# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1072 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1073 --- ## [Hi all, I am trying to ingest json file in Elasticsearch using python , but index is not getting created](https://discuss.elastic.co/t/hi-all-i-am-trying-to-ingest-json-file-in-elasticsearch-using-python-but-index-is-not-getting-created/295903)
**Author:** [@Chinmay\_Bhusate](https://discuss.elastic.co/u/Chinmay_Bhusate)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 9:55am UTC](https://discuss.elastic.co/t/hi-all-i-am-trying-to-ingest-json-file-in-elasticsearch-using-python-but-index-is-not-getting-created/295903 "2022-02-01T09:55:54Z")
Code is running , I'm not getting any error . But at a same time index is not created . Here is my code. import sys import json from pprint import pprint from elasticsearch import Elasticsearch es = Elasticsearch( … --- ## [ELK Alerting for AD logs](https://discuss.elastic.co/t/elk-alerting-for-ad-logs/295823)
**Author:** [@AbdulVaseem](https://discuss.elastic.co/u/AbdulVaseem)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 9:54am UTC](https://discuss.elastic.co/t/elk-alerting-for-ad-logs/295823 "2022-02-01T09:54:24Z")
How to set up an alert when an Admin or Enterprise admin is created on Local AD in kibana --- ## [Logstash error during configuration](https://discuss.elastic.co/t/logstash-error-during-configuration/295911)
**Author:** [@harsh19](https://discuss.elastic.co/u/harsh19)\ **Replies:** 4\ **Last updated:** [February 1, 2022, 9:22am UTC](https://discuss.elastic.co/t/logstash-error-during-configuration/295911 "2022-02-01T09:22:19Z")
When i Run ./logstash -f logstash-simple.conf then it's give me an error like this, Using bundled JDK: /usr/share/logstash/jdk OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 a… --- ## [Filebeat with opensearch](https://discuss.elastic.co/t/filebeat-with-opensearch/295915)
**Author:** [@mohammed.sabil](https://discuss.elastic.co/u/mohammed.sabil)\ **Replies:** 2\ **Last updated:** [February 1, 2022, 9:00am UTC](https://discuss.elastic.co/t/filebeat-with-opensearch/295915 "2022-02-01T09:00:11Z")
Hello Team, I would like to know if I can use filebeat (elastic) docker image with Opensearch as part of the OpenSource licence (Apache 2.0). Is there any restriction as far as the licensing concern? Regards. --- ## [Is Delete by query a clean operation?](https://discuss.elastic.co/t/is-delete-by-query-a-clean-operation/295778)
**Author:** [@yash\_196](https://discuss.elastic.co/u/yash_196)\ **Replies:** 9\ **Last updated:** [February 1, 2022, 7:02am UTC](https://discuss.elastic.co/t/is-delete-by-query-a-clean-operation/295778 "2022-02-01T07:02:00Z")
Hi Everyone, I wanted to know if delete by query is a clean API? Are the resources (Memory or I/O) released gracefully after the query is complete or does it still hold some resource which might affect perormance? --- ## [Logstash is merging messages sent through http](https://discuss.elastic.co/t/logstash-is-merging-messages-sent-through-http/295905)
**Author:** [@Ruben\_Bracamonte](https://discuss.elastic.co/u/Ruben_Bracamonte)\ **Replies:** 0\ **Last updated:** [February 1, 2022, 6:51am UTC](https://discuss.elastic.co/t/logstash-is-merging-messages-sent-through-http/295905 "2022-02-01T06:51:42Z")
Hi, I have a basic Logstash config with HTTP as input. My API is writing logs every 2-3 seconds, and sometimes on Kibana I can see two messages, with their two timestamps and two different IPs (from the caller), etc in … --- ## [Cannot upload Large CSV file, Timeout](https://discuss.elastic.co/t/cannot-upload-large-csv-file-timeout/295774)
**Author:** [@N\_Q](https://discuss.elastic.co/u/N_Q)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 5:31am UTC](https://discuss.elastic.co/t/cannot-upload-large-csv-file-timeout/295774 "2022-02-01T05:31:25Z")
HI Team, I am evaluating Elasticsearch for its multivariate anomaly detection capabilities on data from Manufacturing systems. I have a dataset which is comma separated but whenever I try to upload the full file(around … --- ## [LifeCycle policy doesn't delete index because of wrong index age](https://discuss.elastic.co/t/lifecycle-policy-doesnt-delete-index-because-of-wrong-index-age/295859)
**Author:** [@ashit\_pupu](https://discuss.elastic.co/u/ashit_pupu)\ **Replies:** 4\ **Last updated:** [February 1, 2022, 5:03am UTC](https://discuss.elastic.co/t/lifecycle-policy-doesnt-delete-index-because-of-wrong-index-age/295859 "2022-02-01T05:03:13Z")
Hi I have created an ILM which would delete an index after 5 days of creation. I have disabled the index rollover so my policy has the hot phase and delete phase . Below is the policy for reference . PUT \_ilm/policy/se… --- ## [ELK Alerting on one of the host memory high utilization](https://discuss.elastic.co/t/elk-alerting-on-one-of-the-host-memory-high-utilization/295822)
**Author:** [@AbdulVaseem](https://discuss.elastic.co/u/AbdulVaseem)\ **Replies:** 2\ **Last updated:** [February 1, 2022, 4:52am UTC](https://discuss.elastic.co/t/elk-alerting-on-one-of-the-host-memory-high-utilization/295822 "2022-02-01T04:52:04Z")
How to set up an alert for a server when RAM/CPU reaches a threshold (like 85%) --- ## [Create a query with OR & And condition in elasticsearch](https://discuss.elastic.co/t/create-a-query-with-or-and-condition-in-elasticsearch/295799)
**Author:** [@Mojahid\_Ahmad](https://discuss.elastic.co/u/Mojahid_Ahmad)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 1:48am UTC](https://discuss.elastic.co/t/create-a-query-with-or-and-condition-in-elasticsearch/295799 "2022-02-01T01:48:34Z")
Hi, I am trying to convert this sql query to the DSL query to query in Python select count(\*) from dean\_acc\_p\_alm\_asset where (substring(cast(sys\_updated\_on as varchar),1,10) \>= '2021-11-01' and substring(cast(sys\_upda… --- ## [Azure Event Hub, The client could not finish the operation within specified maximum execution timeout](https://discuss.elastic.co/t/azure-event-hub-the-client-could-not-finish-the-operation-within-specified-maximum-execution-timeout/295875)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 0\ **Last updated:** [January 31, 2022, 8:34pm UTC](https://discuss.elastic.co/t/azure-event-hub-the-client-could-not-finish-the-operation-within-specified-maximum-execution-timeout/295875 "2022-01-31T20:34:31Z")
Hi Im having this Warns when I try to get events from event hub. com.microsoft.azure.storage.StorageException: The client could not finish the operation within specified maximum execution timeout. after those warns I g… --- ## [Finding bottleneck in pipeline](https://discuss.elastic.co/t/finding-bottleneck-in-pipeline/294308)
**Author:** [@YvorL](https://discuss.elastic.co/u/YvorL)\ **Replies:** 8\ **Last updated:** [February 1, 2022, 1:19am UTC](https://discuss.elastic.co/t/finding-bottleneck-in-pipeline/294308 "2022-02-01T01:19:51Z")
Hello, I'm looking for brave and clever people who can help out someone in a pinch. I've been struggling to find out why one of my (very busy) index is lagging behind. I've been reading different posts, suggestions, et… --- ## [Compatibility Kibana/Elasticsearch - Same major version but different minor versions](https://discuss.elastic.co/t/compatibility-kibana-elasticsearch-same-major-version-but-different-minor-versions/295689)
**Author:** [@Sylmarch](https://discuss.elastic.co/u/Sylmarch)\ **Replies:** 2\ **Last updated:** [February 1, 2022, 12:18am UTC](https://discuss.elastic.co/t/compatibility-kibana-elasticsearch-same-major-version-but-different-minor-versions/295689 "2022-02-01T00:18:01Z")
Hello Elastic team! We plan to install Wazuh HIDS. They indicates that it is possible to use Elastic stack solution instead of Open Distro for Elastic solution. So we plan to use our existing Elasticsearch v7.16 clust… --- ## [Enable https on elasticsearchs](https://discuss.elastic.co/t/enable-https-on-elasticsearchs/295702)
**Author:** [@nikssssss](https://discuss.elastic.co/u/nikssssss)\ **Replies:** 0\ **Last updated:** [January 28, 2022, 12:36pm UTC](https://discuss.elastic.co/t/enable-https-on-elasticsearchs/295702 "2022-01-28T12:36:55Z")
hello, I just want to have https for the Elasticsearch... i have my .pem certification from my company with private key. What i have to do to enable https? the above configuration in yml is ok? xpack.security.enabled… --- ## [Elasticsearch Immutable Documents in Indexes](https://discuss.elastic.co/t/elasticsearch-immutable-documents-in-indexes/295825)
**Author:** [@nirvanah](https://discuss.elastic.co/u/nirvanah)\ **Replies:** 4\ **Last updated:** [February 1, 2022, 12:11am UTC](https://discuss.elastic.co/t/elasticsearch-immutable-documents-in-indexes/295825 "2022-02-01T00:11:19Z")
I am using Elastic Stack to store logs of multiple servers. I need to make the logs/document immutable, i.e. Write-once only. There is a compliance requirement to prevent alteration of logs. I am using Elasticsearch 7.10… --- ## [Gateway settings](https://discuss.elastic.co/t/gateway-settings/295848)
**Author:** [@njain213](https://discuss.elastic.co/u/njain213)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 12:06am UTC](https://discuss.elastic.co/t/gateway-settings/295848 "2022-02-01T00:06:05Z")
Hello Team, I am using ES version 7.9.3. I just want to confirm regarding gateway settings. I am having hot,warm and cold architecture. Master nodes : 3 Data nodes: 13 (hot nodes : 3, cold nodes: 6, warm nodes : 4) W… --- ## [Spike in response time during deleteByQuery](https://discuss.elastic.co/t/spike-in-response-time-during-deletebyquery/295766)
**Author:** [@bradptp](https://discuss.elastic.co/u/bradptp)\ **Replies:** 23\ **Last updated:** [February 1, 2022, 12:05am UTC](https://discuss.elastic.co/t/spike-in-response-time-during-deletebyquery/295766 "2022-02-01T00:05:57Z")
We're using a deletebyQuery to remove a large number of records from Elasticsearch using a query similar to this: let query = { "query": { "bool": { "must\_not": { … --- ## [Elasticsearch 7.10.2 Compatibility with Logstash 7.16.3](https://discuss.elastic.co/t/elasticsearch-7-10-2-compatibility-with-logstash-7-16-3/295889)
**Author:** [@andreakatie](https://discuss.elastic.co/u/andreakatie)\ **Replies:** 2\ **Last updated:** [January 31, 2022, 11:56pm UTC](https://discuss.elastic.co/t/elasticsearch-7-10-2-compatibility-with-logstash-7-16-3/295889 "2022-01-31T23:56:36Z")
I originally tried to upgrade Elasticsearch to 7.10.2 with the OpenDistro 1.13.1 update, but it keeps giving me an error (shown below). The compatibility matrix shows that they should work together. If anyone knows wheth… --- ## [Elastic 3node cluster elastic agent configurations](https://discuss.elastic.co/t/elastic-3node-cluster-elastic-agent-configurations/295771)
**Author:** [@Sithija](https://discuss.elastic.co/u/Sithija)\ **Replies:** 1\ **Last updated:** [January 31, 2022, 11:41pm UTC](https://discuss.elastic.co/t/elastic-3node-cluster-elastic-agent-configurations/295771 "2022-01-31T23:41:41Z")
when elastic running on 3 node cluster and connect the elastic agents to node 1,what if node 1 is down and how to get the logs from agents that connect to node 1? --- ## [Has anyone seen automatic heap sizing work?](https://discuss.elastic.co/t/has-anyone-seen-automatic-heap-sizing-work/295887)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 0\ **Last updated:** [January 31, 2022, 10:53pm UTC](https://discuss.elastic.co/t/has-anyone-seen-automatic-heap-sizing-work/295887 "2022-01-31T22:53:19Z")
All postings I've seen are complaints where it doesn't. If it works for you, can you explain how it works? Does it start with the default 1G heap and grow? Does it set a reasonable heap size \> 1G at startup? My test … --- ## [Mapping explosion vs. the filebeat template](https://discuss.elastic.co/t/mapping-explosion-vs-the-filebeat-template/295886)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 0\ **Last updated:** [January 31, 2022, 10:49pm UTC](https://discuss.elastic.co/t/mapping-explosion-vs-the-filebeat-template/295886 "2022-01-31T22:49:10Z")
I'm struggling trying to figure out how to convert from the way we used legacy templates to the new index and component templates. I used to add our own templates with higher priority on top of the supplied filebeat tem… --- ## [Http input plugin](https://discuss.elastic.co/t/http-input-plugin/295609)
**Author:** [@steevhise](https://discuss.elastic.co/u/steevhise)\ **Replies:** 3\ **Last updated:** [January 31, 2022, 10:39pm UTC](https://discuss.elastic.co/t/http-input-plugin/295609 "2022-01-31T22:39:47Z")
I'm trying to debug communication with an endpoint set up in Logstash using the http input plugin. I'd like to be able to see in the logstash log the raw request payload that logstash receives but I can't figure out how … --- ## [Yellow index (primary shard seems fine)](https://discuss.elastic.co/t/yellow-index-primary-shard-seems-fine/295563)
**Author:** [@Michael\_Ubry](https://discuss.elastic.co/u/Michael_Ubry)\ **Replies:** 4\ **Last updated:** [January 31, 2022, 9:48pm UTC](https://discuss.elastic.co/t/yellow-index-primary-shard-seems-fine/295563 "2022-01-31T21:48:37Z")
Hi, most of my indices are yellow. I am curious about one particular index, which is important to me. Due to confidentiallity I have to rename it in Paint and in codes bellow. When I use this code I get result whats in… --- ## ['Refresh' setting for a bulk update request](https://discuss.elastic.co/t/refresh-setting-for-a-bulk-update-request/295641)
**Author:** [@Kaushik\_Lingarkar](https://discuss.elastic.co/u/Kaushik_Lingarkar)\ **Replies:** 7\ **Last updated:** [January 31, 2022, 9:22pm UTC](https://discuss.elastic.co/t/refresh-setting-for-a-bulk-update-request/295641 "2022-01-31T21:22:29Z")
Hello all, This is my first post here and thank you for this amazing tool. I am using the Elasticsearch-rest-client and I wanted a clarification with the behaviour of Refresh setting with the Bulk API. Does the 'refre… --- ## [Where is iptables dashboard?](https://discuss.elastic.co/t/where-is-iptables-dashboard/295850)
**Author:** [@mevan](https://discuss.elastic.co/u/mevan)\ **Replies:** 2\ **Last updated:** [January 31, 2022, 8:38pm UTC](https://discuss.elastic.co/t/where-is-iptables-dashboard/295850 "2022-01-31T20:38:41Z")
Documentation for iptables module speaks of 'dashboards for visualizing the log data' and 'module comes with sample dashboards' yet when I reference Dashboard in Kibana all I see is 'Create your first dashboard.' Nothing… --- ## [Merge data and metadata csv file in logstash](https://discuss.elastic.co/t/merge-data-and-metadata-csv-file-in-logstash/295815)
**Author:** [@danova](https://discuss.elastic.co/u/danova)\ **Replies:** 2\ **Last updated:** [January 31, 2022, 8:13pm UTC](https://discuss.elastic.co/t/merge-data-and-metadata-csv-file-in-logstash/295815 "2022-01-31T20:13:05Z")
Hi, I´m trying to import/combine two csv files as follows logstash\_metadata.csv: Sample,Treatment,Code S4444003,T\_7896\_D3,G10 S4444004,T\_4516\_D0t1h,G01 logstash\_file.csv: Sample,genus,value S4444003,Chloronema… --- ## [Logstash index template + data streams](https://discuss.elastic.co/t/logstash-index-template-data-streams/295872)
**Author:** [@cmanzur](https://discuss.elastic.co/u/cmanzur)\ **Replies:** 0\ **Last updated:** [January 31, 2022, 7:39pm UTC](https://discuss.elastic.co/t/logstash-index-template-data-streams/295872 "2022-01-31T19:39:25Z")
I'm trying to use data streams and index templates in logstash v7.17 What is the right Elasticsearch output configuration to achieve this? Option 1: Using data stream in the template Fails output { elasticse… --- ## [Metricbeat Windows Not Reporting File Systems](https://discuss.elastic.co/t/metricbeat-windows-not-reporting-file-systems/295871)
**Author:** [@sdf301](https://discuss.elastic.co/u/sdf301)\ **Replies:** 0\ **Last updated:** [January 31, 2022, 7:33pm UTC](https://discuss.elastic.co/t/metricbeat-windows-not-reporting-file-systems/295871 "2022-01-31T19:33:43Z")
I have been trying to install Metricbeat (7.16.3) on a Windows 10 system and can't seem to get any file system information. It was running fine for a while but I needed to reinstall it and can't get it working properly a… --- ## [How to benachamr single decumnt indexing](https://discuss.elastic.co/t/how-to-benachamr-single-decumnt-indexing/295852)
**Author:** [@marek\_duciuc](https://discuss.elastic.co/u/marek_duciuc)\ **Replies:** 3\ **Last updated:** [January 31, 2022, 6:11pm UTC](https://discuss.elastic.co/t/how-to-benachamr-single-decumnt-indexing/295852 "2022-01-31T18:11:53Z")
Is this correct way how to index benchmark single document in rally? { "operation": { "name": "small", "operation-type": "bulk", "bulk-size": "1", "ingest-percentage": "1", … --- ## [Visualization of errors aggregated by exception name and stack trace](https://discuss.elastic.co/t/visualization-of-errors-aggregated-by-exception-name-and-stack-trace/295709)
**Author:** [@xsw2-2wsx](https://discuss.elastic.co/u/xsw2-2wsx)\ **Replies:** 2\ **Last updated:** [January 31, 2022, 5:59pm UTC](https://discuss.elastic.co/t/visualization-of-errors-aggregated-by-exception-name-and-stack-trace/295709 "2022-01-31T17:59:00Z")
Hi, I am looking for a Kibana visualization that displays the count of errors that took place in a time range, grouped by an exception and a stack trace. the relevant mappings: { "index\_patterns": \[ ... \], "mappin… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1071) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1073)