# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=670 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 671 --- ## [Checksum failed (hardware problem?)](https://discuss.elastic.co/t/checksum-failed-hardware-problem/322500)
**Author:** [@yang\_peng](https://discuss.elastic.co/u/yang_peng)\ **Replies:** 2\ **Last updated:** [January 11, 2023, 9:11pm UTC](https://discuss.elastic.co/t/checksum-failed-hardware-problem/322500 "2023-01-11T21:11:03Z")
A two-node cluster was restarted. The shard of one index failed to merge. The error is as follows： failed shard on node \[VosGChW1QTudYo9Tcl5sqg\]: shard failure, reason \[merge failed\], failure NotSerializableExceptionWra… --- ## [Watcher Action Webhook (Google Meet space) errored](https://discuss.elastic.co/t/watcher-action-webhook-google-meet-space-errored/322956)
**Author:** [@diegomarting](https://discuss.elastic.co/u/diegomarting)\ **Replies:** 0\ **Last updated:** [January 11, 2023, 4:22pm UTC](https://discuss.elastic.co/t/watcher-action-webhook-google-meet-space-errored/322956 "2023-01-11T16:22:11Z")
I am trying to create a Watcher monitor to check the number of documents of a query and send a message to a Google Webhook when the condition is met. The query and the condition work right. However when the condition is … --- ## [\_dateparseerror for timestamp in this format: 2023-01-11T05:07:30.648881Z,](https://discuss.elastic.co/t/dateparseerror-for-timestamp-in-this-format-2023-01-11t0530-648881z/322959)
**Author:** [@rickfish](https://discuss.elastic.co/u/rickfish)\ **Replies:** 10\ **Last updated:** [January 11, 2023, 8:54pm UTC](https://discuss.elastic.co/t/dateparseerror-for-timestamp-in-this-format-2023-01-11t0530-648881z/322959 "2023-01-11T20:54:45Z")
I am trying to parse a field called create\_ts with a value of 2023-01-11T05:07:30.648881Z and then add fields for year, month and day. I have scoured everything to figure out the correct timestamp pattern and cannot see… --- ## [TEXT FIELDS NOT GETTING IMPORTED](https://discuss.elastic.co/t/text-fields-not-getting-imported/314052)
**Author:** [@Shashank02](https://discuss.elastic.co/u/Shashank02)\ **Replies:** 4\ **Last updated:** [October 20, 2022, 9:06am UTC](https://discuss.elastic.co/t/text-fields-not-getting-imported/314052 "2022-10-20T09:06:20Z")
Text fields are not optimized for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fieldda… --- ## [Logstash Issue](https://discuss.elastic.co/t/logstash-issue/322960)
**Author:** [@amulya](https://discuss.elastic.co/u/amulya)\ **Replies:** 2\ **Last updated:** [January 11, 2023, 6:00pm UTC](https://discuss.elastic.co/t/logstash-issue/322960 "2023-01-11T18:00:53Z")
Starting Logstash for the first time in linux machine There was an error while loading \`logstash-core-plugin-api.gemspec\`: load error: psych -- java.lang.RuntimeException: BUG: we can not copy embedded jar to temp direc… --- ## [When I try to index a jason file using "es.helpers.bulk" the error "TypeError: pop expected at most 1 argument, got 2" is occurring](https://discuss.elastic.co/t/when-i-try-to-index-a-jason-file-using-es-helpers-bulk-the-error-typeerror-pop-expected-at-most-1-argument-got-2-is-occurring/322828)
**Author:** [@pand](https://discuss.elastic.co/u/pand)\ **Replies:** 2\ **Last updated:** [January 11, 2023, 4:54pm UTC](https://discuss.elastic.co/t/when-i-try-to-index-a-jason-file-using-es-helpers-bulk-the-error-typeerror-pop-expected-at-most-1-argument-got-2-is-occurring/322828 "2023-01-11T16:54:09Z")
When I execute the following code the error "TypeError: pop expected at most 1 argument, got 2" is occuring, please provide solutions to fix this. def creatdocs(filename,pdfcontent): docs = \[{ 'content':… --- ## [How to configure filebeat if we are getting log files from different Linux servers?](https://discuss.elastic.co/t/how-to-configure-filebeat-if-we-are-getting-log-files-from-different-linux-servers/322954)
**Author:** [@SP003](https://discuss.elastic.co/u/SP003)\ **Replies:** 0\ **Last updated:** [January 11, 2023, 4:03pm UTC](https://discuss.elastic.co/t/how-to-configure-filebeat-if-we-are-getting-log-files-from-different-linux-servers/322954 "2023-01-11T16:03:57Z")
Hi Experts, As of now, I am able configure filebeat , logstash and get the index created with logs successfully in Elastic Search in the same server where log files are available, now I want to access log files which is… --- ## [Logstash http output plugin times out](https://discuss.elastic.co/t/logstash-http-output-plugin-times-out/322953)
**Author:** [@sarabande](https://discuss.elastic.co/u/sarabande)\ **Replies:** 0\ **Last updated:** [January 11, 2023, 4:03pm UTC](https://discuss.elastic.co/t/logstash-http-output-plugin-times-out/322953 "2023-01-11T16:03:01Z")
I'm using logstash http output plugin to send log events to an URL. This is how my output section looks like: output { if \[logger\_name\] != 'xxx' and \[type\] != "xxx" and \[logger\_name\] != 'xxx' { elasticsearch {… --- ## [Failed indices in snapshot since upgrade to 8.5.3](https://discuss.elastic.co/t/failed-indices-in-snapshot-since-upgrade-to-8-5-3/322802)
**Author:** [@QuLh44](https://discuss.elastic.co/u/QuLh44)\ **Replies:** 7\ **Last updated:** [January 11, 2023, 3:55pm UTC](https://discuss.elastic.co/t/failed-indices-in-snapshot-since-upgrade-to-8-5-3/322802 "2023-01-11T15:55:22Z")
Hello, Since we upgraded Elasticsearch/Logstash/Kibana to 8.5.3 version yesterday, we have lot of failed indices in snapshots (559 indices are OK, but 168 failed). Here is the error for each of them : INTERNAL\_SERVER\_… --- ## [\[ERROR\]\[logstash.agent\] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of \[ \\\\t\\\\r\\\\n\], \\"#\\", \\"and\\", \\"or\\", \\"xor\\", \\"nand\\",](https://discuss.elastic.co/t/error-logstash-agent-failed-to-execute-action-action-logstash-create-pipeline-id-main-exception-logstash-configurationerror-message-expected-one-of-t-r-n-and-or-xor-nand/322599)
**Author:** [@SP003](https://discuss.elastic.co/u/SP003)\ **Replies:** 6\ **Last updated:** [January 11, 2023, 3:50pm UTC](https://discuss.elastic.co/t/error-logstash-agent-failed-to-execute-action-action-logstash-create-pipeline-id-main-exception-logstash-configurationerror-message-expected-one-of-t-r-n-and-or-xor-nand/322599 "2023-01-11T15:50:28Z")
Hello experts, I am setting up filebeat, logstash for my log monitoring work. (Linux system) Getting below error on filebeat. --\> systemctl status filebeat - getting error --\> systemctl status logstash - Running fine… --- ## [How to stagger results by same source id but default sorted by date?](https://discuss.elastic.co/t/how-to-stagger-results-by-same-source-id-but-default-sorted-by-date/322275)
**Author:** [@Urban\_B](https://discuss.elastic.co/u/Urban_B)\ **Replies:** 3\ **Last updated:** [January 11, 2023, 3:37pm UTC](https://discuss.elastic.co/t/how-to-stagger-results-by-same-source-id-but-default-sorted-by-date/322275 "2023-01-11T15:37:54Z")
I have a situation where I have a set of documents that by default sorts by datetime so most resent documents are top listed. The dilemma is that a company can send us a feed of data so that companies results can take u… --- ## [Logstash - Converting input from JDBC to json for an HTTP request](https://discuss.elastic.co/t/logstash-converting-input-from-jdbc-to-json-for-an-http-request/322949)
**Author:** [@L\_C](https://discuss.elastic.co/u/L_C)\ **Replies:** 0\ **Last updated:** [January 11, 2023, 3:32pm UTC](https://discuss.elastic.co/t/logstash-converting-input-from-jdbc-to-json-for-an-http-request/322949 "2023-01-11T15:32:47Z")
Hello, I am looking for some pointers regarding how to convert input data from a JBDC plugin into json to send the content to an API. Here is the logstash.conf: input { jdbc { jdbc\_driver\_library =\> "/logstash-c… --- ## [Reference line - can it vary over time?](https://discuss.elastic.co/t/reference-line-can-it-vary-over-time/321226)
**Author:** [@tinrik](https://discuss.elastic.co/u/tinrik)\ **Replies:** 1\ **Last updated:** [December 14, 2022, 3:36pm UTC](https://discuss.elastic.co/t/reference-line-can-it-vary-over-time/321226 "2022-12-14T15:36:24Z")
Hi! I'm following the tutorial on how to add a reference line. It looks great and exactly what I'm looking for. However I need to have the reference line be different at different points in time. For example at t = 0 t… --- ## [KPI for data comparison in Kibana](https://discuss.elastic.co/t/kpi-for-data-comparison-in-kibana/322920)
**Author:** [@Vasili](https://discuss.elastic.co/u/Vasili)\ **Replies:** 3\ **Last updated:** [January 11, 2023, 3:25pm UTC](https://discuss.elastic.co/t/kpi-for-data-comparison-in-kibana/322920 "2023-01-11T15:25:17Z")
Hello, I'm using Kibana 6.8.21, I have created dashboard regarding users Mailbox usage and corresponding carbon emission over time (with following KPIs for instance: number of sent and received emails per day…). The go… --- ## [Pipeline: copy unique value to a new index](https://discuss.elastic.co/t/pipeline-copy-unique-value-to-a-new-index/322946)
**Author:** [@SalvoDM91](https://discuss.elastic.co/u/SalvoDM91)\ **Replies:** 0\ **Last updated:** [January 11, 2023, 3:19pm UTC](https://discuss.elastic.co/t/pipeline-copy-unique-value-to-a-new-index/322946 "2023-01-11T15:19:27Z")
I guys, I need an help! I have an index called s1v6\_new\_cleaninq2 with more then 1 million of documents. Inside each documents I have a field called "num\_pratica" and this field could be repeated for a couple of documen… --- ## [Optional match for a grok pattern](https://discuss.elastic.co/t/optional-match-for-a-grok-pattern/322904)
**Author:** [@moep](https://discuss.elastic.co/u/moep)\ **Replies:** 3\ **Last updated:** [January 11, 2023, 3:05pm UTC](https://discuss.elastic.co/t/optional-match-for-a-grok-pattern/322904 "2023-01-11T15:05:46Z")
Hey community, I would like to build an optional match for the following logline: 2023-01-11 00:00:11 1pEoP9-000LLu-Gz \<= noreply@domain.de H=fqdn.domain.de (FQDN) \[10.1.1.1\] P=esmtpa A=login\_virtual\_exim:mtaspooler@do… --- ## [Migrating code from ElasticSearch.Net 7 to Elastic.Clients.Elasticsearch 8](https://discuss.elastic.co/t/migrating-code-from-elasticsearch-net-7-to-elastic-clients-elasticsearch-8/322937)
**Author:** [@mbooh](https://discuss.elastic.co/u/mbooh)\ **Replies:** 0\ **Last updated:** [January 11, 2023, 2:03pm UTC](https://discuss.elastic.co/t/migrating-code-from-elasticsearch-net-7-to-elastic-clients-elasticsearch-8/322937 "2023-01-11T14:03:48Z")
Hi! I’m rewriting our code for the new Elastic.Client.Elasticsearch and I’m trying to find some code examples how to do that. For example we have a lot of queries like this one: \> var response = \_client.Search\ **Author:** [@fesiqueira](https://discuss.elastic.co/u/fesiqueira)\ **Replies:** 0\ **Last updated:** [January 11, 2023, 1:52pm UTC](https://discuss.elastic.co/t/get-elastic-shards-failure-upon-search-query-across-multiple-indices-while-creating-indices/322935 "2023-01-11T13:52:37Z") I'm using Elastic 7.13.1. I create indices dynamically using a template based on the year of a timestamp field. So when I try to index a document with a timestamp for 2023-01-01 into index index-2023 the index will be cr… --- ## [Change logstash default @timestamp format](https://discuss.elastic.co/t/change-logstash-default-timestamp-format/322857)
**Author:** [@markedperf](https://discuss.elastic.co/u/markedperf)\ **Replies:** 2\ **Last updated:** [January 11, 2023, 1:41pm UTC](https://discuss.elastic.co/t/change-logstash-default-timestamp-format/322857 "2023-01-11T13:41:29Z")
I am looking to change the default @timestamp format from nano seconds ("@timestamp" : "2023-01-07T17:26:16.969990782Z") to just milliseconds ("@timestamp" : "2023-01-07T17:26:16.969" or "@timestamp" : "2023-01-07T17:26:… --- ## [TCP/UDP VS syslog](https://discuss.elastic.co/t/tcp-udp-vs-syslog/322927)
**Author:** [@m3bgwad](https://discuss.elastic.co/u/m3bgwad)\ **Replies:** 3\ **Last updated:** [January 11, 2023, 1:31pm UTC](https://discuss.elastic.co/t/tcp-udp-vs-syslog/322927 "2023-01-11T13:31:40Z")
What is differences between the below. input { tcp { port =\> 514 type =\> syslog } udp { port =\> 514 type =\> syslog } } VS input { syslog { port =\> 514 } } If I need to receive syslog m… --- ## [Logstash Input plugin for Elasticsearch to query once based on scedule instead of scrolling](https://discuss.elastic.co/t/logstash-input-plugin-for-elasticsearch-to-query-once-based-on-scedule-instead-of-scrolling/322931)
**Author:** [@sahil\_sawhney](https://discuss.elastic.co/u/sahil_sawhney)\ **Replies:** 0\ **Last updated:** [January 11, 2023, 1:21pm UTC](https://discuss.elastic.co/t/logstash-input-plugin-for-elasticsearch-to-query-once-based-on-scedule-instead-of-scrolling/322931 "2023-01-11T13:21:39Z")
As visible in the screenshot for 1-minute duration, the data is queried multiple times. I wish to disable this and for a schedule "\* \* \* \* \*" collect data only once in 1 minute. My current config for logstash input pl… --- ## [Can't add wildcard multifield to double type through Kibana in Component Template](https://discuss.elastic.co/t/cant-add-wildcard-multifield-to-double-type-through-kibana-in-component-template/322310)
**Author:** [@bkelastic](https://discuss.elastic.co/u/bkelastic)\ **Replies:** 2\ **Last updated:** [January 11, 2023, 1:12pm UTC](https://discuss.elastic.co/t/cant-add-wildcard-multifield-to-double-type-through-kibana-in-component-template/322310 "2023-01-11T13:12:09Z")
Stack v 7.17.3 It is not possible to add wildcard multifield to field with type Double through Kibana in Component Template -\> Mappings. Via REST API I am able to add this to mappings in existing index. Searching with … --- ## [Kibana ILM not work correctly (elasticsearch log info message)](https://discuss.elastic.co/t/kibana-ilm-not-work-correctly-elasticsearch-log-info-message/322446)
**Author:** [@mario2](https://discuss.elastic.co/u/mario2)\ **Replies:** 5\ **Last updated:** [January 11, 2023, 1:01pm UTC](https://discuss.elastic.co/t/kibana-ilm-not-work-correctly-elasticsearch-log-info-message/322446 "2023-01-11T13:01:40Z")
Hi, I have 3 node cluster elasticsearch (every on different VM (RHEL8)- node 1, 2 ,3), kibana is installed at one of this nodes (node 2). There is config for one node (other's the same, but with diff names): # -------… --- ## [Elasticsearch 7.7 , cpu usage is very high](https://discuss.elastic.co/t/elasticsearch-7-7-cpu-usage-is-very-high/322726)
**Author:** [@gilsagiv](https://discuss.elastic.co/u/gilsagiv)\ **Replies:** 10\ **Last updated:** [January 11, 2023, 1:00pm UTC](https://discuss.elastic.co/t/elasticsearch-7-7-cpu-usage-is-very-high/322726 "2023-01-11T13:00:36Z")
Hi, My server is working on Elasticsearch 7.7, Recently the CPU usage is reaching 100% when Kibana is running. Elasticsearch process CPU usage is very high. GET \_cat/nodes?v=true&s=cpu:desc GET /\_cluster/setti… --- ## [Logstash Elasticsearch output plugin fails to establish a connection](https://discuss.elastic.co/t/logstash-elasticsearch-output-plugin-fails-to-establish-a-connection/322922)
**Author:** [@Thijsvdp](https://discuss.elastic.co/u/Thijsvdp)\ **Replies:** 2\ **Last updated:** [January 11, 2023, 12:59pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-plugin-fails-to-establish-a-connection/322922 "2023-01-11T12:59:37Z")
Hi all, I am facing an error with Logstash which is not able to connect to Elasticsearch. I am getting the following error: \[2023-01-11T12:10:15,365\]\[WARN \]\[logstash.outputs.elasticsearch\]\[continuous\] Attempted to resu… --- ## [Syslog output plugin :number type input parametrization](https://discuss.elastic.co/t/syslog-output-plugin-number-type-input-parametrization/322905)
**Author:** [@arirajamaki](https://discuss.elastic.co/u/arirajamaki)\ **Replies:** 3\ **Last updated:** [January 11, 2023, 12:38pm UTC](https://discuss.elastic.co/t/syslog-output-plugin-number-type-input-parametrization/322905 "2023-01-11T12:38:49Z")
Hello Community, I'm in trouble with my logstash pipeline configuration. I'm trying to use syslog output plugin so that I can dynamically change the destination syslog server port. I'm trying do tcp/udp connection to d… --- ## [Number of fields displayed in drop down list Controls visualizations](https://discuss.elastic.co/t/number-of-fields-displayed-in-drop-down-list-controls-visualizations/322840)
**Author:** [@Alice\_Ionescu](https://discuss.elastic.co/u/Alice_Ionescu)\ **Replies:** 1\ **Last updated:** [January 11, 2023, 12:24pm UTC](https://discuss.elastic.co/t/number-of-fields-displayed-in-drop-down-list-controls-visualizations/322840 "2023-01-11T12:24:40Z")
Hello, Now when creating a Controls visualization the number of fields displayed in the drop down list is 10. Is there possible to change the number of fields displayed? Thank you! --- ## [Elasticsearch gives execption while report download\["message":"Request cannot be executed; I/O reactor status: STOPPED","errorstacktrace":"java.lang.RuntimeException\]](https://discuss.elastic.co/t/elasticsearch-gives-execption-while-report-download-message-request-cannot-be-executed-i-o-reactor-status-stopped-errorstacktrace-java-lang-runtimeexception/322825)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 2\ **Last updated:** [January 11, 2023, 12:03pm UTC](https://discuss.elastic.co/t/elasticsearch-gives-execption-while-report-download-message-request-cannot-be-executed-i-o-reactor-status-stopped-errorstacktrace-java-lang-runtimeexception/322825 "2023-01-11T12:03:13Z")
Hello All, I'm getting following exception while downloading report by query elastic.Unable to understand resolution for this.Tried increasing the jvm heap to 12 gb ,still same exception. Exception: {"statusCode":"REP… --- ## [Parse PDF catalogs to extract products informations](https://discuss.elastic.co/t/parse-pdf-catalogs-to-extract-products-informations/322145)
**Author:** [@Valentin\_Hirson](https://discuss.elastic.co/u/Valentin_Hirson)\ **Replies:** 3\ **Last updated:** [January 11, 2023, 11:22am UTC](https://discuss.elastic.co/t/parse-pdf-catalogs-to-extract-products-informations/322145 "2023-01-11T11:22:52Z")
Hello, I need to parse some PDF files to find the most relevant words and trying to find what PDF are talking about. Those PDF are vendors catalog, I need for example to extract products to propose them in a web search… --- ## [ES default date type not taking nanos](https://discuss.elastic.co/t/es-default-date-type-not-taking-nanos/322614)
**Author:** [@samee\_alam](https://discuss.elastic.co/u/samee_alam)\ **Replies:** 2\ **Last updated:** [January 11, 2023, 11:19am UTC](https://discuss.elastic.co/t/es-default-date-type-not-taking-nanos/322614 "2023-01-11T11:19:58Z")
ES version 7.17.3 Fluentd config is as below: time\_key timestamp time\_format %Y-%m-%dT%H:%M:%S.%N%Z which takes nano seconds into consideration and data is stored properly in elasticsearch as: But default … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=669) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=671)