# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=998 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 999 --- ## [Filebeat config - several apps on one server](https://discuss.elastic.co/t/filebeat-config-several-apps-on-one-server/300837)
**Author:** [@Albert\_Komst](https://discuss.elastic.co/u/Albert_Komst)\ **Replies:** 0\ **Last updated:** [March 28, 2022, 12:07pm UTC](https://discuss.elastic.co/t/filebeat-config-several-apps-on-one-server/300837 "2022-03-28T12:07:14Z")
Hello, I have few apps I would like to monitor on one server. Filebeat config for app1 looks like below: filebeat: inputs: - fields: fileset: module: app1 name: debug fields\_und… --- ## [Error accessing Kibana after Upgrade](https://discuss.elastic.co/t/error-accessing-kibana-after-upgrade/300677)
**Author:** [@kubernetes87](https://discuss.elastic.co/u/kubernetes87)\ **Replies:** 12\ **Last updated:** [March 28, 2022, 11:46am UTC](https://discuss.elastic.co/t/error-accessing-kibana-after-upgrade/300677 "2022-03-28T11:46:45Z")
Hi community, for testing purposes I copied a VM with Ubuntu 18.04.6. On that machine everything worked fine. I upgraded the Ubuntu to 21.10 (the underlying Kibana and Elasticsearch had been updated too). Now I have … --- ## [Anomaly detection rules don't execute provided actions](https://discuss.elastic.co/t/anomaly-detection-rules-dont-execute-provided-actions/300691)
**Author:** [@Rick\_V](https://discuss.elastic.co/u/Rick_V)\ **Replies:** 1\ **Last updated:** [March 28, 2022, 11:44am UTC](https://discuss.elastic.co/t/anomaly-detection-rules-dont-execute-provided-actions/300691 "2022-03-28T11:44:54Z")
Hi, I've got a detection rule set up for a anomaly job, it checks whether in the last 5 minutes an anomaly higher than 50, 75 or 90 was reported and then performs two action: index a document with data such as the score… --- ## [How to distribute documents across shards equally, using \_routing in Elasticsearch](https://discuss.elastic.co/t/how-to-distribute-documents-across-shards-equally-using-routing-in-elasticsearch/300802)
**Author:** [@likhith1995](https://discuss.elastic.co/u/likhith1995)\ **Replies:** 9\ **Last updated:** [March 28, 2022, 11:41am UTC](https://discuss.elastic.co/t/how-to-distribute-documents-across-shards-equally-using-routing-in-elasticsearch/300802 "2022-03-28T11:41:50Z")
Hi Team, We are ingesting the data into Elasticsearch, using 3 routing values (namely 3g, 4g, 5g). We assigned 3 primary shards and 1 replica. Index Rollover is configured to 1gb (max per primary shard) for testing. Wh… --- ## [The index creating by ElasticSearch(6.8.8) not match the configuration in code?](https://discuss.elastic.co/t/the-index-creating-by-elasticsearch-6-8-8-not-match-the-configuration-in-code/300651)
**Author:** [@xuekg](https://discuss.elastic.co/u/xuekg)\ **Replies:** 2\ **Last updated:** [March 28, 2022, 11:24am UTC](https://discuss.elastic.co/t/the-index-creating-by-elasticsearch-6-8-8-not-match-the-configuration-in-code/300651 "2022-03-28T11:24:10Z")
I hava a cluster of ES with 3 servers. The version of ES and ik are same 6.8.8. Dependency of spring boot: \org.springframework.boot\ \spring-boot-dependencies\ \2.2.13.… --- ## [Elasticsearch : Snapshots not executed automatically (cron schedule issue)](https://discuss.elastic.co/t/elasticsearch-snapshots-not-executed-automatically-cron-schedule-issue/300820)
**Author:** [@Ksnov](https://discuss.elastic.co/u/Ksnov)\ **Replies:** 0\ **Last updated:** [March 28, 2022, 9:05am UTC](https://discuss.elastic.co/t/elasticsearch-snapshots-not-executed-automatically-cron-schedule-issue/300820 "2022-03-28T09:05:02Z")
Hi ! I've changed the schedule of my managed snapshot policy. By default, the cron is each 30 minutes, and I wanted just one per day. Since... the snapshots are not executed automatically... I've putted back the previo… --- ## [pfSense Logs integration not working - What am I missing?](https://discuss.elastic.co/t/pfsense-logs-integration-not-working-what-am-i-missing/300824)
**Author:** [@EvertM](https://discuss.elastic.co/u/EvertM)\ **Replies:** 0\ **Last updated:** [March 28, 2022, 10:12am UTC](https://discuss.elastic.co/t/pfsense-logs-integration-not-working-what-am-i-missing/300824 "2022-03-28T10:12:34Z")
Hi all, I've added the pfSense Logs integration, but it doesn't seem to receive any data. The pfSense box is sending, and it is arriving on on the Elastic-box (verified with nc -l -u 10.10.10.1 -p 9001). Are there any … --- ## [Kibana on Azure webapp - all GET requests fail](https://discuss.elastic.co/t/kibana-on-azure-webapp-all-get-requests-fail/300813)
**Author:** [@jetnet](https://discuss.elastic.co/u/jetnet)\ **Replies:** 0\ **Last updated:** [March 28, 2022, 8:44am UTC](https://discuss.elastic.co/t/kibana-on-azure-webapp-all-get-requests-fail/300813 "2022-03-28T08:44:04Z")
it's a very weird issue: I've deployed Kibana 7.17.1 and Elasticsearch (same version) to separate Azure Webapp (docker containers), almost all works, but: GET .kibana/\_search results to: POST https://MYAPP-kibana.azur… --- ## [Phonetic search with \_msearch query](https://discuss.elastic.co/t/phonetic-search-with-msearch-query/300755)
**Author:** [@Sumit\_Suman](https://discuss.elastic.co/u/Sumit_Suman)\ **Replies:** 1\ **Last updated:** [March 28, 2022, 8:32am UTC](https://discuss.elastic.co/t/phonetic-search-with-msearch-query/300755 "2022-03-28T08:32:01Z")
Hi, I am new to Elasticsearch, I was doing one POC on the Elasticsearch and I was trying to implement the phonetic search. For that, I have installed the phonetic analyzer in the server and created the index by putting … --- ## [Getting last document per specific field](https://discuss.elastic.co/t/getting-last-document-per-specific-field/300564)
**Author:** [@Malo\_Maisonneuve](https://discuss.elastic.co/u/Malo_Maisonneuve)\ **Replies:** 3\ **Last updated:** [March 28, 2022, 8:15am UTC](https://discuss.elastic.co/t/getting-last-document-per-specific-field/300564 "2022-03-28T08:15:22Z")
Hi, I'm collecting logs from multiple devices, and I'm trying to retrieve the last log from each device. For instance, I'd like to have : "deviceId": 4568 =\> {content of last log according to timestamp for this devic… --- ## [Configuration options Auditbeat in windows 10](https://discuss.elastic.co/t/configuration-options-auditbeat-in-windows-10/300453)
**Author:** [@nour41\_nour41](https://discuss.elastic.co/u/nour41_nour41)\ **Replies:** 2\ **Last updated:** [March 28, 2022, 7:43am UTC](https://discuss.elastic.co/t/configuration-options-auditbeat-in-windows-10/300453 "2022-03-28T07:43:15Z")
configuration options Auditbeat in windows 10 --- ## [AIX support for Elastic Stack](https://discuss.elastic.co/t/aix-support-for-elastic-stack/300806)
**Author:** [@mathur7vidit](https://discuss.elastic.co/u/mathur7vidit)\ **Replies:** 2\ **Last updated:** [March 28, 2022, 7:40am UTC](https://discuss.elastic.co/t/aix-support-for-elastic-stack/300806 "2022-03-28T07:40:50Z")
Hi Team, As per Elastic support matrix, AIX is not mentioned anywhere, just wanted to confirm once again here, by any chance, AIX is being supported by any component of Elastic stack? Support matrix URL: Support Matrix… --- ## [High cpu load, just a one node working on 100%](https://discuss.elastic.co/t/high-cpu-load-just-a-one-node-working-on-100/300751)
**Author:** [@phmean21](https://discuss.elastic.co/u/phmean21)\ **Replies:** 2\ **Last updated:** [March 28, 2022, 7:37am UTC](https://discuss.elastic.co/t/high-cpu-load-just-a-one-node-working-on-100/300751 "2022-03-28T07:37:26Z")
Hi everyone, i\`m newbie an elastic. I have cluster of 3 nodes with ES 7.15.0. Problem is just 1 node working on indexing. curl -s -XGET -u user:pass "mv-elk-data-01:9200/\_cat/thread\_pool" |grep " write " mv-elk-data-0… --- ## [Bootstrap vulnerabilities](https://discuss.elastic.co/t/bootstrap-vulnerabilities/300124)
**Author:** [@frenkel](https://discuss.elastic.co/u/frenkel)\ **Replies:** 4\ **Last updated:** [March 28, 2022, 6:51am UTC](https://discuss.elastic.co/t/bootstrap-vulnerabilities/300124 "2022-03-28T06:51:18Z")
Hi I have a question about bootstrap vulnerabilities. In bootstrap versions below 4.1.2, these 3 vulnerabilities have been found: We are using Kibana as part of our solution and when digging into the files we saw t… --- ## [Elasticsearch 8 single node replicas 0](https://discuss.elastic.co/t/elasticsearch-8-single-node-replicas-0/299676)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 9\ **Last updated:** [March 28, 2022, 6:45am UTC](https://discuss.elastic.co/t/elasticsearch-8-single-node-replicas-0/299676 "2022-03-28T06:45:26Z")
I have a single node cluster which is showing yellow because replicas are set to 1 Is there a way to get this setup so that all future indexes have replicas set to 0 This used to be easy with legacy templates curl -XP… --- ## [Nearby Query with Dynamic Data](https://discuss.elastic.co/t/nearby-query-with-dynamic-data/300800)
**Author:** [@kabilsharma](https://discuss.elastic.co/u/kabilsharma)\ **Replies:** 1\ **Last updated:** [March 28, 2022, 6:35am UTC](https://discuss.elastic.co/t/nearby-query-with-dynamic-data/300800 "2022-03-28T06:35:01Z")
(Nearby Query) We are building a search engine where user will type like Restaurant (Category) in Delhi (place) Bar (Category) in Mumbai (place) We are supposed to search first tag into category and second … --- ## [Is there any way to determine what ES doing caused abnormal IO?](https://discuss.elastic.co/t/is-there-any-way-to-determine-what-es-doing-caused-abnormal-io/300527)
**Author:** [@mjikop1231](https://discuss.elastic.co/u/mjikop1231)\ **Replies:** 6\ **Last updated:** [March 28, 2022, 6:19am UTC](https://discuss.elastic.co/t/is-there-any-way-to-determine-what-es-doing-caused-abnormal-io/300527 "2022-03-28T06:19:38Z")
I have a ES cluster with 3 master and 5 data node enabled rebalance and allocation. And in /\_nodes/.../stats doesn't show any thing running in that nodes, and also no tasks in \_tasks. But all data node has near 500 IOPS… --- ## [Make log from socket listener](https://discuss.elastic.co/t/make-log-from-socket-listener/300559)
**Author:** [@Badb0y](https://discuss.elastic.co/u/Badb0y)\ **Replies:** 2\ **Last updated:** [March 28, 2022, 5:26am UTC](https://discuss.elastic.co/t/make-log-from-socket-listener/300559 "2022-03-28T05:26:58Z")
Hi, Is there a way to make a log entry with filebeat from these entries that logstash can consume? I have entries like this Thu Mar 24 17:34:49 +07 2022 # table: https, type: ip, size:1048576, used:0 # table: http, t… --- ## [Logstash 8.1.1 with file input plugin hangs](https://discuss.elastic.co/t/logstash-8-1-1-with-file-input-plugin-hangs/300789)
**Author:** [@geena.rollins](https://discuss.elastic.co/u/geena.rollins)\ **Replies:** 4\ **Last updated:** [March 28, 2022, 12:38am UTC](https://discuss.elastic.co/t/logstash-8-1-1-with-file-input-plugin-hangs/300789 "2022-03-28T00:38:43Z")
On Amazon Linux 2 AMI (HVM) - Kernel 5.10, I installed Java-17, Elasticsearch 8.1.1, and Logstash 8.1.1. When I use the file input plugin, logstash hangs. logstash.yml is node.name: tester file.conf is input { fi… --- ## [Connection refused on put mapping](https://discuss.elastic.co/t/connection-refused-on-put-mapping/300790)
**Author:** [@Arnab\_Dey](https://discuss.elastic.co/u/Arnab_Dey)\ **Replies:** 3\ **Last updated:** [March 28, 2022, 12:00am UTC](https://discuss.elastic.co/t/connection-refused-on-put-mapping/300790 "2022-03-28T00:00:07Z")
Can anyone help me with the /put request for mapping in Elasticsearch the elk is deployed in a server but the put request always gives a connection refused exception the Url is http://#.##.##.##:9200/intscript And pls … --- ## [Can Logstash 7.x work with elastic 8.x](https://discuss.elastic.co/t/can-logstash-7-x-work-with-elastic-8-x/300512)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 1\ **Last updated:** [March 27, 2022, 11:56pm UTC](https://discuss.elastic.co/t/can-logstash-7-x-work-with-elastic-8-x/300512 "2022-03-27T23:56:26Z")
Hi all I have a question before upgrading elastic to 8.x Do i have to upgrade all logstash and filebeat node to version 8.x or it can be keep at version 7.17 Since there is a lot of logstash and filebeat node in my sy… --- ## [Out of RAM memory](https://discuss.elastic.co/t/out-of-ram-memory/300535)
**Author:** [@Uporaba](https://discuss.elastic.co/u/Uporaba)\ **Replies:** 1\ **Last updated:** [March 27, 2022, 11:52pm UTC](https://discuss.elastic.co/t/out-of-ram-memory/300535 "2022-03-27T23:52:35Z")
Hello. I have a cluster of 3 machines with 16 cores and 32 gigs of RAM. The last 2 weeks there has been a problem that 28-29 GB of 32 GB become full. I sinned on the cache, cleaned it, but the memory did not go away. Reb… --- ## [Running multiple servers in one command](https://discuss.elastic.co/t/running-multiple-servers-in-one-command/300578)
**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\ **Replies:** 1\ **Last updated:** [March 27, 2022, 11:50pm UTC](https://discuss.elastic.co/t/running-multiple-servers-in-one-command/300578 "2022-03-27T23:50:56Z")
Hi, Each folder(Elasticsearch,Logstash,Kibana) runs a completely different type of server. They have to have 3 command instances up at the same time. Is there a way I can run the following commands within each folder … --- ## [What types of node require license, or i need license for all node?](https://discuss.elastic.co/t/what-types-of-node-require-license-or-i-need-license-for-all-node/300590)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 1\ **Last updated:** [March 27, 2022, 11:50pm UTC](https://discuss.elastic.co/t/what-types-of-node-require-license-or-i-need-license-for-all-node/300590 "2022-03-27T23:50:10Z")
Hello team. I have build cluster with 67 node, as displayed in below table: My question is that, what types of node require license, or i need license for all node? Nodes Count Warm nodes 16 hot nodes 21 … --- ## [8.1 crowdstrike falcon pipeline](https://discuss.elastic.co/t/8-1-crowdstrike-falcon-pipeline/300631)
**Author:** [@NightSpark](https://discuss.elastic.co/u/NightSpark)\ **Replies:** 0\ **Last updated:** [March 24, 2022, 7:45pm UTC](https://discuss.elastic.co/t/8-1-crowdstrike-falcon-pipeline/300631 "2022-03-24T19:45:21Z")
Hi, Does 8.1 have a pipeline for the filebeat crowdstrike module? I am getting the following errow after upgrading and when trying to load latest pipelines. filebeat setup --pipelines --modules crowdstrike Exiting: m… --- ## [Some vulnerabilities are coming from Elasticsearch rest high level client v7.16.3](https://discuss.elastic.co/t/some-vulnerabilities-are-coming-from-elasticsearch-rest-high-level-client-v7-16-3/300614)
**Author:** [@Sagarika\_Mahalik](https://discuss.elastic.co/u/Sagarika_Mahalik)\ **Replies:** 1\ **Last updated:** [March 27, 2022, 11:47pm UTC](https://discuss.elastic.co/t/some-vulnerabilities-are-coming-from-elasticsearch-rest-high-level-client-v7-16-3/300614 "2022-03-27T23:47:48Z")
There is one vulnerability is coming from Elasticsearch rest high level client v7.16.3. Is there any way to mitigate this? Below is the link for CVE: https://nvd.nist.gov/vuln/detail/CVE-2022-23708 --- ## [Index rollover / Delete indexes](https://discuss.elastic.co/t/index-rollover-delete-indexes/300685)
**Author:** [@humartinez](https://discuss.elastic.co/u/humartinez)\ **Replies:** 1\ **Last updated:** [March 27, 2022, 11:44pm UTC](https://discuss.elastic.co/t/index-rollover-delete-indexes/300685 "2022-03-27T23:44:49Z")
Hi, I have a kind of wierd question. I just want to know if there is a way using index rollover and the index lifecycle to lets say to allways keep the last 3 indexes. Ej Lets say I have a rollover policy that rolls m… --- ## [Unable to get Elastic and Kibana working](https://discuss.elastic.co/t/unable-to-get-elastic-and-kibana-working/299829)
**Author:** [@LtChachee](https://discuss.elastic.co/u/LtChachee)\ **Replies:** 6\ **Last updated:** [March 27, 2022, 10:43pm UTC](https://discuss.elastic.co/t/unable-to-get-elastic-and-kibana-working/299829 "2022-03-27T22:43:38Z")
Hello, I've been trying for hours to get an ELK stack setup so I can start learning it. I attempted the docker guide, but the Kibana container was always unhealthy, and I couldn't find a fix for it here or on the intern… --- ## [Unable to install Endpoint Security on windows server](https://discuss.elastic.co/t/unable-to-install-endpoint-security-on-windows-server/299654)
**Author:** [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)\ **Replies:** 4\ **Last updated:** [March 27, 2022, 9:38pm UTC](https://discuss.elastic.co/t/unable-to-install-endpoint-security-on-windows-server/299654 "2022-03-27T21:38:52Z")
Hello, I'm trying to deploy fleet policy that installs endpoint security on windows server, but the agent keep being unhealthy because of endpoint security install failure. try to execute .\\endpoint-security.exe instal… --- ## [Logstash output to Prometheus](https://discuss.elastic.co/t/logstash-output-to-prometheus/300686)
**Author:** [@Stephy\_Jacob](https://discuss.elastic.co/u/Stephy_Jacob)\ **Replies:** 3\ **Last updated:** [March 27, 2022, 4:15pm UTC](https://discuss.elastic.co/t/logstash-output-to-prometheus/300686 "2022-03-27T16:15:15Z")
Hi, Could you please confirm whether we can send output of Logstash to Prometheus [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=997) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=999)