# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1431 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1432 --- ## [Elasticsearch 7.9, set or not manually JVM heap memory](https://discuss.elastic.co/t/elasticsearch-7-9-set-or-not-manually-jvm-heap-memory/272041)
**Author:** [@parallelism](https://discuss.elastic.co/u/parallelism)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 8:22am UTC](https://discuss.elastic.co/t/elasticsearch-7-9-set-or-not-manually-jvm-heap-memory/272041 "2021-05-04T08:22:51Z")
Hello, We are deploying an Elasticsearch 7.9.3 cluster in a production environment. About setting or not the Java heap memory assignment, we find in the documentation something that seems a little contradictory. Accord… --- ## [Is Elasticsearch going to sleep after some hours?](https://discuss.elastic.co/t/is-elasticsearch-going-to-sleep-after-some-hours/272035)
**Author:** [@JdKock](https://discuss.elastic.co/u/JdKock)\ **Replies:** 9\ **Last updated:** [May 4, 2021, 8:20am UTC](https://discuss.elastic.co/t/is-elasticsearch-going-to-sleep-after-some-hours/272035 "2021-05-04T08:20:34Z")
We are using Elasticsearch (v7.3.2) for our search solution and we use a Java API to get the search results from Elasticsearch. This is working fine. In the Test environment we are not using Elasticsearch everyday. What… --- ## [License information could not be obtained from Elasticsearch due to \[illegal\_argument\_exception\] request \[/\_xpack\] contains unrecognized parameter: \[accept\_enterprise\]](https://discuss.elastic.co/t/license-information-could-not-be-obtained-from-elasticsearch-due-to-illegal-argument-exception-request-xpack-contains-unrecognized-parameter-accept-enterprise/271990)
**Author:** [@IBoskov](https://discuss.elastic.co/u/IBoskov)\ **Replies:** 3\ **Last updated:** [May 4, 2021, 8:10am UTC](https://discuss.elastic.co/t/license-information-could-not-be-obtained-from-elasticsearch-due-to-illegal-argument-exception-request-xpack-contains-unrecognized-parameter-accept-enterprise/271990 "2021-05-04T08:10:05Z")
Hi there, We are trying to upgrade elasticsearch stack from 7.4.0 to 7.10.2, however when upgrading to 7.10.2 we are facing the following error message from kibana logs. {"type":"log","@timestamp":"2021-05-03T13:20:35Z… --- ## [How to configure GREDDYDATA in logstash to take mutiline input](https://discuss.elastic.co/t/how-to-configure-greddydata-in-logstash-to-take-mutiline-input/272046)
**Author:** [@Learn\_Mulesoft\_With](https://discuss.elastic.co/u/Learn_Mulesoft_With)\ **Replies:** 0\ **Last updated:** [May 4, 2021, 7:46am UTC](https://discuss.elastic.co/t/how-to-configure-greddydata-in-logstash-to-take-mutiline-input/272046 "2021-05-04T07:46:33Z")
INFO 2021-04-17 21:40:25,689 \[\[MuleRuntime\].uber.01: \[testproject\].testprojectFlow.CPU\_LITE @4d779882\] \[processor: testprojectFlow/processors/0; event: 6b78a980-9f97-11eb-a8e6-f8ac6500be0e\] org.mule.runtime.core.interna… --- ## [Hmac hash log integrity check](https://discuss.elastic.co/t/hmac-hash-log-integrity-check/272040)
**Author:** [@syn](https://discuss.elastic.co/u/syn)\ **Replies:** 0\ **Last updated:** [May 4, 2021, 7:29am UTC](https://discuss.elastic.co/t/hmac-hash-log-integrity-check/272040 "2021-05-04T07:29:41Z")
Hi, I'm using graylog with filebeats. each line of log has a hash appended at the end. the hash is supposed to be used for data integrity check. Is there a way for the filebeats harvester to check and match the log da… --- ## [Thread Pool max Size and Number of Processor](https://discuss.elastic.co/t/thread-pool-max-size-and-number-of-processor/271971)
**Author:** [@mani1](https://discuss.elastic.co/u/mani1)\ **Replies:** 10\ **Last updated:** [May 4, 2021, 7:25am UTC](https://discuss.elastic.co/t/thread-pool-max-size-and-number-of-processor/271971 "2021-05-04T07:25:03Z")
Hi, In latest elasticSearch Version 7 series, How to decide the maximum Search Thread Pool Size, will it depends on number of vCPUs , and decided by the formula (vCPU\*3/2)+1 OR the max size still is based on 32 vCPUs a… --- ## [Join indexes in Kibana](https://discuss.elastic.co/t/join-indexes-in-kibana/271885)
**Author:** [@Tulay](https://discuss.elastic.co/u/Tulay)\ **Replies:** 2\ **Last updated:** [May 4, 2021, 6:37am UTC](https://discuss.elastic.co/t/join-indexes-in-kibana/271885 "2021-05-04T06:37:39Z")
How can we join two indexes , if we want to join by a specific field of each index in Kibana --- ## [Unable to view "Snapshot & restore" option in Kibana UI( v6.8.14)](https://discuss.elastic.co/t/unable-to-view-snapshot-restore-option-in-kibana-ui-v6-8-14/272010)
**Author:** [@purushothamkdr143](https://discuss.elastic.co/u/purushothamkdr143)\ **Replies:** 3\ **Last updated:** [May 4, 2021, 6:34am UTC](https://discuss.elastic.co/t/unable-to-view-snapshot-restore-option-in-kibana-ui-v6-8-14/272010 "2021-05-04T06:34:30Z")
Hi All, I am novice to elk stack, installed elasticsearch & kibana both with 6.8.14 version however I dont see "Snapshot & restore" option in kibana ui. But I can see "snapshot & restore" option in version 7.12 of kiban… --- ## [Synonym filter not working within a Multiplexer Filter](https://discuss.elastic.co/t/synonym-filter-not-working-within-a-multiplexer-filter/271719)
**Author:** [@gquaire](https://discuss.elastic.co/u/gquaire)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 5:53am UTC](https://discuss.elastic.co/t/synonym-filter-not-working-within-a-multiplexer-filter/271719 "2021-05-04T05:53:06Z")
Hello, I'm using Elasticsearch v7.6.2. I am currently trying to create an custom analyser that uses a MultiplexerFilter with only one filters branc. This branch contains only a SynonymFilter. My goal is to keep original… --- ## [Grok regex, How should I interpret the hour pattern?](https://discuss.elastic.co/t/grok-regex-how-should-i-interpret-the-hour-pattern/272030)
**Author:** [@111420](https://discuss.elastic.co/u/111420)\ **Replies:** 2\ **Last updated:** [May 4, 2021, 5:33am UTC](https://discuss.elastic.co/t/grok-regex-how-should-i-interpret-the-hour-pattern/272030 "2021-05-04T05:33:59Z")
In Logstash, does HOUR's regular expression (?:2\[0123\]|\[01\])?\[0-9\]) I wonder what the number after the colon means and how to interpret the whole thing. --- ## [Security-exception-action-\[indices:admin/settings/update\] is unauthorized for user \[kibana\] on indices \[apm-7.6.0-error-000001\]](https://discuss.elastic.co/t/security-exception-action-indices-admin-settings-update-is-unauthorized-for-user-kibana-on-indices-apm-7-6-0-error-000001/271737)
**Author:** [@Kevin\_Christopher](https://discuss.elastic.co/u/Kevin_Christopher)\ **Replies:** 2\ **Last updated:** [May 4, 2021, 4:24am UTC](https://discuss.elastic.co/t/security-exception-action-indices-admin-settings-update-is-unauthorized-for-user-kibana-on-indices-apm-7-6-0-error-000001/271737 "2021-05-04T04:24:05Z")
I have the elasticsearch,kibana,apm-server in a single ec2 instance. Able to get apm agent data from other application servers. When I look into Index Management I can see index errors for all apm indices ilm.step:ERR… --- ## [Connect to sql](https://discuss.elastic.co/t/connect-to-sql/272021)
**Author:** [@Jeancarlos\_Netto](https://discuss.elastic.co/u/Jeancarlos_Netto)\ **Replies:** 2\ **Last updated:** [May 4, 2021, 4:01am UTC](https://discuss.elastic.co/t/connect-to-sql/272021 "2021-05-04T04:01:28Z")
I am new here I would like to make a query in a sql database and store the results of this query in elastic, can someone help me to configure the application to work this way? --- ## [Some problems about index life cycle](https://discuss.elastic.co/t/some-problems-about-index-life-cycle/271953)
**Author:** [@ktpktr0](https://discuss.elastic.co/u/ktpktr0)\ **Replies:** 8\ **Last updated:** [May 4, 2021, 3:20am UTC](https://discuss.elastic.co/t/some-problems-about-index-life-cycle/271953 "2021-05-04T03:20:43Z")
I use logstash to add fields to dynamically generate indexes. index =\> "%{\[service\]}-%{+YYYY.MM.dd}" I configure the following index template to match the generated index { "index\_templates" : \[ { "name" :… --- ## [Get number of unique results from multiple indices](https://discuss.elastic.co/t/get-number-of-unique-results-from-multiple-indices/271401)
**Author:** [@NLSVTN](https://discuss.elastic.co/u/NLSVTN)\ **Replies:** 2\ **Last updated:** [May 3, 2021, 7:37pm UTC](https://discuss.elastic.co/t/get-number-of-unique-results-from-multiple-indices/271401 "2021-05-03T19:37:21Z")
I have 5 indices: all of them with the same schema, so each one of them represents a dataset among many datasets. Each one of them is around 1Tb of size. I want to issue a query to all of the indices at the same time and… --- ## [Load data from sql server to elasticsearch aws](https://discuss.elastic.co/t/load-data-from-sql-server-to-elasticsearch-aws/272023)
**Author:** [@hiba](https://discuss.elastic.co/u/hiba)\ **Replies:** 2\ **Last updated:** [May 4, 2021, 2:32am UTC](https://discuss.elastic.co/t/load-data-from-sql-server-to-elasticsearch-aws/272023 "2021-05-04T02:32:53Z")
Hi all, How can I load data from sql server to elasticsearch (aws version 6.5) using logstash ( version 7.9). I can't download the output plugin es-amzon on Windows. Can someone help me please and tell me thé steps … --- ## [Fleets AWS Integration Clarification](https://discuss.elastic.co/t/fleets-aws-integration-clarification/271262)
**Author:** [@DaveRT](https://discuss.elastic.co/u/DaveRT)\ **Replies:** 4\ **Last updated:** [May 4, 2021, 2:09am UTC](https://discuss.elastic.co/t/fleets-aws-integration-clarification/271262 "2021-05-04T02:09:43Z")
I'm trying to test the Fleets Beta AWS integration. Initially just with CloudTrail logs before adding others. So far I have done the below: -Created IAM User -Created permissions policy with required permissions, and… --- ## [Multiple indices for single logstash pipeline](https://discuss.elastic.co/t/multiple-indices-for-single-logstash-pipeline/272015)
**Author:** [@srk1](https://discuss.elastic.co/u/srk1)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 12:12am UTC](https://discuss.elastic.co/t/multiple-indices-for-single-logstash-pipeline/272015 "2021-05-04T00:12:31Z")
Hello ES users, i have filebeat instance sending one source log to ES via logstash pipeline. Now, i want to add another file on filebeat input list and use the same logstash pipeline but write to a different new index. C… --- ## [Different field type on couple shards](https://discuss.elastic.co/t/different-field-type-on-couple-shards/272019)
**Author:** [@rh\_es](https://discuss.elastic.co/u/rh_es)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 12:09am UTC](https://discuss.elastic.co/t/different-field-type-on-couple-shards/272019 "2021-05-04T00:09:42Z")
Hello. Somehow the type of one field in two shards is different of type at entire index and rest of the shards. As result some queries that rely on the field having specific type (number) are impacted. I know that it is … --- ## [Confused about ilm, index templates and new indices](https://discuss.elastic.co/t/confused-about-ilm-index-templates-and-new-indices/271996)
**Author:** [@tterranigma](https://discuss.elastic.co/u/tterranigma)\ **Replies:** 0\ **Last updated:** [May 3, 2021, 1:57pm UTC](https://discuss.elastic.co/t/confused-about-ilm-index-templates-and-new-indices/271996 "2021-05-03T13:57:56Z")
I have a serve where I install some beats (e.g. packetbeat) but I don't enable the systemd service. I only use packetbeat setup --index-management on this server so that the packetbeat index template and the ILM policy g… --- ## [Failed to start Kibana with HTTPS](https://discuss.elastic.co/t/failed-to-start-kibana-with-https/271943)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 12\ **Last updated:** [May 3, 2021, 10:48pm UTC](https://discuss.elastic.co/t/failed-to-start-kibana-with-https/271943 "2021-05-03T22:48:30Z")
Hi I have a cluster with two nodes and two nginx I configured ssl tls and https between 2nodes and kibana, but unfortunately my kibana does not open :frowning\_face: I followed step by step with the bellow link: This… --- ## [Modify documents of a datastream index](https://discuss.elastic.co/t/modify-documents-of-a-datastream-index/271490)
**Author:** [@Reggaeny](https://discuss.elastic.co/u/Reggaeny)\ **Replies:** 4\ **Last updated:** [May 3, 2021, 10:47pm UTC](https://discuss.elastic.co/t/modify-documents-of-a-datastream-index/271490 "2021-05-03T22:47:45Z")
Coming from classic SQL and NoSql databases, I thought it must be possible to change documents in Elasticsearch datastream indexes. The first attempt via update\_by\_query (REST-Api) worked in the test but not in productiv… --- ## [Report from Kibana connected to Elastic Cloud - Failed to decrypt report job data](https://discuss.elastic.co/t/report-from-kibana-connected-to-elastic-cloud-failed-to-decrypt-report-job-data/272026)
**Author:** [@dimitris\_sb](https://discuss.elastic.co/u/dimitris_sb)\ **Replies:** 5\ **Last updated:** [May 3, 2021, 10:39pm UTC](https://discuss.elastic.co/t/report-from-kibana-connected-to-elastic-cloud-failed-to-decrypt-report-job-data/272026 "2021-05-03T22:39:02Z")
Hi All, I noticed the following error on a custom Kibana which is connected to Elastic Cloud elasticsearch instance. Reverse proxy exposes port 80 and then Cloudflare provides https connection. Therefore, I have set #… --- ## [Force logstash to restart after "Pipeline aborted due to error"](https://discuss.elastic.co/t/force-logstash-to-restart-after-pipeline-aborted-due-to-error/272007)
**Author:** [@wmd](https://discuss.elastic.co/u/wmd)\ **Replies:** 4\ **Last updated:** [May 3, 2021, 9:45pm UTC](https://discuss.elastic.co/t/force-logstash-to-restart-after-pipeline-aborted-due-to-error/272007 "2021-05-03T21:45:51Z")
Logstash v6.3.1 is logging this at startup and then getting stuck forever: Sending Logstash's logs to /usr/share/logstash/logs which is now configured via log4j2.properties \[2021-04-30T13:05:39,258\]\[ERROR\]\[logstash.pipe… --- ## [Managing Endpoints Monitored by Heartbeat](https://discuss.elastic.co/t/managing-endpoints-monitored-by-heartbeat/271019)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 1\ **Last updated:** [May 3, 2021, 8:47pm UTC](https://discuss.elastic.co/t/managing-endpoints-monitored-by-heartbeat/271019 "2021-05-03T20:47:46Z")
Is a more dynamic way to manage hostnames or IPs monitored by Heartbeat other than putting them in the hosts list in the files found in the monitors.d folder? There appears to be a character limit for that array, which i… --- ## [Metricbeat for MySQL fails - "missing required field accessing '0.queries'"](https://discuss.elastic.co/t/metricbeat-for-mysql-fails-missing-required-field-accessing-0-queries/271895)
**Author:** [@rudimk](https://discuss.elastic.co/u/rudimk)\ **Replies:** 2\ **Last updated:** [May 3, 2021, 8:33pm UTC](https://discuss.elastic.co/t/metricbeat-for-mysql-fails-missing-required-field-accessing-0-queries/271895 "2021-05-03T20:33:31Z")
Hello! I'm setting up Metricbeats on Ubuntu 18.04 to track metrics for a MySQL database. Unfortunately, starting the agent fails with the following error: May 02 11:08:07 ubuntu metricbeat\[69057\]: 2021-05-02T11:08:07.9… --- ## [Kibana not loading after providing credential, It is coming back to login page itself](https://discuss.elastic.co/t/kibana-not-loading-after-providing-credential-it-is-coming-back-to-login-page-itself/267086)
**Author:** [@r\_aravind](https://discuss.elastic.co/u/r_aravind)\ **Replies:** 10\ **Last updated:** [May 3, 2021, 7:53pm UTC](https://discuss.elastic.co/t/kibana-not-loading-after-providing-credential-it-is-coming-back-to-login-page-itself/267086 "2021-05-03T19:53:43Z")
I have setup my ELK stack kibana instance in Azure kubernetes. I have exposed my kibana service to external load balancer and accessing the load balancer service using DNS from NGINX ingress. I have tried accessing elas… --- ## [Control over writing data to a specific drive](https://discuss.elastic.co/t/control-over-writing-data-to-a-specific-drive/271695)
**Author:** [@Abhishek\_Shinde](https://discuss.elastic.co/u/Abhishek_Shinde)\ **Replies:** 6\ **Last updated:** [May 3, 2021, 7:52pm UTC](https://discuss.elastic.co/t/control-over-writing-data-to-a-specific-drive/271695 "2021-05-03T19:52:36Z")
We are planning to use single node Elasticsearch cluster. The node may contain multiple locations for writing indexing data. I would like to know, if it is possible to write the data to a specific indexing location only… --- ## [Auto\_flush\_interval with ordered pipeline](https://discuss.elastic.co/t/auto-flush-interval-with-ordered-pipeline/271924)
**Author:** [@roua.B](https://discuss.elastic.co/u/roua.B)\ **Replies:** 3\ **Last updated:** [May 3, 2021, 7:41pm UTC](https://discuss.elastic.co/t/auto-flush-interval-with-ordered-pipeline/271924 "2021-05-03T19:41:34Z")
Hello, So I was facing an issue with logstash not parsing the last line of my xml log file. I found that the answer would be to add auto\_flush\_interval =\> 1 to my multiline codec. I would like my pipeline to be ordered … --- ## [Hosting Elastic Maps Service Locally with 7.12](https://discuss.elastic.co/t/hosting-elastic-maps-service-locally-with-7-12/270401)
**Author:** [@Chris6](https://discuss.elastic.co/u/Chris6)\ **Replies:** 9\ **Last updated:** [May 3, 2021, 6:31pm UTC](https://discuss.elastic.co/t/hosting-elastic-maps-service-locally-with-7-12/270401 "2021-05-03T18:31:00Z")
I am trying to host elastic maps service locally with the new way to host the service on your my infrastructure. I have been following this guide Connect to Elastic Maps Service | Kibana Guide \[8.11\] | Elastic and have h… --- ## [Logstash mongodb output plugin fails to authenticate](https://discuss.elastic.co/t/logstash-mongodb-output-plugin-fails-to-authenticate/272014)
**Author:** [@aaron-dsouza](https://discuss.elastic.co/u/aaron-dsouza)\ **Replies:** 0\ **Last updated:** [May 3, 2021, 6:09pm UTC](https://discuss.elastic.co/t/logstash-mongodb-output-plugin-fails-to-authenticate/272014 "2021-05-03T18:09:43Z")
I'm using the logstash mongodb output plugin to write documents to Azure cosmos DB. I am facing the exact same issue as reported here Logstash MongoDB Output Plugin - command insert requires authentication Here is my co… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1430) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1432)