# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=906 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 907 --- ## [Multiline pattern not working in filebeat input\_type -filestream](https://discuss.elastic.co/t/multiline-pattern-not-working-in-filebeat-input-type-filestream/306947)
**Author:** [@garry12](https://discuss.elastic.co/u/garry12)\ **Replies:** 5\ **Last updated:** [June 12, 2022, 8:53pm UTC](https://discuss.elastic.co/t/multiline-pattern-not-working-in-filebeat-input-type-filestream/306947 "2022-06-12T20:53:28Z")
I want to make multiline pattern work but the snipped I used below is working only when I change input\_type: log and NOT working with input\_type:filesteam can someone please help me what I should change to make multiline… --- ## [Conditional processing in txt file](https://discuss.elastic.co/t/conditional-processing-in-txt-file/306654)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 4\ **Last updated:** [June 12, 2022, 8:10pm UTC](https://discuss.elastic.co/t/conditional-processing-in-txt-file/306654 "2022-06-12T20:10:31Z")
Hi I need to make a parsing data through logstash but in the one txt file consists four different pattern How to make logstash for write to another index after encountering a given particular pattern. I am also asking… --- ## [\[ERROR\]\[elasticsearch-service\] Unable to retrieve version information from Elasticsearch nodes. getaddrinfo ENOTFOUND poem](https://discuss.elastic.co/t/error-elasticsearch-service-unable-to-retrieve-version-information-from-elasticsearch-nodes-getaddrinfo-enotfound-poem/306962)
**Author:** [@Tony\_Cheng](https://discuss.elastic.co/u/Tony_Cheng)\ **Replies:** 1\ **Last updated:** [June 12, 2022, 3:03pm UTC](https://discuss.elastic.co/t/error-elasticsearch-service-unable-to-retrieve-version-information-from-elasticsearch-nodes-getaddrinfo-enotfound-poem/306962 "2022-06-12T15:03:12Z")
Hi all. I tried to install elastic stack 8.2.2 with docker following the instruction in document. But Kibana server just cannot be ready. Could anybody help me please... My docker-compose: version: "3" services: ela… --- ## [Kibana ingress show 404 server not found](https://discuss.elastic.co/t/kibana-ingress-show-404-server-not-found/306939)
**Author:** [@mohamed\_atef](https://discuss.elastic.co/u/mohamed_atef)\ **Replies:** 3\ **Last updated:** [June 12, 2022, 9:04am UTC](https://discuss.elastic.co/t/kibana-ingress-show-404-server-not-found/306939 "2022-06-12T09:04:37Z")
--- ## [First boot after install fails to display password, token, etc](https://discuss.elastic.co/t/first-boot-after-install-fails-to-display-password-token-etc/306949)
**Author:** [@Jack\_Park](https://discuss.elastic.co/u/Jack_Park)\ **Replies:** 11\ **Last updated:** [June 12, 2022, 2:33am UTC](https://discuss.elastic.co/t/first-boot-after-install-fails-to-display-password-token-etc/306949 "2022-06-12T02:33:11Z")
Version 8.2.2 Since I installed before but failed to grab those values, I started over. What this is telling me is that ES maintains a hidden record, which I cannot find. This is on a Mac. There is no ~/.elastic fie a… --- ## [Packetbeat no data but error Cannot index event publisher.Event](https://discuss.elastic.co/t/packetbeat-no-data-but-error-cannot-index-event-publisher-event/306946)
**Author:** [@mayer](https://discuss.elastic.co/u/mayer)\ **Replies:** 0\ **Last updated:** [June 11, 2022, 8:04pm UTC](https://discuss.elastic.co/t/packetbeat-no-data-but-error-cannot-index-event-publisher-event/306946 "2022-06-11T20:04:13Z")
Dear All, I am running ELK 8.2.2 on Debian 11 bullseye and installed packetbeat 8.2.2. "packetbeat setup" brings no errors. And packetbeat test config Config OK packetbeat test output elasticsearch: https://kibana8.h… --- ## [ELK 8.2 using our ca certifiate for enrolling elastics node](https://discuss.elastic.co/t/elk-8-2-using-our-ca-certifiate-for-enrolling-elastics-node/306390)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 2\ **Last updated:** [June 11, 2022, 7:21pm UTC](https://discuss.elastic.co/t/elk-8-2-using-our-ca-certifiate-for-enrolling-elastics-node/306390 "2022-06-11T19:21:03Z")
Hello, I want to use my own CA certificate in enrolling elastic nodes in the same cluster. What are the steps to follow? Thanks. --- ## [IP enrichment to Hostname](https://discuss.elastic.co/t/ip-enrichment-to-hostname/306944)
**Author:** [@xfaith](https://discuss.elastic.co/u/xfaith)\ **Replies:** 0\ **Last updated:** [June 11, 2022, 7:16pm UTC](https://discuss.elastic.co/t/ip-enrichment-to-hostname/306944 "2022-06-11T19:16:30Z")
Trying to figure how to provide hostname based off the IP, issue is system is reading information out of band so no DNS or anything to tie back to. I could do a basic file/hostfile for majority of IP --\> hostname, or co… --- ## [What should I do if I need special analyzer in ElasticSearch?](https://discuss.elastic.co/t/what-should-i-do-if-i-need-special-analyzer-in-elasticsearch/306941)
**Author:** [@Gresmir](https://discuss.elastic.co/u/Gresmir)\ **Replies:** 1\ **Last updated:** [June 11, 2022, 7:00pm UTC](https://discuss.elastic.co/t/what-should-i-do-if-i-need-special-analyzer-in-elasticsearch/306941 "2022-06-11T19:00:50Z")
In my textual data, I have structures like this: ст. ст. 40, 131, 132, 176-178, 183, ч. 2 ст. 187, 188, 184, 189, 194 KK Where KK is the name of a codex, ст. ст., or ст. mean article, ч. mean part. I want Elasticsear… --- ## [Filebeat config for log group with wildcard for aws-cloudwatch?](https://discuss.elastic.co/t/filebeat-config-for-log-group-with-wildcard-for-aws-cloudwatch/306835)
**Author:** [@jrykowski-huron](https://discuss.elastic.co/u/jrykowski-huron)\ **Replies:** 2\ **Last updated:** [June 11, 2022, 4:29pm UTC](https://discuss.elastic.co/t/filebeat-config-for-log-group-with-wildcard-for-aws-cloudwatch/306835 "2022-06-11T16:29:37Z")
If set of CloudWatch log groups... example1.{guid} example2.{guid} example3.{guid} Is it possible to configure filebeat.inputs for aws-cloudwatch with a single entry using wildcard? Like for example set above with … --- ## [Unable to start kibana with systemd on ubuntu while manually does](https://discuss.elastic.co/t/unable-to-start-kibana-with-systemd-on-ubuntu-while-manually-does/306925)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 3\ **Last updated:** [June 11, 2022, 2:00pm UTC](https://discuss.elastic.co/t/unable-to-start-kibana-with-systemd-on-ubuntu-while-manually-does/306925 "2022-06-11T14:00:01Z")
Hi Team, I am facing a weird isssue. On my ubuntu system I am unable to start kibana process with systemd and its failing while if I am starting from command line or manually it does. Any clud why? below are the error … --- ## [Snapshots Compression](https://discuss.elastic.co/t/snapshots-compression/306932)
**Author:** [@wonderland14](https://discuss.elastic.co/u/wonderland14)\ **Replies:** 2\ **Last updated:** [June 11, 2022, 12:58pm UTC](https://discuss.elastic.co/t/snapshots-compression/306932 "2022-06-11T12:58:03Z")
What is the difference if I toggle switch On the Snapshot Compression? What's the difference when I leave it as Off? Does it any make sense? --- ## [Unable to Parse response from elastic search in Java Spring Data Elasticsearch](https://discuss.elastic.co/t/unable-to-parse-response-from-elastic-search-in-java-spring-data-elasticsearch/306225)
**Author:** [@Waqas\_Rana](https://discuss.elastic.co/u/Waqas_Rana)\ **Replies:** 1\ **Last updated:** [June 11, 2022, 8:30am UTC](https://discuss.elastic.co/t/unable-to-parse-response-from-elastic-search-in-java-spring-data-elasticsearch/306225 "2022-06-11T08:30:27Z")
I am just creating/posting new entry that is created successful but while responding its getting issue of parsing . testRepository.save(application); I am not using any client because JavaHighlevel Rest client… --- ## [Cluster health changing from GREEN to RED](https://discuss.elastic.co/t/cluster-health-changing-from-green-to-red/306929)
**Author:** [@amitsa](https://discuss.elastic.co/u/amitsa)\ **Replies:** 0\ **Last updated:** [June 11, 2022, 6:56am UTC](https://discuss.elastic.co/t/cluster-health-changing-from-green-to-red/306929 "2022-06-11T06:56:39Z")
I am running elastic cluster on kubernetes Master Logs {"@timestamp":"2022-06-11T06:31:02.487Z", "log.level": "INFO", "message":"transport connection to \[{es-data}{NZYIeN70Qzypz7Oh3rAuHQ}{fuY88RvWS3eSlb\_g7GXQyQ}{10.244.… --- ## ["doc\_as\_upsert" overwrites logs instead of appending the logs](https://discuss.elastic.co/t/doc-as-upsert-overwrites-logs-instead-of-appending-the-logs/306898)
**Author:** [@Marc\_Jacques](https://discuss.elastic.co/u/Marc_Jacques)\ **Replies:** 1\ **Last updated:** [June 11, 2022, 4:19am UTC](https://discuss.elastic.co/t/doc-as-upsert-overwrites-logs-instead-of-appending-the-logs/306898 "2022-06-11T04:19:12Z")
Hello Elastic, I have a filebeat agent that harvests logs. It sends the logs to Logstash on the same server, which sends it after to Elastic Cloud, the field "message" has the value of the log on Elastic cloud. After a… --- ## [Download reports by curl](https://discuss.elastic.co/t/download-reports-by-curl/306912)
**Author:** [@PascalThalmann](https://discuss.elastic.co/u/PascalThalmann)\ **Replies:** 1\ **Last updated:** [June 10, 2022, 11:15pm UTC](https://discuss.elastic.co/t/download-reports-by-curl/306912 "2022-06-10T23:15:53Z")
Hi, I have an Elastic Cloud deployment and would like to download saved reports with curl and an API key. I tried curl and wget, but I don't know how to get the right URL of the report. When I download the image manuall… --- ## [Twitter Logstash issue](https://discuss.elastic.co/t/twitter-logstash-issue/306914)
**Author:** [@Didi\_Sisi](https://discuss.elastic.co/u/Didi_Sisi)\ **Replies:** 0\ **Last updated:** [June 10, 2022, 8:57pm UTC](https://discuss.elastic.co/t/twitter-logstash-issue/306914 "2022-06-10T20:57:11Z")
Hello; I have an issue with my twitter app and logstash twitter plugin. I have to extract tweets using the logstash twitter plugin. When I was using my old aps, it works perfectly (I have created it in 2020) Now I cre… --- ## [Possible to redirect Data Visualizer to existing ingest pipeline for import?](https://discuss.elastic.co/t/possible-to-redirect-data-visualizer-to-existing-ingest-pipeline-for-import/306063)
**Author:** [@fl33t](https://discuss.elastic.co/u/fl33t)\ **Replies:** 1\ **Last updated:** [June 10, 2022, 7:51pm UTC](https://discuss.elastic.co/t/possible-to-redirect-data-visualizer-to-existing-ingest-pipeline-for-import/306063 "2022-06-10T19:51:41Z")
In the ML section, if we know the type of log file that we want to upload for visualization and analysis, would it be possible to redirect it to an existing ingest pipeline (with associated mappings and index settings) i… --- ## [Filebeat not reading logs from subdirectories](https://discuss.elastic.co/t/filebeat-not-reading-logs-from-subdirectories/306905)
**Author:** [@garry12](https://discuss.elastic.co/u/garry12)\ **Replies:** 3\ **Last updated:** [June 10, 2022, 6:42pm UTC](https://discuss.elastic.co/t/filebeat-not-reading-logs-from-subdirectories/306905 "2022-06-10T18:42:03Z")
Hey team, I am relatively new to ELK stack and I am trying to send logs from a linux servers to Elasticsearch. The path I am choosing is - I have installed the filebeat on linux server where my application logs are gett… --- ## [Case insensitive wildcard search in 7.17.0](https://discuss.elastic.co/t/case-insensitive-wildcard-search-in-7-17-0/306903)
**Author:** [@mej101](https://discuss.elastic.co/u/mej101)\ **Replies:** 2\ **Last updated:** [June 10, 2022, 6:33pm UTC](https://discuss.elastic.co/t/case-insensitive-wildcard-search-in-7-17-0/306903 "2022-06-10T18:33:27Z")
I'm running Elasticsearch 7.17.0, and when I try to run the following query: GET index\_name/\_search { "query": { "wildcard": { "fieldName.subfield": "\*view", "case\_insensitive": true } } } I get… --- ## [Creating a watcher to check for no data in all the indices](https://discuss.elastic.co/t/creating-a-watcher-to-check-for-no-data-in-all-the-indices/306808)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 2\ **Last updated:** [June 10, 2022, 3:57pm UTC](https://discuss.elastic.co/t/creating-a-watcher-to-check-for-no-data-in-all-the-indices/306808 "2022-06-10T15:57:47Z")
Hello team, I need to create watcher to check for no data in all the indices. I have total 100+ indices. I am using below script. in indices, i am putting \* is this work? I need all index name in body which have 0 re… --- ## ["Unable to lock JVM Memory: error=12, reason=Cannot allocate memory"](https://discuss.elastic.co/t/unable-to-lock-jvm-memory-error-12-reason-cannot-allocate-memory/306000)
**Author:** [@amitsa](https://discuss.elastic.co/u/amitsa)\ **Replies:** 7\ **Last updated:** [June 10, 2022, 3:40pm UTC](https://discuss.elastic.co/t/unable-to-lock-jvm-memory-error-12-reason-cannot-allocate-memory/306000 "2022-06-10T15:40:37Z")
I have enabled bootstrap.memory\_lock: true ERROR: \[1\] bootstrap checks failed. You must address the points described in the following \[1\] lines before starting Elasticsearch. bootstrap check failure \[1\] of \[1\]: memory… --- ## [Can't use variables in containing a slash in elastic-agent configuration](https://discuss.elastic.co/t/cant-use-variables-in-containing-a-slash-in-elastic-agent-configuration/306902)
**Author:** [@antex](https://discuss.elastic.co/u/antex)\ **Replies:** 0\ **Last updated:** [June 10, 2022, 3:39pm UTC](https://discuss.elastic.co/t/cant-use-variables-in-containing-a-slash-in-elastic-agent-configuration/306902 "2022-06-10T15:39:09Z")
I'm trying to define a condition in an elastic-agent configuration where the variable contains a slash, e.g.: streams: - id: \>- filestream-kubernetes.container\_logs-catchall d… --- ## [ILM policy: Document count reduced but Index count unchanged](https://discuss.elastic.co/t/ilm-policy-document-count-reduced-but-index-count-unchanged/306899)
**Author:** [@Chris\_Stone](https://discuss.elastic.co/u/Chris_Stone)\ **Replies:** 0\ **Last updated:** [June 10, 2022, 3:15pm UTC](https://discuss.elastic.co/t/ilm-policy-document-count-reduced-but-index-count-unchanged/306899 "2022-06-10T15:15:12Z")
A timeline of events: At some point, I inadvertently changed max index size changed from 50GB to 1GB. After some time, I began getting circuit-breaker errors about maxing out the Java heap (31GB on each of the 4 nodes)… --- ## [How to get the time a query spends in the queue before the shards receives the query](https://discuss.elastic.co/t/how-to-get-the-time-a-query-spends-in-the-queue-before-the-shards-receives-the-query/306897)
**Author:** [@shivam\_agrawal1](https://discuss.elastic.co/u/shivam_agrawal1)\ **Replies:** 0\ **Last updated:** [June 10, 2022, 1:58pm UTC](https://discuss.elastic.co/t/how-to-get-the-time-a-query-spends-in-the-queue-before-the-shards-receives-the-query/306897 "2022-06-10T13:58:34Z")
The took\_millis in Elasticsearch slow logs tells the time it takes on execution on the shard level, it does not encounter the time it spends in the queue. How to get the time. a query spends in the queue before it is pas… --- ## [How to insert the labels inside the pie chart](https://discuss.elastic.co/t/how-to-insert-the-labels-inside-the-pie-chart/306154)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 3\ **Last updated:** [June 10, 2022, 1:25pm UTC](https://discuss.elastic.co/t/how-to-insert-the-labels-inside-the-pie-chart/306154 "2022-06-10T13:25:11Z")
I want to organize these values inside the colored parts of the chart. I know that by Label radius you can set the distance from the center but I wanted a way to organize them so they fit inside the slices...Is it avaiab… --- ## [Java::JavaLang::IllegalStateException\` for \`PipelineAction::Create\\`"](https://discuss.elastic.co/t/java-illegalstateexception-for-pipelineaction-create-main/306871)
**Author:** [@akjain3](https://discuss.elastic.co/u/akjain3)\ **Replies:** 1\ **Last updated:** [June 10, 2022, 12:44pm UTC](https://discuss.elastic.co/t/java-illegalstateexception-for-pipelineaction-create-main/306871 "2022-06-10T12:44:29Z")
Hi, I am new to logstash and using logstash to add my logs with Elasticsearch. But I can't get through this error. Please help. It is urgent. Using bundled JDK: /Users/akjain3cisco.com/Documents/ELK/logstash-7.15.2/jdk.… --- ## [Persistent Volume / Docker installation](https://discuss.elastic.co/t/persistent-volume-docker-installation/306886)
**Author:** [@Phildefer](https://discuss.elastic.co/u/Phildefer)\ **Replies:** 0\ **Last updated:** [June 10, 2022, 12:26pm UTC](https://discuss.elastic.co/t/persistent-volume-docker-installation/306886 "2022-06-10T12:26:10Z")
Hi, I would like how to install Elasticsearch with a persistent volume for the data in order to be able to upgrade Elasticsearch without loosing the indexes. Thank you --- ## [Issue while running the logstash](https://discuss.elastic.co/t/issue-while-running-the-logstash/306884)
**Author:** [@Akanksha2022](https://discuss.elastic.co/u/Akanksha2022)\ **Replies:** 1\ **Last updated:** [June 10, 2022, 12:16pm UTC](https://discuss.elastic.co/t/issue-while-running-the-logstash/306884 "2022-06-10T12:16:09Z")
runner - The given configuration is invalid. Reason: Failed to parse right-hand side of conditional \[file\]/etc/logstash/conf.d/logstash-grok.conf:70:45:\`\`\` --- ## [\[2018-05-27T08:46:23,536\]\[ERROR\]\[logstash.outputs.elasticsearch\] Encountered a retryable error. Will Retry with exponential backoff {:code=\>413, :url=\>"http://elasticsearch\_address:9200/\_bulk"}](https://discuss.elastic.co/t/2018-05-27t0823-536-error-logstash-outputs-elasticsearch-encountered-a-retryable-error-will-retry-with-exponential-backoff-code-413-url-http-elasticsearch-address-9200-bulk/306876)
**Author:** [@Manohar22](https://discuss.elastic.co/u/Manohar22)\ **Replies:** 0\ **Last updated:** [June 10, 2022, 11:37am UTC](https://discuss.elastic.co/t/2018-05-27t0823-536-error-logstash-outputs-elasticsearch-encountered-a-retryable-error-will-retry-with-exponential-backoff-code-413-url-http-elasticsearch-address-9200-bulk/306876 "2022-06-10T11:37:44Z")
Continuing the discussion from Logstash stuck on "Will Retry with exponential backoff": we are seeing below error in logstash logs \[2022-06-10T04:59:38,367\]\[ERROR\]\[logstash.filters.ruby \] Ruby exception occurred: \[… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=905) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=907)