# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1204 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1205 --- ## [Index size increased after reindexing](https://discuss.elastic.co/t/index-size-increased-after-reindexing/286482)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [October 13, 2021, 1:56am UTC](https://discuss.elastic.co/t/index-size-increased-after-reindexing/286482 "2021-10-13T01:56:40Z")
After the completion of reindex process,the size of new index is very big compare to original index.Although i force\_merge the index nothing happened. Original index size was 101.7gb and new index is 140gb around.We've … --- ## [Set password during deployment elasticsearch for my app](https://discuss.elastic.co/t/set-password-during-deployment-elasticsearch-for-my-app/286548)
**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Replies:** 4\ **Last updated:** [October 13, 2021, 1:53am UTC](https://discuss.elastic.co/t/set-password-during-deployment-elasticsearch-for-my-app/286548 "2021-10-13T01:53:04Z")
I am running my app as a container that need to access Elasticsearch deployed as container also, so in my app settings yaml i have to enter credentials and url for elastic that will be deployed also in docker. How can i… --- ## [Search query duration record](https://discuss.elastic.co/t/search-query-duration-record/286271)
**Author:** [@KiddoATOM](https://discuss.elastic.co/u/KiddoATOM)\ **Replies:** 1\ **Last updated:** [October 13, 2021, 1:12am UTC](https://discuss.elastic.co/t/search-query-duration-record/286271 "2021-10-13T01:12:32Z")
Hi. I have a problem in an ES cluster, where due to heavy search queries the cluster stops responding. I want to adjust the global search timeout and we wanted to know if there was a way to obtain the duration of each se… --- ## [Elasticsearch: Duplicate Documents](https://discuss.elastic.co/t/elasticsearch-duplicate-documents/286478)
**Author:** [@Isekai](https://discuss.elastic.co/u/Isekai)\ **Replies:** 1\ **Last updated:** [October 13, 2021, 1:10am UTC](https://discuss.elastic.co/t/elasticsearch-duplicate-documents/286478 "2021-10-13T01:10:38Z")
Hi everyone, I have an occasional problem that sometimes there are several duplicate documents generated. This is part of our CI and it should upload data to elastic with details about our build failure. After analysi… --- ## [How to find Mapping conflict?](https://discuss.elastic.co/t/how-to-find-mapping-conflict/286497)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 5\ **Last updated:** [October 13, 2021, 12:54am UTC](https://discuss.elastic.co/t/how-to-find-mapping-conflict/286497 "2021-10-13T00:54:17Z")
We upgraded cluster from 7.12 to 7.15 new index created metricbeat-7.15.0 but now in index pattern it says I have mapping conflict in older version there was a field type=conflict but no longer. how do I find which fi… --- ## [Is Elastic search filter in log stash work in synchronous or asynchronous mode?](https://discuss.elastic.co/t/is-elastic-search-filter-in-log-stash-work-in-synchronous-or-asynchronous-mode/286472)
**Author:** [@Sandeep\_Thakur](https://discuss.elastic.co/u/Sandeep_Thakur)\ **Replies:** 1\ **Last updated:** [October 13, 2021, 12:49am UTC](https://discuss.elastic.co/t/is-elastic-search-filter-in-log-stash-work-in-synchronous-or-asynchronous-mode/286472 "2021-10-13T00:49:57Z")
I am facing one issue in ELK when I continuous log and tried to update some fields in log stash configuration file using Elasticsearch filter plugin its updating logs sometimes but sometimes not working, so is there and … --- ## [Kibana server is not ready](https://discuss.elastic.co/t/kibana-server-is-not-ready/286186)
**Author:** [@PELK](https://discuss.elastic.co/u/PELK)\ **Replies:** 2\ **Last updated:** [October 13, 2021, 12:30am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready/286186 "2021-10-13T00:30:43Z")
Salut a tous, après l'installation de Elasticsearch et de kibana tout fonctionne nickel mais après la mise en place d'HTTPS SSL et TLS plus rien ne marche je suis sur ubuntu 21.04 voila les fichier log de kibana {"type… --- ## [Automatic @timestamp in datastream](https://discuss.elastic.co/t/automatic-timestamp-in-datastream/286381)
**Author:** [@ggab31](https://discuss.elastic.co/u/ggab31)\ **Replies:** 2\ **Last updated:** [October 13, 2021, 12:21am UTC](https://discuss.elastic.co/t/automatic-timestamp-in-datastream/286381 "2021-10-13T00:21:04Z")
Hi The documentation says that documents must contain a @timestamp field in order to be accepted by a datastream. I'm trying to make it optional by declaring a default ingest\_pipeline in a datastream template that will… --- ## [Wazuh alerts not received in Kibana](https://discuss.elastic.co/t/wazuh-alerts-not-received-in-kibana/286524)
**Author:** [@Hocine\_Zaidi](https://discuss.elastic.co/u/Hocine_Zaidi)\ **Replies:** 1\ **Last updated:** [October 13, 2021, 12:19am UTC](https://discuss.elastic.co/t/wazuh-alerts-not-received-in-kibana/286524 "2021-10-13T00:19:46Z")
Gents, i receive Wazuh monitoring and statistics but not Alertes , i suspect certificates error if someone help me --- ## [How to get data into the beats specific index via logstash](https://discuss.elastic.co/t/how-to-get-data-into-the-beats-specific-index-via-logstash/286328)
**Author:** [@gwvandesteeg](https://discuss.elastic.co/u/gwvandesteeg)\ **Replies:** 19\ **Last updated:** [October 13, 2021, 12:15am UTC](https://discuss.elastic.co/t/how-to-get-data-into-the-beats-specific-index-via-logstash/286328 "2021-10-13T00:15:58Z")
The use case here is that we have: \*beats -\> logstash -\> elasticsearch cloud The following requirements are in place: The hosts running the beats do not have direct internet access and can only communicate via logsta… --- ## [Upgrade Error: Cannot write to a field alias \[host.hostname\]](https://discuss.elastic.co/t/upgrade-error-cannot-write-to-a-field-alias-host-hostname/286543)
**Author:** [@Karthik\_ek](https://discuss.elastic.co/u/Karthik_ek)\ **Replies:** 0\ **Last updated:** [October 12, 2021, 7:50pm UTC](https://discuss.elastic.co/t/upgrade-error-cannot-write-to-a-field-alias-host-hostname/286543 "2021-10-12T19:50:44Z")
Hi, Can you please help here. I'm getting error after upgrading from filebeat 6.8.6 to filebeat 7.9.2. I see the below error in the logs folder: Cannot write to a field alias \[host.hostname\] 2021-10-12T10:34:28.800-0… --- ## [Finding number of files in latest batch using aggregations](https://discuss.elastic.co/t/finding-number-of-files-in-latest-batch-using-aggregations/286553)
**Author:** [@Tim\_Estes](https://discuss.elastic.co/u/Tim_Estes)\ **Replies:** 0\ **Last updated:** [October 12, 2021, 10:35pm UTC](https://discuss.elastic.co/t/finding-number-of-files-in-latest-batch-using-aggregations/286553 "2021-10-12T22:35:58Z")
Hello, Here is the scenario: I have an index that contains documents representing files uploaded to a file store. These documents are uploaded in batches and each doc is tagged with a batch\_id field as well as the time… --- ## [Custom TopDocsCollector in plugin?](https://discuss.elastic.co/t/custom-topdocscollector-in-plugin/286546)
**Author:** [@larry\_benchling](https://discuss.elastic.co/u/larry_benchling)\ **Replies:** 2\ **Last updated:** [October 12, 2021, 10:18pm UTC](https://discuss.elastic.co/t/custom-topdocscollector-in-plugin/286546 "2021-10-12T22:18:50Z")
Hello! I'm working on a plugin to add some cheminformatics features to our Elasticsearch cluster. Several of these involve steps where there is an inverted index based screening stage (which fits well as a Lucene query)… --- ## [Turn on Anonymous access](https://discuss.elastic.co/t/turn-on-anonymous-access/285955)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 3\ **Last updated:** [October 12, 2021, 10:11pm UTC](https://discuss.elastic.co/t/turn-on-anonymous-access/285955 "2021-10-12T22:11:38Z")
I have been trying to turn on this anonymous access gone through many thread and list on how to do it. none of them seems working I have 7.14.1 basic license and user login is enable with just some role/spaces. I cre… --- ## [Subtract two numbers in different events but same index](https://discuss.elastic.co/t/subtract-two-numbers-in-different-events-but-same-index/286519)
**Author:** [@Adixon\_Diaz](https://discuss.elastic.co/u/Adixon_Diaz)\ **Replies:** 3\ **Last updated:** [October 12, 2021, 9:36pm UTC](https://discuss.elastic.co/t/subtract-two-numbers-in-different-events-but-same-index/286519 "2021-10-12T21:36:58Z")
Hi Comunity, I would like to Subtract two numbers in different events but same index. I tried by sql workbreanch, but there aren't a functions thats works for this. Do you have any another idea? Thank, reggards. --- ## [Understand ILM (shrink index)](https://discuss.elastic.co/t/understand-ilm-shrink-index/286407)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 4\ **Last updated:** [October 12, 2021, 9:00pm UTC](https://discuss.elastic.co/t/understand-ilm-shrink-index/286407 "2021-10-12T21:00:32Z")
I have used ILM policy on my metricbeat data and used shrink option. which worked and created new index called shrink-anre-metricbeat-7.15.0-2021.10.06-000010 but my index pattern is called "metricbeat-\*" how does it… --- ## [Failed to retrieve password hash for reserved user \[elastic\]](https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-elastic/286399)
**Author:** [@rachelyang](https://discuss.elastic.co/u/rachelyang)\ **Replies:** 6\ **Last updated:** [October 12, 2021, 8:51pm UTC](https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-elastic/286399 "2021-10-12T20:51:34Z")
I have verified the password of user elastic. curl -k -u elastic 'https://localhost:9200/\_xpack/security/\_authenticate?pretty' Enter host password for user 'elastic': { "username" : "elastic", "roles" : \[ "super… --- ## [Finding data with logstash 7.13.4](https://discuss.elastic.co/t/finding-data-with-logstash-7-13-4/286135)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 6\ **Last updated:** [October 12, 2021, 8:44pm UTC](https://discuss.elastic.co/t/finding-data-with-logstash-7-13-4/286135 "2021-10-12T20:44:15Z")
I have my installation of the ELK stack up and running. All three aspects are running on separate servers but they all communicate and can talk to one another. I have not yet installed any Beats or Security on the inst… --- ## [What is best way for saving URL on Elasticsearch, only "keyword" type mapping?](https://discuss.elastic.co/t/what-is-best-way-for-saving-url-on-elasticsearch-only-keyword-type-mapping/286477)
**Author:** [@dan\_kim](https://discuss.elastic.co/u/dan_kim)\ **Replies:** 1\ **Last updated:** [October 12, 2021, 8:31pm UTC](https://discuss.elastic.co/t/what-is-best-way-for-saving-url-on-elasticsearch-only-keyword-type-mapping/286477 "2021-10-12T20:31:03Z")
Hello ~ Our team is going to save our product data in Elasticsearch and I got question when i type mapping schema. The url of "product image", or "product payment" is quite big compared to other attribute in Elasticse… --- ## [Comparing two fields between two different index and output result into a third index](https://discuss.elastic.co/t/comparing-two-fields-between-two-different-index-and-output-result-into-a-third-index/286535)
**Author:** [@test\_tester](https://discuss.elastic.co/u/test_tester)\ **Replies:** 1\ **Last updated:** [October 12, 2021, 7:10pm UTC](https://discuss.elastic.co/t/comparing-two-fields-between-two-different-index-and-output-result-into-a-third-index/286535 "2021-10-12T19:10:00Z")
Hello! I got a requirement whereby I am required to match two fields from two different files and output the result into a csv file. Prior to this train of thought, i did a simple python script to do the matching logic… --- ## [Filebeat negate regexp](https://discuss.elastic.co/t/filebeat-negate-regexp/286502)
**Author:** [@Marcus\_Juttner](https://discuss.elastic.co/u/Marcus_Juttner)\ **Replies:** 1\ **Last updated:** [October 12, 2021, 6:59pm UTC](https://discuss.elastic.co/t/filebeat-negate-regexp/286502 "2021-10-12T18:59:11Z")
Hello How can I negate this processors: - drop\_event: when: regexp: message: "^\[0-9\]" I want to read only lines beginning with a number and ignore all others. Thank you Marcus --- ## [Questions about handling delete operations on a latest-data-only index](https://discuss.elastic.co/t/questions-about-handling-delete-operations-on-a-latest-data-only-index/286227)
**Author:** [@nivo](https://discuss.elastic.co/u/nivo)\ **Replies:** 5\ **Last updated:** [October 12, 2021, 6:54pm UTC](https://discuss.elastic.co/t/questions-about-handling-delete-operations-on-a-latest-data-only-index/286227 "2021-10-12T18:54:46Z")
Hi everyone, I have a question regarding our use case following this topic - In our case we use a single index per customer (without rolling it) and keeping its data up to date by indexing or deleting documents when t… --- ## [Highlighting of not indexed text](https://discuss.elastic.co/t/highlighting-of-not-indexed-text/286530)
**Author:** [@Wonder\_Garance](https://discuss.elastic.co/u/Wonder_Garance)\ **Replies:** 0\ **Last updated:** [October 12, 2021, 5:50pm UTC](https://discuss.elastic.co/t/highlighting-of-not-indexed-text/286530 "2021-10-12T17:50:17Z")
Hello, I use Elasticsearch 7.9.3, is there any way to highlight a not indexed text, with expressions highlighted by a phrase query, and synonyms of these expressions? As our text are often updated, if we index them, th… --- ## [Obtain doc\_count values from terms aggregation in bucket](https://discuss.elastic.co/t/obtain-doc-count-values-from-terms-aggregation-in-bucket/286527)
**Author:** [@Felipe\_Fuller](https://discuss.elastic.co/u/Felipe_Fuller)\ **Replies:** 0\ **Last updated:** [October 12, 2021, 4:30pm UTC](https://discuss.elastic.co/t/obtain-doc-count-values-from-terms-aggregation-in-bucket/286527 "2021-10-12T16:30:15Z")
Hello Community! I am having a problem formulating a query in Elasticseach. I want to create a watcher to alert me on slack, the top hits that exceed the 4% of all the documents in a time interval. So in the query of th… --- ## [Elasticsearch Native Language Translation (NLP)](https://discuss.elastic.co/t/elasticsearch-native-language-translation-nlp/286521)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 0\ **Last updated:** [October 12, 2021, 3:18pm UTC](https://discuss.elastic.co/t/elasticsearch-native-language-translation-nlp/286521 "2021-10-12T15:18:27Z")
Hi All, I recently watched the ElasticOn talk on Modern NLP in the Elastic Stack. It was very interesting to see how Elastic is looking to integrate NLP. On this topic, I noticed that recently Elastic had added language… --- ## [Canvas Elements No Longer Interactive](https://discuss.elastic.co/t/canvas-elements-no-longer-interactive/286384)
**Author:** [@hbs128](https://discuss.elastic.co/u/hbs128)\ **Replies:** 1\ **Last updated:** [October 12, 2021, 3:16pm UTC](https://discuss.elastic.co/t/canvas-elements-no-longer-interactive/286384 "2021-10-12T15:16:20Z")
Having some issues with elements in Canvas. Drop down filters that were once working, are no longer interactive (when you click on them, they no longer drop down or react). In addition, maps added to canvas are doing the… --- ## [Sum-up subprocesses](https://discuss.elastic.co/t/sum-up-subprocesses/286097)
**Author:** [@franknord](https://discuss.elastic.co/u/franknord)\ **Replies:** 1\ **Last updated:** [October 12, 2021, 3:11pm UTC](https://discuss.elastic.co/t/sum-up-subprocesses/286097 "2021-10-12T15:11:41Z")
Hi all, On my system I have a parent process spawning several sub-processes: root 84046 0.0 0.2 392688 36420 ? Ss Sep30 2:47 /usr/sbin/httpd -DFOREGROUND apache 121160 3.3 0.1 395720 27616 ? … --- ## [Logstash Converting Base64 IP to Decimal IP](https://discuss.elastic.co/t/logstash-converting-base64-ip-to-decimal-ip/286153)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 19\ **Last updated:** [October 12, 2021, 3:07pm UTC](https://discuss.elastic.co/t/logstash-converting-base64-ip-to-decimal-ip/286153 "2021-10-12T15:07:49Z")
Hello, I'm trying to convert a base64 IP into a decimal IP. I saw that Logstash Ruby filter plugin can assist with this by parsing the message field, but is there a way to do this for just an IP field? --- ## [Running logstash in background in linux](https://discuss.elastic.co/t/running-logstash-in-background-in-linux/286517)
**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\ **Replies:** 1\ **Last updated:** [October 12, 2021, 2:25pm UTC](https://discuss.elastic.co/t/running-logstash-in-background-in-linux/286517 "2021-10-12T14:25:53Z")
I want to run logstash in background on linux server i am using command like this on bin path nohup ./logstash -f sample.conf& is it correct way to run the logstash or anything else but then I need to read nohup.out … --- ## [Elasticsearch 7.14.1 and unassigned shards](https://discuss.elastic.co/t/elasticsearch-7-14-1-and-unassigned-shards/286510)
**Author:** [@Marcello\_A](https://discuss.elastic.co/u/Marcello_A)\ **Replies:** 1\ **Last updated:** [October 12, 2021, 2:04pm UTC](https://discuss.elastic.co/t/elasticsearch-7-14-1-and-unassigned-shards/286510 "2021-10-12T14:04:43Z")
Hi All, we installed a 3 nodes cluster shipped with Elasticsearch 7.14.1. All indices are configured with 2 shards and 1 replica per shard and all works fine. We stop one node and the cluster becomes yellow and some sh… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1203) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1205)