# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1142 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1143 --- ## [Scaling Out a Cloud Deployment](https://discuss.elastic.co/t/scaling-out-a-cloud-deployment/290650)
**Author:** [@nsouth](https://discuss.elastic.co/u/nsouth)\ **Replies:** 4\ **Last updated:** [December 2, 2021, 6:48pm UTC](https://discuss.elastic.co/t/scaling-out-a-cloud-deployment/290650 "2021-12-02T18:48:31Z")
We have an Elastic Cloud deployment and I'd like to scale out the hot data tier. However, it's not clear to me how to scale out vs. scaling up. Questions: Does changing "Size per zone" result in scaling out or only in … --- ## [Specific Graph](https://discuss.elastic.co/t/specific-graph/288909)
**Author:** [@Alexandre\_Solane](https://discuss.elastic.co/u/Alexandre_Solane)\ **Replies:** 1\ **Last updated:** [December 2, 2021, 6:37pm UTC](https://discuss.elastic.co/t/specific-graph/288909 "2021-12-02T18:37:31Z")
Hello everyone, I have a specific question. In my Elastic Index, i've got record which contain many timestamp and one value input\_y (for each record). I want to create graph group by record that mark point input\_y for e… --- ## [Multiple SQL statements in query](https://discuss.elastic.co/t/multiple-sql-statements-in-query/288494)
**Author:** [@antongb](https://discuss.elastic.co/u/antongb)\ **Replies:** 1\ **Last updated:** [December 2, 2021, 6:19pm UTC](https://discuss.elastic.co/t/multiple-sql-statements-in-query/288494 "2021-12-02T18:19:32Z")
Hi, I would like to design a query which finds the subset of field values based on the same values in a different document. Here is the document structure for context: TABLE = FRUIT\_QUESTIONS {"ID": 1, "question": "Do… --- ## [How to export/import an ES snapshot to/from an external harddrive](https://discuss.elastic.co/t/how-to-export-import-an-es-snapshot-to-from-an-external-harddrive/290796)
**Author:** [@dancing\_ghosts](https://discuss.elastic.co/u/dancing_ghosts)\ **Replies:** 4\ **Last updated:** [December 2, 2021, 6:11pm UTC](https://discuss.elastic.co/t/how-to-export-import-an-es-snapshot-to-from-an-external-harddrive/290796 "2021-12-02T18:11:09Z")
We have our customers Filebeat/Winlogbeat data stored on our Elasticsearch instance. The customer has an Elasticsearch instance at their physical location which is the same version as ours. They wish to import this data … --- ## [Filebeat update and resending of logs](https://discuss.elastic.co/t/filebeat-update-and-resending-of-logs/290803)
**Author:** [@CyberSeppi](https://discuss.elastic.co/u/CyberSeppi)\ **Replies:** 0\ **Last updated:** [December 2, 2021, 5:46pm UTC](https://discuss.elastic.co/t/filebeat-update-and-resending-of-logs/290803 "2021-12-02T17:46:53Z")
Hi all, just wanted to ask, if you think that scenario feasable. and more interesting would be, how :slight\_smile: I have an ansible project which installs/update filebeat on target machine. Due to the non-generic setu… --- ## [Error saying request body or source is required](https://discuss.elastic.co/t/error-saying-request-body-or-source-is-required/147523)
**Author:** [@chitresh\_jain](https://discuss.elastic.co/u/chitresh_jain)\ **Replies:** 3\ **Last updated:** [December 2, 2021, 5:27pm UTC](https://discuss.elastic.co/t/error-saying-request-body-or-source-is-required/147523 "2021-12-02T17:27:20Z")
So I am testing my analyzer after I created it successfully using - { "settings" : { "analysis": { "filter": { "autocomplete\_filter" : { "type" : "edge\_ngram", "min\_gram" : 1, "max\_gram" : 20 } }, "analyzer":… --- ## [Help with Winlogbeat and filtering computer accounts](https://discuss.elastic.co/t/help-with-winlogbeat-and-filtering-computer-accounts/290792)
**Author:** [@joachim\_johannesen](https://discuss.elastic.co/u/joachim_johannesen)\ **Replies:** 0\ **Last updated:** [December 2, 2021, 3:57pm UTC](https://discuss.elastic.co/t/help-with-winlogbeat-and-filtering-computer-accounts/290792 "2021-12-02T15:57:48Z")
I have a few ELK stacks up and running but I'm getting a lot of false 'Admin User Sessions' which are the computer accounts eg computer$. I'm using Windows Event forwarding to send all security related events over to my … --- ## [Given Apache logs in ES, how do I get Visitor Stay Length for each URL](https://discuss.elastic.co/t/given-apache-logs-in-es-how-do-i-get-visitor-stay-length-for-each-url/290762)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 3\ **Last updated:** [December 2, 2021, 3:57pm UTC](https://discuss.elastic.co/t/given-apache-logs-in-es-how-do-i-get-visitor-stay-length-for-each-url/290762 "2021-12-02T15:57:45Z")
Given Apache logs in ES, how do I get Visitor Stay Length for each URL Apache logs: 222.105.82.235 - - \[16/Nov/2021:10:04:37 +0530\] "GET /admin/ HTTP/1.1" 301 529 "http://facebook.com/admin/" "Mozilla/5.0 (Windows NT 1… --- ## [Elasticsearch-curator 5.8.2 is failing during TypeError: load() missing 1 required positional argument: 'Loader'](https://discuss.elastic.co/t/elasticsearch-curator-5-8-2-is-failing-during-typeerror-load-missing-1-required-positional-argument-loader/290608)
**Author:** [@hudar01](https://discuss.elastic.co/u/hudar01)\ **Replies:** 2\ **Last updated:** [December 2, 2021, 3:53pm UTC](https://discuss.elastic.co/t/elasticsearch-curator-5-8-2-is-failing-during-typeerror-load-missing-1-required-positional-argument-loader/290608 "2021-12-02T15:53:49Z")
Hello, I'm trying to execute a dry run for delete snapshot when I got this error: TypeError: load() missing 1 required positional argument: 'Loader' Note that it worked before (like 5 days ago). It started failing afte… --- ## [Reuse Dashboards accross different indexes in Kibana](https://discuss.elastic.co/t/reuse-dashboards-accross-different-indexes-in-kibana/289513)
**Author:** [@f4d0](https://discuss.elastic.co/u/f4d0)\ **Replies:** 4\ **Last updated:** [December 2, 2021, 2:33pm UTC](https://discuss.elastic.co/t/reuse-dashboards-accross-different-indexes-in-kibana/289513 "2021-12-02T14:33:21Z")
Hi Everyone, I work in Cybersecurity and every week I have different sets of data to ingest that require separated indexes. The data sets are ingested using the exactly same mappings, and everytime I have to draw new d… --- ## [Manage Auditbeat with Elastic-Agent](https://discuss.elastic.co/t/manage-auditbeat-with-elastic-agent/290770)
**Author:** [@marti1](https://discuss.elastic.co/u/marti1)\ **Replies:** 0\ **Last updated:** [December 2, 2021, 1:25pm UTC](https://discuss.elastic.co/t/manage-auditbeat-with-elastic-agent/290770 "2021-12-02T13:25:13Z")
Hi, I have deployed ElasticAgent to my hosts, and now, I would like to use Auditbeat. Is it possible to deploy and manage Auditbeat with ElasticAgent? I have searched for Auditbeat integration and doesn't exist. Than… --- ## [Deployment of a Fleet-Server](https://discuss.elastic.co/t/deployment-of-a-fleet-server/290750)
**Author:** [@Alphonse\_Kambo](https://discuss.elastic.co/u/Alphonse_Kambo)\ **Replies:** 1\ **Last updated:** [December 2, 2021, 2:24pm UTC](https://discuss.elastic.co/t/deployment-of-a-fleet-server/290750 "2021-12-02T14:24:43Z")
Hello All, We installed months ago Filebeat, Auditbeat, Metricbeat, Heartbeat and Packetbeat on our stand-alone Elastic-Server. Now we have deployed a Fleet-server to have some experience with it. Something is not cle… --- ## [\[Grafana\]\[Elastic Search\] :: Plot IPs hitting website with their Distinct Count](https://discuss.elastic.co/t/grafana-elastic-search-plot-ips-hitting-website-with-their-distinct-count/290675)
**Author:** [@thejusjose-mindcurv](https://discuss.elastic.co/u/thejusjose-mindcurv)\ **Replies:** 1\ **Last updated:** [December 2, 2021, 2:07pm UTC](https://discuss.elastic.co/t/grafana-elastic-search-plot-ips-hitting-website-with-their-distinct-count/290675 "2021-12-02T14:07:35Z")
Hi all, Requirement Get the Top hitting IPs and their count and visualize in Grafana We had this implemented already in Kibana visualization where we have metrics and buckets to filter out the required fields. We a… --- ## [Fleet server, connection limits and duplicate agents](https://discuss.elastic.co/t/fleet-server-connection-limits-and-duplicate-agents/290771)
**Author:** [@blinder](https://discuss.elastic.co/u/blinder)\ **Replies:** 0\ **Last updated:** [December 2, 2021, 1:47pm UTC](https://discuss.elastic.co/t/fleet-server-connection-limits-and-duplicate-agents/290771 "2021-12-02T13:47:02Z")
Hi We recently enrolled about 300 fleet clients to our On-Prem ECE cluster, enrollment seems to be working fine but duplicates( marked as offline) are spawning en mass. Data are being ingested from machines with double … --- ## [Getting issue during running a api command](https://discuss.elastic.co/t/getting-issue-during-running-a-api-command/290142)
**Author:** [@Linuxuser](https://discuss.elastic.co/u/Linuxuser)\ **Replies:** 10\ **Last updated:** [December 2, 2021, 1:44pm UTC](https://discuss.elastic.co/t/getting-issue-during-running-a-api-command/290142 "2021-12-02T13:44:10Z")
http://192.168.1.211:9000/api/sources?range=36000&size=5000 By running this command getting issue. "ElasticsearchException{message=Unable to perform search query\\n\\n\[parent\] Data too large, data for \[\… --- ## [Query regarding azure monitor\_service.go based logging in metricbeat](https://discuss.elastic.co/t/query-regarding-azure-monitor-service-go-based-logging-in-metricbeat/289804)
**Author:** [@adhiraj-g](https://discuss.elastic.co/u/adhiraj-g)\ **Replies:** 2\ **Last updated:** [December 2, 2021, 1:33pm UTC](https://discuss.elastic.co/t/query-regarding-azure-monitor-service-go-based-logging-in-metricbeat/289804 "2021-12-02T13:33:43Z")
Hi @Kaiyan\_Sheng / @MarianaD , Hope you both are doing well. While checking metricbeat logs, i observed the following line: 2021-11-22T06:27:25.307-0500 WARN \[azure monitor service\] azure/monitor\_service.go:130 … --- ## [Using logstash for transferring data to Azure Eventhub](https://discuss.elastic.co/t/using-logstash-for-transferring-data-to-azure-eventhub/290769)
**Author:** [@aeoker](https://discuss.elastic.co/u/aeoker)\ **Replies:** 0\ **Last updated:** [December 2, 2021, 1:08pm UTC](https://discuss.elastic.co/t/using-logstash-for-transferring-data-to-azure-eventhub/290769 "2021-12-02T13:08:13Z")
Hello Everyone, I need to use logstash for sending data to Azure Event Hub.As much as I found, there is only an input plugin for reading data from Azure Hub. Is there a logstash output plugin for sending data to Az… --- ## [Filebeat setup creates more than one write index - ILM](https://discuss.elastic.co/t/filebeat-setup-creates-more-than-one-write-index-ilm/290679)
**Author:** [@JGreene](https://discuss.elastic.co/u/JGreene)\ **Replies:** 3\ **Last updated:** [December 2, 2021, 1:06pm UTC](https://discuss.elastic.co/t/filebeat-setup-creates-more-than-one-write-index-ilm/290679 "2021-12-02T13:06:04Z")
Filebeat should not attempt to create / recreate write index if a write index exists. As indices age out with ILM policies and are deleted, subsequent runs of filebeat setup attempt to create the default index of -000001 … --- ## [Color palette Tag Cloud in canvas](https://discuss.elastic.co/t/color-palette-tag-cloud-in-canvas/290765)
**Author:** [@MTV](https://discuss.elastic.co/u/MTV)\ **Replies:** 0\ **Last updated:** [December 2, 2021, 12:23pm UTC](https://discuss.elastic.co/t/color-palette-tag-cloud-in-canvas/290765 "2021-12-02T12:23:08Z")
Hi, I have a word cloud built in kibana that I want to bring to canvas, which so far is working properly. My questions are reagrding the color of the cloud, and the filters used in canvas. Let's say I have a dropdown w… --- ## [Scripted field error al crear](https://discuss.elastic.co/t/scripted-field-error-al-crear/290667)
**Author:** [@Javier\_Garcia\_Alvare](https://discuss.elastic.co/u/Javier_Garcia_Alvare)\ **Replies:** 5\ **Last updated:** [December 2, 2021, 11:14am UTC](https://discuss.elastic.co/t/scripted-field-error-al-crear/290667 "2021-12-02T11:14:31Z")
Buenos días, soy nuevo en el manejo y estoy intentado crear un scripted field y me da error. Alguien me puede ayudar, Gracias. Nombre scripted\_field: PRUEBA if(doc\['CAMPO'\].value.toString().substring(0,5)==("valor")){… --- ## [Question about latency and response time](https://discuss.elastic.co/t/question-about-latency-and-response-time/290753)
**Author:** [@Ain\_Ryushika](https://discuss.elastic.co/u/Ain_Ryushika)\ **Replies:** 0\ **Last updated:** [December 2, 2021, 10:56am UTC](https://discuss.elastic.co/t/question-about-latency-and-response-time/290753 "2021-12-02T10:56:53Z")
Hi, I have 2 question regarding latency and response time in Elasticsearch. Why on different monitoring clients there are different response time? For example in Kibana average request time is 700ms: In Graphana a… --- ## [Forwarding logs from 4.7 to external logstash via filebeat](https://discuss.elastic.co/t/forwarding-logs-from-4-7-to-external-logstash-via-filebeat/290751)
**Author:** [@sabarivijay88](https://discuss.elastic.co/u/sabarivijay88)\ **Replies:** 0\ **Last updated:** [December 2, 2021, 10:36am UTC](https://discuss.elastic.co/t/forwarding-logs-from-4-7-to-external-logstash-via-filebeat/290751 "2021-12-02T10:36:17Z")
Hi Team, We have deployed filebeat v7.15 daemon sets on Openshift v4.7 We are able to connect external logstash by using default path: /var/log/containers/\*.log We need to setup only one particular Openshift project a… --- ## [Activemq module configuration](https://discuss.elastic.co/t/activemq-module-configuration/290540)
**Author:** [@kpanguila](https://discuss.elastic.co/u/kpanguila)\ **Replies:** 6\ **Last updated:** [December 2, 2021, 10:16am UTC](https://discuss.elastic.co/t/activemq-module-configuration/290540 "2021-12-02T10:16:58Z")
Hello, i hope you are doing great, i am facing an issues on configure my activemq module. i am getting the following error on discover: failed to unmarshal jolokia JSON response '{"error\_type":"java.lang.Exception","er… --- ## [Monitoring ELK Cluster on OpenShift](https://discuss.elastic.co/t/monitoring-elk-cluster-on-openshift/288930)
**Author:** [@gbschenkel](https://discuss.elastic.co/u/gbschenkel)\ **Replies:** 2\ **Last updated:** [December 2, 2021, 9:32am UTC](https://discuss.elastic.co/t/monitoring-elk-cluster-on-openshift/288930 "2021-12-02T09:32:55Z")
Hi, I have successful deployed Elasticsearch and Kibana on OpenShift, I am currently using internal metrics to get info from Elasticsearch and Kibana nodes. Since Elasticsearch will drop the internal metric and 8.0.0 is … --- ## [Metricbeat Prometheus Autodiscovery](https://discuss.elastic.co/t/metricbeat-prometheus-autodiscovery/290465)
**Author:** [@Lance\_Z](https://discuss.elastic.co/u/Lance_Z)\ **Replies:** 2\ **Last updated:** [December 2, 2021, 9:16am UTC](https://discuss.elastic.co/t/metricbeat-prometheus-autodiscovery/290465 "2021-12-02T09:16:40Z")
Trying to get metricbeat to scrape prometheus metrics from a service running in EKS. I have followed examples and docs to no avail. And probably many others... I am using the official Helm charts to deploy metricbea… --- ## [Exiting: Index management requested but the Elasticsearch output is not configured/enabled](https://discuss.elastic.co/t/exiting-index-management-requested-but-the-elasticsearch-output-is-not-configured-enabled/290684)
**Author:** [@adouren](https://discuss.elastic.co/u/adouren)\ **Replies:** 2\ **Last updated:** [December 2, 2021, 8:41am UTC](https://discuss.elastic.co/t/exiting-index-management-requested-but-the-elasticsearch-output-is-not-configured-enabled/290684 "2021-12-02T08:41:50Z")
Hi, I configured filebeat.yml with logstash output but I got this error: Exiting: Index management requested but the Elasticsearch output is not configured/enabled filebeat.yml filebeat.config: modules: path: ${… --- ## [Elasticsearch fuzziness with multi\_match and bool\_prefix type](https://discuss.elastic.co/t/elasticsearch-fuzziness-with-multi-match-and-bool-prefix-type/290735)
**Author:** [@konman1989](https://discuss.elastic.co/u/konman1989)\ **Replies:** 0\ **Last updated:** [December 2, 2021, 7:35am UTC](https://discuss.elastic.co/t/elasticsearch-fuzziness-with-multi-match-and-bool-prefix-type/290735 "2021-12-02T07:35:39Z")
I have a set of search\_as\_you\_type\_fields I need to search against. Here is my mapping "mappings" : { "properties" : { "description" : { "type" : "search\_as\_you\_type", "doc\_values" : fa… --- ## [Filebeat takes hours to start harvesting logs after restart](https://discuss.elastic.co/t/filebeat-takes-hours-to-start-harvesting-logs-after-restart/290693)
**Author:** [@Dancho](https://discuss.elastic.co/u/Dancho)\ **Replies:** 0\ **Last updated:** [December 1, 2021, 4:17pm UTC](https://discuss.elastic.co/t/filebeat-takes-hours-to-start-harvesting-logs-after-restart/290693 "2021-12-01T16:17:17Z")
I have to use wildcards in the PATH section since my log files might be in many different locations. filebeat.inputs: - type: log paths: - /folder1/\*/\*/\*/folder2/\*\*/\*.log after filebeat service restart, it tak… --- ## [How many indices / shards for graylog](https://discuss.elastic.co/t/how-many-indices-shards-for-graylog/290734)
**Author:** [@lkeijser](https://discuss.elastic.co/u/lkeijser)\ **Replies:** 1\ **Last updated:** [December 2, 2021, 7:00am UTC](https://discuss.elastic.co/t/how-many-indices-shards-for-graylog/290734 "2021-12-02T07:00:19Z")
Hi there, I'm running Graylog which uses Elasticsearch as backend. RIght now we have about 1.5TB data (about 2 weeks of logging) and I've created 10G indices (about 120 in total, I expect, it's still a process) and 4 sh… --- ## [How to update Index patterns?](https://discuss.elastic.co/t/how-to-update-index-patterns/290636)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 4\ **Last updated:** [December 2, 2021, 2:22am UTC](https://discuss.elastic.co/t/how-to-update-index-patterns/290636 "2021-12-02T02:22:49Z")
I currently use Elastic stack 7.14. Recently, when I wanted to search for a certain field, I found that it couldn’t be searched. Kibana gave me a prompt "Unindexed fields can not be searched". I remember that index patte… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1141) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1143)