# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=755 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 756 --- ## [Index by hostname?](https://discuss.elastic.co/t/index-by-hostname/317187)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 2\ **Last updated:** [October 22, 2022, 7:14am UTC](https://discuss.elastic.co/t/index-by-hostname/317187 "2022-10-22T07:14:25Z")
elasticsearch { hosts =\> \["localhost:9200"\] index =\> "logstash-%{\[host\]\[hostname\]}%{+YYYY.MM.dd}" } but have --- ## [Logstash convert single quoted json log to double quoted](https://discuss.elastic.co/t/logstash-convert-single-quoted-json-log-to-double-quoted/317164)
**Author:** [@babuzrb](https://discuss.elastic.co/u/babuzrb)\ **Replies:** 4\ **Last updated:** [October 22, 2022, 3:40am UTC](https://discuss.elastic.co/t/logstash-convert-single-quoted-json-log-to-double-quoted/317164 "2022-10-22T03:40:05Z")
Hi I have log files with multiple json lines. Each json has single quotes and some of the values do not even has any quote. Due to this single quote and absence of quote issue, I cannot index them to elasticsearch. Thro… --- ## [HTTP Poller \[API\] input in Logstash - Does it support "Request\_data" on top of "Headers"?](https://discuss.elastic.co/t/http-poller-api-input-in-logstash-does-it-support-request-data-on-top-of-headers/316327)
**Author:** [@Roger\_Huang](https://discuss.elastic.co/u/Roger_Huang)\ **Replies:** 34\ **Last updated:** [October 22, 2022, 2:33am UTC](https://discuss.elastic.co/t/http-poller-api-input-in-logstash-does-it-support-request-data-on-top-of-headers/316327 "2022-10-22T02:33:41Z")
Hi everyone, I am new to ELK and I am trying to pull JSON data from Palo Alto platform into Logstash for processing. Some info redacted as xxxx. API DOCS: Get Alerts Does Logstash support such http headers? input … --- ## [Test and config logstash in docker](https://discuss.elastic.co/t/test-and-config-logstash-in-docker/317237)
**Author:** [@A\_Mightiev](https://discuss.elastic.co/u/A_Mightiev)\ **Replies:** 0\ **Last updated:** [October 21, 2022, 10:12pm UTC](https://discuss.elastic.co/t/test-and-config-logstash-in-docker/317237 "2022-10-21T22:12:12Z")
Hi Is there a way I can use the --config.test\_and\_exit\` functionality from logstash but running as a docker container? Thanks AM --- ## [Best practice for large indexes on docker](https://discuss.elastic.co/t/best-practice-for-large-indexes-on-docker/317235)
**Author:** [@Ostr1969](https://discuss.elastic.co/u/Ostr1969)\ **Replies:** 1\ **Last updated:** [October 21, 2022, 8:40pm UTC](https://discuss.elastic.co/t/best-practice-for-large-indexes-on-docker/317235 "2022-10-21T20:40:00Z")
how can I specify the storage location for an index?. The docker is saves all the container at the /var/lib/docker, but I don't have enough space there. --- ## [Can't use multiple enrich policies in the same ingest pipeline](https://discuss.elastic.co/t/cant-use-multiple-enrich-policies-in-the-same-ingest-pipeline/317219)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 5\ **Last updated:** [October 21, 2022, 6:06pm UTC](https://discuss.elastic.co/t/cant-use-multiple-enrich-policies-in-the-same-ingest-pipeline/317219 "2022-10-21T18:06:24Z")
Hi Im trying to add enrich policies in the same ingest pipeline, but when I try to test it with this simulation I get an error. POST /\_ingest/pipeline/my-pipe/\_simulate?verbose=true { "docs": \[ { "\_index": "… --- ## [.kibana index failed](https://discuss.elastic.co/t/kibana-index-failed/316948)
**Author:** [@Harper\_S1](https://discuss.elastic.co/u/Harper_S1)\ **Replies:** 8\ **Last updated:** [October 21, 2022, 5:56pm UTC](https://discuss.elastic.co/t/kibana-index-failed/316948 "2022-10-21T17:56:42Z")
hi, could someone please advise on this. 2022-10-19T04:16:31.786+00:00\]\[INFO \]\[savedobjects-service\] Waiting until all Elasticsearch nodes are compatible with Kibana before starting saved objects migrations... \[2022-10… --- ## [Max number of Spaces and Roles in Kibana](https://discuss.elastic.co/t/max-number-of-spaces-and-roles-in-kibana/316933)
**Author:** [@tifty](https://discuss.elastic.co/u/tifty)\ **Replies:** 2\ **Last updated:** [October 21, 2022, 5:00pm UTC](https://discuss.elastic.co/t/max-number-of-spaces-and-roles-in-kibana/316933 "2022-10-21T17:00:22Z")
Hi everyone, Is there a max limit to consider for creating Spaces and Roles in Kibana. Moreover, should I worry about cluster performance if I keep increasing number of spaces. Thanks --- ## [Delete document in read only Index](https://discuss.elastic.co/t/delete-document-in-read-only-index/317199)
**Author:** [@manupoti](https://discuss.elastic.co/u/manupoti)\ **Replies:** 1\ **Last updated:** [October 21, 2022, 4:33pm UTC](https://discuss.elastic.co/t/delete-document-in-read-only-index/317199 "2022-10-21T16:33:16Z")
I have two indexes leader index support read write operations and follower index support read operation only but need to delete document in follower index, How can we delete the documents from follower index? Please hel… --- ## [\[8.4.2\] \[JDBC input plugin\] Scheduled prepared statement execution sporadically stops](https://discuss.elastic.co/t/8-4-2-jdbc-input-plugin-scheduled-prepared-statement-execution-sporadically-stops/317217)
**Author:** [@alromos](https://discuss.elastic.co/u/alromos)\ **Replies:** 0\ **Last updated:** [October 21, 2022, 4:11pm UTC](https://discuss.elastic.co/t/8-4-2-jdbc-input-plugin-scheduled-prepared-statement-execution-sporadically-stops/317217 "2022-10-21T16:11:03Z")
Hi there We have 25 logstash pipelines utilizing JDBC input plugin with schedule. input { jdbc { ... schedule =\> "30 \* \* \* \* \*" ... } } Each pipeline has its own value instead of 30, so that prepared s… --- ## [Logstash is blocked by elasticsearch-setup-passwords](https://discuss.elastic.co/t/logstash-is-blocked-by-elasticsearch-setup-passwords/317142)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 19\ **Last updated:** [October 21, 2022, 1:34pm UTC](https://discuss.elastic.co/t/logstash-is-blocked-by-elasticsearch-setup-passwords/317142 "2022-10-21T13:34:26Z")
this a very bad procedure i have used this command for create password for kibana elasticsearch-setup-passwords but logstash is non started --- ## [Reconfigure to default \`max\_num\_segments\`](https://discuss.elastic.co/t/reconfigure-to-default-max-num-segments/317186)
**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\ **Replies:** 1\ **Last updated:** [October 21, 2022, 10:37am UTC](https://discuss.elastic.co/t/reconfigure-to-default-max-num-segments/317186 "2022-10-21T10:37:27Z")
Hi, according documentation: max\_num\_segments (Optional, integer) The number of segments to merge to. To fully merge indices, set it to 1. Defaults to checking if a merge needs to execute. If so, executes it. Once d… --- ## [Remove opening and closing parenthesis using gsub](https://discuss.elastic.co/t/remove-opening-and-closing-parenthesis-using-gsub/317100)
**Author:** [@ombit](https://discuss.elastic.co/u/ombit)\ **Replies:** 6\ **Last updated:** [October 21, 2022, 9:51am UTC](https://discuss.elastic.co/t/remove-opening-and-closing-parenthesis-using-gsub/317100 "2022-10-21T09:51:47Z")
Hi all, I am using Logstash to change the formatting of messages before forwarding them on to a QRadar reader. The syslogs are coming from various other servers, being collated onto one central 'master' server within … --- ## [Can't deploy fleet server : "Remote server is not ready to accept connections..."](https://discuss.elastic.co/t/cant-deploy-fleet-server-remote-server-is-not-ready-to-accept-connections/316912)
**Author:** [@Mouc](https://discuss.elastic.co/u/Mouc)\ **Replies:** 1\ **Last updated:** [October 21, 2022, 9:46am UTC](https://discuss.elastic.co/t/cant-deploy-fleet-server-remote-server-is-not-ready-to-accept-connections/316912 "2022-10-21T09:46:40Z")
Hello, I am currently trying to deploy a fleet server but I am having a problem at the enrollment step, the self signed certificate is generated for Fleet server, then enrollment is starting to the URL i specified for h… --- ## [Encoding issue depending on how logstash is started](https://discuss.elastic.co/t/encoding-issue-depending-on-how-logstash-is-started/317136)
**Author:** [@simon137](https://discuss.elastic.co/u/simon137)\ **Replies:** 10\ **Last updated:** [October 21, 2022, 9:32am UTC](https://discuss.elastic.co/t/encoding-issue-depending-on-how-logstash-is-started/317136 "2022-10-21T09:32:14Z")
Hello, I have two windows maschines, one is a Windows Server and one is a Standard Windows Desktop PC, both have the same elasticsearch (8.4.3) and the same logstash (8.4.3) installed with the same configuration and the… --- ## [Logstash cannot establish pipeline to communicate with elastic search](https://discuss.elastic.co/t/logstash-cannot-establish-pipeline-to-communicate-with-elastic-search/317180)
**Author:** [@Siva\_Priya](https://discuss.elastic.co/u/Siva_Priya)\ **Replies:** 0\ **Last updated:** [October 21, 2022, 9:14am UTC](https://discuss.elastic.co/t/logstash-cannot-establish-pipeline-to-communicate-with-elastic-search/317180 "2022-10-21T09:14:31Z")
I am trying to collect the logs from kubernetes pods and pass it to elastic db using logstash and filebeats.I am able to deploy the Elasticsearch and kibana in k8 cluster but i am not able to deploy my logstash and fileb… --- ## [Logstash Pipeline](https://discuss.elastic.co/t/logstash-pipeline/317155)
**Author:** [@QuestBevan](https://discuss.elastic.co/u/QuestBevan)\ **Replies:** 1\ **Last updated:** [October 21, 2022, 8:42am UTC](https://discuss.elastic.co/t/logstash-pipeline/317155 "2022-10-21T08:42:28Z")
Hi All, Urgent problem here. Have raised a support ticket but hoping to find a solution quicker! We have our logstash pipelines being managed by Kibana. A pipeline was accidently overwritten with an incorrect configura… --- ## [Java client: Aggregate class does not contain geohex\_grid kind](https://discuss.elastic.co/t/java-client-aggregate-class-does-not-contain-geohex-grid-kind/317172)
**Author:** [@Alain\_Bod](https://discuss.elastic.co/u/Alain_Bod)\ **Replies:** 0\ **Last updated:** [October 21, 2022, 8:17am UTC](https://discuss.elastic.co/t/java-client-aggregate-class-does-not-contain-geohex-grid-kind/317172 "2022-10-21T08:17:39Z")
Hi, We are trying to make geohex aggregations with the new java client. The request is possible, however the response misses a method in order to use it. I've opened an issue, but nothing has been done about it. Any i… --- ## [Slow sub-aggregation for low-cardinality field + high-cardinality field](https://discuss.elastic.co/t/slow-sub-aggregation-for-low-cardinality-field-high-cardinality-field/316992)
**Author:** [@astrodi](https://discuss.elastic.co/u/astrodi)\ **Replies:** 1\ **Last updated:** [October 21, 2022, 8:08am UTC](https://discuss.elastic.co/t/slow-sub-aggregation-for-low-cardinality-field-high-cardinality-field/316992 "2022-10-21T08:08:42Z")
Hi there, I'm having index having 14M documents, occupying 1.6TB of pri.storage with 50shards. There is query doing 22 aggregations (mainly simple terms aggs), took 0.3s. I needed to add one sub-aggregation to every o… --- ## [Logstash got response code 401 contacting elasticsearch url](https://discuss.elastic.co/t/logstash-got-response-code-401-contacting-elasticsearch-url/317081)
**Author:** [@mammodde](https://discuss.elastic.co/u/mammodde)\ **Replies:** 6\ **Last updated:** [October 21, 2022, 8:06am UTC](https://discuss.elastic.co/t/logstash-got-response-code-401-contacting-elasticsearch-url/317081 "2022-10-21T08:06:38Z")
Hi everyone, i configured logstash pipeline and yml, from logs I can see that I receive something but when logstash tries to connect to elasticsearch it fails giving me \[2022-10-20T08:26:09,740\]\[WARN \]\[logstash.licensec… --- ## [Logstash\_s3\_output plugin failing with assumerole role\_arn](https://discuss.elastic.co/t/logstash-s3-output-plugin-failing-with-assumerole-role-arn/317167)
**Author:** [@pushpalatha](https://discuss.elastic.co/u/pushpalatha)\ **Replies:** 0\ **Last updated:** [October 21, 2022, 6:30am UTC](https://discuss.elastic.co/t/logstash-s3-output-plugin-failing-with-assumerole-role-arn/317167 "2022-10-21T06:30:41Z")
logstash pod is up and running with s3 plugin install with the image 6.8.23. But failing to upload logs to s3 bucket, due to below error \[ERROR\]\[logstash.outputs.s3 \] Uploading failed, retrying. {:exception=\>Aws::… --- ## [Auditbeat configuration pass dynamic shell environment variable](https://discuss.elastic.co/t/auditbeat-configuration-pass-dynamic-shell-environment-variable/316752)
**Author:** [@satendra1987](https://discuss.elastic.co/u/satendra1987)\ **Replies:** 6\ **Last updated:** [October 21, 2022, 6:01am UTC](https://discuss.elastic.co/t/auditbeat-configuration-pass-dynamic-shell-environment-variable/316752 "2022-10-21T06:01:15Z")
Hi, we need to get a custom field in auditbeat kibana logs and this field value has to come from a shell environment variable. this shell environment variable value can be different on each shell opened. Thanks Satend… --- ## [Strict execution ordering of Logstash output plugins](https://discuss.elastic.co/t/strict-execution-ordering-of-logstash-output-plugins/317048)
**Author:** [@gordonjlee](https://discuss.elastic.co/u/gordonjlee)\ **Replies:** 5\ **Last updated:** [October 20, 2022, 10:49pm UTC](https://discuss.elastic.co/t/strict-execution-ordering-of-logstash-output-plugins/317048 "2022-10-20T22:49:13Z")
I have 2 outputs from a Logstash instance, one output to Elasticsearch and one output to a Kafka topic that is consumed by a homegrown ms. In practice, I have seen instances where the ms consuming the Kafka topic receiv… --- ## [Is it possible to force document update despite a smaller version](https://discuss.elastic.co/t/is-it-possible-to-force-document-update-despite-a-smaller-version/317135)
**Author:** [@Achraf](https://discuss.elastic.co/u/Achraf)\ **Replies:** 1\ **Last updated:** [October 20, 2022, 9:24pm UTC](https://discuss.elastic.co/t/is-it-possible-to-force-document-update-despite-a-smaller-version/317135 "2022-10-20T21:24:06Z")
Our documents are indexed in ES with a version, this allows us to be sure that only new versions of the documents are indexed. In some special circumstances, we would like to baypass this mechanism, meaning updating a do… --- ## [Restored indices in red](https://discuss.elastic.co/t/restored-indices-in-red/317099)
**Author:** [@not\_correct](https://discuss.elastic.co/u/not_correct)\ **Replies:** 3\ **Last updated:** [October 20, 2022, 8:59pm UTC](https://discuss.elastic.co/t/restored-indices-in-red/317099 "2022-10-20T20:59:12Z")
Hi, I just restored the ES snapshot, but however I get all the restored indices in red status. When I call GET \_cluster/allocation/explain , I get the following: { "index" : "componentinformation", "shard" : 0, … --- ## [Logstash is disaster](https://discuss.elastic.co/t/logstash-is-disaster/317151)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 1\ **Last updated:** [October 20, 2022, 8:49pm UTC](https://discuss.elastic.co/t/logstash-is-disaster/317151 "2022-10-20T20:49:33Z")
200% of cpu without pipelines and not produce log Who develops it is aware of its total unreliability? response: deny that Logstash has problems is not the solution in my opinion and better not to use it and try to … --- ## [How can I parse this date format into @timestamp?](https://discuss.elastic.co/t/how-can-i-parse-this-date-format-into-timestamp/316261)
**Author:** [@Roger\_Huang](https://discuss.elastic.co/u/Roger_Huang)\ **Replies:** 5\ **Last updated:** [October 20, 2022, 7:51pm UTC](https://discuss.elastic.co/t/how-can-i-parse-this-date-format-into-timestamp/316261 "2022-10-20T19:51:04Z")
Hi everyone, I am new to ELK and I cannot seems to get this right. Keep getting date parse error. I also wanted to put the \_time to @timestamp. For your kind advise please. 2022-06-30T13:14:40.558 Edgar.conf inpu… --- ## [Filebeat Nginx module not producing url.domain field if domain contains "\_" (underscore)](https://discuss.elastic.co/t/filebeat-nginx-module-not-producing-url-domain-field-if-domain-contains-underscore/317146)
**Author:** [@haikosaw](https://discuss.elastic.co/u/haikosaw)\ **Replies:** 2\ **Last updated:** [October 20, 2022, 7:46pm UTC](https://discuss.elastic.co/t/filebeat-nginx-module-not-producing-url-domain-field-if-domain-contains-underscore/317146 "2022-10-20T19:46:42Z")
Hello. I´m having an issue where I'm using the Nginx module in Filebeat 8.4.2 (via ES\_Agent and Fleet). After searching for a while why sometimes I would get the url.domain field, and sometimes not, I noticed that when… --- ## [Multiple Elastic Search Outputs for two different Azure event hubs as input in Logstash](https://discuss.elastic.co/t/multiple-elastic-search-outputs-for-two-different-azure-event-hubs-as-input-in-logstash/317129)
**Author:** [@Anudeep\_Konaboina](https://discuss.elastic.co/u/Anudeep_Konaboina)\ **Replies:** 3\ **Last updated:** [October 20, 2022, 6:09pm UTC](https://discuss.elastic.co/t/multiple-elastic-search-outputs-for-two-different-azure-event-hubs-as-input-in-logstash/317129 "2022-10-20T18:09:49Z")
I have to configure log stash to read from 2 different event hubs and write them to two different Elasticsearch index as shown below: input { azure\_event\_hubs { config\_mode =\> "advanced" threads =\> 8 d… --- ## [How to use SSL certs with Fleet server - errors on startup](https://discuss.elastic.co/t/how-to-use-ssl-certs-with-fleet-server-errors-on-startup/317148)
**Author:** [@Bitdoctor](https://discuss.elastic.co/u/Bitdoctor)\ **Replies:** 0\ **Last updated:** [October 20, 2022, 5:47pm UTC](https://discuss.elastic.co/t/how-to-use-ssl-certs-with-fleet-server-errors-on-startup/317148 "2022-10-20T17:47:52Z")
I get the following error trying to start Fleet server after installing it on my Logstash node: Fleet Server - Error - x509: certificate signed by unknown authority","ecs.version":"1.6.0" I'm attempting to use the self… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=754) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=756)