# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1367 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1368 --- ## [Remote cluster 6.8 and 7.12](https://discuss.elastic.co/t/remote-cluster-6-8-and-7-12/275954)
**Author:** [@humartinez](https://discuss.elastic.co/u/humartinez)\ **Replies:** 2\ **Last updated:** [June 15, 2021, 7:50am UTC](https://discuss.elastic.co/t/remote-cluster-6-8-and-7-12/275954 "2021-06-15T07:50:08Z")
Im reading the documentation, and as far as I can see I could implement remote clusters to perform a cross cluster search. But theres a catch my cluster 7.x is using TLS and the cluster 6.8 is not using TLS, is it posib… --- ## [What is the replacement of SQL UNION in KQL?](https://discuss.elastic.co/t/what-is-the-replacement-of-sql-union-in-kql/275407)
**Author:** [@VinodKumarPotta](https://discuss.elastic.co/u/VinodKumarPotta)\ **Replies:** 5\ **Last updated:** [June 15, 2021, 7:39am UTC](https://discuss.elastic.co/t/what-is-the-replacement-of-sql-union-in-kql/275407 "2021-06-15T07:39:32Z")
Hi Team, Would like to check in this forum, Is there anyway that we can achieve UNION by using KQL? I have a requirement where I would need to build a Kibana dashboard with UNION of multiple sub-queries. Thank you! --- ## [Cannot have two kibana port-forwarded to localhost:5601 and localhost:5602](https://discuss.elastic.co/t/cannot-have-two-kibana-port-forwarded-to-localhost-5601-and-localhost-5602/275915)
**Author:** [@fzyzcjy](https://discuss.elastic.co/u/fzyzcjy)\ **Replies:** 5\ **Last updated:** [June 15, 2021, 7:33am UTC](https://discuss.elastic.co/t/cannot-have-two-kibana-port-forwarded-to-localhost-5601-and-localhost-5602/275915 "2021-06-15T07:33:47Z")
Hi thanks for the wonderful framework! I have two unrelated elastic cluster. I port-forward the kibanas to 5601 and 5602. However, when I login 5602, the 5601 automatically log out, and vise versa. Is there any way to av… --- ## [Cross Cluster Replication - Disaster Recovery Failback](https://discuss.elastic.co/t/cross-cluster-replication-disaster-recovery-failback/275809)
**Author:** [@rverchere](https://discuss.elastic.co/u/rverchere)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 7:24am UTC](https://discuss.elastic.co/t/cross-cluster-replication-disaster-recovery-failback/275809 "2021-06-15T07:24:56Z")
Hello, I'm currently working on a CCR architecture, to use a follower cluster as a Disaster Recovery. I have a question with the failback: When production cluster is down, then I use the DR (follower) one I promote t… --- ## [Will the data be lost when the network is disconnected?](https://discuss.elastic.co/t/will-the-data-be-lost-when-the-network-is-disconnected/275946)
**Author:** [@aurantiacus](https://discuss.elastic.co/u/aurantiacus)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 6:43am UTC](https://discuss.elastic.co/t/will-the-data-be-lost-when-the-network-is-disconnected/275946 "2021-06-15T06:43:16Z")
Hello, I am using beat version 6.8.0 and Logstash version 6.8.0 I am sending data from "beat"(auditbeat,filebeat,packetbeat,winlogbeat) to "logstash A" and from "logstash A" to another "logstash B". What happens to th… --- ## [Elastic serarch and Elasticsearch-Php client settings](https://discuss.elastic.co/t/elastic-serarch-and-elasticsearch-php-client-settings/275800)
**Author:** [@Pooja\_Sharma](https://discuss.elastic.co/u/Pooja_Sharma)\ **Replies:** 0\ **Last updated:** [June 14, 2021, 7:40am UTC](https://discuss.elastic.co/t/elastic-serarch-and-elasticsearch-php-client-settings/275800 "2021-06-14T07:40:44Z")
I want to add Elastic search server and elastic php client to my mediawiki application. like \[Version - Wikipedia\] Wikipedia is using elasic to their application. I am able to use elastic search and its connection to … --- ## [Index architecture](https://discuss.elastic.co/t/index-architecture/275937)
**Author:** [@silvafa](https://discuss.elastic.co/u/silvafa)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 5:39am UTC](https://discuss.elastic.co/t/index-architecture/275937 "2021-06-15T05:39:33Z")
Hello, So I'm trying to build an index, and I'm struggling with the approach to follow. I have an entity "person" with some related information. That person can have multiple name, like name variations, etc. Something … --- ## [ERROR when filebeat test output talk to server](https://discuss.elastic.co/t/error-when-filebeat-test-output-talk-to-server/275786)
**Author:** [@Maciej\_Gravestone](https://discuss.elastic.co/u/Maciej_Gravestone)\ **Replies:** 5\ **Last updated:** [June 15, 2021, 5:28am UTC](https://discuss.elastic.co/t/error-when-filebeat-test-output-talk-to-server/275786 "2021-06-15T05:28:57Z")
Hi, I encounter an error while I tried to connect filebeat to my elk cluster: # filebeat test output elasticsearch: \:9200... parse url... OK connection... parse host... OK dns lookup... OK… --- ## [How to get the execution time of ES Sql query?](https://discuss.elastic.co/t/how-to-get-the-execution-time-of-es-sql-query/275525)
**Author:** [@Resington\_R](https://discuss.elastic.co/u/Resington_R)\ **Replies:** 2\ **Last updated:** [June 15, 2021, 5:18am UTC](https://discuss.elastic.co/t/how-to-get-the-execution-time-of-es-sql-query/275525 "2021-06-15T05:18:13Z")
Hi.. Can anyone please tell me how to get the execution time ( "took") for this below query. Thanks in advance... async function mysqlfunc(req, res) { client.transport.request({ method: "POST", pat… --- ## [Math operation on Kibana lucene query](https://discuss.elastic.co/t/math-operation-on-kibana-lucene-query/275930)
**Author:** [@niraj\_pandey](https://discuss.elastic.co/u/niraj_pandey)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 5:02am UTC](https://discuss.elastic.co/t/math-operation-on-kibana-lucene-query/275930 "2021-06-15T05:02:14Z")
Hi, Just want to know can we perform math operation with lucene query in kibana. I have a variable and it's value is in GB. I want to convert it in KB in lucene query something like this. $mem = 4 Kibana lucene query… --- ## [How to get the timestamp difference](https://discuss.elastic.co/t/how-to-get-the-timestamp-difference/275746)
**Author:** [@Kiran\_manohar\_Chaval](https://discuss.elastic.co/u/Kiran_manohar_Chaval)\ **Replies:** 2\ **Last updated:** [June 15, 2021, 4:38am UTC](https://discuss.elastic.co/t/how-to-get-the-timestamp-difference/275746 "2021-06-15T04:38:27Z")
Hi All I am trying to get timestamp difference for the following kql filter Here log\_message and timestamp are fields Screenshot attached log\_message : "submit async job-514" or log\_message : "Complete async job-… --- ## [Guice in Elasticsearch](https://discuss.elastic.co/t/guice-in-elasticsearch/275926)
**Author:** [@Yashasvi\_Raj\_Pant](https://discuss.elastic.co/u/Yashasvi_Raj_Pant)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 4:29am UTC](https://discuss.elastic.co/t/guice-in-elasticsearch/275926 "2021-06-15T04:29:19Z")
Is Elasticsearch still using Guice to wire dependencies, they used to used Guice in their old versions. Could anybody confirm it? --- ## [Logstash http output plugin customize building json array for batching](https://discuss.elastic.co/t/logstash-http-output-plugin-customize-building-json-array-for-batching/275535)
**Author:** [@RahulGS](https://discuss.elastic.co/u/RahulGS)\ **Replies:** 8\ **Last updated:** [June 15, 2021, 4:11am UTC](https://discuss.elastic.co/t/logstash-http-output-plugin-customize-building-json-array-for-batching/275535 "2021-06-15T04:11:17Z")
Hello , We have a pipeline running on logstash 6.6.2 with input(redis)-\>filter(ruby)-\>output(http) how do you batch http output using custom format ? we can't use format="json\_batch" because it will construct a simple… --- ## [Logstash plain-log file is getting following lines of errors and causing no logs appear in Kibana. Please help!](https://discuss.elastic.co/t/logstash-plain-log-file-is-getting-following-lines-of-errors-and-causing-no-logs-appear-in-kibana-please-help/275922)
**Author:** [@devashishsingh](https://discuss.elastic.co/u/devashishsingh)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 4:07am UTC](https://discuss.elastic.co/t/logstash-plain-log-file-is-getting-following-lines-of-errors-and-causing-no-logs-appear-in-kibana-please-help/275922 "2021-06-15T04:07:38Z")
\[2021-06-15T11:52:59,022\]\[WARN \]\[io.netty.channel.AbstractChannelHandlerContext\]\[main\]\[841e111a9a3864d5c6aa677dd9865551e728aa14cc10a6e208f20d80a45001cd\] The exceptionCaught() event that was failed to submit was: java.ut… --- ## [Best proxy for Elasticsearch rate limiting](https://discuss.elastic.co/t/best-proxy-for-elasticsearch-rate-limiting/275664)
**Author:** [@anon17386273](https://discuss.elastic.co/u/anon17386273)\ **Replies:** 2\ **Last updated:** [June 15, 2021, 3:54am UTC](https://discuss.elastic.co/t/best-proxy-for-elasticsearch-rate-limiting/275664 "2021-06-15T03:54:01Z")
Hi Is there rate limiting feature for elasticsearch basic license? Not the cloud version If not, what is the best way to perform rate limiting on users' query? My elasticsearch cluster have TLS authentication setup an… --- ## [Note able use bool followed by must followed by should](https://discuss.elastic.co/t/note-able-use-bool-followed-by-must-followed-by-should/275865)
**Author:** [@Anurag\_Mishra2](https://discuss.elastic.co/u/Anurag_Mishra2)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 3:36am UTC](https://discuss.elastic.co/t/note-able-use-bool-followed-by-must-followed-by-should/275865 "2021-06-15T03:36:19Z")
Hi I am trying to search but not getting desired result. I have condition like this detail '--\>' account '--\>' List '--\>' credential '--\>' active also detail '--\>' List '--\>' List '--\> 'credential '--\>' active if(de… --- ## [Sync data from MongoDB using logstash](https://discuss.elastic.co/t/sync-data-from-mongodb-using-logstash/275918)
**Author:** [@Bach\_Tran](https://discuss.elastic.co/u/Bach_Tran)\ **Replies:** 0\ **Last updated:** [June 15, 2021, 2:45am UTC](https://discuss.elastic.co/t/sync-data-from-mongodb-using-logstash/275918 "2021-06-15T02:45:24Z")
I'm using Logstash 6.8.0 to push my Message collection to Elasticsearch 6.8.0. This is my logstash file: input { jdbc { jdbc\_connection\_string =\> "jdbc:mongodb://127.0.0.1:27017/vnpost\_chatdb" jdbc\_driver\_libr… --- ## [KV Filter registered without jruby interruptible regular expressions enabled](https://discuss.elastic.co/t/kv-filter-registered-without-jruby-interruptible-regular-expressions-enabled/275916)
**Author:** [@scott\_stash](https://discuss.elastic.co/u/scott_stash)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 2:29am UTC](https://discuss.elastic.co/t/kv-filter-registered-without-jruby-interruptible-regular-expressions-enabled/275916 "2021-06-15T02:29:25Z")
When logstash starts it logs this for each KV I have configured this logs: Jun 15 01:49:10 hostname logstash\[3879863\]: \[2021-06-15T01:49:10,651\]\[WARN \]\[logstash.filters.kv \] KV Filter registered without jruby inter… --- ## [Unable to access "share" button in Discovery menu](https://discuss.elastic.co/t/unable-to-access-share-button-in-discovery-menu/275892)
**Author:** [@aerodynamic](https://discuss.elastic.co/u/aerodynamic)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 1:45am UTC](https://discuss.elastic.co/t/unable-to-access-share-button-in-discovery-menu/275892 "2021-06-15T01:45:24Z")
Hello, While previously I have been able to access the "share" button in the discovery tab. I'm no longer able to. License is Platinum Version is 7.8.0 Broken in Chrome, works in Safari --- ## [Problems with Part 4 of the Crash Course](https://discuss.elastic.co/t/problems-with-part-4-of-the-crash-course/275888)
**Author:** [@alejohnny](https://discuss.elastic.co/u/alejohnny)\ **Replies:** 6\ **Last updated:** [June 15, 2021, 1:25am UTC](https://discuss.elastic.co/t/problems-with-part-4-of-the-crash-course/275888 "2021-06-15T01:25:15Z")
Hi, I'm new to Elasticsearch and I'm starting with it watching the Crash Course, and in the part 4, when I run the first command to setup data within Elasticsearch, I'm returing a error 400 and couldn't figure out whats … --- ## [How to export dashboard/visualization to another es clusters? (I have 3 isolated es clusters, and I want to sync the dashboards among them)](https://discuss.elastic.co/t/how-to-export-dashboard-visualization-to-another-es-clusters-i-have-3-isolated-es-clusters-and-i-want-to-sync-the-dashboards-among-them/275847)
**Author:** [@fzyzcjy](https://discuss.elastic.co/u/fzyzcjy)\ **Replies:** 2\ **Last updated:** [June 15, 2021, 12:55am UTC](https://discuss.elastic.co/t/how-to-export-dashboard-visualization-to-another-es-clusters-i-have-3-isolated-es-clusters-and-i-want-to-sync-the-dashboards-among-them/275847 "2021-06-15T00:55:45Z")
Hi thanks for the wonderful app! I have 3 isolated es clusters, and I want to sync the dashboards among them. Therefore, I wonder how to export dashboard/visualization to another es clusters? --- ## [Need help with splitting a log using logstash split filter](https://discuss.elastic.co/t/need-help-with-splitting-a-log-using-logstash-split-filter/275906)
**Author:** [@kajira](https://discuss.elastic.co/u/kajira)\ **Replies:** 4\ **Last updated:** [June 15, 2021, 12:49am UTC](https://discuss.elastic.co/t/need-help-with-splitting-a-log-using-logstash-split-filter/275906 "2021-06-15T00:49:50Z")
Hi, I receive json logs with the structure as shown below on logstash from a remote server. { "timestamp: "...". "message": { "records": \[ { result ... }, { result ... }, … --- ## [If query contains \*word\* then the document must contain \*word\*](https://discuss.elastic.co/t/if-query-contains-word-then-the-document-must-contain-word/275911)
**Author:** [@Gabriel\_Nicolae](https://discuss.elastic.co/u/Gabriel_Nicolae)\ **Replies:** 1\ **Last updated:** [June 15, 2021, 12:46am UTC](https://discuss.elastic.co/t/if-query-contains-word-then-the-document-must-contain-word/275911 "2021-06-15T00:46:09Z")
Hi, I am trying to search on how to do the next thing: if my query contains a certain word, let's say "covid" then the documents returned must also contain "covid". Is there a way to do it directly in elasticsearch? The … --- ## [Failed to load plugin class \[org.elasticsearch.xpack.security.Security](https://discuss.elastic.co/t/failed-to-load-plugin-class-org-elasticsearch-xpack-security-security/275701)
**Author:** [@hershkoy](https://discuss.elastic.co/u/hershkoy)\ **Replies:** 2\ **Last updated:** [June 14, 2021, 11:40pm UTC](https://discuss.elastic.co/t/failed-to-load-plugin-class-org-elasticsearch-xpack-security-security/275701 "2021-06-14T23:40:27Z")
Hi, I am completely new to elastic, trying to use it inside a magento store on kubernetes. (It worked with 6.8.5). I tried to upgrade to 7.9.0, and I am getting an error: failed to load plugin class \[org.elasticsearch… --- ## [Dashboard Drilldowns do not work in Data Table (7.13.1)](https://discuss.elastic.co/t/dashboard-drilldowns-do-not-work-in-data-table-7-13-1/275878)
**Author:** [@Jeffrey\_Wilk](https://discuss.elastic.co/u/Jeffrey_Wilk)\ **Replies:** 6\ **Last updated:** [June 14, 2021, 8:15pm UTC](https://discuss.elastic.co/t/dashboard-drilldowns-do-not-work-in-data-table-7-13-1/275878 "2021-06-14T20:15:26Z")
At the help page here it says that Drilldowns are supported in data tables, and the option exists when editing a table panel from a dashboard. However, it does not work. I have tried on our previous version of 7.12.1 a… --- ## [Owner name not showing when file is deleted](https://discuss.elastic.co/t/owner-name-not-showing-when-file-is-deleted/275750)
**Author:** [@shikran](https://discuss.elastic.co/u/shikran)\ **Replies:** 0\ **Last updated:** [June 13, 2021, 5:37am UTC](https://discuss.elastic.co/t/owner-name-not-showing-when-file-is-deleted/275750 "2021-06-13T05:37:26Z")
i have configured auditbeat for windows server for file intergity monitoring, but when i delete a file it does not show who has deleted this? --- ## [Why does heap memory increase?](https://discuss.elastic.co/t/why-does-heap-memory-increase/275768)
**Author:** [@jaeho](https://discuss.elastic.co/u/jaeho)\ **Replies:** 1\ **Last updated:** [June 14, 2021, 9:49pm UTC](https://discuss.elastic.co/t/why-does-heap-memory-increase/275768 "2021-06-14T21:49:03Z")
Hello. I am curious about the increase in memory usage even though the query traffic is low and the number of documents is small, and I would like expert opinions on how to tune the GC. \[Servers (Nodes)\] Total: 4 Nod… --- ## [Winlogbeat pipeline](https://discuss.elastic.co/t/winlogbeat-pipeline/275770)
**Author:** [@lepepa9493](https://discuss.elastic.co/u/lepepa9493)\ **Replies:** 0\ **Last updated:** [June 13, 2021, 5:19pm UTC](https://discuss.elastic.co/t/winlogbeat-pipeline/275770 "2021-06-13T17:19:10Z")
Hi! I noticed winlogbeat events don't have an event.ingested field like events of other beats. I guess the field is created by an ingest pipeline. But running ".\\winlogbeat.exe setup" creates no pipeline. Is there no d… --- ## [High disk.used with low disk.indices](https://discuss.elastic.co/t/high-disk-used-with-low-disk-indices/275771)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 1\ **Last updated:** [June 14, 2021, 9:46pm UTC](https://discuss.elastic.co/t/high-disk-used-with-low-disk-indices/275771 "2021-06-14T21:46:40Z")
I am trying to figure out what is consuming disk space on my hot data node. When I run GET \_cat/allocation, the output shows that disk.indices is only consuming 80.4gb, whereas disk.used is 648.4gb. On my other hot data … --- ## [Limit of total fields \[1000\] has been exceeded- elasticsearch\_metrics](https://discuss.elastic.co/t/limit-of-total-fields-1000-has-been-exceeded-elasticsearch-metrics/275848)
**Author:** [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\ **Replies:** 0\ **Last updated:** [June 14, 2021, 2:05pm UTC](https://discuss.elastic.co/t/limit-of-total-fields-1000-has-been-exceeded-elasticsearch-metrics/275848 "2021-06-14T14:05:42Z")
Im attempting to reroute elasticsearch metrics (via metricbeat) from my primary cluster to a monitoring cluster. Monitoring cluster is running 7.13.1 on Centos 8 - main is 7.11.1. Hitting this error when I restart metri… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1366) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1368)