# Latest **URL:** https://discuss.elastic.co/latest.md?page=1360 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1361 --- ## [How to set network.host to listen to IPv6 as well?](https://discuss.elastic.co/t/how-to-set-network-host-to-listen-to-ipv6-as-well/290923)
**Author:** [@houmie](https://discuss.elastic.co/u/houmie)\ **Replies:** 3\ **Last updated:** [December 6, 2021, 3:59pm UTC](https://discuss.elastic.co/t/how-to-set-network-host-to-listen-to-ipv6-as-well/290923 "2021-12-06T15:59:53Z")
Hello, After struggling for hours why Filebeat can't connect to ES, I realised that this setting in elasticsearch.yaml is the culprit. It is only listening to IPv4 and not IPv6. network.host: 0.0.0.0 I tried many d… --- ## [Shards setup with app search](https://discuss.elastic.co/t/shards-setup-with-app-search/290610)
**Author:** [@Patrice\_G](https://discuss.elastic.co/u/Patrice_G)\ **Replies:** 3\ **Last updated:** [December 6, 2021, 2:26pm UTC](https://discuss.elastic.co/t/shards-setup-with-app-search/290610 "2021-12-06T14:26:28Z")
I have about 100M documents using App Search. Performance is very bad. I need more elasticsearch nodes (cpu, ram disk,...), and I need to increase the number of elasticsearch shards for my index. I saw app search creat… --- ## [How to know which GeoPoint is hit while sorting on GeoPoint field containing multiple points](https://discuss.elastic.co/t/how-to-know-which-geopoint-is-hit-while-sorting-on-geopoint-field-containing-multiple-points/291052)
**Author:** [@Asif\_Mahmood](https://discuss.elastic.co/u/Asif_Mahmood)\ **Replies:** 0\ **Last updated:** [December 6, 2021, 2:08pm UTC](https://discuss.elastic.co/t/how-to-know-which-geopoint-is-hit-while-sorting-on-geopoint-field-containing-multiple-points/291052 "2021-12-06T14:08:14Z")
HI, I am new at using Elasticsearch. I have an index which has the GeoPoint field "Location" and each document can contains multiple points which are stored in GeoPoint field as array. Now, when I sort on the basis of t… --- ## [How to parse timestamp windows event log](https://discuss.elastic.co/t/how-to-parse-timestamp-windows-event-log/291043)
**Author:** [@Roccof97](https://discuss.elastic.co/u/Roccof97)\ **Replies:** 3\ **Last updated:** [December 6, 2021, 2:07pm UTC](https://discuss.elastic.co/t/how-to-parse-timestamp-windows-event-log/291043 "2021-12-06T14:07:23Z")
Hello to all, I have a problem with parsing this field(event.created) with the timestamp, here is the screen: this is the filter I created: thanks --- ## [APM agents together with Dynatrace breaks APM visualisation](https://discuss.elastic.co/t/apm-agents-together-with-dynatrace-breaks-apm-visualisation/290738)
**Author:** [@lancer\_enkor](https://discuss.elastic.co/u/lancer_enkor)\ **Replies:** 5\ **Last updated:** [December 6, 2021, 2:00pm UTC](https://discuss.elastic.co/t/apm-agents-together-with-dynatrace-breaks-apm-visualisation/290738 "2021-12-06T14:00:05Z")
I have the following situation: I have distributed tracing enabled on APM agents and also on Dynatrace. Everything seems working together except for waterfall visualization in Kibana. I tried to dig more into the pro… --- ## [Map keyword values for display](https://discuss.elastic.co/t/map-keyword-values-for-display/291042)
**Author:** [@Senor\_K2n](https://discuss.elastic.co/u/Senor_K2n)\ **Replies:** 2\ **Last updated:** [December 6, 2021, 1:54pm UTC](https://discuss.elastic.co/t/map-keyword-values-for-display/291042 "2021-12-06T13:54:31Z")
Hi, I'm relatively new to working with ELK, and I haven't found a response to this question yet. For storage optimization reasons, I want to use some aliases in my input files to store fixed values. However I would li… --- ## [Prometheus queries fail if a source only snapshot was restored](https://discuss.elastic.co/t/prometheus-queries-fail-if-a-source-only-snapshot-was-restored/291046)
**Author:** [@str8y](https://discuss.elastic.co/u/str8y)\ **Replies:** 0\ **Last updated:** [December 6, 2021, 1:30pm UTC](https://discuss.elastic.co/t/prometheus-queries-fail-if-a-source-only-snapshot-was-restored/291046 "2021-12-06T13:30:00Z")
As part of our backup strategy, we are using source only repos and snapshots. As soon as such a snapshot is restored, the prometheus queries fail. Is there any chance to filter / skip these indices for the metrics? \[2… --- ## [Error: a container name must be specified for pod elk-monitoring-es-hot-0](https://discuss.elastic.co/t/error-a-container-name-must-be-specified-for-pod-elk-monitoring-es-hot-0/291038)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 4\ **Last updated:** [December 6, 2021, 1:13pm UTC](https://discuss.elastic.co/t/error-a-container-name-must-be-specified-for-pod-elk-monitoring-es-hot-0/291038 "2021-12-06T13:13:29Z")
Hi, On GCP Autopilot Cluster(v1.21.5) I have deployed via ECK(1.8) Elasticserach server using this config .yaml metadata: name: elk-monitoring namespace: xx spec: monitoring: metrics: elasticsearchRefs:… --- ## [Logstash output plugin for azure eventhub](https://discuss.elastic.co/t/logstash-output-plugin-for-azure-eventhub/291035)
**Author:** [@Mye1988](https://discuss.elastic.co/u/Mye1988)\ **Replies:** 0\ **Last updated:** [December 6, 2021, 11:59am UTC](https://discuss.elastic.co/t/logstash-output-plugin-for-azure-eventhub/291035 "2021-12-06T11:59:12Z")
Hello Everyone, I need to use logstash for sending data to Azure Event Hub.As much as I found, there is only an input plugin for reading data from Azure Hub. Is there a logstash output plugin for sending data to Azure … --- ## [Api/index\_patterns/\_fields\_for\_wildcard crashes Elasticsearch](https://discuss.elastic.co/t/api-index-patterns-fields-for-wildcard-crashes-elasticsearch/290908)
**Author:** [@rilcy](https://discuss.elastic.co/u/rilcy)\ **Replies:** 4\ **Last updated:** [December 6, 2021, 11:34am UTC](https://discuss.elastic.co/t/api-index-patterns-fields-for-wildcard-crashes-elasticsearch/290908 "2021-12-06T11:34:13Z")
Hi everyone, Could not find any post relating the problem i encounter so i here it is: Since a while i am unable to use Discover tab in Kibana ; when i try to, it basically crashes the Elasticsearch coordinating node w… --- ## [Filebeat decode\_json\_fields failed](https://discuss.elastic.co/t/filebeat-decode-json-fields-failed/291019)
**Author:** [@haoma2514](https://discuss.elastic.co/u/haoma2514)\ **Replies:** 0\ **Last updated:** [December 6, 2021, 8:25am UTC](https://discuss.elastic.co/t/filebeat-decode-json-fields-failed/291019 "2021-12-06T08:25:25Z")
If the length of the message above is greater than 1116, it will be lost after formatting! When using filebeat decode\_json\_fields to parse json object, if the field content of json key is too long, it will be discarde… --- ## [New Elasticsearch installation takes all memory during the startup results get killed by OOM (7.15.2)](https://discuss.elastic.co/t/new-elasticsearch-installation-takes-all-memory-during-the-startup-results-get-killed-by-oom-7-15-2/291010)
**Author:** [@cryonix\_pod](https://discuss.elastic.co/u/cryonix_pod)\ **Replies:** 6\ **Last updated:** [December 6, 2021, 10:57am UTC](https://discuss.elastic.co/t/new-elasticsearch-installation-takes-all-memory-during-the-startup-results-get-killed-by-oom-7-15-2/291010 "2021-12-06T10:57:08Z")
I was trying to install Elasticsearch last few hours and I was unable to do so. It turns out systemd got timed out trying to start the elasticsearch service. Initially I was trying to install it in a vm of 2 Gig mem (ora… --- ## [Rally 2.3.0 now throwing "should include an inner object describing the mapping" but 2.2.1 was fine?](https://discuss.elastic.co/t/rally-2-3-0-now-throwing-should-include-an-inner-object-describing-the-mapping-but-2-2-1-was-fine/290714)
**Author:** [@ddtombb](https://discuss.elastic.co/u/ddtombb)\ **Replies:** 3\ **Last updated:** [December 6, 2021, 10:28am UTC](https://discuss.elastic.co/t/rally-2-3-0-now-throwing-should-include-an-inner-object-describing-the-mapping-but-2-2-1-was-fine/290714 "2021-12-06T10:28:33Z")
Hey, when I was running rally on 2.2.1 it would run fine without issue but as I'm not specifying a version to use it picked up the latest 2.3.0 and now on run is throwing the following, but I don't get how the templates … --- ## [Queries for shard allocation failure](https://discuss.elastic.co/t/queries-for-shard-allocation-failure/291022)
**Author:** [@pratiksha](https://discuss.elastic.co/u/pratiksha)\ **Replies:** 4\ **Last updated:** [December 6, 2021, 10:27am UTC](https://discuss.elastic.co/t/queries-for-shard-allocation-failure/291022 "2021-12-06T10:27:24Z")
I am using Elasticsearch v7.10.2. I have cluster running with many unassigned shards. I want to determine the number of retries that has already finished for the shards. Is there any way to check that as in how many retr… --- ## [How to remove fields with - values in logstash filter?](https://discuss.elastic.co/t/how-to-remove-fields-with-values-in-logstash-filter/290879)
**Author:** [@Anusha\_Kusanghi](https://discuss.elastic.co/u/Anusha_Kusanghi)\ **Replies:** 4\ **Last updated:** [December 6, 2021, 9:58am UTC](https://discuss.elastic.co/t/how-to-remove-fields-with-values-in-logstash-filter/290879 "2021-12-06T09:58:35Z")
I have a patterns like : 2021-10-15 20:00:13 2396 tstur1 /ftp/workspace/ this is message 2020-10-15 18:00:13 - - this is the second message The fields are Date, Time, SessionId, path and message. The grok pattern use… --- ## [Try to Parsing Postfix Log Using Logstash](https://discuss.elastic.co/t/try-to-parsing-postfix-log-using-logstash/288397)
**Author:** [@RichYaNa](https://discuss.elastic.co/u/RichYaNa)\ **Replies:** 6\ **Last updated:** [December 6, 2021, 9:48am UTC](https://discuss.elastic.co/t/try-to-parsing-postfix-log-using-logstash/288397 "2021-12-06T09:48:12Z")
Hi, I'm currently parsing postfix logs using Logstash, you can check my config file here. and here is a sample log that I will parse: Nov 4 08:51:20 mail /postfix-script\[XPIDX\]: the Postfix mail system is running: PI… --- ## [Ingesting ECS ndjson via http\_endpoint?](https://discuss.elastic.co/t/ingesting-ecs-ndjson-via-http-endpoint/291023)
**Author:** [@Matthias\_W](https://discuss.elastic.co/u/Matthias_W)\ **Replies:** 0\ **Last updated:** [December 6, 2021, 9:13am UTC](https://discuss.elastic.co/t/ingesting-ecs-ndjson-via-http-endpoint/291023 "2021-12-06T09:13:02Z")
Hi, I have a C++ application with a custom logging framework. I was able to modify the framework quite easily to produce ECS-formatted JSON messages. Now, I am trying to use FileBeat to load these log messages into Ela… --- ## [Strange cluster behaviour](https://discuss.elastic.co/t/strange-cluster-behaviour/291011)
**Author:** [@Ain\_Ryushika](https://discuss.elastic.co/u/Ain_Ryushika)\ **Replies:** 5\ **Last updated:** [December 6, 2021, 8:39am UTC](https://discuss.elastic.co/t/strange-cluster-behaviour/291011 "2021-12-06T08:39:05Z")
Hello, we have experiencing strange claster behavior. If you look at the charts, the main indicators are falling. Such as query time, total operation stats, network usage. As if the load on the cluster is reduced. But… --- ## [List of users by role?](https://discuss.elastic.co/t/list-of-users-by-role/291021)
**Author:** [@Seba](https://discuss.elastic.co/u/Seba)\ **Replies:** 0\ **Last updated:** [December 6, 2021, 8:35am UTC](https://discuss.elastic.co/t/list-of-users-by-role/291021 "2021-12-06T08:35:02Z")
Hello, Is there a simple way, a command to list all users for a specific role? Kind regards, Sebastien --- ## [Data Analysis with Kibana (On-demand) Lab 4.1: index not available](https://discuss.elastic.co/t/data-analysis-with-kibana-on-demand-lab-4-1-index-not-available/290968)
**Author:** [@rinnes](https://discuss.elastic.co/u/rinnes)\ **Replies:** 1\ **Last updated:** [December 6, 2021, 8:17am UTC](https://discuss.elastic.co/t/data-analysis-with-kibana-on-demand-lab-4-1-index-not-available/290968 "2021-12-06T08:17:51Z")
I'm trying to create an index pattern for "apachelogs\*" logs, but it does not match any indices. When I check Index Management, I don't see any indices whose name contains "apachelogs". Is my lab missing data? Is ther… --- ## [Dec 6th, 2021: \[en\] Using OSQuery in Elastic Stack](https://discuss.elastic.co/t/dec-6th-2021-en-using-osquery-in-elastic-stack/290456)
**Author:** [@aravindputrevu](https://discuss.elastic.co/u/aravindputrevu)\ **Replies:** 0\ **Last updated:** [December 6, 2021, 8:00am UTC](https://discuss.elastic.co/t/dec-6th-2021-en-using-osquery-in-elastic-stack/290456 "2021-12-06T08:00:42Z")
What is Osquery? Osquery is a Opensource project developed from Facebook. As the name suggests, Osquery helps in querying the Operating System resources using SQL. It exposes the underlying Operating system concepts like… --- ## [Filebeat with minimal security on ELK](https://discuss.elastic.co/t/filebeat-with-minimal-security-on-elk/290088)
**Author:** [@Lavandael](https://discuss.elastic.co/u/Lavandael)\ **Replies:** 5\ **Last updated:** [December 6, 2021, 7:39am UTC](https://discuss.elastic.co/t/filebeat-with-minimal-security-on-elk/290088 "2021-12-06T07:39:46Z")
Hello everyone, I am using one ELK stack into only one Centos server. I tried to follow this tutorial : security-minimal-setup So i added this xpack.security.enabled: true discovery.type: single-node into the Elast… --- ## [States condition to be allowed to write into index](https://discuss.elastic.co/t/states-condition-to-be-allowed-to-write-into-index/290891)
**Author:** [@sebastienf](https://discuss.elastic.co/u/sebastienf)\ **Replies:** 2\ **Last updated:** [December 6, 2021, 7:25am UTC](https://discuss.elastic.co/t/states-condition-to-be-allowed-to-write-into-index/290891 "2021-12-06T07:25:59Z")
Hi, I want to bulk-insert into an index. This index is made of 3 shards (0, 1, 2) and 1 replica distributed over 2 nodes as follow : N1: shard 0 p shard 1 r shard 2 p N2 : shard 0 r shard 1 p shard 2 r I loose… --- ## [Error in threshold rules when using ECS](https://discuss.elastic.co/t/error-in-threshold-rules-when-using-ecs/290899)
**Author:** [@nameless](https://discuss.elastic.co/u/nameless)\ **Replies:** 2\ **Last updated:** [December 6, 2021, 7:12am UTC](https://discuss.elastic.co/t/error-in-threshold-rules-when-using-ecs/290899 "2021-12-06T07:12:33Z")
Hello The following error occurs when the rule is running. Please help me understand the reason Bulk Indexing of signals failed: Could not dynamically add mapping for field \[source.ip.keyword\]. Existing mapping for \[s… --- ## [Configuring multiple metricbeats host instances with one elasticsearch and Kibana system dashboard](https://discuss.elastic.co/t/configuring-multiple-metricbeats-host-instances-with-one-elasticsearch-and-kibana-system-dashboard/290846)
**Author:** [@Brendon\_Fernandes](https://discuss.elastic.co/u/Brendon_Fernandes)\ **Replies:** 2\ **Last updated:** [December 6, 2021, 4:33am UTC](https://discuss.elastic.co/t/configuring-multiple-metricbeats-host-instances-with-one-elasticsearch-and-kibana-system-dashboard/290846 "2021-12-06T04:33:12Z")
Hi, I'm trying to configure system metrics from multiple (3) systems via metricbeats + Elasticsearch \_Kibana (ver 7.15.1 ). However, the index in which it gets into is the default index metricbeat-\* My requirement is to… --- ## [Unable start elasticsearch](https://discuss.elastic.co/t/unable-start-elasticsearch/290940)
**Author:** [@karthick\_kn](https://discuss.elastic.co/u/karthick_kn)\ **Replies:** 4\ **Last updated:** [December 6, 2021, 5:57am UTC](https://discuss.elastic.co/t/unable-start-elasticsearch/290940 "2021-12-06T05:57:09Z")
here I attached my log sudo tail -f /var/log/elasticsearch/my-application.log \[2021-12-03T17:10:26,220\]\[INFO \]\[o.e.x.w.WatcherService \] \[node-1\] stopping watch service, reason \[shutdown initiated\] \[2021-12-03T17:10:2… --- ## [Adding disk mounts to metricbeat system module](https://discuss.elastic.co/t/adding-disk-mounts-to-metricbeat-system-module/290849)
**Author:** [@kshepitzki1](https://discuss.elastic.co/u/kshepitzki1)\ **Replies:** 2\ **Last updated:** [December 6, 2021, 5:52am UTC](https://discuss.elastic.co/t/adding-disk-mounts-to-metricbeat-system-module/290849 "2021-12-06T05:52:49Z")
Trying to configure the metricbeat system module to monitor additional mounted drives for free disk space % on Linux. This document does not help: https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-metr… --- ## [Logstash upgrade crashing (6.4.2--\> 6.8.20)](https://discuss.elastic.co/t/logstash-upgrade-crashing-6-4-2-6-8-20/290360)
**Author:** [@arunpatchaivy](https://discuss.elastic.co/u/arunpatchaivy)\ **Replies:** 1\ **Last updated:** [December 6, 2021, 5:30am UTC](https://discuss.elastic.co/t/logstash-upgrade-crashing-6-4-2-6-8-20/290360 "2021-12-06T05:30:48Z")
we are trying to upgrade logstash to new version we doing 2 step upgrade 6.4.2 --\> 6.8.2 --\> 7.15.2 we have downloaded rpm based installer and performed upgrade. Currently we are stuck at logstash version 6.8.2 . we are… --- ## [Sum of each element of array](https://discuss.elastic.co/t/sum-of-each-element-of-array/291009)
**Author:** [@Dimple\_Goyal](https://discuss.elastic.co/u/Dimple_Goyal)\ **Replies:** 2\ **Last updated:** [December 6, 2021, 5:13am UTC](https://discuss.elastic.co/t/sum-of-each-element-of-array/291009 "2021-12-06T05:13:52Z")
I'm trying to use an Elasticsearch aggregation to 'merge' an array of integers based on a set of filters. I have documents that look like: { "arr": \[5, 4, 3, 2, 1\], "name": "test" } { "arr": \[4, 3, 2, 1, 0\], "na… --- ## [Spike Search is too often in elastic](https://discuss.elastic.co/t/spike-search-is-too-often-in-elastic/291007)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 8\ **Last updated:** [December 6, 2021, 5:06am UTC](https://discuss.elastic.co/t/spike-search-is-too-often-in-elastic/291007 "2021-12-06T05:06:31Z")
Hello Everobody, I just want to know, if Elasticsearch there is often a spike like this. What caused of it? can anyone explain to me? FYI: i'm newbie in elastic [Previous page](https://discuss.elastic.co/latest.md?page=1359) [Next page](https://discuss.elastic.co/latest.md?page=1361)