# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1090 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1091 --- ## [K8s (kubernetes) sidecar considerations](https://discuss.elastic.co/t/k8s-kubernetes-sidecar-considerations/294393)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 5\ **Last updated:** [January 18, 2022, 2:29pm UTC](https://discuss.elastic.co/t/k8s-kubernetes-sidecar-considerations/294393 "2022-01-18T14:29:05Z")
Hi, At this moment we have a myriad of microservices running on-prem. However, we are preparing to move everything to tha cloud (k8s on aws). As a result I am redesigning our elastic platform since this will move to aws… --- ## [Not able to start Elasticsearch cluster after disabling security](https://discuss.elastic.co/t/not-able-to-start-elasticsearch-cluster-after-disabling-security/294673)
**Author:** [@hallaoui](https://discuss.elastic.co/u/hallaoui)\ **Replies:** 3\ **Last updated:** [January 18, 2022, 2:17pm UTC](https://discuss.elastic.co/t/not-able-to-start-elasticsearch-cluster-after-disabling-security/294673 "2022-01-18T14:17:13Z")
Hi All, I disabled the security due to expiration of platinum subscription but when trying to start the cluster it is not starting. Any help will be high appreciated. Thanks --- ## [Update mapping to support an additional date format (without reindexing)](https://discuss.elastic.co/t/update-mapping-to-support-an-additional-date-format-without-reindexing/294704)
**Author:** [@Lee\_Tonks](https://discuss.elastic.co/u/Lee_Tonks)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 2:13pm UTC](https://discuss.elastic.co/t/update-mapping-to-support-an-additional-date-format-without-reindexing/294704 "2022-01-18T14:13:59Z")
Is it possible to update my document mapping to support an additional date/time format without having to reindex? ie my current format is: {"type": "date", "format": "yyyy-MM-dd HH:mm:ss"} and the format I want to set… --- ## [Unable to use filters with grok expression](https://discuss.elastic.co/t/unable-to-use-filters-with-grok-expression/294662)
**Author:** [@mohammed.sabil](https://discuss.elastic.co/u/mohammed.sabil)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 8:02am UTC](https://discuss.elastic.co/t/unable-to-use-filters-with-grok-expression/294662 "2022-01-18T08:02:04Z")
Hello Team, I need to use grok expression for ELK to filter the message data I have elk configured using docker compose and filebeat on client server using docker container. I have following files configured for filte… --- ## [How to add personnal aggs in Kibana](https://discuss.elastic.co/t/how-to-add-personnal-aggs-in-kibana/294691)
**Author:** [@Scorfly](https://discuss.elastic.co/u/Scorfly)\ **Replies:** 1\ **Last updated:** [January 18, 2022, 1:28pm UTC](https://discuss.elastic.co/t/how-to-add-personnal-aggs-in-kibana/294691 "2022-01-18T13:28:01Z")
Hello ! I have doc for each of my product. My product have serviceCreationDate and serviceTerminationDate field. i try to have the diff between service created and terminated. However i dont find a solution with Kiban… --- ## [Duplicate error logs](https://discuss.elastic.co/t/duplicate-error-logs/294696)
**Author:** [@Petersson](https://discuss.elastic.co/u/Petersson)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 1:24pm UTC](https://discuss.elastic.co/t/duplicate-error-logs/294696 "2022-01-18T13:24:28Z")
Hello, I have recently started using Elasticsearch in combination with the Kibana presentation layer. My problem now is that in the log analysis all logs are shown to me individually, so there are many identical error … --- ## [Elasticsearch x-paxk error](https://discuss.elastic.co/t/elasticsearch-x-paxk-error/294661)
**Author:** [@harsh19](https://discuss.elastic.co/u/harsh19)\ **Replies:** 1\ **Last updated:** [January 18, 2022, 1:19pm UTC](https://discuss.elastic.co/t/elasticsearch-x-paxk-error/294661 "2022-01-18T13:19:37Z")
When i run ./Elasticsearch it's gives an error how do i reconfiugure keystore or else ? uncaught exception in thread \[main\] java.lang.IllegalArgumentException: unknown secure setting \[xpack.security.transport.ssl.keysto… --- ## [I'm unable to create fields and unable to parse the below logs with split filter please suggest me the correct logstash input](https://discuss.elastic.co/t/im-unable-to-create-fields-and-unable-to-parse-the-below-logs-with-split-filter-please-suggest-me-the-correct-logstash-input/294682)
**Author:** [@aravindpatel](https://discuss.elastic.co/u/aravindpatel)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 10:45am UTC](https://discuss.elastic.co/t/im-unable-to-create-fields-and-unable-to-parse-the-below-logs-with-split-filter-please-suggest-me-the-correct-logstash-input/294682 "2022-01-18T10:45:29Z")
log file { "id": "AAA", "num": "-17.3595", "num": "-145.494", "name": "Anaa", "author": "Anaaauthor", "place": "Tuamotu-Gambier", "landmark": "French Polynesia", "spcid": "12512819", "target": "Pacific/Midway", … --- ## [PATTERN ERROR WHEN ADDING IN INGEST PIPELINE GROK PROCESSOR](https://discuss.elastic.co/t/pattern-error-when-adding-in-ingest-pipeline-grok-processor/294667)
**Author:** [@mohammadawaisjavaid](https://discuss.elastic.co/u/mohammadawaisjavaid)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 8:36am UTC](https://discuss.elastic.co/t/pattern-error-when-adding-in-ingest-pipeline-grok-processor/294667 "2022-01-18T08:36:53Z")
Hi all, I am stucked in one thing and want to ask in community that I am trying to create a grok pattern for a log and in dev tools grok tester I am successfull in writing up a pattern as the below screenshow indicates … --- ## [Curator failing with 'curator.exceptions.FailedExecution'\>: Unable to get snapshot information from repository: elkbackup. Error: NotFoundError(404, 'snapshot\_missing\_exception',](https://discuss.elastic.co/t/curator-failing-with-curator-exceptions-failedexecution-unable-to-get-snapshot-information-from-repository-elkbackup-error-notfounderror-404-snapshot-missing-exception/294660)
**Author:** [@jashwanth](https://discuss.elastic.co/u/jashwanth)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 7:50am UTC](https://discuss.elastic.co/t/curator-failing-with-curator-exceptions-failedexecution-unable-to-get-snapshot-information-from-repository-elkbackup-error-notfounderror-404-snapshot-missing-exception/294660 "2022-01-18T07:50:40Z")
Hi Team, We're facing an issue with Curator and it is failing with below error. The Curator is searching a snapshot which is not present in S3. How can we fix this error for delete\_snapshots to work properly. One of th… --- ## [Cant install jdbc plugin](https://discuss.elastic.co/t/cant-install-jdbc-plugin/294665)
**Author:** [@peledev](https://discuss.elastic.co/u/peledev)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 8:33am UTC](https://discuss.elastic.co/t/cant-install-jdbc-plugin/294665 "2022-01-18T08:33:12Z")
hi i cant install plugin in my server is get error : \[claudede@server logstash\]$ sudo bin/logstash-plugin install logstash-input-jdbc Using bundled JDK: /usr/share/logstash/jdk OpenJDK 64-Bit Server VM warning: Option … --- ## [Would the search performance be very slow if a data stream consists of too many or too large cold backing indices?](https://discuss.elastic.co/t/would-the-search-performance-be-very-slow-if-a-data-stream-consists-of-too-many-or-too-large-cold-backing-indices/294376)
**Author:** [@Morriaty](https://discuss.elastic.co/u/Morriaty)\ **Replies:** 6\ **Last updated:** [January 18, 2022, 8:16am UTC](https://discuss.elastic.co/t/would-the-search-performance-be-very-slow-if-a-data-stream-consists-of-too-many-or-too-large-cold-backing-indices/294376 "2022-01-18T08:16:45Z")
Hi, I'm moving from es 6.x to 7.x, find the new feature data stream and would like to have a try. But I'm a bit worried of the search performace for the docs explains When you submit a read request to a data stream, the… --- ## [How to remove Kibana "Add Integrations" button](https://discuss.elastic.co/t/how-to-remove-kibana-add-integrations-button/293098)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [January 18, 2022, 7:40am UTC](https://discuss.elastic.co/t/how-to-remove-kibana-add-integrations-button/293098 "2022-01-18T07:40:01Z")
Hello, We updated to 7.16.2 today. Seems like there is now a huge "Add Integrations' button in the main Kibana menu.... :frowning: Is there a way to remove this button please? As this results in all kinds of unwanted… --- ## [How to fix \[logstash.filters.geoip.databasemanager\] Connection reset](https://discuss.elastic.co/t/how-to-fix-logstash-filters-geoip-databasemanager-connection-reset/294237)
**Author:** [@Frank\_Kuo](https://discuss.elastic.co/u/Frank_Kuo)\ **Replies:** 2\ **Last updated:** [January 18, 2022, 7:03am UTC](https://discuss.elastic.co/t/how-to-fix-logstash-filters-geoip-databasemanager-connection-reset/294237 "2022-01-18T07:03:21Z")
hi guys, I meet the issue and I don't know why? Does anybody know the reason? Jan 14 10:23:18 OANWELKL1 logstash\[4874\]: \[2022-01-14T10:23:18,644\]\[WARN \]\[org.logstash.instrument.metrics.gauge.LazyDelegatingGauge\]\[main\] … --- ## [What is the point of using EQL to correlate log?](https://discuss.elastic.co/t/what-is-the-point-of-using-eql-to-correlate-log/294542)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 1\ **Last updated:** [January 18, 2022, 6:57am UTC](https://discuss.elastic.co/t/what-is-the-point-of-using-eql-to-correlate-log/294542 "2022-01-18T06:57:48Z")
Hi all I am trying to understand how the eql is difference from the normal search api that we are already using in elastic. For example GET /winlogbeat-\*/\_eql/search { "query": """ process where event.type == "s… --- ## [Can I add a sub "term" "aggregation" for a x-axis filters aggregation?](https://discuss.elastic.co/t/can-i-add-a-sub-term-aggregation-for-a-x-axis-filters-aggregation/294533)
**Author:** [@rogerlee](https://discuss.elastic.co/u/rogerlee)\ **Replies:** 5\ **Last updated:** [January 18, 2022, 5:50am UTC](https://discuss.elastic.co/t/can-i-add-a-sub-term-aggregation-for-a-x-axis-filters-aggregation/294533 "2022-01-18T05:50:18Z")
Hello, experts. I am trying to customize an aggregation via "Json Input" for a horizontal bar chart, and the data I am using is the flight demo data. The purpose is that I want to specify aggregations for every filter on… --- ## [After ES Cluster docker container restart on 7.5.0 could not elect master node with same configuration as old](https://discuss.elastic.co/t/after-es-cluster-docker-container-restart-on-7-5-0-could-not-elect-master-node-with-same-configuration-as-old/294615)
**Author:** [@shubham1121](https://discuss.elastic.co/u/shubham1121)\ **Replies:** 1\ **Last updated:** [January 18, 2022, 4:48am UTC](https://discuss.elastic.co/t/after-es-cluster-docker-container-restart-on-7-5-0-could-not-elect-master-node-with-same-configuration-as-old/294615 "2022-01-18T04:48:18Z")
On physical server container restarts and then could not elect master anymore from 3 node ES cluster --- ## [Questions about the use of maxSeqNoOfUpdatesOrDeletes in planIndexingAsNonPrimary](https://discuss.elastic.co/t/questions-about-the-use-of-maxseqnoofupdatesordeletes-in-planindexingasnonprimary/294650)
**Author:** [@liurui](https://discuss.elastic.co/u/liurui)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 3:48am UTC](https://discuss.elastic.co/t/questions-about-the-use-of-maxseqnoofupdatesordeletes-in-planindexingasnonprimary/294650 "2022-01-18T03:48:14Z")
Hello. :grinning: I recently encountered read IOPS high due to translog operation replay during index recovery on a 710 cluster. I want to know more about the logic of this place and have a question about the method pla… --- ## [What's the detail about enterprise license 30$ per month?](https://discuss.elastic.co/t/whats-the-detail-about-enterprise-license-30-per-month/294643)
**Author:** [@chaishiqi](https://discuss.elastic.co/u/chaishiqi)\ **Replies:** 2\ **Last updated:** [January 18, 2022, 3:29am UTC](https://discuss.elastic.co/t/whats-the-detail-about-enterprise-license-30-per-month/294643 "2022-01-18T03:29:00Z")
As it ,In order to search snapshot on frozen tie of my private Elasticsearch cluster ,the license price on website is 30$ per month, this is all the cluster fee or single node agent? --- ## [Join the two index in the ElasticSearch to query the data with sorting](https://discuss.elastic.co/t/join-the-two-index-in-the-elasticsearch-to-query-the-data-with-sorting/294519)
**Author:** [@jamesweb1](https://discuss.elastic.co/u/jamesweb1)\ **Replies:** 3\ **Last updated:** [January 18, 2022, 3:23am UTC](https://discuss.elastic.co/t/join-the-two-index-in-the-elasticsearch-to-query-the-data-with-sorting/294519 "2022-01-18T03:23:18Z")
In my application, I have two indices like: Elasticsearch (index: 'identify\_results') deviceId value time 00245765 100 2021-11-22T08:20:01.004Z 10245888 200 2021-11-23T10:20:01.004Z 00245765 300 2021-11-24T11:20:01.004Z… --- ## [Issue of Configuring in Logstash](https://discuss.elastic.co/t/issue-of-configuring-in-logstash/294387)
**Author:** [@leyleynewt](https://discuss.elastic.co/u/leyleynewt)\ **Replies:** 7\ **Last updated:** [January 18, 2022, 2:16am UTC](https://discuss.elastic.co/t/issue-of-configuring-in-logstash/294387 "2022-01-18T02:16:07Z")
This is the configuration in logstash-sample.conf: input{ stdin{} } output{ elasticsearch{ hosts =\> \["localhost:9200"\] index =\> "my-index-name" user =\> "elastic" passwo… --- ## [Cannot run forecast, memory usage is predicted to exceed 20MB. v7.8](https://discuss.elastic.co/t/cannot-run-forecast-memory-usage-is-predicted-to-exceed-20mb-v7-8/294623)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 2\ **Last updated:** [January 18, 2022, 2:13am UTC](https://discuss.elastic.co/t/cannot-run-forecast-memory-usage-is-predicted-to-exceed-20mb-v7-8/294623 "2022-01-18T02:13:22Z")
Hi Im having problems runing a forecast, when I use the kibana GUI it throws me a Bad Request error and when I use devtools I get this error. Cannot run forecast: Forecast cannot be executed as forecast memory usage is … --- ## [Kibana cannot create new index'es](https://discuss.elastic.co/t/kibana-cannot-create-new-indexes/294536)
**Author:** [@Adrpan83](https://discuss.elastic.co/u/Adrpan83)\ **Replies:** 3\ **Last updated:** [January 18, 2022, 12:42am UTC](https://discuss.elastic.co/t/kibana-cannot-create-new-indexes/294536 "2022-01-18T00:42:27Z")
Hi all! I have a little bit problem with my indexes. Every day at midnight a new index should be created, but it is created only when I delete or freeze the previous index e.g. from 30 days ago. I have free space on se… --- ## [Not able to parse below multiple json objects i have lot of json objects like this please provide filebeat input and logstsah configuration for this thank you in advance](https://discuss.elastic.co/t/not-able-to-parse-below-multiple-json-objects-i-have-lot-of-json-objects-like-this-please-provide-filebeat-input-and-logstsah-configuration-for-this-thank-you-in-advance/294550)
**Author:** [@aravindpatel](https://discuss.elastic.co/u/aravindpatel)\ **Replies:** 0\ **Last updated:** [January 17, 2022, 8:53am UTC](https://discuss.elastic.co/t/not-able-to-parse-below-multiple-json-objects-i-have-lot-of-json-objects-like-this-please-provide-filebeat-input-and-logstsah-configuration-for-this-thank-you-in-advance/294550 "2022-01-17T08:53:17Z")
{ "id": "AAA", "num": "-17.3595", "num": "-145.494", "name": "Anaa", "author": "Anaaauthor", "place": "Tuamotu-Gambier", "landmark": "French Polynesia", "spcid": "12512819", "target": "Pacific/Midway", "mob": … --- ## [Every Night- Elasticsearch. (code=killed, signal=KILL)](https://discuss.elastic.co/t/every-night-elasticsearch-code-killed-signal-kill/294397)
**Author:** [@beohna](https://discuss.elastic.co/u/beohna)\ **Replies:** 8\ **Last updated:** [January 17, 2022, 10:58pm UTC](https://discuss.elastic.co/t/every-night-elasticsearch-code-killed-signal-kill/294397 "2022-01-17T22:58:41Z")
Hey, on my Rasperry Pi with Nextcloud and full text search (powered by Elasticsearch) every night Elasticsearch is killed (code=killed, signal=KILL). ● elasticsearch.service - Elasticsearch Loaded: loaded (/lib/s… --- ## [Force\_source seems not working](https://discuss.elastic.co/t/force-source-seems-not-working/294622)
**Author:** [@ympark](https://discuss.elastic.co/u/ympark)\ **Replies:** 0\ **Last updated:** [January 17, 2022, 7:41pm UTC](https://discuss.elastic.co/t/force-source-seems-not-working/294622 "2022-01-17T19:41:17Z")
Hi all, I am testing the latest Elasticsearch 7.16.3 and encountered an issue. I have a keyword type field with the lowercase normaliser. When I get highlight on the keyword field, Highlighting seems not to be applied … --- ## [Setting up minimal security for Elasticsearch 7.16.2](https://discuss.elastic.co/t/setting-up-minimal-security-for-elasticsearch-7-16-2/294316)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 1\ **Last updated:** [January 17, 2022, 7:39pm UTC](https://discuss.elastic.co/t/setting-up-minimal-security-for-elasticsearch-7-16-2/294316 "2022-01-17T19:39:13Z")
Hello all, I am using Elastic stack version 7.16.2 with a three node cluster implementation. I am using a basic license. I understand I can set up three different levels of security for my elastic stack. Minimal secu… --- ## [Error in per bucket doc\_count\_error\_upper\_bound for Term Aggregation?](https://discuss.elastic.co/t/error-in-per-bucket-doc-count-error-upper-bound-for-term-aggregation/294249)
**Author:** [@Nishikant\_Tayade](https://discuss.elastic.co/u/Nishikant_Tayade)\ **Replies:** 7\ **Last updated:** [January 17, 2022, 7:07pm UTC](https://discuss.elastic.co/t/error-in-per-bucket-doc-count-error-upper-bound-for-term-aggregation/294249 "2022-01-17T19:07:47Z")
Below configuration for Elasticsearch: 1 Cluster 1 Node 1 Index 3 Shards (1 Replica shard for each primary, but in UNASSIGNED state as there is only 1 node). I have indexed document and those are spread across 3 Shards… --- ## [Error installing Logstash on Linux Server](https://discuss.elastic.co/t/error-installing-logstash-on-linux-server/294621)
**Author:** [@uday22](https://discuss.elastic.co/u/uday22)\ **Replies:** 0\ **Last updated:** [January 17, 2022, 6:40pm UTC](https://discuss.elastic.co/t/error-installing-logstash-on-linux-server/294621 "2022-01-17T18:40:28Z")
OS: Linux i used rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch command to start installation process i am getting errors curl: (7) Failed connect to artifacts.elastic.co:443; connection timed out er… --- ## [Extend the legend entries in vega](https://discuss.elastic.co/t/extend-the-legend-entries-in-vega/294401)
**Author:** [@EduardoM](https://discuss.elastic.co/u/EduardoM)\ **Replies:** 3\ **Last updated:** [January 17, 2022, 5:38pm UTC](https://discuss.elastic.co/t/extend-the-legend-entries-in-vega/294401 "2022-01-17T17:38:38Z")
Have a good day everyone, I have a visualization in vega and apparently it does not support more than 29 different data(entries ) for a legend called Products, can it somehow extend the capacity of a legend in vega? … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1089) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1091)