# Latest **URL:** https://discuss.elastic.co/latest.md?page=1902 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1903 --- ## [How to find which node, with an old version of metricbeat, is the data coming from?](https://discuss.elastic.co/t/how-to-find-which-node-with-an-old-version-of-metricbeat-is-the-data-coming-from/260389)
**Author:** [@vee](https://discuss.elastic.co/u/vee)\ **Replies:** 8\ **Last updated:** [January 11, 2021, 1:51am UTC](https://discuss.elastic.co/t/how-to-find-which-node-with-an-old-version-of-metricbeat-is-the-data-coming-from/260389 "2021-01-11T01:51:53Z")
We've upgraded to elastic v7.5 a few months ago, and upgraded most of the known servers metricbeat to the same version. However, looks like there might be a few servers which still have v6.6 metricbeat running and so we … --- ## [Set \_type in logstash](https://discuss.elastic.co/t/set-type-in-logstash/260643)
**Author:** [@navin1093](https://discuss.elastic.co/u/navin1093)\ **Replies:** 2\ **Last updated:** [January 11, 2021, 1:21am UTC](https://discuss.elastic.co/t/set-type-in-logstash/260643 "2021-01-11T01:21:57Z")
Hi experts. As per my research index (Elastic Search) -\> database (RDMS) type (Elastic Search) -\> table (RDMS) Can i know how i can set the type? input { beats { port =\> 5044 ... type =\> "%{\[fields\]\[na… --- ## [Problem with logs ilm policy elk7.9.1](https://discuss.elastic.co/t/problem-with-logs-ilm-policy-elk7-9-1/260455)
**Author:** [@Rollup\_eval](https://discuss.elastic.co/u/Rollup_eval)\ **Replies:** 2\ **Last updated:** [January 11, 2021, 12:24am UTC](https://discuss.elastic.co/t/problem-with-logs-ilm-policy-elk7-9-1/260455 "2021-01-11T00:24:16Z")
Hi, I have upgrade my stack from elk6.7.1 to elk7.9.1. In my stack index name are : logs-kelogs-pltf-YYYY.MM.dd.hh These indices are not managed by rollover and ilm policies. Logtash creates each hour a new index log… --- ## [Object field vs Individual field](https://discuss.elastic.co/t/object-field-vs-individual-field/260527)
**Author:** [@naghaveer\_r](https://discuss.elastic.co/u/naghaveer_r)\ **Replies:** 1\ **Last updated:** [January 11, 2021, 12:22am UTC](https://discuss.elastic.co/t/object-field-vs-individual-field/260527 "2021-01-11T00:22:19Z")
I have two fields "support.agent" and "support.resolution". If I can map these field as an Object type, I'll be able to fetch them together and also provides more readability "support": { "properties": { … --- ## [Custom data format not working in elasticsearch](https://discuss.elastic.co/t/custom-data-format-not-working-in-elasticsearch/260530)
**Author:** [@gavin-orange](https://discuss.elastic.co/u/gavin-orange)\ **Replies:** 1\ **Last updated:** [January 11, 2021, 12:20am UTC](https://discuss.elastic.co/t/custom-data-format-not-working-in-elasticsearch/260530 "2021-01-11T00:20:57Z")
I am using the filebeat to transfer nginx access log to elasticsearch with json format . access.log { "@timestamp": "05/Jan/2021:13:38:28 +0800", "pid": "52336", "connection": "217062444", "connection\_requests": "18", … --- ## [Running journalbeat as non-privileged user](https://discuss.elastic.co/t/running-journalbeat-as-non-privileged-user/260552)
**Author:** [@jmcclelland](https://discuss.elastic.co/u/jmcclelland)\ **Replies:** 0\ **Last updated:** [January 8, 2021, 2:04pm UTC](https://discuss.elastic.co/t/running-journalbeat-as-non-privileged-user/260552 "2021-01-08T14:04:56Z")
Hi all - I am sharing this for anyone else interested in running journalbeat as a non-root user. I'm grateful for the attention to security of the elasticsearch team but I think the solar winds compromise is making us al… --- ## [ES 7.9.1 - No Lens option](https://discuss.elastic.co/t/es-7-9-1-no-lens-option/260538)
**Author:** [@iam\_rob](https://discuss.elastic.co/u/iam_rob)\ **Replies:** 3\ **Last updated:** [January 11, 2021, 12:18am UTC](https://discuss.elastic.co/t/es-7-9-1-no-lens-option/260538 "2021-01-11T00:18:58Z")
Good morning, We're currently investigating Kibana as a solution. Locally I am running 7.9.2 and when creating a new Visualizations I can select Lens. On our AWS version (7.9.1) we don't appear to have this option. How… --- ## [Elastic 5 \> 7: Decrease Storage Usage?](https://discuss.elastic.co/t/elastic-5-7-decrease-storage-usage/260594)
**Author:** [@myspacebarisbroken](https://discuss.elastic.co/u/myspacebarisbroken)\ **Replies:** 1\ **Last updated:** [January 11, 2021, 12:15am UTC](https://discuss.elastic.co/t/elastic-5-7-decrease-storage-usage/260594 "2021-01-11T00:15:54Z")
Hi! I'm upgrading my ES cluster from V 5 to V7, I've noticed that space usage has significantly been reduced, is that normal? my V5 cluster: 10B Documents, ~2.2 TB V7 Cluster: 10B Documents, ~1.5 TB (Same exact docum… --- ## [java.lang.OutOfMemoryError: Java heap space in Logstash](https://discuss.elastic.co/t/java-lang-outofmemoryerror-java-heap-space-in-logstash/260596)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 1\ **Last updated:** [January 11, 2021, 12:13am UTC](https://discuss.elastic.co/t/java-lang-outofmemoryerror-java-heap-space-in-logstash/260596 "2021-01-11T00:13:43Z")
I have too many configuration files. I run these files together via pipelines.yml. I use these types of settings likewise below; - pipeline.id: pipeline1 path.config: "path\_to\_pipeline1" - pipeline.id: pipeline2 pat… --- ## [How to configure rolling OR delete after X time of data dir , to prevent "out of space" error](https://discuss.elastic.co/t/how-to-configure-rolling-or-delete-after-x-time-of-data-dir-to-prevent-out-of-space-error/260639)
**Author:** [@umen](https://discuss.elastic.co/u/umen)\ **Replies:** 1\ **Last updated:** [January 11, 2021, 12:10am UTC](https://discuss.elastic.co/t/how-to-configure-rolling-or-delete-after-x-time-of-data-dir-to-prevent-out-of-space-error/260639 "2021-01-11T00:10:10Z")
i configured the cluster to claim 5g for the data dir volumeClaimTemplates: - metadata: name: elasticsearch-data spec: accessModes: - ReadWriteOnce resources: requ… --- ## [ES Cloud instance Monotoring and Alerting](https://discuss.elastic.co/t/es-cloud-instance-monotoring-and-alerting/260423)
**Author:** [@webservices](https://discuss.elastic.co/u/webservices)\ **Replies:** 3\ **Last updated:** [January 11, 2021, 12:07am UTC](https://discuss.elastic.co/t/es-cloud-instance-monotoring-and-alerting/260423 "2021-01-11T00:07:02Z")
Hi All, We have a subscription for Elastic Cloud instance and my goal is to monitor the instance for CPU and Memory. I have enabled logs and metrics in my deployment but when I goto metrics then I do not see any data. A… --- ## [Role Granted Documents Query example](https://discuss.elastic.co/t/role-granted-documents-query-example/260652)
**Author:** [@rdesanno](https://discuss.elastic.co/u/rdesanno)\ **Replies:** 2\ **Last updated:** [January 11, 2021, 12:06am UTC](https://discuss.elastic.co/t/role-granted-documents-query-example/260652 "2021-01-11T00:06:14Z")
Hey all! What I am trying to accomplish is to grant access to my Kibana indexes for a certain user BUT limit them to only data being ingested where agent.hostame matches a certain host. I thought I could easily accompl… --- ## [Filebeat fields value unable to use it in logstash configuration file](https://discuss.elastic.co/t/filebeat-fields-value-unable-to-use-it-in-logstash-configuration-file/260614)
**Author:** [@navin1093](https://discuss.elastic.co/u/navin1093)\ **Replies:** 8\ **Last updated:** [January 10, 2021, 11:20pm UTC](https://discuss.elastic.co/t/filebeat-fields-value-unable-to-use-it-in-logstash-configuration-file/260614 "2021-01-10T23:20:24Z")
I have set custom name in filebeat input section. However, in logstash configuration file it was unable to be use Filebeat config file - type: log enabled: true paths: ... fields: - name\_of\_index: group-1… --- ## [Capturing clear text beats traffic with wireshark](https://discuss.elastic.co/t/capturing-clear-text-beats-traffic-with-wireshark/260590)
**Author:** [@qbui](https://discuss.elastic.co/u/qbui)\ **Replies:** 1\ **Last updated:** [January 10, 2021, 10:00pm UTC](https://discuss.elastic.co/t/capturing-clear-text-beats-traffic-with-wireshark/260590 "2021-01-10T22:00:23Z")
Hello, Has anyone tried to capture and analyze the "clear text" beats traffic (FileBeat, Winlogbeats, etc.) as it is being sent to Logstash or Elasticsearch? In its default configuration, the traffic is being sent unenc… --- ## [Scripted\_upsert not working when logtash looses connection to ES and reconnects](https://discuss.elastic.co/t/scripted-upsert-not-working-when-logtash-looses-connection-to-es-and-reconnects/260651)
**Author:** [@Pachidermus](https://discuss.elastic.co/u/Pachidermus)\ **Replies:** 1\ **Last updated:** [January 10, 2021, 6:40pm UTC](https://discuss.elastic.co/t/scripted-upsert-not-working-when-logtash-looses-connection-to-es-and-reconnects/260651 "2021-01-10T18:40:18Z")
I am experiencing the exact same problem as here: The setup is very basic. We are using the ES output plugin with a basic logic: output { if \[@metadata\]\[scripted\_upsert\] == "true" { elasticsearch { ... … --- ## [Multi-Tenancy and Indexes / Aliases / Routing](https://discuss.elastic.co/t/multi-tenancy-and-indexes-aliases-routing/260655)
**Author:** [@nickdb93](https://discuss.elastic.co/u/nickdb93)\ **Replies:** 0\ **Last updated:** [January 10, 2021, 6:16pm UTC](https://discuss.elastic.co/t/multi-tenancy-and-indexes-aliases-routing/260655 "2021-01-10T18:16:31Z")
I know that how one deals with multi-tenancy is really based on use-case, but I just cannot seem to figure out the best approach to take, even after reading some examples. My use case is as such. Organizations are te… --- ## [How could I use in ingest pipeline the Logstash translate filter?](https://discuss.elastic.co/t/how-could-i-use-in-ingest-pipeline-the-logstash-translate-filter/259697)
**Author:** [@marcosvrrs](https://discuss.elastic.co/u/marcosvrrs)\ **Replies:** 4\ **Last updated:** [January 10, 2021, 2:36pm UTC](https://discuss.elastic.co/t/how-could-i-use-in-ingest-pipeline-the-logstash-translate-filter/259697 "2021-01-10T14:36:32Z")
I have a field with some error codes mapped as keyword values that I make some plots. It's not friendly to some people to look at these codes, so I want to change these error codes to a description that I will map as key… --- ## [Kibana TSVB table visualization - group by multiple fields](https://discuss.elastic.co/t/kibana-tsvb-table-visualization-group-by-multiple-fields/260631)
**Author:** [@igorid70](https://discuss.elastic.co/u/igorid70)\ **Replies:** 1\ **Last updated:** [January 10, 2021, 1:21pm UTC](https://discuss.elastic.co/t/kibana-tsvb-table-visualization-group-by-multiple-fields/260631 "2021-01-10T13:21:42Z")
Hi I am using Elastic stack 7.9.1 and trying to build a visualization in Kibana with time series visual builder. In our environment we monitor multiple hosts and one of the visualizations on a dashboard should present … --- ## [Weird memory growth (ES 7.9)](https://discuss.elastic.co/t/weird-memory-growth-es-7-9/260479)
**Author:** [@zanettea](https://discuss.elastic.co/u/zanettea)\ **Replies:** 2\ **Last updated:** [January 10, 2021, 12:12pm UTC](https://discuss.elastic.co/t/weird-memory-growth-es-7-9/260479 "2021-01-10T12:12:53Z")
Hello, we are experiencing anomalous memory usage in a memory constrained cluster of 3 nodes running ES 7.9. We set 2GB heap size with 4 GB overall available RAM. After some days of normal operation where there are mainl… --- ## [Mapping data, tokenizer](https://discuss.elastic.co/t/mapping-data-tokenizer/260629)
**Author:** [@Jaroslav\_Zeman](https://discuss.elastic.co/u/Jaroslav_Zeman)\ **Replies:** 2\ **Last updated:** [January 10, 2021, 11:06am UTC](https://discuss.elastic.co/t/mapping-data-tokenizer/260629 "2021-01-10T11:06:26Z")
Hi I am a beginner in using elasticsearch, and I have a few questions on how best to store the data in elasticsearch with respect to the maximum search speed. In the relational database, I have the following three enti… --- ## [Increasing ‘index.mapping.nested\_objects.limit’ setting](https://discuss.elastic.co/t/increasing-index-mapping-nested-objects-limit-setting/260633)
**Author:** [@kliakos](https://discuss.elastic.co/u/kliakos)\ **Replies:** 0\ **Last updated:** [January 10, 2021, 9:11am UTC](https://discuss.elastic.co/t/increasing-index-mapping-nested-objects-limit-setting/260633 "2021-01-10T09:11:46Z")
I have the same problem as this https://discuss.elastic.co/t/increasing-index-mapping-nested-objects-limit-settings-value-has-no-effect/228242. The new setting, although applied to the index, doesn't seem to have any ef… --- ## [Logstash high CPU on JDBC plugin](https://discuss.elastic.co/t/logstash-high-cpu-on-jdbc-plugin/260610)
**Author:** [@Kevin\_Juliano](https://discuss.elastic.co/u/Kevin_Juliano)\ **Replies:** 1\ **Last updated:** [January 10, 2021, 2:08am UTC](https://discuss.elastic.co/t/logstash-high-cpu-on-jdbc-plugin/260610 "2021-01-10T02:08:40Z")
Hi! I am running Logstash with JDBC plugin postgreSQL, as I check the performance of our server, because I are having some timeout issues, I found out that Logstash when running is having more than 100% CPU usage. Wh… --- ## [Amazon Linux 2 server monitoring](https://discuss.elastic.co/t/amazon-linux-2-server-monitoring/260568)
**Author:** [@Sergey\_Kuyanov](https://discuss.elastic.co/u/Sergey_Kuyanov)\ **Replies:** 5\ **Last updated:** [January 9, 2021, 11:08pm UTC](https://discuss.elastic.co/t/amazon-linux-2-server-monitoring/260568 "2021-01-09T23:08:59Z")
Hello. I am new in Kibana. The problem is that I installed an ELK stack on the Ubuntu 20.04 server. I have no problem getting any logs from all of my other servers regardless of the operating system they are using. Ho… --- ## [Moving elasticsearch storage directory](https://discuss.elastic.co/t/moving-elasticsearch-storage-directory/260611)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 2\ **Last updated:** [January 9, 2021, 5:45pm UTC](https://discuss.elastic.co/t/moving-elasticsearch-storage-directory/260611 "2021-01-09T17:45:15Z")
I've been using the elastic stack for last one year to capture research data (mainly using honeypots hosted on cloud service providers.) I'm using a three-node cluster to capture the data. 2 nodes are data nodes 1 nod… --- ## [Not getting apm service environment](https://discuss.elastic.co/t/not-getting-apm-service-environment/260604)
**Author:** [@soudhaf](https://discuss.elastic.co/u/soudhaf)\ **Replies:** 2\ **Last updated:** [January 9, 2021, 5:14pm UTC](https://discuss.elastic.co/t/not-getting-apm-service-environment/260604 "2021-01-09T17:14:58Z")
I am not getting the service.environment in kibana/elasticsearch as expected, My config in django settings ELASTIC\_APM = { 'SERVICE\_NAME': 'backend', 'SECRET\_TOKEN': 'myroken', 'SERVER\_URL': 'myaddress', … --- ## [How to sent syslog from mikrotik to ELK](https://discuss.elastic.co/t/how-to-sent-syslog-from-mikrotik-to-elk/260601)
**Author:** [@Zhamax](https://discuss.elastic.co/u/Zhamax)\ **Replies:** 1\ **Last updated:** [January 9, 2021, 3:46pm UTC](https://discuss.elastic.co/t/how-to-sent-syslog-from-mikrotik-to-elk/260601 "2021-01-09T15:46:26Z")
Hi everyone i have some questions to ask. i want to sent syslog from mikrotik to Elastic But I'm confused about how to write code into Input, Filter and output ? Thank you in advance for your help --- ## [Logstash Database pipeline resiliency](https://discuss.elastic.co/t/logstash-database-pipeline-resiliency/260608)
**Author:** [@adityaPsl](https://discuss.elastic.co/u/adityaPsl)\ **Replies:** 3\ **Last updated:** [January 9, 2021, 3:28pm UTC](https://discuss.elastic.co/t/logstash-database-pipeline-resiliency/260608 "2021-01-09T15:28:24Z")
Hello Team, I have a use case where Ineed to deploy database pipeline on 2 nodes, but i want to implement in a way that if one node(machine) goes down then only 2nd will pick up from that point and until the second goes… --- ## [Shards failure](https://discuss.elastic.co/t/shards-failure/258185)
**Author:** [@droidus](https://discuss.elastic.co/u/droidus)\ **Replies:** 1\ **Last updated:** [January 9, 2021, 3:17pm UTC](https://discuss.elastic.co/t/shards-failure/258185 "2021-01-09T15:17:25Z")
Here is what I am seeing: How do I resolve this? --- ## [Using the iptables dashboard](https://discuss.elastic.co/t/using-the-iptables-dashboard/259908)
**Author:** [@droidus](https://discuss.elastic.co/u/droidus)\ **Replies:** 3\ **Last updated:** [January 9, 2021, 3:15pm UTC](https://discuss.elastic.co/t/using-the-iptables-dashboard/259908 "2021-01-09T15:15:52Z")
I am running iptables on my server. I enable the module, configure the .yml file for the file /var/log/kern.log. I do a filebeat -E setup.kibana.host= setup --dashboards. I restart kibana on the server, and go to vie… --- ## [TSVB - Top N - Item URL: keep time interval when link to other dashboard](https://discuss.elastic.co/t/tsvb-top-n-item-url-keep-time-interval-when-link-to-other-dashboard/260598)
**Author:** [@anja1](https://discuss.elastic.co/u/anja1)\ **Replies:** 1\ **Last updated:** [January 9, 2021, 12:46pm UTC](https://discuss.elastic.co/t/tsvb-top-n-item-url-keep-time-interval-when-link-to-other-dashboard/260598 "2021-01-09T12:46:50Z")
I´m using the "item url" in TSVB visualization to link to another dashboard. In the new dashboard the search is already filled with the value of "{{key}}" (thats ok). When link to another dashboard I also want to keep… [Previous page](https://discuss.elastic.co/latest.md?page=1901) [Next page](https://discuss.elastic.co/latest.md?page=1903)