# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1257 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1258 --- ## ["Required array length too large" error during reindex](https://discuss.elastic.co/t/required-array-length-too-large-error-during-reindex/283090)
**Author:** [@Richard\_Ney](https://discuss.elastic.co/u/Richard_Ney)\ **Replies:** 0\ **Last updated:** [September 1, 2021, 5:49pm UTC](https://discuss.elastic.co/t/required-array-length-too-large-error-during-reindex/283090 "2021-09-01T17:49:52Z")
I'm in the process of reindexing an index of large nested documents. During the reindex I'm using painless script to pull a couple nested documents up a level. For the most part the reindex is going fine but occasionally… --- ## [Kibana is extremely slow (Loading graphs, new pages, etc.)](https://discuss.elastic.co/t/kibana-is-extremely-slow-loading-graphs-new-pages-etc/282955)
**Author:** [@Dave\_Houser](https://discuss.elastic.co/u/Dave_Houser)\ **Replies:** 6\ **Last updated:** [September 1, 2021, 5:32pm UTC](https://discuss.elastic.co/t/kibana-is-extremely-slow-loading-graphs-new-pages-etc/282955 "2021-09-01T17:32:40Z")
System: Ubuntu 18.04 16 Cores 16Gb RAM ELK system ELK 7.14 Single node (Kibana, Elastic, Logstash) All was deployed with Ubuntu apt (Install Elasticsearch with Debian Package | Elasticsearch Guide \[7.14\] | Elastic)… --- ## [Kafka connectors/streaming for enriching the data](https://discuss.elastic.co/t/kafka-connectors-streaming-for-enriching-the-data/283083)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 0\ **Last updated:** [September 1, 2021, 4:56pm UTC](https://discuss.elastic.co/t/kafka-connectors-streaming-for-enriching-the-data/283083 "2021-09-01T16:56:38Z")
Is it possible to enrich/transform the data in Kafka connect/Streams and feed it to elasticsearch, without using logstash for data transformation/enrichment? --- ## [Metricbeat failed reading counters: failed collecting counter values: No data to return](https://discuss.elastic.co/t/metricbeat-failed-reading-counters-failed-collecting-counter-values-no-data-to-return/283082)
**Author:** [@Woolis\_Xiibil\_Peek](https://discuss.elastic.co/u/Woolis_Xiibil_Peek)\ **Replies:** 0\ **Last updated:** [September 1, 2021, 4:49pm UTC](https://discuss.elastic.co/t/metricbeat-failed-reading-counters-failed-collecting-counter-values-no-data-to-return/283082 "2021-09-01T16:49:15Z")
Hi. I'm tyring to read the perfmon of a Windows Server 2016. I'm using the Windows module, but I'm getting this message in Kibana. "failed reading counters: failed collecting counter values: No data to return" I have n… --- ## [System Down alert on Kibana](https://discuss.elastic.co/t/system-down-alert-on-kibana/282860)
**Author:** [@grumpypant](https://discuss.elastic.co/u/grumpypant)\ **Replies:** 4\ **Last updated:** [September 1, 2021, 4:41pm UTC](https://discuss.elastic.co/t/system-down-alert-on-kibana/282860 "2021-09-01T16:41:41Z")
New to ELK I'm trying to setup rules for alerting on Kibana. One of them would be "Host Down". Trying to use the system.uptime.duration.ms metricset to tell me if a Host is down for more than 5 mins. So far, below ima… --- ## [Multiple output in Filebeat](https://discuss.elastic.co/t/multiple-output-in-filebeat/283001)
**Author:** [@alon\_carmelly](https://discuss.elastic.co/u/alon_carmelly)\ **Replies:** 3\ **Last updated:** [September 1, 2021, 4:39pm UTC](https://discuss.elastic.co/t/multiple-output-in-filebeat/283001 "2021-09-01T16:39:23Z")
I am trying to setup multiple index outputs from the same filebeat.yml. I have different paths on the same server and I need each path to go to the same logstash but have a different index name. Is it possible? --- ## [ES7 - HighLevelClient: QueryBuilder serialization / Licensing / performance single node](https://discuss.elastic.co/t/es7-highlevelclient-querybuilder-serialization-licensing-performance-single-node/282748)
**Author:** [@K\_B](https://discuss.elastic.co/u/K_B)\ **Replies:** 1\ **Last updated:** [September 1, 2021, 4:08pm UTC](https://discuss.elastic.co/t/es7-highlevelclient-querybuilder-serialization-licensing-performance-single-node/282748 "2021-09-01T16:08:06Z")
Hi, i moved our java application from 1.7 to 7.14 (kinda lot of work... much changed, steps were 1.3 -\> 1.7 -\> 2.0 -\> 2.4 -\> 5.6 -\> 6.18 -\> 7.14) and its now nearly working as expected. However, somewhere during the 2.x… --- ## [Custom analyzers in Packetbeat index template](https://discuss.elastic.co/t/custom-analyzers-in-packetbeat-index-template/283074)
**Author:** [@yotamgod](https://discuss.elastic.co/u/yotamgod)\ **Replies:** 0\ **Last updated:** [September 1, 2021, 4:05pm UTC](https://discuss.elastic.co/t/custom-analyzers-in-packetbeat-index-template/283074 "2021-09-01T16:05:40Z")
Hi, I recently started using Packetbeat and started adding my own fields to the index template (using the setup.template.append\_fields). I was wondering if there is some way to create a custom analyzer for my custom te… --- ## [Multiple Grok patterns help](https://discuss.elastic.co/t/multiple-grok-patterns-help/282965)
**Author:** [@Zorkmid](https://discuss.elastic.co/u/Zorkmid)\ **Replies:** 4\ **Last updated:** [September 1, 2021, 3:17pm UTC](https://discuss.elastic.co/t/multiple-grok-patterns-help/282965 "2021-09-01T15:17:19Z")
Hi All, I'm doing something wrong with the following. The goal is parse 5 basic events from a PulseSecure VPN syslog feed. Is the following the correct?? filter { if "PulseSecure" in \[message\] { grok { … --- ## [Applying aggregation to query results](https://discuss.elastic.co/t/applying-aggregation-to-query-results/283042)
**Author:** [@me.mohammed](https://discuss.elastic.co/u/me.mohammed)\ **Replies:** 1\ **Last updated:** [September 1, 2021, 2:52pm UTC](https://discuss.elastic.co/t/applying-aggregation-to-query-results/283042 "2021-09-01T14:52:22Z")
Hello everyone, I'm trying to apply an aggregation filter to my query, I basically have an array of objects which looks like this { "productDeals": \[ { "id": 1, "startAt": "2021-08-30T17:40:14.000Z", "end… --- ## [Alert if index has 0 documents in last X minutes (Rules and connectors or Detection Rules)](https://discuss.elastic.co/t/alert-if-index-has-0-documents-in-last-x-minutes-rules-and-connectors-or-detection-rules/282902)
**Author:** [@gneves](https://discuss.elastic.co/u/gneves)\ **Replies:** 3\ **Last updated:** [September 1, 2021, 2:36pm UTC](https://discuss.elastic.co/t/alert-if-index-has-0-documents-in-last-x-minutes-rules-and-connectors-or-detection-rules/282902 "2021-09-01T14:36:36Z")
Hello Guys, I've been working around with "Rules and Connectors" and "Detection Rules" in order to get a notification when one of my beats stops sending data. Each beat has different indexes, so i would like to "know" i… --- ## [Two node cluster - Keep certain indexes on primary instance](https://discuss.elastic.co/t/two-node-cluster-keep-certain-indexes-on-primary-instance/283050)
**Author:** [@save4elastic](https://discuss.elastic.co/u/save4elastic)\ **Replies:** 1\ **Last updated:** [September 1, 2021, 2:29pm UTC](https://discuss.elastic.co/t/two-node-cluster-keep-certain-indexes-on-primary-instance/283050 "2021-09-01T14:29:51Z")
Is it possible to keep certain high usage indices on the more powerful instance and offload indexes that are older to a low power instance? I am hoping to keep all shards of new indexes on the primary instance to increas… --- ## [Filebeat 7.14.0 filestream input field log.offset is character count of the line](https://discuss.elastic.co/t/filebeat-7-14-0-filestream-input-field-log-offset-is-character-count-of-the-line/282956)
**Author:** [@Michael\_Savettiere](https://discuss.elastic.co/u/Michael_Savettiere)\ **Replies:** 4\ **Last updated:** [September 1, 2021, 2:22pm UTC](https://discuss.elastic.co/t/filebeat-7-14-0-filestream-input-field-log-offset-is-character-count-of-the-line/282956 "2021-09-01T14:22:10Z")
Using Filebeat 7.14.0 input: filestream and output.console: pretty: true I see that the value of log.offset is the size of the event.message and not the offset from the beginning of the file. I used to use input: log an… --- ## [From logstash how to lookup on a data in elastic index?](https://discuss.elastic.co/t/from-logstash-how-to-lookup-on-a-data-in-elastic-index/281387)
**Author:** [@sathish.mtech01](https://discuss.elastic.co/u/sathish.mtech01)\ **Replies:** 10\ **Last updated:** [August 18, 2021, 6:36pm UTC](https://discuss.elastic.co/t/from-logstash-how-to-lookup-on-a-data-in-elastic-index/281387 "2021-08-18T18:36:15Z")
Need a support, i have created a lookup index in elastic search index - lookup Username;Identifier;First name;Last name booker12;l9012;Rachel;Booker grey07;l2070;Laura;Grey johnson81;l4081;Craig;Johnson jenkins46;… --- ## [Is Update By Query API a good choice to update single document in elasticsearch?](https://discuss.elastic.co/t/is-update-by-query-api-a-good-choice-to-update-single-document-in-elasticsearch/283035)
**Author:** [@Karthikeyan\_Amaresan](https://discuss.elastic.co/u/Karthikeyan_Amaresan)\ **Replies:** 2\ **Last updated:** [September 1, 2021, 1:30pm UTC](https://discuss.elastic.co/t/is-update-by-query-api-a-good-choice-to-update-single-document-in-elasticsearch/283035 "2021-09-01T13:30:16Z")
I have a use case where i want to update the document without knowing its index. Currently i am querying by id and getting the index and then updating (2 operation). Update By Query API seems to perform this use case in … --- ## [ElasticSearch version 7.14.0 can't highlight with search\_as\_you\_type datatype subfield](https://discuss.elastic.co/t/elasticsearch-version-7-14-0-cant-highlight-with-search-as-you-type-datatype-subfield/283005)
**Author:** [@andrewbien](https://discuss.elastic.co/u/andrewbien)\ **Replies:** 1\ **Last updated:** [September 1, 2021, 1:17pm UTC](https://discuss.elastic.co/t/elasticsearch-version-7-14-0-cant-highlight-with-search-as-you-type-datatype-subfield/283005 "2021-09-01T13:17:05Z")
Here is my example to reproduce the problem: PUT mytest { "mappings": { "properties": { "title": { "type": "keyword", "fields": { "autocomplete": { "type": "search\_as\_y… --- ## [Scripted field returns null on querying for logs](https://discuss.elastic.co/t/scripted-field-returns-null-on-querying-for-logs/282072)
**Author:** [@NavinKu10](https://discuss.elastic.co/u/NavinKu10)\ **Replies:** 5\ **Last updated:** [September 1, 2021, 12:52pm UTC](https://discuss.elastic.co/t/scripted-field-returns-null-on-querying-for-logs/282072 "2021-09-01T12:52:57Z")
Hi community. I am a newbie in Kibana and Elastic search. I am using scripted fields to search for logs containing certains strings and then visualize them. I have written my script in Painless. Here is the line that is… --- ## [Filebeat unable to send the data to Elastic search](https://discuss.elastic.co/t/filebeat-unable-to-send-the-data-to-elastic-search/282927)
**Author:** [@miqdaadp](https://discuss.elastic.co/u/miqdaadp)\ **Replies:** 1\ **Last updated:** [September 1, 2021, 12:14pm UTC](https://discuss.elastic.co/t/filebeat-unable-to-send-the-data-to-elastic-search/282927 "2021-09-01T12:14:55Z")
Hello, I am trying to send the data from server via Filebeat to Elastic search . Trying to see the data on kibana but i cannot see the data on Kibana. It says no Data. When i started the filebeat service its started … --- ## [Packetbeat Processors - Dropping fields from nested objects in an array](https://discuss.elastic.co/t/packetbeat-processors-dropping-fields-from-nested-objects-in-an-array/282988)
**Author:** [@yotamgod](https://discuss.elastic.co/u/yotamgod)\ **Replies:** 3\ **Last updated:** [September 1, 2021, 11:21am UTC](https://discuss.elastic.co/t/packetbeat-processors-dropping-fields-from-nested-objects-in-an-array/282988 "2021-09-01T11:21:30Z")
I recently started working with Packetbeat. For my use-case, I only need some specific fields (to the point where if I could, I would completely rewrite the mapping, but am leaving that as a last resort). I tried remov… --- ## [Can not achive namespace annotations from OKD (kubernetes)](https://discuss.elastic.co/t/can-not-achive-namespace-annotations-from-okd-kubernetes/283032)
**Author:** [@hollden](https://discuss.elastic.co/u/hollden)\ **Replies:** 0\ **Last updated:** [September 1, 2021, 11:18am UTC](https://discuss.elastic.co/t/can-not-achive-namespace-annotations-from-okd-kubernetes/283032 "2021-09-01T11:18:44Z")
Good day! I'am trying to collect namespace annotations from OKD cluster without any success, while namespace labels is colleted perfectly. Node annotations are not getting either. My config: filebeatConfig: fileb… --- ## [TSVB Variable Name Markdown Syntax](https://discuss.elastic.co/t/tsvb-variable-name-markdown-syntax/281352)
**Author:** [@Bustencio](https://discuss.elastic.co/u/Bustencio)\ **Replies:** 4\ **Last updated:** [September 1, 2021, 11:17am UTC](https://discuss.elastic.co/t/tsvb-variable-name-markdown-syntax/281352 "2021-09-01T11:17:49Z")
Hi, I'm trying to create a TSVB visualization using Markdown to show values and some text. My problem appears when accessing label names while using date fields in a Terms aggregation because it overwrites the label. Is… --- ## [Logstash Pipeline CSV Date Filter Issue](https://discuss.elastic.co/t/logstash-pipeline-csv-date-filter-issue/282994)
**Author:** [@piotr.krupinski](https://discuss.elastic.co/u/piotr.krupinski)\ **Replies:** 1\ **Last updated:** [September 1, 2021, 10:40am UTC](https://discuss.elastic.co/t/logstash-pipeline-csv-date-filter-issue/282994 "2021-09-01T10:40:53Z")
Hello, I have an issue with pipeline which should fetch data from CSV file. When I'm adding a "Data" to filter section because I need to have it in Elastic as a date it does not want to work. The config is below: inpu… --- ## [Sending output to two indices](https://discuss.elastic.co/t/sending-output-to-two-indices/282909)
**Author:** [@proxymoxy](https://discuss.elastic.co/u/proxymoxy)\ **Replies:** 2\ **Last updated:** [September 1, 2021, 10:24am UTC](https://discuss.elastic.co/t/sending-output-to-two-indices/282909 "2021-09-01T10:24:12Z")
Hi, I am in the process of implementing Filebeat/Elasticsearch (not using logstash) to index my logs and create some graphics in Kibana. I have set up the system module in Filebeat which works fine and sends the logs to… --- ## [Is there any solution for just checking the file availability？](https://discuss.elastic.co/t/is-there-any-solution-for-just-checking-the-file-availability/282668)
**Author:** [@lpf86731782](https://discuss.elastic.co/u/lpf86731782)\ **Replies:** 6\ **Last updated:** [September 1, 2021, 9:44am UTC](https://discuss.elastic.co/t/is-there-any-solution-for-just-checking-the-file-availability/282668 "2021-09-01T09:44:05Z")
the system receives a bunch of files daily, monitoring the file availability and size is important for the service quality. No need to check the file content though. Is there any proper way to achieve this with ELK? --- ## [Newbie qn: ingesting netflow](https://discuss.elastic.co/t/newbie-qn-ingesting-netflow/283000)
**Author:** [@hjazz6](https://discuss.elastic.co/u/hjazz6)\ **Replies:** 1\ **Last updated:** [September 1, 2021, 9:38am UTC](https://discuss.elastic.co/t/newbie-qn-ingesting-netflow/283000 "2021-09-01T09:38:42Z")
Hi all, I'm a newbie in ELK, and would like to send Netflow data to ElasticSearch via Filebeat (both on the same server). I'm starting to read all the documentation and configuration guides, but I'm a bit confused about… --- ## [Unexpected "Nesting" for Single Property on IndexRequests Failing](https://discuss.elastic.co/t/unexpected-nesting-for-single-property-on-indexrequests-failing/282930)
**Author:** [@rionmonster](https://discuss.elastic.co/u/rionmonster)\ **Replies:** 1\ **Last updated:** [September 1, 2021, 8:49am UTC](https://discuss.elastic.co/t/unexpected-nesting-for-single-property-on-indexrequests-failing/282930 "2021-09-01T08:49:48Z")
Hi all, I recently started using Elasticsearch and I was a bit baffled when I tried to create an IndexRequest to one of my indices using the following payload and receiving a limit of mapping depth exceeded message: "st… --- ## [Combine Exact/phrase search and \* to get results starting with firstname lastname\* - Robert will\*](https://discuss.elastic.co/t/combine-exact-phrase-search-and-to-get-results-starting-with-firstname-lastname-robert-will/282962)
**Author:** [@lakshmiteja\_salapu](https://discuss.elastic.co/u/lakshmiteja_salapu)\ **Replies:** 1\ **Last updated:** [September 1, 2021, 8:48am UTC](https://discuss.elastic.co/t/combine-exact-phrase-search-and-to-get-results-starting-with-firstname-lastname-robert-will/282962 "2021-09-01T08:48:05Z")
I want to search for Robert Will\* and expecting results that include Robert willow , Robert wills But I am getting documents that contain Robert Smith with street address 18 willow street Question 1) How to get resul… --- ## [How to serialize SearchRequest?](https://discuss.elastic.co/t/how-to-serialize-searchrequest/282793)
**Author:** [@fatcloud](https://discuss.elastic.co/u/fatcloud)\ **Replies:** 6\ **Last updated:** [September 1, 2021, 8:33am UTC](https://discuss.elastic.co/t/how-to-serialize-searchrequest/282793 "2021-09-01T08:33:57Z")
Hi, I'm new to elastic search, I need to log SearchRequest and use them later for testing/analysis purpose, what's the best practice to serialize/deserialize a SearchRequest in Java? Thanks! --- ## [Error establishing direct connection to mongo node at \[ip:port\]. Error output: no reachable servers](https://discuss.elastic.co/t/error-establishing-direct-connection-to-mongo-node-at-ip-port-error-output-no-reachable-servers/282434)
**Author:** [@devopshulk](https://discuss.elastic.co/u/devopshulk)\ **Replies:** 3\ **Last updated:** [September 1, 2021, 6:59am UTC](https://discuss.elastic.co/t/error-establishing-direct-connection-to-mongo-node-at-ip-port-error-output-no-reachable-servers/282434 "2021-09-01T06:59:26Z")
Hi, I am using MongoDB with a replica set. When I am trying to create a metricbeat MongoDB module am not sure How to give a URL. I don't understand how to solve it. when uncommenting the ssl.verification\_mode: 'none' th… --- ## [How to integrate elasticsearch with service now for auto ticketing](https://discuss.elastic.co/t/how-to-integrate-elasticsearch-with-service-now-for-auto-ticketing/282996)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 0\ **Last updated:** [September 1, 2021, 6:49am UTC](https://discuss.elastic.co/t/how-to-integrate-elasticsearch-with-service-now-for-auto-ticketing/282996 "2021-09-01T06:49:32Z")
Hi Team, I have setup of a ELK with 3 node cluster. I want to integrate elastic with service now for auto ticketing. What will be the possible ways to do this? For this service now Integration can we use basic au… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1256) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1258)