# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=936 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 937 --- ## [Refresh\_interval and segment size](https://discuss.elastic.co/t/refresh-interval-and-segment-size/305011)
**Author:** [@hechangqin](https://discuss.elastic.co/u/hechangqin)\ **Replies:** 1\ **Last updated:** [May 18, 2022, 3:11am UTC](https://discuss.elastic.co/t/refresh-interval-and-segment-size/305011 "2022-05-18T03:11:02Z")
Hi Elastic Team. In my current cluster, refresh\_interval is set to 5m , cluster jvm heap memory is 8g , index.buffer defaults to 10% , but when I continue to index, I still find very small segments, such as a few kb . Ac… --- ## [Logstash to influxdb version2.x is it possible?](https://discuss.elastic.co/t/logstash-to-influxdb-version2-x-is-it-possible/304913)
**Author:** [@surinkim](https://discuss.elastic.co/u/surinkim)\ **Replies:** 2\ **Last updated:** [May 18, 2022, 2:14am UTC](https://discuss.elastic.co/t/logstash-to-influxdb-version2-x-is-it-possible/304913 "2022-05-18T02:14:24Z")
HI. I designed a structure to put data from Logstash to influxdb. So, I succeeded in putting data into influx db version 1.8 in the window environment. However, influxdb version 2 gives this error. Connection Error w… --- ## [Having trouble starting Elasticsearch + Kibana out of the box 8.2.0](https://discuss.elastic.co/t/having-trouble-starting-elasticsearch-kibana-out-of-the-box-8-2-0/304972)
**Author:** [@jpark321](https://discuss.elastic.co/u/jpark321)\ **Replies:** 2\ **Last updated:** [May 17, 2022, 10:22pm UTC](https://discuss.elastic.co/t/having-trouble-starting-elasticsearch-kibana-out-of-the-box-8-2-0/304972 "2022-05-17T22:22:04Z")
Hello, I'm new to Elasticsearch. I went ahead and followed through the quick start guide and I am having some trouble getting kibana to work and load the starting dashboard. Here are some outputs from terminal for refer… --- ## [Logstash Kafka input and output with oauth](https://discuss.elastic.co/t/logstash-kafka-input-and-output-with-oauth/304886)
**Author:** [@Jockj](https://discuss.elastic.co/u/Jockj)\ **Replies:** 3\ **Last updated:** [May 17, 2022, 10:02pm UTC](https://discuss.elastic.co/t/logstash-kafka-input-and-output-with-oauth/304886 "2022-05-17T22:02:08Z")
Does anyone know how to use the logstash Kafka input/output plugin with oauth2? I couldn't find any settings with the current plugins. and I'm trying to develop one with the Kafka Java client. It failed with the followin… --- ## [Es document count != wc -l output of file after sending data with logstash?](https://discuss.elastic.co/t/es-document-count-wc-l-output-of-file-after-sending-data-with-logstash/304293)
**Author:** [@elk-user-99](https://discuss.elastic.co/u/elk-user-99)\ **Replies:** 20\ **Last updated:** [May 17, 2022, 9:19pm UTC](https://discuss.elastic.co/t/es-document-count-wc-l-output-of-file-after-sending-data-with-logstash/304293 "2022-05-17T21:19:47Z")
Hi friends! I've got what I thought was a simple configuration -- the input is a file that passes through 3 filters -- csv to parse the file, mutate to do a character replace that makes the timestamp automatically detec… --- ## [New filebeat implementation for Fortinet module not starting](https://discuss.elastic.co/t/new-filebeat-implementation-for-fortinet-module-not-starting/304995)
**Author:** [@doublejz](https://discuss.elastic.co/u/doublejz)\ **Replies:** 1\ **Last updated:** [May 17, 2022, 9:12pm UTC](https://discuss.elastic.co/t/new-filebeat-implementation-for-fortinet-module-not-starting/304995 "2022-05-17T21:12:41Z")
I'm not sure what I'm missing here. I apologize for being a noob but I've just started getting into setting up my ELK stack and can't figure this out. I thought I had it all configured but yet filebeat won't start and I… --- ## [Custom plugin doesn't autoRefresh when added to a dashboard](https://discuss.elastic.co/t/custom-plugin-doesnt-autorefresh-when-added-to-a-dashboard/303766)
**Author:** [@dmprieto](https://discuss.elastic.co/u/dmprieto)\ **Replies:** 2\ **Last updated:** [May 17, 2022, 6:58pm UTC](https://discuss.elastic.co/t/custom-plugin-doesnt-autorefresh-when-added-to-a-dashboard/303766 "2022-05-17T18:58:47Z")
Hi I developed a custom plugin for Kibana 7.17.0 and when I enable the autoRefresh in the Visualization editor page it works ok, but when I add the custom plugin to an empty dashboard it doesn't refresh when autoRefres… --- ## [Using TermsQuery in Java API Client \[7.17\]](https://discuss.elastic.co/t/using-termsquery-in-java-api-client-7-17/304904)
**Author:** [@Vipul\_Kumar](https://discuss.elastic.co/u/Vipul_Kumar)\ **Replies:** 2\ **Last updated:** [May 17, 2022, 5:37pm UTC](https://discuss.elastic.co/t/using-termsquery-in-java-api-client-7-17/304904 "2022-05-17T17:37:30Z")
I'm using Java API Client \[7.17\] in my project. I'm able to do most of the queries, but I'm trying to figure out how to search for multiple values in a particular fields and return values containing any of the values pro… --- ## [Unexpected results when filtering docs in nested field](https://discuss.elastic.co/t/unexpected-results-when-filtering-docs-in-nested-field/304960)
**Author:** [@OmarDacca](https://discuss.elastic.co/u/OmarDacca)\ **Replies:** 2\ **Last updated:** [May 17, 2022, 5:06pm UTC](https://discuss.elastic.co/t/unexpected-results-when-filtering-docs-in-nested-field/304960 "2022-05-17T17:06:28Z")
Hi, suppose we have the following docs: (index name is test\_index) { session\_id: "123", "session\_details":\[ { "page": "/abc" }, { "page": "/xyz" } \] }… --- ## [Kibana embedded Iframe URLs for Dashboards: Can we specify a tag in the URL](https://discuss.elastic.co/t/kibana-embedded-iframe-urls-for-dashboards-can-we-specify-a-tag-in-the-url/304252)
**Author:** [@StephaneRodier](https://discuss.elastic.co/u/StephaneRodier)\ **Replies:** 5\ **Last updated:** [May 17, 2022, 5:26pm UTC](https://discuss.elastic.co/t/kibana-embedded-iframe-urls-for-dashboards-can-we-specify-a-tag-in-the-url/304252 "2022-05-17T17:26:46Z")
Hi, I was wondering if I can specify a tag associated to dashboards in the url to list all associated dashboards? --- ## [Packetbeat not sending to Logstash after Elastic-Agent uninstall](https://discuss.elastic.co/t/packetbeat-not-sending-to-logstash-after-elastic-agent-uninstall/303059)
**Author:** [@fl33t](https://discuss.elastic.co/u/fl33t)\ **Replies:** 2\ **Last updated:** [May 17, 2022, 5:09pm UTC](https://discuss.elastic.co/t/packetbeat-not-sending-to-logstash-after-elastic-agent-uninstall/303059 "2022-05-17T17:09:07Z")
While experimenting with elastic-agent/fleet-server I noticed that once the agent was uninstalled, packetbeat didn't seem able to send to logstash anymore. No more indexes, nothing. The sequence is basically: Packetbe… --- ## [Elasticsearch Weight query](https://discuss.elastic.co/t/elasticsearch-weight-query/304975)
**Author:** [@painless\_elastic](https://discuss.elastic.co/u/painless_elastic)\ **Replies:** 0\ **Last updated:** [May 17, 2022, 4:58pm UTC](https://discuss.elastic.co/t/elasticsearch-weight-query/304975 "2022-05-17T16:58:24Z")
I tried finding the example queries where weight param is used to do relevancy and scoring, but couldn't; able to do so. Is it possible to add weight in the search query similar to boost in the Elasticsearch community e… --- ## [Export kibana dashboard from wui and import using cli](https://discuss.elastic.co/t/export-kibana-dashboard-from-wui-and-import-using-cli/304582)
**Author:** [@zakirpcs](https://discuss.elastic.co/u/zakirpcs)\ **Replies:** 4\ **Last updated:** [May 17, 2022, 4:35pm UTC](https://discuss.elastic.co/t/export-kibana-dashboard-from-wui-and-import-using-cli/304582 "2022-05-17T16:35:32Z")
My Elasticsearch version is 6.8.21 and i want to export my specific dashboard & visualization from Web User Interface . Then want to import using cli (curl). Is there any way to do so? Regards, Zakir --- ## [Initialize counter in logstash and replace the '%{\[message\]\[0\]}'?](https://discuss.elastic.co/t/initialize-counter-in-logstash-and-replace-the-message-0/304912)
**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\ **Replies:** 9\ **Last updated:** [May 17, 2022, 4:28pm UTC](https://discuss.elastic.co/t/initialize-counter-in-logstash-and-replace-the-message-0/304912 "2022-05-17T16:28:12Z")
Hi, after doing the split filter, so my message was an array ok, so %{\[message\]\[0\]} %{\[message\]\[1\]} ... that gives me their value fine. now I have an array of length 30 for example and I start the condition if {} examp… --- ## [Cluster health turns to red](https://discuss.elastic.co/t/cluster-health-turns-to-red/304870)
**Author:** [@rachelyang](https://discuss.elastic.co/u/rachelyang)\ **Replies:** 2\ **Last updated:** [May 17, 2022, 4:21pm UTC](https://discuss.elastic.co/t/cluster-health-turns-to-red/304870 "2022-05-17T16:21:52Z")
Please have a look at the output of \_cluster/health?pretty { "cluster\_name" : "Elasticsearch", "status" : "red", "timed\_out" : false, "number\_of\_nodes" : 2, "number\_of\_data\_nodes" : 2, "active\_primary\_shards… --- ## [Filebeat filestream input not releasing file handler with hard-linked file](https://discuss.elastic.co/t/filebeat-filestream-input-not-releasing-file-handler-with-hard-linked-file/304041)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 2\ **Last updated:** [May 17, 2022, 4:12pm UTC](https://discuss.elastic.co/t/filebeat-filestream-input-not-releasing-file-handler-with-hard-linked-file/304041 "2022-05-17T16:12:20Z")
Hello, I have a use case where I ingest files created by the Wazuh agent, these files are created in paths with the following format: /var/ossec/logs/archives/YYYY/MM/ossec-archive-dd.json For example: /var/ossec/log… --- ## [Problem with checkpoint module and datastream](https://discuss.elastic.co/t/problem-with-checkpoint-module-and-datastream/304965)
**Author:** [@Salvatore\_Mattei](https://discuss.elastic.co/u/Salvatore_Mattei)\ **Replies:** 0\ **Last updated:** [May 17, 2022, 3:53pm UTC](https://discuss.elastic.co/t/problem-with-checkpoint-module-and-datastream/304965 "2022-05-17T15:53:20Z")
Hi, we are ingesting data using checkpoint filebeat module. Some records are not ingested and gives this error: May 17 09:24:45 XXXX filebeat\[3110397\]: 2022-05-17T09:24:45.674Z#011WARN#011\[elasticsearch\]#011elasticsea… --- ## [New to ELK and need some help with existing environment](https://discuss.elastic.co/t/new-to-elk-and-need-some-help-with-existing-environment/304885)
**Author:** [@Jason2](https://discuss.elastic.co/u/Jason2)\ **Replies:** 2\ **Last updated:** [May 17, 2022, 3:53pm UTC](https://discuss.elastic.co/t/new-to-elk-and-need-some-help-with-existing-environment/304885 "2022-05-17T15:53:16Z")
My company uses ELK on kubernetes to monitor CICD infrastructure. We have an index that gathers a massive amount of data every day. We recently stopped showing data in the discover section. All data before two weeks ago … --- ## [Use file values as variable or iterate over values](https://discuss.elastic.co/t/use-file-values-as-variable-or-iterate-over-values/304947)
**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\ **Replies:** 1\ **Last updated:** [May 17, 2022, 3:42pm UTC](https://discuss.elastic.co/t/use-file-values-as-variable-or-iterate-over-values/304947 "2022-05-17T15:42:22Z")
Hello! Right now I have a pipeline that creates a field using a ruby scanner. When this scanner detects one of the values entered in the regular expression, it creates a field with that value. For example: if \[x\] { … --- ## [Get initial log from Logstash warning](https://discuss.elastic.co/t/get-initial-log-from-logstash-warning/304796)
**Author:** [@arazdolski](https://discuss.elastic.co/u/arazdolski)\ **Replies:** 9\ **Last updated:** [May 17, 2022, 3:37pm UTC](https://discuss.elastic.co/t/get-initial-log-from-logstash-warning/304796 "2022-05-17T15:37:05Z")
Hi, I have a rsyslog -\> logstash -\> Elasticsearch setup and noticed a lot of warnings with tried to parse field \[v\] as an object, but found a concrete value in Logstash logs, but I cannot find the initial syslog which L… --- ## [Removing transient settings from cluster](https://discuss.elastic.co/t/removing-transient-settings-from-cluster/304958)
**Author:** [@yquirion](https://discuss.elastic.co/u/yquirion)\ **Replies:** 1\ **Last updated:** [May 17, 2022, 3:16pm UTC](https://discuss.elastic.co/t/removing-transient-settings-from-cluster/304958 "2022-05-17T15:16:24Z")
Hello, I've set the following settings into my cluster for a temporatry moment: PUT \_cluster/settings { "transient": { "cluster.routing.allocation.disk.watermark.low": "90%", "cluster.routing.allocation.d… --- ## [Query fails with parse\_error](https://discuss.elastic.co/t/query-fails-with-parse-error/304956)
**Author:** [@ilBepi](https://discuss.elastic.co/u/ilBepi)\ **Replies:** 0\ **Last updated:** [May 17, 2022, 3:03pm UTC](https://discuss.elastic.co/t/query-fails-with-parse-error/304956 "2022-05-17T15:03:05Z")
Hello, I am trying to run a very simple query using the High Level Client for Java version 6.8.23 The query is like the following: { "query": { "wildcard": { "OBJECTINFO.NAME": { "wildcard": "test\*", "boo… --- ## [Enabling ILM after index exists / Enable ILM on first index creation with new version](https://discuss.elastic.co/t/enabling-ilm-after-index-exists-enable-ilm-on-first-index-creation-with-new-version/304957)
**Author:** [@cotjoey](https://discuss.elastic.co/u/cotjoey)\ **Replies:** 0\ **Last updated:** [May 17, 2022, 3:04pm UTC](https://discuss.elastic.co/t/enabling-ilm-after-index-exists-enable-ilm-on-first-index-creation-with-new-version/304957 "2022-05-17T15:04:26Z")
Hello, I hope I can find help in the community forum for this issue I've been having since the beginning of using Elastic. My problem statement is this: when I start using a new version of a beat (i.e. go from filebeat… --- ## [Logstash monitoring help not seeing in Kibana](https://discuss.elastic.co/t/logstash-monitoring-help-not-seeing-in-kibana/303689)
**Author:** [@Mary2022](https://discuss.elastic.co/u/Mary2022)\ **Replies:** 14\ **Last updated:** [May 17, 2022, 2:54pm UTC](https://discuss.elastic.co/t/logstash-monitoring-help-not-seeing-in-kibana/303689 "2022-05-17T14:54:40Z")
Hi, I am new to ELK and I have been trying to follow the guides and so far I have been abled to install version 7.17 in our 2 kibana nodes and our 3 elasticsearch nodes. If I go to Kibana and look under Cluster Over… --- ## [Getting Elasticsearch cluster status as RED](https://discuss.elastic.co/t/getting-elasticsearch-cluster-status-as-red/304939)
**Author:** [@Yogendra\_Pratap\_Sing](https://discuss.elastic.co/u/Yogendra_Pratap_Sing)\ **Replies:** 16\ **Last updated:** [May 17, 2022, 2:24pm UTC](https://discuss.elastic.co/t/getting-elasticsearch-cluster-status-as-red/304939 "2022-05-17T14:24:25Z")
Hi Community, I'm using Elastic stack on k8s and facing ES cluster status as RED but indices are all in green below is cluster health status \[Elasticsearch@Elasticsearch-master-0 ~\]$ curl -XGET 'localhost:9200/\_cluste… --- ## [How to change index pattern](https://discuss.elastic.co/t/how-to-change-index-pattern/304925)
**Author:** [@wagnar](https://discuss.elastic.co/u/wagnar)\ **Replies:** 3\ **Last updated:** [May 17, 2022, 1:59pm UTC](https://discuss.elastic.co/t/how-to-change-index-pattern/304925 "2022-05-17T13:59:02Z")
I have two different index in Elasticsearch prod and dev. I developed everything in dev pattern and after the export I changed the ID for index pattern in ndjson file. after import it is throwing error and I am not able … --- ## [How to get index contents of a website](https://discuss.elastic.co/t/how-to-get-index-contents-of-a-website/304944)
**Author:** [@Tasdiq\_Shaikh](https://discuss.elastic.co/u/Tasdiq_Shaikh)\ **Replies:** 1\ **Last updated:** [May 17, 2022, 1:39pm UTC](https://discuss.elastic.co/t/how-to-get-index-contents-of-a-website/304944 "2022-05-17T13:39:15Z")
How can I index and perform search operations on the contents of a website of a given web link like discuss.elastic.co using Java 1.8 and Elasticsearch 7.12.0? --- ## [Is Elasticsearch webcrawler an open source feature or it is paid?](https://discuss.elastic.co/t/is-elasticsearch-webcrawler-an-open-source-feature-or-it-is-paid/304789)
**Author:** [@Tasdiq\_Shaikh](https://discuss.elastic.co/u/Tasdiq_Shaikh)\ **Replies:** 6\ **Last updated:** [May 17, 2022, 1:12pm UTC](https://discuss.elastic.co/t/is-elasticsearch-webcrawler-an-open-source-feature-or-it-is-paid/304789 "2022-05-17T13:12:19Z")
What is the roadmap to implement webcrawler in my ES application using Java 1.8 and Elasticsearch version 7.12.0 --- ## [Filebeat haproxy with dns processor](https://discuss.elastic.co/t/filebeat-haproxy-with-dns-processor/304501)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 9\ **Last updated:** [May 17, 2022, 12:56pm UTC](https://discuss.elastic.co/t/filebeat-haproxy-with-dns-processor/304501 "2022-05-17T12:56:47Z")
I have succssfully send haproxy log to Elasticsearch using filebeat. next step I am trying to do is to change destination.ip and source.ip to name but I don't think I am using dns processor correctly. I am not getting… --- ## [Filebeat 7.16 drop\_fields processor not working](https://discuss.elastic.co/t/filebeat-7-16-drop-fields-processor-not-working/304916)
**Author:** [@Sederfo](https://discuss.elastic.co/u/Sederfo)\ **Replies:** 0\ **Last updated:** [May 17, 2022, 10:09am UTC](https://discuss.elastic.co/t/filebeat-7-16-drop-fields-processor-not-working/304916 "2022-05-17T10:09:21Z")
Hello! We are having trouble dropping fields from messages using Filebeat 7.16. We tried to drop fields using the "drop\_fields" processor: processors: - drop\_fields: fields: \["cisco.ftd.message\_id"\] ignor… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=935) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=937)