# Latest **URL:** https://discuss.elastic.co/latest.md?page=1144 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1145 --- ## [How can i conditionally change the unit of metric values i receive?](https://discuss.elastic.co/t/how-can-i-conditionally-change-the-unit-of-metric-values-i-receive/303576)
**Author:** [@ASHOK\_PRIYADARSHI](https://discuss.elastic.co/u/ASHOK_PRIYADARSHI)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 1:32pm UTC](https://discuss.elastic.co/t/how-can-i-conditionally-change-the-unit-of-metric-values-i-receive/303576 "2022-05-05T13:32:09Z")
How can I change the unit as per my metric path ? --- ## [Logstash add custom jars to java class path](https://discuss.elastic.co/t/logstash-add-custom-jars-to-java-class-path/304039)
**Author:** [@ayout](https://discuss.elastic.co/u/ayout)\ **Replies:** 0\ **Last updated:** [May 5, 2022, 1:25pm UTC](https://discuss.elastic.co/t/logstash-add-custom-jars-to-java-class-path/304039 "2022-05-05T13:25:58Z")
how can i just add jars to logstash image ( i need them in order to be able to use custom jdbc driver ,) , when trying to do so the docker runs but fails after 1min . this is the Dockerfile : COPY ./\*.jar /usr/share/lo… --- ## [Kibana watcher sending alert cpu utilisation more than 90%](https://discuss.elastic.co/t/kibana-watcher-sending-alert-cpu-utilisation-more-than-90/303824)
**Author:** [@sanjaychahar](https://discuss.elastic.co/u/sanjaychahar)\ **Replies:** 2\ **Last updated:** [May 5, 2022, 1:24pm UTC](https://discuss.elastic.co/t/kibana-watcher-sending-alert-cpu-utilisation-more-than-90/303824 "2022-05-05T13:24:27Z")
Hi I have configured Kibana watcher to monitor cpu utilisation and its sending alert to out monitoring team stating cpu utilisation ec2 instance(Worker node) more than 90% but when I have checked in AWS CloudWatch cpu u… --- ## [\[filebeat\] - Json processor](https://discuss.elastic.co/t/filebeat-json-processor/303789)
**Author:** [@JH82](https://discuss.elastic.co/u/JH82)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 1:20pm UTC](https://discuss.elastic.co/t/filebeat-json-processor/303789 "2022-05-05T13:20:15Z")
Hello, I try to make a JSON transform with processor in filebeat (with http\_endpoint as input). 2 questions : when I send a simple json message like {"message":"OK"} I receive : {"message": "success"} but I get man… --- ## [How to query multiple hosts using in elasticsearch using wildcard](https://discuss.elastic.co/t/how-to-query-multiple-hosts-using-in-elasticsearch-using-wildcard/303913)
**Author:** [@Gojo](https://discuss.elastic.co/u/Gojo)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 12:43pm UTC](https://discuss.elastic.co/t/how-to-query-multiple-hosts-using-in-elasticsearch-using-wildcard/303913 "2022-05-05T12:43:42Z")
hey all iam new to elk , iam trying to get all the hosts in the Elasticsearch db , i tried using a wildcard and "wild\_card": "hosts", "query": { "host.keyword": "test\*", "severity.keyword": "err" }, consider there … --- ## [Dial tcp {kubelet\_ip}:10250 i/o timeout while trying to get Metricbeat to talk to Azure Kubernetes Service](https://discuss.elastic.co/t/dial-tcp-kubelet-ip-10250-i-o-timeout-while-trying-to-get-metricbeat-to-talk-to-azure-kubernetes-service/303874)
**Author:** [@surprised\_ferret](https://discuss.elastic.co/u/surprised_ferret)\ **Replies:** 5\ **Last updated:** [May 5, 2022, 12:33pm UTC](https://discuss.elastic.co/t/dial-tcp-kubelet-ip-10250-i-o-timeout-while-trying-to-get-metricbeat-to-talk-to-azure-kubernetes-service/303874 "2022-05-05T12:33:23Z")
Getting these errors when trying to install metricbeat as a daemonset using terraform. What could be the issue, metricbeat or AKS ? 2022-05-03T20:09:01.492Z ERROR module/wrapper.go:259 Error fetching data for metricset… --- ## [Windows server 2003 and Elastic agent](https://discuss.elastic.co/t/windows-server-2003-and-elastic-agent/304029)
**Author:** [@JimG](https://discuss.elastic.co/u/JimG)\ **Replies:** 0\ **Last updated:** [May 5, 2022, 12:10pm UTC](https://discuss.elastic.co/t/windows-server-2003-and-elastic-agent/304029 "2022-05-05T12:10:55Z")
Allright.. I know Windows server 2003 logs is not supported. But is it possible to solve? I use a powershell script to collect Windows server 2003 logs to a Windows server 2022 then Im using Elastic Agent with a custom… --- ## [How to simulate small frequent updates parallel to constant queries](https://discuss.elastic.co/t/how-to-simulate-small-frequent-updates-parallel-to-constant-queries/303918)
**Author:** [@jmlucjav](https://discuss.elastic.co/u/jmlucjav)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 11:59am UTC](https://discuss.elastic.co/t/how-to-simulate-small-frequent-updates-parallel-to-constant-queries/303918 "2022-05-05T11:59:35Z")
Hi, when I am benchmarking my querying with Rally, I would like to simulate also the fact that I get some frequent but small updates. Not sure what would be the best way to achieve this? Say I want to have a throughput… --- ## [Sizing question](https://discuss.elastic.co/t/sizing-question/304014)
**Author:** [@marek\_duciuc](https://discuss.elastic.co/u/marek_duciuc)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 11:01am UTC](https://discuss.elastic.co/t/sizing-question/304014 "2022-05-05T11:01:09Z")
Elasticsearch recommendations is as follows: Maximum of 32 GB heap 20 shards per 1 GB of heap 40 to 60 GB of data per shard this gives approximately 25TB to 39TB of data per node. Is this only theoretical or would… --- ## [Docs count delay - docs added regularly, but docs count 0](https://discuss.elastic.co/t/docs-count-delay-docs-added-regularly-but-docs-count-0/303740)
**Author:** [@jb79](https://discuss.elastic.co/u/jb79)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 10:38am UTC](https://discuss.elastic.co/t/docs-count-delay-docs-added-regularly-but-docs-count-0/303740 "2022-05-05T10:38:35Z")
Hi, Docs added regularly, but the count (after all added) could be verified after several minutes : Added docs ( @timestamp from logstash): Transport traffic Indexing rate: Docs count Seems that sth wr… --- ## [Filebeats autodiscover on kubernetes doesn't collect logs from annotated pods](https://discuss.elastic.co/t/filebeats-autodiscover-on-kubernetes-doesnt-collect-logs-from-annotated-pods/304018)
**Author:** [@Ivan\_Kovacic](https://discuss.elastic.co/u/Ivan_Kovacic)\ **Replies:** 0\ **Last updated:** [May 5, 2022, 10:19am UTC](https://discuss.elastic.co/t/filebeats-autodiscover-on-kubernetes-doesnt-collect-logs-from-annotated-pods/304018 "2022-05-05T10:19:18Z")
Hi, I have an issue with filebeat when trying to collect logs from annotated pods, i have been following the documentation but without success. I am using filebeats 7.17 on kubernetes v1.21.5. This is my filebeat confi… --- ## [Storing images , videos in elasticserch](https://discuss.elastic.co/t/storing-images-videos-in-elasticserch/303985)
**Author:** [@Naga\_Prudhvi](https://discuss.elastic.co/u/Naga_Prudhvi)\ **Replies:** 8\ **Last updated:** [May 5, 2022, 10:17am UTC](https://discuss.elastic.co/t/storing-images-videos-in-elasticserch/303985 "2022-05-05T10:17:20Z")
Can someone help me how can I store images in elasticserch? 1st way: using logstash conf file 2nd way; using directly elasticserch --- ## [Attempting to acquire leader lease ... Get "https://10.43.0.1:443/apis/coordination.k8s.io/v1/namespaces/bilalnamespace/leases/metricbeat-cluster-leader": Forbidden](https://discuss.elastic.co/t/attempting-to-acquire-leader-lease-get-https-10-43-0-1-443-apis-coordination-k8s-io-v1-namespaces-bilalnamespace-leases-metricbeat-cluster-leader-forbidden/304012)
**Author:** [@Bilal\_El\_Mahdaoui](https://discuss.elastic.co/u/Bilal_El_Mahdaoui)\ **Replies:** 0\ **Last updated:** [May 5, 2022, 9:44am UTC](https://discuss.elastic.co/t/attempting-to-acquire-leader-lease-get-https-10-43-0-1-443-apis-coordination-k8s-io-v1-namespaces-bilalnamespace-leases-metricbeat-cluster-leader-forbidden/304012 "2022-05-05T09:44:43Z")
Hello, I want to monitor my Kubernetes cluster using metricbeat, and I'm using for that metricbeat autodiscover feature . Also I use a custom docker image based on my custom debian bullseye image. I made all the neces… --- ## [Vega Lab 7.3 Script not compiling](https://discuss.elastic.co/t/vega-lab-7-3-script-not-compiling/303983)
**Author:** [@Silverquick](https://discuss.elastic.co/u/Silverquick)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 9:27am UTC](https://discuss.elastic.co/t/vega-lab-7-3-script-not-compiling/303983 "2022-05-05T09:27:53Z")
Following the Vega 7.3 in the Lab exercise and the script directly listed there will not compile. Screenshot to follow.... Note this is directly copy/pasted from the Lab Instructions here and its not compiling. --- ## [Data migrate from one cluster to another Elasticsearch](https://discuss.elastic.co/t/data-migrate-from-one-cluster-to-another-elasticsearch/304001)
**Author:** [@ranju](https://discuss.elastic.co/u/ranju)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 9:14am UTC](https://discuss.elastic.co/t/data-migrate-from-one-cluster-to-another-elasticsearch/304001 "2022-05-05T09:14:08Z")
Need to Migrate one index data from AWS elastic to Azure Elasticsearch. Which one is the best way 1: Reindex 2: logstash : input as AWS elastic and output as Azure elastic. Any input much appreciated, Thanks in Advan… --- ## [How to refresh/stop shrink action](https://discuss.elastic.co/t/how-to-refresh-stop-shrink-action/303733)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 3\ **Last updated:** [May 5, 2022, 8:31am UTC](https://discuss.elastic.co/t/how-to-refresh-stop-shrink-action/303733 "2022-05-05T08:31:35Z")
HI Can You help me out how I can refresh and disable shrink for indices? during, from the devtool console I didn't find any onging actoin, but it seems that a few a indices are hanging on that steps? Such state doe… --- ## [ELK reindex - no input realtime data](https://discuss.elastic.co/t/elk-reindex-no-input-realtime-data/303928)
**Author:** [@Next\_generation](https://discuss.elastic.co/u/Next_generation)\ **Replies:** 2\ **Last updated:** [May 4, 2022, 9:33pm UTC](https://discuss.elastic.co/t/elk-reindex-no-input-realtime-data/303928 "2022-05-04T21:33:15Z")
how to assign template to specific elk index i created the correct index template and migrated the data from the old index but it is not written further in real time How to make it write? (used by fluentd) --- ## [Filebeat to elasticsearch using ingest pipeline](https://discuss.elastic.co/t/filebeat-to-elasticsearch-using-ingest-pipeline/303341)
**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Replies:** 5\ **Last updated:** [May 5, 2022, 7:45am UTC](https://discuss.elastic.co/t/filebeat-to-elasticsearch-using-ingest-pipeline/303341 "2022-05-05T07:45:04Z")
Dear Team, need a advise we are ingesting data from filebeat to ES using the ingest pipeline in ES I have created an ingest pipeline and also created an index template in that defined the ingest pipeline "PUT \_ingest/… --- ## [Kibana 401 Unauthorized](https://discuss.elastic.co/t/kibana-401-unauthorized/303954)
**Author:** [@CemG](https://discuss.elastic.co/u/CemG)\ **Replies:** 2\ **Last updated:** [May 5, 2022, 7:12am UTC](https://discuss.elastic.co/t/kibana-401-unauthorized/303954 "2022-05-05T07:12:50Z")
Hello, I would like to setup the dashboard of Winlogbeat in Kibana, but when I start Winlogbeat I have an error. I have done a curl, and saw that I got the error 401 as response. My architecture is : Winlogbeat → Kafk… --- ## [How to fix security issue with kibana 5.6 Timelion widget](https://discuss.elastic.co/t/how-to-fix-security-issue-with-kibana-5-6-timelion-widget/303996)
**Author:** [@kashifqazi](https://discuss.elastic.co/u/kashifqazi)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 6:29am UTC](https://discuss.elastic.co/t/how-to-fix-security-issue-with-kibana-5-6-timelion-widget/303996 "2022-05-05T06:29:22Z")
How to fix security issue with kibana 5.6 Timelion widget. --- ## [Using Regex in Kibana Query DSL (filter-option in discover mode)](https://discuss.elastic.co/t/using-regex-in-kibana-query-dsl-filter-option-in-discover-mode/303937)
**Author:** [@CaMaNi](https://discuss.elastic.co/u/CaMaNi)\ **Replies:** 4\ **Last updated:** [May 5, 2022, 5:45am UTC](https://discuss.elastic.co/t/using-regex-in-kibana-query-dsl-filter-option-in-discover-mode/303937 "2022-05-05T05:45:38Z")
Good day everyone, I am relatively new to the use of Kibana. And I have the following problem: I want to filter out all numbers and special characters like "\_" or "-" in a field in Discover mode, so that I only have Le… --- ## [Want to send this logs to Elasticsearch without logstash](https://discuss.elastic.co/t/want-to-send-this-logs-to-elasticsearch-without-logstash/303990)
**Author:** [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 5:28am UTC](https://discuss.elastic.co/t/want-to-send-this-logs-to-elasticsearch-without-logstash/303990 "2022-05-05T05:28:58Z")
Hello Every One I have Following Logs I want sent this logs using script (Powershell) to Elasticsearch without using logstash no need mediator any one can help How can I ? { "Id": "4280", "AppKey": "StoreSearchAPIUR… --- ## [Organize Filebeat inputs and Directory Hierarchy](https://discuss.elastic.co/t/organize-filebeat-inputs-and-directory-hierarchy/303989)
**Author:** [@anushka1203](https://discuss.elastic.co/u/anushka1203)\ **Replies:** 0\ **Last updated:** [May 5, 2022, 4:52am UTC](https://discuss.elastic.co/t/organize-filebeat-inputs-and-directory-hierarchy/303989 "2022-05-05T04:52:22Z")
The log files on my system are stored in the following manner. and these folders finally contain the log files (access, error, audit and csv files) that need to be parsed example: since it is realtime data, n… --- ## [Issue getting Zeek logs into Kibana](https://discuss.elastic.co/t/issue-getting-zeek-logs-into-kibana/303974)
**Author:** [@espressobeanies](https://discuss.elastic.co/u/espressobeanies)\ **Replies:** 3\ **Last updated:** [May 5, 2022, 3:26am UTC](https://discuss.elastic.co/t/issue-getting-zeek-logs-into-kibana/303974 "2022-05-05T03:26:45Z")
I'm having problems getting my Zeek logs into Kibana using an Elastic Agent that is not Fleet Managed. I'm running the latest and greatest versions of everything and I confirmed I can see dashboard information about the … --- ## [How do I connect Kibana with ES 8.0.0?](https://discuss.elastic.co/t/how-do-i-connect-kibana-with-es-8-0-0/303573)
**Author:** [@McLaine](https://discuss.elastic.co/u/McLaine)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 3:00am UTC](https://discuss.elastic.co/t/how-do-i-connect-kibana-with-es-8-0-0/303573 "2022-05-05T03:00:56Z")
Hello! My new ES 8.x Cluster works so far but, not with TLS Cluster and I can´t connect Kibana (also 8) with it. \[2022-04-29T07:41:44,969\]\[WARN \]\[o.e.t.OutboundHandler \] \[node1\] send message failed \[channel: Netty4T… --- ## [Error when running pipelines.yml](https://discuss.elastic.co/t/error-when-running-pipelines-yml/303710)
**Author:** [@rrrrrrrrrrr](https://discuss.elastic.co/u/rrrrrrrrrrr)\ **Replies:** 8\ **Last updated:** [May 5, 2022, 2:33am UTC](https://discuss.elastic.co/t/error-when-running-pipelines-yml/303710 "2022-05-05T02:33:47Z")
Hello, I'm a newbie in Elastic community and I'm trying to run my pipelines.yml on /etc/logstash/ using this command /usr/share/logstash/bin/logstash -f pipelines.yml but all I'm getting is the error below... \[WARN \] 2… --- ## [ELK Issue while enabling x-pack](https://discuss.elastic.co/t/elk-issue-while-enabling-x-pack/303656)
**Author:** [@anubhav.bss](https://discuss.elastic.co/u/anubhav.bss)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 2:27am UTC](https://discuss.elastic.co/t/elk-issue-while-enabling-x-pack/303656 "2022-05-05T02:27:15Z")
Hi Friends, I am facing issue with ELK stack deployed on AWS ECS. Whenever I am trying to connect enable x-pack feature, Elasticsearch and Kibana containers are not coming up. EC2 instance is behind Application load ba… --- ## [Elasticsearch pod going into crashloopbackoff state due to no space left on the device](https://discuss.elastic.co/t/elasticsearch-pod-going-into-crashloopbackoff-state-due-to-no-space-left-on-the-device/303719)
**Author:** [@ayushsharma191](https://discuss.elastic.co/u/ayushsharma191)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 2:25am UTC](https://discuss.elastic.co/t/elasticsearch-pod-going-into-crashloopbackoff-state-due-to-no-space-left-on-the-device/303719 "2022-05-05T02:25:40Z")
Caused by: org.Elasticsearch.gateway.WriteStateException: failed to write state to the first location tmp file /usr/share/Elasticsearch/data/nodes/0/node-1.st.tmp", "at org.Elasticsearch.gateway.MetaDataStateFormat.writ… --- ## [Elasticsearch check if key exist in document](https://discuss.elastic.co/t/elasticsearch-check-if-key-exist-in-document/303816)
**Author:** [@Hovo\_Baghdasaryan](https://discuss.elastic.co/u/Hovo_Baghdasaryan)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 2:23am UTC](https://discuss.elastic.co/t/elasticsearch-check-if-key-exist-in-document/303816 "2022-05-05T02:23:48Z")
Hi All. I have key "field1" in the document of Elasticsearch. With mapping, a field is an object. sometimes field does not exist, sometimes the field exists but is empty (\[\]), sometimes the field has the correct value -… --- ## [Data is not populating in kibana](https://discuss.elastic.co/t/data-is-not-populating-in-kibana/303830)
**Author:** [@SnehaB](https://discuss.elastic.co/u/SnehaB)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 2:20am UTC](https://discuss.elastic.co/t/data-is-not-populating-in-kibana/303830 "2022-05-05T02:20:39Z")
Hi Team, I have created a index on kibana.But I am not able to see the data in the same index. please check the below logs for reference. The logs are showing as follows :- Total time for which application threads we… [Previous page](https://discuss.elastic.co/latest.md?page=1143) [Next page](https://discuss.elastic.co/latest.md?page=1145)