# Latest **URL:** https://discuss.elastic.co/latest.md?page=1813 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1814 --- ## [How much disk should I have?](https://discuss.elastic.co/t/how-much-disk-should-i-have/265619)
**Author:** [@mahalabobis](https://discuss.elastic.co/u/mahalabobis)\ **Replies:** 0\ **Last updated:** [February 26, 2021, 2:41pm UTC](https://discuss.elastic.co/t/how-much-disk-should-i-have/265619 "2021-02-26T14:41:54Z")
How can I know how much disk space I need for Elasticsearch? Right now I'm having unassigned shards because I'm hitting the disk threshold. How much disk growth should I expect? --- ## [Filebeat daemon set misses last few lines of log on pod crash](https://discuss.elastic.co/t/filebeat-daemon-set-misses-last-few-lines-of-log-on-pod-crash/265621)
**Author:** [@val](https://discuss.elastic.co/u/val)\ **Replies:** 0\ **Last updated:** [February 26, 2021, 3:03pm UTC](https://discuss.elastic.co/t/filebeat-daemon-set-misses-last-few-lines-of-log-on-pod-crash/265621 "2021-02-26T15:03:49Z")
I’ve encountered an interesting situation with Filebeat deployed as a daemon set in Openshift (very similar to https://discuss.elastic.co/t/filebeat-missing-end-of-logs-for-k8s-pods/217281). So, we have one dedicated po… --- ## [Split event into multiples and parse with grok separately](https://discuss.elastic.co/t/split-event-into-multiples-and-parse-with-grok-separately/265322)
**Author:** [@Daniel\_Jankech](https://discuss.elastic.co/u/Daniel_Jankech)\ **Replies:** 2\ **Last updated:** [February 26, 2021, 2:45pm UTC](https://discuss.elastic.co/t/split-event-into-multiples-and-parse-with-grok-separately/265322 "2021-02-26T14:45:27Z")
Hello, I'm back with another question. From my understanding split function is used to split lets say messages into multiple lines of code and then you use grok to parse this into a single list of variables. However what… --- ## [Memory Mapped files using full RAM leaving very less room for other processes](https://discuss.elastic.co/t/memory-mapped-files-using-full-ram-leaving-very-less-room-for-other-processes/265617)
**Author:** [@abhinavtk97](https://discuss.elastic.co/u/abhinavtk97)\ **Replies:** 1\ **Last updated:** [February 26, 2021, 1:59pm UTC](https://discuss.elastic.co/t/memory-mapped-files-using-full-ram-leaving-very-less-room-for-other-processes/265617 "2021-02-26T13:59:52Z")
We were testing out Elasticsearch with almost 1.5 TB index size and there is a different java process running on the same machine which does lots of data processing, which gives batch index jobs to Elasticsearch. The mac… --- ## [Blocked by: \[SERVICE\_UNAVAILABLE/2/no master\];](https://discuss.elastic.co/t/blocked-by-service-unavailable-2-no-master/265612)
**Author:** [@abhishek.tripathi](https://discuss.elastic.co/u/abhishek.tripathi)\ **Replies:** 1\ **Last updated:** [February 26, 2021, 1:31pm UTC](https://discuss.elastic.co/t/blocked-by-service-unavailable-2-no-master/265612 "2021-02-26T13:31:15Z")
blocked by: \[SERVICE\_UNAVAILABLE/2/no master\]; I am getting this error at multiple places in logs... \[2021-02-26T16:20:30,781\]\[WARN \]\[r.suppressed \] \[VPRODGRMQ02\] path: /servername\_messagestatus\_0/\_doc/9151… --- ## [Missing fields in a document](https://discuss.elastic.co/t/missing-fields-in-a-document/265531)
**Author:** [@kvmuralidhar](https://discuss.elastic.co/u/kvmuralidhar)\ **Replies:** 1\ **Last updated:** [February 26, 2021, 1:20pm UTC](https://discuss.elastic.co/t/missing-fields-in-a-document/265531 "2021-02-26T13:20:07Z")
Hi, I am working on a watcher that's looking for a specific event type and extracting certain fields from the source document. The source document does not have all fields that I am trying to query. When I try to exec… --- ## [Display a ratio of data](https://discuss.elastic.co/t/display-a-ratio-of-data/265449)
**Author:** [@jazzdorf](https://discuss.elastic.co/u/jazzdorf)\ **Replies:** 9\ **Last updated:** [February 26, 2021, 1:01pm UTC](https://discuss.elastic.co/t/display-a-ratio-of-data/265449 "2021-02-26T13:01:03Z")
Hi guys, I have some difficulties with Kibana. My data contains IDs and links: { "\_index": "debug\_sample\_data", "\_type": "\_doc", "\_id": "rPeEz3cBYzpkMbM6YKCc", "\_version": 1, … --- ## [Need some help with Logstash and the XML filter plugin](https://discuss.elastic.co/t/need-some-help-with-logstash-and-the-xml-filter-plugin/265227)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 10\ **Last updated:** [February 26, 2021, 8:47am UTC](https://discuss.elastic.co/t/need-some-help-with-logstash-and-the-xml-filter-plugin/265227 "2021-02-26T08:47:37Z")
Hello Im trying to parse a XML that Im getting from a Windows Event Viewer. Ill try to explain as best I can and any questions or doubt can be further asked. I have this in a field that is winlog.event\_data.param2 (va… --- ## [Unable to Drop desired fields using drop\_fields processors in filebeat](https://discuss.elastic.co/t/unable-to-drop-desired-fields-using-drop-fields-processors-in-filebeat/264654)
**Author:** [@mauryaravi](https://discuss.elastic.co/u/mauryaravi)\ **Replies:** 2\ **Last updated:** [February 26, 2021, 12:15pm UTC](https://discuss.elastic.co/t/unable-to-drop-desired-fields-using-drop-fields-processors-in-filebeat/264654 "2021-02-26T12:15:17Z")
I am sending log data to elastic search directly using filebeat 7.10. I want to drop some fields of doc using drop\_fields processors before sending to ES. Filebeat is dropping some fields placed in drop\_fields conf but … --- ## [Custome Index name but getting "0" fields](https://discuss.elastic.co/t/custome-index-name-but-getting-0-fields/265474)
**Author:** [@shaiksubhan](https://discuss.elastic.co/u/shaiksubhan)\ **Replies:** 3\ **Last updated:** [February 26, 2021, 12:06pm UTC](https://discuss.elastic.co/t/custome-index-name-but-getting-0-fields/265474 "2021-02-26T12:06:46Z")
Hi, I am trying to create custom Index pattern Name and its coming but I am unable to see any fields in that pattern. Any one help me on this ? Below is my yml file ###################### Metricbeat Configuration Exa… --- ## [Filebeat multiple index rollover problem](https://discuss.elastic.co/t/filebeat-multiple-index-rollover-problem/264833)
**Author:** [@graimato](https://discuss.elastic.co/u/graimato)\ **Replies:** 5\ **Last updated:** [February 26, 2021, 11:32am UTC](https://discuss.elastic.co/t/filebeat-multiple-index-rollover-problem/264833 "2021-02-26T11:32:25Z")
Dear all I'm sending log data to elastic using filebeat. I have multiple files to read, actually I'm sending all log files (eg. \*.log) and it works correctly, I have index and rollover works. Now I need to have differe… --- ## [Cannot drop fields from checkpoint filebeat module](https://discuss.elastic.co/t/cannot-drop-fields-from-checkpoint-filebeat-module/265604)
**Author:** [@lachezar.uzunov](https://discuss.elastic.co/u/lachezar.uzunov)\ **Replies:** 0\ **Last updated:** [February 26, 2021, 11:31am UTC](https://discuss.elastic.co/t/cannot-drop-fields-from-checkpoint-filebeat-module/265604 "2021-02-26T11:31:29Z")
Hello everyone, I am using filebeat checkpoint module and want to reduce the log size of the logs, cutting fields like destination.geo.city.name. My /etc/filebeat/filebeat.yml contains: - drop\_fields: wh… --- ## [Failed to parse exception - Preview of field's value: ''](https://discuss.elastic.co/t/failed-to-parse-exception-preview-of-fields-value/265599)
**Author:** [@Q\_the\_River](https://discuss.elastic.co/u/Q_the_River)\ **Replies:** 0\ **Last updated:** [February 26, 2021, 11:02am UTC](https://discuss.elastic.co/t/failed-to-parse-exception-preview-of-fields-value/265599 "2021-02-26T11:02:11Z")
We are using fluentd to forward logs towards elasticsearch. A lot of messages are getting rejected by ES without a rejection reason, does anybody have idea on how to debug this? Rejected by Elasticsearch \[error type\]: … --- ## [Elastic stack issues Certificates and Kibana is not ready yet](https://discuss.elastic.co/t/elastic-stack-issues-certificates-and-kibana-is-not-ready-yet/264728)
**Author:** [@baddack](https://discuss.elastic.co/u/baddack)\ **Replies:** 9\ **Last updated:** [February 26, 2021, 10:36am UTC](https://discuss.elastic.co/t/elastic-stack-issues-certificates-and-kibana-is-not-ready-yet/264728 "2021-02-26T10:36:19Z")
Hello everyone, I am writing this topic because I have an issue on my Elastic Stack. It comes from the day when certificates reached its expiration date. The following message was on in my Kibana's interface : "Kibana i… --- ## [Matching fields in two different indexes together](https://discuss.elastic.co/t/matching-fields-in-two-different-indexes-together/265563)
**Author:** [@Sagar\_Mandal](https://discuss.elastic.co/u/Sagar_Mandal)\ **Replies:** 3\ **Last updated:** [February 26, 2021, 9:39am UTC](https://discuss.elastic.co/t/matching-fields-in-two-different-indexes-together/265563 "2021-02-26T09:39:08Z")
Hey Team, Let just say I have two different indexes named index1 and index2, they both have a column/ field in them named C1 and C2, what I basically want to do is I want to match where C1 and C2 are the same and creat… --- ## [How to re-indexed in Elasticsearch 6.8.13 before upgrading to 7.6.2](https://discuss.elastic.co/t/how-to-re-indexed-in-elasticsearch-6-8-13-before-upgrading-to-7-6-2/265525)
**Author:** [@MdRashid](https://discuss.elastic.co/u/MdRashid)\ **Replies:** 4\ **Last updated:** [February 26, 2021, 9:34am UTC](https://discuss.elastic.co/t/how-to-re-indexed-in-elasticsearch-6-8-13-before-upgrading-to-7-6-2/265525 "2021-02-26T09:34:03Z")
Hi All, I'm New in Elasticsearch and I don't know how to re-indexed Elasticsearch in Ubuntu Here is the ERROR :- java.lang.IllegalStateException: The index \[\[test-suites- tscount/kKudK8xxxxxxxxxxxXrvzAA\]\] was created … --- ## [Java high level client 7.10 shard successful 0 when took \> 1000](https://discuss.elastic.co/t/java-high-level-client-7-10-shard-successful-0-when-took-1000/265291)
**Author:** [@ZorroYue](https://discuss.elastic.co/u/ZorroYue)\ **Replies:** 2\ **Last updated:** [February 26, 2021, 9:32am UTC](https://discuss.elastic.co/t/java-high-level-client-7-10-shard-successful-0-when-took-1000/265291 "2021-02-26T09:32:48Z")
Hi I'm using java high level client to execute aggregation。 when the took in response gt 1000,it give a wrong result like below( it always ok when i do it in kibana): { "took": 1002, "timed\_out": false, "terminat… --- ## [High level client parse aggregation in response of GetAsyncSearchRequest failed](https://discuss.elastic.co/t/high-level-client-parse-aggregation-in-response-of-getasyncsearchrequest-failed/265582)
**Author:** [@ZorroYue](https://discuss.elastic.co/u/ZorroYue)\ **Replies:** 0\ **Last updated:** [February 26, 2021, 9:14am UTC](https://discuss.elastic.co/t/high-level-client-parse-aggregation-in-response-of-getasyncsearchrequest-failed/265582 "2021-02-26T09:14:48Z")
Hi i got problem that high level client parse aggregation in response of GetAsyncSearchRequest failed.Get async request in kibana as: GET /\_async\_search/FjJxanhwbHpoUS1lUXFDU2M1ajEyVHcdVnp4Z09RT3VTdjZYZWxDUUx3dDRMUTox… --- ## [Delete .reporting index](https://discuss.elastic.co/t/delete-reporting-index/265417)
**Author:** [@Tiephen](https://discuss.elastic.co/u/Tiephen)\ **Replies:** 2\ **Last updated:** [February 26, 2021, 8:37am UTC](https://discuss.elastic.co/t/delete-reporting-index/265417 "2021-02-26T08:37:48Z")
Hello, I use watcher to generate lots of pdf report. I have automatically many .reporting index each 3 days so too many index in my elastic cluster. I would like try to delete automatically index after some time. Is … --- ## [Failed to parse field \[agent\] of type \[text\]](https://discuss.elastic.co/t/failed-to-parse-field-agent-of-type-text/265361)
**Author:** [@meissen](https://discuss.elastic.co/u/meissen)\ **Replies:** 4\ **Last updated:** [February 26, 2021, 8:55am UTC](https://discuss.elastic.co/t/failed-to-parse-field-agent-of-type-text/265361 "2021-02-26T08:55:56Z")
Hello, ELK stack in version 7.9.2 it has been working fine with filebeat 6.4, but after upgrading filebeat to 7.0 I get the following error in logstash logs : \[2021-02-24T15:24:56,954\]\[WARN \]\[logstash.outputs.elasticse… --- ## [Logstash not receiving events from Kafka](https://discuss.elastic.co/t/logstash-not-receiving-events-from-kafka/263545)
**Author:** [@Boris\_Joseph](https://discuss.elastic.co/u/Boris_Joseph)\ **Replies:** 1\ **Last updated:** [February 26, 2021, 7:16am UTC](https://discuss.elastic.co/t/logstash-not-receiving-events-from-kafka/263545 "2021-02-26T07:16:07Z")
Hi team, I have a ELK Stack with 2 Logstash Nodes in DataCentre1 and a Kafka Cluster in another DataCentre2 accepting log events from servers in DataCentre2 . SitetoSite VPN connects the DC1 to DC2. Telnet from Kafka … --- ## [Troubles running Logstash on RHEL](https://discuss.elastic.co/t/troubles-running-logstash-on-rhel/265472)
**Author:** [@PawelKosiorek](https://discuss.elastic.co/u/PawelKosiorek)\ **Replies:** 4\ **Last updated:** [February 26, 2021, 7:12am UTC](https://discuss.elastic.co/t/troubles-running-logstash-on-rhel/265472 "2021-02-26T07:12:31Z")
It used to work fine, but recently it has been giving me this. Please help. Thank you. --- ## [Problem with parsing 'message' field in Winlogbeat](https://discuss.elastic.co/t/problem-with-parsing-message-field-in-winlogbeat/265572)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 0\ **Last updated:** [February 26, 2021, 7:00am UTC](https://discuss.elastic.co/t/problem-with-parsing-message-field-in-winlogbeat/265572 "2021-02-26T07:00:44Z")
Hello all! We are using Winlogbeat to collect data from Windows hosts. But we can't understand why 'message' field can't be parsed by Winlogbeat. Can anyone explain why this field doesn't parsed and maybe give answer how… --- ## [Custom detection rules failing in bulk](https://discuss.elastic.co/t/custom-detection-rules-failing-in-bulk/265376)
**Author:** [@jhanvi](https://discuss.elastic.co/u/jhanvi)\ **Replies:** 2\ **Last updated:** [February 26, 2021, 6:51am UTC](https://discuss.elastic.co/t/custom-detection-rules-failing-in-bulk/265376 "2021-02-26T06:51:24Z")
Hi team, In the detection tab, I am observing that the rules are failing and throwing an error as below. Can you explain what exactly is causing the same? --- ## [Exclude results using controls](https://discuss.elastic.co/t/exclude-results-using-controls/264787)
**Author:** [@vikramnr](https://discuss.elastic.co/u/vikramnr)\ **Replies:** 2\ **Last updated:** [February 26, 2021, 6:44am UTC](https://discuss.elastic.co/t/exclude-results-using-controls/264787 "2021-02-26T06:44:20Z")
Is there way to exclude results using Controls visualisation, similar to what we do manually with filter? Like the below NOT filter using controls --- ## [Kibana installation issue - 7.11](https://discuss.elastic.co/t/kibana-installation-issue-7-11/265147)
**Author:** [@AbhayN](https://discuss.elastic.co/u/AbhayN)\ **Replies:** 2\ **Last updated:** [February 26, 2021, 5:57am UTC](https://discuss.elastic.co/t/kibana-installation-issue-7-11/265147 "2021-02-26T05:57:19Z")
While running kibana.bat from bin folder I am getting this error "KIBANA log \[fatal\]\[root\] Error: Cannot find module '../../../spaces/server'" any idea/direction will help thanks --- ## [Auditbeat File Integrity (Windows OS) Doesn't Capture WHO Changed Files?](https://discuss.elastic.co/t/auditbeat-file-integrity-windows-os-doesnt-capture-who-changed-files/265518)
**Author:** [@efaile](https://discuss.elastic.co/u/efaile)\ **Replies:** 3\ **Last updated:** [February 26, 2021, 4:30am UTC](https://discuss.elastic.co/t/auditbeat-file-integrity-windows-os-doesnt-capture-who-changed-files/265518 "2021-02-26T04:30:50Z")
We need a File Integrity Monitoring solution for Windows OS's - on the server we use as file servers . To further explain "file servers" - not to monitor remotely across shares which is not supported - but directly on th… --- ## [Anomaly notifications are not received](https://discuss.elastic.co/t/anomaly-notifications-are-not-received/265042)
**Author:** [@insanity13](https://discuss.elastic.co/u/insanity13)\ **Replies:** 5\ **Last updated:** [February 26, 2021, 4:27am UTC](https://discuss.elastic.co/t/anomaly-notifications-are-not-received/265042 "2021-02-26T04:27:24Z")
Elastic Cloud 7.11 Created "Anomaly Alert" for Web Application (to Send Slack notification). No notification has been sent --- ## [Grook Format For APM Nginx Log](https://discuss.elastic.co/t/grook-format-for-apm-nginx-log/265439)
**Author:** [@reza\_naipospos](https://discuss.elastic.co/u/reza_naipospos)\ **Replies:** 2\ **Last updated:** [February 26, 2021, 4:25am UTC](https://discuss.elastic.co/t/grook-format-for-apm-nginx-log/265439 "2021-02-26T04:25:40Z")
i have format log like this, how logstash can make new field on elasticsearch for every this log, currently all log is in message field. timestamp="25/Feb/2021:13:34:22 +0700" client=192.168.0.21 request="GET /api/Supir… --- ## [APM-agent-nodejs prevents app start with error - 'metadata requests did not finish, possible deadlock'](https://discuss.elastic.co/t/apm-agent-nodejs-prevents-app-start-with-error-metadata-requests-did-not-finish-possible-deadlock/265426)
**Author:** [@Sim\_Singh](https://discuss.elastic.co/u/Sim_Singh)\ **Replies:** 2\ **Last updated:** [February 26, 2021, 2:28am UTC](https://discuss.elastic.co/t/apm-agent-nodejs-prevents-app-start-with-error-metadata-requests-did-not-finish-possible-deadlock/265426 "2021-02-26T02:28:46Z")
We have a simple nodejs app with APM setup - events coming thru successfully deployed on a k8s cluster. Suddenly we are not able to bring the app up because we have started to receive this error - 'metadata requests did … [Previous page](https://discuss.elastic.co/latest.md?page=1812) [Next page](https://discuss.elastic.co/latest.md?page=1814)