# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=877 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 878 --- ## [Logstash include filter](https://discuss.elastic.co/t/logstash-include-filter/308853)
**Author:** [@tharunkumar](https://discuss.elastic.co/u/tharunkumar)\ **Replies:** 2\ **Last updated:** [July 5, 2022, 7:02am UTC](https://discuss.elastic.co/t/logstash-include-filter/308853 "2022-07-05T07:02:34Z")
Hi i need to send the logs of particular lines to logstash .i have tried by using include filter is not working .can u provide me the solution Eg: 2022-06-30 00:00:07 10.32.13.12 POST /maruvayaparpaidhee-cug/MF/Mfajax… --- ## [Filebeat include filter](https://discuss.elastic.co/t/filebeat-include-filter/308860)
**Author:** [@tharunkumar](https://discuss.elastic.co/u/tharunkumar)\ **Replies:** 1\ **Last updated:** [July 5, 2022, 6:58am UTC](https://discuss.elastic.co/t/filebeat-include-filter/308860 "2022-07-05T06:58:11Z")
Hi i need to send the logs of particular lines to logstash by using filebeat .i have tried by using include filter is not working .can u provide me the solution Eg: 2022-06-30 00:00:07 10.32.13.12 POST /maruvayaparpa… --- ## [Ingest pipeline split MESSAGE field into multiple fields](https://discuss.elastic.co/t/ingest-pipeline-split-message-field-into-multiple-fields/308834)
**Author:** [@moberreiter](https://discuss.elastic.co/u/moberreiter)\ **Replies:** 6\ **Last updated:** [July 5, 2022, 6:20am UTC](https://discuss.elastic.co/t/ingest-pipeline-split-message-field-into-multiple-fields/308834 "2022-07-05T06:20:37Z")
Hello everybody, I am new to elasticsearch and kibana and wanted to ask how to split a message into multiple fields. I tried creating an ingest pipeline with MESSAGE field and "," as separator, but it doesn't work as I… --- ## [Circuit break exception](https://discuss.elastic.co/t/circuit-break-exception/308774)
**Author:** [@Rajesh\_Sahu](https://discuss.elastic.co/u/Rajesh_Sahu)\ **Replies:** 5\ **Last updated:** [July 5, 2022, 6:13am UTC](https://discuss.elastic.co/t/circuit-break-exception/308774 "2022-07-05T06:13:17Z")
Hi all, I have been using Elasticsearch with multiple node setup from last 2 years, but currently all of sudden , got below exception of circuit\_breaking\_exception . \< {"error":{"root\_cause":\[{"type":"circuit\_breaking… --- ## [Huge Difference in the throughput for index](https://discuss.elastic.co/t/huge-difference-in-the-throughput-for-index/308320)
**Author:** [@amitsa](https://discuss.elastic.co/u/amitsa)\ **Replies:** 2\ **Last updated:** [July 5, 2022, 5:39am UTC](https://discuss.elastic.co/t/huge-difference-in-the-throughput-for-index/308320 "2022-07-05T05:39:15Z")
I am running es-cluster on kubernetes on aws 14i\_16xlarge instance. These below pods are running on different aws instances. track :- nyc\_taxis 1 master 1 data nodes 1 esrally client i am trying to calculate index… --- ## [Unique id for multiple indices having same alias](https://discuss.elastic.co/t/unique-id-for-multiple-indices-having-same-alias/308854)
**Author:** [@suj0](https://discuss.elastic.co/u/suj0)\ **Replies:** 1\ **Last updated:** [July 5, 2022, 5:03am UTC](https://discuss.elastic.co/t/unique-id-for-multiple-indices-having-same-alias/308854 "2022-07-05T05:03:00Z")
Is it possible to set unique id for multiple indices having same alias? for example I have 2 indices A001 and A002 under alias A . A001 have data with id as "1" and A002 dont have data with id "1" and my write index is… --- ## [Setting hour in KQL or Lucene](https://discuss.elastic.co/t/setting-hour-in-kql-or-lucene/308740)
**Author:** [@hadi\_farzipour](https://discuss.elastic.co/u/hadi_farzipour)\ **Replies:** 4\ **Last updated:** [July 5, 2022, 5:02am UTC](https://discuss.elastic.co/t/setting-hour-in-kql-or-lucene/308740 "2022-07-05T05:02:59Z")
Hello I have @timestamp field which is in following format Jul 3, 2022 @ 06:55:55.153 How can I filter logs between 06:00 and 10:00 without mentioning days and months in KQL or Lucene query language. --- ## [Statistics of requests' ip](https://discuss.elastic.co/t/statistics-of-requests-ip/306576)
**Author:** [@manropinxu](https://discuss.elastic.co/u/manropinxu)\ **Replies:** 1\ **Last updated:** [July 5, 2022, 2:17am UTC](https://discuss.elastic.co/t/statistics-of-requests-ip/306576 "2022-07-05T02:17:44Z")
Hi all, I would like to get metrics about how many requests does Elasticsearch receive grouped by ip of the request sender. My objective is to find which of my services are querying the most. I checked the stats endpo… --- ## [Question about create data view API](https://discuss.elastic.co/t/question-about-create-data-view-api/308530)
**Author:** [@busishe](https://discuss.elastic.co/u/busishe)\ **Replies:** 4\ **Last updated:** [July 5, 2022, 1:20am UTC](https://discuss.elastic.co/t/question-about-create-data-view-api/308530 "2022-07-05T01:20:32Z")
i want to create a dataview with only "message" field,how can i make the post request? the example only show "fields" is an object,but didnt tell the detail properties in the object. $ curl -X POST api/data\_views/dat… --- ## [My Logstash Docker container cannot start normally, please help me analyze it](https://discuss.elastic.co/t/my-logstash-docker-container-cannot-start-normally-please-help-me-analyze-it/308778)
**Author:** [@ahong](https://discuss.elastic.co/u/ahong)\ **Replies:** 5\ **Last updated:** [July 5, 2022, 12:35am UTC](https://discuss.elastic.co/t/my-logstash-docker-container-cannot-start-normally-please-help-me-analyze-it/308778 "2022-07-05T00:35:24Z")
I deployed ELK in the Docker container (version 8.2.3), but the Docker container wouldn't start when logStash was configured. The log error is as follows: {"log":"\[2022-07-04T03:29:27,007\]\[INFO \]\[logstash.javapipeline … --- ## [Curl command as streaming](https://discuss.elastic.co/t/curl-command-as-streaming/308838)
**Author:** [@Didi\_Sisi](https://discuss.elastic.co/u/Didi_Sisi)\ **Replies:** 0\ **Last updated:** [July 4, 2022, 11:38pm UTC](https://discuss.elastic.co/t/curl-command-as-streaming/308838 "2022-07-04T23:38:46Z")
Hello ; I want to use twitter streaming api V2. because the twitter plugin of logstash is not working with twitter api 2. I decided to use curl commands. I defined the rules. like this: curl --location --request POST … --- ## [Shrink and split APIs](https://discuss.elastic.co/t/shrink-and-split-apis/308752)
**Author:** [@ewolfman](https://discuss.elastic.co/u/ewolfman)\ **Replies:** 4\ **Last updated:** [July 4, 2022, 9:42pm UTC](https://discuss.elastic.co/t/shrink-and-split-apis/308752 "2022-07-04T21:42:57Z")
Hi, I tried the shrink API on a 30GB index and shrinked from 15 shards to 5 shards. What I am not sure about is that this seemed to have happened instantaneously. I checked the \_cat/recovery endpoint and saw that ther… --- ## [Editing a managed policy can break Kibana](https://discuss.elastic.co/t/editing-a-managed-policy-can-break-kibana/308836)
**Author:** [@kmp](https://discuss.elastic.co/u/kmp)\ **Replies:** 0\ **Last updated:** [July 4, 2022, 9:12pm UTC](https://discuss.elastic.co/t/editing-a-managed-policy-can-break-kibana/308836 "2022-07-04T21:12:41Z")
Just upgraded a Cloud deployment to 8.3.1 ... I'm still working on tuning usage, to try to figure out how to ensure that we're using resources efficiently. I've been looking at storage usage, and using lifecycle polici… --- ## [Logstash MySQL pakcet too large exception](https://discuss.elastic.co/t/logstash-mysql-pakcet-too-large-exception/308541)
**Author:** [@Simone1](https://discuss.elastic.co/u/Simone1)\ **Replies:** 3\ **Last updated:** [July 4, 2022, 7:41pm UTC](https://discuss.elastic.co/t/logstash-mysql-pakcet-too-large-exception/308541 "2022-07-04T19:41:50Z")
I'm trying to retreive data from a remote MySQL Server through the 22 port and i receive this error: \[ERROR\] 2022-06-29 15:21:37.081 \[\[main\]\"Ja… --- ## [Processor in auditd module fails](https://discuss.elastic.co/t/processor-in-auditd-module-fails/308693)
**Author:** [@parisila](https://discuss.elastic.co/u/parisila)\ **Replies:** 2\ **Last updated:** [July 4, 2022, 6:38pm UTC](https://discuss.elastic.co/t/processor-in-auditd-module-fails/308693 "2022-07-04T18:38:41Z")
I have a processor defined in the auditd module and seems to be correct based on other posts I have read. No configuration errors and filebeat starts up but I get an error ERROR instance/beat.go:989 Exit… --- ## [Curl -X GET http://localhost:9200 returns Access Denied](https://discuss.elastic.co/t/curl-x-get-http-localhost-9200-returns-access-denied/308687)
**Author:** [@Alaa\_Omar](https://discuss.elastic.co/u/Alaa_Omar)\ **Replies:** 2\ **Last updated:** [July 4, 2022, 6:35pm UTC](https://discuss.elastic.co/t/curl-x-get-http-localhost-9200-returns-access-denied/308687 "2022-07-04T18:35:03Z")
am trying to install and setup Elasticsearch 8 on Centos 7 server, the service started but when I do curl -x GET HTTP://localhost:9200 , or curl -x GET HTTP://127.0.0.1:9200 or curl -x GET HTTP://(local IP of the host):9… --- ## [Get all spaces dev tools](https://discuss.elastic.co/t/get-all-spaces-dev-tools/308827)
**Author:** [@Gabriel\_Vasconcelos](https://discuss.elastic.co/u/Gabriel_Vasconcelos)\ **Replies:** 0\ **Last updated:** [July 4, 2022, 4:18pm UTC](https://discuss.elastic.co/t/get-all-spaces-dev-tools/308827 "2022-07-04T16:18:12Z")
Hello everyone, I would like to know how to return all my spaces through dev tools. The documentation says it would be GET api/spaces/apace, but when I use this path, it only returns the spaces I created with index api. … --- ## [Enrichment policy based on multiple fields / complex query?](https://discuss.elastic.co/t/enrichment-policy-based-on-multiple-fields-complex-query/308826)
**Author:** [@akb](https://discuss.elastic.co/u/akb)\ **Replies:** 0\ **Last updated:** [July 4, 2022, 4:09pm UTC](https://discuss.elastic.co/t/enrichment-policy-based-on-multiple-fields-complex-query/308826 "2022-07-04T16:09:58Z")
I am investigating a way to normalize / prettify geo data during ingestion. I realize there is a way to normalize by lat / lon, however we don't always have these properties availble. Master geo data: { "country": "… --- ## [Regarding grok Date Time](https://discuss.elastic.co/t/regarding-grok-date-time/308636)
**Author:** [@suresh\_u](https://discuss.elastic.co/u/suresh_u)\ **Replies:** 2\ **Last updated:** [July 4, 2022, 3:54pm UTC](https://discuss.elastic.co/t/regarding-grok-date-time/308636 "2022-07-04T15:54:30Z")
In my oracle DB, I have with timestamp like this: "createdDate" =\> 2022-04-02T17:00:44.339Z But in my elasticsearch index, having createdDate as "createdDate": "2022-04-02T17:00:44Z" How can we change the format in Log… --- ## [AGgregation query not working related to child document](https://discuss.elastic.co/t/aggregation-query-not-working-related-to-child-document/308822)
**Author:** [@Udayaprakash\_S\_10d](https://discuss.elastic.co/u/Udayaprakash_S_10d)\ **Replies:** 0\ **Last updated:** [July 4, 2022, 2:38pm UTC](https://discuss.elastic.co/t/aggregation-query-not-working-related-to-child-document/308822 "2022-07-04T14:38:24Z")
"aggregations": { "terms\_parent\_id": { "terms": { "field": "user\_id", "size": 10000, "min\_doc\_count": 1, "shard\_min\_doc\_count": 0, "show\_term\_doc\_count\_error": false, … --- ## [Average search latency increase 900% from 7.4 to 7.10](https://discuss.elastic.co/t/average-search-latency-increase-900-from-7-4-to-7-10/308760)
**Author:** [@fgarsombke](https://discuss.elastic.co/u/fgarsombke)\ **Replies:** 2\ **Last updated:** [July 4, 2022, 2:07pm UTC](https://discuss.elastic.co/t/average-search-latency-increase-900-from-7-4-to-7-10/308760 "2022-07-04T14:07:47Z")
We recently did an upgrade from 7.4 to 7.10 and have seen over a 900% increase in search latency. Before the upgrade our average search latency was about 0.5ms and after the upgrade our average search latency is now at … --- ## [Could not index event to Elasticsearch - no write index is defined for alias](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-no-write-index-is-defined-for-alias/308783)
**Author:** [@teesr5](https://discuss.elastic.co/u/teesr5)\ **Replies:** 1\ **Last updated:** [July 4, 2022, 1:15pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-no-write-index-is-defined-for-alias/308783 "2022-07-04T13:15:31Z")
Hi guys, we are facing an issue on our ELK infrastructure: \[WARN \]\[logstash.outputs.elasticsearch\]\[main\] Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>nil, :\_index=\>"logstash-rollover… --- ## [Failed to monitor mongo cluster](https://discuss.elastic.co/t/failed-to-monitor-mongo-cluster/308453)
**Author:** [@Maksym\_Postument](https://discuss.elastic.co/u/Maksym_Postument)\ **Replies:** 5\ **Last updated:** [July 4, 2022, 1:05pm UTC](https://discuss.elastic.co/t/failed-to-monitor-mongo-cluster/308453 "2022-07-04T13:05:05Z")
I have multiple hosts specified in hosts like this hosts: \["ip1:port1", "ip2:port1"\]. But metricbeats showing error like this. How can i configure it to work correctly fetching data for metricset mongodb.dbstats: could… --- ## [How to make beats send data to multiple instances](https://discuss.elastic.co/t/how-to-make-beats-send-data-to-multiple-instances/308785)
**Author:** [@Santhosh\_Kumar247](https://discuss.elastic.co/u/Santhosh_Kumar247)\ **Replies:** 1\ **Last updated:** [July 4, 2022, 12:03pm UTC](https://discuss.elastic.co/t/how-to-make-beats-send-data-to-multiple-instances/308785 "2022-07-04T12:03:39Z")
Hello, I have the following setting in the filebeats.yml: Two conditions input for logs filebeat.inputs: - paths: - E: \\ log\_type1 \_ \*. Log fields\_under\_root: true fields: type: type1 - paths: - E: \\ … --- ## [How to set TimeStamp from java?](https://discuss.elastic.co/t/how-to-set-timestamp-from-java/308812)
**Author:** [@Enomine](https://discuss.elastic.co/u/Enomine)\ **Replies:** 1\ **Last updated:** [July 4, 2022, 12:01pm UTC](https://discuss.elastic.co/t/how-to-set-timestamp-from-java/308812 "2022-07-04T12:01:37Z")
Hi, i am using the elasticsearch-java-Client: \ \co.elastic.clients\ \elasticsearch-java\ \8.2.0\ \ and connecte… --- ## [Hi I need to remove legends from vertical graphs in kibana plots how do i do that?](https://discuss.elastic.co/t/hi-i-need-to-remove-legends-from-vertical-graphs-in-kibana-plots-how-do-i-do-that/308799)
**Author:** [@damodar\_kv](https://discuss.elastic.co/u/damodar_kv)\ **Replies:** 1\ **Last updated:** [July 4, 2022, 10:58am UTC](https://discuss.elastic.co/t/hi-i-need-to-remove-legends-from-vertical-graphs-in-kibana-plots-how-do-i-do-that/308799 "2022-07-04T10:58:17Z")
Continuing the discussion from Can I hide legend from visualization?: --- ## [Migrating java application to Elasticsearch 8.x from ES 7.17.5](https://discuss.elastic.co/t/migrating-java-application-to-elasticsearch-8-x-from-es-7-17-5/308809)
**Author:** [@Swati\_Jain1](https://discuss.elastic.co/u/Swati_Jain1)\ **Replies:** 0\ **Last updated:** [July 4, 2022, 10:46am UTC](https://discuss.elastic.co/t/migrating-java-application-to-elasticsearch-8-x-from-es-7-17-5/308809 "2022-07-04T10:46:51Z")
We are using Elasticsearch 7.17.5 which is used by a Java 8 application. We are planning to upgrade to Elasticsearch 8.x. Since High-level Rest Client is now deprecated I am unable to resolve dependencies in order to us… --- ## [Unable to initialize central management for Elastic Agents](https://discuss.elastic.co/t/unable-to-initialize-central-management-for-elastic-agents/308311)
**Author:** [@xynobob](https://discuss.elastic.co/u/xynobob)\ **Replies:** 8\ **Last updated:** [July 4, 2022, 10:36am UTC](https://discuss.elastic.co/t/unable-to-initialize-central-management-for-elastic-agents/308311 "2022-07-04T10:36:46Z")
I am new to Elasticsearch and was trying to use Fleet and Elastic Agent. It was fine initially as everything was working perfectly fine; managed to pipe logs to ES, etc, but now when I try to navigate to the Fleet page, … --- ## [Unable to connect to Elastic-Search Server](https://discuss.elastic.co/t/unable-to-connect-to-elastic-search-server/308804)
**Author:** [@Shobhit\_Jain1](https://discuss.elastic.co/u/Shobhit_Jain1)\ **Replies:** 0\ **Last updated:** [July 4, 2022, 9:52am UTC](https://discuss.elastic.co/t/unable-to-connect-to-elastic-search-server/308804 "2022-07-04T09:52:38Z")
A few months back, I deployed the Elastic-Search(version - 8.0.1) on Kubernetes as a service as External load balancer using this guide. Now, I am unable to perform any read or write operation on ES. I checked the logs,… --- ## [Elasticsearch, Multiple Filebeat, Logstash](https://discuss.elastic.co/t/elasticsearch-multiple-filebeat-logstash/308791)
**Author:** [@balasani\_sri](https://discuss.elastic.co/u/balasani_sri)\ **Replies:** 0\ **Last updated:** [July 4, 2022, 8:24am UTC](https://discuss.elastic.co/t/elasticsearch-multiple-filebeat-logstash/308791 "2022-07-04T08:24:32Z")
Hello does anyone knows if is it possible to have multiple beats pointing to the same input port and then having single index output. Basically I need to identify which beat arrives and then how to find if any beat went … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=876) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=878)