# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1021 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1022 --- ## [High memory taken by segments.terms\_memory\_in\_bytes](https://discuss.elastic.co/t/high-memory-taken-by-segments-terms-memory-in-bytes/299134)
**Author:** [@Vikrant\_Aggarwal](https://discuss.elastic.co/u/Vikrant_Aggarwal)\ **Replies:** 11\ **Last updated:** [March 9, 2022, 10:18am UTC](https://discuss.elastic.co/t/high-memory-taken-by-segments-terms-memory-in-bytes/299134 "2022-03-09T10:18:11Z")
Hello Experts, ES : 6.4 We have 21 data nodes cluster. Seeing high memory consumed by segments.terms\_memory\_in\_bytes which causing circuit breaker issues for us. Wanted to understand why segments are taking so much mem… --- ## [Elastic search upgrade from 7.14.2 to 8.0 or near to that](https://discuss.elastic.co/t/elastic-search-upgrade-from-7-14-2-to-8-0-or-near-to-that/298961)
**Author:** [@Vinay\_Menon1](https://discuss.elastic.co/u/Vinay_Menon1)\ **Replies:** 7\ **Last updated:** [March 9, 2022, 10:17am UTC](https://discuss.elastic.co/t/elastic-search-upgrade-from-7-14-2-to-8-0-or-near-to-that/298961 "2022-03-09T10:17:38Z")
Hi Team, I need to upgrade Elasticsearch from 7.14.2 which I see in stack management to 8.0 or near to that version I am also using heartbeat, metricbeat & logstash as well on the on few of the servers to collect data/… --- ## [Monitoring Azure using Elastic Cloud](https://discuss.elastic.co/t/monitoring-azure-using-elastic-cloud/298948)
**Author:** [@mgfeal](https://discuss.elastic.co/u/mgfeal)\ **Replies:** 3\ **Last updated:** [March 9, 2022, 9:45am UTC](https://discuss.elastic.co/t/monitoring-azure-using-elastic-cloud/298948 "2022-03-09T09:45:46Z")
Hello, We have infrastructure in Azure, we are starting with deployments and need to monitor everything. There are applications, kubernetes, microservices, containers, logs.... I've been watching some video of how to c… --- ## [Can we have save query as a sub feature in Kibana](https://discuss.elastic.co/t/can-we-have-save-query-as-a-sub-feature-in-kibana/299061)
**Author:** [@Shashankdevaraj](https://discuss.elastic.co/u/Shashankdevaraj)\ **Replies:** 3\ **Last updated:** [March 9, 2022, 9:16am UTC](https://discuss.elastic.co/t/can-we-have-save-query-as-a-sub-feature-in-kibana/299061 "2022-03-09T09:16:24Z")
If we have a separate access/privilege in role for Kibana to save query it will be great. As without write access we can give this privilege to users. --- ## [Canvas showing couldn't update workpad errors](https://discuss.elastic.co/t/canvas-showing-couldnt-update-workpad-errors/299027)
**Author:** [@azulgrana](https://discuss.elastic.co/u/azulgrana)\ **Replies:** 3\ **Last updated:** [March 9, 2022, 9:16am UTC](https://discuss.elastic.co/t/canvas-showing-couldnt-update-workpad-errors/299027 "2022-03-09T09:16:01Z")
Hi there! I'm new to Canvas and I'm trying to use the service on one of my instances where I'm running other services as well. And while I'm using Canvas I'm seeing some errors showing Couldn't update workpad / Intern… --- ## [Integration of kibana widgets in angular app](https://discuss.elastic.co/t/integration-of-kibana-widgets-in-angular-app/298929)
**Author:** [@frank3nst3in](https://discuss.elastic.co/u/frank3nst3in)\ **Replies:** 3\ **Last updated:** [March 9, 2022, 9:15am UTC](https://discuss.elastic.co/t/integration-of-kibana-widgets-in-angular-app/298929 "2022-03-09T09:15:03Z")
Hi Elastic Team, I have a working angular app, a nodejs backend and a privately hosted ELK instance. Currently, everything is going good with kibana dashboard. But, now I want to display widgets generated by the kiban… --- ## [Elasticsearch and Docker Generating http\_ca.crt](https://discuss.elastic.co/t/elasticsearch-and-docker-generating-http-ca-crt/299011)
**Author:** [@SwampyFox](https://discuss.elastic.co/u/SwampyFox)\ **Replies:** 2\ **Last updated:** [March 9, 2022, 8:40am UTC](https://discuss.elastic.co/t/elasticsearch-and-docker-generating-http-ca-crt/299011 "2022-03-09T08:40:26Z")
I have followed the instructions on installing Elasticsearch on Docker for version 8.0.1. I am able to run the curl command against "https://localhost:9200" with the http\_ca.crt and the password generated for the elasti… --- ## [AWS IoT data to Elastc Cloud](https://discuss.elastic.co/t/aws-iot-data-to-elastc-cloud/298755)
**Author:** [@Keo](https://discuss.elastic.co/u/Keo)\ **Replies:** 2\ **Last updated:** [March 9, 2022, 7:50am UTC](https://discuss.elastic.co/t/aws-iot-data-to-elastc-cloud/298755 "2022-03-09T07:50:52Z")
Hi, Do you have recommendation on how to send data from an AWS IoT Core MQTT Broker to an Elasticsearch instance that is managed using ElasticCloud ? The only lead I have so far is to use a combination of AWS Cloudwatc… --- ## [Snapshot and restore for a Cluster](https://discuss.elastic.co/t/snapshot-and-restore-for-a-cluster/299082)
**Author:** [@Arpita11](https://discuss.elastic.co/u/Arpita11)\ **Replies:** 2\ **Last updated:** [March 9, 2022, 7:08am UTC](https://discuss.elastic.co/t/snapshot-and-restore-for-a-cluster/299082 "2022-03-09T07:08:40Z")
I have a cluster with three nodes (1 master, 2 data and master eligible) in my primary region. I need to take a snapshot of this cluster. If primary region goes down, I will spin up one node in secondary region and rest… --- ## [Any setting in CSV filter to disable auto datatype conversion and keep everything in string?](https://discuss.elastic.co/t/any-setting-in-csv-filter-to-disable-auto-datatype-conversion-and-keep-everything-in-string/299163)
**Author:** [@pinehk](https://discuss.elastic.co/u/pinehk)\ **Replies:** 6\ **Last updated:** [March 9, 2022, 6:59am UTC](https://discuss.elastic.co/t/any-setting-in-csv-filter-to-disable-auto-datatype-conversion-and-keep-everything-in-string/299163 "2022-03-09T06:59:42Z")
In both version 7.x and 8, with a very simple csv filter configuration below, for no reason some fields are mapped as "date". In the documentation, there is a switch "convert" that we can customize datatype conversion fr… --- ## [Elasticsearch Cluster Ingest Node Sizing](https://discuss.elastic.co/t/elasticsearch-cluster-ingest-node-sizing/298971)
**Author:** [@chateesh](https://discuss.elastic.co/u/chateesh)\ **Replies:** 3\ **Last updated:** [March 9, 2022, 6:55am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-ingest-node-sizing/298971 "2022-03-09T06:55:23Z")
Hi Team, We're planning to add a new Ingest node to running ES cluster, this node is dedicated only for data ingestion. How to do capacity planning for ingest node, does this memory optimized or CPU optimized, to ingest… --- ## [Logstash agent stopped due to error "Don't know how to handle \`Java::JavaLang::IllegalStateException\` for \`PipelineAction::Create\\`"](https://discuss.elastic.co/t/logstash-agent-stopped-due-to-error-dont-know-how-to-handle-java-illegalstateexception-for-pipelineaction-create-main/299168)
**Author:** [@ashiqab](https://discuss.elastic.co/u/ashiqab)\ **Replies:** 2\ **Last updated:** [March 9, 2022, 6:43am UTC](https://discuss.elastic.co/t/logstash-agent-stopped-due-to-error-dont-know-how-to-handle-java-illegalstateexception-for-pipelineaction-create-main/299168 "2022-03-09T06:43:41Z")
Hi, I am new to ELK stack and have installed the three components on my SUSE linux 12 server. Running java 17.0.2. My logstash-plain.log repeats the java error for the agent which stops with below error: \[2022-03-09T0… --- ## [Create kibana visualization & dashboard - templates ndjson](https://discuss.elastic.co/t/create-kibana-visualization-dashboard-templates-ndjson/298609)
**Author:** [@swchandu](https://discuss.elastic.co/u/swchandu)\ **Replies:** 6\ **Last updated:** [March 9, 2022, 6:32am UTC](https://discuss.elastic.co/t/create-kibana-visualization-dashboard-templates-ndjson/298609 "2022-03-09T06:32:20Z")
Hi, Is there a tool/method to create a template(ndjson) for a dashboard & its visualizations; so that we can replicate the same structure with a different name for another index pattern. Thanks Chandrakanth --- ## [Need to extract specific message from log](https://discuss.elastic.co/t/need-to-extract-specific-message-from-log/299171)
**Author:** [@sushant12](https://discuss.elastic.co/u/sushant12)\ **Replies:** 0\ **Last updated:** [March 9, 2022, 6:29am UTC](https://discuss.elastic.co/t/need-to-extract-specific-message-from-log/299171 "2022-03-09T06:29:13Z")
address space usage: 1827991552 bytes/1743MB} {rss usage: 389292032 bytes/371MB} \[pid: 19335|app: 0|req: 17171/48113\] 10.195.0.169 () {50 vars in 816 bytes} \[Mon Feb 21 04:06:57 2022\] GET /web/test\_name?name=sush =\> gene… --- ## [Alternative for SQL transaction in Elastic-search](https://discuss.elastic.co/t/alternative-for-sql-transaction-in-elastic-search/299166)
**Author:** [@Muhammad\_Hamza](https://discuss.elastic.co/u/Muhammad_Hamza)\ **Replies:** 1\ **Last updated:** [March 9, 2022, 5:36am UTC](https://discuss.elastic.co/t/alternative-for-sql-transaction-in-elastic-search/299166 "2022-03-09T05:36:39Z")
Is there any alternative to SQL Transactions in Elastic-search? I want to perform multiple bulk indexing operations in batches and if any batch fails at some point, I would like to revert the whole indexing process. --- ## [Replacing all instances of a string in nested JSON](https://discuss.elastic.co/t/replacing-all-instances-of-a-string-in-nested-json/299152)
**Author:** [@7armyant](https://discuss.elastic.co/u/7armyant)\ **Replies:** 4\ **Last updated:** [March 9, 2022, 4:39am UTC](https://discuss.elastic.co/t/replacing-all-instances-of-a-string-in-nested-json/299152 "2022-03-09T04:39:17Z")
Hi Gurus, I'm new to logstash and have had little success with the following. I have been trying to relace all instances of a sting in nested JSON. Below is the JSON in question: "{"totalCount": 2, "nextPageKey": n… --- ## [Scripted fields not working for nested value in Kibana 7.x](https://discuss.elastic.co/t/scripted-fields-not-working-for-nested-value-in-kibana-7-x/297647)
**Author:** [@frankfenomena](https://discuss.elastic.co/u/frankfenomena)\ **Replies:** 7\ **Last updated:** [March 9, 2022, 4:38am UTC](https://discuss.elastic.co/t/scripted-fields-not-working-for-nested-value-in-kibana-7-x/297647 "2022-03-09T04:38:50Z")
My scripted field works as intended in older version of kibana 5.x, but we use 7.x in a different environment and the same scripted field does not work. I've searched for what the syntax change would be in 7.x but could… --- ## [Why and how to use elastic charts?](https://discuss.elastic.co/t/why-and-how-to-use-elastic-charts/298836)
**Author:** [@frank3nst3in](https://discuss.elastic.co/u/frank3nst3in)\ **Replies:** 4\ **Last updated:** [March 9, 2022, 3:26am UTC](https://discuss.elastic.co/t/why-and-how-to-use-elastic-charts/298836 "2022-03-09T03:26:05Z")
I found the @elastic/charts library on official github profile of elastic. So, can I create visualizations (ones which are displayed in a kibana dashboard) by consuming Elasticsearch rest api and @elastic/charts ? If y… --- ## [How to filebeat logs to elastic cloud](https://discuss.elastic.co/t/how-to-filebeat-logs-to-elastic-cloud/299098)
**Author:** [@sulfred](https://discuss.elastic.co/u/sulfred)\ **Replies:** 1\ **Last updated:** [March 9, 2022, 1:41am UTC](https://discuss.elastic.co/t/how-to-filebeat-logs-to-elastic-cloud/299098 "2022-03-09T01:41:54Z")
I am trying the Elastic Cloud. I want to send logs to the cloud with filebeat. I am keep receiving errors: pipeline/output.go:154 Failed to connect to backoff(elasticsearch(https://cloud-name-instance.aws.elastic-clou… --- ## [.management-beats index - can I delete it?](https://discuss.elastic.co/t/management-beats-index-can-i-delete-it/299147)
**Author:** [@lag](https://discuss.elastic.co/u/lag)\ **Replies:** 0\ **Last updated:** [March 8, 2022, 11:30pm UTC](https://discuss.elastic.co/t/management-beats-index-can-i-delete-it/299147 "2022-03-08T23:30:14Z")
We are preparing for Elastic 8.0 and one of the critical errors we have is .management-beats index that was created prior to 7.0. We are not using this functionality and since beats central management has been discontin… --- ## [Newbie to Linux/elastic. I'm having trouble setting up elasticsearch](https://discuss.elastic.co/t/newbie-to-linux-elastic-im-having-trouble-setting-up-elasticsearch/298687)
**Author:** [@elasticScrub](https://discuss.elastic.co/u/elasticScrub)\ **Replies:** 19\ **Last updated:** [March 8, 2022, 11:19pm UTC](https://discuss.elastic.co/t/newbie-to-linux-elastic-im-having-trouble-setting-up-elasticsearch/298687 "2022-03-08T23:19:49Z")
As the title says I'm new to Elasticsearch and Linux in general. I have setup an Ubuntu server in VirtualBox for installing Elasticsearch. I followed the guide listed on installing it and am currently stuck on this step. … --- ## [Mutate gsub pattern help for filter](https://discuss.elastic.co/t/mutate-gsub-pattern-help-for-filter/299020)
**Author:** [@itschobot](https://discuss.elastic.co/u/itschobot)\ **Replies:** 6\ **Last updated:** [March 8, 2022, 10:54pm UTC](https://discuss.elastic.co/t/mutate-gsub-pattern-help-for-filter/299020 "2022-03-08T22:54:13Z")
Hello, still new using regular expressions I currently am working on this to parse in my "message": {"groupByActivity":false,"exampleDevices":\[{"ip":"1.2.3.4","hostname":"example.hostname.com","sid":123456,"subnet":"som… --- ## [How to increase disk capacity of elasticsearch nodes?](https://discuss.elastic.co/t/how-to-increase-disk-capacity-of-elasticsearch-nodes/298951)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 1\ **Last updated:** [March 8, 2022, 10:44pm UTC](https://discuss.elastic.co/t/how-to-increase-disk-capacity-of-elasticsearch-nodes/298951 "2022-03-08T22:44:03Z")
Hello everyone, I want to increase the disk capacity of Elasticsearch data nodes. For this, I expect it to forward the shards on the node to other nodes using "cluster.routing.allocation.exclude.\_ip":"192.168.x.x" first.… --- ## [Elastic agent enrolled but not sending any data](https://discuss.elastic.co/t/elastic-agent-enrolled-but-not-sending-any-data/298957)
**Author:** [@Youssef\_Kaak](https://discuss.elastic.co/u/Youssef_Kaak)\ **Replies:** 0\ **Last updated:** [March 7, 2022, 11:07am UTC](https://discuss.elastic.co/t/elastic-agent-enrolled-but-not-sending-any-data/298957 "2022-03-07T11:07:21Z")
Hey everyone, I have recently started to work ELK and my mission is to mainly deploy the stack and use it as a SIEM. I am using agents for data collection instead of Beats. I have enrolled one agent on a remote machine… --- ## [Snapshot retention policy](https://discuss.elastic.co/t/snapshot-retention-policy/299059)
**Author:** [@Nicole\_Hirshler](https://discuss.elastic.co/u/Nicole_Hirshler)\ **Replies:** 0\ **Last updated:** [March 8, 2022, 8:57am UTC](https://discuss.elastic.co/t/snapshot-retention-policy/299059 "2022-03-08T08:57:05Z")
I'm not sure I understand how snapshots are working. I see that all snapshots are taken without errors according to the policy I have defined, but I do not see that old snapshots are ever deleted. You can see in the att… --- ## [Two Kibana instance on one single Elasticsearch cluster pointing at different Indexes](https://discuss.elastic.co/t/two-kibana-instance-on-one-single-elasticsearch-cluster-pointing-at-different-indexes/299002)
**Author:** [@siemdude](https://discuss.elastic.co/u/siemdude)\ **Replies:** 3\ **Last updated:** [March 8, 2022, 10:11pm UTC](https://discuss.elastic.co/t/two-kibana-instance-on-one-single-elasticsearch-cluster-pointing-at-different-indexes/299002 "2022-03-08T22:11:09Z")
I am trying to create two Kibana on top of a single Elasticsearch cluster. I want to separate data at Kibana level instead of Spaces. Is it possible with Kibana Cloud? Which fields to configure to separate specific indic… --- ## [No output from json line delimited file](https://discuss.elastic.co/t/no-output-from-json-line-delimited-file/299092)
**Author:** [@theflakes](https://discuss.elastic.co/u/theflakes)\ **Replies:** 2\ **Last updated:** [March 8, 2022, 9:33pm UTC](https://discuss.elastic.co/t/no-output-from-json-line-delimited-file/299092 "2022-03-08T21:33:10Z")
I'm trying to get Logstash 8 working with a config that works in Logstash 7. I'm not getting any output even though it works fine in v7. If I remove all the filters, I still do not get any output. When I run LS in debut … --- ## [Problem overwriting field using json filter plugin](https://discuss.elastic.co/t/problem-overwriting-field-using-json-filter-plugin/299132)
**Author:** [@tstrul](https://discuss.elastic.co/u/tstrul)\ **Replies:** 3\ **Last updated:** [March 8, 2022, 9:17pm UTC](https://discuss.elastic.co/t/problem-overwriting-field-using-json-filter-plugin/299132 "2022-03-08T21:17:10Z")
Hey, I have a log that i want to parse as json. field is "log" I want to decode json but use the same field as the orig message. when i try: json { source =\> "log" target =\> "log" } Im ge… --- ## [Update doc only if doc changes? noop?](https://discuss.elastic.co/t/update-doc-only-if-doc-changes-noop/299040)
**Author:** [@andy4324](https://discuss.elastic.co/u/andy4324)\ **Replies:** 4\ **Last updated:** [March 8, 2022, 7:02pm UTC](https://discuss.elastic.co/t/update-doc-only-if-doc-changes-noop/299040 "2022-03-08T19:02:54Z")
Hi ES team, newbie ES user. We have a use case where we want to store signals from various hosts inside ES (as documents of course) and query them later based on a specific field value. Each event might have different fi… --- ## [Updating existing Beats deployment from 7.11.1.0 to 7.16.3](https://discuss.elastic.co/t/updating-existing-beats-deployment-from-7-11-1-0-to-7-16-3/299136)
**Author:** [@iamfrakk](https://discuss.elastic.co/u/iamfrakk)\ **Replies:** 0\ **Last updated:** [March 8, 2022, 6:58pm UTC](https://discuss.elastic.co/t/updating-existing-beats-deployment-from-7-11-1-0-to-7-16-3/299136 "2022-03-08T18:58:35Z")
Hello, I am trying to push out the "Beats" agents into a Windows environment (Servers & Client systems) I will be using SCCM to perform this deployment, and I have found the PowerShell script that Elastic has provided, … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1020) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1022)