# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=289 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 290 --- ## [How to stop ELK logging?](https://discuss.elastic.co/t/how-to-stop-elk-logging/355170)
**Author:** [@shrm](https://discuss.elastic.co/u/shrm)\ **Replies:** 0\ **Last updated:** [March 11, 2024, 3:07pm UTC](https://discuss.elastic.co/t/how-to-stop-elk-logging/355170 "2024-03-11T15:07:07Z")
I ran the elastic stack on docker compose and it is running well. But after a week 50GB of storage was filled with the service without any additional data. I did not provide any content yet, and it was completely clean. … --- ## [Elasticsearch transform configuration must specify exactly 1 function error](https://discuss.elastic.co/t/elasticsearch-transform-configuration-must-specify-exactly-1-function-error/355165)
**Author:** [@rvadiga](https://discuss.elastic.co/u/rvadiga)\ **Replies:** 0\ **Last updated:** [March 11, 2024, 1:48pm UTC](https://discuss.elastic.co/t/elasticsearch-transform-configuration-must-specify-exactly-1-function-error/355165 "2024-03-11T13:48:18Z")
Hello Team, I have a scenario in Elasticsearch transform where I need to ignore all duplicate items from the source index and apply few aggregation after ignore the duplicate documents. Could you please suggest any bes… --- ## [Filter on \_search performed with text\_expansion is not working](https://discuss.elastic.co/t/filter-on-search-performed-with-text-expansion-is-not-working/355110)
**Author:** [@Ankur\_Garg](https://discuss.elastic.co/u/Ankur_Garg)\ **Replies:** 4\ **Last updated:** [March 11, 2024, 1:29pm UTC](https://discuss.elastic.co/t/filter-on-search-performed-with-text-expansion-is-not-working/355110 "2024-03-11T13:29:53Z")
I have an Elasticsearch index ingested with an inference pipeline using ELSER. While performing the search I would like to filter and show all the data where my field "Country" has a certain value "XYZ". My query below … --- ## [Failed to start Kibana after upgrade 7.17 to 8.12](https://discuss.elastic.co/t/failed-to-start-kibana-after-upgrade-7-17-to-8-12/355032)
**Author:** [@michael8](https://discuss.elastic.co/u/michael8)\ **Replies:** 5\ **Last updated:** [March 11, 2024, 1:26pm UTC](https://discuss.elastic.co/t/failed-to-start-kibana-after-upgrade-7-17-to-8-12/355032 "2024-03-11T13:26:02Z")
Hi, I've already looked through all the posts about errors and I can't find a solution for myself. After updating Kibana from 7.17 to 8.12, Kibana does not want to start. All errors were previously eliminated. Elastic… --- ## [Operate with sum-bucket?](https://discuss.elastic.co/t/operate-with-sum-bucket/355154)
**Author:** [@Kilastic](https://discuss.elastic.co/u/Kilastic)\ **Replies:** 0\ **Last updated:** [March 11, 2024, 12:39pm UTC](https://discuss.elastic.co/t/operate-with-sum-bucket/355154 "2024-03-11T12:39:23Z")
Hello. Please can someone help me to create a calculated data field? I have a table that shows: API name (Split rows, aggregation Terms of API name field) API version (Split rows, aggregation Terms of API version fiel… --- ## [Combine Platinum version with Free license version](https://discuss.elastic.co/t/combine-platinum-version-with-free-license-version/354834)
**Author:** [@ekas](https://discuss.elastic.co/u/ekas)\ **Replies:** 14\ **Last updated:** [March 11, 2024, 11:35am UTC](https://discuss.elastic.co/t/combine-platinum-version-with-free-license-version/354834 "2024-03-11T11:35:46Z")
Hi! I deployed 1 ELK stack on premise. I have only 1 Elastic node. I am going to upgrade my license from Free to Platinum (still on premise) and delete the ELK free version cluster. I am going to buy only 1 Elastic no… --- ## [CSV exports alignment problem at every 500 events](https://discuss.elastic.co/t/csv-exports-alignment-problem-at-every-500-events/355139)
**Author:** [@ismailctest\_C](https://discuss.elastic.co/u/ismailctest_C)\ **Replies:** 1\ **Last updated:** [March 11, 2024, 11:31am UTC](https://discuss.elastic.co/t/csv-exports-alignment-problem-at-every-500-events/355139 "2024-03-11T11:31:45Z")
Hi Team, Facing alignment issues at every 500 events when generating csv reports from Discover. Please find the attached sample screenshot. In this screenshot, TLS version moved to the subject column after 500 lines, … --- ## [Kibana stores "Jan 2001 - now" instead of configured time in dashboard](https://discuss.elastic.co/t/kibana-stores-jan-2001-now-instead-of-configured-time-in-dashboard/355127)
**Author:** [@snicoll](https://discuss.elastic.co/u/snicoll)\ **Replies:** 2\ **Last updated:** [March 11, 2024, 9:36am UTC](https://discuss.elastic.co/t/kibana-stores-jan-2001-now-instead-of-configured-time-in-dashboard/355127 "2024-03-11T09:36:46Z")
I don't understand if this is something I am doing wrong or if that's an issue in Kibana. I've created a new space, with a visualization and a dashboard. It's showing download rate for which we have data several times a … --- ## [Using 1 action's output result in another action](https://discuss.elastic.co/t/using-1-actions-output-result-in-another-action/355136)
**Author:** [@Seemant\_Bind](https://discuss.elastic.co/u/Seemant_Bind)\ **Replies:** 0\ **Last updated:** [March 11, 2024, 9:10am UTC](https://discuss.elastic.co/t/using-1-actions-output-result-in-another-action/355136 "2024-03-11T09:10:24Z")
Hi all, I am trying to extract the value from one action output and I want to use that result in the another action block. I am using the below watcher script to extract the value but with this I am not able to get the … --- ## [Scripting aggregation on Object](https://discuss.elastic.co/t/scripting-aggregation-on-object/354905)
**Author:** [@Anand\_Konagala](https://discuss.elastic.co/u/Anand_Konagala)\ **Replies:** 3\ **Last updated:** [March 11, 2024, 7:51am UTC](https://discuss.elastic.co/t/scripting-aggregation-on-object/354905 "2024-03-11T07:51:26Z")
Hi, I have an index with mapping, { "resume": { "otherInformation": { "IndustryScore": { "accounting\_finance": { "type": "text" }, … --- ## [Load balancing using logstash](https://discuss.elastic.co/t/load-balancing-using-logstash/353439)
**Author:** [@kriti\_dabas](https://discuss.elastic.co/u/kriti_dabas)\ **Replies:** 2\ **Last updated:** [March 11, 2024, 6:16am UTC](https://discuss.elastic.co/t/load-balancing-using-logstash/353439 "2024-03-11T06:16:01Z")
I want to use two logstash so that if one goes down I can use the other one. Is there a chance of duplicacy if i am using two logstash with same pipelines? I will configure elasticsearch in the output of logstash. --- ## [How to identify state of an IIS app pool from the IIS metrics: Elastic Agent](https://discuss.elastic.co/t/how-to-identify-state-of-an-iis-app-pool-from-the-iis-metrics-elastic-agent/355121)
**Author:** [@Paril\_Sanghvi](https://discuss.elastic.co/u/Paril_Sanghvi)\ **Replies:** 0\ **Last updated:** [March 11, 2024, 6:39am UTC](https://discuss.elastic.co/t/how-to-identify-state-of-an-iis-app-pool-from-the-iis-metrics-elastic-agent/355121 "2024-03-11T06:39:28Z")
Hi Everyone, I want to get status of App Pool from IIS server. I looked into metrics shipped by the integration but it does not have any metric related to it. Also some of my app in pool has status started and they are … --- ## [Kibana Stack Monitoring Total Shards](https://discuss.elastic.co/t/kibana-stack-monitoring-total-shards/354704)
**Author:** [@CCee](https://discuss.elastic.co/u/CCee)\ **Replies:** 2\ **Last updated:** [March 11, 2024, 3:59am UTC](https://discuss.elastic.co/t/kibana-stack-monitoring-total-shards/354704 "2024-03-11T03:59:21Z")
Hello, I saw the value of "Total shards" in stack monitoring within Kibana. How is this value obtained? Can I set up an alert for this value? For example, send an email if total shards \> 800, given the default value is … --- ## [How to route docs of same \_routing key in Elasticsearch into multiple shard?](https://discuss.elastic.co/t/how-to-route-docs-of-same-routing-key-in-elasticsearch-into-multiple-shard/355105)
**Author:** [@sumandas0](https://discuss.elastic.co/u/sumandas0)\ **Replies:** 2\ **Last updated:** [March 11, 2024, 3:49am UTC](https://discuss.elastic.co/t/how-to-route-docs-of-same-routing-key-in-elasticsearch-into-multiple-shard/355105 "2024-03-11T03:49:34Z")
We have a very large index of almost 600 million documents. A field called \_\_assetType allows us to distinguish between document types. Currently, there's a 10-90% distribution of document types, and we primarily search … --- ## [Logstash dockerfile issue while syncing elasticsearch with mysql using python](https://discuss.elastic.co/t/logstash-dockerfile-issue-while-syncing-elasticsearch-with-mysql-using-python/355083)
**Author:** [@abhinavtyagi](https://discuss.elastic.co/u/abhinavtyagi)\ **Replies:** 9\ **Last updated:** [March 10, 2024, 4:30pm UTC](https://discuss.elastic.co/t/logstash-dockerfile-issue-while-syncing-elasticsearch-with-mysql-using-python/355083 "2024-03-10T16:30:39Z")
Below is the logstash dockerfile taken from GitHub - r13i/sync-elasticsearch-mysql: Using Logstash to synchronize an Elasticsearch index with MySQL data but note that I am using Python and JDBC works with Java. How can … --- ## [Encountering \_geoip\_lookup\_failure within the IP address range 104.16.16.0/20](https://discuss.elastic.co/t/encountering-geoip-lookup-failure-within-the-ip-address-range-104-16-16-0-20/354958)
**Author:** [@yogeshk04](https://discuss.elastic.co/u/yogeshk04)\ **Replies:** 12\ **Last updated:** [March 10, 2024, 9:55am UTC](https://discuss.elastic.co/t/encountering-geoip-lookup-failure-within-the-ip-address-range-104-16-16-0-20/354958 "2024-03-10T09:55:55Z")
Could someone clarify why I consistently encounter the tags in my logstash pipeline "\_geoip\_lookup\_failure" issue with the IP address range 104.16.16.0/20, despite it working fine for other public IP addresses? --- ## [How to fix to keep run the logstash till SQL server query complete](https://discuss.elastic.co/t/how-to-fix-to-keep-run-the-logstash-till-sql-server-query-complete/355085)
**Author:** [@J\_S](https://discuss.elastic.co/u/J_S)\ **Replies:** 0\ **Last updated:** [March 9, 2024, 6:06pm UTC](https://discuss.elastic.co/t/how-to-fix-to-keep-run-the-logstash-till-sql-server-query-complete/355085 "2024-03-09T18:06:22Z")
I have a JDBC Logstash config file, which works perfectly but after few mins, the command prompt window closed automatically and there are still some data left over in the SQL database need to be pushed to Elastic Index. … --- ## [Install Elastic Search using Powershell](https://discuss.elastic.co/t/install-elastic-search-using-powershell/354697)
**Author:** [@kottak01](https://discuss.elastic.co/u/kottak01)\ **Replies:** 7\ **Last updated:** [March 9, 2024, 5:56pm UTC](https://discuss.elastic.co/t/install-elastic-search-using-powershell/354697 "2024-03-09T17:56:13Z")
Hi, I'm currently using Powershell to install Elastic Search and Kibana as my command prompt is not working. I'm unable to install by running ".\\elasticsearch.bat" on powershell. Can anyone assist with my issue? --- ## [Can I upgrade my existing ELK setup to 8.x?](https://discuss.elastic.co/t/can-i-upgrade-my-existing-elk-setup-to-8-x/354129)
**Author:** [@Ravi\_Pattar](https://discuss.elastic.co/u/Ravi_Pattar)\ **Replies:** 28\ **Last updated:** [March 9, 2024, 1:53pm UTC](https://discuss.elastic.co/t/can-i-upgrade-my-existing-elk-setup-to-8-x/354129 "2024-03-09T13:53:14Z")
Hello, I have a query regarding the ELK stack upgrade from 7.17.15 to 8.11 or higher? Please note the current set up is of a production server and is on 7.17.15 and is also basic version (NOT a licensed version) also… --- ## [When Query string contains hyphen characters, hyphen characters will be ignored](https://discuss.elastic.co/t/when-query-string-contains-hyphen-characters-hyphen-characters-will-be-ignored/355039)
**Author:** [@Jerry163](https://discuss.elastic.co/u/Jerry163)\ **Replies:** 2\ **Last updated:** [March 9, 2024, 11:30am UTC](https://discuss.elastic.co/t/when-query-string-contains-hyphen-characters-hyphen-characters-will-be-ignored/355039 "2024-03-09T11:30:36Z")
I want to filter the error logs starting with "ORA-" in the Oracle Alert log, but when I use the query expression of message: "ORA-\*" to filter, many strings starting with ORA are also matched, hyphen characters will be … --- ## [Filebeat data stream not updated](https://discuss.elastic.co/t/filebeat-data-stream-not-updated/354932)
**Author:** [@star2](https://discuss.elastic.co/u/star2)\ **Replies:** 2\ **Last updated:** [March 9, 2024, 4:42am UTC](https://discuss.elastic.co/t/filebeat-data-stream-not-updated/354932 "2024-03-09T04:42:18Z")
I use filebeat to collect Suricata's JSON files，But the data stream display of FileBeat never updates,The logs I saw did not show any errors either filebeat.service - Filebeat sends log files to Logstash or directly … --- ## [Memcached in logstash](https://discuss.elastic.co/t/memcached-in-logstash/355047)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 10\ **Last updated:** [March 8, 2024, 11:11pm UTC](https://discuss.elastic.co/t/memcached-in-logstash/355047 "2024-03-08T23:11:08Z")
I have huge file that I am using in logstash with translate filter. But I think it is causing some issue as it misses some match for some event. By looking around I discover that memcached may be answer to that. but I … --- ## [Alerting - Search Threshold/ES Query Rule](https://discuss.elastic.co/t/alerting-search-threshold-es-query-rule/354553)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 5\ **Last updated:** [March 8, 2024, 9:33pm UTC](https://discuss.elastic.co/t/alerting-search-threshold-es-query-rule/354553 "2024-03-08T21:33:00Z")
Hello, So I created a rule with filters to alert me if a specific document comes. This is working as expected. I was wondering since I am using {{context.hits}} to read through the documents. I was wondering how can I … --- ## [Is the repo broken?](https://discuss.elastic.co/t/is-the-repo-broken/355043)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 2\ **Last updated:** [March 8, 2024, 9:29pm UTC](https://discuss.elastic.co/t/is-the-repo-broken/355043 "2024-03-08T21:29:25Z")
On an existing system running 8.12, I'm getting this error: dnf --enablerepo=elasticsearch update Elasticsearch repository for 8.x packages 0.0 B/s | 0 B 00:00 Errors durin… --- ## [Elevated Memory Utilization and Errors in Filebeat When Integrating External MISP CTI Log Source](https://discuss.elastic.co/t/elevated-memory-utilization-and-errors-in-filebeat-when-integrating-external-misp-cti-log-source/354726)
**Author:** [@sunith](https://discuss.elastic.co/u/sunith)\ **Replies:** 6\ **Last updated:** [March 8, 2024, 5:21pm UTC](https://discuss.elastic.co/t/elevated-memory-utilization-and-errors-in-filebeat-when-integrating-external-misp-cti-log-source/354726 "2024-03-08T17:21:56Z")
Summary: Our Elastic setup incorporates two MISP CTI log sources— one internal and one external—both managed within the Henkel environment. Upon integrating these MISP instances using the filebeat API method, we have ide… --- ## [Few logs are missing in logstash from filebeat](https://discuss.elastic.co/t/few-logs-are-missing-in-logstash-from-filebeat/355046)
**Author:** [@Mrudula](https://discuss.elastic.co/u/Mrudula)\ **Replies:** 0\ **Last updated:** [March 8, 2024, 4:34pm UTC](https://discuss.elastic.co/t/few-logs-are-missing-in-logstash-from-filebeat/355046 "2024-03-08T16:34:47Z")
Hi Team, We are seeing very few logs are missing from pods of OCP to logstash, We are trying to pull the logs by using the filebeat agent. We are seeing very few (1%) logs are missing from some pods and we are seeing ot… --- ## [How to set/change Elastic Agent with same hostname](https://discuss.elastic.co/t/how-to-set-change-elastic-agent-with-same-hostname/354766)
**Author:** [@djarami726](https://discuss.elastic.co/u/djarami726)\ **Replies:** 6\ **Last updated:** [March 8, 2024, 3:53pm UTC](https://discuss.elastic.co/t/how-to-set-change-elastic-agent-with-same-hostname/354766 "2024-03-08T15:53:37Z")
I have installed the elastic agent on two linux VM machines and they have the same hostname on both VMs. Unfortunately, only one shows up on my list of installed agents. How do i change the name used for elastic agent … --- ## [Automate setting fleet outputs to remote\_elasticsearch in kibana.yml](https://discuss.elastic.co/t/automate-setting-fleet-outputs-to-remote-elasticsearch-in-kibana-yml/354953)
**Author:** [@0lzi](https://discuss.elastic.co/u/0lzi)\ **Replies:** 2\ **Last updated:** [March 8, 2024, 2:21pm UTC](https://discuss.elastic.co/t/automate-setting-fleet-outputs-to-remote-elasticsearch-in-kibana-yml/354953 "2024-03-08T14:21:01Z")
Hi, Im currently trying to automate kibana setup using ansible. I can configure the outputs and the fleetServerHosts, but the agents do not come online until i go into the UI to add the service token to the outputs. cu… --- ## [Elastic Latest Transform is not working if sync time and sort time is different](https://discuss.elastic.co/t/elastic-latest-transform-is-not-working-if-sync-time-and-sort-time-is-different/355001)
**Author:** [@shivaraj\_kv](https://discuss.elastic.co/u/shivaraj_kv)\ **Replies:** 6\ **Last updated:** [March 8, 2024, 1:44pm UTC](https://discuss.elastic.co/t/elastic-latest-transform-is-not-working-if-sync-time-and-sort-time-is-different/355001 "2024-03-08T13:44:19Z")
{ "id": "poc.transform", "version": "7.17.11", "create\_time": 1709818588566, "source": { "index": \[ "poc.test.source\*" \], "query": { "match\_all": {} } }, "dest": { "index": "po… --- ## [Can I replicate the same dashboard for different index pattern?](https://discuss.elastic.co/t/can-i-replicate-the-same-dashboard-for-different-index-pattern/354937)
**Author:** [@sudhir\_singh1](https://discuss.elastic.co/u/sudhir_singh1)\ **Replies:** 1\ **Last updated:** [March 8, 2024, 1:15pm UTC](https://discuss.elastic.co/t/can-i-replicate-the-same-dashboard-for-different-index-pattern/354937 "2024-03-08T13:15:37Z")
Can I replicate the same dashboard with all the visualization for different index pattern so I don't have to create again a new dashboard for new index pattern [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=288) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=290)