# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=788 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 789 --- ## [Filebeat 8.4.1 slow](https://discuss.elastic.co/t/filebeat-8-4-1-slow/314783)
**Author:** [@rschwa2](https://discuss.elastic.co/u/rschwa2)\ **Replies:** 0\ **Last updated:** [September 20, 2022, 2:23pm UTC](https://discuss.elastic.co/t/filebeat-8-4-1-slow/314783 "2022-09-20T14:23:41Z")
I upgraded elk to 8.4.1 recently, from 8.3.2. I noticed that filebeat is much slower reading our zeek logs. I configured filebeat to read from one zeek log (conn.log) and output to the console (redirected to /dev/null)… --- ## [Elasticsearch Integration - unavailable?](https://discuss.elastic.co/t/elasticsearch-integration-unavailable/314315)
**Author:** [@Jack\_Judge2](https://discuss.elastic.co/u/Jack_Judge2)\ **Replies:** 9\ **Last updated:** [September 20, 2022, 11:34pm UTC](https://discuss.elastic.co/t/elasticsearch-integration-unavailable/314315 "2022-09-20T23:34:23Z")
Hi, I'm building a monitoring cluster built on an 8.1.1 stack and I noticed that the Elasticsearch integration for Agent isn't available but it is available on an older 7.17 stack. Elasticsearch integration docs This … --- ## [Fleet sever is automatically connected](https://discuss.elastic.co/t/fleet-sever-is-automatically-connected/314741)
**Author:** [@vikas-mishra](https://discuss.elastic.co/u/vikas-mishra)\ **Replies:** 1\ **Last updated:** [September 20, 2022, 11:14pm UTC](https://discuss.elastic.co/t/fleet-sever-is-automatically-connected/314741 "2022-09-20T23:14:23Z")
Hi there, I am trying to set up my fleet server. On my kibana page it was showing fleet server is connected. Even though I' have changed the host is it still connecting to the old fleet server ? Any how by ignoring it… --- ## [How can I Filebeat multiple files that are radically different](https://discuss.elastic.co/t/how-can-i-filebeat-multiple-files-that-are-radically-different/314350)
**Author:** [@dimmthewitted1](https://discuss.elastic.co/u/dimmthewitted1)\ **Replies:** 5\ **Last updated:** [September 20, 2022, 10:43pm UTC](https://discuss.elastic.co/t/how-can-i-filebeat-multiple-files-that-are-radically-different/314350 "2022-09-20T22:43:45Z")
Is this community still active ? I want to ingest two files from my web server, the apache access logs and the modsecurity logs. The modsecurity logs I will have to setup some serious GROK filters. Filebeat and my in… --- ## [Cannot connect to the Elasticsearch cluster](https://discuss.elastic.co/t/cannot-connect-to-the-elasticsearch-cluster/314786)
**Author:** [@jjimenez](https://discuss.elastic.co/u/jjimenez)\ **Replies:** 2\ **Last updated:** [September 20, 2022, 10:30pm UTC](https://discuss.elastic.co/t/cannot-connect-to-the-elasticsearch-cluster/314786 "2022-09-20T22:30:11Z")
Hi Everyone, I new with Kibana and Elasticsearch, I have a trouble with Kibana, when the users open Kibana show the error "Cannot connect to the Elasticsearch cluster", I search the error in the log of elasticsearch and … --- ## [How to guarantee percentage of result in multi\_match search](https://discuss.elastic.co/t/how-to-guarantee-percentage-of-result-in-multi-match-search/314792)
**Author:** [@Guilherme\_Mello](https://discuss.elastic.co/u/Guilherme_Mello)\ **Replies:** 1\ **Last updated:** [September 20, 2022, 10:28pm UTC](https://discuss.elastic.co/t/how-to-guarantee-percentage-of-result-in-multi-match-search/314792 "2022-09-20T22:28:31Z")
I have a search using multi\_match that returns products from multiple stores there is a business logic that i need to implement, which is: ensure that products from certain stores must appear on each pagination (30 ite… --- ## [JavaScript Client](https://discuss.elastic.co/t/javascript-client/314803)
**Author:** [@kbujold\_wr](https://discuss.elastic.co/u/kbujold_wr)\ **Replies:** 0\ **Last updated:** [September 20, 2022, 6:26pm UTC](https://discuss.elastic.co/t/javascript-client/314803 "2022-09-20T18:26:46Z")
Hi we have ELK on a server running 7.17.1 I am trying to use the JavaScript Client. I am following the instructions but I am getting this error Where buffer.constants is undefined in file 'webpack:///node\_modules/@e… --- ## [Table View not loading on Dashboard without manual "Refresh"](https://discuss.elastic.co/t/table-view-not-loading-on-dashboard-without-manual-refresh/313634)
**Author:** [@matled](https://discuss.elastic.co/u/matled)\ **Replies:** 2\ **Last updated:** [September 20, 2022, 8:14pm UTC](https://discuss.elastic.co/t/table-view-not-loading-on-dashboard-without-manual-refresh/313634 "2022-09-20T20:14:12Z")
Strange Issue, not sure how to debug. We habe a dashboards with several elements. Everything works fine except the table views they either don't load like below or generate the message "aborted". The query complexity is … --- ## [Fields .keyword](https://discuss.elastic.co/t/fields-keyword/314800)
**Author:** [@Kaname\_Nishioka](https://discuss.elastic.co/u/Kaname_Nishioka)\ **Replies:** 2\ **Last updated:** [September 20, 2022, 7:34pm UTC](https://discuss.elastic.co/t/fields-keyword/314800 "2022-09-20T19:34:27Z")
Hey guys, My first post in this community, I need reindex all my fields setting type to keyword, but when I do this, the field ".keyword" is removed and my dashboards is deployed using field ".keyword", Is it possible t… --- ## [Help - elastic integration](https://discuss.elastic.co/t/help-elastic-integration/314804)
**Author:** [@aperkins](https://discuss.elastic.co/u/aperkins)\ **Replies:** 1\ **Last updated:** [September 20, 2022, 7:15pm UTC](https://discuss.elastic.co/t/help-elastic-integration/314804 "2022-09-20T19:15:56Z")
Hope I'm in the right place - yesterday I fumbled through installing the elastic stack, setup an agent, a fleet server (all on the same server) So far installed - Elasticsearch, Logstash, Kibana, Metricsbeat. I've got i… --- ## [How to convert this date type to a readable type '1661126482845'](https://discuss.elastic.co/t/how-to-convert-this-date-type-to-a-readable-type-1661126482845/314782)
**Author:** [@Vitoria\_De\_Lara](https://discuss.elastic.co/u/Vitoria_De_Lara)\ **Replies:** 1\ **Last updated:** [September 20, 2022, 4:00pm UTC](https://discuss.elastic.co/t/how-to-convert-this-date-type-to-a-readable-type-1661126482845/314782 "2022-09-20T16:00:36Z")
I need to convert this date type to a readable date type in my file. conf, I'm using the json filter. I've tried several conversion models but it's not working. can anybody help me? --- ## [Rollover actions over custom field](https://discuss.elastic.co/t/rollover-actions-over-custom-field/314784)
**Author:** [@Nicolaegis](https://discuss.elastic.co/u/Nicolaegis)\ **Replies:** 5\ **Last updated:** [September 20, 2022, 3:50pm UTC](https://discuss.elastic.co/t/rollover-actions-over-custom-field/314784 "2022-09-20T15:50:11Z")
Hello, I would like to know if it is possible to make a rollover action for a custom date field, if not, it is possible to write a custom plugin to achieve this? Thank you --- ## [Watcher Query with filter](https://discuss.elastic.co/t/watcher-query-with-filter/314600)
**Author:** [@lchan](https://discuss.elastic.co/u/lchan)\ **Replies:** 2\ **Last updated:** [September 20, 2022, 1:45pm UTC](https://discuss.elastic.co/t/watcher-query-with-filter/314600 "2022-09-20T13:45:07Z")
Hi all, I am new and testing Watcher but for some reason I am not getting any hits count from this search. I am trying to search "Authentication failure" in the syslog index, get alerted if any hits are found in the la… --- ## [Query time increased after upgrade to ES version 8.3](https://discuss.elastic.co/t/query-time-increased-after-upgrade-to-es-version-8-3/314778)
**Author:** [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)\ **Replies:** 0\ **Last updated:** [September 20, 2022, 1:33pm UTC](https://discuss.elastic.co/t/query-time-increased-after-upgrade-to-es-version-8-3/314778 "2022-09-20T13:33:49Z")
Hello We are facing an issue with elasticsearch query performance where we are trying to query elasticsearch index it is recording more than 5 second for most of the queries, we are testing through jmeter Before versio… --- ## [Documents are no longer saved after high disk watermark exceeded on an elasticsearch cluster](https://discuss.elastic.co/t/documents-are-no-longer-saved-after-high-disk-watermark-exceeded-on-an-elasticsearch-cluster/313975)
**Author:** [@Khaled\_Saidi](https://discuss.elastic.co/u/Khaled_Saidi)\ **Replies:** 9\ **Last updated:** [September 19, 2022, 2:53pm UTC](https://discuss.elastic.co/t/documents-are-no-longer-saved-after-high-disk-watermark-exceeded-on-an-elasticsearch-cluster/313975 "2022-09-19T14:53:28Z")
Hi everyone, I have a question about how load balance work on an elasticsearch servers cluster. The cluster is composed by : 4 "master, data" nodes, 2 "data" nodes 1 "coordinator" node The warning "high disk waterma… --- ## [I m unable to restart the logstash after updating the conf.d file](https://discuss.elastic.co/t/i-m-unable-to-restart-the-logstash-after-updating-the-conf-d-file/314768)
**Author:** [@prashanthk](https://discuss.elastic.co/u/prashanthk)\ **Replies:** 1\ **Last updated:** [September 20, 2022, 12:06pm UTC](https://discuss.elastic.co/t/i-m-unable-to-restart-the-logstash-after-updating-the-conf-d-file/314768 "2022-09-20T12:06:02Z")
Im unable to start logstash after updating the conf.d file in logstash. i checked the logs it is showing as Attempted to resurrect connection to dead ES instance, but got an error. I need to start the logstash now. --- ## [Fleetserver installation](https://discuss.elastic.co/t/fleetserver-installation/314719)
**Author:** [@ttyser](https://discuss.elastic.co/u/ttyser)\ **Replies:** 0\ **Last updated:** [September 19, 2022, 6:17pm UTC](https://discuss.elastic.co/t/fleetserver-installation/314719 "2022-09-19T18:17:05Z")
Hello, After spending hours trying different types of configurations and running in circles through all the documentation I will try to find help here. The following setup is done completely on Proxmox. It should help … --- ## [Slow querying of elasticsearch logs](https://discuss.elastic.co/t/slow-querying-of-elasticsearch-logs/314751)
**Author:** [@Faisal\_Umer](https://discuss.elastic.co/u/Faisal_Umer)\ **Replies:** 5\ **Last updated:** [September 20, 2022, 10:44am UTC](https://discuss.elastic.co/t/slow-querying-of-elasticsearch-logs/314751 "2022-09-20T10:44:35Z")
We have an index with 90 primaries & 0 replicas and a new index is created each day. The volume grows up to 7-8TB per day. We have lifecycle policies where the index is moved from hot to warm nodes after 3 days and then … --- ## [Creating alert for low disk space (any server had less than 200mb free space for the /mount/logs mount point))](https://discuss.elastic.co/t/creating-alert-for-low-disk-space-any-server-had-less-than-200mb-free-space-for-the-mount-logs-mount-point/314769)
**Author:** [@Madhu24](https://discuss.elastic.co/u/Madhu24)\ **Replies:** 0\ **Last updated:** [September 20, 2022, 10:23am UTC](https://discuss.elastic.co/t/creating-alert-for-low-disk-space-any-server-had-less-than-200mb-free-space-for-the-mount-logs-mount-point/314769 "2022-09-20T10:23:45Z")
Can anyome help to write how can write a scrit to trigger notification to a slack channel using below sample and how to add aggregations for this and conditon as well. Thanks { "trigger": { "schedule": "60m" } }, "… --- ## [How to saved a query using API](https://discuss.elastic.co/t/how-to-saved-a-query-using-api/314683)
**Author:** [@Azhar\_Uddin1](https://discuss.elastic.co/u/Azhar_Uddin1)\ **Replies:** 3\ **Last updated:** [September 20, 2022, 10:05am UTC](https://discuss.elastic.co/t/how-to-saved-a-query-using-api/314683 "2022-09-20T10:05:51Z")
I am filtering out the elastic sample data using the elasticsearch client but how could I achieve to create a saved object using API (using Elasticsearch client) and apply it There is documentation for saved objects AP… --- ## [ElasticSearch: DSL Query](https://discuss.elastic.co/t/elasticsearch-dsl-query/314767)
**Author:** [@SalvoDM91](https://discuss.elastic.co/u/SalvoDM91)\ **Replies:** 0\ **Last updated:** [September 20, 2022, 9:58am UTC](https://discuss.elastic.co/t/elasticsearch-dsl-query/314767 "2022-09-20T09:58:49Z")
Hi guys, I am opening this topic because I have a problem with a large amount of data (14M). My dataset is composed as follows: {"h":{"id":"AA001","process":"AK01","update-timestamp":1663665372171}} {"h":{"id":"AA002",… --- ## [Cluster ElasticSearch Red](https://discuss.elastic.co/t/cluster-elasticsearch-red/314757)
**Author:** [@meyer1](https://discuss.elastic.co/u/meyer1)\ **Replies:** 5\ **Last updated:** [September 20, 2022, 9:10am UTC](https://discuss.elastic.co/t/cluster-elasticsearch-red/314757 "2022-09-20T09:10:10Z")
Hello everyone, here is my problem, I have my elastic cluster with a red status. I used this api : http://localhost:9200/\_cluster/health Answer: { cluster\_name : "elasticsearch", status : "red", timed\_out : false, num… --- ## [Logstash JDBC - All rows run only once](https://discuss.elastic.co/t/logstash-jdbc-all-rows-run-only-once/314756)
**Author:** [@tag\_v](https://discuss.elastic.co/u/tag_v)\ **Replies:** 0\ **Last updated:** [September 20, 2022, 8:54am UTC](https://discuss.elastic.co/t/logstash-jdbc-all-rows-run-only-once/314756 "2022-09-20T08:54:53Z")
I want to migrate DB table data with millions of rows to S3. I found jdbc plugin. But not clear how to make it run only once for all rows paginated way - The main question is on Scheduling: I don't want to run repeatedly… --- ## [How to detect and send bucket score merging 2 ML Job](https://discuss.elastic.co/t/how-to-detect-and-send-bucket-score-merging-2-ml-job/314729)
**Author:** [@minkiyo](https://discuss.elastic.co/u/minkiyo)\ **Replies:** 1\ **Last updated:** [September 20, 2022, 8:44am UTC](https://discuss.elastic.co/t/how-to-detect-and-send-bucket-score-merging-2-ml-job/314729 "2022-09-20T08:44:17Z")
I can get and check bucket score merging 2 ml job in anomaly exploreer using "edit job selection". additional, I wand to set alert rule merging two ml job. result type : bucket select job: only one job seleted....... … --- ## [Datastream rollover without dated](https://discuss.elastic.co/t/datastream-rollover-without-dated/314710)
**Author:** [@talShtark](https://discuss.elastic.co/u/talShtark)\ **Replies:** 2\ **Last updated:** [September 20, 2022, 8:41am UTC](https://discuss.elastic.co/t/datastream-rollover-without-dated/314710 "2022-09-20T08:41:30Z")
Hello, Im completely new to ES :slight\_smile: I create some indices and index template - "logs", with a datastream. The index template is attached to an Index Lifecycle Policy with automatic rollover (default settings… --- ## [Elasticsearch snapshot how it works](https://discuss.elastic.co/t/elasticsearch-snapshot-how-it-works/314711)
**Author:** [@xalastoi](https://discuss.elastic.co/u/xalastoi)\ **Replies:** 4\ **Last updated:** [September 20, 2022, 8:39am UTC](https://discuss.elastic.co/t/elasticsearch-snapshot-how-it-works/314711 "2022-09-20T08:39:29Z")
i want to understand how snapshot works in elasticsearch case1 snapshots are taken every day and snapshots older than 1 month are deleted I have an index cities and for example there are 3 documents { barcelona, ​​madrid… --- ## [Logstash filter string anywhere](https://discuss.elastic.co/t/logstash-filter-string-anywhere/314552)
**Author:** [@moberreiter](https://discuss.elastic.co/u/moberreiter)\ **Replies:** 5\ **Last updated:** [September 20, 2022, 8:37am UTC](https://discuss.elastic.co/t/logstash-filter-string-anywhere/314552 "2022-09-20T08:37:32Z")
Hi there, I want to filter firewall logs if some specific string matches anywhere in the message and do not know exactly how to do it. Sample Log message: {"zone\_src":"SOURCE","zone\_dst":"EXTERNAL","reason":"rule","ru… --- ## [Logstash S3 output prefix - Event field timestamp](https://discuss.elastic.co/t/logstash-s3-output-prefix-event-field-timestamp/314708)
**Author:** [@tag\_v](https://discuss.elastic.co/u/tag_v)\ **Replies:** 2\ **Last updated:** [September 20, 2022, 8:21am UTC](https://discuss.elastic.co/t/logstash-s3-output-prefix-event-field-timestamp/314708 "2022-09-20T08:21:48Z")
How to set Logstash S3 output prefix dynamically with an event field value in format: "%{+YYYY}/%{+MM}/%{+dd}/%{+HH}" ? input: {"record\_time":"2017-03-09T04:07:51.520Z"} required s3 prefix: 2017/03/09/04 --- ## [Filebeat sending events to Logstash output more than once](https://discuss.elastic.co/t/filebeat-sending-events-to-logstash-output-more-than-once/314560)
**Author:** [@stevesimpson](https://discuss.elastic.co/u/stevesimpson)\ **Replies:** 1\ **Last updated:** [September 20, 2022, 8:21am UTC](https://discuss.elastic.co/t/filebeat-sending-events-to-logstash-output-more-than-once/314560 "2022-09-20T08:21:17Z")
I have Filebeat configured with Loadbalance: True with multiple Logstash servers in the Logstash Output. Everything works fine, I see a nice distribution across all of the Logstash instances. To prevent duplicates I hav… --- ## [Filebeat will hang forever until you force a shutdown with "kill -9"](https://discuss.elastic.co/t/filebeat-will-hang-forever-until-you-force-a-shutdown-with-kill-9/314407)
**Author:** [@silence-linhl](https://discuss.elastic.co/u/silence-linhl)\ **Replies:** 2\ **Last updated:** [September 20, 2022, 8:16am UTC](https://discuss.elastic.co/t/filebeat-will-hang-forever-until-you-force-a-shutdown-with-kill-9/314407 "2022-09-20T08:16:48Z")
When I start filebeat with the config file below, I can't stop it using Ctrl + C config file : debug.yaml # genaral max\_procs: 1 logging.metrics.enabled: false # log logging.to\_files: true logging.files: path: /data… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=787) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=789)