# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1439 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1440 --- ## [How to expand elasticsearch memory disk size](https://discuss.elastic.co/t/how-to-expand-elasticsearch-memory-disk-size/271348)
**Author:** [@charles97](https://discuss.elastic.co/u/charles97)\ **Replies:** 6\ **Last updated:** [April 29, 2021, 2:51am UTC](https://discuss.elastic.co/t/how-to-expand-elasticsearch-memory-disk-size/271348 "2021-04-29T02:51:02Z")
Hi elasticsearch team, I have this case where my VM size is 110gb. Then my freshly installed elasticsearch have 58gb maximum disk available. How do I Optimize my elasticsearch disk available? This cluster is a single n… --- ## [How to return default value for getCell](https://discuss.elastic.co/t/how-to-return-default-value-for-getcell/271565)
**Author:** [@tangkalo](https://discuss.elastic.co/u/tangkalo)\ **Replies:** 3\ **Last updated:** [April 29, 2021, 2:21am UTC](https://discuss.elastic.co/t/how-to-return-default-value-for-getcell/271565 "2021-04-29T02:21:54Z")
Hi, I have the following canvas expression that uses getCell against a data source but it may return null, i.e.the kql returns nothing. Is there a way I can make getCell to return a default value when that happens. Any h… --- ## [Filebeat to elasticsearch configuration(mapping)](https://discuss.elastic.co/t/filebeat-to-elasticsearch-configuration-mapping/271031)
**Author:** [@tkkchan](https://discuss.elastic.co/u/tkkchan)\ **Replies:** 2\ **Last updated:** [April 29, 2021, 2:18am UTC](https://discuss.elastic.co/t/filebeat-to-elasticsearch-configuration-mapping/271031 "2021-04-29T02:18:01Z")
Dear All, I am currently trying to put some files into ES using Filebeat, and meanwhile I want to see if I can set the mapping(with Filebeat, without calling API for ES). As I see from some logstash config, there's a wa… --- ## [Configuration reloading can't be used with 'config.string' (-e)](https://discuss.elastic.co/t/configuration-reloading-cant-be-used-with-config-string-e/271576)
**Author:** [@PAVAN\_KUMAR\_REDDY\_GP](https://discuss.elastic.co/u/PAVAN_KUMAR_REDDY_GP)\ **Replies:** 1\ **Last updated:** [April 29, 2021, 1:10am UTC](https://discuss.elastic.co/t/configuration-reloading-cant-be-used-with-config-string-e/271576 "2021-04-29T01:10:00Z")
Hi Team, Getting an error " Configuration reloading can't be used with 'config.string' (-e)" while running logstash with below command. I tried testing the command in logstash version 7.6.2 and 7.9.2 . Can you please … --- ## [Can I using chinese in condition](https://discuss.elastic.co/t/can-i-using-chinese-in-condition/271339)
**Author:** [@tbs575](https://discuss.elastic.co/u/tbs575)\ **Replies:** 5\ **Last updated:** [April 29, 2021, 1:09am UTC](https://discuss.elastic.co/t/can-i-using-chinese-in-condition/271339 "2021-04-29T01:09:15Z")
Using filebeat to put log into elastic. it seemed I can not using chinese as condition. output.elasticsearch: hosts: '${ELASTICSEARCH\_HOSTS:http://10.200.101.2:9200/}' pipelines: - pipeline: yibo\_test\_jsondata … --- ## [Filebeat AWS Module S3 input error queueURL is not in format](https://discuss.elastic.co/t/filebeat-aws-module-s3-input-error-queueurl-is-not-in-format/261850)
**Author:** [@cjm3625](https://discuss.elastic.co/u/cjm3625)\ **Replies:** 9\ **Last updated:** [April 29, 2021, 12:41am UTC](https://discuss.elastic.co/t/filebeat-aws-module-s3-input-error-queueurl-is-not-in-format/261850 "2021-04-29T00:41:17Z")
Trying to use filebeat to monitor my AWS resources in ISO environment. It looks like the AWS standard endpoint is hard coded. my filebeat.yml filebeat.inputs: - type: s3 queue\_url: https://sqs.us-iso-east-1.c2s.ic.go… --- ## [Wildcard query string](https://discuss.elastic.co/t/wildcard-query-string/271572)
**Author:** [@jrojasp95](https://discuss.elastic.co/u/jrojasp95)\ **Replies:** 0\ **Last updated:** [April 29, 2021, 12:37am UTC](https://discuss.elastic.co/t/wildcard-query-string/271572 "2021-04-29T00:37:30Z")
Hello I need to use wildcards to query about the full\_name and pedt\_fechanac fields, since the input values ​​come from an OCR, I also need the score to be able to get the best match Any recommendation Thank you FIEL… --- ## [Extract multiple xml of multiline log](https://discuss.elastic.co/t/extract-multiple-xml-of-multiline-log/271560)
**Author:** [@E\_T\_N](https://discuss.elastic.co/u/E_T_N)\ **Replies:** 3\ **Last updated:** [April 29, 2021, 12:21am UTC](https://discuss.elastic.co/t/extract-multiple-xml-of-multiline-log/271560 "2021-04-29T00:21:36Z")
Hello. I have a log file with similar estructure: 05 Feb 2021 14:00:00,213 \[AAA-11\] INFO - Line A:\[0\] 05 Feb 2021 14:00:00,231 \[AAA-11\] INFO - Line2:\[0\] 05 Feb 2021 14:00:00,231 \[AAA-11\] INFO - Line3\[: 0\] 05 Feb 202… --- ## [What is maximum limit for new data records for index in data visualizer in kibana?](https://discuss.elastic.co/t/what-is-maximum-limit-for-new-data-records-for-index-in-data-visualizer-in-kibana/271406)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 2\ **Last updated:** [April 29, 2021, 12:20am UTC](https://discuss.elastic.co/t/what-is-maximum-limit-for-new-data-records-for-index-in-data-visualizer-in-kibana/271406 "2021-04-29T00:20:27Z")
Hi all, I just wanted to know maximum how many records or lines of data can be uploaded for a new index in Kibana Data visualizer? What is limit for no of records or lines? Regards --- ## [Configure the anomaly detector to find unusual logon](https://discuss.elastic.co/t/configure-the-anomaly-detector-to-find-unusual-logon/271553)
**Author:** [@Vannessa\_Kemeni](https://discuss.elastic.co/u/Vannessa_Kemeni)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 8:08pm UTC](https://discuss.elastic.co/t/configure-the-anomaly-detector-to-find-unusual-logon/271553 "2021-04-28T20:08:01Z")
Hello everyone, I have a document with IP address and the username. A user in a country can have an IP Address in a specific range for example from 192.168.0.0 up to 192.168.0.255. That means for example it logs on from… --- ## [Cross cluster restore is not working with security enabled on one cluster and disabled on second cluster](https://discuss.elastic.co/t/cross-cluster-restore-is-not-working-with-security-enabled-on-one-cluster-and-disabled-on-second-cluster/271495)
**Author:** [@parthv12](https://discuss.elastic.co/u/parthv12)\ **Replies:** 1\ **Last updated:** [April 29, 2021, 12:10am UTC](https://discuss.elastic.co/t/cross-cluster-restore-is-not-working-with-security-enabled-on-one-cluster-and-disabled-on-second-cluster/271495 "2021-04-29T00:10:23Z")
Hello, I have 2 Elasticsearch clusters, one with security enabled and the other with no security. Using the same repository registered on both the clusters. While trying to restore indices from a snapshot taken on clus… --- ## [Domain Login with Elastic Diagnostics tool](https://discuss.elastic.co/t/domain-login-with-elastic-diagnostics-tool/271460)
**Author:** [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\ **Replies:** 1\ **Last updated:** [April 29, 2021, 12:09am UTC](https://discuss.elastic.co/t/domain-login-with-elastic-diagnostics-tool/271460 "2021-04-29T00:09:46Z")
Hi, We had a problem on our Q-System yesterday so I wanted to look into it using the support diagnostics tool. As we primarily use the active directory login I tried to use the tool with my personal account which has su… --- ## [Parameters for dates](https://discuss.elastic.co/t/parameters-for-dates/271546)
**Author:** [@Pallavibhushan](https://discuss.elastic.co/u/Pallavibhushan)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 6:29pm UTC](https://discuss.elastic.co/t/parameters-for-dates/271546 "2021-04-28T18:29:52Z")
Hi, Below is my use case = % of requests where \[actual\_Date\] \<= \[Planned\_Date\]+24 hrs) I have written below query GET data\_index1/\_search { "size": 1000, "query": { "match\_all": {} }, "aggs": { "NAME": { "val… --- ## [Add users to account on Elastic Cloud](https://discuss.elastic.co/t/add-users-to-account-on-elastic-cloud/271542)
**Author:** [@christhegrand](https://discuss.elastic.co/u/christhegrand)\ **Replies:** 1\ **Last updated:** [April 29, 2021, 12:00am UTC](https://discuss.elastic.co/t/add-users-to-account-on-elastic-cloud/271542 "2021-04-29T00:00:31Z")
How do I create an account for another user on Elastic Cloud? All I see are ways to add users as billing contacts, as operational email contacts, or to a monitoring email whitelist. --- ## [Cluster stops responding when transferring data to relational index](https://discuss.elastic.co/t/cluster-stops-responding-when-transferring-data-to-relational-index/271332)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 11:52pm UTC](https://discuss.elastic.co/t/cluster-stops-responding-when-transferring-data-to-relational-index/271332 "2021-04-28T23:52:11Z")
Hi everyone. I have a cluster of 3 main 13 data nodes. I have a relational index of 40 shards in this set. '\[ERROR\] \[o.e.x.m.c.c.ClusterStatsCollector\] \[main-3\] collector \[cluster\_stats\] timed out while collecting data' … --- ## [Additional data path not used](https://discuss.elastic.co/t/additional-data-path-not-used/270937)
**Author:** [@karlmaresch](https://discuss.elastic.co/u/karlmaresch)\ **Replies:** 7\ **Last updated:** [April 28, 2021, 11:33pm UTC](https://discuss.elastic.co/t/additional-data-path-not-used/270937 "2021-04-28T23:33:28Z")
Hi, We currently have an elasticsearch cluster with two seperate equal servers as two data nodes - one master, one slave. The servers each have 1 TB of diskspace. However, master is now at 81% of disk usage and slave i… --- ## [Moving indices back to ilm hot phase](https://discuss.elastic.co/t/moving-indices-back-to-ilm-hot-phase/271413)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 11:31pm UTC](https://discuss.elastic.co/t/moving-indices-back-to-ilm-hot-phase/271413 "2021-04-28T23:31:46Z")
Hello, Is it possible to change the rules of ilm , so that indices will get back to hot node? For example, the original configuration was "move to warm storage after 5 days" , and we want to change it to 90 days. Ide… --- ## [Metricbeat not retrieving GCP metrics](https://discuss.elastic.co/t/metricbeat-not-retrieving-gcp-metrics/271562)
**Author:** [@Francisco\_Gomez1](https://discuss.elastic.co/u/Francisco_Gomez1)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 9:50pm UTC](https://discuss.elastic.co/t/metricbeat-not-retrieving-gcp-metrics/271562 "2021-04-28T21:50:00Z")
Hi im trying to use metricbeat to monitor a GCP instance, i followed all the steps presents in: Monitor Google Cloud Platform | Observability Guide \[7.12\] | Elastic this tutorial. But when i try to test my GCP connectio… --- ## [Logstash IPV4 bind issue](https://discuss.elastic.co/t/logstash-ipv4-bind-issue/271303)
**Author:** [@edvrfn](https://discuss.elastic.co/u/edvrfn)\ **Replies:** 6\ **Last updated:** [April 28, 2021, 9:09pm UTC](https://discuss.elastic.co/t/logstash-ipv4-bind-issue/271303 "2021-04-28T21:09:52Z")
I have stopped/disabled firewalld and restarted logstash/Elasticsearch services but netstat only shows them listening only on IPv6. Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address … --- ## [Unable to Parse Meraki Flow Syslog Message with GROK and KV Filters in Logstash](https://discuss.elastic.co/t/unable-to-parse-meraki-flow-syslog-message-with-grok-and-kv-filters-in-logstash/271446)
**Author:** [@Khughes0516](https://discuss.elastic.co/u/Khughes0516)\ **Replies:** 4\ **Last updated:** [April 28, 2021, 9:03pm UTC](https://discuss.elastic.co/t/unable-to-parse-meraki-flow-syslog-message-with-grok-and-kv-filters-in-logstash/271446 "2021-04-28T21:03:53Z")
Hello, I am having a lot of trouble with trying to parse a Cisco Meraki flow syslog message in Logstash. A sample message looks like this: Apr 25 13:12:41 gateway 1619356361.230223408 ip\_flow\_end src=10.1.130.45 dst=3… --- ## [I want to import only data that are on a several namespaces](https://discuss.elastic.co/t/i-want-to-import-only-data-that-are-on-a-several-namespaces/271521)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 8:59pm UTC](https://discuss.elastic.co/t/i-want-to-import-only-data-that-are-on-a-several-namespaces/271521 "2021-04-28T20:59:31Z")
Hello, I want to injest via filebeat only data from containers that are in a certain namespace. Is there a possibility to do that? --- ## [Search over all fields](https://discuss.elastic.co/t/search-over-all-fields/271511)
**Author:** [@Sander\_Marx](https://discuss.elastic.co/u/Sander_Marx)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 8:33pm UTC](https://discuss.elastic.co/t/search-over-all-fields/271511 "2021-04-28T20:33:13Z")
Hi, i have a index with multiple documents with severeal fields. I want to be able to search over all the fields without using multi\_match and manualy writing each field. Is there a way to do this? Here is an example of… --- ## [NESTED ATTRIBUTE RENAME NOT WORKING](https://discuss.elastic.co/t/nested-attribute-rename-not-working/271545)
**Author:** [@kamalgunda](https://discuss.elastic.co/u/kamalgunda)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 8:30pm UTC](https://discuss.elastic.co/t/nested-attribute-rename-not-working/271545 "2021-04-28T20:30:27Z")
Hi All, I am not able to rename the nested attribute through logstash mutate/filter/ruby codes while loading the Elasticsearch index and input data is from database. Sample input data and logstash config file given bel… --- ## [Calculate the time difference between 2 xml log lines](https://discuss.elastic.co/t/calculate-the-time-difference-between-2-xml-log-lines/271458)
**Author:** [@roua.B](https://discuss.elastic.co/u/roua.B)\ **Replies:** 4\ **Last updated:** [April 28, 2021, 7:49pm UTC](https://discuss.elastic.co/t/calculate-the-time-difference-between-2-xml-log-lines/271458 "2021-04-28T19:49:02Z")
Hello everyone, I have an XML log file that looks like this: \ \ \ **Author:** [@Vannessa\_Kemeni](https://discuss.elastic.co/u/Vannessa_Kemeni)\ **Replies:** 2\ **Last updated:** [April 28, 2021, 7:42pm UTC](https://discuss.elastic.co/t/find-the-gelocation-from-ip-internal-network/270559 "2021-04-28T19:42:49Z") Hello, i have internal ip adress and the corresonding geolocation. How i can create a list with those ip adresses and the location and enrich my documents in elastic search. Thank you. --- ## [Use a password protected elasticsearch-ca.pem inside kibana.kml](https://discuss.elastic.co/t/use-a-password-protected-elasticsearch-ca-pem-inside-kibana-kml/271396)
**Author:** [@ehsan\_kabiri\_33](https://discuss.elastic.co/u/ehsan_kabiri_33)\ **Replies:** 2\ **Last updated:** [April 28, 2021, 6:05pm UTC](https://discuss.elastic.co/t/use-a-password-protected-elasticsearch-ca-pem-inside-kibana-kml/271396 "2021-04-28T18:05:07Z")
To make communications between Kibana and Elasticsearch be encrypted , I can use one of the followings: elasticsearch.ssl.certificateAuthorities: /etc/kibana/elasticsearch-ca.pem elasticsearch.ssl.key.path: /etc/kibana… --- ## [How to monitor the number of events in Dead letter queue](https://discuss.elastic.co/t/how-to-monitor-the-number-of-events-in-dead-letter-queue/271410)
**Author:** [@Animesh\_Agarwal](https://discuss.elastic.co/u/Animesh_Agarwal)\ **Replies:** 2\ **Last updated:** [April 28, 2021, 6:03pm UTC](https://discuss.elastic.co/t/how-to-monitor-the-number-of-events-in-dead-letter-queue/271410 "2021-04-28T18:03:45Z")
Hi Team, We have configured Dead Letter Queue(DLQ) in our Logstash layer. We want to be alerted when the number of events in DLQ increase beyond a certain limit. I tried going through the Logstash Monitoring docs, but… --- ## [Elasticsearch query to update one document using data from another document in the same es](https://discuss.elastic.co/t/elasticsearch-query-to-update-one-document-using-data-from-another-document-in-the-same-es/271540)
**Author:** [@chamiduz](https://discuss.elastic.co/u/chamiduz)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 5:06pm UTC](https://discuss.elastic.co/t/elasticsearch-query-to-update-one-document-using-data-from-another-document-in-the-same-es/271540 "2021-04-28T17:06:56Z")
Hi, I have static data stored in elasticsearch. for example country name and country id { "id" : 250, "name" : "Sri Lanka" } { "id" : 260, "name" : "India" } I am getting another set of attraction data from a web ser… --- ## [Rally on docker will not list tracks "Cannot list. Could not register track plugin"](https://discuss.elastic.co/t/rally-on-docker-will-not-list-tracks-cannot-list-could-not-register-track-plugin/271510)
**Author:** [@dre](https://discuss.elastic.co/u/dre)\ **Replies:** 2\ **Last updated:** [April 28, 2021, 5:02pm UTC](https://discuss.elastic.co/t/rally-on-docker-will-not-list-tracks-cannot-list-could-not-register-track-plugin/271510 "2021-04-28T17:02:40Z")
Hi, Trying to do the first step with running elastic rally in docker. I get the following issue, both on RHEL VM and on windows. I cannot find anything on this problem in the forum or general searching. Any help apprec… --- ## [\_dateparsefailure mapping date and time to @timestamp field](https://discuss.elastic.co/t/dateparsefailure-mapping-date-and-time-to-timestamp-field/271509)
**Author:** [@Wilks](https://discuss.elastic.co/u/Wilks)\ **Replies:** 2\ **Last updated:** [April 28, 2021, 4:17pm UTC](https://discuss.elastic.co/t/dateparsefailure-mapping-date-and-time-to-timestamp-field/271509 "2021-04-28T16:17:52Z")
I am getting a \_dateparsefailure when I try to map the date and time the log arrived to the @timestamp field. Below is my filter, if I comment out the attempt to map to @timestamp I dont get a \_dateparsefailure so it so… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1438) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1440)