# Latest **URL:** https://discuss.elastic.co/latest.md?page=1472 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1473 --- ## [Metricbeat doesnt create event when service is down](https://discuss.elastic.co/t/metricbeat-doesnt-create-event-when-service-is-down/284424)
**Author:** [@Deny7](https://discuss.elastic.co/u/Deny7)\ **Replies:** 0\ **Last updated:** [September 16, 2021, 4:59pm UTC](https://discuss.elastic.co/t/metricbeat-doesnt-create-event-when-service-is-down/284424 "2021-09-16T16:59:36Z")
Hi, Hi, Im using Metricbeat 7.9 and Elastalert for filesystem usage for each mountpoint. I also want to add alerting when linux service is stopped, so I enabled "- service" and "-process" in metricbeat.reference.yml. Wh… --- ## [Container vs Dedicated Instances Benchmarks](https://discuss.elastic.co/t/container-vs-dedicated-instances-benchmarks/284460)
**Author:** [@ithfdemir](https://discuss.elastic.co/u/ithfdemir)\ **Replies:** 1\ **Last updated:** [September 20, 2021, 4:49am UTC](https://discuss.elastic.co/t/container-vs-dedicated-instances-benchmarks/284460 "2021-09-20T04:49:08Z")
Hi, I have an Elasticsearch cluster (71 Nodes (64 data + 7 master) running in 16 dedicated servers). I'm considering about containerization for this running cluster. Is it possible? If yes, is there any benchmarks or no… --- ## [Search all indices and exclude one](https://discuss.elastic.co/t/search-all-indices-and-exclude-one/284498)
**Author:** [@schawla](https://discuss.elastic.co/u/schawla)\ **Replies:** 2\ **Last updated:** [September 20, 2021, 4:39am UTC](https://discuss.elastic.co/t/search-all-indices-and-exclude-one/284498 "2021-09-20T04:39:06Z")
How can we search all indices across elastic search and exlude one from the list. Something like Nest.Indices search = "\_all,-kibana" --- ## [Nest returning results as IReadOnlyCollection, how to change it so it is usable?](https://discuss.elastic.co/t/nest-returning-results-as-ireadonlycollection-how-to-change-it-so-it-is-usable/284512)
**Author:** [@bensalerno](https://discuss.elastic.co/u/bensalerno)\ **Replies:** 0\ **Last updated:** [September 17, 2021, 7:40pm UTC](https://discuss.elastic.co/t/nest-returning-results-as-ireadonlycollection-how-to-change-it-so-it-is-usable/284512 "2021-09-17T19:40:31Z")
Using elasticsearch, I'm trying to add my hit results into a list after they are returned, like this: var lstModels = new SearchResult\(); var searchResponse = Event.client.Search\(s =\> s … --- ## [Elastic Search Index Mapping](https://discuss.elastic.co/t/elastic-search-index-mapping/284511)
**Author:** [@yun983](https://discuss.elastic.co/u/yun983)\ **Replies:** 7\ **Last updated:** [September 20, 2021, 4:35am UTC](https://discuss.elastic.co/t/elastic-search-index-mapping/284511 "2021-09-20T04:35:58Z")
NEED HELP...... I am trying to add a an array of dictionaries as a field in existing elastic search cluster. Previously my data looked like this: "businessBureauId": "3699", "businessRecordId": "3699", "businessR… --- ## [Caused by: org.elasticsearch.action.UnavailableShardsException: \[.monitoring-es-7-2021.09.17\]\[0\] primary shard is not active Timeout: \[1m\], request: \[BulkShardRequest \[\[.monitoring-es-7-2021.09.17\]\[0\]\] containing \[463\] requests\] ... 11 more](https://discuss.elastic.co/t/caused-by-org-elasticsearch-action-unavailableshardsexception-monitoring-es-7-2021-09-17-0-primary-shard-is-not-active-timeout-1m-request-bulkshardrequest-monitoring-es-7-2021-09-17-0-containing-463-requests-11-more/284520)
**Author:** [@Ashwin\_Patil1](https://discuss.elastic.co/u/Ashwin_Patil1)\ **Replies:** 1\ **Last updated:** [September 20, 2021, 4:34am UTC](https://discuss.elastic.co/t/caused-by-org-elasticsearch-action-unavailableshardsexception-monitoring-es-7-2021-09-17-0-primary-shard-is-not-active-timeout-1m-request-bulkshardrequest-monitoring-es-7-2021-09-17-0-containing-463-requests-11-more/284520 "2021-09-20T04:34:42Z")
How to troubleshoot the following? Caused by: org.elasticsearch.action.UnavailableShardsException: \[.monitoring-es-7-2021.09.17\]\[0\] primary shard is not active Timeout: \[1m\], request: \[BulkShardRequest \[\[.monitoring-es-… --- ## [Can't scale ElasticSearch cluster](https://discuss.elastic.co/t/cant-scale-elasticsearch-cluster/284577)
**Author:** [@mxmtrms](https://discuss.elastic.co/u/mxmtrms)\ **Replies:** 1\ **Last updated:** [September 20, 2021, 4:17am UTC](https://discuss.elastic.co/t/cant-scale-elasticsearch-cluster/284577 "2021-09-20T04:17:35Z")
Hello everyone! Prerequisites For the last year my team and I have been developing a project in which we decided to use ElasticSearch. In the early stages of development, we used a simple single-node cluster that more … --- ## [Getting Error-Cannot delete files/directories outside the current working directory when i wants to generate visualization report in pdf](https://discuss.elastic.co/t/getting-error-cannot-delete-files-directories-outside-the-current-working-directory-when-i-wants-to-generate-visualization-report-in-pdf/283633)
**Author:** [@syed0510](https://discuss.elastic.co/u/syed0510)\ **Replies:** 28\ **Last updated:** [September 20, 2021, 4:21am UTC](https://discuss.elastic.co/t/getting-error-cannot-delete-files-directories-outside-the-current-working-directory-when-i-wants-to-generate-visualization-report-in-pdf/283633 "2021-09-20T04:21:49Z")
Kibana Version: 7.6.1 ElasticSearch version- 6.4.0 Getting address invalid error when wants to generate visualization report in pdf{attaching screenshot of error }. Attaching log files details also. log file is sh… --- ## [Logstash service getting restarted after trying to set keystore on \`v7.14\`](https://discuss.elastic.co/t/logstash-service-getting-restarted-after-trying-to-set-keystore-on-v7-14/284582)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 15\ **Last updated:** [September 20, 2021, 2:28am UTC](https://discuss.elastic.co/t/logstash-service-getting-restarted-after-trying-to-set-keystore-on-v7-14/284582 "2021-09-20T02:28:40Z")
Hi Team, I am trying to set logstash keystore but having hard time. I have refer below link but still its not working. (not creating keystore password from below) I am creating keystore as, echo y | /usr/share/log… --- ## [About the principle of error.grouping\_key](https://discuss.elastic.co/t/about-the-principle-of-error-grouping-key/283622)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 10\ **Last updated:** [September 20, 2021, 1:08am UTC](https://discuss.elastic.co/t/about-the-principle-of-error-grouping-key/283622 "2021-09-20T01:08:24Z")
When service.name, url\_path, and type are the same, why sometimes the id is the same, sometimes not the same id I want to know the error\_group\_id calculated according to what formula？ Is the same event generated… --- ## [Zabbix 5.4, unable send data to Elastic Search (date field)](https://discuss.elastic.co/t/zabbix-5-4-unable-send-data-to-elastic-search-date-field/284585)
**Author:** [@denisb](https://discuss.elastic.co/u/denisb)\ **Replies:** 0\ **Last updated:** [September 20, 2021, 12:34am UTC](https://discuss.elastic.co/t/zabbix-5-4-unable-send-data-to-elastic-search-date-field/284585 "2021-09-20T00:34:49Z")
Hello everybody. There is zabbix 5.4 and Elastic Search 7.11.2. Problem: Can't send data over zabbix\_sender to the element type "zabbix trapper" Error: elastic\_writer\_flush() cannot send data to elasticsearch: index… --- ## [Is there a .NET client for VSCode?](https://discuss.elastic.co/t/is-there-a-net-client-for-vscode/284215)
**Author:** [@bensalerno](https://discuss.elastic.co/u/bensalerno)\ **Replies:** 4\ **Last updated:** [September 19, 2021, 10:55pm UTC](https://discuss.elastic.co/t/is-there-a-net-client-for-vscode/284215 "2021-09-19T22:55:22Z")
I am trying to create a file to write ElasticSearch queries from C#. I have seen that there is are 2 official ElasticSearch clients for .NET (Introduction | Elasticsearch.Net and NEST: the .NET clients \[7.x\] | Elastic) h… --- ## [Failed to Parse Date Field](https://discuss.elastic.co/t/failed-to-parse-date-field/284576)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 2\ **Last updated:** [September 19, 2021, 10:34pm UTC](https://discuss.elastic.co/t/failed-to-parse-date-field/284576 "2021-09-19T22:34:18Z")
I have some CSV files I'm trying to ingest using Logstash's CVS filter plugin. I'm needing the "Date" column to represent the event time field in Kibana (rather than @timestamp, which just tells me when I imported the CS… --- ## [Kibana Showing partial data for Mulesoft API's. Urgent help needed](https://discuss.elastic.co/t/kibana-showing-partial-data-for-mulesoft-apis-urgent-help-needed/284301)
**Author:** [@haribabu.vadlapati](https://discuss.elastic.co/u/haribabu.vadlapati)\ **Replies:** 3\ **Last updated:** [September 19, 2021, 10:09pm UTC](https://discuss.elastic.co/t/kibana-showing-partial-data-for-mulesoft-apis-urgent-help-needed/284301 "2021-09-19T22:09:33Z")
Hello Elastic Community, We are using ELK Stack to monitor Mulesoft cle framework log feeding using filebeat configuration installed on Linux Servers(same servers hosting JV services). We also have different Elastic se… --- ## [Lifecycle policy setting index read-only even with the option disabled](https://discuss.elastic.co/t/lifecycle-policy-setting-index-read-only-even-with-the-option-disabled/284572)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 1\ **Last updated:** [September 19, 2021, 4:07pm UTC](https://discuss.elastic.co/t/lifecycle-policy-setting-index-read-only-even-with-the-option-disabled/284572 "2021-09-19T16:07:43Z")
Hello, I have a hot-warm architecture and a couple of ILM that will move the index from the hot nodes to the warm nodes based on the age. I have an index that is created daily and is moved to the warm nodes after 7 day… --- ## [Logstash bug while removing field](https://discuss.elastic.co/t/logstash-bug-while-removing-field/284562)
**Author:** [@zeoiioze](https://discuss.elastic.co/u/zeoiioze)\ **Replies:** 0\ **Last updated:** [September 19, 2021, 12:13pm UTC](https://discuss.elastic.co/t/logstash-bug-while-removing-field/284562 "2021-09-19T12:13:57Z")
Hey, I realized that the following line : remove\_field =\> \[ "\[doc\]\[vegetables\]\[%{\[tmp\_vegetable\_data\]\[name\]}\]" \] Was not only removing \[doc\]\[vegetables\]\[%{\[tmp\_vegetable\_data\]\[name\]}\], but was also like removing \[tmp\_… --- ## [Filebeat add\_id processor mechanism](https://discuss.elastic.co/t/filebeat-add-id-processor-mechanism/284560)
**Author:** [@Musketeer7](https://discuss.elastic.co/u/Musketeer7)\ **Replies:** 0\ **Last updated:** [September 19, 2021, 11:13am UTC](https://discuss.elastic.co/t/filebeat-add-id-processor-mechanism/284560 "2021-09-19T11:13:36Z")
Hello everyone. I have this relatively large cluster of ES, where logs from many filebeat instances are being shipped into. There are plenty of duplicates, that we can't identify their origin for sure. And because of re… --- ## [Can't send winlogbeat data to logstash](https://discuss.elastic.co/t/cant-send-winlogbeat-data-to-logstash/284489)
**Author:** [@Minh\_Ti\_n\_Tr\_n](https://discuss.elastic.co/u/Minh_Ti_n_Tr_n)\ **Replies:** 2\ **Last updated:** [September 19, 2021, 10:51am UTC](https://discuss.elastic.co/t/cant-send-winlogbeat-data-to-logstash/284489 "2021-09-19T10:51:23Z")
Hi all, I now do the ELK lab with docker The repo: https://github.com/deviantony/docker-elk/ ELK stack host IP: 192.168.87.52 My logstash/pipeline/logstash.conf input { beats { port =\> 5044 … --- ## [Remove the number from the field, and only remain letter](https://discuss.elastic.co/t/remove-the-number-from-the-field-and-only-remain-letter/284548)
**Author:** [@zaidsalah](https://discuss.elastic.co/u/zaidsalah)\ **Replies:** 5\ **Last updated:** [September 19, 2021, 10:23am UTC](https://discuss.elastic.co/t/remove-the-number-from-the-field-and-only-remain-letter/284548 "2021-09-19T10:23:35Z")
remove the number from the field, only I want letter . in my PDF have table contain name and id, id is number when I index and using ingest attachment pipeline number will store as well like this id name 123 user… --- ## [How can I combine some mysql query events with logstash aggregate filter?](https://discuss.elastic.co/t/how-can-i-combine-some-mysql-query-events-with-logstash-aggregate-filter/284533)
**Author:** [@e-fo](https://discuss.elastic.co/u/e-fo)\ **Replies:** 2\ **Last updated:** [September 19, 2021, 6:13am UTC](https://discuss.elastic.co/t/how-can-i-combine-some-mysql-query-events-with-logstash-aggregate-filter/284533 "2021-09-19T06:13:09Z")
Hello, I implemented pipeline with JDBC input plugin, my table in mysql follow the EAV (Entity-Attribute-Value) structure, therefore I can't get all attributes that related to one user (Entity) in one row with mysql que… --- ## [Handling of gigantic unsearchable fields](https://discuss.elastic.co/t/handling-of-gigantic-unsearchable-fields/284552)
**Author:** [@typewar](https://discuss.elastic.co/u/typewar)\ **Replies:** 0\ **Last updated:** [September 19, 2021, 5:52am UTC](https://discuss.elastic.co/t/handling-of-gigantic-unsearchable-fields/284552 "2021-09-19T05:52:20Z")
Hello. I was wondering what good methods for handling gigantic fields are? Let's say a document has an array field for unique visitors of a post, so it will save the ip or the username in this array. If the post now … --- ## [Zeek & ELK integration (A lot of strange fields)](https://discuss.elastic.co/t/zeek-elk-integration-a-lot-of-strange-fields/284547)
**Author:** [@test\_qweqwe](https://discuss.elastic.co/u/test_qweqwe)\ **Replies:** 4\ **Last updated:** [September 18, 2021, 9:02pm UTC](https://discuss.elastic.co/t/zeek-elk-integration-a-lot-of-strange-fields/284547 "2021-09-18T21:02:23Z")
Hi there, I set up ELK and then beats on Zeek server to send data to Elasticsearch. Everything is good except one: there are a lot of fields - 308 And it creates an element of inconvenience for me to create a searc… --- ## [How to match 2 key value pairs in unstructured string that looks like column](https://discuss.elastic.co/t/how-to-match-2-key-value-pairs-in-unstructured-string-that-looks-like-column/284541)
**Author:** [@ansamHox](https://discuss.elastic.co/u/ansamHox)\ **Replies:** 10\ **Last updated:** [September 18, 2021, 7:15pm UTC](https://discuss.elastic.co/t/how-to-match-2-key-value-pairs-in-unstructured-string-that-looks-like-column/284541 "2021-09-18T19:15:51Z")
I have a document with some lines like: Example requested: 24:00:00 Example Used: 01:14:11 What I want is to have is: { "example\_requested": "24:00:00", "example\_used": 01:14:11 } What I tried (t… --- ## [Check if a field exists](https://discuss.elastic.co/t/check-if-a-field-exists/284545)
**Author:** [@zeoiioze](https://discuss.elastic.co/u/zeoiioze)\ **Replies:** 1\ **Last updated:** [September 18, 2021, 4:25pm UTC](https://discuss.elastic.co/t/check-if-a-field-exists/284545 "2021-09-18T16:25:50Z")
I'm using nested fields and a field name in the nested field name, as you can see below (example) : \[doc\]\[vegetables\]\[%{\[tmp\_data\]\[vegetable\_name\]}\]\[number\] The field above is getting created, but now, I want in anot… --- ## [Kibana dashboards and index patterns lost after delete kibana pod](https://discuss.elastic.co/t/kibana-dashboards-and-index-patterns-lost-after-delete-kibana-pod/284422)
**Author:** [@humartinez](https://discuss.elastic.co/u/humartinez)\ **Replies:** 1\ **Last updated:** [September 18, 2021, 1:27pm UTC](https://discuss.elastic.co/t/kibana-dashboards-and-index-patterns-lost-after-delete-kibana-pod/284422 "2021-09-18T13:27:33Z")
Hi, I just delete the kibana pod that I build with eck and I lost all the dashboards and index patterns that I've created. I thought that that info was loaded in the .kibana index. Its theres a way that I can recover th… --- ## [\[apm-agent-php\] Crash PHP application after enable APM agent](https://discuss.elastic.co/t/apm-agent-php-crash-php-application-after-enable-apm-agent/284543)
**Author:** [@quan.vo.zalora](https://discuss.elastic.co/u/quan.vo.zalora)\ **Replies:** 0\ **Last updated:** [September 18, 2021, 12:59pm UTC](https://discuss.elastic.co/t/apm-agent-php-crash-php-application-after-enable-apm-agent/284543 "2021-09-18T12:59:35Z")
I'm installing apm-agent-php by adding a script to my Dockerfile RUN apk --no-cache add curl-dev gcc g++ make autoconf && \\ mkdir -p /etc/apm-agent && \\ curl -L "https://github.com/elastic/apm-agent-php/archive/refs… --- ## ["suggest\_mode": "always" doesn't work for term suggester](https://discuss.elastic.co/t/suggest-mode-always-doesnt-work-for-term-suggester/284537)
**Author:** [@Tomohiro](https://discuss.elastic.co/u/Tomohiro)\ **Replies:** 0\ **Last updated:** [September 18, 2021, 7:56am UTC](https://discuss.elastic.co/t/suggest-mode-always-doesnt-work-for-term-suggester/284537 "2021-09-18T07:56:07Z")
Hello everyone. I'm a rookie cloud developer who is working on a full stack web service. We are introducing elasticsearch to fetch suggestions of movie title. The problem is suggestions couldn't be fetched when the que… --- ## [DSL Query to search in message field for some value and it must not contain something else](https://discuss.elastic.co/t/dsl-query-to-search-in-message-field-for-some-value-and-it-must-not-contain-something-else/284450)
**Author:** [@mguttula](https://discuss.elastic.co/u/mguttula)\ **Replies:** 1\ **Last updated:** [September 18, 2021, 7:35am UTC](https://discuss.elastic.co/t/dsl-query-to-search-in-message-field-for-some-value-and-it-must-not-contain-something-else/284450 "2021-09-18T07:35:25Z")
Trying to come up with a query to search "message" field for something like "Hello" and also the field must not contain strings like "Test" "TestProcess". "UpdatingTestProcess" Below are sample messages: Message: Hel… --- ## [Disk partitioning for Elasticsearch](https://discuss.elastic.co/t/disk-partitioning-for-elasticsearch/284459)
**Author:** [@ithfdemir](https://discuss.elastic.co/u/ithfdemir)\ **Replies:** 1\ **Last updated:** [September 18, 2021, 7:29am UTC](https://discuss.elastic.co/t/disk-partitioning-for-elasticsearch/284459 "2021-09-18T07:29:08Z")
Hi, I have SAS and SSD disk coming from data center's pool. I want to setup my Elasticsearch cluster with those disks. I want to use SSDs only for recent 1 week and SAS for past. Is it possible? This setup will be ded… --- ## [Filebeat merge input duplicate logs](https://discuss.elastic.co/t/filebeat-merge-input-duplicate-logs/284506)
**Author:** [@dangge](https://discuss.elastic.co/u/dangge)\ **Replies:** 2\ **Last updated:** [September 18, 2021, 6:53am UTC](https://discuss.elastic.co/t/filebeat-merge-input-duplicate-logs/284506 "2021-09-18T06:53:36Z")
we had meet some linux filesystem error recently,a troublesome thing is that Linux will log a large number of the same logs at a certain point in time.like this: we use filebeat and logstash to record this error and … [Previous page](https://discuss.elastic.co/latest.md?page=1471) [Next page](https://discuss.elastic.co/latest.md?page=1473)