# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=883 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 884 --- ## [Running ELK Services as Root](https://discuss.elastic.co/t/running-elk-services-as-root/278673)
**Author:** [@6igwig](https://discuss.elastic.co/u/6igwig)\ **Replies:** 1\ **Last updated:** [July 15, 2021, 12:38pm UTC](https://discuss.elastic.co/t/running-elk-services-as-root/278673 "2021-07-15T12:38:14Z")
I am utilizing the full ELK stack in Linux including beats and logstash. I have found a few posts online that recommend not running these services as root such as this discussion post. I tried to find some more informat… --- ## [How to calculate read/write throughput at cluster level?](https://discuss.elastic.co/t/how-to-calculate-read-write-throughput-at-cluster-level/278775)
**Author:** [@Bhagwati\_Malav](https://discuss.elastic.co/u/Bhagwati_Malav)\ **Replies:** 2\ **Last updated:** [July 15, 2021, 12:35pm UTC](https://discuss.elastic.co/t/how-to-calculate-read-write-throughput-at-cluster-level/278775 "2021-07-15T12:35:44Z")
I am working on designing es cluster with below given setup master nodes 3 (m5.a large) 2vcpu, 8gb data nodes 2 (m5.ax large) 4vcpu, 16 gb Keeping default elastic configuration currently. read thread pool - 7 write … --- ## [Kibana throws error in chrome version 91.0.4472.124](https://discuss.elastic.co/t/kibana-throws-error-in-chrome-version-91-0-4472-124/278760)
**Author:** [@Bhavani\_Ananth](https://discuss.elastic.co/u/Bhavani_Ananth)\ **Replies:** 1\ **Last updated:** [July 15, 2021, 12:07pm UTC](https://discuss.elastic.co/t/kibana-throws-error-in-chrome-version-91-0-4472-124/278760 "2021-07-15T12:07:48Z")
I am unable to load kibana 7.8.1 in Google Chrome Version 91.0.4472.124 (Official Build) (64-bit) Build: 32141 It takes the pages ages to load and when it does, the following error is displayed. This works fine in Mic… --- ## [Convert String to Date](https://discuss.elastic.co/t/convert-string-to-date/278782)
**Author:** [@Meryem\_BS](https://discuss.elastic.co/u/Meryem_BS)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 12:01pm UTC](https://discuss.elastic.co/t/convert-string-to-date/278782 "2021-07-15T12:01:33Z")
Hello, In the logs I upload to Kibana have a "mytimestamp" field, supposedly of type Date but when I inject the logs and parsed it in json, my timestamp is converted to type string. Do you know how can I convert my tim… --- ## [Save NodeClient variable to disk](https://discuss.elastic.co/t/save-nodeclient-variable-to-disk/278773)
**Author:** [@daksh0225](https://discuss.elastic.co/u/daksh0225)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 11:33am UTC](https://discuss.elastic.co/t/save-nodeclient-variable-to-disk/278773 "2021-07-15T11:33:30Z")
Hi all, I have been modifying the source code to accomodate some custom features that I would like to have. In doing so, I have added some new class variables to NodeClient. Currently, these variables do not persist ove… --- ## [Weird index shard allocation behaviour](https://discuss.elastic.co/t/weird-index-shard-allocation-behaviour/278734)
**Author:** [@Lefty](https://discuss.elastic.co/u/Lefty)\ **Replies:** 6\ **Last updated:** [July 15, 2021, 11:30am UTC](https://discuss.elastic.co/t/weird-index-shard-allocation-behaviour/278734 "2021-07-15T11:30:10Z")
Hello everyone, I wonder if you can help me - I have a very weird problem I am running the ELK stack version 7.12.0 I have a 5 data node Elastic cluster - 8 TB of disk each 32GB RAM, 8 CPUs Utilization of disk on the… --- ## [Unable to embed Kibana dashboard on a reverse proxy server using Nginx](https://discuss.elastic.co/t/unable-to-embed-kibana-dashboard-on-a-reverse-proxy-server-using-nginx/278521)
**Author:** [@Fabian\_Matesa](https://discuss.elastic.co/u/Fabian_Matesa)\ **Replies:** 2\ **Last updated:** [July 15, 2021, 8:46am UTC](https://discuss.elastic.co/t/unable-to-embed-kibana-dashboard-on-a-reverse-proxy-server-using-nginx/278521 "2021-07-15T08:46:51Z")
I am trying to embed a Kibana dashboard using Nginx, but keep getting a blank screen. No errors are thrown (except for the expected "inline script" error), but nothing gets loaded. Kibana is deployed on an Azure cloud, a… --- ## [Exporting detection rules and its exceptions](https://discuss.elastic.co/t/exporting-detection-rules-and-its-exceptions/278753)
**Author:** [@realtech2338](https://discuss.elastic.co/u/realtech2338)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 8:43am UTC](https://discuss.elastic.co/t/exporting-detection-rules-and-its-exceptions/278753 "2021-07-15T08:43:16Z")
how to export all detection rules along with its query into csv format from elasticsearch portal? how to export exceptions under each detection rule into csv format from elasticsearch portal? --- ## [Error in jvmgcmonitorservice (gc overhead)](https://discuss.elastic.co/t/error-in-jvmgcmonitorservice-gc-overhead/278241)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 9\ **Last updated:** [July 15, 2021, 8:13am UTC](https://discuss.elastic.co/t/error-in-jvmgcmonitorservice-gc-overhead/278241 "2021-07-15T08:13:39Z")
I am having the following problem. $ cat /var/log/elasticsearch/elasticsearch.log | grep WARN \[2021-07-09T00:04:51,795\]\[WARN \]\[o.e.m.j.JvmGcMonitorService\] \[ITS-ELST-01\] \[gc\]\[young\]\[214003\]\[2290\] duration \[1.7s\], collec… --- ## [How to process logs from certain period of time? (I use elasticsearch input plugin)](https://discuss.elastic.co/t/how-to-process-logs-from-certain-period-of-time-i-use-elasticsearch-input-plugin/278702)
**Author:** [@John\_Smith1](https://discuss.elastic.co/u/John_Smith1)\ **Replies:** 4\ **Last updated:** [July 15, 2021, 7:28am UTC](https://discuss.elastic.co/t/how-to-process-logs-from-certain-period-of-time-i-use-elasticsearch-input-plugin/278702 "2021-07-15T07:28:32Z")
In pipeline I receive logs from server with elasticsearch input plugin and I want to process not all logs, but for example only last 2 months, or, preferably from certain date to certain date. When I receive logs there… --- ## [Need Clarification Regarding Size Parameter in ES Query](https://discuss.elastic.co/t/need-clarification-regarding-size-parameter-in-es-query/278735)
**Author:** [@sayamiasis](https://discuss.elastic.co/u/sayamiasis)\ **Replies:** 3\ **Last updated:** [July 15, 2021, 7:23am UTC](https://discuss.elastic.co/t/need-clarification-regarding-size-parameter-in-es-query/278735 "2021-07-15T07:23:27Z")
I wanted to know if there is a difference in executing these two queries when the result response is consisting of only 3 documents. query1: { "size":10, "query": { "bool":{ "must":\[ { "term":{ "t… --- ## [Kibana array of objects visibility after \_source field deprecation](https://discuss.elastic.co/t/kibana-array-of-objects-visibility-after-source-field-deprecation/278143)
**Author:** [@israelst](https://discuss.elastic.co/u/israelst)\ **Replies:** 1\ **Last updated:** [July 15, 2021, 6:43am UTC](https://discuss.elastic.co/t/kibana-array-of-objects-visibility-after-source-field-deprecation/278143 "2021-07-15T06:43:16Z")
Since Kibana 7.12 - the "\_source" field is no longer used by default in favor of the new field API. This totally broke our ability to view array of objects in Discover. What used to be shown as JSON, is now being flatte… --- ## [High Search Rejected](https://discuss.elastic.co/t/high-search-rejected/278700)
**Author:** [@Vishnu\_Singhal](https://discuss.elastic.co/u/Vishnu_Singhal)\ **Replies:** 4\ **Last updated:** [July 15, 2021, 6:09am UTC](https://discuss.elastic.co/t/high-search-rejected/278700 "2021-07-15T06:09:00Z")
Hi, My ELasticsearch thread pool search has very high rejected ration. I have sufficient 72 CPU nodes. node\_name name active queue rejected ES10 search 7 0 22703 ES07 search 0 0 0 … --- ## [How to login screen change in kibana 7.13.0?](https://discuss.elastic.co/t/how-to-login-screen-change-in-kibana-7-13-0/274950)
**Author:** [@111480](https://discuss.elastic.co/u/111480)\ **Replies:** 4\ **Last updated:** [July 15, 2021, 6:03am UTC](https://discuss.elastic.co/t/how-to-login-screen-change-in-kibana-7-13-0/274950 "2021-07-15T06:03:01Z")
how to login screen change in kibana 7.13.0? I tried following the above link 7.10.0 guide, but I couldn't change the elastic logo on the login page. How can I change the login page screen logo? I would appreciate i… --- ## [Unable to load kibana dash board](https://discuss.elastic.co/t/unable-to-load-kibana-dash-board/278737)
**Author:** [@Sachin\_05](https://discuss.elastic.co/u/Sachin_05)\ **Replies:** 1\ **Last updated:** [July 15, 2021, 5:58am UTC](https://discuss.elastic.co/t/unable-to-load-kibana-dash-board/278737 "2021-07-15T05:58:39Z")
Hi I am getting the below error while loading the kibana dashboard could someone please help me resolve this. Loading index pattern filebeat-: {"\_index":".kibana\_7.13.3\_001","\_type":"index-pattern","\_id":"filebeat-","f… --- ## [org.elasticsearch.action.search.SearchPhaseExecutionException: all shards failed](https://discuss.elastic.co/t/org-elasticsearch-action-search-searchphaseexecutionexception-all-shards-failed/278411)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 1\ **Last updated:** [July 15, 2021, 5:10am UTC](https://discuss.elastic.co/t/org-elasticsearch-action-search-searchphaseexecutionexception-all-shards-failed/278411 "2021-07-15T05:10:21Z")
org.elasticsearch.action.search.SearchPhaseExecutionException: all shards failed It is said that all shards fail, what is happening? The index in question shows that the health was green. What do I need to do to avoid… --- ## [Logstash restarts with "ConcurrentModificationException"](https://discuss.elastic.co/t/logstash-restarts-with-concurrentmodificationexception/278738)
**Author:** [@rojin](https://discuss.elastic.co/u/rojin)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 5:03am UTC](https://discuss.elastic.co/t/logstash-restarts-with-concurrentmodificationexception/278738 "2021-07-15T05:03:20Z")
Hi, I have an issue with logstash restarting itself showing “ConcurrentModificationException“ error before stoping and starting again, does anyone have any idea what it might be about? --- ## [Error opening file for writing on windows 10](https://discuss.elastic.co/t/error-opening-file-for-writing-on-windows-10/278619)
**Author:** [@Johnsprenger](https://discuss.elastic.co/u/Johnsprenger)\ **Replies:** 1\ **Last updated:** [July 15, 2021, 4:39am UTC](https://discuss.elastic.co/t/error-opening-file-for-writing-on-windows-10/278619 "2021-07-15T04:39:56Z")
Hello friends. I can't install elastic on my Windows 10 computer. Just showing “error opening file for writing” error. I don't understand why this error is showing and how to solve this problem. Any suggestions will be a… --- ## [Error when restart logstash LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError](https://discuss.elastic.co/t/error-when-restart-logstash-logstash-hostunreachableerror/278687)
**Author:** [@quyennguyen](https://discuss.elastic.co/u/quyennguyen)\ **Replies:** 4\ **Last updated:** [July 15, 2021, 2:36am UTC](https://discuss.elastic.co/t/error-when-restart-logstash-logstash-hostunreachableerror/278687 "2021-07-15T02:36:45Z")
Hello I install Logstash in Ubuntu 18. After changed ip from 192.168.186.147 to 192.168.186.157 I also fixed the .yml and conf.d but it's cant restart with error. /var/log/logstash/logstash-plain.log \[2021-07-14T22:18… --- ## [Attempted to send a bulk request to elasticsearch, but no there are no living connections in the connection pool](https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch-but-no-there-are-no-living-connections-in-the-connection-pool/277307)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 2\ **Last updated:** [July 15, 2021, 1:50am UTC](https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch-but-no-there-are-no-living-connections-in-the-connection-pool/277307 "2021-07-15T01:50:43Z")
I am getting the following error in the log of logstash. $ tail /var/log/logstash/logstash-plain.log \[2021-06-29T01:17:53,584\]\[ERROR\]\[logstash.outputs.elasticsearch\]\[main\]\[9acc851acb29a066b989c90cdd9ba461ce676a2f7643e20… --- ## [Must\_not with an exception](https://discuss.elastic.co/t/must-not-with-an-exception/278301)
**Author:** [@bcam135](https://discuss.elastic.co/u/bcam135)\ **Replies:** 3\ **Last updated:** [July 14, 2021, 9:05pm UTC](https://discuss.elastic.co/t/must-not-with-an-exception/278301 "2021-07-14T21:05:55Z")
In basic terms, I have a current kibana alert and the query is set up to exclude all systems that have 800-999 in the hostname with the extraction query code below. That works fine. However, I would I would like to exc… --- ## [Problem with strigo for Metrics Fundamentals](https://discuss.elastic.co/t/problem-with-strigo-for-metrics-fundamentals/278710)
**Author:** [@Jack\_Shirazi](https://discuss.elastic.co/u/Jack_Shirazi)\ **Replies:** 2\ **Last updated:** [July 14, 2021, 8:35pm UTC](https://discuss.elastic.co/t/problem-with-strigo-for-metrics-fundamentals/278710 "2021-07-14T20:35:30Z")
--- ## ["name" field](https://discuss.elastic.co/t/name-field/278713)
**Author:** [@rojin](https://discuss.elastic.co/u/rojin)\ **Replies:** 0\ **Last updated:** [July 14, 2021, 8:30pm UTC](https://discuss.elastic.co/t/name-field/278713 "2021-07-14T20:30:41Z")
Hey, just wondering if I can use the "name" field in grok patterns. when I use it, the error appears to be like this: \["Error"\], "id"=\>"692aaaf9cd6aedfa9e73788106ef94fc1d968d10a1586c197812a6e14d84010a"}\]=\>\[{"thread\_id"=\>… --- ## [Environment setup for modifying logstash plugin](https://discuss.elastic.co/t/environment-setup-for-modifying-logstash-plugin/278712)
**Author:** [@pjohnson](https://discuss.elastic.co/u/pjohnson)\ **Replies:** 0\ **Last updated:** [July 14, 2021, 7:52pm UTC](https://discuss.elastic.co/t/environment-setup-for-modifying-logstash-plugin/278712 "2021-07-14T19:52:47Z")
Is there a tutorial for setting up your environment for modifying an existing logstash ruby plugin i.e. what version of java to use, jruby to use, how to install jars etc. How to write a Logstash output plugin | Logstash… --- ## [Filter Visualizations on a Dashboard using the default time range (dashboard upper right corner) on filter conditions using fields other than index pattern primary time field](https://discuss.elastic.co/t/filter-visualizations-on-a-dashboard-using-the-default-time-range-dashboard-upper-right-corner-on-filter-conditions-using-fields-other-than-index-pattern-primary-time-field/278209)
**Author:** [@fefontana](https://discuss.elastic.co/u/fefontana)\ **Replies:** 4\ **Last updated:** [July 14, 2021, 7:48pm UTC](https://discuss.elastic.co/t/filter-visualizations-on-a-dashboard-using-the-default-time-range-dashboard-upper-right-corner-on-filter-conditions-using-fields-other-than-index-pattern-primary-time-field/278209 "2021-07-14T19:48:24Z")
Hi, is it possible to have a multiple "Time Field" index pattern ?. I would like to use the default time filter in a dashboard to filter dynamically 3 visualizations this way: Index pattern time field = field1\* Dashbo… --- ## [Elasticsearch Query DSL help need to sort on timestamp](https://discuss.elastic.co/t/elasticsearch-query-dsl-help-need-to-sort-on-timestamp/278634)
**Author:** [@bab](https://discuss.elastic.co/u/bab)\ **Replies:** 1\ **Last updated:** [July 14, 2021, 7:02pm UTC](https://discuss.elastic.co/t/elasticsearch-query-dsl-help-need-to-sort-on-timestamp/278634 "2021-07-14T19:02:07Z")
i need your Help Expertes, i need to update this query to be able to get the result filtered on Prim\_id alphabetic and timestamp ascending, each Prim\_id is present in a log-event sorted on timestamp (log time). i mean ,… --- ## [Creating external case from Elastic to XSOAR](https://discuss.elastic.co/t/creating-external-case-from-elastic-to-xsoar/278354)
**Author:** [@randomguyneedhelp](https://discuss.elastic.co/u/randomguyneedhelp)\ **Replies:** 3\ **Last updated:** [July 14, 2021, 6:53pm UTC](https://discuss.elastic.co/t/creating-external-case-from-elastic-to-xsoar/278354 "2021-07-14T18:53:21Z")
Hi, I will like to know if there are such integration between Elastic and XSOAR. Understand there are integrations for such functions with ServiceNow, JIRA and IBM Resilient, however I am trying to make use Cortex XSOAR… --- ## [Scripted fields: Coalesce](https://discuss.elastic.co/t/scripted-fields-coalesce/278515)
**Author:** [@ITchandj](https://discuss.elastic.co/u/ITchandj)\ **Replies:** 1\ **Last updated:** [July 14, 2021, 6:46pm UTC](https://discuss.elastic.co/t/scripted-fields-coalesce/278515 "2021-07-14T18:46:47Z")
Hello!!! i want to write a scripted fields that do the following calculation. how should i do it. Procuser = coalesce (ProcUserExpanded, ProcUser) --- ## [Rules export in excel and exception search under rule](https://discuss.elastic.co/t/rules-export-in-excel-and-exception-search-under-rule/278703)
**Author:** [@realtech2338](https://discuss.elastic.co/u/realtech2338)\ **Replies:** 0\ **Last updated:** [July 14, 2021, 6:29pm UTC](https://discuss.elastic.co/t/rules-export-in-excel-and-exception-search-under-rule/278703 "2021-07-14T18:29:08Z")
is there a way to download all elastic rules into excel and also exceptions under each rule into excel from ealsticsearch Also how to use search option under exceptions? --- ## [Need Help : To Parse XML and Json data received via TCP syslog in logstash](https://discuss.elastic.co/t/need-help-to-parse-xml-and-json-data-received-via-tcp-syslog-in-logstash/278650)
**Author:** [@Shruti\_Gupta](https://discuss.elastic.co/u/Shruti_Gupta)\ **Replies:** 3\ **Last updated:** [July 14, 2021, 5:45pm UTC](https://discuss.elastic.co/t/need-help-to-parse-xml-and-json-data-received-via-tcp-syslog-in-logstash/278650 "2021-07-14T17:45:43Z")
I am receiving google apigee logs in syslog at 5444 port. Logs are being generating via multiple applications and format is also different like XML and Json. Need help how can we configure logstash.conf to parse both ty… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=882) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=884)