# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=714 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 715 --- ## [Elasticsearch keeps crashing and won't restart often](https://discuss.elastic.co/t/elasticsearch-keeps-crashing-and-wont-restart-often/320199)
**Author:** [@vesnindev](https://discuss.elastic.co/u/vesnindev)\ **Replies:** 1\ **Last updated:** [December 1, 2022, 1:02am UTC](https://discuss.elastic.co/t/elasticsearch-keeps-crashing-and-wont-restart-often/320199 "2022-12-01T01:02:36Z")
Hello. Tell me why Elasticsearch keeps crashing and often doesn't restart? \[2022-12-01T00:50:12.915+0000\]\[16713\]\[safepoint \] Safepoint "ICBufferFull", Time since last: 1183469 ns, Reaching safepoint: 22369 ns, At saf… --- ## [Rate limiter](https://discuss.elastic.co/t/rate-limiter/320177)
**Author:** [@srobison62](https://discuss.elastic.co/u/srobison62)\ **Replies:** 1\ **Last updated:** [November 30, 2022, 10:27pm UTC](https://discuss.elastic.co/t/rate-limiter/320177 "2022-11-30T22:27:01Z")
I understand that Elastic search has a built in functionality to control merges of data so if there is a huge increasing logs it doesn't overload the system. I am wondering where I could actually view these settings or i… --- ## [How flexible the ilm rollover is?](https://discuss.elastic.co/t/how-flexible-the-ilm-rollover-is/320169)
**Author:** [@ThePohorc](https://discuss.elastic.co/u/ThePohorc)\ **Replies:** 4\ **Last updated:** [November 30, 2022, 9:31pm UTC](https://discuss.elastic.co/t/how-flexible-the-ilm-rollover-is/320169 "2022-11-30T21:31:36Z")
Hello! Trying to understand ILM rollover. I created a test on elastic.co and follow the example on: Tutorial: Automate rollover with ILM | Elasticsearch Guide \[8.5\] | Elastic I set rollover on 10 documents. Now, when … --- ## [Silent error on date parsing](https://discuss.elastic.co/t/silent-error-on-date-parsing/320187)
**Author:** [@rfirpo](https://discuss.elastic.co/u/rfirpo)\ **Replies:** 3\ **Last updated:** [November 30, 2022, 9:19pm UTC](https://discuss.elastic.co/t/silent-error-on-date-parsing/320187 "2022-11-30T21:19:16Z")
Logstash is silently dropping my logs after implementing a small modification in my grok filter. The original filter looks like: filter { if \[internal\]\[logtype\] == "mycustomtype" { grok { match =\> { … --- ## [Architecture Question](https://discuss.elastic.co/t/architecture-question/320191)
**Author:** [@bsherman](https://discuss.elastic.co/u/bsherman)\ **Replies:** 1\ **Last updated:** [November 30, 2022, 9:18pm UTC](https://discuss.elastic.co/t/architecture-question/320191 "2022-11-30T21:18:32Z")
We have a 10 node cluster running 7.6 on s390x. I'm aware s390x is not supported but we've been able to make it work. We want to upgrade to 7.17. With the 7.17 upgrade we want to have at least one node to use machine l… --- ## [Elasticsearch how to subtract field number value with specific number](https://discuss.elastic.co/t/elasticsearch-how-to-subtract-field-number-value-with-specific-number/318090)
**Author:** [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)\ **Replies:** 3\ **Last updated:** [November 3, 2022, 11:44am UTC](https://discuss.elastic.co/t/elasticsearch-how-to-subtract-field-number-value-with-specific-number/318090 "2022-11-03T11:44:36Z")
Hello I am looking for solution to prepare dashboard in which i need to prepare a visualization with difference value e.g. site performance field mentioned as 500ms but as per threshold it should be 200ms Field name "… --- ## [Official icon name](https://discuss.elastic.co/t/official-icon-name/320181)
**Author:** [@seanee](https://discuss.elastic.co/u/seanee)\ **Replies:** 2\ **Last updated:** [November 30, 2022, 8:03pm UTC](https://discuss.elastic.co/t/official-icon-name/320181 "2022-11-30T20:03:03Z")
I'm creating user documentation and was wondering, is there an official name for the menu icon in the upper left of the Kibana GUI (the three lines) other than menu icon . I keep referring to it as a 'pancake icon' as it… --- ## [How to setup 'elastic' account from source code](https://discuss.elastic.co/t/how-to-setup-elastic-account-from-source-code/320189)
**Author:** [@augxmas](https://discuss.elastic.co/u/augxmas)\ **Replies:** 0\ **Last updated:** [November 30, 2022, 7:58pm UTC](https://discuss.elastic.co/t/how-to-setup-elastic-account-from-source-code/320189 "2022-11-30T19:58:45Z")
I downloaded elasticsearch source from git then run it via gradle with command 'gradlew run'. when i try to access http://localhost:9200, ES is asking id/password. usally, I setup 'elastics' account with 'elasticsearch… --- ## [Defender\_atp module error message](https://discuss.elastic.co/t/defender-atp-module-error-message/320188)
**Author:** [@intsec](https://discuss.elastic.co/u/intsec)\ **Replies:** 0\ **Last updated:** [November 30, 2022, 7:52pm UTC](https://discuss.elastic.co/t/defender-atp-module-error-message/320188 "2022-11-30T19:52:51Z")
I have finally got my Azure application for defender ATP to connect to my manager but when looking at the logs that are coming in to Kibana they are all with this error.message cannot access method/field \[length\] from a… --- ## [How to load balance data coming from various applications to logstash](https://discuss.elastic.co/t/how-to-load-balance-data-coming-from-various-applications-to-logstash/319989)
**Author:** [@Anusha\_Kusanghi](https://discuss.elastic.co/u/Anusha_Kusanghi)\ **Replies:** 6\ **Last updated:** [November 30, 2022, 7:32pm UTC](https://discuss.elastic.co/t/how-to-load-balance-data-coming-from-various-applications-to-logstash/319989 "2022-11-30T19:32:23Z")
Hi All, I need some suggestions on how/what can be used to balance the data that is coming from 1000 of applications to logstash. Architecture looks like this: We have various sources who's logs needs to be integrated… --- ## [\[SOLVED\] Mistake input with Elastic PHP 8.5.0](https://discuss.elastic.co/t/solved-mistake-input-with-elastic-php-8-5-0/320182)
**Author:** [@abkrim](https://discuss.elastic.co/u/abkrim)\ **Replies:** 1\ **Last updated:** [November 30, 2022, 6:29pm UTC](https://discuss.elastic.co/t/solved-mistake-input-with-elastic-php-8-5-0/320182 "2022-11-30T18:29:22Z")
I'm using PHP Client API for work with SQL (intensive) But I've a problem. In my first few unit tests, I was using a simple named index. My surprise has been when trying to do the integration tests, when I took it out… --- ## [How to convert latitude and longitude in logstash and store in elasticserach in a proper format](https://discuss.elastic.co/t/how-to-convert-latitude-and-longitude-in-logstash-and-store-in-elasticserach-in-a-proper-format/320116)
**Author:** [@Dhanushka\_Samarasing](https://discuss.elastic.co/u/Dhanushka_Samarasing)\ **Replies:** 1\ **Last updated:** [November 30, 2022, 5:45pm UTC](https://discuss.elastic.co/t/how-to-convert-latitude-and-longitude-in-logstash-and-store-in-elasticserach-in-a-proper-format/320116 "2022-11-30T17:45:04Z")
I have latitude and longitude data in a Postgresql DB, now I need to move those data to Elasticsearch through Logstash pipeline. I have tried different methods but non of them did not work so far. This is the sample rec… --- ## [V 8.5.0 update - boolean field not working in donut lens anymore](https://discuss.elastic.co/t/v-8-5-0-update-boolean-field-not-working-in-donut-lens-anymore/318949)
**Author:** [@mayer](https://discuss.elastic.co/u/mayer)\ **Replies:** 11\ **Last updated:** [November 30, 2022, 5:20pm UTC](https://discuss.elastic.co/t/v-8-5-0-update-boolean-field-not-working-in-donut-lens-anymore/318949 "2022-11-30T17:20:39Z")
Dear All, recently I updated to version 8.5.0 Since that time a donut lens isn't working. This mapping for this donat is defined with "bq\_DMZ": { "type": "boolean" }, With logstash I am importing the d… --- ## [Aws vpcflow parser not loading/executing](https://discuss.elastic.co/t/aws-vpcflow-parser-not-loading-executing/320082)
**Author:** [@erhank](https://discuss.elastic.co/u/erhank)\ **Replies:** 4\ **Last updated:** [November 30, 2022, 5:18pm UTC](https://discuss.elastic.co/t/aws-vpcflow-parser-not-loading-executing/320082 "2022-11-30T17:18:57Z")
filebeat 8.4.3 attempting to consume AWS vpcflow logs from S3 and output to logstash S3 consumption is happening correctly, but ingest pipeline fails to run on messages -- the output messages simply contain original mes… --- ## [Filebeat not picking up the data and logs path from config file](https://discuss.elastic.co/t/filebeat-not-picking-up-the-data-and-logs-path-from-config-file/320168)
**Author:** [@Arjun\_Meena](https://discuss.elastic.co/u/Arjun_Meena)\ **Replies:** 1\ **Last updated:** [November 30, 2022, 5:09pm UTC](https://discuss.elastic.co/t/filebeat-not-picking-up-the-data-and-logs-path-from-config-file/320168 "2022-11-30T17:09:03Z")
We are running the filebeat as a service on our ec2 machine. Below is the configuration file. # ============================== Filebeat inputs =============================== filebeat.inputs: - type: log enabled: tr… --- ## [Why use Filebeat before Logstash?](https://discuss.elastic.co/t/why-use-filebeat-before-logstash/320171)
**Author:** [@scantron](https://discuss.elastic.co/u/scantron)\ **Replies:** 0\ **Last updated:** [November 30, 2022, 3:48pm UTC](https://discuss.elastic.co/t/why-use-filebeat-before-logstash/320171 "2022-11-30T15:48:35Z")
Hi all, I am working with syslogs from various different networking devices all going to the same port. Filebeat does not allow you to use multiple modules to parse logs all coming in on the same port. So Logstash is ho… --- ## [Changing the timezone does not change how far the logs are from the current time](https://discuss.elastic.co/t/changing-the-timezone-does-not-change-how-far-the-logs-are-from-the-current-time/319753)
**Author:** [@Hemabh\_Ravee\_Fox](https://discuss.elastic.co/u/Hemabh_Ravee_Fox)\ **Replies:** 6\ **Last updated:** [November 30, 2022, 3:41pm UTC](https://discuss.elastic.co/t/changing-the-timezone-does-not-change-how-far-the-logs-are-from-the-current-time/319753 "2022-11-30T15:41:55Z")
I am using a locally deployed elasticsearch and kibana. When I send data to an index with the current timestamp - in kibana it is displayed as being 5:30 hours ahead of the current time. I came to understand that this i… --- ## [How to properly use two Filebeat modules listening on the same port?](https://discuss.elastic.co/t/how-to-properly-use-two-filebeat-modules-listening-on-the-same-port/320098)
**Author:** [@scantron](https://discuss.elastic.co/u/scantron)\ **Replies:** 5\ **Last updated:** [November 30, 2022, 3:39pm UTC](https://discuss.elastic.co/t/how-to-properly-use-two-filebeat-modules-listening-on-the-same-port/320098 "2022-11-30T15:39:58Z")
I currently have Fortinet and Cisco modules enabled on the same filebeat instance, and have a cisco meraki network device sending syslogs as well as fortinet firewall logs to the same port, 5514. I am using Docker with a… --- ## [Permanent filter on data view](https://discuss.elastic.co/t/permanent-filter-on-data-view/317993)
**Author:** [@Joseph\_Predignac](https://discuss.elastic.co/u/Joseph_Predignac)\ **Replies:** 2\ **Last updated:** [November 3, 2022, 9:24am UTC](https://discuss.elastic.co/t/permanent-filter-on-data-view/317993 "2022-11-03T09:24:15Z")
Hi everyone, I work with o365 logs, and I want to make exceptions on some users, some countries etc... For example, on a dashboard, I focus on login from countries except mine, to see suspicious logs. But, if I know a u… --- ## [Dotnet Client(\`Elastic.Clients.Elasticsearch\`) doesn't support knn\_search](https://discuss.elastic.co/t/dotnet-client-elastic-clients-elasticsearch-doesnt-support-knn-search/319795)
**Author:** [@Jiaxiang\_Wang](https://discuss.elastic.co/u/Jiaxiang_Wang)\ **Replies:** 3\ **Last updated:** [November 30, 2022, 3:29pm UTC](https://discuss.elastic.co/t/dotnet-client-elastic-clients-elasticsearch-doesnt-support-knn-search/319795 "2022-11-30T15:29:32Z")
I try to use elasticsearch knn\_search feature in dotnet. However, I don't think last stable version of es dotnet client Elastic.Clients.Elasticsearch(version 8.0.1) support knn\_search. I try to use Knn feature like cod… --- ## [Field conversion - Transforming Unix Time into Date](https://discuss.elastic.co/t/field-conversion-transforming-unix-time-into-date/320063)
**Author:** [@pedrodantas](https://discuss.elastic.co/u/pedrodantas)\ **Replies:** 4\ **Last updated:** [November 30, 2022, 3:20pm UTC](https://discuss.elastic.co/t/field-conversion-transforming-unix-time-into-date/320063 "2022-11-30T15:20:58Z")
Hello! I was wondering if there is a way to convert a field that is being received in Unix Time (long) into a fully readable Date in the Kibana environment. My application is sending JSON logs to Kibana. Two of the log… --- ## [Number of open sockets](https://discuss.elastic.co/t/number-of-open-sockets/320087)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 3\ **Last updated:** [November 30, 2022, 2:19pm UTC](https://discuss.elastic.co/t/number-of-open-sockets/320087 "2022-11-30T14:19:36Z")
Hi I'm getting regularly such output \>worker0\] elasticsearch - Failed to perform request {:message=\>"Connection reset", :exception=\>Manticore::SocketException, :cause=\>java.ne \[WARN \] 2022-11-29 18:33:45.720 \[\[my\_pipel… --- ## [Help on IF statement in Kibana painless script](https://discuss.elastic.co/t/help-on-if-statement-in-kibana-painless-script/320024)
**Author:** [@auato](https://discuss.elastic.co/u/auato)\ **Replies:** 6\ **Last updated:** [November 30, 2022, 2:07pm UTC](https://discuss.elastic.co/t/help-on-if-statement-in-kibana-painless-script/320024 "2022-11-30T14:07:51Z")
This script below works fine but I would like to insert an IF statement that executes these lines of code only in the case a third '\_' character is present in the field 'measurement', otherwise it does not execute anythi… --- ## [Timelion query to string containing slash "/" -- aka: howto use regexp in timelion](https://discuss.elastic.co/t/timelion-query-to-string-containing-slash-aka-howto-use-regexp-in-timelion/320158)
**Author:** [@DrG](https://discuss.elastic.co/u/DrG)\ **Replies:** 0\ **Last updated:** [November 30, 2022, 1:58pm UTC](https://discuss.elastic.co/t/timelion-query-to-string-containing-slash-aka-howto-use-regexp-in-timelion/320158 "2022-11-30T13:58:52Z")
Hello everybody, in the database, a set of strings (stringified ids) are there, stemming from a directory view. Now I like to filter out subfolders - aka filter out those elements containing slash(es). the database co… --- ## [Kibana (code=exited, status=78)](https://discuss.elastic.co/t/kibana-code-exited-status-78/319819)
**Author:** [@barnabe](https://discuss.elastic.co/u/barnabe)\ **Replies:** 6\ **Last updated:** [November 30, 2022, 1:17pm UTC](https://discuss.elastic.co/t/kibana-code-exited-status-78/319819 "2022-11-30T13:17:39Z")
Hello, I have a problem, Kibana is not starting for reasons that escape me I m not sure how to describe it best so here are the log and config files for Elasticsearch and Kibana as well as the error. the error kali ~ … --- ## [Wrong timestamp and timezone in Custom Log integration](https://discuss.elastic.co/t/wrong-timestamp-and-timezone-in-custom-log-integration/320151)
**Author:** [@hermlam](https://discuss.elastic.co/u/hermlam)\ **Replies:** 0\ **Last updated:** [November 30, 2022, 1:04pm UTC](https://discuss.elastic.co/t/wrong-timestamp-and-timezone-in-custom-log-integration/320151 "2022-11-30T13:04:53Z")
Hi, I have Raspberry Pi’s in different timezones writing logs to a Syslog server. The logs from the Syslog server are being collected by Elastic Agent and are correctly stored in the system.syslog Index Logs look like: … --- ## [Retrieve selected fields from a search - Does it work?](https://discuss.elastic.co/t/retrieve-selected-fields-from-a-search-does-it-work/320133)
**Author:** [@Grigio\_Basi](https://discuss.elastic.co/u/Grigio_Basi)\ **Replies:** 1\ **Last updated:** [November 30, 2022, 12:54pm UTC](https://discuss.elastic.co/t/retrieve-selected-fields-from-a-search-does-it-work/320133 "2022-11-30T12:54:37Z")
I have user's index. Okay. I wonna get limited list of my index fields. I read documentation and found it. I use \_source query and it doesn't work { "\_source": { "includes": \[ "is\_online"\], "excludes": \["logi… --- ## [Elastic Multi tenancy shared index](https://discuss.elastic.co/t/elastic-multi-tenancy-shared-index/319770)
**Author:** [@Zedson.Sagar](https://discuss.elastic.co/u/Zedson.Sagar)\ **Replies:** 7\ **Last updated:** [November 30, 2022, 12:27pm UTC](https://discuss.elastic.co/t/elastic-multi-tenancy-shared-index/319770 "2022-11-30T12:27:29Z")
Hi, we are planning to use Elasticsearch in a multi tenant environment. Based on the article here - https://www.elastic.co/blog/found-multi-tenancy We want to use a shared index model for all the tenants but are stumb… --- ## [Aggregation on flattened fields slows down due bulk writing](https://discuss.elastic.co/t/aggregation-on-flattened-fields-slows-down-due-bulk-writing/320149)
**Author:** [@Asym](https://discuss.elastic.co/u/Asym)\ **Replies:** 1\ **Last updated:** [November 30, 2022, 12:21pm UTC](https://discuss.elastic.co/t/aggregation-on-flattened-fields-slows-down-due-bulk-writing/320149 "2022-11-30T12:21:06Z")
Hi! While working with aggregation on flattened fields, we encountered a problem. We have a cluster, with 3 nodes, number of shards - 10, number of replicas - 2 and ~7 mln documents. Average aggregation (with flattene… --- ## [ElasticSearchAPIConnector - snippet or highlight query](https://discuss.elastic.co/t/elasticsearchapiconnector-snippet-or-highlight-query/320147)
**Author:** [@tavaradhan](https://discuss.elastic.co/u/tavaradhan)\ **Replies:** 0\ **Last updated:** [November 30, 2022, 11:36am UTC](https://discuss.elastic.co/t/elasticsearchapiconnector-snippet-or-highlight-query/320147 "2022-11-30T11:36:59Z")
hi, I am experimenting with ElasticsearchAPIConnector using SearchUI on a small document base. I want to get the full field returned with highlights. The field is less than 1000 characters long. I tried using highlight … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=713) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=715)