# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=857 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 858 --- ## [What are the advantages and the disadvantages of running multiple instances of logstash in the same cluster?](https://discuss.elastic.co/t/what-are-the-advantages-and-the-disadvantages-of-running-multiple-instances-of-logstash-in-the-same-cluster/281087)
**Author:** [@xemyleex](https://discuss.elastic.co/u/xemyleex)\ **Replies:** 3\ **Last updated:** [August 12, 2021, 2:13pm UTC](https://discuss.elastic.co/t/what-are-the-advantages-and-the-disadvantages-of-running-multiple-instances-of-logstash-in-the-same-cluster/281087 "2021-08-12T14:13:21Z")
What are the advantages and the disadvantages of running multiple instances of logstash in the same cluster? --- ## [How to define what data is sent to Elastic from Logstash?](https://discuss.elastic.co/t/how-to-define-what-data-is-sent-to-elastic-from-logstash/279995)
**Author:** [@profsteve](https://discuss.elastic.co/u/profsteve)\ **Replies:** 8\ **Last updated:** [August 12, 2021, 1:37pm UTC](https://discuss.elastic.co/t/how-to-define-what-data-is-sent-to-elastic-from-logstash/279995 "2021-08-12T13:37:12Z")
Hello, I have ELK running on Ubuntu Server with the intention of it receiving Syslog from firewalls and Filebeat from DNS/DHCP/AD services. The primary issue is the firewalls make a lot of Syslog noise without there be… --- ## [Failed to parse field](https://discuss.elastic.co/t/failed-to-parse-field/281112)
**Author:** [@Senthil\_ak](https://discuss.elastic.co/u/Senthil_ak)\ **Replies:** 4\ **Last updated:** [August 12, 2021, 1:25pm UTC](https://discuss.elastic.co/t/failed-to-parse-field/281112 "2021-08-12T13:25:01Z")
Hi admin, I am getting some strange exception in the logstash all of a sudden. I try to debug but unable to do so. Need your kind help. \[2021-08-11T15:37:35,189\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index e… --- ## [Does kibana understand package registry via proxy?](https://discuss.elastic.co/t/does-kibana-understand-package-registry-via-proxy/281086)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 1\ **Last updated:** [August 12, 2021, 1:04pm UTC](https://discuss.elastic.co/t/does-kibana-understand-package-registry-via-proxy/281086 "2021-08-12T13:04:01Z")
Hi, Appearantly since 7.14 (fleet = GA) I am required to have internet access for my selfmanaged kibana's to reach some packet registry (or host one myself). However, I set a proxy in the environment and am still not… --- ## [Elastic workloads deployed in GCP stopped working with connection timeout errors](https://discuss.elastic.co/t/elastic-workloads-deployed-in-gcp-stopped-working-with-connection-timeout-errors/280698)
**Author:** [@Amirtha\_Saminathan](https://discuss.elastic.co/u/Amirtha_Saminathan)\ **Replies:** 1\ **Last updated:** [August 12, 2021, 12:50pm UTC](https://discuss.elastic.co/t/elastic-workloads-deployed-in-gcp-stopped-working-with-connection-timeout-errors/280698 "2021-08-12T12:50:02Z")
The elastic search master, data and client have stopped communicating with each other and we see NodeDisconnectedException and connection timeout errors on 9300 port --- ## [Custom role via Secret not created](https://discuss.elastic.co/t/custom-role-via-secret-not-created/280581)
**Author:** [@pkaramol](https://discuss.elastic.co/u/pkaramol)\ **Replies:** 1\ **Last updated:** [August 12, 2021, 12:40pm UTC](https://discuss.elastic.co/t/custom-role-via-secret-not-created/280581 "2021-08-12T12:40:15Z")
I am trying to create custom roles declaratively in ECK (leveraging the file-based role management), therefore I rely on the usage of Secrets as per the instructions found here. I am defining the following Secret resour… --- ## [Unclear how logstash fingerprint treats empty/non-existing fields](https://discuss.elastic.co/t/unclear-how-logstash-fingerprint-treats-empty-non-existing-fields/281157)
**Author:** [@AdmireDirac](https://discuss.elastic.co/u/AdmireDirac)\ **Replies:** 1\ **Last updated:** [August 12, 2021, 12:00pm UTC](https://discuss.elastic.co/t/unclear-how-logstash-fingerprint-treats-empty-non-existing-fields/281157 "2021-08-12T12:00:19Z")
Hello everyone, I have a hard time to understand the behaviour fo the logstash fingerprint filter if a field is empty or non-existent. My scenario is the following: I'm reading a json-file with logstash and create a d… --- ## [How to use aggregate in inner hits](https://discuss.elastic.co/t/how-to-use-aggregate-in-inner-hits/281195)
**Author:** [@Amir\_Faramarzi](https://discuss.elastic.co/u/Amir_Faramarzi)\ **Replies:** 0\ **Last updated:** [August 12, 2021, 11:22am UTC](https://discuss.elastic.co/t/how-to-use-aggregate-in-inner-hits/281195 "2021-08-12T11:22:49Z")
Hello friends Is it possible to use aggregation in inner hits? If so, how? --- ## [Getting error while starting elastic](https://discuss.elastic.co/t/getting-error-while-starting-elastic/281108)
**Author:** [@Faizan\_Khurshid](https://discuss.elastic.co/u/Faizan_Khurshid)\ **Replies:** 3\ **Last updated:** [August 12, 2021, 10:24am UTC](https://discuss.elastic.co/t/getting-error-while-starting-elastic/281108 "2021-08-12T10:24:17Z")
Hi Folk I am new to ELK , i was trying to install ELK on centos 8.4 below is my error when i was trying to start sudo systemctl start elasticsearch \[root@ ~\]# systemctl status elasticsearch.service ● elasticsearch.… --- ## [Setting up logstash with mongodb not starting](https://discuss.elastic.co/t/setting-up-logstash-with-mongodb-not-starting/280998)
**Author:** [@Bugsbee](https://discuss.elastic.co/u/Bugsbee)\ **Replies:** 5\ **Last updated:** [August 12, 2021, 10:12am UTC](https://discuss.elastic.co/t/setting-up-logstash-with-mongodb-not-starting/280998 "2021-08-12T10:12:05Z")
hi community, need your expertise / advise in this issue im facing when starting logstash which im trying to connect wth mongodb. input { uri =\> 'mongodb://userhere:passwordhere@1234.234.123.12:8081' p… --- ## [Grouping/filtering host servers](https://discuss.elastic.co/t/grouping-filtering-host-servers/281030)
**Author:** [@Garry](https://discuss.elastic.co/u/Garry)\ **Replies:** 3\ **Last updated:** [August 12, 2021, 9:48am UTC](https://discuss.elastic.co/t/grouping-filtering-host-servers/281030 "2021-08-12T09:48:24Z")
I have a situation where the I have a variety of hostnames for each client. E.g. Client 1: host1, host2, host3 Client 2: host4, host5, host6, host7 What would be the most effective way to group these client machines … --- ## [Elasticsearch kibana](https://discuss.elastic.co/t/elasticsearch-kibana/281151)
**Author:** [@Dilnawaz\_Khan](https://discuss.elastic.co/u/Dilnawaz_Khan)\ **Replies:** 1\ **Last updated:** [August 12, 2021, 9:29am UTC](https://discuss.elastic.co/t/elasticsearch-kibana/281151 "2021-08-12T09:29:55Z")
Hello I have 2 master nodes of elasticsearch and 3 data nodes and one seprate node is for kibana Now I have a question if I give host ip of those 2 master node in kibana.yml file then where do I need to configure those … --- ## [Max aggregation on .keyword field with both string and number values](https://discuss.elastic.co/t/max-aggregation-on-keyword-field-with-both-string-and-number-values/281168)
**Author:** [@Daniele\_Renda](https://discuss.elastic.co/u/Daniele_Renda)\ **Replies:** 0\ **Last updated:** [August 12, 2021, 8:16am UTC](https://discuss.elastic.co/t/max-aggregation-on-keyword-field-with-both-string-and-number-values/281168 "2021-08-12T08:16:27Z")
Hi, I've a quite common situation: I've an index for products with a barcode field: "barcode": { "type": "text", "fields": { "ngram": { "type": "tex… --- ## [Pipeline worker error, the pipeline will be stopped {:pipeline\_id=\>"main", :error=\>"(TypeError) no implicit conversion of nil into Integer](https://discuss.elastic.co/t/pipeline-worker-error-the-pipeline-will-be-stopped-pipeline-id-main-error-typeerror-no-implicit-conversion-of-nil-into-integer/281167)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 0\ **Last updated:** [August 12, 2021, 8:16am UTC](https://discuss.elastic.co/t/pipeline-worker-error-the-pipeline-will-be-stopped-pipeline-id-main-error-typeerror-no-implicit-conversion-of-nil-into-integer/281167 "2021-08-12T08:16:12Z")
I have configured SQS as input, not sure why I am getting this error. I am not performing any conversation from my Logstash config file. Can anyone help to identify the issue? The following error message comes right af… --- ## [Kibana startup failure in Windows](https://discuss.elastic.co/t/kibana-startup-failure-in-windows/280709)
**Author:** [@xubisid](https://discuss.elastic.co/u/xubisid)\ **Replies:** 3\ **Last updated:** [August 12, 2021, 6:47am UTC](https://discuss.elastic.co/t/kibana-startup-failure-in-windows/280709 "2021-08-12T06:47:05Z")
I have download the updated 7.14.0 kibana version and wait for the whole zip download but unfortunately getting the same error message Cannot find module './persistence\_google\_workspace\_api\_access\_granted\_via\_domain\_wid… --- ## [Question about Kibana Visualize](https://discuss.elastic.co/t/question-about-kibana-visualize/281111)
**Author:** [@FayeLu](https://discuss.elastic.co/u/FayeLu)\ **Replies:** 3\ **Last updated:** [August 12, 2021, 6:36am UTC](https://discuss.elastic.co/t/question-about-kibana-visualize/281111 "2021-08-12T06:36:24Z")
I am new to Kibana and I am learning how to create custom Kibana visualization chart. Is that possible we can create visualization of Elastic Search schema data using Kibana? eg. I have a data of colleges students with… --- ## [ELK cluster is not stable due to several issues related to shards and JVM configuration](https://discuss.elastic.co/t/elk-cluster-is-not-stable-due-to-several-issues-related-to-shards-and-jvm-configuration/281059)
**Author:** [@Dawood](https://discuss.elastic.co/u/Dawood)\ **Replies:** 2\ **Last updated:** [August 12, 2021, 6:25am UTC](https://discuss.elastic.co/t/elk-cluster-is-not-stable-due-to-several-issues-related-to-shards-and-jvm-configuration/281059 "2021-08-12T06:25:42Z")
Hi, First it is not the first time i am sharing the issues that i am encountering and hopefully this time somebody will help me with that !!! So i have an ELK cluster that is running on premise on a rancher k8s based … --- ## [Can we send jenkins Build console logs to Kibana using filebeat](https://discuss.elastic.co/t/can-we-send-jenkins-build-console-logs-to-kibana-using-filebeat/280547)
**Author:** [@Harindra\_Balanagired](https://discuss.elastic.co/u/Harindra_Balanagired)\ **Replies:** 7\ **Last updated:** [August 12, 2021, 5:47am UTC](https://discuss.elastic.co/t/can-we-send-jenkins-build-console-logs-to-kibana-using-filebeat/280547 "2021-08-12T05:47:08Z")
Can we send Jenkins Build console output to Kibana using the filebeat you figure out in the image? based on timestamp see highlighted time in that image. Based on the timestamp can we create a dashboard --- ## [Split Timelion Graph](https://discuss.elastic.co/t/split-timelion-graph/281152)
**Author:** [@Phanikumar\_21](https://discuss.elastic.co/u/Phanikumar_21)\ **Replies:** 0\ **Last updated:** [August 12, 2021, 6:03am UTC](https://discuss.elastic.co/t/split-timelion-graph/281152 "2021-08-12T06:03:26Z")
Hi, We had ingested job monitoring information… start time / end time / target end time of job for SLA. However, some jobs start in the evening EST time and run into the next day – i.e. 11pm and ends at 2am . We are… --- ## [Kibana overrides original time format from Elasticsearch](https://discuss.elastic.co/t/kibana-overrides-original-time-format-from-elasticsearch/281124)
**Author:** [@rtemotfuorco123](https://discuss.elastic.co/u/rtemotfuorco123)\ **Replies:** 1\ **Last updated:** [August 12, 2021, 5:29am UTC](https://discuss.elastic.co/t/kibana-overrides-original-time-format-from-elasticsearch/281124 "2021-08-12T05:29:10Z")
Hi, I have the index below and when I visualise it in Kibana, the log\_field.time format is changed. I want to keep it as the original one which is RFC3339. How do I get this sorted? See image at the bottom please. By th… --- ## [Grok filter by values](https://discuss.elastic.co/t/grok-filter-by-values/280988)
**Author:** [@IsAa](https://discuss.elastic.co/u/IsAa)\ **Replies:** 4\ **Last updated:** [August 12, 2021, 5:19am UTC](https://discuss.elastic.co/t/grok-filter-by-values/280988 "2021-08-12T05:19:42Z")
Hi Everyone, I have a text in my input as follows, The following text contains {"Food":"Fruit","Type":"Apple"} I am trying to structure my output data to also contain fields Food: Fruit Type: Apple I was looking int… --- ## [Dump elasticsearch documents into avro format](https://discuss.elastic.co/t/dump-elasticsearch-documents-into-avro-format/281146)
**Author:** [@Sagar\_kadu](https://discuss.elastic.co/u/Sagar_kadu)\ **Replies:** 0\ **Last updated:** [August 12, 2021, 4:43am UTC](https://discuss.elastic.co/t/dump-elasticsearch-documents-into-avro-format/281146 "2021-08-12T04:43:10Z")
I want to store elasticsearch query results into avro files using logstash..As far as I know there file output logstash plugin which by default stores JSON documents. after going through logstash documentation,I co… --- ## [Setup Elasticsearch cluster result in two clusers](https://discuss.elastic.co/t/setup-elasticsearch-cluster-result-in-two-clusers/281135)
**Author:** [@Benli](https://discuss.elastic.co/u/Benli)\ **Replies:** 3\ **Last updated:** [August 12, 2021, 3:22am UTC](https://discuss.elastic.co/t/setup-elasticsearch-cluster-result-in-two-clusers/281135 "2021-08-12T03:22:35Z")
Hi there, I'm setting up Elasticsearch cluster by using two separate Linux machines. On the first Linux, elasticsearch.yml: # ---------------------------------- Cluster ----------------------------------- cluster.name:… --- ## [Update fileds in \_source by ES update api , when success, all data of stored\_fields are missing](https://discuss.elastic.co/t/update-fileds-in-source-by-es-update-api-when-success-all-data-of-stored-fields-are-missing/280896)
**Author:** [@jiangnanxue21](https://discuss.elastic.co/u/jiangnanxue21)\ **Replies:** 1\ **Last updated:** [August 12, 2021, 1:48am UTC](https://discuss.elastic.co/t/update-fileds-in-source-by-es-update-api-when-success-all-data-of-stored-fields-are-missing/280896 "2021-08-12T01:48:21Z")
Update fileds in \_source by ES update api , when success, all data of stored\_fields are missing, and I am confused about that....What is the internal mechanism？ --- ## [Too\_many\_clauses but only with ip field type and ip\_range search values?](https://discuss.elastic.co/t/too-many-clauses-but-only-with-ip-field-type-and-ip-range-search-values/281133)
**Author:** [@philosobyte](https://discuss.elastic.co/u/philosobyte)\ **Replies:** 0\ **Last updated:** [August 12, 2021, 1:05am UTC](https://discuss.elastic.co/t/too-many-clauses-but-only-with-ip-field-type-and-ip-range-search-values/281133 "2021-08-12T01:05:35Z")
Hello, We are running into a too\_many\_clauses failure when using a terms query inside a filter context, but only when the target field has type ip and when the search values are CIDRs. Here's an example: PUT /test-ind… --- ## [Dead\_letter\_queueにおける複数pipelineの扱い方](https://discuss.elastic.co/t/dead-letter-queue-pipeline/280287)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 1\ **Last updated:** [August 12, 2021, 1:01am UTC](https://discuss.elastic.co/t/dead-letter-queue-pipeline/280287 "2021-08-12T01:01:23Z")
logstashのdead\_letter\_queueについてご教示ください。 logstashのdead\_letter\_queue inputプラグインにて、以下のような設定をしております。 input { dead\_letter\_queue { commit\_offsets =\> true path =\> "/var/lib/logstash/dead\_letter\_queue" pipeline\_id… --- ## [Parse lvmeng WAF log](https://discuss.elastic.co/t/parse-lvmeng-waf-log/281073)
**Author:** [@star\_cool](https://discuss.elastic.co/u/star_cool)\ **Replies:** 2\ **Last updated:** [August 11, 2021, 11:55pm UTC](https://discuss.elastic.co/t/parse-lvmeng-waf-log/281073 "2021-08-11T23:55:16Z")
hi \<11\>Aug 11 19:14:55 localhost waf: tag:waf\_log\_websec site\_id:1521041933 protect\_id:2623109843 dst\_ip:x.x.x.x dst\_port:80 src\_ip:183.209.173.69 src\_port:17506 method:GET domain:www.domain.com uri:/%5fupload/t… --- ## [Does Http\_poller use something simillar to "sincedb" as File input does?](https://discuss.elastic.co/t/does-http-poller-use-something-simillar-to-sincedb-as-file-input-does/281044)
**Author:** [@panagiss](https://discuss.elastic.co/u/panagiss)\ **Replies:** 2\ **Last updated:** [August 11, 2021, 8:00pm UTC](https://discuss.elastic.co/t/does-http-poller-use-something-simillar-to-sincedb-as-file-input-does/281044 "2021-08-11T20:00:29Z")
I know that File input plugin uses sincedb to "remember" the state of the file and the index position. But what about other input plugins and specifically http\_poller? Because i have noticed that if i make the same req… --- ## [How to use Azure Storage plugin in ECK for Snapshot](https://discuss.elastic.co/t/how-to-use-azure-storage-plugin-in-eck-for-snapshot/237513)
**Author:** [@robinhood\_lko](https://discuss.elastic.co/u/robinhood_lko)\ **Replies:** 7\ **Last updated:** [August 11, 2021, 5:35pm UTC](https://discuss.elastic.co/t/how-to-use-azure-storage-plugin-in-eck-for-snapshot/237513 "2021-08-11T17:35:19Z")
Hi All, I have to configure snapshot in ECK Deployment. Elasticsearch documentation has given example for Google cloud. Please can anyone list the steps for that. I tried this - Created a file azure.client.default.cre… --- ## [Why do N-gram Tokenizers don't treat + (plus) characters as part of a token?](https://discuss.elastic.co/t/why-do-n-gram-tokenizers-dont-treat-plus-characters-as-part-of-a-token/281096)
**Author:** [@ssephillip](https://discuss.elastic.co/u/ssephillip)\ **Replies:** 1\ **Last updated:** [August 11, 2021, 4:38pm UTC](https://discuss.elastic.co/t/why-do-n-gram-tokenizers-dont-treat-plus-characters-as-part-of-a-token/281096 "2021-08-11T16:38:11Z")
Hello everyone, I have a few questions about the behavior of the N-Gram Tokenizer. I am relatively new to this forum, so please forgive me if I'm asking this question in a wrong way. I created my own custom tokenizer … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=856) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=858)