# Latest **URL:** https://discuss.elastic.co/latest.md?page=1427 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1428 --- ## [Cannot start Metricbeat after adding keystore secret](https://discuss.elastic.co/t/cannot-start-metricbeat-after-adding-keystore-secret/286703)
**Author:** [@rubic](https://discuss.elastic.co/u/rubic)\ **Replies:** 1\ **Last updated:** [October 19, 2021, 1:18pm UTC](https://discuss.elastic.co/t/cannot-start-metricbeat-after-adding-keystore-secret/286703 "2021-10-19T13:18:44Z")
Hi, I have added a secret from newly created keystore and after this operation mb service is failing to start. I wanted to use only one secret on field, specified in output.kafka: key\_passphrase: "${my\_secret\_pass\_… --- ## [Oralce to elasticsearch Date time issue](https://discuss.elastic.co/t/oralce-to-elasticsearch-date-time-issue/287068)
**Author:** [@bhavin.shah](https://discuss.elastic.co/u/bhavin.shah)\ **Replies:** 1\ **Last updated:** [October 19, 2021, 12:58pm UTC](https://discuss.elastic.co/t/oralce-to-elasticsearch-date-time-issue/287068 "2021-10-19T12:58:27Z")
Dear team, ES Mapping information :- "ord\_trd\_trade\_time" : { "type" : "date", "format" : "yyyy-MM-dd HH:mm:ss||strict\_date\_optional\_time||epoch\_millis" } Logstash Statement :- to\_char(ord\_trd\_trade\_time,'yyyy-MM-… --- ## [Security Detection Rules Cause: \`circuit\_breaking\_exception\` on medium-ish deployments](https://discuss.elastic.co/t/security-detection-rules-cause-circuit-breaking-exception-on-medium-ish-deployments/286654)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 6\ **Last updated:** [October 19, 2021, 12:51pm UTC](https://discuss.elastic.co/t/security-detection-rules-cause-circuit-breaking-exception-on-medium-ish-deployments/286654 "2021-10-19T12:51:53Z")
Hi All, I noticed that a few detection rules consume a lot of memory, and cause circuit\_breaking\_exception often in medium-ish deployments (~265 winlogbeat deployments). Elasticsearch version: 7.14.1 Offending Rules: … --- ## [\_grokparsefailure on kibana for record through logstash](https://discuss.elastic.co/t/grokparsefailure-on-kibana-for-record-through-logstash/287073)
**Author:** [@kish2010](https://discuss.elastic.co/u/kish2010)\ **Replies:** 1\ **Last updated:** [October 19, 2021, 12:12pm UTC](https://discuss.elastic.co/t/grokparsefailure-on-kibana-for-record-through-logstash/287073 "2021-10-19T12:12:36Z")
Hi All, I have created grok pattern and tested with log on grokdebugger but still it is failing with grokparsefailure error on kibana. PFB Config file:- input { file { path =\> "/tmp/test.csv" } } filter { grok { … --- ## [Number of indices / shards in a cluster](https://discuss.elastic.co/t/number-of-indices-shards-in-a-cluster/287076)
**Author:** [@mmoreram](https://discuss.elastic.co/u/mmoreram)\ **Replies:** 2\ **Last updated:** [October 19, 2021, 12:11pm UTC](https://discuss.elastic.co/t/number-of-indices-shards-in-a-cluster/287076 "2021-10-19T12:11:02Z")
What is the number of indices and shards "allowed" in a cluster? How big should be a cluster to have 1000 indices, having each 1 shard and 1 replica, being each a ~2000 items index? Even a small one is recommended a 1Gb … --- ## [Working on NET6?](https://discuss.elastic.co/t/working-on-net6/285745)
**Author:** [@Jose\_A\_Fernandez\_M](https://discuss.elastic.co/u/Jose_A_Fernandez_M)\ **Replies:** 4\ **Last updated:** [October 19, 2021, 12:06pm UTC](https://discuss.elastic.co/t/working-on-net6/285745 "2021-10-19T12:06:37Z")
I'm triying to wire a net6 minimal ap, i'm using the package Elastic.Apm.NetCoreAll and and use the app.UseAllElasticApm(config) method, apm is not storing metrics, traces or anything. but this works on a net5 api. Any i… --- ## [Expose transport 9300 as Openshift route](https://discuss.elastic.co/t/expose-transport-9300-as-openshift-route/287086)
**Author:** [@fabry](https://discuss.elastic.co/u/fabry)\ **Replies:** 0\ **Last updated:** [October 19, 2021, 11:56am UTC](https://discuss.elastic.co/t/expose-transport-9300-as-openshift-route/287086 "2021-10-19T11:56:03Z")
Hi, Is it possible to expose the transport tsl connection (port 9300) as Openshift route? e.g to implement CCR. So far I couldn't get it working, I succeeded to expose it using NodePort and I can add a remote cluster b… --- ## [BitSet.or consumes almost 60% cpu](https://discuss.elastic.co/t/bitset-or-consumes-almost-60-cpu/286763)
**Author:** [@chembohuang](https://discuss.elastic.co/u/chembohuang)\ **Replies:** 23\ **Last updated:** [October 19, 2021, 11:25am UTC](https://discuss.elastic.co/t/bitset-or-consumes-almost-60-cpu/286763 "2021-10-19T11:25:40Z")
ES 7.7.1, jdk 14. We have two nodes with the same hardware(physical machine) under the same cluster which only hosts one index with 1 replica. Each node has the same shard. The weird thing is that, one of the machine'… --- ## [FileBeat multiline.maxLine Limit](https://discuss.elastic.co/t/filebeat-multiline-maxline-limit/287075)
**Author:** [@Anandh\_Kumar](https://discuss.elastic.co/u/Anandh_Kumar)\ **Replies:** 0\ **Last updated:** [October 19, 2021, 10:52am UTC](https://discuss.elastic.co/t/filebeat-multiline-maxline-limit/287075 "2021-10-19T10:52:41Z")
Hello All, is there a maximum limit for the max\_lines parameter for multiline messages. The lines in the file used in the application may vary and not have a defined maximum limit. In that case is it possible to do a un… --- ## [Snapshot index compatibility](https://discuss.elastic.co/t/snapshot-index-compatibility/287067)
**Author:** [@str8y](https://discuss.elastic.co/u/str8y)\ **Replies:** 1\ **Last updated:** [October 19, 2021, 10:06am UTC](https://discuss.elastic.co/t/snapshot-index-compatibility/287067 "2021-10-19T10:06:55Z")
Hi, I found in the snapshot documentation the compatibility matrix and the following hint Each snapshot can contain indices created in various versions of Elasticsearch. This includes backing indices created for data… --- ## [Filebeat httpjson cursor](https://discuss.elastic.co/t/filebeat-httpjson-cursor/287069)
**Author:** [@vladislav](https://discuss.elastic.co/u/vladislav)\ **Replies:** 0\ **Last updated:** [October 19, 2021, 9:55am UTC](https://discuss.elastic.co/t/filebeat-httpjson-cursor/287069 "2021-10-19T09:55:35Z")
Hello! How to manually clear state of cursor when using httpjson in filebeat? If I get some data using httpjson-cursor and then delete index in Kibana, containing data from it I can't get this data again. Answers from … --- ## [Metricbeat hidden indexes](https://discuss.elastic.co/t/metricbeat-hidden-indexes/287065)
**Author:** [@bm-ai](https://discuss.elastic.co/u/bm-ai)\ **Replies:** 0\ **Last updated:** [October 19, 2021, 9:14am UTC](https://discuss.elastic.co/t/metricbeat-hidden-indexes/287065 "2021-10-19T09:14:10Z")
Hi, I've been using ES and Metricbeat for a while now and I've noticed that my ES nodes capacity is getting full pretty fast even though I have ILM enabled on all Metricbeats indexes. I can see many hidden indexes from … --- ## [Saving request.url variable in filebeat httpjson](https://discuss.elastic.co/t/saving-request-url-variable-in-filebeat-httpjson/286700)
**Author:** [@vladislav](https://discuss.elastic.co/u/vladislav)\ **Replies:** 8\ **Last updated:** [October 19, 2021, 9:48am UTC](https://discuss.elastic.co/t/saving-request-url-variable-in-filebeat-httpjson/286700 "2021-10-19T09:48:14Z")
Good day! The question arose, is it possible to save the last received value of the request.url parameter and then read from it upon request? I use httpjson as an input module with the following settings: # ===========… --- ## [How to monitor cause of deletion of documents in index?](https://discuss.elastic.co/t/how-to-monitor-cause-of-deletion-of-documents-in-index/287052)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 3\ **Last updated:** [October 19, 2021, 9:36am UTC](https://discuss.elastic.co/t/how-to-monitor-cause-of-deletion-of-documents-in-index/287052 "2021-10-19T09:36:53Z")
Dears, Is there any way to monitor process of deletion of documents from index? I'm asking about it because of from few days I observed this odd behavior. Similar situation I had when doc id was the same for few docume… --- ## [Error after OS upgrade](https://discuss.elastic.co/t/error-after-os-upgrade/286966)
**Author:** [@Zincometal](https://discuss.elastic.co/u/Zincometal)\ **Replies:** 6\ **Last updated:** [October 19, 2021, 9:04am UTC](https://discuss.elastic.co/t/error-after-os-upgrade/286966 "2021-10-19T09:04:23Z")
Hello all, I'm a newbie to ELK and after many search I've not found a solution. After an OS upgrade Devuan 3 =\> Devuan 4 my filebeat doesn't work. The error in /var/log/filebeat.log is this: Preformatted text2021-10-… --- ## [Ubuntu 20.04 tar/zip installed - systemd timeout](https://discuss.elastic.co/t/ubuntu-20-04-tar-zip-installed-systemd-timeout/287000)
**Author:** [@imper86](https://discuss.elastic.co/u/imper86)\ **Replies:** 3\ **Last updated:** [October 19, 2021, 9:04am UTC](https://discuss.elastic.co/t/ubuntu-20-04-tar-zip-installed-systemd-timeout/287000 "2021-10-19T09:04:09Z")
Hello, I have a strange issue with a fresh tar/zip installation of Elasticsearch. When I use Elasticsearch v6 this way - there is no problem. Also apt installation works fine. But when I want to use systemd with Elastic… --- ## [Elastic-agent install -f](https://discuss.elastic.co/t/elastic-agent-install-f/286753)
**Author:** [@Greg\_R](https://discuss.elastic.co/u/Greg_R)\ **Replies:** 13\ **Last updated:** [October 19, 2021, 9:03am UTC](https://discuss.elastic.co/t/elastic-agent-install-f/286753 "2021-10-19T09:03:08Z")
Greetings I'm trying to set up fleet. All along the doc I see: elastic-agent install -f but the -f flag is not documented anywhere (and make the elastic-agent choke in the docker version). What is it for? My goal is … --- ## [Optimizing agg on collapse](https://discuss.elastic.co/t/optimizing-agg-on-collapse/287058)
**Author:** [@CarloKok](https://discuss.elastic.co/u/CarloKok)\ **Replies:** 0\ **Last updated:** [October 19, 2021, 8:24am UTC](https://discuss.elastic.co/t/optimizing-agg-on-collapse/287058 "2021-10-19T08:24:53Z")
I have an index with "availability" of rooms in a set of hotels. Each record has among other things: HotelCode RoomType arrival Date Departure Date Price for stay Bunch of room features to filter on The nr of records … --- ## [Coloring Metric aggregation based on String](https://discuss.elastic.co/t/coloring-metric-aggregation-based-on-string/286821)
**Author:** [@Cibot](https://discuss.elastic.co/u/Cibot)\ **Replies:** 3\ **Last updated:** [October 19, 2021, 8:14am UTC](https://discuss.elastic.co/t/coloring-metric-aggregation-based-on-string/286821 "2021-10-19T08:14:54Z")
I have been trying to create a dashboard with relevant information for a service. As such we display logs, uptime over time, errors, current state and so on. To make it easy to indicate whether a service is down, I wan… --- ## [How to apply combination of filters on array of objects?](https://discuss.elastic.co/t/how-to-apply-combination-of-filters-on-array-of-objects/286946)
**Author:** [@nsharma2412](https://discuss.elastic.co/u/nsharma2412)\ **Replies:** 3\ **Last updated:** [October 19, 2021, 7:30am UTC](https://discuss.elastic.co/t/how-to-apply-combination-of-filters-on-array-of-objects/286946 "2021-10-19T07:30:47Z")
Hi Please help me to write a suitable query for my task, I have list of products with different categories and associated attribute and tags. Here is two documents for two categories along with associated attribute list.… --- ## [Errors using filters for analytics queries with AppSearch Python client API](https://discuss.elastic.co/t/errors-using-filters-for-analytics-queries-with-appsearch-python-client-api/287054)
**Author:** [@pcortez](https://discuss.elastic.co/u/pcortez)\ **Replies:** 0\ **Last updated:** [October 19, 2021, 7:14am UTC](https://discuss.elastic.co/t/errors-using-filters-for-analytics-queries-with-appsearch-python-client-api/287054 "2021-10-19T07:14:57Z")
Hello, I will appreciate some help to explain what is the correct way to use analytics filters with the AppSearch python client API? I have an engine running in AppSearch and I want to track clicks and queries through t… --- ## [Logstash Pipeline in Elastic Cloud](https://discuss.elastic.co/t/logstash-pipeline-in-elastic-cloud/287017)
**Author:** [@vladik22](https://discuss.elastic.co/u/vladik22)\ **Replies:** 3\ **Last updated:** [October 19, 2021, 6:06am UTC](https://discuss.elastic.co/t/logstash-pipeline-in-elastic-cloud/287017 "2021-10-19T06:06:11Z")
Hello I'm new on Elastic Cloud. I understood how to send data to Elasticsearch on cloud via logstash. In Kibana I saw option "Logstash Pipelines". How can I use it? I want to send files via filebeat to logstash on… --- ## [Aggregation後のデータの最新、最古の日付を取得したい](https://discuss.elastic.co/t/aggregation/286954)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 4\ **Last updated:** [October 19, 2021, 5:47am UTC](https://discuss.elastic.co/t/aggregation/286954 "2021-10-19T05:47:20Z")
aggregationで、集約結果取得と同時にそれぞれの最新、最古の日付を取得できるかご教示ください。 例) 以下のようなデータをclient\_ipにてaggregationします client\_ip date 10.192.1.1 2021/10/1 10.192.1.1 2021/10/2 10.192.1.1 2021/10/3 10.192.1.2 2021/10/1 10.192.1.2 2021/10/2 … --- ## [Curator failed to delete snapshot: No space left on device](https://discuss.elastic.co/t/curator-failed-to-delete-snapshot-no-space-left-on-device/285189)
**Author:** [@chaitra\_hegde](https://discuss.elastic.co/u/chaitra_hegde)\ **Replies:** 2\ **Last updated:** [October 19, 2021, 5:29am UTC](https://discuss.elastic.co/t/curator-failed-to-delete-snapshot-no-space-left-on-device/285189 "2021-10-19T05:29:09Z")
Hi, I am facing below issue in Curator snapshot deletion. Curator version- 5.8.1, ES- 7.10.2 2021-09-19 02:01:01,159 ERROR Failed to complete action: delete\_snapshots. \:… --- ## [Logstash can't read the environment variable](https://discuss.elastic.co/t/logstash-cant-read-the-environment-variable/286949)
**Author:** [@ramilbermejo](https://discuss.elastic.co/u/ramilbermejo)\ **Replies:** 2\ **Last updated:** [October 19, 2021, 4:58am UTC](https://discuss.elastic.co/t/logstash-cant-read-the-environment-variable/286949 "2021-10-19T04:58:42Z")
Good day everyone! Need some help here. On my dev environment, checking the logstash configuration will show this error. root@devlogstash:~# /usr/share/logstash/bin/logstash --path.settings /etc/logstash -t OpenJDK 64… --- ## [Ingesting JSON logs with filebeat and logstash](https://discuss.elastic.co/t/ingesting-json-logs-with-filebeat-and-logstash/286874)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 8\ **Last updated:** [October 19, 2021, 4:47am UTC](https://discuss.elastic.co/t/ingesting-json-logs-with-filebeat-and-logstash/286874 "2021-10-19T04:47:05Z")
I hope this messages finds the community member's safe and healthy. I am trying to ingest around 600 GB of logs spread across multiple JSON files. Here are few lings of logs (these are scrubbed DNS logs) {"timestamp":"… --- ## [Logstash OutOfMemoryError: Direct buffer memory](https://discuss.elastic.co/t/logstash-outofmemoryerror-direct-buffer-memory/286473)
**Author:** [@Muthu\_Ramachandran\_K](https://discuss.elastic.co/u/Muthu_Ramachandran_K)\ **Replies:** 2\ **Last updated:** [October 19, 2021, 3:41am UTC](https://discuss.elastic.co/t/logstash-outofmemoryerror-direct-buffer-memory/286473 "2021-10-19T03:41:15Z")
Hi, we are using filebeat-\> logstash -\> elastic setup. The set up was working fine without any issues, but recently we noticed that logstash is going down frequently and we could see the below error. can anyone suggest … --- ## [Filebeat \[7.15.0\] hints based discovery does nothing](https://discuss.elastic.co/t/filebeat-7-15-0-hints-based-discovery-does-nothing/287045)
**Author:** [@gwvandesteeg](https://discuss.elastic.co/u/gwvandesteeg)\ **Replies:** 0\ **Last updated:** [October 19, 2021, 3:13am UTC](https://discuss.elastic.co/t/filebeat-7-15-0-hints-based-discovery-does-nothing/287045 "2021-10-19T03:13:27Z")
Continuing the discussion from Filebeat doesn't send logs to Elasticsearch: We're having the exact same problem as the above which doesn't appear to have ever been resolved. Using filebeat 7.15.0, exact same config as … --- ## [Filebeat Fortinet Firewall Module 7.15.1](https://discuss.elastic.co/t/filebeat-fortinet-firewall-module-7-15-1/287046)
**Author:** [@unknown\_user](https://discuss.elastic.co/u/unknown_user)\ **Replies:** 0\ **Last updated:** [October 19, 2021, 3:16am UTC](https://discuss.elastic.co/t/filebeat-fortinet-firewall-module-7-15-1/287046 "2021-10-19T03:16:35Z")
I just started using filebeat fortinet module and noticed that the module failed to split the fields on a fortigate 6.4.7 I've resolved the issue by changing, field\_split: " (?=\[a-z\\\\\_\\\\-\]+=)" to field\_split: ",(?=\[a… --- ## [How we add additional information on Kibana Visualize which is queried by Buckets's X-axis result IDs?](https://discuss.elastic.co/t/how-we-add-additional-information-on-kibana-visualize-which-is-queried-by-bucketss-x-axis-result-ids/287044)
**Author:** [@matoi](https://discuss.elastic.co/u/matoi)\ **Replies:** 0\ **Last updated:** [October 19, 2021, 3:10am UTC](https://discuss.elastic.co/t/how-we-add-additional-information-on-kibana-visualize-which-is-queried-by-bucketss-x-axis-result-ids/287044 "2021-10-19T03:10:36Z")
Hello, I'd like to show the additional information on Kibana Visualize close to Buckets's X-axis. Currently, my X-axis result is document's ids. (That is parent data) These documents have children documents. (But we do… [Previous page](https://discuss.elastic.co/latest.md?page=1426) [Next page](https://discuss.elastic.co/latest.md?page=1428)