# Latest **URL:** https://discuss.elastic.co/latest.md?page=1635 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1636 --- ## [Filebeat modules purpose?](https://discuss.elastic.co/t/filebeat-modules-purpose/275316)
**Author:** [@rebug](https://discuss.elastic.co/u/rebug)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 3:31pm UTC](https://discuss.elastic.co/t/filebeat-modules-purpose/275316 "2021-06-08T15:31:39Z")
I just tested for the first time a Filebeat module. If I'm right, the purpose of a module is to have a ready-to-use pattern and dashboard, with a little data enrichment. So I don't undestand what is going on because th… --- ## [How to transfer index from one elastic server to another using kibana ui](https://discuss.elastic.co/t/how-to-transfer-index-from-one-elastic-server-to-another-using-kibana-ui/275239)
**Author:** [@1ac727ff300829bca0fa](https://discuss.elastic.co/u/1ac727ff300829bca0fa)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 3:16pm UTC](https://discuss.elastic.co/t/how-to-transfer-index-from-one-elastic-server-to-another-using-kibana-ui/275239 "2021-06-08T15:16:01Z")
How to transfer index from one elastic server to another using kibana ui --- ## [Fleet Server keeps crashing](https://discuss.elastic.co/t/fleet-server-keeps-crashing/274444)
**Author:** [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)\ **Replies:** 6\ **Last updated:** [June 8, 2021, 2:54pm UTC](https://discuss.elastic.co/t/fleet-server-keeps-crashing/274444 "2021-06-08T14:54:55Z")
So I wanted to explore the new fleet changes which where introduced lately I dod a complete new setup to get hands on with it. But I am not able to get the fleet server running it keeps crashing with exit code 1 and I am… --- ## [APM Data Storing capabilities when server is down](https://discuss.elastic.co/t/apm-data-storing-capabilities-when-server-is-down/274697)
**Author:** [@wiraj](https://discuss.elastic.co/u/wiraj)\ **Replies:** 2\ **Last updated:** [June 8, 2021, 2:40pm UTC](https://discuss.elastic.co/t/apm-data-storing-capabilities-when-server-is-down/274697 "2021-06-08T14:40:42Z")
Hi All, Is there a way to store APM data using APM agents when the APM server goes down or if we are to switch off the server for a maintenance. I have gone through below topic on what happens if the APM server goes do… --- ## [How to clean up curator messages about system indices being queried](https://discuss.elastic.co/t/how-to-clean-up-curator-messages-about-system-indices-being-queried/275233)
**Author:** [@cknz](https://discuss.elastic.co/u/cknz)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 2:04pm UTC](https://discuss.elastic.co/t/how-to-clean-up-curator-messages-about-system-indices-being-queried/275233 "2021-06-08T14:04:02Z")
I'm using curator to manage my indices currently. I'm suffering from cron spam due to the following: /usr/local/lib/curator/venv/lib64/python3.8/site-packages/elasticsearch/connection/base.py:200: ElasticsearchWarning:… --- ## [Force token filter to output just one token](https://discuss.elastic.co/t/force-token-filter-to-output-just-one-token/275304)
**Author:** [@grad1](https://discuss.elastic.co/u/grad1)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 1:17pm UTC](https://discuss.elastic.co/t/force-token-filter-to-output-just-one-token/275304 "2021-06-08T13:17:01Z")
Hi, I am working on the devlopment of the search solution based on Elasticsearch for Polish language. Initially, I used the recommended analysis-stempel plugin to stem Polish words but after some experiments I found it … --- ## [Cisco ASA module ingest pipeline parsing failure 7.13](https://discuss.elastic.co/t/cisco-asa-module-ingest-pipeline-parsing-failure-7-13/275294)
**Author:** [@mbst83r](https://discuss.elastic.co/u/mbst83r)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 11:49am UTC](https://discuss.elastic.co/t/cisco-asa-module-ingest-pipeline-parsing-failure-7-13/275294 "2021-06-08T11:49:43Z")
Hello, the ingest pipeline is not parsing the IPSEC messages from the Cisco ASA (602303/602304) correctly. I am using filebeat 7.13.1 and the problem is in the filebeat-7.13.1-cisco-asa-asa-ftd-pipeline. 2021-06-08T13:… --- ## [Extra fields created for event](https://discuss.elastic.co/t/extra-fields-created-for-event/275295)
**Author:** [@gyterpena](https://discuss.elastic.co/u/gyterpena)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 12:18pm UTC](https://discuss.elastic.co/t/extra-fields-created-for-event/275295 "2021-06-08T12:18:50Z")
Hello We have this strange situation where logs that have certain fields like source.ip,source.port etc(see attached) get extra fields created eg. event.module:iis OR nginx will show fields named suricata.eve.dest\_ip … --- ## [All indices with yellow status have at least 1 unassigned shard whereas greens have zero, is my analysis correct?](https://discuss.elastic.co/t/all-indices-with-yellow-status-have-at-least-1-unassigned-shard-whereas-greens-have-zero-is-my-analysis-correct/275267)
**Author:** [@devashishsingh](https://discuss.elastic.co/u/devashishsingh)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 12:03pm UTC](https://discuss.elastic.co/t/all-indices-with-yellow-status-have-at-least-1-unassigned-shard-whereas-greens-have-zero-is-my-analysis-correct/275267 "2021-06-08T12:03:43Z")
Hi there! Since all with Yellow status are having trouble processing the data, I have noticed that all indices with yellow status have at least 1 shard unassigned. How can we fix this allocation? Thank you … --- ## [How to convert the output into json in watcher body](https://discuss.elastic.co/t/how-to-convert-the-output-into-json-in-watcher-body/275293)
**Author:** [@Mojahid\_Ahmad](https://discuss.elastic.co/u/Mojahid_Ahmad)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 11:44am UTC](https://discuss.elastic.co/t/how-to-convert-the-output-into-json-in-watcher-body/275293 "2021-06-08T11:44:23Z")
Hi, I want to convert the output into JSON format in the watcher body. I tried {{#toJson}}. But I couldn't get success. Please guide me through how to resolve this issue? "body": """{{#toJson}}{{#ctx.payload.hits.hits}}… --- ## [FATAL Error: Port 5601 is already in use. Another instance of Kibana may be running!](https://discuss.elastic.co/t/fatal-error-port-5601-is-already-in-use-another-instance-of-kibana-may-be-running/274981)
**Author:** [@guxupeta](https://discuss.elastic.co/u/guxupeta)\ **Replies:** 6\ **Last updated:** [June 8, 2021, 11:39am UTC](https://discuss.elastic.co/t/fatal-error-port-5601-is-already-in-use-another-instance-of-kibana-may-be-running/274981 "2021-06-08T11:39:16Z")
Hello guys I'm having problems running start kibana every time I try to start give does tap of errors FATAL Error: Port 5601 is already in use. Another instance of Kibana may be running! I'm sending an image --- ## [Is elastic.co site down?](https://discuss.elastic.co/t/is-elastic-co-site-down/275282)
**Author:** [@ErSumit](https://discuss.elastic.co/u/ErSumit)\ **Replies:** 3\ **Last updated:** [June 8, 2021, 11:19am UTC](https://discuss.elastic.co/t/is-elastic-co-site-down/275282 "2021-06-08T11:19:54Z")
I'm unable to see the elastic website. :strange --- ## [Crear un campo nuevo con scripted field y runtime](https://discuss.elastic.co/t/crear-un-campo-nuevo-con-scripted-field-y-runtime/275176)
**Author:** [@EduardoM](https://discuss.elastic.co/u/EduardoM)\ **Replies:** 3\ **Last updated:** [June 8, 2021, 11:10am UTC](https://discuss.elastic.co/t/crear-un-campo-nuevo-con-scripted-field-y-runtime/275176 "2021-06-08T11:10:31Z")
Hola, espero que se encuentren bien! Quiero tener nuevos valores en un nuevo campo, por ejemplo, la velocidad maxima de un producto pero por tipos de producto. conosco las velocidades maximas por producto y solo quiero… --- ## [Match phrase prefix query stopped working for multiple terms after 7.10.2](https://discuss.elastic.co/t/match-phrase-prefix-query-stopped-working-for-multiple-terms-after-7-10-2/272293)
**Author:** [@Sleepy\_Panda](https://discuss.elastic.co/u/Sleepy_Panda)\ **Replies:** 3\ **Last updated:** [June 8, 2021, 10:44am UTC](https://discuss.elastic.co/t/match-phrase-prefix-query-stopped-working-for-multiple-terms-after-7-10-2/272293 "2021-06-08T10:44:29Z")
Issue: search using match\_phrase\_prefix does not return results for queries which consist of multiple terms, e.g. "Additional HTTP". ElasticSearch 7.10.2: document is returned when searching "Additional HTTP" ElasticSe… --- ## [Filter records with a change in a particular field during a period](https://discuss.elastic.co/t/filter-records-with-a-change-in-a-particular-field-during-a-period/275018)
**Author:** [@Eugene\_Korepanov](https://discuss.elastic.co/u/Eugene_Korepanov)\ **Replies:** 3\ **Last updated:** [June 8, 2021, 10:41am UTC](https://discuss.elastic.co/t/filter-records-with-a-change-in-a-particular-field-during-a-period/275018 "2021-06-08T10:41:37Z")
I have multiple hosts reporting some fields every day. I need to find sources that got a change in a value of a particular field. Let's say yesterday "field1" was 0 and today 1. In addition to that, I need to build a ta… --- ## [Beats status monitoring](https://discuss.elastic.co/t/beats-status-monitoring/275286)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 10:31am UTC](https://discuss.elastic.co/t/beats-status-monitoring/275286 "2021-06-08T10:31:33Z")
Hey, community. I have question - is it possible to make beats send some sort of keepalive messages? I want to know if my beats agents (winlogbeat, auditbeat, filebeat) in active state, and their services up. --- ## [Is jars used in modules can be reused?](https://discuss.elastic.co/t/is-jars-used-in-modules-can-be-reused/275281)
**Author:** [@mohammed\_rizwan](https://discuss.elastic.co/u/mohammed_rizwan)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 9:59am UTC](https://discuss.elastic.co/t/is-jars-used-in-modules-can-be-reused/275281 "2021-06-08T09:59:44Z")
Hi team, We are using the elastic search 7.13.0. We observed that the same jars are available (repeated) in multiple module folders, say httpclient-4.5.10.jar is available in 5 modules. Is it possible to have this jar… --- ## ["\[term\] query malformed, no start\_object after query name"](https://discuss.elastic.co/t/term-query-malformed-no-start-object-after-query-name/275275)
**Author:** [@SeanO95](https://discuss.elastic.co/u/SeanO95)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 9:38am UTC](https://discuss.elastic.co/t/term-query-malformed-no-start-object-after-query-name/275275 "2021-06-08T09:38:44Z")
Hey guys, seeing 'query malformed' no matter what field I try to use. I am trying to use postman to input data for my GET to pull back but seeing this issue. If I use postman to input data into my POST using the same m… --- ## [Vega Error](https://discuss.elastic.co/t/vega-error/274479)
**Author:** [@Krunal](https://discuss.elastic.co/u/Krunal)\ **Replies:** 23\ **Last updated:** [June 8, 2021, 9:10am UTC](https://discuss.elastic.co/t/vega-error/274479 "2021-06-08T09:10:48Z")
Hello expert, I need your help to find the error, i tried to find out but i didnt got it. Thanks in advance... \` { $schema: https://vega.github.io/schema/vega-lite/v5.json data: { url: { %context%: true %… --- ## [\[Filebeat\] module kafka var.kafka\_home not work](https://discuss.elastic.co/t/filebeat-module-kafka-var-kafka-home-not-work/275262)
**Author:** [@yandd](https://discuss.elastic.co/u/yandd)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 8:50am UTC](https://discuss.elastic.co/t/filebeat-module-kafka-var-kafka-home-not-work/275262 "2021-06-08T08:50:58Z")
Version: 7.13.1 Operating System: CentOS Linux release 7.6.1810 (Core) Discuss Forum URL: Steps to Reproduce: Run: filebeat modules enable kafka Edit: modules.d/kafka.yml# Module: kafka # Docs: https://www.… --- ## [Logstash ERROR \`block in controlled\_read'](https://discuss.elastic.co/t/logstash-error-block-in-controlled-read/275269)
**Author:** [@oduvancheg666](https://discuss.elastic.co/u/oduvancheg666)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 9:01am UTC](https://discuss.elastic.co/t/logstash-error-block-in-controlled-read/275269 "2021-06-08T09:01:53Z")
Hello. Logstash version 7.3.0 gets the error: \[2021-06-08T10:13:48,304\]\[ERROR\]\[filewatch.tailmode.handlers.grow\] read\_to\_eof: general error reading //PC/C$/inetpub/logs/LogFiles/W3SVC2/u\_ex210608.log {"error"=\>"#\ 0 bytes](https://discuss.elastic.co/t/inputstream-must-have-0-bytes/275265)
**Author:** [@Mohammed\_Shamran](https://discuss.elastic.co/u/Mohammed_Shamran)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 8:52am UTC](https://discuss.elastic.co/t/inputstream-must-have-0-bytes/275265 "2021-06-08T08:52:59Z")
Hi Im getting following error when my Elasticsearch reindexing content. Any idea why Im getting this error and how can I configure elasticsearch to ignore this error? 2021-06-08 08:00:10.592 ERROR 38 --- \[deployment-3\]… --- ## [Replace legacy collector with metricbeat](https://discuss.elastic.co/t/replace-legacy-collector-with-metricbeat/272952)
**Author:** [@kodka](https://discuss.elastic.co/u/kodka)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 8:52am UTC](https://discuss.elastic.co/t/replace-legacy-collector-with-metricbeat/272952 "2021-06-08T08:52:52Z")
I can't understand how this works: What metricsets do i need to have enabled in order to have everything that legacy collectors scrapes as data. And do i need to have different metricsets configured for master and data… --- ## [\_flush/synced command shows failures after being clean - indexing stopped](https://discuss.elastic.co/t/flush-synced-command-shows-failures-after-being-clean-indexing-stopped/274964)
**Author:** [@kredfern](https://discuss.elastic.co/u/kredfern)\ **Replies:** 2\ **Last updated:** [June 8, 2021, 8:37am UTC](https://discuss.elastic.co/t/flush-synced-command-shows-failures-after-being-clean-indexing-stopped/274964 "2021-06-08T08:37:17Z")
Just wondering if the following behavior can be explained so that we have confidence to continue the rolling restart procedure. We are using v7.4 cluster. We have stopped all indexing into the cluster before these step… --- ## [Cluster Red, many shards Unassigned](https://discuss.elastic.co/t/cluster-red-many-shards-unassigned/275236)
**Author:** [@sakrayaami](https://discuss.elastic.co/u/sakrayaami)\ **Replies:** 2\ **Last updated:** [June 8, 2021, 7:04am UTC](https://discuss.elastic.co/t/cluster-red-many-shards-unassigned/275236 "2021-06-08T07:04:56Z")
Hello, I'm very new to the community and here I am after some months of reading and configuring :slight\_smile: Ok I'm trying to work out a problem with my new cluster, I have the following setup: Elastic 7.13 2 Maste… --- ## [Производительность работы на разных процессорах](https://discuss.elastic.co/t/topic/275251)
**Author:** [@IvanTushin](https://discuss.elastic.co/u/IvanTushin)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 8:12am UTC](https://discuss.elastic.co/t/topic/275251 "2021-06-08T08:12:20Z")
Коллеги здравствуйте! Мы собираемся создать новый кластер и наш хостер предлагает различные варианты процессоров. Раньше мы запускали только на серверных процессорах Intel Xeon E, но сейчас появилась возможность использ… --- ## [Grok pattern(s) working in debugger but not used in logstash?](https://discuss.elastic.co/t/grok-pattern-s-working-in-debugger-but-not-used-in-logstash/274602)
**Author:** [@3lastic](https://discuss.elastic.co/u/3lastic)\ **Replies:** 14\ **Last updated:** [June 8, 2021, 8:04am UTC](https://discuss.elastic.co/t/grok-pattern-s-working-in-debugger-but-not-used-in-logstash/274602 "2021-06-08T08:04:07Z")
Hello, I try to get Sophos Firewall logs into logstash (which is working) but my grok filter to get the logline separated into fields is not working. The test via grok debugger is working... Here are my logstash conf f… --- ## [Elastic Training- Observability](https://discuss.elastic.co/t/elastic-training-observability/275194)
**Author:** [@leemase004](https://discuss.elastic.co/u/leemase004)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 7:56am UTC](https://discuss.elastic.co/t/elastic-training-observability/275194 "2021-06-08T07:56:14Z")
The current Elasticsearch observability course is scheduled for: June 28 -July 1, 2021 9:00 am -3:00 pm America - Chicago Time zone However, there are no other time slots listed. When and how often are these courses … --- ## [How to install logstash-integration-jdbc plugin](https://discuss.elastic.co/t/how-to-install-logstash-integration-jdbc-plugin/275241)
**Author:** [@charles97](https://discuss.elastic.co/u/charles97)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 7:33am UTC](https://discuss.elastic.co/t/how-to-install-logstash-integration-jdbc-plugin/275241 "2021-06-08T07:33:04Z")
I'm trying to install logstash-integration-jdbc following this git logstash-integration-jdbc running logstash 7.12.1 I've installed jruby $ jruby --version jruby 9.1.17.0 (2.3.3) 2020-02-29 fffffff OpenJDK 64-Bit Ser… --- ## [Recommended workflow for indexing many binary docs](https://discuss.elastic.co/t/recommended-workflow-for-indexing-many-binary-docs/275142)
**Author:** [@ottadini](https://discuss.elastic.co/u/ottadini)\ **Replies:** 3\ **Last updated:** [June 8, 2021, 6:50am UTC](https://discuss.elastic.co/t/recommended-workflow-for-indexing-many-binary-docs/275142 "2021-06-08T06:50:30Z")
I have two options in front of me - use fscrawler to crawl my directory, use the setting fs:store\_source (Base64-encoded document) to add the file as a field to the message, send that message to a pipeline on ES that h… [Previous page](https://discuss.elastic.co/latest.md?page=1634) [Next page](https://discuss.elastic.co/latest.md?page=1636)