# Latest **URL:** https://discuss.elastic.co/latest.md?page=1744 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1745 --- ## [Swiftype Schema Meta Tags Not Working on Local Docker Setup](https://discuss.elastic.co/t/swiftype-schema-meta-tags-not-working-on-local-docker-setup/269369)
**Author:** [@tchocky](https://discuss.elastic.co/u/tchocky)\ **Replies:** 3\ **Last updated:** [April 7, 2021, 5:22pm UTC](https://discuss.elastic.co/t/swiftype-schema-meta-tags-not-working-on-local-docker-setup/269369 "2021-04-07T17:22:56Z")
Hi all - I am testing a local enterprise search setup using the steps outlined here. I am using Enterprise Search version 7.12.0 and ingesting data by crawling my site. Everything works great except for when I add sche… --- ## [Filebeat azure module error code 409 BlobAlreadyExists](https://discuss.elastic.co/t/filebeat-azure-module-error-code-409-blobalreadyexists/269251)
**Author:** [@sguerrero](https://discuss.elastic.co/u/sguerrero)\ **Replies:** 1\ **Last updated:** [April 7, 2021, 5:03pm UTC](https://discuss.elastic.co/t/filebeat-azure-module-error-code-409-blobalreadyexists/269251 "2021-04-07T17:03:38Z")
Hi, I'm getting this error from filebeat: Apr 05 15:14:43 SOMETHING filebeat\[410843\]: / \_\_\_\_/ \_\_\_\_\_ \_\_\_\_ / /\_/ / / /\_ \_\_/ /\_ \_\_\_\_\_ Apr 05 15:14:43 SOMETHING filebeat\[410843\]: / \_\_/ | | / / \_ \\/ \_\_ \\/ \_\_/ /\_/… --- ## [Custom match pattern based on log message type](https://discuss.elastic.co/t/custom-match-pattern-based-on-log-message-type/269423)
**Author:** [@sergle](https://discuss.elastic.co/u/sergle)\ **Replies:** 1\ **Last updated:** [April 7, 2021, 4:53pm UTC](https://discuss.elastic.co/t/custom-match-pattern-based-on-log-message-type/269423 "2021-04-07T16:53:46Z")
Hey there, Would very much appreciate some input on something I am trying to achieve. The setup: NLog -\> (UDP) -\> Logstash (ELK) The NLog is configured to send different message structures to Logstash, all in the for… --- ## [Rollover\_alias errors on logstash daily indices from client application (fluentd)](https://discuss.elastic.co/t/rollover-alias-errors-on-logstash-daily-indices-from-client-application-fluentd/267519)
**Author:** [@cotjoey](https://discuss.elastic.co/u/cotjoey)\ **Replies:** 3\ **Last updated:** [April 7, 2021, 4:51pm UTC](https://discuss.elastic.co/t/rollover-alias-errors-on-logstash-daily-indices-from-client-application-fluentd/267519 "2021-04-07T16:51:29Z")
This is the error I am getting on the indices that fluentd is sending directly to Elasticsearch: illegal\_argument\_exception: index.lifecycle.rollover\_alias \[logstash\] does not point to index \[logstash-2021.02.09\] The i… --- ## [How can i create different indices for different module](https://discuss.elastic.co/t/how-can-i-create-different-indices-for-different-module/269095)
**Author:** [@Shriram\_Wasule](https://discuss.elastic.co/u/Shriram_Wasule)\ **Replies:** 11\ **Last updated:** [April 7, 2021, 4:45pm UTC](https://discuss.elastic.co/t/how-can-i-create-different-indices-for-different-module/269095 "2021-04-07T16:45:03Z")
Hello, i have two modules activated Apache and tomcat,, i want to store logs of this two in two different indices for better result but i am not able to get how to do that. please help me to set this configuration in m… --- ## [Safely remove tcp input plugin's "host" and "port" fields](https://discuss.elastic.co/t/safely-remove-tcp-input-plugins-host-and-port-fields/269492)
**Author:** [@Supermathie](https://discuss.elastic.co/u/Supermathie)\ **Replies:** 3\ **Last updated:** [April 7, 2021, 4:44pm UTC](https://discuss.elastic.co/t/safely-remove-tcp-input-plugins-host-and-port-fields/269492 "2021-04-07T16:44:56Z")
The tcp input plugin adds host and port fields to received events. Ideally we don't want to add these but since this isn't documented, there doesn't seem to be a way to remove them. What is the best filter to safely re… --- ## [Filebeat won't get geo\_points field type](https://discuss.elastic.co/t/filebeat-wont-get-geo-points-field-type/269501)
**Author:** [@Chris6](https://discuss.elastic.co/u/Chris6)\ **Replies:** 0\ **Last updated:** [April 7, 2021, 4:40pm UTC](https://discuss.elastic.co/t/filebeat-wont-get-geo-points-field-type/269501 "2021-04-07T16:40:39Z")
I have a json line of input that foes through filebeat. The line is in this format: {"first": "text", "second": "text", "@timestamp": "2021-02-25T08:54:04Z", "location": \[-71.34, 41.12\] } I am trying to get the location… --- ## [500 Internal server error on query\_suggestion](https://discuss.elastic.co/t/500-internal-server-error-on-query-suggestion/269489)
**Author:** [@Bott\_Radio\_Network](https://discuss.elastic.co/u/Bott_Radio_Network)\ **Replies:** 2\ **Last updated:** [April 7, 2021, 4:34pm UTC](https://discuss.elastic.co/t/500-internal-server-error-on-query-suggestion/269489 "2021-04-07T16:34:05Z")
Hi, some of my requests to /query\_suggestion are returning a 500 error with the following message. {"errors":\["Internal server error. Please check your application server logs for more details and contact Elastic suppor… --- ## [Troubles with German Umlaute ä ö ü ß](https://discuss.elastic.co/t/troubles-with-german-umlaute-a-o-u-ss/269428)
**Author:** [@feva](https://discuss.elastic.co/u/feva)\ **Replies:** 1\ **Last updated:** [April 7, 2021, 4:26pm UTC](https://discuss.elastic.co/t/troubles-with-german-umlaute-a-o-u-ss/269428 "2021-04-07T16:26:40Z")
I have problems with German Umlaute ä ü ö ß. I send a json logmessage from IBMi (AS400) to logstash encoded in ISO8859-1. It is not possible to send them in UTF-8. So I tried to set input { http { host =\> "0.0.0.… --- ## [Detection-rules](https://discuss.elastic.co/t/detection-rules/269219)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 8\ **Last updated:** [April 7, 2021, 4:26pm UTC](https://discuss.elastic.co/t/detection-rules/269219 "2021-04-07T16:26:26Z")
Hi, i hope this message finds you well , so how to add the project elastic/detection-rules to my elk stack regards and thanks --- ## [Filebeat autodiscovery in Kubernetes/EKS and multiple outputs](https://discuss.elastic.co/t/filebeat-autodiscovery-in-kubernetes-eks-and-multiple-outputs/268272)
**Author:** [@bplies](https://discuss.elastic.co/u/bplies)\ **Replies:** 1\ **Last updated:** [April 7, 2021, 4:02pm UTC](https://discuss.elastic.co/t/filebeat-autodiscovery-in-kubernetes-eks-and-multiple-outputs/268272 "2021-04-07T16:02:26Z")
Scenario A shared K8s cluster with several different apps all needing their app-specific logs collected by Filebeat. Each different app's logs are substantially different (some plaintext, some json with differing field… --- ## [Download CSV from dashboard panel](https://discuss.elastic.co/t/download-csv-from-dashboard-panel/268638)
**Author:** [@AlessandroKP](https://discuss.elastic.co/u/AlessandroKP)\ **Replies:** 2\ **Last updated:** [April 7, 2021, 3:59pm UTC](https://discuss.elastic.co/t/download-csv-from-dashboard-panel/268638 "2021-04-07T15:59:49Z")
Hi, I'm having trouble exporting saved searches from a Kibana dashboard in CSV format through the Download CSV tool. The download works as usual when I set the time interval (through the time picker of the dashboard) t… --- ## [Script for basic elastic healthchecks](https://discuss.elastic.co/t/script-for-basic-elastic-healthchecks/269440)
**Author:** [@ima](https://discuss.elastic.co/u/ima)\ **Replies:** 3\ **Last updated:** [April 7, 2021, 3:44pm UTC](https://discuss.elastic.co/t/script-for-basic-elastic-healthchecks/269440 "2021-04-07T15:44:57Z")
hello, i have a mission of creating a script for automating elastic healthchecks, can anyone who has already worked on the same topic help me please. --- ## [Change color of Line Graph when it crosses a threshold \[7.12\]](https://discuss.elastic.co/t/change-color-of-line-graph-when-it-crosses-a-threshold-7-12/269468)
**Author:** [@B2A3R9C9A](https://discuss.elastic.co/u/B2A3R9C9A)\ **Replies:** 1\ **Last updated:** [April 7, 2021, 3:36pm UTC](https://discuss.elastic.co/t/change-color-of-line-graph-when-it-crosses-a-threshold-7-12/269468 "2021-04-07T15:36:49Z")
Hi, I have a visualization showcasing CPU Utilization over a given time series. I have set a threshold line of 80 to indicate when utilization is higher than normal. Is it possible on Kibana to change color of the li… --- ## [Connecting Kibana to Big Query](https://discuss.elastic.co/t/connecting-kibana-to-big-query/269447)
**Author:** [@nlogn](https://discuss.elastic.co/u/nlogn)\ **Replies:** 1\ **Last updated:** [April 7, 2021, 3:32pm UTC](https://discuss.elastic.co/t/connecting-kibana-to-big-query/269447 "2021-04-07T15:32:57Z")
We currently use Google BigQuery to store our production logs. I was wondering if it's possible to connect Kibana directly to Google BigQuery to browse and visualize logs? --- ## [Summ of two buckets](https://discuss.elastic.co/t/summ-of-two-buckets/269366)
**Author:** [@rmartinez.rv](https://discuss.elastic.co/u/rmartinez.rv)\ **Replies:** 2\ **Last updated:** [April 7, 2021, 3:18pm UTC](https://discuss.elastic.co/t/summ-of-two-buckets/269366 "2021-04-07T15:18:51Z")
Hi. I'm using Kibana to show a particular metric for data collected from a local SIP device. My data is indexed like this: { "\_index": "calls", "\_type": "\_doc", "\_id": "0ysOqHgBtkTNQGR8TH85", "\_version": 1, … --- ## [Elasticsearch processor environment variable](https://discuss.elastic.co/t/elasticsearch-processor-environment-variable/269089)
**Author:** [@nyquillus](https://discuss.elastic.co/u/nyquillus)\ **Replies:** 1\ **Last updated:** [April 7, 2021, 3:17pm UTC](https://discuss.elastic.co/t/elasticsearch-processor-environment-variable/269089 "2021-04-07T15:17:34Z")
Hi, I recently posted a question about threadpools for my stack on kubernetes. (Question about threadpools) I'm planning to manually increase the node processor count. On docker-compose i can just add "processors=x" to… --- ## [Try to reduce number of mapped field before migrating from elasticsearch 2.4](https://discuss.elastic.co/t/try-to-reduce-number-of-mapped-field-before-migrating-from-elasticsearch-2-4/269496)
**Author:** [@kintetsu](https://discuss.elastic.co/u/kintetsu)\ **Replies:** 0\ **Last updated:** [April 7, 2021, 3:12pm UTC](https://discuss.elastic.co/t/try-to-reduce-number-of-mapped-field-before-migrating-from-elasticsearch-2-4/269496 "2021-04-07T15:12:05Z")
Hi, we are still running elasticsearch 2.4 and planning to migrate to the 7.x in the near future. To prepare for the upgrade we already used the migration plugin and found out that our current mapping is a problem. We h… --- ## [Elastic search aggregation not fetching complete Java trace](https://discuss.elastic.co/t/elastic-search-aggregation-not-fetching-complete-java-trace/269365)
**Author:** [@suresh123](https://discuss.elastic.co/u/suresh123)\ **Replies:** 4\ **Last updated:** [April 7, 2021, 3:05pm UTC](https://discuss.elastic.co/t/elastic-search-aggregation-not-fetching-complete-java-trace/269365 "2021-04-07T15:05:47Z")
Hello Experts, I have created Data Table visualization and API for aggregations to get the application logs. It is fetching only 2 lines of log messages in the Data Table, if the log contains more than 3 lines example J… --- ## [How to recover cluster when 2 master nodes have been lost](https://discuss.elastic.co/t/how-to-recover-cluster-when-2-master-nodes-have-been-lost/269472)
**Author:** [@russinholi](https://discuss.elastic.co/u/russinholi)\ **Replies:** 3\ **Last updated:** [April 7, 2021, 3:05pm UTC](https://discuss.elastic.co/t/how-to-recover-cluster-when-2-master-nodes-have-been-lost/269472 "2021-04-07T15:05:07Z")
Hi everyone, I have the following situation, my cluster is formed by 3 master nodes and 3 data nodes, unfortunately due to a hardware problem we lost 2 master nodes at same time and the left one was not able to assume a… --- ## [Fail to upgrade Kibana from 7.11 to 7.12](https://discuss.elastic.co/t/fail-to-upgrade-kibana-from-7-11-to-7-12/269370)
**Author:** [@paulbrown4](https://discuss.elastic.co/u/paulbrown4)\ **Replies:** 9\ **Last updated:** [April 7, 2021, 3:01pm UTC](https://discuss.elastic.co/t/fail-to-upgrade-kibana-from-7-11-to-7-12/269370 "2021-04-07T15:01:12Z")
Kibana times out waiting for index migration. {"type":"log","@timestamp":"2021-04-06T13:09:46-05:00","tags":\["info","savedobjects-service"\],"pid":9608,"message":"\[.kibana\] UPDATE\_TARGET\_MAPPINGS -\> UPDATE\_TARGET\_MAPPING… --- ## [Elastic Lab 1.4](https://discuss.elastic.co/t/elastic-lab-1-4/269131)
**Author:** [@Troy\_Kelley](https://discuss.elastic.co/u/Troy_Kelley)\ **Replies:** 3\ **Last updated:** [April 7, 2021, 2:59pm UTC](https://discuss.elastic.co/t/elastic-lab-1-4/269131 "2021-04-07T14:59:20Z")
Hello, I am working through the elastic lab 1.4. I am not using virtual lab, I am running mine locally. For some reason I did not have the blogs\_sql.conf when I installed Elastic. So, I found an example on the web, cr… --- ## [Question about wildcard query](https://discuss.elastic.co/t/question-about-wildcard-query/269129)
**Author:** [@anyla](https://discuss.elastic.co/u/anyla)\ **Replies:** 8\ **Last updated:** [April 7, 2021, 2:56pm UTC](https://discuss.elastic.co/t/question-about-wildcard-query/269129 "2021-04-07T14:56:00Z")
Hi all, It seems that there is something about wildcard queries that it is not clear to me As far as I understand, Wildcard queries are term queries so. the search term is not analysed itself and it is "compared" aga… --- ## [Save logstash and metricbeat indices on diferent place](https://discuss.elastic.co/t/save-logstash-and-metricbeat-indices-on-diferent-place/269425)
**Author:** [@jobanuls](https://discuss.elastic.co/u/jobanuls)\ **Replies:** 4\ **Last updated:** [April 7, 2021, 2:37pm UTC](https://discuss.elastic.co/t/save-logstash-and-metricbeat-indices-on-diferent-place/269425 "2021-04-07T14:37:44Z")
Hi, I want have two path on my elasticsearch node for save metricbeat indices in the second path. Anyone knows how save metricbeat indices on second path directly? ElasticVersión : 7.9.2-1 --- ## [Logstash HTTP output plugin not reading metadata fields correctly for user/password fields, what am I doing wrong](https://discuss.elastic.co/t/logstash-http-output-plugin-not-reading-metadata-fields-correctly-for-user-password-fields-what-am-i-doing-wrong/269482)
**Author:** [@R.L](https://discuss.elastic.co/u/R.L)\ **Replies:** 1\ **Last updated:** [April 7, 2021, 2:32pm UTC](https://discuss.elastic.co/t/logstash-http-output-plugin-not-reading-metadata-fields-correctly-for-user-password-fields-what-am-i-doing-wrong/269482 "2021-04-07T14:32:37Z")
This is my config: filter { prune { blacklist\_names =\> \[ "timestamp", "path", "size", "@version", "host" \] } uuid { target =\> "\[@metadata\]\[snapshot\]\[id\]" overwrit… --- ## [Filter out terms aggregation buckets in elastic search after applying aggregation](https://discuss.elastic.co/t/filter-out-terms-aggregation-buckets-in-elastic-search-after-applying-aggregation/269486)
**Author:** [@ruzeenpalsetia](https://discuss.elastic.co/u/ruzeenpalsetia)\ **Replies:** 0\ **Last updated:** [April 7, 2021, 2:32pm UTC](https://discuss.elastic.co/t/filter-out-terms-aggregation-buckets-in-elastic-search-after-applying-aggregation/269486 "2021-04-07T14:32:09Z")
Below is snapshot of the dataset: recordNo employeeId employeeStatus employeeAddr 1 employeeA Permanent 2 employeeA ABC … --- ## [Filebeat configuration module path issue](https://discuss.elastic.co/t/filebeat-configuration-module-path-issue/268871)
**Author:** [@tkkchan](https://discuss.elastic.co/u/tkkchan)\ **Replies:** 4\ **Last updated:** [April 7, 2021, 2:16pm UTC](https://discuss.elastic.co/t/filebeat-configuration-module-path-issue/268871 "2021-04-07T14:16:11Z")
Dear All, I am trying to follow this tutorial here to build a dashboard on some public data sets. However, whenever I tried to run ./filebeat, the following error appeared: 2021-03-31T14:19:44.685+0800 ERROR \[mod… --- ## [Logstash-oss yum packages missing?](https://discuss.elastic.co/t/logstash-oss-yum-packages-missing/269258)
**Author:** [@mentzerk](https://discuss.elastic.co/u/mentzerk)\ **Replies:** 2\ **Last updated:** [April 7, 2021, 2:12pm UTC](https://discuss.elastic.co/t/logstash-oss-yum-packages-missing/269258 "2021-04-07T14:12:45Z")
Hello, I've been installing the logstash-oss package for some time now from the elastic.co yum repo, but today, it seems that the "-oss" packages are no longer included in the repo. Is this maybe a known change that I m… --- ## [Filebeat Crowdstrike Module doesn't handle unix timestamps of 0 correctly](https://discuss.elastic.co/t/filebeat-crowdstrike-module-doesnt-handle-unix-timestamps-of-0-correctly/269045)
**Author:** [@anon68795679](https://discuss.elastic.co/u/anon68795679)\ **Replies:** 10\ **Last updated:** [April 7, 2021, 2:05pm UTC](https://discuss.elastic.co/t/filebeat-crowdstrike-module-doesnt-handle-unix-timestamps-of-0-correctly/269045 "2021-04-07T14:05:33Z")
Hi, Crowdstrike store events with a ProcessEndTime of "0". For example shortened json: { "event": { "ProcessStartTime": 1617278228, "ProcessEndTime": 0, } } Both fields are parsed by the same… --- ## [Calculating time spent in state with Metricbeat and Kibana](https://discuss.elastic.co/t/calculating-time-spent-in-state-with-metricbeat-and-kibana/269457)
**Author:** [@m\_x](https://discuss.elastic.co/u/m_x)\ **Replies:** 1\ **Last updated:** [April 7, 2021, 2:00pm UTC](https://discuss.elastic.co/t/calculating-time-spent-in-state-with-metricbeat-and-kibana/269457 "2021-04-07T14:00:26Z")
Hi, I would like to calculate the time spent in a certain state with Metricbeat and Kibana . For example : how long have the system been up during specified period ? how long have a user spent logged in ?. I'm discoveri… [Previous page](https://discuss.elastic.co/latest.md?page=1743) [Next page](https://discuss.elastic.co/latest.md?page=1745)