# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1317 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1318 --- ## [Exiting: Index management requested but the Elasticsearch output is not configured/enabled](https://discuss.elastic.co/t/exiting-index-management-requested-but-the-elasticsearch-output-is-not-configured-enabled/276274)
**Author:** [@Akanksha\_Pandey](https://discuss.elastic.co/u/Akanksha_Pandey)\ **Replies:** 5\ **Last updated:** [July 19, 2021, 7:57am UTC](https://discuss.elastic.co/t/exiting-index-management-requested-but-the-elasticsearch-output-is-not-configured-enabled/276274 "2021-07-19T07:57:08Z")
While running filebeat setup -e I'm getting this error. Can anyone help me? @Marius\_Iversen 2021-06-17T01:04:54.187-0700 INFO instance/beat.go:665 Home path: \[/usr/share/filebeat\] Config path: \[/etc/filebeat\] Data path… --- ## [Performance issue in Azure](https://discuss.elastic.co/t/performance-issue-in-azure/279026)
**Author:** [@Kai\_Shen](https://discuss.elastic.co/u/Kai_Shen)\ **Replies:** 0\ **Last updated:** [July 19, 2021, 7:24am UTC](https://discuss.elastic.co/t/performance-issue-in-azure/279026 "2021-07-19T07:24:08Z")
Hi, a customer is running into performance issues on Azure. His environment: 3 nodes cluster, 8 GB RAM each. 1 index (around 10 fields), 4 GB storage for this index, so very small. Here are his observations: A query i… --- ## [What is the best way to store unique values of a field](https://discuss.elastic.co/t/what-is-the-best-way-to-store-unique-values-of-a-field/278548)
**Author:** [@OmarDacca](https://discuss.elastic.co/u/OmarDacca)\ **Replies:** 6\ **Last updated:** [July 19, 2021, 7:28am UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-store-unique-values-of-a-field/278548 "2021-07-19T07:28:51Z")
Hi, I have a raw data index, every document has the fields: device, country, browser, utm and many more... I need a way to extract the unique values of each field and store all of them in an index lets call it 'lookups… --- ## [Query for specific pair of fields in Elastic](https://discuss.elastic.co/t/query-for-specific-pair-of-fields-in-elastic/279025)
**Author:** [@saif3r](https://discuss.elastic.co/u/saif3r)\ **Replies:** 1\ **Last updated:** [July 19, 2021, 7:28am UTC](https://discuss.elastic.co/t/query-for-specific-pair-of-fields-in-elastic/279025 "2021-07-19T07:28:20Z")
Hello, I have two documents: POST query\_test/\_doc { "field": \[ { "field1": "Pam", "field2": "Beesly" }, { "field1": "Jim", "field2": "Halpert" } \] } POST query\_test/\_doc { … --- ## [Forward azure logs with syslog?](https://discuss.elastic.co/t/forward-azure-logs-with-syslog/279022)
**Author:** [@JaVa](https://discuss.elastic.co/u/JaVa)\ **Replies:** 0\ **Last updated:** [July 19, 2021, 6:57am UTC](https://discuss.elastic.co/t/forward-azure-logs-with-syslog/279022 "2021-07-19T06:57:59Z")
Sorry for the dumb questions (newbie here) but is there any way of forwarding azure logs from Logstash to another SIEM product? I configured our ELK stack to receive Azure events from the cloud with Logstash azure module… --- ## [Not able to get Floating value in Kibana](https://discuss.elastic.co/t/not-able-to-get-floating-value-in-kibana/279021)
**Author:** [@Saravana37](https://discuss.elastic.co/u/Saravana37)\ **Replies:** 0\ **Last updated:** [July 19, 2021, 6:57am UTC](https://discuss.elastic.co/t/not-able-to-get-floating-value-in-kibana/279021 "2021-07-19T06:57:20Z")
Hello All , I am trying to display one SQL column value TIME\_DIFF in Kibana. which is shown below. But it is displaying in Kibana as shown below . I am trying to convert this using mutate , \> filter { \> mutate { … --- ## [Filebeat: How can I add tags to module input in filebeat?](https://discuss.elastic.co/t/filebeat-how-can-i-add-tags-to-module-input-in-filebeat/276781)
**Author:** [@connectgeeks](https://discuss.elastic.co/u/connectgeeks)\ **Replies:** 4\ **Last updated:** [July 19, 2021, 6:38am UTC](https://discuss.elastic.co/t/filebeat-how-can-i-add-tags-to-module-input-in-filebeat/276781 "2021-07-19T06:38:36Z")
I'm using filebeat module and want to use tag so that I can process different input files based on tags. How can I achieve that ? Below tags doesn't seems to work. modules.d/elasticsearch.yml - module: elasticsearch … --- ## [Deploy Agents on Multiple Servers](https://discuss.elastic.co/t/deploy-agents-on-multiple-servers/278830)
**Author:** [@Ashwin\_Patil1](https://discuss.elastic.co/u/Ashwin_Patil1)\ **Replies:** 4\ **Last updated:** [July 19, 2021, 6:30am UTC](https://discuss.elastic.co/t/deploy-agents-on-multiple-servers/278830 "2021-07-19T06:30:40Z")
I have to deploy winlogbeat agent on 250 windows servers, what would be the best and efficient way of doing this? --- ## [How to Deploy Agents on Multiple Servers](https://discuss.elastic.co/t/how-to-deploy-agents-on-multiple-servers/279018)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 0\ **Last updated:** [July 19, 2021, 6:29am UTC](https://discuss.elastic.co/t/how-to-deploy-agents-on-multiple-servers/279018 "2021-07-19T06:29:37Z")
Hello team, I have installed beat agents on single machine and I want to get them installed (filebeat) on 500 windows and 200 linux machine. I don't want to login to each and every machine and install them. I want to r… --- ## [Elasticsearch storage problem](https://discuss.elastic.co/t/elasticsearch-storage-problem/277850)
**Author:** [@bab](https://discuss.elastic.co/u/bab)\ **Replies:** 5\ **Last updated:** [July 19, 2021, 5:27am UTC](https://discuss.elastic.co/t/elasticsearch-storage-problem/277850 "2021-07-19T05:27:27Z")
Hi guys, I am facing this problem from time to time, would like to know where does this come from and how can I get rid of this completely. the problem stays a few minutes u d after that goes away and can access my ES i… --- ## [Index.final\_pipeline not working as expected](https://discuss.elastic.co/t/index-final-pipeline-not-working-as-expected/276195)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 6\ **Last updated:** [July 19, 2021, 2:19am UTC](https://discuss.elastic.co/t/index-final-pipeline-not-working-as-expected/276195 "2021-07-19T02:19:46Z")
Hello, I have a filebeat that uses a module with a ingest pipeline, since I still need to make some transformations I'm trying to use another ingest pipeline with the setting index.final\_pipeline in the index settings. … --- ## [Can we create alias for other aliases?](https://discuss.elastic.co/t/can-we-create-alias-for-other-aliases/278994)
**Author:** [@im-pratham](https://discuss.elastic.co/u/im-pratham)\ **Replies:** 1\ **Last updated:** [July 19, 2021, 2:11am UTC](https://discuss.elastic.co/t/can-we-create-alias-for-other-aliases/278994 "2021-07-19T02:11:38Z")
How can i create alias with other aliases? Is this possible? --- ## [Increase in response time for aggregations in 7.10.1](https://discuss.elastic.co/t/increase-in-response-time-for-aggregations-in-7-10-1/276295)
**Author:** [@rgopalan](https://discuss.elastic.co/u/rgopalan)\ **Replies:** 6\ **Last updated:** [July 19, 2021, 12:54am UTC](https://discuss.elastic.co/t/increase-in-response-time-for-aggregations-in-7-10-1/276295 "2021-07-19T00:54:56Z")
Hi, We recently upgraded our ElasticSearch cluster from 7.7 to 7.10.1 and we are seeing an increase in the response time. One query that uses aggregations has seen the response time increase by 1-1.5s. Setup \* 3 Mast… --- ## [Functionbeat ignores default region - only deploys to us-east-1 (AWS)](https://discuss.elastic.co/t/functionbeat-ignores-default-region-only-deploys-to-us-east-1-aws/276002)
**Author:** [@Phuurl](https://discuss.elastic.co/u/Phuurl)\ **Replies:** 4\ **Last updated:** [July 18, 2021, 7:59pm UTC](https://discuss.elastic.co/t/functionbeat-ignores-default-region-only-deploys-to-us-east-1-aws/276002 "2021-07-18T19:59:38Z")
Hey, Trying to deploy the latest Functionbeat version (7.13.x), and it appears that Functionbeat is ignoring the AWS\_DEFAULT\_REGION environment variable when deploying - it always deploys to North Virginia (us-east-1) i… --- ## [Kibana Circuit breaker exception -Data too large, data for \[\\]](https://discuss.elastic.co/t/kibana-circuit-breaker-exception-data-too-large-data-for-http-request/278959)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 2\ **Last updated:** [July 18, 2021, 7:24pm UTC](https://discuss.elastic.co/t/kibana-circuit-breaker-exception-data-too-large-data-for-http-request/278959 "2021-07-18T19:24:42Z")
Hi all, One of my Kibana instances crashes everytime with below message: {"statusCode":401,"error":"Unauthorized","message":"\[circuit\_breaking\_exception\] \[parent\] Data too large, data for \[\\] would be \[104… --- ## [Writing DSL Query to find documents for dyanmic fields in the index](https://discuss.elastic.co/t/writing-dsl-query-to-find-documents-for-dyanmic-fields-in-the-index/278985)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 1\ **Last updated:** [July 18, 2021, 4:35pm UTC](https://discuss.elastic.co/t/writing-dsl-query-to-find-documents-for-dyanmic-fields-in-the-index/278985 "2021-07-18T16:35:06Z")
Hi All, I want to write a DSL Query that will fetch results from fields. GET condition/\_search { "query": { "range" : { "tag.value" : { "gte" : "operational.threshold", … --- ## [Metricbeat issue](https://discuss.elastic.co/t/metricbeat-issue/278743)
**Author:** [@raj\_mouriya](https://discuss.elastic.co/u/raj_mouriya)\ **Replies:** 2\ **Last updated:** [July 18, 2021, 2:20pm UTC](https://discuss.elastic.co/t/metricbeat-issue/278743 "2021-07-18T14:20:30Z")
Exiting: error connecting to Kibana: fail to get the Kibana version: HTTP GET request to https://localhost:5601/api/status fails: fail to execute the HTTP GET request: Get "https://localhost:5601/api/status": dial tcp \[:… --- ## [Unknown issue with Elastic snapshots](https://discuss.elastic.co/t/unknown-issue-with-elastic-snapshots/278442)
**Author:** [@kcarsey](https://discuss.elastic.co/u/kcarsey)\ **Replies:** 1\ **Last updated:** [July 18, 2021, 1:49pm UTC](https://discuss.elastic.co/t/unknown-issue-with-elastic-snapshots/278442 "2021-07-18T13:49:27Z")
I will provide a bit of backstory information here as I think it could be relevant. I run several ec2 Elastic clusters in AWS, all being backed up by snapshot to aws s3. I have recently created two new clusters in us-e… --- ## [S3 bucket size holding the snapshots is 2-2.5x of the total disk used of the cluster](https://discuss.elastic.co/t/s3-bucket-size-holding-the-snapshots-is-2-2-5x-of-the-total-disk-used-of-the-cluster/278944)
**Author:** [@MitParekh](https://discuss.elastic.co/u/MitParekh)\ **Replies:** 3\ **Last updated:** [July 17, 2021, 8:01pm UTC](https://discuss.elastic.co/t/s3-bucket-size-holding-the-snapshots-is-2-2-5x-of-the-total-disk-used-of-the-cluster/278944 "2021-07-17T20:01:49Z")
Hi, I have a cluster (ES 7.11.1) with 6 nodes and the total disk used is roughly ~4.5TB. I store logging data in it using data streams. My data stream patterns are like abc-lmn-xyz. The data retention period is 14 days. … --- ## [Composite aggregation on runtime field in 6.2](https://discuss.elastic.co/t/composite-aggregation-on-runtime-field-in-6-2/278990)
**Author:** [@strutdepot-discsn](https://discuss.elastic.co/u/strutdepot-discsn)\ **Replies:** 0\ **Last updated:** [July 18, 2021, 1:15pm UTC](https://discuss.elastic.co/t/composite-aggregation-on-runtime-field-in-6-2/278990 "2021-07-18T13:15:09Z")
I have "city", "state" and "country" fields in the index and need to calculate the document count by each city. The index contains more than 2 million documents. This was my first stab at it: get students/\_search { "… --- ## [Expected \[SRART\_OBJECT\] but found \[START\_ARRAY\]](https://discuss.elastic.co/t/expected-srart-object-but-found-start-array/278667)
**Author:** [@Eran1](https://discuss.elastic.co/u/Eran1)\ **Replies:** 4\ **Last updated:** [July 18, 2021, 12:23pm UTC](https://discuss.elastic.co/t/expected-srart-object-but-found-start-array/278667 "2021-07-18T12:23:13Z")
Hi, I'm using python to connect to elastic as following: import urllib3 from elasticsearch import Elasticsearch from elasticsearch.connection import create\_ssl\_context import configparser def get\_es\_session(es\_u… --- ## [Could Update/Get/Delete an document on an alias accociated to multiple indexes?](https://discuss.elastic.co/t/could-update-get-delete-an-document-on-an-alias-accociated-to-multiple-indexes/278986)
**Author:** [@light\_chen](https://discuss.elastic.co/u/light_chen)\ **Replies:** 1\ **Last updated:** [July 18, 2021, 12:02pm UTC](https://discuss.elastic.co/t/could-update-get-delete-an-document-on-an-alias-accociated-to-multiple-indexes/278986 "2021-07-18T12:02:25Z")
In order to reduce the size of index (I hear that it is better to keep the size lower than 25~30GB per index), I split the data into several indexes using Rollover API. Then I create two alias, in my expectation, the on… --- ## [Logstash and Json, How to ingest this fragment:](https://discuss.elastic.co/t/logstash-and-json-how-to-ingest-this-fragment/278966)
**Author:** [@cibernicola](https://discuss.elastic.co/u/cibernicola)\ **Replies:** 2\ **Last updated:** [July 18, 2021, 11:02am UTC](https://discuss.elastic.co/t/logstash-and-json-how-to-ingest-this-fragment/278966 "2021-07-18T11:02:59Z")
I'm trying to ingest json data with this format: {"info":{"page":1,"pages":53431,"results":53431},"plugins":\[{"name":"Contact Form 7","slug":"contact-form-7","version":"5.4.2","author":"\ **Author:** [@Jedrick](https://discuss.elastic.co/u/Jedrick)\ **Replies:** 3\ **Last updated:** [July 18, 2021, 9:24am UTC](https://discuss.elastic.co/t/failed-to-start-elastic-search/278899 "2021-07-18T09:24:36Z") Hi, Good day. Can you help me with my problem with elastic search? Currently, i am building a Wazuh siem that uses elastic search functions. As I checked, Filebeat, kibana services are running. But the elasticsearch … --- ## [Filter with Grok and KV](https://discuss.elastic.co/t/filter-with-grok-and-kv/278697)
**Author:** [@Sunflower](https://discuss.elastic.co/u/Sunflower)\ **Replies:** 5\ **Last updated:** [July 18, 2021, 6:52am UTC](https://discuss.elastic.co/t/filter-with-grok-and-kv/278697 "2021-07-18T06:52:22Z")
Hi, I'm trying to understand if I'm using the correct configuration for the following logs, or if there is a more efficient option for it. 2021-07-13T10:05:06.061Z 10.20.30.40 \<110\>1 2021-07-13T08:46:58Z 44.236.133.39… --- ## [Reindexing Old index](https://discuss.elastic.co/t/reindexing-old-index/278360)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 3\ **Last updated:** [July 18, 2021, 3:50am UTC](https://discuss.elastic.co/t/reindexing-old-index/278360 "2021-07-18T03:50:51Z")
I want to reindex old index but the problem my alias is writing to current index health status index uuid pri rep docs.count docs.deleted store.size pri.store.size green ope… --- ## [Lost data in kibana but show in syslog logstash](https://discuss.elastic.co/t/lost-data-in-kibana-but-show-in-syslog-logstash/278894)
**Author:** [@quyennguyen](https://discuss.elastic.co/u/quyennguyen)\ **Replies:** 11\ **Last updated:** [July 17, 2021, 7:49pm UTC](https://discuss.elastic.co/t/lost-data-in-kibana-but-show-in-syslog-logstash/278894 "2021-07-17T19:49:07Z")
I have conf file in logstash like this input { beats { host =\> "0.0.0.0" port =\> 5044 ssl =\> false } } filter { if \[fileset\]\[name\] == "auth" { grok { match =\> { "message" =\> "%{SYSLOGT… --- ## [HELP! Logstash restarting after ip2location plugin update](https://discuss.elastic.co/t/help-logstash-restarting-after-ip2location-plugin-update/278957)
**Author:** [@rojin](https://discuss.elastic.co/u/rojin)\ **Replies:** 4\ **Last updated:** [July 17, 2021, 6:33pm UTC](https://discuss.elastic.co/t/help-logstash-restarting-after-ip2location-plugin-update/278957 "2021-07-17T18:33:59Z")
I had an issue with logstash restarting so I updated ip2location plugin and now it keeps restarting every 15 seconds. The error before was ConcurrentModificationException: null. I use logstash v 7.4.2 and the plugin ver… --- ## [I am trying to pick a field from one event to another using aggregation filter](https://discuss.elastic.co/t/i-am-trying-to-pick-a-field-from-one-event-to-another-using-aggregation-filter/278955)
**Author:** [@Kamikaze\_K](https://discuss.elastic.co/u/Kamikaze_K)\ **Replies:** 1\ **Last updated:** [July 17, 2021, 6:10pm UTC](https://discuss.elastic.co/t/i-am-trying-to-pick-a-field-from-one-event-to-another-using-aggregation-filter/278955 "2021-07-17T18:10:01Z")
have log files that I am able to get fields based on two different if/grok statements and patterns. The output from the two are like below; { timestamp" =\> 2021-06-09T03:08:30.943Z, "Loc" =\> "91340", … --- ## [Ailed to parse field \[host\] of type \[text\] in document with id](https://discuss.elastic.co/t/ailed-to-parse-field-host-of-type-text-in-document-with-id/278963)
**Author:** [@Bhuwaneshwar](https://discuss.elastic.co/u/Bhuwaneshwar)\ **Replies:** 1\ **Last updated:** [July 17, 2021, 6:05pm UTC](https://discuss.elastic.co/t/ailed-to-parse-field-host-of-type-text-in-document-with-id/278963 "2021-07-17T18:05:00Z")
Dear Team I am getting below error on Logstash. "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse field \[host\] of type \[text\] in document with id '4qrUs3oBqKFEAtQHASue'. Preview of field's value:… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1316) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1318)