# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1493 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1494 --- ## [Ingest pipeline with update\_by\_query on failure causes version\_conflict\_engine\_exception](https://discuss.elastic.co/t/ingest-pipeline-with-update-by-query-on-failure-causes-version-conflict-engine-exception/266816)
**Author:** [@nuketro0p3r](https://discuss.elastic.co/u/nuketro0p3r)\ **Replies:** 1\ **Last updated:** [March 24, 2021, 1:19pm UTC](https://discuss.elastic.co/t/ingest-pipeline-with-update-by-query-on-failure-causes-version-conflict-engine-exception/266816 "2021-03-24T13:19:32Z")
Situation: I set the "on\_failure" statement to an existing pipeline like follows (for the whole pipeline): "on\_failure" : \[ { "set" : { "field" : "\_index", "value" : "failed-{{ \_in… --- ## [Group Results of terms aggs in "parent" bucket](https://discuss.elastic.co/t/group-results-of-terms-aggs-in-parent-bucket/268205)
**Author:** [@Leander1](https://discuss.elastic.co/u/Leander1)\ **Replies:** 0\ **Last updated:** [March 24, 2021, 11:57am UTC](https://discuss.elastic.co/t/group-results-of-terms-aggs-in-parent-bucket/268205 "2021-03-24T11:57:14Z")
Hey, I'm trying to group results which I get after doing the terms aggregation. I'm getting the following results: hospital 1, doc\_count 20; hospital 2, doc\_count 32; hospital 3, doc\_count 21; facility 1, doc\_count 11;… --- ## [Data source Not Sending Data](https://discuss.elastic.co/t/data-source-not-sending-data/267787)
**Author:** [@Bigranawab](https://discuss.elastic.co/u/Bigranawab)\ **Replies:** 3\ **Last updated:** [March 24, 2021, 11:41am UTC](https://discuss.elastic.co/t/data-source-not-sending-data/267787 "2021-03-24T11:41:31Z")
Hi, I am working on ELK stack and was wondering if a data source has stopped sending data to ELK due to any reason, how can we identify or alert team that this particular network device or server has stopped sending eve… --- ## [Elastic Cloud vs AWS ELK as a service](https://discuss.elastic.co/t/elastic-cloud-vs-aws-elk-as-a-service/268192)
**Author:** [@evgeniy777](https://discuss.elastic.co/u/evgeniy777)\ **Replies:** 1\ **Last updated:** [March 24, 2021, 10:46am UTC](https://discuss.elastic.co/t/elastic-cloud-vs-aws-elk-as-a-service/268192 "2021-03-24T10:46:26Z")
Hi all ! Can you please explain what the cons and pros of using both solutions ? VS https://cloud.elastic.co/ Thanks in advance --- ## [Extract day, month and year from a date field. Changing Timezone](https://discuss.elastic.co/t/extract-day-month-and-year-from-a-date-field-changing-timezone/267646)
**Author:** [@Ernesto\_Guerra](https://discuss.elastic.co/u/Ernesto_Guerra)\ **Replies:** 4\ **Last updated:** [March 24, 2021, 11:30am UTC](https://discuss.elastic.co/t/extract-day-month-and-year-from-a-date-field-changing-timezone/267646 "2021-03-24T11:30:50Z")
Hi, I would like to add some fields extracting data from "\[layers\]\[frame\]\[frame\_frame\_time\]" field. My code is: date { match =\> \[ "\[layers\]\[frame\]\[frame\_frame\_time\]","ISO8601" \] target =\> "\[layers\]\[frame\]\[fr… --- ## [Calculate the correct recovery.max\_bytes\_per\_sec](https://discuss.elastic.co/t/calculate-the-correct-recovery-max-bytes-per-sec/268194)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 0\ **Last updated:** [March 24, 2021, 10:41am UTC](https://discuss.elastic.co/t/calculate-the-correct-recovery-max-bytes-per-sec/268194 "2021-03-24T10:41:47Z")
Hey there, is there a way to calculate the correct value of indices.recovery.max\_bytes\_per\_sec ? --- ## [Filebeat multi-path configuration for send logs to Logstash](https://discuss.elastic.co/t/filebeat-multi-path-configuration-for-send-logs-to-logstash/267599)
**Author:** [@Nagavardhan25](https://discuss.elastic.co/u/Nagavardhan25)\ **Replies:** 5\ **Last updated:** [March 24, 2021, 9:44am UTC](https://discuss.elastic.co/t/filebeat-multi-path-configuration-for-send-logs-to-logstash/267599 "2021-03-24T09:44:44Z")
Hi, I have one config file in filebeat, i am trying to add two paths for reading the logs from two different locations and under feilds i have created two directories for storing the values in logstash side. Below is th… --- ## [Deployment of functionbeat on AWS](https://discuss.elastic.co/t/deployment-of-functionbeat-on-aws/268183)
**Author:** [@workaholicrohit](https://discuss.elastic.co/u/workaholicrohit)\ **Replies:** 0\ **Last updated:** [March 24, 2021, 9:07am UTC](https://discuss.elastic.co/t/deployment-of-functionbeat-on-aws/268183 "2021-03-24T09:07:46Z")
How can we configure the functionbeat on AWS to push sqs data to Elastic? Do we need to install and configure functionbeat on an EC2 to configure the .yml file? --- ## [Logstash 1.5.4 Output to Elasticsearch with https](https://discuss.elastic.co/t/logstash-1-5-4-output-to-elasticsearch-with-https/268065)
**Author:** [@Dan4](https://discuss.elastic.co/u/Dan4)\ **Replies:** 12\ **Last updated:** [March 24, 2021, 9:02am UTC](https://discuss.elastic.co/t/logstash-1-5-4-output-to-elasticsearch-with-https/268065 "2021-03-24T09:02:22Z")
Hello together, I am new to the elastic stack and have no further experience than just google a solution. In my environment I have to use Logstash on a remote server. I can not change it. I have no control over the vers… --- ## [Is there an API to get the read and write performance data?](https://discuss.elastic.co/t/is-there-an-api-to-get-the-read-and-write-performance-data/267642)
**Author:** [@KeithTt](https://discuss.elastic.co/u/KeithTt)\ **Replies:** 9\ **Last updated:** [March 24, 2021, 8:43am UTC](https://discuss.elastic.co/t/is-there-an-api-to-get-the-read-and-write-performance-data/267642 "2021-03-24T08:43:45Z")
ES version: 6.3.0 My ES cluster block sometimes when perform search and bulk operations, but the cluster status is green, it is strange. The cat.thread\_pool api can output some related info, but i do not know how to de… --- ## [Kibana fails to create kibana.pid in /var/run](https://discuss.elastic.co/t/kibana-fails-to-create-kibana-pid-in-var-run/267247)
**Author:** [@m-b79](https://discuss.elastic.co/u/m-b79)\ **Replies:** 2\ **Last updated:** [March 24, 2021, 8:26am UTC](https://discuss.elastic.co/t/kibana-fails-to-create-kibana-pid-in-var-run/267247 "2021-03-24T08:26:24Z")
Hi, I am a beginner with ELK and since I've updated my Ubuntu 20.04, I have the following problem: When I want to start kibana it fails and when I check the logs it says "\[Error: ENOENT: no such file or directory, open… --- ## [Elasticsearch high cpu load on snapshot creation](https://discuss.elastic.co/t/elasticsearch-high-cpu-load-on-snapshot-creation/265650)
**Author:** [@farmean](https://discuss.elastic.co/u/farmean)\ **Replies:** 6\ **Last updated:** [March 24, 2021, 8:24am UTC](https://discuss.elastic.co/t/elasticsearch-high-cpu-load-on-snapshot-creation/265650 "2021-03-24T08:24:13Z")
Hey everyone! We've got some issue that's making us scratch our heads for a while. We have pretty straightforward setup, 13 nodes, 1 index, 1000 shards, 2 replicas for each, a lot of nested document, high write load an… --- ## [How can I add my own html input element like- Text Box, Text Area, Drop down, Save button in my Kibana dashboard UI](https://discuss.elastic.co/t/how-can-i-add-my-own-html-input-element-like-text-box-text-area-drop-down-save-button-in-my-kibana-dashboard-ui/268170)
**Author:** [@Amit\_Singh4](https://discuss.elastic.co/u/Amit_Singh4)\ **Replies:** 1\ **Last updated:** [March 24, 2021, 8:22am UTC](https://discuss.elastic.co/t/how-can-i-add-my-own-html-input-element-like-text-box-text-area-drop-down-save-button-in-my-kibana-dashboard-ui/268170 "2021-03-24T08:22:43Z")
How can I add my own html input element like- Text Box, Text Area, Drop down, Save button in my Kibana dashboard UI. And after clicking on Button (like- Save), I want to save these new html input values into Elasticseac… --- ## [Datetime parsing errors when including locale de-AT](https://discuss.elastic.co/t/datetime-parsing-errors-when-including-locale-de-at/268091)
**Author:** [@philippkahr](https://discuss.elastic.co/u/philippkahr)\ **Replies:** 0\ **Last updated:** [March 23, 2021, 12:21pm UTC](https://discuss.elastic.co/t/datetime-parsing-errors-when-including-locale-de-at/268091 "2021-03-23T12:21:13Z")
Hi, I am at a loss, we have to deal with german encodings of month such as Dezember instead of December, or März instead of March, which also impacts the MMM notation instead of Mar it is Mär. This is an example message… --- ## [Elasticsearch - high load CPU](https://discuss.elastic.co/t/elasticsearch-high-load-cpu/268165)
**Author:** [@Jefferson\_Ferrari](https://discuss.elastic.co/u/Jefferson_Ferrari)\ **Replies:** 22\ **Last updated:** [March 24, 2021, 7:35am UTC](https://discuss.elastic.co/t/elasticsearch-high-load-cpu/268165 "2021-03-24T07:35:28Z")
Hello guys, We have a problem with elasticserach performance. My env is: 3 masters: AWS t3.large VM on premises CPU: 2 Memory: 8GB VM on premises CPU: 2 Memory: 8GB 15 Datas AWS 5 EC2 instance m5.4xlarge 10 VMs… --- ## [Scripted Field not showing Expression Language in Kibana](https://discuss.elastic.co/t/scripted-field-not-showing-expression-language-in-kibana/267945)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 4\ **Last updated:** [March 24, 2021, 7:07am UTC](https://discuss.elastic.co/t/scripted-field-not-showing-expression-language-in-kibana/267945 "2021-03-24T07:07:10Z")
I am not getting expression language in scripted field. I am using kibana 7.11 version. I want to perform sum on two fields but getting error --- ## [My problem about Geo-bounding box query indexed](https://discuss.elastic.co/t/my-problem-about-geo-bounding-box-query-indexed/267597)
**Author:** [@Sakura1996](https://discuss.elastic.co/u/Sakura1996)\ **Replies:** 9\ **Last updated:** [March 24, 2021, 6:42am UTC](https://discuss.elastic.co/t/my-problem-about-geo-bounding-box-query-indexed/267597 "2021-03-24T06:42:31Z")
Hi, I encountered 2 problems when following the doc, ES version is 7.9. As the doc when use type="indexed" option in bounding box query, the geo-point type must have lat and lon indexed, but I want to know how to do i… --- ## [Problem in sorting dual axis graph](https://discuss.elastic.co/t/problem-in-sorting-dual-axis-graph/265618)
**Author:** [@Pranusha119](https://discuss.elastic.co/u/Pranusha119)\ **Replies:** 2\ **Last updated:** [March 24, 2021, 6:37am UTC](https://discuss.elastic.co/t/problem-in-sorting-dual-axis-graph/265618 "2021-03-24T06:37:38Z")
Hi, Plotted bar and line graph together, tried to sort bar graph and expected line graph to sort accordingly. where as line graph was sorted in weird manner. Output : Expected Output : { "$schema": "https://ve… --- ## [Unable to load SSL configuration for Elasticsearch](https://discuss.elastic.co/t/unable-to-load-ssl-configuration-for-elasticsearch/268087)
**Author:** [@runchranda](https://discuss.elastic.co/u/runchranda)\ **Replies:** 4\ **Last updated:** [March 24, 2021, 6:20am UTC](https://discuss.elastic.co/t/unable-to-load-ssl-configuration-for-elasticsearch/268087 "2021-03-24T06:20:57Z")
Hi, I am trying to Encrypt communications in Elasticsearch between nodes. I refer to this, \[Encrypting communications in Elasticsearch\] (Encrypting communications in Elasticsearch | Elasticsearch Reference \[7.11\] | Ela… --- ## [Time based Indexes with the powers of ILM](https://discuss.elastic.co/t/time-based-indexes-with-the-powers-of-ilm/268038)
**Author:** [@Alamgir\_Qazi](https://discuss.elastic.co/u/Alamgir_Qazi)\ **Replies:** 5\ **Last updated:** [March 24, 2021, 5:54am UTC](https://discuss.elastic.co/t/time-based-indexes-with-the-powers-of-ilm/268038 "2021-03-24T05:54:29Z")
I want to get benefits of ILM (hot, warm, cold) features + the fixed size of indexes without changing the date/time index. Is this possible ? E.g. I have an index events-2021-03-23 and I want ILM to create a new index l… --- ## [Create debian package from source](https://discuss.elastic.co/t/create-debian-package-from-source/268097)
**Author:** [@maxlavr](https://discuss.elastic.co/u/maxlavr)\ **Replies:** 2\ **Last updated:** [March 24, 2021, 5:04am UTC](https://discuss.elastic.co/t/create-debian-package-from-source/268097 "2021-03-24T05:04:28Z")
Hello everyone. My name is Max and my profession is DevOps. I'm working in company which use Elastic Stack. New security standards for our product require building your software from source code and creating deb packages… --- ## [How to fuzzy search a subset of the result?](https://discuss.elastic.co/t/how-to-fuzzy-search-a-subset-of-the-result/268164)
**Author:** [@nshimiye.tech](https://discuss.elastic.co/u/nshimiye.tech)\ **Replies:** 0\ **Last updated:** [March 24, 2021, 4:34am UTC](https://discuss.elastic.co/t/how-to-fuzzy-search-a-subset-of-the-result/268164 "2021-03-24T04:34:54Z")
I have a need to search through collapsed results, is this possible? Something like this { "query": { "match\_all": {} }, "sort": { "createdTime": "desc" }, "collapse": { "field": "name.raw", "query"… --- ## [Issue with date field in CSV plugin](https://discuss.elastic.co/t/issue-with-date-field-in-csv-plugin/268047)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 7\ **Last updated:** [March 24, 2021, 4:26am UTC](https://discuss.elastic.co/t/issue-with-date-field-in-csv-plugin/268047 "2021-03-24T04:26:41Z")
Hi All, I'm trying to ingest data into elasticsearch using csv plugin, data is going smooth for one or two days then all of a sudden there is a wired entry which will get updated with some random date and year. I'm … --- ## [Cluster status turn yellow everyday morning 8:00](https://discuss.elastic.co/t/cluster-status-turn-yellow-everyday-morning-8-00/268036)
**Author:** [@KeithTt](https://discuss.elastic.co/u/KeithTt)\ **Replies:** 17\ **Last updated:** [March 24, 2021, 3:10am UTC](https://discuss.elastic.co/t/cluster-status-turn-yellow-everyday-morning-8-00/268036 "2021-03-24T03:10:29Z")
ES version: 6.3.0 I get the pending tasks and thread pool status, here is the info: { "tasks": \[ { "insert\_order": 327314, "priority": "URGENT", "source": "create-index \[… --- ## [Securing Elasticsearch cluster](https://discuss.elastic.co/t/securing-elasticsearch-cluster/268132)
**Author:** [@ehsan\_kabiri\_33](https://discuss.elastic.co/u/ehsan_kabiri_33)\ **Replies:** 1\ **Last updated:** [March 24, 2021, 2:44am UTC](https://discuss.elastic.co/t/securing-elasticsearch-cluster/268132 "2021-03-24T02:44:22Z")
We know it is strongly recommended in Linux to disable root user. We know it is also recommended to disable root user in Mysql. I do not know why we can not disable/rename superuser "elastic" in elasticsearch and we ca… --- ## [Filter for When Log changes Slightly](https://discuss.elastic.co/t/filter-for-when-log-changes-slightly/268152)
**Author:** [@rmoss25](https://discuss.elastic.co/u/rmoss25)\ **Replies:** 1\ **Last updated:** [March 24, 2021, 2:40am UTC](https://discuss.elastic.co/t/filter-for-when-log-changes-slightly/268152 "2021-03-24T02:40:27Z")
HI, How do you create a grok pattern that can handle the log changing every now and then so I have a filter written that works but every so often the last field of an almost identical log is empty and the existing filt… --- ## [New / Breaking Browser Heartbeat Config Syntax in 7.12](https://discuss.elastic.co/t/new-breaking-browser-heartbeat-config-syntax-in-7-12/268150)
**Author:** [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)\ **Replies:** 0\ **Last updated:** [March 24, 2021, 12:31am UTC](https://discuss.elastic.co/t/new-breaking-browser-heartbeat-config-syntax-in-7-12/268150 "2021-03-24T00:31:55Z")
To our synthetics / browser monitor users, with the release of 7.12 today you'll notice a new, improved syntax for specifying browser monitors. Please see our updated docs for more info. Here's a sample of the new confi… --- ## [Restore elastic search 5.5 snapshot in another aws account vpc cluster](https://discuss.elastic.co/t/restore-elastic-search-5-5-snapshot-in-another-aws-account-vpc-cluster/268101)
**Author:** [@swapna](https://discuss.elastic.co/u/swapna)\ **Replies:** 2\ **Last updated:** [March 23, 2021, 11:47pm UTC](https://discuss.elastic.co/t/restore-elastic-search-5-5-snapshot-in-another-aws-account-vpc-cluster/268101 "2021-03-23T23:47:17Z")
Elastic Search Snapshot and Restore from one account cluster to another account vpc cluster I followed this document Created Role , User and S3 bucket Updated and attached the policies Setup in Postman a) Authoriza… --- ## [Elasticsearch 5.6 docker-compose x-pack license expired](https://discuss.elastic.co/t/elasticsearch-5-6-docker-compose-x-pack-license-expired/268068)
**Author:** [@s-light](https://discuss.elastic.co/u/s-light)\ **Replies:** 1\ **Last updated:** [March 23, 2021, 11:33pm UTC](https://discuss.elastic.co/t/elasticsearch-5-6-docker-compose-x-pack-license-expired/268068 "2021-03-23T23:33:44Z")
hello community, iam currently try to restart my elastic-search setup for my owncloud instance. sadly the newest elasticsearch version supported there is 5.6 :frowning: after my first setup all was fine. now i had so… --- ## [Indexing documents with different data types for a same field](https://discuss.elastic.co/t/indexing-documents-with-different-data-types-for-a-same-field/268086)
**Author:** [@ashit\_pupu](https://discuss.elastic.co/u/ashit_pupu)\ **Replies:** 1\ **Last updated:** [March 23, 2021, 11:31pm UTC](https://discuss.elastic.co/t/indexing-documents-with-different-data-types-for-a-same-field/268086 "2021-03-23T23:31:00Z")
I am using kafka connect elasticsearch sink to index data from kafka to elasticsearch index. The problem which I am facing is for particular event a field value is coming as text and for some event it's coming as object.… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1492) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1494)