# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=909 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 910 --- ## [Index pattern doesn't have a UUID](https://discuss.elastic.co/t/index-pattern-doesnt-have-a-uuid/306596)
**Author:** [@Mary2022](https://discuss.elastic.co/u/Mary2022)\ **Replies:** 3\ **Last updated:** [June 9, 2022, 5:02am UTC](https://discuss.elastic.co/t/index-pattern-doesnt-have-a-uuid/306596 "2022-06-09T05:02:46Z")
Hi, I exported all the objects (index patterns, visualizations, dashboards, etc.) to my new cluster. I need to change the index pattern to our visualizations. I noticed the old index pattern url doesn't have a UUID in i… --- ## [Memory leakage of Vega visualization when refreshing data](https://discuss.elastic.co/t/memory-leakage-of-vega-visualization-when-refreshing-data/306751)
**Author:** [@kyh119](https://discuss.elastic.co/u/kyh119)\ **Replies:** 1\ **Last updated:** [June 9, 2022, 4:59am UTC](https://discuss.elastic.co/t/memory-leakage-of-vega-visualization-when-refreshing-data/306751 "2022-06-09T04:59:20Z")
Hi. I created a dashboard with my Vega visualizations that display the latest data. It's kind of real-time monitoring dashboard so I have to refresh every certain period. When it refreshes every 10 seconds, the heap s… --- ## [Can i recover cert folder in elastic search?](https://discuss.elastic.co/t/can-i-recover-cert-folder-in-elastic-search/306602)
**Author:** [@akshay\_bhardwaj](https://discuss.elastic.co/u/akshay_bhardwaj)\ **Replies:** 6\ **Last updated:** [June 9, 2022, 4:22am UTC](https://discuss.elastic.co/t/can-i-recover-cert-folder-in-elastic-search/306602 "2022-06-09T04:22:44Z")
By mistake i deleted the cert folder present in config folder of Elasticsearch is there any command so i can recover below certificates:- transport.p12 http.p12 --- ## [GeoIP filter does not work with a subfield](https://discuss.elastic.co/t/geoip-filter-does-not-work-with-a-subfield/306750)
**Author:** [@austin0918](https://discuss.elastic.co/u/austin0918)\ **Replies:** 2\ **Last updated:** [June 9, 2022, 3:20am UTC](https://discuss.elastic.co/t/geoip-filter-does-not-work-with-a-subfield/306750 "2022-06-09T03:20:16Z")
I have a field client.ip that needs to get geo info. I tried below GeoIP filter but it didn't work. Looks like GeoIP does not work with a subfield. Please advise. filter { if \[client\]\[ip\] { geoip { source =\> "\[cli… --- ## [Line and barchart on same visualization for one sample point makes the linechart a single point](https://discuss.elastic.co/t/line-and-barchart-on-same-visualization-for-one-sample-point-makes-the-linechart-a-single-point/306748)
**Author:** [@tee101](https://discuss.elastic.co/u/tee101)\ **Replies:** 0\ **Last updated:** [June 9, 2022, 12:59am UTC](https://discuss.elastic.co/t/line-and-barchart-on-same-visualization-for-one-sample-point-makes-the-linechart-a-single-point/306748 "2022-06-09T00:59:43Z")
In the following snapshot metric U is a barchart and metric A is a linechart. If there is one sample point, the linechart is just a point, and gets immersed in a big wide bar. Is there a way to have the point extrapolate… --- ## [Recommended resource setting for a Logstash Pod](https://discuss.elastic.co/t/recommended-resource-setting-for-a-logstash-pod/306747)
**Author:** [@amruth](https://discuss.elastic.co/u/amruth)\ **Replies:** 0\ **Last updated:** [June 9, 2022, 12:48am UTC](https://discuss.elastic.co/t/recommended-resource-setting-for-a-logstash-pod/306747 "2022-06-09T00:48:26Z")
Is there any recommended resource setting for a Logstash Pod handling small amount(100GB) of data everyday and no filtering in place? Logstash just reads data from SQLServer and pushes it to Elasticsearch without any fil… --- ## [How to query multiple fileds in Kibana](https://discuss.elastic.co/t/how-to-query-multiple-fileds-in-kibana/306611)
**Author:** [@dev9](https://discuss.elastic.co/u/dev9)\ **Replies:** 22\ **Last updated:** [June 9, 2022, 12:41am UTC](https://discuss.elastic.co/t/how-to-query-multiple-fileds-in-kibana/306611 "2022-06-09T00:41:10Z")
Hi, I am trying to query kibana for multiple fields where the servicename is serviceworker and the correlationId is one of many. My understanding is using terms is the best option here but I cannot get this query to wo… --- ## [Elastic search snapshot size estimate](https://discuss.elastic.co/t/elastic-search-snapshot-size-estimate/306553)
**Author:** [@A\_j\_xx](https://discuss.elastic.co/u/A_j_xx)\ **Replies:** 0\ **Last updated:** [June 7, 2022, 10:39am UTC](https://discuss.elastic.co/t/elastic-search-snapshot-size-estimate/306553 "2022-06-07T10:39:27Z")
Continuing the discussion from Elasticsearch Snapshot repository size estimates: Continuing the discussion can someone with experience comment on this ? How much memory should I have assuming my data grows from 200 gb … --- ## [Add\_field in logstash does not work](https://discuss.elastic.co/t/add-field-in-logstash-does-not-work/306616)
**Author:** [@PriyaM21](https://discuss.elastic.co/u/PriyaM21)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 2:04am UTC](https://discuss.elastic.co/t/add-field-in-logstash-does-not-work/306616 "2022-06-08T02:04:50Z")
I am trying to add a new custom field from the message but new field do not show up in Kabana. There is no error in logstash logs. Below is my logstash code if \[fields\]\[app\_name\] == "cobra" { if \[source\] =~ /^".\*(\\|/… --- ## [Elasticsearch 6.3.2 rolling upgrade to 6.8.22, should the application elasticsearch-rest-high-level-client be upgraded to 6.8.22](https://discuss.elastic.co/t/elasticsearch-6-3-2-rolling-upgrade-to-6-8-22-should-the-application-elasticsearch-rest-high-level-client-be-upgraded-to-6-8-22/306645)
**Author:** [@qiuxb](https://discuss.elastic.co/u/qiuxb)\ **Replies:** 1\ **Last updated:** [June 8, 2022, 11:55pm UTC](https://discuss.elastic.co/t/elasticsearch-6-3-2-rolling-upgrade-to-6-8-22-should-the-application-elasticsearch-rest-high-level-client-be-upgraded-to-6-8-22/306645 "2022-06-08T23:55:18Z")
Refer to an official article： The 6.0 client is able to communicate with any 6.x Elasticsearch node, while the 6.1 client is for sure able to communicate with 6.1, 6.2 and any later 6.x version, but there may be incomp… --- ## [Repository verification exception while using S3 repo](https://discuss.elastic.co/t/repository-verification-exception-while-using-s3-repo/306649)
**Author:** [@Pallavi\_Chaudhari](https://discuss.elastic.co/u/Pallavi_Chaudhari)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 7:51am UTC](https://discuss.elastic.co/t/repository-verification-exception-while-using-s3-repo/306649 "2022-06-08T07:51:23Z")
Hi All, I am trying to use s3 plugin for backup and restore, please find the details below I have create IBM COS bucket which is s3 compatible and created access and secret key I have added s3.client.default.endpoint … --- ## [Filebeat setup](https://discuss.elastic.co/t/filebeat-setup/306695)
**Author:** [@kaul.abhishek1993](https://discuss.elastic.co/u/kaul.abhishek1993)\ **Replies:** 1\ **Last updated:** [June 8, 2022, 11:43pm UTC](https://discuss.elastic.co/t/filebeat-setup/306695 "2022-06-08T23:43:22Z")
Hello Team, i am running setup for filebeat on haproxy node. For DB nodes i am connecting to kibana with url http://prodkibana.oodi.iq:80 and its successfull but with haproxy its failing with error " Jun 08 15:15:57 ORY… --- ## [Getting this error java.lang.ClassNotFoundException: jakarta.json.JsonException](https://discuss.elastic.co/t/getting-this-error-java-lang-classnotfoundexception-jakarta-json-jsonexception/306734)
**Author:** [@Bhavya\_Dawar](https://discuss.elastic.co/u/Bhavya_Dawar)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 5:55pm UTC](https://discuss.elastic.co/t/getting-this-error-java-lang-classnotfoundexception-jakarta-json-jsonexception/306734 "2022-06-08T17:55:49Z")
Failed to instantiate \[co.elastic.clients.Elasticsearch.ElasticsearchClient\]: Factory method 'client' threw exception; nested exception is java.lang.NoClassDefFoundError: jakarta/json/JsonException @Bean public Elastic… --- ## [Unable to create ingest pipeline. Error 504](https://discuss.elastic.co/t/unable-to-create-ingest-pipeline-error-504/306640)
**Author:** [@haopv](https://discuss.elastic.co/u/haopv)\ **Replies:** 2\ **Last updated:** [June 8, 2022, 11:40pm UTC](https://discuss.elastic.co/t/unable-to-create-ingest-pipeline-error-504/306640 "2022-06-08T23:40:06Z")
When I try to create a new pipeline or update an old pipeline there's the response from UI says "Unable to create pipeline 504 Gateway timeout" although any other function in the cluster like indexing and searching w… --- ## [Logstash connectivity from aws to on-premise](https://discuss.elastic.co/t/logstash-connectivity-from-aws-to-on-premise/306638)
**Author:** [@narasingarao.katta](https://discuss.elastic.co/u/narasingarao.katta)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 7:04am UTC](https://discuss.elastic.co/t/logstash-connectivity-from-aws-to-on-premise/306638 "2022-06-08T07:04:42Z")
Hi i want move my cloud watch logs to elk which is hosted out of aws . can any one give some inputs in this --- ## [How to solve elastic error of "Readiness probe failed: Error: Got HTTP code 503 but expected a 200" in GKE?](https://discuss.elastic.co/t/how-to-solve-elastic-error-of-readiness-probe-failed-error-got-http-code-503-but-expected-a-200-in-gke/306726)
**Author:** [@Samuel\_Arogbonlo](https://discuss.elastic.co/u/Samuel_Arogbonlo)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 4:22pm UTC](https://discuss.elastic.co/t/how-to-solve-elastic-error-of-readiness-probe-failed-error-got-http-code-503-but-expected-a-200-in-gke/306726 "2022-06-08T16:22:02Z")
0 I am installing Elastic on GKE with the helm chart here. But after running this command helm upgrade kibana elastic/kibana --values kibana.yaml , it runs successfully but the pod gives this error Readiness probe faile… --- ## [So many layers with same data in MAP](https://discuss.elastic.co/t/so-many-layers-with-same-data-in-map/306676)
**Author:** [@akshay\_bhardwaj](https://discuss.elastic.co/u/akshay_bhardwaj)\ **Replies:** 3\ **Last updated:** [June 8, 2022, 9:25pm UTC](https://discuss.elastic.co/t/so-many-layers-with-same-data-in-map/306676 "2022-06-08T21:25:57Z")
When i draw a map with data there are so many layers on hover showing same data how i can reduce the same. --- ## [Filebeat and GLIBC Errors on Ubuntu 22.04](https://discuss.elastic.co/t/filebeat-and-glibc-errors-on-ubuntu-22-04/306653)
**Author:** [@mibeyki](https://discuss.elastic.co/u/mibeyki)\ **Replies:** 2\ **Last updated:** [June 8, 2022, 8:13pm UTC](https://discuss.elastic.co/t/filebeat-and-glibc-errors-on-ubuntu-22-04/306653 "2022-06-08T20:13:26Z")
Hello, We just deployed filebeat both Ubuntu 22.04 server and Ubuntu 22.04 desktop. However, we cannot be able to get Filebeat connect to Elasticsearch. Both versions of Filebeat and ES is 7.10.1; When you run; file… --- ## [Reverse DNS processor multiple nameservers problem](https://discuss.elastic.co/t/reverse-dns-processor-multiple-nameservers-problem/306704)
**Author:** [@unknotted-evacuee](https://discuss.elastic.co/u/unknotted-evacuee)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 1:56pm UTC](https://discuss.elastic.co/t/reverse-dns-processor-multiple-nameservers-problem/306704 "2022-06-08T13:56:48Z")
Hey filebeat version 8.0.1 I'm suspecting a problem with using multiple namespaces for the DNS processor. My config looks like this (with dummy ip addresses, and I was testing with a low ttl in failure\_cache): … --- ## [Modify the string into another form in Logstash](https://discuss.elastic.co/t/modify-the-string-into-another-form-in-logstash/306732)
**Author:** [@Pranjal\_Sett](https://discuss.elastic.co/u/Pranjal_Sett)\ **Replies:** 1\ **Last updated:** [June 8, 2022, 6:35pm UTC](https://discuss.elastic.co/t/modify-the-string-into-another-form-in-logstash/306732 "2022-06-08T18:35:10Z")
Hello, I am having one csv file, in that csv file there is a attribute named as Time field. And the format of that time field is not as a standard format. Here is the format: \[30/Nov/2017:15:28:27 And I want to change… --- ## [Drop filter to avoid documents to be sent to ES not working](https://discuss.elastic.co/t/drop-filter-to-avoid-documents-to-be-sent-to-es-not-working/306584)
**Author:** [@Carlos\_T](https://discuss.elastic.co/u/Carlos_T)\ **Replies:** 8\ **Last updated:** [June 8, 2022, 6:29pm UTC](https://discuss.elastic.co/t/drop-filter-to-avoid-documents-to-be-sent-to-es-not-working/306584 "2022-06-08T18:29:50Z")
Hi everybody. I've have a ES + Kib + Logstash + Filebeat environment ready for testing purposes, and after installing Filebeat so it sends the data to Logstash, I've realiced that I'm recieving more documents than necce… --- ## [Index\_out\_of\_bounds\_exception](https://discuss.elastic.co/t/index-out-of-bounds-exception/306736)
**Author:** [@magedmakled](https://discuss.elastic.co/u/magedmakled)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 6:29pm UTC](https://discuss.elastic.co/t/index-out-of-bounds-exception/306736 "2022-06-08T18:29:53Z")
Hello All, I have a query that was working but all the sudden it is returning index\_out\_of\_bounds\_exception. The document has a nested field events . I ran this directly from Kibana Elasticsearch 6. GET event\_lists/\_… --- ## [Insert to elasticsearch from logstash IF NOT EXISTS](https://discuss.elastic.co/t/insert-to-elasticsearch-from-logstash-if-not-exists/306368)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 7\ **Last updated:** [June 8, 2022, 6:09pm UTC](https://discuss.elastic.co/t/insert-to-elasticsearch-from-logstash-if-not-exists/306368 "2022-06-08T18:09:58Z")
Hi, I currently have an index that I set unique ids and sometimes there is replica data. In my use case, older data is often more accurate than newer data. So I would like to have logstash only insert if the \_id current… --- ## [Parse ISO 8601 duration format (PT(n)H(n)M(n)S)](https://discuss.elastic.co/t/parse-iso-8601-duration-format-pt-n-h-n-m-n-s/306605)
**Author:** [@Iss](https://discuss.elastic.co/u/Iss)\ **Replies:** 5\ **Last updated:** [June 8, 2022, 5:53pm UTC](https://discuss.elastic.co/t/parse-iso-8601-duration-format-pt-n-h-n-m-n-s/306605 "2022-06-08T17:53:03Z")
Hi! I have a ISO 8601 duration format P(n)Y(n)M(n)DT(n)H(n)M(n)S fields as "duration"=\>"PT0H0M0S" I have to parse it to get time duration in seconds or in format HH:MM:SS. How can I do it with logstash filter? Than… --- ## [Deloy on AKS Elastic stack](https://discuss.elastic.co/t/deloy-on-aks-elastic-stack/306731)
**Author:** [@vladimir\_petukhov](https://discuss.elastic.co/u/vladimir_petukhov)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 5:40pm UTC](https://discuss.elastic.co/t/deloy-on-aks-elastic-stack/306731 "2022-06-08T17:40:13Z")
I tried to deploy on Azure Kubernetes Elastic stack following this example ELASTIC.IO.I want to get logs from mine.Net6 WebApi.For logger I use Serilog. I was made docker-compose to run the elastic stack on the local doc… --- ## [Using IBM common data provider for z systems](https://discuss.elastic.co/t/using-ibm-common-data-provider-for-z-systems/306723)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 4:05pm UTC](https://discuss.elastic.co/t/using-ibm-common-data-provider-for-z-systems/306723 "2022-06-08T16:05:45Z")
Hello all, Hope you are doing well. I have been using ELK 7.16.2. and I want to use IBM Common Data Provider to stream logs to my Logstash instance. But I have a few questions about installation of IBM CDPz, from where… --- ## [Grok pattern matching in debugger but not on logstash](https://discuss.elastic.co/t/grok-pattern-matching-in-debugger-but-not-on-logstash/306624)
**Author:** [@smtp\_server](https://discuss.elastic.co/u/smtp_server)\ **Replies:** 3\ **Last updated:** [June 8, 2022, 3:44pm UTC](https://discuss.elastic.co/t/grok-pattern-matching-in-debugger-but-not-on-logstash/306624 "2022-06-08T15:44:57Z")
Obvious from question, I've been trying to look for fault for so long but still don't seem to be coming around solution. Here's config filter{ grok{ pattern\_definitions =\> { "CUSTOMMONTH" =\> "(Jan|Feb|Mar|Apr|Ma… --- ## [Logstash not working, if installed in a location where the path contains parentheses (on windows)](https://discuss.elastic.co/t/logstash-not-working-if-installed-in-a-location-where-the-path-contains-parentheses-on-windows/306721)
**Author:** [@simon137](https://discuss.elastic.co/u/simon137)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 3:40pm UTC](https://discuss.elastic.co/t/logstash-not-working-if-installed-in-a-location-where-the-path-contains-parentheses-on-windows/306721 "2022-06-08T15:40:29Z")
Hello together, As the title suggests, with a sample path of "C:\\ProgramData\\Test)Test\\logstash", the call to ".\\bin\\logstash.bat" fails with the message: "Test\\logstash\\jdk\\bin\\java.exe" cannot be processed syntactical… --- ## [Connect Metricbeat to Elasticsearch 8.2.0 with password mode](https://discuss.elastic.co/t/connect-metricbeat-to-elasticsearch-8-2-0-with-password-mode/306311)
**Author:** [@Dreinale](https://discuss.elastic.co/u/Dreinale)\ **Replies:** 13\ **Last updated:** [June 8, 2022, 3:23pm UTC](https://discuss.elastic.co/t/connect-metricbeat-to-elasticsearch-8-2-0-with-password-mode/306311 "2022-06-08T15:23:49Z")
HI, I'm trying to connect metricbeat to my elasticsearch which I have configured yesterday with a password mode. (https://www.youtube.com/watch?v=kkrLanotz1I&t=461s). I have 2 users one is for elasticsearch (elastic) … --- ## [Fscrawler \_settings.yaml nodes settings](https://discuss.elastic.co/t/fscrawler-settings-yaml-nodes-settings/306717)
**Author:** [@newschapmj1](https://discuss.elastic.co/u/newschapmj1)\ **Replies:** 0\ **Last updated:** [June 8, 2022, 2:47pm UTC](https://discuss.elastic.co/t/fscrawler-settings-yaml-nodes-settings/306717 "2022-06-08T14:47:54Z")
We have a cluster of 7 nodes (ES 7.10). We run 5 Fscrawlers on 2 other separate servers. In the nodes section of \_settings.yaml At present we have the 7 IP addresses of the 7 nodes listed in ascending order on each of… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=908) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=910)