# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1000 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1001 --- ## [Could not connect to a compatible version of Elasticsearch (elasticsearch 7.8.0 with logstash 7.17.1)](https://discuss.elastic.co/t/could-not-connect-to-a-compatible-version-of-elasticsearch-elasticsearch-7-8-0-with-logstash-7-17-1/300688)
**Author:** [@splash](https://discuss.elastic.co/u/splash)\ **Replies:** 2\ **Last updated:** [March 25, 2022, 3:35pm UTC](https://discuss.elastic.co/t/could-not-connect-to-a-compatible-version-of-elasticsearch-elasticsearch-7-8-0-with-logstash-7-17-1/300688 "2022-03-25T15:35:47Z")
Hi everyone, we are running a Robotic Process Automation software called "Automation Anywhere" which uses Elasticsearch 7.8.0: "version" : { "number" : "7.8.0", "build\_flavor" : "oss", "build\_type" : "zip",… --- ## [Metricbeat, Filebeat spawning lots of child procs](https://discuss.elastic.co/t/metricbeat-filebeat-spawning-lots-of-child-procs/300503)
**Author:** [@perfecto25](https://discuss.elastic.co/u/perfecto25)\ **Replies:** 2\ **Last updated:** [March 25, 2022, 3:31pm UTC](https://discuss.elastic.co/t/metricbeat-filebeat-spawning-lots-of-child-procs/300503 "2022-03-25T15:31:29Z")
Hello, Im running fbeat, mbeat 7.17 on centos 7 I see it spawning off tons of child procs, is there way to limit this? Whats the reason why so many procs are spawned? --- ## [Metricbeat add\_field from file?](https://discuss.elastic.co/t/metricbeat-add-field-from-file/300718)
**Author:** [@thech](https://discuss.elastic.co/u/thech)\ **Replies:** 0\ **Last updated:** [March 25, 2022, 3:31pm UTC](https://discuss.elastic.co/t/metricbeat-add-field-from-file/300718 "2022-03-25T15:31:15Z")
Hello, I have Metricbeat and my application running from different containers. The application starts and generates a UUID, storing it in a file app.uuid. I can mount this file to Metricbeat, but how can I add it as a f… --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/300236)
**Author:** [@justintaylor9](https://discuss.elastic.co/u/justintaylor9)\ **Replies:** 8\ **Last updated:** [March 25, 2022, 2:52pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/300236 "2022-03-25T14:52:34Z")
I am getting this error in the browser. Here are my configs: Kibana.yml: \ server.host: 10.241.89.153 Elasticsearch.hosts: "http://10.241.89.144:9200" server.port: 80 Elasticsearch.ssl.verificationMode: certifica… --- ## [Winlogbeat "No results match your search criteria"](https://discuss.elastic.co/t/winlogbeat-no-results-match-your-search-criteria/300713)
**Author:** [@n.petrovic](https://discuss.elastic.co/u/n.petrovic)\ **Replies:** 0\ **Last updated:** [March 25, 2022, 2:19pm UTC](https://discuss.elastic.co/t/winlogbeat-no-results-match-your-search-criteria/300713 "2022-03-25T14:19:33Z")
winlogbeat "No results match your search criteria" Client setup done properly PS C:\\ProgramData\\Beats\\winlogbeat-7.15.0-windows-x86\_64\> .\\winlogbeat.exe setup Overwriting ILM policy is disabled. Set setup.ilm.overwrit… --- ## [How to update all docs with query that looks for a regex and update it incase found](https://discuss.elastic.co/t/how-to-update-all-docs-with-query-that-looks-for-a-regex-and-update-it-incase-found/299894)
**Author:** [@ShayWeizman](https://discuss.elastic.co/u/ShayWeizman)\ **Replies:** 12\ **Last updated:** [March 25, 2022, 1:52pm UTC](https://discuss.elastic.co/t/how-to-update-all-docs-with-query-that-looks-for-a-regex-and-update-it-incase-found/299894 "2022-03-25T13:52:07Z")
Hi, I'm using 7.16.2. I have a lot of records looks like this { "\_index" : "testcases", "\_type" : "\_doc", "\_id" : "Cv6z8HoBF-BJEaLQYGtU", "\_score" : 1.0, "\_source" : { … --- ## [Error Field \[data\] not present as part of path \[data\]](https://discuss.elastic.co/t/error-field-data-not-present-as-part-of-path-data/300642)
**Author:** [@Enxiad](https://discuss.elastic.co/u/Enxiad)\ **Replies:** 2\ **Last updated:** [March 25, 2022, 12:41pm UTC](https://discuss.elastic.co/t/error-field-data-not-present-as-part-of-path-data/300642 "2022-03-25T12:41:01Z")
(Redacted for improved clarity, please see next post on this thread) --- ## [ILM pattern is incrementing by two numbers instead of one](https://discuss.elastic.co/t/ilm-pattern-is-incrementing-by-two-numbers-instead-of-one/299882)
**Author:** [@adminunix](https://discuss.elastic.co/u/adminunix)\ **Replies:** 1\ **Last updated:** [March 25, 2022, 12:31pm UTC](https://discuss.elastic.co/t/ilm-pattern-is-incrementing-by-two-numbers-instead-of-one/299882 "2022-03-25T12:31:44Z")
Hi, I have a strange issue with new backing indices creates after rollover. Suffix number is incrementing by two numbers instead of one. Initially, ILM generated new indices with correct names incrementing only one… --- ## [How to return data that has particular columns in every \_source dictionary in Elasticsearch?](https://discuss.elastic.co/t/how-to-return-data-that-has-particular-columns-in-every-source-dictionary-in-elasticsearch/300680)
**Author:** [@Harish\_fragger](https://discuss.elastic.co/u/Harish_fragger)\ **Replies:** 1\ **Last updated:** [March 25, 2022, 10:41am UTC](https://discuss.elastic.co/t/how-to-return-data-that-has-particular-columns-in-every-source-dictionary-in-elasticsearch/300680 "2022-03-25T10:41:50Z")
I have an Elasticsearch query which is extracting data from the following fields "\_source": \["data.service","data.vpn","data.policyid","data.srccountry1"\] . While using the search function which gives only max hits of 10… --- ## [Multi level Transform with Elasticsearch](https://discuss.elastic.co/t/multi-level-transform-with-elasticsearch/300226)
**Author:** [@bianca6](https://discuss.elastic.co/u/bianca6)\ **Replies:** 1\ **Last updated:** [March 25, 2022, 10:30am UTC](https://discuss.elastic.co/t/multi-level-transform-with-elasticsearch/300226 "2022-03-25T10:30:05Z")
Hi, I have different logs just like this: timestamp = A, group = B, objectCount= C timestamp = A, group = B, object = D, value = E timestamp = A, group = B, object = F, value = G I already use a Transform which group… --- ## [Concatenate / join values of tags into one field](https://discuss.elastic.co/t/concatenate-join-values-of-tags-into-one-field/300606)
**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\ **Replies:** 2\ **Last updated:** [March 25, 2022, 10:29am UTC](https://discuss.elastic.co/t/concatenate-join-values-of-tags-into-one-field/300606 "2022-03-25T10:29:01Z")
hello! i want to join all the tags field values into one new field? can i do that with join mutate filter ? if not, how can i do that ? example : tags = \["1","2","3"\] new\_field = "123" thanks in advanced! p.d. is… --- ## [Unable to view namespace labels in report, only pod level labels work](https://discuss.elastic.co/t/unable-to-view-namespace-labels-in-report-only-pod-level-labels-work/300683)
**Author:** [@MChal](https://discuss.elastic.co/u/MChal)\ **Replies:** 1\ **Last updated:** [March 25, 2022, 10:01am UTC](https://discuss.elastic.co/t/unable-to-view-namespace-labels-in-report-only-pod-level-labels-work/300683 "2022-03-25T10:01:42Z")
Hey there, I'm looking to create a report that aggregates CPU and Memory usage based on a reporting label. I have labelled some namespaces as a test and my labels don't come up until I also label individual pods. Is the… --- ## [HTTP monitor and TLS connection in Heartbeat 7.17.0](https://discuss.elastic.co/t/http-monitor-and-tls-connection-in-heartbeat-7-17-0/300343)
**Author:** [@gigaset](https://discuss.elastic.co/u/gigaset)\ **Replies:** 5\ **Last updated:** [March 25, 2022, 9:59am UTC](https://discuss.elastic.co/t/http-monitor-and-tls-connection-in-heartbeat-7-17-0/300343 "2022-03-25T09:59:59Z")
Hi, I'm using Heartbeat v7.17.0, and it looks like there is a problem with establishing the TLS connection in the HTTP monitor. The first problem is that the config option ssl.verification\_mode: none seems not to work. … --- ## [Can we import one elastic search cluster data into another?](https://discuss.elastic.co/t/can-we-import-one-elastic-search-cluster-data-into-another/300529)
**Author:** [@Prashant\_Kamble](https://discuss.elastic.co/u/Prashant_Kamble)\ **Replies:** 14\ **Last updated:** [March 25, 2022, 9:14am UTC](https://discuss.elastic.co/t/can-we-import-one-elastic-search-cluster-data-into-another/300529 "2022-03-25T09:14:48Z")
We have two different clusters created on Elasticsearch server cluster 6.8 cluster 7.10 Just wanted to check is there any way to import data from one cluster to another? If yes, what are the ways to do it without re-i… --- ## [Modsecurity integrations vanished](https://discuss.elastic.co/t/modsecurity-integrations-vanished/299341)
**Author:** [@stefan.pinter](https://discuss.elastic.co/u/stefan.pinter)\ **Replies:** 1\ **Last updated:** [March 25, 2022, 8:55am UTC](https://discuss.elastic.co/t/modsecurity-integrations-vanished/299341 "2022-03-25T08:55:37Z")
hi! a few weeks ago I had the possibility to install the modsecurity integration from within kibana... but now it is gone - can this be an issue on my site? thanks! --- ## [Duplicate document ids when using rolling indices](https://discuss.elastic.co/t/duplicate-document-ids-when-using-rolling-indices/300666)
**Author:** [@vlasami](https://discuss.elastic.co/u/vlasami)\ **Replies:** 0\ **Last updated:** [March 25, 2022, 7:46am UTC](https://discuss.elastic.co/t/duplicate-document-ids-when-using-rolling-indices/300666 "2022-03-25T07:46:27Z")
Hi, We have ES v7.17 and started to use index rolling with ILM (with 40G size limit on index) and faced a document duplication issue that was described in the ILM updating record with existing Id on older index creates… --- ## [Unable to run localhost:9200](https://discuss.elastic.co/t/unable-to-run-localhost-9200/300656)
**Author:** [@sureshaws](https://discuss.elastic.co/u/sureshaws)\ **Replies:** 3\ **Last updated:** [March 25, 2022, 8:14am UTC](https://discuss.elastic.co/t/unable-to-run-localhost-9200/300656 "2022-03-25T08:14:10Z")
Installed elastic but do not see localhost:9200 loading # ====================Preformatted text==== Elasticsearch Configuration ========================= # # NOTE: Elasticsearch comes with reasonable defaults for most s… --- ## [Couldn't Harvest log file from Docker](https://discuss.elastic.co/t/couldnt-harvest-log-file-from-docker/300667)
**Author:** [@chathuwadev\_dev](https://discuss.elastic.co/u/chathuwadev_dev)\ **Replies:** 0\ **Last updated:** [March 25, 2022, 7:47am UTC](https://discuss.elastic.co/t/couldnt-harvest-log-file-from-docker/300667 "2022-03-25T07:47:09Z")
Hi All, I am beginner for ELK stack, Below my work scenario I am going to centralize logs from my Microservices Also i used ELK stack and i already config it in docker-compose.yml Kibana,Elasticsearch and Logs… --- ## [Terms aggregation bucket Sorting is not working when using with partition](https://discuss.elastic.co/t/terms-aggregation-bucket-sorting-is-not-working-when-using-with-partition/298502)
**Author:** [@truptir](https://discuss.elastic.co/u/truptir)\ **Replies:** 12\ **Last updated:** [March 25, 2022, 7:47am UTC](https://discuss.elastic.co/t/terms-aggregation-bucket-sorting-is-not-working-when-using-with-partition/298502 "2022-03-25T07:47:04Z")
I am trying to do TermAggregation + Sort order(by \_count) + pagination(using partition). But resulting bucket partitions are not sorted properly. Without using partitions, sorting is working properly. Here is my elasti… --- ## [Need assistance with creating daily winlogbeat indices that follow an ILM policy](https://discuss.elastic.co/t/need-assistance-with-creating-daily-winlogbeat-indices-that-follow-an-ilm-policy/300665)
**Author:** [@roman-tasi](https://discuss.elastic.co/u/roman-tasi)\ **Replies:** 0\ **Last updated:** [March 25, 2022, 7:25am UTC](https://discuss.elastic.co/t/need-assistance-with-creating-daily-winlogbeat-indices-that-follow-an-ilm-policy/300665 "2022-03-25T07:25:43Z")
I created a winlogbeat index with a PUT request as so : PUT /%3Cwinlogbeat-%7Bnow%2Fd%7D-000001%3E { "aliases": { "winlogbeat": { "is\_write\_index": true } } } It then asked me to select a rollover alias from a dropdown… --- ## [How to get results from another results field value](https://discuss.elastic.co/t/how-to-get-results-from-another-results-field-value/300014)
**Author:** [@Shushil\_Shankar](https://discuss.elastic.co/u/Shushil_Shankar)\ **Replies:** 3\ **Last updated:** [March 25, 2022, 7:04am UTC](https://discuss.elastic.co/t/how-to-get-results-from-another-results-field-value/300014 "2022-03-25T07:04:41Z")
Hi Everyone, I need to implement a query when the results are returned, from that I need to take one field value then need to get another result from the field, From the above screenshot, I got some results based on … --- ## [Group by and having max field](https://discuss.elastic.co/t/group-by-and-having-max-field/300519)
**Author:** [@brknlpr](https://discuss.elastic.co/u/brknlpr)\ **Replies:** 2\ **Last updated:** [March 25, 2022, 6:05am UTC](https://discuss.elastic.co/t/group-by-and-having-max-field/300519 "2022-03-25T06:05:20Z")
Hi I have a data in kibana as below What I am trying to do is to get the only journeyId.keyword 's which has max IndexInEntry for example this is the response I want to get c4ca5cfaedbfa3f6de4feb1590002c50 3 c9f6d… --- ## [Sort before pagination](https://discuss.elastic.co/t/sort-before-pagination/300617)
**Author:** [@Rushil\_Patel](https://discuss.elastic.co/u/Rushil_Patel)\ **Replies:** 1\ **Last updated:** [March 25, 2022, 4:17am UTC](https://discuss.elastic.co/t/sort-before-pagination/300617 "2022-03-25T04:17:14Z")
Hey I am trying to sort and paginate the result simultaneously, but I am not getting the expected result. NOTE: we are using 6.1 version Example: data = \[ { level : 0 time: some date ... other fields } , { level: 1 t… --- ## [Is there a way to automatically apply a mapping?](https://discuss.elastic.co/t/is-there-a-way-to-automatically-apply-a-mapping/300632)
**Author:** [@johnrodey](https://discuss.elastic.co/u/johnrodey)\ **Replies:** 1\ **Last updated:** [March 25, 2022, 4:04am UTC](https://discuss.elastic.co/t/is-there-a-way-to-automatically-apply-a-mapping/300632 "2022-03-25T04:04:11Z")
Currently I have an API that on initialization checks if my index exists, if not it creates it and applies my mapping, then allows the client to index documents. By and large this works well however sometimes we run int… --- ## [How to complete a common word from bunch of docs](https://discuss.elastic.co/t/how-to-complete-a-common-word-from-bunch-of-docs/300549)
**Author:** [@casparxu](https://discuss.elastic.co/u/casparxu)\ **Replies:** 2\ **Last updated:** [March 25, 2022, 2:47am UTC](https://discuss.elastic.co/t/how-to-complete-a-common-word-from-bunch-of-docs/300549 "2022-03-25T02:47:12Z")
Hi there, I'm trying to use 'search\_as\_you\_type' for auto complete. I got the idea of how this works, but stuck with a basic scneario. for exmaple I have a field with type 'search\_as\_you\_type' { "mappings": { "p… --- ## [Why strong rotation](https://discuss.elastic.co/t/why-strong-rotation/300413)
**Author:** [@Oliverwq](https://discuss.elastic.co/u/Oliverwq)\ **Replies:** 2\ **Last updated:** [March 25, 2022, 1:34am UTC](https://discuss.elastic.co/t/why-strong-rotation/300413 "2022-03-25T01:34:04Z")
In ClusterHealthResponse that int numberOfNodes = (int) parsedObjects\[i++\]; int numberOfDataNodes = (int) parsedObjects\[i++\]; int activeShards = (int) parsedObjects\[i++\]; int relocat… --- ## [Ubuntu 20.04 What has happened to "http://artifacts.elastic.co/packages/7.x/apt"](https://discuss.elastic.co/t/ubuntu-20-04-what-has-happened-to-http-artifacts-elastic-co-packages-7-x-apt/300641)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 0\ **Last updated:** [March 24, 2022, 9:00pm UTC](https://discuss.elastic.co/t/ubuntu-20-04-what-has-happened-to-http-artifacts-elastic-co-packages-7-x-apt/300641 "2022-03-24T21:00:07Z")
It appear to have vanished -- Trying to install a new kibaban 7.x instance on a new VM and apt update says E: The repository 'http://artifacts.elastic.co/packages/7.x/apt stable Release' does not have a Release file. a… --- ## [Need help: amazon\_es is installed but still getting error that the plugin is not installed](https://discuss.elastic.co/t/need-help-amazon-es-is-installed-but-still-getting-error-that-the-plugin-is-not-installed/300648)
**Author:** [@dontusk1980](https://discuss.elastic.co/u/dontusk1980)\ **Replies:** 0\ **Last updated:** [March 24, 2022, 11:53pm UTC](https://discuss.elastic.co/t/need-help-amazon-es-is-installed-but-still-getting-error-that-the-plugin-is-not-installed/300648 "2022-03-24T23:53:11Z")
Hi team, installed logstash-plugin install logstash-output-amazon\_es, but once restarted the logstash, log says not installed, detailed logs are as below \[root@ip-10-33-89-199 bin\]# ./logstash --version Using JAVA\_HOM… --- ## [Max\_snapshot\_bytes\_per\_sec - Implications of setting this value](https://discuss.elastic.co/t/max-snapshot-bytes-per-sec-implications-of-setting-this-value/300643)
**Author:** [@bar0n36](https://discuss.elastic.co/u/bar0n36)\ **Replies:** 0\ **Last updated:** [March 24, 2022, 9:37pm UTC](https://discuss.elastic.co/t/max-snapshot-bytes-per-sec-implications-of-setting-this-value/300643 "2022-03-24T21:37:37Z")
I am after a more in depth explanation of the implications of adjusting the max\_snapshot\_bytes\_per\_sec for an S3 repository. Reading the documentation, it is simply described as max\_snapshot\_bytes\_per\_sec (Optional, byt… --- ## [Filebeat and Logstash tuning - How to align performance](https://discuss.elastic.co/t/filebeat-and-logstash-tuning-how-to-align-performance/300268)
**Author:** [@bar0n36](https://discuss.elastic.co/u/bar0n36)\ **Replies:** 1\ **Last updated:** [March 24, 2022, 10:22pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash-tuning-how-to-align-performance/300268 "2022-03-24T22:22:55Z")
I am in the process of trying to ingest a massive backlog of logs (10s of TB) via Filebeat \> Logstash \> Ingest Node \> Elasticsearch. I have scaled out the pipeline extensively and am now at a point where I am struggling… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=999) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1001)