# Latest **URL:** https://discuss.elastic.co/latest.md?page=1529 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1530 --- ## [Logstash degrading after a few days and restart solves the issue temporarily](https://discuss.elastic.co/t/logstash-degrading-after-a-few-days-and-restart-solves-the-issue-temporarily/281231)
**Author:** [@dimitris\_sb](https://discuss.elastic.co/u/dimitris_sb)\ **Replies:** 0\ **Last updated:** [August 12, 2021, 4:13pm UTC](https://discuss.elastic.co/t/logstash-degrading-after-a-few-days-and-restart-solves-the-issue-temporarily/281231 "2021-08-12T16:13:07Z")
Hi All, We are using a cluster of two logstash instances (7.13.4) to ingest data to a three-node cluster (7.13.4). We noticed that after a few days the ingest rate falls from 30K - 50K to less than 30K and the data are … --- ## [Découpage avec split ne fonctionne pas](https://discuss.elastic.co/t/decoupage-avec-split-ne-fonctionne-pas/281225)
**Author:** [@Christophe\_Dumont](https://discuss.elastic.co/u/Christophe_Dumont)\ **Replies:** 1\ **Last updated:** [August 12, 2021, 3:46pm UTC](https://discuss.elastic.co/t/decoupage-avec-split-ne-fonctionne-pas/281225 "2021-08-12T15:46:50Z")
Bonjour, Je souhaite indexer des paquets réseau et en extraire certaines informations mais logstash envoi tout dans un champ unique. Voici le code logstash : input { kafka { bootstrap\_servers =\> "172.16.238.204:… --- ## ['Intelligently' cutting out results](https://discuss.elastic.co/t/intelligently-cutting-out-results/281194)
**Author:** [@slawosz](https://discuss.elastic.co/u/slawosz)\ **Replies:** 3\ **Last updated:** [August 12, 2021, 3:27pm UTC](https://discuss.elastic.co/t/intelligently-cutting-out-results/281194 "2021-08-12T15:27:04Z")
Hi, lets say I have products with serial numbers, and format is FOO-XXXXX where FOO is always there and XXXXX are digits. When I search for FOO-12345, the results are showing all products, for example (score in bracket… --- ## [How should I filter this date?](https://discuss.elastic.co/t/how-should-i-filter-this-date/281185)
**Author:** [@AbelAlejandro](https://discuss.elastic.co/u/AbelAlejandro)\ **Replies:** 1\ **Last updated:** [August 12, 2021, 3:16pm UTC](https://discuss.elastic.co/t/how-should-i-filter-this-date/281185 "2021-08-12T15:16:50Z")
My logs are TSVs that look like the following: |timestamp\_fmt|timestamp\_ms|key|tictoc\_ms|mem\_jvm|mem\_phy\_os|tags|comment| |---|---|---|---|---|---|---|---| |2021-08-11T13-55-39.202|1628682939202|SCENARIO|TIC|4548715304|… --- ## [Kafka to logstash , with dynamic topic creation](https://discuss.elastic.co/t/kafka-to-logstash-with-dynamic-topic-creation/281181)
**Author:** [@navox\_nadhir](https://discuss.elastic.co/u/navox_nadhir)\ **Replies:** 1\ **Last updated:** [August 12, 2021, 3:16pm UTC](https://discuss.elastic.co/t/kafka-to-logstash-with-dynamic-topic-creation/281181 "2021-08-12T15:16:43Z")
I have a question ; i need to know if logstash can handle the creation of topics kafka dynamically basing on feilds ! as un output ! the pipeline is kafka input --\> logstash --\> kafka output the use case is kubernet… --- ## [File Input codec =\> "json\_lines" won't work](https://discuss.elastic.co/t/file-input-codec-json-lines-wont-work/281196)
**Author:** [@panagiss](https://discuss.elastic.co/u/panagiss)\ **Replies:** 2\ **Last updated:** [August 12, 2021, 3:05pm UTC](https://discuss.elastic.co/t/file-input-codec-json-lines-wont-work/281196 "2021-08-12T15:05:26Z")
I try to read from a json file but codec=\>"json\_lines" won't work, can't see any output. But when i try and set codec=\>"json" it works and parses the data and i see the output. So you ask me what is the format of the js… --- ## [SEO friendly URLs in React](https://discuss.elastic.co/t/seo-friendly-urls-in-react/281217)
**Author:** [@xubisid](https://discuss.elastic.co/u/xubisid)\ **Replies:** 2\ **Last updated:** [August 12, 2021, 2:40pm UTC](https://discuss.elastic.co/t/seo-friendly-urls-in-react/281217 "2021-08-12T14:40:41Z")
\#Hi, Can someone please share the sample in which our facets/filters will work on behalf of the SEO friendly URLs instead of the following URL http://localhost:3000/?size=n\_20\_n&filters\[0\]\[field\]=store&filters\[0\]\[value… --- ## [Kibana is helpful but interface is very horrible](https://discuss.elastic.co/t/kibana-is-helpful-but-interface-is-very-horrible/281117)
**Author:** [@bailarch](https://discuss.elastic.co/u/bailarch)\ **Replies:** 4\ **Last updated:** [August 12, 2021, 2:30pm UTC](https://discuss.elastic.co/t/kibana-is-helpful-but-interface-is-very-horrible/281117 "2021-08-12T14:30:20Z")
Hello, I've been using Kibana for months but something that really irritates me is the value limit for Lens. Dashboard lens is super intuitive and I love it but its very disappointing to see how the value limit is only … --- ## [Ansible Playbook - cluster.remote.connect Understanding and cross-cluster replication](https://discuss.elastic.co/t/ansible-playbook-cluster-remote-connect-understanding-and-cross-cluster-replication/281216)
**Author:** [@jthart](https://discuss.elastic.co/u/jthart)\ **Replies:** 0\ **Last updated:** [August 12, 2021, 2:23pm UTC](https://discuss.elastic.co/t/ansible-playbook-cluster-remote-connect-understanding-and-cross-cluster-replication/281216 "2021-08-12T14:23:10Z")
I have an elasticsearch deployment consisting of one cluster, and I want to create a second cluster for a primary/secondary setup with cross-cluster replication. Is there something I can be pointed to to understand all o… --- ## [What are the advantages and the disadvantages of running multiple instances of logstash in the same cluster?](https://discuss.elastic.co/t/what-are-the-advantages-and-the-disadvantages-of-running-multiple-instances-of-logstash-in-the-same-cluster/281087)
**Author:** [@xemyleex](https://discuss.elastic.co/u/xemyleex)\ **Replies:** 3\ **Last updated:** [August 12, 2021, 2:13pm UTC](https://discuss.elastic.co/t/what-are-the-advantages-and-the-disadvantages-of-running-multiple-instances-of-logstash-in-the-same-cluster/281087 "2021-08-12T14:13:21Z")
What are the advantages and the disadvantages of running multiple instances of logstash in the same cluster? --- ## [Drop events from metricbeat is not working](https://discuss.elastic.co/t/drop-events-from-metricbeat-is-not-working/281208)
**Author:** [@fpsouza](https://discuss.elastic.co/u/fpsouza)\ **Replies:** 2\ **Last updated:** [August 12, 2021, 1:51pm UTC](https://discuss.elastic.co/t/drop-events-from-metricbeat-is-not-working/281208 "2021-08-12T13:51:42Z")
Hello Folks, as you can see below, I'm not being able to drop event when doesn't have "system". Could u please let me know if if is possible to do that? I really appreciate your help and time processors: drop\_event… --- ## [How to define what data is sent to Elastic from Logstash?](https://discuss.elastic.co/t/how-to-define-what-data-is-sent-to-elastic-from-logstash/279995)
**Author:** [@profsteve](https://discuss.elastic.co/u/profsteve)\ **Replies:** 8\ **Last updated:** [August 12, 2021, 1:37pm UTC](https://discuss.elastic.co/t/how-to-define-what-data-is-sent-to-elastic-from-logstash/279995 "2021-08-12T13:37:12Z")
Hello, I have ELK running on Ubuntu Server with the intention of it receiving Syslog from firewalls and Filebeat from DNS/DHCP/AD services. The primary issue is the firewalls make a lot of Syslog noise without there be… --- ## [Failed to parse field](https://discuss.elastic.co/t/failed-to-parse-field/281112)
**Author:** [@Senthil\_ak](https://discuss.elastic.co/u/Senthil_ak)\ **Replies:** 4\ **Last updated:** [August 12, 2021, 1:25pm UTC](https://discuss.elastic.co/t/failed-to-parse-field/281112 "2021-08-12T13:25:01Z")
Hi admin, I am getting some strange exception in the logstash all of a sudden. I try to debug but unable to do so. Need your kind help. \[2021-08-11T15:37:35,189\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index e… --- ## [Filtering the data list from Discover to only see Unique Ids](https://discuss.elastic.co/t/filtering-the-data-list-from-discover-to-only-see-unique-ids/280472)
**Author:** [@bailarch](https://discuss.elastic.co/u/bailarch)\ **Replies:** 10\ **Last updated:** [August 12, 2021, 1:10pm UTC](https://discuss.elastic.co/t/filtering-the-data-list-from-discover-to-only-see-unique-ids/280472 "2021-08-12T13:10:25Z")
Hello guys - not sure if the subcategory for this issue is docker (not sure what this is but the other options seem incorrect for me) I am trying to get the list of all the users name from Discovery. However I am seein… --- ## [Does kibana understand package registry via proxy?](https://discuss.elastic.co/t/does-kibana-understand-package-registry-via-proxy/281086)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 1\ **Last updated:** [August 12, 2021, 1:04pm UTC](https://discuss.elastic.co/t/does-kibana-understand-package-registry-via-proxy/281086 "2021-08-12T13:04:01Z")
Hi, Appearantly since 7.14 (fleet = GA) I am required to have internet access for my selfmanaged kibana's to reach some packet registry (or host one myself). However, I set a proxy in the environment and am still not… --- ## [Elastic workloads deployed in GCP stopped working with connection timeout errors](https://discuss.elastic.co/t/elastic-workloads-deployed-in-gcp-stopped-working-with-connection-timeout-errors/280698)
**Author:** [@Amirtha\_Saminathan](https://discuss.elastic.co/u/Amirtha_Saminathan)\ **Replies:** 1\ **Last updated:** [August 12, 2021, 12:50pm UTC](https://discuss.elastic.co/t/elastic-workloads-deployed-in-gcp-stopped-working-with-connection-timeout-errors/280698 "2021-08-12T12:50:02Z")
The elastic search master, data and client have stopped communicating with each other and we see NodeDisconnectedException and connection timeout errors on 9300 port --- ## [Custom role via Secret not created](https://discuss.elastic.co/t/custom-role-via-secret-not-created/280581)
**Author:** [@pkaramol](https://discuss.elastic.co/u/pkaramol)\ **Replies:** 1\ **Last updated:** [August 12, 2021, 12:40pm UTC](https://discuss.elastic.co/t/custom-role-via-secret-not-created/280581 "2021-08-12T12:40:15Z")
I am trying to create custom roles declaratively in ECK (leveraging the file-based role management), therefore I rely on the usage of Secrets as per the instructions found here. I am defining the following Secret resour… --- ## [Filebeat doesn't catchup with suricata eve.json](https://discuss.elastic.co/t/filebeat-doesnt-catchup-with-suricata-eve-json/281153)
**Author:** [@3c2c2ff5](https://discuss.elastic.co/u/3c2c2ff5)\ **Replies:** 6\ **Last updated:** [August 12, 2021, 12:20pm UTC](https://discuss.elastic.co/t/filebeat-doesnt-catchup-with-suricata-eve-json/281153 "2021-08-12T12:20:02Z")
Hello ELK community, I am fairly new to the subject ELK stack, I am trying to setup an IDS with suricata and ELK, the initial setup went pretty good, but I realized that the suricata events from eve.json are not getting… --- ## [Unclear how logstash fingerprint treats empty/non-existing fields](https://discuss.elastic.co/t/unclear-how-logstash-fingerprint-treats-empty-non-existing-fields/281157)
**Author:** [@AdmireDirac](https://discuss.elastic.co/u/AdmireDirac)\ **Replies:** 1\ **Last updated:** [August 12, 2021, 12:00pm UTC](https://discuss.elastic.co/t/unclear-how-logstash-fingerprint-treats-empty-non-existing-fields/281157 "2021-08-12T12:00:19Z")
Hello everyone, I have a hard time to understand the behaviour fo the logstash fingerprint filter if a field is empty or non-existent. My scenario is the following: I'm reading a json-file with logstash and create a d… --- ## [ILM rollover for "Logstash Elasticsearch output plugin"](https://discuss.elastic.co/t/ilm-rollover-for-logstash-elasticsearch-output-plugin/281176)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 6\ **Last updated:** [August 12, 2021, 12:00pm UTC](https://discuss.elastic.co/t/ilm-rollover-for-logstash-elasticsearch-output-plugin/281176 "2021-08-12T12:00:13Z")
Hello My logstash code uses the elasticsearch output plugin to ingest docs into elasticsearch . However the index size tends to get larger in size , i came across ILM concepts in the elasticsearch documents, that says t… --- ## [How to use aggregate in inner hits](https://discuss.elastic.co/t/how-to-use-aggregate-in-inner-hits/281195)
**Author:** [@Amir\_Faramarzi](https://discuss.elastic.co/u/Amir_Faramarzi)\ **Replies:** 0\ **Last updated:** [August 12, 2021, 11:22am UTC](https://discuss.elastic.co/t/how-to-use-aggregate-in-inner-hits/281195 "2021-08-12T11:22:49Z")
Hello friends Is it possible to use aggregation in inner hits? If so, how? --- ## [Index filebeat panw error](https://discuss.elastic.co/t/index-filebeat-panw-error/281192)
**Author:** [@newbie313](https://discuss.elastic.co/u/newbie313)\ **Replies:** 0\ **Last updated:** [August 12, 2021, 10:47am UTC](https://discuss.elastic.co/t/index-filebeat-panw-error/281192 "2021-08-12T10:47:28Z")
I'm using filebeat-7.3.2 and configure panw.yml open port 514, the data from palo alto already received ( i check using tshark) but there is error come in the index management shows: Index lifecycle error illegal\_argum… --- ## [Alerts ceased to be generated](https://discuss.elastic.co/t/alerts-ceased-to-be-generated/280671)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 4\ **Last updated:** [August 12, 2021, 10:37am UTC](https://discuss.elastic.co/t/alerts-ceased-to-be-generated/280671 "2021-08-12T10:37:04Z")
Hello every body, I have a problem, The alerts have ceased to be generated today at the detection level, after checking I noticed that the rules are matched but the alerts are not generated and the siem-signals-default … --- ## [Getting error while starting elastic](https://discuss.elastic.co/t/getting-error-while-starting-elastic/281108)
**Author:** [@Faizan\_Khurshid](https://discuss.elastic.co/u/Faizan_Khurshid)\ **Replies:** 3\ **Last updated:** [August 12, 2021, 10:24am UTC](https://discuss.elastic.co/t/getting-error-while-starting-elastic/281108 "2021-08-12T10:24:17Z")
Hi Folk I am new to ELK , i was trying to install ELK on centos 8.4 below is my error when i was trying to start sudo systemctl start elasticsearch \[root@ ~\]# systemctl status elasticsearch.service ● elasticsearch.… --- ## [Websphere Application server Network Deployment 8.5.5](https://discuss.elastic.co/t/websphere-application-server-network-deployment-8-5-5/281128)
**Author:** [@niksu01](https://discuss.elastic.co/u/niksu01)\ **Replies:** 1\ **Last updated:** [August 12, 2021, 10:23am UTC](https://discuss.elastic.co/t/websphere-application-server-network-deployment-8-5-5/281128 "2021-08-12T10:23:08Z")
Hello, I would like to know elastic APM will support Websphere Application Server Network Deployment 8.5.5. We are planning to implement it in our development environment. It's been a while since I have seen any updates… --- ## [Setting up logstash with mongodb not starting](https://discuss.elastic.co/t/setting-up-logstash-with-mongodb-not-starting/280998)
**Author:** [@Bugsbee](https://discuss.elastic.co/u/Bugsbee)\ **Replies:** 5\ **Last updated:** [August 12, 2021, 10:12am UTC](https://discuss.elastic.co/t/setting-up-logstash-with-mongodb-not-starting/280998 "2021-08-12T10:12:05Z")
hi community, need your expertise / advise in this issue im facing when starting logstash which im trying to connect wth mongodb. input { uri =\> 'mongodb://userhere:passwordhere@1234.234.123.12:8081' p… --- ## [Grouping/filtering host servers](https://discuss.elastic.co/t/grouping-filtering-host-servers/281030)
**Author:** [@Garry](https://discuss.elastic.co/u/Garry)\ **Replies:** 3\ **Last updated:** [August 12, 2021, 9:48am UTC](https://discuss.elastic.co/t/grouping-filtering-host-servers/281030 "2021-08-12T09:48:24Z")
I have a situation where the I have a variety of hostnames for each client. E.g. Client 1: host1, host2, host3 Client 2: host4, host5, host6, host7 What would be the most effective way to group these client machines … --- ## [Elasticsearch kibana](https://discuss.elastic.co/t/elasticsearch-kibana/281151)
**Author:** [@Dilnawaz\_Khan](https://discuss.elastic.co/u/Dilnawaz_Khan)\ **Replies:** 1\ **Last updated:** [August 12, 2021, 9:29am UTC](https://discuss.elastic.co/t/elasticsearch-kibana/281151 "2021-08-12T09:29:55Z")
Hello I have 2 master nodes of elasticsearch and 3 data nodes and one seprate node is for kibana Now I have a question if I give host ip of those 2 master node in kibana.yml file then where do I need to configure those … --- ## [Creating Vega visualization with Image in kibana v 7.13](https://discuss.elastic.co/t/creating-vega-visualization-with-image-in-kibana-v-7-13/280942)
**Author:** [@ErSumit](https://discuss.elastic.co/u/ErSumit)\ **Replies:** 1\ **Last updated:** [August 12, 2021, 9:15am UTC](https://discuss.elastic.co/t/creating-vega-visualization-with-image-in-kibana-v-7-13/280942 "2021-08-12T09:15:25Z")
My vega visualization is working perfectly on vega editor, but its failing on kibana. On elastic stack version 7.9.2, the exception message is: “External URLs are not enabled. Add vis\_type\_vega.enableExternalUrls: true… --- ## [Max aggregation on .keyword field with both string and number values](https://discuss.elastic.co/t/max-aggregation-on-keyword-field-with-both-string-and-number-values/281168)
**Author:** [@Daniele\_Renda](https://discuss.elastic.co/u/Daniele_Renda)\ **Replies:** 0\ **Last updated:** [August 12, 2021, 8:16am UTC](https://discuss.elastic.co/t/max-aggregation-on-keyword-field-with-both-string-and-number-values/281168 "2021-08-12T08:16:27Z")
Hi, I've a quite common situation: I've an index for products with a barcode field: "barcode": { "type": "text", "fields": { "ngram": { "type": "tex… [Previous page](https://discuss.elastic.co/latest.md?page=1528) [Next page](https://discuss.elastic.co/latest.md?page=1530)