# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1224 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1225 --- ## [Logstash DLQ Metrics](https://discuss.elastic.co/t/logstash-dlq-metrics/285207)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 0\ **Last updated:** [September 27, 2021, 8:54am UTC](https://discuss.elastic.co/t/logstash-dlq-metrics/285207 "2021-09-27T08:54:05Z")
Hi, Are there dead-letter-queue metrics collected by xpack? I don't see any but would have expected to find something. Thx D --- ## [Issue after install Logstash on Mac OS](https://discuss.elastic.co/t/issue-after-install-logstash-on-mac-os/284028)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 3\ **Last updated:** [September 27, 2021, 9:09am UTC](https://discuss.elastic.co/t/issue-after-install-logstash-on-mac-os/284028 "2021-09-27T09:09:08Z")
Hi I've met some problem within run Logstash on Mac also I've have followed by all commands and at least try to up Logstash instance by (logstash -f /usr/local/etc/logstash/logstash.conf --path.settings=/usr/local/etc/lo… --- ## [Recommanded shards size includes replicas or not?](https://discuss.elastic.co/t/recommanded-shards-size-includes-replicas-or-not/285203)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 2\ **Last updated:** [September 27, 2021, 9:03am UTC](https://discuss.elastic.co/t/recommanded-shards-size-includes-replicas-or-not/285203 "2021-09-27T09:03:19Z")
Hello, Documentation says : Aim for shard sizes between 10GB and 50GB but does not specifiy if it concerns only primary or primary AND replicas I mean, I have an index of 200GB and wants 1 replica. So total index size… --- ## [Using Transforms and including values which only exist on some events in the source index](https://discuss.elastic.co/t/using-transforms-and-including-values-which-only-exist-on-some-events-in-the-source-index/285067)
**Author:** [@nsouth](https://discuss.elastic.co/u/nsouth)\ **Replies:** 1\ **Last updated:** [September 27, 2021, 8:48am UTC](https://discuss.elastic.co/t/using-transforms-and-including-values-which-only-exist-on-some-events-in-the-source-index/285067 "2021-09-27T08:48:59Z")
Hi, I am trying to use Transforms to create an entity-centric index of my command logs. I need help including data that only appears on some documents. Each "command" is represented by multiple events, correlated by a co… --- ## [Graphic display of questions in different time frames](https://discuss.elastic.co/t/graphic-display-of-questions-in-different-time-frames/285150)
**Author:** [@cheerone](https://discuss.elastic.co/u/cheerone)\ **Replies:** 1\ **Last updated:** [September 27, 2021, 8:09am UTC](https://discuss.elastic.co/t/graphic-display-of-questions-in-different-time-frames/285150 "2021-09-27T08:09:00Z")
I use metricbeat system module collect servers data. When i choose "last 30 minutes" "last 24 hours" and "today",the data shown in the graph is too different. Can you explain why this is happening? Is it a statistical p… --- ## [How to build beats excluding unwanted modules?](https://discuss.elastic.co/t/how-to-build-beats-excluding-unwanted-modules/285199)
**Author:** [@8e6d5b4d49f69e9edb4c](https://discuss.elastic.co/u/8e6d5b4d49f69e9edb4c)\ **Replies:** 0\ **Last updated:** [September 27, 2021, 7:52am UTC](https://discuss.elastic.co/t/how-to-build-beats-excluding-unwanted-modules/285199 "2021-09-27T07:52:42Z")
Continuing the discussion from Beats for embedded devices?: I want to use Filebeat on an embedded device where disk is limited. Linked topic is the answer of my question, but outdated. I'm looking for how to build min… --- ## [Missing Hosts in Visulization](https://discuss.elastic.co/t/missing-hosts-in-visulization/285197)
**Author:** [@BoKu](https://discuss.elastic.co/u/BoKu)\ **Replies:** 0\ **Last updated:** [September 27, 2021, 7:41am UTC](https://discuss.elastic.co/t/missing-hosts-in-visulization/285197 "2021-09-27T07:41:33Z")
Hello, yesterday we noticed a strange problem. We depolyed 19 Nginx-VMs with Terraform / Ansible, those 19 VMs had the exactly the same configuration, regarding the filebeat config. In Kibana / Discover we were able to… --- ## [Aws multi account metric beat setup](https://discuss.elastic.co/t/aws-multi-account-metric-beat-setup/283925)
**Author:** [@sinto](https://discuss.elastic.co/u/sinto)\ **Replies:** 2\ **Last updated:** [September 27, 2021, 7:20am UTC](https://discuss.elastic.co/t/aws-multi-account-metric-beat-setup/283925 "2021-09-27T07:20:24Z")
Hi Team, Is there any way I can achieve one metricbeat.yml configuration to fetch aws cloudwatch metrics from multiple aws account and each account need seperate indexes something like like metrics-cloud-\[Account-Number… --- ## [Kibana Crash after upgrade from 7.12](https://discuss.elastic.co/t/kibana-crash-after-upgrade-from-7-12/285128)
**Author:** [@ondemand](https://discuss.elastic.co/u/ondemand)\ **Replies:** 2\ **Last updated:** [September 27, 2021, 7:02am UTC](https://discuss.elastic.co/t/kibana-crash-after-upgrade-from-7-12/285128 "2021-09-27T07:02:53Z")
I previously install 7.12 on my Mac with Brew, after upgrade to 7.15, Kibana failed to start with below error: FATAL Error: Unable to complete saved object migrations for the \[.kibana\] index. Please check the health of… --- ## [Cannot change the field format back to milliseconds - Index Pattern field](https://discuss.elastic.co/t/cannot-change-the-field-format-back-to-milliseconds-index-pattern-field/285108)
**Author:** [@parinitha.nagaraja](https://discuss.elastic.co/u/parinitha.nagaraja)\ **Replies:** 1\ **Last updated:** [September 27, 2021, 5:24am UTC](https://discuss.elastic.co/t/cannot-change-the-field-format-back-to-milliseconds-index-pattern-field/285108 "2021-09-27T05:24:07Z")
Hi, I edited the field format to convert a field from milliseconds (input) to minutes (output). But when I revert it back to original or in other words when I remove the formatting, the data still appears in minutes and… --- ## [After implementation all beats data not showing in discover](https://discuss.elastic.co/t/after-implementation-all-beats-data-not-showing-in-discover/285187)
**Author:** [@savan820](https://discuss.elastic.co/u/savan820)\ **Replies:** 2\ **Last updated:** [September 27, 2021, 4:04am UTC](https://discuss.elastic.co/t/after-implementation-all-beats-data-not-showing-in-discover/285187 "2021-09-27T04:04:38Z")
when we configured SSL and TLS my all beats output is not showing in discovered. kindly give me the resolution. --- ## [Question about grouping to get the total number of filtered buckets in a bucket](https://discuss.elastic.co/t/question-about-grouping-to-get-the-total-number-of-filtered-buckets-in-a-bucket/285183)
**Author:** [@yanglingqiang](https://discuss.elastic.co/u/yanglingqiang)\ **Replies:** 0\ **Last updated:** [September 27, 2021, 3:04am UTC](https://discuss.elastic.co/t/question-about-grouping-to-get-the-total-number-of-filtered-buckets-in-a-bucket/285183 "2021-09-27T03:04:37Z")
this is my source data \[ { "buyer\_id\_std" : 35444337, "seller\_id\_std" : 3587575, "date" : "2021-02-24T00:00:00" }, { "buyer\_id\_std" : 35444337, "seller\_id\_std" : 75848633, "date… --- ## [How to parse a string json type field](https://discuss.elastic.co/t/how-to-parse-a-string-json-type-field/285162)
**Author:** [@Liangliang\_Qiu](https://discuss.elastic.co/u/Liangliang_Qiu)\ **Replies:** 2\ **Last updated:** [September 27, 2021, 2:39am UTC](https://discuss.elastic.co/t/how-to-parse-a-string-json-type-field/285162 "2021-09-27T02:39:01Z")
hi, i have a text type filed(index: false) -- detail , how to parse it into a geo\_shape field? { "took" : 23, "timed\_out" : false, "\_shards" : { "total" : 10, "successful" : 10, "skipped" : 0, "fai… --- ## [Elastic for Appointment Availability](https://discuss.elastic.co/t/elastic-for-appointment-availability/285176)
**Author:** [@updev](https://discuss.elastic.co/u/updev)\ **Replies:** 1\ **Last updated:** [September 27, 2021, 1:47am UTC](https://discuss.elastic.co/t/elastic-for-appointment-availability/285176 "2021-09-27T01:47:03Z")
Hi everyone, I'm in the process of evaluating the best technology stack for an appointment booking system, similar to that of Acuity and Calendly. Does anyone have any experience using ES for this sort of thing? Would… --- ## [Does a node can be at the same time cold\_tier and freeze tier?](https://discuss.elastic.co/t/does-a-node-can-be-at-the-same-time-cold-tier-and-freeze-tier/285097)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 0\ **Last updated:** [September 24, 2021, 3:58pm UTC](https://discuss.elastic.co/t/does-a-node-can-be-at-the-same-time-cold-tier-and-freeze-tier/285097 "2021-09-24T15:58:16Z")
Hello, Until now (v 7.9.1), I use the following ilm policy : Day 1 = hot Day 30 = cold + freeze Day 60 = delete With the recent releases (v 7.14), I noticed the introduction of data tiers, and also a new phase : the… --- ## [Formatting a field as a link to a filtered view on its value](https://discuss.elastic.co/t/formatting-a-field-as-a-link-to-a-filtered-view-on-its-value/284357)
**Author:** [@malsioufi](https://discuss.elastic.co/u/malsioufi)\ **Replies:** 5\ **Last updated:** [September 27, 2021, 12:12am UTC](https://discuss.elastic.co/t/formatting-a-field-as-a-link-to-a-filtered-view-on-its-value/284357 "2021-09-27T00:12:27Z")
I have a field in my index called "labels" that contains an array of strings that is used as tags for the documents. Is there a way to format this field as a link that when a user click on it in the Discover area it lin… --- ## [It is a good idea to implement Ha Proxy in front of Elasticsearch 7?](https://discuss.elastic.co/t/it-is-a-good-idea-to-implement-ha-proxy-in-front-of-elasticsearch-7/285133)
**Author:** [@jeanpl](https://discuss.elastic.co/u/jeanpl)\ **Replies:** 1\ **Last updated:** [September 27, 2021, 12:03am UTC](https://discuss.elastic.co/t/it-is-a-good-idea-to-implement-ha-proxy-in-front-of-elasticsearch-7/285133 "2021-09-27T00:03:36Z")
From my understanding, adding HaProxy on top of Elasticsearch might bring some High Availability, and Load Balancing. Moreover, it is also possible to communicate a single entry point URL (the Ha Proxy host endpoint), fo… --- ## [Curl call for PUT and GET query on multi-node es cluster](https://discuss.elastic.co/t/curl-call-for-put-and-get-query-on-multi-node-es-cluster/284942)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 7\ **Last updated:** [September 27, 2021, 12:01am UTC](https://discuss.elastic.co/t/curl-call-for-put-and-get-query-on-multi-node-es-cluster/284942 "2021-09-27T00:01:40Z")
Hi Team, I would like to know on a multi-node Elasticsearch cluster (3 nodes), to which node we can send PUT curl call (say for creating ILM policy) or to fetch some results (by running query)? In a single node cluste… --- ## [Filebeat module Juniper SRX](https://discuss.elastic.co/t/filebeat-module-juniper-srx/285172)
**Author:** [@jam\_mahmoudi](https://discuss.elastic.co/u/jam_mahmoudi)\ **Replies:** 0\ **Last updated:** [September 26, 2021, 4:08pm UTC](https://discuss.elastic.co/t/filebeat-module-juniper-srx/285172 "2021-09-26T16:08:09Z")
Hi. guys For using filebeat module juniper what scenario do I need ? 1- should I send all logs to independent server that has filebaet installed? HOW ? 2- how can I use filebeat module Juniper ? 3-. I have two… --- ## [Logstash fails on startup](https://discuss.elastic.co/t/logstash-fails-on-startup/285170)
**Author:** [@hazenvs](https://discuss.elastic.co/u/hazenvs)\ **Replies:** 2\ **Last updated:** [September 26, 2021, 7:36pm UTC](https://discuss.elastic.co/t/logstash-fails-on-startup/285170 "2021-09-26T19:36:16Z")
So I've narrowed this issue down to this line in my example.conf (/etc/logstash/conf.d/example.conf) input { tcp { port =\> 5002 type =\> syslog } udp { port =\> 5002 type =\> syslog } beats { … --- ## [Weird rebalancing strategy](https://discuss.elastic.co/t/weird-rebalancing-strategy/285034)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 3\ **Last updated:** [September 25, 2021, 9:25pm UTC](https://discuss.elastic.co/t/weird-rebalancing-strategy/285034 "2021-09-25T21:25:17Z")
I am seeing several active recovery tasks where 1 shard is moving from Node A -\> Node B, but at the same time for a different shard, it's moving from Node C to Node A. Wouldn't this cause rebalancing to never end? Why… --- ## [Elasticsearch setup did not complete normally, please review previously logged errors {:message=\>"No Available connections", :exception=\>LogStash::Outputs::ElasticSearch::HttpClient::Pool::NoConnectionAvailableError}](https://discuss.elastic.co/t/elasticsearch-setup-did-not-complete-normally-please-review-previously-logged-errors-message-no-available-connections-exception-logstash-noconnectionavailableerror/285167)
**Author:** [@Bzpo](https://discuss.elastic.co/u/Bzpo)\ **Replies:** 3\ **Last updated:** [September 26, 2021, 6:45pm UTC](https://discuss.elastic.co/t/elasticsearch-setup-did-not-complete-normally-please-review-previously-logged-errors-message-no-available-connections-exception-logstash-noconnectionavailableerror/285167 "2021-09-26T18:45:50Z")
Hello, I am running Logstash and Elasticsearch both in docker. Elasticsearch takes some time to set up after very first build. Logstash at some moment starts to log errors like the one in topic title and even if Elastics… --- ## [Attempting to start Fleet Server fails](https://discuss.elastic.co/t/attempting-to-start-fleet-server-fails/282859)
**Author:** [@Aiden\_Mitchell](https://discuss.elastic.co/u/Aiden_Mitchell)\ **Replies:** 5\ **Last updated:** [September 26, 2021, 6:13pm UTC](https://discuss.elastic.co/t/attempting-to-start-fleet-server-fails/282859 "2021-09-26T18:13:03Z")
Hi there! I'm trying to install Fleet Server using the Quick Start deployment mode on an Ubuntu 20.04 instance and it's failing: 2021-08-30T22:47:54.988Z INFO cmd/enroll\_cmd.go:354 Generating self-signed ce… --- ## [Elastic platinum + gold subscription](https://discuss.elastic.co/t/elastic-platinum-gold-subscription/285059)
**Author:** [@Faycal\_B](https://discuss.elastic.co/u/Faycal_B)\ **Replies:** 3\ **Last updated:** [September 26, 2021, 5:53pm UTC](https://discuss.elastic.co/t/elastic-platinum-gold-subscription/285059 "2021-09-26T17:53:15Z")
Hi, Is it possible to have multiple clusters, platinum license cluster, and free gold license clusters in the same solution destined to be used as a SaaS (commercial) ? with the recent license changes, I am not sure if… --- ## [Runtime Fields](https://discuss.elastic.co/t/runtime-fields/285142)
**Author:** [@Swapnadeep\_Mondal](https://discuss.elastic.co/u/Swapnadeep_Mondal)\ **Replies:** 4\ **Last updated:** [September 26, 2021, 4:27pm UTC](https://discuss.elastic.co/t/runtime-fields/285142 "2021-09-26T16:27:01Z")
According to documentation runtime fields are not indexed. Now if one field is not indexed then it will not searchable or queryable. but then I query on a runtime field it returned me results instead showing "Cannot sear… --- ## [Filebeat unable to connect logstash server](https://discuss.elastic.co/t/filebeat-unable-to-connect-logstash-server/285137)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 23\ **Last updated:** [September 26, 2021, 12:43pm UTC](https://discuss.elastic.co/t/filebeat-unable-to-connect-logstash-server/285137 "2021-09-26T12:43:42Z")
Hi Team, I have installed filebeat on a server which is having IP as 192.168.x.x and filebeat is trying to send events to two logstash servers which are having IPs as 10.20.x.x. Currently i see filebeat service is fai… --- ## [Geoip error while deploying elasticsearch](https://discuss.elastic.co/t/geoip-error-while-deploying-elasticsearch/284080)
**Author:** [@ssen85](https://discuss.elastic.co/u/ssen85)\ **Replies:** 10\ **Last updated:** [September 26, 2021, 6:34am UTC](https://discuss.elastic.co/t/geoip-error-while-deploying-elasticsearch/284080 "2021-09-26T06:34:04Z")
Hi, I'm trying to start a single node elasticsearch cluster using Docker. I get the following error in the startup logs "type": "server", "timestamp": "2021-09-13T13:41:29,255Z", "level": "ERROR", "component": "o.e.i.… --- ## [GET \_doc request not working as expected with routing aliases](https://discuss.elastic.co/t/get-doc-request-not-working-as-expected-with-routing-aliases/285039)
**Author:** [@vineethsuhas](https://discuss.elastic.co/u/vineethsuhas)\ **Replies:** 3\ **Last updated:** [September 26, 2021, 3:55am UTC](https://discuss.elastic.co/t/get-doc-request-not-working-as-expected-with-routing-aliases/285039 "2021-09-26T03:55:28Z")
Hi, Here is the scenario: 1. We created an index (routing\_test) =\> (with 2 Shards) 2. We created a couple of aliases on that index (routing\_test\_100 and routing\_test\_200) using: PUT routing\_test/\_alias/routing\_test\_100… --- ## [Elasticsearch cluster architecture with 6 nodes](https://discuss.elastic.co/t/elasticsearch-cluster-architecture-with-6-nodes/285147)
**Author:** [@dooger21](https://discuss.elastic.co/u/dooger21)\ **Replies:** 1\ **Last updated:** [September 26, 2021, 3:43am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-architecture-with-6-nodes/285147 "2021-09-26T03:43:58Z")
Hi everyone, Please I need your recommendations regarding the following architectures for a 6-node Elasticsearch cluster, based on the following characteristics: I have 2 zones (zn1, zn2) I have 3 nodes or servers in … --- ## [API keys not enabled in Elasticsearch Contact your system administrator and refer to the docs(opens in a new tab or window) to enable API keys](https://discuss.elastic.co/t/api-keys-not-enabled-in-elasticsearch-contact-your-system-administrator-and-refer-to-the-docs-opens-in-a-new-tab-or-window-to-enable-api-keys/285043)
**Author:** [@savan820](https://discuss.elastic.co/u/savan820)\ **Replies:** 5\ **Last updated:** [September 25, 2021, 8:43pm UTC](https://discuss.elastic.co/t/api-keys-not-enabled-in-elasticsearch-contact-your-system-administrator-and-refer-to-the-docs-opens-in-a-new-tab-or-window-to-enable-api-keys/285043 "2021-09-25T20:43:51Z")
API keys not enabled in Elasticsearch Contact your system administrator to enable API keys. how to resolve this? [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1223) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1225)