# Latest **URL:** https://discuss.elastic.co/latest.md?page=1118 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1119 --- ## [Logstash reads file with multiple lines as "1 hit"](https://discuss.elastic.co/t/logstash-reads-file-with-multiple-lines-as-1-hit/301191)
**Author:** [@RomanKau](https://discuss.elastic.co/u/RomanKau)\ **Replies:** 18\ **Last updated:** [May 24, 2022, 2:02pm UTC](https://discuss.elastic.co/t/logstash-reads-file-with-multiple-lines-as-1-hit/301191 "2022-05-24T14:02:21Z")
Running Windows 10, Logstash 8.1.0, Elasticsearch, kibana and filebeat 8.0.0 all on the same machine. Getting the data from logstash into elasticsearch and kibana works but when multiple files get read at the same time … --- ## [Logstash service started but no input](https://discuss.elastic.co/t/logstash-service-started-but-no-input/305472)
**Author:** [@CemG](https://discuss.elastic.co/u/CemG)\ **Replies:** 2\ **Last updated:** [May 24, 2022, 1:54pm UTC](https://discuss.elastic.co/t/logstash-service-started-but-no-input/305472 "2022-05-24T13:54:54Z")
Hello, I have tested Logstash with debug, every thing worked fine. Also tried to start logstash with /usr/share/logstash/bin/logstash and it worked. I have changed the logstash.service file to use pipeline because it wo… --- ## [ECK Elastic Agent not collecting k8s logs](https://discuss.elastic.co/t/eck-elastic-agent-not-collecting-k8s-logs/304424)
**Author:** [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\ **Replies:** 1\ **Last updated:** [May 24, 2022, 1:28pm UTC](https://discuss.elastic.co/t/eck-elastic-agent-not-collecting-k8s-logs/304424 "2022-05-24T13:28:44Z")
I have eck installed on my aws eks cluster, along with elastic agents managed by fleet. After adding the kuberentes integration and attaching the kubernetes package policy to the agent policy. (following this doc -Config… --- ## [Substring does not match with in a string](https://discuss.elastic.co/t/substring-does-not-match-with-in-a-string/305470)
**Author:** [@vinayrordev](https://discuss.elastic.co/u/vinayrordev)\ **Replies:** 1\ **Last updated:** [May 24, 2022, 1:27pm UTC](https://discuss.elastic.co/t/substring-does-not-match-with-in-a-string/305470 "2022-05-24T13:27:28Z")
I am working on search functionality using the Elasticsearch, I need to show result in dropdown if string or substring is match. right now query result be like if I type in input box test so result is test-load-1 te… --- ## [ECK Master not discovered issue](https://discuss.elastic.co/t/eck-master-not-discovered-issue/305147)
**Author:** [@Sagar\_Dalvi](https://discuss.elastic.co/u/Sagar_Dalvi)\ **Replies:** 1\ **Last updated:** [May 24, 2022, 1:19pm UTC](https://discuss.elastic.co/t/eck-master-not-discovered-issue/305147 "2022-05-24T13:19:31Z")
We have deployed Elasticsearch on Openshift Cluster using ECK Operator. We were facing some sharding issue for Elasticsearch cluster after which we have restarted Elasticsearch operator and runtime pods. After restart … --- ## [Is there a way to have multiple yaml configs?](https://discuss.elastic.co/t/is-there-a-way-to-have-multiple-yaml-configs/305363)
**Author:** [@anon17386273](https://discuss.elastic.co/u/anon17386273)\ **Replies:** 3\ **Last updated:** [May 24, 2022, 1:13pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-have-multiple-yaml-configs/305363 "2022-05-24T13:13:33Z")
Hi I have successfully deployed a HOT-WARM environment using one ECK yaml config file. Lets say i decided to add COLD tier, is it possible to have a separate yaml config that joins the existing ECK cluster? What is th… --- ## [How to invert the y axis to start from 100% in bottom to 0% in top](https://discuss.elastic.co/t/how-to-invert-the-y-axis-to-start-from-100-in-bottom-to-0-in-top/305505)
**Author:** [@AlaaElbahrawy](https://discuss.elastic.co/u/AlaaElbahrawy)\ **Replies:** 0\ **Last updated:** [May 24, 2022, 12:51pm UTC](https://discuss.elastic.co/t/how-to-invert-the-y-axis-to-start-from-100-in-bottom-to-0-in-top/305505 "2022-05-24T12:51:13Z")
Hi, I'm facing a graph where data is almost near 100%. And i need a stacked bar chart to start from 100 in bottom to 0 in top just like the image is that possible? --- ## [Aggregating multiple values from single fields](https://discuss.elastic.co/t/aggregating-multiple-values-from-single-fields/305176)
**Author:** [@MarioRojas](https://discuss.elastic.co/u/MarioRojas)\ **Replies:** 4\ **Last updated:** [May 24, 2022, 12:43pm UTC](https://discuss.elastic.co/t/aggregating-multiple-values-from-single-fields/305176 "2022-05-24T12:43:10Z")
Hi all, I have some documents, where a given field can have one or several values (strings or numerical, not mixed though) and I wanted to know if it's possible to operate these, like count the number of values of one t… --- ## [Null values not showing on Dashboard](https://discuss.elastic.co/t/null-values-not-showing-on-dashboard/305503)
**Author:** [@behappy\_alwayz0401](https://discuss.elastic.co/u/behappy_alwayz0401)\ **Replies:** 0\ **Last updated:** [May 24, 2022, 12:31pm UTC](https://discuss.elastic.co/t/null-values-not-showing-on-dashboard/305503 "2022-05-24T12:31:05Z")
Hi, I have filtered for the same set of data for the same data range on Discover and Dashboard tabs. One of the fields in the data is Region. While Discover shows values for REgion as AMER, EMEA, ASIA and "-", Dashboard… --- ## [Logstash azure log analytics output - Failed to flush outgoing items - block in start\_workers](https://discuss.elastic.co/t/logstash-azure-log-analytics-output-failed-to-flush-outgoing-items-block-in-start-workers/305078)
**Author:** [@pavank](https://discuss.elastic.co/u/pavank)\ **Replies:** 6\ **Last updated:** [May 24, 2022, 12:29pm UTC](https://discuss.elastic.co/t/logstash-azure-log-analytics-output-failed-to-flush-outgoing-items-block-in-start-workers/305078 "2022-05-24T12:29:11Z")
Hi, I am using the redhat openshift logging operator provided fluentd forward to forward my logs to a Logstash instance, and using the azure log analytics output plugin to forward the logs to an Azure Log Analytics Work… --- ## [Mapping conflict with host.ip in filebeat](https://discuss.elastic.co/t/mapping-conflict-with-host-ip-in-filebeat/305502)
**Author:** [@PJ\_ceSofnI\_tseT](https://discuss.elastic.co/u/PJ_ceSofnI_tseT)\ **Replies:** 0\ **Last updated:** [May 24, 2022, 12:19pm UTC](https://discuss.elastic.co/t/mapping-conflict-with-host-ip-in-filebeat/305502 "2022-05-24T12:19:11Z")
Hi all, I am using filebeat on different hosts but on one of them a conflict has appeared for the host.ip field. This field appears to have the types: ip and text. This happens because both the IPv4 and IPv6 version… --- ## [Elastic App Search Analytics: 2 conceptual-level questions](https://discuss.elastic.co/t/elastic-app-search-analytics-2-conceptual-level-questions/305195)
**Author:** [@Cameron\_Ives](https://discuss.elastic.co/u/Cameron_Ives)\ **Replies:** 2\ **Last updated:** [May 24, 2022, 12:18pm UTC](https://discuss.elastic.co/t/elastic-app-search-analytics-2-conceptual-level-questions/305195 "2022-05-24T12:18:24Z")
We are just setting up Elastic App Search for our website's search engine. I have been reading all about the Click analytics API and how you can use it with tags to move toward personalized search. Unfortunately, my co… --- ## [Value of "elastic" is forbidden in Kibana 8.2](https://discuss.elastic.co/t/value-of-elastic-is-forbidden-in-kibana-8-2/305501)
**Author:** [@borisr84](https://discuss.elastic.co/u/borisr84)\ **Replies:** 0\ **Last updated:** [May 24, 2022, 12:04pm UTC](https://discuss.elastic.co/t/value-of-elastic-is-forbidden-in-kibana-8-2/305501 "2022-05-24T12:04:18Z")
Hi, after upgrading to ELK 8.2, I started getting some errors, some of which I was able to resolve for now, however the last error that keeps me stuck is the error of using "elastic" user. I'm getting the following erro… --- ## [Help me in configure filebeat index](https://discuss.elastic.co/t/help-me-in-configure-filebeat-index/305253)
**Author:** [@Rajesh119](https://discuss.elastic.co/u/Rajesh119)\ **Replies:** 21\ **Last updated:** [May 24, 2022, 11:58am UTC](https://discuss.elastic.co/t/help-me-in-configure-filebeat-index/305253 "2022-05-24T11:58:34Z")
i use this command, it will not shown my filebeat index curl http://localhost:9200/\_cat/indices?v And i use below command to know the status filebeat -e -c /etc/filebeat/filebeat.yml output: {"log.level":"info",… --- ## [Wanted to drop specific syslog message and syslog Client](https://discuss.elastic.co/t/wanted-to-drop-specific-syslog-message-and-syslog-client/305498)
**Author:** [@ashisharyan](https://discuss.elastic.co/u/ashisharyan)\ **Replies:** 0\ **Last updated:** [May 24, 2022, 11:56am UTC](https://discuss.elastic.co/t/wanted-to-drop-specific-syslog-message-and-syslog-client/305498 "2022-05-24T11:56:07Z")
Hi, I wanted to drop some specific syslog message and syslog client which should not be send to ELK. Below is the Logstash config file. we have tried but it is not working. So request if anyone can help me to get this … --- ## [Check if index exist in elasticsearch 8.2](https://discuss.elastic.co/t/check-if-index-exist-in-elasticsearch-8-2/305356)
**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\ **Replies:** 8\ **Last updated:** [May 24, 2022, 11:47am UTC](https://discuss.elastic.co/t/check-if-index-exist-in-elasticsearch-8-2/305356 "2022-05-24T11:47:07Z")
Hi, How do I check if index exist in JAVA API 8.2. In v.7.x I used: GetIndexRequest request = new GetIndexRequest("yourindexname"); restHighLevelclient.indices().exists(request, RequestOptions.DEFAULT); --- ## [Filebeat doesn't send logs to elasticsearch](https://discuss.elastic.co/t/filebeat-doesnt-send-logs-to-elasticsearch/305301)
**Author:** [@elduderino](https://discuss.elastic.co/u/elduderino)\ **Replies:** 2\ **Last updated:** [May 24, 2022, 11:31am UTC](https://discuss.elastic.co/t/filebeat-doesnt-send-logs-to-elasticsearch/305301 "2022-05-24T11:31:08Z")
I got some logs and filebeat was shipping them to the ES server just fine but all of a sudden seems to be stopped shipping some files in different folders in the same machine. Filebeat service is running. Did anyone expe… --- ## [Expand\_keys doesn't work if target option is used in decode\_json\_fields beat processor](https://discuss.elastic.co/t/expand-keys-doesnt-work-if-target-option-is-used-in-decode-json-fields-beat-processor/305276)
**Author:** [@iorfix](https://discuss.elastic.co/u/iorfix)\ **Replies:** 3\ **Last updated:** [May 24, 2022, 10:35am UTC](https://discuss.elastic.co/t/expand-keys-doesnt-work-if-target-option-is-used-in-decode-json-fields-beat-processor/305276 "2022-05-24T10:35:08Z")
In decode\_json\_fields processor, expanded notation works only if target is left to "". In fact, in source code ( beats/decode\_json\_fields.go at master · elastic/beats · GitHub ) there is a clear if section: if target… --- ## [Use KV filter in logstash can not filter?](https://discuss.elastic.co/t/use-kv-filter-in-logstash-can-not-filter/305446)
**Author:** [@GhostRaven](https://discuss.elastic.co/u/GhostRaven)\ **Replies:** 2\ **Last updated:** [May 24, 2022, 10:29am UTC](https://discuss.elastic.co/t/use-kv-filter-in-logstash-can-not-filter/305446 "2022-05-24T10:29:45Z")
Use KV filter in logstash. I can get the value, but can not filter ? why ? Does the key can not be uppercase? if \[host\] == "10.9.10.10" { kv { include\_keys =\> \[ "ACMAC", "ACNAME", "AP… --- ## [Adding a New field to index](https://discuss.elastic.co/t/adding-a-new-field-to-index/305408)
**Author:** [@icgncl](https://discuss.elastic.co/u/icgncl)\ **Replies:** 1\ **Last updated:** [May 24, 2022, 10:26am UTC](https://discuss.elastic.co/t/adding-a-new-field-to-index/305408 "2022-05-24T10:26:22Z")
I want to add a new field to my index which includes more than 20m documents. I have dictionary like this Template : \[Catalog\_id : {Keyword: Sold Count}\] Sold Counts = {1234: {Apple:50}, 3242: {Banana:20}, 3423: {Apple:… --- ## [Changing index replication factor to 0](https://discuss.elastic.co/t/changing-index-replication-factor-to-0/305482)
**Author:** [@charvi23](https://discuss.elastic.co/u/charvi23)\ **Replies:** 4\ **Last updated:** [May 24, 2022, 10:08am UTC](https://discuss.elastic.co/t/changing-index-replication-factor-to-0/305482 "2022-05-24T10:08:35Z")
Currently I am working on a single node Elasticsearch setup. But the replication factor was set to 1 by default. The space on my node is 3TB. If I decrease the replication factor to 0 , what will happen in that case? O… --- ## [Failed to execute action](https://discuss.elastic.co/t/failed-to-execute-action/305479)
**Author:** [@Palaibada](https://discuss.elastic.co/u/Palaibada)\ **Replies:** 0\ **Last updated:** [May 24, 2022, 9:40am UTC](https://discuss.elastic.co/t/failed-to-execute-action/305479 "2022-05-24T09:40:30Z")
what is solution for this error "message=\>"java.io.IOException: Page file size is too small to hold elements" ? --- ## [APM integration on Elastic agent 7.17 - agents are healthy but no data appears](https://discuss.elastic.co/t/apm-integration-on-elastic-agent-7-17-agents-are-healthy-but-no-data-appears/305196)
**Author:** [@christianfosli](https://discuss.elastic.co/u/christianfosli)\ **Replies:** 2\ **Last updated:** [May 24, 2022, 9:33am UTC](https://discuss.elastic.co/t/apm-integration-on-elastic-agent-7-17-agents-are-healthy-but-no-data-appears/305196 "2022-05-24T09:33:33Z")
I have tried to set up elastic-agent with APM integration. My configuration is nearly the same as the example here Configuration Examples | Elastic Cloud on Kubernetes \[master\] | Elastic, except I use version 7.17 for ev… --- ## [Preserve original log file name using Filebeat and Logstash](https://discuss.elastic.co/t/preserve-original-log-file-name-using-filebeat-and-logstash/305390)
**Author:** [@Robert\_Garcia\_Torren](https://discuss.elastic.co/u/Robert_Garcia_Torren)\ **Replies:** 1\ **Last updated:** [May 24, 2022, 8:50am UTC](https://discuss.elastic.co/t/preserve-original-log-file-name-using-filebeat-and-logstash/305390 "2022-05-24T08:50:07Z")
Hi. I just want to preserve the original file name for example: laravel-2022-05-17.log and set it as index. I was not able to find the propper way to obtain it using filebeat and sending it to logstash. Thanks … --- ## [ILM rollout not working](https://discuss.elastic.co/t/ilm-rollout-not-working/303463)
**Author:** [@gerardgorrion](https://discuss.elastic.co/u/gerardgorrion)\ **Replies:** 3\ **Last updated:** [May 24, 2022, 8:33am UTC](https://discuss.elastic.co/t/ilm-rollout-not-working/303463 "2022-05-24T08:33:29Z")
Hi all, We want to active the rollout into hot phase in a index. Policy applied before rollout: PUT \_ilm/policy/test-custom { "policy": { "phases": { "hot": { "min\_age": "0ms", "actions": { … --- ## [Processors - Policy - How to use to filter fields](https://discuss.elastic.co/t/processors-policy-how-to-use-to-filter-fields/305467)
**Author:** [@mgfeal](https://discuss.elastic.co/u/mgfeal)\ **Replies:** 0\ **Last updated:** [May 24, 2022, 7:55am UTC](https://discuss.elastic.co/t/processors-policy-how-to-use-to-filter-fields/305467 "2022-05-24T07:55:43Z")
Hi, We are using some Elastic integrations to get logs and metrics to our Elastic Cloud deployment. But there are a lot of fields that we are not using. Right now we collect the complete log files, but we are looking at… --- ## [Kibana URL Error on HTTPS Connection: Refuse To Execute Inline Scripts Because Its Violate The Following Content Security Policy Directive And Failed To Fetch JS Pages](https://discuss.elastic.co/t/kibana-url-error-on-https-connection-refuse-to-execute-inline-scripts-because-its-violate-the-following-content-security-policy-directive-and-failed-to-fetch-js-pages/304945)
**Author:** [@Lokesh\_Sachdeva](https://discuss.elastic.co/u/Lokesh_Sachdeva)\ **Replies:** 0\ **Last updated:** [May 17, 2022, 1:12pm UTC](https://discuss.elastic.co/t/kibana-url-error-on-https-connection-refuse-to-execute-inline-scripts-because-its-violate-the-following-content-security-policy-directive-and-failed-to-fetch-js-pages/304945 "2022-05-17T13:12:15Z")
HI Team We are installing the ELK Docker Image 8.0.0 with configuring SSL security in ELK Cluster. Configured Kibana.yml file with below settings SERVER\_SSL\_ENABLE= true SERVER\_SSL\_CERTIFICATE=config/cert/server/server… --- ## [Can word spacing support and or relationship](https://discuss.elastic.co/t/can-word-spacing-support-and-or-relationship/305444)
**Author:** [@S-Dragon0302](https://discuss.elastic.co/u/S-Dragon0302)\ **Replies:** 6\ **Last updated:** [May 24, 2022, 7:02am UTC](https://discuss.elastic.co/t/can-word-spacing-support-and-or-relationship/305444 "2022-05-24T07:02:39Z")
query\_string case: ((a|b)+(c|d))~10 ==\> ((a+c)~10)|((a+d)~10)|((b+c)~10)|((b+d)~10) Can this be true,What should I do if I want to do this. --- ## [Need information on logs-endpoint.events.file@custom](https://discuss.elastic.co/t/need-information-on-logs-endpoint-events-file-custom/305460)
**Author:** [@niveditakathal](https://discuss.elastic.co/u/niveditakathal)\ **Replies:** 0\ **Last updated:** [May 24, 2022, 6:58am UTC](https://discuss.elastic.co/t/need-information-on-logs-endpoint-events-file-custom/305460 "2022-05-24T06:58:14Z")
Hi Experts, I want to add warm phase under logs ILM policy ; However, editing elastic provided ILM or templates is not recommended. hence I analyzed the existing logs template set up to create new template and ILM for … --- ## [Dedicated Auth Log](https://discuss.elastic.co/t/dedicated-auth-log/305415)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 0\ **Last updated:** [May 23, 2022, 3:54pm UTC](https://discuss.elastic.co/t/dedicated-auth-log/305415 "2022-05-23T15:54:53Z")
Is it possible to setup Elasticsearch to log all authentication attempts to a separate file? This would mostly be Kibana authentications via AD or local user, would it be better to setup logging in Kibana to track this? … [Previous page](https://discuss.elastic.co/latest.md?page=1117) [Next page](https://discuss.elastic.co/latest.md?page=1119)