# Latest **URL:** https://discuss.elastic.co/latest.md?page=911 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 912 --- ## [Logstash webhdfs output plugin AlreadyBeingCreatedException](https://discuss.elastic.co/t/logstash-webhdfs-output-plugin-alreadybeingcreatedexception/317887)
**Author:** [@Rakhshunda\_Noorein\_J](https://discuss.elastic.co/u/Rakhshunda_Noorein_J)\ **Replies:** 10\ **Last updated:** [November 2, 2022, 1:20pm UTC](https://discuss.elastic.co/t/logstash-webhdfs-output-plugin-alreadybeingcreatedexception/317887 "2022-11-02T13:20:54Z")
Hello, I have created a webhdfc logstash configuaration file which will take file input and insert the data in hdfs through webhdfs output. sharing you the config file below. input { file { path =\> "C:/Users/user/… --- ## [Metricbeat and Elastic agent configuration?](https://discuss.elastic.co/t/metricbeat-and-elastic-agent-configuration/317987)
**Author:** [@subash](https://discuss.elastic.co/u/subash)\ **Replies:** 0\ **Last updated:** [November 2, 2022, 1:19pm UTC](https://discuss.elastic.co/t/metricbeat-and-elastic-agent-configuration/317987 "2022-11-02T13:19:55Z")
We are using Fleet managed Elastic agents version 7.17.4 in ECE. Is it possible to edit the metricbeat.yml which is inside the elastic agent? I tried editing it but got "metricbeat corrupted" during the Elastic agent in… --- ## [TCP data splitted into several documents](https://discuss.elastic.co/t/tcp-data-splitted-into-several-documents/317986)
**Author:** [@Fangy](https://discuss.elastic.co/u/Fangy)\ **Replies:** 0\ **Last updated:** [November 2, 2022, 1:14pm UTC](https://discuss.elastic.co/t/tcp-data-splitted-into-several-documents/317986 "2022-11-02T13:14:37Z")
Hi. I'm trying to ingest some new type of message. The message header is very similar to the syslog format, but the message itself is an xml format. Each line in the message ends with 0x0a (LF). These packets are ingeste… --- ## [Filebeat cannot create custom index - even when ilm is disabled](https://discuss.elastic.co/t/filebeat-cannot-create-custom-index-even-when-ilm-is-disabled/317688)
**Author:** [@gisellecarballo](https://discuss.elastic.co/u/gisellecarballo)\ **Replies:** 14\ **Last updated:** [November 2, 2022, 12:46pm UTC](https://discuss.elastic.co/t/filebeat-cannot-create-custom-index-even-when-ilm-is-disabled/317688 "2022-11-02T12:46:17Z")
Hi Team, I would like to ask for help as I cannot create custom index even when setup.ilm.enabled: is set to false. Below is my filebeat config. Thanks. setup.ilm.enabled: false setup.template.enabled: true setup.te… --- ## [Free search event in Paris on Nov 21st](https://discuss.elastic.co/t/free-search-event-in-paris-on-nov-21st/317978)
**Author:** [@flaxsearch](https://discuss.elastic.co/u/flaxsearch)\ **Replies:** 0\ **Last updated:** [November 2, 2022, 11:39am UTC](https://discuss.elastic.co/t/free-search-event-in-paris-on-nov-21st/317978 "2022-11-02T11:39:25Z")
Join OpenSource Connections, founders of the Haystack search relevance conference, and Paris-based search engine tech experts Adelean for an afternoon of search enlightenment – learn how to build great data-driven search… --- ## [Logstash jdbc config throwing error](https://discuss.elastic.co/t/logstash-jdbc-config-throwing-error/317974)
**Author:** [@ashiqab](https://discuss.elastic.co/u/ashiqab)\ **Replies:** 0\ **Last updated:** [November 2, 2022, 10:57am UTC](https://discuss.elastic.co/t/logstash-jdbc-config-throwing-error/317974 "2022-11-02T10:57:54Z")
Hello, I am facing the error below when trying to execute logstash jdbc config file: \[ERROR\] 2022-11-02 11:52:26.435 \[Converge PipelineAction::Create\] agent - Failed to execute action {:action=\>LogStash::PipelineAction… --- ## [Elasticsearch dis\_max with PHP](https://discuss.elastic.co/t/elasticsearch-dis-max-with-php/317976)
**Author:** [@Makaveli1O](https://discuss.elastic.co/u/Makaveli1O)\ **Replies:** 0\ **Last updated:** [November 2, 2022, 11:01am UTC](https://discuss.elastic.co/t/elasticsearch-dis-max-with-php/317976 "2022-11-02T11:01:12Z")
My console query looks like this: { "query": { "dis\_max": { "tie\_breaker": 0.7, "boost": 1.2, "queries": \[ { "multi\_match": { "query": "this exact phrase", … --- ## [Failed to fetch X-pack information from ES - Failure to reach live ES Cluster](https://discuss.elastic.co/t/failed-to-fetch-x-pack-information-from-es-failure-to-reach-live-es-cluster/317306)
**Author:** [@jakinmayowa](https://discuss.elastic.co/u/jakinmayowa)\ **Replies:** 2\ **Last updated:** [November 2, 2022, 10:49am UTC](https://discuss.elastic.co/t/failed-to-fetch-x-pack-information-from-es-failure-to-reach-live-es-cluster/317306 "2022-11-02T10:49:12Z")
I'm currently configuring Logstash ArcSight Module, however I've reached a road-block, error message below: Sending Logstash logs to /usr/share/logstash/logs which is now configured via log4j2.properties \[2022-10-24T10:… --- ## [Aggregation of fields](https://discuss.elastic.co/t/aggregation-of-fields/317969)
**Author:** [@arphillips](https://discuss.elastic.co/u/arphillips)\ **Replies:** 0\ **Last updated:** [November 2, 2022, 10:48am UTC](https://discuss.elastic.co/t/aggregation-of-fields/317969 "2022-11-02T10:48:39Z")
How do I aggregate fields with vega in a sankey graph? I want to build a graph that shows AS paths using bytes. I have most of the graph in place. However, when I use bytes I get a 'flow' for each different number, can … --- ## [Filebeat high read io when collecting log data](https://discuss.elastic.co/t/filebeat-high-read-io-when-collecting-log-data/317857)
**Author:** [@Zhi\_Li](https://discuss.elastic.co/u/Zhi_Li)\ **Replies:** 2\ **Last updated:** [November 2, 2022, 9:18am UTC](https://discuss.elastic.co/t/filebeat-high-read-io-when-collecting-log-data/317857 "2022-11-02T09:18:10Z")
I have a Filebeat setup to collect log data in SATA, but it does have a high read IO of around 20mb/s. below is my Filebeat config, it outputs to Kafka cluster. im just wondering is there any way to slow down the Filebea… --- ## [Logstash profile](https://discuss.elastic.co/t/logstash-profile/317934)
**Author:** [@GEHsu](https://discuss.elastic.co/u/GEHsu)\ **Replies:** 1\ **Last updated:** [November 2, 2022, 8:59am UTC](https://discuss.elastic.co/t/logstash-profile/317934 "2022-11-02T08:59:46Z")
System is Ubuntu Logstash version 7.17 The current idea is to collect logs (via syslog-514Port) from different servers or network devices Logstash will then send the log cut to Elasticsearch I have successfully recei… --- ## [Logstash stuck when lumberjack server is down](https://discuss.elastic.co/t/logstash-stuck-when-lumberjack-server-is-down/317955)
**Author:** [@ferdose\_shaik](https://discuss.elastic.co/u/ferdose_shaik)\ **Replies:** 0\ **Last updated:** [November 2, 2022, 8:44am UTC](https://discuss.elastic.co/t/logstash-stuck-when-lumberjack-server-is-down/317955 "2022-11-02T08:44:07Z")
We are using Logstash 7.15.2 with following lumberjack output configured. output { lumberjack { id =\> "dcae5gcprod" hosts =\> \["dcae-5gc-prod.ecomp.idns.cci.att.com"\] codec =\> json port =\> 31135 ssl\_cert… --- ## [Steps to configure and use memcached in logstash. Can you please share with me the steps](https://discuss.elastic.co/t/steps-to-configure-and-use-memcached-in-logstash-can-you-please-share-with-me-the-steps/317727)
**Author:** [@danishbit09](https://discuss.elastic.co/u/danishbit09)\ **Replies:** 4\ **Last updated:** [November 2, 2022, 8:32am UTC](https://discuss.elastic.co/t/steps-to-configure-and-use-memcached-in-logstash-can-you-please-share-with-me-the-steps/317727 "2022-11-02T08:32:42Z")
Can you please share with me the steps to configure and run memcached in filter plugin. Is memcached server configured in logstash internally or I have to install and start memcached externally? Please guide me. --- ## [Cluster is yellow and 3 shards are unassigned](https://discuss.elastic.co/t/cluster-is-yellow-and-3-shards-are-unassigned/317892)
**Author:** [@fribse](https://discuss.elastic.co/u/fribse)\ **Replies:** 2\ **Last updated:** [November 2, 2022, 8:32am UTC](https://discuss.elastic.co/t/cluster-is-yellow-and-3-shards-are-unassigned/317892 "2022-11-02T08:32:13Z")
I had a Elastic search stack crash due to disk almost full, after enabling extra winlogbeat, which took me a bit with surprise, so I added some policies to reduce them a bit. But after doing that and expanding the disk,… --- ## [一台主机安装两个版本的Elastic Search可以区分输入输出接口同时运行吗？](https://discuss.elastic.co/t/elastic-search/317940)
**Author:** [@Shadow\_CHN](https://discuss.elastic.co/u/Shadow_CHN)\ **Replies:** 2\ **Last updated:** [November 2, 2022, 8:17am UTC](https://discuss.elastic.co/t/elastic-search/317940 "2022-11-02T08:17:39Z")
我在一台CentOS7.8上同时安装了ES7.x和8.x希望服务于不同的应用，请问可以让这两个版本的ES不冲突地同时运行吗？ --- ## [Grok pattern](https://discuss.elastic.co/t/grok-pattern/317891)
**Author:** [@abkonred1](https://discuss.elastic.co/u/abkonred1)\ **Replies:** 4\ **Last updated:** [November 2, 2022, 7:25am UTC](https://discuss.elastic.co/t/grok-pattern/317891 "2022-11-02T07:25:06Z")
Hi Team, I need to ingest the below log file, and i required all the fields without pipe. In order to create visualization and dashboards for the same. kindly any one please help, how to split the fields with this log e… --- ## [Can we do CCR between ECE & elastic cloud services? between local and Elastic cloud services?](https://discuss.elastic.co/t/can-we-do-ccr-between-ece-elastic-cloud-services-between-local-and-elastic-cloud-services/317921)
**Author:** [@Vijaykumar\_Deshmukh1](https://discuss.elastic.co/u/Vijaykumar_Deshmukh1)\ **Replies:** 3\ **Last updated:** [November 2, 2022, 6:44am UTC](https://discuss.elastic.co/t/can-we-do-ccr-between-ece-elastic-cloud-services-between-local-and-elastic-cloud-services/317921 "2022-11-02T06:44:06Z")
Just want to know Can i do CCR between ECE and Elastic cloud services?? Can i do CCR between local machine and Elastic cloud services?? Can i do CCR between local machine and ECE?? Thanks! --- ## [Split index failed](https://discuss.elastic.co/t/split-index-failed/317744)
**Author:** [@tonycongjie](https://discuss.elastic.co/u/tonycongjie)\ **Replies:** 2\ **Last updated:** [November 2, 2022, 5:09am UTC](https://discuss.elastic.co/t/split-index-failed/317744 "2022-11-02T05:09:21Z")
Hello, I tried to split my index to more shard. My cluster has 3 node, the index currently have 1 shard and 1 replicas. I tried to split the shard, but I got a return with “shards\_acknowledged : false” PUT /my\_source\_i… --- ## [Elastic Enterprise Search Instance is Missing](https://discuss.elastic.co/t/elastic-enterprise-search-instance-is-missing/317822)
**Author:** [@wijamw](https://discuss.elastic.co/u/wijamw)\ **Replies:** 4\ **Last updated:** [November 2, 2022, 4:24am UTC](https://discuss.elastic.co/t/elastic-enterprise-search-instance-is-missing/317822 "2022-11-02T04:24:32Z")
I am running elastic cloud stack v.7.17.0. This morning I got this warning. Does this included by default? Because I don't remember I have that instance before (maybe I am not paying attention to it). --- ## [Is Elasticsearch suitable for efficient retrieval of large number of docs?](https://discuss.elastic.co/t/is-elasticsearch-suitable-for-efficient-retrieval-of-large-number-of-docs/317845)
**Author:** [@David\_Yu](https://discuss.elastic.co/u/David_Yu)\ **Replies:** 14\ **Last updated:** [November 1, 2022, 4:13pm UTC](https://discuss.elastic.co/t/is-elasticsearch-suitable-for-efficient-retrieval-of-large-number-of-docs/317845 "2022-11-01T16:13:17Z")
How do we use ES? Our team is using ES to index ads metadata. When we need to show a user ads, we query ES for a list of ads that satisfy certain criteria (e.g. geo, queries, campaign date range, etc). Upon fetching the… --- ## [HIVE-Elasticsearch Error Handler for Malformed records](https://discuss.elastic.co/t/hive-elasticsearch-error-handler-for-malformed-records/317901)
**Author:** [@Md\_rafi](https://discuss.elastic.co/u/Md_rafi)\ **Replies:** 2\ **Last updated:** [November 2, 2022, 3:31am UTC](https://discuss.elastic.co/t/hive-elasticsearch-error-handler-for-malformed-records/317901 "2022-11-02T03:31:32Z")
Hi, We are trying to ingest data from Hive to Elasticsearch, Had issues ingesting the data and few of them are malformed json records Followed below documentation for handling bad records and created DDL script to ing… --- ## [How to add api gateway api key to lambda APM?](https://discuss.elastic.co/t/how-to-add-api-gateway-api-key-to-lambda-apm/317854)
**Author:** [@alex\_123123](https://discuss.elastic.co/u/alex_123123)\ **Replies:** 2\ **Last updated:** [November 2, 2022, 2:44am UTC](https://discuss.elastic.co/t/how-to-add-api-gateway-api-key-to-lambda-apm/317854 "2022-11-02T02:44:50Z")
Kibana version: 8.4.1 Elasticsearch version: 8.4.1 APM Server version: 8.4.1 APM Agent language and version: nodejs, elastic-apm-extension-ver-1-1-0-x86\_64, elastic-apm-node-ver-3-38-0 Browser version: / Original in… --- ## [Never started node but got ERROR: Skipping security auto configuration because it appears that security is already configured](https://discuss.elastic.co/t/never-started-node-but-got-error-skipping-security-auto-configuration-because-it-appears-that-security-is-already-configured/317757)
**Author:** [@2019240081](https://discuss.elastic.co/u/2019240081)\ **Replies:** 3\ **Last updated:** [November 2, 2022, 2:44am UTC](https://discuss.elastic.co/t/never-started-node-but-got-error-skipping-security-auto-configuration-because-it-appears-that-security-is-already-configured/317757 "2022-11-02T02:44:02Z")
I got token from already running master node with following command bin\\elasticsearch-create-enrollment-token -s node I ran other node that I've never strated bin\\elasticsearch --enrollment-token \ b… --- ## [Analyze Event Tool - Subgraph Extraction?](https://discuss.elastic.co/t/analyze-event-tool-subgraph-extraction/317149)
**Author:** [@Sheharyar\_Khalid](https://discuss.elastic.co/u/Sheharyar_Khalid)\ **Replies:** 1\ **Last updated:** [November 2, 2022, 1:12am UTC](https://discuss.elastic.co/t/analyze-event-tool-subgraph-extraction/317149 "2022-11-02T01:12:27Z")
Hello, I am trying to find event correlations using eql. For this I am using the eqlplayground.io with everything set to default. I am using the sample query given by eql: //This is a placeholder query, please feel fre… --- ## [Need advice for my small ElasticSearch cluster](https://discuss.elastic.co/t/need-advice-for-my-small-elasticsearch-cluster/317881)
**Author:** [@tomboy](https://discuss.elastic.co/u/tomboy)\ **Replies:** 2\ **Last updated:** [November 1, 2022, 11:56pm UTC](https://discuss.elastic.co/t/need-advice-for-my-small-elasticsearch-cluster/317881 "2022-11-01T23:56:39Z")
Hi all, We have a 3-node cluster in production in the past, and recently we added an independent DC for backup usage. For simplicity, I want to deploy a single ES instance in the backup DC, and keep data in sync with 3… --- ## [Exiting: error connecting to Kibana: fail to get the Kibana version: HTTP GET request to http://X.X.X.X:5601/api/status fails: fail to execute the HTTP GET request: Get "http://X.X.X.X:5601/api/status": context deadline exceeded. Response:](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-http-get-request-to-http-x-x-x-x-5601-api-status-fails-fail-to-execute-the-http-get-request-get-http-x-x-x-x-5601-api-status-context-deadline-exceeded-response/317848)
**Author:** [@Joao\_Malebo](https://discuss.elastic.co/u/Joao_Malebo)\ **Replies:** 22\ **Last updated:** [November 1, 2022, 11:36pm UTC](https://discuss.elastic.co/t/exiting-error-connecting-to-kibana-fail-to-get-the-kibana-version-http-get-request-to-http-x-x-x-x-5601-api-status-fails-fail-to-execute-the-http-get-request-get-http-x-x-x-x-5601-api-status-context-deadline-exceeded-response/317848 "2022-11-01T23:36:27Z")
Hello, I'm having errors loading --dashboards from filebeats to kibana. But when running the command below, it returns me the following message: \[rcmag.kta@XXXXXXXX ~\]$ sudo filebeat setup --dashboards Loading dashboar… --- ## [Is elastic agent running?](https://discuss.elastic.co/t/is-elastic-agent-running/317927)
**Author:** [@bigverm23](https://discuss.elastic.co/u/bigverm23)\ **Replies:** 0\ **Last updated:** [November 1, 2022, 11:33pm UTC](https://discuss.elastic.co/t/is-elastic-agent-running/317927 "2022-11-01T23:33:54Z")
I am trying to install fleet so after creating the policy and running the presented commands, the below is what I get. it fails. curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.4.3… --- ## [Monitor indicies and shards](https://discuss.elastic.co/t/monitor-indicies-and-shards/317920)
**Author:** [@Saeedeh\_Moghimi](https://discuss.elastic.co/u/Saeedeh_Moghimi)\ **Replies:** 1\ **Last updated:** [November 1, 2022, 7:59pm UTC](https://discuss.elastic.co/t/monitor-indicies-and-shards/317920 "2022-11-01T19:59:49Z")
I'm looking for a way to monitor inside of the cluster like: how many indices are available on my cluster, how many shards each index has and ... I know we can do it manually by GET \_cluster/... commands but I'm looki… --- ## [Convert within Ingest Pipeline not outputting Target field](https://discuss.elastic.co/t/convert-within-ingest-pipeline-not-outputting-target-field/317918)
**Author:** [@Jmc](https://discuss.elastic.co/u/Jmc)\ **Replies:** 0\ **Last updated:** [November 1, 2022, 7:02pm UTC](https://discuss.elastic.co/t/convert-within-ingest-pipeline-not-outputting-target-field/317918 "2022-11-01T19:02:05Z")
I am using a Convert processor in an Ingest Pipeline, attempting to convert a field from a Keyword type to a Double type. No error is thrown when I test a document through my pipeline. However, I have opted to direct the… --- ## [Does new OpenSSL Vulnerability effect Elasticsearch/Kibana/ECE](https://discuss.elastic.co/t/does-new-openssl-vulnerability-effect-elasticsearch-kibana-ece/317768)
**Author:** [@Jugsofbeer](https://discuss.elastic.co/u/Jugsofbeer)\ **Replies:** 2\ **Last updated:** [November 1, 2022, 5:52pm UTC](https://discuss.elastic.co/t/does-new-openssl-vulnerability-effect-elasticsearch-kibana-ece/317768 "2022-11-01T17:52:28Z")
Hi, Can someone please advise if the mentioned OpenSSL vulnerabiity effects Elasticsearch/Kibana/E.C.E ? [Previous page](https://discuss.elastic.co/latest.md?page=910) [Next page](https://discuss.elastic.co/latest.md?page=912)