# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1370 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1371 --- ## [Problems getting new node to join cluster](https://discuss.elastic.co/t/problems-getting-new-node-to-join-cluster/275776)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 1\ **Last updated:** [June 14, 2021, 5:58am UTC](https://discuss.elastic.co/t/problems-getting-new-node-to-join-cluster/275776 "2021-06-14T05:58:42Z")
I am trying to add a couple of nodes to an existing cluster of 3 nodes. These "new" nodes have been in the cluster in the past but were taken out for "refurbishment" and now I am having issues getting them back in. see… --- ## [Search using misspelled querys?](https://discuss.elastic.co/t/search-using-misspelled-querys/275783)
**Author:** [@Sebastian\_Marroquin](https://discuss.elastic.co/u/Sebastian_Marroquin)\ **Replies:** 0\ **Last updated:** [June 14, 2021, 4:18am UTC](https://discuss.elastic.co/t/search-using-misspelled-querys/275783 "2021-06-14T04:18:46Z")
Hi there, I'm working with elasticsearch version 6.2.4 along with the MEN stack. I was wondering if there is any way for elasticsearch to do searches even when the query is misspelled. I'll put it in Spanish to see if I … --- ## [Unassigned shards of index - not permitted by any node](https://discuss.elastic.co/t/unassigned-shards-of-index-not-permitted-by-any-node/275766)
**Author:** [@Roy\_Levy](https://discuss.elastic.co/u/Roy_Levy)\ **Replies:** 1\ **Last updated:** [June 14, 2021, 4:01am UTC](https://discuss.elastic.co/t/unassigned-shards-of-index-not-permitted-by-any-node/275766 "2021-06-14T04:01:07Z")
Hey, I'm trying to understand how to fix this issue of unassigned shards in my index: When running the explain API - I'm getting "no" for allocation: "can\_allocate" : "no" And in each node (9 of them), the decider… --- ## [Number of docs count does not match number of json file records](https://discuss.elastic.co/t/number-of-docs-count-does-not-match-number-of-json-file-records/275739)
**Author:** [@rafaell2](https://discuss.elastic.co/u/rafaell2)\ **Replies:** 7\ **Last updated:** [June 13, 2021, 9:58pm UTC](https://discuss.elastic.co/t/number-of-docs-count-does-not-match-number-of-json-file-records/275739 "2021-06-13T21:58:26Z")
Hi. I am trying to load a json file with 8 records from filebeats to logstash (latest verion 7.13). It looks like i have no errors but when i check number of records at Kibana Index Management i see docs counts = 1 (also… --- ## [Adding Threat Intel Module To Existing Filebeat.yml Installed via Elastic-Agent](https://discuss.elastic.co/t/adding-threat-intel-module-to-existing-filebeat-yml-installed-via-elastic-agent/275775)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 0\ **Last updated:** [June 13, 2021, 9:56pm UTC](https://discuss.elastic.co/t/adding-threat-intel-module-to-existing-filebeat-yml-installed-via-elastic-agent/275775 "2021-06-13T21:56:25Z")
Can I add a threat intel module (e.g., otx) to an existing filebeat.yml that was installed via an elastic agent? --- ## [JSON Filtering In Logstash To Remove Unwanted Fields](https://discuss.elastic.co/t/json-filtering-in-logstash-to-remove-unwanted-fields/275697)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 2\ **Last updated:** [June 13, 2021, 9:38pm UTC](https://discuss.elastic.co/t/json-filtering-in-logstash-to-remove-unwanted-fields/275697 "2021-06-13T21:38:18Z")
I want to ingest JSON PE file data that has 40+ fields w/nested fields. I only want the first few fields. Is there a way to either drop the unwanted fields or can I explicitly state which fields I want? --- ## ["All fetched documents included fields with arrays of values and cannot be visualized."](https://discuss.elastic.co/t/all-fetched-documents-included-fields-with-arrays-of-values-and-cannot-be-visualized/275774)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 0\ **Last updated:** [June 13, 2021, 8:14pm UTC](https://discuss.elastic.co/t/all-fetched-documents-included-fields-with-arrays-of-values-and-cannot-be-visualized/275774 "2021-06-13T20:14:39Z")
Hello, I'm trying to create a data frame analytics ML job, and I have two fields that have an array of numbers. The issue is that the analytics job cannot visualize these arrays. Is there any work around or fix? The err… --- ## [Sorting on Nested array object within the same json file](https://discuss.elastic.co/t/sorting-on-nested-array-object-within-the-same-json-file/275767)
**Author:** [@madhan88](https://discuss.elastic.co/u/madhan88)\ **Replies:** 1\ **Last updated:** [June 13, 2021, 7:03pm UTC](https://discuss.elastic.co/t/sorting-on-nested-array-object-within-the-same-json-file/275767 "2021-06-13T19:03:47Z")
Hi, I'm trying to sort the fields present within an array which is of type nested. My data : { "name" : "abc", "shipping":\[ { "shipmentcode" : 5, "shipmentstatus" : "resolved", "shipmentorderid": "12345" }, { … --- ## [Parsing mySql slow query logs using Logstash](https://discuss.elastic.co/t/parsing-mysql-slow-query-logs-using-logstash/275518)
**Author:** [@learningelk](https://discuss.elastic.co/u/learningelk)\ **Replies:** 6\ **Last updated:** [June 13, 2021, 5:07pm UTC](https://discuss.elastic.co/t/parsing-mysql-slow-query-logs-using-logstash/275518 "2021-06-13T17:07:10Z")
I want to parse the mysql slow query logs using logstash and I want to replace modifieddate \> '2021-06-08 08:13:48' with some generix text like modifieddate \> 'NNNN' Below is the log sample : # Time: 2021-06-10T06:30:… --- ## [Nested queries don't work as documented](https://discuss.elastic.co/t/nested-queries-dont-work-as-documented/275737)
**Author:** [@titani0us](https://discuss.elastic.co/u/titani0us)\ **Replies:** 2\ **Last updated:** [June 13, 2021, 4:45pm UTC](https://discuss.elastic.co/t/nested-queries-dont-work-as-documented/275737 "2021-06-13T16:45:55Z")
Hello, As documented in your documentation here, the documentation shows using dot-notation to traverse a nested field (user -\> id). However, when using the query dsl this way, no results are returned. Instead, you mus… --- ## [How can ser grok if log have different content from the same equipment?](https://discuss.elastic.co/t/how-can-ser-grok-if-log-have-different-content-from-the-same-equipment/275541)
**Author:** [@111418](https://discuss.elastic.co/u/111418)\ **Replies:** 5\ **Last updated:** [June 13, 2021, 3:54pm UTC](https://discuss.elastic.co/t/how-can-ser-grok-if-log-have-different-content-from-the-same-equipment/275541 "2021-06-13T15:54:59Z")
Jun 2 16:45:49 tp-id01.test.corp zorp/scb\_ssh\[1379\]: core.alerting(3): (svc/wwVRLvYoUMToHT2Xz9vEbj/ssh\_alert:11/ssh): Audit event was recognized; rule='PatternMatcherRule', type='adp.event.command', pattern='user', acti… --- ## [Find contact with aggs terms and date range and use the found contacts for another aggs with date\_histogram](https://discuss.elastic.co/t/find-contact-with-aggs-terms-and-date-range-and-use-the-found-contacts-for-another-aggs-with-date-histogram/275762)
**Author:** [@gregoire\_Tarres](https://discuss.elastic.co/u/gregoire_Tarres)\ **Replies:** 0\ **Last updated:** [June 13, 2021, 12:25pm UTC](https://discuss.elastic.co/t/find-contact-with-aggs-terms-and-date-range-and-use-the-found-contacts-for-another-aggs-with-date-histogram/275762 "2021-06-13T12:25:13Z")
Hi, i'm new with Elaticsearch and I need some help for a search query.... Thanks in advance ! I've an index with docs between 2021-02-01 and 2021-04-01. I make a search query like this to retrieve phone numbers that app… --- ## [Logs hit value is different](https://discuss.elastic.co/t/logs-hit-value-is-different/275675)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 7\ **Last updated:** [June 13, 2021, 10:40am UTC](https://discuss.elastic.co/t/logs-hit-value-is-different/275675 "2021-06-13T10:40:30Z")
I have two elasticsearch cluster one elk cluster version is 7.6 and other elk cluster version is 7.11 The former elasticsearch cluster is simple it filebeat send the logs to logstash and logstash to elasticsearch, the … --- ## [Best way to define multiple processors based on a group of conditions](https://discuss.elastic.co/t/best-way-to-define-multiple-processors-based-on-a-group-of-conditions/275732)
**Author:** [@Bryan\_Hamilton](https://discuss.elastic.co/u/Bryan_Hamilton)\ **Replies:** 2\ **Last updated:** [June 13, 2021, 10:21am UTC](https://discuss.elastic.co/t/best-way-to-define-multiple-processors-based-on-a-group-of-conditions/275732 "2021-06-13T10:21:02Z")
Hi all I have been trying to work out the way define multiple processors based on a group of conditions. The below snippet doesn't seem to be working but hopefully it will give you an idea of what I am trying to accompli… --- ## [Logstash grok nginx log](https://discuss.elastic.co/t/logstash-grok-nginx-log/275583)
**Author:** [@rdnaz](https://discuss.elastic.co/u/rdnaz)\ **Replies:** 2\ **Last updated:** [June 13, 2021, 8:19am UTC](https://discuss.elastic.co/t/logstash-grok-nginx-log/275583 "2021-06-13T08:19:36Z")
Hi dears, I want to grok nginx access log but i cant get the seperated field of the message , i tried to use overwrite and doesn't make the solution. my Log format is below : \ Jun 10, 2021 @ 11:07:43.648 host:lo… --- ## [Need to load balance Logstash](https://discuss.elastic.co/t/need-to-load-balance-logstash/275619)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 8\ **Last updated:** [June 13, 2021, 6:45am UTC](https://discuss.elastic.co/t/need-to-load-balance-logstash/275619 "2021-06-13T06:45:58Z")
I'm currently running a single logstash and interested in creating several for resilience in case one goes down, and for improving performance. I'm ingesting data currently with the http input plugin. I'm thinking about… --- ## [Filebeat not reading the files with names saved as numbers](https://discuss.elastic.co/t/filebeat-not-reading-the-files-with-names-saved-as-numbers/275741)
**Author:** [@shani\_angarkadu](https://discuss.elastic.co/u/shani_angarkadu)\ **Replies:** 1\ **Last updated:** [June 13, 2021, 6:05am UTC](https://discuss.elastic.co/t/filebeat-not-reading-the-files-with-names-saved-as-numbers/275741 "2021-06-13T06:05:40Z")
My log files are named with numbers for example 45678.rdlog and the filebeat couldn't able to read it and if I re name the file to something like test.rdlog it can able to read it. these logs are generated by rundeck an… --- ## [Received fatal alert: handshake\_failure. How to Solve it?](https://discuss.elastic.co/t/received-fatal-alert-handshake-failure-how-to-solve-it/275749)
**Author:** [@rkhapre](https://discuss.elastic.co/u/rkhapre)\ **Replies:** 0\ **Last updated:** [June 13, 2021, 5:18am UTC](https://discuss.elastic.co/t/received-fatal-alert-handshake-failure-how-to-solve-it/275749 "2021-06-13T05:18:12Z")
Hi All While running LS, i am getting this below error. My HTTP endpoint uses TLS 1.3 It works perfectly for HTTP endpoint with TLS V1.2 looks like LS package does not support for open jruby-openssl In the Gem.lock f… --- ## [Set up - load the Kibana templates](https://discuss.elastic.co/t/set-up-load-the-kibana-templates/275731)
**Author:** [@sk88](https://discuss.elastic.co/u/sk88)\ **Replies:** 3\ **Last updated:** [June 13, 2021, 12:48am UTC](https://discuss.elastic.co/t/set-up-load-the-kibana-templates/275731 "2021-06-13T00:48:21Z")
i have the fllowing error root@stathis:/home/stathis# /usr/share/filebeat/bin/filebeat setup Exiting: error loading config file: stat filebeat.yml: no such file or directory filebeat test config: Config OK also file… --- ## [Node memory](https://discuss.elastic.co/t/node-memory/275634)
**Author:** [@bevano](https://discuss.elastic.co/u/bevano)\ **Replies:** 2\ **Last updated:** [June 12, 2021, 4:50pm UTC](https://discuss.elastic.co/t/node-memory/275634 "2021-06-12T16:50:14Z")
Hi All, Currently on our nodes we have 64GB RAM, with 30GB allocated to the heap, and the other 34GB for OS. I understand that I shouldn't allocate more then 30GB to the heap, but will ES/OS benefit from 128GB or 256GB… --- ## [Kibana 7.13.1 Windows - kibana-encryption-keys](https://discuss.elastic.co/t/kibana-7-13-1-windows-kibana-encryption-keys/275695)
**Author:** [@KSib](https://discuss.elastic.co/u/KSib)\ **Replies:** 2\ **Last updated:** [June 12, 2021, 2:33pm UTC](https://discuss.elastic.co/t/kibana-7-13-1-windows-kibana-encryption-keys/275695 "2021-06-12T14:33:56Z")
Hi there, from a fresh install of Kibana, I see the following warnings log \[17:57:12.982\] \[info\]\[plugins\]\[taskManager\] TaskManager is identified by the Kibana UUID: 2e13faf3-b90d-44dd-bfe8-07962b2b6a2a log \[17:5… --- ## [Need Suggestion on match\_phrase\_prefix and field priority result top to bottom order](https://discuss.elastic.co/t/need-suggestion-on-match-phrase-prefix-and-field-priority-result-top-to-bottom-order/275728)
**Author:** [@bikashelastic](https://discuss.elastic.co/u/bikashelastic)\ **Replies:** 0\ **Last updated:** [June 12, 2021, 9:47am UTC](https://discuss.elastic.co/t/need-suggestion-on-match-phrase-prefix-and-field-priority-result-top-to-bottom-order/275728 "2021-06-12T09:47:48Z")
Hy Team, I have implemented the bool query "match\_phrase\_prefix" with "slop" in my search functionality and the query is giving me the result as expected. but the order of the result is not giving the field priority. W… --- ## [All Nodes Failed Exception](https://discuss.elastic.co/t/all-nodes-failed-exception/275627)
**Author:** [@NLSVTN](https://discuss.elastic.co/u/NLSVTN)\ **Replies:** 15\ **Last updated:** [June 12, 2021, 5:43am UTC](https://discuss.elastic.co/t/all-nodes-failed-exception/275627 "2021-06-12T05:43:39Z")
Hi, We are getting the following error: Error summary: EsHadoopNoNodesLeftException: Connection error (check network and/or proxy settings)- all nodes failed; tried \[\[https://search-seqr-gris-prod-65wdlm6cncfxo5d326vkd… --- ## [Indices not rolling over](https://discuss.elastic.co/t/indices-not-rolling-over/275640)
**Author:** [@lchan](https://discuss.elastic.co/u/lchan)\ **Replies:** 2\ **Last updated:** [June 12, 2021, 4:55am UTC](https://discuss.elastic.co/t/indices-not-rolling-over/275640 "2021-06-12T04:55:14Z")
I am troubleshooting an issue where my indices (filebeats\*) are not rolling from hot to warm. I changed rollover max\_age=30d to max\_age=1d. However, the indices of the ILM action is "completed" and looks like they won't… --- ## [Join the result of two different queries indices](https://discuss.elastic.co/t/join-the-result-of-two-different-queries-indices/275470)
**Author:** [@Walter\_Jimenez](https://discuss.elastic.co/u/Walter_Jimenez)\ **Replies:** 3\ **Last updated:** [June 11, 2021, 9:53pm UTC](https://discuss.elastic.co/t/join-the-result-of-two-different-queries-indices/275470 "2021-06-11T21:53:38Z")
Good morning, excuse my English. I am new to elastic and I am doing some tests with the queries, I have the following case: I have two indeces, metrics and a custom one of my own, I was able to make each one a separate … --- ## [Limiting dynamic properties/fields indexed](https://discuss.elastic.co/t/limiting-dynamic-properties-fields-indexed/275585)
**Author:** [@ronchalant](https://discuss.elastic.co/u/ronchalant)\ **Replies:** 3\ **Last updated:** [June 11, 2021, 9:48pm UTC](https://discuss.elastic.co/t/limiting-dynamic-properties-fields-indexed/275585 "2021-06-11T21:48:47Z")
We're migrating to ES7, and for one of our indexes which stores email data we are hitting the "Limit of total fields \[1000\]" error. The reason for this is we're indexing all headers, and for some emails the number of he… --- ## [Logstash drop based on size](https://discuss.elastic.co/t/logstash-drop-based-on-size/275610)
**Author:** [@mcosta](https://discuss.elastic.co/u/mcosta)\ **Replies:** 2\ **Last updated:** [June 11, 2021, 9:11pm UTC](https://discuss.elastic.co/t/logstash-drop-based-on-size/275610 "2021-06-11T21:11:12Z")
Hi all, Is it possible to drop a message based on it's size (ex: above 1 MB)? I'm reading from tcp port and writing into Kafka topic. All messages bigger then 1 MB give errors similar to this and then logstash retry t… --- ## [How use metricbeat for logstash logs files in docker container](https://discuss.elastic.co/t/how-use-metricbeat-for-logstash-logs-files-in-docker-container/275540)
**Author:** [@Atesrin](https://discuss.elastic.co/u/Atesrin)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 9:08pm UTC](https://discuss.elastic.co/t/how-use-metricbeat-for-logstash-logs-files-in-docker-container/275540 "2021-06-11T21:08:37Z")
Hi everyone, My first post, so sorry if I made some mistakes. I'm trying to use metricbeat to monitor Logstash. I have elastic, kibana, metricbeat and logstash running in docker containers with 2 docker-compose files … --- ## [Filebeat 503 method not allowed](https://discuss.elastic.co/t/filebeat-503-method-not-allowed/275720)
**Author:** [@burtonrs](https://discuss.elastic.co/u/burtonrs)\ **Replies:** 1\ **Last updated:** [June 11, 2021, 9:02pm UTC](https://discuss.elastic.co/t/filebeat-503-method-not-allowed/275720 "2021-06-11T21:02:15Z")
Filebeat is attempting to send logs, but not working at all. Getting error below. HELP!!!! 2021-06-11T15:25:54.596-0400 DEBUG \[input\] input/input.go:139 Run input 2021-06-11T15:25:54.597-0400 DEBUG \[inpu… --- ## [Parsing csv file through Logstash](https://discuss.elastic.co/t/parsing-csv-file-through-logstash/274792)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 17\ **Last updated:** [June 11, 2021, 9:01pm UTC](https://discuss.elastic.co/t/parsing-csv-file-through-logstash/274792 "2021-06-11T21:01:28Z")
Hi All, I am running ELK stack 7.6.2. I need to parse a csv through Logstash. My logstash conf file looks like this: input { file { path =\> "/opt/gtal/ictal/elasticsearch/app/logstash/stage/STATS-01062021.txt" … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1369) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1371)