# Latest **URL:** https://discuss.elastic.co/latest.md?page=1428 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1429 --- ## [S3-input-plugin; restart logstash on aws\_credentials\_file update](https://discuss.elastic.co/t/s3-input-plugin-restart-logstash-on-aws-credentials-file-update/287036)
**Author:** [@jnkroeker](https://discuss.elastic.co/u/jnkroeker)\ **Replies:** 2\ **Last updated:** [October 19, 2021, 2:07am UTC](https://discuss.elastic.co/t/s3-input-plugin-restart-logstash-on-aws-credentials-file-update/287036 "2021-10-19T02:07:49Z")
Hey there, How can I force logstash to restart when my aws\_credentials\_file is updated? --config.reload.automatic does not appear to work here as neither the config.yaml or pipelines.yaml files are changing. the aws\_cr… --- ## [Filebeat. How drop events with IIS module?](https://discuss.elastic.co/t/filebeat-how-drop-events-with-iis-module/286637)
**Author:** [@psyapathy](https://discuss.elastic.co/u/psyapathy)\ **Replies:** 2\ **Last updated:** [October 19, 2021, 1:43am UTC](https://discuss.elastic.co/t/filebeat-how-drop-events-with-iis-module/286637 "2021-10-19T01:43:12Z")
Hi! I use IIS module for collect IIS logs. I want drop events if field url.path contains "layouts". Where in the config should I use the processors block with drop\_events? In filebeat.yml or iis.yml? Can you show me … --- ## [Elastic Endgame Sensor](https://discuss.elastic.co/t/elastic-endgame-sensor/286933)
**Author:** [@marisa.david](https://discuss.elastic.co/u/marisa.david)\ **Replies:** 5\ **Last updated:** [October 19, 2021, 1:28am UTC](https://discuss.elastic.co/t/elastic-endgame-sensor/286933 "2021-10-19T01:28:19Z")
I have been attempting to deploy a sensor but every time I try to in the command prompt it says it cannot be found. I am not sure if I am putting the information in wrong. --- ## [Certificates between Elasticsearch/Kibana RHEL VM and certificate authority Windows server](https://discuss.elastic.co/t/certificates-between-elasticsearch-kibana-rhel-vm-and-certificate-authority-windows-server/287012)
**Author:** [@rebellionne](https://discuss.elastic.co/u/rebellionne)\ **Replies:** 1\ **Last updated:** [October 19, 2021, 1:23am UTC](https://discuss.elastic.co/t/certificates-between-elasticsearch-kibana-rhel-vm-and-certificate-authority-windows-server/287012 "2021-10-19T01:23:56Z")
Hi everybody After days of research, I finally decided to ask for help. I must precise that working with certificates is quite new to me especially on Linux environment. I run Elasticsearch and Kibana 7.15.0 on the sa… --- ## [Elasticsearch can not started：failed to find global metadata](https://discuss.elastic.co/t/elasticsearch-can-not-started-failed-to-find-global-metadata/287037)
**Author:** [@wangdwcsd](https://discuss.elastic.co/u/wangdwcsd)\ **Replies:** 9\ **Last updated:** [October 19, 2021, 1:02am UTC](https://discuss.elastic.co/t/elasticsearch-can-not-started-failed-to-find-global-metadata/287037 "2021-10-19T01:02:15Z")
After the master node is restarted, it cannot be started. The following errors are always reported in the log，Is there any way to enable the Elasticsearch instance to load metadata？ error log： \[2021-10-19T02:32:17,262\]… --- ## [All Packetbeat dashboards version 7.15.0 don't work: Invalid JSON in search source](https://discuss.elastic.co/t/all-packetbeat-dashboards-version-7-15-0-dont-work-invalid-json-in-search-source/285824)
**Author:** [@hermanator](https://discuss.elastic.co/u/hermanator)\ **Replies:** 14\ **Last updated:** [October 18, 2021, 11:15pm UTC](https://discuss.elastic.co/t/all-packetbeat-dashboards-version-7-15-0-dont-work-invalid-json-in-search-source/285824 "2021-10-18T23:15:02Z")
Hello, I can't get the dashboards for packetbeat to work. The list with packetbeat dashboards are visible in Kibana, but after clicking any of them I get the error: Invalid JSON in search source. I've setup packetbeat… --- ## [Filebeat configuration](https://discuss.elastic.co/t/filebeat-configuration/286972)
**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\ **Replies:** 0\ **Last updated:** [October 18, 2021, 10:24am UTC](https://discuss.elastic.co/t/filebeat-configuration/286972 "2021-10-18T10:24:51Z")
I have to read logs from different server so I am using filebeat for that. in filebeat yml file I have mention filebeat.inputs: - type: log enabled: true paths: - /home/3rdisearch-dev/project/mangeshs/logs/ind… --- ## [Can't connect to ElasticSearch from python API in Docker-Compose setup](https://discuss.elastic.co/t/cant-connect-to-elasticsearch-from-python-api-in-docker-compose-setup/287031)
**Author:** [@amace](https://discuss.elastic.co/u/amace)\ **Replies:** 4\ **Last updated:** [October 18, 2021, 10:33pm UTC](https://discuss.elastic.co/t/cant-connect-to-elasticsearch-from-python-api-in-docker-compose-setup/287031 "2021-10-18T22:33:36Z")
Here is how I create the ES container in Docker-Compose: db: image: docker.elastic.co/elasticsearch/elasticsearch:7.15.1 restart: always ports: - 9200:9200 - 9300:9300 ulimits: memlock:… --- ## [Throughput chart for selected transaction in APM view is not calculated correctly](https://discuss.elastic.co/t/throughput-chart-for-selected-transaction-in-apm-view-is-not-calculated-correctly/286895)
**Author:** [@molsza](https://discuss.elastic.co/u/molsza)\ **Replies:** 3\ **Last updated:** [October 18, 2021, 9:07pm UTC](https://discuss.elastic.co/t/throughput-chart-for-selected-transaction-in-apm-view-is-not-calculated-correctly/286895 "2021-10-18T21:07:16Z")
When particular transaction is selected on APM service view. There are 4 charts: Latency, Throughput, Error rate, Time per span. All but Throughput are showing data for selected transaction. Throughput chart is calculate… --- ## [Receive multiple Logstash inputs with TCP, UDP and Beats](https://discuss.elastic.co/t/receive-multiple-logstash-inputs-with-tcp-udp-and-beats/287020)
**Author:** [@sakshat](https://discuss.elastic.co/u/sakshat)\ **Replies:** 6\ **Last updated:** [October 18, 2021, 9:06pm UTC](https://discuss.elastic.co/t/receive-multiple-logstash-inputs-with-tcp-udp-and-beats/287020 "2021-10-18T21:06:09Z")
Hi everyone, I am trying to get logs input into logstash using TCP, UDP and Beats. I have applications that drain syslog to logstash using tcp and udp and I also have an application that writes logs to files in a server.… --- ## [Elasticsearch s3 plugin error "repository\_verification\_exception"](https://discuss.elastic.co/t/elasticsearch-s3-plugin-error-repository-verification-exception/286781)
**Author:** [@Mark\_Laff](https://discuss.elastic.co/u/Mark_Laff)\ **Replies:** 10\ **Last updated:** [October 18, 2021, 8:24pm UTC](https://discuss.elastic.co/t/elasticsearch-s3-plugin-error-repository-verification-exception/286781 "2021-10-18T20:24:17Z")
I'm running ES 6.8 locally (on Mac OS X installed via Homebrew) $ curl -sS -XGET 127.0.0.1:9200 { "name" : "JdRGfj8", "cluster\_name" : "elasticsearch\_brew", "cluster\_uuid" : "PahjUQpJTpy40myvs-sKMg", "version" :… --- ## [Elastic APM Agent asp.net startup hooks dll](https://discuss.elastic.co/t/elastic-apm-agent-asp-net-startup-hooks-dll/286655)
**Author:** [@ryphilli](https://discuss.elastic.co/u/ryphilli)\ **Replies:** 6\ **Last updated:** [October 18, 2021, 7:37pm UTC](https://discuss.elastic.co/t/elastic-apm-agent-asp-net-startup-hooks-dll/286655 "2021-10-18T19:37:40Z")
If you are asking about a problem you are experiencing, please use the following template, as it will help us help you. If you have a different problem, please delete all of this text :slight\_smile: TIP 1: select at lea… --- ## [Logstash stops receiving logs](https://discuss.elastic.co/t/logstash-stops-receiving-logs/286897)
**Author:** [@Hamza\_El\_Aouane](https://discuss.elastic.co/u/Hamza_El_Aouane)\ **Replies:** 7\ **Last updated:** [October 18, 2021, 7:38pm UTC](https://discuss.elastic.co/t/logstash-stops-receiving-logs/286897 "2021-10-18T19:38:42Z")
Hi everyone. I am a beginner in logstash and ELK in general. Lately I have been facing an issue with logstash. I am receiving some logs on port 3014, and this is the second time that this is happening and I identified t… --- ## [Logstash in Kubernetes Not Using ServiceAccount with IAM Role](https://discuss.elastic.co/t/logstash-in-kubernetes-not-using-serviceaccount-with-iam-role/286081)
**Author:** [@xzxpurple2017](https://discuss.elastic.co/u/xzxpurple2017)\ **Replies:** 3\ **Last updated:** [October 18, 2021, 7:02pm UTC](https://discuss.elastic.co/t/logstash-in-kubernetes-not-using-serviceaccount-with-iam-role/286081 "2021-10-18T19:02:59Z")
I have a Logstash input to pull logs from S3. I attached a serviceaccount with IAM role to interact with S3 to the Logstash stateful set. I checked that the env variables on the container have AWS\_ROLE\_ARN and AWS\_WEB\_… --- ## [Parsing logs from text file using using logstash](https://discuss.elastic.co/t/parsing-logs-from-text-file-using-using-logstash/286995)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 6:08pm UTC](https://discuss.elastic.co/t/parsing-logs-from-text-file-using-using-logstash/286995 "2021-10-18T18:08:29Z")
Hi, I am having logs in the txt file.I checked with kv, grok and dissect filter to ingest logs using logstash, but as logs format is not the same. Maybe I need to assign field and particular value as this is unstructure… --- ## [Add field if based on another timestamps-field value](https://discuss.elastic.co/t/add-field-if-based-on-another-timestamps-field-value/286985)
**Author:** [@Cibot](https://discuss.elastic.co/u/Cibot)\ **Replies:** 2\ **Last updated:** [October 18, 2021, 5:44pm UTC](https://discuss.elastic.co/t/add-field-if-based-on-another-timestamps-field-value/286985 "2021-10-18T17:44:08Z")
I've been trying to add a field describing the status of the current rpm. Basically I've been using execbeats to execute a command which returns all the currently installed rpms. Now we have an internal tool which basi… --- ## [Uptime Monitors not working](https://discuss.elastic.co/t/uptime-monitors-not-working/286887)
**Author:** [@Peter\_Schlafmann](https://discuss.elastic.co/u/Peter_Schlafmann)\ **Replies:** 11\ **Last updated:** [October 18, 2021, 5:40pm UTC](https://discuss.elastic.co/t/uptime-monitors-not-working/286887 "2021-10-18T17:40:09Z")
Hi Community, I am using latest version of ES+Kibana+Heartbeat - I want to setup icmp uptime monitors for some of my hosts in my private network. Struggling with the configuration. Please see my heartbeat .yml and my o… --- ## [Monitoring Cluster stopped receiving data from Production Cluster](https://discuss.elastic.co/t/monitoring-cluster-stopped-receiving-data-from-production-cluster/286876)
**Author:** [@TonyLuc](https://discuss.elastic.co/u/TonyLuc)\ **Replies:** 2\ **Last updated:** [October 18, 2021, 5:03pm UTC](https://discuss.elastic.co/t/monitoring-cluster-stopped-receiving-data-from-production-cluster/286876 "2021-10-18T17:03:59Z")
Observations OS: Windows Sever 2019 Observations are based on: Metricbeat Version 7.15.0 (amd64), libbeat 7.15.0 \[9023152025ec6251bc6b6c38009b309157f10f17 built 2021-09-16 03:28:25 +0000 UTC\] When MetricBeat A… --- ## [Table with Sum of Last values grouped by kubernetes.pod.uuid](https://discuss.elastic.co/t/table-with-sum-of-last-values-grouped-by-kubernetes-pod-uuid/286992)
**Author:** [@milanvdm](https://discuss.elastic.co/u/milanvdm)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 4:52pm UTC](https://discuss.elastic.co/t/table-with-sum-of-last-values-grouped-by-kubernetes-pod-uuid/286992 "2021-10-18T16:52:34Z")
Ive got a counter on each running kubernetes pod: { name: foo, counter: 5, pod.uuid: 111, timestamp: 1 } and { name: foo, counter: 10, pod.uuid: 111, timestamp: 2 } { name: foo, counter: 5, pod.uuid: 222, timestamp: 1 … --- ## [New in Elastic 7.13.1](https://discuss.elastic.co/t/new-in-elastic-7-13-1/285534)
**Author:** [@tsahoo43](https://discuss.elastic.co/u/tsahoo43)\ **Replies:** 5\ **Last updated:** [October 18, 2021, 4:42pm UTC](https://discuss.elastic.co/t/new-in-elastic-7-13-1/285534 "2021-10-18T16:42:02Z")
Hi Team, I am new to Elasticsearch . I have installed Elastic 7.13.1 and perform some security enabled setting to get the Login page for accessing the Elastic . Could you please help here on " How can I disable the show… --- ## [Setup Elasticsearch SlowLog Alerts in Elastic Cloud](https://discuss.elastic.co/t/setup-elasticsearch-slowlog-alerts-in-elastic-cloud/283085)
**Author:** [@Stef\_Nestor](https://discuss.elastic.co/u/Stef_Nestor)\ **Replies:** 2\ **Last updated:** [October 18, 2021, 4:38pm UTC](https://discuss.elastic.co/t/setup-elasticsearch-slowlog-alerts-in-elastic-cloud/283085 "2021-10-18T16:38:02Z")
Is there a way to setup email alerts for SlowLogs in Elasticsearch on Elastic Cloud? --- ## [Cardinality of 1 vs. 0](https://discuss.elastic.co/t/cardinality-of-1-vs-0/287010)
**Author:** [@wolfhoundjesse](https://discuss.elastic.co/u/wolfhoundjesse)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 3:17pm UTC](https://discuss.elastic.co/t/cardinality-of-1-vs-0/287010 "2021-10-18T15:17:51Z")
I'm curious, if cardinality returns the count of distinct values, what does 0 mean? If there are two distinct values, you get 2. If they're all the same, you get 1. My best guess is that a zero means there was nothing to… --- ## [Calculating EPS? events.filtered / duration\_in\_millis is incorrect](https://discuss.elastic.co/t/calculating-eps-events-filtered-duration-in-millis-is-incorrect/286936)
**Author:** [@CamTheMan](https://discuss.elastic.co/u/CamTheMan)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 3:10pm UTC](https://discuss.elastic.co/t/calculating-eps-events-filtered-duration-in-millis-is-incorrect/286936 "2021-10-18T15:10:01Z")
Hello All, I would like to calculate my events per second for logstash. Currently I'm grabbing data via the logstash API but when I calculate the EPS it doesn't match up to what the 'metrics' logstash filter is reporti… --- ## [Search Error The content length (897957165) is bigger than the maximum allowed string (536870888)](https://discuss.elastic.co/t/search-error-the-content-length-897957165-is-bigger-than-the-maximum-allowed-string-536870888/285100)
**Author:** [@vikas1389](https://discuss.elastic.co/u/vikas1389)\ **Replies:** 3\ **Last updated:** [October 18, 2021, 2:31pm UTC](https://discuss.elastic.co/t/search-error-the-content-length-897957165-is-bigger-than-the-maximum-allowed-string-536870888/285100 "2021-10-18T14:31:39Z")
While filtering through logs we getting error: where it mentions content length is bigger. Where is maximum allowed string (536870888) is set- any suggestions to fix this error. --- ## [Logstash CIDR Plugin not working](https://discuss.elastic.co/t/logstash-cidr-plugin-not-working/286267)
**Author:** [@mrodriguez](https://discuss.elastic.co/u/mrodriguez)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 2:25pm UTC](https://discuss.elastic.co/t/logstash-cidr-plugin-not-working/286267 "2021-10-18T14:25:28Z")
Hi, I need to filter events by IP addresses. I would like to use CIDR plugin but it is not working for me. This is my code: filter { if \[type\] == "mytype" { kv{} cidr{ address =\> \[ "%{srcip}" \] network =\>… --- ## [Regex query in 7.13.4](https://discuss.elastic.co/t/regex-query-in-7-13-4/286884)
**Author:** [@junhuangli](https://discuss.elastic.co/u/junhuangli)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 2:24pm UTC](https://discuss.elastic.co/t/regex-query-in-7-13-4/286884 "2021-10-18T14:24:57Z")
After upgrading Elasticsearch from 6.6.2 to 7.13.4, we found the regex query is much slower(10 times slower). We are doing a pretty expensive regex search like ".(\["\]fieldName\["\]:\["\]my-value-\[A-Za-z\]\[A-Za-z\]\[A-Za-z0-9\]\[… --- ## [Best practices to handle jdbc (Postgresql) contents?](https://discuss.elastic.co/t/best-practices-to-handle-jdbc-postgresql-contents/286506)
**Author:** [@lucien.guillermin](https://discuss.elastic.co/u/lucien.guillermin)\ **Replies:** 6\ **Last updated:** [October 18, 2021, 2:24pm UTC](https://discuss.elastic.co/t/best-practices-to-handle-jdbc-postgresql-contents/286506 "2021-10-18T14:24:46Z")
Hello Everyone, I have a beginner question regarding a context in which we have to index a PostgreSQL database with Elastic. Is it required to use an intermediary solution between PostgreSQL and Elastic ? If so what ar… --- ## [Logstash cpu usage blocked at 50%](https://discuss.elastic.co/t/logstash-cpu-usage-blocked-at-50/286465)
**Author:** [@thomastatin](https://discuss.elastic.co/u/thomastatin)\ **Replies:** 2\ **Last updated:** [October 18, 2021, 2:13pm UTC](https://discuss.elastic.co/t/logstash-cpu-usage-blocked-at-50/286465 "2021-10-18T14:13:15Z")
Hi everybody ! I have a logstash pipeline which can receive about 10k e/s in event peaks My logstash usual CPU usage is in "nice" priority with an average 30-40% CPU consumption and without data delay in the data store… --- ## [Log forwarding issue after upgrading logstash](https://discuss.elastic.co/t/log-forwarding-issue-after-upgrading-logstash/286859)
**Author:** [@yankeesfan01x](https://discuss.elastic.co/u/yankeesfan01x)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 2:01pm UTC](https://discuss.elastic.co/t/log-forwarding-issue-after-upgrading-logstash/286859 "2021-10-18T14:01:23Z")
I upgraded the logstash version from 7.12.1 to 7.15.1 and I'm not seeing logs in Kibana from the source host I'm testing with. Is this too much of a jump in versions or did something change in 7.15.1 that I need to upda… --- ## [Event.duration bug](https://discuss.elastic.co/t/event-duration-bug/286733)
**Author:** [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\ **Replies:** 4\ **Last updated:** [October 18, 2021, 1:45pm UTC](https://discuss.elastic.co/t/event-duration-bug/286733 "2021-10-18T13:45:53Z")
I have a field as a double in milliseconds. I want to turn it into nanoseconds and apply it to the event.duration field in logstash, so I can monitor how long certain events take for my machines to process. Here is the … [Previous page](https://discuss.elastic.co/latest.md?page=1427) [Next page](https://discuss.elastic.co/latest.md?page=1429)