# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1295 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1296 --- ## [What is the version map memory?](https://discuss.elastic.co/t/what-is-the-version-map-memory/280332)
**Author:** [@eyecan](https://discuss.elastic.co/u/eyecan)\ **Replies:** 4\ **Last updated:** [August 4, 2021, 8:46am UTC](https://discuss.elastic.co/t/what-is-the-version-map-memory/280332 "2021-08-04T08:46:36Z")
Hello, In the cluster or node stats API there is a field version\_map\_memory. What is the version map? Thanks! --- ## [Timestamp copy problem with Timezone](https://discuss.elastic.co/t/timestamp-copy-problem-with-timezone/279992)
**Author:** [@Kubix0](https://discuss.elastic.co/u/Kubix0)\ **Replies:** 2\ **Last updated:** [July 29, 2021, 3:31pm UTC](https://discuss.elastic.co/t/timestamp-copy-problem-with-timezone/279992 "2021-07-29T15:31:21Z")
Hey there, my first topic here. Wanted to ask some help because I can´t find a answer/solution for my problem. So, I have a Logstash filter that copy the @timestamp filed to make Timestamp more friendly for elastalert. … --- ## [Table](https://discuss.elastic.co/t/table/280299)
**Author:** [@Krunal](https://discuss.elastic.co/u/Krunal)\ **Replies:** 3\ **Last updated:** [August 4, 2021, 8:34am UTC](https://discuss.elastic.co/t/table/280299 "2021-08-04T08:34:38Z")
I would like to remove the value "0" or null from the table. In the table, I have implemented serial difference aggregation but it shows all the value which includes 0 and null. I would like to exclude this. Thank … --- ## [Calculate a new field into new index](https://discuss.elastic.co/t/calculate-a-new-field-into-new-index/280266)
**Author:** [@shifenglim](https://discuss.elastic.co/u/shifenglim)\ **Replies:** 3\ **Last updated:** [August 4, 2021, 8:12am UTC](https://discuss.elastic.co/t/calculate-a-new-field-into-new-index/280266 "2021-08-04T08:12:43Z")
I am displaying my data in grafana using elasticseach as a datasource and using a plugin there called metaqueries to help do a calculation on elasticsearch's field like: A: queryA B: queryB C: queryC D: (A+B) / C I … --- ## [Edit the max sub buckets in aggregation based | query on multiple indexes](https://discuss.elastic.co/t/edit-the-max-sub-buckets-in-aggregation-based-query-on-multiple-indexes/280285)
**Author:** [@Aviel\_Bashari](https://discuss.elastic.co/u/Aviel_Bashari)\ **Replies:** 6\ **Last updated:** [August 4, 2021, 7:53am UTC](https://discuss.elastic.co/t/edit-the-max-sub-buckets-in-aggregation-based-query-on-multiple-indexes/280285 "2021-08-04T07:53:39Z")
Hi, I having 2 questions: 1. I'm trying to create a graph and want more than 3 subbuckets,my steps are as follow: using 'aggregation based ' --\> 'line' --\> choose my index then i choose the X and Y axis and want mor… --- ## [Filebeat sending two logs in nginx module](https://discuss.elastic.co/t/filebeat-sending-two-logs-in-nginx-module/279951)
**Author:** [@boris\_asapov](https://discuss.elastic.co/u/boris_asapov)\ **Replies:** 1\ **Last updated:** [August 4, 2021, 7:43am UTC](https://discuss.elastic.co/t/filebeat-sending-two-logs-in-nginx-module/279951 "2021-08-04T07:43:10Z")
hi all, i've configured nginx module in filebeat , send access log to ELK stack ( logstash ) and its working fine but somehow filebeat sending two logs to logstash instead of one my logstash index is : index =\> "%{\[b… --- ## [Cloudtrail to Logstash automatic roll over on prefix date](https://discuss.elastic.co/t/cloudtrail-to-logstash-automatic-roll-over-on-prefix-date/280376)
**Author:** [@TsuWeiQuan](https://discuss.elastic.co/u/TsuWeiQuan)\ **Replies:** 0\ **Last updated:** [August 4, 2021, 2:19am UTC](https://discuss.elastic.co/t/cloudtrail-to-logstash-automatic-roll-over-on-prefix-date/280376 "2021-08-04T02:19:09Z")
Hi, I am trying to ingest cloudtrail logs to logstash to detect a certain event. I have installed logstash-codec-cloudtrail plugin and was able to ingest cloudtrail logs if i point to a specific folder. Currently i am … --- ## [Refresh in pipeline: output and/or filter](https://discuss.elastic.co/t/refresh-in-pipeline-output-and-or-filter/278044)
**Author:** [@itokai](https://discuss.elastic.co/u/itokai)\ **Replies:** 6\ **Last updated:** [August 4, 2021, 6:54am UTC](https://discuss.elastic.co/t/refresh-in-pipeline-output-and-or-filter/278044 "2021-08-04T06:54:33Z")
Hi, in logstash pipeline consecutive documents are consumed from RabbitMQ. Sometimes need to perform lookup on already imported documents via filter-\>elasticsearch-\>query\_template. However, lookup doesn't query the lat… --- ## [How to use ingest pipelines and processors](https://discuss.elastic.co/t/how-to-use-ingest-pipelines-and-processors/279576)
**Author:** [@ailengcon](https://discuss.elastic.co/u/ailengcon)\ **Replies:** 10\ **Last updated:** [August 4, 2021, 5:48am UTC](https://discuss.elastic.co/t/how-to-use-ingest-pipelines-and-processors/279576 "2021-08-04T05:48:07Z")
So thankful if someone could help me out. I have synced data from a mongodb to elastic with Monstache. Some of the data is mapped so when I make searches, the presentation of the data is rather messy and unstructured, n… --- ## [Pass 2 values for Kibana drilldown](https://discuss.elastic.co/t/pass-2-values-for-kibana-drilldown/280360)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 2\ **Last updated:** [August 4, 2021, 4:44am UTC](https://discuss.elastic.co/t/pass-2-values-for-kibana-drilldown/280360 "2021-08-04T04:44:08Z")
Hi all, I'm having a dashboard where for Drilldown, i need to pass 2 field values i.e company id and computer id to drill down into computer of a particular company. But Kibana drilldown only supports 1 value, I'm unab… --- ## [Index files from a folder in GCS bucket using logstash GCS plugin](https://discuss.elastic.co/t/index-files-from-a-folder-in-gcs-bucket-using-logstash-gcs-plugin/280384)
**Author:** [@madhanbaskar](https://discuss.elastic.co/u/madhanbaskar)\ **Replies:** 0\ **Last updated:** [August 4, 2021, 5:12am UTC](https://discuss.elastic.co/t/index-files-from-a-folder-in-gcs-bucket-using-logstash-gcs-plugin/280384 "2021-08-04T05:12:42Z")
Hi, I have a scenario where in the gcs bucket has multiple folders like dev and qa. Now by using logstash GCS plugin I have to read only the files from dev folder and not from qa. How is this possible? The below config… --- ## [Esrally when gave "index": "\_all", it executes search queries on all the indices instead of search only the defined indices](https://discuss.elastic.co/t/esrally-when-gave-index-all-it-executes-search-queries-on-all-the-indices-instead-of-search-only-the-defined-indices/280207)
**Author:** [@Sameera\_De\_Silva](https://discuss.elastic.co/u/Sameera_De_Silva)\ **Replies:** 4\ **Last updated:** [August 4, 2021, 5:04am UTC](https://discuss.elastic.co/t/esrally-when-gave-index-all-it-executes-search-queries-on-all-the-indices-instead-of-search-only-the-defined-indices/280207 "2021-08-04T05:04:58Z")
I have a requirement to do a simultaneous multiple search query execution in 3 indices . So I defiend them in below track.json and added "index": "\_all", as per the answer of Can't configure multiple indices on which … --- ## [Unable to configure Wildcard certificate in Elasticsearch](https://discuss.elastic.co/t/unable-to-configure-wildcard-certificate-in-elasticsearch/280379)
**Author:** [@Sathish22](https://discuss.elastic.co/u/Sathish22)\ **Replies:** 1\ **Last updated:** [August 4, 2021, 4:56am UTC](https://discuss.elastic.co/t/unable-to-configure-wildcard-certificate-in-elasticsearch/280379 "2021-08-04T04:56:12Z")
Hi Team, We are facing issue replacing wildcard certificate with self-signed certificate, due to below issue. Caused by: java.security.UnrecoverableKeyException: failed to decrypt safe contents entry: javax.crypto.BadP… --- ## [Number of CPU cores and Number of nodes relationship](https://discuss.elastic.co/t/number-of-cpu-cores-and-number-of-nodes-relationship/280323)
**Author:** [@sourabhsuman](https://discuss.elastic.co/u/sourabhsuman)\ **Replies:** 3\ **Last updated:** [August 4, 2021, 4:42am UTC](https://discuss.elastic.co/t/number-of-cpu-cores-and-number-of-nodes-relationship/280323 "2021-08-04T04:42:21Z")
What is the relation between the number of CPU cores, threads, and node sizing. What is the impact in these two cases allocator HOT of 64 CPU and 512 RAM vs 32 CPU & 256 RAM. The allocator HOT nod count changed from 6 to… --- ## [Records not indexed with Logstash](https://discuss.elastic.co/t/records-not-indexed-with-logstash/280124)
**Author:** [@deadloss](https://discuss.elastic.co/u/deadloss)\ **Replies:** 8\ **Last updated:** [August 4, 2021, 4:41am UTC](https://discuss.elastic.co/t/records-not-indexed-with-logstash/280124 "2021-08-04T04:41:36Z")
I am facing this issue, the number of events out by elasticsearch output plugin(using logstash monitoring api) is equal to records in csv this means all records in csv are sent to ES but unfortunately the records are alw… --- ## [Description Failed to start elasticSearch source code compiling on Windows](https://discuss.elastic.co/t/description-failed-to-start-elasticsearch-source-code-compiling-on-windows/280177)
**Author:** [@liuliugang](https://discuss.elastic.co/u/liuliugang)\ **Replies:** 8\ **Last updated:** [August 4, 2021, 3:27am UTC](https://discuss.elastic.co/t/description-failed-to-start-elasticsearch-source-code-compiling-on-windows/280177 "2021-08-04T03:27:37Z")
How do I set es.path.conf? Is there a file explaining the setting method of this parameter in the project? Please advise. Thank you IntelliJ IDEA version:2021.1 Elasticsearch version:7.10.0 Jdk version:14.0.2 Gra… --- ## [Rollover Index reaches maximum number](https://discuss.elastic.co/t/rollover-index-reaches-maximum-number/280312)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 2\ **Last updated:** [August 4, 2021, 3:02am UTC](https://discuss.elastic.co/t/rollover-index-reaches-maximum-number/280312 "2021-08-04T03:02:32Z")
Hello Team I am using Elasticsearch version 7.8.0 I am having Rollover define for my indices. I would like to understand , what will happen if my index reaches maximum numbers : my-index-999999 Will its stop after t… --- ## [Not able to login to Kibana](https://discuss.elastic.co/t/not-able-to-login-to-kibana/280350)
**Author:** [@Harnoor\_Singh](https://discuss.elastic.co/u/Harnoor_Singh)\ **Replies:** 2\ **Last updated:** [August 4, 2021, 2:53am UTC](https://discuss.elastic.co/t/not-able-to-login-to-kibana/280350 "2021-08-04T02:53:49Z")
I restored my elasticsearch and Kibana instance on AWS instance. I had to create all indices and users again. I updated kibana.yml with new user credential to connect to elasticsearch. Yet none of the built in users or n… --- ## [Setting up security and alerting in basic license cluster](https://discuss.elastic.co/t/setting-up-security-and-alerting-in-basic-license-cluster/280296)
**Author:** [@azxqw](https://discuss.elastic.co/u/azxqw)\ **Replies:** 2\ **Last updated:** [August 4, 2021, 2:50am UTC](https://discuss.elastic.co/t/setting-up-security-and-alerting-in-basic-license-cluster/280296 "2021-08-04T02:50:34Z")
Hi I want to enable the security settings to use the alerting capabillites of the stack. What i dont understand from the user guide is this - do i need to do what is told on every node in the cluster? --- ## [Dynamic rollover alias and template name](https://discuss.elastic.co/t/dynamic-rollover-alias-and-template-name/280371)
**Author:** [@tong6462](https://discuss.elastic.co/u/tong6462)\ **Replies:** 6\ **Last updated:** [August 4, 2021, 1:32am UTC](https://discuss.elastic.co/t/dynamic-rollover-alias-and-template-name/280371 "2021-08-04T01:32:57Z")
Hi. Could it be possible to allow using variables in the properties " ilm\_rollover\_alias " as well as " template\_name " in the Elasticsearch output, like we can do with the "index" property? Index lifecycle error ille… --- ## [Kibana can't find the index](https://discuss.elastic.co/t/kibana-cant-find-the-index/280076)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 4\ **Last updated:** [August 4, 2021, 1:12am UTC](https://discuss.elastic.co/t/kibana-cant-find-the-index/280076 "2021-08-04T01:12:54Z")
I have registered the following index in elasticsearch. # curl --user {usr}:{pw} -X GET http://localhost:9200/\_cat/indices/test-\*?v health status index uuid pri rep docs.count docs.deleted st… --- ## [Metricbeat azure module - Simultaneously fetch multi-dimensional metric values](https://discuss.elastic.co/t/metricbeat-azure-module-simultaneously-fetch-multi-dimensional-metric-values/280326)
**Author:** [@ag\_joeb](https://discuss.elastic.co/u/ag_joeb)\ **Replies:** 0\ **Last updated:** [August 3, 2021, 2:03pm UTC](https://discuss.elastic.co/t/metricbeat-azure-module-simultaneously-fetch-multi-dimensional-metric-values/280326 "2021-08-03T14:03:30Z")
I'm trying to fetch Cosmos DB metrics from azure using metricbeat's azure module. An example: - module: azure metricsets: - monitor enabled: true period: 30s client\_id: '\' client\_secret: '\ **Author:** [@Wayne\_Taylor](https://discuss.elastic.co/u/Wayne_Taylor)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 11:29pm UTC](https://discuss.elastic.co/t/ilm-questions/205298 "2021-08-03T23:29:52Z") Hi Elastic Team, I know there is a lot of questions on ILM which encompasses both the Elasticsearch aspects as well as Kibana. Background: We use Fluentd for our log ingestion framework developed by our DevOps teams t… --- ## [ILM Error](https://discuss.elastic.co/t/ilm-error/192773)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 10\ **Last updated:** [August 3, 2021, 11:22pm UTC](https://discuss.elastic.co/t/ilm-error/192773 "2021-08-03T23:22:50Z")
Started getting the following error for multiple indices a few days ago, not just Winlogbeat indices. I'm running Elastic Stack 7.2.0, how do I resolve this? illegal\_argument\_exception: index.lifecycle.rollover\_alias \[… --- ## [Using ILM: error's on more then one write index](https://discuss.elastic.co/t/using-ilm-errors-on-more-then-one-write-index/272804)
**Author:** [@robbert](https://discuss.elastic.co/u/robbert)\ **Replies:** 3\ **Last updated:** [August 3, 2021, 11:15pm UTC](https://discuss.elastic.co/t/using-ilm-errors-on-more-then-one-write-index/272804 "2021-08-03T23:15:21Z")
Greetings, Currently i am in the process of migrating our ELK instance from manual index deletion to using ILM policy, however filebeat is sending logs to logstash but the following error is shown in the logs of logstas… --- ## [IllegalStateException: alias has more than one write index](https://discuss.elastic.co/t/illegalstateexception-alias-has-more-than-one-write-index/254065)
**Author:** [@exper0](https://discuss.elastic.co/u/exper0)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 11:08pm UTC](https://discuss.elastic.co/t/illegalstateexception-alias-has-more-than-one-write-index/254065 "2021-08-03T23:08:39Z")
Hello, I'm getting the same error on all ES data nodes saying that alias has more than one write index so none of data nodes can actually start, cluster is dead. Is there any way to fix the problem without deleting all … --- ## [ES fails to start with error index has more than one write index](https://discuss.elastic.co/t/es-fails-to-start-with-error-index-has-more-than-one-write-index/245828)
**Author:** [@Prashant\_Agrawal](https://discuss.elastic.co/u/Prashant_Agrawal)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 11:07pm UTC](https://discuss.elastic.co/t/es-fails-to-start-with-error-index-has-more-than-one-write-index/245828 "2021-08-03T23:07:20Z")
There was an ES cluster which was running for a while but suddenly docker got restarted and all nodes started to fail with below error: "stacktrace": \["org.elasticsearch.bootstrap.StartupException: java.lang.IllegalSta… --- ## [IllegalStateException: Alias has more than one write index](https://discuss.elastic.co/t/illegalstateexception-alias-has-more-than-one-write-index/210771)
**Author:** [@tami](https://discuss.elastic.co/u/tami)\ **Replies:** 3\ **Last updated:** [August 3, 2021, 11:05pm UTC](https://discuss.elastic.co/t/illegalstateexception-alias-has-more-than-one-write-index/210771 "2021-08-03T23:05:58Z")
We are running version 6.8.3 with a 3.2.2 (master.client.data) setup. Our cluster is currently in the reds state: curl -X GET '$HOST/\_cat/health' 1575572989 19:09:49 es-cluster-dogfood red 6 1 1050 1050 0 0 1116 0 - 48… --- ## [Vega-lite: Able to set href on text mark?](https://discuss.elastic.co/t/vega-lite-able-to-set-href-on-text-mark/280345)
**Author:** [@todd-symmetry](https://discuss.elastic.co/u/todd-symmetry)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 10:57pm UTC](https://discuss.elastic.co/t/vega-lite-able-to-set-href-on-text-mark/280345 "2021-08-03T22:57:37Z")
I'm using vega-lite in a self-hosted Kibana to create a basic visualization -- just a text mark that shows a number plus the title. The whole point of this is to make the text link to another dashboard. I'm having no suc… --- ## [Tanium Configuring Elasticsearch destinations](https://discuss.elastic.co/t/tanium-configuring-elasticsearch-destinations/280291)
**Author:** [@travlest](https://discuss.elastic.co/u/travlest)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 10:45pm UTC](https://discuss.elastic.co/t/tanium-configuring-elasticsearch-destinations/280291 "2021-08-03T22:45:02Z")
Hi, I am new to ELK. I have deployed an ELK stack with Filebeat. Right now I would like to connect my ELK to Tanium using this documentation tanium. But I am encountering this error. I tried to find the solutions onl… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1294) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1296)