# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=693 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 694 --- ## ["stdout only" logs not captured in filebeat while display file with kubectl logs pod](https://discuss.elastic.co/t/stdout-only-logs-not-captured-in-filebeat-while-display-file-with-kubectl-logs-pod/321645)
**Author:** [@Humayun\_Manzer](https://discuss.elastic.co/u/Humayun_Manzer)\ **Replies:** 0\ **Last updated:** [December 20, 2022, 12:38pm UTC](https://discuss.elastic.co/t/stdout-only-logs-not-captured-in-filebeat-while-display-file-with-kubectl-logs-pod/321645 "2022-12-20T12:38:51Z")
This is the filebeats config I am using via helm charts filebeatConfig: filebeat.yml: | filebeat.inputs: - type: container paths: - /var/log/containers/\*.log processors: … --- ## [Integrate external plugin in visualization dashboard](https://discuss.elastic.co/t/integrate-external-plugin-in-visualization-dashboard/319451)
**Author:** [@anik-27](https://discuss.elastic.co/u/anik-27)\ **Replies:** 2\ **Last updated:** [December 20, 2022, 12:19pm UTC](https://discuss.elastic.co/t/integrate-external-plugin-in-visualization-dashboard/319451 "2022-12-20T12:19:20Z")
Hello Everyone ! I have built an external plugin(landingPage) that consist of a navigation bar and footer with React I can access this plugin from the left panel below the elastic logo (Please refer image for better… --- ## [Ldap - local user creation](https://discuss.elastic.co/t/ldap-local-user-creation/321633)
**Author:** [@Bhanuji\_paluri](https://discuss.elastic.co/u/Bhanuji_paluri)\ **Replies:** 3\ **Last updated:** [December 20, 2022, 11:39am UTC](https://discuss.elastic.co/t/ldap-local-user-creation/321633 "2022-12-20T11:39:01Z")
hi Team, Is it possible to create the local user after enable the LDAP ? we are able to create the local users in 7.3.1 before LDAP implementation. but now we are not able login thru the same local user and don't have … --- ## [Customise Bar chart bar width](https://discuss.elastic.co/t/customise-bar-chart-bar-width/321580)
**Author:** [@Amritha\_Patil](https://discuss.elastic.co/u/Amritha_Patil)\ **Replies:** 2\ **Last updated:** [December 20, 2022, 10:55am UTC](https://discuss.elastic.co/t/customise-bar-chart-bar-width/321580 "2022-12-20T10:55:34Z")
Hi, Is there as way to customize the width of bars that are displayed in the bar chart. The number of bars differ based on controls. When the number of bars are low, they tend to be too fat. Is there a way I can fix th… --- ## [Underlying file changed by an external force](https://discuss.elastic.co/t/underlying-file-changed-by-an-external-force/321401)
**Author:** [@Marco201](https://discuss.elastic.co/u/Marco201)\ **Replies:** 3\ **Last updated:** [December 20, 2022, 10:47am UTC](https://discuss.elastic.co/t/underlying-file-changed-by-an-external-force/321401 "2022-12-20T10:47:01Z")
Hello, since some time we can find the following warning in certain time intervals in logs of elastic in our environments. Usually this has no effect, but sometimes not all shards are assigned and you have to do a retry… --- ## [Filebeat exclude\_files regex](https://discuss.elastic.co/t/filebeat-exclude-files-regex/321206)
**Author:** [@Shubham\_Singh](https://discuss.elastic.co/u/Shubham_Singh)\ **Replies:** 3\ **Last updated:** [December 20, 2022, 9:49am UTC](https://discuss.elastic.co/t/filebeat-exclude-files-regex/321206 "2022-12-20T09:49:15Z")
I want to exclude all access logs files from the filebeat except 2 service access logs. I'm using the regex but getting error and filebeat start is failing exclude\_files: \['\\/var\\/log\\/xxx\\/.\*(?!.\*(xxx)).\*\\/.\*(?!.\*(xxx)… --- ## [Prevent shard in specific node](https://discuss.elastic.co/t/prevent-shard-in-specific-node/321619)
**Author:** [@m3bgwad](https://discuss.elastic.co/u/m3bgwad)\ **Replies:** 2\ **Last updated:** [December 20, 2022, 9:37am UTC](https://discuss.elastic.co/t/prevent-shard-in-specific-node/321619 "2022-12-20T09:37:35Z")
Hello everyone, how to prevent shard in specific node because I need add all nodes in the cluster but there is specific node RAM and CPU limitation, how to handle this approach and what is best practice to make this t… --- ## [Invalid multipart payload format while uploading img/pdf](https://discuss.elastic.co/t/invalid-multipart-payload-format-while-uploading-img-pdf/319189)
**Author:** [@iljaskajrris](https://discuss.elastic.co/u/iljaskajrris)\ **Replies:** 1\ **Last updated:** [November 22, 2022, 10:06am UTC](https://discuss.elastic.co/t/invalid-multipart-payload-format-while-uploading-img-pdf/319189 "2022-11-22T10:06:18Z")
hi team, i use kibana 7.10.2 and create endpoint which uploads files as FormData. My code snippet is like: { path: '/api/soc\_services\_audit/attach\_files', options: { body: { … --- ## [Unable to see documents in Discovery after applying an index template](https://discuss.elastic.co/t/unable-to-see-documents-in-discovery-after-applying-an-index-template/321553)
**Author:** [@xzapata](https://discuss.elastic.co/u/xzapata)\ **Replies:** 1\ **Last updated:** [December 20, 2022, 9:30am UTC](https://discuss.elastic.co/t/unable-to-see-documents-in-discovery-after-applying-an-index-template/321553 "2022-12-20T09:30:04Z")
Good morning, I am unable to see my logs in Kibana (Discovery) after I apply an index template. At first, I mapped all fields (I deleted some) and after I saw it didn't work, I started out mapping only 2 fields of the m… --- ## [Indexed documents disappearing randomly within a short time after indexing](https://discuss.elastic.co/t/indexed-documents-disappearing-randomly-within-a-short-time-after-indexing/321560)
**Author:** [@bob22](https://discuss.elastic.co/u/bob22)\ **Replies:** 6\ **Last updated:** [December 20, 2022, 9:29am UTC](https://discuss.elastic.co/t/indexed-documents-disappearing-randomly-within-a-short-time-after-indexing/321560 "2022-12-20T09:29:51Z")
Hello, I'm having a weird issue with elasticsearch when indexed documents would disappear from the index within a short time after indexing. My application is indexing a couple of thousands documents (not a huge batch) … --- ## [Nginx Kibana: Bad Gateway 502](https://discuss.elastic.co/t/nginx-kibana-bad-gateway-502/321561)
**Author:** [@sharbich](https://discuss.elastic.co/u/sharbich)\ **Replies:** 5\ **Last updated:** [December 20, 2022, 9:23am UTC](https://discuss.elastic.co/t/nginx-kibana-bad-gateway-502/321561 "2022-12-20T09:23:09Z")
Hello, I use Nginx as a web server / proxy. I created the following nginx \*.conf file for Kibana. root@dsme01:~# cat /etc/nginx/sites-available/kibana.conf server { # Update this line to be your domain server\_na… --- ## [Filebeat vs logstash](https://discuss.elastic.co/t/filebeat-vs-logstash/321613)
**Author:** [@Indeed2000](https://discuss.elastic.co/u/Indeed2000)\ **Replies:** 2\ **Last updated:** [December 20, 2022, 9:12am UTC](https://discuss.elastic.co/t/filebeat-vs-logstash/321613 "2022-12-20T09:12:00Z")
Hi Need to send logs in this path /var/log/\* on a client to elastic server. which one more suitable for me? filebeat or logstash? there are lots of log exist in this path with different name, I want to able to filt… --- ## [Filebeat consuming too much CPU](https://discuss.elastic.co/t/filebeat-consuming-too-much-cpu/321497)
**Author:** [@Priya\_Vardhan](https://discuss.elastic.co/u/Priya_Vardhan)\ **Replies:** 15\ **Last updated:** [December 20, 2022, 8:30am UTC](https://discuss.elastic.co/t/filebeat-consuming-too-much-cpu/321497 "2022-12-20T08:30:20Z")
Hi, Installed filebeat using docker in 3 servers. In each of the servers, CPU reaching to 99% the moment filebeat starts harvesting. Please suggest how we can control CPU usage --- ## [Unique Count of a Count](https://discuss.elastic.co/t/unique-count-of-a-count/321612)
**Author:** [@QuestBevan](https://discuss.elastic.co/u/QuestBevan)\ **Replies:** 1\ **Last updated:** [December 20, 2022, 7:45am UTC](https://discuss.elastic.co/t/unique-count-of-a-count/321612 "2022-12-20T07:45:25Z")
Hi All, I am trying to figure out a way to build this visualisation. Our use case is, we have X amount of devices\_serial\_numbers (string field) that we want to monitor. Each device send up a result (string field) on wh… --- ## [Logstash conf file for Email Alert](https://discuss.elastic.co/t/logstash-conf-file-for-email-alert/319914)
**Author:** [@Ravi\_Vishwakarma](https://discuss.elastic.co/u/Ravi_Vishwakarma)\ **Replies:** 5\ **Last updated:** [December 20, 2022, 7:42am UTC](https://discuss.elastic.co/t/logstash-conf-file-for-email-alert/319914 "2022-12-20T07:42:19Z")
Hi, Can anyone help me with this I have created two conf file under /etc/logstash/conf.d/ syslog.conf === Working fine input { beats { port =\> "5044" } } filter { grok { match =\> { "messag… --- ## [Argmax in case of ties - Vegalite chart](https://discuss.elastic.co/t/argmax-in-case-of-ties-vegalite-chart/321515)
**Author:** [@Siva\_Kumar\_Menta](https://discuss.elastic.co/u/Siva_Kumar_Menta)\ **Replies:** 4\ **Last updated:** [December 20, 2022, 6:08am UTC](https://discuss.elastic.co/t/argmax-in-case-of-ties-vegalite-chart/321515 "2022-12-20T06:08:50Z")
Hi All, I have Elasticsearch index whose structure is as shown below. My requirement is I want to create chart with highest duration (ms) corresponding to highest frequency for each SNI# by using argmax function in Ve… --- ## [Restore snapshot index](https://discuss.elastic.co/t/restore-snapshot-index/321525)
**Author:** [@Arunadevi](https://discuss.elastic.co/u/Arunadevi)\ **Replies:** 9\ **Last updated:** [December 20, 2022, 5:08am UTC](https://discuss.elastic.co/t/restore-snapshot-index/321525 "2022-12-20T05:08:47Z")
While restoring an index , it requires either index closure or deleting the index. Is there any method to enable read while restoring the index. without causing an outage in search ? --- ## [Assigning failing SHARD's](https://discuss.elastic.co/t/assigning-failing-shards/321544)
**Author:** [@thulsidosskrishnan](https://discuss.elastic.co/u/thulsidosskrishnan)\ **Replies:** 0\ **Last updated:** [December 19, 2022, 10:26am UTC](https://discuss.elastic.co/t/assigning-failing-shards/321544 "2022-12-19T10:26:21Z")
Hello Community, Greetings. I have been trying to get few shards assigned so that the cluster comes back to green status. I have been trying to understand the impact of disable alloaction . Could you please validate … --- ## [Non-zero metrics in the last 30s](https://discuss.elastic.co/t/non-zero-metrics-in-the-last-30s/319031)
**Author:** [@aravindasamy](https://discuss.elastic.co/u/aravindasamy)\ **Replies:** 3\ **Last updated:** [November 22, 2022, 4:50am UTC](https://discuss.elastic.co/t/non-zero-metrics-in-the-last-30s/319031 "2022-11-22T04:50:45Z")
Facing the issue, in the kibana dashboard I can see very less 'available fields'. Logs are not pushed, the source is empty. Can anyone help regarding this? Thanks --- ## [Random network spike until cluster restarted. Is that a bug?](https://discuss.elastic.co/t/random-network-spike-until-cluster-restarted-is-that-a-bug/321540)
**Author:** [@elghazal-a](https://discuss.elastic.co/u/elghazal-a)\ **Replies:** 5\ **Last updated:** [December 20, 2022, 3:00am UTC](https://discuss.elastic.co/t/random-network-spike-until-cluster-restarted-is-that-a-bug/321540 "2022-12-20T03:00:42Z")
We're running an Elasticsearch cluster. The cluster behaves normally for few days but then the network transfer start to spike for all nodes, then this causes other issues like cpu spike and high GC, high latency, etc.. … --- ## [Parallel Queries on Elasticsearch](https://discuss.elastic.co/t/parallel-queries-on-elasticsearch/321541)
**Author:** [@Sheharyar\_Khalid](https://discuss.elastic.co/u/Sheharyar_Khalid)\ **Replies:** 2\ **Last updated:** [December 20, 2022, 2:53am UTC](https://discuss.elastic.co/t/parallel-queries-on-elasticsearch/321541 "2022-12-20T02:53:36Z")
Hello everyone, I am new to elasticsearch and still trying out a few things. I have an ELK deployment with a single node with multiple indexes and shards . Are the search queries run on the data sequential or are they … --- ## [Bash Scripting ElasticSearch and Kibana Passwords](https://discuss.elastic.co/t/bash-scripting-elasticsearch-and-kibana-passwords/317285)
**Author:** [@Ihms](https://discuss.elastic.co/u/Ihms)\ **Replies:** 6\ **Last updated:** [October 25, 2022, 6:09pm UTC](https://discuss.elastic.co/t/bash-scripting-elasticsearch-and-kibana-passwords/317285 "2022-10-25T18:09:36Z")
I have a bash script that automates the installation and configuration of Elastic, Kibana, Logstash, and filebeat. I am currently trying to secure my Kibana. I have enabled xpack in my elastic.yml: xpack.security.enable… --- ## [Spring Data ElasticSearch with SSL](https://discuss.elastic.co/t/spring-data-elasticsearch-with-ssl/321499)
**Author:** [@Daniel\_Schneider](https://discuss.elastic.co/u/Daniel_Schneider)\ **Replies:** 4\ **Last updated:** [December 19, 2022, 10:59pm UTC](https://discuss.elastic.co/t/spring-data-elasticsearch-with-ssl/321499 "2022-12-19T22:59:41Z")
Hi, I'm trying to understand how basic SSL works using Spring Data Elasticsearch. In order to use SSL for Secure HTTPS configuration you need to call usingSsl() method without any parameter during creation of RestHighL… --- ## [Search geo data by IP address](https://discuss.elastic.co/t/search-geo-data-by-ip-address/321559)
**Author:** [@lamka02sk](https://discuss.elastic.co/u/lamka02sk)\ **Replies:** 1\ **Last updated:** [December 19, 2022, 10:54pm UTC](https://discuss.elastic.co/t/search-geo-data-by-ip-address/321559 "2022-12-19T22:54:51Z")
Hi, I have an index that contains geo\_point field. Is there a way to search in this field (for example filter the distance) by an IP address? For example something like this: GET /my\_locations/\_search { "query": { … --- ## [ES 8.4.3: node disconnected after disk is full](https://discuss.elastic.co/t/es-8-4-3-node-disconnected-after-disk-is-full/321336)
**Author:** [@PengWang-SMARTM](https://discuss.elastic.co/u/PengWang-SMARTM)\ **Replies:** 5\ **Last updated:** [December 19, 2022, 10:41pm UTC](https://discuss.elastic.co/t/es-8-4-3-node-disconnected-after-disk-is-full/321336 "2022-12-19T22:41:18Z")
I followed the helm chart example, and created a 3-node elasticsearch 8.4.3 instance, and it was running OK until running out of the data volume space. The first issue I encountered was not able to open kibana. I XDELET… --- ## [Search and bulk transport tasks stuck running for days on ES 7.17.5](https://discuss.elastic.co/t/search-and-bulk-transport-tasks-stuck-running-for-days-on-es-7-17-5/321437)
**Author:** [@joannas\_q](https://discuss.elastic.co/u/joannas_q)\ **Replies:** 8\ **Last updated:** [December 19, 2022, 10:37pm UTC](https://discuss.elastic.co/t/search-and-bulk-transport-tasks-stuck-running-for-days-on-es-7-17-5/321437 "2022-12-19T22:37:27Z")
elasticsearch version: 7.17.5 lucene\_version: 8.11.1 Hi, we have two elasticsearch clusters that have had degraded search and ingestion performance over the past two+ weeks. We have search/scroll/count/bulk client reque… --- ## [Elastic Agent enrollment steps fail to change 'state' file url from 443 to 9243](https://discuss.elastic.co/t/elastic-agent-enrollment-steps-fail-to-change-state-file-url-from-443-to-9243/321600)
**Author:** [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\ **Replies:** 0\ **Last updated:** [December 19, 2022, 8:43pm UTC](https://discuss.elastic.co/t/elastic-agent-enrollment-steps-fail-to-change-state-file-url-from-443-to-9243/321600 "2022-12-19T20:43:58Z")
Elastic Cloud Enterprise 3.5 Deployment Version 7.17.8 Elastic Agent Version 7.17.8 Elastic Agent enrollment steps fail to change 'state' file output section url from 443 to 9243 I started going through the Elastic A… --- ## [Broke login to kibana](https://discuss.elastic.co/t/broke-login-to-kibana/321334)
**Author:** [@ant2ne](https://discuss.elastic.co/u/ant2ne)\ **Replies:** 11\ **Last updated:** [December 19, 2022, 8:12pm UTC](https://discuss.elastic.co/t/broke-login-to-kibana/321334 "2022-12-19T20:12:20Z")
after doing the minimal security configuration (Built-in users | Elasticsearch Guide \[8.5\] | Elastic) I can no longer log into the kibana webui. the login of the webpage loads, but doesn't accept kibanaadmin and its pass… --- ## [Spaces and saved objects / return of experience](https://discuss.elastic.co/t/spaces-and-saved-objects-return-of-experience/321145)
**Author:** [@dao](https://discuss.elastic.co/u/dao)\ **Replies:** 1\ **Last updated:** [December 19, 2022, 8:00pm UTC](https://discuss.elastic.co/t/spaces-and-saved-objects-return-of-experience/321145 "2022-12-19T20:00:45Z")
Hello, we have tried to migrate from flat dashboards/visu (well, saved objects) to spaces. We had this requirement, and were very happy seing this feature coming up. Unfortunately, we found that the feature is not so c… --- ## [Shrink- multiply index by painless script](https://discuss.elastic.co/t/shrink-multiply-index-by-painless-script/321590)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 1\ **Last updated:** [December 19, 2022, 7:54pm UTC](https://discuss.elastic.co/t/shrink-multiply-index-by-painless-script/321590 "2022-12-19T19:54:34Z")
Hi Do You have any ideas how to make a painless scripts for shrink- multiply index I have many of index where I need to merge a few a small shard into one? based on: [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=692) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=694)