# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1228 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1229 --- ## [Elastic cluster is unreachable - Logstash with docker](https://discuss.elastic.co/t/elastic-cluster-is-unreachable-logstash-with-docker/284964)
**Author:** [@Rashmika\_Gamage](https://discuss.elastic.co/u/Rashmika_Gamage)\ **Replies:** 0\ **Last updated:** [September 23, 2021, 7:02am UTC](https://discuss.elastic.co/t/elastic-cluster-is-unreachable-logstash-with-docker/284964 "2021-09-23T07:02:25Z")
I have created a ELK cluster with 3 elastic nodes with docker compose. I am getting an error from logstash. I have been trying with several ways. Appreciate you help. My docker-compose.yml version: '2.2' services: es… --- ## [A markdown to show which filter is applied](https://discuss.elastic.co/t/a-markdown-to-show-which-filter-is-applied/284681)
**Author:** [@Anuj\_Zope](https://discuss.elastic.co/u/Anuj_Zope)\ **Replies:** 2\ **Last updated:** [September 23, 2021, 6:57am UTC](https://discuss.elastic.co/t/a-markdown-to-show-which-filter-is-applied/284681 "2021-09-23T06:57:59Z")
Hi! I am using Kibana 7.10. So on a SUMMARY Dashboard lets say I have a table of subjects. I have linked the Subject names as such that clicking it takes you to the Subject Dashboard and filters that dashboard for the … --- ## [Filebeat-json.log size and rotation](https://discuss.elastic.co/t/filebeat-json-log-size-and-rotation/283773)
**Author:** [@greggailly](https://discuss.elastic.co/u/greggailly)\ **Replies:** 3\ **Last updated:** [September 23, 2021, 6:56am UTC](https://discuss.elastic.co/t/filebeat-json-log-size-and-rotation/283773 "2021-09-23T06:56:13Z")
We are having size issues with the filebeat-json.log file. One of our servers had one 122gb filebeat-json.log, are they not supposed to rotate to prevent this ? All of our servers run windows server 2016/2019 and elast… --- ## [Update Field Type](https://discuss.elastic.co/t/update-field-type/284875)
**Author:** [@Brintha](https://discuss.elastic.co/u/Brintha)\ **Replies:** 4\ **Last updated:** [September 23, 2021, 6:26am UTC](https://discuss.elastic.co/t/update-field-type/284875 "2021-09-23T06:26:49Z")
Hello , Can anyone please help me ,how to update field type in existing index .I have no option to reindex .i want to convert long to keyword --- ## [Understanding the role of elastic agent processes running in my local system](https://discuss.elastic.co/t/understanding-the-role-of-elastic-agent-processes-running-in-my-local-system/284961)
**Author:** [@Mann\_Mehta](https://discuss.elastic.co/u/Mann_Mehta)\ **Replies:** 1\ **Last updated:** [September 23, 2021, 6:00am UTC](https://discuss.elastic.co/t/understanding-the-role-of-elastic-agent-processes-running-in-my-local-system/284961 "2021-09-23T06:00:00Z")
After enrolling the elastic agent into my local machine, I see several processes running like elastic\_agent.exe, filebeat.exe, metricbeat.exe etc. I want to know the role of this process in much more detail? Which comm… --- ## [Elastic Agent and Fleet Server Communication](https://discuss.elastic.co/t/elastic-agent-and-fleet-server-communication/284823)
**Author:** [@Mann\_Mehta](https://discuss.elastic.co/u/Mann_Mehta)\ **Replies:** 0\ **Last updated:** [September 22, 2021, 9:06am UTC](https://discuss.elastic.co/t/elastic-agent-and-fleet-server-communication/284823 "2021-09-22T09:06:22Z")
Need a deeper understanding of how authentication workflow is implemented during the first time installation of elastic agent and how the communication of elastic agent with the fleet server is organized. I have gone th… --- ## [Is there a way to force a replica to become primary?](https://discuss.elastic.co/t/is-there-a-way-to-force-a-replica-to-become-primary/284958)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 0\ **Last updated:** [September 23, 2021, 5:25am UTC](https://discuss.elastic.co/t/is-there-a-way-to-force-a-replica-to-become-primary/284958 "2021-09-23T05:25:15Z")
Like my title suggested. Is it possible? My cluster has a rebalancing error where 1 primary shard is stuck in relocating state and I can't recover it. I'm hoping to force the replica to become the primary and configur… --- ## [Field reference from \_source for conditional output](https://discuss.elastic.co/t/field-reference-from-source-for-conditional-output/284956)
**Author:** [@alfianaf](https://discuss.elastic.co/u/alfianaf)\ **Replies:** 4\ **Last updated:** [September 23, 2021, 4:32am UTC](https://discuss.elastic.co/t/field-reference-from-source-for-conditional-output/284956 "2021-09-23T04:32:31Z")
hello, I'm new to logstash conditional, I want to make different index output based on some field reference on my logstash here is my index example : { "\_index": "iris-new-2021.09", "\_type": "\_doc", "\_id": "EKS5E… --- ## [How to read each array item into a map of key value pair?](https://discuss.elastic.co/t/how-to-read-each-array-item-into-a-map-of-key-value-pair/284769)
**Author:** [@Indigo\_Star](https://discuss.elastic.co/u/Indigo_Star)\ **Replies:** 7\ **Last updated:** [September 23, 2021, 3:34am UTC](https://discuss.elastic.co/t/how-to-read-each-array-item-into-a-map-of-key-value-pair/284769 "2021-09-23T03:34:45Z")
I have a multiline message field, msg= "CPU=9% TotalMem=12288 MB FreeMem=3895 MB AMQMemoryPercentUsage=0% n0-kkk size=0 inFlight=0 enqRate=0 deqRate=0 n1-xxx size=1 inFlight=1 enqRate=13 deqRate=2 n2-yyyy-oo si… --- ## [How can I display value outside bars? ELK 7.14](https://discuss.elastic.co/t/how-can-i-display-value-outside-bars-elk-7-14/283308)
**Author:** [@jamesraznor](https://discuss.elastic.co/u/jamesraznor)\ **Replies:** 3\ **Last updated:** [September 23, 2021, 2:49am UTC](https://discuss.elastic.co/t/how-can-i-display-value-outside-bars-elk-7-14/283308 "2021-09-23T02:49:17Z")
Hello Guys ! I would like to know two questions: how can I display the values outside bars (at the top) If not possible, I would be able to increase the size of the number value inside the bar by changing css or somet… --- ## [Enrich processor high cpu load](https://discuss.elastic.co/t/enrich-processor-high-cpu-load/284778)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 7\ **Last updated:** [September 23, 2021, 1:11am UTC](https://discuss.elastic.co/t/enrich-processor-high-cpu-load/284778 "2021-09-23T01:11:57Z")
Hello, I have a couple of filebeats shipping data directly to elasticsearch, when this data hits elasticsearch two ingest pipelines are executed, one from the module, and another one using the final\_pipeline setting, I'… --- ## [Using Metricbeat AWS Module on Private Subnet EC2](https://discuss.elastic.co/t/using-metricbeat-aws-module-on-private-subnet-ec2/283676)
**Author:** [@roh](https://discuss.elastic.co/u/roh)\ **Replies:** 6\ **Last updated:** [September 23, 2021, 12:36am UTC](https://discuss.elastic.co/t/using-metricbeat-aws-module-on-private-subnet-ec2/283676 "2021-09-23T00:36:06Z")
Hi all! My client wants to collect ec2, ebs, rds metrics using Metricbeat on private subnet ec2 instance with AWS module. So I searched for ways to do it. Judging by document, there are common services to reach like IA… --- ## [Unindexed geo\_point field. What am I missing?](https://discuss.elastic.co/t/unindexed-geo-point-field-what-am-i-missing/284482)
**Author:** [@blueren](https://discuss.elastic.co/u/blueren)\ **Replies:** 3\ **Last updated:** [September 23, 2021, 12:13am UTC](https://discuss.elastic.co/t/unindexed-geo-point-field-what-am-i-missing/284482 "2021-09-23T00:13:48Z")
I have an elastic db which takes in netflow data and enriches them. I have two fields that are defined as below, in the template. (can verify that the template exists from Kibana \> index management \> mappings) "dstGeoLo… --- ## [Kibana in ARM64 TypeError: Cannot read properties of null (reading 'message')](https://discuss.elastic.co/t/kibana-in-arm64-typeerror-cannot-read-properties-of-null-reading-message/284814)
**Author:** [@lql2019](https://discuss.elastic.co/u/lql2019)\ **Replies:** 3\ **Last updated:** [September 23, 2021, 12:09am UTC](https://discuss.elastic.co/t/kibana-in-arm64-typeerror-cannot-read-properties-of-null-reading-message/284814 "2021-09-23T00:09:42Z")
I'm using kibana 6.0 to create index-pattern in arm64 linux system, but I often get error message: TypeError: Cannot read properties of null (reading 'message') at http://10.24.37.240:5601/bundles/kibana.bundle.js?v=16… --- ## [Using workpad variables in esql queries](https://discuss.elastic.co/t/using-workpad-variables-in-esql-queries/284235)
**Author:** [@IGB042](https://discuss.elastic.co/u/IGB042)\ **Replies:** 2\ **Last updated:** [September 22, 2021, 10:51pm UTC](https://discuss.elastic.co/t/using-workpad-variables-in-esql-queries/284235 "2021-09-22T22:51:54Z")
I am developing a report in Canvas currently and several elements use the same field within their esql queries. As it is intended that this workpad would be cloned it would be really useful to use a variable in the query … --- ## [Multiple index Search using php client](https://discuss.elastic.co/t/multiple-index-search-using-php-client/284839)
**Author:** [@Jihad\_Abdulrazaq](https://discuss.elastic.co/u/Jihad_Abdulrazaq)\ **Replies:** 3\ **Last updated:** [September 22, 2021, 10:49pm UTC](https://discuss.elastic.co/t/multiple-index-search-using-php-client/284839 "2021-09-22T22:49:24Z")
Hello All, When searching across multiple indices, how to get the index name in search results using php client methods? Please your support, thanks all. --- ## [ELK SIZING](https://discuss.elastic.co/t/elk-sizing/284945)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 0\ **Last updated:** [September 22, 2021, 9:52pm UTC](https://discuss.elastic.co/t/elk-sizing/284945 "2021-09-22T21:52:41Z")
Hello Evry body, I want to deploy an ELK with the architecture: Server for master node (kibana) Server for Elasticsearch hot Server fot Elasticsearch WARM Server logstash With 23 GB data by day and the re… --- ## [Snapshot Restore - Index green & present with data, but missing data](https://discuss.elastic.co/t/snapshot-restore-index-green-present-with-data-but-missing-data/284944)
**Author:** [@elasticband](https://discuss.elastic.co/u/elasticband)\ **Replies:** 0\ **Last updated:** [September 22, 2021, 9:30pm UTC](https://discuss.elastic.co/t/snapshot-restore-index-green-present-with-data-but-missing-data/284944 "2021-09-22T21:30:53Z")
Hello everyone, I am fairly new to this whole ES thing, but I am getting through the trial by fire on my first misconfiguration. I ended up doing a snapshots from my multi node cluster and restored it to a single node t… --- ## [How to write multiline codec for python stacktrace](https://discuss.elastic.co/t/how-to-write-multiline-codec-for-python-stacktrace/284936)
**Author:** [@Chandrakant\_Naik](https://discuss.elastic.co/u/Chandrakant_Naik)\ **Replies:** 3\ **Last updated:** [September 22, 2021, 8:50pm UTC](https://discuss.elastic.co/t/how-to-write-multiline-codec-for-python-stacktrace/284936 "2021-09-22T20:50:11Z")
below is how my log is captured \[2021-09-17 14:24:16,527\] \[ERROR\] \[app\]\[MainThread\] \[5d9b63a9-dc4d-4756-af87-eba4fb275584\] \[log\_exception:1440\] : Exception on /download\_request\_data \[GET\] Traceback (most recent call las… --- ## [Elasticsearch missing results and incorrect sorting](https://discuss.elastic.co/t/elasticsearch-missing-results-and-incorrect-sorting/284930)
**Author:** [@Mike\_Miller](https://discuss.elastic.co/u/Mike_Miller)\ **Replies:** 2\ **Last updated:** [September 22, 2021, 8:30pm UTC](https://discuss.elastic.co/t/elasticsearch-missing-results-and-incorrect-sorting/284930 "2021-09-22T20:30:12Z")
I have Elasticsearch setup for searching book content. It works for the most part, however it frequently misses single search terms, especially in the 'entryTitle'. An example is in one book there is a Section title call… --- ## [How to use .conut to exclude a character from the .length count?](https://discuss.elastic.co/t/how-to-use-conut-to-exclude-a-character-from-the-length-count/284938)
**Author:** [@Rauly\_Koto](https://discuss.elastic.co/u/Rauly_Koto)\ **Replies:** 1\ **Last updated:** [September 22, 2021, 8:21pm UTC](https://discuss.elastic.co/t/how-to-use-conut-to-exclude-a-character-from-the-length-count/284938 "2021-09-22T20:21:24Z")
Currently it does the account but does not delete the "/". ruby { code =\> ' event.set("execution\_length\_input", event.get("\[execution\]\[input\]").to\_s.length - ("\[execution\]\[input\]… --- ## [Convert int to DateTime in Nest query?](https://discuss.elastic.co/t/convert-int-to-datetime-in-nest-query/284937)
**Author:** [@bensalerno](https://discuss.elastic.co/u/bensalerno)\ **Replies:** 0\ **Last updated:** [September 22, 2021, 7:45pm UTC](https://discuss.elastic.co/t/convert-int-to-datetime-in-nest-query/284937 "2021-09-22T19:45:53Z")
I am attempting to query an ES cluster through Nest. However, I'm having an issue because my types are not matching. This is the C# side: As you can see CreatedTimeStamp is a DateTime. However, this is what I recei… --- ## [Elastic search will not bind to port 80 (no web server is running)](https://discuss.elastic.co/t/elastic-search-will-not-bind-to-port-80-no-web-server-is-running/284658)
**Author:** [@lsnwebmaster](https://discuss.elastic.co/u/lsnwebmaster)\ **Replies:** 6\ **Last updated:** [September 22, 2021, 7:30pm UTC](https://discuss.elastic.co/t/elastic-search-will-not-bind-to-port-80-no-web-server-is-running/284658 "2021-09-22T19:30:55Z")
I am trying elasticsearch as a standalone search for WordPress. I created a new server on Ubuntu 20.04 LTS with nothing but elasticsearch. I did nothing to the config file, accepting all defaults. It started fine on port… --- ## [Kibana CSV Export Error](https://discuss.elastic.co/t/kibana-csv-export-error/284254)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 7\ **Last updated:** [September 22, 2021, 7:10pm UTC](https://discuss.elastic.co/t/kibana-csv-export-error/284254 "2021-09-22T19:10:13Z")
Hi I have a problem about exporting logs to CSV file according to the bellow picture: Users have reporting\_user role. The file is less than 10mb and contains few rows. How can I solve this issue --- ## [APT repository failing](https://discuss.elastic.co/t/apt-repository-failing/284915)
**Author:** [@armov](https://discuss.elastic.co/u/armov)\ **Replies:** 3\ **Last updated:** [September 22, 2021, 6:55pm UTC](https://discuss.elastic.co/t/apt-repository-failing/284915 "2021-09-22T18:55:45Z")
Elasticsearch repository in a Ubuntu focal 20.04 throws the following error while attempting to update apt: E: Failed to fetch https://artifacts.elastic.co/packages/7.x/apt/dists/stable/main/binary-amd64/Packages.bz2 F… --- ## [Extracting string from log path](https://discuss.elastic.co/t/extracting-string-from-log-path/284748)
**Author:** [@Bkumar](https://discuss.elastic.co/u/Bkumar)\ **Replies:** 9\ **Last updated:** [September 22, 2021, 6:30pm UTC](https://discuss.elastic.co/t/extracting-string-from-log-path/284748 "2021-09-22T18:30:59Z")
Hi, As per requirement, i can't put the tag to filebeat to filter log path at logstash end. So only option left with me to filter the log path on the basis of string. Here is the sample log path- /opt/tomcat/instances… --- ## [Url.query field loss occurred when useing iis module (ver 7.14.1)](https://discuss.elastic.co/t/url-query-field-loss-occurred-when-useing-iis-module-ver-7-14-1/284926)
**Author:** [@e997cd7e8d9915436150](https://discuss.elastic.co/u/e997cd7e8d9915436150)\ **Replies:** 0\ **Last updated:** [September 22, 2021, 6:27pm UTC](https://discuss.elastic.co/t/url-query-field-loss-occurred-when-useing-iis-module-ver-7-14-1/284926 "2021-09-22T18:27:14Z")
Actual url parameters are 7,757 out of 215,586 pieces of log. (exclude log header) But i can see only 7,735 pieces of parameters after gathered by iis module. I guess there is a problem in the process of deleti… --- ## [Create DrillDown not available in Kibana 7.10 OSS version](https://discuss.elastic.co/t/create-drilldown-not-available-in-kibana-7-10-oss-version/284851)
**Author:** [@Prathibha\_Y](https://discuss.elastic.co/u/Prathibha_Y)\ **Replies:** 1\ **Last updated:** [September 22, 2021, 6:14pm UTC](https://discuss.elastic.co/t/create-drilldown-not-available-in-kibana-7-10-oss-version/284851 "2021-09-22T18:14:24Z")
Hi, "Create Drill Down" is not visible in kibana 7.10.0 oss version, want to know if it is a paid feature? Thanks Prathibha --- ## [A way to visualize changes in a document from week to week](https://discuss.elastic.co/t/a-way-to-visualize-changes-in-a-document-from-week-to-week/284791)
**Author:** [@Mauro\_Julian\_Fernand](https://discuss.elastic.co/u/Mauro_Julian_Fernand)\ **Replies:** 2\ **Last updated:** [September 22, 2021, 5:59pm UTC](https://discuss.elastic.co/t/a-way-to-visualize-changes-in-a-document-from-week-to-week/284791 "2021-09-22T17:59:49Z")
I'm currently developing a script which ingests documents to a Elasticsearch index which contains data from a network discovery { "\_index": "device\_discovery", "\_type": "\_doc", "\_id": "YAySBnwBWvky… --- ## [Elasticsearch System Parameter for ASYNC IO](https://discuss.elastic.co/t/elasticsearch-system-parameter-for-async-io/284750)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 7\ **Last updated:** [September 22, 2021, 5:50pm UTC](https://discuss.elastic.co/t/elasticsearch-system-parameter-for-async-io/284750 "2021-09-22T17:50:15Z")
Hello Team I am using Elasticsearch version 7.8.0. I understand that Elasticsearch uses ASYNC IO to perform document indexing ... I would like to know in /etc/sysctl.conf minimum values required for ASYNC IO aio-max… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1227) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1229)