# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=799 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 800 --- ## [\_grokparsefailure on kibana for record through logstash](https://discuss.elastic.co/t/grokparsefailure-on-kibana-for-record-through-logstash/287073)
**Author:** [@kish2010](https://discuss.elastic.co/u/kish2010)\ **Replies:** 1\ **Last updated:** [October 19, 2021, 12:12pm UTC](https://discuss.elastic.co/t/grokparsefailure-on-kibana-for-record-through-logstash/287073 "2021-10-19T12:12:36Z")
Hi All, I have created grok pattern and tested with log on grokdebugger but still it is failing with grokparsefailure error on kibana. PFB Config file:- input { file { path =\> "/tmp/test.csv" } } filter { grok { … --- ## [Number of indices / shards in a cluster](https://discuss.elastic.co/t/number-of-indices-shards-in-a-cluster/287076)
**Author:** [@mmoreram](https://discuss.elastic.co/u/mmoreram)\ **Replies:** 2\ **Last updated:** [October 19, 2021, 12:11pm UTC](https://discuss.elastic.co/t/number-of-indices-shards-in-a-cluster/287076 "2021-10-19T12:11:02Z")
What is the number of indices and shards "allowed" in a cluster? How big should be a cluster to have 1000 indices, having each 1 shard and 1 replica, being each a ~2000 items index? Even a small one is recommended a 1Gb … --- ## [BitSet.or consumes almost 60% cpu](https://discuss.elastic.co/t/bitset-or-consumes-almost-60-cpu/286763)
**Author:** [@chembohuang](https://discuss.elastic.co/u/chembohuang)\ **Replies:** 23\ **Last updated:** [October 19, 2021, 11:25am UTC](https://discuss.elastic.co/t/bitset-or-consumes-almost-60-cpu/286763 "2021-10-19T11:25:40Z")
ES 7.7.1, jdk 14. We have two nodes with the same hardware(physical machine) under the same cluster which only hosts one index with 1 replica. Each node has the same shard. The weird thing is that, one of the machine'… --- ## [How to monitor cause of deletion of documents in index?](https://discuss.elastic.co/t/how-to-monitor-cause-of-deletion-of-documents-in-index/287052)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 3\ **Last updated:** [October 19, 2021, 9:36am UTC](https://discuss.elastic.co/t/how-to-monitor-cause-of-deletion-of-documents-in-index/287052 "2021-10-19T09:36:53Z")
Dears, Is there any way to monitor process of deletion of documents from index? I'm asking about it because of from few days I observed this odd behavior. Similar situation I had when doc id was the same for few docume… --- ## [Ubuntu 20.04 tar/zip installed - systemd timeout](https://discuss.elastic.co/t/ubuntu-20-04-tar-zip-installed-systemd-timeout/287000)
**Author:** [@imper86](https://discuss.elastic.co/u/imper86)\ **Replies:** 3\ **Last updated:** [October 19, 2021, 9:04am UTC](https://discuss.elastic.co/t/ubuntu-20-04-tar-zip-installed-systemd-timeout/287000 "2021-10-19T09:04:09Z")
Hello, I have a strange issue with a fresh tar/zip installation of Elasticsearch. When I use Elasticsearch v6 this way - there is no problem. Also apt installation works fine. But when I want to use systemd with Elastic… --- ## [Optimizing agg on collapse](https://discuss.elastic.co/t/optimizing-agg-on-collapse/287058)
**Author:** [@CarloKok](https://discuss.elastic.co/u/CarloKok)\ **Replies:** 0\ **Last updated:** [October 19, 2021, 8:24am UTC](https://discuss.elastic.co/t/optimizing-agg-on-collapse/287058 "2021-10-19T08:24:53Z")
I have an index with "availability" of rooms in a set of hotels. Each record has among other things: HotelCode RoomType arrival Date Departure Date Price for stay Bunch of room features to filter on The nr of records … --- ## [Coloring Metric aggregation based on String](https://discuss.elastic.co/t/coloring-metric-aggregation-based-on-string/286821)
**Author:** [@Cibot](https://discuss.elastic.co/u/Cibot)\ **Replies:** 3\ **Last updated:** [October 19, 2021, 8:14am UTC](https://discuss.elastic.co/t/coloring-metric-aggregation-based-on-string/286821 "2021-10-19T08:14:54Z")
I have been trying to create a dashboard with relevant information for a service. As such we display logs, uptime over time, errors, current state and so on. To make it easy to indicate whether a service is down, I wan… --- ## [How to apply combination of filters on array of objects?](https://discuss.elastic.co/t/how-to-apply-combination-of-filters-on-array-of-objects/286946)
**Author:** [@nsharma2412](https://discuss.elastic.co/u/nsharma2412)\ **Replies:** 3\ **Last updated:** [October 19, 2021, 7:30am UTC](https://discuss.elastic.co/t/how-to-apply-combination-of-filters-on-array-of-objects/286946 "2021-10-19T07:30:47Z")
Hi Please help me to write a suitable query for my task, I have list of products with different categories and associated attribute and tags. Here is two documents for two categories along with associated attribute list.… --- ## [Aggregation後のデータの最新、最古の日付を取得したい](https://discuss.elastic.co/t/aggregation/286954)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 4\ **Last updated:** [October 19, 2021, 5:47am UTC](https://discuss.elastic.co/t/aggregation/286954 "2021-10-19T05:47:20Z")
aggregationで、集約結果取得と同時にそれぞれの最新、最古の日付を取得できるかご教示ください。 例) 以下のようなデータをclient\_ipにてaggregationします client\_ip date 10.192.1.1 2021/10/1 10.192.1.1 2021/10/2 10.192.1.1 2021/10/3 10.192.1.2 2021/10/1 10.192.1.2 2021/10/2 … --- ## [Logstash can't read the environment variable](https://discuss.elastic.co/t/logstash-cant-read-the-environment-variable/286949)
**Author:** [@ramilbermejo](https://discuss.elastic.co/u/ramilbermejo)\ **Replies:** 2\ **Last updated:** [October 19, 2021, 4:58am UTC](https://discuss.elastic.co/t/logstash-cant-read-the-environment-variable/286949 "2021-10-19T04:58:42Z")
Good day everyone! Need some help here. On my dev environment, checking the logstash configuration will show this error. root@devlogstash:~# /usr/share/logstash/bin/logstash --path.settings /etc/logstash -t OpenJDK 64… --- ## [Logstash OutOfMemoryError: Direct buffer memory](https://discuss.elastic.co/t/logstash-outofmemoryerror-direct-buffer-memory/286473)
**Author:** [@Muthu\_Ramachandran\_K](https://discuss.elastic.co/u/Muthu_Ramachandran_K)\ **Replies:** 2\ **Last updated:** [October 19, 2021, 3:41am UTC](https://discuss.elastic.co/t/logstash-outofmemoryerror-direct-buffer-memory/286473 "2021-10-19T03:41:15Z")
Hi, we are using filebeat-\> logstash -\> elastic setup. The set up was working fine without any issues, but recently we noticed that logstash is going down frequently and we could see the below error. can anyone suggest … --- ## [How we add additional information on Kibana Visualize which is queried by Buckets's X-axis result IDs?](https://discuss.elastic.co/t/how-we-add-additional-information-on-kibana-visualize-which-is-queried-by-bucketss-x-axis-result-ids/287044)
**Author:** [@matoi](https://discuss.elastic.co/u/matoi)\ **Replies:** 0\ **Last updated:** [October 19, 2021, 3:10am UTC](https://discuss.elastic.co/t/how-we-add-additional-information-on-kibana-visualize-which-is-queried-by-bucketss-x-axis-result-ids/287044 "2021-10-19T03:10:36Z")
Hello, I'd like to show the additional information on Kibana Visualize close to Buckets's X-axis. Currently, my X-axis result is document's ids. (That is parent data) These documents have children documents. (But we do… --- ## [S3-input-plugin; restart logstash on aws\_credentials\_file update](https://discuss.elastic.co/t/s3-input-plugin-restart-logstash-on-aws-credentials-file-update/287036)
**Author:** [@jnkroeker](https://discuss.elastic.co/u/jnkroeker)\ **Replies:** 2\ **Last updated:** [October 19, 2021, 2:07am UTC](https://discuss.elastic.co/t/s3-input-plugin-restart-logstash-on-aws-credentials-file-update/287036 "2021-10-19T02:07:49Z")
Hey there, How can I force logstash to restart when my aws\_credentials\_file is updated? --config.reload.automatic does not appear to work here as neither the config.yaml or pipelines.yaml files are changing. the aws\_cr… --- ## [Elastic Endgame Sensor](https://discuss.elastic.co/t/elastic-endgame-sensor/286933)
**Author:** [@marisa.david](https://discuss.elastic.co/u/marisa.david)\ **Replies:** 5\ **Last updated:** [October 19, 2021, 1:28am UTC](https://discuss.elastic.co/t/elastic-endgame-sensor/286933 "2021-10-19T01:28:19Z")
I have been attempting to deploy a sensor but every time I try to in the command prompt it says it cannot be found. I am not sure if I am putting the information in wrong. --- ## [Elasticsearch can not started：failed to find global metadata](https://discuss.elastic.co/t/elasticsearch-can-not-started-failed-to-find-global-metadata/287037)
**Author:** [@wangdwcsd](https://discuss.elastic.co/u/wangdwcsd)\ **Replies:** 9\ **Last updated:** [October 19, 2021, 1:02am UTC](https://discuss.elastic.co/t/elasticsearch-can-not-started-failed-to-find-global-metadata/287037 "2021-10-19T01:02:15Z")
After the master node is restarted, it cannot be started. The following errors are always reported in the log，Is there any way to enable the Elasticsearch instance to load metadata？ error log： \[2021-10-19T02:32:17,262\]… --- ## [Logstash stops receiving logs](https://discuss.elastic.co/t/logstash-stops-receiving-logs/286897)
**Author:** [@Hamza\_El\_Aouane](https://discuss.elastic.co/u/Hamza_El_Aouane)\ **Replies:** 7\ **Last updated:** [October 18, 2021, 7:38pm UTC](https://discuss.elastic.co/t/logstash-stops-receiving-logs/286897 "2021-10-18T19:38:42Z")
Hi everyone. I am a beginner in logstash and ELK in general. Lately I have been facing an issue with logstash. I am receiving some logs on port 3014, and this is the second time that this is happening and I identified t… --- ## [Logstash in Kubernetes Not Using ServiceAccount with IAM Role](https://discuss.elastic.co/t/logstash-in-kubernetes-not-using-serviceaccount-with-iam-role/286081)
**Author:** [@xzxpurple2017](https://discuss.elastic.co/u/xzxpurple2017)\ **Replies:** 3\ **Last updated:** [October 18, 2021, 7:02pm UTC](https://discuss.elastic.co/t/logstash-in-kubernetes-not-using-serviceaccount-with-iam-role/286081 "2021-10-18T19:02:59Z")
I have a Logstash input to pull logs from S3. I attached a serviceaccount with IAM role to interact with S3 to the Logstash stateful set. I checked that the env variables on the container have AWS\_ROLE\_ARN and AWS\_WEB\_… --- ## [Parsing logs from text file using using logstash](https://discuss.elastic.co/t/parsing-logs-from-text-file-using-using-logstash/286995)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 6:08pm UTC](https://discuss.elastic.co/t/parsing-logs-from-text-file-using-using-logstash/286995 "2021-10-18T18:08:29Z")
Hi, I am having logs in the txt file.I checked with kv, grok and dissect filter to ingest logs using logstash, but as logs format is not the same. Maybe I need to assign field and particular value as this is unstructure… --- ## [Add field if based on another timestamps-field value](https://discuss.elastic.co/t/add-field-if-based-on-another-timestamps-field-value/286985)
**Author:** [@Cibot](https://discuss.elastic.co/u/Cibot)\ **Replies:** 2\ **Last updated:** [October 18, 2021, 5:44pm UTC](https://discuss.elastic.co/t/add-field-if-based-on-another-timestamps-field-value/286985 "2021-10-18T17:44:08Z")
I've been trying to add a field describing the status of the current rpm. Basically I've been using execbeats to execute a command which returns all the currently installed rpms. Now we have an internal tool which basi… --- ## [Uptime Monitors not working](https://discuss.elastic.co/t/uptime-monitors-not-working/286887)
**Author:** [@Peter\_Schlafmann](https://discuss.elastic.co/u/Peter_Schlafmann)\ **Replies:** 11\ **Last updated:** [October 18, 2021, 5:40pm UTC](https://discuss.elastic.co/t/uptime-monitors-not-working/286887 "2021-10-18T17:40:09Z")
Hi Community, I am using latest version of ES+Kibana+Heartbeat - I want to setup icmp uptime monitors for some of my hosts in my private network. Struggling with the configuration. Please see my heartbeat .yml and my o… --- ## [Table with Sum of Last values grouped by kubernetes.pod.uuid](https://discuss.elastic.co/t/table-with-sum-of-last-values-grouped-by-kubernetes-pod-uuid/286992)
**Author:** [@milanvdm](https://discuss.elastic.co/u/milanvdm)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 4:52pm UTC](https://discuss.elastic.co/t/table-with-sum-of-last-values-grouped-by-kubernetes-pod-uuid/286992 "2021-10-18T16:52:34Z")
Ive got a counter on each running kubernetes pod: { name: foo, counter: 5, pod.uuid: 111, timestamp: 1 } and { name: foo, counter: 10, pod.uuid: 111, timestamp: 2 } { name: foo, counter: 5, pod.uuid: 222, timestamp: 1 … --- ## [Cardinality of 1 vs. 0](https://discuss.elastic.co/t/cardinality-of-1-vs-0/287010)
**Author:** [@wolfhoundjesse](https://discuss.elastic.co/u/wolfhoundjesse)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 3:17pm UTC](https://discuss.elastic.co/t/cardinality-of-1-vs-0/287010 "2021-10-18T15:17:51Z")
I'm curious, if cardinality returns the count of distinct values, what does 0 mean? If there are two distinct values, you get 2. If they're all the same, you get 1. My best guess is that a zero means there was nothing to… --- ## [Search Error The content length (897957165) is bigger than the maximum allowed string (536870888)](https://discuss.elastic.co/t/search-error-the-content-length-897957165-is-bigger-than-the-maximum-allowed-string-536870888/285100)
**Author:** [@vikas1389](https://discuss.elastic.co/u/vikas1389)\ **Replies:** 3\ **Last updated:** [October 18, 2021, 2:31pm UTC](https://discuss.elastic.co/t/search-error-the-content-length-897957165-is-bigger-than-the-maximum-allowed-string-536870888/285100 "2021-10-18T14:31:39Z")
While filtering through logs we getting error: where it mentions content length is bigger. Where is maximum allowed string (536870888) is set- any suggestions to fix this error. --- ## [Logstash CIDR Plugin not working](https://discuss.elastic.co/t/logstash-cidr-plugin-not-working/286267)
**Author:** [@mrodriguez](https://discuss.elastic.co/u/mrodriguez)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 2:25pm UTC](https://discuss.elastic.co/t/logstash-cidr-plugin-not-working/286267 "2021-10-18T14:25:28Z")
Hi, I need to filter events by IP addresses. I would like to use CIDR plugin but it is not working for me. This is my code: filter { if \[type\] == "mytype" { kv{} cidr{ address =\> \[ "%{srcip}" \] network =\>… --- ## [Regex query in 7.13.4](https://discuss.elastic.co/t/regex-query-in-7-13-4/286884)
**Author:** [@junhuangli](https://discuss.elastic.co/u/junhuangli)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 2:24pm UTC](https://discuss.elastic.co/t/regex-query-in-7-13-4/286884 "2021-10-18T14:24:57Z")
After upgrading Elasticsearch from 6.6.2 to 7.13.4, we found the regex query is much slower(10 times slower). We are doing a pretty expensive regex search like ".(\["\]fieldName\["\]:\["\]my-value-\[A-Za-z\]\[A-Za-z\]\[A-Za-z0-9\]\[… --- ## [Logstash cpu usage blocked at 50%](https://discuss.elastic.co/t/logstash-cpu-usage-blocked-at-50/286465)
**Author:** [@thomastatin](https://discuss.elastic.co/u/thomastatin)\ **Replies:** 2\ **Last updated:** [October 18, 2021, 2:13pm UTC](https://discuss.elastic.co/t/logstash-cpu-usage-blocked-at-50/286465 "2021-10-18T14:13:15Z")
Hi everybody ! I have a logstash pipeline which can receive about 10k e/s in event peaks My logstash usual CPU usage is in "nice" priority with an average 30-40% CPU consumption and without data delay in the data store… --- ## [Log forwarding issue after upgrading logstash](https://discuss.elastic.co/t/log-forwarding-issue-after-upgrading-logstash/286859)
**Author:** [@yankeesfan01x](https://discuss.elastic.co/u/yankeesfan01x)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 2:01pm UTC](https://discuss.elastic.co/t/log-forwarding-issue-after-upgrading-logstash/286859 "2021-10-18T14:01:23Z")
I upgraded the logstash version from 7.12.1 to 7.15.1 and I'm not seeing logs in Kibana from the source host I'm testing with. Is this too much of a jump in versions or did something change in 7.15.1 that I need to upda… --- ## [Event.duration bug](https://discuss.elastic.co/t/event-duration-bug/286733)
**Author:** [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\ **Replies:** 4\ **Last updated:** [October 18, 2021, 1:45pm UTC](https://discuss.elastic.co/t/event-duration-bug/286733 "2021-10-18T13:45:53Z")
I have a field as a double in milliseconds. I want to turn it into nanoseconds and apply it to the event.duration field in logstash, so I can monitor how long certain events take for my machines to process. Here is the … --- ## [Alert when no data on an index](https://discuss.elastic.co/t/alert-when-no-data-on-an-index/286977)
**Author:** [@ansarpalakottal](https://discuss.elastic.co/u/ansarpalakottal)\ **Replies:** 1\ **Last updated:** [October 18, 2021, 1:28pm UTC](https://discuss.elastic.co/t/alert-when-no-data-on-an-index/286977 "2021-10-18T13:28:58Z")
How can I create alerts when no data is there on an index/index pattern ? The Kibana version which I am using is 7.12.1 and having Platinum License. --- ## [Logs from different sources in single txt file, to be stored in different indices using logstash](https://discuss.elastic.co/t/logs-from-different-sources-in-single-txt-file-to-be-stored-in-different-indices-using-logstash/286694)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 3\ **Last updated:** [October 18, 2021, 1:19pm UTC](https://discuss.elastic.co/t/logs-from-different-sources-in-single-txt-file-to-be-stored-in-different-indices-using-logstash/286694 "2021-10-18T13:19:35Z")
Hi, I am having txt file consist of 3 different logs coming from 3 sources collated into single text file. I want to separate out logs and stored them in a respective index. Sample Logs- 10/12/2021 8:54:00 AM,MSGID: \<… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=798) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=800)