# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1256

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1257

---

## [Ability to manipulate the slope "m" of linear function used to boost relevance scores](https://discuss.elastic.co/t/ability-to-manipulate-the-slope-m-of-linear-function-used-to-boost-relevance-scores/283144)

<div class="topic-metadata">

**Author:** [@jsandeep316](https://discuss.elastic.co/u/jsandeep316)\
**Replies:** 0\
**Last updated:** [September 2, 2021, 8:37am UTC](https://discuss.elastic.co/t/ability-to-manipulate-the-slope-m-of-linear-function-used-to-boost-relevance-scores/283144 "2021-09-02T08:37:28Z")

</div>

Hi there, I have a use case where I need to augment the text based relevance scoring (such as TF-IDF) with a linear function. However, when I went through the Elasticsearch documentation, nowhere does it mention that the…

---

## [Cardinality agg off by one even after precision increase](https://discuss.elastic.co/t/cardinality-agg-off-by-one-even-after-precision-increase/283096)

<div class="topic-metadata">

**Author:** [@matt.snyder](https://discuss.elastic.co/u/matt.snyder)\
**Replies:** 1\
**Last updated:** [September 2, 2021, 7:50am UTC](https://discuss.elastic.co/t/cardinality-agg-off-by-one-even-after-precision-increase/283096 "2021-09-02T07:50:06Z")

</div>

Docs in my index have a unique id field, which I want to count using a cardinality agg. I found that if my result set is 5792 docs or smaller, the cardinality agg is accurate, but if I go to 5793 or larger, the cardinal…

---

## [Output to Mutliple Kafka Brokers](https://discuss.elastic.co/t/output-to-mutliple-kafka-brokers/283136)

<div class="topic-metadata">

**Author:** [@JSelastic](https://discuss.elastic.co/u/JSelastic)\
**Replies:** 0\
**Last updated:** [September 2, 2021, 7:55am UTC](https://discuss.elastic.co/t/output-to-mutliple-kafka-brokers/283136 "2021-09-02T07:55:46Z")

</div>

Hi, Our winlogbeat configuration outputs to multiple kafka brokers. We are curious if all of the logs from winlogbeat be sent to all brokers simultaneously or will it only be sent to one broker? Thank you

---

## [Prevent duplicates in a data stream](https://discuss.elastic.co/t/prevent-duplicates-in-a-data-stream/283076)

<div class="topic-metadata">

**Author:** [@romathonat](https://discuss.elastic.co/u/romathonat)\
**Replies:** 5\
**Last updated:** [September 2, 2021, 7:40am UTC](https://discuss.elastic.co/t/prevent-duplicates-in-a-data-stream/283076 "2021-09-02T07:40:05Z")

</div>

Hello, Is there a way to prevent duplicates in a data stream ? For a given index, specifying the \_id gives us the guarantee that there will be no duplicate with same \_id. For data streams however, it does not work app…

---

## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/282925)

<div class="topic-metadata">

**Author:** [@Alvaro\_Eixea](https://discuss.elastic.co/u/Alvaro_Eixea)\
**Replies:** 6\
**Last updated:** [September 2, 2021, 7:21am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/282925 "2021-09-02T07:21:54Z")

</div>

Hi, I have upgrade my monolithic server using these guide: Upgrade Elasticsearch, Filebeat and Kibana - Upgrade guide Now ,i have my server broken, kibana show always the message "kibana server is not ready yet" on scr…

---

## [How to delete all the elasticsearch indices, that start with a certain string, based on date ranges](https://discuss.elastic.co/t/how-to-delete-all-the-elasticsearch-indices-that-start-with-a-certain-string-based-on-date-ranges/283063)

<div class="topic-metadata">

**Author:** [@JaswantG](https://discuss.elastic.co/u/JaswantG)\
**Replies:** 7\
**Last updated:** [September 2, 2021, 6:03am UTC](https://discuss.elastic.co/t/how-to-delete-all-the-elasticsearch-indices-that-start-with-a-certain-string-based-on-date-ranges/283063 "2021-09-02T06:03:05Z")

</div>

I am using elasticsearch 2.2.0. I have a requirement wherein I have to delete certain indices, which are created on a day-to-day basis, based on two different dates. (format - abc-xyz-yyyy-mm-dd) For e.g. - There are 1…

---

## [Logstash CSV Output all fields are not working](https://discuss.elastic.co/t/logstash-csv-output-all-fields-are-not-working/282985)

<div class="topic-metadata">

**Author:** [@yogicd](https://discuss.elastic.co/u/yogicd)\
**Replies:** 2\
**Last updated:** [September 2, 2021, 5:55am UTC](https://discuss.elastic.co/t/logstash-csv-output-all-fields-are-not-working/282985 "2021-09-02T05:55:32Z")

</div>

Hello, I am testing to get the all the data in .CSV file and unable to get the all the fields and nested in the.CSV file,My config file as below input { stdin {} beats { port =\> 5044 } } output { csv { #fields …

---

## [Elasticsearch.service: Failed with result 'exit-code'](https://discuss.elastic.co/t/elasticsearch-service-failed-with-result-exit-code/283123)

<div class="topic-metadata">

**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\
**Replies:** 7\
**Last updated:** [September 2, 2021, 5:51am UTC](https://discuss.elastic.co/t/elasticsearch-service-failed-with-result-exit-code/283123 "2021-09-02T05:51:26Z")

</div>

My Elasticsearch is not starting, I don't know why I am getting below error. root@i3insight2:~# systemctl status elasticsearch.service â elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/e…

---

## [Complete newbie, but need urgent cleanup](https://discuss.elastic.co/t/complete-newbie-but-need-urgent-cleanup/282802)

<div class="topic-metadata">

**Author:** [@TwanVeugelers](https://discuss.elastic.co/u/TwanVeugelers)\
**Replies:** 7\
**Last updated:** [September 2, 2021, 5:45am UTC](https://discuss.elastic.co/t/complete-newbie-but-need-urgent-cleanup/282802 "2021-09-02T05:45:41Z")

</div>

Hi. I have taken over the monitoring / elastic search from a colleague that left the company. I now see that our D drive is almost reaching its limits and will be full pretty shortly. I'm a full newbie and need to lea…

---

## [How to connect Elastic Cloud with Laravel Scout?](https://discuss.elastic.co/t/how-to-connect-elastic-cloud-with-laravel-scout/283125)

<div class="topic-metadata">

**Author:** [@Tufan\_Cagkan\_Sokmen](https://discuss.elastic.co/u/Tufan_Cagkan_Sokmen)\
**Replies:** 0\
**Last updated:** [September 2, 2021, 5:31am UTC](https://discuss.elastic.co/t/how-to-connect-elastic-cloud-with-laravel-scout/283125 "2021-09-02T05:31:55Z")

</div>

Hello, Using that package to manage my scout with elasticsearch. I am using elastic cloud service. But that doesnt connect for any. What should I enter for host information? blabla-central1.gcp.cloud.es.io/myproje…

---

## [Mail log event correlation](https://discuss.elastic.co/t/mail-log-event-correlation/283115)

<div class="topic-metadata">

**Author:** [@mherbert](https://discuss.elastic.co/u/mherbert)\
**Replies:** 11\
**Last updated:** [September 2, 2021, 5:25am UTC](https://discuss.elastic.co/t/mail-log-event-correlation/283115 "2021-09-02T05:25:51Z")

</div>

Apologies, I don't know whether this is the correct forum for this question, please bear with me. I have an elasticsearch index containing mail logging events from syslog, however as with postfix the complete transactio…

---

## [Attempted to resurrect connection to dead ES instance in secure ELK](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance-in-secure-elk/282989)

<div class="topic-metadata">

**Author:** [@kiran80511](https://discuss.elastic.co/u/kiran80511)\
**Replies:** 2\
**Last updated:** [September 2, 2021, 4:56am UTC](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance-in-secure-elk/282989 "2021-09-02T04:56:48Z")

</div>

Hi, I am using version 7.14 for elasticsearch, logstash and kibana . In logstash log I got this error: Sep 01 10:43:09 elastic.sys logstash\[2975\]: \[2021-09-01T10:43:09,352\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main\]…

---

## [Failed to authenticate user \[kibana\_system\]](https://discuss.elastic.co/t/failed-to-authenticate-user-kibana-system/282864)

<div class="topic-metadata">

**Author:** [@yyyayo](https://discuss.elastic.co/u/yyyayo)\
**Replies:** 3\
**Last updated:** [September 2, 2021, 2:38am UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-kibana-system/282864 "2021-09-02T02:38:14Z")

</div>

When I tried Kibana development, I ran the following commands: yarn es snapshot --license trial yarn start --run-examples Then I encountered an error in Elasticsearch: failed to retrieve password hash for reserved use…

---

## [Threat intelligence module](https://discuss.elastic.co/t/threat-intelligence-module/282766)

<div class="topic-metadata">

**Author:** [@Servando\_Dominguez](https://discuss.elastic.co/u/Servando_Dominguez)\
**Replies:** 3\
**Last updated:** [September 2, 2021, 2:20am UTC](https://discuss.elastic.co/t/threat-intelligence-module/282766 "2021-09-02T02:20:57Z")

</div>

Hi there! Alert for a maybe, a stupid question. I want to enable the thread intelligence module from diferent resources. I click enable in Kibana and go to the documentation: My question is, where I put this config/…

---

## [How to use elasticsearch sliced scroll with multiprocessing in python?](https://discuss.elastic.co/t/how-to-use-elasticsearch-sliced-scroll-with-multiprocessing-in-python/283108)

<div class="topic-metadata">

**Author:** [@Prem\_George](https://discuss.elastic.co/u/Prem_George)\
**Replies:** 1\
**Last updated:** [September 2, 2021, 1:36am UTC](https://discuss.elastic.co/t/how-to-use-elasticsearch-sliced-scroll-with-multiprocessing-in-python/283108 "2021-09-02T01:36:49Z")

</div>

I'm pulling data from elastic search using python client scroll id and appending in a dataframe as follows import pandas as pd from elasticsearch import Elasticsearch es = Elasticsearch(\[{'host': 'localhost', 'port': 92…

---

## [Logstash is not able to connect to ELasticsearch](https://discuss.elastic.co/t/logstash-is-not-able-to-connect-to-elasticsearch/282206)

<div class="topic-metadata">

**Author:** [@Aboli\_77](https://discuss.elastic.co/u/Aboli_77)\
**Replies:** 12\
**Last updated:** [September 2, 2021, 1:07am UTC](https://discuss.elastic.co/t/logstash-is-not-able-to-connect-to-elasticsearch/282206 "2021-09-02T01:07:40Z")

</div>

I am trying to run logstash but getting below error: ./logstash -f /etc/logstash/conf.d/abc.conf WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. You can specify the p…

---

## [Kibana UI refused to connect](https://discuss.elastic.co/t/kibana-ui-refused-to-connect/283093)

<div class="topic-metadata">

**Author:** [@peter\_murphy](https://discuss.elastic.co/u/peter_murphy)\
**Replies:** 2\
**Last updated:** [September 1, 2021, 10:28pm UTC](https://discuss.elastic.co/t/kibana-ui-refused-to-connect/283093 "2021-09-01T22:28:57Z")

</div>

Hi I'm having trouble accessing the Kibana UI in my browser. I'm sure it's something in the config but I can't tell what. I can successfully curl localhost:9200 on the server but not localhost:5601, and I cannot curl eit…

---

## [Elasticsearch.service has failed (code=exited, status=143)](https://discuss.elastic.co/t/elasticsearch-service-has-failed-code-exited-status-143/283072)

<div class="topic-metadata">

**Author:** [@larzu](https://discuss.elastic.co/u/larzu)\
**Replies:** 1\
**Last updated:** [September 1, 2021, 10:17pm UTC](https://discuss.elastic.co/t/elasticsearch-service-has-failed-code-exited-status-143/283072 "2021-09-01T22:17:09Z")

</div>

I'm a "bit" lost with this Elasticsearch installation (for Magento). I was following the installation for Centos Install Elasticsearch with RPM | Elasticsearch Guide \[7.14\] | Elastic Unfortunately Elasticsearch is not s…

---

## [PANW Integration - Timezone Offset Problem](https://discuss.elastic.co/t/panw-integration-timezone-offset-problem/282978)

<div class="topic-metadata">

**Author:** [@neil6323](https://discuss.elastic.co/u/neil6323)\
**Replies:** 4\
**Last updated:** [September 1, 2021, 10:09pm UTC](https://discuss.elastic.co/t/panw-integration-timezone-offset-problem/282978 "2021-09-01T22:09:26Z")

</div>

Elastic Cluster Version 7.14.0. I am using Elastic-Agent and the PANW integration to ingest Palo Alto Firewall logs. Once ingested the event times are incorrect by the equivalent of the timezone offset. I have found arti…

---

## [Automatic Write Block on Index](https://discuss.elastic.co/t/automatic-write-block-on-index/283014)

<div class="topic-metadata">

**Author:** [@Aamir\_Rizwan](https://discuss.elastic.co/u/Aamir_Rizwan)\
**Replies:** 2\
**Last updated:** [September 1, 2021, 10:09pm UTC](https://discuss.elastic.co/t/automatic-write-block-on-index/283014 "2021-09-01T22:09:11Z")

</div>

I have 3 master and 3 data nodes. I was getting this error: AuthorizationException(403, 'cluster\_block\_exception', 'blocked by: \[FORBIDDEN/8/index write (api)\];') Increased the data nodes by 1 but still getting the sam…

---

## [How to check the progress of searchable snapshot action -?](https://discuss.elastic.co/t/how-to-check-the-progress-of-searchable-snapshot-action/283059)

<div class="topic-metadata">

**Author:** [@Kannappan\_Somu](https://discuss.elastic.co/u/Kannappan_Somu)\
**Replies:** 1\
**Last updated:** [September 1, 2021, 10:08pm UTC](https://discuss.elastic.co/t/how-to-check-the-progress-of-searchable-snapshot-action/283059 "2021-09-01T22:08:37Z")

</div>

How to check the progress of searchable snapshot action - progress ? How do we get to know how much data is left to be snapshotted ? is there any API for this ?

---

## [ElasticSearch as primary database and other solutions](https://discuss.elastic.co/t/elasticsearch-as-primary-database-and-other-solutions/283021)

<div class="topic-metadata">

**Author:** [@xemyleex](https://discuss.elastic.co/u/xemyleex)\
**Replies:** 5\
**Last updated:** [September 1, 2021, 10:07pm UTC](https://discuss.elastic.co/t/elasticsearch-as-primary-database-and-other-solutions/283021 "2021-09-01T22:07:50Z")

</div>

I am using elasticsearch as primary database. But due to the lack of the ACID properties, I want to: or replace it with another database with similar or better performances ( maybe postgresql or kafka/ksql ). or use ot…

---

## [Simultaneous data use of 2 indices differentes | Utilisation simultanée de 2 indices differents](https://discuss.elastic.co/t/simultaneous-data-use-of-2-indices-differentes-utilisation-simultanee-de-2-indices-differents/281688)

<div class="topic-metadata">

**Author:** [@kalache](https://discuss.elastic.co/u/kalache)\
**Replies:** 5\
**Last updated:** [September 1, 2021, 9:54pm UTC](https://discuss.elastic.co/t/simultaneous-data-use-of-2-indices-differentes-utilisation-simultanee-de-2-indices-differents/281688 "2021-09-01T21:54:33Z")

</div>

Hello, I’m improving the IT inventory and I want to use the Elastic Stack to made it. Logstash collect data into CSV file, Elasticsearch analyze this data and Kibana let us to visualize the data. Why we want to use El…

---

## [Filter in aggregation not working with top hits](https://discuss.elastic.co/t/filter-in-aggregation-not-working-with-top-hits/282964)

<div class="topic-metadata">

**Author:** [@saurabh.biswas](https://discuss.elastic.co/u/saurabh.biswas)\
**Replies:** 2\
**Last updated:** [September 1, 2021, 8:17pm UTC](https://discuss.elastic.co/t/filter-in-aggregation-not-working-with-top-hits/282964 "2021-09-01T20:17:58Z")

</div>

Hello, I'm trying to write a query to form an aggregation of all the colleges under a university, put them into country id buckets and get the top colleges based out of each country. Somehow I'm not getting what I'm ex…

---

## [Unable to install fleet server](https://discuss.elastic.co/t/unable-to-install-fleet-server/282613)

<div class="topic-metadata">

**Author:** [@Dovan](https://discuss.elastic.co/u/Dovan)\
**Replies:** 9\
**Last updated:** [September 1, 2021, 6:57pm UTC](https://discuss.elastic.co/t/unable-to-install-fleet-server/282613 "2021-09-01T18:57:07Z")

</div>

I'm trying to install fleet server on my local server (the same where elasticsearch is installed) and I'm not succeeding. I've tried to uninstall and reinstall elastic-agent 7.14 and it doesn't work. the commands and th…

---

## [Multiple Elasticsearch Filters in one Logstash Pipeline](https://discuss.elastic.co/t/multiple-elasticsearch-filters-in-one-logstash-pipeline/283087)

<div class="topic-metadata">

**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\
**Replies:** 5\
**Last updated:** [September 1, 2021, 6:49pm UTC](https://discuss.elastic.co/t/multiple-elasticsearch-filters-in-one-logstash-pipeline/283087 "2021-09-01T18:49:29Z")

</div>

Is it possible to do multiple Elasticsearch lookup filters to search multiple indices in a single Logstash pipeline?

---

## [Painless pains: Weird behaviour with try-catch and dotProduct functions](https://discuss.elastic.co/t/painless-pains-weird-behaviour-with-try-catch-and-dotproduct-functions/282499)

<div class="topic-metadata">

**Author:** [@SKRYMr](https://discuss.elastic.co/u/SKRYMr)\
**Replies:** 1\
**Last updated:** [September 1, 2021, 6:34pm UTC](https://discuss.elastic.co/t/painless-pains-weird-behaviour-with-try-catch-and-dotproduct-functions/282499 "2021-09-01T18:34:48Z")

</div>

Hello, in our team we use painless scripting quite heavily and have come across some very weird behaviour from time to time, the latest having to do with the following piece of code: try { double test = dotProduct(k…

---

## [Troubleshooting logstash configs](https://discuss.elastic.co/t/troubleshooting-logstash-configs/282842)

<div class="topic-metadata">

**Author:** [@kriss332](https://discuss.elastic.co/u/kriss332)\
**Replies:** 8\
**Last updated:** [September 1, 2021, 6:14pm UTC](https://discuss.elastic.co/t/troubleshooting-logstash-configs/282842 "2021-09-01T18:14:11Z")

</div>

Hi all.. I've been working on ELK for about a couple of months now and I've been really liking it apart from the troubelshooting steps. I've just integrated a syslog for trial before going heavily onto production phase. …

---

## [Purpose of State files](https://discuss.elastic.co/t/purpose-of-state-files/282849)

<div class="topic-metadata">

**Author:** [@hyadavalli](https://discuss.elastic.co/u/hyadavalli)\
**Replies:** 5\
**Last updated:** [September 1, 2021, 5:17pm UTC](https://discuss.elastic.co/t/purpose-of-state-files/282849 "2021-09-01T17:17:17Z")

</div>

Hello Everyone, After searching everywhere, I couldn't find the purpose of state files. We started off with version 2.2 and then went to 5.6 and then at 6.8 atm. Below is the scenario we frequently run into: Elastics…

---

## [Counting events in a specific time range](https://discuss.elastic.co/t/counting-events-in-a-specific-time-range/282932)

<div class="topic-metadata">

**Author:** [@katja1](https://discuss.elastic.co/u/katja1)\
**Replies:** 2\
**Last updated:** [September 1, 2021, 5:50pm UTC](https://discuss.elastic.co/t/counting-events-in-a-specific-time-range/282932 "2021-09-01T17:50:02Z")

</div>

Our problem is the following; we are collecting information about customers visiting our page. We are intrested in counting repeated visits by the same customer in a specific time range - we would like to determine the n…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1255)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1257)
