# Latest **URL:** https://discuss.elastic.co/latest.md?page=1629 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1630 --- ## [Count the chattiest server](https://discuss.elastic.co/t/count-the-chattiest-server/275412)
**Author:** [@A\_Mightiev](https://discuss.elastic.co/u/A_Mightiev)\ **Replies:** 1\ **Last updated:** [June 10, 2021, 8:59pm UTC](https://discuss.elastic.co/t/count-the-chattiest-server/275412 "2021-06-10T20:59:59Z")
Hi I am getting logs from different servers and I would like to get a watcher where it will count the number of errors reported and trigger a response after certain threshold. I have it worked but it counts all errors o… --- ## [Is it possible to process AWS Cloudwatch logs using the nginx module?](https://discuss.elastic.co/t/is-it-possible-to-process-aws-cloudwatch-logs-using-the-nginx-module/275438)
**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Replies:** 5\ **Last updated:** [June 10, 2021, 8:34pm UTC](https://discuss.elastic.co/t/is-it-possible-to-process-aws-cloudwatch-logs-using-the-nginx-module/275438 "2021-06-10T20:34:48Z")
I have a service deployed to ECS which is basically an nginx instance. I want to ingest the logs using filebeat - I can do this using the aws cloudwatch input type, but it doesn't grok the message field like the nginx m… --- ## [Is it possible to obtain results with different term queries that each could have a percentage weight?](https://discuss.elastic.co/t/is-it-possible-to-obtain-results-with-different-term-queries-that-each-could-have-a-percentage-weight/275578)
**Author:** [@mstirling](https://discuss.elastic.co/u/mstirling)\ **Replies:** 1\ **Last updated:** [June 10, 2021, 8:25pm UTC](https://discuss.elastic.co/t/is-it-possible-to-obtain-results-with-different-term-queries-that-each-could-have-a-percentage-weight/275578 "2021-06-10T20:25:00Z")
Does anyone know if it's possible to obtain results to use an alternative term search based on a percentage? For example Imagine I have an Apple index. I'd like to have 40% of the results to be color red while 60% to be… --- ## [Bug report for Documents API](https://discuss.elastic.co/t/bug-report-for-documents-api/275613)
**Author:** [@zkirill](https://discuss.elastic.co/u/zkirill)\ **Replies:** 1\ **Last updated:** [June 10, 2021, 8:08pm UTC](https://discuss.elastic.co/t/bug-report-for-documents-api/275613 "2021-06-10T20:08:41Z")
When deleting a document by ID the API falsely suggests that the document was not deleted whereas it has, in fact, been deleted. Given the following document: \[ { "id": 1, "name": "Apple pie" } \] The q… --- ## [Logstash communication | configuration](https://discuss.elastic.co/t/logstash-communication-configuration/275331)
**Author:** [@farciarz121](https://discuss.elastic.co/u/farciarz121)\ **Replies:** 7\ **Last updated:** [June 10, 2021, 8:02pm UTC](https://discuss.elastic.co/t/logstash-communication-configuration/275331 "2021-06-10T20:02:57Z")
I am traying to send logs from beats to logs to ES cloud. 5 beats are hosted on IP addresses from 192.168.1.10-15. Logstash is installed on 192.168.1.100 node. Here is example of part of packet beat conf file from one … --- ## [Japanese autocomplete with App Search](https://discuss.elastic.co/t/japanese-autocomplete-with-app-search/275217)
**Author:** [@zkirill](https://discuss.elastic.co/u/zkirill)\ **Replies:** 2\ **Last updated:** [June 10, 2021, 8:00pm UTC](https://discuss.elastic.co/t/japanese-autocomplete-with-app-search/275217 "2021-06-10T20:00:08Z")
I am performing search query tests as described in Implementing Japanese autocomplete suggestions in Elasticsearch | Elastic Blog but not getting any of the expected results. What does "language optimization" mean for A… --- ## [Will Filebeat Traefik module parse CLF or JSON access logs?](https://discuss.elastic.co/t/will-filebeat-traefik-module-parse-clf-or-json-access-logs/274781)
**Author:** [@bluepuma77](https://discuss.elastic.co/u/bluepuma77)\ **Replies:** 2\ **Last updated:** [June 10, 2021, 7:54pm UTC](https://discuss.elastic.co/t/will-filebeat-traefik-module-parse-clf-or-json-access-logs/274781 "2021-06-10T19:54:10Z")
I check the documentation but it doesn't tell if the module will parse the CLF or JSON log file format of Traefik? Which format should I use? Cheers bluepuma --- ## [How to extract specific data from extraction query response](https://discuss.elastic.co/t/how-to-extract-specific-data-from-extraction-query-response/275349)
**Author:** [@marifwanna](https://discuss.elastic.co/u/marifwanna)\ **Replies:** 2\ **Last updated:** [June 10, 2021, 7:51pm UTC](https://discuss.elastic.co/t/how-to-extract-specific-data-from-extraction-query-response/275349 "2021-06-10T19:51:00Z")
I am using an extraction query in monitor to alert me in case the email I send to a user bounces. I am able to get the trigger to work and receive an alert on slack I would like to include the user's email in the alert … --- ## [Ingest AWS-CloudTrail Logs](https://discuss.elastic.co/t/ingest-aws-cloudtrail-logs/273464)
**Author:** [@vishakh](https://discuss.elastic.co/u/vishakh)\ **Replies:** 10\ **Last updated:** [June 10, 2021, 7:45pm UTC](https://discuss.elastic.co/t/ingest-aws-cloudtrail-logs/273464 "2021-06-10T19:45:46Z")
I’m trying to extract & ingest AWS-Cloudtrail logs using Filebeat-7.10.0 AWS-module. I’m seeing the below error when filebeat is started & fails in starting further until I disable the AWS filebeat module. {"file.name"… --- ## [Kibana repeats data in a table](https://discuss.elastic.co/t/kibana-repeats-data-in-a-table/275595)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 3\ **Last updated:** [June 10, 2021, 7:09pm UTC](https://discuss.elastic.co/t/kibana-repeats-data-in-a-table/275595 "2021-06-10T19:09:44Z")
Hello I have an error when displaying data from a table in kibana, what happens is that the data is repeated and does not show me real data. and in the discover if it shows me the correct data: --- ## [How to get the heap size used by an indices?](https://discuss.elastic.co/t/how-to-get-the-heap-size-used-by-an-indices/275531)
**Author:** [@rebug](https://discuss.elastic.co/u/rebug)\ **Replies:** 1\ **Last updated:** [June 10, 2021, 6:37pm UTC](https://discuss.elastic.co/t/how-to-get-the-heap-size-used-by-an-indices/275531 "2021-06-10T18:37:53Z")
Hello, I would like to know is there a possibility to get the heap used by a particular indices in elastic search ? Thanks :grinning: --- ## [Module for Hardware Monitoring - iDRAC and iLO](https://discuss.elastic.co/t/module-for-hardware-monitoring-idrac-and-ilo/275609)
**Author:** [@albertosoares](https://discuss.elastic.co/u/albertosoares)\ **Replies:** 0\ **Last updated:** [June 10, 2021, 6:23pm UTC](https://discuss.elastic.co/t/module-for-hardware-monitoring-idrac-and-ilo/275609 "2021-06-10T18:23:25Z")
Hello, I would like to collect data from iDRAC and iLO. My intention is to send Syslog messages to Elasticsearch, but before I do it, I would like to know if there are other ways to do it. For example, a module of logst… --- ## [Geocoding using Pelias](https://discuss.elastic.co/t/geocoding-using-pelias/275575)
**Author:** [@element119](https://discuss.elastic.co/u/element119)\ **Replies:** 2\ **Last updated:** [June 10, 2021, 5:59pm UTC](https://discuss.elastic.co/t/geocoding-using-pelias/275575 "2021-06-10T17:59:35Z")
Hi all, very new to Elastick Stack and Pelias... I've searched everything I can think of for a solution but haven't found anything which tells me there's something glaringly obvious I've missed. What I have Elasticsear… --- ## [Yarn kbn bootstrap](https://discuss.elastic.co/t/yarn-kbn-bootstrap/275603)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 6\ **Last updated:** [June 10, 2021, 5:57pm UTC](https://discuss.elastic.co/t/yarn-kbn-bootstrap/275603 "2021-06-10T17:57:09Z")
Hello there, I am trying to build Kibana from the source and following this link. but when I run yarn kbn bootstrap. I received the following error. D:\\Kibana-development\\kibana\>yarn kbn bootstrap yarn run v1.22.1 $… --- ## [Official elasticsearch helm chart - Unable to install plugins](https://discuss.elastic.co/t/official-elasticsearch-helm-chart-unable-to-install-plugins/275593)
**Author:** [@xadamz23](https://discuss.elastic.co/u/xadamz23)\ **Replies:** 0\ **Last updated:** [June 10, 2021, 3:30pm UTC](https://discuss.elastic.co/t/official-elasticsearch-helm-chart-unable-to-install-plugins/275593 "2021-06-10T15:30:40Z")
Hello, I'm using the official elasticsearch helm chart (elasticsearch 7.13.1 · elastic/elastic) and I'm trying to use "extraInitContainers" to install the "repository-azure" plugin. I do know that the recommended way t… --- ## [Aggregate filter: How to delete the event when no matching task\_id found within the timeout?](https://discuss.elastic.co/t/aggregate-filter-how-to-delete-the-event-when-no-matching-task-id-found-within-the-timeout/275375)
**Author:** [@subash](https://discuss.elastic.co/u/subash)\ **Replies:** 3\ **Last updated:** [June 10, 2021, 4:39pm UTC](https://discuss.elastic.co/t/aggregate-filter-how-to-delete-the-event-when-no-matching-task-id-found-within-the-timeout/275375 "2021-06-10T16:39:09Z")
Hi, I am using aggregate filter in Logstash to merge the events based on task\_id. The problem is, I don't want to push the event when no matching task\_id found within the given timeout. Please pour you ideas to achiev… --- ## [Failed to parse field \[eAgent.tstEvent\] of type \[date\]](https://discuss.elastic.co/t/failed-to-parse-field-eagent-tstevent-of-type-date/275576)
**Author:** [@vaclav1](https://discuss.elastic.co/u/vaclav1)\ **Replies:** 1\ **Last updated:** [June 10, 2021, 4:35pm UTC](https://discuss.elastic.co/t/failed-to-parse-field-eagent-tstevent-of-type-date/275576 "2021-06-10T16:35:11Z")
Dear team, I have used date filter plugin to parse the date field: date { match =\> \[ "\[message\]\[tstEventPlan\]", "yyyy-MM-dd HH:mm:ss'.'SSS" \] remove\_field =\> \[ "\[message\]\[tstEventPlan\]" \] target =\> "\[eAgent\]\[t… --- ## [Logstash Elasticsearch plugin compare inputs](https://discuss.elastic.co/t/logstash-elasticsearch-plugin-compare-inputs/275152)
**Author:** [@Armen\_Petrosyan](https://discuss.elastic.co/u/Armen_Petrosyan)\ **Replies:** 6\ **Last updated:** [June 10, 2021, 4:07pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-plugin-compare-inputs/275152 "2021-06-10T16:07:21Z")
I have logstash configured to have two inputs from different ES clusters input { elasticsearch { hosts =\> \["xxx:111"\] ssl =\> true user =\> "" password =\> "" ca\_file =\> "" … --- ## [Elaticsearch multiMatchQuery with wildcard](https://discuss.elastic.co/t/elaticsearch-multimatchquery-with-wildcard/275590)
**Author:** [@saiteja](https://discuss.elastic.co/u/saiteja)\ **Replies:** 0\ **Last updated:** [June 10, 2021, 3:08pm UTC](https://discuss.elastic.co/t/elaticsearch-multimatchquery-with-wildcard/275590 "2021-06-10T15:08:27Z")
Hello, I have a requirement to search in all the fileds data with wild card in java using elaticsearch spring data in spring boot Here is my code String queryString = "362\*"; final Query searchQuery = new… --- ## [Parsing result from custom Beats](https://discuss.elastic.co/t/parsing-result-from-custom-beats/275574)
**Author:** [@blackberrySherbet](https://discuss.elastic.co/u/blackberrySherbet)\ **Replies:** 1\ **Last updated:** [June 10, 2021, 3:05pm UTC](https://discuss.elastic.co/t/parsing-result-from-custom-beats/275574 "2021-06-10T15:05:06Z")
I have created my own Beats and I am passing data from that Beats to logstash. This is what I get when I print to stdout in logstash(stdout { codec =\> "rubydebug"}) { "agent" =\> { "type" =\> "cu… --- ## [Lookup for IP range](https://discuss.elastic.co/t/lookup-for-ip-range/275520)
**Author:** [@abhishek30](https://discuss.elastic.co/u/abhishek30)\ **Replies:** 1\ **Last updated:** [June 10, 2021, 2:57pm UTC](https://discuss.elastic.co/t/lookup-for-ip-range/275520 "2021-06-10T14:57:17Z")
Hi, I would like to perform lookup for IP range in logstash pipeline. IP ranges meaning 10.0.0.0 to 10.255.255.0. Kindly Help Thanks & Regards Abhishek --- ## [How to make custom graph like Monitors overview](https://discuss.elastic.co/t/how-to-make-custom-graph-like-monitors-overview/275589)
**Author:** [@mar-ro](https://discuss.elastic.co/u/mar-ro)\ **Replies:** 1\ **Last updated:** [June 10, 2021, 2:49pm UTC](https://discuss.elastic.co/t/how-to-make-custom-graph-like-monitors-overview/275589 "2021-06-10T14:49:34Z")
Good afternoon. I'm trying to create a custom dashboard that among its "widgets" has one like the one shown in the "Uptime" menu with the monitors that are "Up" and those that are "Down". My intention is to be able to … --- ## [How to change number format in Logstash](https://discuss.elastic.co/t/how-to-change-number-format-in-logstash/275587)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 1\ **Last updated:** [June 10, 2021, 2:39pm UTC](https://discuss.elastic.co/t/how-to-change-number-format-in-logstash/275587 "2021-06-10T14:39:46Z")
I have numbers like 1.553 23 2.383 26 566 When I parse this with logstash, I get string value of these. When I try to use mutate filter plugin like below; mutate { convert =\> { "number\_field" =\> "int… --- ## [Cannot Install Fleet Server](https://discuss.elastic.co/t/cannot-install-fleet-server/275012)
**Author:** [@Nico\_17](https://discuss.elastic.co/u/Nico_17)\ **Replies:** 1\ **Last updated:** [June 10, 2021, 2:17pm UTC](https://discuss.elastic.co/t/cannot-install-fleet-server/275012 "2021-06-10T14:17:30Z")
Hello there, Server info: 1 - I´m running ubuntu server 18.04 2 - Elk stack running on 7.13 version fleet server creation does not work. root@elastic:/tmp/agent/elastic-agent-7.13.1-linux-x86\_64# sudo ./elastic-age… --- ## [ElasticSearch: Configuring keep alive time for scaling threads](https://discuss.elastic.co/t/elasticsearch-configuring-keep-alive-time-for-scaling-threads/275586)
**Author:** [@SatyaAditya](https://discuss.elastic.co/u/SatyaAditya)\ **Replies:** 0\ **Last updated:** [June 10, 2021, 2:16pm UTC](https://discuss.elastic.co/t/elasticsearch-configuring-keep-alive-time-for-scaling-threads/275586 "2021-06-10T14:16:01Z")
I am facing Java Out Of Memory issue while successive index operations. I have a custom ES plugin, which makes an API call, so for each document an API call is made and a new thread is being created for that API call. Fo… --- ## [How to set Environment variable in kibana](https://discuss.elastic.co/t/how-to-set-environment-variable-in-kibana/275483)
**Author:** [@ravi\_yadav2](https://discuss.elastic.co/u/ravi_yadav2)\ **Replies:** 3\ **Last updated:** [June 10, 2021, 2:00pm UTC](https://discuss.elastic.co/t/how-to-set-environment-variable-in-kibana/275483 "2021-06-10T14:00:51Z")
Hi Team, I am working on 7.10.2 kibana source code. On kibana UI i want to show build version which is dynamic in nature and gets changed on each build . How i can access environment variable inside header.tsx file. H… --- ## [Getting org.elasticsearch.hadoop.rest.EsHadoopRemoteException: too\_many\_clauses: too\_many\_clauses: maxClauseCount is set to 1024\\n](https://discuss.elastic.co/t/getting-org-elasticsearch-hadoop-rest-eshadoopremoteexception-too-many-clauses-too-many-clauses-maxclausecount-is-set-to-1024-n/275580)
**Author:** [@Chilaka\_Ramakrishna](https://discuss.elastic.co/u/Chilaka_Ramakrishna)\ **Replies:** 0\ **Last updated:** [June 10, 2021, 1:37pm UTC](https://discuss.elastic.co/t/getting-org-elasticsearch-hadoop-rest-eshadoopremoteexception-too-many-clauses-too-many-clauses-maxclausecount-is-set-to-1024-n/275580 "2021-06-10T13:37:43Z")
Getting the following error while running spark-sql for a simple in query org.elasticsearch.hadoop.rest.EsHadoopRemoteException: too\_many\_clauses: too\_many\_clauses: maxClauseCount is set to 1024\\n --- ## [Painless script to calculate elapsed time between two fields](https://discuss.elastic.co/t/painless-script-to-calculate-elapsed-time-between-two-fields/275133)
**Author:** [@theirfan](https://discuss.elastic.co/u/theirfan)\ **Replies:** 13\ **Last updated:** [June 10, 2021, 1:19pm UTC](https://discuss.elastic.co/t/painless-script-to-calculate-elapsed-time-between-two-fields/275133 "2021-06-10T13:19:05Z")
Hi All, i have two fields, up : "2021-06-03T07:01:56.159Z" down : "2021-06-03T10:01:29.978Z" Following the above link and solution, doc\['down'\].value.millis - doc\['up'\].value.millis shows me Script is invalid. Vi… --- ## [Problema creación de patrón personalizado para fechas en logstash](https://discuss.elastic.co/t/problema-creacion-de-patron-personalizado-para-fechas-en-logstash/275253)
**Author:** [@mar-ro](https://discuss.elastic.co/u/mar-ro)\ **Replies:** 2\ **Last updated:** [June 10, 2021, 12:52pm UTC](https://discuss.elastic.co/t/problema-creacion-de-patron-personalizado-para-fechas-en-logstash/275253 "2021-06-10T12:52:23Z")
Buenos días. Estoy intentando configurar logstash para que obtenga la fecha del campo message de aquellos logs que tengan un formato distinto al de la norma ISO8601 pero no lo consigo. Un ejemplo de fecha obtenido de u… --- ## [See autodiscovery generated configs](https://discuss.elastic.co/t/see-autodiscovery-generated-configs/275567)
**Author:** [@Moshe\_Avni](https://discuss.elastic.co/u/Moshe_Avni)\ **Replies:** 0\ **Last updated:** [June 10, 2021, 12:39pm UTC](https://discuss.elastic.co/t/see-autodiscovery-generated-configs/275567 "2021-06-10T12:39:59Z")
Hi, on the autodiscovery docs, it says: On start, Filebeat will scan existing containers and launch the proper configs for them. Is there a way to see the 'launched' configurations to debug if something is wrong with… [Previous page](https://discuss.elastic.co/latest.md?page=1628) [Next page](https://discuss.elastic.co/latest.md?page=1630)