# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1138 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1139 --- ## [Queries for shard allocation failure](https://discuss.elastic.co/t/queries-for-shard-allocation-failure/291022)
**Author:** [@pratiksha](https://discuss.elastic.co/u/pratiksha)\ **Replies:** 4\ **Last updated:** [December 6, 2021, 10:27am UTC](https://discuss.elastic.co/t/queries-for-shard-allocation-failure/291022 "2021-12-06T10:27:24Z")
I am using Elasticsearch v7.10.2. I have cluster running with many unassigned shards. I want to determine the number of retries that has already finished for the shards. Is there any way to check that as in how many retr… --- ## [How to remove fields with - values in logstash filter?](https://discuss.elastic.co/t/how-to-remove-fields-with-values-in-logstash-filter/290879)
**Author:** [@Anusha\_Kusanghi](https://discuss.elastic.co/u/Anusha_Kusanghi)\ **Replies:** 4\ **Last updated:** [December 6, 2021, 9:58am UTC](https://discuss.elastic.co/t/how-to-remove-fields-with-values-in-logstash-filter/290879 "2021-12-06T09:58:35Z")
I have a patterns like : 2021-10-15 20:00:13 2396 tstur1 /ftp/workspace/ this is message 2020-10-15 18:00:13 - - this is the second message The fields are Date, Time, SessionId, path and message. The grok pattern use… --- ## [Try to Parsing Postfix Log Using Logstash](https://discuss.elastic.co/t/try-to-parsing-postfix-log-using-logstash/288397)
**Author:** [@RichYaNa](https://discuss.elastic.co/u/RichYaNa)\ **Replies:** 6\ **Last updated:** [December 6, 2021, 9:48am UTC](https://discuss.elastic.co/t/try-to-parsing-postfix-log-using-logstash/288397 "2021-12-06T09:48:12Z")
Hi, I'm currently parsing postfix logs using Logstash, you can check my config file here. and here is a sample log that I will parse: Nov 4 08:51:20 mail /postfix-script\[XPIDX\]: the Postfix mail system is running: PI… --- ## [Ingesting ECS ndjson via http\_endpoint?](https://discuss.elastic.co/t/ingesting-ecs-ndjson-via-http-endpoint/291023)
**Author:** [@Matthias\_W](https://discuss.elastic.co/u/Matthias_W)\ **Replies:** 0\ **Last updated:** [December 6, 2021, 9:13am UTC](https://discuss.elastic.co/t/ingesting-ecs-ndjson-via-http-endpoint/291023 "2021-12-06T09:13:02Z")
Hi, I have a C++ application with a custom logging framework. I was able to modify the framework quite easily to produce ECS-formatted JSON messages. Now, I am trying to use FileBeat to load these log messages into Ela… --- ## [Strange cluster behaviour](https://discuss.elastic.co/t/strange-cluster-behaviour/291011)
**Author:** [@Ain\_Ryushika](https://discuss.elastic.co/u/Ain_Ryushika)\ **Replies:** 5\ **Last updated:** [December 6, 2021, 8:39am UTC](https://discuss.elastic.co/t/strange-cluster-behaviour/291011 "2021-12-06T08:39:05Z")
Hello, we have experiencing strange claster behavior. If you look at the charts, the main indicators are falling. Such as query time, total operation stats, network usage. As if the load on the cluster is reduced. But… --- ## [List of users by role?](https://discuss.elastic.co/t/list-of-users-by-role/291021)
**Author:** [@Seba](https://discuss.elastic.co/u/Seba)\ **Replies:** 0\ **Last updated:** [December 6, 2021, 8:35am UTC](https://discuss.elastic.co/t/list-of-users-by-role/291021 "2021-12-06T08:35:02Z")
Hello, Is there a simple way, a command to list all users for a specific role? Kind regards, Sebastien --- ## [Filebeat with minimal security on ELK](https://discuss.elastic.co/t/filebeat-with-minimal-security-on-elk/290088)
**Author:** [@Lavandael](https://discuss.elastic.co/u/Lavandael)\ **Replies:** 5\ **Last updated:** [December 6, 2021, 7:39am UTC](https://discuss.elastic.co/t/filebeat-with-minimal-security-on-elk/290088 "2021-12-06T07:39:46Z")
Hello everyone, I am using one ELK stack into only one Centos server. I tried to follow this tutorial : security-minimal-setup So i added this xpack.security.enabled: true discovery.type: single-node into the Elast… --- ## [States condition to be allowed to write into index](https://discuss.elastic.co/t/states-condition-to-be-allowed-to-write-into-index/290891)
**Author:** [@sebastienf](https://discuss.elastic.co/u/sebastienf)\ **Replies:** 2\ **Last updated:** [December 6, 2021, 7:25am UTC](https://discuss.elastic.co/t/states-condition-to-be-allowed-to-write-into-index/290891 "2021-12-06T07:25:59Z")
Hi, I want to bulk-insert into an index. This index is made of 3 shards (0, 1, 2) and 1 replica distributed over 2 nodes as follow : N1: shard 0 p shard 1 r shard 2 p N2 : shard 0 r shard 1 p shard 2 r I loose… --- ## [Error in threshold rules when using ECS](https://discuss.elastic.co/t/error-in-threshold-rules-when-using-ecs/290899)
**Author:** [@nameless](https://discuss.elastic.co/u/nameless)\ **Replies:** 2\ **Last updated:** [December 6, 2021, 7:12am UTC](https://discuss.elastic.co/t/error-in-threshold-rules-when-using-ecs/290899 "2021-12-06T07:12:33Z")
Hello The following error occurs when the rule is running. Please help me understand the reason Bulk Indexing of signals failed: Could not dynamically add mapping for field \[source.ip.keyword\]. Existing mapping for \[s… --- ## [Configuring multiple metricbeats host instances with one elasticsearch and Kibana system dashboard](https://discuss.elastic.co/t/configuring-multiple-metricbeats-host-instances-with-one-elasticsearch-and-kibana-system-dashboard/290846)
**Author:** [@Brendon\_Fernandes](https://discuss.elastic.co/u/Brendon_Fernandes)\ **Replies:** 2\ **Last updated:** [December 6, 2021, 4:33am UTC](https://discuss.elastic.co/t/configuring-multiple-metricbeats-host-instances-with-one-elasticsearch-and-kibana-system-dashboard/290846 "2021-12-06T04:33:12Z")
Hi, I'm trying to configure system metrics from multiple (3) systems via metricbeats + Elasticsearch \_Kibana (ver 7.15.1 ). However, the index in which it gets into is the default index metricbeat-\* My requirement is to… --- ## [Unable start elasticsearch](https://discuss.elastic.co/t/unable-start-elasticsearch/290940)
**Author:** [@karthick\_kn](https://discuss.elastic.co/u/karthick_kn)\ **Replies:** 4\ **Last updated:** [December 6, 2021, 5:57am UTC](https://discuss.elastic.co/t/unable-start-elasticsearch/290940 "2021-12-06T05:57:09Z")
here I attached my log sudo tail -f /var/log/elasticsearch/my-application.log \[2021-12-03T17:10:26,220\]\[INFO \]\[o.e.x.w.WatcherService \] \[node-1\] stopping watch service, reason \[shutdown initiated\] \[2021-12-03T17:10:2… --- ## [Adding disk mounts to metricbeat system module](https://discuss.elastic.co/t/adding-disk-mounts-to-metricbeat-system-module/290849)
**Author:** [@kshepitzki1](https://discuss.elastic.co/u/kshepitzki1)\ **Replies:** 2\ **Last updated:** [December 6, 2021, 5:52am UTC](https://discuss.elastic.co/t/adding-disk-mounts-to-metricbeat-system-module/290849 "2021-12-06T05:52:49Z")
Trying to configure the metricbeat system module to monitor additional mounted drives for free disk space % on Linux. This document does not help: https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-metr… --- ## [Logstash upgrade crashing (6.4.2--\> 6.8.20)](https://discuss.elastic.co/t/logstash-upgrade-crashing-6-4-2-6-8-20/290360)
**Author:** [@arunpatchaivy](https://discuss.elastic.co/u/arunpatchaivy)\ **Replies:** 1\ **Last updated:** [December 6, 2021, 5:30am UTC](https://discuss.elastic.co/t/logstash-upgrade-crashing-6-4-2-6-8-20/290360 "2021-12-06T05:30:48Z")
we are trying to upgrade logstash to new version we doing 2 step upgrade 6.4.2 --\> 6.8.2 --\> 7.15.2 we have downloaded rpm based installer and performed upgrade. Currently we are stuck at logstash version 6.8.2 . we are… --- ## [Sum of each element of array](https://discuss.elastic.co/t/sum-of-each-element-of-array/291009)
**Author:** [@Dimple\_Goyal](https://discuss.elastic.co/u/Dimple_Goyal)\ **Replies:** 2\ **Last updated:** [December 6, 2021, 5:13am UTC](https://discuss.elastic.co/t/sum-of-each-element-of-array/291009 "2021-12-06T05:13:52Z")
I'm trying to use an Elasticsearch aggregation to 'merge' an array of integers based on a set of filters. I have documents that look like: { "arr": \[5, 4, 3, 2, 1\], "name": "test" } { "arr": \[4, 3, 2, 1, 0\], "na… --- ## [Spike Search is too often in elastic](https://discuss.elastic.co/t/spike-search-is-too-often-in-elastic/291007)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 8\ **Last updated:** [December 6, 2021, 5:06am UTC](https://discuss.elastic.co/t/spike-search-is-too-often-in-elastic/291007 "2021-12-06T05:06:31Z")
Hello Everobody, I just want to know, if Elasticsearch there is often a spike like this. What caused of it? can anyone explain to me? FYI: i'm newbie in elastic --- ## [Indexing of empty arrays affecting search results](https://discuss.elastic.co/t/indexing-of-empty-arrays-affecting-search-results/291006)
**Author:** [@michael-jaxsta](https://discuss.elastic.co/u/michael-jaxsta)\ **Replies:** 0\ **Last updated:** [December 6, 2021, 4:20am UTC](https://discuss.elastic.co/t/indexing-of-empty-arrays-affecting-search-results/291006 "2021-12-06T04:20:46Z")
Hi all, We are using Elasticsearch for searching content on our website which is primarily musician names. The primary search field is "name" but we also have a number of secondary index fields included in the search s… --- ## [How to create birds eye visualization in kibana?](https://discuss.elastic.co/t/how-to-create-birds-eye-visualization-in-kibana/290628)
**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\ **Replies:** 6\ **Last updated:** [December 6, 2021, 3:51am UTC](https://discuss.elastic.co/t/how-to-create-birds-eye-visualization-in-kibana/290628 "2021-12-06T03:51:35Z")
Hi Team, I want to create a similar visualization in kibana dashboard which kind of visualization should I use? I am trying to create a visualization where users could see pod distribution across the nodes. I want s… --- ## [Elastic Cloud Fills up to infinity](https://discuss.elastic.co/t/elastic-cloud-fills-up-to-infinity/290999)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 2\ **Last updated:** [December 6, 2021, 3:34am UTC](https://discuss.elastic.co/t/elastic-cloud-fills-up-to-infinity/290999 "2021-12-06T03:34:27Z")
Hello, I created an instance in Elastic Cloud, and I used Fleet to install Metricbeat, Endpoint Security, etc. My instance started 1GB of RAM, and was costing me $40 a month or so. Now, it is costing me about $300 a mon… --- ## [Change certificate for up and running cluster](https://discuss.elastic.co/t/change-certificate-for-up-and-running-cluster/290976)
**Author:** [@hinoryo](https://discuss.elastic.co/u/hinoryo)\ **Replies:** 1\ **Last updated:** [December 6, 2021, 3:18am UTC](https://discuss.elastic.co/t/change-certificate-for-up-and-running-cluster/290976 "2021-12-06T03:18:15Z")
hello, i want to change/update the whole cluster nodes certificates (because I've lost the ca.key so i can't generate a new certificate for the new node), for that i generated new certs for the cluster nodes using : /b… --- ## [Elasticsearch reindex search\_context\_missing\_exception](https://discuss.elastic.co/t/elasticsearch-reindex-search-context-missing-exception/290890)
**Author:** [@sathish-ykone](https://discuss.elastic.co/u/sathish-ykone)\ **Replies:** 1\ **Last updated:** [December 6, 2021, 2:08am UTC](https://discuss.elastic.co/t/elasticsearch-reindex-search-context-missing-exception/290890 "2021-12-06T02:08:15Z")
We have 30 million entries in our current index, and we're getting a search context missing exception problem during reindexing. Can somebody assist me with this? error "type": "search\_phase\_execution\_exception", "reas… --- ## [Illegal\_argument\_exception](https://discuss.elastic.co/t/illegal-argument-exception/290743)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 1\ **Last updated:** [December 6, 2021, 2:05am UTC](https://discuss.elastic.co/t/illegal-argument-exception/290743 "2021-12-06T02:05:39Z")
Hi, I have problem with elastic error illegal\_argument\_exception because I changed field from text to number. However only new indexes have number field, old still have text field - I guess. "type": "illegal\_argument\_ex… --- ## [Mapping definition has unsupported parameters: \[norms : false\]](https://discuss.elastic.co/t/mapping-definition-has-unsupported-parameters-norms-false/290911)
**Author:** [@NLSVTN](https://discuss.elastic.co/u/NLSVTN)\ **Replies:** 1\ **Last updated:** [December 6, 2021, 1:50am UTC](https://discuss.elastic.co/t/mapping-definition-has-unsupported-parameters-norms-false/290911 "2021-12-06T01:50:58Z")
I am trying to disable norms in Elasticsearch 6.8 but getting the error: elasticsearch.exceptions.RequestError: TransportError(400, 'mapper\_parsing\_exception', 'Mapping definition for \[AC\] has unsupported parameters: … --- ## [Unable to remove Root Node](https://discuss.elastic.co/t/unable-to-remove-root-node/290978)
**Author:** [@salim-buet03](https://discuss.elastic.co/u/salim-buet03)\ **Replies:** 3\ **Last updated:** [December 6, 2021, 1:49am UTC](https://discuss.elastic.co/t/unable-to-remove-root-node/290978 "2021-12-06T01:49:14Z")
I have 2 nodes cluster, both are mastered enabled. node-1 cluster.name: test node.name: "node-1" node.master: true node.data: true path.data: /var/lib/elasticsearch path.logs: /var/log/elasticsearch http.port: 8200 net… --- ## [Need help to create setup.template.name and setup.template.pattern:](https://discuss.elastic.co/t/need-help-to-create-setup-template-name-and-setup-template-pattern/290975)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 1\ **Last updated:** [December 6, 2021, 1:40am UTC](https://discuss.elastic.co/t/need-help-to-create-setup-template-name-and-setup-template-pattern/290975 "2021-12-06T01:40:39Z")
Hello team, I Need help to create setup.template.name and setup.template.pattern I have setup filebeat and rename index name. Can you please help me to setup these two parameter --- ## [Need to apply ILM policy on existing index](https://discuss.elastic.co/t/need-to-apply-ilm-policy-on-existing-index/290984)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 1\ **Last updated:** [December 5, 2021, 11:49pm UTC](https://discuss.elastic.co/t/need-to-apply-ilm-policy-on-existing-index/290984 "2021-12-05T23:49:44Z")
Hello team, I have created one index kafka-facebook and missed to apply ILM policies. Now all data is going into S3 bucket like: partials:kafka-facebook-2021-12-04-000035 The above index has almost 500 GB of data. ca… --- ## [Unit elasticsearch.service has failed to start on centos 7](https://discuss.elastic.co/t/unit-elasticsearch-service-has-failed-to-start-on-centos-7/290224)
**Author:** [@dan\_bau](https://discuss.elastic.co/u/dan_bau)\ **Replies:** 10\ **Last updated:** [December 5, 2021, 11:49pm UTC](https://discuss.elastic.co/t/unit-elasticsearch-service-has-failed-to-start-on-centos-7/290224 "2021-12-05T23:49:10Z")
Can you please help? rpm -qa|grep elasticsearch elasticsearch-7.15.2-1.x86\_64 Nov 25 23:20:01 vps.ovh.net crond\[2260\]: WARNING: RunAsUser for MSP ignored, check group ids (egid=48, want=51) Nov 25 23:20:01 vps.ovh.net … --- ## [Need to apply ILM policy on existing index](https://discuss.elastic.co/t/need-to-apply-ilm-policy-on-existing-index/290987)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 1\ **Last updated:** [December 5, 2021, 11:42pm UTC](https://discuss.elastic.co/t/need-to-apply-ilm-policy-on-existing-index/290987 "2021-12-05T23:42:46Z")
Hello team, I have created one index kafka-facebook and missed to apply ILM policies. Now all data is going into S3 bucket like: partials:kafka-facebook-2021-12-04-000035 The above index has almost 500 GB of data. can… --- ## [ES 7.14: can not get API key to work](https://discuss.elastic.co/t/es-7-14-can-not-get-api-key-to-work/290969)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 1\ **Last updated:** [December 5, 2021, 6:26pm UTC](https://discuss.elastic.co/t/es-7-14-can-not-get-api-key-to-work/290969 "2021-12-05T18:26:57Z")
I am trying to use an API key to authenticate using the API: first the code then the stack trace... $logger.info "Try connecting to ES #{params}" if $logger begin @client = Elasticsearch::Client.ne… --- ## [Logstash cannot Index Log Files into Elasticsearch](https://discuss.elastic.co/t/logstash-cannot-index-log-files-into-elasticsearch/290408)
**Author:** [@Amol](https://discuss.elastic.co/u/Amol)\ **Replies:** 3\ **Last updated:** [December 5, 2021, 12:20pm UTC](https://discuss.elastic.co/t/logstash-cannot-index-log-files-into-elasticsearch/290408 "2021-12-05T12:20:06Z")
Could anyone please help, as i have a logstash config file which need to pick log file when it is updated with new logs. once logstash is started it is working fine, but next day the log file is updated but the data is n… --- ## [ElasticSearch Accessing Nested Documents in a Query Script - Null Pointer Exception](https://discuss.elastic.co/t/elasticsearch-accessing-nested-documents-in-a-query-script-null-pointer-exception/290980)
**Author:** [@abhirathmahipal](https://discuss.elastic.co/u/abhirathmahipal)\ **Replies:** 0\ **Last updated:** [December 5, 2021, 10:43am UTC](https://discuss.elastic.co/t/elasticsearch-accessing-nested-documents-in-a-query-script-null-pointer-exception/290980 "2021-12-05T10:43:50Z")
Gist: Trying to write a custom filter on nested documents using painless. Want to write error checks when there are no nested documents to surpass null\_pointer\_exception I have a mapping as such (simplified) { "video… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1137) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1139)