# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1986 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1987 --- ## [Cannot add a new node in a cluster already composed of 1 node](https://discuss.elastic.co/t/cannot-add-a-new-node-in-a-cluster-already-composed-of-1-node/237841)
**Author:** [@Julius](https://discuss.elastic.co/u/Julius)\ **Replies:** 4\ **Last updated:** [June 19, 2020, 8:48pm UTC](https://discuss.elastic.co/t/cannot-add-a-new-node-in-a-cluster-already-composed-of-1-node/237841 "2020-06-19T20:48:27Z")
here is the configuration of node 1 with IP: 192.168.1.1 : cluster.name: Syslog node.name: ColdServer node.master: false node.data: true path.data: /var/log/ELK/data network.host: 0.0.0.0 http.port: 9200 transport.tcp.p… --- ## [Logstash.inputs.tcp: Error in Netty pipeline: java.io.IOException: Connection reset by peer](https://discuss.elastic.co/t/logstash-inputs-tcp-error-in-netty-pipeline-java-io-ioexception-connection-reset-by-peer/237868)
**Author:** [@Kushal\_Zamkade1](https://discuss.elastic.co/u/Kushal_Zamkade1)\ **Replies:** 0\ **Last updated:** [June 19, 2020, 8:24pm UTC](https://discuss.elastic.co/t/logstash-inputs-tcp-error-in-netty-pipeline-java-io-ioexception-connection-reset-by-peer/237868 "2020-06-19T20:24:08Z")
Getting this error frequently during using TCP input plugin in latest logstash version 7.8 and tcp plugin version 6.0.5 --- ## [Field transformation in elasticsearch](https://discuss.elastic.co/t/field-transformation-in-elasticsearch/237865)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 0\ **Last updated:** [June 19, 2020, 8:11pm UTC](https://discuss.elastic.co/t/field-transformation-in-elasticsearch/237865 "2020-06-19T20:11:33Z")
Hi All, We are ingesting documents into elasticsearch using logstash, i have a field called "business elapsed time" the value of this field is "1 hours 15 minutes" , its getting ingested into elasticsearch as string is… --- ## [Canvas query: COUNT of field](https://discuss.elastic.co/t/canvas-query-count-of-field/237854)
**Author:** [@luopipi](https://discuss.elastic.co/u/luopipi)\ **Replies:** 1\ **Last updated:** [June 19, 2020, 8:00pm UTC](https://discuss.elastic.co/t/canvas-query-count-of-field/237854 "2020-06-19T20:00:36Z")
in canvas, I am using query as: SELECT COUNT("My Field Name") FROM "index\*" It shows error when there is space in "My Field Name". Any idea how the space should be handled? --- ## [How can we use the logstash values by trim some content to show in visualizations or new scripted parameters](https://discuss.elastic.co/t/how-can-we-use-the-logstash-values-by-trim-some-content-to-show-in-visualizations-or-new-scripted-parameters/237857)
**Author:** [@sajjithreddy](https://discuss.elastic.co/u/sajjithreddy)\ **Replies:** 0\ **Last updated:** [June 19, 2020, 7:43pm UTC](https://discuss.elastic.co/t/how-can-we-use-the-logstash-values-by-trim-some-content-to-show-in-visualizations-or-new-scripted-parameters/237857 "2020-06-19T19:43:48Z")
Hello, I have a event called "size" and the value be like "125433 Bytes" in log stash. I have few questions here. Can we trim the value as 125433 and use in Visualization ? If so how can we do? Can we convert the valu… --- ## [Logstash restarts frequently](https://discuss.elastic.co/t/logstash-restarts-frequently/237836)
**Author:** [@avinjos](https://discuss.elastic.co/u/avinjos)\ **Replies:** 3\ **Last updated:** [June 19, 2020, 6:25pm UTC](https://discuss.elastic.co/t/logstash-restarts-frequently/237836 "2020-06-19T18:25:20Z")
I have installed Logstash from RPM and when I stared it with the default config, I see it is restarting frequently. --- ## [Elasticsearch Same document repeating multiple times with filebeat to logstash output](https://discuss.elastic.co/t/elasticsearch-same-document-repeating-multiple-times-with-filebeat-to-logstash-output/237833)
**Author:** [@Bhanu\_Praveen](https://discuss.elastic.co/u/Bhanu_Praveen)\ **Replies:** 0\ **Last updated:** [June 19, 2020, 4:30pm UTC](https://discuss.elastic.co/t/elasticsearch-same-document-repeating-multiple-times-with-filebeat-to-logstash-output/237833 "2020-06-19T16:30:23Z")
Hello, Configured Filebeat to parse inputs from log file: filebeat.inputs: type: log enabled: true recursive\_glob.enabled: true close\_inactive: 1h close\_removed: true clean\_inactive: 5h clean\_removed: true ign… --- ## [Elastic Search nested data type query](https://discuss.elastic.co/t/elastic-search-nested-data-type-query/237773)
**Author:** [@surajdalvi](https://discuss.elastic.co/u/surajdalvi)\ **Replies:** 1\ **Last updated:** [June 19, 2020, 5:07pm UTC](https://discuss.elastic.co/t/elastic-search-nested-data-type-query/237773 "2020-06-19T17:07:12Z")
Hi, I have created the index in elastic search with the following mapping: PUT test { "mappings": { "documents": { "properties": { "title": { "type": "text", "fields": { "raw": { "type"… --- ## [Data Table Metrics Custom label](https://discuss.elastic.co/t/data-table-metrics-custom-label/237731)
**Author:** [@pikonio](https://discuss.elastic.co/u/pikonio)\ **Replies:** 1\ **Last updated:** [June 19, 2020, 4:54pm UTC](https://discuss.elastic.co/t/data-table-metrics-custom-label/237731 "2020-06-19T16:54:18Z")
I am using ELK stack version 7.7.1 and my data look like that I am trying to create a Data Table Visualization that has the following information Date Range: each row shows a predefined period of time like (last year… --- ## [Query from multiple fields with boolean operators](https://discuss.elastic.co/t/query-from-multiple-fields-with-boolean-operators/237690)
**Author:** [@namali](https://discuss.elastic.co/u/namali)\ **Replies:** 2\ **Last updated:** [June 19, 2020, 4:42pm UTC](https://discuss.elastic.co/t/query-from-multiple-fields-with-boolean-operators/237690 "2020-06-19T16:42:25Z")
wanted to query two fields (a and b) in 'and' /'or' operators to check ((a \> 90 and b \>=70 ) or (a\>80 and b\>98))with another field. Please guide me to write combine multiple query clauses using boolean operators """ up… --- ## [Logstash Error: LoadError: no such file to load -- pg](https://discuss.elastic.co/t/logstash-error-loaderror-no-such-file-to-load-pg/237831)
**Author:** [@Arnav\_Parashar](https://discuss.elastic.co/u/Arnav_Parashar)\ **Replies:** 2\ **Last updated:** [June 19, 2020, 4:16pm UTC](https://discuss.elastic.co/t/logstash-error-loaderror-no-such-file-to-load-pg/237831 "2020-06-19T16:16:56Z")
Hi, I am trying to sync a postgres database with elastic search. My file is the following: input { jdbc { jdbc\_driver\_library =\> "~/logstash/postgresql-42.2.14.jar" jdbc\_driver\_class =\> "org.p… --- ## [Filebeat to send application logs to elasticsearch](https://discuss.elastic.co/t/filebeat-to-send-application-logs-to-elasticsearch/237507)
**Author:** [@jacobzh](https://discuss.elastic.co/u/jacobzh)\ **Replies:** 10\ **Last updated:** [June 19, 2020, 4:08pm UTC](https://discuss.elastic.co/t/filebeat-to-send-application-logs-to-elasticsearch/237507 "2020-06-19T16:08:07Z")
Hi, I want to use filebeat to ship developers application logs to elasticsearch running in a developers servers. Developers application generates a log file in a particular folder. Whenever the log file reaches a config… --- ## [Elasticsearch null values aggregation](https://discuss.elastic.co/t/elasticsearch-null-values-aggregation/237828)
**Author:** [@hiba](https://discuss.elastic.co/u/hiba)\ **Replies:** 1\ **Last updated:** [June 19, 2020, 3:57pm UTC](https://discuss.elastic.co/t/elasticsearch-null-values-aggregation/237828 "2020-06-19T15:57:11Z")
Hi , is null values considered a correct value for AVG aggregation in elasticsearch ? example a=5 b=15 c=0 avg =(5+15+0)/3 or avg=(5+15)/2 any help pease! --- ## [Kibana short URL not working behind reverse proxy](https://discuss.elastic.co/t/kibana-short-url-not-working-behind-reverse-proxy/237114)
**Author:** [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Replies:** 1\ **Last updated:** [June 19, 2020, 2:49pm UTC](https://discuss.elastic.co/t/kibana-short-url-not-working-behind-reverse-proxy/237114 "2020-06-19T14:49:47Z")
I’ve a Kibana running on port 5601. And we have set-up Nginx reverse proxy on port 80 that uses RO credentials and sends requests to kibana on port 5601. This is so that RO (read-only) customers can access dashboard with… --- ## [Same log file contains different format of logs data. How can I parse it?](https://discuss.elastic.co/t/same-log-file-contains-different-format-of-logs-data-how-can-i-parse-it/237742)
**Author:** [@TUSHAR\_Sinha](https://discuss.elastic.co/u/TUSHAR_Sinha)\ **Replies:** 8\ **Last updated:** [June 19, 2020, 2:49pm UTC](https://discuss.elastic.co/t/same-log-file-contains-different-format-of-logs-data-how-can-i-parse-it/237742 "2020-06-19T14:49:19Z")
Hi all, I want to parse the logfile which has a different pattern in almost every line. The main difference is actually the length of each line. Suppose my logs have a named variable, in first log it may contain three n… --- ## [Logstash elasticsearch filter causing high CPU usage](https://discuss.elastic.co/t/logstash-elasticsearch-filter-causing-high-cpu-usage/237693)
**Author:** [@Andrew22](https://discuss.elastic.co/u/Andrew22)\ **Replies:** 2\ **Last updated:** [June 19, 2020, 2:17pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-causing-high-cpu-usage/237693 "2020-06-19T14:17:26Z")
Hello, like the title says I am using the elasticsearch filter in logstash and it is causing high CPU usage. I am wondering if there is a way to cache the looked up results so that it may reduce the CPU usage I am seein… --- ## [Kibana 7.8.0 url image problem](https://discuss.elastic.co/t/kibana-7-8-0-url-image-problem/237782)
**Author:** [@Musab\_Dogan](https://discuss.elastic.co/u/Musab_Dogan)\ **Replies:** 1\ **Last updated:** [June 19, 2020, 1:55pm UTC](https://discuss.elastic.co/t/kibana-7-8-0-url-image-problem/237782 "2020-06-19T13:55:07Z")
Hello, I update kibana 7.7.1 to kibana 7.8.0 Before update all of my images were in this folder /usr/share/kibana/optimize/bundles/src/legacy/ui/public/field\_editor/components/field\_format\_editor/editors/url/icons/flag… --- ## [Can't get text on a START\_OBJECT at 1:159\]\]](https://discuss.elastic.co/t/cant-get-text-on-a-start-object-at-1-159/236543)
**Author:** [@Keener](https://discuss.elastic.co/u/Keener)\ **Replies:** 2\ **Last updated:** [June 19, 2020, 1:51pm UTC](https://discuss.elastic.co/t/cant-get-text-on-a-start-object-at-1-159/236543 "2020-06-19T13:51:57Z")
HI, I am a first time user of this forum, I hope this is the place to post this question/issue. I have a customer that upgraded to ES 6.8.9 and now gets the following messages, what does this mean? Preformatted text'El… --- ## [Using Kibana and Watcher function for non-aggregate data visualization and alerting](https://discuss.elastic.co/t/using-kibana-and-watcher-function-for-non-aggregate-data-visualization-and-alerting/237813)
**Author:** [@sinefromabove](https://discuss.elastic.co/u/sinefromabove)\ **Replies:** 0\ **Last updated:** [June 19, 2020, 1:34pm UTC](https://discuss.elastic.co/t/using-kibana-and-watcher-function-for-non-aggregate-data-visualization-and-alerting/237813 "2020-06-19T13:34:50Z")
I have tried using Kibana to visualize data that we are streaming. To be specific, it is measurement data for parts that we manufacture. I want to set-up an alert; to get an email notification whenever a part is out of s… --- ## [How can I filter for the average bucket?](https://discuss.elastic.co/t/how-can-i-filter-for-the-average-bucket/237812)
**Author:** [@serengul](https://discuss.elastic.co/u/serengul)\ **Replies:** 0\ **Last updated:** [June 19, 2020, 1:32pm UTC](https://discuss.elastic.co/t/how-can-i-filter-for-the-average-bucket/237812 "2020-06-19T13:32:56Z")
How can I filter for the average bucket? I want to see the count of requests to my servers per second, but since I cannot filter my documents, nginx error logs is included in my visualization . --- ## [Getting connectivity issue in filebeat with elasticsearch](https://discuss.elastic.co/t/getting-connectivity-issue-in-filebeat-with-elasticsearch/237811)
**Author:** [@Avinash\_sanapala](https://discuss.elastic.co/u/Avinash_sanapala)\ **Replies:** 0\ **Last updated:** [June 19, 2020, 1:32pm UTC](https://discuss.elastic.co/t/getting-connectivity-issue-in-filebeat-with-elasticsearch/237811 "2020-06-19T13:32:11Z")
getting the below error while connecting to elastic search from filebeat failed to check for policy name 'filebeat': (status=403) {"error":{"root\_cause":\[{"type":"security\_exception","reason":"action \[cluster:admin/ilm/… --- ## [.net logs from filebeat to logstash multiline proper format](https://discuss.elastic.co/t/net-logs-from-filebeat-to-logstash-multiline-proper-format/237757)
**Author:** [@catadetest](https://discuss.elastic.co/u/catadetest)\ **Replies:** 1\ **Last updated:** [June 19, 2020, 1:14pm UTC](https://discuss.elastic.co/t/net-logs-from-filebeat-to-logstash-multiline-proper-format/237757 "2020-06-19T13:14:53Z")
I'm trying to ingest logs from a .net application. I have filebeat installed on a node which pushes the logs to a logstash server. logfile: 2020-06-19 00:00:16.421 +02:00 \[Error\] \[Band.Account.HealthCheckService\] \[2HB0… --- ## [Logstash start successfully but no result](https://discuss.elastic.co/t/logstash-start-successfully-but-no-result/237611)
**Author:** [@Katia](https://discuss.elastic.co/u/Katia)\ **Replies:** 18\ **Last updated:** [June 19, 2020, 12:55pm UTC](https://discuss.elastic.co/t/logstash-start-successfully-but-no-result/237611 "2020-06-19T12:55:18Z")
Hello, I really need help importing my log files. If I create a file right now, this will be imported successfully, but if I try to import a file that already exists since about 11 hours, logstash will not show any out… --- ## [How to update documents without using the ingest pipeline](https://discuss.elastic.co/t/how-to-update-documents-without-using-the-ingest-pipeline/237766)
**Author:** [@mabr3](https://discuss.elastic.co/u/mabr3)\ **Replies:** 1\ **Last updated:** [June 19, 2020, 12:53pm UTC](https://discuss.elastic.co/t/how-to-update-documents-without-using-the-ingest-pipeline/237766 "2020-06-19T12:53:17Z")
Hi! Pretty much what the title says: I have an index which uses an ingest pipeline to add some fields and do some changes, but when updating the documents (e.g. for testing or to correct something) I don't want that pip… --- ## [Does installing azure plugin cause any data loss?](https://discuss.elastic.co/t/does-installing-azure-plugin-cause-any-data-loss/237799)
**Author:** [@gokulnath112](https://discuss.elastic.co/u/gokulnath112)\ **Replies:** 1\ **Last updated:** [June 19, 2020, 12:42pm UTC](https://discuss.elastic.co/t/does-installing-azure-plugin-cause-any-data-loss/237799 "2020-06-19T12:42:19Z")
Greetings..! Hope everyone is safe and good. I have a 3 node cluster in production.It holds almost 24Lakhs of records. I want to install azure plugin to take backup in azure container. As it is in production, i'm afraid… --- ## [Docker image in kubernetes](https://discuss.elastic.co/t/docker-image-in-kubernetes/237805)
**Author:** [@rwxr\_xr\_x](https://discuss.elastic.co/u/rwxr_xr_x)\ **Replies:** 0\ **Last updated:** [June 19, 2020, 12:33pm UTC](https://discuss.elastic.co/t/docker-image-in-kubernetes/237805 "2020-06-19T12:33:26Z")
Hello, I see many posts about this error, they all seem to mention external storage, but I don't use any external volumnes. The error I get is: Underlying file changed by an external force I use docker.elastic.co/ela… --- ## [Issue running Kibana behind a Zuul proxy with basic security enabled](https://discuss.elastic.co/t/issue-running-kibana-behind-a-zuul-proxy-with-basic-security-enabled/237792)
**Author:** [@hrb.duke](https://discuss.elastic.co/u/hrb.duke)\ **Replies:** 0\ **Last updated:** [June 19, 2020, 11:01am UTC](https://discuss.elastic.co/t/issue-running-kibana-behind-a-zuul-proxy-with-basic-security-enabled/237792 "2020-06-19T11:01:51Z")
We are running Kibana 7.6.2 behind a Zuul proxy which was put in place when running 6.2 in order to provide secure access. We now wish to make use of the basic security features available in the Elastic stack, but prefer… --- ## [Elasticsearch running in a docker container: How identify it as target for log events?](https://discuss.elastic.co/t/elasticsearch-running-in-a-docker-container-how-identify-it-as-target-for-log-events/237791)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 1\ **Last updated:** [June 19, 2020, 12:22pm UTC](https://discuss.elastic.co/t/elasticsearch-running-in-a-docker-container-how-identify-it-as-target-for-log-events/237791 "2020-06-19T12:22:21Z")
Dear community, I am askig myself this: I have as test a docker-compose.yml up & running with 5 nodes - 3 es node, 1 kibana, 1 logstash. Each and everyone in its container. So far so good. Now I wanted to send from a vm… --- ## [Kerberos support in Jdbc input plugin](https://discuss.elastic.co/t/kerberos-support-in-jdbc-input-plugin/237801)
**Author:** [@shubhamshd99](https://discuss.elastic.co/u/shubhamshd99)\ **Replies:** 0\ **Last updated:** [June 19, 2020, 12:05pm UTC](https://discuss.elastic.co/t/kerberos-support-in-jdbc-input-plugin/237801 "2020-06-19T12:05:47Z")
Hi Guys, Earlier jdbc input plugin did not support kerberos authentication!! So has kerberos support for database connection through jdbc input plugin been added or not?? --- ## [Non standard log](https://discuss.elastic.co/t/non-standard-log/237800)
**Author:** [@AngeloM](https://discuss.elastic.co/u/AngeloM)\ **Replies:** 0\ **Last updated:** [June 19, 2020, 11:57am UTC](https://discuss.elastic.co/t/non-standard-log/237800 "2020-06-19T11:57:36Z")
2018-06-13 13:45:04 DEBUG JAXBGenericUtils:33 - JAXBContext.newInstance(au.bdau.fasci.generated) 2018-06-13 13:45:04 DEBUG JAXBGenericUtils:169 - \*\*\* getObjectXML(String sa, JAXBContext jcpaut) \*\*\* 2018-06-13 13:45:04 … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1985) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1987)