# Latest **URL:** https://discuss.elastic.co/latest.md?page=1208 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1209 --- ## [Getting less search speed](https://discuss.elastic.co/t/getting-less-search-speed/300201)
**Author:** [@Neeraj\_Jain7483](https://discuss.elastic.co/u/Neeraj_Jain7483)\ **Replies:** 3\ **Last updated:** [March 21, 2022, 6:40pm UTC](https://discuss.elastic.co/t/getting-less-search-speed/300201 "2022-03-21T18:40:32Z")
We have a cluster consisting of 3 masters (4 core, 16 GB RAM each), 3 hot(8 core, 32 GB RAM, 300 GB SSD each), and 3 warm nodes(8 core, 32GB RAM, 1.5TB HDD each). We have one index for each month of year following the n… --- ## [Configuration: how to mix environment variable with static config in a list](https://discuss.elastic.co/t/configuration-how-to-mix-environment-variable-with-static-config-in-a-list/300240)
**Author:** [@grained](https://discuss.elastic.co/u/grained)\ **Replies:** 0\ **Last updated:** [March 21, 2022, 6:13pm UTC](https://discuss.elastic.co/t/configuration-how-to-mix-environment-variable-with-static-config-in-a-list/300240 "2022-03-21T18:13:57Z")
I'm trying to exclude\_files using a mix of environment variables and static configuration but the environment variable seems to be expanded to a list of it's own making it impossible to add to an existing list. Example: … --- ## [Setting up Index Life Management](https://discuss.elastic.co/t/setting-up-index-life-management/300077)
**Author:** [@userR](https://discuss.elastic.co/u/userR)\ **Replies:** 5\ **Last updated:** [March 21, 2022, 6:11pm UTC](https://discuss.elastic.co/t/setting-up-index-life-management/300077 "2022-03-21T18:11:00Z")
I use Logstash grok patterns to parse my logs. These logs are outputted to Elasticsearch in daily indexes. I want to create an index template to then apply to an ILM policy that will delete these logs after 60 days. Whe… --- ## [Dockershim is being deprecated in k8s 1.24](https://discuss.elastic.co/t/dockershim-is-being-deprecated-in-k8s-1-24/299808)
**Author:** [@pooch](https://discuss.elastic.co/u/pooch)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 5:35pm UTC](https://discuss.elastic.co/t/dockershim-is-being-deprecated-in-k8s-1-24/299808 "2022-03-21T17:35:44Z")
Starting with Kubernetes ver 1.24 the project is removing the dockershim that processes docker commands as the container runtime engine. I am running Filebeat and Metricbeat 7.16.2 in our clusters currently and they hav… --- ## [Packetbeat8.0 af\_packet report errors](https://discuss.elastic.co/t/packetbeat8-0-af-packet-report-errors/298180)
**Author:** [@chinaxushi](https://discuss.elastic.co/u/chinaxushi)\ **Replies:** 7\ **Last updated:** [March 21, 2022, 5:27pm UTC](https://discuss.elastic.co/t/packetbeat8-0-af-packet-report-errors/298180 "2022-03-21T17:27:29Z")
Packetbeat Version: 8.0 Operating System: Rocky Linux 8.5 After the "af\_packet" mode is enabled in the configuration file, Packetbeat will report an error and prompt "exiting: sniffer loop failed: sniffing error: packe… --- ## [Logstash oracle db jdbc plugin eeror](https://discuss.elastic.co/t/logstash-oracle-db-jdbc-plugin-eeror/300225)
**Author:** [@Hamza\_Shakeel](https://discuss.elastic.co/u/Hamza_Shakeel)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 5:16pm UTC](https://discuss.elastic.co/t/logstash-oracle-db-jdbc-plugin-eeror/300225 "2022-03-21T17:16:44Z")
I am getting the following error : Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of \[ \\t\\r\\n\], "#", \[A-Za-z0-9\_… --- ## [How to specifiy proxy with websoket input plugin](https://discuss.elastic.co/t/how-to-specifiy-proxy-with-websoket-input-plugin/300174)
**Author:** [@zid57](https://discuss.elastic.co/u/zid57)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 5:12pm UTC](https://discuss.elastic.co/t/how-to-specifiy-proxy-with-websoket-input-plugin/300174 "2022-03-21T17:12:30Z")
Hello all, I would need to use the logstash websocket as input plugin. I installed it and it works. However, I'm not able to retrieve data from the websocket URL. The case is simple. In order to reach internet, my l… --- ## [Inputs error journald](https://discuss.elastic.co/t/inputs-error-journald/299804)
**Author:** [@Gyrops](https://discuss.elastic.co/u/Gyrops)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 3:49pm UTC](https://discuss.elastic.co/t/inputs-error-journald/299804 "2022-03-21T15:49:56Z")
log Exiting: Failed to start crawler: starting input failed: Error while initializing input: Error creating input. No such input type exist: 'journald' filebeat version 8.1.0 --- ## [Dedicated Documentation for Java API Client](https://discuss.elastic.co/t/dedicated-documentation-for-java-api-client/300202)
**Author:** [@ssephillip](https://discuss.elastic.co/u/ssephillip)\ **Replies:** 2\ **Last updated:** [March 21, 2022, 3:48pm UTC](https://discuss.elastic.co/t/dedicated-documentation-for-java-api-client/300202 "2022-03-21T15:48:28Z")
Hello everyone, for the Java High Level REST Client there is a dedicated documentation providing detailed information and examples on how to use the Client. This was extremely helpful during development. My questions a… --- ## [Filebeat Apache Module - Apache Module (mod\_dumpio) Support](https://discuss.elastic.co/t/filebeat-apache-module-apache-module-mod-dumpio-support/299999)
**Author:** [@inf](https://discuss.elastic.co/u/inf)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 3:38pm UTC](https://discuss.elastic.co/t/filebeat-apache-module-apache-module-mod-dumpio-support/299999 "2022-03-21T15:38:41Z")
Hi there, I have the following use-case: Capture and parse HTTP(S) POST request information from Apache web servers. An Apache module (mod\_dumpio) is able to do the job. However, the mod\_dumpio module gives tons of inf… --- ## [Filebeat does not harvest all logs from application](https://discuss.elastic.co/t/filebeat-does-not-harvest-all-logs-from-application/300219)
**Author:** [@dorinand](https://discuss.elastic.co/u/dorinand)\ **Replies:** 0\ **Last updated:** [March 21, 2022, 3:28pm UTC](https://discuss.elastic.co/t/filebeat-does-not-harvest-all-logs-from-application/300219 "2022-03-21T15:28:33Z")
I encounter an issue, when filebeat does not harvest all logs (only small amount of them) from my app. I have filebeat that harvest logs from docker applicaitons and send them to the Logstash. Applicaiton is running in … --- ## [How to process json logs from docker container](https://discuss.elastic.co/t/how-to-process-json-logs-from-docker-container/300207)
**Author:** [@paulov](https://discuss.elastic.co/u/paulov)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 3:20pm UTC](https://discuss.elastic.co/t/how-to-process-json-logs-from-docker-container/300207 "2022-03-21T15:20:05Z")
Hi, I receive logs from docker containers, these have a field 'log' that is in itself a json message and that contains a subfield 'message' which I'm interested in. Example: "log"=\>"{"fields":{},"level":"info","@times… --- ## [Cannot connect to X.X.X.X:10514: Connection refused](https://discuss.elastic.co/t/cannot-connect-to-x-x-x-x-connection-refused/300055)
**Author:** [@Oreius](https://discuss.elastic.co/u/Oreius)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 3:16pm UTC](https://discuss.elastic.co/t/cannot-connect-to-x-x-x-x-connection-refused/300055 "2022-03-21T15:16:41Z")
Configuring a ELK stack version 8.1, based on two virtual machine which both run Oracle linux 8. I need to send logs from a VM to the other using rsyslog. On the recieving machine logs will be acquired using FileBeat. Th… --- ## [Search-UI - How to use special Chars like german Umlaute or Whitespaces for facet names?](https://discuss.elastic.co/t/search-ui-how-to-use-special-chars-like-german-umlaute-or-whitespaces-for-facet-names/300150)
**Author:** [@John\_Agricola](https://discuss.elastic.co/u/John_Agricola)\ **Replies:** 2\ **Last updated:** [March 21, 2022, 3:15pm UTC](https://discuss.elastic.co/t/search-ui-how-to-use-special-chars-like-german-umlaute-or-whitespaces-for-facet-names/300150 "2022-03-21T15:15:12Z")
Hi everyone, I have been playing with enterprise search and search UI. I use a JSON file to upload the data. For the values, it looks fine - but for the Keys which are then converted to the names of the facets, I can't… --- ## [Mysql slowquery pipeline fails if schema contains a dash](https://discuss.elastic.co/t/mysql-slowquery-pipeline-fails-if-schema-contains-a-dash/300173)
**Author:** [@Rasmus\_Breinholm\_Rom](https://discuss.elastic.co/u/Rasmus_Breinholm_Rom)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 3:13pm UTC](https://discuss.elastic.co/t/mysql-slowquery-pipeline-fails-if-schema-contains-a-dash/300173 "2022-03-21T15:13:38Z")
The Grok patttern defined in the mysql slowlog ingest pipeline uses the WORD grok pattern to extract schema. This causes the pipeline to fail if schema contains a dash. Using the same pattern as USERNAME seems to fix t… --- ## [Some word should not be transmitted](https://discuss.elastic.co/t/some-word-should-not-be-transmitted/300185)
**Author:** [@peyofe](https://discuss.elastic.co/u/peyofe)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 3:12pm UTC](https://discuss.elastic.co/t/some-word-should-not-be-transmitted/300185 "2022-03-21T15:12:19Z")
Hi. I have a question. I have a log with followings fileds: User;Target;IP-Adress;PrivateCode Name1;Server1;127.0.0.1;CD4523 Name2;Server21;127.0.0.2;CD4542 Name3;Server421;127.0.0.3;CD4556 Filebeat reading the log… --- ## [Elastic Agent Installation Verification Mode Fleet Cert](https://discuss.elastic.co/t/elastic-agent-installation-verification-mode-fleet-cert/300198)
**Author:** [@beijo](https://discuss.elastic.co/u/beijo)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 3:09pm UTC](https://discuss.elastic.co/t/elastic-agent-installation-verification-mode-fleet-cert/300198 "2022-03-21T15:09:05Z")
Hi all, is it possible to define the verification\_mode used to validate the fleet server certificate when installing an elastic agent? I'm thinking about filebeat where you can set verification\_mode to certificate to on… --- ## [LDAP load while auditbeat collects event.category iam](https://discuss.elastic.co/t/ldap-load-while-auditbeat-collects-event-category-iam/300200)
**Author:** [@alchy](https://discuss.elastic.co/u/alchy)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 3:04pm UTC](https://discuss.elastic.co/t/ldap-load-while-auditbeat-collects-event-category-iam/300200 "2022-03-21T15:04:49Z")
We have been dealing with the fact that twice a day we have a heavily loaded LDAP server that manages user accounts in the Unix world. The situation occurs regularly every day around 8:30 in the morning and 8:30 in the … --- ## [Understanding a match query on a search-as-you-type index](https://discuss.elastic.co/t/understanding-a-match-query-on-a-search-as-you-type-index/300215)
**Author:** [@dlants](https://discuss.elastic.co/u/dlants)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 3:04pm UTC](https://discuss.elastic.co/t/understanding-a-match-query-on-a-search-as-you-type-index/300215 "2022-03-21T15:04:45Z")
I'm curious if there is any way to understand the lucene query that's generated for a particular Elasticsearch DSL query. For example, if I create an index: await client.indices.create({ index: 'activities', … --- ## [Filebeat: Error with the google\_workspace module](https://discuss.elastic.co/t/filebeat-error-with-the-google-workspace-module/298871)
**Author:** [@PJ\_ceSofnI\_tseT](https://discuss.elastic.co/u/PJ_ceSofnI_tseT)\ **Replies:** 6\ **Last updated:** [March 21, 2022, 2:54pm UTC](https://discuss.elastic.co/t/filebeat-error-with-the-google-workspace-module/298871 "2022-03-21T14:54:42Z")
Hi all, I find myself integrating the google\_workspace module via filebeat (filebeat-7.17.0-linux-x86\_64) on an Ubuntu 20.04 LTS. I have followed all the steps in the "Configure the module" reference (Google Workspace m… --- ## [APM The selected trace cannot be found after 7.17.1 -\> 8.1 upgrade](https://discuss.elastic.co/t/apm-the-selected-trace-cannot-be-found-after-7-17-1-8-1-upgrade/299964)
**Author:** [@edwardcccc](https://discuss.elastic.co/u/edwardcccc)\ **Replies:** 2\ **Last updated:** [March 21, 2022, 2:46pm UTC](https://discuss.elastic.co/t/apm-the-selected-trace-cannot-be-found-after-7-17-1-8-1-upgrade/299964 "2022-03-21T14:46:16Z")
If you are asking about a problem you are experiencing, please use the following template, as it will help us help you. If you have a different problem, please delete all of this text :slight\_smile: Kibana version: Doc… --- ## [ELK stack sizing](https://discuss.elastic.co/t/elk-stack-sizing/300214)
**Author:** [@PRASOON\_VINODAN](https://discuss.elastic.co/u/PRASOON_VINODAN)\ **Replies:** 0\ **Last updated:** [March 21, 2022, 2:43pm UTC](https://discuss.elastic.co/t/elk-stack-sizing/300214 "2022-03-21T14:43:17Z")
We are planning to use ELK stack with beats for few of our applications & OS real time monitoring. Currently I am doing some POC. I couldn't find any documentation regarding sizing when considering to build a ELK cluster… --- ## [Failed to verify all nodes have repository access](https://discuss.elastic.co/t/failed-to-verify-all-nodes-have-repository-access/299467)
**Author:** [@Caio\_Cesar](https://discuss.elastic.co/u/Caio_Cesar)\ **Replies:** 4\ **Last updated:** [March 21, 2022, 2:03pm UTC](https://discuss.elastic.co/t/failed-to-verify-all-nodes-have-repository-access/299467 "2022-03-21T14:03:48Z")
hello, I have a problem regarding backup using curator, I use version 6.3.2 of Elasticsearch and curator in version 5.7.6 , backups are stored in a google gsc bucket with all permissions but this error always appears Fa… --- ## [Uri\_parts Ingest Processor - domain field](https://discuss.elastic.co/t/uri-parts-ingest-processor-domain-field/300139)
**Author:** [@sera123k](https://discuss.elastic.co/u/sera123k)\ **Replies:** 2\ **Last updated:** [March 21, 2022, 1:51pm UTC](https://discuss.elastic.co/t/uri-parts-ingest-processor-domain-field/300139 "2022-03-21T13:51:48Z")
I'm working with the Zscaler integration and noticed that when passing the logs through the pipeline the uri\_parts ingest processor does not create url.domain out of the URL that Zscaler sends based off the test logs fro… --- ## [How create a visualization with the last date of document](https://discuss.elastic.co/t/how-create-a-visualization-with-the-last-date-of-document/299938)
**Author:** [@David\_Oceans](https://discuss.elastic.co/u/David_Oceans)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 1:01pm UTC](https://discuss.elastic.co/t/how-create-a-visualization-with-the-last-date-of-document/299938 "2022-03-21T13:01:01Z")
Hi, I would like create a dashboard / visualization with the timestamp of even better with the days from the first document in my indexes, like that Option A) First document found 13-03-2022 10:00 Option B) Retenti… --- ## [Need help in delete index after x days](https://discuss.elastic.co/t/need-help-in-delete-index-after-x-days/300192)
**Author:** [@Saranya\_V](https://discuss.elastic.co/u/Saranya_V)\ **Replies:** 5\ **Last updated:** [March 21, 2022, 12:52pm UTC](https://discuss.elastic.co/t/need-help-in-delete-index-after-x-days/300192 "2022-03-21T12:52:06Z")
I'm using Elasticsearch 1.x. is there any way we can delete index after x days without using delete query. --- ## [How to convert null value and empty value to "-"](https://discuss.elastic.co/t/how-to-convert-null-value-and-empty-value-to/300157)
**Author:** [@vuhai\_fo4](https://discuss.elastic.co/u/vuhai_fo4)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 12:46pm UTC](https://discuss.elastic.co/t/how-to-convert-null-value-and-empty-value-to/300157 "2022-03-21T12:46:08Z")
In my dashboard, I have many data empty value and null value. I want to change them to "-". Please recommend to me some solution for this case --- ## [Kibana Dashboard PDF and PNG reporting options missing](https://discuss.elastic.co/t/kibana-dashboard-pdf-and-png-reporting-options-missing/300167)
**Author:** [@Petteri](https://discuss.elastic.co/u/Petteri)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 12:45pm UTC](https://discuss.elastic.co/t/kibana-dashboard-pdf-and-png-reporting-options-missing/300167 "2022-03-21T12:45:59Z")
FYI. The original problem Kibana Dashboard PDF and PNG reporting options missing is due to an bug in elastic code: \[Reporting\] Application Privileges for PNG/PDF exports incorrectly require platinum license · Issue #127… --- ## [Migration from scripted to runtime field](https://discuss.elastic.co/t/migration-from-scripted-to-runtime-field/299484)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 12:37pm UTC](https://discuss.elastic.co/t/migration-from-scripted-to-runtime-field/299484 "2022-03-21T12:37:36Z")
We have a scripted field, for example winlogbeat.user\_data.mysf (my snowflake). I guess we are forced to move this to a runtime field, they were deprecated in 7.13, but I'm not sure when they really quit working. My w… --- ## [New visualization plugin with inputs](https://discuss.elastic.co/t/new-visualization-plugin-with-inputs/299616)
**Author:** [@H1gH](https://discuss.elastic.co/u/H1gH)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 12:29pm UTC](https://discuss.elastic.co/t/new-visualization-plugin-with-inputs/299616 "2022-03-21T12:29:08Z")
Hello, I want to create a new plugin which will make a POST request to an API and will show the response in the view. I created my input using Eui forms \ \