# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=908 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 909 --- ## [How to concatenate two fields using add fields processor in filebeat](https://discuss.elastic.co/t/how-to-concatenate-two-fields-using-add-fields-processor-in-filebeat/306488)
**Author:** [@Anagha\_nambiar](https://discuss.elastic.co/u/Anagha_nambiar)\ **Replies:** 13\ **Last updated:** [June 9, 2022, 4:16pm UTC](https://discuss.elastic.co/t/how-to-concatenate-two-fields-using-add-fields-processor-in-filebeat/306488 "2022-06-09T16:16:45Z")
I have 2 fields with one field carrying date value and another field carrying time value. I would like to have a single field with both date and time values concatenated. Could you please suggest? --- ## [\[Spring Data Elasticsearch\] Exception during save regardless of success](https://discuss.elastic.co/t/spring-data-elasticsearch-exception-during-save-regardless-of-success/306813)
**Author:** [@Almost\_Familiar](https://discuss.elastic.co/u/Almost_Familiar)\ **Replies:** 1\ **Last updated:** [June 9, 2022, 3:59pm UTC](https://discuss.elastic.co/t/spring-data-elasticsearch-exception-during-save-regardless-of-success/306813 "2022-06-09T15:59:21Z")
Hello everyone, we are using version Spring Boot 2.7.0 with Spring Data Elasticsearch, with reactive code. We prefer to make our requests with native queries via the ReactiveElasticsearchOperations interface. For an i… --- ## [Average count record per Min using LENS](https://discuss.elastic.co/t/average-count-record-per-min-using-lens/306379)
**Author:** [@dfraz](https://discuss.elastic.co/u/dfraz)\ **Replies:** 3\ **Last updated:** [June 9, 2022, 1:38pm UTC](https://discuss.elastic.co/t/average-count-record-per-min-using-lens/306379 "2022-06-09T13:38:44Z")
I need to calculate the Average count record ( orders ) per Min and then multiply by 60 to get an estimation of orders per hour. Can it be done with LENS ? Thanks in advance --- ## [Need help to configure http output plugin for https](https://discuss.elastic.co/t/need-help-to-configure-http-output-plugin-for-https/306773)
**Author:** [@guillaumeV](https://discuss.elastic.co/u/guillaumeV)\ **Replies:** 1\ **Last updated:** [June 9, 2022, 2:17pm UTC](https://discuss.elastic.co/t/need-help-to-configure-http-output-plugin-for-https/306773 "2022-06-09T14:17:00Z")
Hello i would like to send data via http output plugin (Http output plugin | Logstash Reference \[8.19\] | Elastic) to a https url . I have a very simple example with "https://www.google.com" which is not working is it pos… --- ## [Error executing 'postInstallation': EACCES: permission denied, mkdir '/bitnami/kibana/data'](https://discuss.elastic.co/t/error-executing-postinstallation-eacces-permission-denied-mkdir-bitnami-kibana-data/306798)
**Author:** [@mohamed\_atef](https://discuss.elastic.co/u/mohamed_atef)\ **Replies:** 2\ **Last updated:** [June 9, 2022, 2:03pm UTC](https://discuss.elastic.co/t/error-executing-postinstallation-eacces-permission-denied-mkdir-bitnami-kibana-data/306798 "2022-06-09T14:03:57Z")
i have issue when i try to run kibana on K8S cluster via helm chart Error executing 'postInstallation': EACCES: permission denied, mkdir '/bitnami/kibana/data' --- ## [Grok pattern for snort alerts](https://discuss.elastic.co/t/grok-pattern-for-snort-alerts/306625)
**Author:** [@anushka1203](https://discuss.elastic.co/u/anushka1203)\ **Replies:** 4\ **Last updated:** [June 9, 2022, 1:54pm UTC](https://discuss.elastic.co/t/grok-pattern-for-snort-alerts/306625 "2022-06-09T13:54:27Z")
HI everyone, Need help constructing grok pattern for the snort alert log file. I have the so far, but the output is incomplete - %{MONTHNUM:month}\\/%{MONTHDAY:day}-%{HOUR:hour}:%{MINUTE:minute}:%{SECOND:second}\\s+\\\[\\\*\\… --- ## [Snapshots in Kibana show failed while running](https://discuss.elastic.co/t/snapshots-in-kibana-show-failed-while-running/306702)
**Author:** [@eh2021-elastic](https://discuss.elastic.co/u/eh2021-elastic)\ **Replies:** 2\ **Last updated:** [June 9, 2022, 1:45pm UTC](https://discuss.elastic.co/t/snapshots-in-kibana-show-failed-while-running/306702 "2022-06-09T13:45:04Z")
We upgraded from 7.11 to 7.16.3 and after the upgrade when we run snapshots of indices Kibana will show all the shards failed while the snapshot runs. Then once the snapshot completes it will have updated info and will … --- ## [Packetbeat flooding logs with FindSocketsOfPid errors when on system with short living processes](https://discuss.elastic.co/t/packetbeat-flooding-logs-with-findsocketsofpid-errors-when-on-system-with-short-living-processes/306802)
**Author:** [@Christos\_Arvanitis](https://discuss.elastic.co/u/Christos_Arvanitis)\ **Replies:** 0\ **Last updated:** [June 9, 2022, 1:39pm UTC](https://discuss.elastic.co/t/packetbeat-flooding-logs-with-findsocketsofpid-errors-when-on-system-with-short-living-processes/306802 "2022-06-09T13:39:44Z")
Hello, Due to the error logging here, on systems running many short living processes, we realized that packetbeat is flooding logs with entries like the following: {"log.level":"error","@timestamp":"2022-06-09T15:25:57… --- ## [How to create index name with date and incremental Number](https://discuss.elastic.co/t/how-to-create-index-name-with-date-and-incremental-number/305923)
**Author:** [@gokulnath112](https://discuss.elastic.co/u/gokulnath112)\ **Replies:** 3\ **Last updated:** [June 9, 2022, 1:33pm UTC](https://discuss.elastic.co/t/how-to-create-index-name-with-date-and-incremental-number/305923 "2022-06-09T13:33:22Z")
Greetings ..! I want to create index from Logstash. The index name should be (index\_name-2022-05-30-001). And I set a limit to index is 1.5gb, when it exceeds in the same day, the newly created index name should be ind… --- ## [Jira Connector - Version supported](https://discuss.elastic.co/t/jira-connector-version-supported/306801)
**Author:** [@Orlando\_Gonzalez](https://discuss.elastic.co/u/Orlando_Gonzalez)\ **Replies:** 0\ **Last updated:** [June 9, 2022, 1:30pm UTC](https://discuss.elastic.co/t/jira-connector-version-supported/306801 "2022-06-09T13:30:20Z")
Hi everybody We are trying to configure the Jira connector from an ELK 7.15.0, where the Jira Service Desk is Server Onpremise version 4.9.1. So far we have not been able to configure it, can you tell us if this configu… --- ## [Data size on disk increase 15 times when moved from hive to elasticsearch](https://discuss.elastic.co/t/data-size-on-disk-increase-15-times-when-moved-from-hive-to-elasticsearch/305654)
**Author:** [@charvi23](https://discuss.elastic.co/u/charvi23)\ **Replies:** 26\ **Last updated:** [June 9, 2022, 1:21pm UTC](https://discuss.elastic.co/t/data-size-on-disk-increase-15-times-when-moved-from-hive-to-elasticsearch/305654 "2022-06-09T13:21:56Z")
I am using hive-hadoop jar to move data from hive to Elasticsearch. The data size on disk is ~ 35GB which when moved to ES becomes ~600GB. Is this expected behaviour? Or is there that something is missing from our end. R… --- ## [Append an array element to logs coming from Logstash](https://discuss.elastic.co/t/append-an-array-element-to-logs-coming-from-logstash/306794)
**Author:** [@dishant.sharma](https://discuss.elastic.co/u/dishant.sharma)\ **Replies:** 0\ **Last updated:** [June 9, 2022, 12:27pm UTC](https://discuss.elastic.co/t/append-an-array-element-to-logs-coming-from-logstash/306794 "2022-06-09T12:27:19Z")
how to append an element to a particular field already containing an array? Actually, I am writing a painless script in the output part of the Logstash conf file. Code inside my conf file is: input { kafka { … --- ## [Splunk vs. Elastic: Lookup Tables](https://discuss.elastic.co/t/splunk-vs-elastic-lookup-tables/306669)
**Author:** [@alaine](https://discuss.elastic.co/u/alaine)\ **Replies:** 4\ **Last updated:** [June 9, 2022, 12:07pm UTC](https://discuss.elastic.co/t/splunk-vs-elastic-lookup-tables/306669 "2022-06-09T12:07:32Z")
Good Morning, I have been working with a customer for a while and they have chosen to migrate from Splunk to Elastic. One sticking point has been lookup tables. They had very specific lookup tables that provided them wi… --- ## [Alerting error: Can't get text on a START\_OBJECT](https://discuss.elastic.co/t/alerting-error-cant-get-text-on-a-start-object/306781)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 4\ **Last updated:** [June 9, 2022, 11:25am UTC](https://discuss.elastic.co/t/alerting-error-cant-get-text-on-a-start-object/306781 "2022-06-09T11:25:04Z")
Hi all, I'm trying to create an alert for a query so that it sends an email when that query condition is met. When i try to create monitor & action, when i click on create -it throws an error-: \[illegal\_state\_except… --- ## [Connection problem between Logstash and Elasticsearch running on Docker](https://discuss.elastic.co/t/connection-problem-between-logstash-and-elasticsearch-running-on-docker/306757)
**Author:** [@Francesco66](https://discuss.elastic.co/u/Francesco66)\ **Replies:** 4\ **Last updated:** [June 9, 2022, 11:24am UTC](https://discuss.elastic.co/t/connection-problem-between-logstash-and-elasticsearch-running-on-docker/306757 "2022-06-09T11:24:15Z")
Hello team, I have a Logstash that I can successfully run and start by using the following docker command: ------------------------- docker run --rm -d --name logstash-Casex -p 8080:8080 -p 8081:8081 -v /Logstash\_custom\_… --- ## [Can't etablish connection with logstash and my filebeat 7.17.1](https://discuss.elastic.co/t/cant-etablish-connection-with-logstash-and-my-filebeat-7-17-1/306722)
**Author:** [@Dreinale](https://discuss.elastic.co/u/Dreinale)\ **Replies:** 5\ **Last updated:** [June 9, 2022, 11:15am UTC](https://discuss.elastic.co/t/cant-etablish-connection-with-logstash-and-my-filebeat-7-17-1/306722 "2022-06-09T11:15:48Z")
Hi all, I want to do a monitoring of my log but i don't understand why my logstash doesn't"t work with filebeat. For now i have Elasticsearch: Elasticsearch.yml node.name: master-node-1 node.master: true cluster.init… --- ## [Logstash Docker on GCP Cloud Run: Expected the service InnerService \[FAILED\] to be TERMINATED, but the service has FAILED](https://discuss.elastic.co/t/logstash-docker-on-gcp-cloud-run-expected-the-service-innerservice-failed-to-be-terminated-but-the-service-has-failed/306785)
**Author:** [@hegdesandesh25](https://discuss.elastic.co/u/hegdesandesh25)\ **Replies:** 0\ **Last updated:** [June 9, 2022, 10:42am UTC](https://discuss.elastic.co/t/logstash-docker-on-gcp-cloud-run-expected-the-service-innerservice-failed-to-be-terminated-but-the-service-has-failed/306785 "2022-06-09T10:42:36Z")
Continuing the discussion from Logstash Docker on GCP Cloud Run: Failed to find a usable hardware address from the network interfaces: I have a similar use-case, running custom logstash container from gcloud-run with th… --- ## [Permissions for Move to lifecycle step API wrong in docs?](https://discuss.elastic.co/t/permissions-for-move-to-lifecycle-step-api-wrong-in-docs/304691)
**Author:** [@nisow95612](https://discuss.elastic.co/u/nisow95612)\ **Replies:** 1\ **Last updated:** [June 9, 2022, 10:23am UTC](https://discuss.elastic.co/t/permissions-for-move-to-lifecycle-step-api-wrong-in-docs/304691 "2022-06-09T10:23:29Z")
Hello nice people of elastic, I am confused about the permissions required to use the Move to lifecycle step API | Elasticsearch Guide \[8.2\] | Elastic The docs say you must have the manage\_ilm privileges on the indices … --- ## [Set index setting like unassigned.node\_left timeout from ILM](https://discuss.elastic.co/t/set-index-setting-like-unassigned-node-left-timeout-from-ilm/306782)
**Author:** [@nisow95612](https://discuss.elastic.co/u/nisow95612)\ **Replies:** 0\ **Last updated:** [June 9, 2022, 10:22am UTC](https://discuss.elastic.co/t/set-index-setting-like-unassigned-node-left-timeout-from-ilm/306782 "2022-06-09T10:22:57Z")
Hello, I wonder, is there a way to apply settings to indices when transitioning betwen ILM phases? My motivation is that I would like my cold indices to have longer index.unassigned.node\_left.delayed\_timeout than the h… --- ## [How to sort buckets in Elasticsearch on their first occurrence in a search](https://discuss.elastic.co/t/how-to-sort-buckets-in-elasticsearch-on-their-first-occurrence-in-a-search/306776)
**Author:** [@Peter\_Dewachtere](https://discuss.elastic.co/u/Peter_Dewachtere)\ **Replies:** 0\ **Last updated:** [June 9, 2022, 9:24am UTC](https://discuss.elastic.co/t/how-to-sort-buckets-in-elasticsearch-on-their-first-occurrence-in-a-search/306776 "2022-06-09T09:24:29Z")
I have an Elasticsearch query (version 7) that returns a paged result of products. The query has a specific sort on multiple fields: Product A - image 1 Product B - image 1 Product C - image 2 Product D - image 2 Prod… --- ## [Why does elasticsearch assign shards to cold nodes?](https://discuss.elastic.co/t/why-does-elasticsearch-assign-shards-to-cold-nodes/306774)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 0\ **Last updated:** [June 9, 2022, 9:04am UTC](https://discuss.elastic.co/t/why-does-elasticsearch-assign-shards-to-cold-nodes/306774 "2022-06-09T09:04:19Z")
elk: 7.17.3 01-03 nodes I want to use for hot data search and storage and 04-05 nodes as cold and frozen nodes. I have read the es documentation. By default, the data of the collector will be sent to the data\_content n… --- ## [Unable to restore snapshot](https://discuss.elastic.co/t/unable-to-restore-snapshot/306771)
**Author:** [@noob2](https://discuss.elastic.co/u/noob2)\ **Replies:** 0\ **Last updated:** [June 9, 2022, 8:53am UTC](https://discuss.elastic.co/t/unable-to-restore-snapshot/306771 "2022-06-09T08:53:44Z")
I logged in as admin user , still not able to restore snapshot from aws s3 , while creating snapshot , the response was "Success". while restoring the snapshot, i get the following response, { "error" : { "root… --- ## [Cannot index event publisher.Event](https://discuss.elastic.co/t/cannot-index-event-publisher-event/306420)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 1\ **Last updated:** [June 9, 2022, 8:44am UTC](https://discuss.elastic.co/t/cannot-index-event-publisher-event/306420 "2022-06-09T08:44:07Z")
Hi there, I got this setup using misp integration with elastic-agent and looks fine apart from there´s no data on the dashboard page. I can see on the data stream that indeed data is coming but no parsed? Maybe?: And… --- ## [Elastic Search nodes spitting Unrecognized SSL message error](https://discuss.elastic.co/t/elastic-search-nodes-spitting-unrecognized-ssl-message-error/306720)
**Author:** [@krishnav1](https://discuss.elastic.co/u/krishnav1)\ **Replies:** 3\ **Last updated:** [June 9, 2022, 7:34am UTC](https://discuss.elastic.co/t/elastic-search-nodes-spitting-unrecognized-ssl-message-error/306720 "2022-06-09T07:34:43Z")
Hello, I have Elasticsearch installed along with Fluentbit and Kibana in our kubernetes cluster. Of late, We have a heavy loss of logs from the kubernetes nodes to the elastic indices and there by Kibana. I have been n… --- ## [Need help with special character search](https://discuss.elastic.co/t/need-help-with-special-character-search/306692)
**Author:** [@Kapil.Lanjewar](https://discuss.elastic.co/u/Kapil.Lanjewar)\ **Replies:** 8\ **Last updated:** [June 9, 2022, 7:12am UTC](https://discuss.elastic.co/t/need-help-with-special-character-search/306692 "2022-06-09T07:12:14Z")
I have difficulties searching the special characters from my documents. One of the attribute of the document - "phrase" - contains special characters. Its value is -\> "The 2 QUICK Brown-Foxes jumped over the lazy dog's… --- ## [Snapshot Estimate](https://discuss.elastic.co/t/snapshot-estimate/306742)
**Author:** [@A\_j\_xx](https://discuss.elastic.co/u/A_j_xx)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 9:50pm UTC](https://discuss.elastic.co/t/snapshot-estimate/306742 "2022-06-08T21:50:55Z")
Hi all , In order to take snapshot of index whose size is around 2 TB , how should i set { Chunk size max\_restore\_bytes\_per\_sec max\_snapshot\_bytes\_per\_sec } these parameters to get optimal and maximum performance … --- ## [Active - Active Cross Cluster Replication](https://discuss.elastic.co/t/active-active-cross-cluster-replication/306298)
**Author:** [@cagdasalagoz](https://discuss.elastic.co/u/cagdasalagoz)\ **Replies:** 4\ **Last updated:** [June 9, 2022, 6:30am UTC](https://discuss.elastic.co/t/active-active-cross-cluster-replication/306298 "2022-06-09T06:30:03Z")
Hello World! I am trying to come up with a configuration for disaster recovery for our elastic stack. We have two data-centers(DC1 and DC2) in separate cities and both will be up and running at the same time. If a prob… --- ## [Appending data to existing index](https://discuss.elastic.co/t/appending-data-to-existing-index/306533)
**Author:** [@behappy\_alwayz0401](https://discuss.elastic.co/u/behappy_alwayz0401)\ **Replies:** 2\ **Last updated:** [June 9, 2022, 6:23am UTC](https://discuss.elastic.co/t/appending-data-to-existing-index/306533 "2022-06-09T06:23:40Z")
I have an index that already has data. One of the lines in the CSV that was uploaded, had location field which reflects the co-ordinates for Vietname, showing null values due to which that particular line from the CSV d… --- ## [$ in Top N graph of TSVB](https://discuss.elastic.co/t/in-top-n-graph-of-tsvb/306666)
**Author:** [@behappy\_alwayz0401](https://discuss.elastic.co/u/behappy_alwayz0401)\ **Replies:** 2\ **Last updated:** [June 9, 2022, 6:04am UTC](https://discuss.elastic.co/t/in-top-n-graph-of-tsvb/306666 "2022-06-09T06:04:22Z")
Hi, I have a run time field "Abs Delta Value" which has format as $0,0.\[000\]. The $ sign is showing on all charts in lens and elsewhere except on TSVB. In the "Top N" chart under TSVB, it is only showing the number wi… --- ## [Docker Logstash Error: Cannot assign requested address](https://discuss.elastic.co/t/docker-logstash-error-cannot-assign-requested-address/306711)
**Author:** [@Francesco66](https://discuss.elastic.co/u/Francesco66)\ **Replies:** 2\ **Last updated:** [June 9, 2022, 5:42am UTC](https://discuss.elastic.co/t/docker-logstash-error-cannot-assign-requested-address/306711 "2022-06-09T05:42:23Z")
Hello , I am running a Logstash as Docker container using the following command: .......... docker run --rm -d --name logstash-Casex -p 8080:8080 -p 8081:8081 -v /Logstash\_custom\_configs/config/pipelines.yml:/usr/share/l… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=907) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=909)