# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1200 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1201 --- ## [Strategy for automatically importing a kibana backup JSON file](https://discuss.elastic.co/t/strategy-for-automatically-importing-a-kibana-backup-json-file/286829)
**Author:** [@ramom01](https://discuss.elastic.co/u/ramom01)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 1:53pm UTC](https://discuss.elastic.co/t/strategy-for-automatically-importing-a-kibana-backup-json-file/286829 "2021-10-15T13:53:01Z")
I have an instance of elastic + kibana in version 7.13.1 with docker compose, I have some kibana backup files with some dashboards, and I was wondering if there is a strategy to automatically import these backups when I … --- ## [Winlogbeat modules and file ingestion](https://discuss.elastic.co/t/winlogbeat-modules-and-file-ingestion/286845)
**Author:** [@jane](https://discuss.elastic.co/u/jane)\ **Replies:** 0\ **Last updated:** [October 15, 2021, 1:46pm UTC](https://discuss.elastic.co/t/winlogbeat-modules-and-file-ingestion/286845 "2021-10-15T13:46:34Z")
Hey, Is it possible to apply Security, Sysmon and Powershell modules in winlogbeat.yml if I'm ingesting a file? I'm trying something like this, but it doesn't work :confused: winlogbeat.event\_logs: - name: "C:/LOGS/so… --- ## [StackOverflowError triggering cluster crash](https://discuss.elastic.co/t/stackoverflowerror-triggering-cluster-crash/285550)
**Author:** [@bhargava\_kovi](https://discuss.elastic.co/u/bhargava_kovi)\ **Replies:** 7\ **Last updated:** [October 15, 2021, 1:43pm UTC](https://discuss.elastic.co/t/stackoverflowerror-triggering-cluster-crash/285550 "2021-10-15T13:43:36Z")
The cluster was suddenly crashed mentioning the below stack trace. we are using version ES 7.10.1. I tried to look for a similar issue on StackOverflowError in Lucene but couldnt find much on it. Can anyone help to un… --- ## [Aggregation after rescore](https://discuss.elastic.co/t/aggregation-after-rescore/286833)
**Author:** [@SantaDiver](https://discuss.elastic.co/u/SantaDiver)\ **Replies:** 0\ **Last updated:** [October 15, 2021, 12:47pm UTC](https://discuss.elastic.co/t/aggregation-after-rescore/286833 "2021-10-15T12:47:50Z")
Hello! I am trying to build ecommerce search engine with facets using Elasticsearch. I am using Elasticsearch-ltr plugin, which provides me possibility to rescore documents using machine learning formula. I want to cut … --- ## [In Vega, Filter one data table by another data table's contents](https://discuss.elastic.co/t/in-vega-filter-one-data-table-by-another-data-tables-contents/286747)
**Author:** [@nsimi](https://discuss.elastic.co/u/nsimi)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 12:16pm UTC](https://discuss.elastic.co/t/in-vega-filter-one-data-table-by-another-data-tables-contents/286747 "2021-10-15T12:16:11Z")
Hello, I am trying to determine how I could filter data tables based on another tables contents. e.g. Lets assume I have two tables; Table A that has items 1,3,5, and 7 in it. and Table B that has items 1,2,3,4,5, and… --- ## [Random node frequently removed from the cluster](https://discuss.elastic.co/t/random-node-frequently-removed-from-the-cluster/286296)
**Author:** [@JohnPhilip](https://discuss.elastic.co/u/JohnPhilip)\ **Replies:** 11\ **Last updated:** [October 11, 2021, 9:58am UTC](https://discuss.elastic.co/t/random-node-frequently-removed-from-the-cluster/286296 "2021-10-11T09:58:32Z")
I found different node removed from cluster in last month, sometimes it happens 10 times a day. ES version is 7.6.2, and there are 5000+ shards, 6 data nodes with 30gb heap size, and another 3 master node in the cluster… --- ## [Elasticsearch huge CPU utilisation](https://discuss.elastic.co/t/elasticsearch-huge-cpu-utilisation/286707)
**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Replies:** 6\ **Last updated:** [October 15, 2021, 11:10am UTC](https://discuss.elastic.co/t/elasticsearch-huge-cpu-utilisation/286707 "2021-10-15T11:10:02Z")
Hello, We have ELK Stack in our Company. Last time I had stability issues with Elasticsearch - meaning Elasticsearch was running after restart and after 3 hours was hung. Right now I see java process in Elasticsearch … --- ## [Optional field for boosting results score](https://discuss.elastic.co/t/optional-field-for-boosting-results-score/286805)
**Author:** [@Sodium](https://discuss.elastic.co/u/Sodium)\ **Replies:** 2\ **Last updated:** [October 15, 2021, 11:01am UTC](https://discuss.elastic.co/t/optional-field-for-boosting-results-score/286805 "2021-10-15T11:01:18Z")
Hello, I currently have this request: 'query' =\> 'multi\_match' =\> \[ 'query' =\> $queryString, 'type' =\> 'bool\_prefix', 'fields' =\> \[ 'label^3', 'categories\_lis… --- ## [Can I update a pivot Transform's aggregation script?](https://discuss.elastic.co/t/can-i-update-a-pivot-transforms-aggregation-script/286740)
**Author:** [@nsouth](https://discuss.elastic.co/u/nsouth)\ **Replies:** 2\ **Last updated:** [October 15, 2021, 10:34am UTC](https://discuss.elastic.co/t/can-i-update-a-pivot-transforms-aggregation-script/286740 "2021-10-15T10:34:38Z")
I have a transform with a scripted metric aggregation. I need to change how some fields are being calculated and I need to drop a few fields. However, the update API doesn't appear to support updating the transform's agg… --- ## [.startsWith Implementation](https://discuss.elastic.co/t/startswith-implementation/286489)
**Author:** [@varunbsgaur](https://discuss.elastic.co/u/varunbsgaur)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 9:33am UTC](https://discuss.elastic.co/t/startswith-implementation/286489 "2021-10-15T09:33:47Z")
Need to know proper implementation of startsWith for the url for the script to run in all the 4 cases of document. Error comes for startsWith when runnned. SCRIPT:- POST \_ingest/pipeline/\_simulate { "pipeline": { … --- ## [Help needed using a column of results returned in a second query (Chained input)](https://discuss.elastic.co/t/help-needed-using-a-column-of-results-returned-in-a-second-query-chained-input/286809)
**Author:** [@SamHunt](https://discuss.elastic.co/u/SamHunt)\ **Replies:** 0\ **Last updated:** [October 15, 2021, 9:00am UTC](https://discuss.elastic.co/t/help-needed-using-a-column-of-results-returned-in-a-second-query-chained-input/286809 "2021-10-15T09:00:52Z")
Help needed using a column of results returned in a second query (Chained input). I'm aware of an example in the docs showing chained input but it does not seem to work or be suitable for adaptation. I would like the f… --- ## [onQueryPhase listener org.elasticsearch.index.SearchSlowLog fails with NullpointerException](https://discuss.elastic.co/t/onqueryphase-listener-org-elasticsearch-index-searchslowlog-fails-with-nullpointerexception/286726)
**Author:** [@Harald\_Bittermann](https://discuss.elastic.co/u/Harald_Bittermann)\ **Replies:** 3\ **Last updated:** [October 15, 2021, 8:13am UTC](https://discuss.elastic.co/t/onqueryphase-listener-org-elasticsearch-index-searchslowlog-fails-with-nullpointerexception/286726 "2021-10-15T08:13:34Z")
Within the last month we are seeing the following exceptions like the one below more and more often on one of our clusters. \[2021-10-12T12:38:45,944 UTC\]\[WARN \]\[o.e.i.s.IndexShard \] \[10.180.253.11\] \[visit-global-l… --- ## [What happens if 2 of 5 data nodes are down?](https://discuss.elastic.co/t/what-happens-if-2-of-5-data-nodes-are-down/286019)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 2\ **Last updated:** [October 15, 2021, 7:04am UTC](https://discuss.elastic.co/t/what-happens-if-2-of-5-data-nodes-are-down/286019 "2021-10-15T07:04:32Z")
Dear community, what does happen if in an Elasticsearch cluster 2 of 5 data nodes are down, data is still incoming via logstash and daily indices are used (cluster version 7.8.1)? For example the nodes are down for max … --- ## [Elsticsearch, do POST, GET Requests between custom plugins with the nodeClient](https://discuss.elastic.co/t/elsticsearch-do-post-get-requests-between-custom-plugins-with-the-nodeclient/286795)
**Author:** [@aza-zil](https://discuss.elastic.co/u/aza-zil)\ **Replies:** 0\ **Last updated:** [October 15, 2021, 6:30am UTC](https://discuss.elastic.co/t/elsticsearch-do-post-get-requests-between-custom-plugins-with-the-nodeclient/286795 "2021-10-15T06:30:05Z")
I have two plugins in ES, and I want one of them to send GET/POST requests to the other using the nodeCLient, how can I do that? --- ## [No cached mapping for this field!](https://discuss.elastic.co/t/no-cached-mapping-for-this-field/286684)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 5\ **Last updated:** [October 15, 2021, 5:39am UTC](https://discuss.elastic.co/t/no-cached-mapping-for-this-field/286684 "2021-10-15T05:39:44Z")
I tried the management -\> index pattern and hit refreshed button still I am not getting these fields. In the discover window, I am seeing these fields with warning tags but I am not getting these fields while using in… --- ## [Cluster returns 200 to queries even if entire shards are unavailable](https://discuss.elastic.co/t/cluster-returns-200-to-queries-even-if-entire-shards-are-unavailable/286432)
**Author:** [@Mon48](https://discuss.elastic.co/u/Mon48)\ **Replies:** 11\ **Last updated:** [October 15, 2021, 5:16am UTC](https://discuss.elastic.co/t/cluster-returns-200-to-queries-even-if-entire-shards-are-unavailable/286432 "2021-10-15T05:16:31Z")
I'm working with about 80 instances, and a index of 2TB and 50 shards with 1 replica However for some reason from time to time the cluster collapses (still root causing this) As you can see from the image, instances… --- ## [CountAsync can't consume descriptor like SearchAsync](https://discuss.elastic.co/t/countasync-cant-consume-descriptor-like-searchasync/286794)
**Author:** [@puksigon](https://discuss.elastic.co/u/puksigon)\ **Replies:** 0\ **Last updated:** [October 15, 2021, 5:14am UTC](https://discuss.elastic.co/t/countasync-cant-consume-descriptor-like-searchasync/286794 "2021-10-15T05:14:02Z")
I use Nest lib in my project. I try to use repository pattern with base repository class. For search method, is work fine with "SearchDescriptor", but for count method, is't work with "CountDescriptor" like search me… --- ## [Kibana docker setup](https://discuss.elastic.co/t/kibana-docker-setup/285612)
**Author:** [@alpine\_f1](https://discuss.elastic.co/u/alpine_f1)\ **Replies:** 3\ **Last updated:** [October 15, 2021, 3:56am UTC](https://discuss.elastic.co/t/kibana-docker-setup/285612 "2021-10-15T03:56:34Z")
I am running Elasticsearch cluster (2 master, 2 data and 1 voter) as docker containers behind a load balanced setup. F5 URL for that looks like https://myelastic.mycompany.com. I am also running Kibana container that con… --- ## [Kibana-visualization Data Table not allow choose a source with index pattern type](https://discuss.elastic.co/t/kibana-visualization-data-table-not-allow-choose-a-source-with-index-pattern-type/286516)
**Author:** [@Oskr](https://discuss.elastic.co/u/Oskr)\ **Replies:** 4\ **Last updated:** [October 15, 2021, 2:52am UTC](https://discuss.elastic.co/t/kibana-visualization-data-table-not-allow-choose-a-source-with-index-pattern-type/286516 "2021-10-15T02:52:28Z")
When I tried to create a new visualization type Data Table in kibana can\`t select a index pattern. I have others spaces in my kibana and in the others if I can. What is the reason for this behavior? --- ## [Elapsed time filter calculating negative time](https://discuss.elastic.co/t/elapsed-time-filter-calculating-negative-time/286786)
**Author:** [@Indigo\_Star](https://discuss.elastic.co/u/Indigo_Star)\ **Replies:** 0\ **Last updated:** [October 15, 2021, 1:58am UTC](https://discuss.elastic.co/t/elapsed-time-filter-calculating-negative-time/286786 "2021-10-15T01:58:53Z")
Hi I am loading offline logs and using elapsed plugin to calculate delay between 2 events, but the time calculating is not always correct sometimes it doesn't display the value in correct second sometimes it shows negat… --- ## [Use Kibana current user to send request to Elasticsearch plugin](https://discuss.elastic.co/t/use-kibana-current-user-to-send-request-to-elasticsearch-plugin/286732)
**Author:** [@aza-zil](https://discuss.elastic.co/u/aza-zil)\ **Replies:** 2\ **Last updated:** [October 15, 2021, 1:37am UTC](https://discuss.elastic.co/t/use-kibana-current-user-to-send-request-to-elasticsearch-plugin/286732 "2021-10-15T01:37:39Z")
I have an ES ActionPlugin that has an API, and I created a Kibana plugin, I want the Kibana plugin to send a post request to the ES plugin using context.core.Elasticsearch.legacy.client.callAsInternalUser or context.c… --- ## [Vega: Datasource external to elasticsearch](https://discuss.elastic.co/t/vega-datasource-external-to-elasticsearch/286742)
**Author:** [@Vishal\_Patil](https://discuss.elastic.co/u/Vishal_Patil)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 1:11am UTC](https://discuss.elastic.co/t/vega-datasource-external-to-elasticsearch/286742 "2021-10-15T01:11:51Z")
Is it possible to create a Vega/Vega-lite chart in Kibana with an external API endpoint that returns json data ? --- ## [Can not upgrade 7.11.1 -\> 7.15.0 (docker-compose. dev.env)](https://discuss.elastic.co/t/can-not-upgrade-7-11-1-7-15-0-docker-compose-dev-env/286676)
**Author:** [@zpsx](https://discuss.elastic.co/u/zpsx)\ **Replies:** 6\ **Last updated:** [October 15, 2021, 12:54am UTC](https://discuss.elastic.co/t/can-not-upgrade-7-11-1-7-15-0-docker-compose-dev-env/286676 "2021-10-15T00:54:44Z")
I am currently using the elastic stack in my development environment. I'm using a single elastic stack system with docker compose. The version used is 7.11.1. I found out that 7.15.0 was released recently. Change onl… --- ## [How to create ELK user in Bitnami ELK instance (AWS)](https://discuss.elastic.co/t/how-to-create-elk-user-in-bitnami-elk-instance-aws/286723)
**Author:** [@Swarup\_Mukherjee](https://discuss.elastic.co/u/Swarup_Mukherjee)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 12:29am UTC](https://discuss.elastic.co/t/how-to-create-elk-user-in-bitnami-elk-instance-aws/286723 "2021-10-15T00:29:14Z")
Hi Team, How to create ELK user in Bitnami ELK instance (AWS) like we have “USER” Please share the steps. --- ## [JVM spikes over 85% and baseline doesn't drop back down](https://discuss.elastic.co/t/jvm-spikes-over-85-and-baseline-doesnt-drop-back-down/286730)
**Author:** [@cshawler](https://discuss.elastic.co/u/cshawler)\ **Replies:** 1\ **Last updated:** [October 15, 2021, 12:27am UTC](https://discuss.elastic.co/t/jvm-spikes-over-85-and-baseline-doesnt-drop-back-down/286730 "2021-10-15T00:27:16Z")
We have watchers setup to notify when our JVM increases over 85% we have noticed that once the watcher is triggered the alerts keep firing and the jvm usage never drops back down. Is this normal behavior? We have … --- ## [Securing Elastic Stack: Logstash](https://discuss.elastic.co/t/securing-elastic-stack-logstash/286782)
**Author:** [@jceddy](https://discuss.elastic.co/u/jceddy)\ **Replies:** 2\ **Last updated:** [October 15, 2021, 12:09am UTC](https://discuss.elastic.co/t/securing-elastic-stack-logstash/286782 "2021-10-15T00:09:53Z")
I have been working on securing my elastic stack, and am now stuck on getting Logstash to communicate with Elasticsearch securely. I have a cluster with three nodes (call them elk1, elk2, and elk3), each running an Elas… --- ## [Multiple Synonym lists for the same field controlled by other field in Elastic Search](https://discuss.elastic.co/t/multiple-synonym-lists-for-the-same-field-controlled-by-other-field-in-elastic-search/286784)
**Author:** [@twisha](https://discuss.elastic.co/u/twisha)\ **Replies:** 0\ **Last updated:** [October 14, 2021, 11:48pm UTC](https://discuss.elastic.co/t/multiple-synonym-lists-for-the-same-field-controlled-by-other-field-in-elastic-search/286784 "2021-10-14T23:48:58Z")
Is there a way to define multiple synonym lists in Elasticsearch 7 based on languages and some specific field in the Elasticsearch document? The use case is, I have a field "A" with possible values "Y" and "Z". Now, depe… --- ## [Elasticsearch cluster data nodes are being removed from cluster by timeout](https://discuss.elastic.co/t/elasticsearch-cluster-data-nodes-are-being-removed-from-cluster-by-timeout/285635)
**Author:** [@Vadym](https://discuss.elastic.co/u/Vadym)\ **Replies:** 17\ **Last updated:** [October 14, 2021, 10:43pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-data-nodes-are-being-removed-from-cluster-by-timeout/285635 "2021-10-14T22:43:52Z")
Hi everyone, I have an issue while deleting rather big 800Gb Elasticsearch index. Shortly after index deletion data nodes are getting disconnected, cluster loses all data nodes and switches into "red" state for ~10 minu… --- ## [Elastic-agent install: Unknown resource](https://discuss.elastic.co/t/elastic-agent-install-unknown-resource/286758)
**Author:** [@jknight](https://discuss.elastic.co/u/jknight)\ **Replies:** 0\ **Last updated:** [October 14, 2021, 4:43pm UTC](https://discuss.elastic.co/t/elastic-agent-install-unknown-resource/286758 "2021-10-14T16:43:21Z")
I'm trying to install elastic-agent on our server and am getting message: Unknown resource. I'm using the hosted elastic offering and have APM & Fleet enabled. Steps Taken: Download Linux 64-bit tarball to server U… --- ## [What is the content of the segment file in node/0/\_state](https://discuss.elastic.co/t/what-is-the-content-of-the-segment-file-in-node-0-state/286698)
**Author:** [@verdantyang](https://discuss.elastic.co/u/verdantyang)\ **Replies:** 2\ **Last updated:** [October 14, 2021, 6:44pm UTC](https://discuss.elastic.co/t/what-is-the-content-of-the-segment-file-in-node-0-state/286698 "2021-10-14T18:44:07Z")
Hello, ES 6.\* only stores .st files in the /nodes/0/\_state directory to record node status information. But under the ES 7.12 version, I found segment-related file in /nodes/0/\_state directory, such as segment\_N and .s… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1199) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1201)