# Latest **URL:** https://discuss.elastic.co/latest.md?page=1622 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1623 --- ## [Error with IIS Dashboards \[ 7.10.2 \]](https://discuss.elastic.co/t/error-with-iis-dashboards-7-10-2/276007)
**Author:** [@rodrigo.gz](https://discuss.elastic.co/u/rodrigo.gz)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 1:22pm UTC](https://discuss.elastic.co/t/error-with-iis-dashboards-7-10-2/276007 "2021-06-15T13:22:11Z")
Hello! I am trying to monitor an IIS with metricbeat and filebeat. When I do the setup and start the agent, it starts collecting metrics and logs correctly but, the dashboards do not show the collected information as e… --- ## [Performance Downgrade, after upgrading from 6.4 to 7.7](https://discuss.elastic.co/t/performance-downgrade-after-upgrading-from-6-4-to-7-7/274861)
**Author:** [@chintushah46](https://discuss.elastic.co/u/chintushah46)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 12:30pm UTC](https://discuss.elastic.co/t/performance-downgrade-after-upgrading-from-6-4-to-7-7/274861 "2021-06-15T12:30:41Z")
I am seeing a huge performance downgrade after upgrading Elasticsearch from version 6.4 to 7.7. Query Sample: {"size": 1000000,"from": 0,"track\_total\_hits": true,"query": {"bool": {"filter": {"bool": {"should": \[{"boo… --- ## [Filter messages in logstash with different index](https://discuss.elastic.co/t/filter-messages-in-logstash-with-different-index/275990)
**Author:** [@learner21](https://discuss.elastic.co/u/learner21)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 11:45am UTC](https://discuss.elastic.co/t/filter-messages-in-logstash-with-different-index/275990 "2021-06-15T11:45:11Z")
I am getting 3 types of messages in logstash, based on that i need to parse and save in elasticSearch with 3 different index Message 1 =\> "2021-05-26T09:55:36.091040+00:00 10.13.14.11 \[S=294230650\] \[ID=fbf282:30:1115898… --- ## [Display Top 20 Results by Event Count](https://discuss.elastic.co/t/display-top-20-results-by-event-count/275492)
**Author:** [@nazevedo3](https://discuss.elastic.co/u/nazevedo3)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 11:32am UTC](https://discuss.elastic.co/t/display-top-20-results-by-event-count/275492 "2021-06-15T11:32:31Z")
Hi All, I have a dataset that returns data that includes a networks ASN. I'd like to be able to visualize a set of specific ASNs AND the top 20 of all other ASNs in my dataset based on event count. Any suggestions on … --- ## [Logstash multiple pipelines](https://discuss.elastic.co/t/logstash-multiple-pipelines/275984)
**Author:** [@sreedhar1](https://discuss.elastic.co/u/sreedhar1)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 11:25am UTC](https://discuss.elastic.co/t/logstash-multiple-pipelines/275984 "2021-06-15T11:25:30Z")
Hi All, I am using Logstash to populate data from sql server to Elasticsearch. I have created multiple .conf files to populate data in ES. Created pipeline to run all these .conf files. Question: do we need to create m… --- ## [Is it possible to leave the dashboard always fullscreen or hide the query part?](https://discuss.elastic.co/t/is-it-possible-to-leave-the-dashboard-always-fullscreen-or-hide-the-query-part/275702)
**Author:** [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\ **Replies:** 2\ **Last updated:** [June 15, 2021, 11:11am UTC](https://discuss.elastic.co/t/is-it-possible-to-leave-the-dashboard-always-fullscreen-or-hide-the-query-part/275702 "2021-06-15T11:11:02Z")
Is it possible to leave the dashboard always fullscreen or hide the query part? as follows in the image. --- ## [Kibana Report Error: Failed to decrypt report job data](https://discuss.elastic.co/t/kibana-report-error-failed-to-decrypt-report-job-data/275657)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 2\ **Last updated:** [June 15, 2021, 10:56am UTC](https://discuss.elastic.co/t/kibana-report-error-failed-to-decrypt-report-job-data/275657 "2021-06-15T10:56:05Z")
Hi there, I am facing following error each time I want to generate a CSV Report from Kibana Discover Module. Either immediately or after some time (like 30 seconds or so) I see following Error: Error: Failed to decryp… --- ## [Pods not finding PVC when using storage class with Retain reclaim policy](https://discuss.elastic.co/t/pods-not-finding-pvc-when-using-storage-class-with-retain-reclaim-policy/275835)
**Author:** [@pkaramol](https://discuss.elastic.co/u/pkaramol)\ **Replies:** 4\ **Last updated:** [June 15, 2021, 10:51am UTC](https://discuss.elastic.co/t/pods-not-finding-pvc-when-using-storage-class-with-retain-reclaim-policy/275835 "2021-06-15T10:51:02Z")
I am using in an Elasticsearch instance, a StorageClass that has Retain (instead of Delete) as its reclaim policy. Here are my PVCs before deleting the Elasticsearch instance ▶ k get pvc NAME … --- ## [Metricbeat and Logstash](https://discuss.elastic.co/t/metricbeat-and-logstash/275391)
**Author:** [@stefan0s](https://discuss.elastic.co/u/stefan0s)\ **Replies:** 3\ **Last updated:** [June 15, 2021, 10:43am UTC](https://discuss.elastic.co/t/metricbeat-and-logstash/275391 "2021-06-15T10:43:53Z")
Hello, I have installed logstash to collect logs and send to elasticsearch. Logstash is configured to keep indexes in hourly base. I need now to install metricbeat modules and also send to elasticsearch in hourly base … --- ## [Have not access to labs of Engineer 1](https://discuss.elastic.co/t/have-not-access-to-labs-of-engineer-1/275780)
**Author:** [@Donyez.Abdennadher](https://discuss.elastic.co/u/Donyez.Abdennadher)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 10:39am UTC](https://discuss.elastic.co/t/have-not-access-to-labs-of-engineer-1/275780 "2021-06-15T10:39:48Z")
Hi, I have done Engineer 1 (on demand) courses, and now I'm learning engineer 2 (on-demand) courses. I tried to access to labs of Engineer 1 but I have not access. I need to have the instructions lab and the correct… --- ## [How to monitor the beats using prometheus](https://discuss.elastic.co/t/how-to-monitor-the-beats-using-prometheus/275394)
**Author:** [@PeterFulier](https://discuss.elastic.co/u/PeterFulier)\ **Replies:** 2\ **Last updated:** [June 15, 2021, 10:26am UTC](https://discuss.elastic.co/t/how-to-monitor-the-beats-using-prometheus/275394 "2021-06-15T10:26:11Z")
Hello, I am trying to find a way to expose beats (especially the metricbeat) statistics to prometheus to have the option to monitor the correct functionality of metricbeat in terms of its connection to elastic. Current… --- ## [Metric value 0 breaking change (since upgrade to version 7.13)](https://discuss.elastic.co/t/metric-value-0-breaking-change-since-upgrade-to-version-7-13/275956)
**Author:** [@Chenlrv](https://discuss.elastic.co/u/Chenlrv)\ **Replies:** 5\ **Last updated:** [June 15, 2021, 10:09am UTC](https://discuss.elastic.co/t/metric-value-0-breaking-change-since-upgrade-to-version-7-13/275956 "2021-06-15T10:09:22Z")
Hello, since upgrading to version 7.13, Metric visualizations with value of 0 look like this: where before upgrade Metric visualizations showed 0. Is there any solution to this? we want to show the value 0 and not da… --- ## [Rally metrics in a single node cluster](https://discuss.elastic.co/t/rally-metrics-in-a-single-node-cluster/275808)
**Author:** [@Lasse\_Nedergaard](https://discuss.elastic.co/u/Lasse_Nedergaard)\ **Replies:** 9\ **Last updated:** [June 15, 2021, 10:05am UTC](https://discuss.elastic.co/t/rally-metrics-in-a-single-node-cluster/275808 "2021-06-15T10:05:53Z")
Hi For simplicity I want to store reporting metrics in a single node cluster. I can see the index is created with 1 replicas. Are there any way to set replicas to 0? Or is my only option to create a cluster with more n… --- ## [Update all fields containing specific string in field name by painless script](https://discuss.elastic.co/t/update-all-fields-containing-specific-string-in-field-name-by-painless-script/275973)
**Author:** [@sbienert](https://discuss.elastic.co/u/sbienert)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 9:55am UTC](https://discuss.elastic.co/t/update-all-fields-containing-specific-string-in-field-name-by-painless-script/275973 "2021-06-15T09:55:06Z")
Hi, I have a pretty simple request but I don't manage to get it working. I need to increase a datetime of multiple fields in one document. The date fields can be nested fields at different levels. Instead of having to u… --- ## [ILM Waiting for allocation on warm nodes](https://discuss.elastic.co/t/ilm-waiting-for-allocation-on-warm-nodes/275969)
**Author:** [@jamesp220291](https://discuss.elastic.co/u/jamesp220291)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 9:49am UTC](https://discuss.elastic.co/t/ilm-waiting-for-allocation-on-warm-nodes/275969 "2021-06-15T09:49:48Z")
Hi my iLM is stuck on awaiting allocation. my cluster has 2x warm nodes the warning is Action status Waiting for \[2\] shards to be allocated to nodes matching the given filters as you can see, nothing is rolling ove… --- ## [Logstash is not creating ingest pipelines](https://discuss.elastic.co/t/logstash-is-not-creating-ingest-pipelines/275953)
**Author:** [@Mocem](https://discuss.elastic.co/u/Mocem)\ **Replies:** 2\ **Last updated:** [June 15, 2021, 9:35am UTC](https://discuss.elastic.co/t/logstash-is-not-creating-ingest-pipelines/275953 "2021-06-15T09:35:42Z")
Hi All, For the past few days I'm struggling with loading the pipelines from filebeat. Basically nothing is happening. It works directly to Elastic but not when logstash is in between. Once I create the ingest pipeline … --- ## [How to write query in Dev tools to find expired date of customers by comparing current date?](https://discuss.elastic.co/t/how-to-write-query-in-dev-tools-to-find-expired-date-of-customers-by-comparing-current-date/275663)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 4\ **Last updated:** [June 15, 2021, 9:32am UTC](https://discuss.elastic.co/t/how-to-write-query-in-dev-tools-to-find-expired-date-of-customers-by-comparing-current-date/275663 "2021-06-15T09:32:08Z")
I have a index that contains date field of customers that contains date of customers to be expired. Now my task is you to compare that date with current date(dynamically) changes as current date change gives result "expi… --- ## [Metricbeat system module CPU missing fields](https://discuss.elastic.co/t/metricbeat-system-module-cpu-missing-fields/275837)
**Author:** [@phani\_akkina](https://discuss.elastic.co/u/phani_akkina)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 8:57am UTC](https://discuss.elastic.co/t/metricbeat-system-module-cpu-missing-fields/275837 "2021-06-15T08:57:09Z")
Metricbeat System module CPU missing fields of nice, iowait, softirq, irq, and others for Windows and its reporting all for Linux VMS. Earlier we used the 6.1 version and its reported all the values but after the upgrad… --- ## [Hide the Kibana Header (black/top)](https://discuss.elastic.co/t/hide-the-kibana-header-black-top/275939)
**Author:** [@Jayanth\_Palle](https://discuss.elastic.co/u/Jayanth_Palle)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 8:45am UTC](https://discuss.elastic.co/t/hide-the-kibana-header-black-top/275939 "2021-06-15T08:45:47Z")
I am new to ELK stack.The Kibana header(black/top) is good but it will be fine for us if there is an option to hide it (we aren't using it at all) so that we could use some more space.Is there a way to do so? Need to re… --- ## [I want to get Notification if Filebeat get down](https://discuss.elastic.co/t/i-want-to-get-notification-if-filebeat-get-down/275960)
**Author:** [@Rohit\_Kumbhar](https://discuss.elastic.co/u/Rohit_Kumbhar)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 8:40am UTC](https://discuss.elastic.co/t/i-want-to-get-notification-if-filebeat-get-down/275960 "2021-06-15T08:40:20Z")
Hi, I want to Uptime monitoring of Filebeat and if Filebeat gets down I should get slack notification regarding that. Is their any url for Filebeat so i can monitor it through Heartbeat? Thanks, Regards Rohit --- ## [Excessive disk usage ( ~80M/s) filebeat](https://discuss.elastic.co/t/excessive-disk-usage-80m-s-filebeat/275655)
**Author:** [@111304](https://discuss.elastic.co/u/111304)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 8:38am UTC](https://discuss.elastic.co/t/excessive-disk-usage-80m-s-filebeat/275655 "2021-06-15T08:38:51Z")
Hi, I am using filebeat 7.6.0 vesrion on each server. I have a 3 node elastic cluster 6.8.16 version and Graylog version 4.0.8-1. In one run, I found that filebeat writes to disk (~ 80 Mbps), although normal writes (~ 2… --- ## [Received an event that has a different character encoding than you configured. Log4j2 to Logstash](https://discuss.elastic.co/t/received-an-event-that-has-a-different-character-encoding-than-you-configured-log4j2-to-logstash/275952)
**Author:** [@Rashmika\_Gamage](https://discuss.elastic.co/u/Rashmika_Gamage)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 7:08am UTC](https://discuss.elastic.co/t/received-an-event-that-has-a-different-character-encoding-than-you-configured-log4j2-to-logstash/275952 "2021-06-15T07:08:21Z")
I am trying to get spark logs to logstash with custom log4j2 properties. My log4j2 properties file #Define the log4j configuration for local application #log4j.rootLogger=INFO, server #We will use socket appender log4j… --- ## [Elastic Fleet Agent Upgrade failing](https://discuss.elastic.co/t/elastic-fleet-agent-upgrade-failing/272502)
**Author:** [@The1WhoPrtNocks](https://discuss.elastic.co/u/The1WhoPrtNocks)\ **Replies:** 8\ **Last updated:** [June 15, 2021, 8:01am UTC](https://discuss.elastic.co/t/elastic-fleet-agent-upgrade-failing/272502 "2021-06-15T08:01:46Z")
Hi, Whenever I try to upgrade an agent via fleet it fails with the following; \[elastic\_agent\]\[error\] failed to dispatch actions, error: failed upgrade of agent binary: 2 errors occurred: \* package 'C:\\Program Files\\El… --- ## [Constant increase in RAM location for Elasticsearch](https://discuss.elastic.co/t/constant-increase-in-ram-location-for-elasticsearch/275128)
**Author:** [@kaerhick.networker](https://discuss.elastic.co/u/kaerhick.networker)\ **Replies:** 5\ **Last updated:** [June 15, 2021, 7:52am UTC](https://discuss.elastic.co/t/constant-increase-in-ram-location-for-elasticsearch/275128 "2021-06-15T07:52:26Z")
Initially the application stated running on 1Gig or Ram, next day we upgraded to 2Gig and then 4GB and still continues to consume more and more RAM over time. All it was indexing is just a 32.4 MB worth of data all toge… --- ## [Tryining to get float number in scripted filed](https://discuss.elastic.co/t/tryining-to-get-float-number-in-scripted-filed/275895)
**Author:** [@dontAskToAsk](https://discuss.elastic.co/u/dontAskToAsk)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 7:50am UTC](https://discuss.elastic.co/t/tryining-to-get-float-number-in-scripted-filed/275895 "2021-06-15T07:50:36Z")
hey I am tried to run this command in a scripted filed if (doc\['tunnels\_map.rx\_stats.counters.packets\_lost'\].size() != 0 && doc\['tunnels\_map.rx\_stats.counters.packets'\].size() != 0) {doc\['tunnels\_map.rx\_stats.counters.… --- ## [Vega Error](https://discuss.elastic.co/t/vega-error/275584)
**Author:** [@Krunal](https://discuss.elastic.co/u/Krunal)\ **Replies:** 5\ **Last updated:** [June 15, 2021, 7:50am UTC](https://discuss.elastic.co/t/vega-error/275584 "2021-06-15T07:50:29Z")
Hello expert, Vega Graph is working perfectly, but getting 0 at x-axis ... why 0 ? { "$schema": "https://vega.github.io/schema/vega-lite/v5.json", "title": "Difference par Jour", "data": { "url": { "… --- ## [Remote cluster 6.8 and 7.12](https://discuss.elastic.co/t/remote-cluster-6-8-and-7-12/275954)
**Author:** [@humartinez](https://discuss.elastic.co/u/humartinez)\ **Replies:** 2\ **Last updated:** [June 15, 2021, 7:50am UTC](https://discuss.elastic.co/t/remote-cluster-6-8-and-7-12/275954 "2021-06-15T07:50:08Z")
Im reading the documentation, and as far as I can see I could implement remote clusters to perform a cross cluster search. But theres a catch my cluster 7.x is using TLS and the cluster 6.8 is not using TLS, is it posib… --- ## [What is the replacement of SQL UNION in KQL?](https://discuss.elastic.co/t/what-is-the-replacement-of-sql-union-in-kql/275407)
**Author:** [@VinodKumarPotta](https://discuss.elastic.co/u/VinodKumarPotta)\ **Replies:** 5\ **Last updated:** [June 15, 2021, 7:39am UTC](https://discuss.elastic.co/t/what-is-the-replacement-of-sql-union-in-kql/275407 "2021-06-15T07:39:32Z")
Hi Team, Would like to check in this forum, Is there anyway that we can achieve UNION by using KQL? I have a requirement where I would need to build a Kibana dashboard with UNION of multiple sub-queries. Thank you! --- ## [Cannot have two kibana port-forwarded to localhost:5601 and localhost:5602](https://discuss.elastic.co/t/cannot-have-two-kibana-port-forwarded-to-localhost-5601-and-localhost-5602/275915)
**Author:** [@fzyzcjy](https://discuss.elastic.co/u/fzyzcjy)\ **Replies:** 5\ **Last updated:** [June 15, 2021, 7:33am UTC](https://discuss.elastic.co/t/cannot-have-two-kibana-port-forwarded-to-localhost-5601-and-localhost-5602/275915 "2021-06-15T07:33:47Z")
Hi thanks for the wonderful framework! I have two unrelated elastic cluster. I port-forward the kibanas to 5601 and 5602. However, when I login 5602, the 5601 automatically log out, and vise versa. Is there any way to av… --- ## [Cross Cluster Replication - Disaster Recovery Failback](https://discuss.elastic.co/t/cross-cluster-replication-disaster-recovery-failback/275809)
**Author:** [@rverchere](https://discuss.elastic.co/u/rverchere)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 7:24am UTC](https://discuss.elastic.co/t/cross-cluster-replication-disaster-recovery-failback/275809 "2021-06-15T07:24:56Z")
Hello, I'm currently working on a CCR architecture, to use a follower cluster as a Disaster Recovery. I have a question with the failback: When production cluster is down, then I use the DR (follower) one I promote t… [Previous page](https://discuss.elastic.co/latest.md?page=1621) [Next page](https://discuss.elastic.co/latest.md?page=1623)