# Latest **URL:** https://discuss.elastic.co/latest.md?page=1219 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1220 --- ## [Harvester\_buffer\_size - why increase it?](https://discuss.elastic.co/t/harvester-buffer-size-why-increase-it/299226)
**Author:** [@mikewillis](https://discuss.elastic.co/u/mikewillis)\ **Replies:** 2\ **Last updated:** [March 14, 2022, 10:04am UTC](https://discuss.elastic.co/t/harvester-buffer-size-why-increase-it/299226 "2022-03-14T10:04:49Z")
The documentation says what the harvest\_buffer\_size setting of the log input is for, but I don't see anything about why one might want to change it. I noticed that a Filebeat 7.17 instance on a CentOS 7 server that is… --- ## [Beats Logs differentiation based on Environment in Kibana UI](https://discuss.elastic.co/t/beats-logs-differentiation-based-on-environment-in-kibana-ui/299500)
**Author:** [@helper](https://discuss.elastic.co/u/helper)\ **Replies:** 2\ **Last updated:** [March 14, 2022, 9:58am UTC](https://discuss.elastic.co/t/beats-logs-differentiation-based-on-environment-in-kibana-ui/299500 "2022-03-14T09:58:51Z")
Hi there, I am looking for some help to differentiate the logs which I am sending from various environments to the Elastic. Flow : File Beat -\> Logstash -\> Elastic -\> Kibana. I would like to see the logs which I pushed… --- ## [Monitor/alert beats dropped events](https://discuss.elastic.co/t/monitor-alert-beats-dropped-events/295591)
**Author:** [@smueller](https://discuss.elastic.co/u/smueller)\ **Replies:** 7\ **Last updated:** [March 14, 2022, 8:28am UTC](https://discuss.elastic.co/t/monitor-alert-beats-dropped-events/295591 "2022-03-14T08:28:42Z")
Hi, i need to alert me on filebeat dropping events. Even better alerting me on the kind of error that lead to the dropping. I'm running filebeat 7.15 on rhel-7. First tack i tried was to use the internal monitorings sys… --- ## [Discrepancy (bug or misunderstanding) in how simple\_query\_string handles queries?](https://discuss.elastic.co/t/discrepancy-bug-or-misunderstanding-in-how-simple-query-string-handles-queries/299351)
**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Replies:** 2\ **Last updated:** [March 14, 2022, 9:52am UTC](https://discuss.elastic.co/t/discrepancy-bug-or-misunderstanding-in-how-simple-query-string-handles-queries/299351 "2022-03-14T09:52:22Z")
I have a field, let's call it MyField mapped as a keyword type. If I search using simple\_query\_string, like so: GET /my-index/\_search { "from": 0, "size": 1000, "query": { "bool": { "filter": \[ … --- ## [Golang Agent Local Development Import Statements](https://discuss.elastic.co/t/golang-agent-local-development-import-statements/299575)
**Author:** [@jaamish](https://discuss.elastic.co/u/jaamish)\ **Replies:** 1\ **Last updated:** [March 14, 2022, 9:29am UTC](https://discuss.elastic.co/t/golang-agent-local-development-import-statements/299575 "2022-03-14T09:29:41Z")
Hi there, I am trying to add a new database instrumentation support in golfing agent locally. But I see that by default if I add a new module in place, the import module should point to "go.elastic.co" for me to pull it … --- ## [Couldn't run filebeat image](https://discuss.elastic.co/t/couldnt-run-filebeat-image/299590)
**Author:** [@Mariem](https://discuss.elastic.co/u/Mariem)\ **Replies:** 1\ **Last updated:** [March 14, 2022, 8:36am UTC](https://discuss.elastic.co/t/couldnt-run-filebeat-image/299590 "2022-03-14T08:36:38Z")
Can someone help me solve this problem --- ## [HTTP Output Could not fetch url (Illegal character)](https://discuss.elastic.co/t/http-output-could-not-fetch-url-illegal-character/299439)
**Author:** [@josemariafrupm](https://discuss.elastic.co/u/josemariafrupm)\ **Replies:** 2\ **Last updated:** [March 14, 2022, 8:23am UTC](https://discuss.elastic.co/t/http-output-could-not-fetch-url-illegal-character/299439 "2022-03-14T08:23:58Z")
Hi! I'm an university student working on his final degree project, and I can't find any info about the problem I'm having. I need to send logs through Logstash with http but it says it can't fetch the url. I think the pr… --- ## [Elasticsearch 8 disable BEGIN SECURITY AUTO CONFIGURATION](https://discuss.elastic.co/t/elasticsearch-8-disable-begin-security-auto-configuration/299507)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 2\ **Last updated:** [March 14, 2022, 7:52am UTC](https://discuss.elastic.co/t/elasticsearch-8-disable-begin-security-auto-configuration/299507 "2022-03-14T07:52:00Z")
Is there a way to disable this during install? or even have a yes and no option I'm trying to create an automated install with my own certificates and sometimes during testing I don't want to have user authentication en… --- ## [Is it possible to update Elasticsearch using logstash conf file with field other than document id](https://discuss.elastic.co/t/is-it-possible-to-update-elasticsearch-using-logstash-conf-file-with-field-other-than-document-id/299203)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 1\ **Last updated:** [March 14, 2022, 3:52am UTC](https://discuss.elastic.co/t/is-it-possible-to-update-elasticsearch-using-logstash-conf-file-with-field-other-than-document-id/299203 "2022-03-14T03:52:21Z")
Hello if\[sid\]!="null" and \[sid\]!="" { elasticsearch { hosts =\> \["localhost:9200"\] document\_id =\> "%{sid}" index =\> "dashboard\_write" … --- ## [Can I create a Visualization from two different indices?](https://discuss.elastic.co/t/can-i-create-a-visualization-from-two-different-indices/299556)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 3\ **Last updated:** [March 14, 2022, 3:06am UTC](https://discuss.elastic.co/t/can-i-create-a-visualization-from-two-different-indices/299556 "2022-03-14T03:06:50Z")
Hi Team, I wanted to plot a data in a table and need to pick up a fields from different indices. Can that be possible with Kibana? If not then any other alternatives you can think of? --- ## [How to fix kafka fatal error when running](https://discuss.elastic.co/t/how-to-fix-kafka-fatal-error-when-running/299582)
**Author:** [@leyleynewt](https://discuss.elastic.co/u/leyleynewt)\ **Replies:** 1\ **Last updated:** [March 14, 2022, 2:48am UTC](https://discuss.elastic.co/t/how-to-fix-kafka-fatal-error-when-running/299582 "2022-03-14T02:48:39Z")
Please see screenshots below: Thanks in advance!!! --- ## [How to curl this query to shell script](https://discuss.elastic.co/t/how-to-curl-this-query-to-shell-script/299292)
**Author:** [@leyleynewt](https://discuss.elastic.co/u/leyleynewt)\ **Replies:** 4\ **Last updated:** [March 14, 2022, 2:30am UTC](https://discuss.elastic.co/t/how-to-curl-this-query-to-shell-script/299292 "2022-03-14T02:30:03Z")
I want to delete the 5 days old data of all my indexes. How to curl this query to shell script POST \_all/\_delete\_by\_query { "query": { "range": { "@timestamp": { "lte": "now-5d" } } } } Than… --- ## [How to convert KQL to curl command in bash](https://discuss.elastic.co/t/how-to-convert-kql-to-curl-command-in-bash/299207)
**Author:** [@leyleynewt](https://discuss.elastic.co/u/leyleynewt)\ **Replies:** 4\ **Last updated:** [March 14, 2022, 2:26am UTC](https://discuss.elastic.co/t/how-to-convert-kql-to-curl-command-in-bash/299207 "2022-03-14T02:26:18Z")
How can I run this KQL in the bash command POST \_all/\_delete\_by\_query { "query": { "range": { "@timestamp": { "lte": "now-5d" } } } } Thank you in advance! --- ## [Monitoring SAP SaaS using ElasticSearch](https://discuss.elastic.co/t/monitoring-sap-saas-using-elasticsearch/299564)
**Author:** [@hamdyahmed1984](https://discuss.elastic.co/u/hamdyahmed1984)\ **Replies:** 1\ **Last updated:** [March 13, 2022, 6:13pm UTC](https://discuss.elastic.co/t/monitoring-sap-saas-using-elasticsearch/299564 "2022-03-13T18:13:59Z")
Can I monitor SAP using Elasticsearch? SAP is used as software as a service. --- ## [NetApp reports Elasticsearch High Latency alerts](https://discuss.elastic.co/t/netapp-reports-elasticsearch-high-latency-alerts/299570)
**Author:** [@KrishnaCh](https://discuss.elastic.co/u/KrishnaCh)\ **Replies:** 0\ **Last updated:** [March 13, 2022, 5:20pm UTC](https://discuss.elastic.co/t/netapp-reports-elasticsearch-high-latency-alerts/299570 "2022-03-13T17:20:27Z")
Hi All, We have NetApp storage in our environment. And there is one cluster which is hardly being used by the application, and there is very minimal data traffic coming into this cluster We are using Zabbix monitoring … --- ## [Logstash output using environment variable](https://discuss.elastic.co/t/logstash-output-using-environment-variable/299569)
**Author:** [@Amit\_Halle](https://discuss.elastic.co/u/Amit_Halle)\ **Replies:** 1\ **Last updated:** [March 13, 2022, 4:23pm UTC](https://discuss.elastic.co/t/logstash-output-using-environment-variable/299569 "2022-03-13T16:23:02Z")
hi I'm trying to send my logs to an additional output when a certain field's value is a member in a given list. The way I go about this is wrapping the additional output part in the pipeline with an "if" condition and … --- ## [Collapse results by multipli fields( highRestClient java](https://discuss.elastic.co/t/collapse-results-by-multipli-fields-highrestclient-java/298740)
**Author:** [@Anna\_Kuranda](https://discuss.elastic.co/u/Anna_Kuranda)\ **Replies:** 4\ **Last updated:** [March 13, 2022, 2:26pm UTC](https://discuss.elastic.co/t/collapse-results-by-multipli-fields-highrestclient-java/298740 "2022-03-13T14:26:06Z")
Hi I need do collapse by two fields :field1 and field2 I use java collapse by field1 searchSourceBuilder.collapse(new CollapseBuilder("field1").setInnerHits(innerHitBuilder)); In my case I need additional colla… --- ## [Using Variables in Elastic Synthetics](https://discuss.elastic.co/t/using-variables-in-elastic-synthetics/299567)
**Author:** [@zx8086](https://discuss.elastic.co/u/zx8086)\ **Replies:** 0\ **Last updated:** [March 13, 2022, 2:17pm UTC](https://discuss.elastic.co/t/using-variables-in-elastic-synthetics/299567 "2022-03-13T14:17:03Z")
Hi Guys, Is it possible to use variables for example in the Url field ? I need to have the Host IP Address instead of something generic like localhost or 127.0.0.1 --- ## [Elasticsearch 8.1 fail to start](https://discuss.elastic.co/t/elasticsearch-8-1-fail-to-start/299524)
**Author:** [@mayayisim](https://discuss.elastic.co/u/mayayisim)\ **Replies:** 1\ **Last updated:** [March 13, 2022, 12:37pm UTC](https://discuss.elastic.co/t/elasticsearch-8-1-fail-to-start/299524 "2022-03-13T12:37:27Z")
Good day Please assist with Elasticsearch failing to start, I checked the logs and its complaining about access denied on /var/run/Elasticsearch. I then created the path and now it's complaining about the Elasticsearch.… --- ## [Output format](https://discuss.elastic.co/t/output-format/299558)
**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\ **Replies:** 0\ **Last updated:** [March 13, 2022, 8:20am UTC](https://discuss.elastic.co/t/output-format/299558 "2022-03-13T08:20:47Z")
Hi, Is there a way to get csv output format when querying by DSL? I show that when querying by SQL, you have to option to do it. Thanks... --- ## [Elastic agent failing to enroll on a fresh install](https://discuss.elastic.co/t/elastic-agent-failing-to-enroll-on-a-fresh-install/298895)
**Author:** [@epheria](https://discuss.elastic.co/u/epheria)\ **Replies:** 3\ **Last updated:** [March 13, 2022, 6:50am UTC](https://discuss.elastic.co/t/elastic-agent-failing-to-enroll-on-a-fresh-install/298895 "2022-03-13T06:50:03Z")
Hello! I am having trouble getting an elastic agent to enroll on a host for monitoring (more specific details to come below). As an overview, here's what I'm working with: Freshly installed Elasticsearch and kibana (… --- ## [Log correlation does not match trace.id from active span/transaction?](https://discuss.elastic.co/t/log-correlation-does-not-match-trace-id-from-active-span-transaction/298967)
**Author:** [@efdknittlfrank](https://discuss.elastic.co/u/efdknittlfrank)\ **Replies:** 12\ **Last updated:** [March 13, 2022, 6:22am UTC](https://discuss.elastic.co/t/log-correlation-does-not-match-trace-id-from-active-span-transaction/298967 "2022-03-13T06:22:04Z")
I have a use-case where tasks (Java Function\ or Supplier) are potentially queued. If no task is currently running, the current thread directly executes the task. If another task is pending, the new task will be que… --- ## [How about collect "request.body.bytes" in Nginx ingest-pipeline provided by Filebeat?](https://discuss.elastic.co/t/how-about-collect-request-body-bytes-in-nginx-ingest-pipeline-provided-by-filebeat/299554)
**Author:** [@Lee\_Sun\_Ro](https://discuss.elastic.co/u/Lee_Sun_Ro)\ **Replies:** 0\ **Last updated:** [March 13, 2022, 5:11am UTC](https://discuss.elastic.co/t/how-about-collect-request-body-bytes-in-nginx-ingest-pipeline-provided-by-filebeat/299554 "2022-03-13T05:11:35Z")
Hello, I'm a light user of Filebeat. According to the documentation, the nginx.ingress\_controller collects the body size of the http request, but the nginx access module does not. Why is there such a difference? Or am… --- ## [Null Value Replacement in Mapping does not work using NEST](https://discuss.elastic.co/t/null-value-replacement-in-mapping-does-not-work-using-nest/299553)
**Author:** [@xef](https://discuss.elastic.co/u/xef)\ **Replies:** 0\ **Last updated:** [March 13, 2022, 4:09am UTC](https://discuss.elastic.co/t/null-value-replacement-in-mapping-does-not-work-using-nest/299553 "2022-03-13T04:09:42Z")
We have ES version 17.14 and have a mapping for our Index: .Keyword(s =\> s.Name(c =\> c.Website).Index(false).NullValue("")) But if we try to use the update API : var result = await client.UpdateAsync\(post.Id,… --- ## [Remove backslash from Json logs in Kibana](https://discuss.elastic.co/t/remove-backslash-from-json-logs-in-kibana/299550)
**Author:** [@gooner\_holmes](https://discuss.elastic.co/u/gooner_holmes)\ **Replies:** 0\ **Last updated:** [March 13, 2022, 3:27am UTC](https://discuss.elastic.co/t/remove-backslash-from-json-logs-in-kibana/299550 "2022-03-13T03:27:25Z")
filebeat.inputs: - type: log paths: - '/var/lib/docker/containers/\*/\*.log' multiline.type: pattern multiline.pattern: '^\\\\' multiline.negate: true multiline.match: after processors: - add\_docker\_metadat… --- ## [I regret that I couldn't find an OCR parser to handle image/ocr-png.Please set the OCR\_STRATEGY to NO\_OCR or configure yourOCR parser correctly](https://discuss.elastic.co/t/i-regret-that-i-couldnt-find-an-ocr-parser-to-handle-image-ocr-png-please-set-the-ocr-strategy-to-no-ocr-or-configure-yourocr-parser-correctly/299512)
**Author:** [@Morphus1](https://discuss.elastic.co/u/Morphus1)\ **Replies:** 8\ **Last updated:** [March 13, 2022, 3:18am UTC](https://discuss.elastic.co/t/i-regret-that-i-couldnt-find-an-ocr-parser-to-handle-image-ocr-png-please-set-the-ocr-strategy-to-no-ocr-or-configure-yourocr-parser-correctly/299512 "2022-03-13T03:18:59Z")
Hi Everyone, I'm trying to use OCR when indexing but not getting any results. I've tried using tesseract for images and Tika for the pdfs but not a single one will get indexed with "content". The error message is: 09… --- ## [Elastic Query Bool Logic/Subquery Structure Help](https://discuss.elastic.co/t/elastic-query-bool-logic-subquery-structure-help/299491)
**Author:** [@bsmith](https://discuss.elastic.co/u/bsmith)\ **Replies:** 1\ **Last updated:** [March 12, 2022, 5:09pm UTC](https://discuss.elastic.co/t/elastic-query-bool-logic-subquery-structure-help/299491 "2022-03-12T17:09:51Z")
Need help converting some SQL into elastic and stuck on some of the bool logic and probably isn't structured properly. Goal is to get a count of users that are active at a specified start date and are still active at the… --- ## [Creating a new column from existing columns](https://discuss.elastic.co/t/creating-a-new-column-from-existing-columns/299528)
**Author:** [@carl25en](https://discuss.elastic.co/u/carl25en)\ **Replies:** 1\ **Last updated:** [March 12, 2022, 5:00pm UTC](https://discuss.elastic.co/t/creating-a-new-column-from-existing-columns/299528 "2022-03-12T17:00:40Z")
Dear Elasticsearch community, I was wondering how I can create a DateTime column from 5 columns (forecasted\_year,month,day,hour,minute) as it is shown in the image (after creating a new index). I am not sure if this sh… --- ## [Records are getting dropped while creating map using logstash](https://discuss.elastic.co/t/records-are-getting-dropped-while-creating-map-using-logstash/299509)
**Author:** [@Deepak\_Dandotiya](https://discuss.elastic.co/u/Deepak_Dandotiya)\ **Replies:** 1\ **Last updated:** [March 12, 2022, 3:26pm UTC](https://discuss.elastic.co/t/records-are-getting-dropped-while-creating-map-using-logstash/299509 "2022-03-12T15:26:42Z")
Hi Experts, I need your help here. Context is, I am trying to read the data from DB after multiple joins and then forming a Map in Elasticsearch using ID column as agreegate and trying to handle the duplicate event from… --- ## [Elasticsearch Index creation time](https://discuss.elastic.co/t/elasticsearch-index-creation-time/299529)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 0\ **Last updated:** [March 12, 2022, 3:26pm UTC](https://discuss.elastic.co/t/elasticsearch-index-creation-time/299529 "2022-03-12T15:26:17Z")
Hi, Somehow my indexes are created each day at around 17pm. Indexes are being rolled over every day. What is happening is, for example, at 17pm of 11/03 the index-name-2022-03-11-00001 is created. Then, at 17pm of 12/0… [Previous page](https://discuss.elastic.co/latest.md?page=1218) [Next page](https://discuss.elastic.co/latest.md?page=1220)