# Latest **URL:** https://discuss.elastic.co/latest.md?page=1652 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1653 --- ## [Aggregation on time series data (metricbeat and TSVB)](https://discuss.elastic.co/t/aggregation-on-time-series-data-metricbeat-and-tsvb/273455)
**Author:** [@zvazquez](https://discuss.elastic.co/u/zvazquez)\ **Replies:** 4\ **Last updated:** [May 30, 2021, 2:27pm UTC](https://discuss.elastic.co/t/aggregation-on-time-series-data-metricbeat-and-tsvb/273455 "2021-05-30T14:27:54Z")
Hi all, The scenarios is as follow: We are using metricbeat to capture metrics from multiple Kubernetes clusters into a single Elasticsearch cluster, we have enriched the data by adding a label using the processor, by … --- ## [Reindex API for split a field](https://discuss.elastic.co/t/reindex-api-for-split-a-field/274012)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 3\ **Last updated:** [May 30, 2021, 6:29am UTC](https://discuss.elastic.co/t/reindex-api-for-split-a-field/274012 "2021-05-30T06:29:15Z")
Hi I've created an index template, and now trying to reindex my logs according to that index template. This is a log just for instance: "\_score": null, "\_source": { "@timestamp": "2021-05-25T08:38:36", "ho… --- ## [File structure cannot be determined. illegal\_argument\_exception](https://discuss.elastic.co/t/file-structure-cannot-be-determined-illegal-argument-exception/273858)
**Author:** [@Muhammad\_Uxman](https://discuss.elastic.co/u/Muhammad_Uxman)\ **Replies:** 2\ **Last updated:** [May 30, 2021, 6:01am UTC](https://discuss.elastic.co/t/file-structure-cannot-be-determined-illegal-argument-exception/273858 "2021-05-30T06:01:08Z")
Hi Elastic Community, I am new to Kibana and Elastic. I am following the official Elastic tutorial. In the demonstration, a file was uploaded to Data Visualizer, which was analyzed successfully, but I got the following… --- ## [I am Trying to use logstash oss 7.9.1 to push csv files into Open Distro Elasticsearch 1.13.2](https://discuss.elastic.co/t/i-am-trying-to-use-logstash-oss-7-9-1-to-push-csv-files-into-open-distro-elasticsearch-1-13-2/274411)
**Author:** [@aswanth\_jabba](https://discuss.elastic.co/u/aswanth_jabba)\ **Replies:** 1\ **Last updated:** [May 30, 2021, 4:06am UTC](https://discuss.elastic.co/t/i-am-trying-to-use-logstash-oss-7-9-1-to-push-csv-files-into-open-distro-elasticsearch-1-13-2/274411 "2021-05-30T04:06:06Z")
Please suggest me with version combabilities, I am not sure if thats the case of my errors When I try to run logstash i get these errors \[2021-05-30T03:34:51,112\]\[WARN \]\[logstash.config.source.multilocal\] Ignoring the … --- ## ["Key" and "docCount" are missing when serializing BucketAggregate to string with Nest client](https://discuss.elastic.co/t/key-and-doccount-are-missing-when-serializing-bucketaggregate-to-string-with-nest-client/274389)
**Author:** [@jthoni](https://discuss.elastic.co/u/jthoni)\ **Replies:** 3\ **Last updated:** [May 30, 2021, 3:42am UTC](https://discuss.elastic.co/t/key-and-doccount-are-missing-when-serializing-bucketaggregate-to-string-with-nest-client/274389 "2021-05-30T03:42:57Z")
I am working on upgrading a service from ES 5.0 to 6.8. I have a bucket aggregate that in v5 serializes to this: "items": \[ { "key": "random+topic", "docCount": 27919, "aggreg… --- ## [Qradar Logs to Logstash/Elastic?](https://discuss.elastic.co/t/qradar-logs-to-logstash-elastic/274385)
**Author:** [@mohamed\_el\_mannouti](https://discuss.elastic.co/u/mohamed_el_mannouti)\ **Replies:** 3\ **Last updated:** [May 30, 2021, 12:58am UTC](https://discuss.elastic.co/t/qradar-logs-to-logstash-elastic/274385 "2021-05-30T00:58:02Z")
we have a Qradar SIEM which we plan to extend to Elastic for threat hunting(Log Forwarding from Qradar to Elastic) Has anyone found any success with it. Any known shortcomings/pitfalls from the setup. --- ## [Kibana | FATAL Error: HELP](https://discuss.elastic.co/t/kibana-fatal-error-help/274274)
**Author:** [@LombardoAndrea195](https://discuss.elastic.co/u/LombardoAndrea195)\ **Replies:** 6\ **Last updated:** [May 30, 2021, 12:09am UTC](https://discuss.elastic.co/t/kibana-fatal-error-help/274274 "2021-05-30T00:09:33Z")
Hi all I've obtained this error: I've created some plot through vega lite and when I execute again the script used for kibana I've this error but until some time before everthing works well. I've a node of kibana and a… --- ## [Filebeat not working](https://discuss.elastic.co/t/filebeat-not-working/274316)
**Author:** [@Drupad\_Soni](https://discuss.elastic.co/u/Drupad_Soni)\ **Replies:** 4\ **Last updated:** [May 29, 2021, 8:32pm UTC](https://discuss.elastic.co/t/filebeat-not-working/274316 "2021-05-29T20:32:24Z")
Filebeat not working ● filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch. Loaded: loaded (/lib/systemd/system/filebeat.service; disabled; vendor preset: enabled) Active: failed (Resu… --- ## [Configuration to process certain logs with pipeline using Autodiscover](https://discuss.elastic.co/t/configuration-to-process-certain-logs-with-pipeline-using-autodiscover/274407)
**Author:** [@zvazquez](https://discuss.elastic.co/u/zvazquez)\ **Replies:** 1\ **Last updated:** [May 29, 2021, 6:51pm UTC](https://discuss.elastic.co/t/configuration-to-process-certain-logs-with-pipeline-using-autodiscover/274407 "2021-05-29T18:51:49Z")
Hi, I have filebeats running on Kubernetes with the autodiscover option, I have Ambassador running on the K8 cluster among several other application and I am trying to process the logs for the Ambassador containers diff… --- ## [Slow logs search en ES 7.x](https://discuss.elastic.co/t/slow-logs-search-en-es-7-x/273866)
**Author:** [@Cristian1988](https://discuss.elastic.co/u/Cristian1988)\ **Replies:** 2\ **Last updated:** [May 29, 2021, 5:41pm UTC](https://discuss.elastic.co/t/slow-logs-search-en-es-7-x/273866 "2021-05-29T17:41:22Z")
Hola, Tengo un clúster en el cual tengo una media de búsqueda de unos 3seg dependiendo de la búsqueda, para saber en qué fase de la búsqueda y que búsqueda tarda más he activado los slow logs durante un par de horas y h… --- ## [Backup (snapshot) strategy for a two data node cluster](https://discuss.elastic.co/t/backup-snapshot-strategy-for-a-two-data-node-cluster/274404)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 4\ **Last updated:** [May 29, 2021, 5:15pm UTC](https://discuss.elastic.co/t/backup-snapshot-strategy-for-a-two-data-node-cluster/274404 "2021-05-29T17:15:26Z")
Hello, I hope you and your loved ones are safe and healthy. I have a three node cluster with 2 data nodes and 1 voting node running Elastic Stack 7.13 on Ubuntu 20.04.2. All of the node are on a single physical worksta… --- ## [Detection rules which are based on indices where host field is fetched as string are not generating the alerts](https://discuss.elastic.co/t/detection-rules-which-are-based-on-indices-where-host-field-is-fetched-as-string-are-not-generating-the-alerts/274406)
**Author:** [@aditi\_salunke](https://discuss.elastic.co/u/aditi_salunke)\ **Replies:** 0\ **Last updated:** [May 29, 2021, 4:37pm UTC](https://discuss.elastic.co/t/detection-rules-which-are-based-on-indices-where-host-field-is-fetched-as-string-are-not-generating-the-alerts/274406 "2021-05-29T16:37:52Z")
Bulk Indexing of signals failed: object mapping for \[host\] tried to parse field \[host\] as object, but found a concrete value name: "\:\" rule id: "\" signals index: ".siem-signals-default" So… --- ## [GROK errors](https://discuss.elastic.co/t/grok-errors/273973)
**Author:** [@NogNeetMachinaal](https://discuss.elastic.co/u/NogNeetMachinaal)\ **Replies:** 2\ **Last updated:** [May 29, 2021, 4:36pm UTC](https://discuss.elastic.co/t/grok-errors/273973 "2021-05-29T16:36:50Z")
Everyone, Below 2 lines of syslog messages: 2021-05-15T14:24:35.235Z - Omada\[Controller\] \[client:A6-09-A2-5A-31-E3\] was disconnected from network "LAN (default)" on \[osg:90-9A-4A-FD-0D-A5\](connected t\> 2021-05-15T14:24… --- ## [Duplication of data due to logstash configuration](https://discuss.elastic.co/t/duplication-of-data-due-to-logstash-configuration/274382)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 6\ **Last updated:** [May 29, 2021, 4:15pm UTC](https://discuss.elastic.co/t/duplication-of-data-due-to-logstash-configuration/274382 "2021-05-29T16:15:49Z")
Hello, I hope you and your loved ones are safe and healthy. I am suspecting multiple copies of the same data being created due to faulty logstash configuration. Here is the ingestion pipeline: Log files in JSON file … --- ## [NEST API for Snapshot and Restore](https://discuss.elastic.co/t/nest-api-for-snapshot-and-restore/273586)
**Author:** [@Abhishek\_Shinde](https://discuss.elastic.co/u/Abhishek_Shinde)\ **Replies:** 1\ **Last updated:** [May 29, 2021, 1:40pm UTC](https://discuss.elastic.co/t/nest-api-for-snapshot-and-restore/273586 "2021-05-29T13:40:56Z")
Hi Team, We are planning to integrate Elasticsearch in one of our Enterprise product for indexing and search purpose. Our application is on-prem software gets deployed at customer end on the windows machine. We are plan… --- ## [Snapshot](https://discuss.elastic.co/t/snapshot/273692)
**Author:** [@Abhishek\_Shinde](https://discuss.elastic.co/u/Abhishek_Shinde)\ **Replies:** 5\ **Last updated:** [May 29, 2021, 12:46pm UTC](https://discuss.elastic.co/t/snapshot/273692 "2021-05-29T12:46:26Z")
Hi team, is there any sizing guidelines for snapshots and restore? If I wanted take snapshot of upto 10 TB of indexing data. Is there any limitations on the number of CPU and memory for better performance? --- ## [Machine Configuration for elasticsearch as a database](https://discuss.elastic.co/t/machine-configuration-for-elasticsearch-as-a-database/273735)
**Author:** [@Anirudhan](https://discuss.elastic.co/u/Anirudhan)\ **Replies:** 2\ **Last updated:** [May 29, 2021, 11:33am UTC](https://discuss.elastic.co/t/machine-configuration-for-elasticsearch-as-a-database/273735 "2021-05-29T11:33:59Z")
Hi I am trying to move the SQL database into elasticsearch. Successfully flattened the data from SQL into elasticsearch. These is the details of the index which was created from SQL to elastic Doc'sCount : 49201833, S… --- ## [Logstash not starting with the error "error: jvm options parser failed; exiting"](https://discuss.elastic.co/t/logstash-not-starting-with-the-error-error-jvm-options-parser-failed-exiting/274393)
**Author:** [@Swaroop\_S](https://discuss.elastic.co/u/Swaroop_S)\ **Replies:** 1\ **Last updated:** [May 29, 2021, 8:44am UTC](https://discuss.elastic.co/t/logstash-not-starting-with-the-error-error-jvm-options-parser-failed-exiting/274393 "2021-05-29T08:44:51Z")
Hi All, I downloaded the logstash file and created the config file and I am trying to start the logstash with the command "logstash -f simple-config.conf" after navigating to bin folder in logstash. But I am getting err… --- ## [Index rotation](https://discuss.elastic.co/t/index-rotation/274150)
**Author:** [@humartinez](https://discuss.elastic.co/u/humartinez)\ **Replies:** 2\ **Last updated:** [May 29, 2021, 8:41am UTC](https://discuss.elastic.co/t/index-rotation/274150 "2021-05-29T08:41:54Z")
Hello, I would like to know if there is a way to rotate an index for a period of time. I have an app that writes to a fix ES index name and I need to to rotate the index lets say after one day "app-index-0001", the next… --- ## [Update API - Async on server-side](https://discuss.elastic.co/t/update-api-async-on-server-side/274388)
**Author:** [@Leuteris](https://discuss.elastic.co/u/Leuteris)\ **Replies:** 3\ **Last updated:** [May 29, 2021, 8:03am UTC](https://discuss.elastic.co/t/update-api-async-on-server-side/274388 "2021-05-29T08:03:23Z")
Is it possible to execute the following request asynchronously on the server side? POST test/\_update/1 { "script" : "ctx.\_source.new\_field = 'value\_of\_new\_field'" } By "server side", I mean server should write the re… --- ## [Calculs statistiques en pourcentage (turnover)](https://discuss.elastic.co/t/calculs-statistiques-en-pourcentage-turnover/273289)
**Author:** [@crigastel](https://discuss.elastic.co/u/crigastel)\ **Replies:** 4\ **Last updated:** [May 28, 2021, 10:34pm UTC](https://discuss.elastic.co/t/calculs-statistiques-en-pourcentage-turnover/273289 "2021-05-28T22:34:59Z")
Bonjour, Nous utilisons Kibana avec des données salariés (nom, prénom, date d'entrée, date de sortie, statut actif/inactif...). J'ai réussi à réaliser des indicateurs RH (répartition H/F, effectif par site, service, âg… --- ## [Search by all variants of a value](https://discuss.elastic.co/t/search-by-all-variants-of-a-value/274023)
**Author:** [@Carina\_Sirbu](https://discuss.elastic.co/u/Carina_Sirbu)\ **Replies:** 1\ **Last updated:** [May 28, 2021, 9:33pm UTC](https://discuss.elastic.co/t/search-by-all-variants-of-a-value/274023 "2021-05-28T21:33:49Z")
Hello, I have an application where the user can search for beauty products. Let's say the user wants to find all products from L'Oréal company. So when he goes to the search, he might type: LOREAL, L'OREAL, L'oreal, L'o… --- ## [Problem with fuction\_score and field\_value\_factor](https://discuss.elastic.co/t/problem-with-fuction-score-and-field-value-factor/274330)
**Author:** [@Biiru](https://discuss.elastic.co/u/Biiru)\ **Replies:** 1\ **Last updated:** [May 28, 2021, 9:17pm UTC](https://discuss.elastic.co/t/problem-with-fuction-score-and-field-value-factor/274330 "2021-05-28T21:17:49Z")
Hi all, I have a problem with a query GET score-score-score/\_search { "query": { "function\_score": { "query": { "bool": { "must": \[ {"term": { "validity": true }}, … --- ## [Metricbeat is not sending cluster\_stats for elasticsearch module](https://discuss.elastic.co/t/metricbeat-is-not-sending-cluster-stats-for-elasticsearch-module/274378)
**Author:** [@Cousin\_John](https://discuss.elastic.co/u/Cousin_John)\ **Replies:** 0\ **Last updated:** [May 28, 2021, 8:30pm UTC](https://discuss.elastic.co/t/metricbeat-is-not-sending-cluster-stats-for-elasticsearch-module/274378 "2021-05-28T20:30:57Z")
I am having the same issue as this closed post: I am trying to monitor our Elasticsearch cluster 2.x with metricbeat 7.7.1. Metricbeat is sending over the data for node, node\_stats but for some reason it's not sending … --- ## [Histogram hard\_bounds not working with min\_doc\_count=0 Kibana 7.10.2](https://discuss.elastic.co/t/histogram-hard-bounds-not-working-with-min-doc-count-0-kibana-7-10-2/274375)
**Author:** [@ssimmons](https://discuss.elastic.co/u/ssimmons)\ **Replies:** 1\ **Last updated:** [May 28, 2021, 8:18pm UTC](https://discuss.elastic.co/t/histogram-hard-bounds-not-working-with-min-doc-count-0-kibana-7-10-2/274375 "2021-05-28T20:18:37Z")
I'm creating a histogram and running into issues where extended\_bounds is pulling back a lot more buckets than it should. The upper and low bounds of the histogram can vary dramatically in my plugin and the interval size… --- ## [Logstash filter based on reference set or database](https://discuss.elastic.co/t/logstash-filter-based-on-reference-set-or-database/274302)
**Author:** [@redfish462](https://discuss.elastic.co/u/redfish462)\ **Replies:** 3\ **Last updated:** [May 28, 2021, 8:07pm UTC](https://discuss.elastic.co/t/logstash-filter-based-on-reference-set-or-database/274302 "2021-05-28T20:07:16Z")
Hello, I have to redirect some logs based on their username (the usernames are contains in the logs) to different outputs. This list has 80 entry, so it's a lot to write this in the configuration file. I would like to … --- ## [Calculating fields in logstash on upsert](https://discuss.elastic.co/t/calculating-fields-in-logstash-on-upsert/274371)
**Author:** [@tumbledwyer](https://discuss.elastic.co/u/tumbledwyer)\ **Replies:** 1\ **Last updated:** [May 28, 2021, 7:59pm UTC](https://discuss.elastic.co/t/calculating-fields-in-logstash-on-upsert/274371 "2021-05-28T19:59:01Z")
Hi I have a pipeline used to enrich some json data from different sources to build up an index for a report. I would like to do a calculation based on 2 fields from the different sources, but since the sources are diffe… --- ## [API Endpoint for Elastic Stack Monitoring?](https://discuss.elastic.co/t/api-endpoint-for-elastic-stack-monitoring/274373)
**Author:** [@Sumit\_Gupta2](https://discuss.elastic.co/u/Sumit_Gupta2)\ **Replies:** 0\ **Last updated:** [May 28, 2021, 7:30pm UTC](https://discuss.elastic.co/t/api-endpoint-for-elastic-stack-monitoring/274373 "2021-05-28T19:30:28Z")
Which is the API Endpoint for Elastic Stack Monitoring? --- ## [Installing filebeat on dockers question](https://discuss.elastic.co/t/installing-filebeat-on-dockers-question/274370)
**Author:** [@Kaleb](https://discuss.elastic.co/u/Kaleb)\ **Replies:** 0\ **Last updated:** [May 28, 2021, 6:37pm UTC](https://discuss.elastic.co/t/installing-filebeat-on-dockers-question/274370 "2021-05-28T18:37:03Z")
I'm new Elastic Stack. I've been able to install Elasticsearch and Kibana via Docker using the instructions on elastic.co. However, I'm having some difficulty installing filebeats using the directions on elastic.co. Afte… --- ## [Multiline: flush downstream error java.io.IOException since upgrading from 6.8 to 7.12](https://discuss.elastic.co/t/multiline-flush-downstream-error-java-io-ioexception-since-upgrading-from-6-8-to-7-12/274236)
**Author:** [@soulless](https://discuss.elastic.co/u/soulless)\ **Replies:** 3\ **Last updated:** [May 28, 2021, 5:51pm UTC](https://discuss.elastic.co/t/multiline-flush-downstream-error-java-io-ioexception-since-upgrading-from-6-8-to-7-12/274236 "2021-05-28T17:51:49Z")
We have a multiline config that we use for capturing exceptions. codec =\> multiline { pattern =\> "^%{TIMESTAMP\_ISO8601}" negate =\> true what =\> "previous" } It appears to still be working, but since upgradi… [Previous page](https://discuss.elastic.co/latest.md?page=1651) [Next page](https://discuss.elastic.co/latest.md?page=1653)