# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=782 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 783 --- ## [How to ignore exceptions and read the next offset of kafka](https://discuss.elastic.co/t/how-to-ignore-exceptions-and-read-the-next-offset-of-kafka/315235)
**Author:** [@lythen](https://discuss.elastic.co/u/lythen)\ **Replies:** 0\ **Last updated:** [September 27, 2022, 6:49am UTC](https://discuss.elastic.co/t/how-to-ignore-exceptions-and-read-the-next-offset-of-kafka/315235 "2022-09-27T06:49:03Z")
My Logstash is used in reading the data of kafka and sending them to Elasticsearch. But now I 'm facing some problems,sucsh as when the index was frozen in ES, the Logstash would throw an exception and then, the Logstash… --- ## [Conditional sorting by different text fields in Elastic Search Query](https://discuss.elastic.co/t/conditional-sorting-by-different-text-fields-in-elastic-search-query/315231)
**Author:** [@christianholsen](https://discuss.elastic.co/u/christianholsen)\ **Replies:** 0\ **Last updated:** [September 27, 2022, 5:58am UTC](https://discuss.elastic.co/t/conditional-sorting-by-different-text-fields-in-elastic-search-query/315231 "2022-09-27T05:58:11Z")
I have a problem sorting some data in an Elastic Search index. My data in ES are documents with a default name and possibly translation of the name can be found in a translations nested structure: \[ { "defaultName"… --- ## [A simple answer to QA question: how does Elasticsearch work?](https://discuss.elastic.co/t/a-simple-answer-to-qa-question-how-does-elasticsearch-work/315223)
**Author:** [@catmanjan](https://discuss.elastic.co/u/catmanjan)\ **Replies:** 12\ **Last updated:** [September 27, 2022, 5:26am UTC](https://discuss.elastic.co/t/a-simple-answer-to-qa-question-how-does-elasticsearch-work/315223 "2022-09-27T05:26:34Z")
Lets say I have a very simple Elasticsearch index, 100,000 documents with a single field called "text" which was indexed using the default text analyzer A QA engineer wants to know, when they type something in, what sho… --- ## [Trying to install output mongodb](https://discuss.elastic.co/t/trying-to-install-output-mongodb/314309)
**Author:** [@Niels434](https://discuss.elastic.co/u/Niels434)\ **Replies:** 6\ **Last updated:** [September 27, 2022, 5:23am UTC](https://discuss.elastic.co/t/trying-to-install-output-mongodb/314309 "2022-09-27T05:23:08Z")
I'm trying to get the output plugin MongoDB for the Logstash pipeline installed. But i'm getting an error code: jruby: warning: unknown property jruby.mx1g jruby: warning: unknown property jruby.ms1g jruby: unknown o… --- ## [Regarding duplicacy of logs through filebeat at kibana](https://discuss.elastic.co/t/regarding-duplicacy-of-logs-through-filebeat-at-kibana/314365)
**Author:** [@Priyanka\_chauhan](https://discuss.elastic.co/u/Priyanka_chauhan)\ **Replies:** 8\ **Last updated:** [September 27, 2022, 4:23am UTC](https://discuss.elastic.co/t/regarding-duplicacy-of-logs-through-filebeat-at-kibana/314365 "2022-09-27T04:23:34Z")
Hi, As attached screenshot of kibana, logs are repeated with same message in two format, only difference of it log.file.path as I seen here. These dhcp logs are coming through filebeat to kafka. Logs flow is: filebea… --- ## [Logstash circuit breaking](https://discuss.elastic.co/t/logstash-circuit-breaking/315049)
**Author:** [@Harper\_S1](https://discuss.elastic.co/u/Harper_S1)\ **Replies:** 2\ **Last updated:** [September 27, 2022, 3:24am UTC](https://discuss.elastic.co/t/logstash-circuit-breaking/315049 "2022-09-27T03:24:11Z")
Hi, Do anyone know how to solve this circuit breaking exception in logstash (7.10). \[2022-09-23T14:38:22,920\]\[INFO \]\[logstash.outputs.elasticsearch\]\[main\]\[299ec4f1e5994d0fe7b59d4e4d29f50e734f0d6401d909dc198ecbc402ca398… --- ## [Deleted Elasticsearch http\_ca.crt](https://discuss.elastic.co/t/deleted-elasticsearch-http-ca-crt/315225)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [September 27, 2022, 3:17am UTC](https://discuss.elastic.co/t/deleted-elasticsearch-http-ca-crt/315225 "2022-09-27T03:17:37Z")
A client, who has logstash and a elastic node in the same machine, was having problem indexing data with logstash, the cacert configuration in the logstash output was pointing to the elasticsearch directory where he h… --- ## [Restricting Elastic Cluster Access From Browser and unwanted Servers](https://discuss.elastic.co/t/restricting-elastic-cluster-access-from-browser-and-unwanted-servers/315208)
**Author:** [@sanjaykumr](https://discuss.elastic.co/u/sanjaykumr)\ **Replies:** 1\ **Last updated:** [September 27, 2022, 2:41am UTC](https://discuss.elastic.co/t/restricting-elastic-cluster-access-from-browser-and-unwanted-servers/315208 "2022-09-27T02:41:18Z")
We have 5 Node Cluster with 3 Master Nodes , 3 Coord nodes and 6 Data Nodes. Currently we can view the content of Elastic cluster via browser using the url \["" http://hostname:9200/\_cat/nodes""\] , we want access from th… --- ## [Skipping security auto configuration](https://discuss.elastic.co/t/skipping-security-auto-configuration/315173)
**Author:** [@cdy5159](https://discuss.elastic.co/u/cdy5159)\ **Replies:** 1\ **Last updated:** [September 27, 2022, 12:12am UTC](https://discuss.elastic.co/t/skipping-security-auto-configuration/315173 "2022-09-27T00:12:41Z")
I'm attempting to build a 3 node cluster with Elastic 8.2.3. I can build the first node as a single node cluster successfully and connect with kibana. My problem is adding nodes. On the first node, I've run the comman… --- ## [Kibana Create Role API returns 404](https://discuss.elastic.co/t/kibana-create-role-api-returns-404/315211)
**Author:** [@jlos](https://discuss.elastic.co/u/jlos)\ **Replies:** 3\ **Last updated:** [September 26, 2022, 11:25pm UTC](https://discuss.elastic.co/t/kibana-create-role-api-returns-404/315211 "2022-09-26T23:25:48Z")
Hello, I know this is technically a duplicate of this discussion right here, but I'm not satisfied with the outcome of it. I'm attempting to use Kibana's create/update role API to create a user role. I'm following the … --- ## [Duplicate data from filebeat (input type: log)](https://discuss.elastic.co/t/duplicate-data-from-filebeat-input-type-log/315221)
**Author:** [@sathishpal](https://discuss.elastic.co/u/sathishpal)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 11:27pm UTC](https://discuss.elastic.co/t/duplicate-data-from-filebeat-input-type-log/315221 "2022-09-26T23:27:23Z")
Hi All, Duplicate data is sent from Filebeat. When I start the elastic agent, I can see two filebeat processes running. If I Kill the first one it auto restarts and the second one disappears when I kill it twice. Once … --- ## [Full space /var/lib/elasticsearch](https://discuss.elastic.co/t/full-space-var-lib-elasticsearch/315197)
**Author:** [@Diego\_Santos](https://discuss.elastic.co/u/Diego_Santos)\ **Replies:** 3\ **Last updated:** [September 26, 2022, 10:13pm UTC](https://discuss.elastic.co/t/full-space-var-lib-elasticsearch/315197 "2022-09-26T22:13:08Z")
Hi everyone, I have my /var/lib/elasticsearch filesystem reached 100%. Could you please tell me what I can do? health status index uuid pri rep docs.count docs.del… --- ## [Create a POST body for a search](https://discuss.elastic.co/t/create-a-post-body-for-a-search/315201)
**Author:** [@Sergio\_vrijk](https://discuss.elastic.co/u/Sergio_vrijk)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 6:38pm UTC](https://discuss.elastic.co/t/create-a-post-body-for-a-search/315201 "2022-09-26T18:38:20Z")
I would like some help on a query that I am trying. I have three fields in my JSON. The field1.key, field2.key and field3 which has a nest of data1,data2,data3. What I am trying to do is. Get per unique combination of th… --- ## [Primary Shard Allocation\_Failed](https://discuss.elastic.co/t/primary-shard-allocation-failed/315033)
**Author:** [@ivandbarria](https://discuss.elastic.co/u/ivandbarria)\ **Replies:** 4\ **Last updated:** [September 26, 2022, 9:32pm UTC](https://discuss.elastic.co/t/primary-shard-allocation-failed/315033 "2022-09-26T21:32:23Z")
Hello, Hope everyone is doing great. We had a power outage and our ES server went down. When the server went back online I noticed ES status on red: "cluster\_name" : "elasticsearch", "status" : "red", "timed\_out" : … --- ## [Logstash + datastreams](https://discuss.elastic.co/t/logstash-datastreams/315210)
**Author:** [@Zdeno\_Liska](https://discuss.elastic.co/u/Zdeno_Liska)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 7:33pm UTC](https://discuss.elastic.co/t/logstash-datastreams/315210 "2022-09-26T19:33:46Z")
Hi, I have issue with configuration of Logstash and Datastreams with already defined ILM,index template here are details: Logstash pipeline config: elasticsearch { hosts =\> \["host1"\] data\_stream =\> "true" … --- ## [Error multiples inputs - block in multifilter, block in start\_workers, ParseException: No close tag for /log4j:event/log4j:throwable](https://discuss.elastic.co/t/error-multiples-inputs-block-in-multifilter-block-in-start-workers-parseexception-no-close-tag-for-log4j-event-log4j-throwable/315106)
**Author:** [@erwin339](https://discuss.elastic.co/u/erwin339)\ **Replies:** 4\ **Last updated:** [September 26, 2022, 6:54pm UTC](https://discuss.elastic.co/t/error-multiples-inputs-block-in-multifilter-block-in-start-workers-parseexception-no-close-tag-for-log4j-event-log4j-throwable/315106 "2022-09-26T18:54:15Z")
Context: I have 4 folders, one contains logstash, the other 3 each contain filebeat, the first acts as if an application launched log, the second with 2 applications that send logs for which filebeat has 2 entries, and t… --- ## [Facing issue in kibana after upgrading 8.4](https://discuss.elastic.co/t/facing-issue-in-kibana-after-upgrading-8-4/315082)
**Author:** [@gone](https://discuss.elastic.co/u/gone)\ **Replies:** 1\ **Last updated:** [September 26, 2022, 6:51pm UTC](https://discuss.elastic.co/t/facing-issue-in-kibana-after-upgrading-8-4/315082 "2022-09-26T18:51:17Z")
Hi All, we are facing one issue with kibana after upgarding SO to 2.3.160 version. whenever i am clicking on any of the kibana dashboard field its throwing me thi s error. --- ## [Authentication failed for null](https://discuss.elastic.co/t/authentication-failed-for-null/314389)
**Author:** [@lcsb-sysadmins](https://discuss.elastic.co/u/lcsb-sysadmins)\ **Replies:** 1\ **Last updated:** [September 26, 2022, 6:48pm UTC](https://discuss.elastic.co/t/authentication-failed-for-null/314389 "2022-09-26T18:48:53Z")
Hello everyone! I'm setting up a new elastic cluster and I have an issue with with alerts in Kibana. I have the following error for each alert in jarvis-cluster.log \[2022-09-14T10:43:56,623\]\[WARN \]\[c.f.s.a.b.RequestAu… --- ## [Why is the error log being sent divided?](https://discuss.elastic.co/t/why-is-the-error-log-being-sent-divided/315192)
**Author:** [@erwin339](https://discuss.elastic.co/u/erwin339)\ **Replies:** 1\ **Last updated:** [September 26, 2022, 6:08pm UTC](https://discuss.elastic.co/t/why-is-the-error-log-being-sent-divided/315192 "2022-09-26T18:08:56Z")
I am sending error and fatal logs, these have multiple lines, so the multiline is configured like this: filebeat multiline: This is throwing me an error: my error and fatal log have this structure: \ **Author:** [@st11x](https://discuss.elastic.co/u/st11x)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 5:49pm UTC](https://discuss.elastic.co/t/cannot-find-answers-to-prefix-queries-and-max-expansion/315196 "2022-09-26T17:49:10Z") I have seen many posts asking the same question with elaborate examples and most never got answered and got closed by the bot. With a phrase query like "quick brown f" as in the example on Match phrase prefix query | El… --- ## [Error restoring state from URL Unable to completely restore the URL, be sure to use the share functionality](https://discuss.elastic.co/t/error-restoring-state-from-url-unable-to-completely-restore-the-url-be-sure-to-use-the-share-functionality/314925)
**Author:** [@Irwan\_Kurniawan](https://discuss.elastic.co/u/Irwan_Kurniawan)\ **Replies:** 1\ **Last updated:** [September 26, 2022, 5:46pm UTC](https://discuss.elastic.co/t/error-restoring-state-from-url-unable-to-completely-restore-the-url-be-sure-to-use-the-share-functionality/314925 "2022-09-26T17:46:13Z")
When I open Kibana, it show error like this. I search on discussion and nobody answer. How to fix it? --- ## [Kibana Canvas error: Invalid string. Length must be a multiple of 4](https://discuss.elastic.co/t/kibana-canvas-error-invalid-string-length-must-be-a-multiple-of-4/314286)
**Author:** [@bhavya](https://discuss.elastic.co/u/bhavya)\ **Replies:** 1\ **Last updated:** [September 26, 2022, 5:42pm UTC](https://discuss.elastic.co/t/kibana-canvas-error-invalid-string-length-must-be-a-multiple-of-4/314286 "2022-09-26T17:42:40Z")
I am using version 7.16.2 of Kibana. I am adding a dropdown filter in Canvas. Let's say the index pattern is \*-\*\_stage. This index pattern includes 100 data streams. When trying to add this index pattern in the Canva… --- ## [Logstash not working with jdk 11.0.16](https://discuss.elastic.co/t/logstash-not-working-with-jdk-11-0-16/315105)
**Author:** [@shivani\_aggarwal](https://discuss.elastic.co/u/shivani_aggarwal)\ **Replies:** 4\ **Last updated:** [September 26, 2022, 5:38pm UTC](https://discuss.elastic.co/t/logstash-not-working-with-jdk-11-0-16/315105 "2022-09-26T17:38:35Z")
Hi, Version details: Logstash - logstash-oss:7.17.3 OS: centos7 java version: java-11-openjdk-11.0.16.0.8 Background: On a centos-based docker image, I install java, followed by the logstash-oss rpm and use this in … --- ## [Using leader election condition in fleet managed Custom Logs integration doesn't work](https://discuss.elastic.co/t/using-leader-election-condition-in-fleet-managed-custom-logs-integration-doesnt-work/314591)
**Author:** [@woodywoodsta](https://discuss.elastic.co/u/woodywoodsta)\ **Replies:** 1\ **Last updated:** [September 26, 2022, 5:07pm UTC](https://discuss.elastic.co/t/using-leader-election-condition-in-fleet-managed-custom-logs-integration-doesnt-work/314591 "2022-09-26T17:07:01Z")
I have a fleet managed Daemonset of agents which are assigned a policy including the Custom Logs integration. I want to collect logs which are duplicated across all nodes, so I'm only interested in one of the agents ship… --- ## [Remove\_fields doesn't remove field in json](https://discuss.elastic.co/t/remove-fields-doesnt-remove-field-in-json/315176)
**Author:** [@Kostyantyn\_Dobriohlo](https://discuss.elastic.co/u/Kostyantyn_Dobriohlo)\ **Replies:** 2\ **Last updated:** [September 26, 2022, 4:53pm UTC](https://discuss.elastic.co/t/remove-fields-doesnt-remove-field-in-json/315176 "2022-09-26T16:53:23Z")
Cannot remove fields in json, 'cause always have a json parsing error. Tried many different ways, but inside the json nothing changes. And there is a warning in logs: Error parsing json Config file: input { tcp { … --- ## [OutOfDirectMemoryError: failed in Logstash logs](https://discuss.elastic.co/t/outofdirectmemoryerror-failed-in-logstash-logs/315145)
**Author:** [@madurad](https://discuss.elastic.co/u/madurad)\ **Replies:** 2\ **Last updated:** [September 26, 2022, 4:45pm UTC](https://discuss.elastic.co/t/outofdirectmemoryerror-failed-in-logstash-logs/315145 "2022-09-26T16:45:13Z")
Hi, Continuously getting OutOfDirectMemoryError: failed error on Logstash, I chekced the host memory usage and CPU all good and memory is around 60% used, but no clear idea how this issue is being happened. In jvm.opt… --- ## [I can't access my elasticsearch , since it's already running in my terminal](https://discuss.elastic.co/t/i-cant-access-my-elasticsearch-since-its-already-running-in-my-terminal/315183)
**Author:** [@Vitoria\_De\_Lara](https://discuss.elastic.co/u/Vitoria_De_Lara)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 3:04pm UTC](https://discuss.elastic.co/t/i-cant-access-my-elasticsearch-since-its-already-running-in-my-terminal/315183 "2022-09-26T15:04:50Z")
Good morning guys, I'm trying to access my elasticsearch but so far without success. I installed it on my centos8 virtual machine and it is already running. I gave a netstat -na to see and it says that I have to enable … --- ## [Does \_split actually splits data or just copies it across shards](https://discuss.elastic.co/t/does-split-actually-splits-data-or-just-copies-it-across-shards/315164)
**Author:** [@danskiyq](https://discuss.elastic.co/u/danskiyq)\ **Replies:** 4\ **Last updated:** [September 26, 2022, 3:50pm UTC](https://discuss.elastic.co/t/does-split-actually-splits-data-or-just-copies-it-across-shards/315164 "2022-09-26T15:50:13Z")
I want to create a new index with bigger amount of shards and copy my data across. \_reindex would probably be the best solution, but I expected split to do what I wanted. So I have 38gb 1shard index and I wanted to spli… --- ## [Watcher : parsing index to get values to be used in watchers](https://discuss.elastic.co/t/watcher-parsing-index-to-get-values-to-be-used-in-watchers/315041)
**Author:** [@JohnJ\_M](https://discuss.elastic.co/u/JohnJ_M)\ **Replies:** 2\ **Last updated:** [September 26, 2022, 3:49pm UTC](https://discuss.elastic.co/t/watcher-parsing-index-to-get-values-to-be-used-in-watchers/315041 "2022-09-26T15:49:50Z")
Hello the community, first post for me so please excuse my possible mistakes. Here is my issue: I am using the watcher in Elastic v7.13.4. I am using watcher to send mail to my customers to produce audit report on dif… --- ## [Unable to change JVM heap file in Elastic search 5.4.0](https://discuss.elastic.co/t/unable-to-change-jvm-heap-file-in-elastic-search-5-4-0/315186)
**Author:** [@TharinduK](https://discuss.elastic.co/u/TharinduK)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 3:33pm UTC](https://discuss.elastic.co/t/unable-to-change-jvm-heap-file-in-elastic-search-5-4-0/315186 "2022-09-26T15:33:33Z")
5 Nodes 7 GB memory - 3.5 GB JVM heap file Indices - 62 Primary Shared 222 Replica Shared 157 We have been tried to change jvm.option file in /etc/elasticsearch but it is not reflecting in Kibana dashboard. [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=781) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=783)