# Latest **URL:** https://discuss.elastic.co/latest.md?page=950 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 951 --- ## [Multiple indices from one log file](https://discuss.elastic.co/t/multiple-indices-from-one-log-file/315290)
**Author:** [@kkovacs](https://discuss.elastic.co/u/kkovacs)\ **Replies:** 3\ **Last updated:** [September 29, 2022, 6:38am UTC](https://discuss.elastic.co/t/multiple-indices-from-one-log-file/315290 "2022-09-29T06:38:25Z")
Dear Community! I have a question regarding filebeat configuration. Is there any method to make two separate index from the same log file? My purpose is to make two separate index for Kibana from the same log file - to… --- ## [JsonParsingException: expected:',', actual:'"application/pdf; version=1.7"', at offset:428](https://discuss.elastic.co/t/jsonparsingexception-expected-actual-application-pdf-version-1-7-at-offset-428/314857)
**Author:** [@Roman\_Cerny](https://discuss.elastic.co/u/Roman_Cerny)\ **Replies:** 2\ **Last updated:** [September 29, 2022, 6:08am UTC](https://discuss.elastic.co/t/jsonparsingexception-expected-actual-application-pdf-version-1-7-at-offset-428/314857 "2022-09-29T06:08:34Z")
Hello there, I'm new to Elasticsearch and I'm trying to set up a cloud solution of Elasticsearch on azure with .Net 6.0 and a NEST, but I encoutered a problem when working with 7.17.4 NEST and 8.x version of Elasticsear… --- ## [Elastic-operator "Shutting down due to signal"](https://discuss.elastic.co/t/elastic-operator-shutting-down-due-to-signal/315352)
**Author:** [@lnx](https://discuss.elastic.co/u/lnx)\ **Replies:** 1\ **Last updated:** [September 29, 2022, 6:05am UTC](https://discuss.elastic.co/t/elastic-operator-shutting-down-due-to-signal/315352 "2022-09-29T06:05:44Z")
The elastic operator pod stops and comes up again every 3-4 min. Just before it stops I see this in the logs {"log.level":"info","@timestamp":"2022-09-28T09:52:42.062Z","log.logger":"manager","message":"Shutting down du… --- ## [Elasticsearch \[6.8\] Shard distribution based on traffic](https://discuss.elastic.co/t/elasticsearch-6-8-shard-distribution-based-on-traffic/315422)
**Author:** [@srivatsa](https://discuss.elastic.co/u/srivatsa)\ **Replies:** 1\ **Last updated:** [September 29, 2022, 5:32am UTC](https://discuss.elastic.co/t/elasticsearch-6-8-shard-distribution-based-on-traffic/315422 "2022-09-29T05:32:37Z")
Hi Folks, We are seeing scenarios where the cluster is allocating 6 -10 shards(primaries & replicas) of an index with shard sizes around 50GB on a single node of the cluster even though all nodes in the cluster are of t… --- ## [Logstash 8.4.2 Extremely High CPU Loading](https://discuss.elastic.co/t/logstash-8-4-2-extremely-high-cpu-loading/315417)
**Author:** [@ivanchak](https://discuss.elastic.co/u/ivanchak)\ **Replies:** 3\ **Last updated:** [September 29, 2022, 4:35am UTC](https://discuss.elastic.co/t/logstash-8-4-2-extremely-high-cpu-loading/315417 "2022-09-29T04:35:38Z")
My Logstash loading has been about avg. ~10% loading for couple months. Without any change on grokking and configuration, even event/s is about the same rate, just upgrading my Logstash to v8.4.2 causing CPU loading jump… --- ## [Extract attribute from XML field in search results](https://discuss.elastic.co/t/extract-attribute-from-xml-field-in-search-results/315420)
**Author:** [@Eddie\_Vuong](https://discuss.elastic.co/u/Eddie_Vuong)\ **Replies:** 0\ **Last updated:** [September 29, 2022, 3:45am UTC](https://discuss.elastic.co/t/extract-attribute-from-xml-field-in-search-results/315420 "2022-09-29T03:45:20Z")
I have a field that contains XML string in my data and I want to, instead of retrieving the full XML, extract a few attributes from it in the final results. In practice I can do it using Python (query all the needed dat… --- ## [Kibana startup stuck when elasticsearch use http](https://discuss.elastic.co/t/kibana-startup-stuck-when-elasticsearch-use-http/315414)
**Author:** [@acerphoenix](https://discuss.elastic.co/u/acerphoenix)\ **Replies:** 2\ **Last updated:** [September 29, 2022, 3:11am UTC](https://discuss.elastic.co/t/kibana-startup-stuck-when-elasticsearch-use-http/315414 "2022-09-29T03:11:15Z")
Hello, I install es and kibana version 8.4.2, they enable https by default. but i prefer http in private network. so i follow the official instruction, download es and start it, and get some security information indicat… --- ## [Kibana dashboard error](https://discuss.elastic.co/t/kibana-dashboard-error/315332)
**Author:** [@wodhgud](https://discuss.elastic.co/u/wodhgud)\ **Replies:** 1\ **Last updated:** [September 29, 2022, 2:19am UTC](https://discuss.elastic.co/t/kibana-dashboard-error/315332 "2022-09-29T02:19:28Z")
I am currently using version 7.11.1. When dashboarding in kibana " \[parent\] data too large, data for \[index:data/read/search\[step/query\]\] is \[1045822710/997.3mb\], It is larger than the limit of \[1020054732/972.7mb\]. A… --- ## [Uptime Monitor Status Rule / Alert , Which field is considered to filter?](https://discuss.elastic.co/t/uptime-monitor-status-rule-alert-which-field-is-considered-to-filter/314200)
**Author:** [@aji.shinde7](https://discuss.elastic.co/u/aji.shinde7)\ **Replies:** 3\ **Last updated:** [September 28, 2022, 10:56pm UTC](https://discuss.elastic.co/t/uptime-monitor-status-rule-alert-which-field-is-considered-to-filter/314200 "2022-09-28T22:56:34Z")
Hello Experts, I have configured Heartbeat. To reduce the data , I have used "include fields" processor as below. So, now I get data for below fields and metadata fields (default). the issue is , in "Uptime Monitor … --- ## [Specify ILM process with cron syntax](https://discuss.elastic.co/t/specify-ilm-process-with-cron-syntax/315396)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 2\ **Last updated:** [September 28, 2022, 10:00pm UTC](https://discuss.elastic.co/t/specify-ilm-process-with-cron-syntax/315396 "2022-09-28T22:00:35Z")
Running a very busy cluster, we want to be able to specify when ILM tasks are running. Example: we run Spark job during 2 jours, and sometimes shrink'ing happen, which completely kill search scroll performance (less sha… --- ## [ML Job low severity score](https://discuss.elastic.co/t/ml-job-low-severity-score/315408)
**Author:** [@Camilo\_Otalora](https://discuss.elastic.co/u/Camilo_Otalora)\ **Replies:** 0\ **Last updated:** [September 28, 2022, 9:59pm UTC](https://discuss.elastic.co/t/ml-job-low-severity-score/315408 "2022-09-28T21:59:14Z")
Hello! I was developing a Machine Learning task so I could automate some anomaly detection between people’s activity. We have activity x12 times higher than usual, but the severity is way lower than what we expected (\< 1… --- ## [Logstash Failed to install template Error 400](https://discuss.elastic.co/t/logstash-failed-to-install-template-error-400/315403)
**Author:** [@fformoso](https://discuss.elastic.co/u/fformoso)\ **Replies:** 0\ **Last updated:** [September 28, 2022, 8:34pm UTC](https://discuss.elastic.co/t/logstash-failed-to-install-template-error-400/315403 "2022-09-28T20:34:39Z")
Dear all, I need help to understand root cause, I can add the template via api, but not using logstash 8.3 I've tried to fix it adding diferent roles to user =\> "logstash\_writer" and didnt work Error: \[2022-09-28T17… --- ## [Kibana index import success but different user none index](https://discuss.elastic.co/t/kibana-index-import-success-but-different-user-none-index/312977)
**Author:** [@laminus](https://discuss.elastic.co/u/laminus)\ **Replies:** 1\ **Last updated:** [September 28, 2022, 8:07pm UTC](https://discuss.elastic.co/t/kibana-index-import-success-but-different-user-none-index/312977 "2022-09-28T20:07:35Z")
hello please help me old kibana used index obect export and new kibana index obect import success but different user none index what can i do? --- ## [Is custom plugin creation methodology and code same for Kibana 7 and 8?](https://discuss.elastic.co/t/is-custom-plugin-creation-methodology-and-code-same-for-kibana-7-and-8/313236)
**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\ **Replies:** 1\ **Last updated:** [September 28, 2022, 6:23pm UTC](https://discuss.elastic.co/t/is-custom-plugin-creation-methodology-and-code-same-for-kibana-7-and-8/313236 "2022-09-28T18:23:25Z")
Hi, I have already started creating a custom external plugin (using React) in Kibana 8.5 source code. Can I install the same plugin in any version of Kibana, given I specify the same (version) when building the plugin? … --- ## [How to display exact match and variations after](https://discuss.elastic.co/t/how-to-display-exact-match-and-variations-after/315394)
**Author:** [@Guilherme\_Mello](https://discuss.elastic.co/u/Guilherme_Mello)\ **Replies:** 1\ **Last updated:** [September 28, 2022, 5:47pm UTC](https://discuss.elastic.co/t/how-to-display-exact-match-and-variations-after/315394 "2022-09-28T17:47:34Z")
How can I display first the exact match and search variations after? example: query: all star results: all star red (exact) all star blue (exact) all star long (exact) dress all red (partial) shoes star (partial) … --- ## [How to change the logo in Kibana 8.3.3](https://discuss.elastic.co/t/how-to-change-the-logo-in-kibana-8-3-3/313462)
**Author:** [@Arsalan1](https://discuss.elastic.co/u/Arsalan1)\ **Replies:** 2\ **Last updated:** [September 28, 2022, 5:30pm UTC](https://discuss.elastic.co/t/how-to-change-the-logo-in-kibana-8-3-3/313462 "2022-09-28T17:30:56Z")
I am facing some issues during the logo customization in Kibana version 8.3.3. I don't know how to customize the logo in Kibana. So, I read some blogs and discussion related to this topic but all in vain. can any one hel… --- ## [Offline install of ELK stack on Oracle Linux](https://discuss.elastic.co/t/offline-install-of-elk-stack-on-oracle-linux/315389)
**Author:** [@ccloutr.alex](https://discuss.elastic.co/u/ccloutr.alex)\ **Replies:** 1\ **Last updated:** [September 28, 2022, 4:36pm UTC](https://discuss.elastic.co/t/offline-install-of-elk-stack-on-oracle-linux/315389 "2022-09-28T16:36:21Z")
I need to install ELK stack with all of its dependencies on a Oracle Linux box that is not connected to the internet. Is there a Offline install package that contains all dependencies? --- ## [Custom Pipeline with Elastic Agent AWS EC2 Cloudwatch Log integration](https://discuss.elastic.co/t/custom-pipeline-with-elastic-agent-aws-ec2-cloudwatch-log-integration/315031)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 2\ **Last updated:** [September 28, 2022, 4:00pm UTC](https://discuss.elastic.co/t/custom-pipeline-with-elastic-agent-aws-ec2-cloudwatch-log-integration/315031 "2022-09-28T16:00:13Z")
I'm trying to migrate some Cloudwatch logs currently being captured by Functionbeat to a fleet-managed Elastic Agent integration (AWS EC2 Cloudwatch). The logs are being captured, as expected. However, I am getting a gro… --- ## [Hot indices vs cold indices in same cluster](https://discuss.elastic.co/t/hot-indices-vs-cold-indices-in-same-cluster/315294)
**Author:** [@sara251186](https://discuss.elastic.co/u/sara251186)\ **Replies:** 1\ **Last updated:** [September 28, 2022, 3:36pm UTC](https://discuss.elastic.co/t/hot-indices-vs-cold-indices-in-same-cluster/315294 "2022-09-28T15:36:04Z")
I have a cluster for 12 data nodes running for a e commerce search, we also have 6 indices representing countries like US, CA, DE etc. I was running perf test against this cluster with just 1 index (i.e US - this compri… --- ## [Getting runtime\_exception exceeds maxClauseCount after Elasticsearch upgrade](https://discuss.elastic.co/t/getting-runtime-exception-exceeds-maxclausecount-after-elasticsearch-upgrade/315380)
**Author:** [@gwillis](https://discuss.elastic.co/u/gwillis)\ **Replies:** 0\ **Last updated:** [September 28, 2022, 2:55pm UTC](https://discuss.elastic.co/t/getting-runtime-exception-exceeds-maxclausecount-after-elasticsearch-upgrade/315380 "2022-09-28T14:55:23Z")
We are upgrading from Elasticsearch 6.2.4 to Elasticsearch 8.4.1 and are experiencing problems with several queries getting a runtime\_exception exceeds maxClauseCount. Elasticsearch 6.2.4 uses the default for index.query… --- ## [Alert : kibana.alert.rule.name: "Remote Execution via File Shares"](https://discuss.elastic.co/t/alert-kibana-alert-rule-name-remote-execution-via-file-shares/315378)
**Author:** [@Viral-Technology](https://discuss.elastic.co/u/Viral-Technology)\ **Replies:** 0\ **Last updated:** [September 28, 2022, 2:16pm UTC](https://discuss.elastic.co/t/alert-kibana-alert-rule-name-remote-execution-via-file-shares/315378 "2022-09-28T14:16:48Z")
Hello All, We are very new to the Elastic Stack, We had an alert show up this morning for " Remote Execution via File Shares" However, I can not find any corresponding data to go with it. is it normal that this alert do… --- ## [APM transaction propogation does not shown in Kibana](https://discuss.elastic.co/t/apm-transaction-propogation-does-not-shown-in-kibana/315374)
**Author:** [@zeevik.sha](https://discuss.elastic.co/u/zeevik.sha)\ **Replies:** 2\ **Last updated:** [September 28, 2022, 1:56pm UTC](https://discuss.elastic.co/t/apm-transaction-propogation-does-not-shown-in-kibana/315374 "2022-09-28T13:56:54Z")
Hi everyone, I have an Angular app and 2 node.js services that I want to monitor using APM. The angular app is the first transaction, I followed the elastic APM documentation to propogate the trace from the angular app… --- ## [Is there a plan to update nodejs version to v16.17.1 in kibana 7.17?](https://discuss.elastic.co/t/is-there-a-plan-to-update-nodejs-version-to-v16-17-1-in-kibana-7-17/315350)
**Author:** [@tan\_minkee](https://discuss.elastic.co/u/tan_minkee)\ **Replies:** 2\ **Last updated:** [September 28, 2022, 1:30pm UTC](https://discuss.elastic.co/t/is-there-a-plan-to-update-nodejs-version-to-v16-17-1-in-kibana-7-17/315350 "2022-09-28T13:30:53Z")
As per subject. Would like to request kibana v7.17 to update nodejs to v16.17.1 due to its vulnerability in CVE - CVE-2022-35255 (mitre.org) and CVE - CVE-2022-35256 (mitre.org) --- ## [How to Send the alerts to opsgenie from kibana using ALERT-API URL](https://discuss.elastic.co/t/how-to-send-the-alerts-to-opsgenie-from-kibana-using-alert-api-url/315370)
**Author:** [@ankamsandeep](https://discuss.elastic.co/u/ankamsandeep)\ **Replies:** 1\ **Last updated:** [September 28, 2022, 1:02pm UTC](https://discuss.elastic.co/t/how-to-send-the-alerts-to-opsgenie-from-kibana-using-alert-api-url/315370 "2022-09-28T13:02:46Z")
Hi all, I am new to Elastic and Kibana, can anyone help in how can i integrate opsgenie with Kibana using Alert api. Unable to find the solution, if any one of you can assist on this would be really helpful. Looking … --- ## [Why does Elasticsearch's default settings for logging via log4j2 retain such large amounts logs?](https://discuss.elastic.co/t/why-does-elasticsearchs-default-settings-for-logging-via-log4j2-retain-such-large-amounts-logs/315255)
**Author:** [@bassistcz](https://discuss.elastic.co/u/bassistcz)\ **Replies:** 4\ **Last updated:** [September 28, 2022, 12:22pm UTC](https://discuss.elastic.co/t/why-does-elasticsearchs-default-settings-for-logging-via-log4j2-retain-such-large-amounts-logs/315255 "2022-09-28T12:22:33Z")
I am curious about the logging settings for Elasticsearch, (I am running 7.17.3) as they appear much larger then what I typically expect for application logging. I have run into issues where the logs have filled my loggi… --- ## [Add fleet server self signed certificate error](https://discuss.elastic.co/t/add-fleet-server-self-signed-certificate-error/315187)
**Author:** [@david-a76](https://discuss.elastic.co/u/david-a76)\ **Replies:** 2\ **Last updated:** [September 28, 2022, 12:17pm UTC](https://discuss.elastic.co/t/add-fleet-server-self-signed-certificate-error/315187 "2022-09-28T12:17:39Z")
I'm trying to install Fleet with Kabana's Quick Start Wizard. When I run the installer: ./elastic-agent install --fleet-server-es=https://192.168.80.10:9200 --fleet-server-service-token=AAE....MQQ --fleet-server-policy… --- ## [Filebeat Index with Module in Name -\> Alias and ILM](https://discuss.elastic.co/t/filebeat-index-with-module-in-name-alias-and-ilm/315346)
**Author:** [@BoKu](https://discuss.elastic.co/u/BoKu)\ **Replies:** 0\ **Last updated:** [September 28, 2022, 9:50am UTC](https://discuss.elastic.co/t/filebeat-index-with-module-in-name-alias-and-ilm/315346 "2022-09-28T09:50:56Z")
Hello there, i do have the following situation. I run Filebeat on an dedicated server for the panw-Module, with a dedicated Port. Our Paloalto Firewall is shipping the logs via syslog to the filebeat-server. If i run f… --- ## [Found encoding issue with Filebeat MS SQL module](https://discuss.elastic.co/t/found-encoding-issue-with-filebeat-ms-sql-module/315351)
**Author:** [@imad\_orange](https://discuss.elastic.co/u/imad_orange)\ **Replies:** 0\ **Last updated:** [September 28, 2022, 10:03am UTC](https://discuss.elastic.co/t/found-encoding-issue-with-filebeat-ms-sql-module/315351 "2022-09-28T10:03:54Z")
Hello, For people who find a probleme to read files Error of SQL server with the module mssql, you should add encoding: utf-16le-bom in module\\mssql\\log\\config\\config.yml file. Thanks to @varun1992 (Found encoding iss… --- ## [Bucket aggregation And Java client](https://discuss.elastic.co/t/bucket-aggregation-and-java-client/315136)
**Author:** [@Shubh](https://discuss.elastic.co/u/Shubh)\ **Replies:** 1\ **Last updated:** [September 28, 2022, 10:00am UTC](https://discuss.elastic.co/t/bucket-aggregation-and-java-client/315136 "2022-09-28T10:00:02Z")
Hi all, can you help me with my query result the out is not coming as i expected. below is my query pls check if i have to make any changes in the query GET /\_search { "query": { "bool": { "filter": \[ … --- ## [Consultation about a use case](https://discuss.elastic.co/t/consultation-about-a-use-case/315305)
**Author:** [@royassis](https://discuss.elastic.co/u/royassis)\ **Replies:** 1\ **Last updated:** [September 28, 2022, 9:49am UTC](https://discuss.elastic.co/t/consultation-about-a-use-case/315305 "2022-09-28T09:49:56Z")
Hey In my company we are building a awb application. Out application data resided in multiple data sources : aws s3, postgres, mongodb. I was looking for a way to speed up some of the queries. There are some drop dow… [Previous page](https://discuss.elastic.co/latest.md?page=949) [Next page](https://discuss.elastic.co/latest.md?page=951)