T05:01:15Z")
Hi all, Need your help. I have integrated Camunda BPM in my spring boot application with MySQL (to store Camunda varibales and data) and elasticsearch (to store real business application data), and it was working file. … --- ## [Snapshot delete understanding](https://discuss.elastic.co/t/snapshot-delete-understanding/246783)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 6\ **Last updated:** [August 30, 2020, 2:11am UTC](https://discuss.elastic.co/t/snapshot-delete-understanding/246783 "2020-08-30T02:11:57Z")
Lets say when I run first snapshot it creates full backup and my snapshot name is 08-29-2020 now I created another one tomorrow and by default it will do incremental named 8-30-2020 now I created third one which will … --- ## [Elastic dump creates index, but index not found in elastic search](https://discuss.elastic.co/t/elastic-dump-creates-index-but-index-not-found-in-elastic-search/246830)
**Author:** [@Rahul\_Seetharaman](https://discuss.elastic.co/u/Rahul_Seetharaman)\ **Replies:** 2\ **Last updated:** [August 29, 2020, 10:55pm UTC](https://discuss.elastic.co/t/elastic-dump-creates-index-but-index-not-found-in-elastic-search/246830 "2020-08-29T22:55:11Z")
I am using the elastic dump command to push my data to Elasticsearch running locally on port 9200. While elasticdump command itself does not give any error, while doing curl localhost:9200/{index\_name} I get the follo… --- ## [Logstash is sending garbage value to ES](https://discuss.elastic.co/t/logstash-is-sending-garbage-value-to-es/246658)
**Author:** [@Himanshii](https://discuss.elastic.co/u/Himanshii)\ **Replies:** 5\ **Last updated:** [August 29, 2020, 9:12pm UTC](https://discuss.elastic.co/t/logstash-is-sending-garbage-value-to-es/246658 "2020-08-29T21:12:13Z")
I'm using Logstash to read data from Oracle DB & ingesting it into a Kafka topic, then reading the data from the topic & ingesting it into ES (basically Oracle -\> Kafka, Kafka -\> ES). The query used is capturing data for… --- ## [Elastic search entry has JSON escaped in the message field](https://discuss.elastic.co/t/elastic-search-entry-has-json-escaped-in-the-message-field/246856)
**Author:** [@jordanr](https://discuss.elastic.co/u/jordanr)\ **Replies:** 0\ **Last updated:** [August 29, 2020, 8:43pm UTC](https://discuss.elastic.co/t/elastic-search-entry-has-json-escaped-in-the-message-field/246856 "2020-08-29T20:43:27Z")
Good afternoon, we are configuring our elastic search stack and struggling with getting the message inside elastic search to reflect the format we desire. We have php logs going to standard out, and the message is corre… --- ## [\\n as newline in Kibana](https://discuss.elastic.co/t/n-as-newline-in-kibana/246813)
**Author:** [@AditiKhalatkar](https://discuss.elastic.co/u/AditiKhalatkar)\ **Replies:** 2\ **Last updated:** [August 29, 2020, 8:05pm UTC](https://discuss.elastic.co/t/n-as-newline-in-kibana/246813 "2020-08-29T20:05:55Z")
I have a value for a field in Elasticsearch as "a \\n b", need to display this in Kibana as "a b" It is storing in Elasticsearch as "a \\n b", any way I can display multiline within a particular field, trying to fetch a… --- ## [First time trying to run elk with docker-compose](https://discuss.elastic.co/t/first-time-trying-to-run-elk-with-docker-compose/246368)
**Author:** [@leostereo](https://discuss.elastic.co/u/leostereo)\ **Replies:** 8\ **Last updated:** [August 29, 2020, 5:53pm UTC](https://discuss.elastic.co/t/first-time-trying-to-run-elk-with-docker-compose/246368 "2020-08-29T17:53:20Z")
Hi guys, im very interested setting up a centralized log server using docker / docker-compose: After following oficial , and no oficial documentation: https://www.elastic.co/guide/en/elastic-stack-get-started/current/g… --- ## [Grabbing UDP data stream with Beats?](https://discuss.elastic.co/t/grabbing-udp-data-stream-with-beats/246756)
**Author:** [@dewell](https://discuss.elastic.co/u/dewell)\ **Replies:** 1\ **Last updated:** [August 29, 2020, 3:43pm UTC](https://discuss.elastic.co/t/grabbing-udp-data-stream-with-beats/246756 "2020-08-29T15:43:24Z")
Hello, I read now a lot about logstash and beats and I'm still insecure what's the easiest way to get my data into elasticsearch. It seems filebeat supports UDP so I started with that. Intuitively I assumed packetbeat wo… --- ## [Filebeat Multiline Config Help](https://discuss.elastic.co/t/filebeat-multiline-config-help/246667)
**Author:** [@userR](https://discuss.elastic.co/u/userR)\ **Replies:** 1\ **Last updated:** [August 29, 2020, 3:34pm UTC](https://discuss.elastic.co/t/filebeat-multiline-config-help/246667 "2020-08-29T15:34:48Z")
Log start: Aug 24 03:32:21 Filebeat Multiline: multiline.pattern: ^\[\[A-Z\]\[a-z\]{3} \[0-9\]{2} \[0-9\]{2}:\[0-9\]{2}:\[0-9\]{2} Logstash date filter: "MMM dd HH:mm:ss" For some reason, my Filebeat multiline pattern does n… --- ## [Updating document in elasticsearch](https://discuss.elastic.co/t/updating-document-in-elasticsearch/246587)
**Author:** [@pksinghal](https://discuss.elastic.co/u/pksinghal)\ **Replies:** 1\ **Last updated:** [August 29, 2020, 2:55pm UTC](https://discuss.elastic.co/t/updating-document-in-elasticsearch/246587 "2020-08-29T14:55:35Z")
Hi, We are indexing user profile data to elasticsearch. We are creating monthly index and indexing user to a particular index based on user last visit. So whenever a user visits, we first check user data in elasticsear… --- ## [Error on Logstash pipeline](https://discuss.elastic.co/t/error-on-logstash-pipeline/246831)
**Author:** [@zellu\_rakib](https://discuss.elastic.co/u/zellu_rakib)\ **Replies:** 1\ **Last updated:** [August 29, 2020, 2:44pm UTC](https://discuss.elastic.co/t/error-on-logstash-pipeline/246831 "2020-08-29T14:44:09Z")
what is the error on this pipeline: input { jdbc { jdbc\_driver\_library =\> "/mysql-connector-java-8.0.21.jar" jdbc\_driver\_class =\> "com.mysql.jdbc.Driver" jdbc\_connection\_string =\> "jdbc:mysql://74.117.156.179:3306/e… --- ## [How to write in query](https://discuss.elastic.co/t/how-to-write-in-query/246844)
**Author:** [@zellu\_rakib](https://discuss.elastic.co/u/zellu_rakib)\ **Replies:** 1\ **Last updated:** [August 29, 2020, 2:00pm UTC](https://discuss.elastic.co/t/how-to-write-in-query/246844 "2020-08-29T14:00:35Z")
I want to write this mysql query on my ES. select c.\* ,u.name as createrName,cj.job\_title as Jobtitle,u.avathar,u.avatar\_color,u.email as createrEmail from candidates as c inner join candidate\_jobs as cj on cj.candidate… --- ## [Import Kibana saved objects to same space](https://discuss.elastic.co/t/import-kibana-saved-objects-to-same-space/246798)
**Author:** [@atharvak](https://discuss.elastic.co/u/atharvak)\ **Replies:** 3\ **Last updated:** [August 29, 2020, 1:30pm UTC](https://discuss.elastic.co/t/import-kibana-saved-objects-to-same-space/246798 "2020-08-29T13:30:08Z")
Hello guys, I am trying to import a dashboard, which was created in space a, in the space a itself. Although import is successful, the only thing that happens is the existing objects are overridden. I want a copy of suc… --- ## [If else condition for pipeline filter. How to normalise data before making into Common schema?](https://discuss.elastic.co/t/if-else-condition-for-pipeline-filter-how-to-normalise-data-before-making-into-common-schema/246768)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 1\ **Last updated:** [August 29, 2020, 1:12pm UTC](https://discuss.elastic.co/t/if-else-condition-for-pipeline-filter-how-to-normalise-data-before-making-into-common-schema/246768 "2020-08-29T13:12:45Z")
We got certain sources coming from syslog servers (different type of data) in a single pipeline. I wanted to split the single pipeline into multiple datasets before applying the common schema For instance, the syslog da… --- ## [Index creation in Elastic Search using Python in 5.4 Version](https://discuss.elastic.co/t/index-creation-in-elastic-search-using-python-in-5-4-version/246674)
**Author:** [@AKumar123](https://discuss.elastic.co/u/AKumar123)\ **Replies:** 2\ **Last updated:** [August 29, 2020, 10:32am UTC](https://discuss.elastic.co/t/index-creation-in-elastic-search-using-python-in-5-4-version/246674 "2020-08-29T10:32:43Z")
I am not able to create index in Elastic Search for version 5.4. Same code i am able to do it for 7.8 Version --- ## [New node high cpu](https://discuss.elastic.co/t/new-node-high-cpu/246839)
**Author:** [@12\_auqf](https://discuss.elastic.co/u/12_auqf)\ **Replies:** 1\ **Last updated:** [August 29, 2020, 10:23am UTC](https://discuss.elastic.co/t/new-node-high-cpu/246839 "2020-08-29T10:23:35Z")
my es(6.7) cluster add a new node, and the new node's CPU is very high, by the hot\_threads, I found the thread "Lucene Merge" is occupy the cpu, and the other's no, why? --- ## [Limitation of ISM feature](https://discuss.elastic.co/t/limitation-of-ism-feature/246824)
**Author:** [@pinakinab](https://discuss.elastic.co/u/pinakinab)\ **Replies:** 1\ **Last updated:** [August 29, 2020, 8:04am UTC](https://discuss.elastic.co/t/limitation-of-ism-feature/246824 "2020-08-29T08:04:37Z")
As per ES Pricing documentation, basic version of elasticsearch also has a feature of Index Lifecycle Management. If we have a basic security for ES, then do we need to have special permissions to enable Index Lifecycle … --- ## [Master not discovered yet, this node has not previously joined a bootstrapped (v7+) cluster](https://discuss.elastic.co/t/master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster/246411)
**Author:** [@galvin1234](https://discuss.elastic.co/u/galvin1234)\ **Replies:** 2\ **Last updated:** [August 29, 2020, 7:39am UTC](https://discuss.elastic.co/t/master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster/246411 "2020-08-29T07:39:33Z")
ES V7.9.0 I had used ES V7.6.0 with default configuration, but in V7.9.0 I am facing above mentioned issue. I looked into output of both the versions and found that V7.6.0 was able to generate "cluster\_uuid" : "7PaoDB… --- ## [Setup mode is not available You do not have the necessary permissions to do this](https://discuss.elastic.co/t/setup-mode-is-not-available-you-do-not-have-the-necessary-permissions-to-do-this/245635)
**Author:** [@Yogesh\_Kumar1](https://discuss.elastic.co/u/Yogesh_Kumar1)\ **Replies:** 29\ **Last updated:** [August 29, 2020, 7:36am UTC](https://discuss.elastic.co/t/setup-mode-is-not-available-you-do-not-have-the-necessary-permissions-to-do-this/245635 "2020-08-29T07:36:38Z")
i have installed a Elasticsearch cluster of 3 master and 2 data nodes and a single node Elasticsearch monitoring cluster. i am sending the metrics of Elasticsearch using metricbeat. i can see the metrics when i check th… --- ## [Logstash how to different format message](https://discuss.elastic.co/t/logstash-how-to-different-format-message/246076)
**Author:** [@Champion\_Xie](https://discuss.elastic.co/u/Champion_Xie)\ **Replies:** 4\ **Last updated:** [August 29, 2020, 4:11am UTC](https://discuss.elastic.co/t/logstash-how-to-different-format-message/246076 "2020-08-29T04:11:13Z")
07/20/20 00:48:28 INFO hello 353 us.(channel/Channel.cpp:575) 07/20/20 00:48:28 INFO transfercity:bj(city/cityTransferQueryBusiness.cpp:72) 07/20/20 00:48:29 INFO transferQuery city 965380 us.(channel/Channel.cpp:57… --- ## [Redis slowlog monitoring with ECK (Elastic on Kubernetes)?](https://discuss.elastic.co/t/redis-slowlog-monitoring-with-eck-elastic-on-kubernetes/246377)
**Author:** [@fzyzcjy](https://discuss.elastic.co/u/fzyzcjy)\ **Replies:** 5\ **Last updated:** [August 29, 2020, 2:02am UTC](https://discuss.elastic.co/t/redis-slowlog-monitoring-with-eck-elastic-on-kubernetes/246377 "2020-08-29T02:02:45Z")
Hi thanks for the wonderful elastic stack! I am trying to monitor the SLOWLOG of Redis in elastic, and I am on Kubernetes (using ECK). The doc says Redis filebeat for slowlog needs to specify a list of hosts. However, in… --- ## [Illegal Argument Eeption](https://discuss.elastic.co/t/illegal-argument-eeption/245334)
**Author:** [@TomWBM](https://discuss.elastic.co/u/TomWBM)\ **Replies:** 18\ **Last updated:** [August 29, 2020, 2:00am UTC](https://discuss.elastic.co/t/illegal-argument-eeption/245334 "2020-08-29T02:00:21Z")
Opening my Kibana Dashboard on my standalone ELK implementation I get the referenced error, detailed ouput below: { "took": 906, "timed\_out": false, "num\_reduce\_phases": 8, "\_shards": { "total": 74, "suc… --- ## [Connect to Oracle DB using JDBC input plugin](https://discuss.elastic.co/t/connect-to-oracle-db-using-jdbc-input-plugin/246365)
**Author:** [@newtologstash](https://discuss.elastic.co/u/newtologstash)\ **Replies:** 6\ **Last updated:** [August 29, 2020, 1:16am UTC](https://discuss.elastic.co/t/connect-to-oracle-db-using-jdbc-input-plugin/246365 "2020-08-29T01:16:38Z")
Hi, I'm able to connect to oracle database using oracle jdbc thin driver with the below config file. In the original config file we have the username/password parameters defined. input { jdbc { jdbc\_valid… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1835) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1837)