# Latest **URL:** https://discuss.elastic.co/latest.md?page=964 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 965 --- ## [Logstash filter taking. high cpu](https://discuss.elastic.co/t/logstash-filter-taking-high-cpu/314550)
**Author:** [@krishan.kumar](https://discuss.elastic.co/u/krishan.kumar)\ **Replies:** 0\ **Last updated:** [September 16, 2022, 6:35am UTC](https://discuss.elastic.co/t/logstash-filter-taking-high-cpu/314550 "2022-09-16T06:35:54Z")
Hi, My logstash grok pattern taking high CPU This is my log format I, \[2022-09-16T06:27:40.386003 #13375\] INFO -- : \[s45g0-e726-56y7-adcf-3382276c1a77\] \[user\_id: xxxxxx, portfolio\_id: xxxxxxx\] {"method":"GET","path":… --- ## [Kibana No monitoring data found](https://discuss.elastic.co/t/kibana-no-monitoring-data-found/313677)
**Author:** [@WenhaoXu](https://discuss.elastic.co/u/WenhaoXu)\ **Replies:** 15\ **Last updated:** [September 16, 2022, 6:46am UTC](https://discuss.elastic.co/t/kibana-no-monitoring-data-found/313677 "2022-09-16T06:46:37Z")
version : 8.2.3 kibana No monitoring data found get cluster info not found . is it the reason? And GET /\_cat/indices?v&s=index has .monitoring-kibana-7-2022.09.05 .monitoring-es-7-2022.09.05 --- ## [Nodes do not release RAM when idle](https://discuss.elastic.co/t/nodes-do-not-release-ram-when-idle/314321)
**Author:** [@Thijsvdp](https://discuss.elastic.co/u/Thijsvdp)\ **Replies:** 17\ **Last updated:** [September 16, 2022, 6:17am UTC](https://discuss.elastic.co/t/nodes-do-not-release-ram-when-idle/314321 "2022-09-16T06:17:51Z")
Hi all, I have experienced some weird behavior on my development cluster while reading an index using the Elasticsearch-Hadoop connector. I am benchmarking the read performance, by running some scripts that read the ful… --- ## [Transform Data - Vega Kibana](https://discuss.elastic.co/t/transform-data-vega-kibana/314545)
**Author:** [@Irwan\_Kurniawan](https://discuss.elastic.co/u/Irwan_Kurniawan)\ **Replies:** 0\ **Last updated:** [September 16, 2022, 3:24am UTC](https://discuss.elastic.co/t/transform-data-vega-kibana/314545 "2022-09-16T03:24:49Z")
How to transform data that I already get from index like this: Into the format like this: So the Type and Value can be separated in different column. I only know how to do this in Vega-Lite but not in Vega. --- ## [When does the pending count become 0](https://discuss.elastic.co/t/when-does-the-pending-count-become-0/313649)
**Author:** [@hanhee](https://discuss.elastic.co/u/hanhee)\ **Replies:** 3\ **Last updated:** [September 16, 2022, 12:36am UTC](https://discuss.elastic.co/t/when-does-the-pending-count-become-0/313649 "2022-09-16T00:36:58Z")
hi I do not speak English well. sorry my servers log file create 100/1min every day and delete all 12:00 pm but registry json not show flag "remove" and log.json, number.json just keeps getting bigger. i wonder Wh… --- ## [How elastic bulk data](https://discuss.elastic.co/t/how-elastic-bulk-data/314513)
**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\ **Replies:** 3\ **Last updated:** [September 16, 2022, 12:30am UTC](https://discuss.elastic.co/t/how-elastic-bulk-data/314513 "2022-09-16T00:30:00Z")
How Java client send the data source to the cluster? bulkRequest.add(new IndexRequest().source(object)); client.bulk(\_bulkRequest, RequestOptions.DEFAULT); What exactly it does after converting the data to JSON? Does… --- ## [Problem with aggs queries returning null?](https://discuss.elastic.co/t/problem-with-aggs-queries-returning-null/314529)
**Author:** [@JamesD\_7](https://discuss.elastic.co/u/JamesD_7)\ **Replies:** 1\ **Last updated:** [September 15, 2022, 11:17pm UTC](https://discuss.elastic.co/t/problem-with-aggs-queries-returning-null/314529 "2022-09-15T23:17:09Z")
Hello, I'm having trouble getting a simple aggs query to return data. GET mydata1/\_search { "aggs": { "avg\_num\_days": { "avg": { "field": "myField" } } } } I was getting an error: "error"… --- ## [Issues with outside certificate provider - nodes not connecting](https://discuss.elastic.co/t/issues-with-outside-certificate-provider-nodes-not-connecting/312307)
**Author:** [@jamesp](https://discuss.elastic.co/u/jamesp)\ **Replies:** 7\ **Last updated:** [September 15, 2022, 10:02pm UTC](https://discuss.elastic.co/t/issues-with-outside-certificate-provider-nodes-not-connecting/312307 "2022-09-15T22:02:50Z")
Hello, I set up a test instance of elasticsearch 7.11.1 on a Windows VM and created the certificates for SSL encryption following the processes in the documentation, which worked without an issue. I then created CSR's … --- ## [Match filter queries with OR instead of AND](https://discuss.elastic.co/t/match-filter-queries-with-or-instead-of-and/314533)
**Author:** [@mattshubs](https://discuss.elastic.co/u/mattshubs)\ **Replies:** 0\ **Last updated:** [September 15, 2022, 7:15pm UTC](https://discuss.elastic.co/t/match-filter-queries-with-or-instead-of-and/314533 "2022-09-15T19:15:01Z")
Hi, I am setting up alerting off of kibana logs search. Was not able to find documention for my desired use case. Is there a way to match multiple queries under a filter with OR instead of AND? This is \*.yml file. Examp… --- ## [Is it possible to configure filters that use boolean logic for SearchProvider?](https://discuss.elastic.co/t/is-it-possible-to-configure-filters-that-use-boolean-logic-for-searchprovider/314352)
**Author:** [@Beratna](https://discuss.elastic.co/u/Beratna)\ **Replies:** 9\ **Last updated:** [September 15, 2022, 5:50pm UTC](https://discuss.elastic.co/t/is-it-possible-to-configure-filters-that-use-boolean-logic-for-searchprovider/314352 "2022-09-15T17:50:52Z")
Hi there, I'm currently using App Search with search-ui react library. I'm looking for a way to apply boolean logic to the filters inside my searchQuery config. Let's say I have 10 documents in my search engine. Each… --- ## [Filebeat 8.4.1: Autodiscovery and processor not working as expected as per the doc](https://discuss.elastic.co/t/filebeat-8-4-1-autodiscovery-and-processor-not-working-as-expected-as-per-the-doc/314530)
**Author:** [@Ivan\_Gonzalez](https://discuss.elastic.co/u/Ivan_Gonzalez)\ **Replies:** 0\ **Last updated:** [September 15, 2022, 5:12pm UTC](https://discuss.elastic.co/t/filebeat-8-4-1-autodiscovery-and-processor-not-working-as-expected-as-per-the-doc/314530 "2022-09-15T17:12:13Z")
Hi. I am new to filebeat (previously using fluentbit to send kubernetes logs to graylog) and I am struggling with some things that seems not to work as it is in the doc. Maybe I am missing something, so please be benevo… --- ## [Logstash cipher fragment error](https://discuss.elastic.co/t/logstash-cipher-fragment-error/314523)
**Author:** [@RaonyO](https://discuss.elastic.co/u/RaonyO)\ **Replies:** 3\ **Last updated:** [September 15, 2022, 3:41pm UTC](https://discuss.elastic.co/t/logstash-cipher-fragment-error/314523 "2022-09-15T15:41:03Z")
I have an error in a pipeline in logstash, the input is via tcp and ssl. config: input { tcp { port =\> 7771 codec =\> line ssl\_verify =\> false ssl\_enable =\> true ssl\_cert =\> "/etc/logstash/certs/cert.crt… --- ## [RequestOption](https://discuss.elastic.co/t/requestoption/314516)
**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\ **Replies:** 1\ **Last updated:** [September 15, 2022, 2:39pm UTC](https://discuss.elastic.co/t/requestoption/314516 "2022-09-15T14:39:32Z")
What does RequestOptions means? When we need to custom it? client.bulk(\_bulkRequest, RequestOptions.DEFAULT); --- ## [Ways to build Json doc in ES8 Java API client](https://discuss.elastic.co/t/ways-to-build-json-doc-in-es8-java-api-client/314459)
**Author:** [@ijaxahmed](https://discuss.elastic.co/u/ijaxahmed)\ **Replies:** 1\ **Last updated:** [September 15, 2022, 2:22pm UTC](https://discuss.elastic.co/t/ways-to-build-json-doc-in-es8-java-api-client/314459 "2022-09-15T14:22:09Z")
How to build Json document In Elasticsearch 8 API client , as In older Client APIs its possible to build using XContentBuilder like XContentBuilder builder = jsonBuilder() .startObject() .field("firstName", … --- ## [How is the state (last read file or position in a file) is maintained for multiple pods running logstash](https://discuss.elastic.co/t/how-is-the-state-last-read-file-or-position-in-a-file-is-maintained-for-multiple-pods-running-logstash/314502)
**Author:** [@Jyoti\_Patel](https://discuss.elastic.co/u/Jyoti_Patel)\ **Replies:** 4\ **Last updated:** [September 15, 2022, 2:12pm UTC](https://discuss.elastic.co/t/how-is-the-state-last-read-file-or-position-in-a-file-is-maintained-for-multiple-pods-running-logstash/314502 "2022-09-15T14:12:00Z")
Hi Everyone, I just have a query regarding last read s3 file or the last read line in the s3 file. How or where is that data stored? and how is that shared among multiple pods running logstash? What if the pod is repl… --- ## [Metricbeat - Azure: Linux OS Guest metrics not included in compute\_vm metricset](https://discuss.elastic.co/t/metricbeat-azure-linux-os-guest-metrics-not-included-in-compute-vm-metricset/314519)
**Author:** [@Harm](https://discuss.elastic.co/u/Harm)\ **Replies:** 0\ **Last updated:** [September 15, 2022, 2:00pm UTC](https://discuss.elastic.co/t/metricbeat-azure-linux-os-guest-metrics-not-included-in-compute-vm-metricset/314519 "2022-09-15T14:00:04Z")
Hi, I have created a data collection rule in Azure Monitor to collect both Windows and Linux Guest OS metrics (type: Performance Counters). I was happily surprised to see that the Windows Guest OS metrics are already co… --- ## [Has support for percolating multiple EXISTING documents been added?](https://discuss.elastic.co/t/has-support-for-percolating-multiple-existing-documents-been-added/314450)
**Author:** [@fedreg](https://discuss.elastic.co/u/fedreg)\ **Replies:** 2\ **Last updated:** [September 15, 2022, 1:52pm UTC](https://discuss.elastic.co/t/has-support-for-percolating-multiple-existing-documents-been-added/314450 "2022-09-15T13:52:49Z")
Hello! Question about Percolator Queries in ES 8.x... Wondering if the ability to query multiple EXISTING docs has been added to the API? I know I can query multiple raw documents such as GET /my-index-000001/\_search… --- ## [CSV Export not available when xpack.reporting.roles.enabled set to false](https://discuss.elastic.co/t/csv-export-not-available-when-xpack-reporting-roles-enabled-set-to-false/313445)
**Author:** [@Harm](https://discuss.elastic.co/u/Harm)\ **Replies:** 5\ **Last updated:** [September 15, 2022, 1:49pm UTC](https://discuss.elastic.co/t/csv-export-not-available-when-xpack-reporting-roles-enabled-set-to-false/313445 "2022-09-15T13:49:48Z")
Hi, since the xpack.reporting.roles settings are deprecated since v7.14.0, I have disabled the use of the reporting role in our 7.17.6 environment by setting: xpack.reporting.roles.enabled: false The new subfeatures … --- ## [Logstash and filebeat data streams](https://discuss.elastic.co/t/logstash-and-filebeat-data-streams/314488)
**Author:** [@gborg](https://discuss.elastic.co/u/gborg)\ **Replies:** 1\ **Last updated:** [September 15, 2022, 1:24pm UTC](https://discuss.elastic.co/t/logstash-and-filebeat-data-streams/314488 "2022-09-15T13:24:35Z")
Hello I have a setup where I run filebeats, which send their logs to a queue, logstash reads off the queue and writes the data to elasticsearch. With version 7 I had no issues, I recently upgraded to elasticsearch to e… --- ## [Elasticsearch cut strings with forward slash](https://discuss.elastic.co/t/elasticsearch-cut-strings-with-forward-slash/314355)
**Author:** [@abolinhas](https://discuss.elastic.co/u/abolinhas)\ **Replies:** 1\ **Last updated:** [September 15, 2022, 12:43pm UTC](https://discuss.elastic.co/t/elasticsearch-cut-strings-with-forward-slash/314355 "2022-09-15T12:43:43Z")
I have configured my squid proxy to send the logs to Elasticsearch 7.17.6, everything is working fine, except the USER mapping. The string expect is DOMAIN/USER, the ELK recieves it correctly on original message but the… --- ## [APM - logs for trace is not available](https://discuss.elastic.co/t/apm-logs-for-trace-is-not-available/314429)
**Author:** [@schikin-sw](https://discuss.elastic.co/u/schikin-sw)\ **Replies:** 2\ **Last updated:** [September 15, 2022, 11:38am UTC](https://discuss.elastic.co/t/apm-logs-for-trace-is-not-available/314429 "2022-09-15T11:38:53Z")
Hello, we are using the latest Elastic Cloud (ver. 8.4) with APM. We are sending logs using filebeat in ECS format. We can see logs coming in and trace.id is present in log events. We also have APM data flowing properly … --- ## [While creating new dashboard and search I get fields just from one index](https://discuss.elastic.co/t/while-creating-new-dashboard-and-search-i-get-fields-just-from-one-index/314416)
**Author:** [@111363](https://discuss.elastic.co/u/111363)\ **Replies:** 3\ **Last updated:** [September 15, 2022, 11:38am UTC](https://discuss.elastic.co/t/while-creating-new-dashboard-and-search-i-get-fields-just-from-one-index/314416 "2022-09-15T11:38:34Z")
Hi, I have few indexes in Kibana ("index1", "index2", ...). I have created a new dashboard. Added some visualizations that I created with "index2". Now I use search for filter data but the only fields I get are from "i… --- ## [Search a string in Kibana](https://discuss.elastic.co/t/search-a-string-in-kibana/314468)
**Author:** [@sree3](https://discuss.elastic.co/u/sree3)\ **Replies:** 2\ **Last updated:** [September 15, 2022, 11:01am UTC](https://discuss.elastic.co/t/search-a-string-in-kibana/314468 "2022-09-15T11:01:34Z")
Hi, We could see below custom message from one of the indices. I'm trying to filter a string "heap.memory.used/total=7" so that an action can triggered if the used heap memory used greater than 9\*%. Every time if is try… --- ## [Fetch results with wildcard issue](https://discuss.elastic.co/t/fetch-results-with-wildcard-issue/314254)
**Author:** [@mani7](https://discuss.elastic.co/u/mani7)\ **Replies:** 2\ **Last updated:** [September 15, 2022, 10:22am UTC](https://discuss.elastic.co/t/fetch-results-with-wildcard-issue/314254 "2022-09-15T10:22:52Z")
is there have any way to fetch elastic results with lower case letter with wildcard. but data in elastic index is in capital letter. --- ## [Rang query with format](https://discuss.elastic.co/t/rang-query-with-format/314495)
**Author:** [@casterQ](https://discuss.elastic.co/u/casterQ)\ **Replies:** 0\ **Last updated:** [September 15, 2022, 9:59am UTC](https://discuss.elastic.co/t/rang-query-with-format/314495 "2022-09-15T09:59:51Z")
This DSL works: POST xxxxx/\_search?size=1 { "profile": "true", "query": { "range": { "date\_createdAt": { "gte": "2005W161", "lt": "2005W171", "format": "basic\_week\_date" } … --- ## [Functionbeat unable to extract microsecond @timestamp using decode\_json\_fields](https://discuss.elastic.co/t/functionbeat-unable-to-extract-microsecond-timestamp-using-decode-json-fields/314494)
**Author:** [@adrian-skybaker](https://discuss.elastic.co/u/adrian-skybaker)\ **Replies:** 0\ **Last updated:** [September 15, 2022, 9:55am UTC](https://discuss.elastic.co/t/functionbeat-unable-to-extract-microsecond-timestamp-using-decode-json-fields/314494 "2022-09-15T09:55:15Z")
I'm having issues extracting a @timestamp field from a nested JSON string (in standard ISO format), It works if the nested timestamp has millisecond precision. It doesn't if it has microsecond or nanosecond precision. T… --- ## [Best practice of using volumes across a cluster](https://discuss.elastic.co/t/best-practice-of-using-volumes-across-a-cluster/314483)
**Author:** [@Dmitry\_Kulik](https://discuss.elastic.co/u/Dmitry_Kulik)\ **Replies:** 4\ **Last updated:** [September 15, 2022, 9:51am UTC](https://discuss.elastic.co/t/best-practice-of-using-volumes-across-a-cluster/314483 "2022-09-15T09:51:10Z")
Hi all. Wanted to ask you, what is the best approach for using volumes within a cluster? So basically I have a cluster with 3 master/data nodes (combined, not separate). And I want to increase this cluster and not lose … --- ## [Logs from filebeat not being written to kafka topic](https://discuss.elastic.co/t/logs-from-filebeat-not-being-written-to-kafka-topic/314490)
**Author:** [@shivendra95](https://discuss.elastic.co/u/shivendra95)\ **Replies:** 0\ **Last updated:** [September 15, 2022, 9:38am UTC](https://discuss.elastic.co/t/logs-from-filebeat-not-being-written-to-kafka-topic/314490 "2022-09-15T09:38:29Z")
Hi, I have filebeat application deployed on ec2 instance. I'm trying to connect to kafka that is deployed on EKS cluster. When I'm trying to connect to kafka, the connection gets established but nothing is being writte… --- ## ["latest" continuous transform destination index does not have all unique key docs consistently/continually](https://discuss.elastic.co/t/latest-continuous-transform-destination-index-does-not-have-all-unique-key-docs-consistently-continually/314414)
**Author:** [@Mark\_Duncan](https://discuss.elastic.co/u/Mark_Duncan)\ **Replies:** 6\ **Last updated:** [September 15, 2022, 9:27am UTC](https://discuss.elastic.co/t/latest-continuous-transform-destination-index-does-not-have-all-unique-key-docs-consistently-continually/314414 "2022-09-15T09:27:38Z")
I have the following latest continuous transform running. The source index has 10 unique key values. The destination index, at various times, will have between 1 and 10 docs in it when I view (and repeatedly refresh) th… --- ## [Snapshot - no space left on device](https://discuss.elastic.co/t/snapshot-no-space-left-on-device/314486)
**Author:** [@mcosta](https://discuss.elastic.co/u/mcosta)\ **Replies:** 0\ **Last updated:** [September 15, 2022, 9:11am UTC](https://discuss.elastic.co/t/snapshot-no-space-left-on-device/314486 "2022-09-15T09:11:27Z")
Hi all, Today we run out of disk space for snapshots. The major problem is that it's impossible to delete old snapshots when there is no space left. I faced this problem in the past and was able to manage it by doing … [Previous page](https://discuss.elastic.co/latest.md?page=963) [Next page](https://discuss.elastic.co/latest.md?page=965)