# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=637 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 638 --- ## [Elasticsearch, kibana y logstash y filebeat](https://discuss.elastic.co/t/elasticsearch-kibana-y-logstash-y-filebeat/325228)
**Author:** [@jomaguca](https://discuss.elastic.co/u/jomaguca)\ **Replies:** 1\ **Last updated:** [February 10, 2023, 12:46pm UTC](https://discuss.elastic.co/t/elasticsearch-kibana-y-logstash-y-filebeat/325228 "2023-02-10T12:46:06Z")
Hello everybody My name is José Manuel and I am testing this solution to be use in logs managment so I hope you can help to work with this. My idea is install this in a debian 11 and elasticsearch 8.6.1 with kibana 8.6… --- ## [Gelf Input plugin dropping messages](https://discuss.elastic.co/t/gelf-input-plugin-dropping-messages/325260)
**Author:** [@karlo95](https://discuss.elastic.co/u/karlo95)\ **Replies:** 0\ **Last updated:** [February 10, 2023, 12:08pm UTC](https://discuss.elastic.co/t/gelf-input-plugin-dropping-messages/325260 "2023-02-10T12:08:36Z")
Hello, I'm having problems with Gelf Input plugin dropping messages when listening on UDP. When a lot of messagess comes in same time, it seems like logstash plugin is dropping them randomly. E.g. when I restart quark… --- ## [Elastic-agent error ResourceExhausted desc = grpc: received message larger than max](https://discuss.elastic.co/t/elastic-agent-error-resourceexhausted-desc-grpc-received-message-larger-than-max/325256)
**Author:** [@fabien9402](https://discuss.elastic.co/u/fabien9402)\ **Replies:** 0\ **Last updated:** [February 10, 2023, 11:46am UTC](https://discuss.elastic.co/t/elastic-agent-error-resourceexhausted-desc-grpc-received-message-larger-than-max/325256 "2023-02-10T11:46:58Z")
We have an error in one of our elastic-agent. This returns the error below: 12:17:47.199 elastic\_agent.filebeat \[elastic\_agent.filebeat\]\[error\] elastic-agent-client got error: rpc error: code = ResourceExhausted desc =… --- ## [Adding Memcached integration turns agent unhealthy](https://discuss.elastic.co/t/adding-memcached-integration-turns-agent-unhealthy/325254)
**Author:** [@rrodrigues](https://discuss.elastic.co/u/rrodrigues)\ **Replies:** 0\ **Last updated:** [February 10, 2023, 11:39am UTC](https://discuss.elastic.co/t/adding-memcached-integration-turns-agent-unhealthy/325254 "2023-02-10T11:39:29Z")
When I add the Memcached Elastic Agent integration to a Fleet-managed agent it goes unhealthy. I believe this issue is similar to this one reported on Nginx/Kafka integration. Elastic Cloud/Elastic Agent: 8.6.1 Memcach… --- ## [GCSToElasticsearch Template](https://discuss.elastic.co/t/gcstoelasticsearch-template/323834)
**Author:** [@Roque\_Moyano](https://discuss.elastic.co/u/Roque_Moyano)\ **Replies:** 1\ **Last updated:** [February 10, 2023, 11:31am UTC](https://discuss.elastic.co/t/gcstoelasticsearch-template/323834 "2023-02-10T11:31:12Z")
Hi, I'm following this tutorial: Ingest data directly from Google Cloud Storage into Elastic using Google Dataflow | Elastic Blog but when the dataflow job is running I got this error: {"severity":"INFO","time":"2023/0… --- ## [Pass Multiple Fields in span term query](https://discuss.elastic.co/t/pass-multiple-fields-in-span-term-query/325213)
**Author:** [@Sahil5](https://discuss.elastic.co/u/Sahil5)\ **Replies:** 1\ **Last updated:** [February 10, 2023, 11:26am UTC](https://discuss.elastic.co/t/pass-multiple-fields-in-span-term-query/325213 "2023-02-10T11:26:25Z")
Hi Team, Can anyone please help how to pass multiple fields for searching in span\_term query? Example for span\_term query { "span\_term": { "field1": "value1" } } I want to pass something like this { "span\_term": { \[… --- ## [UNABLE TO CREATE THE VISUAL FOR MULTIPLE LOGS](https://discuss.elastic.co/t/unable-to-create-the-visual-for-multiple-logs/325245)
**Author:** [@Naveen3](https://discuss.elastic.co/u/Naveen3)\ **Replies:** 0\ **Last updated:** [February 10, 2023, 11:09am UTC](https://discuss.elastic.co/t/unable-to-create-the-visual-for-multiple-logs/325245 "2023-02-10T11:09:10Z")
How do I create the visual for the one value in two different logs? For the Example A is passed through L1. B is passed through L1. A is inducted from M1 L1 and M1 were in different logs for the same value. How do … --- ## [Fleet Server No Data Stream](https://discuss.elastic.co/t/fleet-server-no-data-stream/324753)
**Author:** [@NathanLau](https://discuss.elastic.co/u/NathanLau)\ **Replies:** 5\ **Last updated:** [February 10, 2023, 11:03am UTC](https://discuss.elastic.co/t/fleet-server-no-data-stream/324753 "2023-02-10T11:03:55Z")
Hi All , When installed Fleet server with quick start. the fleet server cannot receive any data themselves , same as system. install command : sudo ./elastic-agent install \\ --fleet-server-es=https://172.16.\*\*.\*\*:9… --- ## [Prometheus metricset - query vs. collector](https://discuss.elastic.co/t/prometheus-metricset-query-vs-collector/325140)
**Author:** [@Honken77](https://discuss.elastic.co/u/Honken77)\ **Replies:** 2\ **Last updated:** [February 10, 2023, 10:44am UTC](https://discuss.elastic.co/t/prometheus-metricset-query-vs-collector/325140 "2023-02-10T10:44:56Z")
Hi! At the moment I am collecting metrics from my OpenShift cluster with the collector metricset like so: metricbeat.modules: - module: prometheus period: 15s timeout: 15s hosts: \["https://prometheus-k8s.openshif… --- ## [Unable to install Kibana Development Enviroment](https://discuss.elastic.co/t/unable-to-install-kibana-development-enviroment/325214)
**Author:** [@Mufasa](https://discuss.elastic.co/u/Mufasa)\ **Replies:** 2\ **Last updated:** [February 10, 2023, 10:01am UTC](https://discuss.elastic.co/t/unable-to-install-kibana-development-enviroment/325214 "2023-02-10T10:01:38Z")
Hello Team, I am a beginner and almost tried all tutorials, blogs and gits to build my kibana development environment but unable to sort this mystery out. Can someone please help me out. Best --- ## [Installed ElasticSearch on linux, service is running but curl to elasticsearch url is failing](https://discuss.elastic.co/t/installed-elasticsearch-on-linux-service-is-running-but-curl-to-elasticsearch-url-is-failing/324937)
**Author:** [@Devanshu](https://discuss.elastic.co/u/Devanshu)\ **Replies:** 3\ **Last updated:** [February 10, 2023, 9:37am UTC](https://discuss.elastic.co/t/installed-elasticsearch-on-linux-service-is-running-but-curl-to-elasticsearch-url-is-failing/324937 "2023-02-10T09:37:55Z")
Installed Elasticsearch on linux, service is running but curl to elasticsearch url is failing. Getting below error curl: (52) Empty reply from server --- ## [Kibana cannot connect to the Elastic Package Registry, which provides Elastic Agent integrations](https://discuss.elastic.co/t/kibana-cannot-connect-to-the-elastic-package-registry-which-provides-elastic-agent-integrations/325233)
**Author:** [@zyaza](https://discuss.elastic.co/u/zyaza)\ **Replies:** 0\ **Last updated:** [February 10, 2023, 9:27am UTC](https://discuss.elastic.co/t/kibana-cannot-connect-to-the-elastic-package-registry-which-provides-elastic-agent-integrations/325233 "2023-02-10T09:27:28Z")
After installing elasticsearch, kibana and auditbeat i went to http://127.0.0.1:5601. I clicked on Discorver and this what the image I saw --- ## [Packetbeat TLS \[Client|Server\] hello Ciphers on one string](https://discuss.elastic.co/t/packetbeat-tls-client-server-hello-ciphers-on-one-string/325229)
**Author:** [@franpom](https://discuss.elastic.co/u/franpom)\ **Replies:** 0\ **Last updated:** [February 10, 2023, 9:06am UTC](https://discuss.elastic.co/t/packetbeat-tls-client-server-hello-ciphers-on-one-string/325229 "2023-02-10T09:06:32Z")
Hello, Would it be possible to integrate an additional field concerning the tls client support\_ciphers? This field currently is broken down for each cipher presented. The problem is that we lose the order of preferenc… --- ## [I use the SLM policy, and the start time of the snapshot is inconsistent with the scheduled time](https://discuss.elastic.co/t/i-use-the-slm-policy-and-the-start-time-of-the-snapshot-is-inconsistent-with-the-scheduled-time/325082)
**Author:** [@lijianzhi](https://discuss.elastic.co/u/lijianzhi)\ **Replies:** 8\ **Last updated:** [February 10, 2023, 8:59am UTC](https://discuss.elastic.co/t/i-use-the-slm-policy-and-the-start-time-of-the-snapshot-is-inconsistent-with-the-scheduled-time/325082 "2023-02-10T08:59:49Z")
I use slm policy to create a snapshot policy plan 0 0 \* \* \*?, The next plan is 12:00, but the actual start time of the snapshot is 11:59:59, one second ahead of schedule. Or 12:00:01, delay 1 second. There are three repl… --- ## [Split Alert Message in Elasticsearch Query type Alert](https://discuss.elastic.co/t/split-alert-message-in-elasticsearch-query-type-alert/325226)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 0\ **Last updated:** [February 10, 2023, 8:56am UTC](https://discuss.elastic.co/t/split-alert-message-in-elasticsearch-query-type-alert/325226 "2023-02-10T08:56:38Z")
Hi there, i want to ask about alerting message. i was created an alert using elasticsearch query to find some cert that close to it's expire date and i used server log connector. the alert is running as well, but the pr… --- ## [Elastic agent random shutdown/goes offline](https://discuss.elastic.co/t/elastic-agent-random-shutdown-goes-offline/325223)
**Author:** [@fontexD](https://discuss.elastic.co/u/fontexD)\ **Replies:** 0\ **Last updated:** [February 10, 2023, 8:27am UTC](https://discuss.elastic.co/t/elastic-agent-random-shutdown-goes-offline/325223 "2023-02-10T08:27:41Z")
Ive deployed a elk stack with elastic kibana and fleet server, all going smooth using self-gen self-created certs for transport all the way and my own ssl in front via ingress version 6.2.1 created with elk operator in… --- ## [Unable to install markdown & handlebars plugin in kibana](https://discuss.elastic.co/t/unable-to-install-markdown-handlebars-plugin-in-kibana/325218)
**Author:** [@ateethrigvedi](https://discuss.elastic.co/u/ateethrigvedi)\ **Replies:** 1\ **Last updated:** [February 10, 2023, 7:56am UTC](https://discuss.elastic.co/t/unable-to-install-markdown-handlebars-plugin-in-kibana/325218 "2023-02-10T07:56:02Z")
I have been trying to install sw-jung/kibana\_markdown\_doc\_view in windows. Command used: \*\*kibana-plugin install https://github.com/sw-jung/kibana\_markdown\_doc\_view/releases/download/v6.2.4/markdown\_doc\_view-6.2.4.zip\*… --- ## [Solace/Jagger integration with Elasticsearch](https://discuss.elastic.co/t/solace-jagger-integration-with-elasticsearch/325215)
**Author:** [@akhil](https://discuss.elastic.co/u/akhil)\ **Replies:** 1\ **Last updated:** [February 10, 2023, 7:43am UTC](https://discuss.elastic.co/t/solace-jagger-integration-with-elasticsearch/325215 "2023-02-10T07:43:55Z")
We are getting below exception while connecting elk through Jagger, please help us to fix the issue. HTTP Error: search services failed: elastic: Error 400 (Bad Request): all shards failed \[type=search\_phase\_execution\_e… --- ## [ILM deleted after run](https://discuss.elastic.co/t/ilm-deleted-after-run/325130)
**Author:** [@laurijssen](https://discuss.elastic.co/u/laurijssen)\ **Replies:** 2\ **Last updated:** [February 10, 2023, 7:42am UTC](https://discuss.elastic.co/t/ilm-deleted-after-run/325130 "2023-02-10T07:42:41Z")
I've created an ILM that deletes data after x days. PUT idx\*/\_settings { "index": { "lifecycle": { "name": "x-days-policy" } } } The data gets deleted only once and then the ILM is removed. GET idx/\_… --- ## [Kibana patches from 8.5.3 to 8.6.1](https://discuss.elastic.co/t/kibana-patches-from-8-5-3-to-8-6-1/324202)
**Author:** [@ArpitChoudhary](https://discuss.elastic.co/u/ArpitChoudhary)\ **Replies:** 26\ **Last updated:** [February 10, 2023, 7:15am UTC](https://discuss.elastic.co/t/kibana-patches-from-8-5-3-to-8-6-1/324202 "2023-02-10T07:15:12Z")
Hello guys, Need help while upgrading kibana patches from 8.5.3 to 8.6.1. not able to connect a node on browser. I update a node by apt update -y & apy upgrade -y, reboot it, try to make it out from the cluster but go… --- ## [Elasticsearch, Logstash, Kibana Scale-out Architecture](https://discuss.elastic.co/t/elasticsearch-logstash-kibana-scale-out-architecture/325206)
**Author:** [@haikal.azaim](https://discuss.elastic.co/u/haikal.azaim)\ **Replies:** 1\ **Last updated:** [February 10, 2023, 7:04am UTC](https://discuss.elastic.co/t/elasticsearch-logstash-kibana-scale-out-architecture/325206 "2023-02-10T07:04:54Z")
Hi Elastic Community, please need your advice. I have 2 logstash, 3 elasticsearch nodes, and 1 kibana for one office. I want to scale out the architecture, because there is new office with 300GB/day. My goal is to stick… --- ## [Grok filter request for json/custom pattern](https://discuss.elastic.co/t/grok-filter-request-for-json-custom-pattern/325135)
**Author:** [@a.emrekaraman](https://discuss.elastic.co/u/a.emrekaraman)\ **Replies:** 0\ **Last updated:** [February 9, 2023, 11:39am UTC](https://discuss.elastic.co/t/grok-filter-request-for-json-custom-pattern/325135 "2023-02-09T11:39:16Z")
Hi Team, I installed logstash and try to create right grok filter for my logs to parse it. How can I parse below logs ? ( timestamp seems as custom.%{TIMESTAMP\_ISO8601:timestamp}" doesnt work) 09-Feb-2023 09:52:49 tmp… --- ## [GROK Pattern creation](https://discuss.elastic.co/t/grok-pattern-creation/324605)
**Author:** [@anushka1203](https://discuss.elastic.co/u/anushka1203)\ **Replies:** 7\ **Last updated:** [February 10, 2023, 6:25am UTC](https://discuss.elastic.co/t/grok-pattern-creation/324605 "2023-02-10T06:25:33Z")
Hi all, Need help in creating grok pattern that works for both the following type of logs 01/25-05:17:51.314622 192.168.1.1:138 -\> 192.168.1.255:138 UDP TTL:64 TOS:0x0 ID:50222 IpLen:20 DgmLen:229 DF Len: 201 =+=+=+=+=… --- ## [Create an index with 0 replicas using terraform](https://discuss.elastic.co/t/create-an-index-with-0-replicas-using-terraform/324707)
**Author:** [@james-world](https://discuss.elastic.co/u/james-world)\ **Replies:** 2\ **Last updated:** [February 9, 2023, 11:42pm UTC](https://discuss.elastic.co/t/create-an-index-with-0-replicas-using-terraform/324707 "2023-02-09T23:42:26Z")
I am trying to use the latest terraform provider, currently 0.5.0 to create an index with no replicas into an existing Azure managed deployment. I can successfully create the index, but I always get 1 replica, even thou… --- ## [Filebeat kafka input message is incomplete and full of Unicode characters](https://discuss.elastic.co/t/filebeat-kafka-input-message-is-incomplete-and-full-of-unicode-characters/324139)
**Author:** [@gfar72](https://discuss.elastic.co/u/gfar72)\ **Replies:** 1\ **Last updated:** [February 9, 2023, 11:19pm UTC](https://discuss.elastic.co/t/filebeat-kafka-input-message-is-incomplete-and-full-of-unicode-characters/324139 "2023-02-09T23:19:18Z")
Hi Forum We have a filebeat instance that uses the kafka input to read from a topic. The instance is able to connect to the topic, but the output of the "message" key is incomplete, and full of Unicode characters see t… --- ## ["missing authentication credentials for REST request \[/\]"](https://discuss.elastic.co/t/missing-authentication-credentials-for-rest-request/325177)
**Author:** [@vijaybala](https://discuss.elastic.co/u/vijaybala)\ **Replies:** 1\ **Last updated:** [February 9, 2023, 10:48pm UTC](https://discuss.elastic.co/t/missing-authentication-credentials-for-rest-request/325177 "2023-02-09T22:48:36Z")
Hi, I'm new to ELK Stack .I'm using 8.6.1 I have configured elasticsearch and kibana, and failed to configure logstash. After shutting down the system and running elasticsearch.bat, and connection to the local port it is… --- ## [Kibana new metric visualization too small and doesn't show full value](https://discuss.elastic.co/t/kibana-new-metric-visualization-too-small-and-doesnt-show-full-value/325077)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 7\ **Last updated:** [February 9, 2023, 10:19pm UTC](https://discuss.elastic.co/t/kibana-new-metric-visualization-too-small-and-doesnt-show-full-value/325077 "2023-02-09T22:19:56Z")
Hello, I'm currently on version 8.5.1 and can't updated at the moment, I'm trying to creat a dashboard showing some metrics and decided to use the Metric visualization instead of the old Legacy Visualization, but I have… --- ## [Elasticsearch service does not start on Windows](https://discuss.elastic.co/t/elasticsearch-service-does-not-start-on-windows/325165)
**Author:** [@ludovic.denee](https://discuss.elastic.co/u/ludovic.denee)\ **Replies:** 1\ **Last updated:** [February 9, 2023, 9:42pm UTC](https://discuss.elastic.co/t/elasticsearch-service-does-not-start-on-windows/325165 "2023-02-09T21:42:28Z")
Hi all, In the context of an upgrade of Azure DevOps Server from 2020 to 2022, I needed to upgrade the ES service. from 6 to 7. Update is ok but impossible to start the service. I tried to uninstall and reinstall the … --- ## [Logstash to Elasticsearch connection](https://discuss.elastic.co/t/logstash-to-elasticsearch-connection/325198)
**Author:** [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\ **Replies:** 0\ **Last updated:** [February 9, 2023, 9:39pm UTC](https://discuss.elastic.co/t/logstash-to-elasticsearch-connection/325198 "2023-02-09T21:39:17Z")
Hello! I have filebeat running on 192.168.035 and ELK on 192.168.0.36 (name of the remote server is not good - " logstash" which can be confusing) I'm runnnig filebeat -e -c filebeat.yml -d "publish" using logstash… --- ## [Changing date format through Logstash](https://discuss.elastic.co/t/changing-date-format-through-logstash/325061)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 4\ **Last updated:** [February 9, 2023, 9:39pm UTC](https://discuss.elastic.co/t/changing-date-format-through-logstash/325061 "2023-02-09T21:39:16Z")
Hello. We are getting feed from Kafka topic. One of the fields rdt appears in the following format: I need to change the date format to YYYY-MM-dd This was added in the logstash conf file: if "KafkCollect" in … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=636) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=638)