# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1954 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1955 --- ## [How to reduce collection time](https://discuss.elastic.co/t/how-to-reduce-collection-time/239730)
**Author:** [@jang](https://discuss.elastic.co/u/jang)\ **Replies:** 3\ **Last updated:** [July 3, 2020, 6:32am UTC](https://discuss.elastic.co/t/how-to-reduce-collection-time/239730 "2020-07-03T06:32:48Z")
hello, I'm using elk. After a day of testing, there was a problem. The difference between collection time and log generation time is widening. For example, the collection time and log generation time were exactly th… --- ## [Keep index template and ILM when using logstash](https://discuss.elastic.co/t/keep-index-template-and-ilm-when-using-logstash/239736)
**Author:** [@sref](https://discuss.elastic.co/u/sref)\ **Replies:** 0\ **Last updated:** [July 3, 2020, 6:31am UTC](https://discuss.elastic.co/t/keep-index-template-and-ilm-when-using-logstash/239736 "2020-07-03T06:31:51Z")
Im looking for guidance on how to keep ILM working, when sending logs via Logstash to a custom index. I do the classic setup with Winlogbeat-\>Logstash-\>ES. Logstash output config: output { if "CUSTOMTAG" in \[tags\] {… --- ## [Should I be worried for this warn message when installing Elastic?](https://discuss.elastic.co/t/should-i-be-worried-for-this-warn-message-when-installing-elastic/239734)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 0\ **Last updated:** [July 3, 2020, 6:15am UTC](https://discuss.elastic.co/t/should-i-be-worried-for-this-warn-message-when-installing-elastic/239734 "2020-07-03T06:15:39Z")
after a successful instalation, I get this line warning: elasticsearch-7.8.0-x86\_64.rpm: Header V4 RSA/SHA512 Signature, key ID XXXXXX: NOKEY\` I have instaled elastic downloading the file from elastic website, and then… --- ## [Help with converting String to Integer in xml parsing](https://discuss.elastic.co/t/help-with-converting-string-to-integer-in-xml-parsing/239672)
**Author:** [@jyotsna.ganji](https://discuss.elastic.co/u/jyotsna.ganji)\ **Replies:** 1\ **Last updated:** [July 3, 2020, 5:56am UTC](https://discuss.elastic.co/t/help-with-converting-string-to-integer-in-xml-parsing/239672 "2020-07-03T05:56:46Z")
I am parsing a nested xml using the below conf file and it parses individual tag elements perfectly. But when I try to convert string elements to Integer using XPath, it forms arrays of values. input{ http\_poller{ … --- ## [JVM error in elasticsearch](https://discuss.elastic.co/t/jvm-error-in-elasticsearch/239701)
**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Replies:** 6\ **Last updated:** [July 3, 2020, 5:27am UTC](https://discuss.elastic.co/t/jvm-error-in-elasticsearch/239701 "2020-07-03T05:27:37Z")
HI Team, when i try to star the elasticsearch service it throwing below error \> Java HotSpot(TM) 64-Bit Server VM warning: INFO: os::commit\_memory(0x00002b76c9990000, 33661845504, 0) failed; error='Cannot allocate … --- ## [How to query data from elasticsearch in kibana plugin in version 7.7.1?](https://discuss.elastic.co/t/how-to-query-data-from-elasticsearch-in-kibana-plugin-in-version-7-7-1/239727)
**Author:** [@K\_Chaitanya](https://discuss.elastic.co/u/K_Chaitanya)\ **Replies:** 0\ **Last updated:** [July 3, 2020, 4:43am UTC](https://discuss.elastic.co/t/how-to-query-data-from-elasticsearch-in-kibana-plugin-in-version-7-7-1/239727 "2020-07-03T04:43:00Z")
Hi, I'm trying to build Kibana plugin and I am using basic free authentication in kibana. I need to query GET /\_security/user/\_has\_privileges to get the privileges of the current logged in user api further I need to per… --- ## [Upgrading to Elastic Search 7.1.x not able to get the cluster up](https://discuss.elastic.co/t/upgrading-to-elastic-search-7-1-x-not-able-to-get-the-cluster-up/239726)
**Author:** [@Ranjit\_Singh](https://discuss.elastic.co/u/Ranjit_Singh)\ **Replies:** 1\ **Last updated:** [July 3, 2020, 4:41am UTC](https://discuss.elastic.co/t/upgrading-to-elastic-search-7-1-x-not-able-to-get-the-cluster-up/239726 "2020-07-03T04:41:05Z")
I have an existing Elastic 5.5.2 cluster that I am trying to upgrade to 7.1.x. The ssl was not enabled on the old cluster as it was in a non-prod environment I have changed elasticsearch.yaml to the following configurat… --- ## [Dead Letter - cannot write event to DLQ: reached maxQueueSize of 2147483648](https://discuss.elastic.co/t/dead-letter-cannot-write-event-to-dlq-reached-maxqueuesize-of-2147483648/239100)
**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Replies:** 6\ **Last updated:** [July 3, 2020, 4:24am UTC](https://discuss.elastic.co/t/dead-letter-cannot-write-event-to-dlq-reached-maxqueuesize-of-2147483648/239100 "2020-07-03T04:24:55Z")
Hi Team, I facing syncing issue in Elasticsearch and when i check my logstash log and i observer the below error "cannot write event to DLQ: reached maxQueueSize of 2147483648". whether its causing the syncing issue … --- ## [Is there up-to-date documentation for implementing a custom Elasticsearch realm?](https://discuss.elastic.co/t/is-there-up-to-date-documentation-for-implementing-a-custom-elasticsearch-realm/239367)
**Author:** [@TimothyMDean](https://discuss.elastic.co/u/TimothyMDean)\ **Replies:** 4\ **Last updated:** [July 3, 2020, 1:09am UTC](https://discuss.elastic.co/t/is-there-up-to-date-documentation-for-implementing-a-custom-elasticsearch-realm/239367 "2020-07-03T01:09:03Z")
Hello, I am trying to implement a custom authentication realm for Elasticsearch, as documented at https://www.elastic.co/guide/en/elasticsearch/reference/current/custom-realms.html. I think I understand the basics, but … --- ## [Optimize logstash configuration](https://discuss.elastic.co/t/optimize-logstash-configuration/239574)
**Author:** [@ohoroyoi](https://discuss.elastic.co/u/ohoroyoi)\ **Replies:** 5\ **Last updated:** [July 3, 2020, 12:32am UTC](https://discuss.elastic.co/t/optimize-logstash-configuration/239574 "2020-07-03T00:32:00Z")
Hello. I'm syncing 4 tables of geo data from postgres to elasticsearch using logstash. I am updating the data to be changed using the doc\_as\_upsert option. One table has more than 700,000 rows. Not many, but sometimes … --- ## [Node/Admin Certificates no longer work after upgrade to ES 7.7.0 from 7.3.2](https://discuss.elastic.co/t/node-admin-certificates-no-longer-work-after-upgrade-to-es-7-7-0-from-7-3-2/239713)
**Author:** [@tmiller1142](https://discuss.elastic.co/u/tmiller1142)\ **Replies:** 1\ **Last updated:** [July 2, 2020, 11:38pm UTC](https://discuss.elastic.co/t/node-admin-certificates-no-longer-work-after-upgrade-to-es-7-7-0-from-7-3-2/239713 "2020-07-02T23:38:12Z")
We recently upgraded our Elasticsearch Stack to use OpenDistro 1.8.0 with Elasticsearch 7.7.0 from OpenDistro 1.3.0 with Elasticsearch 7.3.2. Before the upgrade, we used version 3 node and admin certs with Subject Altern… --- ## [Dissect json array of strings](https://discuss.elastic.co/t/dissect-json-array-of-strings/239711)
**Author:** [@theflakes](https://discuss.elastic.co/u/theflakes)\ **Replies:** 1\ **Last updated:** [July 2, 2020, 9:54pm UTC](https://discuss.elastic.co/t/dissect-json-array-of-strings/239711 "2020-07-02T21:54:52Z")
I have a Json array of strings. I want to find the one entry that starts with “xx” and create a new field with it as the value. The text after “xx” can vary. Not sure how to use the dissect directive on an array of stri… --- ## [Logstash Runner Error](https://discuss.elastic.co/t/logstash-runner-error/239704)
**Author:** [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\ **Replies:** 1\ **Last updated:** [July 2, 2020, 9:45pm UTC](https://discuss.elastic.co/t/logstash-runner-error/239704 "2020-07-02T21:45:18Z")
Hi All, I am seeing this error in my logstash logs and not sure how to resolve. Some people say to install xpack plugin. My logstash is on version 6.8 and I believe it already comes with xpack by default with this vers… --- ## [\[Filebeat\] Using the System module while running Filebeat in docker](https://discuss.elastic.co/t/filebeat-using-the-system-module-while-running-filebeat-in-docker/239700)
**Author:** [@miande](https://discuss.elastic.co/u/miande)\ **Replies:** 0\ **Last updated:** [July 2, 2020, 6:41pm UTC](https://discuss.elastic.co/t/filebeat-using-the-system-module-while-running-filebeat-in-docker/239700 "2020-07-02T18:41:49Z")
When running Filebeat as a docker container and using the System module in the filebeat.yml it requires access to the host's file system for reading from /var/logs/ (easy enough) but once the System module pulls the logs… --- ## [Raw Query in Nest C#](https://discuss.elastic.co/t/raw-query-in-nest-c/239383)
**Author:** [@Ramesh\_balasubramani](https://discuss.elastic.co/u/Ramesh_balasubramani)\ **Replies:** 1\ **Last updated:** [July 2, 2020, 8:44pm UTC](https://discuss.elastic.co/t/raw-query-in-nest-c/239383 "2020-07-02T20:44:20Z")
string query = @" { ""size"" : 0, ""aggs"" : { ""words"" : { ""terms"" : { ""field"" : ""bodyContent"" , ""size"" : 80, ""exclude"" : \[""is"",""an"" \] } } } }"; client.LowLevel.Se… --- ## [How to deal with bigger loops in ElasticSearch?](https://discuss.elastic.co/t/how-to-deal-with-bigger-loops-in-elasticsearch/239705)
**Author:** [@jsonpaul](https://discuss.elastic.co/u/jsonpaul)\ **Replies:** 0\ **Last updated:** [July 2, 2020, 8:35pm UTC](https://discuss.elastic.co/t/how-to-deal-with-bigger-loops-in-elasticsearch/239705 "2020-07-02T20:35:19Z")
Hello everyone, I have a painless script that calculates user sessions. The script works fine but when I have more than 10k entry in the painless script loop throws this error: "caused\_by": { "type": "p… --- ## [Can I change an URL template with JSON input field](https://discuss.elastic.co/t/can-i-change-an-url-template-with-json-input-field/239671)
**Author:** [@Goishin](https://discuss.elastic.co/u/Goishin)\ **Replies:** 1\ **Last updated:** [July 2, 2020, 8:18pm UTC](https://discuss.elastic.co/t/can-i-change-an-url-template-with-json-input-field/239671 "2020-07-02T20:18:16Z")
I'm using Kibana to report my test pass results. I have now added the test devices to my dashboard. The problem is that some of my test devices have generic names, but may be on different servers. So, if I want to see th… --- ## [Pinned query limit of 100 configurable?](https://discuss.elastic.co/t/pinned-query-limit-of-100-configurable/239667)
**Author:** [@Karl\_Kevilus](https://discuss.elastic.co/u/Karl_Kevilus)\ **Replies:** 12\ **Last updated:** [July 2, 2020, 8:11pm UTC](https://discuss.elastic.co/t/pinned-query-limit-of-100-configurable/239667 "2020-07-02T20:11:23Z")
How can I configure the maximum # of items returned in a 'pinned query'? I'm getting the following error: "caused\_by": { "type": "x\_content\_parse\_exception", "reason": "Failed to build \[pinned\] after l… --- ## [Capturing Start and Stop Times in An Aggregated Data Record?](https://discuss.elastic.co/t/capturing-start-and-stop-times-in-an-aggregated-data-record/239668)
**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Replies:** 4\ **Last updated:** [July 2, 2020, 7:37pm UTC](https://discuss.elastic.co/t/capturing-start-and-stop-times-in-an-aggregated-data-record/239668 "2020-07-02T19:37:54Z")
Hi Logstash Superheroes, Not long ago, this forum helped me with the syntax for an Aggregate Filter Plugin. I got it working, but now I need to append Start and Stop timestamps to the aggregated records. To explain… … --- ## [Beat - logstash - logserver](https://discuss.elastic.co/t/beat-logstash-logserver/239692)
**Author:** [@slawek](https://discuss.elastic.co/u/slawek)\ **Replies:** 4\ **Last updated:** [July 2, 2020, 7:26pm UTC](https://discuss.elastic.co/t/beat-logstash-logserver/239692 "2020-07-02T19:26:47Z")
Hello, Can I configure logstash as a receiver from winlogbeat and send these logs in CEF format to another log server? If yes. How should I do that? Regards --- ## [Elastic Search fails to restart because of high CPU usage and error failed to recover from translog](https://discuss.elastic.co/t/elastic-search-fails-to-restart-because-of-high-cpu-usage-and-error-failed-to-recover-from-translog/239696)
**Author:** [@adiwakar](https://discuss.elastic.co/u/adiwakar)\ **Replies:** 0\ **Last updated:** [July 2, 2020, 6:23pm UTC](https://discuss.elastic.co/t/elastic-search-fails-to-restart-because-of-high-cpu-usage-and-error-failed-to-recover-from-translog/239696 "2020-07-02T18:23:16Z")
Hi All, I shall be grateful if you could help me. I am using ES version 6.4 and have 2 node cluster setup (I know its bad, we have plans to change it). One node is in Washington and another Virginia. Everything… --- ## [Kibana ciphers not bringing up the port 5601](https://discuss.elastic.co/t/kibana-ciphers-not-bringing-up-the-port-5601/239542)
**Author:** [@funlearning321](https://discuss.elastic.co/u/funlearning321)\ **Replies:** 2\ **Last updated:** [July 2, 2020, 6:16pm UTC](https://discuss.elastic.co/t/kibana-ciphers-not-bringing-up-the-port-5601/239542 "2020-07-02T18:16:28Z")
Hi, I have added the below configuration in kibana.yml but however, when the service is restarted, kibana is throwing error. server.ssl.cipherSuites: "ECDHE-RSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-R… --- ## [Can I put chirpstack’s data into Kibana?](https://discuss.elastic.co/t/can-i-put-chirpstack-s-data-into-kibana/239683)
**Author:** [@miuiuiuiuiu](https://discuss.elastic.co/u/miuiuiuiuiu)\ **Replies:** 1\ **Last updated:** [July 2, 2020, 5:45pm UTC](https://discuss.elastic.co/t/can-i-put-chirpstack-s-data-into-kibana/239683 "2020-07-02T17:45:54Z")
I am using lora wan to transmit data, the data transmits to chirpstack and i want to use Kibana to visualize and analyze my data. But turns out Kibana does not support and chirpstack do not support EC just wondering … --- ## [How to inject variables to input plugin](https://discuss.elastic.co/t/how-to-inject-variables-to-input-plugin/239597)
**Author:** [@ohoroyoi](https://discuss.elastic.co/u/ohoroyoi)\ **Replies:** 1\ **Last updated:** [July 2, 2020, 5:32pm UTC](https://discuss.elastic.co/t/how-to-inject-variables-to-input-plugin/239597 "2020-07-02T17:32:19Z")
according to, this answer https://discuss.elastic.co/t/optimize-logstash-configuration/239574/3 I realized I have to compare lastest row date and last run date. but the problem is I don't know that. I can find last ru… --- ## [Date range doesn't have effect in Dashboard, missing in Explore](https://discuss.elastic.co/t/date-range-doesnt-have-effect-in-dashboard-missing-in-explore/238889)
**Author:** [@dmatt](https://discuss.elastic.co/u/dmatt)\ **Replies:** 2\ **Last updated:** [July 2, 2020, 5:30pm UTC](https://discuss.elastic.co/t/date-range-doesnt-have-effect-in-dashboard-missing-in-explore/238889 "2020-07-02T17:30:39Z")
Hi, I'm trying to solve a problem with the date range not appearing in the Explore page, and if I adjust the filter in a Dashboard, it has no effect on Data. Here's are the details: Kibana 7.1.0 created a visualization… --- ## [Pipeline does not exist](https://discuss.elastic.co/t/pipeline-does-not-exist/239478)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 4\ **Last updated:** [July 2, 2020, 5:27pm UTC](https://discuss.elastic.co/t/pipeline-does-not-exist/239478 "2020-07-02T17:27:58Z")
Hi, I'm sending logs from filebeat to logstash but it I'm getting this error from logstash connecting to elastisearch: Jul 01 14:26:49 elk logstash\[5445\]: \[2020-07-01T14:26:49,288\]\[WARN \]\[logstash.outputs.elasticsearch… --- ## [Metricbeat deamonset no system metrics](https://discuss.elastic.co/t/metricbeat-deamonset-no-system-metrics/239130)
**Author:** [@Bogdan\_Milescu](https://discuss.elastic.co/u/Bogdan_Milescu)\ **Replies:** 1\ **Last updated:** [July 2, 2020, 5:27pm UTC](https://discuss.elastic.co/t/metricbeat-deamonset-no-system-metrics/239130 "2020-07-02T17:27:14Z")
Hey guys, I have the deployed metricbeat as a daemonset on a k8s cluster. I have added the system module in order to monitor worker nodes metrics but it seems that no system metrics are recorded. The configuration is as… --- ## [Help with filter](https://discuss.elastic.co/t/help-with-filter/239556)
**Author:** [@rocanelo](https://discuss.elastic.co/u/rocanelo)\ **Replies:** 2\ **Last updated:** [July 2, 2020, 5:13pm UTC](https://discuss.elastic.co/t/help-with-filter/239556 "2020-07-02T17:13:39Z")
Dear community I have the next logs: \<6\> CEF:0|A10|TH1040S|4.1.4-GR1-P2|WAF62|filter-resp-hdrs|6|rt=Jul 01 2020 20:14:29 src=X.X.X.X spt=36230 dst=X.X.X.X dpt=443 dhost=axd341sas12jf.enjoy.cl cs1=WAF\_TEST cs2=8e139634b… --- ## [Centos 8 install Java before installing the elasticstack?](https://discuss.elastic.co/t/centos-8-install-java-before-installing-the-elasticstack/239546)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [July 2, 2020, 5:13pm UTC](https://discuss.elastic.co/t/centos-8-install-java-before-installing-the-elasticstack/239546 "2020-07-02T17:13:08Z")
Hi, in the documentation says that elasticsearch includes a bundled version of OpenJDK Elasticsearch is built using Java, and includes a bundled version of OpenJDK from the JDK maintainers (GPLv2+CE) within each distrib… --- ## [Getting issues with Java heap on Elasticsearch](https://discuss.elastic.co/t/getting-issues-with-java-heap-on-elasticsearch/239649)
**Author:** [@AshokBachchan](https://discuss.elastic.co/u/AshokBachchan)\ **Replies:** 6\ **Last updated:** [July 2, 2020, 4:14pm UTC](https://discuss.elastic.co/t/getting-issues-with-java-heap-on-elasticsearch/239649 "2020-07-02T16:14:42Z")
Hello @matw We have facing issue with elasticsearch, suddenly master nodes getting down. Logs were showing Java OutOfMemoryError. Master nodes have r5.xlarge instance type (4 Core CPU, 32 GB RAM), I have configured 15… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1953) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1955)