# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1169 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1170 --- ## [Intermittently failed with 401 Unauthorized](https://discuss.elastic.co/t/intermittently-failed-with-401-unauthorized/288835)
**Author:** [@John\_Luong\_Nhat\_Truo](https://discuss.elastic.co/u/John_Luong_Nhat_Truo)\ **Replies:** 5\ **Last updated:** [November 10, 2021, 7:24am UTC](https://discuss.elastic.co/t/intermittently-failed-with-401-unauthorized/288835 "2021-11-10T07:24:22Z")
Hi, I'm using basic authentication with REST API but sometime server response 401 Unauthorized as: 401 Unauthorized {"error":{"root\_cause":\[{"type":"security\_exception","reason":"unable to authenticate user \[xxxxxxxxx\]… --- ## [A way better than rollup and transform](https://discuss.elastic.co/t/a-way-better-than-rollup-and-transform/288747)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 6:50am UTC](https://discuss.elastic.co/t/a-way-better-than-rollup-and-transform/288747 "2021-11-10T06:50:29Z")
Hi there, Thanks a lot for your great and wonderful support team! At first step we use rollup jobs for create hourly and daily aggregation of our data, but rollup indices dont support ILM! unfortunately. At second st… --- ## [Heartbeat.yml file number\_of\_replicas not being applied](https://discuss.elastic.co/t/heartbeat-yml-file-number-of-replicas-not-being-applied/288691)
**Author:** [@Daniel.X](https://discuss.elastic.co/u/Daniel.X)\ **Replies:** 2\ **Last updated:** [November 10, 2021, 6:14am UTC](https://discuss.elastic.co/t/heartbeat-yml-file-number-of-replicas-not-being-applied/288691 "2021-11-10T06:14:38Z")
Heartbeat Version: 7.14.0 Hi there, I configured our heartbeat that runs as sidecar container on AWS ECS using the heartbeat.yml file configuration. I set the number\_of\_replicas to be 0 (see code snippet below). Howeve… --- ## [Kibana not found elasticsearch host](https://discuss.elastic.co/t/kibana-not-found-elasticsearch-host/288839)
**Author:** [@mehmood1](https://discuss.elastic.co/u/mehmood1)\ **Replies:** 14\ **Last updated:** [November 10, 2021, 5:15am UTC](https://discuss.elastic.co/t/kibana-not-found-elasticsearch-host/288839 "2021-11-10T05:15:02Z")
when i run kibana.bat on windows os it is showing error. Both are running in same machine. FATAL Error: \[config validation of \[server\].host\]: types that failed validation: \[config validation of \[server\].host.0\]: val… --- ## [Logstash showing Document count as 1. only last line of the syslog is displaying in kibana](https://discuss.elastic.co/t/logstash-showing-document-count-as-1-only-last-line-of-the-syslog-is-displaying-in-kibana/288787)
**Author:** [@kalyan\_M](https://discuss.elastic.co/u/kalyan_M)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 4:02pm UTC](https://discuss.elastic.co/t/logstash-showing-document-count-as-1-only-last-line-of-the-syslog-is-displaying-in-kibana/288787 "2021-11-09T16:02:12Z")
Hi, I am new to ELK configurations. I configured the ubuntu VM logs to ELK VM. I am getting logs from the ubuntu VM to log stash. but it was showing document count as only 1. please help with the issue. --- ## [Curator is running but not deleting any index in elastic search and not printing any logs](https://discuss.elastic.co/t/curator-is-running-but-not-deleting-any-index-in-elastic-search-and-not-printing-any-logs/288800)
**Author:** [@Kumar\_Reddy](https://discuss.elastic.co/u/Kumar_Reddy)\ **Replies:** 3\ **Last updated:** [November 10, 2021, 4:00am UTC](https://discuss.elastic.co/t/curator-is-running-but-not-deleting-any-index-in-elastic-search-and-not-printing-any-logs/288800 "2021-11-10T04:00:04Z")
Hi, I am using docker-compose to run Elasticsearch with curator. Elasticsearch is working fine but curator is running but not deleting any index and not printing any logs. This is my docker-compose yml file :- version… --- ## [Kibana Development 7.15 Yarn Bootstrap Fails no native build was found for platform=linux](https://discuss.elastic.co/t/kibana-development-7-15-yarn-bootstrap-fails-no-native-build-was-found-for-platform-linux/288282)
**Author:** [@Jsof](https://discuss.elastic.co/u/Jsof)\ **Replies:** 4\ **Last updated:** [November 10, 2021, 1:47am UTC](https://discuss.elastic.co/t/kibana-development-7-15-yarn-bootstrap-fails-no-native-build-was-found-for-platform-linux/288282 "2021-11-10T01:47:28Z")
Hi, i am trying to get kibana development environment for kibana 7.15 running but i keep getting the error below when running "yarn kbn boostrap". I am running the dev environment on CentOS Linux release 7.8.2003 \[vsco… --- ## [CPU at 100% with XPACK security Enabled - ES 7.9.0](https://discuss.elastic.co/t/cpu-at-100-with-xpack-security-enabled-es-7-9-0/288820)
**Author:** [@ilavajuthy](https://discuss.elastic.co/u/ilavajuthy)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 11:29pm UTC](https://discuss.elastic.co/t/cpu-at-100-with-xpack-security-enabled-es-7-9-0/288820 "2021-11-09T23:29:11Z")
Hi, We are noticing high CPU after upgrading to 7.9.0 with XPACK security. Earlier we had 6.8.7 version without XPACK auth. We are using ECK deployment. I see few posts on this issue, but none of the topic has resoluti… --- ## [Elasticsearch return empty list of objects to spark](https://discuss.elastic.co/t/elasticsearch-return-empty-list-of-objects-to-spark/288052)
**Author:** [@mohsen\_mortezapour](https://discuss.elastic.co/u/mohsen_mortezapour)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 10:58pm UTC](https://discuss.elastic.co/t/elasticsearch-return-empty-list-of-objects-to-spark/288052 "2021-11-09T22:58:29Z")
I have a problem with Elasticsearch . I want to read data from Elasticsearch index with Pyspark . my data look like as below: user\_id: 123, features: { hashtags: \[ { text: "hello", c… --- ## [SQS client ignores the fips flag for the service endpoint](https://discuss.elastic.co/t/sqs-client-ignores-the-fips-flag-for-the-service-endpoint/288687)
**Author:** [@Andrew\_Chang](https://discuss.elastic.co/u/Andrew_Chang)\ **Replies:** 3\ **Last updated:** [November 9, 2021, 10:41pm UTC](https://discuss.elastic.co/t/sqs-client-ignores-the-fips-flag-for-the-service-endpoint/288687 "2021-11-09T22:41:54Z")
At least in 7.15.1 when using the fips\_enabled flag, only s3 respects the fips configuration. SQS does not. It seems to be hard coded. beats/input.go at master · elastic/beats · GitHub --- ## [OIDC token\_type issue, Token type must be Bearer](https://discuss.elastic.co/t/oidc-token-type-issue-token-type-must-be-bearer/288655)
**Author:** [@ibrooes](https://discuss.elastic.co/u/ibrooes)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 10:31pm UTC](https://discuss.elastic.co/t/oidc-token-type-issue-token-type-must-be-bearer/288655 "2021-11-09T22:31:34Z")
Hi, I am trying to setup OIDC Authentication. Open ID Connect Provider I am using sends id\_token, access token, etc. All tokens are JWT. The issue I am facing is token\_type field sent from Open ID Connect provider. The v… --- ## [Beat for Status Interface Network](https://discuss.elastic.co/t/beat-for-status-interface-network/288826)
**Author:** [@Ing\_Carlos\_Salas](https://discuss.elastic.co/u/Ing_Carlos_Salas)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 10:08pm UTC](https://discuss.elastic.co/t/beat-for-status-interface-network/288826 "2021-11-09T22:08:06Z")
Hi community I search a beat for view the status of interfaces network for example status up or down, bandwidth, errors THROUGHPUT I need monitoring state of the network interface to run the command, ifconfig IP ADDR … --- ## [Elasticsearch Storage Distribution](https://discuss.elastic.co/t/elasticsearch-storage-distribution/288774)
**Author:** [@gutierrezfj](https://discuss.elastic.co/u/gutierrezfj)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 9:34pm UTC](https://discuss.elastic.co/t/elasticsearch-storage-distribution/288774 "2021-11-09T21:34:01Z")
Hi dear community, a doubt: for a small cluster: is it better to centralize the data of all nodes in a single storage unit or file system? Or is it better for each node on a dedicated host to store its own data? Tha… --- ## [Cross cluster replication Data streams](https://discuss.elastic.co/t/cross-cluster-replication-data-streams/288803)
**Author:** [@iasenzaniro](https://discuss.elastic.co/u/iasenzaniro)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 5:41pm UTC](https://discuss.elastic.co/t/cross-cluster-replication-data-streams/288803 "2021-11-09T17:41:12Z")
Hi, here is the environment i am working with. Local cluster : running elastic stack. My local cluster is connected to the remote cluster. Remote cluster: vm running elk stack in aws cloud. This a single node cluster w… --- ## [How to handle this error](https://discuss.elastic.co/t/how-to-handle-this-error/288726)
**Author:** [@Mahrukh\_Malik](https://discuss.elastic.co/u/Mahrukh_Malik)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 9:08pm UTC](https://discuss.elastic.co/t/how-to-handle-this-error/288726 "2021-11-09T21:08:01Z")
elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since Tue 2021-11-09 13:38:12 PKT; 11s ago … --- ## [How to loop through nested field in painless script](https://discuss.elastic.co/t/how-to-loop-through-nested-field-in-painless-script/288695)
**Author:** [@Agnivesh\_Sharma](https://discuss.elastic.co/u/Agnivesh_Sharma)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 8:44pm UTC](https://discuss.elastic.co/t/how-to-loop-through-nested-field-in-painless-script/288695 "2021-11-09T20:44:01Z")
I have following nested type mapping: "visitor\_data": { "type": "nested", "dynamic": "false", "properties": { "checkin\_time": { "type": "date", … --- ## [Parse Vsftp log (Filebeat + Logstash)](https://discuss.elastic.co/t/parse-vsftp-log-filebeat-logstash/288040)
**Author:** [@Hecha](https://discuss.elastic.co/u/Hecha)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 8:21pm UTC](https://discuss.elastic.co/t/parse-vsftp-log-filebeat-logstash/288040 "2021-11-09T20:21:12Z")
Hello guys! I am trying to parse the logs of my FTP server (Vsftpd) with logstash but I am having trouble. The logs follow the following format Fri Oct 29 17:16:17 2021 \[pid 22947\] CONNECT: Client "::ffff:10.0.1.6" Fri… --- ## [Where would my syslogs be?](https://discuss.elastic.co/t/where-would-my-syslogs-be/288819)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 8:19pm UTC](https://discuss.elastic.co/t/where-would-my-syslogs-be/288819 "2021-11-09T20:19:28Z")
Good Afternoon Elastic team. I have proof via packetbeat that my syslogs are flowing to my Logstash server. I can also netstat and confirm the ports are open and listening on the configured port. I have the following … --- ## ["Too small maximum heap"](https://discuss.elastic.co/t/too-small-maximum-heap/288816)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 7:53pm UTC](https://discuss.elastic.co/t/too-small-maximum-heap/288816 "2021-11-09T19:53:42Z")
I have installed 7.14 on a new machine running ubuntu 18.04. This machine has 48 GB of memory and is identical to another machine that I am currently running ES 7.14 on. The Elasticsearch.yml is identical and jvm.opti… --- ## [ParNew and ConcurrentMarkSweep seen in logs](https://discuss.elastic.co/t/parnew-and-concurrentmarksweep-seen-in-logs/288806)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 4\ **Last updated:** [November 9, 2021, 7:37pm UTC](https://discuss.elastic.co/t/parnew-and-concurrentmarksweep-seen-in-logs/288806 "2021-11-09T19:37:22Z")
Good Afternoon everyone; I am seeing the following lines when I place my Logstash in Debug mode to collect logs. I have a feeling that it is what is stopping me from seeing any syslog that has been forwarded to the logs… --- ## [Error install kibana last version](https://discuss.elastic.co/t/error-install-kibana-last-version/288684)
**Author:** [@samuel\_desseaux](https://discuss.elastic.co/u/samuel_desseaux)\ **Replies:** 7\ **Last updated:** [November 9, 2021, 7:29pm UTC](https://discuss.elastic.co/t/error-install-kibana-last-version/288684 "2021-11-09T19:29:57Z")
Hello I've installed elastcisearch without any problems in the last version,things are OK but when i installl kibana, it says "kibana server is not ready yet". In my configuration file, i've just filled the port,url of… --- ## [Get the first line of \[message\] field coming from winlogbeat](https://discuss.elastic.co/t/get-the-first-line-of-message-field-coming-from-winlogbeat/288768)
**Author:** [@yquirion](https://discuss.elastic.co/u/yquirion)\ **Replies:** 6\ **Last updated:** [November 9, 2021, 7:24pm UTC](https://discuss.elastic.co/t/get-the-first-line-of-message-field-coming-from-winlogbeat/288768 "2021-11-09T19:24:30Z")
Hello, I'm trying to get the first line of the message field because this is an important information to keep. The \[message\] line, when I set the output to file using rudydebug option looks like this: "message" =\> "A… --- ## [Unexpected file read error while reading index](https://discuss.elastic.co/t/unexpected-file-read-error-while-reading-index/288795)
**Author:** [@tropically](https://discuss.elastic.co/u/tropically)\ **Replies:** 2\ **Last updated:** [November 9, 2021, 7:23pm UTC](https://discuss.elastic.co/t/unexpected-file-read-error-while-reading-index/288795 "2021-11-09T19:23:58Z")
Hi We are running elastisearch on Openshift. Currently there are 3 nodes configured. We received the below error on one of the 3 nodes that we have : ElasticsearchException\[failed to load metadata\]; nested: CorruptI… --- ## [How elasticsearch index Geo-points?](https://discuss.elastic.co/t/how-elasticsearch-index-geo-points/288813)
**Author:** [@ehsan\_kabiri\_33](https://discuss.elastic.co/u/ehsan_kabiri_33)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 7:19pm UTC](https://discuss.elastic.co/t/how-elasticsearch-index-geo-points/288813 "2021-11-09T19:19:31Z")
I can't imagine how Elasteicsearch index Geo-points. Suppose I have 1 million records/documents in my table/index and each document has a geo point (Lat/Lon). In sql , if I want to find the 10 nearest docs, I need to … --- ## [\_update\_by\_query with substring](https://discuss.elastic.co/t/update-by-query-with-substring/288777)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 3\ **Last updated:** [November 9, 2021, 6:45pm UTC](https://discuss.elastic.co/t/update-by-query-with-substring/288777 "2021-11-09T18:45:12Z")
Hi I wand to update specific fields with its substring value MSISDN: "444123456" replace with MSISDN: "123456" is there a way how to write update query ? What is the best way to do such thing. thank you P POST t… --- ## [Logstashpipelines, Internal API server error, path\_info=\>"/\_node/stats"](https://discuss.elastic.co/t/logstashpipelines-internal-api-server-error-path-info-node-stats/288735)
**Author:** [@Melany](https://discuss.elastic.co/u/Melany)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 6:03pm UTC](https://discuss.elastic.co/t/logstashpipelines-internal-api-server-error-path-info-node-stats/288735 "2021-11-09T18:03:42Z")
Hello, when I start my logstashpipelines service I am getting the following error: \[2021-11-09T10:05:16,268\]\[ERROR\]\[logstash.agent \] Internal API server error {:status=\>500, :request\_method=\>"GET", :path\_info=\>"/\_node/s… --- ## [How to replace all groups of number in a string using gsub](https://discuss.elastic.co/t/how-to-replace-all-groups-of-number-in-a-string-using-gsub/288761)
**Author:** [@gustavon](https://discuss.elastic.co/u/gustavon)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 5:49pm UTC](https://discuss.elastic.co/t/how-to-replace-all-groups-of-number-in-a-string-using-gsub/288761 "2021-11-09T17:49:00Z")
Hi, I have an uri on nginx log like this: /xyz/attachment/thumbnail/61355754/90/90 and others, so I need to use gsub to replace all number to something else, /xyz/attachment/thumbnail/{}/{}/{} for example, I tried to us… --- ## [Grok Named capture group as metadata](https://discuss.elastic.co/t/grok-named-capture-group-as-metadata/288731)
**Author:** [@sirReeall](https://discuss.elastic.co/u/sirReeall)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 5:47pm UTC](https://discuss.elastic.co/t/grok-named-capture-group-as-metadata/288731 "2021-11-09T17:47:57Z")
Hello, I was wondering if it is possible to set a named capture group as metadata rather then a field sent to Elastic? I'm parsing some data that has these permutations for the same field: 1m 125s 345ms 125s 345ms 345… --- ## [Generate Series of Days with ElasticSearch](https://discuss.elastic.co/t/generate-series-of-days-with-elasticsearch/288804)
**Author:** [@TomTom](https://discuss.elastic.co/u/TomTom)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 5:47pm UTC](https://discuss.elastic.co/t/generate-series-of-days-with-elasticsearch/288804 "2021-11-09T17:47:40Z")
With PostgreSQL I can use the generate\_series feature to generate a list of days between two dates, and with a little effort, even generate a list of sales made by day within that range, even if there are no sales for th… --- ## [Elasticsearch Mapping field for Multiple languages Search](https://discuss.elastic.co/t/elasticsearch-mapping-field-for-multiple-languages-search/288762)
**Author:** [@faizan.gulzar](https://discuss.elastic.co/u/faizan.gulzar)\ **Replies:** 1\ **Last updated:** [November 9, 2021, 5:09pm UTC](https://discuss.elastic.co/t/elasticsearch-mapping-field-for-multiple-languages-search/288762 "2021-11-09T17:09:00Z")
We are using Elasticsearch (Version 2.3.1) to Search on our website. Company Names are different in different languages like English, German, Polisch, Turkish, etc. When we search Company Name using English characters, … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1168) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1170)