# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=270 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 271 --- ## [Logs from different ports issue](https://discuss.elastic.co/t/logs-from-different-ports-issue/356763)
**Author:** [@tegerei](https://discuss.elastic.co/u/tegerei)\ **Replies:** 2\ **Last updated:** [April 4, 2024, 12:03pm UTC](https://discuss.elastic.co/t/logs-from-different-ports-issue/356763 "2024-04-04T12:03:59Z")
Hello, I have the following setup: system logs are sent to logstash using filebeat on port 5044, Apache logs being sent to logstash (same logstash instance as above) using filebeat on port 5047 I then pull these logs… --- ## [Is there a way to create "cookieSessionStorageFactory" for external plugins?](https://discuss.elastic.co/t/is-there-a-way-to-create-cookiesessionstoragefactory-for-external-plugins/356695)
**Author:** [@mertcb](https://discuss.elastic.co/u/mertcb)\ **Replies:** 1\ **Last updated:** [April 4, 2024, 12:02pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-create-cookiesessionstoragefactory-for-external-plugins/356695 "2024-04-04T12:02:43Z")
Hi, I'm developing a plugin for Kibana 8 that uses cookies. But when I want to create a cookieSessionStorageFactory, it is giving the following error. Error: A cookieSessionStorageFactory was already created at Htt… --- ## [Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch](https://discuss.elastic.co/t/failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/356664)
**Author:** [@Chadi\_SHWADA](https://discuss.elastic.co/u/Chadi_SHWADA)\ **Replies:** 1\ **Last updated:** [April 3, 2024, 1:02pm UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/356664 "2024-04-03T13:02:06Z")
I have two servers, one on which I install elasticsearch and kibana and the other on which json files are stored. I would like to send these files via filebeat to my other server on kibana to view the data. I install… --- ## [Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch](https://discuss.elastic.co/t/failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/356765)
**Author:** [@Chadi\_SHWADA](https://discuss.elastic.co/u/Chadi_SHWADA)\ **Replies:** 0\ **Last updated:** [April 4, 2024, 12:00pm UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/356765 "2024-04-04T12:00:48Z")
I have two servers, one on which I install elasticsearch and kibana and the other on which json files are stored. I would like to send these files via filebeat to my other server on kibana to view the data. I install… --- ## [Trouble getting OpenID Connect set up using Keycloak -- receiving error message](https://discuss.elastic.co/t/trouble-getting-openid-connect-set-up-using-keycloak-receiving-error-message/355908)
**Author:** [@arutkwccu](https://discuss.elastic.co/u/arutkwccu)\ **Replies:** 1\ **Last updated:** [April 4, 2024, 11:26am UTC](https://discuss.elastic.co/t/trouble-getting-openid-connect-set-up-using-keycloak-receiving-error-message/355908 "2024-04-04T11:26:31Z")
I am having quite a bit of trouble getting OpenID Connect set up. It all stems from a single error that I keep getting, and I can't seem to resolve the error: \[2024-03-21T13:09:57,036\]\[ERROR\]\[org.elasticsearch.bootstrap… --- ## [Logstash input TCP with TLS connection in a CLOSE\_WAIT state](https://discuss.elastic.co/t/logstash-input-tcp-with-tls-connection-in-a-close-wait-state/356761)
**Author:** [@RifwanJ](https://discuss.elastic.co/u/RifwanJ)\ **Replies:** 0\ **Last updated:** [April 4, 2024, 10:50am UTC](https://discuss.elastic.co/t/logstash-input-tcp-with-tls-connection-in-a-close-wait-state/356761 "2024-04-04T10:50:30Z")
Hi There, I'm using logstash 8.12.2 version and trying to use input tcp plugging with ssl\_enabled to receive logs from palo alto panorama (client) to logstash.service (server) on port 5400. below is the input tcp confi… --- ## [Access to system indices](https://discuss.elastic.co/t/access-to-system-indices/356731)
**Author:** [@Krishna\_Teja](https://discuss.elastic.co/u/Krishna_Teja)\ **Replies:** 4\ **Last updated:** [April 4, 2024, 9:48am UTC](https://discuss.elastic.co/t/access-to-system-indices/356731 "2024-04-04T09:48:03Z")
If access to system indices is removed, can we still access them by changing users permissions or via rules? Or is it totally inaccessible? --- ## [Multiple Elastic Agents on the same system](https://discuss.elastic.co/t/multiple-elastic-agents-on-the-same-system/306215)
**Author:** [@AndreiRD](https://discuss.elastic.co/u/AndreiRD)\ **Replies:** 1\ **Last updated:** [April 4, 2024, 8:38am UTC](https://discuss.elastic.co/t/multiple-elastic-agents-on-the-same-system/306215 "2024-04-04T08:38:01Z")
Is there any method by which two Elastic Agents with different Fleet&Output configurations can run simultaneously on the same server? (except for Docker Containers scenario). It looks like the installation paths cannot … --- ## [Is it possible to install multiple agents concurrently on the same host?](https://discuss.elastic.co/t/is-it-possible-to-install-multiple-agents-concurrently-on-the-same-host/347646)
**Author:** [@catn0b0t](https://discuss.elastic.co/u/catn0b0t)\ **Replies:** 1\ **Last updated:** [April 4, 2024, 8:37am UTC](https://discuss.elastic.co/t/is-it-possible-to-install-multiple-agents-concurrently-on-the-same-host/347646 "2024-04-04T08:37:16Z")
Hi, We are planning to start monitoring our appliances (Windows server based) installed at customers sites using elastic-agent. However, some of our clients have their own elastic-agent already running on our appliance,… --- ## [Logstash terminating with java.lang.ArrayIndexOutOfBoundsException: Index -1 out of bounds for length 80](https://discuss.elastic.co/t/logstash-terminating-with-java-lang-arrayindexoutofboundsexception-index-1-out-of-bounds-for-length-80/356739)
**Author:** [@teja\_tata](https://discuss.elastic.co/u/teja_tata)\ **Replies:** 1\ **Last updated:** [April 4, 2024, 8:14am UTC](https://discuss.elastic.co/t/logstash-terminating-with-java-lang-arrayindexoutofboundsexception-index-1-out-of-bounds-for-length-80/356739 "2024-04-04T08:14:44Z")
logstash getting terminated with below error 2024-03-27T15:10:25.063631230+01:00 warning: thread "Converge PipelineAction::Create\" terminated with exception (report\_on\_exception is true): 2024-03-27T15:10:25.0… --- ## [Adding Elasticsearch Node to a Cluster](https://discuss.elastic.co/t/adding-elasticsearch-node-to-a-cluster/356680)
**Author:** [@sravan\_kaheti](https://discuss.elastic.co/u/sravan_kaheti)\ **Replies:** 7\ **Last updated:** [April 4, 2024, 7:43am UTC](https://discuss.elastic.co/t/adding-elasticsearch-node-to-a-cluster/356680 "2024-04-04T07:43:27Z")
Hi Team , I have a Elasticsearch cluster of 25 nodes , which is lets say belongs subnet-a and all nodes i have configured/added to cluster using ./elasticsearch-create-enrollment-token -s node and then reconfigure comma… --- ## [Does watcher retry failed webhook triggers?](https://discuss.elastic.co/t/does-watcher-retry-failed-webhook-triggers/356668)
**Author:** [@Krishna\_Teja](https://discuss.elastic.co/u/Krishna_Teja)\ **Replies:** 6\ **Last updated:** [April 4, 2024, 4:26am UTC](https://discuss.elastic.co/t/does-watcher-retry-failed-webhook-triggers/356668 "2024-04-04T04:26:19Z")
I'm using watcher to trigger a webhook on a condition. It failed with "type": "socket\_exception", "reason": "Connection reset"}. Subsequent request on the next check passed. As the webhook trigger is crucial, I want to … --- ## [Any progress in embedded url? (?embed=true to hide headers in canvas workpad)](https://discuss.elastic.co/t/any-progress-in-embedded-url-embed-true-to-hide-headers-in-canvas-workpad/356509)
**Author:** [@Faker](https://discuss.elastic.co/u/Faker)\ **Replies:** 1\ **Last updated:** [April 4, 2024, 4:11am UTC](https://discuss.elastic.co/t/any-progress-in-embedded-url-embed-true-to-hide-headers-in-canvas-workpad/356509 "2024-04-04T04:11:40Z")
Hello~! I've used to render kibana dashboards usually and embed=true works well. but this time, i want to render my es index as Table and found that "canvas" fits for me. so, i made url and put it in iframe but ?embed… --- ## [\[es/search\] failed: \[x\_content\_parse\_exception\] \[2:4\] Unexpected character ('\\' (code 92)): was expecting double-quote](https://discuss.elastic.co/t/es-search-failed-x-content-parse-exception-2-4-unexpected-character-code-92-was-expecting-double-quote/356632)
**Author:** [@thatelasticguy](https://discuss.elastic.co/u/thatelasticguy)\ **Replies:** 8\ **Last updated:** [April 3, 2024, 8:20pm UTC](https://discuss.elastic.co/t/es-search-failed-x-content-parse-exception-2-4-unexpected-character-code-92-was-expecting-double-quote/356632 "2024-04-03T20:20:41Z")
I am using elastic version 8+ with spring boot elasticsearch 5.2.0 dependency. I want to query my index with Odata $filter. I have configured my parser for Odata and it's generating below query json for following query: $… --- ## [Elastic Agent Imperva Integration](https://discuss.elastic.co/t/elastic-agent-imperva-integration/356718)
**Author:** [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\ **Replies:** 0\ **Last updated:** [April 3, 2024, 8:01pm UTC](https://discuss.elastic.co/t/elastic-agent-imperva-integration/356718 "2024-04-03T20:01:15Z")
I am attempting to migrate from GitHub - imperva/incapsula-logs-downloader: A Python script for downloading log files from Incapsula to the Elastic Agent Imperva integration to collect Imperva WAF logs. I'm using the AP… --- ## [Elasticsearch 2.4.6 starts with warnings](https://discuss.elastic.co/t/elasticsearch-2-4-6-starts-with-warnings/356696)
**Author:** [@Aldahir\_Zamora](https://discuss.elastic.co/u/Aldahir_Zamora)\ **Replies:** 11\ **Last updated:** [April 3, 2024, 6:55pm UTC](https://discuss.elastic.co/t/elasticsearch-2-4-6-starts-with-warnings/356696 "2024-04-03T18:55:30Z")
Hello, I am having a problem with the elasticsearch service (2.4.6) that I am running on a centos server, currently the service goes down every so often (1-2 days) and when I start the service it gives me this warning, I… --- ## [If you have capacity, is 1 index with 5 shards better than 5 indices with 1 shard each?](https://discuss.elastic.co/t/if-you-have-capacity-is-1-index-with-5-shards-better-than-5-indices-with-1-shard-each/356636)
**Author:** [@bruce289](https://discuss.elastic.co/u/bruce289)\ **Replies:** 6\ **Last updated:** [April 3, 2024, 6:19pm UTC](https://discuss.elastic.co/t/if-you-have-capacity-is-1-index-with-5-shards-better-than-5-indices-with-1-shard-each/356636 "2024-04-03T18:19:48Z")
Let’s say the cluster is empty and we have the choice between: 1 index with 5 50 GB shards 5 indices, each with 1 50 GB shard Is there any difference between these 2 options purely from a performance standpoint? Assum… --- ## [Sync Data Mongo](https://discuss.elastic.co/t/sync-data-mongo/356698)
**Author:** [@hoang\_van\_th\_ng](https://discuss.elastic.co/u/hoang_van_th_ng)\ **Replies:** 1\ **Last updated:** [April 3, 2024, 6:14pm UTC](https://discuss.elastic.co/t/sync-data-mongo/356698 "2024-04-03T18:14:15Z")
I have that error in logstash logs when logstash starting. Here my config file for logstash: input { mongodb { uri =\> 'mongodb://shardsvr1:27017,shardsvr2:27017,shardsvr3:27017/db\_mongo?replicaSet=RplS' placeholde… --- ## [Why do we have so many bulk indexing tasks?](https://discuss.elastic.co/t/why-do-we-have-so-many-bulk-indexing-tasks/354331)
**Author:** [@tronboto](https://discuss.elastic.co/u/tronboto)\ **Replies:** 3\ **Last updated:** [April 3, 2024, 5:58pm UTC](https://discuss.elastic.co/t/why-do-we-have-so-many-bulk-indexing-tasks/354331 "2024-04-03T17:58:59Z")
We ingest data into our elasticsearch cluster solely using 16 logstash nodes each configured with the following settings: pipeline.workers: 48 pipeline.batch.size: 4000 pipeline.batch.delay: 1000 These hosts only have … --- ## [Mapping issue in adding a new filed to existing index](https://discuss.elastic.co/t/mapping-issue-in-adding-a-new-filed-to-existing-index/356681)
**Author:** [@Kesavan](https://discuss.elastic.co/u/Kesavan)\ **Replies:** 1\ **Last updated:** [April 3, 2024, 5:40pm UTC](https://discuss.elastic.co/t/mapping-issue-in-adding-a-new-filed-to-existing-index/356681 "2024-04-03T17:40:12Z")
WE are using Spring-boot-Elasticsearch to create a index into elastic from java. We are facing a issue describe below: Entity: @Document(indexName = "user") @Setting(settingPath = "/settings/lower-case-normalizer.json… --- ## [How can I get the (randomly generated) watcher ID?](https://discuss.elastic.co/t/how-can-i-get-the-randomly-generated-watcher-id/356708)
**Author:** [@fun-with-ES](https://discuss.elastic.co/u/fun-with-ES)\ **Replies:** 0\ **Last updated:** [April 3, 2024, 5:20pm UTC](https://discuss.elastic.co/t/how-can-i-get-the-randomly-generated-watcher-id/356708 "2024-04-03T17:20:09Z")
I'm creating a watch in Kibana, and Elastic creates its ID as a random hash. That's fine as I don't necessarily want to override it. Now in the watcher JSON definition, I'm trying to get the randomly generated watcher I… --- ## [Kibana - same old ... (logging.dest broken, /etc/systemd vs. /usr/lib/systemd, etc](https://discuss.elastic.co/t/kibana-same-old-logging-dest-broken-etc-systemd-vs-usr-lib-systemd-etc/356703)
**Author:** [@Joe\_J](https://discuss.elastic.co/u/Joe_J)\ **Replies:** 0\ **Last updated:** [April 3, 2024, 3:57pm UTC](https://discuss.elastic.co/t/kibana-same-old-logging-dest-broken-etc-systemd-vs-usr-lib-systemd-etc/356703 "2024-04-03T15:57:05Z")
steps: point repo to elastic 8.x apt install kibana/stable 8.13.1 amd64 sudo to enroll to elastic-- seems to work ok ... seems like no config/ dir, mkdir + chown ... odd try again -- complaints about \[logging\].dest - e… --- ## [java.net.SocketTimeoutException: Read timed out when nodes leave the cluster](https://discuss.elastic.co/t/java-net-sockettimeoutexception-read-timed-out-when-nodes-leave-the-cluster/356701)
**Author:** [@Chuck\_Reynolds](https://discuss.elastic.co/u/Chuck_Reynolds)\ **Replies:** 0\ **Last updated:** [April 3, 2024, 3:13pm UTC](https://discuss.elastic.co/t/java-net-sockettimeoutexception-read-timed-out-when-nodes-leave-the-cluster/356701 "2024-04-03T15:13:31Z")
I'm seeing a lot of SocketTimeout read errors when nodes leave the cluster. The nodes return with in a few minutes of leaving. The cluster has a primary and 1 replica. We are using Elasticsearch 7.16.3 in Kubernetes a… --- ## [Setting to read from S3 with request\_payer enabled?](https://discuss.elastic.co/t/setting-to-read-from-s3-with-request-payer-enabled/356682)
**Author:** [@Ritesh\_Uniyal](https://discuss.elastic.co/u/Ritesh_Uniyal)\ **Replies:** 0\ **Last updated:** [April 3, 2024, 12:53pm UTC](https://discuss.elastic.co/t/setting-to-read-from-s3-with-request-payer-enabled/356682 "2024-04-03T12:53:50Z")
how to read data from an s3 bucket which has request\_payer enabled? Thanks --- ## [How to correctly parse a RSS feed/XML file with Logstash](https://discuss.elastic.co/t/how-to-correctly-parse-a-rss-feed-xml-file-with-logstash/356613)
**Author:** [@ThomasWILHEM](https://discuss.elastic.co/u/ThomasWILHEM)\ **Replies:** 8\ **Last updated:** [April 3, 2024, 12:34pm UTC](https://discuss.elastic.co/t/how-to-correctly-parse-a-rss-feed-xml-file-with-logstash/356613 "2024-04-03T12:34:33Z")
Hello everyone, I am currently learning Elasticsearch and Logstash, and I have a job to do. I want to parse a Google News RSS Feed (ex : google news feed) and put the data (from every items) in an indice. The RSS feed… --- ## [Searching IP Address with regex](https://discuss.elastic.co/t/searching-ip-address-with-regex/355465)
**Author:** [@martcus](https://discuss.elastic.co/u/martcus)\ **Replies:** 6\ **Last updated:** [April 3, 2024, 12:36pm UTC](https://discuss.elastic.co/t/searching-ip-address-with-regex/355465 "2024-04-03T12:36:16Z")
Hi All, I need to search for the presence of ip addresses on application logs in the following format: http://xxx.xxx.xxx.xxx https://xxx.xxx.xxx.xxx The field could also contain information other than the ip address … --- ## [Error":"handle volume expansion: volume claim templates can only have their storage requests increased, if the storage class allows volume expansion. Any other change is forbidden"](https://discuss.elastic.co/t/error-handle-volume-expansion-volume-claim-templates-can-only-have-their-storage-requests-increased-if-the-storage-class-allows-volume-expansion-any-other-change-is-forbidden/356679)
**Author:** [@sagarbud](https://discuss.elastic.co/u/sagarbud)\ **Replies:** 0\ **Last updated:** [April 3, 2024, 12:34pm UTC](https://discuss.elastic.co/t/error-handle-volume-expansion-volume-claim-templates-can-only-have-their-storage-requests-increased-if-the-storage-class-allows-volume-expansion-any-other-change-is-forbidden/356679 "2024-04-03T12:34:10Z")
Hello All, I have 12 node elastic cluster(7.4.2) on GKE K8s cluster. Also, I have installed elastic operator. But when I upgrade elastic operator from 1.0.0-beta to 2.4.0, it gives below error. To upgrade elastic operat… --- ## [Heartbeat reference documentation has extra syntax](https://discuss.elastic.co/t/heartbeat-reference-documentation-has-extra-syntax/355925)
**Author:** [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\ **Replies:** 2\ **Last updated:** [April 3, 2024, 11:46am UTC](https://discuss.elastic.co/t/heartbeat-reference-documentation-has-extra-syntax/355925 "2024-04-03T11:46:31Z")
Hearbeat version: 8.12.2 Original install method (e.g. download page, yum, from source, etc.): MSI Describe the bug: The Heartbeat reference file, heartbeat.reference.yml, and the documentation site has an extra das… --- ## [Query for documents with datetime field where time is outside office hours](https://discuss.elastic.co/t/query-for-documents-with-datetime-field-where-time-is-outside-office-hours/356297)
**Author:** [@Peter\_K](https://discuss.elastic.co/u/Peter_K)\ **Replies:** 5\ **Last updated:** [April 3, 2024, 11:25am UTC](https://discuss.elastic.co/t/query-for-documents-with-datetime-field-where-time-is-outside-office-hours/356297 "2024-04-03T11:25:08Z")
query for documents with datetime field where time is outside office hours. There's a field vraag\_datumtijd (same format as @timestamp) that's filled with a date time stamp of the moment of doing an user action and a fi… --- ## [Regarding visualization created for status code monitoring](https://discuss.elastic.co/t/regarding-visualization-created-for-status-code-monitoring/356393)
**Author:** [@vaishnavi1](https://discuss.elastic.co/u/vaishnavi1)\ **Replies:** 10\ **Last updated:** [April 3, 2024, 10:18am UTC](https://discuss.elastic.co/t/regarding-visualization-created-for-status-code-monitoring/356393 "2024-04-03T10:18:21Z")
We have created visualization for status code monitoring, for 15 days its showing 99.99 % and for 30 days' timeframe it is showing 100. query is that why it's not showing other status code rather than 401 and 400. [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=269) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=271)