# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1882 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1883 --- ## [Winlogbeat Index not rolling over - alias not pointing to index](https://discuss.elastic.co/t/winlogbeat-index-not-rolling-over-alias-not-pointing-to-index/244072)
**Author:** [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\ **Replies:** 0\ **Last updated:** [August 6, 2020, 5:26pm UTC](https://discuss.elastic.co/t/winlogbeat-index-not-rolling-over-alias-not-pointing-to-index/244072 "2020-08-06T17:26:44Z")
Hello, I've create an ILM policy that should roll over the index when it gets to 50 GB. I then created an index template: PUT /\_template/winlogbeat-default { "index\_patterns" : \["winlogbeat-\*"\], "order" : 2, … --- ## [Intersection of two lists stored as string](https://discuss.elastic.co/t/intersection-of-two-lists-stored-as-string/244064)
**Author:** [@Sultanow](https://discuss.elastic.co/u/Sultanow)\ **Replies:** 0\ **Last updated:** [August 6, 2020, 4:27pm UTC](https://discuss.elastic.co/t/intersection-of-two-lists-stored-as-string/244064 "2020-08-06T16:27:28Z")
We have an index called "queues" that stores snapshots of queue states as follows: Each document contains (along some other fields) the following fields: timestamp: type=date, and it is searchable, aggregatable it… --- ## [Send AIX logs to ELK](https://discuss.elastic.co/t/send-aix-logs-to-elk/243061)
**Author:** [@hmillares](https://discuss.elastic.co/u/hmillares)\ **Replies:** 3\ **Last updated:** [August 6, 2020, 4:42pm UTC](https://discuss.elastic.co/t/send-aix-logs-to-elk/243061 "2020-08-06T16:42:53Z")
Hi Guys, I´m using AIX machine on my environment and I want to know how is the best way to send logs to the ELK. I know that filebeat is not supported on AIX Can you help me with this problem? Thanks in advance. Rega… --- ## [Logstash - match filename](https://discuss.elastic.co/t/logstash-match-filename/241792)
**Author:** [@elk6](https://discuss.elastic.co/u/elk6)\ **Replies:** 1\ **Last updated:** [August 6, 2020, 4:34pm UTC](https://discuss.elastic.co/t/logstash-match-filename/241792 "2020-08-06T16:34:26Z")
I have two servers. The first one hosts elastic stack. Both servers have a file /var/log/commands.log which is configured in the same way and are being shipped with filebeat to logstash. Using grok, I tried parsing the … --- ## [Error while delete ml anomaly job](https://discuss.elastic.co/t/error-while-delete-ml-anomaly-job/243888)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 13\ **Last updated:** [August 6, 2020, 4:29pm UTC](https://discuss.elastic.co/t/error-while-delete-ml-anomaly-job/243888 "2020-08-06T16:29:52Z")
I'm trying to delete an ML job. I used Kibana to do so, and Kibana shows "deleting" status for this job. DELETE \_ml/anomaly\_detectors/jobid?force=true gives: "reason" : { "type" : "node\_disconnected\_exception", "r… --- ## [Query with a large set of ids (67000+ terms)](https://discuss.elastic.co/t/query-with-a-large-set-of-ids-67000-terms/244065)
**Author:** [@Vesli](https://discuss.elastic.co/u/Vesli)\ **Replies:** 0\ **Last updated:** [August 6, 2020, 4:28pm UTC](https://discuss.elastic.co/t/query-with-a-large-set-of-ids-67000-terms/244065 "2020-08-06T16:28:32Z")
Hello, I have a query for document that I want to filter by excluding a large set of ids (67000 terms) that I'm current doing as following: query := map\[string\]interface{}{ "query": map\[string\]interface{}{ "b… --- ## [Logstash is not generating logs](https://discuss.elastic.co/t/logstash-is-not-generating-logs/241621)
**Author:** [@ramkumar.J](https://discuss.elastic.co/u/ramkumar.J)\ **Replies:** 1\ **Last updated:** [August 6, 2020, 4:26pm UTC](https://discuss.elastic.co/t/logstash-is-not-generating-logs/241621 "2020-08-06T16:26:57Z")
My Log stash service is running as a Windows service. No issue in the running status. But the Logs are not getting generated. I have Pipeline configured for this logstash service. I need a help to enable the Logs for t… --- ## [Kibana UI crashing when searching Index Pattern](https://discuss.elastic.co/t/kibana-ui-crashing-when-searching-index-pattern/244031)
**Author:** [@holt\_g](https://discuss.elastic.co/u/holt_g)\ **Replies:** 2\ **Last updated:** [August 6, 2020, 4:18pm UTC](https://discuss.elastic.co/t/kibana-ui-crashing-when-searching-index-pattern/244031 "2020-08-06T16:18:52Z")
Using Kibana 7.6.1, when I open a Codex Index Pattern in the Discover Page the UI freezes and stops responding. No error messages. --- ## [Need help using "Logstash multiline codec" to parse below oswatcher log lines](https://discuss.elastic.co/t/need-help-using-logstash-multiline-codec-to-parse-below-oswatcher-log-lines/244040)
**Author:** [@saurabhc](https://discuss.elastic.co/u/saurabhc)\ **Replies:** 3\ **Last updated:** [August 6, 2020, 4:18pm UTC](https://discuss.elastic.co/t/need-help-using-logstash-multiline-codec-to-parse-below-oswatcher-log-lines/244040 "2020-08-06T16:18:39Z")
I have logs from oswatcher which looks like below. zzz \*\*\*Thu Jul 23 14:00:31 UTC 2020 MemoryTotal: 100831888 kB MemoryFree: 1212388 kB MemoryAvailable: 49997588 kB zzz \*\*\*Thu Jul 23 14:01:02 UTC 2020 Me… --- ## [Flow Chart for Connecting Microservices](https://discuss.elastic.co/t/flow-chart-for-connecting-microservices/244036)
**Author:** [@dangj](https://discuss.elastic.co/u/dangj)\ **Replies:** 1\ **Last updated:** [August 6, 2020, 4:03pm UTC](https://discuss.elastic.co/t/flow-chart-for-connecting-microservices/244036 "2020-08-06T16:03:53Z")
I have a use case where there are multiple microservices from where data is logged. Is there a way in Kibana to create a flow chart to show what services were called? --- ## [DELETE PLEASE](https://discuss.elastic.co/t/delete-please/244039)
**Author:** [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Replies:** 1\ **Last updated:** [August 6, 2020, 3:59pm UTC](https://discuss.elastic.co/t/delete-please/244039 "2020-08-06T15:59:54Z")
DELETE PLEASE --- ## [Multiple Users viewing Kibana Reports](https://discuss.elastic.co/t/multiple-users-viewing-kibana-reports/243277)
**Author:** [@vikasp](https://discuss.elastic.co/u/vikasp)\ **Replies:** 5\ **Last updated:** [August 6, 2020, 3:49pm UTC](https://discuss.elastic.co/t/multiple-users-viewing-kibana-reports/243277 "2020-08-06T15:49:22Z")
Hi, I observed that I can see only reports I created. Is there any way that I can view reports created by other users as well in kibana. --- ## [Image (.TIF) is supported by Ingest Attachment plugin? (OCR for images)](https://discuss.elastic.co/t/image-tif-is-supported-by-ingest-attachment-plugin-ocr-for-images/243780)
**Author:** [@christiancj](https://discuss.elastic.co/u/christiancj)\ **Replies:** 4\ **Last updated:** [August 6, 2020, 3:33pm UTC](https://discuss.elastic.co/t/image-tif-is-supported-by-ingest-attachment-plugin-ocr-for-images/243780 "2020-08-06T15:33:57Z")
I've ES 7.3.1 with Ingest Attachment plugin, I can extract text for PDF, txt, docx, xlsx, however I'm dealing as well with .TIF documents, does the plugin support image to extract text (OCR) ?. I was reading few web si… --- ## [Kibana TSVB Markdown](https://discuss.elastic.co/t/kibana-tsvb-markdown/243999)
**Author:** [@david.preston](https://discuss.elastic.co/u/david.preston)\ **Replies:** 2\ **Last updated:** [August 6, 2020, 3:33pm UTC](https://discuss.elastic.co/t/kibana-tsvb-markdown/243999 "2020-08-06T15:33:18Z")
Hi, Can conditional logic be added to the TSVB Markdown visualisation? I saw a post where the Markdown element in a canvas could be conditionally customised by editing the expression. However I cannot see the same fe… --- ## [Its possible activate the parser a json format for specific pod?](https://discuss.elastic.co/t/its-possible-activate-the-parser-a-json-format-for-specific-pod/243325)
**Author:** [@David\_Oceans](https://discuss.elastic.co/u/David_Oceans)\ **Replies:** 2\ **Last updated:** [August 6, 2020, 3:23pm UTC](https://discuss.elastic.co/t/its-possible-activate-the-parser-a-json-format-for-specific-pod/243325 "2020-08-06T15:23:38Z")
I'm using filebeat 7.8.0 inside my kubernetes cluster. With that configuration --- apiVersion: v1 kind: ConfigMap metadata: name: filebeat-config namespace: logging labels: k8s-app: filebeat data: filebeat.… --- ## [Displaying names for IDs in graphs](https://discuss.elastic.co/t/displaying-names-for-ids-in-graphs/244027)
**Author:** [@ch\_tom](https://discuss.elastic.co/u/ch_tom)\ **Replies:** 1\ **Last updated:** [August 6, 2020, 3:20pm UTC](https://discuss.elastic.co/t/displaying-names-for-ids-in-graphs/244027 "2020-08-06T15:20:51Z")
I found this issue mentioned in a few other (older) threads, but sadly without solutions and was wondering whether there was any way of doing this in the current version. Problem: We process sales data for music artists… --- ## [Logstash indexing data to elasticsearch cluster](https://discuss.elastic.co/t/logstash-indexing-data-to-elasticsearch-cluster/244033)
**Author:** [@FranB](https://discuss.elastic.co/u/FranB)\ **Replies:** 1\ **Last updated:** [August 6, 2020, 3:16pm UTC](https://discuss.elastic.co/t/logstash-indexing-data-to-elasticsearch-cluster/244033 "2020-08-06T15:16:17Z")
hello guys, i need some help here. i was indexing data to a cluster at a 2500~/s and then suddenly it deprecated to 100~/s any idea what might have been or what do i have to do? logs seems fine, no errors. i can a… --- ## [Reindexing indicies results in issues in 7.8.1](https://discuss.elastic.co/t/reindexing-indicies-results-in-issues-in-7-8-1/244051)
**Author:** [@undelete](https://discuss.elastic.co/u/undelete)\ **Replies:** 0\ **Last updated:** [August 6, 2020, 3:01pm UTC](https://discuss.elastic.co/t/reindexing-indicies-results-in-issues-in-7-8-1/244051 "2020-08-06T15:01:03Z")
I'm reindexing a few indicies and I get the message #! Deprecation: index \[my\_index\] matches multiple legacy templates \[filebeat-7.8.1, fv2-test\], composable templates will only match a single template. I've built my in… --- ## [LDAP integration with elk](https://discuss.elastic.co/t/ldap-integration-with-elk/244049)
**Author:** [@suresh123](https://discuss.elastic.co/u/suresh123)\ **Replies:** 0\ **Last updated:** [August 6, 2020, 2:50pm UTC](https://discuss.elastic.co/t/ldap-integration-with-elk/244049 "2020-08-06T14:50:43Z")
Hi Experts, I am trying to integrate LDAP with ELK stack. I have modified below script in elasticsearch.yml xpack.security.enabled: true xpack: security: authc: realms: ldap: ldap1: … --- ## [Cluster not forming multi-master eligible. Each forming 1 node cluster with itself as master](https://discuss.elastic.co/t/cluster-not-forming-multi-master-eligible-each-forming-1-node-cluster-with-itself-as-master/243926)
**Author:** [@randomuser10](https://discuss.elastic.co/u/randomuser10)\ **Replies:** 2\ **Last updated:** [August 6, 2020, 2:45pm UTC](https://discuss.elastic.co/t/cluster-not-forming-multi-master-eligible-each-forming-1-node-cluster-with-itself-as-master/243926 "2020-08-06T14:45:07Z")
I have three nodes setup running oss-7.8.1 on CentOS 7 with SELinux Disabled I'm just trying to do a very basic initial setup as this is my first time playing with it. I have been reading different walkthroughs as well … --- ## [Transform data with false time range](https://discuss.elastic.co/t/transform-data-with-false-time-range/244015)
**Author:** [@marcospi](https://discuss.elastic.co/u/marcospi)\ **Replies:** 1\ **Last updated:** [August 6, 2020, 2:22pm UTC](https://discuss.elastic.co/t/transform-data-with-false-time-range/244015 "2020-08-06T14:22:20Z")
Hey there, I want to use the transform method to transform my original data in a more compact version. In my orignal data I have at aech document the fields "unique user Id" and the exact date. Now I want to transform … --- ## [Scripted field with division does not show result](https://discuss.elastic.co/t/scripted-field-with-division-does-not-show-result/243148)
**Author:** [@MyQuery](https://discuss.elastic.co/u/MyQuery)\ **Replies:** 2\ **Last updated:** [August 6, 2020, 2:03pm UTC](https://discuss.elastic.co/t/scripted-field-with-division-does-not-show-result/243148 "2020-08-06T14:03:13Z")
Hi , In Scripted filed division is not working. Am not getting the returned values. Here is the snippet perncentile = ((failures\_AF)/(count \* 1.0)); My Version of Kibana is 4.7.2 . Cann some one please help me how to… --- ## [Low level Java rest client very slow](https://discuss.elastic.co/t/low-level-java-rest-client-very-slow/244035)
**Author:** [@aldm](https://discuss.elastic.co/u/aldm)\ **Replies:** 0\ **Last updated:** [August 6, 2020, 2:02pm UTC](https://discuss.elastic.co/t/low-level-java-rest-client-very-slow/244035 "2020-08-06T14:02:27Z")
Hi. We're using Elasticsearch very extensively in our Scala (Akka based) system. We currently moved to Java low level rest client and we're experiencing some issues, namely requests take much more time executed with cli… --- ## [Best Practice to Make sure clients Logs are written in correct clients Index](https://discuss.elastic.co/t/best-practice-to-make-sure-clients-logs-are-written-in-correct-clients-index/244006)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 2\ **Last updated:** [August 6, 2020, 2:00pm UTC](https://discuss.elastic.co/t/best-practice-to-make-sure-clients-logs-are-written-in-correct-clients-index/244006 "2020-08-06T14:00:12Z")
Hi, I want to ask for best practice for following problem: You have different clients and you ship your logs using filebeat to logstash. You want to seperate the clients in different indeces and you have a filter … --- ## [How to send laravel logs to elk server](https://discuss.elastic.co/t/how-to-send-laravel-logs-to-elk-server/243931)
**Author:** [@mycloud2040](https://discuss.elastic.co/u/mycloud2040)\ **Replies:** 3\ **Last updated:** [August 6, 2020, 1:57pm UTC](https://discuss.elastic.co/t/how-to-send-laravel-logs-to-elk-server/243931 "2020-08-06T13:57:56Z")
Hi , I am new to ELK, can i have any document to send laravel logs to elk. my ELK server running on ubuntu 18.04. and laraval application is running on same ubuntu18.04. Thanks --- ## [Add header row to csv output file](https://discuss.elastic.co/t/add-header-row-to-csv-output-file/244010)
**Author:** [@akhilsharma.in](https://discuss.elastic.co/u/akhilsharma.in)\ **Replies:** 1\ **Last updated:** [August 6, 2020, 1:47pm UTC](https://discuss.elastic.co/t/add-header-row-to-csv-output-file/244010 "2020-08-06T13:47:33Z")
Using csv output plugin to store JSON field data. But there are no column names; wondering how to give names to columns or how to add header row. --- ## [What is the bottleneck of elasticsearch? What gives the greatest performance boosts?](https://discuss.elastic.co/t/what-is-the-bottleneck-of-elasticsearch-what-gives-the-greatest-performance-boosts/243880)
**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\ **Replies:** 5\ **Last updated:** [August 6, 2020, 1:37pm UTC](https://discuss.elastic.co/t/what-is-the-bottleneck-of-elasticsearch-what-gives-the-greatest-performance-boosts/243880 "2020-08-06T13:37:33Z")
Hi, its a general question: What limits elasticsearch the most? Lets say we have a normal node with: i5, 4 Cores 32GB, DDR4 Ram 2TB SSD What will give me the greates performance boost when I change these components? … --- ## [Elastic agent does not send data](https://discuss.elastic.co/t/elastic-agent-does-not-send-data/239190)
**Author:** [@Pavel\_Penka](https://discuss.elastic.co/u/Pavel_Penka)\ **Replies:** 5\ **Last updated:** [August 6, 2020, 1:36pm UTC](https://discuss.elastic.co/t/elastic-agent-does-not-send-data/239190 "2020-08-06T13:36:45Z")
Hello, I am trying to use ingest management and elastic agent on Windows Server 2012 against elastic cloud instance. Unfortunately, I am ending with the error bellow and no data is sent to elastic. Can someone please h… --- ## [Problem with "cloning" (filebeat -\> logstash -\> elasticsearch) - more logstash pipelines](https://discuss.elastic.co/t/problem-with-cloning-filebeat-logstash-elasticsearch-more-logstash-pipelines/244018)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 5\ **Last updated:** [August 6, 2020, 1:22pm UTC](https://discuss.elastic.co/t/problem-with-cloning-filebeat-logstash-elasticsearch-more-logstash-pipelines/244018 "2020-08-06T13:22:47Z")
Hi, I have a problem. In simple terms, the problem looks like this: If I add one pipeline in logstash: input { beats { ... } } filter { ... } output { elasticsearch { ... } } Everything wor… --- ## [With a small ES cluster that shares master duties, where do I send my Logstash output?](https://discuss.elastic.co/t/with-a-small-es-cluster-that-shares-master-duties-where-do-i-send-my-logstash-output/244028)
**Author:** [@brandondash](https://discuss.elastic.co/u/brandondash)\ **Replies:** 0\ **Last updated:** [August 6, 2020, 1:14pm UTC](https://discuss.elastic.co/t/with-a-small-es-cluster-that-shares-master-duties-where-do-i-send-my-logstash-output/244028 "2020-08-06T13:14:18Z")
Do I send to all ES nodes? Just pick one? output { elasticsearch { index =\> "test-%{+YYYY.MM.dd}" hosts =\> \["10.128.172.112","10.128.172.113","10.128.172.114"\] } } [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1881) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1883)