# Latest **URL:** https://discuss.elastic.co/latest.md?page=982 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 983 --- ## [How to recover from split log messages](https://discuss.elastic.co/t/how-to-recover-from-split-log-messages/313579)
**Author:** [@bobus](https://discuss.elastic.co/u/bobus)\ **Replies:** 3\ **Last updated:** [September 2, 2022, 10:20pm UTC](https://discuss.elastic.co/t/how-to-recover-from-split-log-messages/313579 "2022-09-02T22:20:47Z")
There appears to be a years-long-standing issue with large ( longer than 16KB) messages getting split into parts and appearing on Kibana in multiple lines. Such long messages typically include Java exception stack traces… --- ## [Filebeat/Logstash Apache Access Logs timestamp issue](https://discuss.elastic.co/t/filebeat-logstash-apache-access-logs-timestamp-issue/313278)
**Author:** [@SirStephanikus](https://discuss.elastic.co/u/SirStephanikus)\ **Replies:** 8\ **Last updated:** [September 2, 2022, 8:24pm UTC](https://discuss.elastic.co/t/filebeat-logstash-apache-access-logs-timestamp-issue/313278 "2022-09-02T20:24:38Z")
Hello everyone I'm new to the ELK world and need some help with a basic Apache HTTP filebeat -\> logstash -\> Elasticsearch \<- Kibana filter/pipeline for learning purposes. Version: 8.3.3 Problem: A dummy apache acce… --- ## [Whether CCR and reindex from remote are same?](https://discuss.elastic.co/t/whether-ccr-and-reindex-from-remote-are-same/313106)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 4\ **Last updated:** [September 2, 2022, 7:08pm UTC](https://discuss.elastic.co/t/whether-ccr-and-reindex-from-remote-are-same/313106 "2022-09-02T19:08:44Z")
Whether CCR and reindex from remote are same? --- ## [Upgrading from ECK 0.9.0](https://discuss.elastic.co/t/upgrading-from-eck-0-9-0/313580)
**Author:** [@charles3](https://discuss.elastic.co/u/charles3)\ **Replies:** 0\ **Last updated:** [September 2, 2022, 6:14pm UTC](https://discuss.elastic.co/t/upgrading-from-eck-0-9-0/313580 "2022-09-02T18:14:46Z")
Is there a guide for upgrading from ECK 0.9.0 to 1.0.0-beta1? I've followed the Upgrade Guide and it always results in the deletion of the persistent volumes and, ultimately, the loss of data. In the last test that I r… --- ## [CCR - 7.14 to 8.0/8.x version](https://discuss.elastic.co/t/ccr-7-14-to-8-0-8-x-version/312644)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 2\ **Last updated:** [September 2, 2022, 5:45pm UTC](https://discuss.elastic.co/t/ccr-7-14-to-8-0-8-x-version/312644 "2022-09-02T17:45:52Z")
Is it possible to have a CCR to new 8.0 elasticsearch cluster from existing 7.14 version elasticsearch cluster (Remote Cluster)? or the existing 7.14 version cluster needs to be upgraded to 7.17 vesrion first? --- ## [Error starting Logstash](https://discuss.elastic.co/t/error-starting-logstash/313470)
**Author:** [@steevhise](https://discuss.elastic.co/u/steevhise)\ **Replies:** 6\ **Last updated:** [September 2, 2022, 4:06pm UTC](https://discuss.elastic.co/t/error-starting-logstash/313470 "2022-09-02T16:06:58Z")
Logstash is exiting with an error when starting up: \[ERROR\] 2022-09-01 17:35:32.473 \[Converge PipelineAction::Create\\] agent - Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :… --- ## [Unable to pass Azure snapshot repository Setting "client" in java API](https://discuss.elastic.co/t/unable-to-pass-azure-snapshot-repository-setting-client-in-java-api/313558)
**Author:** [@irene\_ghafari](https://discuss.elastic.co/u/irene_ghafari)\ **Replies:** 0\ **Last updated:** [September 2, 2022, 2:10pm UTC](https://discuss.elastic.co/t/unable-to-pass-azure-snapshot-repository-setting-client-in-java-api/313558 "2022-09-02T14:10:45Z")
Hello :slight\_smile: I want to register an Azure repository for Elasticsearch snapshot restoration, from a client other than default. It mentions in the documentation that I should set the client in repository settings.… --- ## [Multiple ELK Clusters and one Global web FrontEnd](https://discuss.elastic.co/t/multiple-elk-clusters-and-one-global-web-frontend/313473)
**Author:** [@lcui\_dxc](https://discuss.elastic.co/u/lcui_dxc)\ **Replies:** 3\ **Last updated:** [September 2, 2022, 2:06pm UTC](https://discuss.elastic.co/t/multiple-elk-clusters-and-one-global-web-frontend/313473 "2022-09-02T14:06:29Z")
Hello there: We have a client, they sell goods globally and wanted to use Elasticsearch as Search Engine. They have their databases in one region but wanted the search performance fast in multiple regions (Europe, Nort… --- ## [Logstash multiline codec do not read all lines](https://discuss.elastic.co/t/logstash-multiline-codec-do-not-read-all-lines/313542)
**Author:** [@alex\_96](https://discuss.elastic.co/u/alex_96)\ **Replies:** 2\ **Last updated:** [September 2, 2022, 1:33pm UTC](https://discuss.elastic.co/t/logstash-multiline-codec-do-not-read-all-lines/313542 "2022-09-02T13:33:33Z")
Hi I'm using multiline codec to concatenate lines into one event, here's an example of it: # Time: 2022-08-29T07:43:30.314166Z # User@Host: root\[root\] @ 1.1.1.1. \[\] Id: 111111 # Query\_time: 0.019870 Lock\_time: 0.00000… --- ## [Ingest data from Relational DB to Elasticsearch](https://discuss.elastic.co/t/ingest-data-from-relational-db-to-elasticsearch/313376)
**Author:** [@lcui\_dxc](https://discuss.elastic.co/u/lcui_dxc)\ **Replies:** 9\ **Last updated:** [September 2, 2022, 1:14pm UTC](https://discuss.elastic.co/t/ingest-data-from-relational-db-to-elasticsearch/313376 "2022-09-02T13:14:49Z")
Hello there: We are building a search engine with Elastic, the source data is on a relational DB. We need to ingest data from the DB to Elasticsearch. We know it is doable using JDBC Input Plugin on Logstash to ingest d… --- ## [Manipulate score by field integer value](https://discuss.elastic.co/t/manipulate-score-by-field-integer-value/313553)
**Author:** [@frankmehlhop.com](https://discuss.elastic.co/u/frankmehlhop.com)\ **Replies:** 0\ **Last updated:** [September 2, 2022, 12:21pm UTC](https://discuss.elastic.co/t/manipulate-score-by-field-integer-value/313553 "2022-09-02T12:21:57Z")
I use Elastic for searching pdf's. One of the fields apart of the pdf-content is doridat, what is a date as integer. The newest documents should get a higher score (higher ranking). This means that the higher the value i… --- ## [Disk Usage problem](https://discuss.elastic.co/t/disk-usage-problem/313543)
**Author:** [@Medel](https://discuss.elastic.co/u/Medel)\ **Replies:** 14\ **Last updated:** [September 2, 2022, 12:20pm UTC](https://discuss.elastic.co/t/disk-usage-problem/313543 "2022-09-02T12:20:48Z")
Hello! I have a strange issue in my elasticsearch cluster So I have 3 nodes, and each node server has 300gb disk space on it But it showed that only 20gb is available. How I can add more space to the nodes? --- ## [How to Increase checkpoint interval in azure event Hub logstash](https://discuss.elastic.co/t/how-to-increase-checkpoint-interval-in-azure-event-hub-logstash/313548)
**Author:** [@karthik\_Ravichandran](https://discuss.elastic.co/u/karthik_Ravichandran)\ **Replies:** 0\ **Last updated:** [September 2, 2022, 11:46am UTC](https://discuss.elastic.co/t/how-to-increase-checkpoint-interval-in-azure-event-hub-logstash/313548 "2022-09-02T11:46:38Z")
input { azure\_event\_hubs { event\_hub\_connections =\> \["${CLCEHPRIMARYCONNECTIONSTRING};EntityPath=cef"\] storage\_connection =\> "${CLCSTORAGEPRIMARYENDPOINT}" checkpoint\_interval =\> 60 storage\_container =\> "offsets-par… --- ## [Filebeat not reading logs on Kubernetes](https://discuss.elastic.co/t/filebeat-not-reading-logs-on-kubernetes/313545)
**Author:** [@shivendra95](https://discuss.elastic.co/u/shivendra95)\ **Replies:** 0\ **Last updated:** [September 2, 2022, 11:15am UTC](https://discuss.elastic.co/t/filebeat-not-reading-logs-on-kubernetes/313545 "2022-09-02T11:15:30Z")
Hi I'm trying to use filebeat as sidecar to one of my pods in our kubernetes clusyer. Below is the configmap that I'm using apiVersion: v1 kind: ConfigMap metadata: name: filebeat-configmap-dev namespace: dev data:… --- ## [Using upsert to update existing record base on value in fields](https://discuss.elastic.co/t/using-upsert-to-update-existing-record-base-on-value-in-fields/313494)
**Author:** [@nookseal](https://discuss.elastic.co/u/nookseal)\ **Replies:** 1\ **Last updated:** [September 2, 2022, 10:15am UTC](https://discuss.elastic.co/t/using-upsert-to-update-existing-record-base-on-value-in-fields/313494 "2022-09-02T10:15:43Z")
Hi all, Currently I'm trying to manage the Elasticsearch records from Filebeat which came from bash script and write to CSV file for each execute, then Filebeat collect log from CSV file. Below are example of header(no… --- ## [Problem handling null value with jdbc\_streaming filter](https://discuss.elastic.co/t/problem-handling-null-value-with-jdbc-streaming-filter/313538)
**Author:** [@Kowsalya\_Mouttou](https://discuss.elastic.co/u/Kowsalya_Mouttou)\ **Replies:** 0\ **Last updated:** [September 2, 2022, 10:20am UTC](https://discuss.elastic.co/t/problem-handling-null-value-with-jdbc-streaming-filter/313538 "2022-09-02T10:20:05Z")
Hi, here is my filter plugin in logsatsh configuration : filter { jdbc\_streaming { jdbc\_driver\_library =\> "/usr/share/logstash/logstash-core/lib/jars/postgresql-42.2.6.jar" jdbc\_driver\_class =\> "org.postgre… --- ## [Don’t see logs in kibana stack monitoring](https://discuss.elastic.co/t/don-t-see-logs-in-kibana-stack-monitoring/311914)
**Author:** [@cheshirecat](https://discuss.elastic.co/u/cheshirecat)\ **Replies:** 21\ **Last updated:** [September 2, 2022, 10:06am UTC](https://discuss.elastic.co/t/don-t-see-logs-in-kibana-stack-monitoring/311914 "2022-09-02T10:06:58Z")
Hello There! I have seen similar topic but it is closed for two years. I can not see STRUCTURED LOGS in Kibana. I am using filebeat with module elasticsearch and this is module's config: # Module: elasticsearch # D… --- ## [One index shows red status](https://discuss.elastic.co/t/one-index-shows-red-status/313128)
**Author:** [@Shashi\_Prakash](https://discuss.elastic.co/u/Shashi_Prakash)\ **Replies:** 5\ **Last updated:** [September 2, 2022, 7:25am UTC](https://discuss.elastic.co/t/one-index-shows-red-status/313128 "2022-09-02T07:25:14Z")
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size red open hft-filebeat 2aHzkG-YRLODjaTR0IAErQ 1 0 Not sure why this shows red although have restarted … --- ## [Logstash giving error "Elasticsearch Unreachable](https://discuss.elastic.co/t/logstash-giving-error-elasticsearch-unreachable/313515)
**Author:** [@Amit\_sah](https://discuss.elastic.co/u/Amit_sah)\ **Replies:** 4\ **Last updated:** [September 2, 2022, 9:34am UTC](https://discuss.elastic.co/t/logstash-giving-error-elasticsearch-unreachable/313515 "2022-09-02T09:34:33Z")
\[2022-09-02T13:20:38,199\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main\] Attempted to resurrect connection to dead ES instance, but got an error {:url=\>"http://elastic:xxxxxx@localhost:9200/", :exception=\>LogStash::Outputs… --- ## [Monitoring AWS Lambda .Net runtimes with Elastic APM](https://discuss.elastic.co/t/monitoring-aws-lambda-net-runtimes-with-elastic-apm/313531)
**Author:** [@javaripa](https://discuss.elastic.co/u/javaripa)\ **Replies:** 0\ **Last updated:** [September 2, 2022, 9:08am UTC](https://discuss.elastic.co/t/monitoring-aws-lambda-net-runtimes-with-elastic-apm/313531 "2022-09-02T09:08:40Z")
I'm interested in monitoring AWS Lambda Functions in .Net (.NET Core 3.1 & .NET 6). According to the following document, only Node.js, Python & Java is supported What is the recommended approach for my case? --- ## [Automating Email Whitelisting for Alerts (elasticsearch, kibana)](https://discuss.elastic.co/t/automating-email-whitelisting-for-alerts-elasticsearch-kibana/313369)
**Author:** [@Hayden\_WB](https://discuss.elastic.co/u/Hayden_WB)\ **Replies:** 10\ **Last updated:** [September 2, 2022, 8:33am UTC](https://discuss.elastic.co/t/automating-email-whitelisting-for-alerts-elasticsearch-kibana/313369 "2022-09-02T08:33:11Z")
Hi folks! We are trying to achieve observability for a large organisation, and we now have users creating alerts in various elastic deployments. We have recently learned that, in order to receive the email alerts our us… --- ## [K8s dashboard giving bad gateway](https://discuss.elastic.co/t/k8s-dashboard-giving-bad-gateway/313001)
**Author:** [@sandeep\_kumar5](https://discuss.elastic.co/u/sandeep_kumar5)\ **Replies:** 2\ **Last updated:** [September 2, 2022, 8:25am UTC](https://discuss.elastic.co/t/k8s-dashboard-giving-bad-gateway/313001 "2022-09-02T08:25:27Z")
Hi everyone I have deployed kibana with xpack using helm chart on on premises k8s cluster. I have used traefik as load balancer. Without xpack I am able to get kibana ui running on private hostname but with xpack I am n… --- ## [Update by query not work on linux terminal but work on devtool UI](https://discuss.elastic.co/t/update-by-query-not-work-on-linux-terminal-but-work-on-devtool-ui/313517)
**Author:** [@siwapong.cha](https://discuss.elastic.co/u/siwapong.cha)\ **Replies:** 1\ **Last updated:** [September 2, 2022, 8:21am UTC](https://discuss.elastic.co/t/update-by-query-not-work-on-linux-terminal-but-work-on-devtool-ui/313517 "2022-09-02T08:21:48Z")
I'm doing the update by query and it's work well on the devtool UI Screenshot below But when I did the same thing on linux terminal curl -X POST -k -u myusername:mypassword "https://localhost:9200/my-index/\_update\_… --- ## [If filebeat is deployed with single instance then no issue is observed in multiline handling. If Filebeat is deployed with daemonset then all events does not follow proper multiline pattern thus results in individual events. Is there any bug reported?](https://discuss.elastic.co/t/if-filebeat-is-deployed-with-single-instance-then-no-issue-is-observed-in-multiline-handling-if-filebeat-is-deployed-with-daemonset-then-all-events-does-not-follow-proper-multiline-pattern-thus-results-in-individual-events-is-there-any-bug-reported/313141)
**Author:** [@Chitra1](https://discuss.elastic.co/u/Chitra1)\ **Replies:** 2\ **Last updated:** [September 2, 2022, 7:37am UTC](https://discuss.elastic.co/t/if-filebeat-is-deployed-with-single-instance-then-no-issue-is-observed-in-multiline-handling-if-filebeat-is-deployed-with-daemonset-then-all-events-does-not-follow-proper-multiline-pattern-thus-results-in-individual-events-is-there-any-bug-reported/313141 "2022-09-02T07:37:46Z")
If filebeat is deployed with single instance then no issue is observed in multiline handling. If Filebeat is deployed with daemonset then all events does not follow proper multiline pattern thus results in individual eve… --- ## [Elastic Agent already installed but not reporting to server](https://discuss.elastic.co/t/elastic-agent-already-installed-but-not-reporting-to-server/313503)
**Author:** [@Ashish10195](https://discuss.elastic.co/u/Ashish10195)\ **Replies:** 0\ **Last updated:** [September 2, 2022, 6:20am UTC](https://discuss.elastic.co/t/elastic-agent-already-installed-but-not-reporting-to-server/313503 "2022-09-02T06:20:07Z")
We have some servers in same environment with same Elastic Agent but not reporting to server .some are showing in Offline state and some are not showing anywhere .if we reinstall the Agent all the server will start showi… --- ## [Kafka Implementation](https://discuss.elastic.co/t/kafka-implementation/313241)
**Author:** [@Sarala\_C](https://discuss.elastic.co/u/Sarala_C)\ **Replies:** 2\ **Last updated:** [September 2, 2022, 6:12am UTC](https://discuss.elastic.co/t/kafka-implementation/313241 "2022-09-02T06:12:57Z")
We are Trying to Implement Kafka in our environment. So right now our Set up is like: Syslog Server(Logstash) --\> Event Hub --\> Azure VM Logstash --\> Azure VM Elasticsearch --\> Azure VM kibana. We want to place Kafka i… --- ## [Elasticsearch / Kibana showing different results](https://discuss.elastic.co/t/elasticsearch-kibana-showing-different-results/313498)
**Author:** [@AfricanHipp0](https://discuss.elastic.co/u/AfricanHipp0)\ **Replies:** 2\ **Last updated:** [September 2, 2022, 5:51am UTC](https://discuss.elastic.co/t/elasticsearch-kibana-showing-different-results/313498 "2022-09-02T05:51:51Z")
Hi all, Just wondering if anyone can provide me some guidance. I have Elasticsearch/Kibana running on a Ubuntu Server VM. My goal is to monitor Windows machines in my homelab. I've installed Winlogbeat on one of the Win… --- ## [More than 90 days records unable to set the time](https://discuss.elastic.co/t/more-than-90-days-records-unable-to-set-the-time/312078)
**Author:** [@muthusundar.p](https://discuss.elastic.co/u/muthusundar.p)\ **Replies:** 4\ **Last updated:** [September 2, 2022, 3:39am UTC](https://discuss.elastic.co/t/more-than-90-days-records-unable-to-set-the-time/312078 "2022-09-02T03:39:06Z")
I trying to create an alert for more than 90 days of records for my audit purpose. I only see the "last" xx days in the option, but I need more than \> 90 days old data. Could you please help me with how to set it up? I t… --- ## [OTEL plugin error in sending data to APM server](https://discuss.elastic.co/t/otel-plugin-error-in-sending-data-to-apm-server/313027)
**Author:** [@senyam08](https://discuss.elastic.co/u/senyam08)\ **Replies:** 5\ **Last updated:** [September 2, 2022, 1:14am UTC](https://discuss.elastic.co/t/otel-plugin-error-in-sending-data-to-apm-server/313027 "2022-09-02T01:14:39Z")
We have verified Open-telemetry protocol data to APM server endpoint with elastic 7.16 version. We have migrated to 8.2 version and running Elasticsearch observability in kubernetes. APM agents are able to send the data … --- ## [Translate a CURL command into a HTTP filter request](https://discuss.elastic.co/t/translate-a-curl-command-into-a-http-filter-request/313403)
**Author:** [@Ygal\_Mizrachi](https://discuss.elastic.co/u/Ygal_Mizrachi)\ **Replies:** 2\ **Last updated:** [September 1, 2022, 10:28pm UTC](https://discuss.elastic.co/t/translate-a-curl-command-into-a-http-filter-request/313403 "2022-09-01T22:28:10Z")
Hello i need some help translating this CURL request into a http filter syntax curl -k -u username:password -X POST 'https://192.168.88.1/rest/tool/flood-ping' \\--data '{"address":"192.168.88.223","count":"12","interval… [Previous page](https://discuss.elastic.co/latest.md?page=981) [Next page](https://discuss.elastic.co/latest.md?page=983)