# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1356 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1357 --- ## [Elasticsearch Cluster Status red and Incides status red without error and reason](https://discuss.elastic.co/t/elasticsearch-cluster-status-red-and-incides-status-red-without-error-and-reason/276513)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 3\ **Last updated:** [June 22, 2021, 12:50am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-status-red-and-incides-status-red-without-error-and-reason/276513 "2021-06-22T00:50:55Z")
Hi everyone, My problem is some indices have red status without reason. ENV: Elasticsearch 7.9.0 Centos 7 Clustering 4 node (3 data-master Node + 1 Coordinator Node) Using logstash to parsing data and using elasticse… --- ## [Logstash -\> array field -\> subquery](https://discuss.elastic.co/t/logstash-array-field-subquery/276584)
**Author:** [@seboraid](https://discuss.elastic.co/u/seboraid)\ **Replies:** 1\ **Last updated:** [June 22, 2021, 12:06am UTC](https://discuss.elastic.co/t/logstash-array-field-subquery/276584 "2021-06-22T00:06:42Z")
Hi! Im looking to add data from a subquery (i dont jnow if this is possible) to an array field in a elastic index. I have the following tables in MySQL: transactions and applied\_rules where applied\_rules has the follo… --- ## [\nter\>nginx\tity Too Large\\d\>bana response: invalid character '\<' looking for beginning of value. Response: \](https://discuss.elastic.co/t/html-nter-nginx-center-tity-too-large-h1-center-d-bana-response-invalid-character-looking-for-beginning-of-value-response-html/276550)
**Author:** [@gavinmathias](https://discuss.elastic.co/u/gavinmathias)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 10:05pm UTC](https://discuss.elastic.co/t/html-nter-nginx-center-tity-too-large-h1-center-d-bana-response-invalid-character-looking-for-beginning-of-value-response-html/276550 "2021-06-21T22:05:34Z")
Seeing this error when running filebeat -e setup. Any hints on how to troubleshoot this? Index setup finished. Loading dashboards (Kibana must be running and reachable) 2021-06-21T13:19:14.860Z INFO kibana/client.go:119… --- ## [Is there a way to do msearch operations with ESRally?](https://discuss.elastic.co/t/is-there-a-way-to-do-msearch-operations-with-esrally/276579)
**Author:** [@sanoj85](https://discuss.elastic.co/u/sanoj85)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 9:29pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-do-msearch-operations-with-esrally/276579 "2021-06-21T21:29:30Z")
Like the title says. I was using the regular search operations in benchmark, but was considering switching to msearch. I know it is not in the documentation spec, but is there a way to emulate it, or is it on the way in … --- ## [Using Filebeat to fetch CrowdStrike Falcon Data Replicator (FDR) logs with S3 SQS](https://discuss.elastic.co/t/using-filebeat-to-fetch-crowdstrike-falcon-data-replicator-fdr-logs-with-s3-sqs/276395)
**Author:** [@meatwad](https://discuss.elastic.co/u/meatwad)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 8:37pm UTC](https://discuss.elastic.co/t/using-filebeat-to-fetch-crowdstrike-falcon-data-replicator-fdr-logs-with-s3-sqs/276395 "2021-06-21T20:37:31Z")
I'm interested in using Filebeat to fetch CrowdStrike Falcon Data Replicator (FDR) logs with the aws-s3 plugin, and use its parallel processing functionality due to the sheer volume of data FDR produces. But I'm running… --- ## [Automatic setting of read\_only\_allow\_delete](https://discuss.elastic.co/t/automatic-setting-of-read-only-allow-delete/276525)
**Author:** [@kfehrenbach](https://discuss.elastic.co/u/kfehrenbach)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 8:09pm UTC](https://discuss.elastic.co/t/automatic-setting-of-read-only-allow-delete/276525 "2021-06-21T20:09:06Z")
We're running elasticsearch version 6.8.8 and 7.7. In both clusters we observed the bahaviour, that the cluster is setting the parameter read\_only\_allow\_delete to true as soon as the fllod stage is reached for some of th… --- ## [ECS fields for Postfix?](https://discuss.elastic.co/t/ecs-fields-for-postfix/276284)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 8:06pm UTC](https://discuss.elastic.co/t/ecs-fields-for-postfix/276284 "2021-06-21T20:06:58Z")
Initially in response to My Elastic Stack Observability Wishlist - #5 by weltenwort, but I think this really is it's own topic. Are there ECS fields for Postfix logs? Or, rather, how would you break out postfix log mess… --- ## [Phrase Suggester doesn't work with short prefixes?](https://discuss.elastic.co/t/phrase-suggester-doesnt-work-with-short-prefixes/276569)
**Author:** [@sabetai](https://discuss.elastic.co/u/sabetai)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 5:56pm UTC](https://discuss.elastic.co/t/phrase-suggester-doesnt-work-with-short-prefixes/276569 "2021-06-21T17:56:49Z")
I'm trying to implement simple auto-complete where entering the prefix of a phrase will retrieve auto-complete suggestions (ie for phrase size of 3-5). However, the Phrase Suggester often doesn't yield results until the … --- ## [To much results](https://discuss.elastic.co/t/to-much-results/276572)
**Author:** [@Joni94](https://discuss.elastic.co/u/Joni94)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 6:34pm UTC](https://discuss.elastic.co/t/to-much-results/276572 "2021-06-21T18:34:59Z")
My problem first of all i try this query: GET /index/\_search { "query": { "simple\_query\_string": { "query": "(\\"cheaper+than,+therapy\\")", "analyzer": "standard", "flags": "OR|AND", … --- ## [Issue importing saved objects via API](https://discuss.elastic.co/t/issue-importing-saved-objects-via-api/276287)
**Author:** [@Kohlman](https://discuss.elastic.co/u/Kohlman)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 6:25pm UTC](https://discuss.elastic.co/t/issue-importing-saved-objects-via-api/276287 "2021-06-21T18:25:05Z")
We are using 7.11.2. From the documentation (Import objects API | Kibana Guide \[7.13\] | Elastic) it said "The request body must include the multipart/form-data type." So we created a python script to "export" and "impo… --- ## [How to multiply score of shouldClause and mustClause in booleanQuery?](https://discuss.elastic.co/t/how-to-multiply-score-of-shouldclause-and-mustclause-in-booleanquery/276566)
**Author:** [@lunablessing](https://discuss.elastic.co/u/lunablessing)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 5:12pm UTC](https://discuss.elastic.co/t/how-to-multiply-score-of-shouldclause-and-mustclause-in-booleanquery/276566 "2021-06-21T17:12:52Z")
I know booleanQuery will add score of should clauses and must clauses. I used to do log(scoreOfShould) + log(scoreOfMust) + log(\_score) for sorting as scoreOfShould \* scoreOfMust \* \_score. In my case, scoreOfShould is q… --- ## [Heartbeat: HTTP check with dynamic url prameter](https://discuss.elastic.co/t/heartbeat-http-check-with-dynamic-url-prameter/275813)
**Author:** [@ibexit](https://discuss.elastic.co/u/ibexit)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 4:43pm UTC](https://discuss.elastic.co/t/heartbeat-http-check-with-dynamic-url-prameter/275813 "2021-06-21T16:43:44Z")
Hi, we´re trying to have some kind of dynamic parameter in the monitored URL in order to prevent the existing cache infrastructure deliver the response. We need to check the underlying infrastructure and not the cache. … --- ## [How to extract JSON from lambda-generated cloudwatch logs with Functionbeat?](https://discuss.elastic.co/t/how-to-extract-json-from-lambda-generated-cloudwatch-logs-with-functionbeat/276564)
**Author:** [@achristensen](https://discuss.elastic.co/u/achristensen)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 4:17pm UTC](https://discuss.elastic.co/t/how-to-extract-json-from-lambda-generated-cloudwatch-logs-with-functionbeat/276564 "2021-06-21T16:17:56Z")
I have a fresh Elasticsearch/Kibana instance that I'm trying to feed data to from Cloudwatch. I was able to get Functionbeat set up easily and data flows in as expected, but all of the logs are simply being put into the … --- ## [ILM rollover works as expected, but write-index does not move](https://discuss.elastic.co/t/ilm-rollover-works-as-expected-but-write-index-does-not-move/275724)
**Author:** [@BradVido](https://discuss.elastic.co/u/BradVido)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 4:06pm UTC](https://discuss.elastic.co/t/ilm-rollover-works-as-expected-but-write-index-does-not-move/275724 "2021-06-21T16:06:06Z")
I'm using ES 6.8.1 and have ILM configured with a Hot, Warm, and Delete phase. When my index hits its rollover threshold (50gb), ES does trigger a rollover, and creates a new index with the number incremented. However,… --- ## [Vega control panel](https://discuss.elastic.co/t/vega-control-panel/276530)
**Author:** [@GavinBeattie](https://discuss.elastic.co/u/GavinBeattie)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 3:57pm UTC](https://discuss.elastic.co/t/vega-control-panel/276530 "2021-06-21T15:57:31Z")
Is there a way to hide on open/temporarily disable the Vega visualisation control panel. Basically, when more casual users open the visualisation, I don't want them to see the code. I can hide the panel using the control… --- ## [Rally throughput counter include data generation](https://discuss.elastic.co/t/rally-throughput-counter-include-data-generation/276366)
**Author:** [@Lasse\_Nedergaard](https://discuss.elastic.co/u/Lasse_Nedergaard)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 3:32pm UTC](https://discuss.elastic.co/t/rally-throughput-counter-include-data-generation/276366 "2021-06-21T15:32:34Z")
We have some large JSON doc’s we use for testing. The manipulation of the document before ingest takes some time. I can see Rally’s finally output score include throughputs but the time is Rally’s throughput and it’s in… --- ## [Filebeat install error on windows server 2003 32 bit](https://discuss.elastic.co/t/filebeat-install-error-on-windows-server-2003-32-bit/276556)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 3:04pm UTC](https://discuss.elastic.co/t/filebeat-install-error-on-windows-server-2003-32-bit/276556 "2021-06-21T15:04:57Z")
Hello team, I am trying to install filebeat 7.9.3 32 bit on windows server 2003 which is 32 bit OS. I tried with taking new file again I thought it is corrupted but no luck. But I am getting following error: Program '… --- ## [Logstash-output-syslog incorrect time](https://discuss.elastic.co/t/logstash-output-syslog-incorrect-time/276554)
**Author:** [@bambam](https://discuss.elastic.co/u/bambam)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 2:57pm UTC](https://discuss.elastic.co/t/logstash-output-syslog-incorrect-time/276554 "2021-06-21T14:57:46Z")
I'm having an issue with using the logstash-output-syslog plugin. The syslog message header is showing a timestamp for UTC and not the timezone for where I'm located. Can someone provide some input on how to change the t… --- ## [ElasticSearch Keystore Setup up error when deploying Docker image 7:10:2 to pod](https://discuss.elastic.co/t/elasticsearch-keystore-setup-up-error-when-deploying-docker-image-72-to-pod/276402)
**Author:** [@patelsop78](https://discuss.elastic.co/u/patelsop78)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 2:40pm UTC](https://discuss.elastic.co/t/elasticsearch-keystore-setup-up-error-when-deploying-docker-image-72-to-pod/276402 "2021-06-21T14:40:20Z")
Getting below error when deploying pod using Docker 7.10.2 image. Exception in thread "main" java.io.IOException: Is a directory: SimpleFSIndexInput(path="/usr/share/elasticsearch/config/elasticsearch.keystore") at org… --- ## [Visualizing the latest Entries by a specific Field](https://discuss.elastic.co/t/visualizing-the-latest-entries-by-a-specific-field/276197)
**Author:** [@New\_ElasticFan](https://discuss.elastic.co/u/New_ElasticFan)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 2:29pm UTC](https://discuss.elastic.co/t/visualizing-the-latest-entries-by-a-specific-field/276197 "2021-06-21T14:29:17Z")
So, I am new to Elastic Stack. My index have different entries like the following. { "\_index": "events", "\_type": "\_doc", "\_id": "irkkDFHoBkM1o5v\_kC", "\_score": null, "fields": { "@timestamp": \[ "2021-02-18T15:46:47.000… --- ## [Infinite extent for field "count": \[Infinity, -Infinity\]](https://discuss.elastic.co/t/infinite-extent-for-field-count-infinity-infinity/276333)
**Author:** [@Nisha2297](https://discuss.elastic.co/u/Nisha2297)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 2:26pm UTC](https://discuss.elastic.co/t/infinite-extent-for-field-count-infinity-infinity/276333 "2021-06-21T14:26:55Z")
I am building a bar chart in Vega visualization and it is getting created as expected. But when I change the time range or put some filter for which I don't have data, then ideally the chart should be blank and display n… --- ## [How to "remove" cluster.routing.allocation.awareness.attributes](https://discuss.elastic.co/t/how-to-remove-cluster-routing-allocation-awareness-attributes/276537)
**Author:** [@Maxime\_Poirier-Journ](https://discuss.elastic.co/u/Maxime_Poirier-Journ)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 2:20pm UTC](https://discuss.elastic.co/t/how-to-remove-cluster-routing-allocation-awareness-attributes/276537 "2021-06-21T14:20:29Z")
Hi there, We're using Elastic in all our environments from dev, qa to prod. We're currently using cluster.routing.allocation.awareness.attributes on all our clusters based on the attribute "aws\_availability\_zone" meanin… --- ## [Log4j2.properties- Rolling File Issue](https://discuss.elastic.co/t/log4j2-properties-rolling-file-issue/276551)
**Author:** [@anguri\_sudhakar](https://discuss.elastic.co/u/anguri_sudhakar)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 2:14pm UTC](https://discuss.elastic.co/t/log4j2-properties-rolling-file-issue/276551 "2021-06-21T14:14:16Z")
Hi Team, we have 4-node cluster elasticsearch-7.5.2 installed and configure Centos 7 in Dev- Environment Like below : master-1 master-2 hotnode warmnode We are using default log4j2.properties file for roll the lo… --- ## [Kibana map date format](https://discuss.elastic.co/t/kibana-map-date-format/276369)
**Author:** [@jvidin](https://discuss.elastic.co/u/jvidin)\ **Replies:** 7\ **Last updated:** [June 21, 2021, 2:02pm UTC](https://discuss.elastic.co/t/kibana-map-date-format/276369 "2021-06-21T14:02:26Z")
Hi There , Im ingesting some 'date type' data using the following mapping properties. "processed\_date": { "type": "date", "format": "yyyy/MM/dd HH:mm:ss.SSSZZ||yyyy/MM/dd HH:mm:ss.SSS||yyyy/MM/dd" … --- ## [Elasticsearch Kibana Preference](https://discuss.elastic.co/t/elasticsearch-kibana-preference/276423)
**Author:** [@Sanchit\_Agrawal](https://discuss.elastic.co/u/Sanchit_Agrawal)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 11:26am UTC](https://discuss.elastic.co/t/elasticsearch-kibana-preference/276423 "2021-06-21T11:26:16Z")
GET /executives/\_search?request\_cache=true&preference=sa GET /executives/\_search?request\_cache=true When hitting from Kibana both with the same query doesn't make any difference. Is it true preferences are ignored in … --- ## [I get error with Logstash: IllegalStateException](https://discuss.elastic.co/t/i-get-error-with-logstash-illegalstateexception/276486)
**Author:** [@an\_dinh](https://discuss.elastic.co/u/an_dinh)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 12:09pm UTC](https://discuss.elastic.co/t/i-get-error-with-logstash-illegalstateexception/276486 "2021-06-21T12:09:02Z")
Here is my logstash.conf: input { mongodb{ uri =\> 'mongodb://localhost:27017/vnExpressCrawler?authSource=vnExpressCrawler' placeholder\_db\_dir =\> '/opt/logstash-mongodb/' placeholder\_db\_name =\> 'logstash\_s… --- ## [Append hostname in each index name](https://discuss.elastic.co/t/append-hostname-in-each-index-name/276519)
**Author:** [@connectgeeks](https://discuss.elastic.co/u/connectgeeks)\ **Replies:** 1\ **Last updated:** [June 21, 2021, 12:00pm UTC](https://discuss.elastic.co/t/append-hostname-in-each-index-name/276519 "2021-06-21T12:00:49Z")
I would like to append hostname in each index name for classification of files based on the source hostname. output{ elasticsearch { hosts =\> \["127.0.0.1:9200"\] index =\> "sample-%{\[@metadata\]\[hostname\]}-%{\[@me… --- ## [Parsing a Concatenated Field to Extract Sub-Fields](https://discuss.elastic.co/t/parsing-a-concatenated-field-to-extract-sub-fields/276523)
**Author:** [@fmaginga](https://discuss.elastic.co/u/fmaginga)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 11:29am UTC](https://discuss.elastic.co/t/parsing-a-concatenated-field-to-extract-sub-fields/276523 "2021-06-21T11:29:23Z")
Hello, I am trying to write a logstash filter to extract individual sub-fields from on concatenated field. Example: I have a field CGI = 640070003110080 CGI = 640070003110080 I want to split the CGI field in to four… --- ## [Filebeat fortinet module](https://discuss.elastic.co/t/filebeat-fortinet-module/276529)
**Author:** [@Dvir\_Solomon](https://discuss.elastic.co/u/Dvir_Solomon)\ **Replies:** 0\ **Last updated:** [June 21, 2021, 11:26am UTC](https://discuss.elastic.co/t/filebeat-fortinet-module/276529 "2021-06-21T11:26:32Z")
Hi, totally Newby, I have have setup elastic + kibana + filebeat all on windows server 2019 manually (no service yet). i am using filebeat(syslog) + Fortinet module. Fortinet module was working, after I restarted fil… --- ## [Why does returning just the ID from a search fails?](https://discuss.elastic.co/t/why-does-returning-just-the-id-from-a-search-fails/276461)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 2\ **Last updated:** [June 21, 2021, 11:18am UTC](https://discuss.elastic.co/t/why-does-returning-just-the-id-from-a-search-fails/276461 "2021-06-21T11:18:51Z")
Dear all =) Can someone figure out why I am getting {"statusCode":400,"error":"Bad Request","message":"\[request query.fields\]: could not parse array value from json input"} when I search for a specific rule base="htt… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1355) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1357)