# Latest **URL:** https://discuss.elastic.co/latest.md?page=1465 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1466 --- ## [Filebeat-json.log size and rotation](https://discuss.elastic.co/t/filebeat-json-log-size-and-rotation/283773)
**Author:** [@greggailly](https://discuss.elastic.co/u/greggailly)\ **Replies:** 3\ **Last updated:** [September 23, 2021, 6:56am UTC](https://discuss.elastic.co/t/filebeat-json-log-size-and-rotation/283773 "2021-09-23T06:56:13Z")
We are having size issues with the filebeat-json.log file. One of our servers had one 122gb filebeat-json.log, are they not supposed to rotate to prevent this ? All of our servers run windows server 2016/2019 and elast… --- ## [Update Field Type](https://discuss.elastic.co/t/update-field-type/284875)
**Author:** [@Brintha](https://discuss.elastic.co/u/Brintha)\ **Replies:** 4\ **Last updated:** [September 23, 2021, 6:26am UTC](https://discuss.elastic.co/t/update-field-type/284875 "2021-09-23T06:26:49Z")
Hello , Can anyone please help me ,how to update field type in existing index .I have no option to reindex .i want to convert long to keyword --- ## [ECK - Alternative secrets storage using CSI Driver for KeyVault in Azure](https://discuss.elastic.co/t/eck-alternative-secrets-storage-using-csi-driver-for-keyvault-in-azure/284294)
**Author:** [@x00m](https://discuss.elastic.co/u/x00m)\ **Replies:** 2\ **Last updated:** [September 23, 2021, 6:18am UTC](https://discuss.elastic.co/t/eck-alternative-secrets-storage-using-csi-driver-for-keyvault-in-azure/284294 "2021-09-23T06:18:01Z")
I have integrated my AKS cluster with Azure Keyvault CSI Driver for secrets storage. Link: GitHub - Azure/secrets-store-csi-driver-provider-azure: Azure Key Vault provider for Secret Store CSI driver allows you to get … --- ## [Understanding the role of elastic agent processes running in my local system](https://discuss.elastic.co/t/understanding-the-role-of-elastic-agent-processes-running-in-my-local-system/284961)
**Author:** [@Mann\_Mehta](https://discuss.elastic.co/u/Mann_Mehta)\ **Replies:** 1\ **Last updated:** [September 23, 2021, 6:00am UTC](https://discuss.elastic.co/t/understanding-the-role-of-elastic-agent-processes-running-in-my-local-system/284961 "2021-09-23T06:00:00Z")
After enrolling the elastic agent into my local machine, I see several processes running like elastic\_agent.exe, filebeat.exe, metricbeat.exe etc. I want to know the role of this process in much more detail? Which comm… --- ## [Elastic Agent and Fleet Server Communication](https://discuss.elastic.co/t/elastic-agent-and-fleet-server-communication/284823)
**Author:** [@Mann\_Mehta](https://discuss.elastic.co/u/Mann_Mehta)\ **Replies:** 0\ **Last updated:** [September 22, 2021, 9:06am UTC](https://discuss.elastic.co/t/elastic-agent-and-fleet-server-communication/284823 "2021-09-22T09:06:22Z")
Need a deeper understanding of how authentication workflow is implemented during the first time installation of elastic agent and how the communication of elastic agent with the fleet server is organized. I have gone th… --- ## [Is there a way to force a replica to become primary?](https://discuss.elastic.co/t/is-there-a-way-to-force-a-replica-to-become-primary/284958)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 0\ **Last updated:** [September 23, 2021, 5:25am UTC](https://discuss.elastic.co/t/is-there-a-way-to-force-a-replica-to-become-primary/284958 "2021-09-23T05:25:15Z")
Like my title suggested. Is it possible? My cluster has a rebalancing error where 1 primary shard is stuck in relocating state and I can't recover it. I'm hoping to force the replica to become the primary and configur… --- ## [Field reference from \_source for conditional output](https://discuss.elastic.co/t/field-reference-from-source-for-conditional-output/284956)
**Author:** [@alfianaf](https://discuss.elastic.co/u/alfianaf)\ **Replies:** 4\ **Last updated:** [September 23, 2021, 4:32am UTC](https://discuss.elastic.co/t/field-reference-from-source-for-conditional-output/284956 "2021-09-23T04:32:31Z")
hello, I'm new to logstash conditional, I want to make different index output based on some field reference on my logstash here is my index example : { "\_index": "iris-new-2021.09", "\_type": "\_doc", "\_id": "EKS5E… --- ## [How to read each array item into a map of key value pair?](https://discuss.elastic.co/t/how-to-read-each-array-item-into-a-map-of-key-value-pair/284769)
**Author:** [@Indigo\_Star](https://discuss.elastic.co/u/Indigo_Star)\ **Replies:** 7\ **Last updated:** [September 23, 2021, 3:34am UTC](https://discuss.elastic.co/t/how-to-read-each-array-item-into-a-map-of-key-value-pair/284769 "2021-09-23T03:34:45Z")
I have a multiline message field, msg= "CPU=9% TotalMem=12288 MB FreeMem=3895 MB AMQMemoryPercentUsage=0% n0-kkk size=0 inFlight=0 enqRate=0 deqRate=0 n1-xxx size=1 inFlight=1 enqRate=13 deqRate=2 n2-yyyy-oo si… --- ## [How can I display value outside bars? ELK 7.14](https://discuss.elastic.co/t/how-can-i-display-value-outside-bars-elk-7-14/283308)
**Author:** [@jamesraznor](https://discuss.elastic.co/u/jamesraznor)\ **Replies:** 3\ **Last updated:** [September 23, 2021, 2:49am UTC](https://discuss.elastic.co/t/how-can-i-display-value-outside-bars-elk-7-14/283308 "2021-09-23T02:49:17Z")
Hello Guys ! I would like to know two questions: how can I display the values outside bars (at the top) If not possible, I would be able to increase the size of the number value inside the bar by changing css or somet… --- ## [Connecting Enterprise Search and Kibana with ECK](https://discuss.elastic.co/t/connecting-enterprise-search-and-kibana-with-eck/284219)
**Author:** [@lgoolsby](https://discuss.elastic.co/u/lgoolsby)\ **Replies:** 1\ **Last updated:** [September 23, 2021, 2:48am UTC](https://discuss.elastic.co/t/connecting-enterprise-search-and-kibana-with-eck/284219 "2021-09-23T02:48:25Z")
When connecting Kibana and Enterprise Search, the docs say to use the host name. However, using the external DNS name that I configured for our k8s cluster does not work. I can change the host name to the internal IP add… --- ## [Error sending data to APM server](https://discuss.elastic.co/t/error-sending-data-to-apm-server/284695)
**Author:** [@Prasanth\_V](https://discuss.elastic.co/u/Prasanth_V)\ **Replies:** 7\ **Last updated:** [September 23, 2021, 2:31am UTC](https://discuss.elastic.co/t/error-sending-data-to-apm-server/284695 "2021-09-23T02:31:57Z")
Dear Team, I'm facing the below issue, Could you please suggest me? Note: We've a sufficient disk space and CPU core. 2021-09-21 12:07:05,978 \[elastic-apm-server-reporter\] WARN co.elastic.apm.agent.report.IntakeV2Rep… --- ## [Enrich processor high cpu load](https://discuss.elastic.co/t/enrich-processor-high-cpu-load/284778)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 7\ **Last updated:** [September 23, 2021, 1:11am UTC](https://discuss.elastic.co/t/enrich-processor-high-cpu-load/284778 "2021-09-23T01:11:57Z")
Hello, I have a couple of filebeats shipping data directly to elasticsearch, when this data hits elasticsearch two ingest pipelines are executed, one from the module, and another one using the final\_pipeline setting, I'… --- ## [Using Metricbeat AWS Module on Private Subnet EC2](https://discuss.elastic.co/t/using-metricbeat-aws-module-on-private-subnet-ec2/283676)
**Author:** [@roh](https://discuss.elastic.co/u/roh)\ **Replies:** 6\ **Last updated:** [September 23, 2021, 12:36am UTC](https://discuss.elastic.co/t/using-metricbeat-aws-module-on-private-subnet-ec2/283676 "2021-09-23T00:36:06Z")
Hi all! My client wants to collect ec2, ebs, rds metrics using Metricbeat on private subnet ec2 instance with AWS module. So I searched for ways to do it. Judging by document, there are common services to reach like IA… --- ## [Index pattern for all ccs deployments](https://discuss.elastic.co/t/index-pattern-for-all-ccs-deployments/284810)
**Author:** [@pbroek](https://discuss.elastic.co/u/pbroek)\ **Replies:** 0\ **Last updated:** [September 22, 2021, 7:14am UTC](https://discuss.elastic.co/t/index-pattern-for-all-ccs-deployments/284810 "2021-09-22T07:14:13Z")
Hi, Within ECE we have multiple deployments. Most of them acting as backend deployments without kibana instances. And one deployment acts as frontend where we use all kibana features. On ECE I setup CCS to all the back… --- ## [Unindexed geo\_point field. What am I missing?](https://discuss.elastic.co/t/unindexed-geo-point-field-what-am-i-missing/284482)
**Author:** [@blueren](https://discuss.elastic.co/u/blueren)\ **Replies:** 3\ **Last updated:** [September 23, 2021, 12:13am UTC](https://discuss.elastic.co/t/unindexed-geo-point-field-what-am-i-missing/284482 "2021-09-23T00:13:48Z")
I have an elastic db which takes in netflow data and enriches them. I have two fields that are defined as below, in the template. (can verify that the template exists from Kibana \> index management \> mappings) "dstGeoLo… --- ## [Kibana in ARM64 TypeError: Cannot read properties of null (reading 'message')](https://discuss.elastic.co/t/kibana-in-arm64-typeerror-cannot-read-properties-of-null-reading-message/284814)
**Author:** [@lql2019](https://discuss.elastic.co/u/lql2019)\ **Replies:** 3\ **Last updated:** [September 23, 2021, 12:09am UTC](https://discuss.elastic.co/t/kibana-in-arm64-typeerror-cannot-read-properties-of-null-reading-message/284814 "2021-09-23T00:09:42Z")
I'm using kibana 6.0 to create index-pattern in arm64 linux system, but I often get error message: TypeError: Cannot read properties of null (reading 'message') at http://10.24.37.240:5601/bundles/kibana.bundle.js?v=16… --- ## [Using workpad variables in esql queries](https://discuss.elastic.co/t/using-workpad-variables-in-esql-queries/284235)
**Author:** [@IGB042](https://discuss.elastic.co/u/IGB042)\ **Replies:** 2\ **Last updated:** [September 22, 2021, 10:51pm UTC](https://discuss.elastic.co/t/using-workpad-variables-in-esql-queries/284235 "2021-09-22T22:51:54Z")
I am developing a report in Canvas currently and several elements use the same field within their esql queries. As it is intended that this workpad would be cloned it would be really useful to use a variable in the query … --- ## [Multiple index Search using php client](https://discuss.elastic.co/t/multiple-index-search-using-php-client/284839)
**Author:** [@Jihad\_Abdulrazaq](https://discuss.elastic.co/u/Jihad_Abdulrazaq)\ **Replies:** 3\ **Last updated:** [September 22, 2021, 10:49pm UTC](https://discuss.elastic.co/t/multiple-index-search-using-php-client/284839 "2021-09-22T22:49:24Z")
Hello All, When searching across multiple indices, how to get the index name in search results using php client methods? Please your support, thanks all. --- ## [Calculations for APM Visualizations](https://discuss.elastic.co/t/calculations-for-apm-visualizations/284386)
**Author:** [@Christina01](https://discuss.elastic.co/u/Christina01)\ **Replies:** 8\ **Last updated:** [September 22, 2021, 9:31pm UTC](https://discuss.elastic.co/t/calculations-for-apm-visualizations/284386 "2021-09-22T21:31:37Z")
How can I calculate the difference between one span start time and child transaction start time and in another way - child transaction end time substract span end time on any chart --- ## [ELK SIZING](https://discuss.elastic.co/t/elk-sizing/284945)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 0\ **Last updated:** [September 22, 2021, 9:52pm UTC](https://discuss.elastic.co/t/elk-sizing/284945 "2021-09-22T21:52:41Z")
Hello Evry body, I want to deploy an ELK with the architecture: Server for master node (kibana) Server for Elasticsearch hot Server fot Elasticsearch WARM Server logstash With 23 GB data by day and the re… --- ## [Snapshot Restore - Index green & present with data, but missing data](https://discuss.elastic.co/t/snapshot-restore-index-green-present-with-data-but-missing-data/284944)
**Author:** [@elasticband](https://discuss.elastic.co/u/elasticband)\ **Replies:** 0\ **Last updated:** [September 22, 2021, 9:30pm UTC](https://discuss.elastic.co/t/snapshot-restore-index-green-present-with-data-but-missing-data/284944 "2021-09-22T21:30:53Z")
Hello everyone, I am fairly new to this whole ES thing, but I am getting through the trial by fire on my first misconfiguration. I ended up doing a snapshots from my multi node cluster and restored it to a single node t… --- ## [How to write multiline codec for python stacktrace](https://discuss.elastic.co/t/how-to-write-multiline-codec-for-python-stacktrace/284936)
**Author:** [@Chandrakant\_Naik](https://discuss.elastic.co/u/Chandrakant_Naik)\ **Replies:** 3\ **Last updated:** [September 22, 2021, 8:50pm UTC](https://discuss.elastic.co/t/how-to-write-multiline-codec-for-python-stacktrace/284936 "2021-09-22T20:50:11Z")
below is how my log is captured \[2021-09-17 14:24:16,527\] \[ERROR\] \[app\]\[MainThread\] \[5d9b63a9-dc4d-4756-af87-eba4fb275584\] \[log\_exception:1440\] : Exception on /download\_request\_data \[GET\] Traceback (most recent call las… --- ## [Elasticsearch missing results and incorrect sorting](https://discuss.elastic.co/t/elasticsearch-missing-results-and-incorrect-sorting/284930)
**Author:** [@Mike\_Miller](https://discuss.elastic.co/u/Mike_Miller)\ **Replies:** 2\ **Last updated:** [September 22, 2021, 8:30pm UTC](https://discuss.elastic.co/t/elasticsearch-missing-results-and-incorrect-sorting/284930 "2021-09-22T20:30:12Z")
I have Elasticsearch setup for searching book content. It works for the most part, however it frequently misses single search terms, especially in the 'entryTitle'. An example is in one book there is a Section title call… --- ## [How to use .conut to exclude a character from the .length count?](https://discuss.elastic.co/t/how-to-use-conut-to-exclude-a-character-from-the-length-count/284938)
**Author:** [@Rauly\_Koto](https://discuss.elastic.co/u/Rauly_Koto)\ **Replies:** 1\ **Last updated:** [September 22, 2021, 8:21pm UTC](https://discuss.elastic.co/t/how-to-use-conut-to-exclude-a-character-from-the-length-count/284938 "2021-09-22T20:21:24Z")
Currently it does the account but does not delete the "/". ruby { code =\> ' event.set("execution\_length\_input", event.get("\[execution\]\[input\]").to\_s.length - ("\[execution\]\[input\]… --- ## [🎉 Elastic Stack 7.15 released](https://discuss.elastic.co/t/elastic-stack-7-15-released/284939)
**Author:** [@elyssaemrich](https://discuss.elastic.co/u/elyssaemrich)\ **Replies:** 0\ **Last updated:** [September 22, 2021, 8:18pm UTC](https://discuss.elastic.co/t/elastic-stack-7-15-released/284939 "2021-09-22T20:18:24Z")
New in Elastic 7.15 With Elastic 7.15 comes the general availability of the Elastic App Search web crawler and tighter integrations with Google Cloud — enabling our customers and community to more quickly create powerful… --- ## [Convert int to DateTime in Nest query?](https://discuss.elastic.co/t/convert-int-to-datetime-in-nest-query/284937)
**Author:** [@bensalerno](https://discuss.elastic.co/u/bensalerno)\ **Replies:** 0\ **Last updated:** [September 22, 2021, 7:45pm UTC](https://discuss.elastic.co/t/convert-int-to-datetime-in-nest-query/284937 "2021-09-22T19:45:53Z")
I am attempting to query an ES cluster through Nest. However, I'm having an issue because my types are not matching. This is the C# side: As you can see CreatedTimeStamp is a DateTime. However, this is what I recei… --- ## [Elastic search will not bind to port 80 (no web server is running)](https://discuss.elastic.co/t/elastic-search-will-not-bind-to-port-80-no-web-server-is-running/284658)
**Author:** [@lsnwebmaster](https://discuss.elastic.co/u/lsnwebmaster)\ **Replies:** 6\ **Last updated:** [September 22, 2021, 7:30pm UTC](https://discuss.elastic.co/t/elastic-search-will-not-bind-to-port-80-no-web-server-is-running/284658 "2021-09-22T19:30:55Z")
I am trying elasticsearch as a standalone search for WordPress. I created a new server on Ubuntu 20.04 LTS with nothing but elasticsearch. I did nothing to the config file, accepting all defaults. It started fine on port… --- ## [Kibana CSV Export Error](https://discuss.elastic.co/t/kibana-csv-export-error/284254)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 7\ **Last updated:** [September 22, 2021, 7:10pm UTC](https://discuss.elastic.co/t/kibana-csv-export-error/284254 "2021-09-22T19:10:13Z")
Hi I have a problem about exporting logs to CSV file according to the bellow picture: Users have reporting\_user role. The file is less than 10mb and contains few rows. How can I solve this issue --- ## [APT repository failing](https://discuss.elastic.co/t/apt-repository-failing/284915)
**Author:** [@armov](https://discuss.elastic.co/u/armov)\ **Replies:** 3\ **Last updated:** [September 22, 2021, 6:55pm UTC](https://discuss.elastic.co/t/apt-repository-failing/284915 "2021-09-22T18:55:45Z")
Elasticsearch repository in a Ubuntu focal 20.04 throws the following error while attempting to update apt: E: Failed to fetch https://artifacts.elastic.co/packages/7.x/apt/dists/stable/main/binary-amd64/Packages.bz2 F… --- ## [Extracting string from log path](https://discuss.elastic.co/t/extracting-string-from-log-path/284748)
**Author:** [@Bkumar](https://discuss.elastic.co/u/Bkumar)\ **Replies:** 9\ **Last updated:** [September 22, 2021, 6:30pm UTC](https://discuss.elastic.co/t/extracting-string-from-log-path/284748 "2021-09-22T18:30:59Z")
Hi, As per requirement, i can't put the tag to filebeat to filter log path at logstash end. So only option left with me to filter the log path on the basis of string. Here is the sample log path- /opt/tomcat/instances… [Previous page](https://discuss.elastic.co/latest.md?page=1464) [Next page](https://discuss.elastic.co/latest.md?page=1466)