# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=759 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 760 --- ## [Docker error during 3-node cluster running](https://discuss.elastic.co/t/docker-error-during-3-node-cluster-running/315304)
**Author:** [@tifty](https://discuss.elastic.co/u/tifty)\ **Replies:** 3\ **Last updated:** [October 19, 2022, 1:24am UTC](https://discuss.elastic.co/t/docker-error-during-3-node-cluster-running/315304 "2022-10-19T01:24:03Z")
Hi everyone, I am trying to run a 3-node cluster on my local machine. Although it doesn't happen with every run but at times I am getting the "Error response from daemon: i/o timeout" error in one of the nodes randomly a… --- ## [Nested Json](https://discuss.elastic.co/t/nested-json/316939)
**Author:** [@Rdonaldson](https://discuss.elastic.co/u/Rdonaldson)\ **Replies:** 0\ **Last updated:** [October 18, 2022, 10:56pm UTC](https://discuss.elastic.co/t/nested-json/316939 "2022-10-18T22:56:28Z")
New to ES and Json. Working on building queries to extract product logging events. Could you point me in the direction/search terms/pointers so I can learn how to parse out/select data fields that are within a nested J… --- ## [X509: certificate signed by unknown authority](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority/316904)
**Author:** [@EExisT](https://discuss.elastic.co/u/EExisT)\ **Replies:** 2\ **Last updated:** [October 18, 2022, 10:53pm UTC](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority/316904 "2022-10-18T22:53:56Z")
Hello, I have an SSL connection between a Windows machine with Winlogbeat and Metricbeat and an Ubuntu machine with ES and Kibana on it. The beat's .ymls file are the same, with same configuration. With the elasticsea… --- ## [Import CSV date format time difference](https://discuss.elastic.co/t/import-csv-date-format-time-difference/316907)
**Author:** [@Julian\_Tang](https://discuss.elastic.co/u/Julian_Tang)\ **Replies:** 6\ **Last updated:** [October 18, 2022, 9:50pm UTC](https://discuss.elastic.co/t/import-csv-date-format-time-difference/316907 "2022-10-18T21:50:00Z")
Hi I try to import a CSV file in logstash. but I have problem, the csv file first is date and time, I use separator to "timestamp", but it + 8 hours (my time zone is +8) so I how to set time don't +8 ? input { file… --- ## [New to Elastic Community](https://discuss.elastic.co/t/new-to-elastic-community/315025)
**Author:** [@tifty](https://discuss.elastic.co/u/tifty)\ **Replies:** 2\ **Last updated:** [October 18, 2022, 8:17pm UTC](https://discuss.elastic.co/t/new-to-elastic-community/315025 "2022-10-18T20:17:32Z")
Hi everyone, I am very new to using elastic stack and docker. I am using elasticsearch built by docker-compose, and currently, I am just practicing on my local machine how to make any deployment production ready. It will… --- ## [Wildcard suffix for indicies, aggregate for each index](https://discuss.elastic.co/t/wildcard-suffix-for-indicies-aggregate-for-each-index/316779)
**Author:** [@daekblad](https://discuss.elastic.co/u/daekblad)\ **Replies:** 1\ **Last updated:** [October 18, 2022, 7:29pm UTC](https://discuss.elastic.co/t/wildcard-suffix-for-indicies-aggregate-for-each-index/316779 "2022-10-18T19:29:00Z")
Hi, I have this watcher that checks for errors and sends an e-mail if any error is found. It's setup so that it checks a wildcard index patterns ("services-\*"). There are too many services so a wildcard is a must since … --- ## [How to enable size-mapper plugin / \_size field via RestHighLevelClient](https://discuss.elastic.co/t/how-to-enable-size-mapper-plugin-size-field-via-resthighlevelclient/314501)
**Author:** [@rowi1de](https://discuss.elastic.co/u/rowi1de)\ **Replies:** 19\ **Last updated:** [October 18, 2022, 7:19pm UTC](https://discuss.elastic.co/t/how-to-enable-size-mapper-plugin-size-field-via-resthighlevelclient/314501 "2022-10-18T19:19:38Z")
Hey Folks, I'm trying to add the \_size field to an existing index via RestHighLevelClient and failing to see there I could put the following "mappings": { "\_size": { "enabled": true } } the Dev Tools… --- ## [Does logstash support zip format logs from s3 bucket](https://discuss.elastic.co/t/does-logstash-support-zip-format-logs-from-s3-bucket/316877)
**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Replies:** 7\ **Last updated:** [October 18, 2022, 6:20pm UTC](https://discuss.elastic.co/t/does-logstash-support-zip-format-logs-from-s3-bucket/316877 "2022-10-18T18:20:38Z")
Hi Team, Just want to know does logstash support the integration of logs from s3 bucket which are in .zip format? Regards --- ## [Fleet Integrations in dockerized services](https://discuss.elastic.co/t/fleet-integrations-in-dockerized-services/316926)
**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\ **Replies:** 0\ **Last updated:** [October 18, 2022, 5:53pm UTC](https://discuss.elastic.co/t/fleet-integrations-in-dockerized-services/316926 "2022-10-18T17:53:39Z")
Hello, I'm trying to get som Traefik logs from a docker container. With regular filebeat I can configure the autodiscover option to make it work, but not sure how to do this with Fleet. I could only find this: docker… --- ## [There are no transform nodes available](https://discuss.elastic.co/t/there-are-no-transform-nodes-available/316889)
**Author:** [@Kosala\_Randika\_Paran](https://discuss.elastic.co/u/Kosala_Randika_Paran)\ **Replies:** 4\ **Last updated:** [October 18, 2022, 5:26pm UTC](https://discuss.elastic.co/t/there-are-no-transform-nodes-available/316889 "2022-10-18T17:26:38Z")
Hi, I am configuring enroll an agent with endpoint and cloud security module and while it doing I'm getting error "Required transform failed" and "A required transform, endpoint.metadata\_current-default-8.4.1, endpoint.… --- ## [Agent binary download source location not working](https://discuss.elastic.co/t/agent-binary-download-source-location-not-working/316925)
**Author:** [@andrisarkameru](https://discuss.elastic.co/u/andrisarkameru)\ **Replies:** 0\ **Last updated:** [October 18, 2022, 5:09pm UTC](https://discuss.elastic.co/t/agent-binary-download-source-location-not-working/316925 "2022-10-18T17:09:40Z")
Hello, I'm using elasticsearch/kibana version 8.4.2 on windows containers. It seems that Kibana fleet binary download source setting does not work, or does not get taken into account. i'm following the air-gapped inst… --- ## [Ingest already created doc in pubsub to elk using logstash](https://discuss.elastic.co/t/ingest-already-created-doc-in-pubsub-to-elk-using-logstash/316924)
**Author:** [@Dennis\_John](https://discuss.elastic.co/u/Dennis_John)\ **Replies:** 0\ **Last updated:** [October 18, 2022, 5:00pm UTC](https://discuss.elastic.co/t/ingest-already-created-doc-in-pubsub-to-elk-using-logstash/316924 "2022-10-18T17:00:09Z")
Hi, I am using microservices and part of the job by microservices is to create a doc with index and doc id and other fields that will be pushed to pubsub. Currently, we are ingesting to elk by pulling messages from GCP… --- ## [ILM shrink adds random uuid but no aliases created](https://discuss.elastic.co/t/ilm-shrink-adds-random-uuid-but-no-aliases-created/316457)
**Author:** [@danksim](https://discuss.elastic.co/u/danksim)\ **Replies:** 3\ **Last updated:** [October 18, 2022, 3:35pm UTC](https://discuss.elastic.co/t/ilm-shrink-adds-random-uuid-but-no-aliases-created/316457 "2022-10-18T15:35:36Z")
elasticsearch version 7.17 since upgrading from 7.6.2. to 7.17.x, i noticed ilm adds a random uuid to the shrunk index name. looks like this feature was added in 7.13 (see here). my ilm policy was set up again right af… --- ## [Winlogbeat SSL connection to ES\\Kibana](https://discuss.elastic.co/t/winlogbeat-ssl-connection-to-es-kibana/316645)
**Author:** [@EExisT](https://discuss.elastic.co/u/EExisT)\ **Replies:** 4\ **Last updated:** [October 18, 2022, 3:27pm UTC](https://discuss.elastic.co/t/winlogbeat-ssl-connection-to-es-kibana/316645 "2022-10-18T15:27:38Z")
Hello, i have an Ubuntu VM where I run ES and Kibana and a Windows VM where i want to run Winlogbeat. The idea is to send windows events to ES and visualise it with Kibana. Kibana is reachable by browser from both VMs… --- ## [Sending Data to elasticsearch](https://discuss.elastic.co/t/sending-data-to-elasticsearch/316911)
**Author:** [@VitorBarroso](https://discuss.elastic.co/u/VitorBarroso)\ **Replies:** 0\ **Last updated:** [October 18, 2022, 3:11pm UTC](https://discuss.elastic.co/t/sending-data-to-elasticsearch/316911 "2022-10-18T15:11:26Z")
Hello, When i try to connect to my elasticsearch, i have this problem. If i dont use ca\_certs, its ok but i have the warnings because i dont use the ssl, but when i use the ssl, i have this error( elastic\_transport.Tl… --- ## [The result of "metricbeat test modules sql" has timeout failure when the query does not have any output](https://discuss.elastic.co/t/the-result-of-metricbeat-test-modules-sql-has-timeout-failure-when-the-query-does-not-have-any-output/316874)
**Author:** [@donald\_b90](https://discuss.elastic.co/u/donald_b90)\ **Replies:** 1\ **Last updated:** [October 18, 2022, 3:01pm UTC](https://discuss.elastic.co/t/the-result-of-metricbeat-test-modules-sql-has-timeout-failure-when-the-query-does-not-have-any-output/316874 "2022-10-18T15:01:32Z")
Hi All, First of all, I appreciate your attention in advance. Since, I am new in using ELK Stack, I have one question. I have one simple query in my sql.yml file which returns no records (The sql module is enabled). /… --- ## [No data log in Discover section](https://discuss.elastic.co/t/no-data-log-in-discover-section/316775)
**Author:** [@EExisT](https://discuss.elastic.co/u/EExisT)\ **Replies:** 1\ **Last updated:** [October 18, 2022, 2:29pm UTC](https://discuss.elastic.co/t/no-data-log-in-discover-section/316775 "2022-10-18T14:29:46Z")
Hi, I'm sending Winlogbeat events form a Windows VM to an Ubuntu VM, where are running both ES than Kibana. The VM's are on the same subnet and I can access the https Kibana GUI from both VM's. If I go to "Stack Manag… --- ## [ElasticSearch snapshots are not visisble](https://discuss.elastic.co/t/elasticsearch-snapshots-are-not-visisble/316808)
**Author:** [@not\_correct](https://discuss.elastic.co/u/not_correct)\ **Replies:** 7\ **Last updated:** [October 18, 2022, 2:12pm UTC](https://discuss.elastic.co/t/elasticsearch-snapshots-are-not-visisble/316808 "2022-10-18T14:12:39Z")
Hi, I have Elasticsearch cluster running and s3 bucket that contains snapshot files to this cluster. However, when I first listed \_snapshot/\_all no repository, and/or snapshots were found. I added the repository using t… --- ## [Logstash hardware requirements](https://discuss.elastic.co/t/logstash-hardware-requirements/316851)
**Author:** [@perezdev](https://discuss.elastic.co/u/perezdev)\ **Replies:** 1\ **Last updated:** [October 18, 2022, 1:55pm UTC](https://discuss.elastic.co/t/logstash-hardware-requirements/316851 "2022-10-18T13:55:32Z")
Hello, I'm going to install logstash in a Linux VM. I'm trying to find out the best hardware requirements for this VM so that logstash could handle the amount of data expected as smooth as possible. The amount of data … --- ## [How to Apply cross filtering only to plots that can be applied and avoid the remaining](https://discuss.elastic.co/t/how-to-apply-cross-filtering-only-to-plots-that-can-be-applied-and-avoid-the-remaining/316606)
**Author:** [@eleven\_e](https://discuss.elastic.co/u/eleven_e)\ **Replies:** 3\ **Last updated:** [October 18, 2022, 1:52pm UTC](https://discuss.elastic.co/t/how-to-apply-cross-filtering-only-to-plots-that-can-be-applied-and-avoid-the-remaining/316606 "2022-10-18T13:52:17Z")
I'm working on a dashboard and I have 2 indices with different structure and when i apply the cross filtering by clicking on a particular bar in a bar graph the data gets filtered and some plots turn to 'NO RESULTS FOUND… --- ## [Unable to create snapshot repo in azure](https://discuss.elastic.co/t/unable-to-create-snapshot-repo-in-azure/316804)
**Author:** [@jaykb77](https://discuss.elastic.co/u/jaykb77)\ **Replies:** 5\ **Last updated:** [October 18, 2022, 1:33pm UTC](https://discuss.elastic.co/t/unable-to-create-snapshot-repo-in-azure/316804 "2022-10-18T13:33:58Z")
Im trying to register an azure blob as snapshot repository. I have already tested this with elasticsearch 7.17 on test VMs outside my firm but it is failing when Im trying the same steps inside the firm. My first impre… --- ## [How to specify an UNC-Path (network share) for logstash file input plugin](https://discuss.elastic.co/t/how-to-specify-an-unc-path-network-share-for-logstash-file-input-plugin/316900)
**Author:** [@simon137](https://discuss.elastic.co/u/simon137)\ **Replies:** 0\ **Last updated:** [October 18, 2022, 1:29pm UTC](https://discuss.elastic.co/t/how-to-specify-an-unc-path-network-share-for-logstash-file-input-plugin/316900 "2022-10-18T13:29:16Z")
Hello, I tried specifying a UNC-Path for the "path"-Setting of the logstash file input plugin and unfortunately it doesn't work. Is this a known issue or does someone here know how to get this to work on a windows masc… --- ## [Inode change without reason](https://discuss.elastic.co/t/inode-change-without-reason/316898)
**Author:** [@Victor\_Caetano](https://discuss.elastic.co/u/Victor_Caetano)\ **Replies:** 0\ **Last updated:** [October 18, 2022, 1:23pm UTC](https://discuss.elastic.co/t/inode-change-without-reason/316898 "2022-10-18T13:23:37Z")
I Have an ELK stack stablished using the following workflow A DB2 server generating logs in .txt format, a FTP for ingest those logs into a S3 bucket in my AWS environment Than a s3fs-fuse mount system, using this S3 b… --- ## [How come recoveries for a given shard with EMPTY\_STORE is not showing but the index has data?](https://discuss.elastic.co/t/how-come-recoveries-for-a-given-shard-with-empty-store-is-not-showing-but-the-index-has-data/316894)
**Author:** [@jmlucjav](https://discuss.elastic.co/u/jmlucjav)\ **Replies:** 0\ **Last updated:** [October 18, 2022, 1:08pm UTC](https://discuss.elastic.co/t/how-come-recoveries-for-a-given-shard-with-empty-store-is-not-showing-but-the-index-has-data/316894 "2022-10-18T13:08:39Z")
I have an index in red state. It has some docs, so at some point it was in yellow or green..But if I run GET/indexA/\_recovery I get entries for shards 0 and 2, but shard 1 is not showing up at all, does it mean it was … --- ## [Convert java query output in json format](https://discuss.elastic.co/t/convert-java-query-output-in-json-format/316893)
**Author:** [@Shubh](https://discuss.elastic.co/u/Shubh)\ **Replies:** 0\ **Last updated:** [October 18, 2022, 1:06pm UTC](https://discuss.elastic.co/t/convert-java-query-output-in-json-format/316893 "2022-10-18T13:06:31Z")
Hi all, can someone help get my java query output in json format im just printing it in line and now i want to upgrade my code output tried multiple ways but no luck. Below is my code elasticsearch java api code. try… --- ## [Standard Memory recommendation for each POD having 3 node cluster running on Elasticsearch 7.17.1](https://discuss.elastic.co/t/standard-memory-recommendation-for-each-pod-having-3-node-cluster-running-on-elasticsearch-7-17-1/316854)
**Author:** [@bikas](https://discuss.elastic.co/u/bikas)\ **Replies:** 2\ **Last updated:** [October 18, 2022, 10:24am UTC](https://discuss.elastic.co/t/standard-memory-recommendation-for-each-pod-having-3-node-cluster-running-on-elasticsearch-7-17-1/316854 "2022-10-18T10:24:08Z")
Hello, I would like to know the recommended Memory needs to be allocated to Elasticsearch 7.17.1 POD. Currently we have 3 node cluster deployed in GKE. Each POD is being allocated to 4GB RAM and 50% of its memory to Hea… --- ## [Writing events to different indexes through a variable](https://discuss.elastic.co/t/writing-events-to-different-indexes-through-a-variable/316814)
**Author:** [@Aleksei](https://discuss.elastic.co/u/Aleksei)\ **Replies:** 7\ **Last updated:** [October 18, 2022, 10:19am UTC](https://discuss.elastic.co/t/writing-events-to-different-indexes-through-a-variable/316814 "2022-10-18T10:19:22Z")
Hi everyone I did not find a suitable topic in the community, I decided to create a topic. Has anyone tried this configuration ? output { \*\* \*\* elasticsearch { \*\* \*\* index =\> "%{\[some\_field\]\[sub\_field\]}-… --- ## [High cpu usage during search](https://discuss.elastic.co/t/high-cpu-usage-during-search/316795)
**Author:** [@faisal.k](https://discuss.elastic.co/u/faisal.k)\ **Replies:** 9\ **Last updated:** [October 18, 2022, 9:52am UTC](https://discuss.elastic.co/t/high-cpu-usage-during-search/316795 "2022-10-18T09:52:18Z")
Hello, I have tried to read through most of the topics and tried with the suggestions, nothing has helped so far. We are running an elasticsearch cluster (v7.16.1) with 2 nodes (4 CPUs, heap assigned as 16GB - physical… --- ## [Can we use conditions in input plugin of logstash](https://discuss.elastic.co/t/can-we-use-conditions-in-input-plugin-of-logstash/316873)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 0\ **Last updated:** [October 18, 2022, 9:51am UTC](https://discuss.elastic.co/t/can-we-use-conditions-in-input-plugin-of-logstash/316873 "2022-10-18T09:51:46Z")
Hi team, Can we used multiple inputs plugin based on conditions we have specified --- ## [How to extract timestamp and log level from message and add it as a filed](https://discuss.elastic.co/t/how-to-extract-timestamp-and-log-level-from-message-and-add-it-as-a-filed/316639)
**Author:** [@Akumar22](https://discuss.elastic.co/u/Akumar22)\ **Replies:** 6\ **Last updated:** [October 18, 2022, 9:47am UTC](https://discuss.elastic.co/t/how-to-extract-timestamp-and-log-level-from-message-and-add-it-as-a-filed/316639 "2022-10-18T09:47:42Z")
Hi I want to extract timestamp and log level from message and want to add it as a field can you please suggest some filter or grok pattern to do this sample log : 2022-10-12 12:02:32,611 \[DEBUG\]\[pool-5-thread-14\]\[com.… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=758) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=760)