# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1239 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1240 --- ## [Impact of group\_events on Filebeat and Kafka efficiency](https://discuss.elastic.co/t/impact-of-group-events-on-filebeat-and-kafka-efficiency/283414)
**Author:** [@md2](https://discuss.elastic.co/u/md2)\ **Replies:** 1\ **Last updated:** [September 15, 2021, 6:43am UTC](https://discuss.elastic.co/t/impact-of-group-events-on-filebeat-and-kafka-efficiency/283414 "2021-09-15T06:43:10Z")
Hello team, I have a pretty large fleet of Filebeat instances and all of them ship events to a Kafka cluster with multiple brokers which then got consumed by Logstash. I am currently researching on how to configure File… --- ## [I want to set up sending notifications about errors](https://discuss.elastic.co/t/i-want-to-set-up-sending-notifications-about-errors/283287)
**Author:** [@sasha198407](https://discuss.elastic.co/u/sasha198407)\ **Replies:** 8\ **Last updated:** [September 15, 2021, 6:13am UTC](https://discuss.elastic.co/t/i-want-to-set-up-sending-notifications-about-errors/283287 "2021-09-15T06:13:27Z")
Hello. I want to set up sending notifications about errors (errors in the operation of Apache, MySQL, Nginx, as well as if the server is not available) from logstesh to e-mail. Wrote at ./logstash/pipeline/logstash.conf … --- ## [Going from 6.8.15 to 6.8.18 should be no issue correct](https://discuss.elastic.co/t/going-from-6-8-15-to-6-8-18-should-be-no-issue-correct/284198)
**Author:** [@cis4life](https://discuss.elastic.co/u/cis4life)\ **Replies:** 4\ **Last updated:** [September 15, 2021, 5:29am UTC](https://discuss.elastic.co/t/going-from-6-8-15-to-6-8-18-should-be-no-issue-correct/284198 "2021-09-15T05:29:23Z")
Good Day, I have a cluster that has ES 6.8.15 install and see that 6.8.18 is there to upgrade to. This should be a straight forward upgrade correct. Everything is currently working in our cluster, but I wanted to make… --- ## [Elasticsearch 7.8.1 maximum shards open error](https://discuss.elastic.co/t/elasticsearch-7-8-1-maximum-shards-open-error/284234)
**Author:** [@ManOfDestiny](https://discuss.elastic.co/u/ManOfDestiny)\ **Replies:** 2\ **Last updated:** [September 15, 2021, 5:17am UTC](https://discuss.elastic.co/t/elasticsearch-7-8-1-maximum-shards-open-error/284234 "2021-09-15T05:17:01Z")
How can I solve this problem? Env 1. elsticsearch version : 7.8.1 2. cluster 1) master node 3EA 2) data Node : 7EA ConfigFile : elasticsearch.yml cluster.max\_shards\_per\_node: 10000 Cluster setting GET /\_clust… --- ## [Routing to an Index Partition - Custom Routing](https://discuss.elastic.co/t/routing-to-an-index-partition-custom-routing/284240)
**Author:** [@sudhir-ch](https://discuss.elastic.co/u/sudhir-ch)\ **Replies:** 0\ **Last updated:** [September 15, 2021, 3:28am UTC](https://discuss.elastic.co/t/routing-to-an-index-partition-custom-routing/284240 "2021-09-15T03:28:31Z")
Hi, I have configured the index such that custom routing values will go to a subset of the shards rather than a single shard by providing the index level setting "index.routing\_partition\_size" at index creation. Index … --- ## [Rally is not able to manage multiple types](https://discuss.elastic.co/t/rally-is-not-able-to-manage-multiple-types/283577)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 6\ **Last updated:** [September 15, 2021, 2:43am UTC](https://discuss.elastic.co/t/rally-is-not-able-to-manage-multiple-types/283577 "2021-09-15T02:43:46Z")
Hey there, I created a custom track from an existing index that includes several document types (at least 3). Can I know how to use this track during the import phase to have the correct imported type? If I specify ta… --- ## [The rebalancing task lasted for more than a week without stopping, and the balance has not been reached](https://discuss.elastic.co/t/the-rebalancing-task-lasted-for-more-than-a-week-without-stopping-and-the-balance-has-not-been-reached/284020)
**Author:** [@liwanjie](https://discuss.elastic.co/u/liwanjie)\ **Replies:** 17\ **Last updated:** [September 15, 2021, 2:32am UTC](https://discuss.elastic.co/t/the-rebalancing-task-lasted-for-more-than-a-week-without-stopping-and-the-balance-has-not-been-reached/284020 "2021-09-15T02:32:51Z")
version ：7.10.2 My cluster has a total of 30 machines, one machine has two data nodes, so there are a total of 60 nodes i add a dataNode to cluster，and then the rebalance tasks started... but a week has passed，rebalan… --- ## [Kibana - Is the translation to pt-BR still working the same since 2019?](https://discuss.elastic.co/t/kibana-is-the-translation-to-pt-br-still-working-the-same-since-2019/284193)
**Author:** [@medina](https://discuss.elastic.co/u/medina)\ **Replies:** 3\ **Last updated:** [September 15, 2021, 2:29am UTC](https://discuss.elastic.co/t/kibana-is-the-translation-to-pt-br-still-working-the-same-since-2019/284193 "2021-09-15T02:29:28Z")
I need to translate kibana to pt-BR and I'm new to Kibana (and how it's plugins work). I checked this link Translating Kibana to pt-BR - Elastic Stack / Kibana - Discuss the Elastic Stack and I was wondering if it still… --- ## [Elasticsearch7.5 routing hash function](https://discuss.elastic.co/t/elasticsearch7-5-routing-hash-function/284187)
**Author:** [@chenchuangc](https://discuss.elastic.co/u/chenchuangc)\ **Replies:** 0\ **Last updated:** [September 14, 2021, 1:15pm UTC](https://discuss.elastic.co/t/elasticsearch7-5-routing-hash-function/284187 "2021-09-14T13:15:37Z")
the Elasticsearch routine description like this routing\_factor = num\_routing\_shards / num\_primary\_shards shard\_num = (hash(\_routing) % num\_routing\_shards) / routing\_factor i want to know the hash function so that i … --- ## [Packetbeat: Decode Https Traffic](https://discuss.elastic.co/t/packetbeat-decode-https-traffic/284194)
**Author:** [@Claudio\_Ract\_Costa](https://discuss.elastic.co/u/Claudio_Ract_Costa)\ **Replies:** 3\ **Last updated:** [September 15, 2021, 12:57am UTC](https://discuss.elastic.co/t/packetbeat-decode-https-traffic/284194 "2021-09-15T00:57:12Z")
Hi Folks, Is there any way to decode https/ssl traffic using packetbeat ? I have to server/client key do decode the traffic but i dont know how can i use it to decode the traffic. Thks --- ## [Filebeat dont send Logs to Kafka](https://discuss.elastic.co/t/filebeat-dont-send-logs-to-kafka/284200)
**Author:** [@Robsen\_Inc](https://discuss.elastic.co/u/Robsen_Inc)\ **Replies:** 1\ **Last updated:** [September 15, 2021, 12:19am UTC](https://discuss.elastic.co/t/filebeat-dont-send-logs-to-kafka/284200 "2021-09-15T00:19:39Z")
Hi guys! I have a question, what could be the reason that my Filebeat does not send log messages to the Kafka as soon as the time is behind. (When I stop my virtual machine and like the start no logs arrive, only when … --- ## [Object Array in Painless source loses values and indexes with "\[\]" for values](https://discuss.elastic.co/t/object-array-in-painless-source-loses-values-and-indexes-with-for-values/284160)
**Author:** [@jthoni](https://discuss.elastic.co/u/jthoni)\ **Replies:** 3\ **Last updated:** [September 14, 2021, 11:05pm UTC](https://discuss.elastic.co/t/object-array-in-painless-source-loses-values-and-indexes-with-for-values/284160 "2021-09-14T23:05:14Z")
We have just upgraded from ES/Nest v5 to v 6.8. We have an api that does an upsert using a Painless script. The script checks to see that the lastUpdated date in the payload is greater than that in the indexed document, … --- ## [Automating Filebeat](https://discuss.elastic.co/t/automating-filebeat/283816)
**Author:** [@peter\_murphy](https://discuss.elastic.co/u/peter_murphy)\ **Replies:** 5\ **Last updated:** [September 14, 2021, 9:53pm UTC](https://discuss.elastic.co/t/automating-filebeat/283816 "2021-09-14T21:53:31Z")
Hello, I am using Filebeat to send my local device's Osquery log to my self-hosted Elasticsearch via Logstash. The pipeline is working correctly, but only if I trigger Filebeat manually. I'm sure the answer is simple, b… --- ## [Is changing the jvm heap size a problem?](https://discuss.elastic.co/t/is-changing-the-jvm-heap-size-a-problem/284172)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 3\ **Last updated:** [September 14, 2021, 9:50pm UTC](https://discuss.elastic.co/t/is-changing-the-jvm-heap-size-a-problem/284172 "2021-09-14T21:50:58Z")
Hello, there are a total of 16 nodes in the cluster, including 13 data nodes and 3 master nodes. Master nodes have 64 gb ram. But jvm heap is set to 16gb. Data nodes have 64 GB ram. But jvm heap is set to 30gb. Does t… --- ## [Filebeat mssql](https://discuss.elastic.co/t/filebeat-mssql/284175)
**Author:** [@Marcel\_Palme](https://discuss.elastic.co/u/Marcel_Palme)\ **Replies:** 3\ **Last updated:** [September 14, 2021, 9:49pm UTC](https://discuss.elastic.co/t/filebeat-mssql/284175 "2021-09-14T21:49:50Z")
I'm trying to transfer the mssql log to elastic. This also works so far, but I get the errors all in text fields How can I split this field into individual fields or how can I search for certain keywords in this fiel… --- ## [Latest Winlogbeat for windows Url](https://discuss.elastic.co/t/latest-winlogbeat-for-windows-url/284191)
**Author:** [@operat0r](https://discuss.elastic.co/u/operat0r)\ **Replies:** 1\ **Last updated:** [September 14, 2021, 9:45pm UTC](https://discuss.elastic.co/t/latest-winlogbeat-for-windows-url/284191 "2021-09-14T21:45:32Z")
Even using wget I can't auto download the latest ZIP for winlogbeat ... I looked on github and all the scripts are doing the same thing with static paths ... is there any way I can have a "latest winlogbeat for winows" U… --- ## [Scripting a Field with multiple fields with Null values](https://discuss.elastic.co/t/scripting-a-field-with-multiple-fields-with-null-values/284207)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 0\ **Last updated:** [September 14, 2021, 5:05pm UTC](https://discuss.elastic.co/t/scripting-a-field-with-multiple-fields-with-null-values/284207 "2021-09-14T17:05:38Z")
Hi, I'm attempting to use a script processor to add the sum of other fields into a total field, but some of the values are null. I know that I can use a "gsub" or "set" processors to set null values to 0, but the "gsub… --- ## [Possible to run a remote Kibana instance that communicates with managed Elastic Stack?](https://discuss.elastic.co/t/possible-to-run-a-remote-kibana-instance-that-communicates-with-managed-elastic-stack/284087)
**Author:** [@GavinAnderegg](https://discuss.elastic.co/u/GavinAnderegg)\ **Replies:** 5\ **Last updated:** [September 14, 2021, 2:41pm UTC](https://discuss.elastic.co/t/possible-to-run-a-remote-kibana-instance-that-communicates-with-managed-elastic-stack/284087 "2021-09-14T14:41:17Z")
I might be missing something, but I'm having a hard time trying to connect an externally hosted Kibana instance to an Elasticsearch instance hosted on Elastic.co's managed Elastic Stack product (Elasticsearch Service: Ma… --- ## [How to use Elasticseach API client.security.authenticate() in kibana custom plugin?](https://discuss.elastic.co/t/how-to-use-elasticseach-api-client-security-authenticate-in-kibana-custom-plugin/283872)
**Author:** [@Disha\_Bodade](https://discuss.elastic.co/u/Disha_Bodade)\ **Replies:** 3\ **Last updated:** [September 14, 2021, 3:00pm UTC](https://discuss.elastic.co/t/how-to-use-elasticseach-api-client-security-authenticate-in-kibana-custom-plugin/283872 "2021-09-14T15:00:32Z")
I have a custom plugin created, I want to get current user login details to check whether the user is admin or not. I found out Elasticseach API client.security.authenticate() this can be used to do so, but I did not ge… --- ## [Logging not working with Kibana 7.14.1](https://discuss.elastic.co/t/logging-not-working-with-kibana-7-14-1/283624)
**Author:** [@Zeeshan\_Alam](https://discuss.elastic.co/u/Zeeshan_Alam)\ **Replies:** 1\ **Last updated:** [September 14, 2021, 2:43pm UTC](https://discuss.elastic.co/t/logging-not-working-with-kibana-7-14-1/283624 "2021-09-14T14:43:05Z")
In my kibana.yml I have given the following. But I don't see kibana logs being written to the path I defined logging: root: level: all appenders: rolling-file: type: rolling-file fileName: /apps… --- ## [Migration failed, dumping execution log](https://discuss.elastic.co/t/migration-failed-dumping-execution-log/283937)
**Author:** [@LombardoAndrea195](https://discuss.elastic.co/u/LombardoAndrea195)\ **Replies:** 1\ **Last updated:** [September 14, 2021, 2:21pm UTC](https://discuss.elastic.co/t/migration-failed-dumping-execution-log/283937 "2021-09-14T14:21:16Z")
Error generated in kibana log: {"type":"log","@timestamp":"2021-09-11T11:08:43+00:00","tags":\["info","savedobjects-service"\],"pid":1214,"message":"\[.kibana\_task\_manager\] OUTDATED\_DOCUMENTS\_SEARCH\_CLOSE\_PIT -\> UPDATE\_TAR… --- ## [How to disable geoip usage in 7.14.0](https://discuss.elastic.co/t/how-to-disable-geoip-usage-in-7-14-0/281076)
**Author:** [@Alex\_Batt](https://discuss.elastic.co/u/Alex_Batt)\ **Replies:** 21\ **Last updated:** [September 14, 2021, 2:18pm UTC](https://discuss.elastic.co/t/how-to-disable-geoip-usage-in-7-14-0/281076 "2021-09-14T14:18:55Z")
hi, I want to disable the usage of geoip functionality because of licensing and no usage . I have a single node cluster, which works fine. I've tried to disable the geoip on a cluster level using the following param: ing… --- ## ["type": "parsing\_exception","reason":"unknown query \[aggs\] - Elasticsearch node js client](https://discuss.elastic.co/t/type-parsing-exception-reason-unknown-query-aggs-elasticsearch-node-js-client/281402)
**Author:** [@manojkrishna561994](https://discuss.elastic.co/u/manojkrishna561994)\ **Replies:** 4\ **Last updated:** [September 14, 2021, 2:11pm UTC](https://discuss.elastic.co/t/type-parsing-exception-reason-unknown-query-aggs-elasticsearch-node-js-client/281402 "2021-09-14T14:11:42Z")
Hi, I want to connect to elasticsearch through elasticsearch node js client. I'm using search api and want to run few aggregation to calculate the total count of docs which passes the given condition. However, im gettin… --- ## [Installed Elasticsearch docker does not have a password](https://discuss.elastic.co/t/installed-elasticsearch-docker-does-not-have-a-password/281805)
**Author:** [@evo](https://discuss.elastic.co/u/evo)\ **Replies:** 6\ **Last updated:** [September 14, 2021, 2:10pm UTC](https://discuss.elastic.co/t/installed-elasticsearch-docker-does-not-have-a-password/281805 "2021-09-14T14:10:55Z")
I have just following the docker installation guide and have got ES up and running but anyone can add documents to it. I am confused on how to secure it. Is the authentication only pre-configured in the paid version? W… --- ## [Logstash refuses to bind to port 9600](https://discuss.elastic.co/t/logstash-refuses-to-bind-to-port-9600/284183)
**Author:** [@Dan\_Sputnikk](https://discuss.elastic.co/u/Dan_Sputnikk)\ **Replies:** 3\ **Last updated:** [September 14, 2021, 2:04pm UTC](https://discuss.elastic.co/t/logstash-refuses-to-bind-to-port-9600/284183 "2021-09-14T14:04:20Z")
Hi all, Using Logstash 6. I have: http.host: "0.0.0.0" http.port: 9600-9700 xpack.monitoring.enabled: true xpack.monitoring.elasticsearch.hosts: \["http://10.1.96.89:9200", "http://10.1.96.90:9200", "http://10.1.96.9… --- ## [Geo\_shape size and elastic performance](https://discuss.elastic.co/t/geo-shape-size-and-elastic-performance/283920)
**Author:** [@rgwozdz](https://discuss.elastic.co/u/rgwozdz)\ **Replies:** 4\ **Last updated:** [September 14, 2021, 1:30pm UTC](https://discuss.elastic.co/t/geo-shape-size-and-elastic-performance/283920 "2021-09-14T13:30:44Z")
We have an index that contains about 5 million documents. About 20% will have a geo\_shape field that contains polygon data. I need to support intersect queries on these geo\_shapes. Some of these polygons are very comp… --- ## [Need help with conditional only if field contains a period](https://discuss.elastic.co/t/need-help-with-conditional-only-if-field-contains-a-period/284126)
**Author:** [@pcharles1](https://discuss.elastic.co/u/pcharles1)\ **Replies:** 2\ **Last updated:** [September 14, 2021, 1:04pm UTC](https://discuss.elastic.co/t/need-help-with-conditional-only-if-field-contains-a-period/284126 "2021-09-14T13:04:44Z")
I'm trying to grok the host name field only if it contains a period using the conditional below: if (\[host\]\[name\] =~ ".") { grok host.name field } For some reason, when the host name field doesn't contain a period, I g… --- ## [Stop token filter how to set whitespace char as stop word in stopwords\_path config file](https://discuss.elastic.co/t/stop-token-filter-how-to-set-whitespace-char-as-stop-word-in-stopwords-path-config-file/282429)
**Author:** [@chenchuangc](https://discuss.elastic.co/u/chenchuangc)\ **Replies:** 2\ **Last updated:** [September 14, 2021, 1:02pm UTC](https://discuss.elastic.co/t/stop-token-filter-how-to-set-whitespace-char-as-stop-word-in-stopwords-path-config-file/282429 "2021-09-14T13:02:52Z")
Elasticsearch 7.5 thank you for help me ! i want to set the stop word by the stopwords\_path , i set a lot word in the stopwords.txt file , most of the word in the file is effective but only the whitespace char is not e… --- ## [Pagerduty - Set Urgency - Feature Request](https://discuss.elastic.co/t/pagerduty-set-urgency-feature-request/283717)
**Author:** [@bevano](https://discuss.elastic.co/u/bevano)\ **Replies:** 1\ **Last updated:** [September 14, 2021, 12:58pm UTC](https://discuss.elastic.co/t/pagerduty-set-urgency-feature-request/283717 "2021-09-14T12:58:11Z")
Within Pagerduty there is a concept of 'urgency' for incidents. Based on the level of urgency different rules get applied. This should be configurable within Kibana to set the Urgency. I see this was previously raised f… --- ## [Change event name based on type](https://discuss.elastic.co/t/change-event-name-based-on-type/284129)
**Author:** [@antonisnyc94](https://discuss.elastic.co/u/antonisnyc94)\ **Replies:** 1\ **Last updated:** [September 14, 2021, 12:48pm UTC](https://discuss.elastic.co/t/change-event-name-based-on-type/284129 "2021-09-14T12:48:30Z")
Hello, I am having a field which is an object but sometimes it's a string. I'm using the below ruby code but for some reason im still getting an error.. Does anyone know why? if event.get("\[data\]\[aws\]\[configuration\]\[s… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1238) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1240)