# Latest **URL:** https://discuss.elastic.co/latest.md?page=984 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 985 --- ## [Shutting down Elastic Agent and sending last events](https://discuss.elastic.co/t/shutting-down-elastic-agent-and-sending-last-events/313347)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 2\ **Last updated:** [September 1, 2022, 1:21pm UTC](https://discuss.elastic.co/t/shutting-down-elastic-agent-and-sending-last-events/313347 "2022-09-01T13:21:45Z")
Hi There, in a fresh / one node vm 7.17.4 with elasticsearch / Kibana / Logstash running I went to Fleet-\>agent to try for the first time this new tech. I go step by step with what is written here Add a Fleet Server | … --- ## [Any Elastic Stack tutors around this weekend?](https://discuss.elastic.co/t/any-elastic-stack-tutors-around-this-weekend/312526)
**Author:** [@Yolanda.darricarrere](https://discuss.elastic.co/u/Yolanda.darricarrere)\ **Replies:** 2\ **Last updated:** [September 1, 2022, 1:09pm UTC](https://discuss.elastic.co/t/any-elastic-stack-tutors-around-this-weekend/312526 "2022-09-01T13:09:31Z")
Seeking tutor for an hour or two ($50/hr?) - I'm EST time but flexible on time (today thru Mon.) --- ## [Parsing JSON data](https://discuss.elastic.co/t/parsing-json-data/313217)
**Author:** [@Pukar](https://discuss.elastic.co/u/Pukar)\ **Replies:** 4\ **Last updated:** [September 1, 2022, 12:54pm UTC](https://discuss.elastic.co/t/parsing-json-data/313217 "2022-09-01T12:54:58Z")
Hi Team, New to ELK environment so please bear with me. I'm trying to ingest data from json file and visualise in kibana. The ingest itself is working but the message is coming as: "message" =\> " "totalCount": … --- ## [Headless or GUI](https://discuss.elastic.co/t/headless-or-gui/313407)
**Author:** [@Technolust](https://discuss.elastic.co/u/Technolust)\ **Replies:** 2\ **Last updated:** [September 1, 2022, 12:31pm UTC](https://discuss.elastic.co/t/headless-or-gui/313407 "2022-09-01T12:31:29Z")
Setting up an Elastic Cluster using Rocky Linux 9. I have three servers planned to start. 1 Elasticsearch, 1 Kibana, 1 Logstash. The question I can’t find an answer to is do I need to install Rocky Server with GUI on any… --- ## [Performance issues when indexing data](https://discuss.elastic.co/t/performance-issues-when-indexing-data/313187)
**Author:** [@Sadia\_Mukhtar](https://discuss.elastic.co/u/Sadia_Mukhtar)\ **Replies:** 6\ **Last updated:** [September 1, 2022, 12:29pm UTC](https://discuss.elastic.co/t/performance-issues-when-indexing-data/313187 "2022-09-01T12:29:46Z")
Hi there, In our application we decided to use elasticsearch create a daily snapshot of some critical application data for visualizations. We have about 700K documents that will inserted into one of our index on daily … --- ## [Log4j2.properties configuration for elasticsearch](https://discuss.elastic.co/t/log4j2-properties-configuration-for-elasticsearch/313443)
**Author:** [@irivas95](https://discuss.elastic.co/u/irivas95)\ **Replies:** 0\ **Last updated:** [September 1, 2022, 12:24pm UTC](https://discuss.elastic.co/t/log4j2-properties-configuration-for-elasticsearch/313443 "2022-09-01T12:24:34Z")
Hi, I am trying to configure a log policy based on the IfAccumulatedFileSize property reducing the default 2GB to 50MB because I already have too many logs in my folder. I have seen that the folder where I have the logs… --- ## [Ingest pipeline buffer for incoming documents](https://discuss.elastic.co/t/ingest-pipeline-buffer-for-incoming-documents/313438)
**Author:** [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\ **Replies:** 2\ **Last updated:** [September 1, 2022, 11:59am UTC](https://discuss.elastic.co/t/ingest-pipeline-buffer-for-incoming-documents/313438 "2022-09-01T11:59:14Z")
I am investigating using an ingest pipeline for one type of document for my cluster. I am wondering if I have a maintenance or upgrade window or even an unplanned outage does the ingest pipeline have a buffer for that do… --- ## [Start Service in Terminal](https://discuss.elastic.co/t/start-service-in-terminal/313429)
**Author:** [@Irwan\_Kurniawan](https://discuss.elastic.co/u/Irwan_Kurniawan)\ **Replies:** 1\ **Last updated:** [September 1, 2022, 11:57am UTC](https://discuss.elastic.co/t/start-service-in-terminal/313429 "2022-09-01T11:57:56Z")
When I installed elasticsearch in server and started it, it always shown this one. I already tried to reinstalled it and still happen. systemd-entrypoint\[1067640\]: /usr/share/elasticsearch/bin/systemd-entrypoint: 7: can… --- ## [ElasticSearch not starting - Main ERROR Null object returned for RollingFile in Appenders](https://discuss.elastic.co/t/elasticsearch-not-starting-main-error-null-object-returned-for-rollingfile-in-appenders/313437)
**Author:** [@afernandes](https://discuss.elastic.co/u/afernandes)\ **Replies:** 0\ **Last updated:** [September 1, 2022, 11:43am UTC](https://discuss.elastic.co/t/elasticsearch-not-starting-main-error-null-object-returned-for-rollingfile-in-appenders/313437 "2022-09-01T11:43:58Z")
Hi, I had installed Elasticsearch on a cluster of three Redhat 7.9 servers, but the service failed to start. When I check the elasticsearch status it's displayed several errors main ERROR Null object returned for Roll… --- ## [Logstash don't reach elasticsearch](https://discuss.elastic.co/t/logstash-dont-reach-elasticsearch/312311)
**Author:** [@SilasMuniz1](https://discuss.elastic.co/u/SilasMuniz1)\ **Replies:** 16\ **Last updated:** [September 1, 2022, 11:36am UTC](https://discuss.elastic.co/t/logstash-dont-reach-elasticsearch/312311 "2022-09-01T11:36:39Z")
Hi all, I set up an elasticsearch's cluster with 3 nodes. I deploy the first one e installed after kibana in the same VM(RHEL). It's work ok. With Xpack-security enable. elasticsearch.yml: Added other 2 nodes usin… --- ## [Should I merge my many indices into 1 and use ILM?](https://discuss.elastic.co/t/should-i-merge-my-many-indices-into-1-and-use-ilm/313421)
**Author:** [@kk123](https://discuss.elastic.co/u/kk123)\ **Replies:** 2\ **Last updated:** [September 1, 2022, 11:18am UTC](https://discuss.elastic.co/t/should-i-merge-my-many-indices-into-1-and-use-ilm/313421 "2022-09-01T11:18:18Z")
Hi, this question follows on from previous issues I've had Shards per node, Heap, 100% CPU....help please I have since updated to 7.15 and have reduced the number of shard per index to 2 (from 5) with 1 replica. The clu… --- ## [Template priority explanation](https://discuss.elastic.co/t/template-priority-explanation/311443)
**Author:** [@pestevao](https://discuss.elastic.co/u/pestevao)\ **Replies:** 3\ **Last updated:** [September 1, 2022, 11:11am UTC](https://discuss.elastic.co/t/template-priority-explanation/311443 "2022-09-01T11:11:10Z")
Hi all, I'm trying to change the number\_of\_replicas of some indexes, applying a loosely index\_patterns but... I'm struggling with priority. If I make a change on number\_of\_replicas and define a priority 1 on my new tem… --- ## [APM Event Logger does not read Flask parameters](https://discuss.elastic.co/t/apm-event-logger-does-not-read-flask-parameters/313433)
**Author:** [@papers\_hive](https://discuss.elastic.co/u/papers_hive)\ **Replies:** 0\ **Last updated:** [September 1, 2022, 10:49am UTC](https://discuss.elastic.co/t/apm-event-logger-does-not-read-flask-parameters/313433 "2022-09-01T10:49:07Z")
I am running a flask application with apm as an agent. I have configured my app as the following initially: app = Flask(\_\_name\_\_) APM\_DICTIONARY = { 'SERVICE\_NAME': 'MY\_SERVICE\_NAME' , 'SERVER\_U… --- ## [Logstash Error : S3 input plugins](https://discuss.elastic.co/t/logstash-error-s3-input-plugins/313432)
**Author:** [@priyankamondalhcl](https://discuss.elastic.co/u/priyankamondalhcl)\ **Replies:** 0\ **Last updated:** [September 1, 2022, 10:48am UTC](https://discuss.elastic.co/t/logstash-error-s3-input-plugins/313432 "2022-09-01T10:48:40Z")
Hi Team, I am using us3 input plugins which was connecting with S3 bucket and provided data to elasticsearch. but suddenly, It stopped working. My configuration input { s3 { "access\_key\_id" =\> "" "secret\_access\_key… --- ## [Cisco module IOS error on parsing logs](https://discuss.elastic.co/t/cisco-module-ios-error-on-parsing-logs/313431)
**Author:** [@it\_dev](https://discuss.elastic.co/u/it_dev)\ **Replies:** 0\ **Last updated:** [September 1, 2022, 10:34am UTC](https://discuss.elastic.co/t/cisco-module-ios-error-on-parsing-logs/313431 "2022-09-01T10:34:07Z")
There are Cisco IOS logs on local machine and filebeat installed on it. Sending that logs to Elasticsearch (Without Logstash). When I discover those logs, error message appears and logs are not parsed: \> GoError: could… --- ## [Roles with different access to index'ss](https://discuss.elastic.co/t/roles-with-different-access-to-indexss/312272)
**Author:** [@Barca88](https://discuss.elastic.co/u/Barca88)\ **Replies:** 2\ **Last updated:** [September 1, 2022, 10:07am UTC](https://discuss.elastic.co/t/roles-with-different-access-to-indexss/312272 "2022-09-01T10:07:19Z")
I am newbie with elastic and after watching some tutorials I started digging around and fund this: Is it possible with the free and open subscription, having different roles that can only access to a specific index a… --- ## [Ingest pipeline - format error](https://discuss.elastic.co/t/ingest-pipeline-format-error/313419)
**Author:** [@elkuser1234](https://discuss.elastic.co/u/elkuser1234)\ **Replies:** 0\ **Last updated:** [September 1, 2022, 8:14am UTC](https://discuss.elastic.co/t/ingest-pipeline-format-error/313419 "2022-09-01T08:14:58Z")
Hello I create ingest pipeline, i have an error: Field \[event.created\] of type \[keyword\] doesn't support formats. My log: - 10.10.10.11 - \[01/Sep/2022:07:48:00 +0100\] "- - " 100 - "-" "-" My ingest: \[ { "pip… --- ## [Can't get any other state on a process exept Running state on Metricbeat](https://discuss.elastic.co/t/cant-get-any-other-state-on-a-process-exept-running-state-on-metricbeat/313428)
**Author:** [@Mor123460](https://discuss.elastic.co/u/Mor123460)\ **Replies:** 0\ **Last updated:** [September 1, 2022, 9:39am UTC](https://discuss.elastic.co/t/cant-get-any-other-state-on-a-process-exept-running-state-on-metricbeat/313428 "2022-09-01T09:39:49Z")
Hey :slight\_smile: I can't get any other state on a process exept Running state on Metricbeat. According to the documents it's said that it can give you the state of the process under the module SYSTEM and under the me… --- ## [Logstash unable to decode Cisco protobuf](https://discuss.elastic.co/t/logstash-unable-to-decode-cisco-protobuf/313424)
**Author:** [@Siddarajgj](https://discuss.elastic.co/u/Siddarajgj)\ **Replies:** 0\ **Last updated:** [September 1, 2022, 9:13am UTC](https://discuss.elastic.co/t/logstash-unable-to-decode-cisco-protobuf/313424 "2022-09-01T09:13:53Z")
Hoping someone has configured logstash to receive Cisco telemetry before, I'm able to receive the events but can't decode the telemetry. I'm getting the folowing error from logstash: \[2022-09-01T09:01:23,341\]\[WARN \]\[lo… --- ## [Failed to create query: Score function should not be null](https://discuss.elastic.co/t/failed-to-create-query-score-function-should-not-be-null/313268)
**Author:** [@Sarit\_Ghosh](https://discuss.elastic.co/u/Sarit_Ghosh)\ **Replies:** 1\ **Last updated:** [September 1, 2022, 9:09am UTC](https://discuss.elastic.co/t/failed-to-create-query-score-function-should-not-be-null/313268 "2022-09-01T09:09:59Z")
We are trying to move from ES 6.8 to ES 7.17. On an ES query we are getting the following error (the same query was working fine in ES 6.8): When I try Kibana also, I get the same error: "root\_cause": \[ { "type": "qu… --- ## [Autodetect\_column\_name with 2 different CSV](https://discuss.elastic.co/t/autodetect-column-name-with-2-different-csv/313310)
**Author:** [@EliottB](https://discuss.elastic.co/u/EliottB)\ **Replies:** 4\ **Last updated:** [September 1, 2022, 8:37am UTC](https://discuss.elastic.co/t/autodetect-column-name-with-2-different-csv/313310 "2022-09-01T08:37:16Z")
Hello all, I have an issue with the autodetect\_column\_name of my pipeline below: filter { csv { separator =\>"," autodetect\_column\_names =\> true } When I process the first CSV message country,city,name… --- ## [APM .net agent see the Service Name in the logs for correlated transactions](https://discuss.elastic.co/t/apm-net-agent-see-the-service-name-in-the-logs-for-correlated-transactions/311137)
**Author:** [@Nicolas\_Rey](https://discuss.elastic.co/u/Nicolas_Rey)\ **Replies:** 14\ **Last updated:** [September 1, 2022, 8:17am UTC](https://discuss.elastic.co/t/apm-net-agent-see-the-service-name-in-the-logs-for-correlated-transactions/311137 "2022-09-01T08:17:09Z")
Kibana version: 7.16.3 (Docker) Elasticsearch version: 7.16.3 (Docker) APM Server version: 7.16.3 (Docker) APM Agent language and version: .net \ **Author:** [@Martin\_Braendle](https://discuss.elastic.co/u/Martin_Braendle)\ **Replies:** 2\ **Last updated:** [September 1, 2022, 8:10am UTC](https://discuss.elastic.co/t/bug-drilldowns-do-not-take-over-values-from-controls/313349 "2022-09-01T08:10:18Z") Elasticsearch / Kibana 8.3.3 I've replaced the Input Control Visualisations (that were outlined as deprecated) with the new controls. However, a drilldown does not take over the values that have been set by a control,… --- ## [Elasticsearch error after upgrade "can not run elasticsearch as root"](https://discuss.elastic.co/t/elasticsearch-error-after-upgrade-can-not-run-elasticsearch-as-root/312632)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 3\ **Last updated:** [September 1, 2022, 7:48am UTC](https://discuss.elastic.co/t/elasticsearch-error-after-upgrade-can-not-run-elasticsearch-as-root/312632 "2022-09-01T07:48:43Z")
Hello team, I have update my elasticsearch data node from 7,16,3 to 7.17.5. But it is through below error. Can you please help on same.. All files running as root.elasticsearch \[2022-08-22T18:26:40,213\]\[ERROR\]\[o.e.b… --- ## [Elasticsearch\_1 exited with code 1](https://discuss.elastic.co/t/elasticsearch-1-exited-with-code-1/313416)
**Author:** [@boot4root](https://discuss.elastic.co/u/boot4root)\ **Replies:** 1\ **Last updated:** [September 1, 2022, 7:43am UTC](https://discuss.elastic.co/t/elasticsearch-1-exited-with-code-1/313416 "2022-09-01T07:43:46Z")
Hello, when I try to run elasticsearch and kibana through docker-compose, I get the following error. Elasticsearch\_1 exited with code 1 Here is manual with this settings. Elastiflow I tried different versions, I also… --- ## [Monitor kibana using metricbeat](https://discuss.elastic.co/t/monitor-kibana-using-metricbeat/313384)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 4\ **Last updated:** [September 1, 2022, 7:37am UTC](https://discuss.elastic.co/t/monitor-kibana-using-metricbeat/313384 "2022-09-01T07:37:32Z")
Hi Experts, I using ELK 7.16.2v. I am doing a cluster stack monitoring using metricbeat. I have installed metricbeat on kibana server and enable the kibana-xpack module , disbale the system module. Confgure kibana-xpa… --- ## [MetricBeat is not sending Kubernets node pods etc data but getting system information](https://discuss.elastic.co/t/metricbeat-is-not-sending-kubernets-node-pods-etc-data-but-getting-system-information/313415)
**Author:** [@saifulshihab](https://discuss.elastic.co/u/saifulshihab)\ **Replies:** 0\ **Last updated:** [September 1, 2022, 7:00am UTC](https://discuss.elastic.co/t/metricbeat-is-not-sending-kubernets-node-pods-etc-data-but-getting-system-information/313415 "2022-09-01T07:00:12Z")
Hellow I configured metric beat to minitor kubernets cluster node pods deployments. But it is not working as documents. How to check what is the missing in my configuration. I need to troubleshoot the issue. But there … --- ## [Multiple Nested JSON Formats parsing with Logstash](https://discuss.elastic.co/t/multiple-nested-json-formats-parsing-with-logstash/313414)
**Author:** [@Prateek\_Kumar\_Saini](https://discuss.elastic.co/u/Prateek_Kumar_Saini)\ **Replies:** 0\ **Last updated:** [September 1, 2022, 6:59am UTC](https://discuss.elastic.co/t/multiple-nested-json-formats-parsing-with-logstash/313414 "2022-09-01T06:59:14Z")
Hello everyone, I am trying to ingest multiple logs into my logstash. The input type is a JSON (Nested Jsons), but the formats are varying. For example, JSON 1) 1|2|3|4|{"event-ts":"07-07-2022 17:42:55.294","event-na… --- ## [Preloading all documents to filesystem cache](https://discuss.elastic.co/t/preloading-all-documents-to-filesystem-cache/313381)
**Author:** [@9guar1](https://discuss.elastic.co/u/9guar1)\ **Replies:** 2\ **Last updated:** [September 1, 2022, 6:51am UTC](https://discuss.elastic.co/t/preloading-all-documents-to-filesystem-cache/313381 "2022-09-01T06:51:12Z")
Hi community, Is there any possibility to preload all documents to the filesystem cache using 'index.store.preload' to increase search perfomance of the fetch phase? Search query is below: POST /structure/\_search?type… --- ## [Kibana server is not ready yet, error : Unable to get issuer certificate](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-error-unable-to-get-issuer-certificate/313218)
**Author:** [@Florian-LB](https://discuss.elastic.co/u/Florian-LB)\ **Replies:** 2\ **Last updated:** [September 1, 2022, 6:47am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-error-unable-to-get-issuer-certificate/313218 "2022-09-01T06:47:47Z")
Hello, I’ve been struggling for some time with the SSL configuration of Kibana. I need to set the elasticsearch.ssl.verificationMode on "full" or on "certificate" but Kibana is only working in "none". When I start the… [Previous page](https://discuss.elastic.co/latest.md?page=983) [Next page](https://discuss.elastic.co/latest.md?page=985)