# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1337 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1338 --- ## [Extra memory required to accomodate extra buckets](https://discuss.elastic.co/t/extra-memory-required-to-accomodate-extra-buckets/277186)
**Author:** [@prashant1](https://discuss.elastic.co/u/prashant1)\ **Replies:** 5\ **Last updated:** [July 5, 2021, 2:06am UTC](https://discuss.elastic.co/t/extra-memory-required-to-accomodate-extra-buckets/277186 "2021-07-05T02:06:10Z")
We are getting too many buckets exception error in viewing the visualization. The default limit for max.buckets is 10000 if we want to increase this parameter to 20000 to resolve the exception so how much would be the e… --- ## [Snapshot on fast changing clusters](https://discuss.elastic.co/t/snapshot-on-fast-changing-clusters/276468)
**Author:** [@nadler](https://discuss.elastic.co/u/nadler)\ **Replies:** 5\ **Last updated:** [July 5, 2021, 2:01am UTC](https://discuss.elastic.co/t/snapshot-on-fast-changing-clusters/276468 "2021-07-05T02:01:15Z")
Hey, So, in the last two weeks i have encountered a problem with one of our clusters. I have a daily backup procedure running on it and often, while the snapshot procedure is running, we get the following exception: I… --- ## [Log fields are not parsing as expected using grok filter](https://discuss.elastic.co/t/log-fields-are-not-parsing-as-expected-using-grok-filter/277746)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 5\ **Last updated:** [July 4, 2021, 11:35pm UTC](https://discuss.elastic.co/t/log-fields-are-not-parsing-as-expected-using-grok-filter/277746 "2021-07-04T23:35:22Z")
Hi All, I am using below configuration and expecting it to get parse as per below fields. below is the pipeline.conf file. input { beats { port =\> "5044" } } filter { grok { match =\> { "mes… --- ## [Extract data from CSV column](https://discuss.elastic.co/t/extract-data-from-csv-column/277745)
**Author:** [@anon33720113](https://discuss.elastic.co/u/anon33720113)\ **Replies:** 3\ **Last updated:** [July 4, 2021, 8:49pm UTC](https://discuss.elastic.co/t/extract-data-from-csv-column/277745 "2021-07-04T20:49:44Z")
Hey I have logs as CSV and one column which is in string and has multiple values that need to extracted and stored as new fields. The column name is comment and it's value is VPN token auth failed. Destination was: 62.… --- ## [Can't add sample data to Kibana](https://discuss.elastic.co/t/cant-add-sample-data-to-kibana/277726)
**Author:** [@Chenlrv](https://discuss.elastic.co/u/Chenlrv)\ **Replies:** 3\ **Last updated:** [July 4, 2021, 7:03pm UTC](https://discuss.elastic.co/t/cant-add-sample-data-to-kibana/277726 "2021-07-04T19:03:33Z")
Hi, I created a new space and trying to add sample data to it. The "Add data" button is disabled for all of the 3 options, and there's a tooltip "Unable to verify dataset status, error: Response Error" How can I sol… --- ## [Logstash kafka input consumer group not finding all partitions](https://discuss.elastic.co/t/logstash-kafka-input-consumer-group-not-finding-all-partitions/277741)
**Author:** [@Bakkali\_Amine](https://discuss.elastic.co/u/Bakkali_Amine)\ **Replies:** 0\ **Last updated:** [July 4, 2021, 4:09pm UTC](https://discuss.elastic.co/t/logstash-kafka-input-consumer-group-not-finding-all-partitions/277741 "2021-07-04T16:09:30Z")
I have a topic with two partitions but logstash consume only one of them. "Adding newly assigned partitions: partition-0", it is missing the other partition. And when I delete my logstash pod (I'm on kubernetes) it rand… --- ## [Why is TermQuery so much faster than PointRangeQuery?](https://discuss.elastic.co/t/why-is-termquery-so-much-faster-than-pointrangequery/277740)
**Author:** [@asasas234](https://discuss.elastic.co/u/asasas234)\ **Replies:** 0\ **Last updated:** [July 4, 2021, 2:42pm UTC](https://discuss.elastic.co/t/why-is-termquery-so-much-faster-than-pointrangequery/277740 "2021-07-04T14:42:25Z")
I have 1 index with data volume around 80 million. I had 1 slow query before, which was 3 conditions, including 1 date equivalent query as well as 2 numeric column equivalent queries, and the query time was at least 5 se… --- ## [Index Shrinking?](https://discuss.elastic.co/t/index-shrinking/277739)
**Author:** [@herzel.sapago](https://discuss.elastic.co/u/herzel.sapago)\ **Replies:** 1\ **Last updated:** [July 4, 2021, 2:18pm UTC](https://discuss.elastic.co/t/index-shrinking/277739 "2021-07-04T14:18:37Z")
Hi We are implementing elastic in our company. As the person who responsible for it, I had been ask from my manager to check for grow of index each day and report it to group of managers. well I did it, finding that … --- ## [Elasticsearch-7.9.2-amd64.deb exit status 78](https://discuss.elastic.co/t/elasticsearch-7-9-2-amd64-deb-exit-status-78/277717)
**Author:** [@Sayantan\_Chakraborty](https://discuss.elastic.co/u/Sayantan_Chakraborty)\ **Replies:** 8\ **Last updated:** [July 4, 2021, 1:29pm UTC](https://discuss.elastic.co/t/elasticsearch-7-9-2-amd64-deb-exit-status-78/277717 "2021-07-04T13:29:29Z")
hi, i am facing a few issues for the Magento2.4.x installation. The process' exit code is 'exited' and its exit status is 78. Jul 04 02:12:40 somehost systemd\[1\]: elasticsearch.service: Failed with result\> -- Subject: U… --- ## [Impact of increasing index.max\_result\_window size to 10 million?](https://discuss.elastic.co/t/impact-of-increasing-index-max-result-window-size-to-10-million/277241)
**Author:** [@StringerBell](https://discuss.elastic.co/u/StringerBell)\ **Replies:** 2\ **Last updated:** [July 4, 2021, 1:34pm UTC](https://discuss.elastic.co/t/impact-of-increasing-index-max-result-window-size-to-10-million/277241 "2021-07-04T13:34:24Z")
I have a scenario where I want to increase the index.max\_result\_window size to about 10 million. My query only cares about fetching the sort order and not the actual \_source field. Does changing the max\_result\_window si… --- ## [Elasticsearch-plugin install PLUGIN hangs](https://discuss.elastic.co/t/elasticsearch-plugin-install-plugin-hangs/277732)
**Author:** [@mlrodrigo](https://discuss.elastic.co/u/mlrodrigo)\ **Replies:** 0\ **Last updated:** [July 4, 2021, 11:09am UTC](https://discuss.elastic.co/t/elasticsearch-plugin-install-plugin-hangs/277732 "2021-07-04T11:09:02Z")
Installing an Elasticsearch plugin hangs after a few tries due to (likely) a lack of entropy in /dev/random: bin/elasticsearch-plugin install analysis-smartcn --verbose -\> Installing analysis-smartcn Checking if url exi… --- ## [Elasticsearch Query Expansion problem, multi-field search](https://discuss.elastic.co/t/elasticsearch-query-expansion-problem-multi-field-search/277729)
**Author:** [@Federico\_Bottarelli](https://discuss.elastic.co/u/Federico_Bottarelli)\ **Replies:** 0\ **Last updated:** [July 4, 2021, 10:16am UTC](https://discuss.elastic.co/t/elasticsearch-query-expansion-problem-multi-field-search/277729 "2021-07-04T10:16:17Z")
Hi guys. I'm trying to expand some queries via Blind Relevance Feedback for an Information Retrieval project using TREC evaluation system, (CORD-19 database) I would like to use prefixes of the best terms instead of who… --- ## [\[Solved\] Elastic agent as fleet server auto shutdown for no reason in K8S](https://discuss.elastic.co/t/solved-elastic-agent-as-fleet-server-auto-shutdown-for-no-reason-in-k8s/277724)
**Author:** [@SaigyoujiYuyuko233](https://discuss.elastic.co/u/SaigyoujiYuyuko233)\ **Replies:** 2\ **Last updated:** [July 4, 2021, 9:26am UTC](https://discuss.elastic.co/t/solved-elastic-agent-as-fleet-server-auto-shutdown-for-no-reason-in-k8s/277724 "2021-07-04T09:26:05Z")
Contextualization I'm trying to run a fleet server using elastic agent in k8s Using docker img: docker.elastic.co/beats/elastic-agent:7.13.2 Elasticsearch Ver: 7.13.2 Kibana Ver: 7.13.2 What happened When the fleet s… --- ## [How to integrate CAS auth in Kibana?](https://discuss.elastic.co/t/how-to-integrate-cas-auth-in-kibana/277647)
**Author:** [@tong6462](https://discuss.elastic.co/u/tong6462)\ **Replies:** 3\ **Last updated:** [July 4, 2021, 9:12am UTC](https://discuss.elastic.co/t/how-to-integrate-cas-auth-in-kibana/277647 "2021-07-04T09:12:55Z")
Hi. I need to integrate CAS Auth in Kibana CAS URL: https://mydomain.com/sso/login Verify ticket: https://mydomain.com/sso/p3/serviceValidate? Can anyone help me please? --- ## [Imap Input - Java OutOfMemoryError](https://discuss.elastic.co/t/imap-input-java-outofmemoryerror/277720)
**Author:** [@RoteEdition](https://discuss.elastic.co/u/RoteEdition)\ **Replies:** 0\ **Last updated:** [July 4, 2021, 4:54am UTC](https://discuss.elastic.co/t/imap-input-java-outofmemoryerror/277720 "2021-07-04T04:54:17Z")
Hi there, i am trying to import about ~1000 Mails from my Inbox. I marked the first e-mail as unread, got the UID and activated uid\_tracking. The first ~60 mails got fetched like intended. I don't think it's my configu… --- ## [HEXADECIMAL string to Binary and Binary to decimal in log-stash using ruby filter](https://discuss.elastic.co/t/hexadecimal-string-to-binary-and-binary-to-decimal-in-log-stash-using-ruby-filter/277715)
**Author:** [@Kamikaze\_K](https://discuss.elastic.co/u/Kamikaze_K)\ **Replies:** 2\ **Last updated:** [July 4, 2021, 2:30am UTC](https://discuss.elastic.co/t/hexadecimal-string-to-binary-and-binary-to-decimal-in-log-stash-using-ruby-filter/277715 "2021-07-04T02:30:05Z")
I am working with logstash and I am using ruby filter to change HEX to decimal which works fine for one set of data. What I use for this is ; ruby{ code =\> "event.set('xxx', event.get('xx').hex)" } I am looking for s… --- ## [Json @timestamp vs date {}](https://discuss.elastic.co/t/json-timestamp-vs-date/277713)
**Author:** [@danielmotaleite](https://discuss.elastic.co/u/danielmotaleite)\ **Replies:** 2\ **Last updated:** [July 4, 2021, 12:23am UTC](https://discuss.elastic.co/t/json-timestamp-vs-date/277713 "2021-07-04T00:23:14Z")
From what i see, one should use in logstash the date {} to modify the event date, but setting the @timestamp field to seems to also work, at least when using json {}, @timestamp object seems to set the date correctly. I… --- ## [Dynamically Re-Indexing Old Indices After A Long Time](https://discuss.elastic.co/t/dynamically-re-indexing-old-indices-after-a-long-time/275302)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 1\ **Last updated:** [July 3, 2021, 7:42pm UTC](https://discuss.elastic.co/t/dynamically-re-indexing-old-indices-after-a-long-time/275302 "2021-07-03T19:42:53Z")
I have some indices like below; people\_in\_maribor people\_in\_rome etc. This indices get bigger after a long time. I want to ask how to reindex automatically old indices after a long time. As an example, I mean after… --- ## [Rally benchmarking Elasticsearch with 429 error code](https://discuss.elastic.co/t/rally-benchmarking-elasticsearch-with-429-error-code/276917)
**Author:** [@parallelism](https://discuss.elastic.co/u/parallelism)\ **Replies:** 1\ **Last updated:** [July 3, 2021, 6:11pm UTC](https://discuss.elastic.co/t/rally-benchmarking-elasticsearch-with-429-error-code/276917 "2021-07-03T18:11:18Z")
Hello, We are testing a new Elasticsearch cluster with Rally. The indexing task is getting an error rate greater than zero and we also found that the total number of indexed documents does not match the target number of… --- ## [Elasticsearch high load on some nodes](https://discuss.elastic.co/t/elasticsearch-high-load-on-some-nodes/276907)
**Author:** [@bxl](https://discuss.elastic.co/u/bxl)\ **Replies:** 1\ **Last updated:** [July 3, 2021, 6:08pm UTC](https://discuss.elastic.co/t/elasticsearch-high-load-on-some-nodes/276907 "2021-07-03T18:08:36Z")
os :CentOS Linux release 7.5.1804 (Core) java:1.8.0\_275 elasticsearch:6.8.1 ::: {192.168.1.3\_hot}{r6gbkwdTRDSUUooaLfWZPw}{djXsTjmBS3OM1IBzw4E2hA}{192.168.1.3}{192.168.1.3:9300}{ml.machine\_memory=540476571648, ml.max\_o… --- ## [Remove postfix of indices name on Restore](https://discuss.elastic.co/t/remove-postfix-of-indices-name-on-restore/276937)
**Author:** [@egibrajshori](https://discuss.elastic.co/u/egibrajshori)\ **Replies:** 1\ **Last updated:** [July 3, 2021, 6:05pm UTC](https://discuss.elastic.co/t/remove-postfix-of-indices-name-on-restore/276937 "2021-07-03T18:05:45Z")
I have a snapshot of an Elasticsearch cluster which has a number of indices. I have to restore the cluster on a new Elasticsearch cluster. All the indices have a -reindexed postfix as part of their name. What I need to … --- ## [ElasticSearch Segment merge not happening when deleted documents count is greater than 50%](https://discuss.elastic.co/t/elasticsearch-segment-merge-not-happening-when-deleted-documents-count-is-greater-than-50/277209)
**Author:** [@Vignesh\_Ramesh](https://discuss.elastic.co/u/Vignesh_Ramesh)\ **Replies:** 1\ **Last updated:** [July 3, 2021, 5:54pm UTC](https://discuss.elastic.co/t/elasticsearch-segment-merge-not-happening-when-deleted-documents-count-is-greater-than-50/277209 "2021-07-03T17:54:47Z")
Elasticsearch version: 7.10.0 I have an elasticsearch index with 8 shards in 8 different nodes and with a document count greater than 25 million documents(nested not included). It's an heavy update index. The document s… --- ## ["\_dateparsefailure"](https://discuss.elastic.co/t/dateparsefailure/277700)
**Author:** [@RoteEdition](https://discuss.elastic.co/u/RoteEdition)\ **Replies:** 3\ **Last updated:** [July 3, 2021, 5:12pm UTC](https://discuss.elastic.co/t/dateparsefailure/277700 "2021-07-03T17:12:21Z")
Hi there, i am trying to parse a .CSV file with a pretty horrible date format. I am using the Date filter: date { match =\> \[ "HelperDate", "dMMyyyy", "ddMMyyyy" \] } Some example data: 6112019 -\> … --- ## [Help with Features of Kibana Interactive filters](https://discuss.elastic.co/t/help-with-features-of-kibana-interactive-filters/277587)
**Author:** [@Jason2073](https://discuss.elastic.co/u/Jason2073)\ **Replies:** 2\ **Last updated:** [July 3, 2021, 4:50pm UTC](https://discuss.elastic.co/t/help-with-features-of-kibana-interactive-filters/277587 "2021-07-03T16:50:24Z")
I am working with the kibana controls panels, pictured here And some functionality seems very restrictive. I want to have these drop down options to be put in any order, and for the options under the others to update… --- ## [Logstash split log and insert it separately into elasticsearch](https://discuss.elastic.co/t/logstash-split-log-and-insert-it-separately-into-elasticsearch/277694)
**Author:** [@shifenglim](https://discuss.elastic.co/u/shifenglim)\ **Replies:** 1\ **Last updated:** [July 3, 2021, 4:18pm UTC](https://discuss.elastic.co/t/logstash-split-log-and-insert-it-separately-into-elasticsearch/277694 "2021-07-03T16:18:56Z")
I am writing a logstash config file and a log I am receiving is giving me issues, the team sent me multiple logs merged into one eg. message: \[logitem(aaa=1, bbb=1, ccc=1), logitem(aaa=2, bbb=2, ccc=2), logitem(aaa=3, b… --- ## [Elasticsearch 7.13.2 linux(centos) service - Custom JVM - Doesn't start](https://discuss.elastic.co/t/elasticsearch-7-13-2-linux-centos-service-custom-jvm-doesnt-start/277668)
**Author:** [@Rajnish\_Kumar](https://discuss.elastic.co/u/Rajnish_Kumar)\ **Replies:** 2\ **Last updated:** [July 3, 2021, 2:56pm UTC](https://discuss.elastic.co/t/elasticsearch-7-13-2-linux-centos-service-custom-jvm-doesnt-start/277668 "2021-07-03T14:56:49Z")
It's installed as a linux service. It comes up and works fine using the bundled jdk(16). \[tsadmin@tsmkmslin04 ~\]$ curl -XGET 'http://localhost:9200' { "name" : "tsmkmslin04", "cluster\_name" : "elasticsearch", "clu… --- ## [Removing custom time filter](https://discuss.elastic.co/t/removing-custom-time-filter/276900)
**Author:** [@venkatesh\_prasanth](https://discuss.elastic.co/u/venkatesh_prasanth)\ **Replies:** 2\ **Last updated:** [July 3, 2021, 7:54am UTC](https://discuss.elastic.co/t/removing-custom-time-filter/276900 "2021-07-03T07:54:13Z")
Hi, i have done visualisation in lens but when i import to canvas it comes with time filter, i dont need that to be used. also remove button is disabled --- ## [How to fetch kibana Visualisation data to Powershell automation](https://discuss.elastic.co/t/how-to-fetch-kibana-visualisation-data-to-powershell-automation/277532)
**Author:** [@Sahithi\_V](https://discuss.elastic.co/u/Sahithi_V)\ **Replies:** 2\ **Last updated:** [July 3, 2021, 9:04am UTC](https://discuss.elastic.co/t/how-to-fetch-kibana-visualisation-data-to-powershell-automation/277532 "2021-07-03T09:04:55Z")
Continuing the discussion from Get data from visualize/ dashboard using the API: I tried to get data from visualization present in Dashboard but I am able to navigate till saved objects of visualizatin with its id but d… --- ## [ElasticSearch distinct results by multiple fields with pagination](https://discuss.elastic.co/t/elasticsearch-distinct-results-by-multiple-fields-with-pagination/277455)
**Author:** [@adolbik](https://discuss.elastic.co/u/adolbik)\ **Replies:** 2\ **Last updated:** [July 3, 2021, 7:52am UTC](https://discuss.elastic.co/t/elasticsearch-distinct-results-by-multiple-fields-with-pagination/277455 "2021-07-03T07:52:08Z")
I have index with bunch of events (user viewed page, clicked something and etc.). I have a page in the system where I need to display uniq results (only one row per user + event + itemId). It means if we have 7 rows like… --- ## [Type date\_range formatting v6.8 vs v7.12](https://discuss.elastic.co/t/type-date-range-formatting-v6-8-vs-v7-12/277698)
**Author:** [@elasticfish](https://discuss.elastic.co/u/elasticfish)\ **Replies:** 0\ **Last updated:** [July 3, 2021, 7:38am UTC](https://discuss.elastic.co/t/type-date-range-formatting-v6-8-vs-v7-12/277698 "2021-07-03T07:38:33Z")
Hello, I am upgrading from ES 6.8 to ES 7.12.1 and I have a dynamic template like: "dynamic\_templates": \[ { "ecom\_data": { "mapping": { "type": "date\_range", "f… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1336) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1338)