# Latest **URL:** https://discuss.elastic.co/latest.md?page=1460 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1461 --- ## [LogLevel changed in CentralConfigFetcher](https://discuss.elastic.co/t/loglevel-changed-in-centralconfigfetcher/284413)
**Author:** [@gerardpeters](https://discuss.elastic.co/u/gerardpeters)\ **Replies:** 1\ **Last updated:** [September 27, 2021, 2:54pm UTC](https://discuss.elastic.co/t/loglevel-changed-in-centralconfigfetcher/284413 "2021-09-27T14:54:32Z")
Hi, I've upgraded to .net agent 1.11.1 and there is a code change that changed to loglevel from trace to info. See: Before: \_logger.IfLevel(waitingLogSeverity) ?.Log("Waiting {WaitInterval}... {WaitReason}. dbgI… --- ## [Detecting DNS Exfiltration](https://discuss.elastic.co/t/detecting-dns-exfiltration/285239)
**Author:** [@ksremo](https://discuss.elastic.co/u/ksremo)\ **Replies:** 1\ **Last updated:** [September 27, 2021, 2:47pm UTC](https://discuss.elastic.co/t/detecting-dns-exfiltration/285239 "2021-09-27T14:47:56Z")
Hello, we ingest dns logs into Elasticsearch. the format is domain -\> whole domain -\> deeper.cdn.example.com domain1 -\> com domain2 -\> example domain3 -\> cdn domain4 -\> deeper Now we want to create a siem detecti… --- ## [How to calculate the average count with term](https://discuss.elastic.co/t/how-to-calculate-the-average-count-with-term/284879)
**Author:** [@forst](https://discuss.elastic.co/u/forst)\ **Replies:** 7\ **Last updated:** [September 27, 2021, 2:31pm UTC](https://discuss.elastic.co/t/how-to-calculate-the-average-count-with-term/284879 "2021-09-27T14:31:44Z")
I am looking to make a heatmap type visualization, I wanted to put the time on x-axis and the team (name) on y-axis. a team has a number of different jobs I wanted to put the average count with : count total / count j… --- ## [ECK Update Secret for Kibana.yml fails](https://discuss.elastic.co/t/eck-update-secret-for-kibana-yml-fails/285082)
**Author:** [@bwheatley](https://discuss.elastic.co/u/bwheatley)\ **Replies:** 2\ **Last updated:** [September 27, 2021, 2:19pm UTC](https://discuss.elastic.co/t/eck-update-secret-for-kibana-yml-fails/285082 "2021-09-27T14:19:35Z")
Good Morning, This is hopefully me being stupid and missing something easy. If someone can point me in the right direction I would appreciate it. I'm trying to update the secret quickstart-kb-config so i can update my … --- ## [Elastic Stack Mapping Error](https://discuss.elastic.co/t/elastic-stack-mapping-error/284871)
**Author:** [@dayajamal](https://discuss.elastic.co/u/dayajamal)\ **Replies:** 9\ **Last updated:** [September 27, 2021, 2:15pm UTC](https://discuss.elastic.co/t/elastic-stack-mapping-error/284871 "2021-09-27T14:15:13Z")
Hello, this my second time posting here with a hope to find a solution this time. I'm working on the Elastic Stack. I'm sending logs from Filebeat through Logstash to Elasticsearch. My logs get structured in Logstash, no… --- ## [Canvas - Values retrieved from ESQL aren't the same as the ones displayed in chart](https://discuss.elastic.co/t/canvas-values-retrieved-from-esql-arent-the-same-as-the-ones-displayed-in-chart/284640)
**Author:** [@Luis\_P](https://discuss.elastic.co/u/Luis_P)\ **Replies:** 6\ **Last updated:** [September 27, 2021, 2:13pm UTC](https://discuss.elastic.co/t/canvas-values-retrieved-from-esql-arent-the-same-as-the-ones-displayed-in-chart/284640 "2021-09-27T14:13:03Z")
I made a query which produces the following table: I've cropped out the other column, but it represents the processes I have documents on, being NrByProcess the count of documents for each process. However, when using… --- ## [Logstash not processing syslog data (logs not arriving in Elastic)](https://discuss.elastic.co/t/logstash-not-processing-syslog-data-logs-not-arriving-in-elastic/285177)
**Author:** [@hazenvs](https://discuss.elastic.co/u/hazenvs)\ **Replies:** 0\ **Last updated:** [September 26, 2021, 8:53pm UTC](https://discuss.elastic.co/t/logstash-not-processing-syslog-data-logs-not-arriving-in-elastic/285177 "2021-09-26T20:53:48Z")
Logstash is up and running: \[root@node1 logstash\]# systemctl status logstash.service ● logstash.service - logstash Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: disabled) Active: ac… --- ## [Cannot restore snapshot to new single node cluster](https://discuss.elastic.co/t/cannot-restore-snapshot-to-new-single-node-cluster/285025)
**Author:** [@cdalexndr](https://discuss.elastic.co/u/cdalexndr)\ **Replies:** 3\ **Last updated:** [September 27, 2021, 1:14pm UTC](https://discuss.elastic.co/t/cannot-restore-snapshot-to-new-single-node-cluster/285025 "2021-09-27T13:14:58Z")
I've made a snapshot for a single node cluster using default settings: PUT /\_snapshot/backup/%3Csnapshot-%7Bnow%2Fd%7D%3E Created a new single node cluster, and tried to restore it: POST /\_snapshot/backup/snapshot-202… --- ## [How many hosts I can list in logstash output](https://discuss.elastic.co/t/how-many-hosts-i-can-list-in-logstash-output/285093)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 6\ **Last updated:** [September 27, 2021, 1:00pm UTC](https://discuss.elastic.co/t/how-many-hosts-i-can-list-in-logstash-output/285093 "2021-09-27T13:00:04Z")
how many hosts I can list in output section of host part? can I use wildcard? something like this? hosts =\> \["host\_123\*"\] --- ## [Error fetching alert status Stack Monitoring](https://discuss.elastic.co/t/error-fetching-alert-status-stack-monitoring/283707)
**Author:** [@vikasgurlinka](https://discuss.elastic.co/u/vikasgurlinka)\ **Replies:** 1\ **Last updated:** [September 27, 2021, 12:51pm UTC](https://discuss.elastic.co/t/error-fetching-alert-status-stack-monitoring/283707 "2021-09-27T12:51:18Z")
We have been using Kibana 7.9.1 and when we open stack monitoring an error message saying Error fetching alert status is being popped up. But it seems the Stack monitoring displays all monitored data correctly (CPU, mem… --- ## [How to get e-mail notification with log file path og log file hostname](https://discuss.elastic.co/t/how-to-get-e-mail-notification-with-log-file-path-og-log-file-hostname/283890)
**Author:** [@amiraliw](https://discuss.elastic.co/u/amiraliw)\ **Replies:** 1\ **Last updated:** [September 27, 2021, 12:40pm UTC](https://discuss.elastic.co/t/how-to-get-e-mail-notification-with-log-file-path-og-log-file-hostname/283890 "2021-09-27T12:40:30Z")
Hi I am very new in elasticsearch and kibana. I have elasticsearch and kibana on the same on premise server. And filebeat agents are installed on several other servers (on premise). These agents send logs to elasticsea… --- ## [Upgrade Elasticsearch from 7.8.1 to 7.14.2](https://discuss.elastic.co/t/upgrade-elasticsearch-from-7-8-1-to-7-14-2/285217)
**Author:** [@Pete\_Watcharawit](https://discuss.elastic.co/u/Pete_Watcharawit)\ **Replies:** 4\ **Last updated:** [September 27, 2021, 10:33am UTC](https://discuss.elastic.co/t/upgrade-elasticsearch-from-7-8-1-to-7-14-2/285217 "2021-09-27T10:33:23Z")
Hello, I am having two issues with the upgrade from 7.8.1 to 7.14.2 I downloaded the tar.gz file for 7.14.2 and launched the Elasticsearch instance by running /bin/Elasticsearch. The instance updates existing indices a… --- ## [Packetbeat "dropping event, queue is blocked (seq=0)"](https://discuss.elastic.co/t/packetbeat-dropping-event-queue-is-blocked-seq-0/285219)
**Author:** [@guido.lamoto](https://discuss.elastic.co/u/guido.lamoto)\ **Replies:** 0\ **Last updated:** [September 27, 2021, 10:18am UTC](https://discuss.elastic.co/t/packetbeat-dropping-event-queue-is-blocked-seq-0/285219 "2021-09-27T10:18:54Z")
We have a Packetbeat 7.15.0 on Ubuntu 20.04 directly connected to a Debian 10 with Elasticsearch 7.14.1. Packetbeat is running on a a DNS server with an average of 4000 queries/s. This is the configuration file: packet… --- ## [Node Stats API in 7.15 broken?](https://discuss.elastic.co/t/node-stats-api-in-7-15-broken/285212)
**Author:** [@oliver](https://discuss.elastic.co/u/oliver)\ **Replies:** 2\ **Last updated:** [September 27, 2021, 10:12am UTC](https://discuss.elastic.co/t/node-stats-api-in-7-15-broken/285212 "2021-09-27T10:12:22Z")
Hello! In #75433 you added a shard count structure to the Node Stats API. That results in a new JSON key named shards. However, if you run the Node Stats API with level=shards, you already have a JSON key named shards. … --- ## [How to update values present in particular field for every docs in index using DSL query](https://discuss.elastic.co/t/how-to-update-values-present-in-particular-field-for-every-docs-in-index-using-dsl-query/284885)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 1\ **Last updated:** [September 27, 2021, 9:02am UTC](https://discuss.elastic.co/t/how-to-update-values-present-in-particular-field-for-every-docs-in-index-using-dsl-query/284885 "2021-09-27T09:02:57Z")
Hi, I want to update a particular field in the index. Index contains 100 docs. I want to update field "name" with "condition\_system" in every doc where "Condition System" is present. GET part\_ther/\_search { "\_… --- ## [Elasticsearch install on MacOS USB stick fails - java.nio.channels.OverlappingFileLockException](https://discuss.elastic.co/t/elasticsearch-install-on-macos-usb-stick-fails-java-nio-channels-overlappingfilelockexception/285215)
**Author:** [@John\_Lewis](https://discuss.elastic.co/u/John_Lewis)\ **Replies:** 0\ **Last updated:** [September 27, 2021, 9:55am UTC](https://discuss.elastic.co/t/elasticsearch-install-on-macos-usb-stick-fails-java-nio-channels-overlappingfilelockexception/285215 "2021-09-27T09:55:55Z")
Running bin/Elasticsearch on 'tar -xf Elasticsearch-7.15.0-darwin-x86\_64.tar' install fails to start (base) ➜ Samsung\_T5 cd elasticsearch-7.15.0 (base) ➜ elasticsearch-7.15.0 pwd /Volumes/Samsung\_T5/elasticsearch-7.15… --- ## [No shard exception after logstash tries to index large data](https://discuss.elastic.co/t/no-shard-exception-after-logstash-tries-to-index-large-data/285193)
**Author:** [@yash\_chaudhary](https://discuss.elastic.co/u/yash_chaudhary)\ **Replies:** 4\ **Last updated:** [September 27, 2021, 9:43am UTC](https://discuss.elastic.co/t/no-shard-exception-after-logstash-tries-to-index-large-data/285193 "2021-09-27T09:43:49Z")
My goal is to migrate data from psql db to Elasticsearch. I am using jdbc plugin to achieve it. Issue: ES instance is breaking for larger db ( 700k records ) NOTE: For small db ( say 500 records ), it works perfectly … --- ## [Logstash DLQ Metrics](https://discuss.elastic.co/t/logstash-dlq-metrics/285207)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 0\ **Last updated:** [September 27, 2021, 8:54am UTC](https://discuss.elastic.co/t/logstash-dlq-metrics/285207 "2021-09-27T08:54:05Z")
Hi, Are there dead-letter-queue metrics collected by xpack? I don't see any but would have expected to find something. Thx D --- ## [Issue after install Logstash on Mac OS](https://discuss.elastic.co/t/issue-after-install-logstash-on-mac-os/284028)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 3\ **Last updated:** [September 27, 2021, 9:09am UTC](https://discuss.elastic.co/t/issue-after-install-logstash-on-mac-os/284028 "2021-09-27T09:09:08Z")
Hi I've met some problem within run Logstash on Mac also I've have followed by all commands and at least try to up Logstash instance by (logstash -f /usr/local/etc/logstash/logstash.conf --path.settings=/usr/local/etc/lo… --- ## [Recommanded shards size includes replicas or not?](https://discuss.elastic.co/t/recommanded-shards-size-includes-replicas-or-not/285203)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 2\ **Last updated:** [September 27, 2021, 9:03am UTC](https://discuss.elastic.co/t/recommanded-shards-size-includes-replicas-or-not/285203 "2021-09-27T09:03:19Z")
Hello, Documentation says : Aim for shard sizes between 10GB and 50GB but does not specifiy if it concerns only primary or primary AND replicas I mean, I have an index of 200GB and wants 1 replica. So total index size… --- ## [Using Transforms and including values which only exist on some events in the source index](https://discuss.elastic.co/t/using-transforms-and-including-values-which-only-exist-on-some-events-in-the-source-index/285067)
**Author:** [@nsouth](https://discuss.elastic.co/u/nsouth)\ **Replies:** 1\ **Last updated:** [September 27, 2021, 8:48am UTC](https://discuss.elastic.co/t/using-transforms-and-including-values-which-only-exist-on-some-events-in-the-source-index/285067 "2021-09-27T08:48:59Z")
Hi, I am trying to use Transforms to create an entity-centric index of my command logs. I need help including data that only appears on some documents. Each "command" is represented by multiple events, correlated by a co… --- ## [Graphic display of questions in different time frames](https://discuss.elastic.co/t/graphic-display-of-questions-in-different-time-frames/285150)
**Author:** [@cheerone](https://discuss.elastic.co/u/cheerone)\ **Replies:** 1\ **Last updated:** [September 27, 2021, 8:09am UTC](https://discuss.elastic.co/t/graphic-display-of-questions-in-different-time-frames/285150 "2021-09-27T08:09:00Z")
I use metricbeat system module collect servers data. When i choose "last 30 minutes" "last 24 hours" and "today",the data shown in the graph is too different. Can you explain why this is happening? Is it a statistical p… --- ## [How to build beats excluding unwanted modules?](https://discuss.elastic.co/t/how-to-build-beats-excluding-unwanted-modules/285199)
**Author:** [@8e6d5b4d49f69e9edb4c](https://discuss.elastic.co/u/8e6d5b4d49f69e9edb4c)\ **Replies:** 0\ **Last updated:** [September 27, 2021, 7:52am UTC](https://discuss.elastic.co/t/how-to-build-beats-excluding-unwanted-modules/285199 "2021-09-27T07:52:42Z")
Continuing the discussion from Beats for embedded devices?: I want to use Filebeat on an embedded device where disk is limited. Linked topic is the answer of my question, but outdated. I'm looking for how to build min… --- ## [Logstash неправильно интерпритирует входящие данные](https://discuss.elastic.co/t/logstash/284158)
**Author:** [@hellotty](https://discuss.elastic.co/u/hellotty)\ **Replies:** 3\ **Last updated:** [September 27, 2021, 7:46am UTC](https://discuss.elastic.co/t/logstash/284158 "2021-09-27T07:46:21Z")
Добрый день. Я передаю логи mdaemon с помощью filebeat и использую "multiline.pattern" для объединения строк в одно событие. С помощью logstash я создаю поля "mail from", "mail to", "message id" и т.д. И при написании … --- ## [Missing Hosts in Visulization](https://discuss.elastic.co/t/missing-hosts-in-visulization/285197)
**Author:** [@BoKu](https://discuss.elastic.co/u/BoKu)\ **Replies:** 0\ **Last updated:** [September 27, 2021, 7:41am UTC](https://discuss.elastic.co/t/missing-hosts-in-visulization/285197 "2021-09-27T07:41:33Z")
Hello, yesterday we noticed a strange problem. We depolyed 19 Nginx-VMs with Terraform / Ansible, those 19 VMs had the exactly the same configuration, regarding the filebeat config. In Kibana / Discover we were able to… --- ## [Aws multi account metric beat setup](https://discuss.elastic.co/t/aws-multi-account-metric-beat-setup/283925)
**Author:** [@sinto](https://discuss.elastic.co/u/sinto)\ **Replies:** 2\ **Last updated:** [September 27, 2021, 7:20am UTC](https://discuss.elastic.co/t/aws-multi-account-metric-beat-setup/283925 "2021-09-27T07:20:24Z")
Hi Team, Is there any way I can achieve one metricbeat.yml configuration to fetch aws cloudwatch metrics from multiple aws account and each account need seperate indexes something like like metrics-cloud-\[Account-Number… --- ## [Kibana Crash after upgrade from 7.12](https://discuss.elastic.co/t/kibana-crash-after-upgrade-from-7-12/285128)
**Author:** [@ondemand](https://discuss.elastic.co/u/ondemand)\ **Replies:** 2\ **Last updated:** [September 27, 2021, 7:02am UTC](https://discuss.elastic.co/t/kibana-crash-after-upgrade-from-7-12/285128 "2021-09-27T07:02:53Z")
I previously install 7.12 on my Mac with Brew, after upgrade to 7.15, Kibana failed to start with below error: FATAL Error: Unable to complete saved object migrations for the \[.kibana\] index. Please check the health of… --- ## [Cannot change the field format back to milliseconds - Index Pattern field](https://discuss.elastic.co/t/cannot-change-the-field-format-back-to-milliseconds-index-pattern-field/285108)
**Author:** [@parinitha.nagaraja](https://discuss.elastic.co/u/parinitha.nagaraja)\ **Replies:** 1\ **Last updated:** [September 27, 2021, 5:24am UTC](https://discuss.elastic.co/t/cannot-change-the-field-format-back-to-milliseconds-index-pattern-field/285108 "2021-09-27T05:24:07Z")
Hi, I edited the field format to convert a field from milliseconds (input) to minutes (output). But when I revert it back to original or in other words when I remove the formatting, the data still appears in minutes and… --- ## [After implementation all beats data not showing in discover](https://discuss.elastic.co/t/after-implementation-all-beats-data-not-showing-in-discover/285187)
**Author:** [@savan820](https://discuss.elastic.co/u/savan820)\ **Replies:** 2\ **Last updated:** [September 27, 2021, 4:04am UTC](https://discuss.elastic.co/t/after-implementation-all-beats-data-not-showing-in-discover/285187 "2021-09-27T04:04:38Z")
when we configured SSL and TLS my all beats output is not showing in discovered. kindly give me the resolution. --- ## [Question about grouping to get the total number of filtered buckets in a bucket](https://discuss.elastic.co/t/question-about-grouping-to-get-the-total-number-of-filtered-buckets-in-a-bucket/285183)
**Author:** [@yanglingqiang](https://discuss.elastic.co/u/yanglingqiang)\ **Replies:** 0\ **Last updated:** [September 27, 2021, 3:04am UTC](https://discuss.elastic.co/t/question-about-grouping-to-get-the-total-number-of-filtered-buckets-in-a-bucket/285183 "2021-09-27T03:04:37Z")
this is my source data \[ { "buyer\_id\_std" : 35444337, "seller\_id\_std" : 3587575, "date" : "2021-02-24T00:00:00" }, { "buyer\_id\_std" : 35444337, "seller\_id\_std" : 75848633, "date… [Previous page](https://discuss.elastic.co/latest.md?page=1459) [Next page](https://discuss.elastic.co/latest.md?page=1461)