# Latest **URL:** https://discuss.elastic.co/latest.md?page=973 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 974 --- ## [Logstash process killed and as a result the ingestion stopped](https://discuss.elastic.co/t/logstash-process-killed-and-as-a-result-the-ingestion-stopped/314032)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 0\ **Last updated:** [September 9, 2022, 6:59am UTC](https://discuss.elastic.co/t/logstash-process-killed-and-as-a-result-the-ingestion-stopped/314032 "2022-09-09T06:59:14Z")
Hi All, I had a perfectly fine working configuration of Logstash. I colleague of mine tried to troubleshoote and killed the Logstash process thought. After Logstash restarted the ingestion stopped and in the log file … --- ## [Logstash create plugin tutorial](https://discuss.elastic.co/t/logstash-create-plugin-tutorial/314031)
**Author:** [@Laurent\_DEGEN](https://discuss.elastic.co/u/Laurent_DEGEN)\ **Replies:** 0\ **Last updated:** [September 9, 2022, 5:31am UTC](https://discuss.elastic.co/t/logstash-create-plugin-tutorial/314031 "2022-09-09T05:31:31Z")
Hi, I'am looking for good/updated ressources to learn how to create a codec-plugin. I have tried to follow this one : How to write a Logstash codec plugin | Logstash Reference \[8.4\] | Elastic ( I used the plugin genera… --- ## [How to configure apm agent for multiple php sites on one machine](https://discuss.elastic.co/t/how-to-configure-apm-agent-for-multiple-php-sites-on-one-machine/313508)
**Author:** [@lhb6540](https://discuss.elastic.co/u/lhb6540)\ **Replies:** 4\ **Last updated:** [September 9, 2022, 4:34am UTC](https://discuss.elastic.co/t/how-to-configure-apm-agent-for-multiple-php-sites-on-one-machine/313508 "2022-09-09T04:34:12Z")
Follow this page Configuration | APM PHP Agent Reference \[1.x\] | Elastic It is easy to configure apm agent for one php site on the machine by configuring php.ini, but if I have multiple php apps on one machine, how shou… --- ## [Elastic Log data transfer in remote server](https://discuss.elastic.co/t/elastic-log-data-transfer-in-remote-server/314029)
**Author:** [@saifulshihab](https://discuss.elastic.co/u/saifulshihab)\ **Replies:** 0\ **Last updated:** [September 9, 2022, 4:06am UTC](https://discuss.elastic.co/t/elastic-log-data-transfer-in-remote-server/314029 "2022-09-09T04:06:49Z")
I have 3 node cluster all three node have same configuration node.master: true node.data: true so now my storage i filled up almost 800GB. I want to transfer some data for future reference from the path : /var/lib/el… --- ## [When access to enterprise search it automatically redirect to kibana](https://discuss.elastic.co/t/when-access-to-enterprise-search-it-automatically-redirect-to-kibana/313656)
**Author:** [@MaralErdene\_Tumursuh](https://discuss.elastic.co/u/MaralErdene_Tumursuh)\ **Replies:** 3\ **Last updated:** [September 9, 2022, 3:57am UTC](https://discuss.elastic.co/t/when-access-to-enterprise-search-it-automatically-redirect-to-kibana/313656 "2022-09-09T03:57:45Z")
Hello, I installed enterprise search on premise. Then access to http://my\_ip:3002 it redirect to kibana. My kibana installed another server. Is there any config i missed? My enterprise-search.yml has below config. a… --- ## [Health agent but no data sent to fleet server / elasticsearch?](https://discuss.elastic.co/t/health-agent-but-no-data-sent-to-fleet-server-elasticsearch/313559)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 1\ **Last updated:** [September 9, 2022, 3:56am UTC](https://discuss.elastic.co/t/health-agent-but-no-data-sent-to-fleet-server-elasticsearch/313559 "2022-09-09T03:56:07Z")
Hi there, I am running an all-in-one node with elasticsearch, kibana, logstash all 7.17.4 and fleet running. I have 2 agents. One on the this all-in-one node. The other installes to a second, empy ubuntu VM - just to co… --- ## [Unable to export Kibana dashboard using API](https://discuss.elastic.co/t/unable-to-export-kibana-dashboard-using-api/313941)
**Author:** [@rt\_888](https://discuss.elastic.co/u/rt_888)\ **Replies:** 13\ **Last updated:** [September 9, 2022, 3:26am UTC](https://discuss.elastic.co/t/unable-to-export-kibana-dashboard-using-api/313941 "2022-09-09T03:26:49Z")
// curl -X POST “http://localhost:5601/api/saved\_objects/\_export” -H ‘kbn-xsrf: true’ -H ‘Content-Type: application/json’ -d’ { “type”: “index-pattern” } ‘ I use this as to export my dashboard but i get the error "Incor… --- ## [Fleet Server not respecting custom port config](https://discuss.elastic.co/t/fleet-server-not-respecting-custom-port-config/313590)
**Author:** [@bfarren240](https://discuss.elastic.co/u/bfarren240)\ **Replies:** 4\ **Last updated:** [September 9, 2022, 1:00am UTC](https://discuss.elastic.co/t/fleet-server-not-respecting-custom-port-config/313590 "2022-09-09T01:00:00Z")
Upgraded ES and Kibana from 8.1.2 -\> 8.4.1. Un-enrolled my fleet server, and deployed a new fleet server agent with the following (newly created in 8.4.1) config: However, the elastic agent does not respect the … --- ## [LEAK: ByteBuf.release() was not called before it's garbage-collected](https://discuss.elastic.co/t/leak-bytebuf-release-was-not-called-before-its-garbage-collected/313658)
**Author:** [@Orwell-coder](https://discuss.elastic.co/u/Orwell-coder)\ **Replies:** 6\ **Last updated:** [September 9, 2022, 12:44am UTC](https://discuss.elastic.co/t/leak-bytebuf-release-was-not-called-before-its-garbage-collected/313658 "2022-09-09T00:44:48Z")
Hello, everyone. I have a problem I have never encountered, so I need some help. I have a single-type es node , the es node is runing by docker contianer. Host Version: CentOS 8.3 x64. Docker Version: 20.10.5. ES Ve… --- ## [Elastic Security field values in connector getting duplicated](https://discuss.elastic.co/t/elastic-security-field-values-in-connector-getting-duplicated/313725)
**Author:** [@RaonyO](https://discuss.elastic.co/u/RaonyO)\ **Replies:** 2\ **Last updated:** [September 9, 2022, 12:30am UTC](https://discuss.elastic.co/t/elastic-security-field-values-in-connector-getting-duplicated/313725 "2022-09-09T00:30:38Z")
hello everyone, I'm trying to create a rule in elastic security via query in a specific index, and the rule detects it normally, but in the action part the events are going with duplicate fields. for example: "result": … --- ## [Issue with selecting date fields from the \`jdbc\_streaming\` \`filter\` plugin](https://discuss.elastic.co/t/issue-with-selecting-date-fields-from-the-jdbc-streaming-filter-plugin/314023)
**Author:** [@nkumarcc](https://discuss.elastic.co/u/nkumarcc)\ **Replies:** 0\ **Last updated:** [September 8, 2022, 10:39pm UTC](https://discuss.elastic.co/t/issue-with-selecting-date-fields-from-the-jdbc-streaming-filter-plugin/314023 "2022-09-08T22:39:34Z")
I have a nested field in my Elasticsearch mapping which holds an array of objects. We wanted to add this array to records via a jdbc\_streaming filter. However, 2 of the fields we query for are timestamp fields, which cau… --- ## [Unable to access Kibana with 500 Internal Server Error](https://discuss.elastic.co/t/unable-to-access-kibana-with-500-internal-server-error/313842)
**Author:** [@m-amano](https://discuss.elastic.co/u/m-amano)\ **Replies:** 5\ **Last updated:** [September 8, 2022, 9:04pm UTC](https://discuss.elastic.co/t/unable-to-access-kibana-with-500-internal-server-error/313842 "2022-09-08T21:04:45Z")
Elastic Cloud version 7.17.6. After I deleted these indices, I could not access to Kibana or Elasticsearch in Elastic Cloud. .apm-agent-configuration .apm-custom-link .async-search .fleet-enrollment-api-keys-7 .fleet-p… --- ## [Add Elastic Agent tags to log events](https://discuss.elastic.co/t/add-elastic-agent-tags-to-log-events/312737)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 7\ **Last updated:** [September 8, 2022, 7:58pm UTC](https://discuss.elastic.co/t/add-elastic-agent-tags-to-log-events/312737 "2022-09-08T19:58:53Z")
Is there a way to append the Elastic Agent tags to the event, or at least to log events? My use case is that I designate agents by application environment (e.g., dev/qa/stage/prod), and would like that tag to be availabl… --- ## [Elastic Rule Connector sends a String instead of JSON to the Webhook](https://discuss.elastic.co/t/elastic-rule-connector-sends-a-string-instead-of-json-to-the-webhook/313833)
**Author:** [@yzaritskyi](https://discuss.elastic.co/u/yzaritskyi)\ **Replies:** 5\ **Last updated:** [September 8, 2022, 7:18pm UTC](https://discuss.elastic.co/t/elastic-rule-connector-sends-a-string-instead-of-json-to-the-webhook/313833 "2022-09-08T19:18:13Z")
Hey there! First of all, I'd like to describe my situation. I have an Elastic Rule, that successfully creates the Alerts in the Elastic Security. Now I have configured a connector, that allows me to send those Alerts to… --- ## [Strigo lab has ended but haven't finished the course](https://discuss.elastic.co/t/strigo-lab-has-ended-but-havent-finished-the-course/314012)
**Author:** [@jbalandranocoro-goda](https://discuss.elastic.co/u/jbalandranocoro-goda)\ **Replies:** 1\ **Last updated:** [September 8, 2022, 7:04pm UTC](https://discuss.elastic.co/t/strigo-lab-has-ended-but-havent-finished-the-course/314012 "2022-09-08T19:04:42Z")
Hi, I'm trying to finish a course in elasticsearch training but when I go to the strigo lab it says "this course has ended" and I have no way to restart it. Can anyone help me with this? Thanks1 --- ## [Permissions error for creating a Enrich (.enrich-\*) index after following docs](https://discuss.elastic.co/t/permissions-error-for-creating-a-enrich-enrich-index-after-following-docs/314014)
**Author:** [@Madhav\_Sharma](https://discuss.elastic.co/u/Madhav_Sharma)\ **Replies:** 2\ **Last updated:** [September 8, 2022, 6:47pm UTC](https://discuss.elastic.co/t/permissions-error-for-creating-a-enrich-enrich-index-after-following-docs/314014 "2022-09-08T18:47:54Z")
I tied using the dev\_tools console to create a .enrich-\* index and i got: "action \[indices:admin/create\] is unauthorized for user \[foo@bar.com\] with roles \[superuser\] on restricted indices \[.enrich-foobar\], this action… --- ## [Logstash remove N/A field](https://discuss.elastic.co/t/logstash-remove-n-a-field/314002)
**Author:** [@mleg](https://discuss.elastic.co/u/mleg)\ **Replies:** 1\ **Last updated:** [September 8, 2022, 6:29pm UTC](https://discuss.elastic.co/t/logstash-remove-n-a-field/314002 "2022-09-08T18:29:11Z")
I am trying to remove all the fields which have N/A next to the them like "toto: N/A", I am currently removing them with a enormous IF forest which I have hard coded but I would like a better alternative, to an enormous … --- ## [Redirecting stdout to /dev/null](https://discuss.elastic.co/t/redirecting-stdout-to-dev-null/313973)
**Author:** [@jatindavey](https://discuss.elastic.co/u/jatindavey)\ **Replies:** 2\ **Last updated:** [September 8, 2022, 6:02pm UTC](https://discuss.elastic.co/t/redirecting-stdout-to-dev-null/313973 "2022-09-08T18:02:57Z")
Hi I am not sure if this has already been discussed in the forums but i could not find a definitive help in this regard. Basically when i run logstash as a systemd service , whenever logstash gets log files for process… --- ## [Create visualization table horizontally aligned](https://discuss.elastic.co/t/create-visualization-table-horizontally-aligned/313529)
**Author:** [@Alice\_Ionescu](https://discuss.elastic.co/u/Alice_Ionescu)\ **Replies:** 1\ **Last updated:** [September 8, 2022, 5:56pm UTC](https://discuss.elastic.co/t/create-visualization-table-horizontally-aligned/313529 "2022-09-08T17:56:11Z")
Hello, Is there a possibility to create a new visualization to look like this: ||column\_name ||column\_value|| ||column\_name ||column\_value|| And display information only on a row from an index. Thanks! --- ## [Packetbeat not monitoring https protocol](https://discuss.elastic.co/t/packetbeat-not-monitoring-https-protocol/313766)
**Author:** [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)\ **Replies:** 1\ **Last updated:** [September 8, 2022, 5:50pm UTC](https://discuss.elastic.co/t/packetbeat-not-monitoring-https-protocol/313766 "2022-09-08T17:50:36Z")
Hello Environment detail - We are having Elasticsearch cluster running with secured http port 9200, 9201 & 9202 with version 8.3 We have installed packetbeat v8.3 on elasticsearch server to monitor the http traffic on… --- ## [Packetbeat recording high responce time for connections](https://discuss.elastic.co/t/packetbeat-recording-high-responce-time-for-connections/313772)
**Author:** [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)\ **Replies:** 3\ **Last updated:** [September 8, 2022, 5:24pm UTC](https://discuss.elastic.co/t/packetbeat-recording-high-responce-time-for-connections/313772 "2022-09-08T17:24:00Z")
Hello Environment detail - Packetbeat 8.3 installed on Elasticsearch 8.3 server to monitor the completed connections duration. where we want to know in what time duration the incoming query search connection got comple… --- ## [Elasticsearch get exited and shows unhealthy status in docker container](https://discuss.elastic.co/t/elasticsearch-get-exited-and-shows-unhealthy-status-in-docker-container/313931)
**Author:** [@paris1](https://discuss.elastic.co/u/paris1)\ **Replies:** 14\ **Last updated:** [September 8, 2022, 5:06pm UTC](https://discuss.elastic.co/t/elasticsearch-get-exited-and-shows-unhealthy-status-in-docker-container/313931 "2022-09-08T17:06:49Z")
I Run Elasticsearch on docker production on aws ec2(ubuntu).It was working fine.my elasticsearch got exited today after I updated an index I started again manually.after this the status of the containers changed to unhea… --- ## [Filebeat not sending/error sending data to logstash](https://discuss.elastic.co/t/filebeat-not-sending-error-sending-data-to-logstash/314005)
**Author:** [@alex\_96](https://discuss.elastic.co/u/alex_96)\ **Replies:** 0\ **Last updated:** [September 8, 2022, 3:14pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-error-sending-data-to-logstash/314005 "2022-09-08T15:14:49Z")
Hello, I'm trying to send mysql logs to logstash, initially there was only logstash configuration, but I ran into the fact that filebeat sent messages in encoded form, so I had to redo the filebeat config, here it is: #… --- ## [Domain Name Configuration with Docker on EC2](https://discuss.elastic.co/t/domain-name-configuration-with-docker-on-ec2/313824)
**Author:** [@tchocky](https://discuss.elastic.co/u/tchocky)\ **Replies:** 5\ **Last updated:** [September 8, 2022, 3:02pm UTC](https://discuss.elastic.co/t/domain-name-configuration-with-docker-on-ec2/313824 "2022-09-08T15:02:27Z")
Hi - I am testing the deployment of an Enterprise Search stack to an EC2 using the docker-compose example outlined here. The stack runs great on the EC2 and I can access everything if I hit the EC2 IP address directly. T… --- ## [App search - Multi term synonyms](https://discuss.elastic.co/t/app-search-multi-term-synonyms/313775)
**Author:** [@Gerardo\_Zenobi](https://discuss.elastic.co/u/Gerardo_Zenobi)\ **Replies:** 3\ **Last updated:** [September 8, 2022, 2:57pm UTC](https://discuss.elastic.co/t/app-search-multi-term-synonyms/313775 "2022-09-08T14:57:23Z")
Hi there :wave: I got the impression that Multi term synonyms are not currently supported by App Search ? Or is there a special way of configuring this ? My example use case: ai =\> machine learning This was matching d… --- ## [Field missing when select Top Hit on Y-axis for bar chart](https://discuss.elastic.co/t/field-missing-when-select-top-hit-on-y-axis-for-bar-chart/313442)
**Author:** [@siwapong.cha](https://discuss.elastic.co/u/siwapong.cha)\ **Replies:** 3\ **Last updated:** [September 8, 2022, 2:22pm UTC](https://discuss.elastic.co/t/field-missing-when-select-top-hit-on-y-axis-for-bar-chart/313442 "2022-09-08T14:22:44Z")
Hi all, I'm trying to use Top Hit on my bar chart but many fields are missing from the field selection. Below are my custom field which came from filebeat (ansible.xxxxxx) Here when I selected Top Hit, all my ansi… --- ## [Closing index and memory missing warning?](https://discuss.elastic.co/t/closing-index-and-memory-missing-warning/313993)
**Author:** [@ewolfman](https://discuss.elastic.co/u/ewolfman)\ **Replies:** 2\ **Last updated:** [September 8, 2022, 2:14pm UTC](https://discuss.elastic.co/t/closing-index-and-memory-missing-warning/313993 "2022-09-08T14:14:23Z")
Continuing the discussion from Does close index free up disk or memory: Maybe this warning about losing data ("To reduce the risk of data loss..." Open / Close Index API | Elasticsearch Guide \[6.8\] | Elastic) from 6.8 d… --- ## [Prometheus metrics coming in slowly](https://discuss.elastic.co/t/prometheus-metrics-coming-in-slowly/313921)
**Author:** [@Renato\_D](https://discuss.elastic.co/u/Renato_D)\ **Replies:** 2\ **Last updated:** [September 8, 2022, 1:47pm UTC](https://discuss.elastic.co/t/prometheus-metrics-coming-in-slowly/313921 "2022-09-08T13:47:05Z")
I'm not entirely sure what is causing this. autodiscover is configured like so: - type: kubernetes include\_annotations: \["prometheus.io.scrape", "prometheus.io.port"\] resource: service templates: - condition:… --- ## [Kibana - does not highlight search results](https://discuss.elastic.co/t/kibana-does-not-highlight-search-results/312806)
**Author:** [@elkuser1234](https://discuss.elastic.co/u/elkuser1234)\ **Replies:** 1\ **Last updated:** [September 8, 2022, 1:29pm UTC](https://discuss.elastic.co/t/kibana-does-not-highlight-search-results/312806 "2022-09-08T13:29:26Z")
Hello I don't understand why when searching through kibana, it doesn't highlight the result for the log\_message field. "log\_message" is the parsed "message" field, by grok. I can only assume that the kibana is not … --- ## [Logstash: filter unique key documents](https://discuss.elastic.co/t/logstash-filter-unique-key-documents/313880)
**Author:** [@Moshe\_Sharon1](https://discuss.elastic.co/u/Moshe_Sharon1)\ **Replies:** 4\ **Last updated:** [September 8, 2022, 1:08pm UTC](https://discuss.elastic.co/t/logstash-filter-unique-key-documents/313880 "2022-09-08T13:08:37Z")
Hello, We have an index which has multiple documents with the same phone number. Each document will always contain the phone number and may contain additional information (see example below) The documents are written … [Previous page](https://discuss.elastic.co/latest.md?page=972) [Next page](https://discuss.elastic.co/latest.md?page=974)