# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=942 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 943 --- ## [Error while stopping harverster group](https://discuss.elastic.co/t/error-while-stopping-harverster-group/304590)
**Author:** [@leonelfonseca](https://discuss.elastic.co/u/leonelfonseca)\ **Replies:** 0\ **Last updated:** [May 12, 2022, 2:39pm UTC](https://discuss.elastic.co/t/error-while-stopping-harverster-group/304590 "2022-05-12T14:39:12Z")
Hi, can anyone explain about this error message that appears in the Filebeat log ? \> Error while stopping harverster group: task failures error while adding new reader to the bookkeeper harvester is already running… --- ## [Escaping commas in \_routing search impossible](https://discuss.elastic.co/t/escaping-commas-in-routing-search-impossible/304578)
**Author:** [@mhamb](https://discuss.elastic.co/u/mhamb)\ **Replies:** 0\ **Last updated:** [May 12, 2022, 1:15pm UTC](https://discuss.elastic.co/t/escaping-commas-in-routing-search-impossible/304578 "2022-05-12T13:15:21Z")
Hi! I'm running an Elasticsearch production environment with a custom routing field. This has helped search performance significantly, but we just noticed that some routing fields are unsearchable as they were indexed w… --- ## [Apache tomcat module](https://discuss.elastic.co/t/apache-tomcat-module/304563)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 0\ **Last updated:** [May 12, 2022, 11:50am UTC](https://discuss.elastic.co/t/apache-tomcat-module/304563 "2022-05-12T11:50:32Z")
Hello team, We configured apache module in our server but we are able to get only below two types of message in our ELK. Can any one please help on this Error: HTTP error 404 in : 404 error making http request: Post… --- ## [Async system index through python AsyncElasticsearch prevented by default?](https://discuss.elastic.co/t/async-system-index-through-python-asyncelasticsearch-prevented-by-default/304542)
**Author:** [@martward](https://discuss.elastic.co/u/martward)\ **Replies:** 0\ **Last updated:** [May 12, 2022, 9:09am UTC](https://discuss.elastic.co/t/async-system-index-through-python-asyncelasticsearch-prevented-by-default/304542 "2022-05-12T09:09:19Z")
Hi all, I'm using the AsyncElasticsearch client in python, recently I started getting the warning that direct access to async-search will be prevented. Does this mean at some point it will no longer be possible to use t… --- ## [This site is inaccsessible kibana](https://discuss.elastic.co/t/this-site-is-inaccsessible-kibana/303163)
**Author:** [@Abderraouf\_ZAYEN](https://discuss.elastic.co/u/Abderraouf_ZAYEN)\ **Replies:** 10\ **Last updated:** [May 12, 2022, 11:02am UTC](https://discuss.elastic.co/t/this-site-is-inaccsessible-kibana/303163 "2022-05-12T11:02:29Z")
Hi, systemctl status kibana & systemctl status Elasticsearch & systemctl status logstash & systemctl status filebeat all active (running) . my problem in browser localhost:9200 it works but localhost:5601 didn't work (… --- ## [AWS integration CloudWatch tags filter](https://discuss.elastic.co/t/aws-integration-cloudwatch-tags-filter/303724)
**Author:** [@kalbusse](https://discuss.elastic.co/u/kalbusse)\ **Replies:** 6\ **Last updated:** [May 12, 2022, 10:33am UTC](https://discuss.elastic.co/t/aws-integration-cloudwatch-tags-filter/303724 "2022-05-12T10:33:59Z")
Hello, I am trying to collect metrics from only a subset of resources with the AWS CloudWatch integration. I used the following configuration: - namespace: AWS/ApplicationELB tags: - key: "Application" val… --- ## [How to build grok filter](https://discuss.elastic.co/t/how-to-build-grok-filter/304537)
**Author:** [@smam](https://discuss.elastic.co/u/smam)\ **Replies:** 10\ **Last updated:** [May 12, 2022, 10:31am UTC](https://discuss.elastic.co/t/how-to-build-grok-filter/304537 "2022-05-12T10:31:42Z")
Hello, I want to understand how to build grok filter since other posts did not make it clear enough for me. Here are example lines I want to send: 30,05/10/22,07:30:27,DNS Update Request,\,\,,,0,6,,,,,,,,,0 11… --- ## [How to install sigma rule elk version 8](https://discuss.elastic.co/t/how-to-install-sigma-rule-elk-version-8/304237)
**Author:** [@CodeRed](https://discuss.elastic.co/u/CodeRed)\ **Replies:** 2\ **Last updated:** [May 12, 2022, 10:09am UTC](https://discuss.elastic.co/t/how-to-install-sigma-rule-elk-version-8/304237 "2022-05-12T10:09:56Z")
I am trying to install sigma rule on kibana I followed the instructions but it failed The document of sigma rule has instructions for me to execute the command: /usr/share/kibana/bin/./kibana-plugin install file:///PAT… --- ## [How to increase the performance of the kafka input in indexer](https://discuss.elastic.co/t/how-to-increase-the-performance-of-the-kafka-input-in-indexer/304549)
**Author:** [@Marco\_Bonardo](https://discuss.elastic.co/u/Marco_Bonardo)\ **Replies:** 0\ **Last updated:** [May 12, 2022, 9:42am UTC](https://discuss.elastic.co/t/how-to-increase-the-performance-of-the-kafka-input-in-indexer/304549 "2022-05-12T09:42:39Z")
Hello everyone, I have a problem I've been working on for days and I can't find a compatible solution. I need to consume about 150k messages per second via a kafka input / topic / groupid. I have 8 logstash on separate m… --- ## [\_source 50% bigger after reindex](https://discuss.elastic.co/t/source-50-bigger-after-reindex/303805)
**Author:** [@nisow95612](https://discuss.elastic.co/u/nisow95612)\ **Replies:** 17\ **Last updated:** [May 12, 2022, 9:36am UTC](https://discuss.elastic.co/t/source-50-bigger-after-reindex/303805 "2022-05-12T09:36:30Z")
Hello. Context: I reindexed a 7.15 index into 7.16 one and suddenly it is taking about +50% space. By Analyze index disk usage API | Elasticsearch Guide \[7.16\] | Elastic I found that \_source field alone is now taking … --- ## [Filebeat filestream input rereading rotated log files](https://discuss.elastic.co/t/filebeat-filestream-input-rereading-rotated-log-files/300038)
**Author:** [@lpeter](https://discuss.elastic.co/u/lpeter)\ **Replies:** 14\ **Last updated:** [May 12, 2022, 9:08am UTC](https://discuss.elastic.co/t/filebeat-filestream-input-rereading-rotated-log-files/300038 "2022-05-12T09:08:23Z")
Hello! I'm running into this very common problem of rotated files being reread and resent. I'm using Filebeat 8.1.0 with the new(ish) filestream input plugin. I've read the docs of the plugin and the article on this spe… --- ## [Event.original not searchable](https://discuss.elastic.co/t/event-original-not-searchable/304490)
**Author:** [@grover](https://discuss.elastic.co/u/grover)\ **Replies:** 2\ **Last updated:** [May 12, 2022, 8:40am UTC](https://discuss.elastic.co/t/event-original-not-searchable/304490 "2022-05-12T08:40:58Z")
Hi I'm new to Elasticsearch and I am trying to get information from a Juniper SRX firewall. The logs are being ingested but the information I would like to search is in event.original which is not indexed or searchable.… --- ## [Grok pattern for optional field in ingest pipeline](https://discuss.elastic.co/t/grok-pattern-for-optional-field-in-ingest-pipeline/304520)
**Author:** [@alfianaf](https://discuss.elastic.co/u/alfianaf)\ **Replies:** 3\ **Last updated:** [May 12, 2022, 8:00am UTC](https://discuss.elastic.co/t/grok-pattern-for-optional-field-in-ingest-pipeline/304520 "2022-05-12T08:00:19Z")
Hello, I'm working with ingest pipeline and grok processor right now. I need to filter log message with grok processor but there's optional fields, here's the log example \[Nest\] 6448 - 04/26/2022, 3:30:03 PM \[activity… --- ## [Restore historical into data stream](https://discuss.elastic.co/t/restore-historical-into-data-stream/304523)
**Author:** [@Jasper\_Nygaard](https://discuss.elastic.co/u/Jasper_Nygaard)\ **Replies:** 2\ **Last updated:** [May 12, 2022, 7:29am UTC](https://discuss.elastic.co/t/restore-historical-into-data-stream/304523 "2022-05-12T07:29:01Z")
Just moved to Elastic Cloud from on-onprem for our logging, setting up data streams instead of using date based indices. I now need to restore our historical data from snapshots - anyway to restore these into the data st… --- ## [How to use our index name in data section in vega?](https://discuss.elastic.co/t/how-to-use-our-index-name-in-data-section-in-vega/304416)
**Author:** [@Arifullah](https://discuss.elastic.co/u/Arifullah)\ **Replies:** 2\ **Last updated:** [May 12, 2022, 6:46am UTC](https://discuss.elastic.co/t/how-to-use-our-index-name-in-data-section-in-vega/304416 "2022-05-12T06:46:16Z")
I want to create tree layout graph in vega from my index which its name is 123. the index has many fields but I want only two fields of the index to be showed in the graph which is A and B. The question is how to use my… --- ## [Accessing nested fields in a script (null\_pointer\_exception)](https://discuss.elastic.co/t/accessing-nested-fields-in-a-script-null-pointer-exception/304521)
**Author:** [@heikis](https://discuss.elastic.co/u/heikis)\ **Replies:** 2\ **Last updated:** [May 12, 2022, 6:41am UTC](https://discuss.elastic.co/t/accessing-nested-fields-in-a-script-null-pointer-exception/304521 "2022-05-12T06:41:00Z")
Hello. I have a nested document and I would like to do some processing on it before indexing it. The parent document has a "reference\_ts" containing a timestamp. Then come the nested fields that each have their own tim… --- ## [Enrollment agent](https://discuss.elastic.co/t/enrollment-agent/304528)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 0\ **Last updated:** [May 12, 2022, 6:30am UTC](https://discuss.elastic.co/t/enrollment-agent/304528 "2022-05-12T06:30:44Z")
how to enrollment agent. i follow in Install Fleet-managed Elastic Agents | Fleet and Elastic Agent Guide \[7.17\] | Elastic i got error Error: fail to enroll: fail to execute request to fleet-server: fail to read origina… --- ## [Kibana 7.17 dashboard URL in iframe sid cookie getting rejected by browser](https://discuss.elastic.co/t/kibana-7-17-dashboard-url-in-iframe-sid-cookie-getting-rejected-by-browser/303523)
**Author:** [@homesh\_joshi](https://discuss.elastic.co/u/homesh_joshi)\ **Replies:** 9\ **Last updated:** [May 12, 2022, 6:16am UTC](https://discuss.elastic.co/t/kibana-7-17-dashboard-url-in-iframe-sid-cookie-getting-rejected-by-browser/303523 "2022-05-12T06:16:21Z")
Hi, I am trying to embed kibana dashboard in to another URL. My kibana URL is dashboard.example.com My other URL is reports.example.com (SSL enabled) My kibana is behind apache reverse proxy ( SSL is enabled only on… --- ## [Elasticsearch Watcher error while trying to send email attachment, dashboard.pdf](https://discuss.elastic.co/t/elasticsearch-watcher-error-while-trying-to-send-email-attachment-dashboard-pdf/301048)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 13\ **Last updated:** [May 12, 2022, 5:53am UTC](https://discuss.elastic.co/t/elasticsearch-watcher-error-while-trying-to-send-email-attachment-dashboard-pdf/301048 "2022-05-12T05:53:09Z")
Hi, I have created a watcher alert from the advanced option which sends dashboard.pdf as an email attachment when the triggering condition is met. Now when the criteria is matching (threshold is exceeded) then it is thr… --- ## [Grok issue in Logstash input - data from Kafka logs using Filebeat Kafka module](https://discuss.elastic.co/t/grok-issue-in-logstash-input-data-from-kafka-logs-using-filebeat-kafka-module/303801)
**Author:** [@Sharon\_Hacham](https://discuss.elastic.co/u/Sharon_Hacham)\ **Replies:** 4\ **Last updated:** [May 12, 2022, 4:57am UTC](https://discuss.elastic.co/t/grok-issue-in-logstash-input-data-from-kafka-logs-using-filebeat-kafka-module/303801 "2022-05-12T04:57:44Z")
Hi , we are ingesting Kafka logs from on-premise servers running Kafka Connect and Kafka Rest-Proxy , We have 3 Logstash Windows servers ... we're using the built-in Dashboard you supply with the Filebeat Kafka module… --- ## [Http input and output google bigquery](https://discuss.elastic.co/t/http-input-and-output-google-bigquery/304323)
**Author:** [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\ **Replies:** 4\ **Last updated:** [May 12, 2022, 4:27am UTC](https://discuss.elastic.co/t/http-input-and-output-google-bigquery/304323 "2022-05-12T04:27:22Z")
input { http { host =\> "0.0.0.0" # default: 0.0.0.0 port =\> 0000 # default: 8080 } } filter { urldecode { all\_fields =\> true } } filter { mutate { gsub =\> \[ "message", "\\\]", "}", "message", "\\\[", "{" \] } … --- ## [Date processor ingest pipeline failed to parse](https://discuss.elastic.co/t/date-processor-ingest-pipeline-failed-to-parse/304515)
**Author:** [@alfianaf](https://discuss.elastic.co/u/alfianaf)\ **Replies:** 4\ **Last updated:** [May 12, 2022, 3:45am UTC](https://discuss.elastic.co/t/date-processor-ingest-pipeline-failed-to-parse/304515 "2022-05-12T03:45:41Z")
Hello, I'm using date processor on ingest pipeline, I've seen the documentation about the date processor, the syntax I wrote seems right, but the result is not. here's my date example 05/11/2022, 7:03:52 AM and here'… --- ## [Renewing Let's Encrypt Certification - Kibana](https://discuss.elastic.co/t/renewing-lets-encrypt-certification-kibana/304390)
**Author:** [@Hunter\_Goncalves](https://discuss.elastic.co/u/Hunter_Goncalves)\ **Replies:** 2\ **Last updated:** [May 12, 2022, 1:57am UTC](https://discuss.elastic.co/t/renewing-lets-encrypt-certification-kibana/304390 "2022-05-12T01:57:56Z")
I'm stumped on renewing these lets encrypt certifications for kibana. There seems to be a permissions error but i'm not sure where. Screenshots show error message and permissions for lets encrypt files and kibana ssl sym… --- ## [Is elasticsearch, logstash impacted by opendJDK Vulnerability](https://discuss.elastic.co/t/is-elasticsearch-logstash-impacted-by-opendjdk-vulnerability/304423)
**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Replies:** 1\ **Last updated:** [May 11, 2022, 11:30pm UTC](https://discuss.elastic.co/t/is-elasticsearch-logstash-impacted-by-opendjdk-vulnerability/304423 "2022-05-11T23:30:06Z")
is Elasticsearch and logstash got impacted by opendJDK vulnerability? CVE's The versions impacted are: OpenJDK 7 \<= 7u331 OpenJDK 8 \<= 8u322 OpenJDK 11.0.0 \<= 11.0.14 OpenJDK 13.0.0 \<= 13.0.10 OpenJDK 15.0.0 \<= … --- ## [Data stream, ILM and refresh\_interval](https://discuss.elastic.co/t/data-stream-ilm-and-refresh-interval/304456)
**Author:** [@Valentin\_Pletzer](https://discuss.elastic.co/u/Valentin_Pletzer)\ **Replies:** 1\ **Last updated:** [May 11, 2022, 11:22pm UTC](https://discuss.elastic.co/t/data-stream-ilm-and-refresh-interval/304456 "2022-05-11T23:22:08Z")
Hi, I am using Elasticsearch for a really long time now, mostly for logging data and aggregating. One pattern I am using successfully is the rolling daily indices. Write to the current one and set the older ones to "ref… --- ## [Data Archival in Elastic Search](https://discuss.elastic.co/t/data-archival-in-elastic-search/304442)
**Author:** [@Nikhil\_Ray5](https://discuss.elastic.co/u/Nikhil_Ray5)\ **Replies:** 2\ **Last updated:** [May 11, 2022, 11:18pm UTC](https://discuss.elastic.co/t/data-archival-in-elastic-search/304442 "2022-05-11T23:18:28Z")
Can you help me with how to archive data in Elasticsearch. that I don't know what is curator and data shrink. I am fresher to Elasticsearch. from where I have to start studying and what all things I have to do? --- ## [Kibana Error - \`/app/management/data/index\_management/indices\`](https://discuss.elastic.co/t/kibana-error-app-management-data-index-management-indices/304475)
**Author:** [@JGreene](https://discuss.elastic.co/u/JGreene)\ **Replies:** 0\ **Last updated:** [May 11, 2022, 2:20pm UTC](https://discuss.elastic.co/t/kibana-error-app-management-data-index-management-indices/304475 "2022-05-11T14:20:32Z")
Elastic version; 7.16.2 When attempting to load indices under /app/management/data/index\_management/indices, we receive the following error: Kibana error logs: {"type":"error","@timestamp":"2022-05-11T07:16:42-07:0… --- ## [Purging the index using curator script](https://discuss.elastic.co/t/purging-the-index-using-curator-script/304478)
**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Replies:** 0\ **Last updated:** [May 11, 2022, 2:58pm UTC](https://discuss.elastic.co/t/purging-the-index-using-curator-script/304478 "2022-05-11T14:58:21Z")
HI, I'm using curator script to purge our data in production. Currently we are having 2 type of format in ES once is for Production index and another one is pre-prod index. Basically we keep last 5 week records of pro… --- ## [SearchRequest source timeout not working for Java HighLevelRESTClient](https://discuss.elastic.co/t/searchrequest-source-timeout-not-working-for-java-highlevelrestclient/304507)
**Author:** [@Constantine\_Cheng](https://discuss.elastic.co/u/Constantine_Cheng)\ **Replies:** 0\ **Last updated:** [May 11, 2022, 9:39pm UTC](https://discuss.elastic.co/t/searchrequest-source-timeout-not-working-for-java-highlevelrestclient/304507 "2022-05-11T21:39:01Z")
Hello, I am trying to parse a timeout parameter to searchRequest.source().timeout() in Kotlin and run HighLevelRestClient.search(searchRequest). The timeout interval in my case is set to be 1 ms for testing if the timeo… --- ## [Delete\_by\_query not deleting the indices](https://discuss.elastic.co/t/delete-by-query-not-deleting-the-indices/304500)
**Author:** [@Sam1231](https://discuss.elastic.co/u/Sam1231)\ **Replies:** 5\ **Last updated:** [May 11, 2022, 11:07pm UTC](https://discuss.elastic.co/t/delete-by-query-not-deleting-the-indices/304500 "2022-05-11T23:07:58Z")
hi, i have a python program which needs to delete the indices after 20 days of creation. i have used delete\_by\_query but when i run the program, there is no error but also the indices are not getting deleted. can some… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=941) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=943)