# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=236 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 237 --- ## [How to get Logstash installer to download to /tmp?](https://discuss.elastic.co/t/how-to-get-logstash-installer-to-download-to-tmp/359574)
**Author:** [@paolovalladolid](https://discuss.elastic.co/u/paolovalladolid)\ **Replies:** 5\ **Last updated:** [May 21, 2024, 3:49pm UTC](https://discuss.elastic.co/t/how-to-get-logstash-installer-to-download-to-tmp/359574 "2024-05-21T15:49:05Z")
I followed the instructions for installing with YUM, published at: This is the error: Error Summary ------------- Disk Requirements: At least 297MB more space needed on the / filesystem. Looks like 405MB on / is no… --- ## [Help with query](https://discuss.elastic.co/t/help-with-query/359929)
**Author:** [@mbuchan74](https://discuss.elastic.co/u/mbuchan74)\ **Replies:** 5\ **Last updated:** [May 21, 2024, 3:46pm UTC](https://discuss.elastic.co/t/help-with-query/359929 "2024-05-21T15:46:21Z")
Hi, I am trying to query inside the message to search for anything that contains 'HTTP STATUS' But id like to query to find all results that begin with 4 i.e status=404 or if status=400. I can search for a singular one… --- ## [Extract string from GREEDYDATA](https://discuss.elastic.co/t/extract-string-from-greedydata/359861)
**Author:** [@lemospt](https://discuss.elastic.co/u/lemospt)\ **Replies:** 4\ **Last updated:** [May 21, 2024, 3:29pm UTC](https://discuss.elastic.co/t/extract-string-from-greedydata/359861 "2024-05-21T15:29:19Z")
Hi, my log message is already parsed in a grok filter and i have greedy data, in some messages the greedy data has an oracle error code, and i want to create a new field with this error code. The error code could be at … --- ## [\[Java SDK\] Optimistic lock occurs since switching to the 8.10 SDK](https://discuss.elastic.co/t/java-sdk-optimistic-lock-occurs-since-switching-to-the-8-10-sdk/359523)
**Author:** [@Odarik](https://discuss.elastic.co/u/Odarik)\ **Replies:** 1\ **Last updated:** [May 21, 2024, 2:35pm UTC](https://discuss.elastic.co/t/java-sdk-optimistic-lock-occurs-since-switching-to-the-8-10-sdk/359523 "2024-05-21T14:35:03Z")
Hello, We were in the process of switching from Elasticsearch 7 to Elasticsearch 8 and the first step was to update all of our Java SDK from the version 7.17.9 to 8.10.9. We have a CI that check regression on this part… --- ## [What is the best possible way to show time difference between two events in elastic search?](https://discuss.elastic.co/t/what-is-the-best-possible-way-to-show-time-difference-between-two-events-in-elastic-search/359911)
**Author:** [@gaurow.deshmukh](https://discuss.elastic.co/u/gaurow.deshmukh)\ **Replies:** 1\ **Last updated:** [May 21, 2024, 12:42pm UTC](https://discuss.elastic.co/t/what-is-the-best-possible-way-to-show-time-difference-between-two-events-in-elastic-search/359911 "2024-05-21T12:42:34Z")
What is the best possible way to show time difference between two events in Elasticsearch? Is it possible to add an additional field & show the time difference in that particular field --- ## [Getting a syntax error on output - Expected one of \[ \\\\t\\\\r\\\\n\], \\"#\\", \\"(\\" at line](https://discuss.elastic.co/t/getting-a-syntax-error-on-output-expected-one-of-t-r-n-at-line/359916)
**Author:** [@Danyal\_Danish](https://discuss.elastic.co/u/Danyal_Danish)\ **Replies:** 6\ **Last updated:** [May 21, 2024, 12:33pm UTC](https://discuss.elastic.co/t/getting-a-syntax-error-on-output-expected-one-of-t-r-n-at-line/359916 "2024-05-21T12:33:25Z")
Hi, I'm facing an issue when trying to run this logstash configuration that uses http\_poller to run a query and then compare the results from it with a local data table on my pc. Here's the output and the ERROR in it: … --- ## [Grok filter works in debugger but not in logstash](https://discuss.elastic.co/t/grok-filter-works-in-debugger-but-not-in-logstash/359903)
**Author:** [@s0p4L1n3](https://discuss.elastic.co/u/s0p4L1n3)\ **Replies:** 4\ **Last updated:** [May 21, 2024, 12:27pm UTC](https://discuss.elastic.co/t/grok-filter-works-in-debugger-but-not-in-logstash/359903 "2024-05-21T12:27:27Z")
Hi, I want to monitor windows registry event. I have a grok filter to extract 2 values of registry path and put them in matching fields. The target field is winlog.event\_data.ObjectName Kibana displayed value: \\REG… --- ## [Elasticsearch cannot connect to the Remote Server](https://discuss.elastic.co/t/elasticsearch-cannot-connect-to-the-remote-server/359915)
**Author:** [@Akila\_P](https://discuss.elastic.co/u/Akila_P)\ **Replies:** 1\ **Last updated:** [May 21, 2024, 11:22am UTC](https://discuss.elastic.co/t/elasticsearch-cannot-connect-to-the-remote-server/359915 "2024-05-21T11:22:23Z")
When using Localhost root@ip-172-16-0-102:/etc/elasticsearch# curl localhost:9200 { "name" : "ip-172-16-0-102", "cluster\_name" : "elasticsearch", "cluster\_uuid" : "xXGFhvjvR\_qbJK\_oC0YPSg", "version" : { "num… --- ## [Why is Elasticsearch not using analyzer tokens during search?](https://discuss.elastic.co/t/why-is-elasticsearch-not-using-analyzer-tokens-during-search/359859)
**Author:** [@nikola1](https://discuss.elastic.co/u/nikola1)\ **Replies:** 1\ **Last updated:** [May 21, 2024, 11:16am UTC](https://discuss.elastic.co/t/why-is-elasticsearch-not-using-analyzer-tokens-during-search/359859 "2024-05-21T11:16:58Z")
index/\_analyze { "analyzer": "autocomplete", "field": "name", "text": "жаб" } gives me correct tokens: { "tokens": \[{ "token": "žab", "start\_offset"… --- ## [Agents in Fleet Server going offline and inactive and becoming healthy any reason and how to delete the offline Agents from the Fleet server](https://discuss.elastic.co/t/agents-in-fleet-server-going-offline-and-inactive-and-becoming-healthy-any-reason-and-how-to-delete-the-offline-agents-from-the-fleet-server/357983)
**Author:** [@nkreddyp](https://discuss.elastic.co/u/nkreddyp)\ **Replies:** 1\ **Last updated:** [May 21, 2024, 11:09am UTC](https://discuss.elastic.co/t/agents-in-fleet-server-going-offline-and-inactive-and-becoming-healthy-any-reason-and-how-to-delete-the-offline-agents-from-the-fleet-server/357983 "2024-05-21T11:09:11Z")
we have integrated Linux and Windows hosts to Fleet server facing issue especially with windows agents its going offline very often and becoming healthy again i have checked the logs however i couldn't see any about this… --- ## [Caught exception while handling client http traffic, closing connection](https://discuss.elastic.co/t/caught-exception-while-handling-client-http-traffic-closing-connection/357567)
**Author:** [@sudharsanam132](https://discuss.elastic.co/u/sudharsanam132)\ **Replies:** 2\ **Last updated:** [May 21, 2024, 10:11am UTC](https://discuss.elastic.co/t/caught-exception-while-handling-client-http-traffic-closing-connection/357567 "2024-05-21T10:11:12Z")
While adding fleet I have this warning in elasticsearch repeatedly log: \[chamber1\] caught exception while handling client http traffic, closing connection Netty4HttpChannel{localAddress=/192.168.1.78:9200, remoteAddre… --- ## [ElasticSearch Snapshot using HDFS](https://discuss.elastic.co/t/elasticsearch-snapshot-using-hdfs/359908)
**Author:** [@saivenkatg5](https://discuss.elastic.co/u/saivenkatg5)\ **Replies:** 1\ **Last updated:** [May 21, 2024, 10:10am UTC](https://discuss.elastic.co/t/elasticsearch-snapshot-using-hdfs/359908 "2024-05-21T10:10:59Z")
Hey team, I was trying to take a snapshost of ES indices and store it in the HDFS files system, but when I give HDFS HA config, it is not able to initiate a config, whereas if we give Active NN hostname, it is working, … --- ## [Error from pwr admin while i m installing fleet server](https://discuss.elastic.co/t/error-from-pwr-admin-while-i-m-installing-fleet-server/357831)
**Author:** [@laurent\_mandine](https://discuss.elastic.co/u/laurent_mandine)\ **Replies:** 1\ **Last updated:** [May 21, 2024, 9:52am UTC](https://discuss.elastic.co/t/error-from-pwr-admin-while-i-m-installing-fleet-server/357831 "2024-05-21T09:52:02Z")
can t install fleet server and get this message error , it worked with Linux but not with windows , anyone can help ? thanks --- ## [Elastic Agent (fleet) change default mapping](https://discuss.elastic.co/t/elastic-agent-fleet-change-default-mapping/357212)
**Author:** [@Eran\_Hadad](https://discuss.elastic.co/u/Eran_Hadad)\ **Replies:** 1\ **Last updated:** [May 21, 2024, 9:45am UTC](https://discuss.elastic.co/t/elastic-agent-fleet-change-default-mapping/357212 "2024-05-21T09:45:26Z")
Hi, I'm using fleet agent to collect logs from Azure event hub. I'm simply trying to change mapping so one field would be a text instead of a keyword. To make a long story short, I found the Component Templates that i… --- ## [Error when assigning agent policy after data loss](https://discuss.elastic.co/t/error-when-assigning-agent-policy-after-data-loss/356854)
**Author:** [@malthuis](https://discuss.elastic.co/u/malthuis)\ **Replies:** 1\ **Last updated:** [May 21, 2024, 9:43am UTC](https://discuss.elastic.co/t/error-when-assigning-agent-policy-after-data-loss/356854 "2024-05-21T09:43:33Z")
Hello, a few days ago I had the problem that Kibana was still loading and followed the suggestion to delete everything related to kibana on StackOverflow (which I can't link to from here, but the topic was "Kibana serve… --- ## [Ignore API key failure from elastic cluster log](https://discuss.elastic.co/t/ignore-api-key-failure-from-elastic-cluster-log/359902)
**Author:** [@Nightingale\_John](https://discuss.elastic.co/u/Nightingale_John)\ **Replies:** 0\ **Last updated:** [May 21, 2024, 9:42am UTC](https://discuss.elastic.co/t/ignore-api-key-failure-from-elastic-cluster-log/359902 "2024-05-21T09:42:15Z")
Hi, For various reasons we have a lot of agents in the wild attempting to connect with aged API keys, e.g.: \[o.e.x.s.a.ApiKeyAuthenticator\] \[node\] Authentication using apikey failed - unable to find apikey with id Doe… --- ## [Logs-azure.eventhub@custom](https://discuss.elastic.co/t/logs-azure-eventhub-custom/356775)
**Author:** [@Eran\_Hadad](https://discuss.elastic.co/u/Eran_Hadad)\ **Replies:** 1\ **Last updated:** [May 21, 2024, 9:41am UTC](https://discuss.elastic.co/t/logs-azure-eventhub-custom/356775 "2024-05-21T09:41:05Z")
Hi, I'm using fleet to insert Azure logs into elasticsearch. I want to enrich my index with a new field so I created a new ingest pipeline named: logs-azure.eventhub@custom which I see that is been called from the mana… --- ## [What are the probable reasons of having LockException in logstash](https://discuss.elastic.co/t/what-are-the-probable-reasons-of-having-lockexception-in-logstash/359900)
**Author:** [@sasikiranvaddi](https://discuss.elastic.co/u/sasikiranvaddi)\ **Replies:** 0\ **Last updated:** [May 21, 2024, 9:29am UTC](https://discuss.elastic.co/t/what-are-the-probable-reasons-of-having-lockexception-in-logstash/359900 "2024-05-21T09:29:26Z")
Hi, We observe LockException when logstash process is running. Looking at the logs, before LockException has occurred logstash.agent is trying to fetch the pipelines count but it couldn't get casuing JavanNullPointerExc… --- ## [Help Needed: Interpreting MemoryAnalyzer Results for Memory Leak in ElasticSearch](https://discuss.elastic.co/t/help-needed-interpreting-memoryanalyzer-results-for-memory-leak-in-elasticsearch/359894)
**Author:** [@524186aa](https://discuss.elastic.co/u/524186aa)\ **Replies:** 0\ **Last updated:** [May 21, 2024, 8:41am UTC](https://discuss.elastic.co/t/help-needed-interpreting-memoryanalyzer-results-for-memory-leak-in-elasticsearch/359894 "2024-05-21T08:41:42Z")
Hi everyone, I'm encountering an issue with Elasticsearch and would greatly appreciate some assistance. Background Information: Elasticsearch Version: 7.15.2 Problem Description: I've been experiencing memory manage… --- ## [Establishing connection between Filbeat configured in AWS instance and Logstash in my localhost](https://discuss.elastic.co/t/establishing-connection-between-filbeat-configured-in-aws-instance-and-logstash-in-my-localhost/359885)
**Author:** [@NagendraK](https://discuss.elastic.co/u/NagendraK)\ **Replies:** 0\ **Last updated:** [May 21, 2024, 7:47am UTC](https://discuss.elastic.co/t/establishing-connection-between-filbeat-configured-in-aws-instance-and-logstash-in-my-localhost/359885 "2024-05-21T07:47:41Z")
I configured Filebeat in an AWS instance to harvest logs saved in efs and send to Logstash configured in my localhost (Windows). I started the Filebeat in the instance and ELK in my localhost. There is a way to establis… --- ## [Lower case all fields](https://discuss.elastic.co/t/lower-case-all-fields/359791)
**Author:** [@han\_fatzot](https://discuss.elastic.co/u/han_fatzot)\ **Replies:** 8\ **Last updated:** [May 21, 2024, 7:44am UTC](https://discuss.elastic.co/t/lower-case-all-fields/359791 "2024-05-21T07:44:20Z")
hello :blush: I want to create visualizations on lowercase fields. Text type can not work because it can be aggerated. example: I want to create a visualization that shows the top ten process.executable but i want to… --- ## [Cannot create a fleet policy without specifying package\_policies in Kibana.yml](https://discuss.elastic.co/t/cannot-create-a-fleet-policy-without-specifying-package-policies-in-kibana-yml/358526)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 1\ **Last updated:** [May 21, 2024, 7:42am UTC](https://discuss.elastic.co/t/cannot-create-a-fleet-policy-without-specifying-package-policies-in-kibana-yml/358526 "2024-05-21T07:42:58Z")
Hello, I'm doing some tests to try to create a docker compose that would spin up a quick cluster to be used as development and for this I want to have 2 fleet policies in kibana.yml. One would be the fleet server polic… --- ## [How to take the fleet ouptut?](https://discuss.elastic.co/t/how-to-take-the-fleet-ouptut/359218)
**Author:** [@Brian\_Jeong](https://discuss.elastic.co/u/Brian_Jeong)\ **Replies:** 1\ **Last updated:** [May 21, 2024, 7:24am UTC](https://discuss.elastic.co/t/how-to-take-the-fleet-ouptut/359218 "2024-05-21T07:24:17Z")
Does Elasticsearch snapshot restore information from fleet \> settings \> output also recover? --- ## [Logstash config with Grok](https://discuss.elastic.co/t/logstash-config-with-grok/359299)
**Author:** [@iceman0410](https://discuss.elastic.co/u/iceman0410)\ **Replies:** 15\ **Last updated:** [May 21, 2024, 5:31am UTC](https://discuss.elastic.co/t/logstash-config-with-grok/359299 "2024-05-21T05:31:48Z")
Hi Everyone, I am trying to config logstash parse the log with 3 field : date & time (dts), Log level (lvl) and rest message. But the out put always show timestamp is not correct, timestamp i want to show is the time i… --- ## [Elastic Search Cluster node set up and best practices](https://discuss.elastic.co/t/elastic-search-cluster-node-set-up-and-best-practices/359781)
**Author:** [@Bibhutibhusan\_Sahoo](https://discuss.elastic.co/u/Bibhutibhusan_Sahoo)\ **Replies:** 2\ **Last updated:** [May 21, 2024, 5:03am UTC](https://discuss.elastic.co/t/elastic-search-cluster-node-set-up-and-best-practices/359781 "2024-05-21T05:03:36Z")
Hi team, We have two data center and hosted three Elasticsearch (master + data) node in each of these two data centers (2 node + 1 node). The intension is to achieve high availability during diester recovery. All these … --- ## [Filebeat with Kafka Does Not Insert Message Missing a Colon into Kibana](https://discuss.elastic.co/t/filebeat-with-kafka-does-not-insert-message-missing-a-colon-into-kibana/359737)
**Author:** [@jquisenberry](https://discuss.elastic.co/u/jquisenberry)\ **Replies:** 4\ **Last updated:** [May 20, 2024, 11:51pm UTC](https://discuss.elastic.co/t/filebeat-with-kafka-does-not-insert-message-missing-a-colon-into-kibana/359737 "2024-05-20T23:51:10Z")
I am working with an application that writes to a log file. Filebeat uses the Kafka module to send the log data to a central logging server. I am testing the process by appending to the log file with echo. This command … --- ## [Access number of tokens of a query from a filter](https://discuss.elastic.co/t/access-number-of-tokens-of-a-query-from-a-filter/359869)
**Author:** [@antoinelefloch](https://discuss.elastic.co/u/antoinelefloch)\ **Replies:** 0\ **Last updated:** [May 20, 2024, 9:12pm UTC](https://discuss.elastic.co/t/access-number-of-tokens-of-a-query-from-a-filter/359869 "2024-05-20T21:12:03Z")
Hello, I would like to filter only if there is more than one token in the query. I don't want to filter if there is a single stop word in the query. I was thinking of using something like here below in my settings, but… --- ## [Error encountered in metric beat installation](https://discuss.elastic.co/t/error-encountered-in-metric-beat-installation/359783)
**Author:** [@viera120](https://discuss.elastic.co/u/viera120)\ **Replies:** 1\ **Last updated:** [May 20, 2024, 7:49pm UTC](https://discuss.elastic.co/t/error-encountered-in-metric-beat-installation/359783 "2024-05-20T19:49:57Z")
Hi, We are running a 3 Node Elastic Cluster with Basic security features enabled and HTTPS communication with browser and Kibana enabled. We have followed the \[https://www.elastic.co/guide/en/elasticsearch/reference/cu… --- ## [Kibana cannot connect to the Elastic Package Registry, which provides Elastic Agent integrations](https://discuss.elastic.co/t/kibana-cannot-connect-to-the-elastic-package-registry-which-provides-elastic-agent-integrations/359829)
**Author:** [@sara.0x](https://discuss.elastic.co/u/sara.0x)\ **Replies:** 1\ **Last updated:** [May 20, 2024, 7:43pm UTC](https://discuss.elastic.co/t/kibana-cannot-connect-to-the-elastic-package-registry-which-provides-elastic-agent-integrations/359829 "2024-05-20T19:43:58Z")
hello I am receiving this message when I try to install a fleet server 'Kibana cannot connect to the Elastic Package Registry, which provides Elastic Agent integrations' due this reason Kibana is not showing the fleet s… --- ## [Scaling cluster waits on shard initialization](https://discuss.elastic.co/t/scaling-cluster-waits-on-shard-initialization/359863)
**Author:** [@cvarano](https://discuss.elastic.co/u/cvarano)\ **Replies:** 0\ **Last updated:** [May 20, 2024, 7:22pm UTC](https://discuss.elastic.co/t/scaling-cluster-waits-on-shard-initialization/359863 "2024-05-20T19:22:45Z")
Hi team! When scaling up our Elastic-managed cluster, the new nodes do not begin serving search requests until all shards on all indices are initialized. I've increased our primary search index's priority so it's initia… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=235) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=237)