# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1914 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1915 --- ## [Metricbeat-Filebeat Install & Run as Docker Container](https://discuss.elastic.co/t/metricbeat-filebeat-install-run-as-docker-container/241919)
**Author:** [@vishakh](https://discuss.elastic.co/u/vishakh)\ **Replies:** 2\ **Last updated:** [July 21, 2020, 6:02pm UTC](https://discuss.elastic.co/t/metricbeat-filebeat-install-run-as-docker-container/241919 "2020-07-21T18:02:35Z")
Task Objective: using aws module (metricbeat + filebeat), I would like to pull logs and metrics from multiple aws accounts from one server. Thus reducing the server cost of running beats in each aws account. To achieve… --- ## [Logstash MySQL to Elasticsearch output does not reflect data in indices](https://discuss.elastic.co/t/logstash-mysql-to-elasticsearch-output-does-not-reflect-data-in-indices/241885)
**Author:** [@profgrammer](https://discuss.elastic.co/u/profgrammer)\ **Replies:** 1\ **Last updated:** [July 21, 2020, 5:57pm UTC](https://discuss.elastic.co/t/logstash-mysql-to-elasticsearch-output-does-not-reflect-data-in-indices/241885 "2020-07-21T17:57:01Z")
I am trying to build search functionality for a website, where there are different assets whose names, descriptions, tags, categories, etc. can be searched for. I am using the AWS elasticsearch service (elasticsearch ver… --- ## [How to get exact unique doc count based on some fields](https://discuss.elastic.co/t/how-to-get-exact-unique-doc-count-based-on-some-fields/241718)
**Author:** [@sandeep\_rana](https://discuss.elastic.co/u/sandeep_rana)\ **Replies:** 7\ **Last updated:** [July 21, 2020, 5:38pm UTC](https://discuss.elastic.co/t/how-to-get-exact-unique-doc-count-based-on-some-fields/241718 "2020-07-21T17:38:53Z")
Any way to find exact unique document count .. based on some fields.. I have also tried cardinality its not working as expected --- ## [Timelion fraction offset](https://discuss.elastic.co/t/timelion-fraction-offset/241477)
**Author:** [@Hugo\_Pires](https://discuss.elastic.co/u/Hugo_Pires)\ **Replies:** 5\ **Last updated:** [July 21, 2020, 4:33pm UTC](https://discuss.elastic.co/t/timelion-fraction-offset/241477 "2020-07-21T16:33:59Z")
Hello Is it possible to use timelion offset to compare the value of a metric, daily, at the same hour (from now, for instance)? My question is that we are not considering the complete day, but a fraction starting 0:00,… --- ## [Documentation on Kibana Visualisation - Query time & Request time](https://discuss.elastic.co/t/documentation-on-kibana-visualisation-query-time-request-time/242018)
**Author:** [@Thiru\_C](https://discuss.elastic.co/u/Thiru_C)\ **Replies:** 1\ **Last updated:** [July 21, 2020, 4:12pm UTC](https://discuss.elastic.co/t/documentation-on-kibana-visualisation-query-time-request-time/242018 "2020-07-21T16:12:14Z")
Can anyone point out the documents for Query time and Request time shown on the Inspect page in Kibana Visualisation? Best that I can come across is on discussion forum https://discuss.elastic.co/t/what-is-query-durat… --- ## [Timelion - Failure Rate problem](https://discuss.elastic.co/t/timelion-failure-rate-problem/242047)
**Author:** [@Tomszy](https://discuss.elastic.co/u/Tomszy)\ **Replies:** 2\ **Last updated:** [July 21, 2020, 3:56pm UTC](https://discuss.elastic.co/t/timelion-failure-rate-problem/242047 "2020-07-21T15:56:28Z")
Dear All, I would like to create Timelion line chart which should show the failure rate in %. The 'info' field shoudl contain 2 value. FAILED or PASSED I have this query: (.es(index=my-index-\*,timefield=@timestamp,q=… --- ## [Max event size for tcp input plugin](https://discuss.elastic.co/t/max-event-size-for-tcp-input-plugin/241773)
**Author:** [@Jehutywong](https://discuss.elastic.co/u/Jehutywong)\ **Replies:** 1\ **Last updated:** [July 21, 2020, 3:52pm UTC](https://discuss.elastic.co/t/max-event-size-for-tcp-input-plugin/241773 "2020-07-21T15:52:40Z")
Logstash version 7.6 I am sending a big json over TCP to Logstash. Somehow only partial of the event was able to output. roughly 60KB. The rest of the event was dicarded. Any way i can increase this limit. I tried to i… --- ## [How to generate multiple of Discover Plugin in Kibana 7.6](https://discuss.elastic.co/t/how-to-generate-multiple-of-discover-plugin-in-kibana-7-6/241966)
**Author:** [@Akhil\_Kaithoju](https://discuss.elastic.co/u/Akhil_Kaithoju)\ **Replies:** 4\ **Last updated:** [July 21, 2020, 3:51pm UTC](https://discuss.elastic.co/t/how-to-generate-multiple-of-discover-plugin-in-kibana-7-6/241966 "2020-07-21T15:51:19Z")
Hi, Is it Possible to add Discover plugin into Custom plugins or Can we generate multiple Discover Plugins in the Kibana 7.6. I want to add some extra functionality and that should be separate as Default Discover. Tha… --- ## [From logstash i want forward message to an application that read syslog in from port 514 ... the applictaion read and support Octet counting or LF ... how to setup logstah to send Octect or LF?](https://discuss.elastic.co/t/from-logstash-i-want-forward-message-to-an-application-that-read-syslog-in-from-port-514-the-applictaion-read-and-support-octet-counting-or-lf-how-to-setup-logstah-to-send-octect-or-lf/242063)
**Author:** [@Maurizio\_Tarducci](https://discuss.elastic.co/u/Maurizio_Tarducci)\ **Replies:** 0\ **Last updated:** [July 21, 2020, 3:51pm UTC](https://discuss.elastic.co/t/from-logstash-i-want-forward-message-to-an-application-that-read-syslog-in-from-port-514-the-applictaion-read-and-support-octet-counting-or-lf-how-to-setup-logstah-to-send-octect-or-lf/242063 "2020-07-21T15:51:18Z")
from logstash i want forward message to an application that read syslog in from port 514 ... the applictaion read and support Octet counting or LF ... how to setup logstah to send Octect or LF ? --- ## [Gelf output to Logstash not working](https://discuss.elastic.co/t/gelf-output-to-logstash-not-working/242061)
**Author:** [@pointonj](https://discuss.elastic.co/u/pointonj)\ **Replies:** 0\ **Last updated:** [July 21, 2020, 3:44pm UTC](https://discuss.elastic.co/t/gelf-output-to-logstash-not-working/242061 "2020-07-21T15:44:58Z")
Hi, I'm trying to get the logs from my Graylog server into 3 Logstash Servers that are load balanced. I'm not sure if this is an issue with Graylog or Logstash but as i've posted this on the Graylog community and got no… --- ## [Salesforce and Logstash integration](https://discuss.elastic.co/t/salesforce-and-logstash-integration/242055)
**Author:** [@vtrezza](https://discuss.elastic.co/u/vtrezza)\ **Replies:** 0\ **Last updated:** [July 21, 2020, 3:22pm UTC](https://discuss.elastic.co/t/salesforce-and-logstash-integration/242055 "2020-07-21T15:22:23Z")
Hi, I have to integrate Salesforce and Logstash in order to sync data from Salesforce to Logstash. The only possible way I have found is using the plugin "Salesforce input plugin". This plugin is working on making a S… --- ## [TLS handhake timeout in Elastic cloud](https://discuss.elastic.co/t/tls-handhake-timeout-in-elastic-cloud/242029)
**Author:** [@curiousmind](https://discuss.elastic.co/u/curiousmind)\ **Replies:** 1\ **Last updated:** [July 21, 2020, 2:46pm UTC](https://discuss.elastic.co/t/tls-handhake-timeout-in-elastic-cloud/242029 "2020-07-21T14:46:11Z")
I am using Elastic cloud with a platinum license, set to be expiring in 2021. I am getting the following error from today, when trying to take the dashboards. It also occurs when I am trying to edit/save watcher … --- ## [Elasticsearch Shard Allocation - ALLOCATION\_FAILED due to apparent disk quota issues, nowhere near max](https://discuss.elastic.co/t/elasticsearch-shard-allocation-allocation-failed-due-to-apparent-disk-quota-issues-nowhere-near-max/242038)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 1\ **Last updated:** [July 21, 2020, 2:42pm UTC](https://discuss.elastic.co/t/elasticsearch-shard-allocation-allocation-failed-due-to-apparent-disk-quota-issues-nowhere-near-max/242038 "2020-07-21T14:42:37Z")
Environment Elasticsearch 7.8.0 running in EKS EFS filesystem 3 master nodes 5 data nodes 649 total shards TL;DR Receiving ALLOCATION\_FAILED on shards due to apparent disk quota issues, should have more than enough dis… --- ## [Stop words filter works non-deterministically](https://discuss.elastic.co/t/stop-words-filter-works-non-deterministically/242050)
**Author:** [@Ewelina\_Zarebska](https://discuss.elastic.co/u/Ewelina_Zarebska)\ **Replies:** 0\ **Last updated:** [July 21, 2020, 2:42pm UTC](https://discuss.elastic.co/t/stop-words-filter-works-non-deterministically/242050 "2020-07-21T14:42:30Z")
Hi colleagues, I have following filter and custom analyzer: "custom\_address\_stopwords\_filter": { "type": "stop", "stopwords": \[ "po" , "p.o." , "box" , "n\\a" , "n\\a" , "n/a" , "n/a" , "-" , "-----" , "none" , "TBD" \] }… --- ## [Percentage metric in Kibana](https://discuss.elastic.co/t/percentage-metric-in-kibana/241911)
**Author:** [@paolinux](https://discuss.elastic.co/u/paolinux)\ **Replies:** 2\ **Last updated:** [July 21, 2020, 2:23pm UTC](https://discuss.elastic.co/t/percentage-metric-in-kibana/241911 "2020-07-21T14:23:25Z")
Hi, what is the best way to calculate a percentage metric in Kibana, as a ratio of two other metrics? thanks! Paolo --- ## [AWS Cost and Usage Details with Metricbeat](https://discuss.elastic.co/t/aws-cost-and-usage-details-with-metricbeat/241930)
**Author:** [@stevewritescode](https://discuss.elastic.co/u/stevewritescode)\ **Replies:** 2\ **Last updated:** [July 21, 2020, 2:23pm UTC](https://discuss.elastic.co/t/aws-cost-and-usage-details-with-metricbeat/241930 "2020-07-21T14:23:05Z")
Hi Beats pros! Is there any recommended way to pull and index AWS cost and usage report data into Elastic? I've been using the built-in AWS Billing Metricbeat module to pull in billing data from AWS. From what I can te… --- ## [How can I allow for fuzziness in a multimatch query for elasticsearch?](https://discuss.elastic.co/t/how-can-i-allow-for-fuzziness-in-a-multimatch-query-for-elasticsearch/242043)
**Author:** [@securisec](https://discuss.elastic.co/u/securisec)\ **Replies:** 0\ **Last updated:** [July 21, 2020, 2:20pm UTC](https://discuss.elastic.co/t/how-can-i-allow-for-fuzziness-in-a-multimatch-query-for-elasticsearch/242043 "2020-07-21T14:20:04Z")
Consider an index containing thousands of flowers and their descriptions in my ES. For example, a redacted json document would look like this: { "name": "rose", "description": "some long description about roses", … --- ## [Update by query performance question](https://discuss.elastic.co/t/update-by-query-performance-question/242042)
**Author:** [@ciocan](https://discuss.elastic.co/u/ciocan)\ **Replies:** 0\ **Last updated:** [July 21, 2020, 2:18pm UTC](https://discuss.elastic.co/t/update-by-query-performance-question/242042 "2020-07-21T14:18:25Z")
Hi, I'm quite new to elastic search. My problem is the following: There are two indexes: index1 - around 18m docs (~40gb of data) index2 - around 22k docs (10mb of data) I need to update all documents from index1 wit… --- ## [Handling IBM MQ messages with MQRFH2 header in logstash](https://discuss.elastic.co/t/handling-ibm-mq-messages-with-mqrfh2-header-in-logstash/242028)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 1\ **Last updated:** [July 21, 2020, 1:33pm UTC](https://discuss.elastic.co/t/handling-ibm-mq-messages-with-mqrfh2-header-in-logstash/242028 "2020-07-21T13:33:31Z")
Hi All, Can you please suggest , how to handle incoming IBM MQ messages MQRFH2 header in logstash, It is working fine when I pick a normal message without MQRFH2 header but whenever client is sending MQRFH2 header, thi… --- ## [Red dot in index data](https://discuss.elastic.co/t/red-dot-in-index-data/241694)
**Author:** [@bhumireddy](https://discuss.elastic.co/u/bhumireddy)\ **Replies:** 1\ **Last updated:** [July 21, 2020, 1:19pm UTC](https://discuss.elastic.co/t/red-dot-in-index-data/241694 "2020-07-21T13:19:10Z")
Unable to search based on a field, when i search the field has "red dot" in the suffix. If if copy and paste it is not showing dot. Search on missing is resulting many records. Not sure what is the error. There are t… --- ## [HTTP Proxy twitter client error for logstash-input-twitter plugin](https://discuss.elastic.co/t/http-proxy-twitter-client-error-for-logstash-input-twitter-plugin/242027)
**Author:** [@shaswatgupta](https://discuss.elastic.co/u/shaswatgupta)\ **Replies:** 0\ **Last updated:** [July 21, 2020, 12:58pm UTC](https://discuss.elastic.co/t/http-proxy-twitter-client-error-for-logstash-input-twitter-plugin/242027 "2020-07-21T12:58:46Z")
Logstash log: \[2020-07-21T12:08:19,838\]\[WARN \]\[logstash.inputs.twitter \] Twitter client error {:message=\>"End of file reached", :exception=\>"EOFError", :backtrace=\>\["org/jruby/RubyIO.java:2889:in \`readpartial'", "/us… --- ## [Watcher Alert Condition](https://discuss.elastic.co/t/watcher-alert-condition/240972)
**Author:** [@velu](https://discuss.elastic.co/u/velu)\ **Replies:** 3\ **Last updated:** [July 21, 2020, 12:48pm UTC](https://discuss.elastic.co/t/watcher-alert-condition/240972 "2020-07-21T12:48:29Z")
Hi , Please help me on this how to set conditional alert in watcher ..the alert to be trigger once my threshold breaches more than 10 mins. Thanks, Velu G --- ## [ES 2 to 7.5 migration](https://discuss.elastic.co/t/es-2-to-7-5-migration/242022)
**Author:** [@lhmzhou](https://discuss.elastic.co/u/lhmzhou)\ **Replies:** 1\ **Last updated:** [July 21, 2020, 12:46pm UTC](https://discuss.elastic.co/t/es-2-to-7-5-migration/242022 "2020-07-21T12:46:09Z")
Hi, I'm currently migrating from ES 2 to 7.5. Below query gives me results in the older version and no results/error in newer version when executed in Postman. {"query":{"constant\_score":{"filter":{"terms":{"templateI… --- ## [Incoming logs from Cisco switches don't appear in filebeat-\* indexes](https://discuss.elastic.co/t/incoming-logs-from-cisco-switches-dont-appear-in-filebeat-indexes/241679)
**Author:** [@robertitox](https://discuss.elastic.co/u/robertitox)\ **Replies:** 2\ **Last updated:** [July 21, 2020, 12:43pm UTC](https://discuss.elastic.co/t/incoming-logs-from-cisco-switches-dont-appear-in-filebeat-indexes/241679 "2020-07-21T12:43:11Z")
Dear all, I have ELK 7.8.0 and I've configured cisco asa module from Filebeat 7.8.0 in order to receive incoming logs from Cisco switches. Here it is the /etc/filebeat/modules.d/cisco.yml below module.cisco line: ios: … --- ## [Records from all nodes are not searched by the custom plugin](https://discuss.elastic.co/t/records-from-all-nodes-are-not-searched-by-the-custom-plugin/242021)
**Author:** [@radhika](https://discuss.elastic.co/u/radhika)\ **Replies:** 0\ **Last updated:** [July 21, 2020, 11:57am UTC](https://discuss.elastic.co/t/records-from-all-nodes-are-not-searched-by-the-custom-plugin/242021 "2020-07-21T11:57:45Z")
Hi, I have recently migrated a custom scoring plugin from ES 1.7.5 to version 7.5.2. The plugin works fine and gives expected results when running in a single node environment. The issue arrises when there are 2 or more… --- ## [Repository-gcs high amount of requests](https://discuss.elastic.co/t/repository-gcs-high-amount-of-requests/241902)
**Author:** [@chaekew2xie1ohh2aoYe](https://discuss.elastic.co/u/chaekew2xie1ohh2aoYe)\ **Replies:** 5\ **Last updated:** [July 21, 2020, 11:42am UTC](https://discuss.elastic.co/t/repository-gcs-high-amount-of-requests/241902 "2020-07-21T11:42:00Z")
I followed the repository-gcs guide to install a snapshot repository for gcs a month ago. https://www.elastic.co/guide/en/elasticsearch/plugins/7.5/repository-gcs.html POST http://elasticsearch-cluster:9200/\_snapshot/da… --- ## [Filebeat Event Hub - 409 The specified blob already exists](https://discuss.elastic.co/t/filebeat-event-hub-409-the-specified-blob-already-exists/241942)
**Author:** [@CSelastic](https://discuss.elastic.co/u/CSelastic)\ **Replies:** 1\ **Last updated:** [July 21, 2020, 11:03am UTC](https://discuss.elastic.co/t/filebeat-event-hub-409-the-specified-blob-already-exists/241942 "2020-07-21T11:03:13Z")
Hi -- I'm running filebeat 7.6.2 and am encountering an issue with the Azure Event Hub input plugin. I believe this was caused due to unclean shutdown. I'm seeing the following errors, and messages are not pulled in from… --- ## [Filebeat add docker metada fail](https://discuss.elastic.co/t/filebeat-add-docker-metada-fail/241958)
**Author:** [@tungpzostar](https://discuss.elastic.co/u/tungpzostar)\ **Replies:** 1\ **Last updated:** [July 21, 2020, 10:57am UTC](https://discuss.elastic.co/t/filebeat-add-docker-metada-fail/241958 "2020-07-21T10:57:49Z")
Hello everybody, I'm having this issue when try to get docker metada. This is myconfiguration: filebeat.inputs: - type: docker combine\_partial: true containers: path: "/usr/share/dockerlogs/data" stream: "al… --- ## [Before Mapping](https://discuss.elastic.co/t/before-mapping/241837)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 3\ **Last updated:** [July 21, 2020, 10:52am UTC](https://discuss.elastic.co/t/before-mapping/241837 "2020-07-21T10:52:29Z")
I am using filebeat and i would like to know that to create a mapping do i need to know the field name or should i start the filebeat and analyse that these the fields are coming i can see in kibana discover and after th… --- ## [Bug in standard analyzer?](https://discuss.elastic.co/t/bug-in-standard-analyzer/242010)
**Author:** [@corbosman](https://discuss.elastic.co/u/corbosman)\ **Replies:** 0\ **Last updated:** [July 21, 2020, 10:51am UTC](https://discuss.elastic.co/t/bug-in-standard-analyzer/242010 "2020-07-21T10:51:27Z")
Hi all, we have a field that contains hostnames like "foo.bar.com". I noticed that when I searched for hostnames with only digits, I got too many results. Let's say I search for "1234.example.com", I would also get back… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1913) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1915)