# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=986 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 987 --- ## [ELK+Filebeat errors - multiline\_codec\_max\_lines\_reached, \_xmlparsefailure, \_split\_type\_failure - Large XML Files - pushing Child nodes as separate events](https://discuss.elastic.co/t/elk-filebeat-errors-multiline-codec-max-lines-reached-xmlparsefailure-split-type-failure-large-xml-files-pushing-child-nodes-as-separate-events/301538)
**Author:** [@rubberband](https://discuss.elastic.co/u/rubberband)\ **Replies:** 0\ **Last updated:** [April 4, 2022, 3:38pm UTC](https://discuss.elastic.co/t/elk-filebeat-errors-multiline-codec-max-lines-reached-xmlparsefailure-split-type-failure-large-xml-files-pushing-child-nodes-as-separate-events/301538 "2022-04-04T15:38:24Z")
Dear Team, Requesting your guidance to solve this problem. Big Problem: There's a set of old, HUGE XML files (100+ MB per file, not pretty-formatted, and over 100 million characters) with logs that I have been trying t… --- ## [Need help with Pattern Capture Token Filter](https://discuss.elastic.co/t/need-help-with-pattern-capture-token-filter/301469)
**Author:** [@dishant.sharma](https://discuss.elastic.co/u/dishant.sharma)\ **Replies:** 0\ **Last updated:** [April 4, 2022, 8:17am UTC](https://discuss.elastic.co/t/need-help-with-pattern-capture-token-filter/301469 "2022-04-04T08:17:11Z")
I am currently using the Pattern Capture Group Token Filter inside an Elasticsearch plugin. Currently, the plugin is working absolutely fine and is emitting the tokens also. But, the issue is that the pattern which I am … --- ## [Logstash does not execute config file](https://discuss.elastic.co/t/logstash-does-not-execute-config-file/301594)
**Author:** [@Niya](https://discuss.elastic.co/u/Niya)\ **Replies:** 0\ **Last updated:** [April 5, 2022, 6:46am UTC](https://discuss.elastic.co/t/logstash-does-not-execute-config-file/301594 "2022-04-05T06:46:55Z")
I want some data in a postgresql database to be indexed to an Elasticsearch index. To do so I decided to use Logstash. I installed Logstash and JDBC. I perform the following config: jdbc { jdbc\_connection\_s… --- ## [How to create two elastic search cluster. In single kubernetes cluster](https://discuss.elastic.co/t/how-to-create-two-elastic-search-cluster-in-single-kubernetes-cluster/301525)
**Author:** [@chethankumar4046](https://discuss.elastic.co/u/chethankumar4046)\ **Replies:** 2\ **Last updated:** [April 5, 2022, 6:40am UTC](https://discuss.elastic.co/t/how-to-create-two-elastic-search-cluster-in-single-kubernetes-cluster/301525 "2022-04-05T06:40:14Z")
i want to install two different versions of Elasticsearch in my single kubernetes cluster. is it posible --- ## [Filter with script\_fields on VEGA visualization](https://discuss.elastic.co/t/filter-with-script-fields-on-vega-visualization/301592)
**Author:** [@rogerlee](https://discuss.elastic.co/u/rogerlee)\ **Replies:** 0\ **Last updated:** [April 5, 2022, 6:37am UTC](https://discuss.elastic.co/t/filter-with-script-fields-on-vega-visualization/301592 "2022-04-05T06:37:41Z")
Hi Everyone, I am trying to create a dashboard with VEGA visualization and "control" visualization. In the "control" visualization, I want to use "script\_fields" that I created in the index-pattern to filter results in … --- ## [Logstash aborted when run in multipipeline](https://discuss.elastic.co/t/logstash-aborted-when-run-in-multipipeline/301459)
**Author:** [@Vikrant1](https://discuss.elastic.co/u/Vikrant1)\ **Replies:** 2\ **Last updated:** [April 5, 2022, 6:23am UTC](https://discuss.elastic.co/t/logstash-aborted-when-run-in-multipipeline/301459 "2022-04-05T06:23:49Z")
Hi All, When am trying to run multi-pipeline one - two logstash pipe-line getting abort by error - Errno::ENOENT: No such file or directory - /home/user/.logstash\_jdbc\_last\_run\> am not able to find this mentioned file … --- ## [Error in setting up the Metricbeat](https://discuss.elastic.co/t/error-in-setting-up-the-metricbeat/301512)
**Author:** [@Siavash\_Fazli](https://discuss.elastic.co/u/Siavash_Fazli)\ **Replies:** 0\ **Last updated:** [April 4, 2022, 12:43pm UTC](https://discuss.elastic.co/t/error-in-setting-up-the-metricbeat/301512 "2022-04-04T12:43:11Z")
Hi guys!! I have a problem with Metricbeat V 7.16.2 I have two VPS, one of them for test another one is product environment. I ran the metricbeat successfully on my test server, but in the production environment, I go… --- ## [How to return day num in Kibana Scripted field](https://discuss.elastic.co/t/how-to-return-day-num-in-kibana-scripted-field/299683)
**Author:** [@krishray09](https://discuss.elastic.co/u/krishray09)\ **Replies:** 2\ **Last updated:** [April 5, 2022, 5:18am UTC](https://discuss.elastic.co/t/how-to-return-day-num-in-kibana-scripted-field/299683 "2022-04-05T05:18:55Z")
Hi all, Im using ES query in multiple Timelion charts to compare data for multiple dates. So I used new variables e.x: $u1=-32d, $u2=-69d in below es() query. Can anyone guide me how to use this as a scripted field to be… --- ## [Prioritise health checks in ES cluster to prevent nodes falling out](https://discuss.elastic.co/t/prioritise-health-checks-in-es-cluster-to-prevent-nodes-falling-out/301578)
**Author:** [@anon17386273](https://discuss.elastic.co/u/anon17386273)\ **Replies:** 1\ **Last updated:** [April 5, 2022, 4:04am UTC](https://discuss.elastic.co/t/prioritise-health-checks-in-es-cluster-to-prevent-nodes-falling-out/301578 "2022-04-05T04:04:58Z")
Hi I have a 30 node cluster. Occasionally, I encounter searches that spams the cluster, causing health checks to fail. I see errors like "SERVICE\_UNAVAILABLE/2/no master\]" and my coordinating node falls out of the clust… --- ## [Incorrect HTTP method for URI](https://discuss.elastic.co/t/incorrect-http-method-for-uri/301440)
**Author:** [@wcpoon](https://discuss.elastic.co/u/wcpoon)\ **Replies:** 4\ **Last updated:** [April 5, 2022, 3:38am UTC](https://discuss.elastic.co/t/incorrect-http-method-for-uri/301440 "2022-04-05T03:38:06Z")
Hi guys, PUT /\ PUT /%3Cmy-index-%7Bnow%2Fd%7D%3E I'm getting this error when I run the command above. { "error" : "Incorrect HTTP method for uri \[/%3Cmy-index-%7Bnow/d%7D%3E?pretty=true\] and method… --- ## [My filebeat won't receive any log](https://discuss.elastic.co/t/my-filebeat-wont-receive-any-log/301577)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 1\ **Last updated:** [April 5, 2022, 3:30am UTC](https://discuss.elastic.co/t/my-filebeat-wont-receive-any-log/301577 "2022-04-05T03:30:09Z")
hi everyone, why my filebeat stop receive any log? here's the config filebeat.inputs: # Each - is an input. Most options can be set at the input level, so # you can use different inputs for various configurations. # B… --- ## [How to setup alerting in kibana with data from indexes](https://discuss.elastic.co/t/how-to-setup-alerting-in-kibana-with-data-from-indexes/299685)
**Author:** [@krishray09](https://discuss.elastic.co/u/krishray09)\ **Replies:** 4\ **Last updated:** [April 5, 2022, 2:53am UTC](https://discuss.elastic.co/t/how-to-setup-alerting-in-kibana-with-data-from-indexes/299685 "2022-04-05T02:53:08Z")
Hi all, I need help on how to setup simple/basic alerting in Elastic v7.10 similar to Sentinl available in older versions. Since I'm currently using Elastic v7.10 open source free/basic version so I need to setup alertin… --- ## [Data stopped coming after DST change (Logstash JDBC input)](https://discuss.elastic.co/t/data-stopped-coming-after-dst-change-logstash-jdbc-input/301562)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 4\ **Last updated:** [April 5, 2022, 2:25am UTC](https://discuss.elastic.co/t/data-stopped-coming-after-dst-change-logstash-jdbc-input/301562 "2022-04-05T02:25:25Z")
Hi, We had the DST change in Australia. \[ It ends at 2am (which is 3am Daylight Saving Time) on the first Sunday in April , when clocks are put back one hour.\] The data came in till 1:59 AM in night (April 3rd, 2022) … --- ## [Query in ElasticSearch comparing properties in a document](https://discuss.elastic.co/t/query-in-elasticsearch-comparing-properties-in-a-document/301246)
**Author:** [@TomTom](https://discuss.elastic.co/u/TomTom)\ **Replies:** 4\ **Last updated:** [April 5, 2022, 1:37am UTC](https://discuss.elastic.co/t/query-in-elasticsearch-comparing-properties-in-a-document/301246 "2022-04-05T01:37:46Z")
Is it possible in Elasticsearch to search for documents that have two equal/different properties or a property in the document root is equal/different to a property in a nested property? For example, I have a document t… --- ## [Taking a snapshot causes nodes to fall out of the cluster](https://discuss.elastic.co/t/taking-a-snapshot-causes-nodes-to-fall-out-of-the-cluster/301545)
**Author:** [@reshippie](https://discuss.elastic.co/u/reshippie)\ **Replies:** 3\ **Last updated:** [April 5, 2022, 12:20am UTC](https://discuss.elastic.co/t/taking-a-snapshot-causes-nodes-to-fall-out-of-the-cluster/301545 "2022-04-05T00:20:20Z")
I've got a 22 node cluster (64GB RAM, 16 or 32 cores, 6x2TB SSD in RAID5) along with 3 master eligible nodes. I'm trying to take snapshots of a few indices and whenever I do, I see messages like: \[o.e.c.c.C.Coordinator… --- ## [Integration limits?](https://discuss.elastic.co/t/integration-limits/301553)
**Author:** [@hebph001](https://discuss.elastic.co/u/hebph001)\ **Replies:** 1\ **Last updated:** [April 4, 2022, 10:59pm UTC](https://discuss.elastic.co/t/integration-limits/301553 "2022-04-04T22:59:32Z")
Hi Elasticians, I would like to know how many integrations a single Elastic Agent can support? I can't find this information in the documentation. Thanks, Philippe --- ## [How to find active users of Kibana](https://discuss.elastic.co/t/how-to-find-active-users-of-kibana/301517)
**Author:** [@Pavani\_Reddy](https://discuss.elastic.co/u/Pavani_Reddy)\ **Replies:** 2\ **Last updated:** [April 4, 2022, 10:40pm UTC](https://discuss.elastic.co/t/how-to-find-active-users-of-kibana/301517 "2022-04-04T22:40:31Z")
Hi I am trying to find active users of Kibana,but I couldn't find a way. I am using opendistro security How can I find active users of Kibana. Please help me on this. Thanks in advance, Thanks & Regards, Pavani --- ## [Fluent-bit microservice getting restart frequently](https://discuss.elastic.co/t/fluent-bit-microservice-getting-restart-frequently/301496)
**Author:** [@muralikri](https://discuss.elastic.co/u/muralikri)\ **Replies:** 1\ **Last updated:** [April 4, 2022, 10:39pm UTC](https://discuss.elastic.co/t/fluent-bit-microservice-getting-restart-frequently/301496 "2022-04-04T22:39:53Z")
Hi Team, We have created configmap as below, fluent-bit MS is getting terminate and startup frequently and i could see that it is throwing below error in the logs. After restart it indexing fine and also no buffer \*.flb… --- ## [Elasticsearch file realm users in docker image](https://discuss.elastic.co/t/elasticsearch-file-realm-users-in-docker-image/301555)
**Author:** [@zvonimir](https://discuss.elastic.co/u/zvonimir)\ **Replies:** 0\ **Last updated:** [April 4, 2022, 7:27pm UTC](https://discuss.elastic.co/t/elasticsearch-file-realm-users-in-docker-image/301555 "2022-04-04T19:27:16Z")
Hello. I have security dilemma to create Elasticsearch docker image with file realm files (user, user\_roles) to have some users ready as soon as cluster is deployed. Is that common approach or security issues? I am worr… --- ## [Save only unique events that are not yet stored in ES based on field value](https://discuss.elastic.co/t/save-only-unique-events-that-are-not-yet-stored-in-es-based-on-field-value/301466)
**Author:** [@Lupul\_Dacic](https://discuss.elastic.co/u/Lupul_Dacic)\ **Replies:** 4\ **Last updated:** [April 4, 2022, 7:57pm UTC](https://discuss.elastic.co/t/save-only-unique-events-that-are-not-yet-stored-in-es-based-on-field-value/301466 "2022-04-04T19:57:44Z")
Hi all, I am using Logstash with a http\_poller. Basically I am querying an API and save the data in ELK. All is fine, but the situation is that I am saving the same events and I need unique ones. I would like to save o… --- ## [Logstash is not sending data to the output](https://discuss.elastic.co/t/logstash-is-not-sending-data-to-the-output/301432)
**Author:** [@Bkumar](https://discuss.elastic.co/u/Bkumar)\ **Replies:** 6\ **Last updated:** [April 4, 2022, 6:34pm UTC](https://discuss.elastic.co/t/logstash-is-not-sending-data-to-the-output/301432 "2022-04-04T18:34:19Z")
Hi, This is the message source is sending to the logstash \<132\>Mar 13 23:50:32 k8s-93f066ee-9b76 {\\"projectid\\":\\"JHAR\_BV\\",\\"\_kmd\\":{\\"lmt\\":\\"2022-03-13T23:50:26:388Z\\",\\"ecf\\":\\"2022-03-13T23:50:26:388Z\\"},\\type\\":\\… --- ## [Issue with logstash (1:7.17.1-1) service on Ubuntu 18.04.3 LTS](https://discuss.elastic.co/t/issue-with-logstash-1-7-17-1-1-service-on-ubuntu-18-04-3-lts/299460)
**Author:** [@rahulgupta18](https://discuss.elastic.co/u/rahulgupta18)\ **Replies:** 1\ **Last updated:** [April 4, 2022, 6:30pm UTC](https://discuss.elastic.co/t/issue-with-logstash-1-7-17-1-1-service-on-ubuntu-18-04-3-lts/299460 "2022-04-04T18:30:06Z")
Hi Team, I have deployed a 2-node ELK stack cluster where I can successfully login to kibana instance with my superuser credentials. All of the ELK components (running on same Ubuntu VM) including metricbeats is runnin… --- ## [Reference Tables in Elastic](https://discuss.elastic.co/t/reference-tables-in-elastic/301369)
**Author:** [@Matthew\_Dominic\_Ramp](https://discuss.elastic.co/u/Matthew_Dominic_Ramp)\ **Replies:** 7\ **Last updated:** [April 4, 2022, 6:24pm UTC](https://discuss.elastic.co/t/reference-tables-in-elastic/301369 "2022-04-04T18:24:12Z")
Scenario: I have a multi-field index which stores documents, 'index a', which has a field "id" whose value is a hexadecimal number i have another index 'b' which stores a list of id's and their corresponding string nam… --- ## [Is it possible to exclude the geo\_shape match field in a geo\_match enrich policy?](https://discuss.elastic.co/t/is-it-possible-to-exclude-the-geo-shape-match-field-in-a-geo-match-enrich-policy/301007)
**Author:** [@Joseph\_Parish](https://discuss.elastic.co/u/Joseph_Parish)\ **Replies:** 1\ **Last updated:** [April 4, 2022, 6:00pm UTC](https://discuss.elastic.co/t/is-it-possible-to-exclude-the-geo-shape-match-field-in-a-geo-match-enrich-policy/301007 "2022-04-04T18:00:23Z")
I am following this example and excluded the match\_field from the enrich\_fields (the example includes the match\_field in the array) but the match\_field still shows up in the target\_field. The reason for exclusion is that… --- ## [IIS - Taken time - event.duration?](https://discuss.elastic.co/t/iis-taken-time-event-duration/301546)
**Author:** [@mgfeal](https://discuss.elastic.co/u/mgfeal)\ **Replies:** 0\ **Last updated:** [April 4, 2022, 5:56pm UTC](https://discuss.elastic.co/t/iis-taken-time-event-duration/301546 "2022-04-04T17:56:02Z")
Hi, I was reading this topic: And we also use to put in our dashboards the "Taken Time" from IIS. So, is correct that event.duration is the value for taken time? If it's not correct, how can we use it? Thanks! --- ## [Unable to send data from metricbeat to logstash](https://discuss.elastic.co/t/unable-to-send-data-from-metricbeat-to-logstash/301523)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 1\ **Last updated:** [April 4, 2022, 5:46pm UTC](https://discuss.elastic.co/t/unable-to-send-data-from-metricbeat-to-logstash/301523 "2022-04-04T17:46:53Z")
Hello , Can someone help in this,I'm unable to send data from metricbeat to logstash. Below are the configurations: metricbeat.config.modules: path: ${path.config}/modules.d/\*.yml reload.enabled: false setup.kiban… --- ## [Which NEST version should i use with the latest 8.1 Elastic?](https://discuss.elastic.co/t/which-nest-version-should-i-use-with-the-latest-8-1-elastic/301458)
**Author:** [@Suat\_Kose](https://discuss.elastic.co/u/Suat_Kose)\ **Replies:** 1\ **Last updated:** [April 4, 2022, 5:13pm UTC](https://discuss.elastic.co/t/which-nest-version-should-i-use-with-the-latest-8-1-elastic/301458 "2022-04-04T17:13:45Z")
Hi, We use NEST 6.8.0 with 6.8.4 Elasticsearch. We are upgrading our Elasticsearch version to 8.1. Should we use this client ?NuGet Gallery | Elastic.Clients.Elasticsearch 8.0.0-alpha.4 Is this alpha version recommende… --- ## [Running 2x 4 Node Cluster Using Docker, Advice with Hardware and Approach](https://discuss.elastic.co/t/running-2x-4-node-cluster-using-docker-advice-with-hardware-and-approach/301540)
**Author:** [@webscrapinglife](https://discuss.elastic.co/u/webscrapinglife)\ **Replies:** 0\ **Last updated:** [April 4, 2022, 4:24pm UTC](https://discuss.elastic.co/t/running-2x-4-node-cluster-using-docker-advice-with-hardware-and-approach/301540 "2022-04-04T16:24:34Z")
Hi everyone, i'm looking for some input/feedback /guidance on how i use elastic both from a hardware point of view and how i utilising docker. First everything below has grown from self interest, i don't operate a busin… --- ## [Logstash kv plugin is not working](https://discuss.elastic.co/t/logstash-kv-plugin-is-not-working/300548)
**Author:** [@mmk1995](https://discuss.elastic.co/u/mmk1995)\ **Replies:** 10\ **Last updated:** [April 4, 2022, 3:36pm UTC](https://discuss.elastic.co/t/logstash-kv-plugin-is-not-working/300548 "2022-04-04T15:36:42Z")
I am using ELK 7.6.2 The problem is when I remove the kv plugin, there is log loaded to Elasticsearch, when I add kv plugin, there is zero data can be loaded to Elasticsearch. Moreover, there is no error is logged in t… --- ## [Unable to activate GOLD license](https://discuss.elastic.co/t/unable-to-activate-gold-license/301524)
**Author:** [@discuss\_lipak](https://discuss.elastic.co/u/discuss_lipak)\ **Replies:** 1\ **Last updated:** [April 4, 2022, 2:37pm UTC](https://discuss.elastic.co/t/unable-to-activate-gold-license/301524 "2022-04-04T14:37:43Z")
We are having Elasticsearch GOLD license for our org and we are trying to install the license with security disabled. But we are getting error "Cannot install a \[GOLD\] license unless TLS is configured or security is dis… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=985) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=987)