# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=234 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 235 --- ## [Error in heartbeat](https://discuss.elastic.co/t/error-in-heartbeat/359977)
**Author:** [@robbyq92](https://discuss.elastic.co/u/robbyq92)\ **Replies:** 2\ **Last updated:** [May 23, 2024, 11:42am UTC](https://discuss.elastic.co/t/error-in-heartbeat/359977 "2024-05-23T11:42:57Z")
apiVersion: v1 kind: ConfigMap metadata: name: heartbeat-elk-config namespace: heartbeat-elk data: heartbeat.yml: | heartbeat.monitors: - type: http schedule: '@every 30s' urls: \["http://example… --- ## [Logstash Output Empty || Firewall](https://discuss.elastic.co/t/logstash-output-empty-firewall/360041)
**Author:** [@Yogesh\_AS](https://discuss.elastic.co/u/Yogesh_AS)\ **Replies:** 1\ **Last updated:** [May 23, 2024, 11:15am UTC](https://discuss.elastic.co/t/logstash-output-empty-firewall/360041 "2024-05-23T11:15:54Z")
Hi Team, I have a issues in collecting the traps from the logstash. please help me out what is the issues in the given below script. input { snmptrap { type =\> "snmptrap" host =\> "10.10.100.19" #logstashserver ip p… --- ## [Possible race condition on metricbeat startup (rename meta.json.new fails)](https://discuss.elastic.co/t/possible-race-condition-on-metricbeat-startup-rename-meta-json-new-fails/357998)
**Author:** [@smoehrle](https://discuss.elastic.co/u/smoehrle)\ **Replies:** 5\ **Last updated:** [May 23, 2024, 10:01am UTC](https://discuss.elastic.co/t/possible-race-condition-on-metricbeat-startup-rename-meta-json-new-fails/357998 "2024-05-23T10:01:30Z")
Hey, I use Metricbeat (version 8.13.2) as sidecar in an AWS ECS Service. Every now and then (approx. 1 out of 100 task startups, but not in regular intervals) metricbeat fails on startup with the below error message. As… --- ## [\[Error\] Unable to run esrally benchmark in local](https://discuss.elastic.co/t/error-unable-to-run-esrally-benchmark-in-local/360053)
**Author:** [@gmittal22](https://discuss.elastic.co/u/gmittal22)\ **Replies:** 2\ **Last updated:** [May 23, 2024, 9:45am UTC](https://discuss.elastic.co/t/error-unable-to-run-esrally-benchmark-in-local/360053 "2024-05-23T09:45:36Z")
Command used: esrally race --distribution-version=7.10.0 --track=geonames --challenge=append-no-conflicts --target-hosts=127.0.0.1:9200 --kill-running-processes --pipeline=benchmark-only Logs: 2024-05-23 04:51:49,486 … --- ## [Improving Elasticsearach ingest capacity](https://discuss.elastic.co/t/improving-elasticsearach-ingest-capacity/360050)
**Author:** [@grazingelk](https://discuss.elastic.co/u/grazingelk)\ **Replies:** 6\ **Last updated:** [May 23, 2024, 9:33am UTC](https://discuss.elastic.co/t/improving-elasticsearach-ingest-capacity/360050 "2024-05-23T09:33:08Z")
Hi all, I have a self-hosted Kafka -\> Logstash -\> Elasticsearch setup. Logstash doesn't seem to be the bottleneck. By sending the LS output to /dev/null, I was able to achieve an average rate of 97,000 documents per s… --- ## [Reindex find different storage size](https://discuss.elastic.co/t/reindex-find-different-storage-size/360045)
**Author:** [@Frances\_Chu](https://discuss.elastic.co/u/Frances_Chu)\ **Replies:** 5\ **Last updated:** [May 23, 2024, 9:33am UTC](https://discuss.elastic.co/t/reindex-find-different-storage-size/360045 "2024-05-23T09:33:07Z")
i got 2 index: index\_A with 10 docs indexB with 4 docs I try to reindex index\_A and index\_B to index\_C reindex index\_A and index\_B to index\_D with no error message I found both index\_C and index\_D got 14 docs, expec… --- ## [Compare query performance between two index](https://discuss.elastic.co/t/compare-query-performance-between-two-index/360060)
**Author:** [@Frances\_Chu](https://discuss.elastic.co/u/Frances_Chu)\ **Replies:** 0\ **Last updated:** [May 23, 2024, 9:12am UTC](https://discuss.elastic.co/t/compare-query-performance-between-two-index/360060 "2024-05-23T09:12:31Z")
Would like to know is there any method to compare the performance of two index --- ## [Data field type changed from date to text](https://discuss.elastic.co/t/data-field-type-changed-from-date-to-text/360046)
**Author:** [@Frances\_Chu](https://discuss.elastic.co/u/Frances_Chu)\ **Replies:** 1\ **Last updated:** [May 23, 2024, 8:51am UTC](https://discuss.elastic.co/t/data-field-type-changed-from-date-to-text/360046 "2024-05-23T08:51:37Z")
My logstash configuration file like this After reading the csv file I change the log\_datetime field from "dd-MM HH:mm:ss" to "2024-05-23T01:18:07.000Z" by the following configuration in test.conf date { match =\> … --- ## [Increased write rejection count since elastic 8 upgrade](https://discuss.elastic.co/t/increased-write-rejection-count-since-elastic-8-upgrade/360055)
**Author:** [@kley](https://discuss.elastic.co/u/kley)\ **Replies:** 0\ **Last updated:** [May 23, 2024, 8:41am UTC](https://discuss.elastic.co/t/increased-write-rejection-count-since-elastic-8-upgrade/360055 "2024-05-23T08:41:28Z")
Hello! We recently upgraded one of our elasticsearch 7 environments to elasticsearch 8.9.1 and are now seeing many write rejections for whatever reason. We do not see any CPU and memory increase, we rather see a decreas… --- ## [Node: http://boardoftrustees-elk.kb.westeurope.azure.elastic-cloud.com:9243/, status: 400, \[es/indices.create\] Expecting JSON data but response content-type is: application/octet-stream](https://discuss.elastic.co/t/node-http-boardoftrustees-elk-kb-westeurope-azure-elastic-cloud-com-9243-status-400-es-indices-create-expecting-json-data-but-response-content-type-is-application-octet-stream/360024)
**Author:** [@fsk](https://discuss.elastic.co/u/fsk)\ **Replies:** 6\ **Last updated:** [May 23, 2024, 8:39am UTC](https://discuss.elastic.co/t/node-http-boardoftrustees-elk-kb-westeurope-azure-elastic-cloud-com-9243-status-400-es-indices-create-expecting-json-data-but-response-content-type-is-application-octet-stream/360024 "2024-05-23T08:39:59Z")
Hello guys. I have a project using spring boot and elastic cloud on azure. When i run command mvn clean install i have an error like below. Caused by: co.elastic.clients.transport.TransportException: node: http://trust… --- ## [Live index data transformation by using ingest pipeline](https://discuss.elastic.co/t/live-index-data-transformation-by-using-ingest-pipeline/359975)
**Author:** [@PavanSatya](https://discuss.elastic.co/u/PavanSatya)\ **Replies:** 7\ **Last updated:** [May 23, 2024, 8:32am UTC](https://discuss.elastic.co/t/live-index-data-transformation-by-using-ingest-pipeline/359975 "2024-05-23T08:32:45Z")
Dear Team, I'm new to ELK stack and need your support on this, I had an index where live date in coming form the kafka. Recently I had converted string data to date format by using the ingest pipeline. After that I h… --- ## [Create crawler index programatically](https://discuss.elastic.co/t/create-crawler-index-programatically/360048)
**Author:** [@javigsg](https://discuss.elastic.co/u/javigsg)\ **Replies:** 0\ **Last updated:** [May 23, 2024, 8:11am UTC](https://discuss.elastic.co/t/create-crawler-index-programatically/360048 "2024-05-23T08:11:07Z")
Hi Team! Do you know if it is possible to create an crawler index programatically with the API and then configure a custom ingesting pipeline? cheers --- ## [Custom Logs integration with variable file path?](https://discuss.elastic.co/t/custom-logs-integration-with-variable-file-path/358508)
**Author:** [@jbrasee](https://discuss.elastic.co/u/jbrasee)\ **Replies:** 1\ **Last updated:** [May 23, 2024, 7:41am UTC](https://discuss.elastic.co/t/custom-logs-integration-with-variable-file-path/358508 "2024-05-23T07:41:14Z")
I'm using a Fleet Agent with Custom Logs integration, but the path to the log file is dynamic and dependent on the name of the agent host -- so I have "C:\\logs\\${host.hostname}\\elastic\*.log" as the log file path. However… --- ## [Searching words within a Sentence/paragraph](https://discuss.elastic.co/t/searching-words-within-a-sentence-paragraph/360044)
**Author:** [@Alok\_Tripathi](https://discuss.elastic.co/u/Alok_Tripathi)\ **Replies:** 2\ **Last updated:** [May 23, 2024, 7:39am UTC](https://discuss.elastic.co/t/searching-words-within-a-sentence-paragraph/360044 "2024-05-23T07:39:41Z")
I want to search for words to be in same sentence/paragraph. Example: If I search for words "Bill", "Steve" then no document2 should be returned because both words exist in the same sentence. But if I search for "Bill" … --- ## [Config logstash display grok pattern](https://discuss.elastic.co/t/config-logstash-display-grok-pattern/359049)
**Author:** [@iceman0410](https://discuss.elastic.co/u/iceman0410)\ **Replies:** 1\ **Last updated:** [May 23, 2024, 7:38am UTC](https://discuss.elastic.co/t/config-logstash-display-grok-pattern/359049 "2024-05-23T07:38:19Z")
Hi everyone, I am trying to config logstash.conf to display 3 patterns: Date time, Log Level and Message but it does not display patterns. Here is my logstash config file. Please help me check correct if any thing wrong… --- ## [Controlling dropping of multiple Logstash instances when using with Kafka](https://discuss.elastic.co/t/controlling-dropping-of-multiple-logstash-instances-when-using-with-kafka/360036)
**Author:** [@kentshenlim](https://discuss.elastic.co/u/kentshenlim)\ **Replies:** 1\ **Last updated:** [May 23, 2024, 7:28am UTC](https://discuss.elastic.co/t/controlling-dropping-of-multiple-logstash-instances-when-using-with-kafka/360036 "2024-05-23T07:28:04Z")
Hi everyone, I am new to Elastic, apologies if this is something obvious. I have multiple Logstash instances getting input from MSK Kafka, so as to lower the load per Logstash instance. In each Logstash instance, I use… --- ## [Date stream can not be created with uppercase name?](https://discuss.elastic.co/t/date-stream-can-not-be-created-with-uppercase-name/360034)
**Author:** [@liurui](https://discuss.elastic.co/u/liurui)\ **Replies:** 1\ **Last updated:** [May 23, 2024, 7:25am UTC](https://discuss.elastic.co/t/date-stream-can-not-be-created-with-uppercase-name/360034 "2024-05-23T07:25:57Z")
Why can't date stream names contain uppercase letters? PUT \_data\_stream/Log # response { "error" : { "root\_cause" : \[ { "type" : "illegal\_argument\_exception", "reason" : "data\_stream \[Log\] m… --- ## [Facing error while starting kibana & trying to connect to elasticsearch version 8.5.1](https://discuss.elastic.co/t/facing-error-while-starting-kibana-trying-to-connect-to-elasticsearch-version-8-5-1/359884)
**Author:** [@Sunil\_Jagtap](https://discuss.elastic.co/u/Sunil_Jagtap)\ **Replies:** 7\ **Last updated:** [May 23, 2024, 6:17am UTC](https://discuss.elastic.co/t/facing-error-while-starting-kibana-trying-to-connect-to-elasticsearch-version-8-5-1/359884 "2024-05-23T06:17:18Z")
Hi Everyone, w.r.t suggetion given by Devid over post : I tried both ways, (FYI : I am testing this on kibana plugin development environment) supplied below values to respective parameters to config/kibana.yml el… --- ## [Logstash timestamp format](https://discuss.elastic.co/t/logstash-timestamp-format/359949)
**Author:** [@iceman0410](https://discuss.elastic.co/u/iceman0410)\ **Replies:** 4\ **Last updated:** [May 23, 2024, 5:32am UTC](https://discuss.elastic.co/t/logstash-timestamp-format/359949 "2024-05-23T05:32:12Z")
Hi everyone, I have a log message as below. The date is not match any format so logstash does not parse timestamp. Anyone please help me review my logstash conf and advice please. Thanks Log Message: \[30@00:01:33.048:… --- ## [Upgrade ES 7.17.10 \> 8.6.2](https://discuss.elastic.co/t/upgrade-es-7-17-10-8-6-2/360014)
**Author:** [@Albert\_S](https://discuss.elastic.co/u/Albert_S)\ **Replies:** 1\ **Last updated:** [May 22, 2024, 11:02pm UTC](https://discuss.elastic.co/t/upgrade-es-7-17-10-8-6-2/360014 "2024-05-22T23:02:42Z")
Hello. I'm a complete newbie to ES. please help me, I need to update the cluster, what is the best or correct way to do this. which way to go? 9 nodes, docker, number\_of\_replics = 0.kibana and logstash are not used. … --- ## [Getting ReceiveTimeoutTransportException at Index creation, Indexing and Repo Creation](https://discuss.elastic.co/t/getting-receivetimeouttransportexception-at-index-creation-indexing-and-repo-creation/359072)
**Author:** [@dharunkumar](https://discuss.elastic.co/u/dharunkumar)\ **Replies:** 6\ **Last updated:** [May 22, 2024, 5:39pm UTC](https://discuss.elastic.co/t/getting-receivetimeouttransportexception-at-index-creation-indexing-and-repo-creation/359072 "2024-05-22T17:39:37Z")
Hi Team, while creating new Index shard acknowledgement fails, due to this mapping is not updated to the Index and status is yellow. Indexing fails due to ReceiveTimeoutTransportException. Also, Repo creation fails due … --- ## [Restore snapshot from cluster without hot-warm architecture](https://discuss.elastic.co/t/restore-snapshot-from-cluster-without-hot-warm-architecture/359886)
**Author:** [@Aliya\_Khalel](https://discuss.elastic.co/u/Aliya_Khalel)\ **Replies:** 1\ **Last updated:** [May 22, 2024, 4:06pm UTC](https://discuss.elastic.co/t/restore-snapshot-from-cluster-without-hot-warm-architecture/359886 "2024-05-22T16:06:36Z")
Hello, I have question Our customer has small 3-node cluster with 5 TB data. We planning to deploy new cluster with 3 hot, 1 warm and 3 cold nodes and 3 master. On which step I can restore snapshot with data to new c… --- ## [Replace doesn't seem to be working](https://discuss.elastic.co/t/replace-doesnt-seem-to-be-working/358518)
**Author:** [@roman-tasi](https://discuss.elastic.co/u/roman-tasi)\ **Replies:** 2\ **Last updated:** [May 22, 2024, 3:22pm UTC](https://discuss.elastic.co/t/replace-doesnt-seem-to-be-working/358518 "2024-05-22T15:22:24Z")
This is what I am trying: # if geoip city and region are both blank, replace region value with country value # this is to avoid double ?s in alerts for example "?,?" if \[geoip\]\[city\_name\] == "?" and \[geoip\]\[region\_name\]… --- ## [Kibana 8.12 transform process is too slow](https://discuss.elastic.co/t/kibana-8-12-transform-process-is-too-slow/360007)
**Author:** [@RobertC1](https://discuss.elastic.co/u/RobertC1)\ **Replies:** 0\ **Last updated:** [May 22, 2024, 3:06pm UTC](https://discuss.elastic.co/t/kibana-8-12-transform-process-is-too-slow/360007 "2024-05-22T15:06:56Z")
Every hour text files ar ingested to update the index. I have the following code of a process that transforms the data to seconds. "version": "10.0.0", "create\_time": 1714766696988, "source": { "index": \[ … --- ## [Error While PDF Reporting](https://discuss.elastic.co/t/error-while-pdf-reporting/359907)
**Author:** [@NikoCosmico01](https://discuss.elastic.co/u/NikoCosmico01)\ **Replies:** 1\ **Last updated:** [May 22, 2024, 3:00pm UTC](https://discuss.elastic.co/t/error-while-pdf-reporting/359907 "2024-05-22T15:00:53Z")
While I click on Share -\> PDF Reports on kibana I see the following ERROR: \[2024-05-21T09:59:07.004+00:00\]\[ERROR\]\[plugins.reporting.runTask\] Error: ReportingError(code: unknown\_error) "Max attempts (3) reached for job l… --- ## [Index sorting would cause indexed data movement?](https://discuss.elastic.co/t/index-sorting-would-cause-indexed-data-movement/359978)
**Author:** [@chrwhy](https://discuss.elastic.co/u/chrwhy)\ **Replies:** 9\ **Last updated:** [May 22, 2024, 2:02pm UTC](https://discuss.elastic.co/t/index-sorting-would-cause-indexed-data-movement/359978 "2024-05-22T14:02:32Z")
Anybody know that index-sorting data is physically or logically sorted on disk? here is my question: if there are existing sorted data, when inserting a new record into the index, how will the new index-sorting data be … --- ## [Large number of Empty Fields in Discover Tab](https://discuss.elastic.co/t/large-number-of-empty-fields-in-discover-tab/358585)
**Author:** [@morningjacket](https://discuss.elastic.co/u/morningjacket)\ **Replies:** 4\ **Last updated:** [May 22, 2024, 1:29pm UTC](https://discuss.elastic.co/t/large-number-of-empty-fields-in-discover-tab/358585 "2024-05-22T13:29:48Z")
Hello all, I am trying reduce the noise when using Kibana and I have noticed that within the discover tab and when trying to create a lens there are 5700+ fields which are always displayed as empty. I have tried to go … --- ## [Multiple Harvested of log file path got started for the same log file name within the span of 7 seconds](https://discuss.elastic.co/t/multiple-harvested-of-log-file-path-got-started-for-the-same-log-file-name-within-the-span-of-7-seconds/360000)
**Author:** [@vikas271019](https://discuss.elastic.co/u/vikas271019)\ **Replies:** 1\ **Last updated:** [May 22, 2024, 1:25pm UTC](https://discuss.elastic.co/t/multiple-harvested-of-log-file-path-got-started-for-the-same-log-file-name-within-the-span-of-7-seconds/360000 "2024-05-22T13:25:08Z")
The problem that we are facing is, multiple harvester is being created for a single log file, within a span of 7 seconds as result of which duplicate logs being generated from filebeat. For example, please find the belo… --- ## [Grok pattern error after upgrade logstash from 7.5.2 to 7.17.0v](https://discuss.elastic.co/t/grok-pattern-error-after-upgrade-logstash-from-7-5-2-to-7-17-0v/359986)
**Author:** [@padmavathi](https://discuss.elastic.co/u/padmavathi)\ **Replies:** 2\ **Last updated:** [May 22, 2024, 1:19pm UTC](https://discuss.elastic.co/t/grok-pattern-error-after-upgrade-logstash-from-7-5-2-to-7-17-0v/359986 "2024-05-22T13:19:58Z")
Hi , I have recently upgraded logstash version from 7.52 to 7.17.0. I am getting the grok pattern error now .i dont have any issues with the v7.5.2. \[2024-05-22T12:13:51,017\]\[INFO \]\[logstash.outputs.elasticsearch\]\[uat… --- ## [Export index template](https://discuss.elastic.co/t/export-index-template/359969)
**Author:** [@alro](https://discuss.elastic.co/u/alro)\ **Replies:** 7\ **Last updated:** [May 22, 2024, 12:55pm UTC](https://discuss.elastic.co/t/export-index-template/359969 "2024-05-22T12:55:47Z")
Hi Community i like to export a changed index template from the "Index Management". The index is a clone of an existing Index and then edited. I now need to have an export of this edited index to replicate/import it on… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=233) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=235)