# Latest **URL:** https://discuss.elastic.co/latest.md?page=1311 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1312 --- ## [Fleet Windows agent: failed to filter configuration: provided datastream dataset is invalid](https://discuss.elastic.co/t/fleet-windows-agent-failed-to-filter-configuration-provided-datastream-dataset-is-invalid/294200)
**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\ **Replies:** 0\ **Last updated:** [January 12, 2022, 6:59pm UTC](https://discuss.elastic.co/t/fleet-windows-agent-failed-to-filter-configuration-provided-datastream-dataset-is-invalid/294200 "2022-01-12T18:59:29Z")
Hello, I installed the fleet agent on a windows machine and I'm having this error: {"log.level":"error","@timestamp":"2021-12-19T03:23:34.442Z","log.origin":{"file.name":"fleet/fleet\_gateway.go","file.line":180},"messa… --- ## [Logstash pipeline filter](https://discuss.elastic.co/t/logstash-pipeline-filter/294018)
**Author:** [@max\_cyril](https://discuss.elastic.co/u/max_cyril)\ **Replies:** 7\ **Last updated:** [January 12, 2022, 6:36pm UTC](https://discuss.elastic.co/t/logstash-pipeline-filter/294018 "2022-01-12T18:36:47Z")
Hi, I am new to ELK and struggling to write my first logstash pipeline. Can anyone help me to write the filter section? Thanks in advance. i want to filter and only output the maximum of completion per users fo… --- ## [I'm seeing too many requests for a write operation on a node when I query it with the thread pool API](https://discuss.elastic.co/t/im-seeing-too-many-requests-for-a-write-operation-on-a-node-when-i-query-it-with-the-thread-pool-api/293208)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 6:18pm UTC](https://discuss.elastic.co/t/im-seeing-too-many-requests-for-a-write-operation-on-a-node-when-i-query-it-with-the-thread-pool-api/293208 "2022-01-12T18:18:42Z")
Hi everyone, I'm seeing too many requests for a write operation on a node when I query it with the thread pool API. On other nodes, this status appears as 0. It seems like write requests come to only one node. How can I… --- ## [Elasticsearch java api client](https://discuss.elastic.co/t/elasticsearch-java-api-client/294042)
**Author:** [@Arun\_Nath](https://discuss.elastic.co/u/Arun_Nath)\ **Replies:** 8\ **Last updated:** [January 12, 2022, 5:28pm UTC](https://discuss.elastic.co/t/elasticsearch-java-api-client/294042 "2022-01-12T17:28:43Z")
{ "aggs": { "my-agg-name": { "terms": { "field": "my-field" }, "aggs": { "my-sub-agg-name": { "avg": { "field": "my-other-field" } } }… --- ## [Best practice for logging in an microservice-based architecture](https://discuss.elastic.co/t/best-practice-for-logging-in-an-microservice-based-architecture/294023)
**Author:** [@peoh](https://discuss.elastic.co/u/peoh)\ **Replies:** 1\ **Last updated:** [January 12, 2022, 5:16pm UTC](https://discuss.elastic.co/t/best-practice-for-logging-in-an-microservice-based-architecture/294023 "2022-01-12T17:16:46Z")
Hi! My current environment has multiple applications on multiple servers that logs to a local file and then uses Filebeat to send logs to Logstash for processing. This works fine and I like that the logs will show up ev… --- ## [Hyphenation decompounder token filter seems to ignore the \`only\_longest\_match\` option](https://discuss.elastic.co/t/hyphenation-decompounder-token-filter-seems-to-ignore-the-only-longest-match-option/294047)
**Author:** [@Jelena\_Malinovic](https://discuss.elastic.co/u/Jelena_Malinovic)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 5:12pm UTC](https://discuss.elastic.co/t/hyphenation-decompounder-token-filter-seems-to-ignore-the-only-longest-match-option/294047 "2022-01-12T17:12:53Z")
Hi everyone, We are trying to improve searches on our website which include compounds words. For that purpose, we are using the token filter hyphenation\_decompounder. During testing, we found out that only\_longest\_match … --- ## [Unable to uninstall Endgame Sensor](https://discuss.elastic.co/t/unable-to-uninstall-endgame-sensor/258051)
**Author:** [@Greg\_Schles](https://discuss.elastic.co/u/Greg_Schles)\ **Replies:** 3\ **Last updated:** [January 12, 2022, 4:40pm UTC](https://discuss.elastic.co/t/unable-to-uninstall-endgame-sensor/258051 "2022-01-12T16:40:15Z")
Hello, I'm not able to remove an old sensor from some machines (Win 10). Command being ran: SensorWindowsInstaller-Sensor1.exe -c SensorWindowsInstaller-Sensor1.cfg -k API\_KEY\_REDACTED\_HERE -d false -l install.log L… --- ## [Docker Swarm - Internode Communication Issue](https://discuss.elastic.co/t/docker-swarm-internode-communication-issue/294176)
**Author:** [@Darryl\_Idle](https://discuss.elastic.co/u/Darryl_Idle)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 4:31pm UTC](https://discuss.elastic.co/t/docker-swarm-internode-communication-issue/294176 "2022-01-12T16:31:14Z")
Hi, My environment for ELK is a Docker Swarm setup. Three containers on three individual hosts to utilize distributed storage. I'm using Swarmpit as my orchestrator to compose the stack as follows: version: '3.3' servi… --- ## [Run multiple queries to MySQL](https://discuss.elastic.co/t/run-multiple-queries-to-mysql/293154)
**Author:** [@vPilot](https://discuss.elastic.co/u/vPilot)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 4:12pm UTC](https://discuss.elastic.co/t/run-multiple-queries-to-mysql/293154 "2022-01-12T16:12:04Z")
I have my mysql.yml file configured to run two separate queries for collecting both processlist details and replication details: - module: mysql metricsets: - status - query queries: - query: … --- ## [Metricbeat on Fleet 20-30% CPU](https://discuss.elastic.co/t/metricbeat-on-fleet-20-30-cpu/293972)
**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\ **Replies:** 4\ **Last updated:** [January 12, 2022, 4:09pm UTC](https://discuss.elastic.co/t/metricbeat-on-fleet-20-30-cpu/293972 "2022-01-12T16:09:24Z")
Hello, I'm having 20% of CPU usage in a brand fresh Ubuntu installation. I'm running under Fleet so I'm not sure where to start/debug. Any advice? Thanks! --- ## [Heap space error (Changes not reflecting even after changes in jvm.options file)](https://discuss.elastic.co/t/heap-space-error-changes-not-reflecting-even-after-changes-in-jvm-options-file/294172)
**Author:** [@Anilkumar061988](https://discuss.elastic.co/u/Anilkumar061988)\ **Replies:** 5\ **Last updated:** [January 12, 2022, 3:48pm UTC](https://discuss.elastic.co/t/heap-space-error-changes-not-reflecting-even-after-changes-in-jvm-options-file/294172 "2022-01-12T15:48:14Z")
Hi Everyone, I am using elastic search 5.1.2 in my application which has 1 node 5 indexes. I am running elastic on a windows machine with 4 core and 14 GB RAM. Java heap space configured was 3G with initial setup, … --- ## [Programmatically update Logstash configuration file](https://discuss.elastic.co/t/programmatically-update-logstash-configuration-file/294096)
**Author:** [@Matt\_Jones](https://discuss.elastic.co/u/Matt_Jones)\ **Replies:** 3\ **Last updated:** [January 12, 2022, 3:43pm UTC](https://discuss.elastic.co/t/programmatically-update-logstash-configuration-file/294096 "2022-01-12T15:43:58Z")
Hi, I would like to create multiple ingestion pipelines in Elastic Cloud, each of which containing a pipeline configuration (inputs, filters, outputs). Different pipelines are being created to support different custome… --- ## [Filebeat: Microsoft Module seems to be acquiring the same events for a period of time](https://discuss.elastic.co/t/filebeat-microsoft-module-seems-to-be-acquiring-the-same-events-for-a-period-of-time/294179)
**Author:** [@Log\_Gobbler](https://discuss.elastic.co/u/Log_Gobbler)\ **Replies:** 0\ **Last updated:** [January 12, 2022, 3:15pm UTC](https://discuss.elastic.co/t/filebeat-microsoft-module-seems-to-be-acquiring-the-same-events-for-a-period-of-time/294179 "2022-01-12T15:15:05Z")
I am testing the Filebeat Microsoft Module using the eicar test files from Download Anti Malware Testfile – Eicar. I download one of the files. Then, Windows Defender AV "prevents" the infection (and generates events fr… --- ## [Do people use the Log viewer in Kibana?](https://discuss.elastic.co/t/do-people-use-the-log-viewer-in-kibana/294152)
**Author:** [@mybyte](https://discuss.elastic.co/u/mybyte)\ **Replies:** 3\ **Last updated:** [January 12, 2022, 3:17pm UTC](https://discuss.elastic.co/t/do-people-use-the-log-viewer-in-kibana/294152 "2022-01-12T15:17:39Z")
We're currently setting up a POC where we - among other things - collect a whole bunch of logs from many different machines. The idea was to centralize logs so we don't have to go rummage around multiple machines to find… --- ## [Tsvb markdown with two different color table](https://discuss.elastic.co/t/tsvb-markdown-with-two-different-color-table/294054)
**Author:** [@Cap\_Ho](https://discuss.elastic.co/u/Cap_Ho)\ **Replies:** 3\ **Last updated:** [January 12, 2022, 3:05pm UTC](https://discuss.elastic.co/t/tsvb-markdown-with-two-different-color-table/294054 "2022-01-12T15:05:23Z")
Hello, I have a use case that i need to created two different bg color table in the same markdown. As i know markdown support class (so i may use class selector in css). But it seems that it don't work in Kibana tsvb ma… --- ## [\[logstash.outputsCould not index event to Elasticsearch."error {"type"=\>"mapper\_parsing\_exception", "reason"=\>"object mapping for \[host\] tried to parse field \[host\] as object, but found a concrete value"](https://discuss.elastic.co/t/logstash-outputscould-not-index-event-to-elasticsearch-error-type-mapper-parsing-exception-reason-object-mapping-for-host-tried-to-parse-field-host-as-object-but-found-a-concrete-value/294000)
**Author:** [@jannatnishat](https://discuss.elastic.co/u/jannatnishat)\ **Replies:** 3\ **Last updated:** [January 12, 2022, 2:18pm UTC](https://discuss.elastic.co/t/logstash-outputscould-not-index-event-to-elasticsearch-error-type-mapper-parsing-exception-reason-object-mapping-for-host-tried-to-parse-field-host-as-object-but-found-a-concrete-value/294000 "2022-01-12T14:18:38Z")
Getting this error \[2022-01-11T12:48:53,887\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main\]\[d60352f946d70780df98c56812b4beacd1633b0b5fb5d9c306d2c578620115b7\] Could not index event to Elasticsearch. {:status=\>400, :action=\>… --- ## [Data modelling to avoid reprocessing](https://discuss.elastic.co/t/data-modelling-to-avoid-reprocessing/293148)
**Author:** [@lunea](https://discuss.elastic.co/u/lunea)\ **Replies:** 1\ **Last updated:** [January 12, 2022, 1:58pm UTC](https://discuss.elastic.co/t/data-modelling-to-avoid-reprocessing/293148 "2022-01-12T13:58:56Z")
Hi team! I'm not experienced in Elasticsearch. I'm looking for a new technical solution to dashboard generation with filters and aggregations queries, so I decided to look at Elasticsearch. However, my data is composed… --- ## [Filebeat : Split the multiline json(array of json object) from message field to separate fields](https://discuss.elastic.co/t/filebeat-split-the-multiline-json-array-of-json-object-from-message-field-to-separate-fields/294134)
**Author:** [@Magesh\_02](https://discuss.elastic.co/u/Magesh_02)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 1:08pm UTC](https://discuss.elastic.co/t/filebeat-split-the-multiline-json-array-of-json-object-from-message-field-to-separate-fields/294134 "2022-01-12T13:08:05Z")
I need to use filebeat to push my json data into Elasticsearch, but I'm having trouble decoding my json fields into separate fields extracted from the message field. Filebeat version : 7.16.2 Filebeat.yml filebeat.inp… --- ## [To get the ingestion rate to elasticsearch cluster](https://discuss.elastic.co/t/to-get-the-ingestion-rate-to-elasticsearch-cluster/294156)
**Author:** [@Varun\_S](https://discuss.elastic.co/u/Varun_S)\ **Replies:** 1\ **Last updated:** [January 12, 2022, 12:45pm UTC](https://discuss.elastic.co/t/to-get-the-ingestion-rate-to-elasticsearch-cluster/294156 "2022-01-12T12:45:07Z")
Hi Team, We are deploying fluentd and Elasticsearch in the k8s environment, fluentd is sending data to Elasticsearch and we are monitoring Elasticsearch metrics using the Prometheus plugin. We want to calculate the inge… --- ## [Elastic Agent -\> Oracle Metrics / Oracle Logs via Filebeat to Logstash to Elasticsearch](https://discuss.elastic.co/t/elastic-agent-oracle-metrics-oracle-logs-via-filebeat-to-logstash-to-elasticsearch/294159)
**Author:** [@BoKu](https://discuss.elastic.co/u/BoKu)\ **Replies:** 0\ **Last updated:** [January 12, 2022, 12:18pm UTC](https://discuss.elastic.co/t/elastic-agent-oracle-metrics-oracle-logs-via-filebeat-to-logstash-to-elasticsearch/294159 "2022-01-12T12:18:25Z")
Hello, i am preparing to switch my beat infrastructure to Elastic-agent. I notices that there is no real integration for oracle-metrics, is that correct or what do i have to do to use oracle-metric-module within elastic… --- ## [Why there are always x.x.1 and x.x.2 under a minor version](https://discuss.elastic.co/t/why-there-are-always-x-x-1-and-x-x-2-under-a-minor-version/294128)
**Author:** [@JohnPhilip](https://discuss.elastic.co/u/JohnPhilip)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 11:42am UTC](https://discuss.elastic.co/t/why-there-are-always-x-x-1-and-x-x-2-under-a-minor-version/294128 "2022-01-12T11:42:32Z")
Hi, there, I'm curious about the release plan of Elasticsearch, it seems that there are always two version under a minor version, is it a convention or something? :rofl: --- ## [Metricbeat showing wrong usage of memory](https://discuss.elastic.co/t/metricbeat-showing-wrong-usage-of-memory/294147)
**Author:** [@lalchand\_rajak](https://discuss.elastic.co/u/lalchand_rajak)\ **Replies:** 0\ **Last updated:** [January 12, 2022, 11:11am UTC](https://discuss.elastic.co/t/metricbeat-showing-wrong-usage-of-memory/294147 "2022-01-12T11:11:10Z")
when I am using free -h command on server it's showing something else and metricbeat showing something else, attaching both snapshots. --- ## [Filebeat-\* index pattern Search Error in Discover](https://discuss.elastic.co/t/filebeat-index-pattern-search-error-in-discover/293264)
**Author:** [@mkay299](https://discuss.elastic.co/u/mkay299)\ **Replies:** 3\ **Last updated:** [January 12, 2022, 10:35am UTC](https://discuss.elastic.co/t/filebeat-index-pattern-search-error-in-discover/293264 "2022-01-12T10:35:36Z")
So I had some issues with my filebeat-\* index it wasn't updating on the new fields correctly so I deleted it and remade it. after I recreated it I get the following error in discovery. and none of the dashboards work a… --- ## [Unable to generate csv report from discover](https://discuss.elastic.co/t/unable-to-generate-csv-report-from-discover/293623)
**Author:** [@nfxitglobal](https://discuss.elastic.co/u/nfxitglobal)\ **Replies:** 1\ **Last updated:** [January 12, 2022, 10:27am UTC](https://discuss.elastic.co/t/unable-to-generate-csv-report-from-discover/293623 "2022-01-12T10:27:33Z")
Hi Pressing the generate csv report failing with the below error...any idea? Service Unavailable http\_fetch\_error\_HttpFetchError@http://localhost:5601/46307/bundles/core/core.entry.js:8:52683 fetchResponse@http://loca… --- ## [Shipping logs of system Linux with Filebeat and Logstash](https://discuss.elastic.co/t/shipping-logs-of-system-linux-with-filebeat-and-logstash/294137)
**Author:** [@Lynow](https://discuss.elastic.co/u/Lynow)\ **Replies:** 0\ **Last updated:** [January 12, 2022, 9:35am UTC](https://discuss.elastic.co/t/shipping-logs-of-system-linux-with-filebeat-and-logstash/294137 "2022-01-12T09:35:05Z")
Hello, I am setting up a log monitoring architecture, for this I am using Opensearch and Kibana to collect all the data. The data is sent by Filebeat, which retrieves the logs from Wazuh (with different agents). I then… --- ## [Stats aggregation on latitude or longitude of a geo\_point](https://discuss.elastic.co/t/stats-aggregation-on-latitude-or-longitude-of-a-geo-point/294070)
**Author:** [@seb\_2](https://discuss.elastic.co/u/seb_2)\ **Replies:** 4\ **Last updated:** [January 12, 2022, 9:30am UTC](https://discuss.elastic.co/t/stats-aggregation-on-latitude-or-longitude-of-a-geo-point/294070 "2022-01-12T09:30:01Z")
Hi I use geo\_point data and I'd like to have stats aggregation on latitude. like "aggs": { "lat": { "avg": { "field": "location.lat" } }, where location is a geo\_… --- ## [Kibana 8.0.0-alpha1](https://discuss.elastic.co/t/kibana-8-0-0-alpha1/293872)
**Author:** [@Abhishek\_Gautam](https://discuss.elastic.co/u/Abhishek_Gautam)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 9:20am UTC](https://discuss.elastic.co/t/kibana-8-0-0-alpha1/293872 "2022-01-12T09:20:51Z")
When installing dependencies for kibana using command : yarn kbn bootstrap --force-install getting the following error: succ yarn.lock analysis completed without any issues \[vscode\] succ updated /home/elastic/Abhishe… --- ## [Different Values in Kibana Table from Kibana Discover](https://discuss.elastic.co/t/different-values-in-kibana-table-from-kibana-discover/294051)
**Author:** [@Avnish\_Singh](https://discuss.elastic.co/u/Avnish_Singh)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 9:19am UTC](https://discuss.elastic.co/t/different-values-in-kibana-table-from-kibana-discover/294051 "2022-01-12T09:19:05Z")
Hi, I am getting a deviation in values in Kibana Visualize and Kibana Discover. Here is the screenshot for the value on 01-01-2022 00:00:00 The value on 02-01-2022 00:00:00 While in the Visualization they do not… --- ## [Elasticsearch integration tests with Jest](https://discuss.elastic.co/t/elasticsearch-integration-tests-with-jest/294064)
**Author:** [@kabethy](https://discuss.elastic.co/u/kabethy)\ **Replies:** 3\ **Last updated:** [January 12, 2022, 9:14am UTC](https://discuss.elastic.co/t/elasticsearch-integration-tests-with-jest/294064 "2022-01-12T09:14:24Z")
Hi, I am using Elasticsearch (Opensearch) in a Nx monorepo in a node js serverless app that connects to aws services. I would like to use jest to test but so far I have not been able to get responses from Opensearch. … --- ## [Customization winlogbeat 7.16.2 on windows server](https://discuss.elastic.co/t/customization-winlogbeat-7-16-2-on-windows-server/294110)
**Author:** [@holpa](https://discuss.elastic.co/u/holpa)\ **Replies:** 0\ **Last updated:** [January 12, 2022, 5:28am UTC](https://discuss.elastic.co/t/customization-winlogbeat-7-16-2-on-windows-server/294110 "2022-01-12T05:28:01Z")
Hello. Tell me how to set it up correctly. There is a server srvlog, it collects all logs from domain controllers (forward event). How to configure WinLogbeat to send logs received by this server? My config now: winlo… [Previous page](https://discuss.elastic.co/latest.md?page=1310) [Next page](https://discuss.elastic.co/latest.md?page=1312)