# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1522 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1523 --- ## [Message not fully read (response) for request AND incompatible wire format](https://discuss.elastic.co/t/message-not-fully-read-response-for-request-and-incompatible-wire-format/266209)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 7\ **Last updated:** [March 5, 2021, 8:29am UTC](https://discuss.elastic.co/t/message-not-fully-read-response-for-request-and-incompatible-wire-format/266209 "2021-03-05T08:29:53Z")
Hello, I am trying ELasticsearch from code source (8.0.0) , and I am getting these warninigs: java.lang.IllegalStateException: Message not fully read (response) for requestId \[542\], handler \[org.elasticsearch.transpor… --- ## [HELP with query =\> Doc with array of 2 values Return 2 hits](https://discuss.elastic.co/t/help-with-query-doc-with-array-of-2-values-return-2-hits/266325)
**Author:** [@Peter4](https://discuss.elastic.co/u/Peter4)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 8:11am UTC](https://discuss.elastic.co/t/help-with-query-doc-with-array-of-2-values-return-2-hits/266325 "2021-03-05T08:11:24Z")
Hi I need help writing query. doc in ES is { A: "A", B: \["1","2"\] } result from query should be: hits(2x) { A:"A" , B: "1"} { A:"A" , B: "2" } is this possible? --- ## [How to increase speed when using es-hadoop bulk data from hdfs to elasticsearch?](https://discuss.elastic.co/t/how-to-increase-speed-when-using-es-hadoop-bulk-data-from-hdfs-to-elasticsearch/266329)
**Author:** [@Chuckiefan](https://discuss.elastic.co/u/Chuckiefan)\ **Replies:** 0\ **Last updated:** [March 5, 2021, 7:55am UTC](https://discuss.elastic.co/t/how-to-increase-speed-when-using-es-hadoop-bulk-data-from-hdfs-to-elasticsearch/266329 "2021-03-05T07:55:13Z")
When I use es-hadoop to run a MapReduce bulk data from hdfs to elasticsearch ,the number of reducer is 1 as default. Is there any way to increase the speed of it ? --- ## [Get events for Elasticsearch cluster health degraded , but cluster is green](https://discuss.elastic.co/t/get-events-for-elasticsearch-cluster-health-degraded-but-cluster-is-green/266322)
**Author:** [@oldthreefeng](https://discuss.elastic.co/u/oldthreefeng)\ **Replies:** 0\ **Last updated:** [March 5, 2021, 6:55am UTC](https://discuss.elastic.co/t/get-events-for-elasticsearch-cluster-health-degraded-but-cluster-is-green/266322 "2021-03-05T06:55:40Z")
the es version is 6.8.8 $ k get events -n sls-prod LAST SEEN TYPE REASON OBJECT MESSAGE 44m Warning Unhealthy elasticsearch/elastic Elasticsearch cluster health degraded but … --- ## [Logstash CIDR Filter : create new field with matched network](https://discuss.elastic.co/t/logstash-cidr-filter-create-new-field-with-matched-network/266282)
**Author:** [@Nybble](https://discuss.elastic.co/u/Nybble)\ **Replies:** 2\ **Last updated:** [March 5, 2021, 6:22am UTC](https://discuss.elastic.co/t/logstash-cidr-filter-create-new-field-with-matched-network/266282 "2021-03-05T06:22:03Z")
Hello, I'm currently using the Logstash CIDR filter to tag private and public IP. Now, I want to use this plugin with a list of all the networks used within my company and add a field or a tag with network information … --- ## [Can't get filebeat 7.x syslogs into elasticsearch](https://discuss.elastic.co/t/cant-get-filebeat-7-x-syslogs-into-elasticsearch/265739)
**Author:** [@Aholzheimer](https://discuss.elastic.co/u/Aholzheimer)\ **Replies:** 3\ **Last updated:** [March 5, 2021, 6:00am UTC](https://discuss.elastic.co/t/cant-get-filebeat-7-x-syslogs-into-elasticsearch/265739 "2021-03-05T06:00:46Z")
Hi, I'm wondering if anyone else has had this problem. I am in the process up upgrading filebeat on our CentOS 7 servers. They are running filebeat version 6.8 and our ELK stack is 7.10.1. We are planning to upgrade t… --- ## [Watcher Assistance (ii)](https://discuss.elastic.co/t/watcher-assistance-ii/265261)
**Author:** [@PinkElephant](https://discuss.elastic.co/u/PinkElephant)\ **Replies:** 2\ **Last updated:** [March 5, 2021, 5:45am UTC](https://discuss.elastic.co/t/watcher-assistance-ii/265261 "2021-03-05T05:45:07Z")
Hey, Trying to use some code I found in the docs, and am met with an error. { "trigger": { "schedule": { "interval": "1m" } }, "input": { "search": { "request": { "indices": ".moni… --- ## [Unable to use Top hit for ip address in pie chart](https://discuss.elastic.co/t/unable-to-use-top-hit-for-ip-address-in-pie-chart/266054)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 2\ **Last updated:** [March 5, 2021, 5:44am UTC](https://discuss.elastic.co/t/unable-to-use-top-hit-for-ip-address-in-pie-chart/266054 "2021-03-05T05:44:05Z")
Hi all, I'm trying to give a pie chart in kibana for ip address to monitor the up/down status of a device. SO many times, device ip may be down, but currently it is up. SO i want to give top hit of ip ordered by time… --- ## [Curate Unable to connect to Elasticsearch cluster](https://discuss.elastic.co/t/curate-unable-to-connect-to-elasticsearch-cluster/266171)
**Author:** [@Bjen\_Shah](https://discuss.elastic.co/u/Bjen_Shah)\ **Replies:** 4\ **Last updated:** [March 5, 2021, 4:43am UTC](https://discuss.elastic.co/t/curate-unable-to-connect-to-elasticsearch-cluster/266171 "2021-03-05T04:43:28Z")
$ curator\_cli --version curator\_cli, version 5.8.3 $ curator\_cli --loglevel DEBUG --use\_ssl --host 'https://test01.elk.com' --certificate '/etc/pki/www/pams-ca.pem' --port 9200 show\_indices 2021-03-03 16:22:08,053 DEBUG… --- ## [Can I define color range in Object](https://discuss.elastic.co/t/can-i-define-color-range-in-object/266095)
**Author:** [@ChrisaT](https://discuss.elastic.co/u/ChrisaT)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 4:17am UTC](https://discuss.elastic.co/t/can-i-define-color-range-in-object/266095 "2021-03-05T04:17:06Z")
Hi, im having issues with visualisations and defining colour ranges. Although I can override the colour via the legend in the visualisation adding this into a Canvas ignores the colours I set. It reverts to the default g… --- ## [Default analyser in annotated text](https://discuss.elastic.co/t/default-analyser-in-annotated-text/266313)
**Author:** [@Deepti](https://discuss.elastic.co/u/Deepti)\ **Replies:** 0\ **Last updated:** [March 5, 2021, 4:05am UTC](https://discuss.elastic.co/t/default-analyser-in-annotated-text/266313 "2021-03-05T04:05:41Z")
What is the default analyser used in annotated text?is it standard analyser?how do I find it? Can we use a different analyser for annotated text? --- ## [How to find whether the field in elasticSearch is sortable and analysed](https://discuss.elastic.co/t/how-to-find-whether-the-field-in-elasticsearch-is-sortable-and-analysed/265106)
**Author:** [@Deepti](https://discuss.elastic.co/u/Deepti)\ **Replies:** 8\ **Last updated:** [March 5, 2021, 4:00am UTC](https://discuss.elastic.co/t/how-to-find-whether-the-field-in-elasticsearch-is-sortable-and-analysed/265106 "2021-03-05T04:00:16Z")
How to find whether the field in elasticSearch is sortable and analysed --- ## [Rmdir syscall event and file path](https://discuss.elastic.co/t/rmdir-syscall-event-and-file-path/266015)
**Author:** [@alanoe](https://discuss.elastic.co/u/alanoe)\ **Replies:** 2\ **Last updated:** [March 5, 2021, 2:55am UTC](https://discuss.elastic.co/t/rmdir-syscall-event-and-file-path/266015 "2021-03-05T02:55:08Z")
I'm tracking the rmdir syscall with the following rule: audit\_rules: | -a always,exit -F dir=/sasdata -F arch=b64 -S creat -S open -S openat -S unlink -S unlinkat -S symlink -S symlinkat -S link -S linkat -S renam… --- ## [Dissector mapping, pattern not found (Jfrog artifactory service logs)](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-jfrog-artifactory-service-logs/266305)
**Author:** [@jchiu](https://discuss.elastic.co/u/jchiu)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 2:23am UTC](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-jfrog-artifactory-service-logs/266305 "2021-03-05T02:23:48Z")
Hello all, I am having a hard time parsing the JFrog's artifactory-service log with "dissect". Even after few searches here, I still couldn't figure out what went wrong... Hope that someone could be kind enough to take… --- ## [Elasticstack Audit Logging](https://discuss.elastic.co/t/elasticstack-audit-logging/266093)
**Author:** [@Ingram\_Gultom](https://discuss.elastic.co/u/Ingram_Gultom)\ **Replies:** 2\ **Last updated:** [March 5, 2021, 2:01am UTC](https://discuss.elastic.co/t/elasticstack-audit-logging/266093 "2021-03-05T02:01:42Z")
Hello, Is there any audit configuration for elastic stack to know which user change dynamic cluster configuration or add/delete dashboard at kibana ? Thank you --- ## [Visualization in Kibana for Custome field](https://discuss.elastic.co/t/visualization-in-kibana-for-custome-field/265993)
**Author:** [@Subrat\_Dash](https://discuss.elastic.co/u/Subrat_Dash)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 2:00am UTC](https://discuss.elastic.co/t/visualization-in-kibana-for-custome-field/265993 "2021-03-05T02:00:24Z")
HI All, We have application log in JSON format with key value pair and those keys are coming as Fields in Kibana GUI. WIth this field I am able to parse in text filter but those field does not have virtualization option… --- ## [Getting Error While executing the Automatic report of Watcher](https://discuss.elastic.co/t/getting-error-while-executing-the-automatic-report-of-watcher/265742)
**Author:** [@Karrie\_Koo](https://discuss.elastic.co/u/Karrie_Koo)\ **Replies:** 0\ **Last updated:** [March 1, 2021, 2:01am UTC](https://discuss.elastic.co/t/getting-error-while-executing-the-automatic-report-of-watcher/265742 "2021-03-01T02:01:42Z")
I received the following errors when I simulate the watcher: Watch\[inlined\] reporting\[error\_report.pdf\] Error response when trying to trigger reporting generation host\[eapvmc1m\], port\[9400\] method\[POST\], path\[/api/repor… --- ## [Reading zookeeper log files -](https://discuss.elastic.co/t/reading-zookeeper-log-files/266308)
**Author:** [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\ **Replies:** 0\ **Last updated:** [March 5, 2021, 1:32am UTC](https://discuss.elastic.co/t/reading-zookeeper-log-files/266308 "2021-03-05T01:32:12Z")
I use puppet to maintain \*beat across the fleet. If there is a \*beat module in existence I just rename / replace it from the .disabled version. What I don't see to have is a module for zookeeper. It produces a single fi… --- ## [Isuue while overriding JSON object in document](https://discuss.elastic.co/t/isuue-while-overriding-json-object-in-document/266239)
**Author:** [@pawar.pradeep85](https://discuss.elastic.co/u/pawar.pradeep85)\ **Replies:** 0\ **Last updated:** [March 4, 2021, 12:43pm UTC](https://discuss.elastic.co/t/isuue-while-overriding-json-object-in-document/266239 "2021-03-04T12:43:40Z")
Hello, I want to perform a task which requires below activities: Override "xyz" record with the new "xyz" record completely (avoid update/merging) in the existing document. New "xyz" record structure could be differen… --- ## [Unable to ingest data using different JDBC Drivers in one Conf file](https://discuss.elastic.co/t/unable-to-ingest-data-using-different-jdbc-drivers-in-one-conf-file/266261)
**Author:** [@ronaldom](https://discuss.elastic.co/u/ronaldom)\ **Replies:** 0\ **Last updated:** [March 4, 2021, 4:21pm UTC](https://discuss.elastic.co/t/unable-to-ingest-data-using-different-jdbc-drivers-in-one-conf-file/266261 "2021-03-04T16:21:31Z")
Hello, I am currently doing a proof of concept where I try to pull data from 2 different databases (SQL and Snowflake). I don't see any error in the logs when running the conf file and logstash never seem to complete eve… --- ## [Elastalert spike rule not getting any hits](https://discuss.elastic.co/t/elastalert-spike-rule-not-getting-any-hits/266306)
**Author:** [@Bhanu\_Praveen](https://discuss.elastic.co/u/Bhanu_Praveen)\ **Replies:** 0\ **Last updated:** [March 5, 2021, 12:57am UTC](https://discuss.elastic.co/t/elastalert-spike-rule-not-getting-any-hits/266306 "2021-03-05T00:57:27Z")
Hello, I have a scenario to identify if any spike on incoming work items. There is a huge spike around 57000 for works arrived when compared to a max range of 27000 last 3 months as shown below. I tried to use a spi… --- ## [Kibana instance with multi node elastic cluster](https://discuss.elastic.co/t/kibana-instance-with-multi-node-elastic-cluster/266297)
**Author:** [@raulk89](https://discuss.elastic.co/u/raulk89)\ **Replies:** 1\ **Last updated:** [March 4, 2021, 11:53pm UTC](https://discuss.elastic.co/t/kibana-instance-with-multi-node-elastic-cluster/266297 "2021-03-04T23:53:42Z")
Hi Elastic 7.11.1 Lets' say I have 3 node elastic cluster and I would like to access this cluster through kibana. node-1 node-2 node-3 How should I proceed, I mean, should I: install kibana on each of these 3 serv… --- ## [ILM based on disk space / FIFO indices](https://discuss.elastic.co/t/ilm-based-on-disk-space-fifo-indices/266301)
**Author:** [@Kfiro](https://discuss.elastic.co/u/Kfiro)\ **Replies:** 0\ **Last updated:** [March 4, 2021, 11:42pm UTC](https://discuss.elastic.co/t/ilm-based-on-disk-space-fifo-indices/266301 "2021-03-04T23:42:33Z")
Hi, Im wondering if there is option to save Elastic from getting above 90% disk space.. I have ILM policy set to rollover new index every 50 GIGA and Delete phase for 30 Days. i have 10 Tera disk space on my Cluster... … --- ## [Setting a long custom \_id value when inserting into Elastic search](https://discuss.elastic.co/t/setting-a-long-custom-id-value-when-inserting-into-elastic-search/266300)
**Author:** [@scott\_stash](https://discuss.elastic.co/u/scott_stash)\ **Replies:** 0\ **Last updated:** [March 4, 2021, 11:42pm UTC](https://discuss.elastic.co/t/setting-a-long-custom-id-value-when-inserting-into-elastic-search/266300 "2021-03-04T23:42:18Z")
I'm reading data with filebeat, sending to logstash and it ends up in ES. One issue we have is sometimes Filebeat re-reads files leading to duplicate entries in Elastic Search. One idea was to create a custom \_id value… --- ## [Found differences in mapping. Can I simply update the mapping?](https://discuss.elastic.co/t/found-differences-in-mapping-can-i-simply-update-the-mapping/266278)
**Author:** [@Lennart\_Wong](https://discuss.elastic.co/u/Lennart_Wong)\ **Replies:** 1\ **Last updated:** [March 4, 2021, 11:04pm UTC](https://discuss.elastic.co/t/found-differences-in-mapping-can-i-simply-update-the-mapping/266278 "2021-03-04T23:04:10Z")
Hello! I am very new to Elasticsearch and was tasked to add a new cluster and put it to work. Any help is much appreciated! My company has a few existing ES cluster. After I added the new cluster and the indexes, I a… --- ## [Sort by string in kibana's discover (search)](https://discuss.elastic.co/t/sort-by-string-in-kibanas-discover-search/266284)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 5\ **Last updated:** [March 4, 2021, 10:15pm UTC](https://discuss.elastic.co/t/sort-by-string-in-kibanas-discover-search/266284 "2021-03-04T22:15:43Z")
When I go to Kiban's discover and add fields I can sort on date field or Number field but I can't on string. is this by design or I have to change some setting to enable this I am using version 7.10.1 --- ## [Kibana - Visualize Metric](https://discuss.elastic.co/t/kibana-visualize-metric/266201)
**Author:** [@cvasilak](https://discuss.elastic.co/u/cvasilak)\ **Replies:** 1\ **Last updated:** [March 4, 2021, 9:56pm UTC](https://discuss.elastic.co/t/kibana-visualize-metric/266201 "2021-03-04T21:56:40Z")
hey all, apologies but currently I am new to Elastic and Kibana and need some guidance. I have a custom app that puts an index that contains a 'payload' field which is a String and stored as-is. That 'payload' field is … --- ## [maxClauseCount error on Multi Match after Upgrade to 7.10.1](https://discuss.elastic.co/t/maxclausecount-error-on-multi-match-after-upgrade-to-7-10-1/266160)
**Author:** [@dwhite44](https://discuss.elastic.co/u/dwhite44)\ **Replies:** 1\ **Last updated:** [March 4, 2021, 9:39pm UTC](https://discuss.elastic.co/t/maxclausecount-error-on-multi-match-after-upgrade-to-7-10-1/266160 "2021-03-04T21:39:20Z")
We are in the process of upgrading from Elasticsearch 6.5.4 to 7.10.1. We have some searches that worked fine against 6.5.4 but are getting "failed to create query: maxClauseCount is set to 1024" errors against 7.10.1. H… --- ## [Metricbeat Jolokia module - same jolokia.agent.id for multiple agents](https://discuss.elastic.co/t/metricbeat-jolokia-module-same-jolokia-agent-id-for-multiple-agents/266291)
**Author:** [@igorid70](https://discuss.elastic.co/u/igorid70)\ **Replies:** 0\ **Last updated:** [March 4, 2021, 9:22pm UTC](https://discuss.elastic.co/t/metricbeat-jolokia-module-same-jolokia-agent-id-for-multiple-agents/266291 "2021-03-04T21:22:39Z")
Hi I use jolokia module with auto-discovery while the metrics are scrapped from multiple agents. The metrics are properly exported to Elasticsearch, however if I have a few agents from which I collect the same metrics a… --- ## [Index all data from treshold watcher](https://discuss.elastic.co/t/index-all-data-from-treshold-watcher/266222)
**Author:** [@tomaszgorka](https://discuss.elastic.co/u/tomaszgorka)\ **Replies:** 0\ **Last updated:** [March 4, 2021, 11:20am UTC](https://discuss.elastic.co/t/index-all-data-from-treshold-watcher/266222 "2021-03-04T11:20:41Z")
Hi, I have a treshold alert on my data. The data is simply an integer "age" and "phone", and varchars of name and surname, and a date "time". I made a condition that checks if the age is below 18 in the data from last w… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1521) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1523)