# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1234 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1235 --- ## [Elasticsearch snapshot and restore best practices](https://discuss.elastic.co/t/elasticsearch-snapshot-and-restore-best-practices/284141)
**Author:** [@eolver](https://discuss.elastic.co/u/eolver)\ **Replies:** 9\ **Last updated:** [September 20, 2021, 5:59am UTC](https://discuss.elastic.co/t/elasticsearch-snapshot-and-restore-best-practices/284141 "2021-09-20T05:59:37Z")
Hi All, I want to know the best way, to store elastic data for recovery. Currently we had each cluster hosted in azure and the cluster backed up daily using RSV. However we wanted to do more frequently snapshots which… --- ## [Date histogram for Bucket Aggregation](https://discuss.elastic.co/t/date-histogram-for-bucket-aggregation/284592)
**Author:** [@Manisekhar\_techo](https://discuss.elastic.co/u/Manisekhar_techo)\ **Replies:** 0\ **Last updated:** [September 20, 2021, 5:43am UTC](https://discuss.elastic.co/t/date-histogram-for-bucket-aggregation/284592 "2021-09-20T05:43:07Z")
Hi, I have a terms bucket aggregation on a field. is there a way to get the date histogram for each of the listed Bucket items received from terms aggregation. Something like this. this isn't working but just to give t… --- ## [How i can calculate the cluster nodes size like RAM, CPU and Disk](https://discuss.elastic.co/t/how-i-can-calculate-the-cluster-nodes-size-like-ram-cpu-and-disk/283933)
**Author:** [@elastic\_dev](https://discuss.elastic.co/u/elastic_dev)\ **Replies:** 9\ **Last updated:** [September 20, 2021, 5:14am UTC](https://discuss.elastic.co/t/how-i-can-calculate-the-cluster-nodes-size-like-ram-cpu-and-disk/283933 "2021-09-20T05:14:56Z")
HI, I am trying to figure how should I calculate my nodes size, its RAM, CPU, and Disk. If I have data of around 10G. On basis of what I should calculate nodes size. Can anyone guide me, please? --- ## [NEST indexing missing documents without errors](https://discuss.elastic.co/t/nest-indexing-missing-documents-without-errors/284370)
**Author:** [@Vyil](https://discuss.elastic.co/u/Vyil)\ **Replies:** 1\ **Last updated:** [September 20, 2021, 4:58am UTC](https://discuss.elastic.co/t/nest-indexing-missing-documents-without-errors/284370 "2021-09-20T04:58:46Z")
Hi there, So i'm trying to index around 636k documents into my ES node. I have a 1 node cluster where i end up with around 550k/636k documents, and i don't get any error messages at all while indexing. Then i try on my… --- ## [Viewing JSON result or Object of ES query?](https://discuss.elastic.co/t/viewing-json-result-or-object-of-es-query/284420)
**Author:** [@bensalerno](https://discuss.elastic.co/u/bensalerno)\ **Replies:** 0\ **Last updated:** [September 16, 2021, 3:35pm UTC](https://discuss.elastic.co/t/viewing-json-result-or-object-of-es-query/284420 "2021-09-16T15:35:50Z")
I apologize if this is a stupid question, newcomer here. I have a ES cluster that I'm trying to search through and view the result in JSON format. Right now, this is what I'm doing in a very basic example. … --- ## [Metricbeat doesnt create event when service is down](https://discuss.elastic.co/t/metricbeat-doesnt-create-event-when-service-is-down/284424)
**Author:** [@Deny7](https://discuss.elastic.co/u/Deny7)\ **Replies:** 0\ **Last updated:** [September 16, 2021, 4:59pm UTC](https://discuss.elastic.co/t/metricbeat-doesnt-create-event-when-service-is-down/284424 "2021-09-16T16:59:36Z")
Hi, Hi, Im using Metricbeat 7.9 and Elastalert for filesystem usage for each mountpoint. I also want to add alerting when linux service is stopped, so I enabled "- service" and "-process" in metricbeat.reference.yml. Wh… --- ## [Container vs Dedicated Instances Benchmarks](https://discuss.elastic.co/t/container-vs-dedicated-instances-benchmarks/284460)
**Author:** [@ithfdemir](https://discuss.elastic.co/u/ithfdemir)\ **Replies:** 1\ **Last updated:** [September 20, 2021, 4:49am UTC](https://discuss.elastic.co/t/container-vs-dedicated-instances-benchmarks/284460 "2021-09-20T04:49:08Z")
Hi, I have an Elasticsearch cluster (71 Nodes (64 data + 7 master) running in 16 dedicated servers). I'm considering about containerization for this running cluster. Is it possible? If yes, is there any benchmarks or no… --- ## [Search all indices and exclude one](https://discuss.elastic.co/t/search-all-indices-and-exclude-one/284498)
**Author:** [@schawla](https://discuss.elastic.co/u/schawla)\ **Replies:** 2\ **Last updated:** [September 20, 2021, 4:39am UTC](https://discuss.elastic.co/t/search-all-indices-and-exclude-one/284498 "2021-09-20T04:39:06Z")
How can we search all indices across elastic search and exlude one from the list. Something like Nest.Indices search = "\_all,-kibana" --- ## [Nest returning results as IReadOnlyCollection, how to change it so it is usable?](https://discuss.elastic.co/t/nest-returning-results-as-ireadonlycollection-how-to-change-it-so-it-is-usable/284512)
**Author:** [@bensalerno](https://discuss.elastic.co/u/bensalerno)\ **Replies:** 0\ **Last updated:** [September 17, 2021, 7:40pm UTC](https://discuss.elastic.co/t/nest-returning-results-as-ireadonlycollection-how-to-change-it-so-it-is-usable/284512 "2021-09-17T19:40:31Z")
Using elasticsearch, I'm trying to add my hit results into a list after they are returned, like this: var lstModels = new SearchResult\(); var searchResponse = Event.client.Search\(s =\> s … --- ## [Elastic Search Index Mapping](https://discuss.elastic.co/t/elastic-search-index-mapping/284511)
**Author:** [@yun983](https://discuss.elastic.co/u/yun983)\ **Replies:** 7\ **Last updated:** [September 20, 2021, 4:35am UTC](https://discuss.elastic.co/t/elastic-search-index-mapping/284511 "2021-09-20T04:35:58Z")
NEED HELP...... I am trying to add a an array of dictionaries as a field in existing elastic search cluster. Previously my data looked like this: "businessBureauId": "3699", "businessRecordId": "3699", "businessR… --- ## [Caused by: org.elasticsearch.action.UnavailableShardsException: \[.monitoring-es-7-2021.09.17\]\[0\] primary shard is not active Timeout: \[1m\], request: \[BulkShardRequest \[\[.monitoring-es-7-2021.09.17\]\[0\]\] containing \[463\] requests\] ... 11 more](https://discuss.elastic.co/t/caused-by-org-elasticsearch-action-unavailableshardsexception-monitoring-es-7-2021-09-17-0-primary-shard-is-not-active-timeout-1m-request-bulkshardrequest-monitoring-es-7-2021-09-17-0-containing-463-requests-11-more/284520)
**Author:** [@Ashwin\_Patil1](https://discuss.elastic.co/u/Ashwin_Patil1)\ **Replies:** 1\ **Last updated:** [September 20, 2021, 4:34am UTC](https://discuss.elastic.co/t/caused-by-org-elasticsearch-action-unavailableshardsexception-monitoring-es-7-2021-09-17-0-primary-shard-is-not-active-timeout-1m-request-bulkshardrequest-monitoring-es-7-2021-09-17-0-containing-463-requests-11-more/284520 "2021-09-20T04:34:42Z")
How to troubleshoot the following? Caused by: org.elasticsearch.action.UnavailableShardsException: \[.monitoring-es-7-2021.09.17\]\[0\] primary shard is not active Timeout: \[1m\], request: \[BulkShardRequest \[\[.monitoring-es-… --- ## [Can't scale ElasticSearch cluster](https://discuss.elastic.co/t/cant-scale-elasticsearch-cluster/284577)
**Author:** [@mxmtrms](https://discuss.elastic.co/u/mxmtrms)\ **Replies:** 1\ **Last updated:** [September 20, 2021, 4:17am UTC](https://discuss.elastic.co/t/cant-scale-elasticsearch-cluster/284577 "2021-09-20T04:17:35Z")
Hello everyone! Prerequisites For the last year my team and I have been developing a project in which we decided to use ElasticSearch. In the early stages of development, we used a simple single-node cluster that more … --- ## [Getting Error-Cannot delete files/directories outside the current working directory when i wants to generate visualization report in pdf](https://discuss.elastic.co/t/getting-error-cannot-delete-files-directories-outside-the-current-working-directory-when-i-wants-to-generate-visualization-report-in-pdf/283633)
**Author:** [@syed0510](https://discuss.elastic.co/u/syed0510)\ **Replies:** 28\ **Last updated:** [September 20, 2021, 4:21am UTC](https://discuss.elastic.co/t/getting-error-cannot-delete-files-directories-outside-the-current-working-directory-when-i-wants-to-generate-visualization-report-in-pdf/283633 "2021-09-20T04:21:49Z")
Kibana Version: 7.6.1 ElasticSearch version- 6.4.0 Getting address invalid error when wants to generate visualization report in pdf{attaching screenshot of error }. Attaching log files details also. log file is sh… --- ## [Logstash service getting restarted after trying to set keystore on \`v7.14\`](https://discuss.elastic.co/t/logstash-service-getting-restarted-after-trying-to-set-keystore-on-v7-14/284582)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 15\ **Last updated:** [September 20, 2021, 2:28am UTC](https://discuss.elastic.co/t/logstash-service-getting-restarted-after-trying-to-set-keystore-on-v7-14/284582 "2021-09-20T02:28:40Z")
Hi Team, I am trying to set logstash keystore but having hard time. I have refer below link but still its not working. (not creating keystore password from below) I am creating keystore as, echo y | /usr/share/log… --- ## [Zabbix 5.4, unable send data to Elastic Search (date field)](https://discuss.elastic.co/t/zabbix-5-4-unable-send-data-to-elastic-search-date-field/284585)
**Author:** [@denisb](https://discuss.elastic.co/u/denisb)\ **Replies:** 0\ **Last updated:** [September 20, 2021, 12:34am UTC](https://discuss.elastic.co/t/zabbix-5-4-unable-send-data-to-elastic-search-date-field/284585 "2021-09-20T00:34:49Z")
Hello everybody. There is zabbix 5.4 and Elastic Search 7.11.2. Problem: Can't send data over zabbix\_sender to the element type "zabbix trapper" Error: elastic\_writer\_flush() cannot send data to elasticsearch: index… --- ## [Is there a .NET client for VSCode?](https://discuss.elastic.co/t/is-there-a-net-client-for-vscode/284215)
**Author:** [@bensalerno](https://discuss.elastic.co/u/bensalerno)\ **Replies:** 4\ **Last updated:** [September 19, 2021, 10:55pm UTC](https://discuss.elastic.co/t/is-there-a-net-client-for-vscode/284215 "2021-09-19T22:55:22Z")
I am trying to create a file to write ElasticSearch queries from C#. I have seen that there is are 2 official ElasticSearch clients for .NET (Introduction | Elasticsearch.Net and NEST: the .NET clients \[7.x\] | Elastic) h… --- ## [Failed to Parse Date Field](https://discuss.elastic.co/t/failed-to-parse-date-field/284576)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 2\ **Last updated:** [September 19, 2021, 10:34pm UTC](https://discuss.elastic.co/t/failed-to-parse-date-field/284576 "2021-09-19T22:34:18Z")
I have some CSV files I'm trying to ingest using Logstash's CVS filter plugin. I'm needing the "Date" column to represent the event time field in Kibana (rather than @timestamp, which just tells me when I imported the CS… --- ## [Kibana Showing partial data for Mulesoft API's. Urgent help needed](https://discuss.elastic.co/t/kibana-showing-partial-data-for-mulesoft-apis-urgent-help-needed/284301)
**Author:** [@haribabu.vadlapati](https://discuss.elastic.co/u/haribabu.vadlapati)\ **Replies:** 3\ **Last updated:** [September 19, 2021, 10:09pm UTC](https://discuss.elastic.co/t/kibana-showing-partial-data-for-mulesoft-apis-urgent-help-needed/284301 "2021-09-19T22:09:33Z")
Hello Elastic Community, We are using ELK Stack to monitor Mulesoft cle framework log feeding using filebeat configuration installed on Linux Servers(same servers hosting JV services). We also have different Elastic se… --- ## [Lifecycle policy setting index read-only even with the option disabled](https://discuss.elastic.co/t/lifecycle-policy-setting-index-read-only-even-with-the-option-disabled/284572)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 1\ **Last updated:** [September 19, 2021, 4:07pm UTC](https://discuss.elastic.co/t/lifecycle-policy-setting-index-read-only-even-with-the-option-disabled/284572 "2021-09-19T16:07:43Z")
Hello, I have a hot-warm architecture and a couple of ILM that will move the index from the hot nodes to the warm nodes based on the age. I have an index that is created daily and is moved to the warm nodes after 7 day… --- ## [Logstash bug while removing field](https://discuss.elastic.co/t/logstash-bug-while-removing-field/284562)
**Author:** [@zeoiioze](https://discuss.elastic.co/u/zeoiioze)\ **Replies:** 0\ **Last updated:** [September 19, 2021, 12:13pm UTC](https://discuss.elastic.co/t/logstash-bug-while-removing-field/284562 "2021-09-19T12:13:57Z")
Hey, I realized that the following line : remove\_field =\> \[ "\[doc\]\[vegetables\]\[%{\[tmp\_vegetable\_data\]\[name\]}\]" \] Was not only removing \[doc\]\[vegetables\]\[%{\[tmp\_vegetable\_data\]\[name\]}\], but was also like removing \[tmp\_… --- ## [Filebeat add\_id processor mechanism](https://discuss.elastic.co/t/filebeat-add-id-processor-mechanism/284560)
**Author:** [@Musketeer7](https://discuss.elastic.co/u/Musketeer7)\ **Replies:** 0\ **Last updated:** [September 19, 2021, 11:13am UTC](https://discuss.elastic.co/t/filebeat-add-id-processor-mechanism/284560 "2021-09-19T11:13:36Z")
Hello everyone. I have this relatively large cluster of ES, where logs from many filebeat instances are being shipped into. There are plenty of duplicates, that we can't identify their origin for sure. And because of re… --- ## [Can't send winlogbeat data to logstash](https://discuss.elastic.co/t/cant-send-winlogbeat-data-to-logstash/284489)
**Author:** [@Minh\_Ti\_n\_Tr\_n](https://discuss.elastic.co/u/Minh_Ti_n_Tr_n)\ **Replies:** 2\ **Last updated:** [September 19, 2021, 10:51am UTC](https://discuss.elastic.co/t/cant-send-winlogbeat-data-to-logstash/284489 "2021-09-19T10:51:23Z")
Hi all, I now do the ELK lab with docker The repo: https://github.com/deviantony/docker-elk/ ELK stack host IP: 192.168.87.52 My logstash/pipeline/logstash.conf input { beats { port =\> 5044 … --- ## [Remove the number from the field, and only remain letter](https://discuss.elastic.co/t/remove-the-number-from-the-field-and-only-remain-letter/284548)
**Author:** [@zaidsalah](https://discuss.elastic.co/u/zaidsalah)\ **Replies:** 5\ **Last updated:** [September 19, 2021, 10:23am UTC](https://discuss.elastic.co/t/remove-the-number-from-the-field-and-only-remain-letter/284548 "2021-09-19T10:23:35Z")
remove the number from the field, only I want letter . in my PDF have table contain name and id, id is number when I index and using ingest attachment pipeline number will store as well like this id name 123 user… --- ## [How can I combine some mysql query events with logstash aggregate filter?](https://discuss.elastic.co/t/how-can-i-combine-some-mysql-query-events-with-logstash-aggregate-filter/284533)
**Author:** [@e-fo](https://discuss.elastic.co/u/e-fo)\ **Replies:** 2\ **Last updated:** [September 19, 2021, 6:13am UTC](https://discuss.elastic.co/t/how-can-i-combine-some-mysql-query-events-with-logstash-aggregate-filter/284533 "2021-09-19T06:13:09Z")
Hello, I implemented pipeline with JDBC input plugin, my table in mysql follow the EAV (Entity-Attribute-Value) structure, therefore I can't get all attributes that related to one user (Entity) in one row with mysql que… --- ## [Handling of gigantic unsearchable fields](https://discuss.elastic.co/t/handling-of-gigantic-unsearchable-fields/284552)
**Author:** [@typewar](https://discuss.elastic.co/u/typewar)\ **Replies:** 0\ **Last updated:** [September 19, 2021, 5:52am UTC](https://discuss.elastic.co/t/handling-of-gigantic-unsearchable-fields/284552 "2021-09-19T05:52:20Z")
Hello. I was wondering what good methods for handling gigantic fields are? Let's say a document has an array field for unique visitors of a post, so it will save the ip or the username in this array. If the post now … --- ## [Zeek & ELK integration (A lot of strange fields)](https://discuss.elastic.co/t/zeek-elk-integration-a-lot-of-strange-fields/284547)
**Author:** [@test\_qweqwe](https://discuss.elastic.co/u/test_qweqwe)\ **Replies:** 4\ **Last updated:** [September 18, 2021, 9:02pm UTC](https://discuss.elastic.co/t/zeek-elk-integration-a-lot-of-strange-fields/284547 "2021-09-18T21:02:23Z")
Hi there, I set up ELK and then beats on Zeek server to send data to Elasticsearch. Everything is good except one: there are a lot of fields - 308 And it creates an element of inconvenience for me to create a searc… --- ## [How to match 2 key value pairs in unstructured string that looks like column](https://discuss.elastic.co/t/how-to-match-2-key-value-pairs-in-unstructured-string-that-looks-like-column/284541)
**Author:** [@ansamHox](https://discuss.elastic.co/u/ansamHox)\ **Replies:** 10\ **Last updated:** [September 18, 2021, 7:15pm UTC](https://discuss.elastic.co/t/how-to-match-2-key-value-pairs-in-unstructured-string-that-looks-like-column/284541 "2021-09-18T19:15:51Z")
I have a document with some lines like: Example requested: 24:00:00 Example Used: 01:14:11 What I want is to have is: { "example\_requested": "24:00:00", "example\_used": 01:14:11 } What I tried (t… --- ## [Check if a field exists](https://discuss.elastic.co/t/check-if-a-field-exists/284545)
**Author:** [@zeoiioze](https://discuss.elastic.co/u/zeoiioze)\ **Replies:** 1\ **Last updated:** [September 18, 2021, 4:25pm UTC](https://discuss.elastic.co/t/check-if-a-field-exists/284545 "2021-09-18T16:25:50Z")
I'm using nested fields and a field name in the nested field name, as you can see below (example) : \[doc\]\[vegetables\]\[%{\[tmp\_data\]\[vegetable\_name\]}\]\[number\] The field above is getting created, but now, I want in anot… --- ## ["suggest\_mode": "always" doesn't work for term suggester](https://discuss.elastic.co/t/suggest-mode-always-doesnt-work-for-term-suggester/284537)
**Author:** [@Tomohiro](https://discuss.elastic.co/u/Tomohiro)\ **Replies:** 0\ **Last updated:** [September 18, 2021, 7:56am UTC](https://discuss.elastic.co/t/suggest-mode-always-doesnt-work-for-term-suggester/284537 "2021-09-18T07:56:07Z")
Hello everyone. I'm a rookie cloud developer who is working on a full stack web service. We are introducing elasticsearch to fetch suggestions of movie title. The problem is suggestions couldn't be fetched when the que… --- ## [DSL Query to search in message field for some value and it must not contain something else](https://discuss.elastic.co/t/dsl-query-to-search-in-message-field-for-some-value-and-it-must-not-contain-something-else/284450)
**Author:** [@mguttula](https://discuss.elastic.co/u/mguttula)\ **Replies:** 1\ **Last updated:** [September 18, 2021, 7:35am UTC](https://discuss.elastic.co/t/dsl-query-to-search-in-message-field-for-some-value-and-it-must-not-contain-something-else/284450 "2021-09-18T07:35:25Z")
Trying to come up with a query to search "message" field for something like "Hello" and also the field must not contain strings like "Test" "TestProcess". "UpdatingTestProcess" Below are sample messages: Message: Hel… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1233) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1235)