# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1068 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1069 --- ## [Sizing of elastic cluster](https://discuss.elastic.co/t/sizing-of-elastic-cluster/296186)
**Author:** [@Rus](https://discuss.elastic.co/u/Rus)\ **Replies:** 1\ **Last updated:** [February 3, 2022, 4:07pm UTC](https://discuss.elastic.co/t/sizing-of-elastic-cluster/296186 "2022-02-03T16:07:30Z")
Currently I have a 3 node (DATA+MASTER). One node (CLIENT) with 24 gig RAM. The besic info of cluster now is JVM Heap 38.7 GB / 64.0 GB Documents 1281635203 Data1.1 TB Indices 636 Total shards 6032 re… --- ## [Updating document in elasticsearch](https://discuss.elastic.co/t/updating-document-in-elasticsearch/294916)
**Author:** [@Aniketvk008](https://discuss.elastic.co/u/Aniketvk008)\ **Replies:** 11\ **Last updated:** [February 3, 2022, 3:41pm UTC](https://discuss.elastic.co/t/updating-document-in-elasticsearch/294916 "2022-02-03T15:41:08Z")
After updating document its creating new row rather than updating in same row Doc\_id|| EmpID || Name || Age || Salary || Salary credited || Active xxxxx || 10001 || John || 30 || 20000 … --- ## [Can I replace a dead primary shard with the ok-replica?](https://discuss.elastic.co/t/can-i-replace-a-dead-primary-shard-with-the-ok-replica/296174)
**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Replies:** 2\ **Last updated:** [February 3, 2022, 3:16pm UTC](https://discuss.elastic.co/t/can-i-replace-a-dead-primary-shard-with-the-ok-replica/296174 "2022-02-03T15:16:50Z")
I had a situation last night where a node left the cluster and I lost some primary shards. It rejoined, and the shards are showing up as UNASSIGNED with no documents: { "index": "my-index", "shard": "0", "… --- ## [Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id](https://discuss.elastic.co/t/failed-to-execute-action-action-logstash-create-pipeline-id/296138)
**Author:** [@jeromeat](https://discuss.elastic.co/u/jeromeat)\ **Replies:** 5\ **Last updated:** [February 3, 2022, 3:07pm UTC](https://discuss.elastic.co/t/failed-to-execute-action-action-logstash-create-pipeline-id/296138 "2022-02-03T15:07:51Z")
I'm currently trying to use Input http\_poller to make an API call to a site to pull some data. However I keep getting the following error: Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id… --- ## [Counting each key of an array inside aggregation](https://discuss.elastic.co/t/counting-each-key-of-an-array-inside-aggregation/296060)
**Author:** [@hugomeloo](https://discuss.elastic.co/u/hugomeloo)\ **Replies:** 4\ **Last updated:** [February 3, 2022, 3:06pm UTC](https://discuss.elastic.co/t/counting-each-key-of-an-array-inside-aggregation/296060 "2022-02-03T15:06:41Z")
I am trying to make an aggregation in which I can count the number of times each key specific of an array is repeated. As an example: curl -XPUT "localhost:9200/products/\_mapping" -H 'Content-Type: application/json' -d'… --- ## [Options list](https://discuss.elastic.co/t/options-list/296059)
**Author:** [@iraidalavrovaa](https://discuss.elastic.co/u/iraidalavrovaa)\ **Replies:** 2\ **Last updated:** [February 3, 2022, 3:06pm UTC](https://discuss.elastic.co/t/options-list/296059 "2022-02-03T15:06:24Z")
Hi everyone, I've recently started using Elastic. While working on my dashboard I faced a problem. I want to add an options list but the information I'm interested in is located in 3 different fields: Level 1, Level 2, … --- ## [Can i export data from elasticsearch into mongodb database?](https://discuss.elastic.co/t/can-i-export-data-from-elasticsearch-into-mongodb-database/296118)
**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\ **Replies:** 3\ **Last updated:** [February 3, 2022, 3:03pm UTC](https://discuss.elastic.co/t/can-i-export-data-from-elasticsearch-into-mongodb-database/296118 "2022-02-03T15:03:17Z")
Hi, I would like to know can I export data from Elasticsearch to mongodb? or from Elasticsearch to another database? I prefer Mongodb but if it is not possible I would like to know which database can I use and how if th… --- ## [Data collection from Proxmox](https://discuss.elastic.co/t/data-collection-from-proxmox/295469)
**Author:** [@vovan13111](https://discuss.elastic.co/u/vovan13111)\ **Replies:** 3\ **Last updated:** [February 3, 2022, 2:47pm UTC](https://discuss.elastic.co/t/data-collection-from-proxmox/295469 "2022-02-03T14:47:09Z")
Good afternoon. When studying metricbeat for the ability to collect data from kvm, the question arose, will the ability to collect data from proxmox be added, like from vSphere? If this is already possible, then please … --- ## [Aliases for 5 fields in 5 indices](https://discuss.elastic.co/t/aliases-for-5-fields-in-5-indices/296175)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 2\ **Last updated:** [February 3, 2022, 12:05pm UTC](https://discuss.elastic.co/t/aliases-for-5-fields-in-5-indices/296175 "2022-02-03T12:05:34Z")
Hi all, I have 5 indices : ( indices a1, a2, a3, a4, a5) with 5 different fields : Merchant\_Id, Mer\_Id, Merc\_Id, MERCHANT\_Id, MERCH\_ID. For some reasons, I cannot delete or alter the field or data. I want to create a… --- ## [Snapshots not running as scheduled](https://discuss.elastic.co/t/snapshots-not-running-as-scheduled/295714)
**Author:** [@mwise29](https://discuss.elastic.co/u/mwise29)\ **Replies:** 5\ **Last updated:** [February 3, 2022, 2:26pm UTC](https://discuss.elastic.co/t/snapshots-not-running-as-scheduled/295714 "2022-02-03T14:26:50Z")
I configured a snapshot cron schedule and just recently it stopped running. We restarted Elasticsearch and that didn't fix it. We restarted the nodes and that also did not fix it. I re-created the policy and that also… --- ## [Multiple indexes multiple tag](https://discuss.elastic.co/t/multiple-indexes-multiple-tag/295229)
**Author:** [@graimato](https://discuss.elastic.co/u/graimato)\ **Replies:** 4\ **Last updated:** [February 3, 2022, 1:37pm UTC](https://discuss.elastic.co/t/multiple-indexes-multiple-tag/295229 "2022-02-03T13:37:28Z")
Hello, I divide my log in different index using event.module value indices: - index: "filebeat-system-%{+yyyy.MM.dd}" when.equals: event.module: "system" - index: "filebeat-apache-%{+yyyy.MM.dd}" … --- ## [Unable to get all indices in the data folder that have been reindexed from 5.6 to 6.8 however I can see indices when I use query \_cat /indices](https://discuss.elastic.co/t/unable-to-get-all-indices-in-the-data-folder-that-have-been-reindexed-from-5-6-to-6-8-however-i-can-see-indices-when-i-use-query-cat-indices/295686)
**Author:** [@rutika\_kamble](https://discuss.elastic.co/u/rutika_kamble)\ **Replies:** 8\ **Last updated:** [February 3, 2022, 1:23pm UTC](https://discuss.elastic.co/t/unable-to-get-all-indices-in-the-data-folder-that-have-been-reindexed-from-5-6-to-6-8-however-i-can-see-indices-when-i-use-query-cat-indices/295686 "2022-02-03T13:23:21Z")
Unable to get all indices in the data folder that have been reindexed from 5.6 to 6.8 however I can see indices when I use query \_cat /indices PFA attachments please suggest here something --- ## [Can the logstash rabbitmq input plugin read from the start of a stream?](https://discuss.elastic.co/t/can-the-logstash-rabbitmq-input-plugin-read-from-the-start-of-a-stream/296084)
**Author:** [@Daniel\_Bray](https://discuss.elastic.co/u/Daniel_Bray)\ **Replies:** 0\ **Last updated:** [February 2, 2022, 4:08pm UTC](https://discuss.elastic.co/t/can-the-logstash-rabbitmq-input-plugin-read-from-the-start-of-a-stream/296084 "2022-02-02T16:08:21Z")
I have a rabbitmq stream whose events I want logstash to process. I can get it working mostly ok but logstash only processes records that are pushed to the stream while logstash is running. If I push messages before lo… --- ## [Flat table of data](https://discuss.elastic.co/t/flat-table-of-data/296177)
**Author:** [@ShayWeizman](https://discuss.elastic.co/u/ShayWeizman)\ **Replies:** 8\ **Last updated:** [February 3, 2022, 1:01pm UTC](https://discuss.elastic.co/t/flat-table-of-data/296177 "2022-02-03T13:01:03Z")
Hi all, I'm using 7.16.2 version. I have data in elastic which is representing result of tests, one json for example: My question is, how can I create new table in kibana with flat result, not top values. I want to s… --- ## [SQL metadata interface (SHOW TABLE) not showing DataStreams](https://discuss.elastic.co/t/sql-metadata-interface-show-table-not-showing-datastreams/288618)
**Author:** [@JPMoresmau](https://discuss.elastic.co/u/JPMoresmau)\ **Replies:** 1\ **Last updated:** [February 2, 2022, 5:25pm UTC](https://discuss.elastic.co/t/sql-metadata-interface-show-table-not-showing-datastreams/288618 "2022-02-02T17:25:33Z")
Hello, I have defined a data stream with backing indices and an index policy. So far so good. POST http://localhost:9200/\_sql?format=txt Content-Type: application/json { "query": "select \* from \\"my-data-stream\\"" } … --- ## [Regexp query for phrase](https://discuss.elastic.co/t/regexp-query-for-phrase/296026)
**Author:** [@Divyank\_Garg](https://discuss.elastic.co/u/Divyank_Garg)\ **Replies:** 6\ **Last updated:** [February 3, 2022, 12:50pm UTC](https://discuss.elastic.co/t/regexp-query-for-phrase/296026 "2022-02-03T12:50:27Z")
I need to search for two signature pattern with 'and' operator between two phrase. How to write the query for that. In these two phrase I as shown below the \* means any number or value between 0-9 can be taken into consi… --- ## [Ingest node doesn't process log](https://discuss.elastic.co/t/ingest-node-doesnt-process-log/296112)
**Author:** [@UweW](https://discuss.elastic.co/u/UweW)\ **Replies:** 2\ **Last updated:** [February 3, 2022, 12:31pm UTC](https://discuss.elastic.co/t/ingest-node-doesnt-process-log/296112 "2022-02-03T12:31:35Z")
Hi, logs per second are growing and I want to move the ingest load from the data nodes to ingest only nodes. I have added an additional Elasticsearch ingest only node but I can see in the ingest stats, that the processe… --- ## [Upload Windows Event Logs](https://discuss.elastic.co/t/upload-windows-event-logs/295930)
**Author:** [@smam](https://discuss.elastic.co/u/smam)\ **Replies:** 4\ **Last updated:** [February 3, 2022, 12:26pm UTC](https://discuss.elastic.co/t/upload-windows-event-logs/295930 "2022-02-03T12:26:31Z")
Hello, Where do I find files that i sent via winlogbeat when using the Elasticsearch output? Can I add indexes? And how could I send just a selection of files, that is e.g. stored in some directory? I tried: - name: … --- ## [Export Rules -- Getting BAD request](https://discuss.elastic.co/t/export-rules-getting-bad-request/296101)
**Author:** [@Detlef](https://discuss.elastic.co/u/Detlef)\ **Replies:** 3\ **Last updated:** [February 3, 2022, 12:09pm UTC](https://discuss.elastic.co/t/export-rules-getting-bad-request/296101 "2022-02-03T12:09:50Z")
I'm trying to extract my created detection rules. From my python script I receive the following debug messages: 2022-02-02 17:57:22,859 \_\_main\_\_ INFO Selected the following elastic host for requests: dw-prodkib… --- ## [Configure Beats to only see certain fields in Elasticsearch](https://discuss.elastic.co/t/configure-beats-to-only-see-certain-fields-in-elasticsearch/296161)
**Author:** [@\_Thomas](https://discuss.elastic.co/u/_Thomas)\ **Replies:** 2\ **Last updated:** [February 3, 2022, 9:55am UTC](https://discuss.elastic.co/t/configure-beats-to-only-see-certain-fields-in-elasticsearch/296161 "2022-02-03T09:55:18Z")
Hi Guys, first of all, I do apologize if this is something that had been answered in the past. What I'm trying to achieve is the following - let's take the Winlogbeat as an example: I'm only interested to see what typ… --- ## [Elastic Cloud IP Address](https://discuss.elastic.co/t/elastic-cloud-ip-address/296117)
**Author:** [@teamomni](https://discuss.elastic.co/u/teamomni)\ **Replies:** 2\ **Last updated:** [February 3, 2022, 11:45am UTC](https://discuss.elastic.co/t/elastic-cloud-ip-address/296117 "2022-02-03T11:45:07Z")
Our firewalls have been getting hit by several IP address that are from within the United States, and we would like to verify that it is not related to communication with our Elastic Agents and the Elastic Cloud. Is the… --- ## [I have a problem help me](https://discuss.elastic.co/t/i-have-a-problem-help-me/296088)
**Author:** [@slowup](https://discuss.elastic.co/u/slowup)\ **Replies:** 4\ **Last updated:** [February 3, 2022, 11:43am UTC](https://discuss.elastic.co/t/i-have-a-problem-help-me/296088 "2022-02-03T11:43:33Z")
It is an index where data is continuously flowing in. As a result, merges continue to occur, the query cache goes down, and as a result, I/O increases again. What should I do? below is 1 hour below is 3 hou… --- ## [Logstash configuration File](https://discuss.elastic.co/t/logstash-configuration-file/296179)
**Author:** [@harsh19](https://discuss.elastic.co/u/harsh19)\ **Replies:** 3\ **Last updated:** [February 3, 2022, 11:17am UTC](https://discuss.elastic.co/t/logstash-configuration-file/296179 "2022-02-03T11:17:10Z")
input { file { type =\> "json" path =\> "/home/harsh/Documents/elklog/2022/01/1/\*.json" start\_position =\> "beginning" sincedb\_path =\> "/dev/null" } } filter { } output { stdout { codec =\> rubydebug… --- ## [Hot to get all results in the Dev Tools](https://discuss.elastic.co/t/hot-to-get-all-results-in-the-dev-tools/296178)
**Author:** [@ShayWeizman](https://discuss.elastic.co/u/ShayWeizman)\ **Replies:** 2\ **Last updated:** [February 3, 2022, 11:14am UTC](https://discuss.elastic.co/t/hot-to-get-all-results-in-the-dev-tools/296178 "2022-02-03T11:14:55Z")
Hi All, I'm using 7.16.2, When I run query in the dev tools I get only 10 first results... How can I get all the query results? Thanks, Shay --- ## [Error with \_sql query with curl](https://discuss.elastic.co/t/error-with-sql-query-with-curl/295232)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 4\ **Last updated:** [February 3, 2022, 10:05am UTC](https://discuss.elastic.co/t/error-with-sql-query-with-curl/295232 "2022-02-03T10:05:57Z")
Hello ! I am trying to cast a query to my Elasticsearch cluster. When I use where with numeric fields, everything works correctly, but when I try to use it with text fields, problems appear. What would be the correct s… --- ## [Filebeat cannot assign requested address](https://discuss.elastic.co/t/filebeat-cannot-assign-requested-address/296137)
**Author:** [@sulfred](https://discuss.elastic.co/u/sulfred)\ **Replies:** 4\ **Last updated:** [February 3, 2022, 9:25am UTC](https://discuss.elastic.co/t/filebeat-cannot-assign-requested-address/296137 "2022-02-03T09:25:08Z")
I am trying to read the syslog information by filebeat. I have my filebeat installed in docker. I get error message ERROR \[syslog\] syslog/input.go:150 Error starting the servererrorlisten tcp 192.168.1.142:… --- ## [Transfer message via filebeat](https://discuss.elastic.co/t/transfer-message-via-filebeat/288793)
**Author:** [@San9](https://discuss.elastic.co/u/San9)\ **Replies:** 9\ **Last updated:** [February 3, 2022, 9:06am UTC](https://discuss.elastic.co/t/transfer-message-via-filebeat/288793 "2022-02-03T09:06:39Z")
Lines passed by filebeat are not processed correctly. Part of the line sometimes breaks up into several parts, part of the message arrives, and the other can be shaken altogether. original file Network Management Card… --- ## [How to create grok filter to parse the below log format](https://discuss.elastic.co/t/how-to-create-grok-filter-to-parse-the-below-log-format/295988)
**Author:** [@poddraj](https://discuss.elastic.co/u/poddraj)\ **Replies:** 2\ **Last updated:** [February 3, 2022, 7:32am UTC](https://discuss.elastic.co/t/how-to-create-grok-filter-to-parse-the-below-log-format/295988 "2022-02-03T07:32:59Z")
2022-02-01 01:25:45.778-\[ActivationSrvc-28\] com.verizon.vnm.activation.ejb.helper.ActivationRequestHelper.nbaReqResponse(ActivationRequestHelper.java:3313) INFO {"VSAD\_ID":"ABFD","log\_type":"","app\_name":"ABC","VAST\_ID"… --- ## [Logstash Automation](https://discuss.elastic.co/t/logstash-automation/296150)
**Author:** [@harsh19](https://discuss.elastic.co/u/harsh19)\ **Replies:** 2\ **Last updated:** [February 3, 2022, 7:26am UTC](https://discuss.elastic.co/t/logstash-automation/296150 "2022-02-03T07:26:57Z")
there is a one Folder name logs in that Folder there is multiple json file like 1.json, 2.json, etc i want to pars logs in Elasticsearch with logstash so Question is that how to configure that all file in one conf fi… --- ## [Kafka input kibana message one field](https://discuss.elastic.co/t/kafka-input-kibana-message-one-field/296134)
**Author:** [@splitmessage88](https://discuss.elastic.co/u/splitmessage88)\ **Replies:** 2\ **Last updated:** [February 3, 2022, 7:00am UTC](https://discuss.elastic.co/t/kafka-input-kibana-message-one-field/296134 "2022-02-03T07:00:31Z")
Hello! I'm new here and have been stuck with an issue for 2 days. I have a working flow with winlogbeat - kafka - logstash - Elasticsearch. I receive the winlogbeat logs in kibana but the problem is that the full log … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1067) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1069)