# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=809 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 810 --- ## [Query latency/service time are always identical](https://discuss.elastic.co/t/query-latency-service-time-are-always-identical/313477)
**Author:** [@jmlucjav](https://discuss.elastic.co/u/jmlucjav)\ **Replies:** 2\ **Last updated:** [September 1, 2022, 8:07pm UTC](https://discuss.elastic.co/t/query-latency-service-time-are-always-identical/313477 "2022-09-01T20:07:45Z")
Hi, in all my benchmarks, these values are always the same: | 50th percentile latency | replay-listing-query | 4.3336 | ms | | … --- ## [Processing large CSV by file module](https://discuss.elastic.co/t/processing-large-csv-by-file-module/313291)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 4\ **Last updated:** [September 1, 2022, 7:14pm UTC](https://discuss.elastic.co/t/processing-large-csv-by-file-module/313291 "2022-09-01T19:14:03Z")
Hi, I'm facing an issue with decoding my CSV files after that when I've changes the approach to upload file. My first solution has been worked through input on multiply port to logstash. What can I observer that logstas… --- ## [Could not communicate with fleet-server Checking API](https://discuss.elastic.co/t/could-not-communicate-with-fleet-server-checking-api/312352)
**Author:** [@nash-sprd](https://discuss.elastic.co/u/nash-sprd)\ **Replies:** 1\ **Last updated:** [September 1, 2022, 7:37pm UTC](https://discuss.elastic.co/t/could-not-communicate-with-fleet-server-checking-api/312352 "2022-09-01T19:37:11Z")
Hello there! Unfortunately, this is a very reoccurring error in Elastic Cloud, I found people have been having this error many times. I have an Elastic Cloud account. I onboard agents, and everything goes well, I can s… --- ## [Auditbeat - auditd module default rules](https://discuss.elastic.co/t/auditbeat-auditd-module-default-rules/313238)
**Author:** [@Ppetro](https://discuss.elastic.co/u/Ppetro)\ **Replies:** 1\ **Last updated:** [September 1, 2022, 7:34pm UTC](https://discuss.elastic.co/t/auditbeat-auditd-module-default-rules/313238 "2022-09-01T19:34:00Z")
Hi, I am testing Auditbeat with auditd module. I have noticed that even if I don't have any auditd rule listed in my config, I can still see some events generated by this module. I did some research here on the forum a… --- ## [ELK6.0 with filebeat](https://discuss.elastic.co/t/elk6-0-with-filebeat/313154)
**Author:** [@lalitg](https://discuss.elastic.co/u/lalitg)\ **Replies:** 1\ **Last updated:** [September 1, 2022, 7:20pm UTC](https://discuss.elastic.co/t/elk6-0-with-filebeat/313154 "2022-09-01T19:20:23Z")
Hi, I configure ELK6.0 with filebeat to read logs files generated with log4j. I got below output { "\_index": "filebeat-6.0.0", "\_type": "doc", "\_id": "GawR6YIBaCy-nPSp4SyK", "\_version": 1, "\_score": null, "\_sour… --- ## [Collect log from file via Filebeat to Logstash VS collect from logstash directly](https://discuss.elastic.co/t/collect-log-from-file-via-filebeat-to-logstash-vs-collect-from-logstash-directly/311816)
**Author:** [@thahgr](https://discuss.elastic.co/u/thahgr)\ **Replies:** 3\ **Last updated:** [September 1, 2022, 7:13pm UTC](https://discuss.elastic.co/t/collect-log-from-file-via-filebeat-to-logstash-vs-collect-from-logstash-directly/311816 "2022-09-01T19:13:20Z")
What are the PROS and CONS of using Filebeat to collect logs from an application writing files against using the File input plugin of Logstash to directly gather them. What is more efficient ? --- ## [How do i know the number of threads of filebeat on window os?](https://discuss.elastic.co/t/how-do-i-know-the-number-of-threads-of-filebeat-on-window-os/313309)
**Author:** [@nairobi](https://discuss.elastic.co/u/nairobi)\ **Replies:** 1\ **Last updated:** [September 1, 2022, 7:08pm UTC](https://discuss.elastic.co/t/how-do-i-know-the-number-of-threads-of-filebeat-on-window-os/313309 "2022-09-01T19:08:58Z")
On linux, I can find how many threads filebeat daemon use. But i have no idea how to find it on window os. From another discussion, it says "Each harvester is a goroutine". I can assume the number of threads by this. … --- ## [How to Grok hexidecimals to Human Readable Values](https://discuss.elastic.co/t/how-to-grok-hexidecimals-to-human-readable-values/313380)
**Author:** [@DominicS](https://discuss.elastic.co/u/DominicS)\ **Replies:** 5\ **Last updated:** [September 1, 2022, 6:58pm UTC](https://discuss.elastic.co/t/how-to-grok-hexidecimals-to-human-readable-values/313380 "2022-09-01T18:58:34Z")
Hello, I am a Grok newbie , this is my first post i need to know how to grok hex values into a grok pattern for the purpose of creating a logstash pipeline.I have googled for a while but found nothing helpful this i… --- ## [Elastic agent - Google Cloud metrics integration](https://discuss.elastic.co/t/elastic-agent-google-cloud-metrics-integration/313450)
**Author:** [@Chris\_Pinto](https://discuss.elastic.co/u/Chris_Pinto)\ **Replies:** 4\ **Last updated:** [September 1, 2022, 5:31pm UTC](https://discuss.elastic.co/t/elastic-agent-google-cloud-metrics-integration/313450 "2022-09-01T17:31:49Z")
Request integrations for the Google cloud metrics using Elastic Agent --- ## [Delay logs Paloalto](https://discuss.elastic.co/t/delay-logs-paloalto/313367)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 15\ **Last updated:** [September 1, 2022, 5:24pm UTC](https://discuss.elastic.co/t/delay-logs-paloalto/313367 "2022-09-01T17:24:30Z")
Hello, I am completely new to ELK, in my case someone installed this tool but it is no longer in my organization and I am putting a lot of effort into trying to keep the ELK solution working. Excuse my English as I'm u… --- ## [File based roles for Kibana access](https://discuss.elastic.co/t/file-based-roles-for-kibana-access/313040)
**Author:** [@rivermigue](https://discuss.elastic.co/u/rivermigue)\ **Replies:** 3\ **Last updated:** [September 1, 2022, 4:53pm UTC](https://discuss.elastic.co/t/file-based-roles-for-kibana-access/313040 "2022-09-01T16:53:03Z")
Hello, I am trying to grant access to users by using the File Based security realm (Using puppet to distribute the files) the reason is because I dont want users to be able to change the passwords, however I have not be… --- ## [Issue using Terms Lookup query inside Percolator](https://discuss.elastic.co/t/issue-using-terms-lookup-query-inside-percolator/312513)
**Author:** [@patricio.gorin](https://discuss.elastic.co/u/patricio.gorin)\ **Replies:** 3\ **Last updated:** [September 1, 2022, 4:37pm UTC](https://discuss.elastic.co/t/issue-using-terms-lookup-query-inside-percolator/312513 "2022-09-01T16:37:40Z")
Hi! I'm facing a problem using a terms lookup query inside a percolator query. The actual problem is that the terms are not re-fetched until I reindex the document with the percolator query. I was expecting that, if I u… --- ## [Sub Aggregation in new JAVA Api Client](https://discuss.elastic.co/t/sub-aggregation-in-new-java-api-client/313447)
**Author:** [@Sarthak\_Agarwal](https://discuss.elastic.co/u/Sarthak_Agarwal)\ **Replies:** 1\ **Last updated:** [September 1, 2022, 4:29pm UTC](https://discuss.elastic.co/t/sub-aggregation-in-new-java-api-client/313447 "2022-09-01T16:29:34Z")
TermsAggregationBuilder term = AggregationBuilders.terms("agg1").field("test"); term.size(100); FilterAggregationBuilder filterAgg = new FilterAggregationBuilder("agg2", new MatchAllQueryBuilder()).subAggregation(term);… --- ## [querqy/SMUI Elastic Search connection support](https://discuss.elastic.co/t/querqy-smui-elastic-search-connection-support/313391)
**Author:** [@luis13](https://discuss.elastic.co/u/luis13)\ **Replies:** 6\ **Last updated:** [September 1, 2022, 4:22pm UTC](https://discuss.elastic.co/t/querqy-smui-elastic-search-connection-support/313391 "2022-09-01T16:22:06Z")
I have querqy/SMUI installed and i'm trying to connect it to Elastic Search but i haven't success so far, is there any information about if this tool is actually supported by Elastic Search or even more how to get connec… --- ## [Data Table multiple fields](https://discuss.elastic.co/t/data-table-multiple-fields/313370)
**Author:** [@frederico](https://discuss.elastic.co/u/frederico)\ **Replies:** 3\ **Last updated:** [September 1, 2022, 3:19pm UTC](https://discuss.elastic.co/t/data-table-multiple-fields/313370 "2022-09-01T15:19:34Z")
Hello, I want to create a table where I display top values for multiple fields What I currently have: This would be fine if I'd only two fields, however I intend to use more (+8) and having a column for each is not… --- ## [Problem with the time in elastic](https://discuss.elastic.co/t/problem-with-the-time-in-elastic/312810)
**Author:** [@yosi\_herschkovitz](https://discuss.elastic.co/u/yosi_herschkovitz)\ **Replies:** 9\ **Last updated:** [September 1, 2022, 3:08pm UTC](https://discuss.elastic.co/t/problem-with-the-time-in-elastic/312810 "2022-09-01T15:08:42Z")
hi i have elasticsearch-7.10.1 and kibana-7.10.1 and filebeat-7.10.1 and i cant configure the time for israel in the Discover i see the timestamp and log\_date are different. how i can fix that the both time are Will b… --- ## [ElasticSearch Java API client - connection reset by peer](https://discuss.elastic.co/t/elasticsearch-java-api-client-connection-reset-by-peer/313454)
**Author:** [@ch\_mohansai](https://discuss.elastic.co/u/ch_mohansai)\ **Replies:** 0\ **Last updated:** [September 1, 2022, 2:29pm UTC](https://discuss.elastic.co/t/elasticsearch-java-api-client-connection-reset-by-peer/313454 "2022-09-01T14:29:29Z")
I have noticed that after upgrading my service to Java api client it is giving random connection reset by peer error, where the 1 st request always failed , later it worked and after 10 minutes this happens again. My ser… --- ## [CI builds of NEST not being updated](https://discuss.elastic.co/t/ci-builds-of-nest-not-being-updated/313449)
**Author:** [@knafve](https://discuss.elastic.co/u/knafve)\ **Replies:** 0\ **Last updated:** [September 1, 2022, 1:44pm UTC](https://discuss.elastic.co/t/ci-builds-of-nest-not-being-updated/313449 "2022-09-01T13:44:52Z")
We are currently using Elasticsearch 6 and are trying to follow the below guidance on upgrading to Elasticsearch 8: NEST and Elasticsearch.Net; upgrading your Elasticsearch server and codebase | Elastic Blog In the blo… --- ## [Shutting down Elastic Agent and sending last events](https://discuss.elastic.co/t/shutting-down-elastic-agent-and-sending-last-events/313347)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 2\ **Last updated:** [September 1, 2022, 1:21pm UTC](https://discuss.elastic.co/t/shutting-down-elastic-agent-and-sending-last-events/313347 "2022-09-01T13:21:45Z")
Hi There, in a fresh / one node vm 7.17.4 with elasticsearch / Kibana / Logstash running I went to Fleet-\>agent to try for the first time this new tech. I go step by step with what is written here Add a Fleet Server | … --- ## [Any Elastic Stack tutors around this weekend?](https://discuss.elastic.co/t/any-elastic-stack-tutors-around-this-weekend/312526)
**Author:** [@Yolanda.darricarrere](https://discuss.elastic.co/u/Yolanda.darricarrere)\ **Replies:** 2\ **Last updated:** [September 1, 2022, 1:09pm UTC](https://discuss.elastic.co/t/any-elastic-stack-tutors-around-this-weekend/312526 "2022-09-01T13:09:31Z")
Seeking tutor for an hour or two ($50/hr?) - I'm EST time but flexible on time (today thru Mon.) --- ## [Parsing JSON data](https://discuss.elastic.co/t/parsing-json-data/313217)
**Author:** [@Pukar](https://discuss.elastic.co/u/Pukar)\ **Replies:** 4\ **Last updated:** [September 1, 2022, 12:54pm UTC](https://discuss.elastic.co/t/parsing-json-data/313217 "2022-09-01T12:54:58Z")
Hi Team, New to ELK environment so please bear with me. I'm trying to ingest data from json file and visualise in kibana. The ingest itself is working but the message is coming as: "message" =\> " "totalCount": … --- ## [Headless or GUI](https://discuss.elastic.co/t/headless-or-gui/313407)
**Author:** [@Technolust](https://discuss.elastic.co/u/Technolust)\ **Replies:** 2\ **Last updated:** [September 1, 2022, 12:31pm UTC](https://discuss.elastic.co/t/headless-or-gui/313407 "2022-09-01T12:31:29Z")
Setting up an Elastic Cluster using Rocky Linux 9. I have three servers planned to start. 1 Elasticsearch, 1 Kibana, 1 Logstash. The question I can’t find an answer to is do I need to install Rocky Server with GUI on any… --- ## [Performance issues when indexing data](https://discuss.elastic.co/t/performance-issues-when-indexing-data/313187)
**Author:** [@Sadia\_Mukhtar](https://discuss.elastic.co/u/Sadia_Mukhtar)\ **Replies:** 6\ **Last updated:** [September 1, 2022, 12:29pm UTC](https://discuss.elastic.co/t/performance-issues-when-indexing-data/313187 "2022-09-01T12:29:46Z")
Hi there, In our application we decided to use elasticsearch create a daily snapshot of some critical application data for visualizations. We have about 700K documents that will inserted into one of our index on daily … --- ## [Log4j2.properties configuration for elasticsearch](https://discuss.elastic.co/t/log4j2-properties-configuration-for-elasticsearch/313443)
**Author:** [@irivas95](https://discuss.elastic.co/u/irivas95)\ **Replies:** 0\ **Last updated:** [September 1, 2022, 12:24pm UTC](https://discuss.elastic.co/t/log4j2-properties-configuration-for-elasticsearch/313443 "2022-09-01T12:24:34Z")
Hi, I am trying to configure a log policy based on the IfAccumulatedFileSize property reducing the default 2GB to 50MB because I already have too many logs in my folder. I have seen that the folder where I have the logs… --- ## [Ingest pipeline buffer for incoming documents](https://discuss.elastic.co/t/ingest-pipeline-buffer-for-incoming-documents/313438)
**Author:** [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\ **Replies:** 2\ **Last updated:** [September 1, 2022, 11:59am UTC](https://discuss.elastic.co/t/ingest-pipeline-buffer-for-incoming-documents/313438 "2022-09-01T11:59:14Z")
I am investigating using an ingest pipeline for one type of document for my cluster. I am wondering if I have a maintenance or upgrade window or even an unplanned outage does the ingest pipeline have a buffer for that do… --- ## [Start Service in Terminal](https://discuss.elastic.co/t/start-service-in-terminal/313429)
**Author:** [@Irwan\_Kurniawan](https://discuss.elastic.co/u/Irwan_Kurniawan)\ **Replies:** 1\ **Last updated:** [September 1, 2022, 11:57am UTC](https://discuss.elastic.co/t/start-service-in-terminal/313429 "2022-09-01T11:57:56Z")
When I installed elasticsearch in server and started it, it always shown this one. I already tried to reinstalled it and still happen. systemd-entrypoint\[1067640\]: /usr/share/elasticsearch/bin/systemd-entrypoint: 7: can… --- ## [ElasticSearch not starting - Main ERROR Null object returned for RollingFile in Appenders](https://discuss.elastic.co/t/elasticsearch-not-starting-main-error-null-object-returned-for-rollingfile-in-appenders/313437)
**Author:** [@afernandes](https://discuss.elastic.co/u/afernandes)\ **Replies:** 0\ **Last updated:** [September 1, 2022, 11:43am UTC](https://discuss.elastic.co/t/elasticsearch-not-starting-main-error-null-object-returned-for-rollingfile-in-appenders/313437 "2022-09-01T11:43:58Z")
Hi, I had installed Elasticsearch on a cluster of three Redhat 7.9 servers, but the service failed to start. When I check the elasticsearch status it's displayed several errors main ERROR Null object returned for Roll… --- ## [Logstash don't reach elasticsearch](https://discuss.elastic.co/t/logstash-dont-reach-elasticsearch/312311)
**Author:** [@SilasMuniz1](https://discuss.elastic.co/u/SilasMuniz1)\ **Replies:** 16\ **Last updated:** [September 1, 2022, 11:36am UTC](https://discuss.elastic.co/t/logstash-dont-reach-elasticsearch/312311 "2022-09-01T11:36:39Z")
Hi all, I set up an elasticsearch's cluster with 3 nodes. I deploy the first one e installed after kibana in the same VM(RHEL). It's work ok. With Xpack-security enable. elasticsearch.yml: Added other 2 nodes usin… --- ## [Should I merge my many indices into 1 and use ILM?](https://discuss.elastic.co/t/should-i-merge-my-many-indices-into-1-and-use-ilm/313421)
**Author:** [@kk123](https://discuss.elastic.co/u/kk123)\ **Replies:** 2\ **Last updated:** [September 1, 2022, 11:18am UTC](https://discuss.elastic.co/t/should-i-merge-my-many-indices-into-1-and-use-ilm/313421 "2022-09-01T11:18:18Z")
Hi, this question follows on from previous issues I've had Shards per node, Heap, 100% CPU....help please I have since updated to 7.15 and have reduced the number of shard per index to 2 (from 5) with 1 replica. The clu… --- ## [Template priority explanation](https://discuss.elastic.co/t/template-priority-explanation/311443)
**Author:** [@pestevao](https://discuss.elastic.co/u/pestevao)\ **Replies:** 3\ **Last updated:** [September 1, 2022, 11:11am UTC](https://discuss.elastic.co/t/template-priority-explanation/311443 "2022-09-01T11:11:10Z")
Hi all, I'm trying to change the number\_of\_replicas of some indexes, applying a loosely index\_patterns but... I'm struggling with priority. If I make a change on number\_of\_replicas and define a priority 1 on my new tem… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=808) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=810)