# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1982 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1983 --- ## [Help required for full GC logging to elastic search by parsing verbose GC logs](https://discuss.elastic.co/t/help-required-for-full-gc-logging-to-elastic-search-by-parsing-verbose-gc-logs/237837)
**Author:** [@Bhanu\_Praveen](https://discuss.elastic.co/u/Bhanu_Praveen)\ **Replies:** 0\ **Last updated:** [June 19, 2020, 4:41pm UTC](https://discuss.elastic.co/t/help-required-for-full-gc-logging-to-elastic-search-by-parsing-verbose-gc-logs/237837 "2020-06-19T16:41:36Z")
Hello, I am looking for parsing full GC logs generated using verbose jvm parameters. Need to get all below details into Elastic stack: Heap before and after GC GC throughput Minor/Major GC stats etc Is there any lo… --- ## [Logstash error : Failed to publish events caused by: write tcp YY.YY.YY.YY:40912-\>XX.XX.XX.XX:5044: write: connection reset by peer](https://discuss.elastic.co/t/logstash-error-failed-to-publish-events-caused-by-write-tcp-yy-yy-yy-yy-40912-xx-xx-xx-xx-write-connection-reset-by-peer/237898)
**Author:** [@Aqel](https://discuss.elastic.co/u/Aqel)\ **Replies:** 0\ **Last updated:** [June 20, 2020, 7:08am UTC](https://discuss.elastic.co/t/logstash-error-failed-to-publish-events-caused-by-write-tcp-yy-yy-yy-yy-40912-xx-xx-xx-xx-write-connection-reset-by-peer/237898 "2020-06-20T07:08:45Z")
I am using filebeat to push my logs to elasticsearch using logstash and the set up was working fine for me before. I am getting Failed to publish events error now. filebeat | 2020-06-20T06:26:03.832969730Z 2020-06… --- ## [Setup dashboards](https://discuss.elastic.co/t/setup-dashboards/238028)
**Author:** [@dobby](https://discuss.elastic.co/u/dobby)\ **Replies:** 0\ **Last updated:** [June 22, 2020, 7:51am UTC](https://discuss.elastic.co/t/setup-dashboards/238028 "2020-06-22T07:51:42Z")
When trying to set up dashboards for winlogbeat i get "Failed to import dashboard" The error doesnt come if i never change the password for the users. So if i try with default "elastic" and "changeme" it works. But af… --- ## [Scripted Field using timestamp](https://discuss.elastic.co/t/scripted-field-using-timestamp/238106)
**Author:** [@Brpat](https://discuss.elastic.co/u/Brpat)\ **Replies:** 0\ **Last updated:** [June 22, 2020, 2:55pm UTC](https://discuss.elastic.co/t/scripted-field-using-timestamp/238106 "2020-06-22T14:55:09Z")
Hello, I'm new to Elastic, and I've been trying to create a custom dashboard that will show user activity after hours. I wanted to create a scripted field to filter by hour of day and I found this post Kibana Filter for… --- ## [Elasticsearch parser problem](https://discuss.elastic.co/t/elasticsearch-parser-problem/238109)
**Author:** [@vaclav1](https://discuss.elastic.co/u/vaclav1)\ **Replies:** 0\ **Last updated:** [June 22, 2020, 3:02pm UTC](https://discuss.elastic.co/t/elasticsearch-parser-problem/238109 "2020-06-22T15:02:29Z")
Hello, we are having difficulties while parsing incoming object from http poller plugin and storing into ELS. Template mapping is here: "aqarchive": { "properties": { "hea… --- ## [Filebeat - o365 module Error, api error:AF20051](https://discuss.elastic.co/t/filebeat-o365-module-error-api-error-af20051/238148)
**Author:** [@zerolife](https://discuss.elastic.co/u/zerolife)\ **Replies:** 0\ **Last updated:** [June 22, 2020, 8:08pm UTC](https://discuss.elastic.co/t/filebeat-o365-module-error-api-error-af20051/238148 "2020-06-22T20:08:51Z")
Hi, I was hoping someone can help point me in the right direction here. I setup Filebeat and the o365 module. Everything was working fine for 8 days or so. And then for some reason, it stopped being able to connect to… --- ## [Data ingest using curl](https://discuss.elastic.co/t/data-ingest-using-curl/237517)
**Author:** [@vee](https://discuss.elastic.co/u/vee)\ **Replies:** 3\ **Last updated:** [June 22, 2020, 10:38pm UTC](https://discuss.elastic.co/t/data-ingest-using-curl/237517 "2020-06-22T22:38:59Z")
Is there a way to pull logs from an external system into Elastic through curl command? If so, what are the recommendations on it's architecture. Here is what I have in mind: Setup a shell script to run curl command -\> … --- ## [\_cat indice filtering by index wildcard](https://discuss.elastic.co/t/cat-indice-filtering-by-index-wildcard/238154)
**Author:** [@morty](https://discuss.elastic.co/u/morty)\ **Replies:** 0\ **Last updated:** [June 22, 2020, 9:09pm UTC](https://discuss.elastic.co/t/cat-indice-filtering-by-index-wildcard/238154 "2020-06-22T21:09:03Z")
According to this endpoint documentation (Optional, string) Comma-separated list or wildcard expression of index names used to limit the request. But in reality it also checks for aliases which makes this filtering … --- ## [Elasticsearch jdk](https://discuss.elastic.co/t/elasticsearch-jdk/238153)
**Author:** [@griffer98](https://discuss.elastic.co/u/griffer98)\ **Replies:** 0\ **Last updated:** [June 22, 2020, 8:59pm UTC](https://discuss.elastic.co/t/elasticsearch-jdk/238153 "2020-06-22T20:59:20Z")
I just installed elasticsearch 7.8 and when I run I get this error could not find java in bundled jdk at ..... What is wrong? --- ## [Messages escaped in Filebeat](https://discuss.elastic.co/t/messages-escaped-in-filebeat/237125)
**Author:** [@JeanN](https://discuss.elastic.co/u/JeanN)\ **Replies:** 5\ **Last updated:** [June 22, 2020, 8:45pm UTC](https://discuss.elastic.co/t/messages-escaped-in-filebeat/237125 "2020-06-22T20:45:30Z")
Hi, I have an issue with Filebeat, I have escaping characters that I can't remove from the message value, or I don't know how. I know there already are some topics on that matter but none solved my issue, that's why I'm… --- ## [How to remove auto indexes in Kibana?](https://discuss.elastic.co/t/how-to-remove-auto-indexes-in-kibana/238140)
**Author:** [@impkos](https://discuss.elastic.co/u/impkos)\ **Replies:** 4\ **Last updated:** [June 22, 2020, 7:51pm UTC](https://discuss.elastic.co/t/how-to-remove-auto-indexes-in-kibana/238140 "2020-06-22T19:51:24Z")
Help remove indexes --- ## [Filter Sonicwall Logstash](https://discuss.elastic.co/t/filter-sonicwall-logstash/238146)
**Author:** [@Danilo\_Visual](https://discuss.elastic.co/u/Danilo_Visual)\ **Replies:** 0\ **Last updated:** [June 22, 2020, 7:41pm UTC](https://discuss.elastic.co/t/filter-sonicwall-logstash/238146 "2020-06-22T19:41:28Z")
I'm new to Logstash and I'm trying to filter my Sonicwall log My logstash.conf: input { syslog { type =\> Sonicwall port =\> 9991 } } filter { if \[type\] == "Sonicwall" { kv { exclude\_keys =\> \[ "c", "id", "m", "… --- ## [Xpack.monitoring.history.duration with a value other than "7d" does not work](https://discuss.elastic.co/t/xpack-monitoring-history-duration-with-a-value-other-than-7d-does-not-work/238134)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 1\ **Last updated:** [June 22, 2020, 7:16pm UTC](https://discuss.elastic.co/t/xpack-monitoring-history-duration-with-a-value-other-than-7d-does-not-work/238134 "2020-06-22T19:16:27Z")
Hi, Referring to the documentation: https://www.elastic.co/guide/en/elasticsearch/reference/current/monitoring-settings.html We have value: xpack.monitoring.history.duration (default 7d). I can execute query: PUT \_c… --- ## [Ruby time.strftime logstash](https://discuss.elastic.co/t/ruby-time-strftime-logstash/238138)
**Author:** [@Rushabh\_Doshi](https://discuss.elastic.co/u/Rushabh_Doshi)\ **Replies:** 1\ **Last updated:** [June 22, 2020, 7:05pm UTC](https://discuss.elastic.co/t/ruby-time-strftime-logstash/238138 "2020-06-22T19:05:58Z")
Hi I want to convert hour to number , hour is extracted from timestamp as below in logstash: ruby { code =\> "event.set('\[hour\]',event.get('Activity-Time-New').time.strftime('%k') )" } In Kibana i want #hour ,a number … --- ## [Scripted field to convert 1024 Bytes to 1000 metric bytes](https://discuss.elastic.co/t/scripted-field-to-convert-1024-bytes-to-1000-metric-bytes/237901)
**Author:** [@chowpay](https://discuss.elastic.co/u/chowpay)\ **Replies:** 1\ **Last updated:** [June 22, 2020, 6:15pm UTC](https://discuss.elastic.co/t/scripted-field-to-convert-1024-bytes-to-1000-metric-bytes/237901 "2020-06-22T18:15:28Z")
In 6.4.2 I have a scripted filed that converts 1024Bytes to 1000Bytes as that is how we bill by this is the script that was working in 6.4.2 (doc\['total\_usage'\].value \*1000000000) \* Math.pow(1.024, Math.floor(Math.log(… --- ## [Coordinating node to route requests from intranet/internet to two distinct subsets of nodes](https://discuss.elastic.co/t/coordinating-node-to-route-requests-from-intranet-internet-to-two-distinct-subsets-of-nodes/237981)
**Author:** [@xandmaga](https://discuss.elastic.co/u/xandmaga)\ **Replies:** 5\ **Last updated:** [June 22, 2020, 5:54pm UTC](https://discuss.elastic.co/t/coordinating-node-to-route-requests-from-intranet-internet-to-two-distinct-subsets-of-nodes/237981 "2020-06-22T17:54:43Z")
Hi, we have very different throughput scenarios for our cluster regarding the same indexes. Our product will be available through our private intranet, but it will be released publicly too, and available through internet… --- ## [Logstash grok filter combinedapachelog does not work](https://discuss.elastic.co/t/logstash-grok-filter-combinedapachelog-does-not-work/238133)
**Author:** [@ademxoy](https://discuss.elastic.co/u/ademxoy)\ **Replies:** 1\ **Last updated:** [June 22, 2020, 5:50pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-combinedapachelog-does-not-work/238133 "2020-06-22T17:50:16Z")
Grok does not seem to create any outputs for COMBINEDAPACHELOG Here is my filter: filter { grok { match =\> { "messages" =\> "%{COMBINEDAPACHELOG}"} } mutate { convert =\> { "bytes" =\> "integer" } } date { mat… --- ## [FIlebeat data not pushed into filebeat-7.8 index](https://discuss.elastic.co/t/filebeat-data-not-pushed-into-filebeat-7-8-index/238114)
**Author:** [@Shadowphax](https://discuss.elastic.co/u/Shadowphax)\ **Replies:** 1\ **Last updated:** [June 22, 2020, 5:10pm UTC](https://discuss.elastic.co/t/filebeat-data-not-pushed-into-filebeat-7-8-index/238114 "2020-06-22T17:10:27Z")
Hi, Today we upgraded ES, Kibana, and Filebeats from 7.7 to 7.8. Everything went well but unfortunately, it seems like Filebeats is not pushing the cisco fdt module data it receives into ElasticSearch filebeat-7.8 index… --- ## [When a new forescast is created, it overwrite the older forecast?](https://discuss.elastic.co/t/when-a-new-forescast-is-created-it-overwrite-the-older-forecast/238117)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 1\ **Last updated:** [June 22, 2020, 4:31pm UTC](https://discuss.elastic.co/t/when-a-new-forescast-is-created-it-overwrite-the-older-forecast/238117 "2020-06-22T16:31:57Z")
If I run a 7 days forecast on monday, an then on tuesday I run another 7 days forecast it will overwrite the old one? I ask this because I have a visualization (on a dashboard) of the forecast that covers 7days an to ha… --- ## [Kubernetes module vs add\_kubernetes\_metadata](https://discuss.elastic.co/t/kubernetes-module-vs-add-kubernetes-metadata/237489)
**Author:** [@akrzos](https://discuss.elastic.co/u/akrzos)\ **Replies:** 2\ **Last updated:** [June 22, 2020, 3:53pm UTC](https://discuss.elastic.co/t/kubernetes-module-vs-add-kubernetes-metadata/237489 "2020-06-22T15:53:35Z")
If you are using the kubernetes module is there any reason to use the add\_kubernetes\_metadata processor? What is the difference between these two (module vs processor) and the use cases for each. Thanks --- ## [Return nested fields from query using source filter](https://discuss.elastic.co/t/return-nested-fields-from-query-using-source-filter/238091)
**Author:** [@misheck](https://discuss.elastic.co/u/misheck)\ **Replies:** 1\ **Last updated:** [June 22, 2020, 3:25pm UTC](https://discuss.elastic.co/t/return-nested-fields-from-query-using-source-filter/238091 "2020-06-22T15:25:58Z")
I am trying to query my signals indices in Elastic and I would like the results to return only the fields that I am interested and my current challenge is that some of the fields are nested. I have tried various methods … --- ## [ODBC Connection to Elasticsearch v6.8](https://discuss.elastic.co/t/odbc-connection-to-elasticsearch-v6-8/238094)
**Author:** [@Garry](https://discuss.elastic.co/u/Garry)\ **Replies:** 1\ **Last updated:** [June 22, 2020, 3:15pm UTC](https://discuss.elastic.co/t/odbc-connection-to-elasticsearch-v6-8/238094 "2020-06-22T15:15:17Z")
I am looking to connect to Elasticsearch in AWS via odbc, but get the following error... connection failed: \[Elastic\]\[EsODBC 6.8(c0ace37 +,u,r) Driver\]{"Message":"Your Request: '/\_xpack/sql' is not allowed."} Where can… --- ## [ERROR Unable to delete file](https://discuss.elastic.co/t/error-unable-to-delete-file/237948)
**Author:** [@rezekiel](https://discuss.elastic.co/u/rezekiel)\ **Replies:** 5\ **Last updated:** [June 22, 2020, 3:13pm UTC](https://discuss.elastic.co/t/error-unable-to-delete-file/237948 "2020-06-22T15:13:28Z")
Hi , I use elasticsearch for windows amd getting --- ## [Sincronizar](https://discuss.elastic.co/t/sincronizar/238102)
**Author:** [@Juliano\_de\_Mello](https://discuss.elastic.co/u/Juliano_de_Mello)\ **Replies:** 1\ **Last updated:** [June 22, 2020, 3:10pm UTC](https://discuss.elastic.co/t/sincronizar/238102 "2020-06-22T15:10:20Z")
Estou com dificuldades para sincronizar minha base mongoDB com elasticsearch. Há algum tutorial recente que possa me ajudar? I'm having trouble synchronizing my mongoDB base with elasticsearch. Are there any recent tuto… --- ## [Logstash input plugin for azure service bus topics](https://discuss.elastic.co/t/logstash-input-plugin-for-azure-service-bus-topics/238103)
**Author:** [@fim](https://discuss.elastic.co/u/fim)\ **Replies:** 0\ **Last updated:** [June 22, 2020, 2:31pm UTC](https://discuss.elastic.co/t/logstash-input-plugin-for-azure-service-bus-topics/238103 "2020-06-22T14:31:26Z")
Hello, Does anybody know about the following logstash plugin? This plugin reads messages from Azure Service Bus Topics but we would like to monitor only meta-data like number of messages in queue. Is this plug-in … --- ## [@timestamp field slow range query "DocValuesFieldExistsQuery"](https://discuss.elastic.co/t/timestamp-field-slow-range-query-docvaluesfieldexistsquery/234995)
**Author:** [@YvorL](https://discuss.elastic.co/u/YvorL)\ **Replies:** 12\ **Last updated:** [June 22, 2020, 2:27pm UTC](https://discuss.elastic.co/t/timestamp-field-slow-range-query-docvaluesfieldexistsquery/234995 "2020-06-22T14:27:31Z")
Hi! I was profiling my queries and I run into this: According to this thread there's isn't anything I can do to avoid this behavior and it seems that the newest ES version has older Lucene version (8.5) which doesn't… --- ## [How to parse dynamic array json through logstash?](https://discuss.elastic.co/t/how-to-parse-dynamic-array-json-through-logstash/238081)
**Author:** [@Rahul\_rr](https://discuss.elastic.co/u/Rahul_rr)\ **Replies:** 1\ **Last updated:** [June 22, 2020, 2:10pm UTC](https://discuss.elastic.co/t/how-to-parse-dynamic-array-json-through-logstash/238081 "2020-06-22T14:10:38Z")
Here is my array json. "service\_lines": \[ { "id": 584942, "is\_approved": null, "aar": { "category": { "id": 42, "name": "Tires" }, "system": { "id": 1, "name": "Tire" }, "subsystem": { "id": 1, "name": "T… --- ## [Logstash multiple jdbc input and clone](https://discuss.elastic.co/t/logstash-multiple-jdbc-input-and-clone/237739)
**Author:** [@ohoroyoi](https://discuss.elastic.co/u/ohoroyoi)\ **Replies:** 3\ **Last updated:** [June 22, 2020, 1:50pm UTC](https://discuss.elastic.co/t/logstash-multiple-jdbc-input-and-clone/237739 "2020-06-22T13:50:25Z")
I want to synchronize 2 postgres tables with 3 elasticsearch indexes. I'm going to split one of the tables and synchronize it with two indexes. so I'm cloning one of those tables. Divide the cloned things into 2 indexe… --- ## [How to create multiple pattern dissect processor - Ingest pipeline](https://discuss.elastic.co/t/how-to-create-multiple-pattern-dissect-processor-ingest-pipeline/237688)
**Author:** [@Mohan\_vel](https://discuss.elastic.co/u/Mohan_vel)\ **Replies:** 1\ **Last updated:** [June 22, 2020, 1:50pm UTC](https://discuss.elastic.co/t/how-to-create-multiple-pattern-dissect-processor-ingest-pipeline/237688 "2020-06-22T13:50:11Z")
I have created the ingest pipeline to dissect the incoming message with single pattern but the challenge is going with multiple patterns. Given my pipeline for reference. PUT \_ingest/pipeline/dissectpipeline { … --- ## [Okta module in filebeat retrieving an error failed to find message](https://discuss.elastic.co/t/okta-module-in-filebeat-retrieving-an-error-failed-to-find-message/237456)
**Author:** [@Mohan\_vel](https://discuss.elastic.co/u/Mohan_vel)\ **Replies:** 3\ **Last updated:** [June 22, 2020, 1:49pm UTC](https://discuss.elastic.co/t/okta-module-in-filebeat-retrieving-an-error-failed-to-find-message/237456 "2020-06-22T13:49:22Z")
Hi all, i am using the filebeat to ship the logs from Okta to elasticsearch, connection established successfully and elaticsearch is receiving the event.dataset from okta when i look into the log messages it's showing f… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1981) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1983)