# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1207

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1208

---

## [Size mapper plugin - how to see it in Kibana?](https://discuss.elastic.co/t/size-mapper-plugin-how-to-see-it-in-kibana/286247)

<div class="topic-metadata">

**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\
**Replies:** 1\
**Last updated:** [October 11, 2021, 11:19am UTC](https://discuss.elastic.co/t/size-mapper-plugin-how-to-see-it-in-kibana/286247 "2021-10-11T11:19:39Z")

</div>

I am going to try that again, since there where already some topics about it: I have installed: Mapper Size Plugin | Elasticsearch Plugins and Integrations \[7.15\] | Elastic on my 7.13.2 cluster and I have created a new …

---

## [Java API Client Documentation](https://discuss.elastic.co/t/java-api-client-documentation/286132)

<div class="topic-metadata">

**Author:** [@blueJ](https://discuss.elastic.co/u/blueJ)\
**Replies:** 3\
**Last updated:** [October 11, 2021, 11:17am UTC](https://discuss.elastic.co/t/java-api-client-documentation/286132 "2021-10-11T11:17:41Z")

</div>

Hey everyone, could You help me to find documentation for Java API Client (this beta solution that replaces Java High Level REST Client)? I mean something like the official oracle java libraries documentation? Kind reg…

---

## [RFC-5424 log parsing](https://discuss.elastic.co/t/rfc-5424-log-parsing/286129)

<div class="topic-metadata">

**Author:** [@Sunflower](https://discuss.elastic.co/u/Sunflower)\
**Replies:** 6\
**Last updated:** [October 11, 2021, 10:59am UTC](https://discuss.elastic.co/t/rfc-5424-log-parsing/286129 "2021-10-11T10:59:10Z")

</div>

Hi, I have logs that I'm sending to Logstash from SentinelOne in an RFC-5424 format(this is the way they called it) that I wasn't sure how to handle. I began by dividing the fields using Grok and now my issue is how to…

---

## [Elastic agents reporting error: status code: 429, fleet-server returned an error: MaxLimit](https://discuss.elastic.co/t/elastic-agents-reporting-error-status-code-429-fleet-server-returned-an-error-maxlimit/286348)

<div class="topic-metadata">

**Author:** [@chippey5](https://discuss.elastic.co/u/chippey5)\
**Replies:** 0\
**Last updated:** [October 11, 2021, 8:46am UTC](https://discuss.elastic.co/t/elastic-agents-reporting-error-status-code-429-fleet-server-returned-an-error-maxlimit/286348 "2021-10-11T08:46:10Z")

</div>

Hi, Lately we've been receving a lot of Could not communicate with fleet-server Checking API will retry, error: status code: 429, fleet-server returned an error: MaxLimit, message: exceeded the max limit messages from o…

---

## [Conditional coloring Kibana canvas](https://discuss.elastic.co/t/conditional-coloring-kibana-canvas/286037)

<div class="topic-metadata">

**Author:** [@Kadhem](https://discuss.elastic.co/u/Kadhem)\
**Replies:** 4\
**Last updated:** [October 11, 2021, 8:56am UTC](https://discuss.elastic.co/t/conditional-coloring-kibana-canvas/286037 "2021-10-11T08:56:39Z")

</div>

Hi, I'm want to change the color of the bars here depending on the value of "Primary channel " . i may have 12 values in "Primary channel" . the graph is displayed in real time so the color changing must be updated ( i…

---

## [Best way to index hierarchical types](https://discuss.elastic.co/t/best-way-to-index-hierarchical-types/286242)

<div class="topic-metadata">

**Author:** [@lovrodoe](https://discuss.elastic.co/u/lovrodoe)\
**Replies:** 1\
**Last updated:** [October 11, 2021, 8:03am UTC](https://discuss.elastic.co/t/best-way-to-index-hierarchical-types/286242 "2021-10-11T08:03:22Z")

</div>

Let's say I have hierarchical types such as in example below: base\_type child\_type1 child\_type3 child\_type2 child\_type1 and child\_type2 inherit metadata properties from base\_type. child\_type3 has all pr…

---

## [Indexing strategy for hierarchical types](https://discuss.elastic.co/t/indexing-strategy-for-hierarchical-types/286343)

<div class="topic-metadata">

**Author:** [@lovrodoe](https://discuss.elastic.co/u/lovrodoe)\
**Replies:** 1\
**Last updated:** [October 11, 2021, 7:58am UTC](https://discuss.elastic.co/t/indexing-strategy-for-hierarchical-types/286343 "2021-10-11T07:58:09Z")

</div>

Hello, I wrote a post on Friday (here) and since I didn't get a reply, I'll give it another go with a different question. Just a quick summary (check my previous post for a more detailed explanation): Currently on Elas…

---

## [Kibana monitor to execute job if hit disk space (self healing)](https://discuss.elastic.co/t/kibana-monitor-to-execute-job-if-hit-disk-space-self-healing/286339)

<div class="topic-metadata">

**Author:** [@josh12](https://discuss.elastic.co/u/josh12)\
**Replies:** 2\
**Last updated:** [October 11, 2021, 7:02am UTC](https://discuss.elastic.co/t/kibana-monitor-to-execute-job-if-hit-disk-space-self-healing/286339 "2021-10-11T07:02:14Z")

</div>

Hi can I know is it possible to elk stack to call a script or Jenkins job if it his 50 percents of disk space. Can share what i can start research on

---

## [Remove the registry of a concrete input](https://discuss.elastic.co/t/remove-the-registry-of-a-concrete-input/286338)

<div class="topic-metadata">

**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\
**Replies:** 0\
**Last updated:** [October 11, 2021, 6:53am UTC](https://discuss.elastic.co/t/remove-the-registry-of-a-concrete-input/286338 "2021-10-11T06:53:27Z")

</div>

hello ! i have a filebeat with two inputs with differents tags and outputs. i want to remove only the registry of one of them. is there any way or parameter to remove the registry or or set the entry to read from the b…

---

## [Different index output using ingest pipeline](https://discuss.elastic.co/t/different-index-output-using-ingest-pipeline/286325)

<div class="topic-metadata">

**Author:** [@alfianaf](https://discuss.elastic.co/u/alfianaf)\
**Replies:** 7\
**Last updated:** [October 11, 2021, 5:57am UTC](https://discuss.elastic.co/t/different-index-output-using-ingest-pipeline/286325 "2021-10-11T05:57:43Z")

</div>

Hello, I'm trying to use ingest pipeline to get different index output. Here's my case: I have fluentd to hit input on Elasticsearch, fluentd make index input on Elasticsearch named as "app-write", I want to filter from…

---

## [Elasticsearch-certutil http](https://discuss.elastic.co/t/elasticsearch-certutil-http/286230)

<div class="topic-metadata">

**Author:** [@karpaz](https://discuss.elastic.co/u/karpaz)\
**Replies:** 2\
**Last updated:** [October 11, 2021, 5:25am UTC](https://discuss.elastic.co/t/elasticsearch-certutil-http/286230 "2021-10-11T05:25:12Z")

</div>

Hello everyone, I figured out that when generating http certificates by tool ./bin/elasticsearch-certutil http than it didn't work when I have password protected \*.pem/\*.key files. It does generate certs only if it's us…

---

## [Get "readiness probe failed" error when deploy to K8S](https://discuss.elastic.co/t/get-readiness-probe-failed-error-when-deploy-to-k8s/286333)

<div class="topic-metadata">

**Author:** [@zhaoyi0113](https://discuss.elastic.co/u/zhaoyi0113)\
**Replies:** 0\
**Last updated:** [October 11, 2021, 5:11am UTC](https://discuss.elastic.co/t/get-readiness-probe-failed-error-when-deploy-to-k8s/286333 "2021-10-11T05:11:05Z")

</div>

I am trying to deploy Elasticsearch cluster to AWS EKS. I have this spec: apiVersion: elasticsearch.k8s.elastic.co/v1 kind: Elasticsearch metadata: name: datasource spec: version: 7.14.0 nodeSets: - name: node …

---

## [Beats load balancer feature vs F5 Load balancer](https://discuss.elastic.co/t/beats-load-balancer-feature-vs-f5-load-balancer/286332)

<div class="topic-metadata">

**Author:** [@Ismaeel\_Enjreny](https://discuss.elastic.co/u/Ismaeel_Enjreny)\
**Replies:** 0\
**Last updated:** [October 11, 2021, 5:10am UTC](https://discuss.elastic.co/t/beats-load-balancer-feature-vs-f5-load-balancer/286332 "2021-10-11T05:10:53Z")

</div>

Beats (Filebeat and Heartbeat) provide a way to do load balancing when they send data to output (to Logstash or Elasticsearch), the configuration include the following points: hosts: \["localhost:5044", "localhost:5045"\]…

---

## [How to call Explain with a NEST SearchDescriptor object?](https://discuss.elastic.co/t/how-to-call-explain-with-a-nest-searchdescriptor-object/286327)

<div class="topic-metadata">

**Author:** [@chm](https://discuss.elastic.co/u/chm)\
**Replies:** 0\
**Last updated:** [October 11, 2021, 4:04am UTC](https://discuss.elastic.co/t/how-to-call-explain-with-a-nest-searchdescriptor-object/286327 "2021-10-11T04:04:30Z")

</div>

I'm running a search calling Nest's SearchAsync with a SearchDescriptor object. I want to be able to reuse that SearchDescriptor object in a call to the Explain API with a particular document id, to see why that doc was/…

---

## [Index size is different from ILM index size](https://discuss.elastic.co/t/index-size-is-different-from-ilm-index-size/286000)

<div class="topic-metadata">

**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Replies:** 6\
**Last updated:** [October 11, 2021, 1:41am UTC](https://discuss.elastic.co/t/index-size-is-different-from-ilm-index-size/286000 "2021-10-11T01:41:57Z")

</div>

Why my index size is different from ilm index size property health status index uuid pri rep docs.count docs.deleted store.size pri.store.size green open log-wlb-sysmon-20…

---

## [Is Elasticsearch the right solution for regularly updated content search?](https://discuss.elastic.co/t/is-elasticsearch-the-right-solution-for-regularly-updated-content-search/286322)

<div class="topic-metadata">

**Author:** [@renegademarketer](https://discuss.elastic.co/u/renegademarketer)\
**Replies:** 1\
**Last updated:** [October 11, 2021, 1:24am UTC](https://discuss.elastic.co/t/is-elasticsearch-the-right-solution-for-regularly-updated-content-search/286322 "2021-10-11T01:24:26Z")

</div>

I have the following use case and I'm not sure if Elasticsearch/Elasticpress is the right solution. I want to do the following: User will search WordPress custom post types (CPT), its taxonomies, custom fields (CF), an…

---

## [What is proper index naming policy for log monitoring?](https://discuss.elastic.co/t/what-is-proper-index-naming-policy-for-log-monitoring/285898)

<div class="topic-metadata">

**Author:** [@Hur](https://discuss.elastic.co/u/Hur)\
**Replies:** 1\
**Last updated:** [October 11, 2021, 1:14am UTC](https://discuss.elastic.co/t/what-is-proper-index-naming-policy-for-log-monitoring/285898 "2021-10-11T01:14:09Z")

</div>

Hello, I have an question about the index naming policy for log monitoring. As a purpose of saving log, what is the recommended index naming policy? Are there any good ES skills to handle a number of indices? Simply, …

---

## [No alive nodes found in your cluster](https://discuss.elastic.co/t/no-alive-nodes-found-in-your-cluster/285946)

<div class="topic-metadata">

**Author:** [@dreamte](https://discuss.elastic.co/u/dreamte)\
**Replies:** 1\
**Last updated:** [October 11, 2021, 1:13am UTC](https://discuss.elastic.co/t/no-alive-nodes-found-in-your-cluster/285946 "2021-10-11T01:13:05Z")

</div>

Hello, periodically (with an increase in the frequency of the number of additions to the index) an error occurs - no active nodes were found in your cluster. My configuration: cluster.name: elk\_test node.name: elk\_tes…

---

## [ES Migrated from 7.7.0 to 7.15.0 - all application 'logs-\*' legacy templates superseded by new managed logs index](https://discuss.elastic.co/t/es-migrated-from-7-7-0-to-7-15-0-all-application-logs-legacy-templates-superseded-by-new-managed-logs-index/285913)

<div class="topic-metadata">

**Author:** [@Nazar\_Aziz](https://discuss.elastic.co/u/Nazar_Aziz)\
**Replies:** 2\
**Last updated:** [October 11, 2021, 1:12am UTC](https://discuss.elastic.co/t/es-migrated-from-7-7-0-to-7-15-0-all-application-logs-legacy-templates-superseded-by-new-managed-logs-index/285913 "2021-10-11T01:12:38Z")

</div>

Greetings! We have a simple Elasticsearch/Kibana cloud deployment primarily used for application logs against which we generate graphs and dashboard. Logs are shipped directly from applications directly to ES search, i.…

---

## [Using Elastic Services with XenForo Forum software](https://discuss.elastic.co/t/using-elastic-services-with-xenforo-forum-software/285960)

<div class="topic-metadata">

**Author:** [@tommythejoat](https://discuss.elastic.co/u/tommythejoat)\
**Replies:** 1\
**Last updated:** [October 11, 2021, 1:10am UTC](https://discuss.elastic.co/t/using-elastic-services-with-xenforo-forum-software/285960 "2021-10-11T01:10:27Z")

</div>

Does anyone have experience using Elastic services like Eastic Cloud with third party products like the Extended Search facility for XenForo forum system? We are currently running Elasticsearch 7.14.0 on an in house sys…

---

## [Logstash change port](https://discuss.elastic.co/t/logstash-change-port/285895)

<div class="topic-metadata">

**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\
**Replies:** 8\
**Last updated:** [October 11, 2021, 1:06am UTC](https://discuss.elastic.co/t/logstash-change-port/285895 "2021-10-11T01:06:54Z")

</div>

Logstash is running on 9600 by default and I want to run another logstash on same system Is there opion to change default port for logstash I don't want to use beats for this. beacuse I want to run two logstash with d…

---

## [Indexed documents with composite \_id collide](https://discuss.elastic.co/t/indexed-documents-with-composite-id-collide/286073)

<div class="topic-metadata">

**Author:** [@Jason-Leap](https://discuss.elastic.co/u/Jason-Leap)\
**Replies:** 1\
**Last updated:** [October 11, 2021, 1:02am UTC](https://discuss.elastic.co/t/indexed-documents-with-composite-id-collide/286073 "2021-10-11T01:02:16Z")

</div>

Hi guys. I've found some interesting behaviour that I was hoping to get some clarification on. Let's say I perform a bulk index of two documents like so: curl --request POST \\ --url \<domain\>/\<index\>/\_bulk \\ --header…

---

## [Could not find logstash.yml file despite the file being located in the default directory](https://discuss.elastic.co/t/could-not-find-logstash-yml-file-despite-the-file-being-located-in-the-default-directory/286084)

<div class="topic-metadata">

**Author:** [@Johnny\_Cash\_Cow](https://discuss.elastic.co/u/Johnny_Cash_Cow)\
**Replies:** 1\
**Last updated:** [October 11, 2021, 12:52am UTC](https://discuss.elastic.co/t/could-not-find-logstash-yml-file-despite-the-file-being-located-in-the-default-directory/286084 "2021-10-11T00:52:42Z")

</div>

Good Evening, Here is the layout of my directory: Within /etc/logstash/ is the following files and directories: conf.d log4j2.properties logstash.yml startup.options jvm.options logstash-sample.conf piple…

---

## [Watcher input search failing due to exceeded dynamic compilation](https://discuss.elastic.co/t/watcher-input-search-failing-due-to-exceeded-dynamic-compilation/286087)

<div class="topic-metadata">

**Author:** [@Munavir\_Chavody](https://discuss.elastic.co/u/Munavir_Chavody)\
**Replies:** 1\
**Last updated:** [October 11, 2021, 12:51am UTC](https://discuss.elastic.co/t/watcher-input-search-failing-due-to-exceeded-dynamic-compilation/286087 "2021-10-11T00:51:53Z")

</div>

I'm getting dynamic execution circuit breaking error for many watchers in our environment saying that the input search query failed to compile. What is the reason for the same. How can we avoid such errors at all? Erro…

---

## [Exiting: 9 errors: protocol not available](https://discuss.elastic.co/t/exiting-9-errors-protocol-not-available/286157)

<div class="topic-metadata">

**Author:** [@Johnatan\_Gonzalez\_Ve](https://discuss.elastic.co/u/Johnatan_Gonzalez_Ve)\
**Replies:** 1\
**Last updated:** [October 11, 2021, 12:42am UTC](https://discuss.elastic.co/t/exiting-9-errors-protocol-not-available/286157 "2021-10-11T00:42:45Z")

</div>

module: system period: 10s metricsets: - cpu - load - memory - filesystem - fsstat - network - process - process\_summary - socket\_summary - entropy - core - diskio - socket - service - users process.include\_to…

---

## [Add data nodes in peak time](https://discuss.elastic.co/t/add-data-nodes-in-peak-time/286175)

<div class="topic-metadata">

**Author:** [@yukai](https://discuss.elastic.co/u/yukai)\
**Replies:** 1\
**Last updated:** [October 11, 2021, 12:36am UTC](https://discuss.elastic.co/t/add-data-nodes-in-peak-time/286175 "2021-10-11T00:36:34Z")

</div>

Hi, I have a self-managed Elasticsearch cluster with 3 dedicated master nodes, in peak time I would simply add data nodes to increase cluster throughput. And I don't think this action would bring any side affects to the…

---

## [Snapshot Lifecycle Management (SLM) in Python 3](https://discuss.elastic.co/t/snapshot-lifecycle-management-slm-in-python-3/286208)

<div class="topic-metadata">

**Author:** [@ttttien](https://discuss.elastic.co/u/ttttien)\
**Replies:** 0\
**Last updated:** [October 8, 2021, 8:57am UTC](https://discuss.elastic.co/t/snapshot-lifecycle-management-slm-in-python-3/286208 "2021-10-08T08:57:28Z")

</div>

Hello, I had done "snapshot" for the indexes in an database Elasticsearch by script : es.snapshot.create(repository=repository\_name, snapshot=snapshot\_name) I would like to Automatic backup with SML. I really need you…

---

## [New ElasticSearch Node.js client "@elastic/elasticsearch" slower than legacy ElasticSearch Node.js client "elasticsearch" in searches](https://discuss.elastic.co/t/new-elasticsearch-node-js-client-elastic-elasticsearch-slower-than-legacy-elasticsearch-node-js-client-elasticsearch-in-searches/286216)

<div class="topic-metadata">

**Author:** [@luce](https://discuss.elastic.co/u/luce)\
**Replies:** 0\
**Last updated:** [October 8, 2021, 9:36am UTC](https://discuss.elastic.co/t/new-elasticsearch-node-js-client-elastic-elasticsearch-slower-than-legacy-elasticsearch-node-js-client-elasticsearch-in-searches/286216 "2021-10-08T09:36:28Z")

</div>

Hi folk, We are using ES version 7.9.0, the application that uses ES is on the NodeJS platform. We have currently replaced the legacy ES client library ("Elasticsearch": "16.7.2"), with the new ES client library "@elast…

---

## [How to assign an Alias in an existing Index](https://discuss.elastic.co/t/how-to-assign-an-alias-in-an-existing-index/286233)

<div class="topic-metadata">

**Author:** [@qttv](https://discuss.elastic.co/u/qttv)\
**Replies:** 5\
**Last updated:** [October 11, 2021, 12:26am UTC](https://discuss.elastic.co/t/how-to-assign-an-alias-in-an-existing-index/286233 "2021-10-11T00:26:22Z")

</div>

Good Morning, I'm using Kibana version 7.0, and I need to assign an alias to a filed into an existing Index that i can't delete. This field is named "processName" and I need to rename it as "processname". I read the do…

---

## [Elasticsearch cluster query logic by ElastAlert](https://discuss.elastic.co/t/elasticsearch-cluster-query-logic-by-elastalert/286301)

<div class="topic-metadata">

**Author:** [@josh12](https://discuss.elastic.co/u/josh12)\
**Replies:** 1\
**Last updated:** [October 11, 2021, 12:19am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-query-logic-by-elastalert/286301 "2021-10-11T00:19:45Z")

</div>

Hi, I have question. I am planning to use elasticalert for Elasticsearch. I have 1 cluster with 3 node in my docker es01,es02 and es03. Can I know when elasticalert query in es01, if data does not exists will it query in…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1206)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1208)
