# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1089 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1090 --- ## [Inserting data in Elasticsearch 8.0.0 preview](https://discuss.elastic.co/t/inserting-data-in-elasticsearch-8-0-0-preview/294477)
**Author:** [@Abhishek\_Gautam](https://discuss.elastic.co/u/Abhishek_Gautam)\ **Replies:** 4\ **Last updated:** [January 19, 2022, 9:12am UTC](https://discuss.elastic.co/t/inserting-data-in-elasticsearch-8-0-0-preview/294477 "2022-01-19T09:12:37Z")
Hi team, is there any way to insert bulk data into Elasticsearch 8.0.0 alpha 1, as there isnt any Logstash version compatible with this version. --- ## [Request to close index fails due to socket timeout](https://discuss.elastic.co/t/request-to-close-index-fails-due-to-socket-timeout/294687)
**Author:** [@Shubham\_M](https://discuss.elastic.co/u/Shubham_M)\ **Replies:** 13\ **Last updated:** [January 19, 2022, 9:08am UTC](https://discuss.elastic.co/t/request-to-close-index-fails-due-to-socket-timeout/294687 "2022-01-19T09:08:42Z")
Scenario: We create new index on daily basis so as to keep the data in the index updated.After creation of new index when close request is made,it times out with Socket failure execption. { class: "org.quartz.simpl.Sim… --- ## [Argument \`path\` of the module file\_integrity enhancement?](https://discuss.elastic.co/t/argument-path-of-the-module-file-integrity-enhancement/293668)
**Author:** [@krakz](https://discuss.elastic.co/u/krakz)\ **Replies:** 1\ **Last updated:** [January 19, 2022, 9:05am UTC](https://discuss.elastic.co/t/argument-path-of-the-module-file-integrity-enhancement/293668 "2022-01-19T09:05:33Z")
Hi, The module file\_integrity takes a list of file path, which is useful for binary and configuration file monitoring, but generic users file cannot be monitored otherwise than with the option recursive enable. Is ther… --- ## [How to determine the correct size for terms aggregation, which will produce accurate aggregation results?](https://discuss.elastic.co/t/how-to-determine-the-correct-size-for-terms-aggregation-which-will-produce-accurate-aggregation-results/294771)
**Author:** [@Nishikant\_Tayade](https://discuss.elastic.co/u/Nishikant_Tayade)\ **Replies:** 3\ **Last updated:** [January 19, 2022, 8:27am UTC](https://discuss.elastic.co/t/how-to-determine-the-correct-size-for-terms-aggregation-which-will-produce-accurate-aggregation-results/294771 "2022-01-19T08:27:13Z")
As I read through document for Terms Aggregation, I came across the fact that the results from Term Aggregation are not always accurate, but we can increase the size to get the accurate results. I know : - How Query-T… --- ## [Circular data overwriting](https://discuss.elastic.co/t/circular-data-overwriting/294768)
**Author:** [@jelns](https://discuss.elastic.co/u/jelns)\ **Replies:** 2\ **Last updated:** [January 19, 2022, 7:51am UTC](https://discuss.elastic.co/t/circular-data-overwriting/294768 "2022-01-19T07:51:38Z")
Hi. Is it possible to cyclically overwrite data in Elasticsearch storage (as Round-robin databases do)? For instance, when the storage is full, new data will overwrite the oldest. Maybe there are some way to organize th… --- ## [Discover Can't Show data (Panw Module Filebeat)](https://discuss.elastic.co/t/discover-cant-show-data-panw-module-filebeat/294435)
**Author:** [@Xenial](https://discuss.elastic.co/u/Xenial)\ **Replies:** 4\ **Last updated:** [January 19, 2022, 6:49am UTC](https://discuss.elastic.co/t/discover-cant-show-data-panw-module-filebeat/294435 "2022-01-19T06:49:33Z")
Hi All, I've configured the ELK system for monitoring Palo Alto Log using Filebeats Modules PANW. i check the data index management is real time counting and grow, but when i go to Discover not showing any data. In… --- ## [Elasticsearch plugin turned red](https://discuss.elastic.co/t/elasticsearch-plugin-turned-red/294503)
**Author:** [@Mohammad\_Ramadan\_Abd](https://discuss.elastic.co/u/Mohammad_Ramadan_Abd)\ **Replies:** 3\ **Last updated:** [January 19, 2022, 6:48am UTC](https://discuss.elastic.co/t/elasticsearch-plugin-turned-red/294503 "2022-01-19T06:48:09Z")
Hello Bros' In my setup here i suddenly found my setup stoped working with Elasticsearch plugin is red "Chaeck attachments", I have restarted the server several times but still not working. Any help to have it back wor… --- ## [Import from mongodb using logstash](https://discuss.elastic.co/t/import-from-mongodb-using-logstash/294770)
**Author:** [@saeed](https://discuss.elastic.co/u/saeed)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 6:29am UTC](https://discuss.elastic.co/t/import-from-mongodb-using-logstash/294770 "2022-01-19T06:29:49Z")
Hi I need to import my documents from mongodb to Elasticsearch and I used logstash. This is my output in CMD when I run this command: C:\\logstash-7.16.3\\bin\\logstash -f c:\\logstash-7.16.3\\bin\\mongo2.conf "Using bundl… --- ## [Doc\_values: false Not effective?](https://discuss.elastic.co/t/doc-values-false-not-effective/294760)
**Author:** [@S-Dragon0302](https://discuss.elastic.co/u/S-Dragon0302)\ **Replies:** 1\ **Last updated:** [January 19, 2022, 4:00am UTC](https://discuss.elastic.co/t/doc-values-false-not-effective/294760 "2022-01-19T04:00:22Z")
Elasticsearch version:7.15.1 { - "contentindex\_2m\_20211109\_1412": { - "mappings": { - "dynamic": "false", "\_source": { - "enabled": false }, "properties": { - "ContentHtml": { - "type": "keyword", "doc\_values"… --- ## [Filebeat Non-Root User Permissions](https://discuss.elastic.co/t/filebeat-non-root-user-permissions/294743)
**Author:** [@harry\_cook](https://discuss.elastic.co/u/harry_cook)\ **Replies:** 1\ **Last updated:** [January 19, 2022, 12:37am UTC](https://discuss.elastic.co/t/filebeat-non-root-user-permissions/294743 "2022-01-19T00:37:32Z")
Can I Install filebeat as a non-root user on on-prem servers ? If yes what/where all permissions do I need to run it as non-root user ? --- ## [Custom Interactive Filters in Kibana](https://discuss.elastic.co/t/custom-interactive-filters-in-kibana/294216)
**Author:** [@Jason2073](https://discuss.elastic.co/u/Jason2073)\ **Replies:** 3\ **Last updated:** [January 18, 2022, 10:30pm UTC](https://discuss.elastic.co/t/custom-interactive-filters-in-kibana/294216 "2022-01-18T22:30:46Z")
Hello! I have been working to make a kibana dashboard more interactive for a very picky client that wants a way of interacting with filters that I can't seem to find a way of doing with the features I have seen in kibana… --- ## [Kibana 7.6.2 URL drill down dashboard](https://discuss.elastic.co/t/kibana-7-6-2-url-drill-down-dashboard/294705)
**Author:** [@gaetano](https://discuss.elastic.co/u/gaetano)\ **Replies:** 2\ **Last updated:** [January 18, 2022, 9:47pm UTC](https://discuss.elastic.co/t/kibana-7-6-2-url-drill-down-dashboard/294705 "2022-01-18T21:47:05Z")
In Kibana 7.6.2 Is it possible to create interactive dashboards where you can drill down to a specific url from a visualization that belongs to the dashboard? --- ## [Setting up basic security plus secured HTTP Traffic](https://discuss.elastic.co/t/setting-up-basic-security-plus-secured-http-traffic/294735)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 8:43pm UTC](https://discuss.elastic.co/t/setting-up-basic-security-plus-secured-http-traffic/294735 "2022-01-18T20:43:19Z")
Hello all, I have a three node implementation cluster for Elastic stack on three different VMs and I am using version 7.16.2 with basic license. I have set up two layers of security and working on the last one which is … --- ## [Switching from index names to alias - performance impact?](https://discuss.elastic.co/t/switching-from-index-names-to-alias-performance-impact/294633)
**Author:** [@sale](https://discuss.elastic.co/u/sale)\ **Replies:** 4\ **Last updated:** [January 18, 2022, 8:50pm UTC](https://discuss.elastic.co/t/switching-from-index-names-to-alias-performance-impact/294633 "2022-01-18T20:50:53Z")
We use Elasticsearch for time series data with indices created every day. We perform all operations (ingest, search etc) using the REST APIs. We keep 60-days worth of data available to query. Currently, when we do searc… --- ## [Disk usage exceed in Elastic search after logstash upgrade](https://discuss.elastic.co/t/disk-usage-exceed-in-elastic-search-after-logstash-upgrade/294577)
**Author:** [@abkonr](https://discuss.elastic.co/u/abkonr)\ **Replies:** 2\ **Last updated:** [January 18, 2022, 8:47pm UTC](https://discuss.elastic.co/t/disk-usage-exceed-in-elastic-search-after-logstash-upgrade/294577 "2022-01-18T20:47:43Z")
Hi Elastic Team, kindly help with below issue. FYI we have seen this error after logstash upgrade. i.e 7.16.2 and upgrade has been perfomed to fix the log4j vulnerability. please suggest us to fix this problem. error=\>{… --- ## [Logstash hanged, cant be even restarted, Elastic output plugin might be the rascal?](https://discuss.elastic.co/t/logstash-hanged-cant-be-even-restarted-elastic-output-plugin-might-be-the-rascal/294732)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 1\ **Last updated:** [January 18, 2022, 7:26pm UTC](https://discuss.elastic.co/t/logstash-hanged-cant-be-even-restarted-elastic-output-plugin-might-be-the-rascal/294732 "2022-01-18T19:26:22Z")
Hi, I've a configuration that reads from a file and gets its content to a data stream in Elastic. My setup is like that: I have a conf file under /etc/logstash/conf.d/ that listens on a port to get the logs and writes… --- ## [Docker-Compose and ELK, inaccessable from web](https://discuss.elastic.co/t/docker-compose-and-elk-inaccessable-from-web/294728)
**Author:** [@userR](https://discuss.elastic.co/u/userR)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 7:01pm UTC](https://discuss.elastic.co/t/docker-compose-and-elk-inaccessable-from-web/294728 "2022-01-18T19:01:39Z")
Below is my Docker-Compose file, I can't seem to access it when I type in the port and IP. version: '2.2' services: elasticsearch: image: docker.elastic.co/elasticsearch/elasticsearch:7.16.2 container\_name: el… --- ## [Exclude master node from query user operations - how?](https://discuss.elastic.co/t/exclude-master-node-from-query-user-operations-how/294636)
**Author:** [@sale](https://discuss.elastic.co/u/sale)\ **Replies:** 6\ **Last updated:** [January 18, 2022, 6:25pm UTC](https://discuss.elastic.co/t/exclude-master-node-from-query-user-operations-how/294636 "2022-01-18T18:25:25Z")
We have a 11 node Elasticsearch cluster (3 master-eligible node + 8 data nodes). We perform all operations (ingesting, search etc) using REST calls. The master nodes are lightweight as compared to data nodes. For the sa… --- ## ["operation primary term \[1\] is too old (current \[2\])"](https://discuss.elastic.co/t/operation-primary-term-1-is-too-old-current-2/294459)
**Author:** [@noactivation](https://discuss.elastic.co/u/noactivation)\ **Replies:** 2\ **Last updated:** [January 18, 2022, 6:14pm UTC](https://discuss.elastic.co/t/operation-primary-term-1-is-too-old-current-2/294459 "2022-01-18T18:14:27Z")
I'm novice with Elasticsearch, looking at some issues today. The company subject matter expert is in a different timezone where it is well-past business hours on a Friday night. This doesn't seem critical, so I'm not goi… --- ## [Show text from index](https://discuss.elastic.co/t/show-text-from-index/294713)
**Author:** [@czxch](https://discuss.elastic.co/u/czxch)\ **Replies:** 1\ **Last updated:** [January 18, 2022, 5:41pm UTC](https://discuss.elastic.co/t/show-text-from-index/294713 "2022-01-18T17:41:34Z")
Is it possible to show a text field in a visualization like in a Markdown but with the text coming from an index as I want this text to be updated dynamically each time it changes --- ## [Can't delete/change data in @timestamp field yielded by ingest processor](https://discuss.elastic.co/t/cant-delete-change-data-in-timestamp-field-yielded-by-ingest-processor/294497)
**Author:** [@SomeAkk](https://discuss.elastic.co/u/SomeAkk)\ **Replies:** 5\ **Last updated:** [January 18, 2022, 5:29pm UTC](https://discuss.elastic.co/t/cant-delete-change-data-in-timestamp-field-yielded-by-ingest-processor/294497 "2022-01-18T17:29:35Z")
Hi! Today i add to my document @timestamp field (before this value was not in the document, and document no any date data.) with date data using ingest set processor: { "processors": \[ { "set": { "de… --- ## [Roll Up Index does not get populated with documents](https://discuss.elastic.co/t/roll-up-index-does-not-get-populated-with-documents/294707)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 1\ **Last updated:** [January 18, 2022, 5:04pm UTC](https://discuss.elastic.co/t/roll-up-index-does-not-get-populated-with-documents/294707 "2022-01-18T17:04:37Z")
Hi folks, my goal is to archive the document \_size of incoming logs in specific archive index, because the original document gets deleted using ILM. Example Document: { "\_index":"filebeat-live-index-01", "\_type"… --- ## [Upsert data using painless script if updated\_at is higher than previous document](https://discuss.elastic.co/t/upsert-data-using-painless-script-if-updated-at-is-higher-than-previous-document/294632)
**Author:** [@garotad508](https://discuss.elastic.co/u/garotad508)\ **Replies:** 1\ **Last updated:** [January 18, 2022, 4:35pm UTC](https://discuss.elastic.co/t/upsert-data-using-painless-script-if-updated-at-is-higher-than-previous-document/294632 "2022-01-18T16:35:28Z")
I have a collection which gets updated frequently. We need to perform upsert operation, i.e., if document doesn't exist then create else update. Another constraint we require is timestamp of updated\_at should be higher… --- ## [Select documents with nested collection without something](https://discuss.elastic.co/t/select-documents-with-nested-collection-without-something/294714)
**Author:** [@Ivan\_Popov](https://discuss.elastic.co/u/Ivan_Popov)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 4:22pm UTC](https://discuss.elastic.co/t/select-documents-with-nested-collection-without-something/294714 "2022-01-18T16:22:38Z")
Here is my test data \[ { "id": 1, "last\_email\_sent": \[ { "letterId": 1, "timestamp": 555 }, { "letterId": 2, "timestamp": 666 } \] }, { "id": … --- ## [Elasticsearch docker environment variables prefix](https://discuss.elastic.co/t/elasticsearch-docker-environment-variables-prefix/294711)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 4:08pm UTC](https://discuss.elastic.co/t/elasticsearch-docker-environment-variables-prefix/294711 "2022-01-18T16:08:58Z")
I'm trying to run ES in docker with specific env variables such as discovery.type=single-node, but my hosting provider prohibits . characters in env variable names. This is discussed here: Install Elasticsearch with Doc… --- ## [Logstash OSS 7.16.3 and Elasticsearch OSS 7.10.2](https://discuss.elastic.co/t/logstash-oss-7-16-3-and-elasticsearch-oss-7-10-2/294658)
**Author:** [@Thilak1](https://discuss.elastic.co/u/Thilak1)\ **Replies:** 2\ **Last updated:** [January 18, 2022, 4:00pm UTC](https://discuss.elastic.co/t/logstash-oss-7-16-3-and-elasticsearch-oss-7-10-2/294658 "2022-01-18T16:00:34Z")
Hi Team , I am getting the below error when using Elasticsearch output plugin in logstash OSS 7.16.3 \[2021-04-16T05:31:15,846\]\[ERROR\]\[logstash.javapipeline \] Pipeline error {:pipeline\_id=\>"main", :exception=\>#\ **Author:** [@linuxlion](https://discuss.elastic.co/u/linuxlion)\ **Replies:** 2\ **Last updated:** [January 17, 2022, 4:36pm UTC](https://discuss.elastic.co/t/how-to-restart-collection-after-high-disk-watermark/294605 "2022-01-17T16:36:50Z") Elasticsearch stop collection after high disk watermark. After cleanup the disk, I want to restart collection. Some years ago on version 6.8.23-1 I use: curl -X PUT "http://127.0.0.1:9200/settings?pretty" -H 'Content-… --- ## [Conditional in the output is ignored](https://discuss.elastic.co/t/conditional-in-the-output-is-ignored/294343)
**Author:** [@edster](https://discuss.elastic.co/u/edster)\ **Replies:** 5\ **Last updated:** [January 18, 2022, 3:15pm UTC](https://discuss.elastic.co/t/conditional-in-the-output-is-ignored/294343 "2022-01-18T15:15:22Z")
The conditional statement in my logstash configuration is being ignored. It is being skipped over no matter what I put in it. I have 4 elasticsearch options in the output divided by an if and else statement. I've tried u… --- ## [How can I add kubernetes metadata for my cri-containerd pods](https://discuss.elastic.co/t/how-can-i-add-kubernetes-metadata-for-my-cri-containerd-pods/294706)
**Author:** [@jianwu](https://discuss.elastic.co/u/jianwu)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 2:49pm UTC](https://discuss.elastic.co/t/how-can-i-add-kubernetes-metadata-for-my-cri-containerd-pods/294706 "2022-01-18T14:49:43Z")
I am using filebeat 7.16.2 to collect containers stdout which run-time is containerd. MY kubernetes' versin v1.20.10, and containerd version is v1.19.0. Below is some of my filebeat.yaml filebeat.inputs: - type… --- ## [Create custom visualization for Kibana composed by image + text](https://discuss.elastic.co/t/create-custom-visualization-for-kibana-composed-by-image-text/294590)
**Author:** [@gaetano](https://discuss.elastic.co/u/gaetano)\ **Replies:** 1\ **Last updated:** [January 18, 2022, 2:49pm UTC](https://discuss.elastic.co/t/create-custom-visualization-for-kibana-composed-by-image-text/294590 "2022-01-18T14:49:34Z")
Is it possible to create a visualization that is composed by an image and a test side by side? An other charateristic is that the visualization has an associated url for reaching a specific dashboard. Or is it possible… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1088) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1090)