# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=276 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 277 --- ## [Only one document is indexed](https://discuss.elastic.co/t/only-one-document-is-indexed/356254)
**Author:** [@Khaled\_Saidi](https://discuss.elastic.co/u/Khaled_Saidi)\ **Replies:** 0\ **Last updated:** [March 27, 2024, 9:47am UTC](https://discuss.elastic.co/t/only-one-document-is-indexed/356254 "2024-03-27T09:47:56Z")
My filebeat agent has the monitoring section configured to send logs every 5s, directly to an elasticsearch cluster dedicated only for logs monitoring. However, only one document is indexed at midnight during the rollov… --- ## [Randomly out of memory exception when bulk importing data](https://discuss.elastic.co/t/randomly-out-of-memory-exception-when-bulk-importing-data/355555)
**Author:** [@docwarems](https://discuss.elastic.co/u/docwarems)\ **Replies:** 3\ **Last updated:** [March 27, 2024, 9:47am UTC](https://discuss.elastic.co/t/randomly-out-of-memory-exception-when-bulk-importing-data/355555 "2024-03-27T09:47:11Z")
Hi, we use the Javascript bulk helper API to bulk import data to ES. Randomly the import process crashes with out of memory exception (OOME). Of course we check for errors from the bulk import but there aren't any. I'm… --- ## [Logstash8.12.2 restart many times may encounter plugin load errors 'cabin/metrics','cabin/log/logger', "logstash::codecs::multiline::grok"](https://discuss.elastic.co/t/logstash8-12-2-restart-many-times-may-encounter-plugin-load-errors-cabin-metrics-cabin-log-logger-logstash-grok/355206)
**Author:** [@LiYuzhuo2020](https://discuss.elastic.co/u/LiYuzhuo2020)\ **Replies:** 15\ **Last updated:** [March 27, 2024, 9:31am UTC](https://discuss.elastic.co/t/logstash8-12-2-restart-many-times-may-encounter-plugin-load-errors-cabin-metrics-cabin-log-logger-logstash-grok/355206 "2024-03-27T09:31:40Z")
I upgrade the logstash from 7.16.3 to 8.12.2 and it can start up successfully after the configuration file adjustment, but if I restart the logstash service time from times it may encounter above plugin load errors. Can … --- ## [CURL query, search in a bunch of indexes](https://discuss.elastic.co/t/curl-query-search-in-a-bunch-of-indexes/356248)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 0\ **Last updated:** [March 27, 2024, 9:26am UTC](https://discuss.elastic.co/t/curl-query-search-in-a-bunch-of-indexes/356248 "2024-03-27T09:26:55Z")
Hi Just I'm looking a method for use curl as a search in a bunch of index. If it's possible for search over created data view? --- ## [Docker container logs via fleet on Windows Docker Host using WSL2](https://discuss.elastic.co/t/docker-container-logs-via-fleet-on-windows-docker-host-using-wsl2/355395)
**Author:** [@Ian\_Core](https://discuss.elastic.co/u/Ian_Core)\ **Replies:** 1\ **Last updated:** [March 27, 2024, 8:57am UTC](https://discuss.elastic.co/t/docker-container-logs-via-fleet-on-windows-docker-host-using-wsl2/355395 "2024-03-27T08:57:51Z")
Hi All, I am trying to ingest docker container logs using fleet. My agent policy has docker and docker metrics are successfully being sent using the npipe:////./pipe/docker\_engine configuration for host. The docs su… --- ## [Elastic agent uses configured proxy to get metadata apis](https://discuss.elastic.co/t/elastic-agent-uses-configured-proxy-to-get-metadata-apis/356203)
**Author:** [@aleccoder](https://discuss.elastic.co/u/aleccoder)\ **Replies:** 1\ **Last updated:** [March 27, 2024, 8:53am UTC](https://discuss.elastic.co/t/elastic-agent-uses-configured-proxy-to-get-metadata-apis/356203 "2024-03-27T08:53:49Z")
.\\elastic-agent.exe install --url=https://id.fleet.us-east-1.aws.found.io:443 --enrollment-token=l --proxy-url=proxyurl --- ## [Filebeat setup on Kubernetes cluster - Split index output by namespace](https://discuss.elastic.co/t/filebeat-setup-on-kubernetes-cluster-split-index-output-by-namespace/356239)
**Author:** [@connectgeeks](https://discuss.elastic.co/u/connectgeeks)\ **Replies:** 0\ **Last updated:** [March 27, 2024, 8:24am UTC](https://discuss.elastic.co/t/filebeat-setup-on-kubernetes-cluster-split-index-output-by-namespace/356239 "2024-03-27T08:24:00Z")
Hi, I'm trying to deploy filebeats on Kubernetes cluster(EKS) using ECK stack as below(a). I want to split the output index by namespace, something like mentioned (b) which is not working. Can you suggest how can I pas… --- ## [Elastic doesn't meet my requirements](https://discuss.elastic.co/t/elastic-doesnt-meet-my-requirements/356212)
**Author:** [@deathofangel](https://discuss.elastic.co/u/deathofangel)\ **Replies:** 4\ **Last updated:** [March 27, 2024, 8:22am UTC](https://discuss.elastic.co/t/elastic-doesnt-meet-my-requirements/356212 "2024-03-27T08:22:42Z")
Hello. I am continuously listening to data from a receiver. It continuously sends the data to a port in json format. I need to parse and save the data I receive from the receiver very quickly. When I write a server for … --- ## [Kibana8.10 connet elasticsearch8.10 token 验证还要账户kibana\_system和密码登录](https://discuss.elastic.co/t/kibana8-10-connet-elasticsearch8-10-token-kibana-system/356238)
**Author:** [@chenkang404](https://discuss.elastic.co/u/chenkang404)\ **Replies:** 0\ **Last updated:** [March 27, 2024, 8:22am UTC](https://discuss.elastic.co/t/kibana8-10-connet-elasticsearch8-10-token-kibana-system/356238 "2024-03-27T08:22:10Z")
为什么不能用elastic用户，从哪里获得账户kibana\_system的密码 --- ## [ELSER ingest pipeline with ingest processor](https://discuss.elastic.co/t/elser-ingest-pipeline-with-ingest-processor/356219)
**Author:** [@Abhilash\_B](https://discuss.elastic.co/u/Abhilash_B)\ **Replies:** 0\ **Last updated:** [March 27, 2024, 3:57am UTC](https://discuss.elastic.co/t/elser-ingest-pipeline-with-ingest-processor/356219 "2024-03-27T03:57:33Z")
I have peculiar situation where I need to create embeddings for each text value of a field within an array of objects. Sample Document: { "areas\_of\_expertise":\[{ "id": 14, "is\_active": true,… --- ## [Query assistance for conditional querying](https://discuss.elastic.co/t/query-assistance-for-conditional-querying/356218)
**Author:** [@Spandana](https://discuss.elastic.co/u/Spandana)\ **Replies:** 1\ **Last updated:** [March 27, 2024, 3:52am UTC](https://discuss.elastic.co/t/query-assistance-for-conditional-querying/356218 "2024-03-27T03:52:22Z")
I have elastic index with fields styleId, sellingStyleId, styleName, inventoryEnabled, inventoryCount need help with query to pull all the records but if inventoryEnabled is true then check if inventoryCount is greater … --- ## [Kibana/Dashboard Zoom Settings](https://discuss.elastic.co/t/kibana-dashboard-zoom-settings/356213)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 0\ **Last updated:** [March 26, 2024, 11:33pm UTC](https://discuss.elastic.co/t/kibana-dashboard-zoom-settings/356213 "2024-03-26T23:33:00Z")
Hello, I am wondering if there's away to change the zoom settings of Kibana, specifically dashboards? It feels like depending on your computer monitor, the dashboards can look distortional. Also, It feels like the das… --- ## [Java api client example for rollover](https://discuss.elastic.co/t/java-api-client-example-for-rollover/356131)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 3\ **Last updated:** [March 26, 2024, 11:06pm UTC](https://discuss.elastic.co/t/java-api-client-example-for-rollover/356131 "2024-03-26T23:06:34Z")
Is there a centralized place with examples of how java API clients are being invoked? It seems to be very lacking even after several years deprecating the old REST client. I am trying to figure out how to issue rollove… --- ## [Information about licensing](https://discuss.elastic.co/t/information-about-licensing/356147)
**Author:** [@Yerbolat\_Talasbekov](https://discuss.elastic.co/u/Yerbolat_Talasbekov)\ **Replies:** 5\ **Last updated:** [March 26, 2024, 7:26pm UTC](https://discuss.elastic.co/t/information-about-licensing/356147 "2024-03-26T19:26:03Z")
Hello everyone! Can someone help me with understanding elasticsearch license, how it works, differencies between licences. --- ## [ELK Stack on VM directly or docker environment using docker swarm](https://discuss.elastic.co/t/elk-stack-on-vm-directly-or-docker-environment-using-docker-swarm/356188)
**Author:** [@rubhamra](https://discuss.elastic.co/u/rubhamra)\ **Replies:** 1\ **Last updated:** [March 26, 2024, 6:46pm UTC](https://discuss.elastic.co/t/elk-stack-on-vm-directly-or-docker-environment-using-docker-swarm/356188 "2024-03-26T18:46:01Z")
Hello, I'm looking advice regarding the deployment of the ELK stack and Fleet Server. Should I opt for directly deploying them on virtual machines (VMs) or utilize a Docker environment with Docker Swarm to deploy all se… --- ## [Parsing Clamscan logs when redirecting logs to Kibana using Filebeat](https://discuss.elastic.co/t/parsing-clamscan-logs-when-redirecting-logs-to-kibana-using-filebeat/356202)
**Author:** [@Cexico](https://discuss.elastic.co/u/Cexico)\ **Replies:** 0\ **Last updated:** [March 26, 2024, 6:30pm UTC](https://discuss.elastic.co/t/parsing-clamscan-logs-when-redirecting-logs-to-kibana-using-filebeat/356202 "2024-03-26T18:30:28Z")
what should I do to understand the clamscan result that I do in the terminal in kibana logs normally? how should I do the parsing part, write a grok filter? --- ## [How to get IPTable information using beats or elastic agent](https://discuss.elastic.co/t/how-to-get-iptable-information-using-beats-or-elastic-agent/356190)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 0\ **Last updated:** [March 26, 2024, 2:27pm UTC](https://discuss.elastic.co/t/how-to-get-iptable-information-using-beats-or-elastic-agent/356190 "2024-03-26T14:27:59Z")
When I type the command iptables -S, I see this: -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -N f2b-pizza-login -A INPUT -p tcp -m multiport --dports 0:65535 -j f2b-pizza-login -A f2b-pizza-login -s 192.168.88.16… --- ## [Dev Tools console not maintaining prefix\_path v8.12.2](https://discuss.elastic.co/t/dev-tools-console-not-maintaining-prefix-path-v8-12-2/354975)
**Author:** [@B\_Blank](https://discuss.elastic.co/u/B_Blank)\ **Replies:** 4\ **Last updated:** [March 26, 2024, 1:53pm UTC](https://discuss.elastic.co/t/dev-tools-console-not-maintaining-prefix-path-v8-12-2/354975 "2024-03-26T13:53:58Z")
I'm seeing in Kibana 8.12.2 that the prefix\_path is being dropped by Dev Tools Console commands. i.e. the "/kibana" in the example below. kibana.yml elasticsearch.hosts: "server.mydomain.com:443/kibana In Dev Tools C… --- ## [Import saved object of type "apm-indices" does not work correctly](https://discuss.elastic.co/t/import-saved-object-of-type-apm-indices-does-not-work-correctly/356174)
**Author:** [@fuphil](https://discuss.elastic.co/u/fuphil)\ **Replies:** 1\ **Last updated:** [March 26, 2024, 1:45pm UTC](https://discuss.elastic.co/t/import-saved-object-of-type-apm-indices-does-not-work-correctly/356174 "2024-03-26T13:45:41Z")
Hi, I am running version 8.12.2 and have an issue with the import of a saved object of type "apm-indices". It is not possible to set the attribute "apmIndices", it is always empty. API: /s/myspace/api/saved\_objects/\_i… --- ## [NEST 7.17 RequestBodyInBytes invalid JSON?](https://discuss.elastic.co/t/nest-7-17-requestbodyinbytes-invalid-json/356181)
**Author:** [@TomRom27](https://discuss.elastic.co/u/TomRom27)\ **Replies:** 0\ **Last updated:** [March 26, 2024, 1:16pm UTC](https://discuss.elastic.co/t/nest-7-17-requestbodyinbytes-invalid-json/356181 "2024-03-26T13:16:37Z")
Hi, Recently played a bit with diagnostics of queries sent to ES via NEST and noticed that RequestBodyInBytes (when Utf8 decoded) returns invalid JSON - see attachment: last closing bracket (red) should match 2nd openin… --- ## [I can't create this metric in my kibana dashboard](https://discuss.elastic.co/t/i-cant-create-this-metric-in-my-kibana-dashboard/356177)
**Author:** [@Federico\_Ruso](https://discuss.elastic.co/u/Federico_Ruso)\ **Replies:** 0\ **Last updated:** [March 26, 2024, 12:44pm UTC](https://discuss.elastic.co/t/i-cant-create-this-metric-in-my-kibana-dashboard/356177 "2024-03-26T12:44:35Z")
I want to create a metric that outputs the rounded value in red but i can't. I try with various forms of formulas, but none worked. The last one was this sum(uc\_pend / overall\_sum(uc\_pend) \* dias) Thks! --- ## [Filebeat harvests files again in combination with logrotate compress directive](https://discuss.elastic.co/t/filebeat-harvests-files-again-in-combination-with-logrotate-compress-directive/356097)
**Author:** [@jori-be](https://discuss.elastic.co/u/jori-be)\ **Replies:** 3\ **Last updated:** [March 26, 2024, 11:45am UTC](https://discuss.elastic.co/t/filebeat-harvests-files-again-in-combination-with-logrotate-compress-directive/356097 "2024-03-26T11:45:12Z")
I'm using filebeat 8.11.3 on my systems and I notice that filebeat resubmits logs multiple times. My application writes logs to the filesystem, logrotate rotates logs everyday. We compress older log files also via logr… --- ## [Kuromoji\_tokenizer: sort clause does not seem to work for some specific character combinations](https://discuss.elastic.co/t/kuromoji-tokenizer-sort-clause-does-not-seem-to-work-for-some-specific-character-combinations/356173)
**Author:** [@Ajay\_Purohit](https://discuss.elastic.co/u/Ajay_Purohit)\ **Replies:** 0\ **Last updated:** [March 26, 2024, 11:40am UTC](https://discuss.elastic.co/t/kuromoji-tokenizer-sort-clause-does-not-seem-to-work-for-some-specific-character-combinations/356173 "2024-03-26T11:40:35Z")
Query: { "query": { "bool": { } }, "sort": \[ { "attribute.sortable": { "order": "asc" } } \] } Results: "hits": \[ { "\_index": "example\_1", "\_type": "example\_1", … --- ## [Logstash with multi port nad multi file not work properly](https://discuss.elastic.co/t/logstash-with-multi-port-nad-multi-file-not-work-properly/356144)
**Author:** [@shahrestanaki](https://discuss.elastic.co/u/shahrestanaki)\ **Replies:** 3\ **Last updated:** [March 26, 2024, 11:17am UTC](https://discuss.elastic.co/t/logstash-with-multi-port-nad-multi-file-not-work-properly/356144 "2024-03-26T11:17:06Z")
hello. i start used ELK with: spring boot 3.1.0 logstash-logback-encoder 7.4 janino 3.1.12 setup elk 8.12.1-1 in linux server centos 7 (ELK server) my senario is: i used 2 project (base and auth). and setup logback… --- ## [Querying elasticsearch during a rolling update](https://discuss.elastic.co/t/querying-elasticsearch-during-a-rolling-update/356152)
**Author:** [@Lucy\_Johnson](https://discuss.elastic.co/u/Lucy_Johnson)\ **Replies:** 0\ **Last updated:** [March 26, 2024, 8:26am UTC](https://discuss.elastic.co/t/querying-elasticsearch-during-a-rolling-update/356152 "2024-03-26T08:26:14Z")
Hello everyone. I'm not super sure if that's the best place to ask but I'm hoping to get further information from here. My goal is to query my elasticsearch-cluster (v 7.17) with either the deprecated elastic client or … --- ## [Kibana API call unathorized](https://discuss.elastic.co/t/kibana-api-call-unathorized/355915)
**Author:** [@h.d.intodata](https://discuss.elastic.co/u/h.d.intodata)\ **Replies:** 2\ **Last updated:** [March 26, 2024, 10:47am UTC](https://discuss.elastic.co/t/kibana-api-call-unathorized/355915 "2024-03-26T10:47:35Z")
Hi team, I have a series of dashboards that i need to copy from one kibana server to another. I tried using POST http://\:\/api/saved\_objects/\_export However, all i get is { "statusCode": 4… --- ## [Basic license, users, and https](https://discuss.elastic.co/t/basic-license-users-and-https/356163)
**Author:** [@RainTown](https://discuss.elastic.co/u/RainTown)\ **Replies:** 3\ **Last updated:** [March 26, 2024, 10:45am UTC](https://discuss.elastic.co/t/basic-license-users-and-https/356163 "2024-03-26T10:45:25Z")
hi i have a local (my personal use only) elasticsearch/kibana instance insalled and setup in Jan 2024 on my Mac. All worked fine, until it didn't. My basic license has expired. This was expected. I did not anticpate … --- ## [Module "..." found, but does not contain package "..."](https://discuss.elastic.co/t/module-found-but-does-not-contain-package/356052)
**Author:** [@zeynepyz](https://discuss.elastic.co/u/zeynepyz)\ **Replies:** 1\ **Last updated:** [March 26, 2024, 10:30am UTC](https://discuss.elastic.co/t/module-found-but-does-not-contain-package/356052 "2024-03-26T10:30:52Z")
Hello i am trying to create new metricbeat module for my self improvement. This is my pr. As you can see i get trouble with all at of tests. Some of them are mage check errors. Error: ../../../../go/pkg/mod/github.com/d… --- ## [Unable to format rule/alert in Kibana](https://discuss.elastic.co/t/unable-to-format-rule-alert-in-kibana/354730)
**Author:** [@Nikhil\_SA](https://discuss.elastic.co/u/Nikhil_SA)\ **Replies:** 3\ **Last updated:** [March 26, 2024, 9:52am UTC](https://discuss.elastic.co/t/unable-to-format-rule-alert-in-kibana/354730 "2024-03-26T09:52:33Z")
I'm using a email connector for action in our rule and I'm unable to format the alert mail body. This is creating very clumsy mail being sent which is not at all appealing to the customer. How to format the alert proper… --- ## [Enrich Fleet Integration](https://discuss.elastic.co/t/enrich-fleet-integration/355895)
**Author:** [@Eran\_Hadad](https://discuss.elastic.co/u/Eran_Hadad)\ **Replies:** 3\ **Last updated:** [March 26, 2024, 9:46am UTC](https://discuss.elastic.co/t/enrich-fleet-integration/355895 "2024-03-26T09:46:06Z")
Hi, I'm using Elastic Fleet to integrate with Azure Event Hub and import logs. One of the log fields is a URL. I want to create a new short URL filed that extracts the URL until the first question mark. URL: www.webs… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=275) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=277)