# Latest **URL:** https://discuss.elastic.co/latest.md?page=1365 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1366 --- ## [Filebeat update and resending of logs](https://discuss.elastic.co/t/filebeat-update-and-resending-of-logs/290803)
**Author:** [@CyberSeppi](https://discuss.elastic.co/u/CyberSeppi)\ **Replies:** 0\ **Last updated:** [December 2, 2021, 5:46pm UTC](https://discuss.elastic.co/t/filebeat-update-and-resending-of-logs/290803 "2021-12-02T17:46:53Z")
Hi all, just wanted to ask, if you think that scenario feasable. and more interesting would be, how :slight\_smile: I have an ansible project which installs/update filebeat on target machine. Due to the non-generic setu… --- ## [Error saying request body or source is required](https://discuss.elastic.co/t/error-saying-request-body-or-source-is-required/147523)
**Author:** [@chitresh\_jain](https://discuss.elastic.co/u/chitresh_jain)\ **Replies:** 3\ **Last updated:** [December 2, 2021, 5:27pm UTC](https://discuss.elastic.co/t/error-saying-request-body-or-source-is-required/147523 "2021-12-02T17:27:20Z")
So I am testing my analyzer after I created it successfully using - { "settings" : { "analysis": { "filter": { "autocomplete\_filter" : { "type" : "edge\_ngram", "min\_gram" : 1, "max\_gram" : 20 } }, "analyzer":… --- ## [APM Agent logs shown on Discover but not on APM UI](https://discuss.elastic.co/t/apm-agent-logs-shown-on-discover-but-not-on-apm-ui/289706)
**Author:** [@jorsec](https://discuss.elastic.co/u/jorsec)\ **Replies:** 14\ **Last updated:** [December 2, 2021, 1:55pm UTC](https://discuss.elastic.co/t/apm-agent-logs-shown-on-discover-but-not-on-apm-ui/289706 "2021-12-02T13:55:03Z")
Hello all, Currently i am using ELK APM for my java application running on tomcat, with centos 7 as a linux distrubution and its my fresh installation but while apm java agent transfer the logs to apm server -\> elastrics… --- ## [Alerts on kubernetes.node.status. fields](https://discuss.elastic.co/t/alerts-on-kubernetes-node-status-fields/290780)
**Author:** [@Hakim](https://discuss.elastic.co/u/Hakim)\ **Replies:** 2\ **Last updated:** [December 2, 2021, 4:49pm UTC](https://discuss.elastic.co/t/alerts-on-kubernetes-node-status-fields/290780 "2021-12-02T16:49:33Z")
Hi Elastic team, I'm looking to add alerts on boolean fields of kubernetes nodes starting with kubernetes.node.status. but when I try to create alerte rule for these fields there is no condition in Metric threshold for t… --- ## [Help with Winlogbeat and filtering computer accounts](https://discuss.elastic.co/t/help-with-winlogbeat-and-filtering-computer-accounts/290792)
**Author:** [@joachim\_johannesen](https://discuss.elastic.co/u/joachim_johannesen)\ **Replies:** 0\ **Last updated:** [December 2, 2021, 3:57pm UTC](https://discuss.elastic.co/t/help-with-winlogbeat-and-filtering-computer-accounts/290792 "2021-12-02T15:57:48Z")
I have a few ELK stacks up and running but I'm getting a lot of false 'Admin User Sessions' which are the computer accounts eg computer$. I'm using Windows Event forwarding to send all security related events over to my … --- ## [Given Apache logs in ES, how do I get Visitor Stay Length for each URL](https://discuss.elastic.co/t/given-apache-logs-in-es-how-do-i-get-visitor-stay-length-for-each-url/290762)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 3\ **Last updated:** [December 2, 2021, 3:57pm UTC](https://discuss.elastic.co/t/given-apache-logs-in-es-how-do-i-get-visitor-stay-length-for-each-url/290762 "2021-12-02T15:57:45Z")
Given Apache logs in ES, how do I get Visitor Stay Length for each URL Apache logs: 222.105.82.235 - - \[16/Nov/2021:10:04:37 +0530\] "GET /admin/ HTTP/1.1" 301 529 "http://facebook.com/admin/" "Mozilla/5.0 (Windows NT 1… --- ## [Elasticsearch-curator 5.8.2 is failing during TypeError: load() missing 1 required positional argument: 'Loader'](https://discuss.elastic.co/t/elasticsearch-curator-5-8-2-is-failing-during-typeerror-load-missing-1-required-positional-argument-loader/290608)
**Author:** [@hudar01](https://discuss.elastic.co/u/hudar01)\ **Replies:** 2\ **Last updated:** [December 2, 2021, 3:53pm UTC](https://discuss.elastic.co/t/elasticsearch-curator-5-8-2-is-failing-during-typeerror-load-missing-1-required-positional-argument-loader/290608 "2021-12-02T15:53:49Z")
Hello, I'm trying to execute a dry run for delete snapshot when I got this error: TypeError: load() missing 1 required positional argument: 'Loader' Note that it worked before (like 5 days ago). It started failing afte… --- ## [Dec 2nd, 2021: \[en\] Generating document thumbnails - now Open Source on the JVM](https://discuss.elastic.co/t/dec-2nd-2021-en-generating-document-thumbnails-now-open-source-on-the-jvm/288270)
**Author:** [@Sean\_Story](https://discuss.elastic.co/u/Sean_Story)\ **Replies:** 3\ **Last updated:** [December 2, 2021, 3:49pm UTC](https://discuss.elastic.co/t/dec-2nd-2021-en-generating-document-thumbnails-now-open-source-on-the-jvm/288270 "2021-12-02T15:49:43Z")
Generating document thumbnails - now open source on the JVM It's something that I'd always taken for granted. You work with any sort of file system/file browser/search engine and you just expect to see thumbnail images. … --- ## [Reuse Dashboards accross different indexes in Kibana](https://discuss.elastic.co/t/reuse-dashboards-accross-different-indexes-in-kibana/289513)
**Author:** [@f4d0](https://discuss.elastic.co/u/f4d0)\ **Replies:** 4\ **Last updated:** [December 2, 2021, 2:33pm UTC](https://discuss.elastic.co/t/reuse-dashboards-accross-different-indexes-in-kibana/289513 "2021-12-02T14:33:21Z")
Hi Everyone, I work in Cybersecurity and every week I have different sets of data to ingest that require separated indexes. The data sets are ingested using the exactly same mappings, and everytime I have to draw new d… --- ## [Manage Auditbeat with Elastic-Agent](https://discuss.elastic.co/t/manage-auditbeat-with-elastic-agent/290770)
**Author:** [@marti1](https://discuss.elastic.co/u/marti1)\ **Replies:** 0\ **Last updated:** [December 2, 2021, 1:25pm UTC](https://discuss.elastic.co/t/manage-auditbeat-with-elastic-agent/290770 "2021-12-02T13:25:13Z")
Hi, I have deployed ElasticAgent to my hosts, and now, I would like to use Auditbeat. Is it possible to deploy and manage Auditbeat with ElasticAgent? I have searched for Auditbeat integration and doesn't exist. Than… --- ## [Deployment of a Fleet-Server](https://discuss.elastic.co/t/deployment-of-a-fleet-server/290750)
**Author:** [@Alphonse\_Kambo](https://discuss.elastic.co/u/Alphonse_Kambo)\ **Replies:** 1\ **Last updated:** [December 2, 2021, 2:24pm UTC](https://discuss.elastic.co/t/deployment-of-a-fleet-server/290750 "2021-12-02T14:24:43Z")
Hello All, We installed months ago Filebeat, Auditbeat, Metricbeat, Heartbeat and Packetbeat on our stand-alone Elastic-Server. Now we have deployed a Fleet-server to have some experience with it. Something is not cle… --- ## [\[Grafana\]\[Elastic Search\] :: Plot IPs hitting website with their Distinct Count](https://discuss.elastic.co/t/grafana-elastic-search-plot-ips-hitting-website-with-their-distinct-count/290675)
**Author:** [@thejusjose-mindcurv](https://discuss.elastic.co/u/thejusjose-mindcurv)\ **Replies:** 1\ **Last updated:** [December 2, 2021, 2:07pm UTC](https://discuss.elastic.co/t/grafana-elastic-search-plot-ips-hitting-website-with-their-distinct-count/290675 "2021-12-02T14:07:35Z")
Hi all, Requirement Get the Top hitting IPs and their count and visualize in Grafana We had this implemented already in Kibana visualization where we have metrics and buckets to filter out the required fields. We a… --- ## [Fleet server, connection limits and duplicate agents](https://discuss.elastic.co/t/fleet-server-connection-limits-and-duplicate-agents/290771)
**Author:** [@blinder](https://discuss.elastic.co/u/blinder)\ **Replies:** 0\ **Last updated:** [December 2, 2021, 1:47pm UTC](https://discuss.elastic.co/t/fleet-server-connection-limits-and-duplicate-agents/290771 "2021-12-02T13:47:02Z")
Hi We recently enrolled about 300 fleet clients to our On-Prem ECE cluster, enrollment seems to be working fine but duplicates( marked as offline) are spawning en mass. Data are being ingested from machines with double … --- ## [Getting issue during running a api command](https://discuss.elastic.co/t/getting-issue-during-running-a-api-command/290142)
**Author:** [@Linuxuser](https://discuss.elastic.co/u/Linuxuser)\ **Replies:** 10\ **Last updated:** [December 2, 2021, 1:44pm UTC](https://discuss.elastic.co/t/getting-issue-during-running-a-api-command/290142 "2021-12-02T13:44:10Z")
http://192.168.1.211:9000/api/sources?range=36000&size=5000 By running this command getting issue. "ElasticsearchException{message=Unable to perform search query\\n\\n\[parent\] Data too large, data for \[\… --- ## [Query regarding azure monitor\_service.go based logging in metricbeat](https://discuss.elastic.co/t/query-regarding-azure-monitor-service-go-based-logging-in-metricbeat/289804)
**Author:** [@adhiraj-g](https://discuss.elastic.co/u/adhiraj-g)\ **Replies:** 2\ **Last updated:** [December 2, 2021, 1:33pm UTC](https://discuss.elastic.co/t/query-regarding-azure-monitor-service-go-based-logging-in-metricbeat/289804 "2021-12-02T13:33:43Z")
Hi @Kaiyan\_Sheng / @MarianaD , Hope you both are doing well. While checking metricbeat logs, i observed the following line: 2021-11-22T06:27:25.307-0500 WARN \[azure monitor service\] azure/monitor\_service.go:130 … --- ## [Using logstash for transferring data to Azure Eventhub](https://discuss.elastic.co/t/using-logstash-for-transferring-data-to-azure-eventhub/290769)
**Author:** [@aeoker](https://discuss.elastic.co/u/aeoker)\ **Replies:** 0\ **Last updated:** [December 2, 2021, 1:08pm UTC](https://discuss.elastic.co/t/using-logstash-for-transferring-data-to-azure-eventhub/290769 "2021-12-02T13:08:13Z")
Hello Everyone, I need to use logstash for sending data to Azure Event Hub.As much as I found, there is only an input plugin for reading data from Azure Hub. Is there a logstash output plugin for sending data to Az… --- ## [Filebeat setup creates more than one write index - ILM](https://discuss.elastic.co/t/filebeat-setup-creates-more-than-one-write-index-ilm/290679)
**Author:** [@JGreene](https://discuss.elastic.co/u/JGreene)\ **Replies:** 3\ **Last updated:** [December 2, 2021, 1:06pm UTC](https://discuss.elastic.co/t/filebeat-setup-creates-more-than-one-write-index-ilm/290679 "2021-12-02T13:06:04Z")
Filebeat should not attempt to create / recreate write index if a write index exists. As indices age out with ILM policies and are deleted, subsequent runs of filebeat setup attempt to create the default index of -000001 … --- ## [Color palette Tag Cloud in canvas](https://discuss.elastic.co/t/color-palette-tag-cloud-in-canvas/290765)
**Author:** [@MTV](https://discuss.elastic.co/u/MTV)\ **Replies:** 0\ **Last updated:** [December 2, 2021, 12:23pm UTC](https://discuss.elastic.co/t/color-palette-tag-cloud-in-canvas/290765 "2021-12-02T12:23:08Z")
Hi, I have a word cloud built in kibana that I want to bring to canvas, which so far is working properly. My questions are reagrding the color of the cloud, and the filters used in canvas. Let's say I have a dropdown w… --- ## [How to setup client node and Loadbalancer in ECK setup?](https://discuss.elastic.co/t/how-to-setup-client-node-and-loadbalancer-in-eck-setup/290732)
**Author:** [@manu\_john](https://discuss.elastic.co/u/manu_john)\ **Replies:** 3\ **Last updated:** [December 2, 2021, 12:10pm UTC](https://discuss.elastic.co/t/how-to-setup-client-node-and-loadbalancer-in-eck-setup/290732 "2021-12-02T12:10:54Z")
I have ECK setup with master and data nodes, how to add client node and a loadbalancer to the existing setup? Any sample code will be appreciated --- ## [Scripted field error al crear](https://discuss.elastic.co/t/scripted-field-error-al-crear/290667)
**Author:** [@Javier\_Garcia\_Alvare](https://discuss.elastic.co/u/Javier_Garcia_Alvare)\ **Replies:** 5\ **Last updated:** [December 2, 2021, 11:14am UTC](https://discuss.elastic.co/t/scripted-field-error-al-crear/290667 "2021-12-02T11:14:31Z")
Buenos días, soy nuevo en el manejo y estoy intentado crear un scripted field y me da error. Alguien me puede ayudar, Gracias. Nombre scripted\_field: PRUEBA if(doc\['CAMPO'\].value.toString().substring(0,5)==("valor")){… --- ## [Question about latency and response time](https://discuss.elastic.co/t/question-about-latency-and-response-time/290753)
**Author:** [@Ain\_Ryushika](https://discuss.elastic.co/u/Ain_Ryushika)\ **Replies:** 0\ **Last updated:** [December 2, 2021, 10:56am UTC](https://discuss.elastic.co/t/question-about-latency-and-response-time/290753 "2021-12-02T10:56:53Z")
Hi, I have 2 question regarding latency and response time in Elasticsearch. Why on different monitoring clients there are different response time? For example in Kibana average request time is 700ms: In Graphana a… --- ## [Forwarding logs from 4.7 to external logstash via filebeat](https://discuss.elastic.co/t/forwarding-logs-from-4-7-to-external-logstash-via-filebeat/290751)
**Author:** [@sabarivijay88](https://discuss.elastic.co/u/sabarivijay88)\ **Replies:** 0\ **Last updated:** [December 2, 2021, 10:36am UTC](https://discuss.elastic.co/t/forwarding-logs-from-4-7-to-external-logstash-via-filebeat/290751 "2021-12-02T10:36:17Z")
Hi Team, We have deployed filebeat v7.15 daemon sets on Openshift v4.7 We are able to connect external logstash by using default path: /var/log/containers/\*.log We need to setup only one particular Openshift project a… --- ## [Activemq module configuration](https://discuss.elastic.co/t/activemq-module-configuration/290540)
**Author:** [@kpanguila](https://discuss.elastic.co/u/kpanguila)\ **Replies:** 6\ **Last updated:** [December 2, 2021, 10:16am UTC](https://discuss.elastic.co/t/activemq-module-configuration/290540 "2021-12-02T10:16:58Z")
Hello, i hope you are doing great, i am facing an issues on configure my activemq module. i am getting the following error on discover: failed to unmarshal jolokia JSON response '{"error\_type":"java.lang.Exception","er… --- ## [Monitoring ELK Cluster on OpenShift](https://discuss.elastic.co/t/monitoring-elk-cluster-on-openshift/288930)
**Author:** [@gbschenkel](https://discuss.elastic.co/u/gbschenkel)\ **Replies:** 2\ **Last updated:** [December 2, 2021, 9:32am UTC](https://discuss.elastic.co/t/monitoring-elk-cluster-on-openshift/288930 "2021-12-02T09:32:55Z")
Hi, I have successful deployed Elasticsearch and Kibana on OpenShift, I am currently using internal metrics to get info from Elasticsearch and Kibana nodes. Since Elasticsearch will drop the internal metric and 8.0.0 is … --- ## [Metricbeat Prometheus Autodiscovery](https://discuss.elastic.co/t/metricbeat-prometheus-autodiscovery/290465)
**Author:** [@Lance\_Z](https://discuss.elastic.co/u/Lance_Z)\ **Replies:** 2\ **Last updated:** [December 2, 2021, 9:16am UTC](https://discuss.elastic.co/t/metricbeat-prometheus-autodiscovery/290465 "2021-12-02T09:16:40Z")
Trying to get metricbeat to scrape prometheus metrics from a service running in EKS. I have followed examples and docs to no avail. And probably many others... I am using the official Helm charts to deploy metricbea… --- ## [Unable to run quickstart on bare metal k8s with error "Failed to apply spec change: adjust resources: adjust discovery config: Operation cannot be fulfilled on..."](https://discuss.elastic.co/t/unable-to-run-quickstart-on-bare-metal-k8s-with-error-failed-to-apply-spec-change-adjust-resources-adjust-discovery-config-operation-cannot-be-fulfilled-on/290049)
**Author:** [@Mehmet\_Giritli](https://discuss.elastic.co/u/Mehmet_Giritli)\ **Replies:** 1\ **Last updated:** [December 2, 2021, 9:14am UTC](https://discuss.elastic.co/t/unable-to-run-quickstart-on-bare-metal-k8s-with-error-failed-to-apply-spec-change-adjust-resources-adjust-discovery-config-operation-cannot-be-fulfilled-on/290049 "2021-12-02T09:14:32Z")
I'm trying to install Elasticsearch quickstart on bare metal kubernetes and es pods remain in a "Init:CrashLoopBackOff" state and never start. What I discovered as you can see from events log, is a message saying "Faile… --- ## [Exiting: Index management requested but the Elasticsearch output is not configured/enabled](https://discuss.elastic.co/t/exiting-index-management-requested-but-the-elasticsearch-output-is-not-configured-enabled/290684)
**Author:** [@adouren](https://discuss.elastic.co/u/adouren)\ **Replies:** 2\ **Last updated:** [December 2, 2021, 8:41am UTC](https://discuss.elastic.co/t/exiting-index-management-requested-but-the-elasticsearch-output-is-not-configured-enabled/290684 "2021-12-02T08:41:50Z")
Hi, I configured filebeat.yml with logstash output but I got this error: Exiting: Index management requested but the Elasticsearch output is not configured/enabled filebeat.yml filebeat.config: modules: path: ${… --- ## [Elasticsearch fuzziness with multi\_match and bool\_prefix type](https://discuss.elastic.co/t/elasticsearch-fuzziness-with-multi-match-and-bool-prefix-type/290735)
**Author:** [@konman1989](https://discuss.elastic.co/u/konman1989)\ **Replies:** 0\ **Last updated:** [December 2, 2021, 7:35am UTC](https://discuss.elastic.co/t/elasticsearch-fuzziness-with-multi-match-and-bool-prefix-type/290735 "2021-12-02T07:35:39Z")
I have a set of search\_as\_you\_type\_fields I need to search against. Here is my mapping "mappings" : { "properties" : { "description" : { "type" : "search\_as\_you\_type", "doc\_values" : fa… --- ## [Filebeat takes hours to start harvesting logs after restart](https://discuss.elastic.co/t/filebeat-takes-hours-to-start-harvesting-logs-after-restart/290693)
**Author:** [@Dancho](https://discuss.elastic.co/u/Dancho)\ **Replies:** 0\ **Last updated:** [December 1, 2021, 4:17pm UTC](https://discuss.elastic.co/t/filebeat-takes-hours-to-start-harvesting-logs-after-restart/290693 "2021-12-01T16:17:17Z")
I have to use wildcards in the PATH section since my log files might be in many different locations. filebeat.inputs: - type: log paths: - /folder1/\*/\*/\*/folder2/\*\*/\*.log after filebeat service restart, it tak… --- ## [How many indices / shards for graylog](https://discuss.elastic.co/t/how-many-indices-shards-for-graylog/290734)
**Author:** [@lkeijser](https://discuss.elastic.co/u/lkeijser)\ **Replies:** 1\ **Last updated:** [December 2, 2021, 7:00am UTC](https://discuss.elastic.co/t/how-many-indices-shards-for-graylog/290734 "2021-12-02T07:00:19Z")
Hi there, I'm running Graylog which uses Elasticsearch as backend. RIght now we have about 1.5TB data (about 2 weeks of logging) and I've created 10G indices (about 120 in total, I expect, it's still a process) and 4 sh… [Previous page](https://discuss.elastic.co/latest.md?page=1364) [Next page](https://discuss.elastic.co/latest.md?page=1366)