# Latest **URL:** https://discuss.elastic.co/latest.md?page=1151 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1152 --- ## [How to get IP address of collectd client](https://discuss.elastic.co/t/how-to-get-ip-address-of-collectd-client/303674)
**Author:** [@Rostam](https://discuss.elastic.co/u/Rostam)\ **Replies:** 4\ **Last updated:** [May 1, 2022, 5:25pm UTC](https://discuss.elastic.co/t/how-to-get-ip-address-of-collectd-client/303674 "2022-05-01T17:25:36Z")
Hello I have configured collectd on all my devices (running Linux). The configuration is: /etc/collectd.conf LoadPlugin cpu LoadPlugin interface LoadPlugin df \ server "10.2.9.35" "5555" /Plugin My l… --- ## [Grokparsefailure ... but it's all working and logs are being parsed...?](https://discuss.elastic.co/t/grokparsefailure-but-its-all-working-and-logs-are-being-parsed/303614)
**Author:** [@joshn](https://discuss.elastic.co/u/joshn)\ **Replies:** 7\ **Last updated:** [May 1, 2022, 4:54pm UTC](https://discuss.elastic.co/t/grokparsefailure-but-its-all-working-and-logs-are-being-parsed/303614 "2022-05-01T16:54:29Z")
I'm seeing pretty much all of my logs in Elastic/Kibana tagged with the following tags: \_grokparsefailure\_sysloginput, \_grokparsefailure, \_geoip\_lookup\_failure Which is odd, as they are being processed just fine. Exam… --- ## [Docker implementation - Filebeats 7.17.2 - drop\_events not working](https://discuss.elastic.co/t/docker-implementation-filebeats-7-17-2-drop-events-not-working/303647)
**Author:** [@amills157](https://discuss.elastic.co/u/amills157)\ **Replies:** 8\ **Last updated:** [May 1, 2022, 4:44pm UTC](https://discuss.elastic.co/t/docker-implementation-filebeats-7-17-2-drop-events-not-working/303647 "2022-05-01T16:44:06Z")
I am trying to setup filebeats to monitor some docker containers - I am using autodiscover, but I don't want to be logging anything from my stack (Elastic, Kibana, Filebeats itself). I have tried to use drop\_events but i… --- ## [Failed to start Filebeat MISP treats](https://discuss.elastic.co/t/failed-to-start-filebeat-misp-treats/303056)
**Author:** [@Tetsuho](https://discuss.elastic.co/u/Tetsuho)\ **Replies:** 5\ **Last updated:** [May 1, 2022, 1:54pm UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-misp-treats/303056 "2022-05-01T13:54:50Z")
Hi Everyone im glad to be part of this comunity. Im here beacause a got a error message when I try to start the filebeat service after do some modifications related to a enable de MISP threat intel Logs. Here is the fil… --- ## [DNS issues with the Lab and Strigo](https://discuss.elastic.co/t/dns-issues-with-the-lab-and-strigo/303541)
**Author:** [@Silverquick](https://discuss.elastic.co/u/Silverquick)\ **Replies:** 2\ **Last updated:** [May 1, 2022, 7:00am UTC](https://discuss.elastic.co/t/dns-issues-with-the-lab-and-strigo/303541 "2022-05-01T07:00:59Z")
When going into the Labs it initiates Strigo. Then you are supposed to take the DNS address and paste it into another web browser to go there. It works the first time you do it but after that if you stop and go back in… --- ## [Number of vCPUS vs Number of Shards](https://discuss.elastic.co/t/number-of-vcpus-vs-number-of-shards/303651)
**Author:** [@TomTom](https://discuss.elastic.co/u/TomTom)\ **Replies:** 3\ **Last updated:** [April 30, 2022, 11:11pm UTC](https://discuss.elastic.co/t/number-of-vcpus-vs-number-of-shards/303651 "2022-04-30T23:11:32Z")
I have an on-premise server with Elasticsearch 6.8 that was created years ago, and at the time I only had one vCPU and now I have 4 vCPU on that server. It happens that when I mapped the indexes I defined the code below… --- ## [Filebeat not sending to Logstash until it's terminated](https://discuss.elastic.co/t/filebeat-not-sending-to-logstash-until-its-terminated/303565)
**Author:** [@alex\_london](https://discuss.elastic.co/u/alex_london)\ **Replies:** 5\ **Last updated:** [April 30, 2022, 5:07pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-to-logstash-until-its-terminated/303565 "2022-04-30T17:07:28Z")
I've just started my Elastic Stack adventure and got myself stuck in what must be the simplest problem, but for the life of me cannot figure it out... My environment: Logstash 8.1.3 in Docker (Ubuntu 20.04) Filebeat 8… --- ## [Trace don't show up if entry point isn't http func](https://discuss.elastic.co/t/trace-dont-show-up-if-entry-point-isnt-http-func/303187)
**Author:** [@gvencadze](https://discuss.elastic.co/u/gvencadze)\ **Replies:** 2\ **Last updated:** [April 26, 2022, 7:25am UTC](https://discuss.elastic.co/t/trace-dont-show-up-if-entry-point-isnt-http-func/303187 "2022-04-26T07:25:14Z")
If we have http handler as entry point, everything is okay, and we have full trace, but if it in workers (for example), we have only transaction name and that's all. I think that I misunderstand official docs part about… --- ## [Unclear setup for the documented "Migration from the High Level Rest Client" topic](https://discuss.elastic.co/t/unclear-setup-for-the-documented-migration-from-the-high-level-rest-client-topic/303474)
**Author:** [@patrikjetzer](https://discuss.elastic.co/u/patrikjetzer)\ **Replies:** 3\ **Last updated:** [April 30, 2022, 8:43am UTC](https://discuss.elastic.co/t/unclear-setup-for-the-documented-migration-from-the-high-level-rest-client-topic/303474 "2022-04-30T08:43:37Z")
The current java api client documentation contains a chapter regarding migration. This describes the usage of High Level Rest Client in combination with the Java API Client: But there are no information provided how t… --- ## [Migrate Elastic Cloud Regions](https://discuss.elastic.co/t/migrate-elastic-cloud-regions/303636)
**Author:** [@TomTom](https://discuss.elastic.co/u/TomTom)\ **Replies:** 4\ **Last updated:** [April 30, 2022, 3:14am UTC](https://discuss.elastic.co/t/migrate-elastic-cloud-regions/303636 "2022-04-30T03:14:54Z")
Using Elastic Cloud with GCP, can I start using it in one region, eg North Virginia, and then change the region of this implementation to another GCP region? --- ## [Please translate this aggregation into elasticsearch](https://discuss.elastic.co/t/please-translate-this-aggregation-into-elasticsearch/303611)
**Author:** [@UchihaYuki](https://discuss.elastic.co/u/UchihaYuki)\ **Replies:** 1\ **Last updated:** [April 30, 2022, 1:55am UTC](https://discuss.elastic.co/t/please-translate-this-aggregation-into-elasticsearch/303611 "2022-04-30T01:55:52Z")
I just can't understand what does this aggregation in TSVB do exactly. I think if anybody can translate it into Elasticsearch query DSL, then I can understand it. Thank you so much in advance. --- ## [Using ElasticSerach 8 via Docker without certificate](https://discuss.elastic.co/t/using-elasticserach-8-via-docker-without-certificate/303617)
**Author:** [@TomTom](https://discuss.elastic.co/u/TomTom)\ **Replies:** 1\ **Last updated:** [April 30, 2022, 12:38am UTC](https://discuss.elastic.co/t/using-elasticserach-8-via-docker-without-certificate/303617 "2022-04-30T00:38:02Z")
Today my team works with Elasticsearch (6.8) through a Docker machine, connecting via HTTP (php curl), just to test our system and the integration with Elasticsearch. We tried to use the Elasticsearch 8 image on Docker,… --- ## [Connecting app-search to postman via the REST API](https://discuss.elastic.co/t/connecting-app-search-to-postman-via-the-rest-api/303557)
**Author:** [@Ines\_ZAYANI](https://discuss.elastic.co/u/Ines_ZAYANI)\ **Replies:** 4\ **Last updated:** [April 29, 2022, 10:20pm UTC](https://discuss.elastic.co/t/connecting-app-search-to-postman-via-the-rest-api/303557 "2022-04-29T22:20:53Z")
hello everyone! I'm trying to connect app-search to postman: while using the Dev Tools in kibana i tried with POST and got the following error: Request: GET 'http://localhost:3002/api/as/v1/engines/iot/search.json' \\ … --- ## [Combine different fields for percentile](https://discuss.elastic.co/t/combine-different-fields-for-percentile/303634)
**Author:** [@sweeper42](https://discuss.elastic.co/u/sweeper42)\ **Replies:** 0\ **Last updated:** [April 29, 2022, 9:50pm UTC](https://discuss.elastic.co/t/combine-different-fields-for-percentile/303634 "2022-04-29T21:50:03Z")
I have a situation where I have documents with multiple histogram fields. I would sometimes like to get the percentile of combined fields. Here is a sample mapping PUT /t1 { "settings": { "index": { "number… --- ## [Kibana error](https://discuss.elastic.co/t/kibana-error/303570)
**Author:** [@theacodes](https://discuss.elastic.co/u/theacodes)\ **Replies:** 1\ **Last updated:** [April 29, 2022, 8:17pm UTC](https://discuss.elastic.co/t/kibana-error/303570 "2022-04-29T20:17:29Z")
anyone know this error?? getting it again and again. kibana starts working for a while and goes back to this error --- ## [Logstash to elastic search TCP connection error](https://discuss.elastic.co/t/logstash-to-elastic-search-tcp-connection-error/303624)
**Author:** [@newelastic](https://discuss.elastic.co/u/newelastic)\ **Replies:** 5\ **Last updated:** [April 29, 2022, 7:33pm UTC](https://discuss.elastic.co/t/logstash-to-elastic-search-tcp-connection-error/303624 "2022-04-29T19:33:52Z")
Hi, I'm trying to connect to Elasticsearch using logstash and running into an TCP connection error. Below is my input plugin for logstash input { elasticsearch { hosts =\> \["https://esipAddress:9200"\] index =\> "tes… --- ## [Change path cluster](https://discuss.elastic.co/t/change-path-cluster/303610)
**Author:** [@bekk777](https://discuss.elastic.co/u/bekk777)\ **Replies:** 1\ **Last updated:** [April 29, 2022, 3:39pm UTC](https://discuss.elastic.co/t/change-path-cluster/303610 "2022-04-29T15:39:14Z")
Hi everyone. Just one question about editing disk usage on Elasticsearch. On the existing server ELK, we added a newly attached disk and want to change disk usage, is it possible to use this new attached disk path or n… --- ## [Update by query, values from another index](https://discuss.elastic.co/t/update-by-query-values-from-another-index/303608)
**Author:** [@save4elastic](https://discuss.elastic.co/u/save4elastic)\ **Replies:** 1\ **Last updated:** [April 29, 2022, 3:34pm UTC](https://discuss.elastic.co/t/update-by-query-values-from-another-index/303608 "2022-04-29T15:34:45Z")
I have an index with values like FIRST\_INDEX (10 billion entries) { id: 123, car: "Volvo" }, { id: 124, car: "Vaneo" } The goal is to fill the above FIRST\_INDEX with values from the SECOND\_INDEX. SECOND\_INDEX (1 milli… --- ## [Logstash-filter-http Post Body error](https://discuss.elastic.co/t/logstash-filter-http-post-body-error/303532)
**Author:** [@zurb3](https://discuss.elastic.co/u/zurb3)\ **Replies:** 9\ **Last updated:** [April 29, 2022, 3:24pm UTC](https://discuss.elastic.co/t/logstash-filter-http-post-body-error/303532 "2022-04-29T15:24:49Z")
I'm trying to get some kind of data enrichment using an API call to Abuse.ch as documents come into the pipeline. The logstash-filter-http plugin seems like the right answer, however it isn't working for what I need it t… --- ## [How to get rid of event.original field?](https://discuss.elastic.co/t/how-to-get-rid-of-event-original-field/303604)
**Author:** [@alytkowski](https://discuss.elastic.co/u/alytkowski)\ **Replies:** 6\ **Last updated:** [April 29, 2022, 3:03pm UTC](https://discuss.elastic.co/t/how-to-get-rid-of-event-original-field/303604 "2022-04-29T15:03:26Z")
After upgrading to ELK 8.1, I noticed that every event has the "event.original" field containing all of the log data. This is highly unwanted, how to prevent this field from being sent from Filebeat? I tried doing it on… --- ## [Search timeout not working](https://discuss.elastic.co/t/search-timeout-not-working/303044)
**Author:** [@MrFantastic2022](https://discuss.elastic.co/u/MrFantastic2022)\ **Replies:** 14\ **Last updated:** [April 29, 2022, 2:28pm UTC](https://discuss.elastic.co/t/search-timeout-not-working/303044 "2022-04-29T14:28:19Z")
Hello. I have a small index (~10000 documents) and have specified 1000 as the argument to the size() method of SearchSourceBuilder. When I inspect the totalHits value for some of my searches, that number is in excess o… --- ## [Grok Filter..so close... yet so far](https://discuss.elastic.co/t/grok-filter-so-close-yet-so-far/303592)
**Author:** [@joshn](https://discuss.elastic.co/u/joshn)\ **Replies:** 2\ **Last updated:** [April 29, 2022, 2:13pm UTC](https://discuss.elastic.co/t/grok-filter-so-close-yet-so-far/303592 "2022-04-29T14:13:16Z")
I'm using this website to debug my Grok code: https://grokdebug.herokuapp.com/ Two different logs I'm trying to ingest: 1: \<134\>1 1651225979.448642514 EMEA\_ISP ip\_flow\_end src=192.168.15.6 dst=8.8.4.4 protocol=udp spo… --- ## [Log warning about missing Windows Events](https://discuss.elastic.co/t/log-warning-about-missing-windows-events/303600)
**Author:** [@Tadas](https://discuss.elastic.co/u/Tadas)\ **Replies:** 0\ **Last updated:** [April 29, 2022, 12:20pm UTC](https://discuss.elastic.co/t/log-warning-about-missing-windows-events/303600 "2022-04-29T12:20:55Z")
Hi! There is no good way to detect situations where Winlogbeat is starting up and unable to continue ingesting events from the last bookmarked position (i.e. event log has rolled forward and some events have been lost). … --- ## [Can I add document data in aggregated group?](https://discuss.elastic.co/t/can-i-add-document-data-in-aggregated-group/303571)
**Author:** [@marauderbro](https://discuss.elastic.co/u/marauderbro)\ **Replies:** 1\ **Last updated:** [April 29, 2022, 12:08pm UTC](https://discuss.elastic.co/t/can-i-add-document-data-in-aggregated-group/303571 "2022-04-29T12:08:00Z")
I'm totally new to Elasticsearch, And I'm now logging our product view log to serve "popular product" to client side. Our logic is below.... User clicks product Client request product data to server When serving produ… --- ## [Elasticsearch async bulkprocess using low level client](https://discuss.elastic.co/t/elasticsearch-async-bulkprocess-using-low-level-client/303588)
**Author:** [@yelururao](https://discuss.elastic.co/u/yelururao)\ **Replies:** 1\ **Last updated:** [April 29, 2022, 12:06pm UTC](https://discuss.elastic.co/t/elasticsearch-async-bulkprocess-using-low-level-client/303588 "2022-04-29T12:06:34Z")
Hi, I'm using Low-level rest-client version 8.0.0. how to do async bulk process ? Thanks & Regads, Venkat --- ## [I want Message values as feild using logstash](https://discuss.elastic.co/t/i-want-message-values-as-feild-using-logstash/303519)
**Author:** [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\ **Replies:** 9\ **Last updated:** [April 29, 2022, 11:59am UTC](https://discuss.elastic.co/t/i-want-message-values-as-feild-using-logstash/303519 "2022-04-29T11:59:32Z")
Hello Every One Following is my message I want to split message value and add as field for filter and visulize how can I achive that please help any one message url=&type=click&date\_time=2013-01-01+12:00:00&initiated… --- ## [Rename added agents from fleet](https://discuss.elastic.co/t/rename-added-agents-from-fleet/303268)
**Author:** [@theacodes](https://discuss.elastic.co/u/theacodes)\ **Replies:** 2\ **Last updated:** [April 29, 2022, 11:35am UTC](https://discuss.elastic.co/t/rename-added-agents-from-fleet/303268 "2022-04-29T11:35:03Z")
how can I rename this agent host (aarsh-isg-virtualbox) to something else? --- ## [Discover, missing Date Filter and Process Chart](https://discuss.elastic.co/t/discover-missing-date-filter-and-process-chart/303589)
**Author:** [@Bavaria](https://discuss.elastic.co/u/Bavaria)\ **Replies:** 1\ **Last updated:** [April 29, 2022, 11:13am UTC](https://discuss.elastic.co/t/discover-missing-date-filter-and-process-chart/303589 "2022-04-29T11:13:37Z")
Hey, I created a new index with alias, to be able to add ILM Policy. In my Data View in discover, I am not able to see the Show dates Filter and the Process chart. (highligthed red) I am getting data in. How can I get… --- ## [\[Filebeat\]\[K8S\] How to process multiple types of logs (1 single + 2 different multiple lines) in one file?](https://discuss.elastic.co/t/filebeat-k8s-how-to-process-multiple-types-of-logs-1-single-2-different-multiple-lines-in-one-file/303160)
**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\ **Replies:** 2\ **Last updated:** [April 29, 2022, 10:51am UTC](https://discuss.elastic.co/t/filebeat-k8s-how-to-process-multiple-types-of-logs-1-single-2-different-multiple-lines-in-one-file/303160 "2022-04-29T10:51:24Z")
Hello guys, can anyone give me tip how to process multiple types of logs in one file for this usecase: In the log file I have 3 types of log: 1) PHP-FPM Access log (is single-line) 10.102.0.141 - 25/Apr/2022:11:17:5… --- ## [Confused on LS outputs and data not going to right index](https://discuss.elastic.co/t/confused-on-ls-outputs-and-data-not-going-to-right-index/303498)
**Author:** [@joshn](https://discuss.elastic.co/u/joshn)\ **Replies:** 4\ **Last updated:** [April 29, 2022, 10:26am UTC](https://discuss.elastic.co/t/confused-on-ls-outputs-and-data-not-going-to-right-index/303498 "2022-04-29T10:26:51Z")
Hey there, I'm not understanding the "output" section of my config for Logstash \> Elasticsearch. I've been following this guide: How To Install Elasticsearch, Logstash, and Kibana (Elastic Stack) on Ubuntu 22.04 | Digi… [Previous page](https://discuss.elastic.co/latest.md?page=1150) [Next page](https://discuss.elastic.co/latest.md?page=1152)