# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=777 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 778 --- ## [Filtered Log messages show up as empty fields in Kibana](https://discuss.elastic.co/t/filtered-log-messages-show-up-as-empty-fields-in-kibana/315399)
**Author:** [@Chma](https://discuss.elastic.co/u/Chma)\ **Replies:** 1\ **Last updated:** [October 1, 2022, 2:02am UTC](https://discuss.elastic.co/t/filtered-log-messages-show-up-as-empty-fields-in-kibana/315399 "2022-10-01T02:02:28Z")
I have filtered my log message using grok. But when I check Kibana, I find the new fields on the left side of the page, but they are empty. I am also getting the \_grokparsefailure tag. Here's an example of my log messag… --- ## [How to mock an index?](https://discuss.elastic.co/t/how-to-mock-an-index/315580)
**Author:** [@sajidb](https://discuss.elastic.co/u/sajidb)\ **Replies:** 1\ **Last updated:** [October 1, 2022, 12:08am UTC](https://discuss.elastic.co/t/how-to-mock-an-index/315580 "2022-10-01T00:08:08Z")
I want to create an integration test in C#10 (.NET 6) that does some tests on the Elasticsearch index but I can't do it with the real data. I want to mock an index or create an index with dummy data and then test it by g… --- ## [Does a log have a message space limit when processed by logstash with the xml filter?](https://discuss.elastic.co/t/does-a-log-have-a-message-space-limit-when-processed-by-logstash-with-the-xml-filter/315608)
**Author:** [@erwin339](https://discuss.elastic.co/u/erwin339)\ **Replies:** 0\ **Last updated:** [September 30, 2022, 10:13pm UTC](https://discuss.elastic.co/t/does-a-log-have-a-message-space-limit-when-processed-by-logstash-with-the-xml-filter/315608 "2022-09-30T22:13:35Z")
I am working with an xml that contains very large logs (more than 1500 lines) and others with only one line, the large logs are giving me an error "Error parsing xml with XmlSimple", I have other logs with the same struc… --- ## [Extending multi-match for nested Object objects in MongoDB](https://discuss.elastic.co/t/extending-multi-match-for-nested-object-objects-in-mongodb/315471)
**Author:** [@scheung38](https://discuss.elastic.co/u/scheung38)\ **Replies:** 7\ **Last updated:** [September 30, 2022, 6:23pm UTC](https://discuss.elastic.co/t/extending-multi-match-for-nested-object-objects-in-mongodb/315471 "2022-09-30T18:23:16Z")
Given this works, but how to extend this multi\_match to nested ObjectID objects in a MongoDB database: GET address\*/\_search/ { "query": { "multi\_match" : { "query": "york", "fields": \[ "outward\_code"… --- ## [Stuck on \[Bucket max\] cardinality estimate required for \[influencers\] \[response\_time\_cat\] but not supplied](https://discuss.elastic.co/t/stuck-on-bucket-max-cardinality-estimate-required-for-influencers-response-time-cat-but-not-supplied/315533)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 3\ **Last updated:** [September 30, 2022, 5:22pm UTC](https://discuss.elastic.co/t/stuck-on-bucket-max-cardinality-estimate-required-for-influencers-response-time-cat-but-not-supplied/315533 "2022-09-30T17:22:39Z")
Hi team, I have created a runtime field (categorical field) in the Datafeed of ml job to use it as an influencer for the anomalies. I am able to find the field in the influencer section but after that when I tried to fi… --- ## [Elastic agent install failing](https://discuss.elastic.co/t/elastic-agent-install-failing/315501)
**Author:** [@Cyrax002](https://discuss.elastic.co/u/Cyrax002)\ **Replies:** 1\ **Last updated:** [September 30, 2022, 5:10pm UTC](https://discuss.elastic.co/t/elastic-agent-install-failing/315501 "2022-09-30T17:10:46Z")
When installing elastic agent on one host I am receiving the following error message: panic: EvalSymlinks: too many links goroutine 1 \[running\]: github.com/elastic/elastic-agent/internal/pkg/agent/application/paths.ret… --- ## [How create 2 different indexs with same file source?](https://discuss.elastic.co/t/how-create-2-different-indexs-with-same-file-source/315594)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 3\ **Last updated:** [September 30, 2022, 5:07pm UTC](https://discuss.elastic.co/t/how-create-2-different-indexs-with-same-file-source/315594 "2022-09-30T17:07:56Z")
this is my conf file and it's ok i've created an index with only errors match but now it's possible create a second indexs with file warning or custom? code =\> "event.cancel if not event.get('message').include? 'WARN' … --- ## [Watcher, how to create and compare arrays](https://discuss.elastic.co/t/watcher-how-to-create-and-compare-arrays/315597)
**Author:** [@sguerrero](https://discuss.elastic.co/u/sguerrero)\ **Replies:** 0\ **Last updated:** [September 30, 2022, 4:46pm UTC](https://discuss.elastic.co/t/watcher-how-to-create-and-compare-arrays/315597 "2022-09-30T16:46:14Z")
Hi. We're trying to perform an alarm with a watcher alarm but we don't know how. We have two different indices, index-1 and index-2, we need to search all events of index-1 and find all unique values of a field called f… --- ## [Custom Term Vectors](https://discuss.elastic.co/t/custom-term-vectors/315593)
**Author:** [@Tobias\_Fink](https://discuss.elastic.co/u/Tobias_Fink)\ **Replies:** 0\ **Last updated:** [September 30, 2022, 3:54pm UTC](https://discuss.elastic.co/t/custom-term-vectors/315593 "2022-09-30T15:54:22Z")
Hello, I'm trying to create custom term frequencies for terms in my documents, independent of the actual term frequencies in the document and including expansion terms that are not in the original document. Position and… --- ## [Custom filter in ruby?](https://discuss.elastic.co/t/custom-filter-in-ruby/315567)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 2\ **Last updated:** [September 30, 2022, 3:49pm UTC](https://discuss.elastic.co/t/custom-filter-in-ruby/315567 "2022-09-30T15:49:39Z")
hello i've used this config but have error when executed filter { ruby { code =\> ' if event.get("message").include? ' INFO ' event.cancel end ' … --- ## [ELK 8.x Unable to create "Log threshold" Alert Rule for new Index - "There aren't any options available"](https://discuss.elastic.co/t/elk-8-x-unable-to-create-log-threshold-alert-rule-for-new-index-there-arent-any-options-available/314933)
**Author:** [@Cezary](https://discuss.elastic.co/u/Cezary)\ **Replies:** 2\ **Last updated:** [September 30, 2022, 3:43pm UTC](https://discuss.elastic.co/t/elk-8-x-unable-to-create-log-threshold-alert-rule-for-new-index-there-arent-any-options-available/314933 "2022-09-30T15:43:11Z")
Hello Guys, Fresh install of ELK 8.x New index syslog-\* created via logstash Logstash config: input { tcp { port =\> 5000 type =\> syslog mode =\> "server" ssl\_enable =\> true ssl\_verify =\> false … --- ## [High CPU usage logstash](https://discuss.elastic.co/t/high-cpu-usage-logstash/315468)
**Author:** [@Cheroufa](https://discuss.elastic.co/u/Cheroufa)\ **Replies:** 10\ **Last updated:** [September 30, 2022, 3:27pm UTC](https://discuss.elastic.co/t/high-cpu-usage-logstash/315468 "2022-09-30T15:27:06Z")
Hi all, Whene i start logstash CPU usage jump to 99%, 100% and the logstash status is running but realy not started and no logs written can someone please help me to resolve this issue ? thank you. --- ## [ELK Snapshots Fail:](https://discuss.elastic.co/t/elk-snapshots-fail/315474)
**Author:** [@NJMitchell](https://discuss.elastic.co/u/NJMitchell)\ **Replies:** 3\ **Last updated:** [September 30, 2022, 3:22pm UTC](https://discuss.elastic.co/t/elk-snapshots-fail/315474 "2022-09-30T15:22:04Z")
Hi elastic community, I’m have some new problems with snapshots failing. A little background: We are required to archive our log data and keep it for a long time. What we do is create a single snapshot policy per indic… --- ## [Not able to install Elasticsearch 8.4.1](https://discuss.elastic.co/t/not-able-to-install-elasticsearch-8-4-1/314650)
**Author:** [@shivang.ahd](https://discuss.elastic.co/u/shivang.ahd)\ **Replies:** 17\ **Last updated:** [September 30, 2022, 3:10pm UTC](https://discuss.elastic.co/t/not-able-to-install-elasticsearch-8-4-1/314650 "2022-09-30T15:10:39Z")
Hi, I am not able to install elasticsearch 8.4.1 I am getting the below mentioned error. will not overwrite keystore at \[C:\\ProgramData\\Elastic\\Elasticsearch\\config\\elasticsearch.keystore\], because this incurs changi… --- ## [Fleet Server not connecting to Elastic after install, x509 error](https://discuss.elastic.co/t/fleet-server-not-connecting-to-elastic-after-install-x509-error/315560)
**Author:** [@marchias](https://discuss.elastic.co/u/marchias)\ **Replies:** 0\ **Last updated:** [September 30, 2022, 1:21pm UTC](https://discuss.elastic.co/t/fleet-server-not-connecting-to-elastic-after-install-x509-error/315560 "2022-09-30T13:21:19Z")
I have deployed two Docker containers for elastic and kibana. Those two are talking to each other and working fine. I am now trying to deploy Fleet Server and have followed all the documentation and the Fleet Server and … --- ## [Missing records when using BulkProcessor (Java High Level Rest Client)](https://discuss.elastic.co/t/missing-records-when-using-bulkprocessor-java-high-level-rest-client/315576)
**Author:** [@F\_Jx](https://discuss.elastic.co/u/F_Jx)\ **Replies:** 1\ **Last updated:** [September 30, 2022, 2:29pm UTC](https://discuss.elastic.co/t/missing-records-when-using-bulkprocessor-java-high-level-rest-client/315576 "2022-09-30T14:29:45Z")
Missing records when using BulkProcessor (Java High Level Rest Client) I had exactly the same problem I use spring-boot-starter-data-elasticsearch client (elasticsearch-rest-high-level-client 7.6.2) My English not goo… --- ## [Barracuda Integration](https://discuss.elastic.co/t/barracuda-integration/315554)
**Author:** [@Garry](https://discuss.elastic.co/u/Garry)\ **Replies:** 0\ **Last updated:** [September 30, 2022, 12:32pm UTC](https://discuss.elastic.co/t/barracuda-integration/315554 "2022-09-30T12:32:10Z")
I have configured the Barracuda integration to listen on a port number over UDP on Server A. I have also configured the Barracuda WAF to export log files to Server A using UDP. So, it looks ok, but I can't see data bei… --- ## [ELK 8.x Logstash creates index with variable name instead variable value](https://discuss.elastic.co/t/elk-8-x-logstash-creates-index-with-variable-name-instead-variable-value/315365)
**Author:** [@Cezary](https://discuss.elastic.co/u/Cezary)\ **Replies:** 1\ **Last updated:** [September 30, 2022, 12:31pm UTC](https://discuss.elastic.co/t/elk-8-x-logstash-creates-index-with-variable-name-instead-variable-value/315365 "2022-09-30T12:31:24Z")
Hello Guys, I have an issue with Logstash, it creates index in elasticsearch and archive filename with variable name instead variable value and next creates index and archive filename with correct name. My logstash co… --- ## [Elastic SearchSearch API - default\_allow\_partial\_results parameter](https://discuss.elastic.co/t/elastic-searchsearch-api-default-allow-partial-results-parameter/315553)
**Author:** [@edsonma](https://discuss.elastic.co/u/edsonma)\ **Replies:** 0\ **Last updated:** [September 30, 2022, 12:30pm UTC](https://discuss.elastic.co/t/elastic-searchsearch-api-default-allow-partial-results-parameter/315553 "2022-09-30T12:30:22Z")
I am working on a project and looking at ES documentation I found a query parameter allow\_partial\_search\_results. (Optional, Boolean) If true, returns partial results if there are shard request timeouts or shard failur… --- ## [Filebeat memory usage is keep increasing](https://discuss.elastic.co/t/filebeat-memory-usage-is-keep-increasing/313597)
**Author:** [@SeungHyun\_Roh](https://discuss.elastic.co/u/SeungHyun_Roh)\ **Replies:** 5\ **Last updated:** [September 30, 2022, 12:10pm UTC](https://discuss.elastic.co/t/filebeat-memory-usage-is-keep-increasing/313597 "2022-09-30T12:10:12Z")
Hello, community! My colleague's struggling with some issue with filebeat in his project for 5 months, so every engineer in my team decided to help him. He's using filebeat 7.14.2 to collect logs and send it to kafka. … --- ## [Malformed action/metadata line \[1\], expected START\_OBJECT but found \[START\_ARRAY\]](https://discuss.elastic.co/t/malformed-action-metadata-line-1-expected-start-object-but-found-start-array/315528)
**Author:** [@Hemabh\_Ravee\_Fox](https://discuss.elastic.co/u/Hemabh_Ravee_Fox)\ **Replies:** 5\ **Last updated:** [September 30, 2022, 10:56am UTC](https://discuss.elastic.co/t/malformed-action-metadata-line-1-expected-start-object-but-found-start-array/315528 "2022-09-30T10:56:03Z")
I've been trying to use the bulk api to insert a large number of documents to an index. I followed the documentation and came up with the following API call - POST https://localhost:9200/index/\_bulk \[ {"create":{}}… --- ## [Failed to publish events: temporary bulk send failure](https://discuss.elastic.co/t/failed-to-publish-events-temporary-bulk-send-failure/315545)
**Author:** [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\ **Replies:** 0\ **Last updated:** [September 30, 2022, 10:41am UTC](https://discuss.elastic.co/t/failed-to-publish-events-temporary-bulk-send-failure/315545 "2022-09-30T10:41:53Z")
We are receiving this error for a filbeat pod in a node on our kuberntes cluster. This specific filebeat pod seems to always be using a high amount of cpu. We wonder if this error message and the high cpu usage is linke… --- ## [Cloudflare integration doesn't work (LogPull)](https://discuss.elastic.co/t/cloudflare-integration-doesnt-work-logpull/315538)
**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\ **Replies:** 0\ **Last updated:** [September 30, 2022, 9:48am UTC](https://discuss.elastic.co/t/cloudflare-integration-doesnt-work-logpull/315538 "2022-09-30T09:48:01Z")
HI to all, I'm try to set up cloudflare integration, it seems all ok (agent,policy,integration) but it's not getting logpull logs. I have configured everything according to the documentation and after I save integration… --- ## [ElasticSearch HighLevel Rest client returns java.net.SocketTimeoutException](https://discuss.elastic.co/t/elasticsearch-highlevel-rest-client-returns-java-net-sockettimeoutexception/315537)
**Author:** [@ilBepi](https://discuss.elastic.co/u/ilBepi)\ **Replies:** 0\ **Last updated:** [September 30, 2022, 9:28am UTC](https://discuss.elastic.co/t/elasticsearch-highlevel-rest-client-returns-java-net-sockettimeoutexception/315537 "2022-09-30T09:28:41Z")
Hello, I am updating Elasticsearch from version 7.4 to 7.17. My code instantiates an ElasticSearchNode, starts it, and then creates a HighLevel Rest client to make calls to that node. The node is local to the machine,… --- ## [Enrolling Fleet server](https://discuss.elastic.co/t/enrolling-fleet-server/315278)
**Author:** [@BenjaminD](https://discuss.elastic.co/u/BenjaminD)\ **Replies:** 3\ **Last updated:** [September 30, 2022, 9:24am UTC](https://discuss.elastic.co/t/enrolling-fleet-server/315278 "2022-09-30T09:24:55Z")
Hello ! We are having trouble to enroll fleet server on our host. We are working with : Windows Server 2019 Standard Elasticsearch / Kibana / Elastic-Agent version 8.4.2 (same issue with 8.4.1) We try to enroll Fleet… --- ## [Send logs to specific elasic node in kubernetes](https://discuss.elastic.co/t/send-logs-to-specific-elasic-node-in-kubernetes/315534)
**Author:** [@theodor](https://discuss.elastic.co/u/theodor)\ **Replies:** 0\ **Last updated:** [September 30, 2022, 8:51am UTC](https://discuss.elastic.co/t/send-logs-to-specific-elasic-node-in-kubernetes/315534 "2022-09-30T08:51:38Z")
Hi! I have 3 nodes of Elasticsearch (el-0, el-1, el-2) each on 3 nodes of kubernetes (k8node-0, k8node-1, k8node2) . All of them master-node. Also i have 3 instance of Filebeat (fb-0, fb-1, fb-2) each on the same 3 nod… --- ## [Requirement to build logstah core module to generate a custom logstah for a specific purpose](https://discuss.elastic.co/t/requirement-to-build-logstah-core-module-to-generate-a-custom-logstah-for-a-specific-purpose/315200)
**Author:** [@rravitech](https://discuss.elastic.co/u/rravitech)\ **Replies:** 3\ **Last updated:** [September 30, 2022, 9:01am UTC](https://discuss.elastic.co/t/requirement-to-build-logstah-core-module-to-generate-a-custom-logstah-for-a-specific-purpose/315200 "2022-09-30T09:01:01Z")
I have a requirement to edit the logstash core, and generate a kind of build out of it. Need to customize logstash code to resist over the below mechanism. Logstash has an at-least-once delivery model. Every event is s… --- ## [Boost based on value of sum two fields](https://discuss.elastic.co/t/boost-based-on-value-of-sum-two-fields/314567)
**Author:** [@Ismet](https://discuss.elastic.co/u/Ismet)\ **Replies:** 5\ **Last updated:** [September 30, 2022, 8:42am UTC](https://discuss.elastic.co/t/boost-based-on-value-of-sum-two-fields/314567 "2022-09-30T08:42:14Z")
Hi, I have two inventory fields: inventory.warehouse1.availableInventory: 10 inventory.warehouse2.availableInventory: 20 I need to make a query with sum of these two fields and make a boost if total \> 0. I try to mak… --- ## [About FileBeat Dissect processor](https://discuss.elastic.co/t/about-filebeat-dissect-processor/315138)
**Author:** [@aluopy](https://discuss.elastic.co/u/aluopy)\ **Replies:** 1\ **Last updated:** [September 30, 2022, 8:02am UTC](https://discuss.elastic.co/t/about-filebeat-dissect-processor/315138 "2022-09-30T08:02:40Z")
HI, I want to use FileBeat's Dissect processor to handle my log simply, but always report an error. The relevant information is as follows: Version Info: elasticsearch: 8.4.2 kibana: 8.4.2 filebeat: 8.4.2 filebeat.yml:… --- ## [Collapse dense\_vector field in search results](https://discuss.elastic.co/t/collapse-dense-vector-field-in-search-results/315517)
**Author:** [@ruslaniv](https://discuss.elastic.co/u/ruslaniv)\ **Replies:** 1\ **Last updated:** [September 30, 2022, 8:00am UTC](https://discuss.elastic.co/t/collapse-dense-vector-field-in-search-results/315517 "2022-09-30T08:00:57Z")
Hi! Is it possible to collapse or hide a dense\_vector field in the results returned by ES? When developing, I have to send a lot of queries to ES and then inspect the results and it is getting really tiresome to scroll… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=776) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=778)