# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1365 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1366 --- ## [Elasticsearch s3 snapshot](https://discuss.elastic.co/t/elasticsearch-s3-snapshot/275639)
**Author:** [@drewkrrb](https://discuss.elastic.co/u/drewkrrb)\ **Replies:** 3\ **Last updated:** [June 16, 2021, 12:25am UTC](https://discuss.elastic.co/t/elasticsearch-s3-snapshot/275639 "2021-06-16T00:25:47Z")
Hi Good people of elastic Am trying to upload snapshot through s3. Our elastic cluster is on top of our kubernetes cluster currently we have two Elasticsearch pod running and I already enable the s3 plugin in the image.… --- ## [How to show max count of last three days with 1 hour time bucket?](https://discuss.elastic.co/t/how-to-show-max-count-of-last-three-days-with-1-hour-time-bucket/275891)
**Author:** [@baragonte](https://discuss.elastic.co/u/baragonte)\ **Replies:** 1\ **Last updated:** [June 16, 2021, 12:22am UTC](https://discuss.elastic.co/t/how-to-show-max-count-of-last-three-days-with-1-hour-time-bucket/275891 "2021-06-16T00:22:49Z")
I have to create a visualization where I want the peak of the number of docs by hour every day for the last 3 days. I was able to show the peak but I can't show the correct timestamp. Is there any way I can show the time… --- ## [Invalid snapshot name snapshot with the same name already in-progress Elasticsearch](https://discuss.elastic.co/t/invalid-snapshot-name-snapshot-with-the-same-name-already-in-progress-elasticsearch/275981)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 1\ **Last updated:** [June 16, 2021, 12:19am UTC](https://discuss.elastic.co/t/invalid-snapshot-name-snapshot-with-the-same-name-already-in-progress-elasticsearch/275981 "2021-06-16T00:19:25Z")
I am trying to get snapshot of my Elasticsearch Cluster with below commands. PUT \_snapshot/backups { "type": "fs", "settings": { "compress": true, "location": "/backup\_path" } } The above returns ok. But … --- ## [Unable to lock JVM after failed Snapshot](https://discuss.elastic.co/t/unable-to-lock-jvm-after-failed-snapshot/276019)
**Author:** [@Junebee](https://discuss.elastic.co/u/Junebee)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 11:21pm UTC](https://discuss.elastic.co/t/unable-to-lock-jvm-after-failed-snapshot/276019 "2021-06-15T23:21:54Z")
I have a three data node and one ingest node cluster. I recently had a node fail during a snapshot and it brought down my entire stack which had been running well for almost 6 months. When I went to restart the failed n… --- ## [Elastic search not loading](https://discuss.elastic.co/t/elastic-search-not-loading/275997)
**Author:** [@dorcas](https://discuss.elastic.co/u/dorcas)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 10:45pm UTC](https://discuss.elastic.co/t/elastic-search-not-loading/275997 "2021-06-15T22:45:13Z")
Dear Team, I mistakenly deleted some indices folders inside data.nodes in elasticsearch. Now I have restarted the service but unable to access Kibana. Please find below the error logs. policy \[ilm-history-ilm-policy-7da… --- ## [Archive data elastic stack](https://discuss.elastic.co/t/archive-data-elastic-stack/276034)
**Author:** [@ima](https://discuss.elastic.co/u/ima)\ **Replies:** 5\ **Last updated:** [June 15, 2021, 10:36pm UTC](https://discuss.elastic.co/t/archive-data-elastic-stack/276034 "2021-06-15T22:36:33Z")
hello everybody can anyone please help me i need to know if it is possible to archive the ELK logs to an external storage off the current platform, and the data will still be searchable. and does anybody know of a method… --- ## [Executing a command from Elasticsearch/kibana](https://discuss.elastic.co/t/executing-a-command-from-elasticsearch-kibana/275920)
**Author:** [@T1330](https://discuss.elastic.co/u/T1330)\ **Replies:** 10\ **Last updated:** [June 15, 2021, 10:08pm UTC](https://discuss.elastic.co/t/executing-a-command-from-elasticsearch-kibana/275920 "2021-06-15T22:08:16Z")
Could you please have any example that executing a command from Elasticsearch to another server etc. i.e. moving from file "C:/aaa/a111.txt" to "C:/bbb/a111.txt" or displaying a pop-up by command Elasticsearch-kibana … --- ## [Filebeat is not authenticating with elasticsearch after xpack was enabled](https://discuss.elastic.co/t/filebeat-is-not-authenticating-with-elasticsearch-after-xpack-was-enabled/275909)
**Author:** [@Antonio\_Chadwick](https://discuss.elastic.co/u/Antonio_Chadwick)\ **Replies:** 5\ **Last updated:** [June 15, 2021, 10:07pm UTC](https://discuss.elastic.co/t/filebeat-is-not-authenticating-with-elasticsearch-after-xpack-was-enabled/275909 "2021-06-15T22:07:09Z")
Hi Team, I have a local setup that running ubuntu which i have elasticsearch and kibana running on, and a separate box running centOS, which has filebeat installed on this is the server. I want to monitor logs from this… --- ## [Is it possible to combine two docs in different indices?](https://discuss.elastic.co/t/is-it-possible-to-combine-two-docs-in-different-indices/276035)
**Author:** [@attiley](https://discuss.elastic.co/u/attiley)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 10:03pm UTC](https://discuss.elastic.co/t/is-it-possible-to-combine-two-docs-in-different-indices/276035 "2021-06-15T22:03:45Z")
Hello guys! If I have two docs in two different indices. One doc in index "content" is like this { "id": "content\_id", "content": random content, "user\_details":{ "user\_id":"123" } } and anoth… --- ## [CPU,RAM spec details for Elasticsearch Master & Data nodes](https://discuss.elastic.co/t/cpu-ram-spec-details-for-elasticsearch-master-data-nodes/276038)
**Author:** [@purushothamkdr143](https://discuss.elastic.co/u/purushothamkdr143)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 10:02pm UTC](https://discuss.elastic.co/t/cpu-ram-spec-details-for-elasticsearch-master-data-nodes/276038 "2021-06-15T22:02:16Z")
Hi All, I am setting up elasticsearch cluster on k8s using eck operator. From the document I understood that Heapsize should be no more than 50% of Allocated RAM so passed the details accordingly. Details: k8 cluster:… --- ## [Is it possible to integrate anomaly detection with large amounts of data using Amazon's Elastiservice? Detection keeps on crashing when parsing through the information](https://discuss.elastic.co/t/is-it-possible-to-integrate-anomaly-detection-with-large-amounts-of-data-using-amazons-elastiservice-detection-keeps-on-crashing-when-parsing-through-the-information/276046)
**Author:** [@kanrab](https://discuss.elastic.co/u/kanrab)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 9:53pm UTC](https://discuss.elastic.co/t/is-it-possible-to-integrate-anomaly-detection-with-large-amounts-of-data-using-amazons-elastiservice-detection-keeps-on-crashing-when-parsing-through-the-information/276046 "2021-06-15T21:53:56Z")
I am parsing large amounts of information and want to use this feature without it crashing --- ## [How do you detect any malicious traffic through baselines via Amazon's Elastiservice?](https://discuss.elastic.co/t/how-do-you-detect-any-malicious-traffic-through-baselines-via-amazons-elastiservice/276048)
**Author:** [@kanrab](https://discuss.elastic.co/u/kanrab)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 9:52pm UTC](https://discuss.elastic.co/t/how-do-you-detect-any-malicious-traffic-through-baselines-via-amazons-elastiservice/276048 "2021-06-15T21:52:57Z")
I am looking for an effective way to parse through all the data --- ## [Kibana timeseries with stacked bar graph](https://discuss.elastic.co/t/kibana-timeseries-with-stacked-bar-graph/275464)
**Author:** [@rmartinez.rv](https://discuss.elastic.co/u/rmartinez.rv)\ **Replies:** 2\ **Last updated:** [June 15, 2021, 9:42pm UTC](https://discuss.elastic.co/t/kibana-timeseries-with-stacked-bar-graph/275464 "2021-06-15T21:42:30Z")
Hi. I'm looking for help with getting a "particular" graph from kibana. I have an index in my elastic server filling with this kind of information: { "\_index": "register", "\_type": "\_doc", "\_id": "6kRQ8XkBeDPVH1… --- ## [How to drop a block of lines in logstash filter?](https://discuss.elastic.co/t/how-to-drop-a-block-of-lines-in-logstash-filter/276053)
**Author:** [@Patr123](https://discuss.elastic.co/u/Patr123)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 8:29pm UTC](https://discuss.elastic.co/t/how-to-drop-a-block-of-lines-in-logstash-filter/276053 "2021-06-15T20:29:50Z")
I have these lines in my websphere Systemout.log file: \*\*\*\*\*\*\*\*\*\*\*\* Start Display Current Environment \*\*\*\*\*\*\*\*\*\*\*\* line 1 line 2 line 3 line 4 line 5 line 7 \*\*\*\*\*\*\*\*\*\*\*\*\* End Display Current Environment \*\*\*\*\*\*\*\*\*\*\*\*\* H… --- ## [Is there a way to query/filter for just RFC Non-Compliant Traffic?](https://discuss.elastic.co/t/is-there-a-way-to-query-filter-for-just-rfc-non-compliant-traffic/275155)
**Author:** [@kanrab](https://discuss.elastic.co/u/kanrab)\ **Replies:** 3\ **Last updated:** [June 15, 2021, 8:14pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-query-filter-for-just-rfc-non-compliant-traffic/275155 "2021-06-15T20:14:41Z")
I was unable to come up with a come up with anything. Any ideas? --- ## [How does kibana regenerate the target file](https://discuss.elastic.co/t/how-does-kibana-regenerate-the-target-file/275237)
**Author:** [@541002492](https://discuss.elastic.co/u/541002492)\ **Replies:** 3\ **Last updated:** [June 15, 2021, 7:59pm UTC](https://discuss.elastic.co/t/how-does-kibana-regenerate-the-target-file/275237 "2021-06-15T19:59:46Z")
I want to modify one of kibana's index.js files, but running the modification does not take effect. Looking at the browser, I find that the browser is loading the target file. How to recompile the index.js file to genera… --- ## [Filebeat Stops Processing logs for AWS module](https://discuss.elastic.co/t/filebeat-stops-processing-logs-for-aws-module/275993)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 7\ **Last updated:** [June 15, 2021, 7:38pm UTC](https://discuss.elastic.co/t/filebeat-stops-processing-logs-for-aws-module/275993 "2021-06-15T19:38:56Z")
I am facing exactly the same issue as this thread Filebeat stops proccessing s3 input with no error. Also, I experienced sometimes Filebeat suddenly stops processing data for other modules too, I faced it with Gsuite mo… --- ## [Logstash does not parse all logs with file as input](https://discuss.elastic.co/t/logstash-does-not-parse-all-logs-with-file-as-input/276044)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 7:22pm UTC](https://discuss.elastic.co/t/logstash-does-not-parse-all-logs-with-file-as-input/276044 "2021-06-15T19:22:20Z")
Hi All. I am using file input plugin to read logs. My config looks like below: input { file { path =\> "/opt/gtal/iptal/elasticsearch/app/logstash/stage/CVMQA\_UAT\_STATS-\*.txt" codec =\> multiline { pattern =\> "… --- ## [Is there a way to get all doc ID's from an index for a specified time range?](https://discuss.elastic.co/t/is-there-a-way-to-get-all-doc-ids-from-an-index-for-a-specified-time-range/275885)
**Author:** [@aidenosi](https://discuss.elastic.co/u/aidenosi)\ **Replies:** 3\ **Last updated:** [June 15, 2021, 5:34pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-get-all-doc-ids-from-an-index-for-a-specified-time-range/275885 "2021-06-15T17:34:35Z")
Hello, We recently had an issue that caused one of our servers to report as "down" to heartbeat even though it was up. This caused us to have 3 days of "downtime" in our metrics. We want to fix this by going through and… --- ## [Winlogbeat 7.13.0 expected int but got type string in equals condition](https://discuss.elastic.co/t/winlogbeat-7-13-0-expected-int-but-got-type-string-in-equals-condition/274273)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 5\ **Last updated:** [June 15, 2021, 5:17pm UTC](https://discuss.elastic.co/t/winlogbeat-7-13-0-expected-int-but-got-type-string-in-equals-condition/274273 "2021-06-15T17:17:58Z")
I've upgraded to the latest version and winlogbeat is not sending data anymore The changes in 7.13.0 Change event.code and winlog.event\_id from int to keyword. I'm seeing a lot of these WARN \[conditions\] condit… --- ## [Elasticsearch Performance Issues Upgrading v6.2.3 to v7.13.1](https://discuss.elastic.co/t/elasticsearch-performance-issues-upgrading-v6-2-3-to-v7-13-1/275611)
**Author:** [@radleta](https://discuss.elastic.co/u/radleta)\ **Replies:** 2\ **Last updated:** [June 15, 2021, 5:06pm UTC](https://discuss.elastic.co/t/elasticsearch-performance-issues-upgrading-v6-2-3-to-v7-13-1/275611 "2021-06-15T17:06:53Z")
We've been working on an upgrade from Elasticsearch cluster running v6.2.3 to v7.13.1 and running into a major performance roadblock. We are running the versions side-by-side and trying to cut-over to the new version bu… --- ## [Rename strings field to nested field](https://discuss.elastic.co/t/rename-strings-field-to-nested-field/275912)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 6\ **Last updated:** [June 15, 2021, 4:48pm UTC](https://discuss.elastic.co/t/rename-strings-field-to-nested-field/275912 "2021-06-15T16:48:00Z")
Hello every body, I want to parse the logs bellow Apr 20 01:10:04 hostname sshproxy\[150\]: \[SSH Session\] session\_id="56454646eaeazjajflen" client\_ip="X.X.X.X" target\_ip="X.X.X.X" user="X.X.X.X" device="X.X.X.X" service… --- ## [Elasticsearch cluster with 2 nodes](https://discuss.elastic.co/t/elasticsearch-cluster-with-2-nodes/275588)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 4\ **Last updated:** [June 15, 2021, 4:35pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-with-2-nodes/275588 "2021-06-15T16:35:16Z")
hi I hope this message finds you well I have situation where I have installed two instance of Elasticsearch setup in remote server 1 (node1) and remote server 2 (node2), and I want to connect both these node in one clu… --- ## [High Disk IO utilization in filebeat and logstash nodes](https://discuss.elastic.co/t/high-disk-io-utilization-in-filebeat-and-logstash-nodes/276032)
**Author:** [@bhavaniprasad\_reddy](https://discuss.elastic.co/u/bhavaniprasad_reddy)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 4:30pm UTC](https://discuss.elastic.co/t/high-disk-io-utilization-in-filebeat-and-logstash-nodes/276032 "2021-06-15T16:30:55Z")
I see high Disk IO utilization in nodes where filebeat and logstash pods are running. This is lowering the event collection rates in all the nodes. I do not know what are the factors that are effecting the event collect… --- ## [Way to change the version of JARs used in Elasticsearch](https://discuss.elastic.co/t/way-to-change-the-version-of-jars-used-in-elasticsearch/275999)
**Author:** [@Ripu\_Sudan](https://discuss.elastic.co/u/Ripu_Sudan)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 4:05pm UTC](https://discuss.elastic.co/t/way-to-change-the-version-of-jars-used-in-elasticsearch/275999 "2021-06-15T16:05:30Z")
I've used the latest version of Elasticsearch docker image, As in image you can see the listing of JARs used, On running vulnerabilities test on image, some modules gives vulnerabilities, like jackson-dataformat-cbor-… --- ## [How do I divide two metrics calculated in bar-chart](https://discuss.elastic.co/t/how-do-i-divide-two-metrics-calculated-in-bar-chart/276024)
**Author:** [@Dhruv\_Makwana](https://discuss.elastic.co/u/Dhruv_Makwana)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 3:52pm UTC](https://discuss.elastic.co/t/how-do-i-divide-two-metrics-calculated-in-bar-chart/276024 "2021-06-15T15:52:34Z")
I want to divide two metrics which were calculated by sum and count at the y-axis in Bar-graphs. I went through some discussion, for the newer version there's supposed to calculation field in metrics aggregation. But… --- ## [It is possible to use two filters within a query in NodeJs?](https://discuss.elastic.co/t/it-is-possible-to-use-two-filters-within-a-query-in-nodejs/276029)
**Author:** [@Sebastian\_Marroquin](https://discuss.elastic.co/u/Sebastian_Marroquin)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 3:39pm UTC](https://discuss.elastic.co/t/it-is-possible-to-use-two-filters-within-a-query-in-nodejs/276029 "2021-06-15T15:39:09Z")
Hello everybody. I was wondering if it is possible to have within a variable in NodeJs two types of filters, for example: query = { "bool": { … --- ## [Overwrite @timestamp with log timestamp](https://discuss.elastic.co/t/overwrite-timestamp-with-log-timestamp/275713)
**Author:** [@Evan\_W](https://discuss.elastic.co/u/Evan_W)\ **Replies:** 5\ **Last updated:** [June 15, 2021, 3:28pm UTC](https://discuss.elastic.co/t/overwrite-timestamp-with-log-timestamp/275713 "2021-06-15T15:28:47Z")
As the title says, I'm looking to overwrite ingest timestamp to reflect the actual timestamp pulled from log data. I've already got a custom regex that can pull this timestamp out of my logs as its own unique field, but … --- ## [How would I parse further the syslog5424\_msg in a syslog event in logstash conf?](https://discuss.elastic.co/t/how-would-i-parse-further-the-syslog5424-msg-in-a-syslog-event-in-logstash-conf/275964)
**Author:** [@devashishsingh](https://discuss.elastic.co/u/devashishsingh)\ **Replies:** 4\ **Last updated:** [June 15, 2021, 2:47pm UTC](https://discuss.elastic.co/t/how-would-i-parse-further-the-syslog5424-msg-in-a-syslog-event-in-logstash-conf/275964 "2021-06-15T14:47:54Z")
Hello, I have parsed the XML log format coming from a syslog source as defined in logstash config file. What shall be done further to parse the syslog message field within the XML? Below is the config: input { tcp … --- ## [Request Body is Required](https://discuss.elastic.co/t/request-body-is-required/275691)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 3\ **Last updated:** [June 15, 2021, 2:41pm UTC](https://discuss.elastic.co/t/request-body-is-required/275691 "2021-06-15T14:41:50Z")
I am attempting to use the reindex API to combine indices for the month into one single index: POST \_reindex?pretty { "conflicts": "proceed", "source": { "index": "my-index-2021.04.\*" }, "dest": { "index… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1364) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1366)