# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1937 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1938 --- ## [Getting mutate\_error while trying to use ECS schema](https://discuss.elastic.co/t/getting-mutate-error-while-trying-to-use-ecs-schema/240707)
**Author:** [@curiousmind](https://discuss.elastic.co/u/curiousmind)\ **Replies:** 4\ **Last updated:** [July 11, 2020, 5:24pm UTC](https://discuss.elastic.co/t/getting-mutate-error-while-trying-to-use-ecs-schema/240707 "2020-07-11T17:24:25Z")
I was trying to ingest Fortigate firewall logs and under ECS schema. Here is my configuration: input { udp { host =\> "0.0.0.0" port =\> 10514 type =\> "log" } } filter { if \[type\] == "log" { kv { … --- ## [Timelion is ignoring both interval setting and scale\_interval parameter in 7.8](https://discuss.elastic.co/t/timelion-is-ignoring-both-interval-setting-and-scale-interval-parameter-in-7-8/240674)
**Author:** [@saif3r](https://discuss.elastic.co/u/saif3r)\ **Replies:** 1\ **Last updated:** [July 11, 2020, 3:08pm UTC](https://discuss.elastic.co/t/timelion-is-ignoring-both-interval-setting-and-scale-interval-parameter-in-7-8/240674 "2020-07-11T15:08:31Z")
Hello, We just upgraded to 7.8 (from 7.6.2) and we noticed something odd with Timelion. It appears that it's ignoring interval settings. Normally we have our visualizations with interval set to 1h, but despite that, TIm… --- ## [Cumulative Sum Aggregation and Display Issue in Kibana 7.8](https://discuss.elastic.co/t/cumulative-sum-aggregation-and-display-issue-in-kibana-7-8/240616)
**Author:** [@tenet\_testuser1](https://discuss.elastic.co/u/tenet_testuser1)\ **Replies:** 2\ **Last updated:** [July 11, 2020, 2:40pm UTC](https://discuss.elastic.co/t/cumulative-sum-aggregation-and-display-issue-in-kibana-7-8/240616 "2020-07-11T14:40:46Z")
Hello, I have a line graph chart comparing showing % change of a certain metric for each of the many sectors. My Report: Bucket : split series Term: sector\_name.keyword Order by "Custom Metric" Aggregation: Max (f… --- ## [How to display raw data not the sum in kibana](https://discuss.elastic.co/t/how-to-display-raw-data-not-the-sum-in-kibana/240628)
**Author:** [@Evelyn233](https://discuss.elastic.co/u/Evelyn233)\ **Replies:** 1\ **Last updated:** [July 11, 2020, 1:44pm UTC](https://discuss.elastic.co/t/how-to-display-raw-data-not-the-sum-in-kibana/240628 "2020-07-11T13:44:10Z")
i am new to the kibana, now i want to display the request time and response time of every logs. just the exact request time and response time, but the sum or other computation. The display is meant to show which log have… --- ## [K7 design actual for 7.x kibana and later](https://discuss.elastic.co/t/k7-design-actual-for-7-x-kibana-and-later/240666)
**Author:** [@masterThomas](https://discuss.elastic.co/u/masterThomas)\ **Replies:** 1\ **Last updated:** [July 11, 2020, 1:42pm UTC](https://discuss.elastic.co/t/k7-design-actual-for-7-x-kibana-and-later/240666 "2020-07-11T13:42:09Z")
Hi team, i use 6.7.3 Kibana, so i would like to know whether K7 design and its top header panel will be available from advanced settings in Kibana later versions. --- ## [Auditbeat - 120% CPU?](https://discuss.elastic.co/t/auditbeat-120-cpu/234909)
**Author:** [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\ **Replies:** 29\ **Last updated:** [July 11, 2020, 11:44am UTC](https://discuss.elastic.co/t/auditbeat-120-cpu/234909 "2020-07-11T11:44:14Z")
The high CPU usage of this process has been an ongoing issue. Recently I created a portal host for remote workers. Just supposed to be a gateway to move to other machines. 2 CPUs, 4Gb RAM, etc. Started getting reports o… --- ## [Define multiple ES coordinator nodes of same cluster in logstash output](https://discuss.elastic.co/t/define-multiple-es-coordinator-nodes-of-same-cluster-in-logstash-output/240795)
**Author:** [@SNJY](https://discuss.elastic.co/u/SNJY)\ **Replies:** 0\ **Last updated:** [July 11, 2020, 11:36am UTC](https://discuss.elastic.co/t/define-multiple-es-coordinator-nodes-of-same-cluster-in-logstash-output/240795 "2020-07-11T11:36:02Z")
Hi All, I need to define multiple ES coordinator nodes of same cluster in logstash output hosts setting. My cluster and logstash are running on 6.2.4. In this context, I would like to clarify following - Will logstash… --- ## [Convert lat, , long coming as two attributes to geo point](https://discuss.elastic.co/t/convert-lat-long-coming-as-two-attributes-to-geo-point/239877)
**Author:** [@vsk1](https://discuss.elastic.co/u/vsk1)\ **Replies:** 12\ **Last updated:** [July 11, 2020, 8:53am UTC](https://discuss.elastic.co/t/convert-lat-long-coming-as-two-attributes-to-geo-point/239877 "2020-07-11T08:53:15Z")
Hi, The input data that I'm getting from my application is returning as below { "timestamp": 2020-07-02, "name" : "location", "latitude": 39.01289 "longtitude" -76.979 } how do i update the elasticsearch index t… --- ## [Error loading config file: yaml: line 38: did not find expected key](https://discuss.elastic.co/t/error-loading-config-file-yaml-line-38-did-not-find-expected-key/240794)
**Author:** [@asagnam](https://discuss.elastic.co/u/asagnam)\ **Replies:** 0\ **Last updated:** [July 11, 2020, 11:11am UTC](https://discuss.elastic.co/t/error-loading-config-file-yaml-line-38-did-not-find-expected-key/240794 "2020-07-11T11:11:57Z")
when i was testing the winloagbeat config i got error in line 38 couldn't find expected key this is my winlogbeat.yml file kindly help me please to solve this problem thank you ###################### Winlogbeat Conf… --- ## [Processes are not logged in winlogbeat](https://discuss.elastic.co/t/processes-are-not-logged-in-winlogbeat/240471)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 1\ **Last updated:** [July 11, 2020, 7:49am UTC](https://discuss.elastic.co/t/processes-are-not-logged-in-winlogbeat/240471 "2020-07-11T07:49:48Z")
Hi, I've winlogbeat sending data to logstash then to elasticsearc and kibana. If I run cmd.exe or calc.exe or any process on the beat machine, the process.name in kibana doesn't have any values for them. It only shows… --- ## [Getting below Error while executing elasticsearch.bat](https://discuss.elastic.co/t/getting-below-error-while-executing-elasticsearch-bat/240788)
**Author:** [@vedantmehra18](https://discuss.elastic.co/u/vedantmehra18)\ **Replies:** 0\ **Last updated:** [July 11, 2020, 7:23am UTC](https://discuss.elastic.co/t/getting-below-error-while-executing-elasticsearch-bat/240788 "2020-07-11T07:23:24Z")
C:\\Elastic\_Stack\\elasticsearch-7.8.0-windows-x86\_64\\elasticsearch-7.8.0\\bin\>elasticsearch.bat future versions of Elasticsearch will require Java 11; your Java version from \[C:\\Program Files\\Java\\jdk1.8.0\_144\\jre\] does n… --- ## [Send Data from Mobile application to ELK](https://discuss.elastic.co/t/send-data-from-mobile-application-to-elk/240157)
**Author:** [@nirav.gshah](https://discuss.elastic.co/u/nirav.gshah)\ **Replies:** 6\ **Last updated:** [July 11, 2020, 4:37am UTC](https://discuss.elastic.co/t/send-data-from-mobile-application-to-elk/240157 "2020-07-11T04:37:58Z")
Hi All, I am looking for a solution, how can we ingest data into my elastic search directly from user Mobile Phone using rest API, Any help or document or method is appreciated. --- ## [Docker, ES 7.8.0, and the localhost snapshot repository](https://discuss.elastic.co/t/docker-es-7-8-0-and-the-localhost-snapshot-repository/240619)
**Author:** [@Jasper\_Showers](https://discuss.elastic.co/u/Jasper_Showers)\ **Replies:** 5\ **Last updated:** [July 11, 2020, 3:49am UTC](https://discuss.elastic.co/t/docker-es-7-8-0-and-the-localhost-snapshot-repository/240619 "2020-07-11T03:49:20Z")
I'm trying to execute a Dockerfile from elasticsearch:7.8.0 that will: Add a backup.tar.gz file to the image and extract it to a backup location. Change ownership of that folder so that ES has permission to read it. Ac… --- ## [Syslog with UDP and TCP ports](https://discuss.elastic.co/t/syslog-with-udp-and-tcp-ports/240773)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [July 11, 2020, 3:17am UTC](https://discuss.elastic.co/t/syslog-with-udp-and-tcp-ports/240773 "2020-07-11T03:17:38Z")
Hi, I'm ingesting syslog logs with the UDP input, but I have seen others pipelines for syslog logs that use both UDP and TCP, so I was wandering why they do that?, they get different syslog logs from each port? Im gettin… --- ## [Applying ILM to existing time-series indices](https://discuss.elastic.co/t/applying-ilm-to-existing-time-series-indices/240069)
**Author:** [@vanessa](https://discuss.elastic.co/u/vanessa)\ **Replies:** 1\ **Last updated:** [July 10, 2020, 11:24pm UTC](https://discuss.elastic.co/t/applying-ilm-to-existing-time-series-indices/240069 "2020-07-10T23:24:24Z")
Hello! I feel as though I've been on a wild goose chase today. Would appreciate any guidance here. As context, when I originally set up ILM in my index templates, I missed the step where you have to specify a rollover\_al… --- ## [How to return the modified document with bulk update](https://discuss.elastic.co/t/how-to-return-the-modified-document-with-bulk-update/240758)
**Author:** [@Attila\_Nagy](https://discuss.elastic.co/u/Attila_Nagy)\ **Replies:** 0\ **Last updated:** [July 10, 2020, 8:09pm UTC](https://discuss.elastic.co/t/how-to-return-the-modified-document-with-bulk-update/240758 "2020-07-10T20:09:03Z")
Previously (not sure about the versions, but I can't see errors with 6.8) I could use the bulk API to update a doc and to get back the modified document with (snippet from actual code using the Python Elastic client): b… --- ## [Re-index previous heartbeat data in ES through logstash processing](https://discuss.elastic.co/t/re-index-previous-heartbeat-data-in-es-through-logstash-processing/240739)
**Author:** [@paolinux](https://discuss.elastic.co/u/paolinux)\ **Replies:** 2\ **Last updated:** [July 10, 2020, 7:40pm UTC](https://discuss.elastic.co/t/re-index-previous-heartbeat-data-in-es-through-logstash-processing/240739 "2020-07-10T19:40:02Z")
Hi all, I know that the error described in this post has already been discussed but actually I could not find a solution yet. What I have been trying to accomplish it to have Logstash 7.6.2 read a bunch of JSON documen… --- ## [Elasticsearch cluster error "client did not trust this server's certificate, closing connection"](https://discuss.elastic.co/t/elasticsearch-cluster-error-client-did-not-trust-this-servers-certificate-closing-connection/240750)
**Author:** [@null\_or\_void\_at\_work](https://discuss.elastic.co/u/null_or_void_at_work)\ **Replies:** 0\ **Last updated:** [July 10, 2020, 7:31pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-error-client-did-not-trust-this-servers-certificate-closing-connection/240750 "2020-07-10T19:31:30Z")
Hi everyone. It's the first time I'm setting up an Elasticsearch (7.8) cluster. The cluster is running in 3 RHEL 7.7 virtual machines in Azure. The cluster runs just fine when there's no security enabled, but I start t… --- ## [Cluster Red after scale down with allocation\_status = fetching\_shard\_data](https://discuss.elastic.co/t/cluster-red-after-scale-down-with-allocation-status-fetching-shard-data/240749)
**Author:** [@UDixit](https://discuss.elastic.co/u/UDixit)\ **Replies:** 0\ **Last updated:** [July 10, 2020, 7:24pm UTC](https://discuss.elastic.co/t/cluster-red-after-scale-down-with-allocation-status-fetching-shard-data/240749 "2020-07-10T19:24:24Z")
Each of my index is 12 shards. I was running a 6R6P cluster(2 shards per partition). I recently scaled it down to 1R1P configuration. During the scale down, I reduced the replicacount to 0. After this, the cluster rema… --- ## [Total Hits in collapse has an upperbound of 10,000](https://discuss.elastic.co/t/total-hits-in-collapse-has-an-upperbound-of-10-000/240743)
**Author:** [@apurvnerlekar](https://discuss.elastic.co/u/apurvnerlekar)\ **Replies:** 0\ **Last updated:** [July 10, 2020, 6:43pm UTC](https://discuss.elastic.co/t/total-hits-in-collapse-has-an-upperbound-of-10-000/240743 "2020-07-10T18:43:16Z")
Hello, I am observing that the total\_hits in collapse field has an upperbound of 10,000. We have certain use-cases when we do use collapse and retrieve the total number of hits in it. If the inner\_hits are more than 10,… --- ## [Transfer data from elastic to oracle db with Logstash](https://discuss.elastic.co/t/transfer-data-from-elastic-to-oracle-db-with-logstash/240577)
**Author:** [@liron\_gofberg](https://discuss.elastic.co/u/liron_gofberg)\ **Replies:** 4\ **Last updated:** [July 10, 2020, 6:34pm UTC](https://discuss.elastic.co/t/transfer-data-from-elastic-to-oracle-db-with-logstash/240577 "2020-07-10T18:34:53Z")
Hi, Can Logstash transfer data from Elasticsearch to Oracle db? Thanks, Liron --- ## [Logstash Node & Pipeline Stack-Monitoring 404 on Kibana](https://discuss.elastic.co/t/logstash-node-pipeline-stack-monitoring-404-on-kibana/240453)
**Author:** [@vishakh](https://discuss.elastic.co/u/vishakh)\ **Replies:** 9\ **Last updated:** [July 10, 2020, 6:23pm UTC](https://discuss.elastic.co/t/logstash-node-pipeline-stack-monitoring-404-on-kibana/240453 "2020-07-10T18:23:00Z")
I'm trying to access Logstash Node and Pipeline from Stack-Monitoring but receiving 404 Not Found Below is the Kibana-Log when accessing logstash node-pipeline on kibana { "type": "response", "@timestamp": "2020-07… --- ## [For All Indexes and Timestamps Kibana Maps Shows "No results found"](https://discuss.elastic.co/t/for-all-indexes-and-timestamps-kibana-maps-shows-no-results-found/240588)
**Author:** [@alpo](https://discuss.elastic.co/u/alpo)\ **Replies:** 1\ **Last updated:** [July 10, 2020, 6:10pm UTC](https://discuss.elastic.co/t/for-all-indexes-and-timestamps-kibana-maps-shows-no-results-found/240588 "2020-07-10T18:10:16Z")
All, We're facing an interesting issue where Kibana Maps fails to find data within Elasticsearch. However, all other visualizations do find the data. A few bulleted notes for your consideration: When creating a new … --- ## [ILM is not Working properly for ECK](https://discuss.elastic.co/t/ilm-is-not-working-properly-for-eck/240207)
**Author:** [@Melvin\_Ramos](https://discuss.elastic.co/u/Melvin_Ramos)\ **Replies:** 1\ **Last updated:** [July 10, 2020, 6:06pm UTC](https://discuss.elastic.co/t/ilm-is-not-working-properly-for-eck/240207 "2020-07-10T18:06:31Z")
Hello all, We've been running a ECK last May, 2020 and there are some weird issues we are seeing ES 7.6.2 Context: ECK 1.1.0 Hot-Warm Architecture 4 HotNodes = 64G Ram - 5TB Storage Fast SSD 8 warm Nodes = 28G ram… --- ## [Elasticsearch installation failed for some reason](https://discuss.elastic.co/t/elasticsearch-installation-failed-for-some-reason/240612)
**Author:** [@Splunk](https://discuss.elastic.co/u/Splunk)\ **Replies:** 3\ **Last updated:** [July 10, 2020, 5:47pm UTC](https://discuss.elastic.co/t/elasticsearch-installation-failed-for-some-reason/240612 "2020-07-10T17:47:20Z")
Hi Guys, this is the issue I am facing while I'm trying to install ES on my EC2 instance. OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 OpenJDK 64-Bit Server VM warning: INF… --- ## [Add\_tag from fields than delete source fields](https://discuss.elastic.co/t/add-tag-from-fields-than-delete-source-fields/240730)
**Author:** [@dikkini](https://discuss.elastic.co/u/dikkini)\ **Replies:** 1\ **Last updated:** [July 10, 2020, 5:43pm UTC](https://discuss.elastic.co/t/add-tag-from-fields-than-delete-source-fields/240730 "2020-07-10T17:43:23Z")
Hello! I got JSON and there tags element which i want to use to add tags. I rename it to telegraf\_tags because of this topic and want to use them as source for ES tags. JSON: {"fields":{"created":1594396144981,"value… --- ## [How to enrich query using external lookup or DB table?](https://discuss.elastic.co/t/how-to-enrich-query-using-external-lookup-or-db-table/240699)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 7\ **Last updated:** [July 10, 2020, 5:33pm UTC](https://discuss.elastic.co/t/how-to-enrich-query-using-external-lookup-or-db-table/240699 "2020-07-10T17:33:59Z")
hi I couldn't find a proper example of enriching outcome of a search query using external lookup/DB-table I'm looking for something like.. \ | lookup ip within {external lookup file or DB table} | if ip is p… --- ## [Unexpected results on transpositions](https://discuss.elastic.co/t/unexpected-results-on-transpositions/240734)
**Author:** [@Diego\_Solis](https://discuss.elastic.co/u/Diego_Solis)\ **Replies:** 0\ **Last updated:** [July 10, 2020, 5:33pm UTC](https://discuss.elastic.co/t/unexpected-results-on-transpositions/240734 "2020-07-10T17:33:38Z")
Hello folks, Is there a way to calculate/analyze how many expansions I would like to use in my query. I was playing with the query below, and the default 50 max\_expansions was not enough to get "John" out of "Jhon". I d… --- ## [Logstash if condition skipped](https://discuss.elastic.co/t/logstash-if-condition-skipped/239806)
**Author:** [@katara](https://discuss.elastic.co/u/katara)\ **Replies:** 17\ **Last updated:** [July 10, 2020, 5:16pm UTC](https://discuss.elastic.co/t/logstash-if-condition-skipped/239806 "2020-07-10T17:16:38Z")
Hi, I have a logstash filter as below: mutate { convert =\> {"\[xmldata\]\[metric-data\]\[metricValues\]\[metric-value\]\[value\]" =\> "integer" } } if \[xmldata\]\[metric-data\]\[metricValues\]\[metric-value\]\[value\] == "200" #also tr… --- ## [URIPATH with other languages failing Grok parse](https://discuss.elastic.co/t/uripath-with-other-languages-failing-grok-parse/240225)
**Author:** [@andrew.campbell](https://discuss.elastic.co/u/andrew.campbell)\ **Replies:** 2\ **Last updated:** [July 10, 2020, 5:13pm UTC](https://discuss.elastic.co/t/uripath-with-other-languages-failing-grok-parse/240225 "2020-07-10T17:13:32Z")
We have some URIs with 8bit characters that are not getting parsed by Grok but are valid URIs. I've validated with the debugger that it is failing at this URIPATH field in our logs. /uk-UA/Properties/бц-«леонардо»-фаза-… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1936) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1938)