# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=808 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 809 --- ## [Error starting Logstash](https://discuss.elastic.co/t/error-starting-logstash/313470)
**Author:** [@steevhise](https://discuss.elastic.co/u/steevhise)\ **Replies:** 6\ **Last updated:** [September 2, 2022, 4:06pm UTC](https://discuss.elastic.co/t/error-starting-logstash/313470 "2022-09-02T16:06:58Z")
Logstash is exiting with an error when starting up: \[ERROR\] 2022-09-01 17:35:32.473 \[Converge PipelineAction::Create\\] agent - Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :… --- ## [Unable to pass Azure snapshot repository Setting "client" in java API](https://discuss.elastic.co/t/unable-to-pass-azure-snapshot-repository-setting-client-in-java-api/313558)
**Author:** [@irene\_ghafari](https://discuss.elastic.co/u/irene_ghafari)\ **Replies:** 0\ **Last updated:** [September 2, 2022, 2:10pm UTC](https://discuss.elastic.co/t/unable-to-pass-azure-snapshot-repository-setting-client-in-java-api/313558 "2022-09-02T14:10:45Z")
Hello :slight\_smile: I want to register an Azure repository for Elasticsearch snapshot restoration, from a client other than default. It mentions in the documentation that I should set the client in repository settings.… --- ## [Multiple ELK Clusters and one Global web FrontEnd](https://discuss.elastic.co/t/multiple-elk-clusters-and-one-global-web-frontend/313473)
**Author:** [@lcui\_dxc](https://discuss.elastic.co/u/lcui_dxc)\ **Replies:** 3\ **Last updated:** [September 2, 2022, 2:06pm UTC](https://discuss.elastic.co/t/multiple-elk-clusters-and-one-global-web-frontend/313473 "2022-09-02T14:06:29Z")
Hello there: We have a client, they sell goods globally and wanted to use Elasticsearch as Search Engine. They have their databases in one region but wanted the search performance fast in multiple regions (Europe, Nort… --- ## [Logstash multiline codec do not read all lines](https://discuss.elastic.co/t/logstash-multiline-codec-do-not-read-all-lines/313542)
**Author:** [@alex\_96](https://discuss.elastic.co/u/alex_96)\ **Replies:** 2\ **Last updated:** [September 2, 2022, 1:33pm UTC](https://discuss.elastic.co/t/logstash-multiline-codec-do-not-read-all-lines/313542 "2022-09-02T13:33:33Z")
Hi I'm using multiline codec to concatenate lines into one event, here's an example of it: # Time: 2022-08-29T07:43:30.314166Z # User@Host: root\[root\] @ 1.1.1.1. \[\] Id: 111111 # Query\_time: 0.019870 Lock\_time: 0.00000… --- ## [Ingest data from Relational DB to Elasticsearch](https://discuss.elastic.co/t/ingest-data-from-relational-db-to-elasticsearch/313376)
**Author:** [@lcui\_dxc](https://discuss.elastic.co/u/lcui_dxc)\ **Replies:** 9\ **Last updated:** [September 2, 2022, 1:14pm UTC](https://discuss.elastic.co/t/ingest-data-from-relational-db-to-elasticsearch/313376 "2022-09-02T13:14:49Z")
Hello there: We are building a search engine with Elastic, the source data is on a relational DB. We need to ingest data from the DB to Elasticsearch. We know it is doable using JDBC Input Plugin on Logstash to ingest d… --- ## [Manipulate score by field integer value](https://discuss.elastic.co/t/manipulate-score-by-field-integer-value/313553)
**Author:** [@frankmehlhop.com](https://discuss.elastic.co/u/frankmehlhop.com)\ **Replies:** 0\ **Last updated:** [September 2, 2022, 12:21pm UTC](https://discuss.elastic.co/t/manipulate-score-by-field-integer-value/313553 "2022-09-02T12:21:57Z")
I use Elastic for searching pdf's. One of the fields apart of the pdf-content is doridat, what is a date as integer. The newest documents should get a higher score (higher ranking). This means that the higher the value i… --- ## [Disk Usage problem](https://discuss.elastic.co/t/disk-usage-problem/313543)
**Author:** [@Medel](https://discuss.elastic.co/u/Medel)\ **Replies:** 14\ **Last updated:** [September 2, 2022, 12:20pm UTC](https://discuss.elastic.co/t/disk-usage-problem/313543 "2022-09-02T12:20:48Z")
Hello! I have a strange issue in my elasticsearch cluster So I have 3 nodes, and each node server has 300gb disk space on it But it showed that only 20gb is available. How I can add more space to the nodes? --- ## [How to Increase checkpoint interval in azure event Hub logstash](https://discuss.elastic.co/t/how-to-increase-checkpoint-interval-in-azure-event-hub-logstash/313548)
**Author:** [@karthik\_Ravichandran](https://discuss.elastic.co/u/karthik_Ravichandran)\ **Replies:** 0\ **Last updated:** [September 2, 2022, 11:46am UTC](https://discuss.elastic.co/t/how-to-increase-checkpoint-interval-in-azure-event-hub-logstash/313548 "2022-09-02T11:46:38Z")
input { azure\_event\_hubs { event\_hub\_connections =\> \["${CLCEHPRIMARYCONNECTIONSTRING};EntityPath=cef"\] storage\_connection =\> "${CLCSTORAGEPRIMARYENDPOINT}" checkpoint\_interval =\> 60 storage\_container =\> "offsets-par… --- ## [Filebeat not reading logs on Kubernetes](https://discuss.elastic.co/t/filebeat-not-reading-logs-on-kubernetes/313545)
**Author:** [@shivendra95](https://discuss.elastic.co/u/shivendra95)\ **Replies:** 0\ **Last updated:** [September 2, 2022, 11:15am UTC](https://discuss.elastic.co/t/filebeat-not-reading-logs-on-kubernetes/313545 "2022-09-02T11:15:30Z")
Hi I'm trying to use filebeat as sidecar to one of my pods in our kubernetes clusyer. Below is the configmap that I'm using apiVersion: v1 kind: ConfigMap metadata: name: filebeat-configmap-dev namespace: dev data:… --- ## [Using upsert to update existing record base on value in fields](https://discuss.elastic.co/t/using-upsert-to-update-existing-record-base-on-value-in-fields/313494)
**Author:** [@nookseal](https://discuss.elastic.co/u/nookseal)\ **Replies:** 1\ **Last updated:** [September 2, 2022, 10:15am UTC](https://discuss.elastic.co/t/using-upsert-to-update-existing-record-base-on-value-in-fields/313494 "2022-09-02T10:15:43Z")
Hi all, Currently I'm trying to manage the Elasticsearch records from Filebeat which came from bash script and write to CSV file for each execute, then Filebeat collect log from CSV file. Below are example of header(no… --- ## [Problem handling null value with jdbc\_streaming filter](https://discuss.elastic.co/t/problem-handling-null-value-with-jdbc-streaming-filter/313538)
**Author:** [@Kowsalya\_Mouttou](https://discuss.elastic.co/u/Kowsalya_Mouttou)\ **Replies:** 0\ **Last updated:** [September 2, 2022, 10:20am UTC](https://discuss.elastic.co/t/problem-handling-null-value-with-jdbc-streaming-filter/313538 "2022-09-02T10:20:05Z")
Hi, here is my filter plugin in logsatsh configuration : filter { jdbc\_streaming { jdbc\_driver\_library =\> "/usr/share/logstash/logstash-core/lib/jars/postgresql-42.2.6.jar" jdbc\_driver\_class =\> "org.postgre… --- ## [Don’t see logs in kibana stack monitoring](https://discuss.elastic.co/t/don-t-see-logs-in-kibana-stack-monitoring/311914)
**Author:** [@cheshirecat](https://discuss.elastic.co/u/cheshirecat)\ **Replies:** 21\ **Last updated:** [September 2, 2022, 10:06am UTC](https://discuss.elastic.co/t/don-t-see-logs-in-kibana-stack-monitoring/311914 "2022-09-02T10:06:58Z")
Hello There! I have seen similar topic but it is closed for two years. I can not see STRUCTURED LOGS in Kibana. I am using filebeat with module elasticsearch and this is module's config: # Module: elasticsearch # D… --- ## [One index shows red status](https://discuss.elastic.co/t/one-index-shows-red-status/313128)
**Author:** [@Shashi\_Prakash](https://discuss.elastic.co/u/Shashi_Prakash)\ **Replies:** 5\ **Last updated:** [September 2, 2022, 7:25am UTC](https://discuss.elastic.co/t/one-index-shows-red-status/313128 "2022-09-02T07:25:14Z")
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size red open hft-filebeat 2aHzkG-YRLODjaTR0IAErQ 1 0 Not sure why this shows red although have restarted … --- ## [Logstash giving error "Elasticsearch Unreachable](https://discuss.elastic.co/t/logstash-giving-error-elasticsearch-unreachable/313515)
**Author:** [@Amit\_sah](https://discuss.elastic.co/u/Amit_sah)\ **Replies:** 4\ **Last updated:** [September 2, 2022, 9:34am UTC](https://discuss.elastic.co/t/logstash-giving-error-elasticsearch-unreachable/313515 "2022-09-02T09:34:33Z")
\[2022-09-02T13:20:38,199\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main\] Attempted to resurrect connection to dead ES instance, but got an error {:url=\>"http://elastic:xxxxxx@localhost:9200/", :exception=\>LogStash::Outputs… --- ## [Automating Email Whitelisting for Alerts (elasticsearch, kibana)](https://discuss.elastic.co/t/automating-email-whitelisting-for-alerts-elasticsearch-kibana/313369)
**Author:** [@Hayden\_WB](https://discuss.elastic.co/u/Hayden_WB)\ **Replies:** 10\ **Last updated:** [September 2, 2022, 8:33am UTC](https://discuss.elastic.co/t/automating-email-whitelisting-for-alerts-elasticsearch-kibana/313369 "2022-09-02T08:33:11Z")
Hi folks! We are trying to achieve observability for a large organisation, and we now have users creating alerts in various elastic deployments. We have recently learned that, in order to receive the email alerts our us… --- ## [K8s dashboard giving bad gateway](https://discuss.elastic.co/t/k8s-dashboard-giving-bad-gateway/313001)
**Author:** [@sandeep\_kumar5](https://discuss.elastic.co/u/sandeep_kumar5)\ **Replies:** 2\ **Last updated:** [September 2, 2022, 8:25am UTC](https://discuss.elastic.co/t/k8s-dashboard-giving-bad-gateway/313001 "2022-09-02T08:25:27Z")
Hi everyone I have deployed kibana with xpack using helm chart on on premises k8s cluster. I have used traefik as load balancer. Without xpack I am able to get kibana ui running on private hostname but with xpack I am n… --- ## [Update by query not work on linux terminal but work on devtool UI](https://discuss.elastic.co/t/update-by-query-not-work-on-linux-terminal-but-work-on-devtool-ui/313517)
**Author:** [@siwapong.cha](https://discuss.elastic.co/u/siwapong.cha)\ **Replies:** 1\ **Last updated:** [September 2, 2022, 8:21am UTC](https://discuss.elastic.co/t/update-by-query-not-work-on-linux-terminal-but-work-on-devtool-ui/313517 "2022-09-02T08:21:48Z")
I'm doing the update by query and it's work well on the devtool UI Screenshot below But when I did the same thing on linux terminal curl -X POST -k -u myusername:mypassword "https://localhost:9200/my-index/\_update\_… --- ## [If filebeat is deployed with single instance then no issue is observed in multiline handling. If Filebeat is deployed with daemonset then all events does not follow proper multiline pattern thus results in individual events. Is there any bug reported?](https://discuss.elastic.co/t/if-filebeat-is-deployed-with-single-instance-then-no-issue-is-observed-in-multiline-handling-if-filebeat-is-deployed-with-daemonset-then-all-events-does-not-follow-proper-multiline-pattern-thus-results-in-individual-events-is-there-any-bug-reported/313141)
**Author:** [@Chitra1](https://discuss.elastic.co/u/Chitra1)\ **Replies:** 2\ **Last updated:** [September 2, 2022, 7:37am UTC](https://discuss.elastic.co/t/if-filebeat-is-deployed-with-single-instance-then-no-issue-is-observed-in-multiline-handling-if-filebeat-is-deployed-with-daemonset-then-all-events-does-not-follow-proper-multiline-pattern-thus-results-in-individual-events-is-there-any-bug-reported/313141 "2022-09-02T07:37:46Z")
If filebeat is deployed with single instance then no issue is observed in multiline handling. If Filebeat is deployed with daemonset then all events does not follow proper multiline pattern thus results in individual eve… --- ## [Elastic Agent already installed but not reporting to server](https://discuss.elastic.co/t/elastic-agent-already-installed-but-not-reporting-to-server/313503)
**Author:** [@Ashish10195](https://discuss.elastic.co/u/Ashish10195)\ **Replies:** 0\ **Last updated:** [September 2, 2022, 6:20am UTC](https://discuss.elastic.co/t/elastic-agent-already-installed-but-not-reporting-to-server/313503 "2022-09-02T06:20:07Z")
We have some servers in same environment with same Elastic Agent but not reporting to server .some are showing in Offline state and some are not showing anywhere .if we reinstall the Agent all the server will start showi… --- ## [Kafka Implementation](https://discuss.elastic.co/t/kafka-implementation/313241)
**Author:** [@Sarala\_C](https://discuss.elastic.co/u/Sarala_C)\ **Replies:** 2\ **Last updated:** [September 2, 2022, 6:12am UTC](https://discuss.elastic.co/t/kafka-implementation/313241 "2022-09-02T06:12:57Z")
We are Trying to Implement Kafka in our environment. So right now our Set up is like: Syslog Server(Logstash) --\> Event Hub --\> Azure VM Logstash --\> Azure VM Elasticsearch --\> Azure VM kibana. We want to place Kafka i… --- ## [Elasticsearch / Kibana showing different results](https://discuss.elastic.co/t/elasticsearch-kibana-showing-different-results/313498)
**Author:** [@AfricanHipp0](https://discuss.elastic.co/u/AfricanHipp0)\ **Replies:** 2\ **Last updated:** [September 2, 2022, 5:51am UTC](https://discuss.elastic.co/t/elasticsearch-kibana-showing-different-results/313498 "2022-09-02T05:51:51Z")
Hi all, Just wondering if anyone can provide me some guidance. I have Elasticsearch/Kibana running on a Ubuntu Server VM. My goal is to monitor Windows machines in my homelab. I've installed Winlogbeat on one of the Win… --- ## [More than 90 days records unable to set the time](https://discuss.elastic.co/t/more-than-90-days-records-unable-to-set-the-time/312078)
**Author:** [@muthusundar.p](https://discuss.elastic.co/u/muthusundar.p)\ **Replies:** 4\ **Last updated:** [September 2, 2022, 3:39am UTC](https://discuss.elastic.co/t/more-than-90-days-records-unable-to-set-the-time/312078 "2022-09-02T03:39:06Z")
I trying to create an alert for more than 90 days of records for my audit purpose. I only see the "last" xx days in the option, but I need more than \> 90 days old data. Could you please help me with how to set it up? I t… --- ## [Translate a CURL command into a HTTP filter request](https://discuss.elastic.co/t/translate-a-curl-command-into-a-http-filter-request/313403)
**Author:** [@Ygal\_Mizrachi](https://discuss.elastic.co/u/Ygal_Mizrachi)\ **Replies:** 2\ **Last updated:** [September 1, 2022, 10:28pm UTC](https://discuss.elastic.co/t/translate-a-curl-command-into-a-http-filter-request/313403 "2022-09-01T22:28:10Z")
Hello i need some help translating this CURL request into a http filter syntax curl -k -u username:password -X POST 'https://192.168.88.1/rest/tool/flood-ping' \\--data '{"address":"192.168.88.223","count":"12","interval… --- ## [Error starting logstash version 8.4.1](https://discuss.elastic.co/t/error-starting-logstash-version-8-4-1/313478)
**Author:** [@nathan\_ledall](https://discuss.elastic.co/u/nathan_ledall)\ **Replies:** 6\ **Last updated:** [September 1, 2022, 9:53pm UTC](https://discuss.elastic.co/t/error-starting-logstash-version-8-4-1/313478 "2022-09-01T21:53:04Z")
Hi, I'm daving an issue trying to start logstash. if I run logstash/bat -f logstash.conf everything works fine and logstash even starts but then quickly shuts down and says there is an error any ideas on how to fix it? b… --- ## [Observability stream- logstash](https://discuss.elastic.co/t/observability-stream-logstash/313487)
**Author:** [@preethi\_yogasundaram](https://discuss.elastic.co/u/preethi_yogasundaram)\ **Replies:** 0\ **Last updated:** [September 1, 2022, 9:25pm UTC](https://discuss.elastic.co/t/observability-stream-logstash/313487 "2022-09-01T21:25:54Z")
Hi, i tried to edit the observability stream configuration to include my logstash\* index pattern but i could not apply the changes, i even gave admin privileges but i still couldnt add it. Kindly help me --- ## [Error in Filebeat logs](https://discuss.elastic.co/t/error-in-filebeat-logs/313049)
**Author:** [@netnal](https://discuss.elastic.co/u/netnal)\ **Replies:** 8\ **Last updated:** [September 1, 2022, 8:46pm UTC](https://discuss.elastic.co/t/error-in-filebeat-logs/313049 "2022-09-01T20:46:53Z")
Hello, I am trying to ship logs from windows machine to logz.io using Filebeat 8.2 and Filebeat 7.17(for windows). But I see the below error. Failed to connect to backoff(tcp://listener-ca.logz.io:5015)): tls: downgrad… --- ## [Index management requested but the Elasticsearch output is not configured/enabled](https://discuss.elastic.co/t/index-management-requested-but-the-elasticsearch-output-is-not-configured-enabled/313296)
**Author:** [@emmanuel\_stevens\_LED](https://discuss.elastic.co/u/emmanuel_stevens_LED)\ **Replies:** 4\ **Last updated:** [September 1, 2022, 8:43pm UTC](https://discuss.elastic.co/t/index-management-requested-but-the-elasticsearch-output-is-not-configured-enabled/313296 "2022-09-01T20:43:58Z")
when i run the command : metricbeat setup -e i have the error message : Exiting: index management requested but the Elasticsearch output is not configured/enabled I try to send my datas to kafka. before doing it i sen… --- ## [Unable to retrieve version information from Elasticsearch nodes](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes/313467)
**Author:** [@Technolust](https://discuss.elastic.co/u/Technolust)\ **Replies:** 4\ **Last updated:** [September 1, 2022, 8:22pm UTC](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes/313467 "2022-09-01T20:22:27Z")
I'm not able to get kibana to present username password continuously shows: 10.141.0.171:5601 Kibana server is not ready yet. kibana.log shows: "ecs":{"version":"8.4.0"},"@timestamp":"2022-09-01T13:03:37.022-04:00","… --- ## [Logstash input from multiple redis servers](https://discuss.elastic.co/t/logstash-input-from-multiple-redis-servers/313456)
**Author:** [@kurdit](https://discuss.elastic.co/u/kurdit)\ **Replies:** 2\ **Last updated:** [September 1, 2022, 8:19pm UTC](https://discuss.elastic.co/t/logstash-input-from-multiple-redis-servers/313456 "2022-09-01T20:19:14Z")
hello community! I have the following configuration: 9 nodes, 2 redis servers and 3 logstash servers my logs will go to the redis server (it will work as a broker) -\> then to logstash -\> and to elasticsearch the questi… --- ## [Connecting to Elasticsearch Cluster Node|| Nodes via Javascript client](https://discuss.elastic.co/t/connecting-to-elasticsearch-cluster-node-nodes-via-javascript-client/313481)
**Author:** [@whizyrel](https://discuss.elastic.co/u/whizyrel)\ **Replies:** 0\ **Last updated:** [September 1, 2022, 8:10pm UTC](https://discuss.elastic.co/t/connecting-to-elasticsearch-cluster-node-nodes-via-javascript-client/313481 "2022-09-01T20:10:40Z")
I have a quick dumb question, I have an elasticsearch self-managed cluster in compose, the question is how should I connect: by specifying a node or mandatorily specifying all nodes? I appreciate the feedback, thank you … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=807) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=809)