# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=800 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 801 --- ## [Logstash create plugin tutorial](https://discuss.elastic.co/t/logstash-create-plugin-tutorial/314031)
**Author:** [@Laurent\_DEGEN](https://discuss.elastic.co/u/Laurent_DEGEN)\ **Replies:** 0\ **Last updated:** [September 9, 2022, 5:31am UTC](https://discuss.elastic.co/t/logstash-create-plugin-tutorial/314031 "2022-09-09T05:31:31Z")
Hi, I'am looking for good/updated ressources to learn how to create a codec-plugin. I have tried to follow this one : How to write a Logstash codec plugin | Logstash Reference \[8.4\] | Elastic ( I used the plugin genera… --- ## [Elastic Log data transfer in remote server](https://discuss.elastic.co/t/elastic-log-data-transfer-in-remote-server/314029)
**Author:** [@saifulshihab](https://discuss.elastic.co/u/saifulshihab)\ **Replies:** 0\ **Last updated:** [September 9, 2022, 4:06am UTC](https://discuss.elastic.co/t/elastic-log-data-transfer-in-remote-server/314029 "2022-09-09T04:06:49Z")
I have 3 node cluster all three node have same configuration node.master: true node.data: true so now my storage i filled up almost 800GB. I want to transfer some data for future reference from the path : /var/lib/el… --- ## [Health agent but no data sent to fleet server / elasticsearch?](https://discuss.elastic.co/t/health-agent-but-no-data-sent-to-fleet-server-elasticsearch/313559)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 1\ **Last updated:** [September 9, 2022, 3:56am UTC](https://discuss.elastic.co/t/health-agent-but-no-data-sent-to-fleet-server-elasticsearch/313559 "2022-09-09T03:56:07Z")
Hi there, I am running an all-in-one node with elasticsearch, kibana, logstash all 7.17.4 and fleet running. I have 2 agents. One on the this all-in-one node. The other installes to a second, empy ubuntu VM - just to co… --- ## [Unable to export Kibana dashboard using API](https://discuss.elastic.co/t/unable-to-export-kibana-dashboard-using-api/313941)
**Author:** [@rt\_888](https://discuss.elastic.co/u/rt_888)\ **Replies:** 13\ **Last updated:** [September 9, 2022, 3:26am UTC](https://discuss.elastic.co/t/unable-to-export-kibana-dashboard-using-api/313941 "2022-09-09T03:26:49Z")
// curl -X POST “http://localhost:5601/api/saved\_objects/\_export” -H ‘kbn-xsrf: true’ -H ‘Content-Type: application/json’ -d’ { “type”: “index-pattern” } ‘ I use this as to export my dashboard but i get the error "Incor… --- ## [Fleet Server not respecting custom port config](https://discuss.elastic.co/t/fleet-server-not-respecting-custom-port-config/313590)
**Author:** [@bfarren240](https://discuss.elastic.co/u/bfarren240)\ **Replies:** 4\ **Last updated:** [September 9, 2022, 1:00am UTC](https://discuss.elastic.co/t/fleet-server-not-respecting-custom-port-config/313590 "2022-09-09T01:00:00Z")
Upgraded ES and Kibana from 8.1.2 -\> 8.4.1. Un-enrolled my fleet server, and deployed a new fleet server agent with the following (newly created in 8.4.1) config: However, the elastic agent does not respect the … --- ## [LEAK: ByteBuf.release() was not called before it's garbage-collected](https://discuss.elastic.co/t/leak-bytebuf-release-was-not-called-before-its-garbage-collected/313658)
**Author:** [@Orwell-coder](https://discuss.elastic.co/u/Orwell-coder)\ **Replies:** 6\ **Last updated:** [September 9, 2022, 12:44am UTC](https://discuss.elastic.co/t/leak-bytebuf-release-was-not-called-before-its-garbage-collected/313658 "2022-09-09T00:44:48Z")
Hello, everyone. I have a problem I have never encountered, so I need some help. I have a single-type es node , the es node is runing by docker contianer. Host Version: CentOS 8.3 x64. Docker Version: 20.10.5. ES Ve… --- ## [Issue with selecting date fields from the \`jdbc\_streaming\` \`filter\` plugin](https://discuss.elastic.co/t/issue-with-selecting-date-fields-from-the-jdbc-streaming-filter-plugin/314023)
**Author:** [@nkumarcc](https://discuss.elastic.co/u/nkumarcc)\ **Replies:** 0\ **Last updated:** [September 8, 2022, 10:39pm UTC](https://discuss.elastic.co/t/issue-with-selecting-date-fields-from-the-jdbc-streaming-filter-plugin/314023 "2022-09-08T22:39:34Z")
I have a nested field in my Elasticsearch mapping which holds an array of objects. We wanted to add this array to records via a jdbc\_streaming filter. However, 2 of the fields we query for are timestamp fields, which cau… --- ## [Unable to access Kibana with 500 Internal Server Error](https://discuss.elastic.co/t/unable-to-access-kibana-with-500-internal-server-error/313842)
**Author:** [@m-amano](https://discuss.elastic.co/u/m-amano)\ **Replies:** 5\ **Last updated:** [September 8, 2022, 9:04pm UTC](https://discuss.elastic.co/t/unable-to-access-kibana-with-500-internal-server-error/313842 "2022-09-08T21:04:45Z")
Elastic Cloud version 7.17.6. After I deleted these indices, I could not access to Kibana or Elasticsearch in Elastic Cloud. .apm-agent-configuration .apm-custom-link .async-search .fleet-enrollment-api-keys-7 .fleet-p… --- ## [Add Elastic Agent tags to log events](https://discuss.elastic.co/t/add-elastic-agent-tags-to-log-events/312737)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 7\ **Last updated:** [September 8, 2022, 7:58pm UTC](https://discuss.elastic.co/t/add-elastic-agent-tags-to-log-events/312737 "2022-09-08T19:58:53Z")
Is there a way to append the Elastic Agent tags to the event, or at least to log events? My use case is that I designate agents by application environment (e.g., dev/qa/stage/prod), and would like that tag to be availabl… --- ## [Permissions error for creating a Enrich (.enrich-\*) index after following docs](https://discuss.elastic.co/t/permissions-error-for-creating-a-enrich-enrich-index-after-following-docs/314014)
**Author:** [@Madhav\_Sharma](https://discuss.elastic.co/u/Madhav_Sharma)\ **Replies:** 2\ **Last updated:** [September 8, 2022, 6:47pm UTC](https://discuss.elastic.co/t/permissions-error-for-creating-a-enrich-enrich-index-after-following-docs/314014 "2022-09-08T18:47:54Z")
I tied using the dev\_tools console to create a .enrich-\* index and i got: "action \[indices:admin/create\] is unauthorized for user \[foo@bar.com\] with roles \[superuser\] on restricted indices \[.enrich-foobar\], this action… --- ## [Logstash remove N/A field](https://discuss.elastic.co/t/logstash-remove-n-a-field/314002)
**Author:** [@mleg](https://discuss.elastic.co/u/mleg)\ **Replies:** 1\ **Last updated:** [September 8, 2022, 6:29pm UTC](https://discuss.elastic.co/t/logstash-remove-n-a-field/314002 "2022-09-08T18:29:11Z")
I am trying to remove all the fields which have N/A next to the them like "toto: N/A", I am currently removing them with a enormous IF forest which I have hard coded but I would like a better alternative, to an enormous … --- ## [Redirecting stdout to /dev/null](https://discuss.elastic.co/t/redirecting-stdout-to-dev-null/313973)
**Author:** [@jatindavey](https://discuss.elastic.co/u/jatindavey)\ **Replies:** 2\ **Last updated:** [September 8, 2022, 6:02pm UTC](https://discuss.elastic.co/t/redirecting-stdout-to-dev-null/313973 "2022-09-08T18:02:57Z")
Hi I am not sure if this has already been discussed in the forums but i could not find a definitive help in this regard. Basically when i run logstash as a systemd service , whenever logstash gets log files for process… --- ## [Create visualization table horizontally aligned](https://discuss.elastic.co/t/create-visualization-table-horizontally-aligned/313529)
**Author:** [@Alice\_Ionescu](https://discuss.elastic.co/u/Alice_Ionescu)\ **Replies:** 1\ **Last updated:** [September 8, 2022, 5:56pm UTC](https://discuss.elastic.co/t/create-visualization-table-horizontally-aligned/313529 "2022-09-08T17:56:11Z")
Hello, Is there a possibility to create a new visualization to look like this: ||column\_name ||column\_value|| ||column\_name ||column\_value|| And display information only on a row from an index. Thanks! --- ## [Packetbeat not monitoring https protocol](https://discuss.elastic.co/t/packetbeat-not-monitoring-https-protocol/313766)
**Author:** [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)\ **Replies:** 1\ **Last updated:** [September 8, 2022, 5:50pm UTC](https://discuss.elastic.co/t/packetbeat-not-monitoring-https-protocol/313766 "2022-09-08T17:50:36Z")
Hello Environment detail - We are having Elasticsearch cluster running with secured http port 9200, 9201 & 9202 with version 8.3 We have installed packetbeat v8.3 on elasticsearch server to monitor the http traffic on… --- ## [Packetbeat recording high responce time for connections](https://discuss.elastic.co/t/packetbeat-recording-high-responce-time-for-connections/313772)
**Author:** [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)\ **Replies:** 3\ **Last updated:** [September 8, 2022, 5:24pm UTC](https://discuss.elastic.co/t/packetbeat-recording-high-responce-time-for-connections/313772 "2022-09-08T17:24:00Z")
Hello Environment detail - Packetbeat 8.3 installed on Elasticsearch 8.3 server to monitor the completed connections duration. where we want to know in what time duration the incoming query search connection got comple… --- ## [Elasticsearch get exited and shows unhealthy status in docker container](https://discuss.elastic.co/t/elasticsearch-get-exited-and-shows-unhealthy-status-in-docker-container/313931)
**Author:** [@paris1](https://discuss.elastic.co/u/paris1)\ **Replies:** 14\ **Last updated:** [September 8, 2022, 5:06pm UTC](https://discuss.elastic.co/t/elasticsearch-get-exited-and-shows-unhealthy-status-in-docker-container/313931 "2022-09-08T17:06:49Z")
I Run Elasticsearch on docker production on aws ec2(ubuntu).It was working fine.my elasticsearch got exited today after I updated an index I started again manually.after this the status of the containers changed to unhea… --- ## [Filebeat not sending/error sending data to logstash](https://discuss.elastic.co/t/filebeat-not-sending-error-sending-data-to-logstash/314005)
**Author:** [@alex\_96](https://discuss.elastic.co/u/alex_96)\ **Replies:** 0\ **Last updated:** [September 8, 2022, 3:14pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-error-sending-data-to-logstash/314005 "2022-09-08T15:14:49Z")
Hello, I'm trying to send mysql logs to logstash, initially there was only logstash configuration, but I ran into the fact that filebeat sent messages in encoded form, so I had to redo the filebeat config, here it is: #… --- ## [Field missing when select Top Hit on Y-axis for bar chart](https://discuss.elastic.co/t/field-missing-when-select-top-hit-on-y-axis-for-bar-chart/313442)
**Author:** [@siwapong.cha](https://discuss.elastic.co/u/siwapong.cha)\ **Replies:** 3\ **Last updated:** [September 8, 2022, 2:22pm UTC](https://discuss.elastic.co/t/field-missing-when-select-top-hit-on-y-axis-for-bar-chart/313442 "2022-09-08T14:22:44Z")
Hi all, I'm trying to use Top Hit on my bar chart but many fields are missing from the field selection. Below are my custom field which came from filebeat (ansible.xxxxxx) Here when I selected Top Hit, all my ansi… --- ## [Closing index and memory missing warning?](https://discuss.elastic.co/t/closing-index-and-memory-missing-warning/313993)
**Author:** [@ewolfman](https://discuss.elastic.co/u/ewolfman)\ **Replies:** 2\ **Last updated:** [September 8, 2022, 2:14pm UTC](https://discuss.elastic.co/t/closing-index-and-memory-missing-warning/313993 "2022-09-08T14:14:23Z")
Continuing the discussion from Does close index free up disk or memory: Maybe this warning about losing data ("To reduce the risk of data loss..." Open / Close Index API | Elasticsearch Guide \[6.8\] | Elastic) from 6.8 d… --- ## [Prometheus metrics coming in slowly](https://discuss.elastic.co/t/prometheus-metrics-coming-in-slowly/313921)
**Author:** [@Renato\_D](https://discuss.elastic.co/u/Renato_D)\ **Replies:** 2\ **Last updated:** [September 8, 2022, 1:47pm UTC](https://discuss.elastic.co/t/prometheus-metrics-coming-in-slowly/313921 "2022-09-08T13:47:05Z")
I'm not entirely sure what is causing this. autodiscover is configured like so: - type: kubernetes include\_annotations: \["prometheus.io.scrape", "prometheus.io.port"\] resource: service templates: - condition:… --- ## [Kibana - does not highlight search results](https://discuss.elastic.co/t/kibana-does-not-highlight-search-results/312806)
**Author:** [@elkuser1234](https://discuss.elastic.co/u/elkuser1234)\ **Replies:** 1\ **Last updated:** [September 8, 2022, 1:29pm UTC](https://discuss.elastic.co/t/kibana-does-not-highlight-search-results/312806 "2022-09-08T13:29:26Z")
Hello I don't understand why when searching through kibana, it doesn't highlight the result for the log\_message field. "log\_message" is the parsed "message" field, by grok. I can only assume that the kibana is not … --- ## [Logstash: filter unique key documents](https://discuss.elastic.co/t/logstash-filter-unique-key-documents/313880)
**Author:** [@Moshe\_Sharon1](https://discuss.elastic.co/u/Moshe_Sharon1)\ **Replies:** 4\ **Last updated:** [September 8, 2022, 1:08pm UTC](https://discuss.elastic.co/t/logstash-filter-unique-key-documents/313880 "2022-09-08T13:08:37Z")
Hello, We have an index which has multiple documents with the same phone number. Each document will always contain the phone number and may contain additional information (see example below) The documents are written … --- ## [Kibana report generate using docker based configuration](https://discuss.elastic.co/t/kibana-report-generate-using-docker-based-configuration/313996)
**Author:** [@maadhav](https://discuss.elastic.co/u/maadhav)\ **Replies:** 0\ **Last updated:** [September 8, 2022, 1:03pm UTC](https://discuss.elastic.co/t/kibana-report-generate-using-docker-based-configuration/313996 "2022-09-08T13:03:14Z")
Hi Team We have Docker based multi-node ES cluster v7.17.4. Kibana also runs as a docker container. When we try to generate a PDF report from Canvas, it shows following error: Error: Max attempts (3) reached for job l… --- ## [How to get the value in aggregations in watcher](https://discuss.elastic.co/t/how-to-get-the-value-in-aggregations-in-watcher/313526)
**Author:** [@upreddy](https://discuss.elastic.co/u/upreddy)\ **Replies:** 1\ **Last updated:** [September 8, 2022, 1:04pm UTC](https://discuss.elastic.co/t/how-to-get-the-value-in-aggregations-in-watcher/313526 "2022-09-08T13:04:31Z")
Hi, we are trying to create a new watcher for getting total value in perticular field for that which value is select in aggregations. "aggs": { "abc": { "filter": { "term": { "field": "abc" in abc place we need di… --- ## [Logstash delay](https://discuss.elastic.co/t/logstash-delay/313991)
**Author:** [@tom.verbeek](https://discuss.elastic.co/u/tom.verbeek)\ **Replies:** 2\ **Last updated:** [September 8, 2022, 1:03pm UTC](https://discuss.elastic.co/t/logstash-delay/313991 "2022-09-08T13:03:31Z")
Hi, I have a problem with logs being ingested into elastic with a delay. This delay does not start from the beginning but it builds up. Right now the delay is 1 day and 10 hours. We checked the Source device sending th… --- ## [I am looking to add some custom data to the date sent using Elastic Agents](https://discuss.elastic.co/t/i-am-looking-to-add-some-custom-data-to-the-date-sent-using-elastic-agents/313995)
**Author:** [@Garry](https://discuss.elastic.co/u/Garry)\ **Replies:** 0\ **Last updated:** [September 8, 2022, 12:59pm UTC](https://discuss.elastic.co/t/i-am-looking-to-add-some-custom-data-to-the-date-sent-using-elastic-agents/313995 "2022-09-08T12:59:36Z")
Hi, I am am looking to add some custom data through the integrations used by elastic agents. For example, when I manually use metricbeat I can send through static custom fields using processors: add\_host\_metadata: ~ a… --- ## [Please upgrade your browser This Kibana installation has strict security requirements enabled that your current browser does not meet](https://discuss.elastic.co/t/please-upgrade-your-browser-this-kibana-installation-has-strict-security-requirements-enabled-that-your-current-browser-does-not-meet/313989)
**Author:** [@bandodkarD](https://discuss.elastic.co/u/bandodkarD)\ **Replies:** 1\ **Last updated:** [September 8, 2022, 12:36pm UTC](https://discuss.elastic.co/t/please-upgrade-your-browser-this-kibana-installation-has-strict-security-requirements-enabled-that-your-current-browser-does-not-meet/313989 "2022-09-08T12:36:36Z")
We are building a POC to deploy Kibana iframe using a react app. We have an existing react app and have embedded the iframe into it. Elastic cloud version 8.3.3 is used. The iframe successfully loads but we do not want… --- ## [Is it possible to join field via conditions?](https://discuss.elastic.co/t/is-it-possible-to-join-field-via-conditions/313952)
**Author:** [@Stanislau\_Karaliou](https://discuss.elastic.co/u/Stanislau_Karaliou)\ **Replies:** 4\ **Last updated:** [September 8, 2022, 12:26pm UTC](https://discuss.elastic.co/t/is-it-possible-to-join-field-via-conditions/313952 "2022-09-08T12:26:59Z")
I have structure { id: 1 name: "Root folder" parent\_id: 0, inherit\_folder\_id: null, inherit\_permission: false, permissions: \[some permissions\] }, { id: 2 name: "Accounts" parent\_id: 1, inherit\_folder… --- ## [\[Filebeat : v7.9.3\] Invalid memory address or nil pointer dereference](https://discuss.elastic.co/t/filebeat-v7-9-3-invalid-memory-address-or-nil-pointer-dereference/313958)
**Author:** [@iamyeka](https://discuss.elastic.co/u/iamyeka)\ **Replies:** 3\ **Last updated:** [September 8, 2022, 8:30am UTC](https://discuss.elastic.co/t/filebeat-v7-9-3-invalid-memory-address-or-nil-pointer-dereference/313958 "2022-09-08T08:30:46Z")
Filebeat version: 7.9.3 I met some issue about "invalid memory address or nil pointer dereference" which caused a panic. But i cannot figure out why that happened. Below is the stack of the panic. panic: runtime error:… --- ## [Scroll query with slice](https://discuss.elastic.co/t/scroll-query-with-slice/313331)
**Author:** [@philkpler](https://discuss.elastic.co/u/philkpler)\ **Replies:** 1\ **Last updated:** [September 8, 2022, 12:23pm UTC](https://discuss.elastic.co/t/scroll-query-with-slice/313331 "2022-09-08T12:23:45Z")
Hello, Can someone confirm me that when querying using the scroll api, with slices, it will be targeting the same "state/snapshot" of the index ? As far as I know, to simplify, scroll allow to "freeze" a state of the … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=799) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=801)