# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=888 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 889 --- ## [XPOST Failing](https://discuss.elastic.co/t/xpost-failing/308153)
**Author:** [@chandramouli\_ravi](https://discuss.elastic.co/u/chandramouli_ravi)\ **Replies:** 5\ **Last updated:** [June 25, 2022, 2:50pm UTC](https://discuss.elastic.co/t/xpost-failing/308153 "2022-06-25T14:50:47Z")
Hi, I am running elasticsearch 8.2.3 from my laptop. Able to check health, create index but insert document is failing. Could you please help what's the problem here. C:\\Users\\ravich\>curl --insecure -H "Content-Type:… --- ## [How do I increase the number of logs per second processing by Elastic Agent and Ingest pipeline?](https://discuss.elastic.co/t/how-do-i-increase-the-number-of-logs-per-second-processing-by-elastic-agent-and-ingest-pipeline/306535)
**Author:** [@alah64](https://discuss.elastic.co/u/alah64)\ **Replies:** 1\ **Last updated:** [June 25, 2022, 12:45pm UTC](https://discuss.elastic.co/t/how-do-i-increase-the-number-of-logs-per-second-processing-by-elastic-agent-and-ingest-pipeline/306535 "2022-06-25T12:45:22Z")
Hi I came first and only received the Suricata log from the elastic agent, about 600 EPS processing is done. The amount of CPU that you can see in the following figure by htop command: Then I came and processed othe… --- ## [Filebeat use too many cpu times to gzip](https://discuss.elastic.co/t/filebeat-use-too-many-cpu-times-to-gzip/308163)
**Author:** [@MrLiukang](https://discuss.elastic.co/u/MrLiukang)\ **Replies:** 0\ **Last updated:** [June 25, 2022, 12:10pm UTC](https://discuss.elastic.co/t/filebeat-use-too-many-cpu-times-to-gzip/308163 "2022-06-25T12:10:24Z")
hey guys. I found my filebeat send msg too slow,so I use two commands to profile filebeat, perf record -a -g -p xxx perf report -n --stdio the result show the filebeat use lots of cpu times to gzip msg? can we red… --- ## [Python 无法通过ssh使用Elasticsearch类和远程服务器建立连接](https://discuss.elastic.co/t/python-ssh-elasticsearch/308157)
**Author:** [@qigemingzihaonana](https://discuss.elastic.co/u/qigemingzihaonana)\ **Replies:** 2\ **Last updated:** [June 25, 2022, 8:11am UTC](https://discuss.elastic.co/t/python-ssh-elasticsearch/308157 "2022-06-25T08:11:45Z")
elasticsearch.exceptions.ConnectionError: ConnectionError(\: Failed to establish a new connection: \[WinError 10061\] 由于目标计算机积极拒绝，无法连接。) caused by: NewConnecti… --- ## [How to take input from kafka avro consumer](https://discuss.elastic.co/t/how-to-take-input-from-kafka-avro-consumer/308150)
**Author:** [@saurabhlam](https://discuss.elastic.co/u/saurabhlam)\ **Replies:** 0\ **Last updated:** [June 25, 2022, 5:55am UTC](https://discuss.elastic.co/t/how-to-take-input-from-kafka-avro-consumer/308150 "2022-06-25T05:55:49Z")
Hi Currently I have defined kafka as input in logstash but I want to take input from kafka avro consumer (avro-console-consumer) . Below is my current config input { kafka { bootstrap\_servers =\> "kafka:9092" topics… --- ## [Set data view format in index template](https://discuss.elastic.co/t/set-data-view-format-in-index-template/307445)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 10\ **Last updated:** [June 25, 2022, 1:40am UTC](https://discuss.elastic.co/t/set-data-view-format-in-index-template/307445 "2022-06-25T01:40:06Z")
Hi, I have multiple spaces that all reference the same index with an index pattern - metricbeat-\*./ Metricbeat comes with MANY \*.pct fields and I'd like to display them all as percentages rather than numbers. It would … --- ## [Num\_reduce\_phases in query response](https://discuss.elastic.co/t/num-reduce-phases-in-query-response/308145)
**Author:** [@Akshay\_Pawar](https://discuss.elastic.co/u/Akshay_Pawar)\ **Replies:** 0\ **Last updated:** [June 25, 2022, 12:43am UTC](https://discuss.elastic.co/t/num-reduce-phases-in-query-response/308145 "2022-06-25T00:43:24Z")
Hello, we are using Elasticsearch's version 7.5.1 and noticed that sometimes (not always) Elasticsearch returns "num\_reduced\_phases" in query response for aggregate queries. Is there any specific query/scenario which can… --- ## [Canvas Charts Limiting Results](https://discuss.elastic.co/t/canvas-charts-limiting-results/304591)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 4\ **Last updated:** [June 24, 2022, 9:01pm UTC](https://discuss.elastic.co/t/canvas-charts-limiting-results/304591 "2022-06-24T21:01:59Z")
I am using an Elasticsearch SQL query in a horizontal bar chart in Kibana. At the end of my query I have LIMIT ALL, which should return all results that match the WHERE statement. Discover shows 292,589 hits for the same… --- ## [How to implement Keep alive in logstash using JDBC input](https://discuss.elastic.co/t/how-to-implement-keep-alive-in-logstash-using-jdbc-input/308140)
**Author:** [@Oskr](https://discuss.elastic.co/u/Oskr)\ **Replies:** 0\ **Last updated:** [June 24, 2022, 7:30pm UTC](https://discuss.elastic.co/t/how-to-implement-keep-alive-in-logstash-using-jdbc-input/308140 "2022-06-24T19:30:26Z")
Hello Team, I have a question about a bug in my environment, I am using logstash to extract data from the oracle database, our logstash is running on AWS the sql takes 100 sec to run on average, but at some times of the… --- ## [SunCertPathBuilderException in Logstash Running Elasticsearch in Docker](https://discuss.elastic.co/t/suncertpathbuilderexception-in-logstash-running-elasticsearch-in-docker/308054)
**Author:** [@jhop](https://discuss.elastic.co/u/jhop)\ **Replies:** 7\ **Last updated:** [June 24, 2022, 7:00pm UTC](https://discuss.elastic.co/t/suncertpathbuilderexception-in-logstash-running-elasticsearch-in-docker/308054 "2022-06-24T19:00:02Z")
I am running Elasticsearch in docker. I am trying to hit port 5044 from my browser (or from anywhere). My error is as follows: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certificat… --- ## [Changing node roles in an already existing ES environment](https://discuss.elastic.co/t/changing-node-roles-in-an-already-existing-es-environment/307013)
**Author:** [@Carlos\_T](https://discuss.elastic.co/u/Carlos_T)\ **Replies:** 3\ **Last updated:** [June 24, 2022, 6:17pm UTC](https://discuss.elastic.co/t/changing-node-roles-in-an-already-existing-es-environment/307013 "2022-06-24T18:17:10Z")
Good morning everybody. As, due to my job, I will have to get a Production ES environment in the future, I decided to create a testing ES environment at home. This environment has three multi-role node. The three of th… --- ## [Update to 8.2.2 showing error in keystore-init](https://discuss.elastic.co/t/update-to-8-2-2-showing-error-in-keystore-init/307076)
**Author:** [@Dxnium](https://discuss.elastic.co/u/Dxnium)\ **Replies:** 4\ **Last updated:** [June 24, 2022, 5:07pm UTC](https://discuss.elastic.co/t/update-to-8-2-2-showing-error-in-keystore-init/307076 "2022-06-24T17:07:09Z")
Currently testing to update elastic from 8.1.3 to 8.2.2, but when i tried to deploy with the latest version I'm getting this error. Also getting the same error with version 8.2.0 I'm using the same cofiguration from 8.… --- ## [Indentation error on filebeat conf](https://discuss.elastic.co/t/indentation-error-on-filebeat-conf/308033)
**Author:** [@Guillaume\_D](https://discuss.elastic.co/u/Guillaume_D)\ **Replies:** 4\ **Last updated:** [June 24, 2022, 4:58pm UTC](https://discuss.elastic.co/t/indentation-error-on-filebeat-conf/308033 "2022-06-24T16:58:55Z")
Hi, I want to do some basic process with filebeat on my logs but I have some indentations problemes I just don't know how to resolve. Here is the current stat of the conf file, input and output has been sensored but I a… --- ## [SNMP Input - Stop Table Polling at Specific Table OID](https://discuss.elastic.co/t/snmp-input-stop-table-polling-at-specific-table-oid/308134)
**Author:** [@bennrtc](https://discuss.elastic.co/u/bennrtc)\ **Replies:** 0\ **Last updated:** [June 24, 2022, 4:54pm UTC](https://discuss.elastic.co/t/snmp-input-stop-table-polling-at-specific-table-oid/308134 "2022-06-24T16:54:54Z")
I'm using Logstash to query a network device that has a large number of interfaces (nearly 1500). I'm interested in a variety of interface metrics that are stored in different tables. I only need the metrics from the f… --- ## [Elastic search service is getting stopped automatically version 7.12](https://discuss.elastic.co/t/elastic-search-service-is-getting-stopped-automatically-version-7-12/308132)
**Author:** [@Azhar\_Uddin1](https://discuss.elastic.co/u/Azhar_Uddin1)\ **Replies:** 0\ **Last updated:** [June 24, 2022, 4:10pm UTC](https://discuss.elastic.co/t/elastic-search-service-is-getting-stopped-automatically-version-7-12/308132 "2022-06-24T16:10:20Z")
I am getting a warning in the kibana service after that elastic service stopped automatically executing the below commands yarn es snapshot --oss yarn start --run-examples and also executes yarn start but in both ca… --- ## [How to add a 0 before a field, with a condicion?](https://discuss.elastic.co/t/how-to-add-a-0-before-a-field-with-a-condicion/308106)
**Author:** [@jvinacio](https://discuss.elastic.co/u/jvinacio)\ **Replies:** 1\ **Last updated:** [June 24, 2022, 3:52pm UTC](https://discuss.elastic.co/t/how-to-add-a-0-before-a-field-with-a-condicion/308106 "2022-06-24T15:52:34Z")
Hello! I have different docs with different hours from 0 to 23 like the following { "date" : "2022-06-23", "eventDate" : "2022", "StoreID" : 190, "hour" : 0, "PosID" : 12, "tempo" : 0.0 } { "date" : "2022-06-2… --- ## [Calculate a delta between two time slices](https://discuss.elastic.co/t/calculate-a-delta-between-two-time-slices/307411)
**Author:** [@Kohlman](https://discuss.elastic.co/u/Kohlman)\ **Replies:** 9\ **Last updated:** [June 24, 2022, 3:50pm UTC](https://discuss.elastic.co/t/calculate-a-delta-between-two-time-slices/307411 "2022-06-24T15:50:26Z")
Is there a visualization that can calculate a delta between to two most recent records or any two time slices for that matter. Specifically we have metricbeat data from SQL server. Many of the metrics we extract are cumu… --- ## [Logstash filter for filtering out specific words from message](https://discuss.elastic.co/t/logstash-filter-for-filtering-out-specific-words-from-message/307853)
**Author:** [@Muhammed\_Danish](https://discuss.elastic.co/u/Muhammed_Danish)\ **Replies:** 6\ **Last updated:** [June 24, 2022, 3:42pm UTC](https://discuss.elastic.co/t/logstash-filter-for-filtering-out-specific-words-from-message/307853 "2022-06-24T15:42:10Z")
Hello team, I am looking for a filter to filter out based on the words in a log message. For example, Log messages - This is a test message from server hosted in AWS and This is a test message coming from server hoste… --- ## [Filebeat setup (error loading template: failed to put data stream. no matching index template found for data stream)](https://discuss.elastic.co/t/filebeat-setup-error-loading-template-failed-to-put-data-stream-no-matching-index-template-found-for-data-stream/307789)
**Author:** [@ulisses](https://discuss.elastic.co/u/ulisses)\ **Replies:** 5\ **Last updated:** [June 24, 2022, 3:24pm UTC](https://discuss.elastic.co/t/filebeat-setup-error-loading-template-failed-to-put-data-stream-no-matching-index-template-found-for-data-stream/307789 "2022-06-24T15:24:31Z")
I'm running a dev environment to understand how i can use filebeat and elasticsearch to store our application logs but i can't make it work with custom configurations. I'm trying to change index name following this docu… --- ## [EFK stack performance with large data](https://discuss.elastic.co/t/efk-stack-performance-with-large-data/308101)
**Author:** [@Mohit.Sharma](https://discuss.elastic.co/u/Mohit.Sharma)\ **Replies:** 3\ **Last updated:** [June 24, 2022, 3:06pm UTC](https://discuss.elastic.co/t/efk-stack-performance-with-large-data/308101 "2022-06-24T15:06:10Z")
Hello Team, We are planning to store logs in ElasticSearch DB through Filebeat and then create dashboards on Kibana for graphical visualization(Lens, TSVB, Aggregations) using basic license. As we are expecting around 2… --- ## [Pie Chart Canvas - Show only pencertage as label to prevent overlapping](https://discuss.elastic.co/t/pie-chart-canvas-show-only-pencertage-as-label-to-prevent-overlapping/308103)
**Author:** [@Chiaaa](https://discuss.elastic.co/u/Chiaaa)\ **Replies:** 2\ **Last updated:** [June 24, 2022, 2:00pm UTC](https://discuss.elastic.co/t/pie-chart-canvas-show-only-pencertage-as-label-to-prevent-overlapping/308103 "2022-06-24T14:00:27Z")
Hi, I want to create a pie chart in Canvas and I set the "Show Labels" property. The labels overlapping, so I would like to know if is possibile set css properties or something similar that allow me to show only the pe… --- ## [Grok filter some entries have additional fields](https://discuss.elastic.co/t/grok-filter-some-entries-have-additional-fields/308092)
**Author:** [@tartaarsap](https://discuss.elastic.co/u/tartaarsap)\ **Replies:** 2\ **Last updated:** [June 24, 2022, 1:55pm UTC](https://discuss.elastic.co/t/grok-filter-some-entries-have-additional-fields/308092 "2022-06-24T13:55:46Z")
I have the following dataset: 1613766382 FILE %computerName% MACB \[4096\] c:/$MFTMirr 1613766382 FILE %computerName% MACB \[4096\] c:/$MFTMirr ($FILE\_NAME) I am trying to build a GROK filter to match on both lines. Howe… --- ## [How to run FS Crawler in background on Ubuntu 20.04](https://discuss.elastic.co/t/how-to-run-fs-crawler-in-background-on-ubuntu-20-04/308072)
**Author:** [@zxuz111](https://discuss.elastic.co/u/zxuz111)\ **Replies:** 2\ **Last updated:** [June 24, 2022, 1:42pm UTC](https://discuss.elastic.co/t/how-to-run-fs-crawler-in-background-on-ubuntu-20-04/308072 "2022-06-24T13:42:38Z")
I tried to run FS Crawler in background on Ubuntu 20.04, and I changed the last line of file bin/fscrawler as following: exec "nohup $JAVA" ${JAVA\_OPTS} -cp "$FS\_CLASSPATH" "fr.pilato.elasticsearch.crawler.fs.cli.FsCraw… --- ## [Backport of a Lucene bugfix (Lucene 9.0/ES 8.0)?](https://discuss.elastic.co/t/backport-of-a-lucene-bugfix-lucene-9-0-es-8-0/308093)
**Author:** [@mhugo](https://discuss.elastic.co/u/mhugo)\ **Replies:** 2\ **Last updated:** [June 24, 2022, 1:23pm UTC](https://discuss.elastic.co/t/backport-of-a-lucene-bugfix-lucene-9-0-es-8-0/308093 "2022-06-24T13:23:37Z")
Hi, We are migrating from ES 6.8 to ES 7.17 and encountered a bug during indexing for some complex shapes. It turns out the issue is a tessellation bug in Lucene that has been fixed in Lucene 9.0 (see \[LUCENE-9580\] Tess… --- ## [Why query ignores slop value?](https://discuss.elastic.co/t/why-query-ignores-slop-value/307953)
**Author:** [@asil](https://discuss.elastic.co/u/asil)\ **Replies:** 3\ **Last updated:** [June 24, 2022, 12:47pm UTC](https://discuss.elastic.co/t/why-query-ignores-slop-value/307953 "2022-06-24T12:47:59Z")
I'm using elastic search 7.6.2 I have index with the following mapping: "mappings": { "properties": { "content": {"type": "text"}, } } with 3 documents: Distri… --- ## [Issues with clustering on Docker](https://discuss.elastic.co/t/issues-with-clustering-on-docker/308104)
**Author:** [@Wrighty11](https://discuss.elastic.co/u/Wrighty11)\ **Replies:** 2\ **Last updated:** [June 24, 2022, 12:37pm UTC](https://discuss.elastic.co/t/issues-with-clustering-on-docker/308104 "2022-06-24T12:37:51Z")
Hi everyone, having an issue with setting up an elasticsearch cluster over talking over 2 centos machines. Here are my compse files: VM 1 - version: '2.2' services: es-8.2.2: image: docker.elastic.co/elasticsear… --- ## [How to sort month/day properly in Canvas](https://discuss.elastic.co/t/how-to-sort-month-day-properly-in-canvas/307529)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 3\ **Last updated:** [June 24, 2022, 11:51am UTC](https://discuss.elastic.co/t/how-to-sort-month-day-properly-in-canvas/307529 "2022-06-24T11:51:38Z")
Hello everyone, got a problem working with the canvas. The date isn't showing properly (organized by month then day) and I was wondering if theres anything I could use to have it fixed. Here is how the chart is looking … --- ## [Logstash JSON File input](https://discuss.elastic.co/t/logstash-json-file-input/308108)
**Author:** [@priyankamondalhcl](https://discuss.elastic.co/u/priyankamondalhcl)\ **Replies:** 0\ **Last updated:** [June 24, 2022, 11:39am UTC](https://discuss.elastic.co/t/logstash-json-file-input/308108 "2022-06-24T11:39:47Z")
Hi Team, Please help me to set logstash config from nested json input file. My json file look like below: \[ { "billing\_account\_id": "loma", "InvoiceMonth": "123456", "credits": \[ { "name": "abc", "amount": ,0.0… --- ## [Unable to multi\_match in php library](https://discuss.elastic.co/t/unable-to-multi-match-in-php-library/308107)
**Author:** [@Jeroen2](https://discuss.elastic.co/u/Jeroen2)\ **Replies:** 0\ **Last updated:** [June 24, 2022, 11:32am UTC](https://discuss.elastic.co/t/unable-to-multi-match-in-php-library/308107 "2022-06-24T11:32:07Z")
I'm trying to use a filter to search multiple fields and query between dates. The PHP looks like this: $params = \[ 'index' =\> $this-\>index . '\*', 'size' =\> self::HITS\_SIZE, 'from' =\> … --- ## [Logstash pipeline currently forwarding logs to elasticsearch](https://discuss.elastic.co/t/logstash-pipeline-currently-forwarding-logs-to-elasticsearch/307197)
**Author:** [@lhmzhou](https://discuss.elastic.co/u/lhmzhou)\ **Replies:** 5\ **Last updated:** [June 24, 2022, 11:28am UTC](https://discuss.elastic.co/t/logstash-pipeline-currently-forwarding-logs-to-elasticsearch/307197 "2022-06-24T11:28:50Z")
Hi, Currently, I have a logstash pipeline that is forwarding logs to Elasticsearch. I am planning to send logfiles to S3 as a batch using the aws s3 cli. What are some drawbacks to this approach? Is it possible to accou… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=887) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=889)