# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=672 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 673 --- ## [/hostfs/sys/fs/cgroup/io.stat: input does not match format](https://discuss.elastic.co/t/hostfs-sys-fs-cgroup-io-stat-input-does-not-match-format/322837)
**Author:** [@litronics](https://discuss.elastic.co/u/litronics)\ **Replies:** 0\ **Last updated:** [January 10, 2023, 12:48pm UTC](https://discuss.elastic.co/t/hostfs-sys-fs-cgroup-io-stat-input-does-not-match-format/322837 "2023-01-10T12:48:02Z")
Hi, I am getting constantly the following errormessage in my metricbeat logs: \[elastic\_agent.metricbeat\]\[error\] error getting cgroup stats for V2: error fetching stats for controller io: error fetching IO stats: error … --- ## [Exclude user access using regular expressions in kibana](https://discuss.elastic.co/t/exclude-user-access-using-regular-expressions-in-kibana/322833)
**Author:** [@Shivani\_Hadke](https://discuss.elastic.co/u/Shivani_Hadke)\ **Replies:** 4\ **Last updated:** [January 10, 2023, 12:45pm UTC](https://discuss.elastic.co/t/exclude-user-access-using-regular-expressions-in-kibana/322833 "2023-01-10T12:45:45Z")
I would like to exclude only a particular index and have access to rest of all indexes in a cluster. Right now, I'm adding every index by clicking on it and in roles and it is a hectic task to do just to exclude one ind… --- ## [Filebeat daemonset in Kubernetes is slow (or fails) to harvest logs from multiple pods](https://discuss.elastic.co/t/filebeat-daemonset-in-kubernetes-is-slow-or-fails-to-harvest-logs-from-multiple-pods/322634)
**Author:** [@melkamar](https://discuss.elastic.co/u/melkamar)\ **Replies:** 2\ **Last updated:** [January 10, 2023, 12:08pm UTC](https://discuss.elastic.co/t/filebeat-daemonset-in-kubernetes-is-slow-or-fails-to-harvest-logs-from-multiple-pods/322634 "2023-01-10T12:08:58Z")
Hi! After a full day of pulling my hair I’m giving up and want to ask for help here :pray: I have a Kubernetes cluster where I am running a Filebeat daemonset. I noticed that the logs from some of the pods go missing so… --- ## [Embedding external plugin in create Visualization section](https://discuss.elastic.co/t/embedding-external-plugin-in-create-visualization-section/322797)
**Author:** [@anik-27](https://discuss.elastic.co/u/anik-27)\ **Replies:** 1\ **Last updated:** [January 10, 2023, 11:11am UTC](https://discuss.elastic.co/t/embedding-external-plugin-in-create-visualization-section/322797 "2023-01-10T11:11:44Z")
Hello friends ! I have created an external plugin, I want it to be a part of New Visualization just like Lens, TSVB, custom visualization. (refer image for better understanding) Can anyone please help me to achieve th… --- ## [Data duplication happening when using multiple configuration for logstash with different input ports](https://discuss.elastic.co/t/data-duplication-happening-when-using-multiple-configuration-for-logstash-with-different-input-ports/322799)
**Author:** [@asambasivan](https://discuss.elastic.co/u/asambasivan)\ **Replies:** 2\ **Last updated:** [January 10, 2023, 11:05am UTC](https://discuss.elastic.co/t/data-duplication-happening-when-using-multiple-configuration-for-logstash-with-different-input-ports/322799 "2023-01-10T11:05:32Z")
Hello, We have two logstash configurations with two different input ports 5044 and 5045 for accepting connections, but while the filebeat is sending logs to logstash via port 5045 the data is getting duplicated and we a… --- ## [Kibana Visualization of bucket aggregation data](https://discuss.elastic.co/t/kibana-visualization-of-bucket-aggregation-data/320554)
**Author:** [@jos\_nubel007](https://discuss.elastic.co/u/jos_nubel007)\ **Replies:** 3\ **Last updated:** [December 13, 2022, 9:33am UTC](https://discuss.elastic.co/t/kibana-visualization-of-bucket-aggregation-data/320554 "2022-12-13T09:33:05Z")
I created an index that collects metrics for different applications and I visualize these metrics in Kibana. However, there is a field that contains bucket aggregation datas (something like that: Variable width histogram… --- ## [Kibana Data view "fieldAttrs"](https://discuss.elastic.co/t/kibana-data-view-fieldattrs/322629)
**Author:** [@cotarbe](https://discuss.elastic.co/u/cotarbe)\ **Replies:** 2\ **Last updated:** [January 10, 2023, 9:28am UTC](https://discuss.elastic.co/t/kibana-data-view-fieldattrs/322629 "2023-01-10T09:28:03Z")
Hello, I used Kibana API to get info about a data view GET kbn:/api/data\_views/data\_view/\ and I got an object as the following: { "data\_view": { "id": "...", "version": "...", "tit… --- ## [Monitor Filebeat read/write throughput](https://discuss.elastic.co/t/monitor-filebeat-read-write-throughput/322805)
**Author:** [@anando](https://discuss.elastic.co/u/anando)\ **Replies:** 0\ **Last updated:** [January 10, 2023, 8:53am UTC](https://discuss.elastic.co/t/monitor-filebeat-read-write-throughput/322805 "2023-01-10T08:53:19Z")
Hi all, I am new to Filebeat. In our environment, we have deployed an Elasticsearch cluster using ECK on the k8s cluster. k8s cluster has 1 master node and 3 worker nodes. ELK cluster is deployed with 1 coordinating n… --- ## [Keyword Stuffing](https://discuss.elastic.co/t/keyword-stuffing/322786)
**Author:** [@Kharad](https://discuss.elastic.co/u/Kharad)\ **Replies:** 1\ **Last updated:** [January 10, 2023, 8:04am UTC](https://discuss.elastic.co/t/keyword-stuffing/322786 "2023-01-10T08:04:09Z")
Need Help with Keyword Stuffing. Scenario: I have 2 Presentations, with the titles as follows: Example 1: Presentation #1: "Bake Cake Bake bake cake cake cake bake" Presentation #2: "Bake Cake" Now, when I search wi… --- ## [Can I use pattern in Logstash output plugin](https://discuss.elastic.co/t/can-i-use-pattern-in-logstash-output-plugin/322600)
**Author:** [@Rakhshunda\_Noorein\_J](https://discuss.elastic.co/u/Rakhshunda_Noorein_J)\ **Replies:** 12\ **Last updated:** [January 10, 2023, 7:30am UTC](https://discuss.elastic.co/t/can-i-use-pattern-in-logstash-output-plugin/322600 "2023-01-10T07:30:27Z")
Hello, I want to track all the failures log in a file. For Example, if "\_jsonparsefailure" in \[tags\] { file { path =\> "\_jsonparsefailure.txt" } } Can I use pattern like - if "\*failure\*" in \[tags\] so that I… --- ## [Log events not stored in syslog persistent queue](https://discuss.elastic.co/t/log-events-not-stored-in-syslog-persistent-queue/322622)
**Author:** [@ferdose\_shaik](https://discuss.elastic.co/u/ferdose_shaik)\ **Replies:** 3\ **Last updated:** [January 10, 2023, 7:17am UTC](https://discuss.elastic.co/t/log-events-not-stored-in-syslog-persistent-queue/322622 "2023-01-10T07:17:05Z")
Hi, We are using Logstash 8.3.0. We are using syslog output with persistent queue. Please see following configuration. logstash.yml: ---- http.host: "0.0.0.0" http.port: 9600 log.level: "info" pipeline.workers: 2 pipel… --- ## [GUID is not a configured index pattern ID Showing the default index pattern:](https://discuss.elastic.co/t/guid-is-not-a-configured-index-pattern-id-showing-the-default-index-pattern/322352)
**Author:** [@hagite](https://discuss.elastic.co/u/hagite)\ **Replies:** 2\ **Last updated:** [January 10, 2023, 7:11am UTC](https://discuss.elastic.co/t/guid-is-not-a-configured-index-pattern-id-showing-the-default-index-pattern/322352 "2023-01-10T07:11:50Z")
Hello, My Kibana is working well always, yesterday, in Discovery page I got the message 99792e00-1552-11ec-929c-81cfc96dcc03" is not a configured index pattern ID Showing the default index pattern: "file\*" (5c1d0020… --- ## ['Select A field' option is not populating while creating a new alert](https://discuss.elastic.co/t/select-a-field-option-is-not-populating-while-creating-a-new-alert/322794)
**Author:** [@Narinder\_Tiwari](https://discuss.elastic.co/u/Narinder_Tiwari)\ **Replies:** 0\ **Last updated:** [January 10, 2023, 7:11am UTC](https://discuss.elastic.co/t/select-a-field-option-is-not-populating-while-creating-a-new-alert/322794 "2023-01-10T07:11:46Z")
Hi, i am trying to create a Metric threshold alert for memory usages is \> 90 %. No field is populating in 'Select A field'' option . When I trying to add the field 'system.memory.used.pct'. it's not accepting it. Surpr… --- ## [Elasticsearch return search response very quickly with timeout:true](https://discuss.elastic.co/t/elasticsearch-return-search-response-very-quickly-with-timeout-true/322537)
**Author:** [@chenchuangc](https://discuss.elastic.co/u/chenchuangc)\ **Replies:** 8\ **Last updated:** [January 10, 2023, 7:01am UTC](https://discuss.elastic.co/t/elasticsearch-return-search-response-very-quickly-with-timeout-true/322537 "2023-01-10T07:01:56Z")
Elasticsearch version bin/elasticsearch --version 7.6.0 Problem I use go-elasticsearch client query from elasticsearch. resp, err := client.Search( client.Search.WithContext(d.ctx), client.Search.WithIndex(inde… --- ## [Logstash regex pattern for a windows path](https://discuss.elastic.co/t/logstash-regex-pattern-for-a-windows-path/322790)
**Author:** [@ShubhamKumarJena](https://discuss.elastic.co/u/ShubhamKumarJena)\ **Replies:** 0\ **Last updated:** [January 10, 2023, 6:22am UTC](https://discuss.elastic.co/t/logstash-regex-pattern-for-a-windows-path/322790 "2023-01-10T06:22:33Z")
Hello Elastic community, I am trying to use a if condition for my logstash filter for a windows path but not sure about the delimiter and correct syntax. Here is my complete windows directory " R:\\I3\\IC\\Logs\\Sabio\_Elk\_… --- ## [I want to show that's ip which is triggered](https://discuss.elastic.co/t/i-want-to-show-thats-ip-which-is-triggered/322788)
**Author:** [@Tayyab\_Ilyas](https://discuss.elastic.co/u/Tayyab_Ilyas)\ **Replies:** 0\ **Last updated:** [January 10, 2023, 6:14am UTC](https://discuss.elastic.co/t/i-want-to-show-thats-ip-which-is-triggered/322788 "2023-01-10T06:14:52Z")
I want the detected anomaly's IP to show in the alert, I am attaching the picture for reference. --- ## [Log Deletion on Elasticsearch nodes based on lastModified](https://discuss.elastic.co/t/log-deletion-on-elasticsearch-nodes-based-on-lastmodified/322785)
**Author:** [@mahesh\_tangella](https://discuss.elastic.co/u/mahesh_tangella)\ **Replies:** 0\ **Last updated:** [January 10, 2023, 5:30am UTC](https://discuss.elastic.co/t/log-deletion-on-elasticsearch-nodes-based-on-lastmodified/322785 "2023-01-10T05:30:46Z")
Hello Team, We are facing an issue with log deletion policy defined in log4j2.properties based on ifLastModified age. We want to delete all the log files which are larger than 2GB in size and older than 15 days. So, we… --- ## [Mismatch between dotted lines and the default dark lines in Time Series of TSVB visualization](https://discuss.elastic.co/t/mismatch-between-dotted-lines-and-the-default-dark-lines-in-time-series-of-tsvb-visualization/319540)
**Author:** [@Abj\_Ins](https://discuss.elastic.co/u/Abj_Ins)\ **Replies:** 12\ **Last updated:** [December 13, 2022, 5:20am UTC](https://discuss.elastic.co/t/mismatch-between-dotted-lines-and-the-default-dark-lines-in-time-series-of-tsvb-visualization/319540 "2022-12-13T05:20:34Z")
Hi Team, In the Timeseries visualization, we can see dotted lines in the middle of the visualization which is matching exactly on top of the default dark lines. However, when we hover the mouse either on the left or … --- ## [Kibana Server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/322780)
**Author:** [@Rishvana](https://discuss.elastic.co/u/Rishvana)\ **Replies:** 8\ **Last updated:** [January 10, 2023, 4:04am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/322780 "2023-01-10T04:04:10Z")
Hi Team, We are not able to login to kibana application as it throws an error "Kibana server is not ready yet. we recently renewed ssl certificate for kibana and we done sanity check at that time it works fine. can let… --- ## [Force kibana into connecting to preferred ES node](https://discuss.elastic.co/t/force-kibana-into-connecting-to-preferred-es-node/322779)
**Author:** [@blueren](https://discuss.elastic.co/u/blueren)\ **Replies:** 2\ **Last updated:** [January 10, 2023, 2:55am UTC](https://discuss.elastic.co/t/force-kibana-into-connecting-to-preferred-es-node/322779 "2023-01-10T02:55:10Z")
Hi, I've installed two instances of ES (co-ordinator only) running on a couple of machines, with a kibana instance. For kibana, I've set both of them as elasticsearch.hosts=\[es1, es2\] However, I'd always like it to talk… --- ## [How do I get find which parts of an Elasticsearch query match](https://discuss.elastic.co/t/how-do-i-get-find-which-parts-of-an-elasticsearch-query-match/322761)
**Author:** [@amirs5](https://discuss.elastic.co/u/amirs5)\ **Replies:** 7\ **Last updated:** [January 10, 2023, 2:37am UTC](https://discuss.elastic.co/t/how-do-i-get-find-which-parts-of-an-elasticsearch-query-match/322761 "2023-01-10T02:37:33Z")
I have a list of Key-word-sets, for example: set\_1: \["movie", "cinema", "theater"\], set\_2: \["beach", "ocean", "dock"\], set\_3: \["office", "downtown", "center"\] and I want to build up a single query that tells us which o… --- ## [External versioning when using nested documents and painless scripting](https://discuss.elastic.co/t/external-versioning-when-using-nested-documents-and-painless-scripting/322777)
**Author:** [@bpawQ](https://discuss.elastic.co/u/bpawQ)\ **Replies:** 0\ **Last updated:** [January 10, 2023, 1:19am UTC](https://discuss.elastic.co/t/external-versioning-when-using-nested-documents-and-painless-scripting/322777 "2023-01-10T01:19:27Z")
Hello, we have some use cases where we were considering using external versioning since we stream data from a DynamoDB instance to our elasticsearch cluster. I was wondering if it is possible to use external versioning i… --- ## [Canvas Filters (filterrows)](https://discuss.elastic.co/t/canvas-filters-filterrows/321075)
**Author:** [@Mark\_Rodman](https://discuss.elastic.co/u/Mark_Rodman)\ **Replies:** 2\ **Last updated:** [December 13, 2022, 1:21am UTC](https://discuss.elastic.co/t/canvas-filters-filterrows/321075 "2022-12-13T01:21:00Z")
Hi, I'm starting to learn Canvas but struggling with a few concepts in the expression editor. I hope someone can point me in the correct direction. I'm trying to filter a table, using the current date. My table conta… --- ## [Logstash configuration](https://discuss.elastic.co/t/logstash-configuration/322736)
**Author:** [@themainguru](https://discuss.elastic.co/u/themainguru)\ **Replies:** 1\ **Last updated:** [January 9, 2023, 10:59pm UTC](https://discuss.elastic.co/t/logstash-configuration/322736 "2023-01-09T22:59:24Z")
Hello All, I am using a docker image of sebp/elk. I have setup an EC2 Ubuntu machine. This is a vanilla installation. I have a rails app on another server. I want to push logs from rails to logstash. I am not sure wher… --- ## [Elasticsearch-java dependency on httpclient](https://discuss.elastic.co/t/elasticsearch-java-dependency-on-httpclient/322770)
**Author:** [@bbunton](https://discuss.elastic.co/u/bbunton)\ **Replies:** 2\ **Last updated:** [January 9, 2023, 10:33pm UTC](https://discuss.elastic.co/t/elasticsearch-java-dependency-on-httpclient/322770 "2023-01-09T22:33:45Z")
I have been working with Elasticsearch as a developer for a couple of years now and have successfully written some NiFi services that use the now deprecated Java API that uses port 9300 to query/retrieve/delete records t… --- ## [Indexing multiple csv files into one index with nested fields](https://discuss.elastic.co/t/indexing-multiple-csv-files-into-one-index-with-nested-fields/322687)
**Author:** [@ivandreev1618](https://discuss.elastic.co/u/ivandreev1618)\ **Replies:** 1\ **Last updated:** [January 9, 2023, 10:25pm UTC](https://discuss.elastic.co/t/indexing-multiple-csv-files-into-one-index-with-nested-fields/322687 "2023-01-09T22:25:10Z")
I want to load data from multiple CSV files(Users, Scores, Messages) into one index via logstash. All CSV files have the same "userId" field that connects data in it. My goal is to have User-Index as a result, that has… --- ## [Understanding metrics filters](https://discuss.elastic.co/t/understanding-metrics-filters/322648)
**Author:** [@Dustin527](https://discuss.elastic.co/u/Dustin527)\ **Replies:** 11\ **Last updated:** [January 9, 2023, 10:15pm UTC](https://discuss.elastic.co/t/understanding-metrics-filters/322648 "2023-01-09T22:15:23Z")
Hi I am having trouble understanding the proper way to use metrics filter plugin to count the number of fields of a particular type. Say I have a file formatted with a name and age separated by a space e.g.: dustin 40 e… --- ## [Script\_score query with cosineSimularity on alias](https://discuss.elastic.co/t/script-score-query-with-cosinesimularity-on-alias/321700)
**Author:** [@KentLee](https://discuss.elastic.co/u/KentLee)\ **Replies:** 0\ **Last updated:** [December 20, 2022, 10:19pm UTC](https://discuss.elastic.co/t/script-score-query-with-cosinesimularity-on-alias/321700 "2022-12-20T22:19:45Z")
I have an alias created with several different indices and each index has multiple dense\_vector fields. I want to perform a script\_score search on all the dense\_vector field with the cosineSimularity function. For examp… --- ## [Logstash syntax error](https://discuss.elastic.co/t/logstash-syntax-error/322754)
**Author:** [@cool999](https://discuss.elastic.co/u/cool999)\ **Replies:** 5\ **Last updated:** [January 9, 2023, 8:28pm UTC](https://discuss.elastic.co/t/logstash-syntax-error/322754 "2023-01-09T20:28:20Z")
Hi Team, I have logstash on two servers. It seems its working as index are getting created and logstash service is running from few days but whenever i checked logstash syntax, it shows below error. Is there anything wr… --- ## [How delete platinum license?](https://discuss.elastic.co/t/how-delete-platinum-license/322742)
**Author:** [@kurdit](https://discuss.elastic.co/u/kurdit)\ **Replies:** 4\ **Last updated:** [January 9, 2023, 6:38pm UTC](https://discuss.elastic.co/t/how-delete-platinum-license/322742 "2023-01-09T18:38:36Z")
hi! how can i remove the platinum license and enable the basic license? I tried POST /\_license/start\_trial?acknowledge=true but after 30 days the platinum license still remains... and tried xpack.license.self\_gen… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=671) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=673)