# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1032 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1033 --- ## [ILM increasing number of replicas - suboptimal behavior?](https://discuss.elastic.co/t/ilm-increasing-number-of-replicas-suboptimal-behavior/297516)
**Author:** [@nisow95612](https://discuss.elastic.co/u/nisow95612)\ **Replies:** 4\ **Last updated:** [March 1, 2022, 1:12pm UTC](https://discuss.elastic.co/t/ilm-increasing-number-of-replicas-suboptimal-behavior/297516 "2022-03-01T13:12:43Z")
Hello nice elastic people. I am currently toying with ILM (7.x, not yet upgraded to 8.0) and ran into a surprising behavior. I have configured ILM to increase the number of replicas when transitioning from hot to cold. … --- ## [Weekly chart label mismatched?](https://discuss.elastic.co/t/weekly-chart-label-mismatched/298269)
**Author:** [@howai](https://discuss.elastic.co/u/howai)\ **Replies:** 3\ **Last updated:** [March 1, 2022, 1:03pm UTC](https://discuss.elastic.co/t/weekly-chart-label-mismatched/298269 "2022-03-01T13:03:25Z")
I noticed that weekly chart (pic3) is use “First day of week” as date label and “End day of week” as data value. May I know is there any way that I can change the date label as “End day of week” in weekly chart (i.e. … --- ## [Unable to use of beats (here journalbeat) with AWS ElasticSearch 7.x](https://discuss.elastic.co/t/unable-to-use-of-beats-here-journalbeat-with-aws-elasticsearch-7-x/298506)
**Author:** [@obourdon](https://discuss.elastic.co/u/obourdon)\ **Replies:** 1\ **Last updated:** [March 1, 2022, 12:24pm UTC](https://discuss.elastic.co/t/unable-to-use-of-beats-here-journalbeat-with-aws-elasticsearch-7-x/298506 "2022-03-01T12:24:11Z")
As detailed in https://github.com/elastic/beats/issues/30192 I used to have a perfectly working AWS ES 6.8 + journalbeat OSS 7.12.1 setup I also know about the breaking change of beats 7.13.0 which prevented me from up… --- ## [\_delete\_by\_query not removes messages from another index created in same date](https://discuss.elastic.co/t/delete-by-query-not-removes-messages-from-another-index-created-in-same-date/298503)
**Author:** [@mkobzev](https://discuss.elastic.co/u/mkobzev)\ **Replies:** 0\ **Last updated:** [March 1, 2022, 12:10pm UTC](https://discuss.elastic.co/t/delete-by-query-not-removes-messages-from-another-index-created-in-same-date/298503 "2022-03-01T12:10:51Z")
Hello, I am removing messages from nonprod kubernetes namespaces using next query --query=app-\*/\_delete\_by\_query -XPOST -d'{ "query": {"bool": {"must": \[{"regexp": {"kubernetes.namespace\_name": {"value": ".\*nonprod"}}}… --- ## [Null Values Ignred by Elasticsearch](https://discuss.elastic.co/t/null-values-ignred-by-elasticsearch/298456)
**Author:** [@xef](https://discuss.elastic.co/u/xef)\ **Replies:** 2\ **Last updated:** [March 1, 2022, 11:44am UTC](https://discuss.elastic.co/t/null-values-ignred-by-elasticsearch/298456 "2022-03-01T11:44:43Z")
We are using the NEST library with Elasticsearch versions 7.14. Lets say we have assigned a field a value of "hello World". The filed is mapped as a Keyword type and Not Indexed. If you update that document using the … --- ## [Error during make update while creating custom filebeat module](https://discuss.elastic.co/t/error-during-make-update-while-creating-custom-filebeat-module/298407)
**Author:** [@kkouramenos](https://discuss.elastic.co/u/kkouramenos)\ **Replies:** 3\ **Last updated:** [March 1, 2022, 10:31am UTC](https://discuss.elastic.co/t/error-during-make-update-while-creating-custom-filebeat-module/298407 "2022-03-01T10:31:55Z")
Trying to create a custom module for filebeat. I passed successfully the make create-module, make create-fileset, create and test the pipeline, make create-fields. When running make update I get the following mage upda… --- ## [\[error\]\[data\]\[elasticsearch\] \[status\_exception\]: error while executing search](https://discuss.elastic.co/t/error-data-elasticsearch-status-exception-error-while-executing-search/298492)
**Author:** [@linuxxin](https://discuss.elastic.co/u/linuxxin)\ **Replies:** 3\ **Last updated:** [March 1, 2022, 10:23am UTC](https://discuss.elastic.co/t/error-data-elasticsearch-status-exception-error-while-executing-search/298492 "2022-03-01T10:23:42Z")
\[error\]\[data\]\[Elasticsearch\] \[status\_exception\]: error while executing search --- ## [Set processor isn't working after another Set processor - Injest Pipeline](https://discuss.elastic.co/t/set-processor-isnt-working-after-another-set-processor-injest-pipeline/298478)
**Author:** [@shivani\_singh](https://discuss.elastic.co/u/shivani_singh)\ **Replies:** 10\ **Last updated:** [March 1, 2022, 10:22am UTC](https://discuss.elastic.co/t/set-processor-isnt-working-after-another-set-processor-injest-pipeline/298478 "2022-03-01T10:22:11Z")
Hi, I'm copying value of responseBody.results into embedded\_original\_value\_obj both are object type fields. This is my defined pipeline - PUT \_ingest/pipeline/apiproxy-embedded-copy { "processors": \[ { "se… --- ## [Ruby filter to whitelist nested fields](https://discuss.elastic.co/t/ruby-filter-to-whitelist-nested-fields/298424)
**Author:** [@lordcosmos1978](https://discuss.elastic.co/u/lordcosmos1978)\ **Replies:** 2\ **Last updated:** [March 1, 2022, 9:48am UTC](https://discuss.elastic.co/t/ruby-filter-to-whitelist-nested-fields/298424 "2022-03-01T09:48:27Z")
I am trying to whitelist a number of nested fields. I first tried it using the prune filter but it seems that one does not support nested fields only top level fields. I saw in this topic Logstash prune nested fields t… --- ## [@timestamp vs timestamp date field](https://discuss.elastic.co/t/timestamp-vs-timestamp-date-field/298483)
**Author:** [@notgurev](https://discuss.elastic.co/u/notgurev)\ **Replies:** 1\ **Last updated:** [March 1, 2022, 9:02am UTC](https://discuss.elastic.co/t/timestamp-vs-timestamp-date-field/298483 "2022-03-01T09:02:52Z")
Is there any difference between using "@timestamp" and "timestamp" date fields? Does elastic optimize search using those fields across multiple daily indices, perhaps if it knows min and max timestamp for each index? Cu… --- ## [Watcher & sentinl](https://discuss.elastic.co/t/watcher-sentinl/298477)
**Author:** [@Nasser](https://discuss.elastic.co/u/Nasser)\ **Replies:** 3\ **Last updated:** [March 1, 2022, 8:25am UTC](https://discuss.elastic.co/t/watcher-sentinl/298477 "2022-03-01T08:25:06Z")
Hi i have 2 ELK clusters the first one have kibana v6.6.1 and i already installed sentinl v2 and working perfect but , the other clusters i have kibana 7.15.x and sentinl is incompatible with 7.x my question is can i u… --- ## [Update partial fields failure, but update all success](https://discuss.elastic.co/t/update-partial-fields-failure-but-update-all-success/298472)
**Author:** [@yanllearnn](https://discuss.elastic.co/u/yanllearnn)\ **Replies:** 3\ **Last updated:** [March 1, 2022, 7:19am UTC](https://discuss.elastic.co/t/update-partial-fields-failure-but-update-all-success/298472 "2022-03-01T07:19:34Z")
Hi, when I update the doc by some fields using updateRequest, it is not working. and no anyt errors. But when I update the doc all fields using updateRequest, it is working. How to update partial fields? Thanks. --- ## [Logstashからelasticsearchにデータを保存できません](https://discuss.elastic.co/t/logstash-elasticsearch/298476)
**Author:** [@tamina](https://discuss.elastic.co/u/tamina)\ **Replies:** 0\ **Last updated:** [March 1, 2022, 7:31am UTC](https://discuss.elastic.co/t/logstash-elasticsearch/298476 "2022-03-01T07:31:46Z")
logstash8.0からelasticsearch8.0にデータを保存しようとしているのですがエラーが出てしまい成功しません。どこを直したらよいでしょうか？ ■発生しているエラー ''' \[2022-03-01T16:11:11,837\]\[WARN \]\[o.e.t.TcpTransport \] \[JPC00006506\] exception caught on transport layer \[Netty4TcpCh… --- ## [Remove services from elastic cloud](https://discuss.elastic.co/t/remove-services-from-elastic-cloud/298414)
**Author:** [@Eran\_Hadad](https://discuss.elastic.co/u/Eran_Hadad)\ **Replies:** 2\ **Last updated:** [March 1, 2022, 7:20am UTC](https://discuss.elastic.co/t/remove-services-from-elastic-cloud/298414 "2022-03-01T07:20:05Z")
Hi all, I have a small 1GB test deployment on elastic cloud that I inherited. This deployment has 255 shards that I want to reduce obviously. I only created 2 indices so the rest of 253 shards are system once. Most … --- ## [Fscrawler and elasticsearch 8](https://discuss.elastic.co/t/fscrawler-and-elasticsearch-8/298422)
**Author:** [@Emile\_Plas](https://discuss.elastic.co/u/Emile_Plas)\ **Replies:** 2\ **Last updated:** [March 1, 2022, 6:46am UTC](https://discuss.elastic.co/t/fscrawler-and-elasticsearch-8/298422 "2022-03-01T06:46:11Z")
Hey! I am using Elasticsearch 8 on a local server and fscrawler. Fscrawler logs the following error at the moment of startup: WARN \[f.p.e.c.f.c.ElasticsearchClient\] failed to create index \[dbrc\], disabling crawler... … --- ## [Force Merge To do or not to do](https://discuss.elastic.co/t/force-merge-to-do-or-not-to-do/298070)
**Author:** [@Neeraj\_Jain7483](https://discuss.elastic.co/u/Neeraj_Jain7483)\ **Replies:** 7\ **Last updated:** [March 1, 2022, 5:22am UTC](https://discuss.elastic.co/t/force-merge-to-do-or-not-to-do/298070 "2022-03-01T05:22:43Z")
I have a scenario in which we have indices for each month, and each document has a field, say expiry date, and according to that expiry date, documents will be deleted when they reach their expiry. One-month-old index wi… --- ## [Invalid configuration for xpack.security.transport.ssl](https://discuss.elastic.co/t/invalid-configuration-for-xpack-security-transport-ssl/297989)
**Author:** [@Akaren](https://discuss.elastic.co/u/Akaren)\ **Replies:** 5\ **Last updated:** [March 1, 2022, 4:12am UTC](https://discuss.elastic.co/t/invalid-configuration-for-xpack-security-transport-ssl/297989 "2022-03-01T04:12:05Z")
We tried to update to ES 8.0 deb package. ES refused to start with an error \[2022-02-23T09:10:15,109\]\[ERROR\]\[o.e.b.Bootstrap \] \[mon\] Exception org.elasticsearch.ElasticsearchSecurityException: invalid configura… --- ## [How to get the default password](https://discuss.elastic.co/t/how-to-get-the-default-password/298463)
**Author:** [@ericsoul](https://discuss.elastic.co/u/ericsoul)\ **Replies:** 1\ **Last updated:** [March 1, 2022, 3:17am UTC](https://discuss.elastic.co/t/how-to-get-the-default-password/298463 "2022-03-01T03:17:54Z")
branch:master commitid: 6b50cf75b3f I compiled the ES from command ./gradlew localDistro then started the server by bin/elasticsearch -d then I got no password in logs/elasticsearch.log --- ## [Error: java.lang.ClassNotFoundException: com.dbschema.MongoJdbcDriver. Are you sure you've included the correct jdbc driver in :jdbc\_driver\_library?](https://discuss.elastic.co/t/error-java-lang-classnotfoundexception-com-dbschema-mongojdbcdriver-are-you-sure-youve-included-the-correct-jdbc-driver-in-jdbc-driver-library/298460)
**Author:** [@Amal\_Anush](https://discuss.elastic.co/u/Amal_Anush)\ **Replies:** 0\ **Last updated:** [March 1, 2022, 3:04am UTC](https://discuss.elastic.co/t/error-java-lang-classnotfoundexception-com-dbschema-mongojdbcdriver-are-you-sure-youve-included-the-correct-jdbc-driver-in-jdbc-driver-library/298460 "2022-03-01T03:04:03Z")
hi , im using dbschema mongo driver to connect to move data from mongo to logstash . but here is the error Error: java.lang.ClassNotFoundException: com.dbschema.MongoJdbcDriver. Are you sure you've included the correct… --- ## [No new data getting indexed after disabling rollover in ILM](https://discuss.elastic.co/t/no-new-data-getting-indexed-after-disabling-rollover-in-ilm/298429)
**Author:** [@diraj](https://discuss.elastic.co/u/diraj)\ **Replies:** 3\ **Last updated:** [March 1, 2022, 2:47am UTC](https://discuss.elastic.co/t/no-new-data-getting-indexed-after-disabling-rollover-in-ilm/298429 "2022-03-01T02:47:07Z")
Hello, We have implemented ILM for indexes recently. We have a rollover policy for hot tier that gets triggered when the index gets larger than 40gb. This particular change did not go well with the policy, as it had ali… --- ## [How to skip downloading ml-cpp-8.2.0-SNAPSHOT.zip while using "./gradlew localDistro"](https://discuss.elastic.co/t/how-to-skip-downloading-ml-cpp-8-2-0-snapshot-zip-while-using-gradlew-localdistro/298390)
**Author:** [@ericsoul](https://discuss.elastic.co/u/ericsoul)\ **Replies:** 3\ **Last updated:** [March 1, 2022, 2:26am UTC](https://discuss.elastic.co/t/how-to-skip-downloading-ml-cpp-8-2-0-snapshot-zip-while-using-gradlew-localdistro/298390 "2022-03-01T02:26:43Z")
Because of the network is not very stable, every time the "./gradlew localDistro" command reaches the downloading of ml-cpp-8.2.0-SNAPSHOT.zip,it will fail after long download before finish. I have downloaded the packag… --- ## [Filebeat configuration allows multiple pipelines for a log file?](https://discuss.elastic.co/t/filebeat-configuration-allows-multiple-pipelines-for-a-log-file/298458)
**Author:** [@jie](https://discuss.elastic.co/u/jie)\ **Replies:** 0\ **Last updated:** [March 1, 2022, 1:57am UTC](https://discuss.elastic.co/t/filebeat-configuration-allows-multiple-pipelines-for-a-log-file/298458 "2022-03-01T01:57:11Z")
Specifically, I have a pipeline preprocessing log file does not match the log is not saved, I want to not match the log file is saved in the log file data loss. --- ## [Logtstash updating fron 7.9 to 7.16.2](https://discuss.elastic.co/t/logtstash-updating-fron-7-9-to-7-16-2/298453)
**Author:** [@Faisal\_Malik](https://discuss.elastic.co/u/Faisal_Malik)\ **Replies:** 3\ **Last updated:** [February 28, 2022, 11:54pm UTC](https://discuss.elastic.co/t/logtstash-updating-fron-7-9-to-7-16-2/298453 "2022-02-28T23:54:10Z")
Hi i am trying to update logstash from 7.9.0 to 7.16.2 (Using Helm chart ) Getting error. Pipeline error {:pipeline\_id=\>"main", :exception=\>#\ **Author:** [@djschny](https://discuss.elastic.co/u/djschny)\ **Replies:** 2\ **Last updated:** [February 28, 2022, 11:48pm UTC](https://discuss.elastic.co/t/logstash-in-docker-fails-after-plugin-installed/298446 "2022-02-28T23:48:19Z") When using the official image for logstash (8.0.0) if a plugin is installed, after that Logstash will not load. If I use the image without the plugin installed then it works. For example: docker run --rm --name my-logst… --- ## [Unable to display Array of Polygons in Kibana Maps](https://discuss.elastic.co/t/unable-to-display-array-of-polygons-in-kibana-maps/298358)
**Author:** [@scottfred](https://discuss.elastic.co/u/scottfred)\ **Replies:** 10\ **Last updated:** [February 28, 2022, 10:46pm UTC](https://discuss.elastic.co/t/unable-to-display-array-of-polygons-in-kibana-maps/298358 "2022-02-28T22:46:46Z")
Kibana is unable to display an Array of geo\_shape "polygon" data; however, I am able to display a single Polygon geo\_shape. I would expect Kibana to parse the Array of results and display each of the polygon objects fro… --- ## [How to increase Kibana Memory?](https://discuss.elastic.co/t/how-to-increase-kibana-memory/297204)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 4\ **Last updated:** [February 28, 2022, 10:01pm UTC](https://discuss.elastic.co/t/how-to-increase-kibana-memory/297204 "2022-02-28T22:01:51Z")
Hello, How can i Increase the memory that Kibana uses? I tried following this part of the documentation, but it does not work, there is no change in the memory used in the monitoring. I want to use 4096 MB for Kibana,… --- ## [Can you use copy\_fields processor for @timestamp in winlogbeat](https://discuss.elastic.co/t/can-you-use-copy-fields-processor-for-timestamp-in-winlogbeat/239501)
**Author:** [@Jasonespo](https://discuss.elastic.co/u/Jasonespo)\ **Replies:** 0\ **Last updated:** [July 1, 2020, 2:12pm UTC](https://discuss.elastic.co/t/can-you-use-copy-fields-processor-for-timestamp-in-winlogbeat/239501 "2020-07-01T14:12:49Z")
Hi guys, Does anyone know if there is a way to copy the @timestamp value from winlogbeat json to a separate field (for troubleshooting purposes) using winlogbeat.yml file? I'm trying to use the copy fields processor: … --- ## [Elasticsearch response does not have desired fields/data](https://discuss.elastic.co/t/elasticsearch-response-does-not-have-desired-fields-data/298237)
**Author:** [@roman-tasi](https://discuss.elastic.co/u/roman-tasi)\ **Replies:** 5\ **Last updated:** [February 28, 2022, 9:58pm UTC](https://discuss.elastic.co/t/elasticsearch-response-does-not-have-desired-fields-data/298237 "2022-02-28T21:58:16Z")
I have been using ElastAlert to monitor and alert on my Elasticsearch data. However the Elasticsearch response does not have the fields that I want to pull data from in my alerts. I have been using the DEBUG feature to v… --- ## [Logstash-plugin install logstash-output-influxdb error proxy](https://discuss.elastic.co/t/logstash-plugin-install-logstash-output-influxdb-error-proxy/298451)
**Author:** [@bob\_monty](https://discuss.elastic.co/u/bob_monty)\ **Replies:** 0\ **Last updated:** [February 28, 2022, 9:38pm UTC](https://discuss.elastic.co/t/logstash-plugin-install-logstash-output-influxdb-error-proxy/298451 "2022-02-28T21:38:52Z")
Greetings im trying to logstash-plugin install logstash-output-influxdb but im behind a firewall and we have a proxy. i set the proxy at the command line with HTTP\_PROXY, and also tried setting it in logstash-7.16.1/vend… --- ## [Collecting logs with rsyslog instead of beats](https://discuss.elastic.co/t/collecting-logs-with-rsyslog-instead-of-beats/298425)
**Author:** [@Khammassi\_HoussemEdd](https://discuss.elastic.co/u/Khammassi_HoussemEdd)\ **Replies:** 0\ **Last updated:** [February 28, 2022, 3:54pm UTC](https://discuss.elastic.co/t/collecting-logs-with-rsyslog-instead-of-beats/298425 "2022-02-28T15:54:45Z")
i got used to use beats (especially filebeat ) to collect logs from linux machines and send them to logstash where i do parsing and filtering .. there is a while since i have heard about rsyslog and i tried it and it's… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1031) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1033)