# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=748 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 749 --- ## [Grok processor - Multiple matches of the same pattern](https://discuss.elastic.co/t/grok-processor-multiple-matches-of-the-same-pattern/317805)
**Author:** [@robdiluca](https://discuss.elastic.co/u/robdiluca)\ **Replies:** 0\ **Last updated:** [October 31, 2022, 9:54am UTC](https://discuss.elastic.co/t/grok-processor-multiple-matches-of-the-same-pattern/317805 "2022-10-31T09:54:12Z")
Hi all, I'm using the grok processor to parse the "message" field of a document in a ingest pipeline. That field can contain zero or more occurrences of UUIDs. I'm only interested in finding all the occurrences of UUIDs… --- ## [Set role for cluster-member node](https://discuss.elastic.co/t/set-role-for-cluster-member-node/317785)
**Author:** [@g.le](https://discuss.elastic.co/u/g.le)\ **Replies:** 3\ **Last updated:** [October 31, 2022, 8:50am UTC](https://discuss.elastic.co/t/set-role-for-cluster-member-node/317785 "2022-10-31T08:50:43Z")
We 've been using ELK v7.10 in a cluster setup with several nodes. For the time being, all nodes have the same roles. According to the documentation, we could specify that a given node (member of the cluster) can have … --- ## [Filebeat Fortinet Module + Kibana SIEM](https://discuss.elastic.co/t/filebeat-fortinet-module-kibana-siem/317721)
**Author:** [@Rafa\_Moreno](https://discuss.elastic.co/u/Rafa_Moreno)\ **Replies:** 7\ **Last updated:** [October 31, 2022, 8:12am UTC](https://discuss.elastic.co/t/filebeat-fortinet-module-kibana-siem/317721 "2022-10-31T08:12:56Z")
Hi there, I have an installation of kibana and Elasticsearch, I have tried to use the fortinet filebeat module, even the elastic agent, and send the logs by syslogd, I understand that I should be able to see the fortiga… --- ## [How to grok a certain fields from a log file](https://discuss.elastic.co/t/how-to-grok-a-certain-fields-from-a-log-file/315996)
**Author:** [@anupvtr](https://discuss.elastic.co/u/anupvtr)\ **Replies:** 1\ **Last updated:** [October 31, 2022, 6:43am UTC](https://discuss.elastic.co/t/how-to-grok-a-certain-fields-from-a-log-file/315996 "2022-10-31T06:43:42Z")
Preformatted textHi All, I am quite new to the magic world of Grok. Any help will be thankful. I need to apply filter for the following file. 2022-08-22 22:18:59 , 666 INFO @ (blockurcolumn-11) \[rbbit\_MQ\_Versa.appa… --- ## [Fresh ELK install 8.4.3. Logstash problem](https://discuss.elastic.co/t/fresh-elk-install-8-4-3-logstash-problem/317670)
**Author:** [@Xgraver1](https://discuss.elastic.co/u/Xgraver1)\ **Replies:** 2\ **Last updated:** [October 31, 2022, 6:06am UTC](https://discuss.elastic.co/t/fresh-elk-install-8-4-3-logstash-problem/317670 "2022-10-31T06:06:50Z")
Hello Could use some help with fresh ELK installation on premises. I installed Elasticstack and Kibana with mostly default configuration. In Elasticstack conf i changed Data path and uncommented host and port settings. … --- ## [Pagination, sorted and aggregation on data](https://discuss.elastic.co/t/pagination-sorted-and-aggregation-on-data/317291)
**Author:** [@StephenGuo](https://discuss.elastic.co/u/StephenGuo)\ **Replies:** 4\ **Last updated:** [October 31, 2022, 2:54am UTC](https://discuss.elastic.co/t/pagination-sorted-and-aggregation-on-data/317291 "2022-10-31T02:54:53Z")
Hi I have a group of user access data which contain the user name, access timestamp, and some of other info. There will be multiple records with the same username but different access timestamp. What I want is to do i… --- ## [ElasticSearch Failed to build \[request\] after last required field arrived](https://discuss.elastic.co/t/elasticsearch-failed-to-build-request-after-last-required-field-arrived/317364)
**Author:** [@akshay-atam](https://discuss.elastic.co/u/akshay-atam)\ **Replies:** 1\ **Last updated:** [October 31, 2022, 2:25am UTC](https://discuss.elastic.co/t/elasticsearch-failed-to-build-request-after-last-required-field-arrived/317364 "2022-10-31T02:25:33Z")
--- ## [Best practice on data ingestion methods](https://discuss.elastic.co/t/best-practice-on-data-ingestion-methods/317484)
**Author:** [@Boemo2023](https://discuss.elastic.co/u/Boemo2023)\ **Replies:** 1\ **Last updated:** [October 31, 2022, 2:24am UTC](https://discuss.elastic.co/t/best-practice-on-data-ingestion-methods/317484 "2022-10-31T02:24:23Z")
I currently have a self managed elasticsearch cluster that up until now I have just been feeding with data via HTTP POSTs (to port 9200) to specific indexes from various servers. I'm now in the process of setting up bea… --- ## [Elastic Agent Might Not Be Running](https://discuss.elastic.co/t/elastic-agent-might-not-be-running/317535)
**Author:** [@bigverm23](https://discuss.elastic.co/u/bigverm23)\ **Replies:** 1\ **Last updated:** [October 31, 2022, 2:21am UTC](https://discuss.elastic.co/t/elastic-agent-might-not-be-running/317535 "2022-10-31T02:21:45Z")
{"log.level":"info","@timestamp":"2022-10-26T10:03:34.190-0400","log.origin":{"file.name":"cmd/enroll\_cmd.go","file.line":271},"message":"Elastic Agent might not be running; unable to trigger restart","ecs.version":"1.6.… --- ## [Error: Could not create the Java Virtual Machine. ES won't start](https://discuss.elastic.co/t/error-could-not-create-the-java-virtual-machine-es-wont-start/317581)
**Author:** [@rrrrrrrrrrr](https://discuss.elastic.co/u/rrrrrrrrrrr)\ **Replies:** 2\ **Last updated:** [October 31, 2022, 2:20am UTC](https://discuss.elastic.co/t/error-could-not-create-the-java-virtual-machine-es-wont-start/317581 "2022-10-31T02:20:44Z")
Hello, I've tried to follow this step https://discuss.elastic.co/t/elasticsearch-logs-are-getting-piled-up-in-var-log-elasticsearch-path-how-to-cater-to-this-problem/186039 to do the log rotation but when I tried to res… --- ## [Filebeat Kafka module with autodiscover](https://discuss.elastic.co/t/filebeat-kafka-module-with-autodiscover/317537)
**Author:** [@Avivl1](https://discuss.elastic.co/u/Avivl1)\ **Replies:** 0\ **Last updated:** [October 26, 2022, 2:25pm UTC](https://discuss.elastic.co/t/filebeat-kafka-module-with-autodiscover/317537 "2022-10-26T14:25:19Z")
Hi, Im trying to ship logs from Kafka cluster that hosts in Kubernetes cluster with Kafka module to Elasticsearch throw log-stash , I tried to configure my filebeat.yaml and logstash pipeline like the documentation ( we… --- ## [Accidental force merge](https://discuss.elastic.co/t/accidental-force-merge/317539)
**Author:** [@h0llym0lly](https://discuss.elastic.co/u/h0llym0lly)\ **Replies:** 1\ **Last updated:** [October 31, 2022, 2:17am UTC](https://discuss.elastic.co/t/accidental-force-merge/317539 "2022-10-31T02:17:08Z")
Hi, I executed force merge and forgot to add index name which I want to merge... Now the task is ongoing for some time and it has description: "Force-merge indices \[\], maxSegments\[4\], onlyExpungeDeletes\[false\], flush… --- ## [Optimize elastic search performance](https://discuss.elastic.co/t/optimize-elastic-search-performance/317765)
**Author:** [@geek](https://discuss.elastic.co/u/geek)\ **Replies:** 3\ **Last updated:** [October 31, 2022, 2:10am UTC](https://discuss.elastic.co/t/optimize-elastic-search-performance/317765 "2022-10-31T02:10:23Z")
I am trying to benchmark my Elasticsearch setup by posting documents against a large schema. The two variations of schema are: indexing enabled for each attribute. indexing disabled for all the attributes. My benchmar… --- ## [Is there any way to do automation for rollup job creation?](https://discuss.elastic.co/t/is-there-any-way-to-do-automation-for-rollup-job-creation/317767)
**Author:** [@Nitin08bisht](https://discuss.elastic.co/u/Nitin08bisht)\ **Replies:** 1\ **Last updated:** [October 31, 2022, 1:57am UTC](https://discuss.elastic.co/t/is-there-any-way-to-do-automation-for-rollup-job-creation/317767 "2022-10-31T01:57:29Z")
Hi, I want to know that is there any way to do automation for rollup job creation? Because creation of rollup job is taking much time when we have to create jobs for taking rollup of each month data separately. --- ## [How can we get data of specific month from rollup index?](https://discuss.elastic.co/t/how-can-we-get-data-of-specific-month-from-rollup-index/317487)
**Author:** [@Nitin08bisht](https://discuss.elastic.co/u/Nitin08bisht)\ **Replies:** 1\ **Last updated:** [October 31, 2022, 1:49am UTC](https://discuss.elastic.co/t/how-can-we-get-data-of-specific-month-from-rollup-index/317487 "2022-10-31T01:49:10Z")
Rollup index store months or years of data. And if we want specific month data from that rollup index then how we can get it from? --- ## [\[ERROR\]\[testhost\] policy \[test-data-retention\] for index \[test\_logger\_info.20221026\] failed on step \[{"phase":"hot","action":"rollover","name":"check-rollover-ready"}\]. Moving to ERROR step](https://discuss.elastic.co/t/error-testhost-policy-test-data-retention-for-index-test-logger-info-20221026-failed-on-step-phase-hot-action-rollover-name-check-rollover-ready-moving-to-error-step/317613)
**Author:** [@Tanya\_Patel](https://discuss.elastic.co/u/Tanya_Patel)\ **Replies:** 1\ **Last updated:** [October 31, 2022, 1:47am UTC](https://discuss.elastic.co/t/error-testhost-policy-test-data-retention-for-index-test-logger-info-20221026-failed-on-step-phase-hot-action-rollover-name-check-rollover-ready-moving-to-error-step/317613 "2022-10-31T01:47:39Z")
I am getting the following error - single node/cluster setup ILM Policy Template --- ## [Why had Elastic released a complete new API with 8.0?](https://discuss.elastic.co/t/why-had-elastic-released-a-complete-new-api-with-8-0/317292)
**Author:** [@Michael\_Gattinger](https://discuss.elastic.co/u/Michael_Gattinger)\ **Replies:** 4\ **Last updated:** [October 31, 2022, 1:44am UTC](https://discuss.elastic.co/t/why-had-elastic-released-a-complete-new-api-with-8-0/317292 "2022-10-31T01:44:50Z")
Why had Elastic released a complete new API with 8.0? High Level API Client was working well. Why replacing it with Elasticsearch Java API Client? Thanks - Enomine --- ## [Indices deleted as a result of unauthorised access – how to restore?](https://discuss.elastic.co/t/indices-deleted-as-a-result-of-unauthorised-access-how-to-restore/317637)
**Author:** [@Drept](https://discuss.elastic.co/u/Drept)\ **Replies:** 2\ **Last updated:** [October 31, 2022, 1:41am UTC](https://discuss.elastic.co/t/indices-deleted-as-a-result-of-unauthorised-access-how-to-restore/317637 "2022-10-31T01:41:23Z")
As a result of compromised security, my ES server was accessed by a third party that deleted all the indices. While I can easily recreate and repopulate my own indices, there are a few that I don't know how to deal with.… --- ## [Can i use "date type field" more than two?](https://discuss.elastic.co/t/can-i-use-date-type-field-more-than-two/317671)
**Author:** [@hellocomputer](https://discuss.elastic.co/u/hellocomputer)\ **Replies:** 1\ **Last updated:** [October 31, 2022, 1:40am UTC](https://discuss.elastic.co/t/can-i-use-date-type-field-more-than-two/317671 "2022-10-31T01:40:11Z")
Hello I want to use a field called "timestamp" as time series data. I'm using monstache to connect mongoDB and Elasticsearch. In mostache mapping file, I set type of timestamp to "date". But, in elastic index, type of… --- ## [Elastic agent and filebeat installation in windows PC](https://discuss.elastic.co/t/elastic-agent-and-filebeat-installation-in-windows-pc/317720)
**Author:** [@subash](https://discuss.elastic.co/u/subash)\ **Replies:** 1\ **Last updated:** [October 30, 2022, 9:54pm UTC](https://discuss.elastic.co/t/elastic-agent-and-filebeat-installation-in-windows-pc/317720 "2022-10-30T21:54:59Z")
Hello, We are using Elasticsearch 7.17.4. The objective is to collect the metrics and logs from Windows PC. Currently, using Elastic agents to send the logs and metrics to Elasticsearch. In one of the use cases, we ar… --- ## [Manually insert words and occurrence into the index](https://discuss.elastic.co/t/manually-insert-words-and-occurrence-into-the-index/317707)
**Author:** [@Ostr1969](https://discuss.elastic.co/u/Ostr1969)\ **Replies:** 3\ **Last updated:** [October 30, 2022, 9:16pm UTC](https://discuss.elastic.co/t/manually-insert-words-and-occurrence-into-the-index/317707 "2022-10-30T21:16:27Z")
I assume that the words of each doc are shown in the index somehow. I have a table of each word and occurrences of a doc( from some other tool) . Can I insert manually the words to the index and specify their assuranc… --- ## [What's the solution of this error please?](https://discuss.elastic.co/t/whats-the-solution-of-this-error-please/317485)
**Author:** [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\ **Replies:** 12\ **Last updated:** [October 30, 2022, 8:59pm UTC](https://discuss.elastic.co/t/whats-the-solution-of-this-error-please/317485 "2022-10-30T20:59:42Z")
I don't find a solution for this error anyone help me please when I try to start elasticsearch. \[ 2022-10-26T08:13:00,690\]\[WARN \]\[i.n.u.i.PlatformDependent\] \[elastic\] Failed to get the temporary directory; falling back… --- ## [Why did Elastic release Elasticsearch Java API Client to replace the old High Level Client?](https://discuss.elastic.co/t/why-did-elastic-release-elasticsearch-java-api-client-to-replace-the-old-high-level-client/317749)
**Author:** [@Michael\_Gattinger](https://discuss.elastic.co/u/Michael_Gattinger)\ **Replies:** 2\ **Last updated:** [October 30, 2022, 5:59pm UTC](https://discuss.elastic.co/t/why-did-elastic-release-elasticsearch-java-api-client-to-replace-the-old-high-level-client/317749 "2022-10-30T17:59:49Z")
Did Elastic release the ESJAC to replace the old High Level Client because of the dispute with amazon about the Amazon Elasticsearch Service to make Elasticsearch in any matter incompatible with AES? Thanks - Enomine --- ## [Performance problem with custom sort](https://discuss.elastic.co/t/performance-problem-with-custom-sort/317435)
**Author:** [@Guilherme\_Mello](https://discuss.elastic.co/u/Guilherme_Mello)\ **Replies:** 5\ **Last updated:** [October 30, 2022, 2:51pm UTC](https://discuss.elastic.co/t/performance-problem-with-custom-sort/317435 "2022-10-30T14:51:57Z")
Hello! My search page needs to have a custom sorting type. To do this sorting i need to return about 5k items from elasticsearch The problem is that this causes a serious performance problem, the application ends up c… --- ## [New indices on elastic.com](https://discuss.elastic.co/t/new-indices-on-elastic-com/317711)
**Author:** [@sportys](https://discuss.elastic.co/u/sportys)\ **Replies:** 4\ **Last updated:** [October 30, 2022, 2:32pm UTC](https://discuss.elastic.co/t/new-indices-on-elastic-com/317711 "2022-10-30T14:32:22Z")
Hello, I set up a new indices on elastic.co, I'm just trying it out, I only see connectivity through port 443 with a api key. I'm using java and spring and usually connect via port 9300. So I'm having a hard time trans… --- ## [Grokparse failure seen with tcp input plugin in logstash pipeline](https://discuss.elastic.co/t/grokparse-failure-seen-with-tcp-input-plugin-in-logstash-pipeline/317447)
**Author:** [@Arinjay\_Jain](https://discuss.elastic.co/u/Arinjay_Jain)\ **Replies:** 5\ **Last updated:** [October 30, 2022, 11:52am UTC](https://discuss.elastic.co/t/grokparse-failure-seen-with-tcp-input-plugin-in-logstash-pipeline/317447 "2022-10-30T11:52:14Z")
Hi, I have the following logstash pipeline configuration. input { tcp { port =\> 5102 codec =\> plain } } filter { grok { match =\> {"message" =\> "%{SYSLOGTIMESTAMP:time} %{DATA:trace\_n… --- ## [Index rollover not working](https://discuss.elastic.co/t/index-rollover-not-working/317750)
**Author:** [@Eran\_Hadad](https://discuss.elastic.co/u/Eran_Hadad)\ **Replies:** 2\ **Last updated:** [October 30, 2022, 11:08am UTC](https://discuss.elastic.co/t/index-rollover-not-working/317750 "2022-10-30T11:08:37Z")
I have an index, let's call it index-name-000001, current size 30gb. Aliases index-name Current action rollover under phase definition: "actions": { "rollover": { "max\_primary\_shard\_size": "20gb" … --- ## [Output Batch Sizes](https://discuss.elastic.co/t/output-batch-sizes/317486)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 3\ **Last updated:** [October 30, 2022, 9:39am UTC](https://discuss.elastic.co/t/output-batch-sizes/317486 "2022-10-30T09:39:55Z")
Hi, How can we see the size of the batches logstash is pushing to elasticsearch? Thx D --- ## [Phrase search with fuzziness](https://discuss.elastic.co/t/phrase-search-with-fuzziness/317725)
**Author:** [@Davood1659](https://discuss.elastic.co/u/Davood1659)\ **Replies:** 0\ **Last updated:** [October 29, 2022, 12:24pm UTC](https://discuss.elastic.co/t/phrase-search-with-fuzziness/317725 "2022-10-29T12:24:34Z")
Hi all, A while ago, I needed to find documents that a certain term(word) is repeated twice or more in a certain field of those documents. Some queries like Match query doesn't work in such situations as they just check… --- ## [Security for multiple users accessing the same index](https://discuss.elastic.co/t/security-for-multiple-users-accessing-the-same-index/317736)
**Author:** [@HockeyFan0000](https://discuss.elastic.co/u/HockeyFan0000)\ **Replies:** 2\ **Last updated:** [October 29, 2022, 11:12pm UTC](https://discuss.elastic.co/t/security-for-multiple-users-accessing-the-same-index/317736 "2022-10-29T23:12:25Z")
We have multiple users creating indexes for very few documents. One index has one document they update daily and another has 2-3 documents indexed every two weeks. We would like to combine all these minimal-use cases i… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=747) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=749)