# Latest

**URL:** https://discuss.elastic.co/latest.md?page=1601

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1602

---

## [{"statusCode":500,"error":"Internal Server Error","message":"An internal server error occurred."}](https://discuss.elastic.co/t/statuscode-500-error-internal-server-error-message-an-internal-server-error-occurred/277013)

<div class="topic-metadata">

**Author:** [@Tirupathirao](https://discuss.elastic.co/u/Tirupathirao)\
**Replies:** 6\
**Last updated:** [June 26, 2021, 6:57am UTC](https://discuss.elastic.co/t/statuscode-500-error-internal-server-error-message-an-internal-server-error-occurred/277013 "2021-06-26T06:57:31Z")

</div>

{"statusCode":500,"error":"Internal Server Error","message":"An internal server error occurred."}

---

## [How to send synology device logs to elk](https://discuss.elastic.co/t/how-to-send-synology-device-logs-to-elk/269555)

<div class="topic-metadata">

**Author:** [@jubin03](https://discuss.elastic.co/u/jubin03)\
**Replies:** 6\
**Last updated:** [June 26, 2021, 5:59am UTC](https://discuss.elastic.co/t/how-to-send-synology-device-logs-to-elk/269555 "2021-06-26T05:59:38Z")

</div>

Do we need to install filbeat on Synology for sending logs to elk

---

## [Add more parameter to kafka input](https://discuss.elastic.co/t/add-more-parameter-to-kafka-input/277109)

<div class="topic-metadata">

**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\
**Replies:** 0\
**Last updated:** [June 26, 2021, 5:36am UTC](https://discuss.elastic.co/t/add-more-parameter-to-kafka-input/277109 "2021-06-26T05:36:44Z")

</div>

Hello, Logstash version is 7.9 and kafka version is 2.5.0 could you please confirm that can we change the below parameter in kafka input plugin? allow.auto.create.topics (default is true) group.instance.id …

---

## [Resolve unassigned shards?](https://discuss.elastic.co/t/resolve-unassigned-shards/276793)

<div class="topic-metadata">

**Author:** [@lchan](https://discuss.elastic.co/u/lchan)\
**Replies:** 5\
**Last updated:** [June 26, 2021, 3:17am UTC](https://discuss.elastic.co/t/resolve-unassigned-shards/276793 "2021-06-26T03:17:57Z")

</div>

I am an unassigned shards issue on a newly setup cluster where the ilm policy is not moving the shares from hot to warm. The ilm policy is set to rollover after 1d or 50gb but the allocation is complaining about node do…

---

## [Diagnose high CPU usage of beats deployed by Agent](https://discuss.elastic.co/t/diagnose-high-cpu-usage-of-beats-deployed-by-agent/276998)

<div class="topic-metadata">

**Author:** [@netfire](https://discuss.elastic.co/u/netfire)\
**Replies:** 2\
**Last updated:** [June 26, 2021, 2:51am UTC](https://discuss.elastic.co/t/diagnose-high-cpu-usage-of-beats-deployed-by-agent/276998 "2021-06-26T02:51:32Z")

</div>

I'm testing fleet and I have noticed that filebeat and metricbeat use quite a few CPU cycles. I'm using the Windows, System and IIS integrations, and on an 8 vcpu VM, filebeat consistently consumes 20%. Metricbeat consum…

---

## [Нет ли примера файлов конфигурации ELK (elastic+kibana+logsthash) с TLS при запуске через docker-compose?](https://discuss.elastic.co/t/elk-elastic-kibana-logsthash-tls-docker-compose/277039)

<div class="topic-metadata">

**Author:** [@Savai](https://discuss.elastic.co/u/Savai)\
**Replies:** 1\
**Last updated:** [June 26, 2021, 12:30am UTC](https://discuss.elastic.co/t/elk-elastic-kibana-logsthash-tls-docker-compose/277039 "2021-06-26T00:30:18Z")

</div>

Сосбственно вопрос- нет ли примера файл docker-compose.yml при запуске стека ELK c TLS? В документации на elastic нашел как запускается elastic+kibana, по образу и подобию logstash запустить не получается.

---

## [Get rid of .keyword](https://discuss.elastic.co/t/get-rid-of-keyword/277105)

<div class="topic-metadata">

**Author:** [@svenvg93](https://discuss.elastic.co/u/svenvg93)\
**Replies:** 1\
**Last updated:** [June 25, 2021, 9:36pm UTC](https://discuss.elastic.co/t/get-rid-of-keyword/277105 "2021-06-25T21:36:00Z")

</div>

Hi, I'm still a ELK noob so bear with me here ;). I've setup Logstash to send the output of fping command to Elasticsearch and add some geoip data to it. Fping output; ec2.eu-west-1.amazonaws.com : xmt/rcv/%loss = 3…

---

## [Unreadable "Source: (byte\[\])" gives input\_coercion\_exception](https://discuss.elastic.co/t/unreadable-source-byte-gives-input-coercion-exception/277104)

<div class="topic-metadata">

**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\
**Replies:** 1\
**Last updated:** [June 25, 2021, 9:26pm UTC](https://discuss.elastic.co/t/unreadable-source-byte-gives-input-coercion-exception/277104 "2021-06-25T21:26:24Z")

</div>

I'm receiving the following warning in my Logstash container. I think it's because there may be some malformed/corrupt data coming through. \[WARN \] 2021-06-25 20:38:37.941 \[\[test\]\>worker0\] elasticsearch - Could not ind…

---

## [How to create new field by comparing the data against JSON using Pipelines or Logstash](https://discuss.elastic.co/t/how-to-create-new-field-by-comparing-the-data-against-json-using-pipelines-or-logstash/277102)

<div class="topic-metadata">

**Author:** [@Mahesh\_Gadagi](https://discuss.elastic.co/u/Mahesh_Gadagi)\
**Replies:** 0\
**Last updated:** [June 25, 2021, 8:03pm UTC](https://discuss.elastic.co/t/how-to-create-new-field-by-comparing-the-data-against-json-using-pipelines-or-logstash/277102 "2021-06-25T20:03:54Z")

</div>

Hello, I wanted to create a new field either using logstash or elastic search pipeline, can you please help me? I have JSON mapping as \[{"name":"a","age":25},{"name":"b","age":10}\] I have field already in my index as n…

---

## [Will Filebeat ever send my log file content to stdout?](https://discuss.elastic.co/t/will-filebeat-ever-send-my-log-file-content-to-stdout/276988)

<div class="topic-metadata">

**Author:** [@Wade](https://discuss.elastic.co/u/Wade)\
**Replies:** 3\
**Last updated:** [June 25, 2021, 7:39pm UTC](https://discuss.elastic.co/t/will-filebeat-ever-send-my-log-file-content-to-stdout/276988 "2021-06-25T19:39:14Z")

</div>

Is there ever a scenario where filebeat would log the contents of the files it is harvesting to standard out? I am shipping log files to elasticsearch with sensitive information and anything that is written to stdout it …

---

## [I have a use case related to Cumulative Flow Diagram](https://discuss.elastic.co/t/i-have-a-use-case-related-to-cumulative-flow-diagram/277015)

<div class="topic-metadata">

**Author:** [@aswanth\_jabba](https://discuss.elastic.co/u/aswanth_jabba)\
**Replies:** 4\
**Last updated:** [June 25, 2021, 7:32pm UTC](https://discuss.elastic.co/t/i-have-a-use-case-related-to-cumulative-flow-diagram/277015 "2021-06-25T19:32:00Z")

</div>

Hi all, I am trying to build a Cumulative Flow Diagram, you can have a look at this I will try to explain how we can view this chart, We have 8 Ready Stories on 10 June and 3 Work in Progress , we can see that the a…

---

## [Index.mapping.total\_fields.limit](https://discuss.elastic.co/t/index-mapping-total-fields-limit/275193)

<div class="topic-metadata">

**Author:** [@Bruceclegg](https://discuss.elastic.co/u/Bruceclegg)\
**Replies:** 6\
**Last updated:** [June 25, 2021, 7:01pm UTC](https://discuss.elastic.co/t/index-mapping-total-fields-limit/275193 "2021-06-25T19:01:43Z")

</div>

... We're running elasticsearch 6.8.15 For various reasons we are unable to run Lifecycle Management on our indexes - so I have set up a cron job which uses curator that when an index reaches a certain size or age it w…

---

## [Elasticsearch build failure](https://discuss.elastic.co/t/elasticsearch-build-failure/276965)

<div class="topic-metadata">

**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\
**Replies:** 3\
**Last updated:** [June 25, 2021, 6:55pm UTC](https://discuss.elastic.co/t/elasticsearch-build-failure/276965 "2021-06-25T18:55:57Z")

</div>

Hello, I was running ELK from source, and today I run "git pull" and tried to build again, but when I run "./gradlew assemble" I am getting these errors : FAILURE: Build failed with an exception. \* What went wrong: A …

---

## [Difference betwwen logs and apm](https://discuss.elastic.co/t/difference-betwwen-logs-and-apm/277008)

<div class="topic-metadata">

**Author:** [@guimap](https://discuss.elastic.co/u/guimap)\
**Replies:** 4\
**Last updated:** [June 25, 2021, 6:28pm UTC](https://discuss.elastic.co/t/difference-betwwen-logs-and-apm/277008 "2021-06-25T18:28:33Z")

</div>

hi guys, i've been adding apm into my applications, then I noticed that apm elk adds some indices into my elasticsearch, such as transactions, errors and etc my questions is, if I have all this data in these indices, w…

---

## [Breaking change in 7.12-13: Date processor](https://discuss.elastic.co/t/breaking-change-in-7-12-13-date-processor/277092)

<div class="topic-metadata">

**Author:** [@Dennis1](https://discuss.elastic.co/u/Dennis1)\
**Replies:** 4\
**Last updated:** [June 25, 2021, 6:22pm UTC](https://discuss.elastic.co/t/breaking-change-in-7-12-13-date-processor/277092 "2021-06-25T18:22:40Z")

</div>

I'd like to report a major breaking change that occurred in 7.12.1 (as originally reported and described here: Date filter problems after upgrade), and which I personally experienced when I upgraded from 7.11.1 to 7.13.2…

---

## [Restrict kibana space user access internal apis](https://discuss.elastic.co/t/restrict-kibana-space-user-access-internal-apis/277096)

<div class="topic-metadata">

**Author:** [@south](https://discuss.elastic.co/u/south)\
**Replies:** 0\
**Last updated:** [June 25, 2021, 6:19pm UTC](https://discuss.elastic.co/t/restrict-kibana-space-user-access-internal-apis/277096 "2021-06-25T18:19:00Z")

</div>

Hi, I am trying to restrict the users in kibana space to access information for os, memory, authentications.... The space and role of the user only have privileges for kibana analytics(dashboard, visualizations..), but …

---

## [Logstash pipeline](https://discuss.elastic.co/t/logstash-pipeline/277082)

<div class="topic-metadata">

**Author:** [@Sarthak\_Mishra](https://discuss.elastic.co/u/Sarthak_Mishra)\
**Replies:** 2\
**Last updated:** [June 25, 2021, 5:40pm UTC](https://discuss.elastic.co/t/logstash-pipeline/277082 "2021-06-25T17:40:11Z")

</div>

My logstash does not ship the data. Please help input { file { path =\> "C:/Users/kumar/Desktop/grok.csv" start\_position =\> "beginning" sincedb\_path =\> "NULL" } } filter { csv { separator =\> "," columns =\> \["Na…

---

## [How to grok pattern match middle of a string?](https://discuss.elastic.co/t/how-to-grok-pattern-match-middle-of-a-string/276708)

<div class="topic-metadata">

**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\
**Replies:** 2\
**Last updated:** [June 25, 2021, 4:51pm UTC](https://discuss.elastic.co/t/how-to-grok-pattern-match-middle-of-a-string/276708 "2021-06-25T16:51:04Z")

</div>

I have a string that looks like this: SITE;500400;PEER FLOW (AS 3535);;100G;MR;PP:10.02.01.91 97,98; I just want to extract "FLOW" into a field named peer. I tried doing this: (?\<peer\>\\w+\\D\\d+\\D\\w+\\s(\\w+)) But tha…

---

## [Date filter problems after upgrade](https://discuss.elastic.co/t/date-filter-problems-after-upgrade/274841)

<div class="topic-metadata">

**Author:** [@Renato](https://discuss.elastic.co/u/Renato)\
**Replies:** 1\
**Last updated:** [June 25, 2021, 4:25pm UTC](https://discuss.elastic.co/t/date-filter-problems-after-upgrade/274841 "2021-06-25T16:25:19Z")

</div>

Hey, we are having problems after we upgraded elk to 7.12.1 (I'm not sure which version we previously used 7.xx). The date filter which we previously used is not working anymore. We don't get any logs in elastic. If I w…

---

## [Kibana - Splitting series by field names](https://discuss.elastic.co/t/kibana-splitting-series-by-field-names/276984)

<div class="topic-metadata">

**Author:** [@dineshgaglani](https://discuss.elastic.co/u/dineshgaglani)\
**Replies:** 2\
**Last updated:** [June 25, 2021, 4:06pm UTC](https://discuss.elastic.co/t/kibana-splitting-series-by-field-names/276984 "2021-06-25T16:06:32Z")

</div>

I was hoping to find a way to split a series by field names (and not values of a particular field) in kibana I have a data set that looks like below: { { date: 24/06/2021, foo: 12, bar: 20}, { date: 24/06/2021, foo: 16…

---

## [Data Logstash filter not putting month into @timestamp](https://discuss.elastic.co/t/data-logstash-filter-not-putting-month-into-timestamp/277079)

<div class="topic-metadata">

**Author:** [@adwearys](https://discuss.elastic.co/u/adwearys)\
**Replies:** 2\
**Last updated:** [June 25, 2021, 3:46pm UTC](https://discuss.elastic.co/t/data-logstash-filter-not-putting-month-into-timestamp/277079 "2021-06-25T15:46:01Z")

</div>

Hi, I'm trying to take the date and time from a syslog message and put it into the @timestamp field (so the @timestamp field has the date and time that the source system created the message, rather than when it arrived …

---

## [Logstash error](https://discuss.elastic.co/t/logstash-error/277048)

<div class="topic-metadata">

**Author:** [@Ashwin\_Patil1](https://discuss.elastic.co/u/Ashwin_Patil1)\
**Replies:** 2\
**Last updated:** [June 25, 2021, 3:42pm UTC](https://discuss.elastic.co/t/logstash-error/277048 "2021-06-25T15:42:44Z")

</div>

I have installed logstash and the following is the .conf file input { beat { port =\> 5044 type =\> syslog } } filter { if \[type\] == "syslog" { grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} …

---

## [CSV File re-reading/re-parsing issue 7.10](https://discuss.elastic.co/t/csv-file-re-reading-re-parsing-issue-7-10/276940)

<div class="topic-metadata">

**Author:** [@Rajesh\_S](https://discuss.elastic.co/u/Rajesh_S)\
**Replies:** 3\
**Last updated:** [June 25, 2021, 3:36pm UTC](https://discuss.elastic.co/t/csv-file-re-reading-re-parsing-issue-7-10/276940 "2021-06-25T15:36:07Z")

</div>

I am trying to re-read a csv file from the beginning using sincedb set to '/dev/null'. logstash is started using --config.reload.automatic. All entries are blank when the file is re-read. This is not consistent, some tim…

---

## [KQL Max query search](https://discuss.elastic.co/t/kql-max-query-search/277061)

<div class="topic-metadata">

**Author:** [@fredrick.bb](https://discuss.elastic.co/u/fredrick.bb)\
**Replies:** 1\
**Last updated:** [June 25, 2021, 3:21pm UTC](https://discuss.elastic.co/t/kql-max-query-search/277061 "2021-06-25T15:21:08Z")

</div>

Hello, I need to figure out a KQL query to pick a max value. My data is like below Doc1 =\> AppName: "A" , Revision : 1 then other keys Doc2 =\> AppName: "A" , Revision : 2 \* \* Docn =\> AppName: "A" , Revision : n. R…

---

## [Update Query not working in Elastic 7](https://discuss.elastic.co/t/update-query-not-working-in-elastic-7/277029)

<div class="topic-metadata">

**Author:** [@rohitj559](https://discuss.elastic.co/u/rohitj559)\
**Replies:** 3\
**Last updated:** [June 25, 2021, 3:12pm UTC](https://discuss.elastic.co/t/update-query-not-working-in-elastic-7/277029 "2021-06-25T15:12:00Z")

</div>

I am trying to update(POST) a elastic record using below query but i am getting back a weird error. Request: \_update\_by\_query { "script": "{ctx.\_source.orderDocuments\[0\] = newobj};", "params": { "newobj": { …

---

## [Elasticsearch 7.4.1 java stats\_buckets](https://discuss.elastic.co/t/elasticsearch-7-4-1-java-stats-buckets/277055)

<div class="topic-metadata">

**Author:** [@jey](https://discuss.elastic.co/u/jey)\
**Replies:** 0\
**Last updated:** [June 25, 2021, 11:47am UTC](https://discuss.elastic.co/t/elasticsearch-7-4-1-java-stats-buckets/277055 "2021-06-25T11:47:21Z")

</div>

I made an elasticsearch request in json with aggregation and stats\_buckets. I have an error: org.elasticsearch.action.ActionRequestValidationException: Validation Failed: 1: No aggregation found for path \[terms\_caller…

---

## [How to make filter in beat on the logstash](https://discuss.elastic.co/t/how-to-make-filter-in-beat-on-the-logstash/276992)

<div class="topic-metadata">

**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Replies:** 3\
**Last updated:** [June 25, 2021, 2:48pm UTC](https://discuss.elastic.co/t/how-to-make-filter-in-beat-on-the-logstash/276992 "2021-06-25T14:48:04Z")

</div>

Hi, I need to create a filter to avoid duplicating the information that I have from one index to another, in the configuration of the logstash file where the data of the first index that I upload to elastic are, I alread…

---

## [Annotated text highlighter identifies incorrect phrase hit when wrapped in function\_score query](https://discuss.elastic.co/t/annotated-text-highlighter-identifies-incorrect-phrase-hit-when-wrapped-in-function-score-query/277073)

<div class="topic-metadata">

**Author:** [@robmartin11](https://discuss.elastic.co/u/robmartin11)\
**Replies:** 0\
**Last updated:** [June 25, 2021, 2:15pm UTC](https://discuss.elastic.co/t/annotated-text-highlighter-identifies-incorrect-phrase-hit-when-wrapped-in-function-score-query/277073 "2021-06-25T14:15:52Z")

</div>

Wondering if the following could be a bug or just user error? Given I create a new index with annotated text fields: PUT test\_index { "mappings": { "properties": { "a": { "type":…

---

## [Logstash Pipeline which works fine for file input but not working when set with filebeats](https://discuss.elastic.co/t/logstash-pipeline-which-works-fine-for-file-input-but-not-working-when-set-with-filebeats/277068)

<div class="topic-metadata">

**Author:** [@MuskanBeig](https://discuss.elastic.co/u/MuskanBeig)\
**Replies:** 1\
**Last updated:** [June 25, 2021, 1:42pm UTC](https://discuss.elastic.co/t/logstash-pipeline-which-works-fine-for-file-input-but-not-working-when-set-with-filebeats/277068 "2021-06-25T13:42:12Z")

</div>

My logstash pipeline works fine with the input as file or generator plugin But the same pipeline is not working when i use beats as input plugin the filebeat is working properly

---

## [Data table visualization that shows the end message combined with the start time of a particular case](https://discuss.elastic.co/t/data-table-visualization-that-shows-the-end-message-combined-with-the-start-time-of-a-particular-case/277065)

<div class="topic-metadata">

**Author:** [@hNiven](https://discuss.elastic.co/u/hNiven)\
**Replies:** 0\
**Last updated:** [June 25, 2021, 1:36pm UTC](https://discuss.elastic.co/t/data-table-visualization-that-shows-the-end-message-combined-with-the-start-time-of-a-particular-case/277065 "2021-06-25T13:36:59Z")

</div>

Hi, I am looking to create a data table using the visualize section, where I track the outcome of multiple cases. Each case will have its own unique identifier to be able to track its lifecycle. To simplify it, I am loo…

[Previous page](https://discuss.elastic.co/latest.md?page=1600)

[Next page](https://discuss.elastic.co/latest.md?page=1602)
