# Latest **URL:** https://discuss.elastic.co/latest.md?page=1134 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1135 --- ## [Remove left whitespaces logstash](https://discuss.elastic.co/t/remove-left-whitespaces-logstash/304514)
**Author:** [@dannie-ml](https://discuss.elastic.co/u/dannie-ml)\ **Replies:** 7\ **Last updated:** [May 12, 2022, 4:01pm UTC](https://discuss.elastic.co/t/remove-left-whitespaces-logstash/304514 "2022-05-12T16:01:15Z")
Hi i have the following fields: "delivery\_quantity" : " \\s\\s\\s\\s4", "numerator" : "\\s\\s\\s1", "denominator" : "\\s\\s\\s1" I've tried to use mutate split and gsub but didnt work. I've seen that split works when you ha… --- ## [ILM Error while deleting ES index](https://discuss.elastic.co/t/ilm-error-while-deleting-es-index/304320)
**Author:** [@Aman\_Gupta1](https://discuss.elastic.co/u/Aman_Gupta1)\ **Replies:** 1\ **Last updated:** [May 12, 2022, 3:53pm UTC](https://discuss.elastic.co/t/ilm-error-while-deleting-es-index/304320 "2022-05-12T15:53:20Z")
Hi Team, I'm facing issue while deleteing index via ILM. description: i have index with name $webservicelogs\* ( where $webservice is name of actual services and after rotation it becomes webservicelogs2022.05.10 simila… --- ## [Mappings types](https://discuss.elastic.co/t/mappings-types/304477)
**Author:** [@hebph001](https://discuss.elastic.co/u/hebph001)\ **Replies:** 10\ **Last updated:** [May 12, 2022, 3:30pm UTC](https://discuss.elastic.co/t/mappings-types/304477 "2022-05-12T15:30:56Z")
Hi Elastic community, I'm having a hard time figuring out what is wrong with my index template configuration, but Kibana shows me a message of "mapping types for this template uses types, which have been removed". I don… --- ## [How to set routing allocation on the filebeat template](https://discuss.elastic.co/t/how-to-set-routing-allocation-on-the-filebeat-template/304601)
**Author:** [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\ **Replies:** 0\ **Last updated:** [May 12, 2022, 3:22pm UTC](https://discuss.elastic.co/t/how-to-set-routing-allocation-on-the-filebeat-template/304601 "2022-05-12T15:22:23Z")
I use ECK and i have filebeat setup. I have 3 nodeset Elasticsearch cluster, one which is named "monitoring" i have defined the node attri according to the following docs (Index-level shard allocation filtering | Elastic… --- ## [Search template can not parser data in geoshape search](https://discuss.elastic.co/t/search-template-can-not-parser-data-in-geoshape-search/304446)
**Author:** [@yeziblo](https://discuss.elastic.co/u/yeziblo)\ **Replies:** 7\ **Last updated:** [May 12, 2022, 2:42pm UTC](https://discuss.elastic.co/t/search-template-can-not-parser-data-in-geoshape-search/304446 "2022-05-12T14:42:51Z")
Hi everyone. I just set a search template like: POST \_scripts/geoshape\_search { "script": { "lang": "mustache", "source": { "query": { "geo\_shape": { "geo\_json": { "shape": { "type": "point", "coordinates": … --- ## [Error while stopping harverster group](https://discuss.elastic.co/t/error-while-stopping-harverster-group/304590)
**Author:** [@leonelfonseca](https://discuss.elastic.co/u/leonelfonseca)\ **Replies:** 0\ **Last updated:** [May 12, 2022, 2:39pm UTC](https://discuss.elastic.co/t/error-while-stopping-harverster-group/304590 "2022-05-12T14:39:12Z")
Hi, can anyone explain about this error message that appears in the Filebeat log ? \> Error while stopping harverster group: task failures error while adding new reader to the bookkeeper harvester is already running… --- ## [APM Python: request body too large](https://discuss.elastic.co/t/apm-python-request-body-too-large/304418)
**Author:** [@stk1](https://discuss.elastic.co/u/stk1)\ **Replies:** 2\ **Last updated:** [May 12, 2022, 1:59pm UTC](https://discuss.elastic.co/t/apm-python-request-body-too-large/304418 "2022-05-12T13:59:27Z")
Kibana version: 7.17 Elasticsearch version: 7.17 APM Server version: 7.15 APM Agent language and version: Python, v6.3.3 Hi, it happens a few times a day that the application throws an exception that can't be inspec… --- ## [Elastic App Search nodes crash or return 500 when load testing](https://discuss.elastic.co/t/elastic-app-search-nodes-crash-or-return-500-when-load-testing/304579)
**Author:** [@Tyranwyn](https://discuss.elastic.co/u/Tyranwyn)\ **Replies:** 0\ **Last updated:** [May 12, 2022, 1:20pm UTC](https://discuss.elastic.co/t/elastic-app-search-nodes-crash-or-return-500-when-load-testing/304579 "2022-05-12T13:20:55Z")
We have created an elastic cloud through Azure and have 2 engines in a meta engine. We are trying to load balance in this environment. When the elastic app search is scaled pretty low, the instances just crash, so we dec… --- ## [Escaping commas in \_routing search impossible](https://discuss.elastic.co/t/escaping-commas-in-routing-search-impossible/304578)
**Author:** [@mhamb](https://discuss.elastic.co/u/mhamb)\ **Replies:** 0\ **Last updated:** [May 12, 2022, 1:15pm UTC](https://discuss.elastic.co/t/escaping-commas-in-routing-search-impossible/304578 "2022-05-12T13:15:21Z")
Hi! I'm running an Elasticsearch production environment with a custom routing field. This has helped search performance significantly, but we just noticed that some routing fields are unsearchable as they were indexed w… --- ## [Apache tomcat module](https://discuss.elastic.co/t/apache-tomcat-module/304563)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 0\ **Last updated:** [May 12, 2022, 11:50am UTC](https://discuss.elastic.co/t/apache-tomcat-module/304563 "2022-05-12T11:50:32Z")
Hello team, We configured apache module in our server but we are able to get only below two types of message in our ELK. Can any one please help on this Error: HTTP error 404 in : 404 error making http request: Post… --- ## [Async system index through python AsyncElasticsearch prevented by default?](https://discuss.elastic.co/t/async-system-index-through-python-asyncelasticsearch-prevented-by-default/304542)
**Author:** [@martward](https://discuss.elastic.co/u/martward)\ **Replies:** 0\ **Last updated:** [May 12, 2022, 9:09am UTC](https://discuss.elastic.co/t/async-system-index-through-python-asyncelasticsearch-prevented-by-default/304542 "2022-05-12T09:09:19Z")
Hi all, I'm using the AsyncElasticsearch client in python, recently I started getting the warning that direct access to async-search will be prevented. Does this mean at some point it will no longer be possible to use t… --- ## [This site is inaccsessible kibana](https://discuss.elastic.co/t/this-site-is-inaccsessible-kibana/303163)
**Author:** [@Abderraouf\_ZAYEN](https://discuss.elastic.co/u/Abderraouf_ZAYEN)\ **Replies:** 10\ **Last updated:** [May 12, 2022, 11:02am UTC](https://discuss.elastic.co/t/this-site-is-inaccsessible-kibana/303163 "2022-05-12T11:02:29Z")
Hi, systemctl status kibana & systemctl status Elasticsearch & systemctl status logstash & systemctl status filebeat all active (running) . my problem in browser localhost:9200 it works but localhost:5601 didn't work (… --- ## [AWS integration CloudWatch tags filter](https://discuss.elastic.co/t/aws-integration-cloudwatch-tags-filter/303724)
**Author:** [@kalbusse](https://discuss.elastic.co/u/kalbusse)\ **Replies:** 6\ **Last updated:** [May 12, 2022, 10:33am UTC](https://discuss.elastic.co/t/aws-integration-cloudwatch-tags-filter/303724 "2022-05-12T10:33:59Z")
Hello, I am trying to collect metrics from only a subset of resources with the AWS CloudWatch integration. I used the following configuration: - namespace: AWS/ApplicationELB tags: - key: "Application" val… --- ## [How to build grok filter](https://discuss.elastic.co/t/how-to-build-grok-filter/304537)
**Author:** [@smam](https://discuss.elastic.co/u/smam)\ **Replies:** 10\ **Last updated:** [May 12, 2022, 10:31am UTC](https://discuss.elastic.co/t/how-to-build-grok-filter/304537 "2022-05-12T10:31:42Z")
Hello, I want to understand how to build grok filter since other posts did not make it clear enough for me. Here are example lines I want to send: 30,05/10/22,07:30:27,DNS Update Request,\,\,,,0,6,,,,,,,,,0 11… --- ## [How to install sigma rule elk version 8](https://discuss.elastic.co/t/how-to-install-sigma-rule-elk-version-8/304237)
**Author:** [@CodeRed](https://discuss.elastic.co/u/CodeRed)\ **Replies:** 2\ **Last updated:** [May 12, 2022, 10:09am UTC](https://discuss.elastic.co/t/how-to-install-sigma-rule-elk-version-8/304237 "2022-05-12T10:09:56Z")
I am trying to install sigma rule on kibana I followed the instructions but it failed The document of sigma rule has instructions for me to execute the command: /usr/share/kibana/bin/./kibana-plugin install file:///PAT… --- ## [Mongodb traces for netcoreapp3.1 mvc](https://discuss.elastic.co/t/mongodb-traces-for-netcoreapp3-1-mvc/304214)
**Author:** [@Namita\_Jaokar](https://discuss.elastic.co/u/Namita_Jaokar)\ **Replies:** 4\ **Last updated:** [May 12, 2022, 9:59am UTC](https://discuss.elastic.co/t/mongodb-traces-for-netcoreapp3-1-mvc/304214 "2022-05-12T09:59:44Z")
Hi, I am trying to configure my netcoreapp3.1 version mvc application which uses mongodb as the database with elastic APM instrumentation with zero code changes . I am able to view the transactions but there are no sta… --- ## [How to increase the performance of the kafka input in indexer](https://discuss.elastic.co/t/how-to-increase-the-performance-of-the-kafka-input-in-indexer/304549)
**Author:** [@Marco\_Bonardo](https://discuss.elastic.co/u/Marco_Bonardo)\ **Replies:** 0\ **Last updated:** [May 12, 2022, 9:42am UTC](https://discuss.elastic.co/t/how-to-increase-the-performance-of-the-kafka-input-in-indexer/304549 "2022-05-12T09:42:39Z")
Hello everyone, I have a problem I've been working on for days and I can't find a compatible solution. I need to consume about 150k messages per second via a kafka input / topic / groupid. I have 8 logstash on separate m… --- ## [\_source 50% bigger after reindex](https://discuss.elastic.co/t/source-50-bigger-after-reindex/303805)
**Author:** [@nisow95612](https://discuss.elastic.co/u/nisow95612)\ **Replies:** 17\ **Last updated:** [May 12, 2022, 9:36am UTC](https://discuss.elastic.co/t/source-50-bigger-after-reindex/303805 "2022-05-12T09:36:30Z")
Hello. Context: I reindexed a 7.15 index into 7.16 one and suddenly it is taking about +50% space. By Analyze index disk usage API | Elasticsearch Guide \[7.16\] | Elastic I found that \_source field alone is now taking … --- ## [Filebeat filestream input rereading rotated log files](https://discuss.elastic.co/t/filebeat-filestream-input-rereading-rotated-log-files/300038)
**Author:** [@lpeter](https://discuss.elastic.co/u/lpeter)\ **Replies:** 14\ **Last updated:** [May 12, 2022, 9:08am UTC](https://discuss.elastic.co/t/filebeat-filestream-input-rereading-rotated-log-files/300038 "2022-05-12T09:08:23Z")
Hello! I'm running into this very common problem of rotated files being reread and resent. I'm using Filebeat 8.1.0 with the new(ish) filestream input plugin. I've read the docs of the plugin and the article on this spe… --- ## [Event.original not searchable](https://discuss.elastic.co/t/event-original-not-searchable/304490)
**Author:** [@grover](https://discuss.elastic.co/u/grover)\ **Replies:** 2\ **Last updated:** [May 12, 2022, 8:40am UTC](https://discuss.elastic.co/t/event-original-not-searchable/304490 "2022-05-12T08:40:58Z")
Hi I'm new to Elasticsearch and I am trying to get information from a Juniper SRX firewall. The logs are being ingested but the information I would like to search is in event.original which is not indexed or searchable.… --- ## [Grok pattern for optional field in ingest pipeline](https://discuss.elastic.co/t/grok-pattern-for-optional-field-in-ingest-pipeline/304520)
**Author:** [@alfianaf](https://discuss.elastic.co/u/alfianaf)\ **Replies:** 3\ **Last updated:** [May 12, 2022, 8:00am UTC](https://discuss.elastic.co/t/grok-pattern-for-optional-field-in-ingest-pipeline/304520 "2022-05-12T08:00:19Z")
Hello, I'm working with ingest pipeline and grok processor right now. I need to filter log message with grok processor but there's optional fields, here's the log example \[Nest\] 6448 - 04/26/2022, 3:30:03 PM \[activity… --- ## [哪位兄弟知道，怎么在 filebeat 的 json 模板里使用自定义的 analyzer](https://discuss.elastic.co/t/filebeat-json-analyzer/304444)
**Author:** [@fanybook](https://discuss.elastic.co/u/fanybook)\ **Replies:** 4\ **Last updated:** [May 12, 2022, 7:31am UTC](https://discuss.elastic.co/t/filebeat-json-analyzer/304444 "2022-05-12T07:31:35Z")
filebeat version: 7.17.3 json 模板是这样的 { "index\_patterns": \["test\_logs\*"\], "template": { "settings": { "number\_of\_shards": 1 }, "mappings": { "properties": { "message123": { … --- ## [Restore historical into data stream](https://discuss.elastic.co/t/restore-historical-into-data-stream/304523)
**Author:** [@Jasper\_Nygaard](https://discuss.elastic.co/u/Jasper_Nygaard)\ **Replies:** 2\ **Last updated:** [May 12, 2022, 7:29am UTC](https://discuss.elastic.co/t/restore-historical-into-data-stream/304523 "2022-05-12T07:29:01Z")
Just moved to Elastic Cloud from on-onprem for our logging, setting up data streams instead of using date based indices. I now need to restore our historical data from snapshots - anyway to restore these into the data st… --- ## [How to use our index name in data section in vega?](https://discuss.elastic.co/t/how-to-use-our-index-name-in-data-section-in-vega/304416)
**Author:** [@Arifullah](https://discuss.elastic.co/u/Arifullah)\ **Replies:** 2\ **Last updated:** [May 12, 2022, 6:46am UTC](https://discuss.elastic.co/t/how-to-use-our-index-name-in-data-section-in-vega/304416 "2022-05-12T06:46:16Z")
I want to create tree layout graph in vega from my index which its name is 123. the index has many fields but I want only two fields of the index to be showed in the graph which is A and B. The question is how to use my… --- ## [Accessing nested fields in a script (null\_pointer\_exception)](https://discuss.elastic.co/t/accessing-nested-fields-in-a-script-null-pointer-exception/304521)
**Author:** [@heikis](https://discuss.elastic.co/u/heikis)\ **Replies:** 2\ **Last updated:** [May 12, 2022, 6:41am UTC](https://discuss.elastic.co/t/accessing-nested-fields-in-a-script-null-pointer-exception/304521 "2022-05-12T06:41:00Z")
Hello. I have a nested document and I would like to do some processing on it before indexing it. The parent document has a "reference\_ts" containing a timestamp. Then come the nested fields that each have their own tim… --- ## [Enrollment agent](https://discuss.elastic.co/t/enrollment-agent/304528)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 0\ **Last updated:** [May 12, 2022, 6:30am UTC](https://discuss.elastic.co/t/enrollment-agent/304528 "2022-05-12T06:30:44Z")
how to enrollment agent. i follow in Install Fleet-managed Elastic Agents | Fleet and Elastic Agent Guide \[7.17\] | Elastic i got error Error: fail to enroll: fail to execute request to fleet-server: fail to read origina… --- ## [Kibana 7.17 dashboard URL in iframe sid cookie getting rejected by browser](https://discuss.elastic.co/t/kibana-7-17-dashboard-url-in-iframe-sid-cookie-getting-rejected-by-browser/303523)
**Author:** [@homesh\_joshi](https://discuss.elastic.co/u/homesh_joshi)\ **Replies:** 9\ **Last updated:** [May 12, 2022, 6:16am UTC](https://discuss.elastic.co/t/kibana-7-17-dashboard-url-in-iframe-sid-cookie-getting-rejected-by-browser/303523 "2022-05-12T06:16:21Z")
Hi, I am trying to embed kibana dashboard in to another URL. My kibana URL is dashboard.example.com My other URL is reports.example.com (SSL enabled) My kibana is behind apache reverse proxy ( SSL is enabled only on… --- ## [Elasticsearch Watcher error while trying to send email attachment, dashboard.pdf](https://discuss.elastic.co/t/elasticsearch-watcher-error-while-trying-to-send-email-attachment-dashboard-pdf/301048)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 13\ **Last updated:** [May 12, 2022, 5:53am UTC](https://discuss.elastic.co/t/elasticsearch-watcher-error-while-trying-to-send-email-attachment-dashboard-pdf/301048 "2022-05-12T05:53:09Z")
Hi, I have created a watcher alert from the advanced option which sends dashboard.pdf as an email attachment when the triggering condition is met. Now when the criteria is matching (threshold is exceeded) then it is thr… --- ## [Grok issue in Logstash input - data from Kafka logs using Filebeat Kafka module](https://discuss.elastic.co/t/grok-issue-in-logstash-input-data-from-kafka-logs-using-filebeat-kafka-module/303801)
**Author:** [@Sharon\_Hacham](https://discuss.elastic.co/u/Sharon_Hacham)\ **Replies:** 4\ **Last updated:** [May 12, 2022, 4:57am UTC](https://discuss.elastic.co/t/grok-issue-in-logstash-input-data-from-kafka-logs-using-filebeat-kafka-module/303801 "2022-05-12T04:57:44Z")
Hi , we are ingesting Kafka logs from on-premise servers running Kafka Connect and Kafka Rest-Proxy , We have 3 Logstash Windows servers ... we're using the built-in Dashboard you supply with the Filebeat Kafka module… --- ## [Http input and output google bigquery](https://discuss.elastic.co/t/http-input-and-output-google-bigquery/304323)
**Author:** [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\ **Replies:** 4\ **Last updated:** [May 12, 2022, 4:27am UTC](https://discuss.elastic.co/t/http-input-and-output-google-bigquery/304323 "2022-05-12T04:27:22Z")
input { http { host =\> "0.0.0.0" # default: 0.0.0.0 port =\> 0000 # default: 8080 } } filter { urldecode { all\_fields =\> true } } filter { mutate { gsub =\> \[ "message", "\\\]", "}", "message", "\\\[", "{" \] } … [Previous page](https://discuss.elastic.co/latest.md?page=1133) [Next page](https://discuss.elastic.co/latest.md?page=1135)