# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1526 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1527 --- ## [Error: Resource is under maintenance / recovery](https://discuss.elastic.co/t/error-resource-is-under-maintenance-recovery/266056)
**Author:** [@Arjun\_S](https://discuss.elastic.co/u/Arjun_S)\ **Replies:** 1\ **Last updated:** [March 3, 2021, 7:32am UTC](https://discuss.elastic.co/t/error-resource-is-under-maintenance-recovery/266056 "2021-03-03T07:32:25Z")
We have hosted the ES in the ES cloud, and we got this error multiple times while doing a write operation request(POST) to one of our indices. Elasticsearch\\Common\\Exceptions\\ServerErrorResponseException: {"ok":false,"m… --- ## [Logstash Helm Deployment](https://discuss.elastic.co/t/logstash-helm-deployment/266060)
**Author:** [@Karl\_Ofeiche](https://discuss.elastic.co/u/Karl_Ofeiche)\ **Replies:** 0\ **Last updated:** [March 3, 2021, 7:14am UTC](https://discuss.elastic.co/t/logstash-helm-deployment/266060 "2021-03-03T07:14:59Z")
Hey everyone. I've been trying to send logs from an untangle firewall device to my ELK SIEM on Kubernetes. To do so I created a pipeline that I deployed as a ConfigMap and from here I'm stuck. Here's a part of the Helm… --- ## [Metricbeat - error getting group status: open /proc/\/cgroup](https://discuss.elastic.co/t/metricbeat-error-getting-group-status-open-proc-pid-cgroup/264355)
**Author:** [@anoopkv](https://discuss.elastic.co/u/anoopkv)\ **Replies:** 2\ **Last updated:** [March 3, 2021, 6:34am UTC](https://discuss.elastic.co/t/metricbeat-error-getting-group-status-open-proc-pid-cgroup/264355 "2021-03-03T06:34:21Z")
I have an ELK stack setup in a K8s cluster with security enabled. All components are working fine Installed metricbeat and kube-state-metrics using helm charts, and the containers are not starting, and i see the follow… --- ## [Logstash- Unable to retrieve license information from license server](https://discuss.elastic.co/t/logstash-unable-to-retrieve-license-information-from-license-server/264979)
**Author:** [@anoopkv](https://discuss.elastic.co/u/anoopkv)\ **Replies:** 4\ **Last updated:** [March 3, 2021, 6:29am UTC](https://discuss.elastic.co/t/logstash-unable-to-retrieve-license-information-from-license-server/264979 "2021-03-03T06:29:36Z")
Trying to setup ELK stack on my on-premise K8S cluster using helm charts. Have enabled x-pack security and both Elasticsearch and kibana are working fine after enabling transport, http security I have used elasticsearch… --- ## [One of the master pod is going to crashloop backoff](https://discuss.elastic.co/t/one-of-the-master-pod-is-going-to-crashloop-backoff/265977)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 3\ **Last updated:** [March 3, 2021, 6:08am UTC](https://discuss.elastic.co/t/one-of-the-master-pod-is-going-to-crashloop-backoff/265977 "2021-03-03T06:08:35Z")
We have deployed Elasticsearch cluster with 7.4.0 and operator version 1.1.0 in GKE .One of the master pod is going to crashloop backoff without doing any changes. I can see below error when I checked the logs "org.elas… --- ## [How to use \_sql (SQL queries) to access Elasticsearch indexes in Logstash input plugin](https://discuss.elastic.co/t/how-to-use-sql-sql-queries-to-access-elasticsearch-indexes-in-logstash-input-plugin/265327)
**Author:** [@Amit\_Singh4](https://discuss.elastic.co/u/Amit_Singh4)\ **Replies:** 4\ **Last updated:** [March 3, 2021, 6:08am UTC](https://discuss.elastic.co/t/how-to-use-sql-sql-queries-to-access-elasticsearch-indexes-in-logstash-input-plugin/265327 "2021-03-03T06:08:07Z")
Hi I want to use \_sql (SQL queries) to access Elasticsearch indexes in Logstash input plugin. Find my logstash config as below: input { http\_poller { urls =\> { test1 =\> { method =\> "POST" user =\> "abc" password =\>… --- ## [Elasticdump doesn't work on https self signed certificate links](https://discuss.elastic.co/t/elasticdump-doesnt-work-on-https-self-signed-certificate-links/266049)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [March 3, 2021, 6:06am UTC](https://discuss.elastic.co/t/elasticdump-doesnt-work-on-https-self-signed-certificate-links/266049 "2021-03-03T06:06:34Z")
Hi all, I'm trying to import an index data using elasticdump tool from an elasticsearch server which has self signed certificates. NODE\_TLS\_REJECT\_UNAUTHORIZED=0 elasticdump \\ --input=https://elastic:\*\*\*\*\*\*\*\*\*\*\*\*@mysec… --- ## [RestHighLevelClient get api hangs forever](https://discuss.elastic.co/t/resthighlevelclient-get-api-hangs-forever/265756)
**Author:** [@pavanpatel20](https://discuss.elastic.co/u/pavanpatel20)\ **Replies:** 2\ **Last updated:** [March 3, 2021, 5:36am UTC](https://discuss.elastic.co/t/resthighlevelclient-get-api-hangs-forever/265756 "2021-03-03T05:36:14Z")
I am using elasticsearch-rest-client 7.6.2 in my project and we saw that in one of the get call the get hangs forever and never returns. We got the thread dump and see that the thread is blocked on org.apache.http.concu… --- ## [Is it possible to write the index under restoring?](https://discuss.elastic.co/t/is-it-possible-to-write-the-index-under-restoring/266035)
**Author:** [@math\_u](https://discuss.elastic.co/u/math_u)\ **Replies:** 2\ **Last updated:** [March 3, 2021, 1:31am UTC](https://discuss.elastic.co/t/is-it-possible-to-write-the-index-under-restoring/266035 "2021-03-03T01:31:27Z")
I'm now using ES version 7.10.0. I suppose the indices under restoring are forbidden to write then, how is the documents of the indices which is occured while restoring dealt with? --- ## [How to remove some items in the header](https://discuss.elastic.co/t/how-to-remove-some-items-in-the-header/264932)
**Author:** [@hayzjd836](https://discuss.elastic.co/u/hayzjd836)\ **Replies:** 2\ **Last updated:** [March 3, 2021, 4:12am UTC](https://discuss.elastic.co/t/how-to-remove-some-items-in-the-header/264932 "2021-03-03T04:12:02Z")
Hi As shown in the picture below, I want to remove some items in the red box on the top header. My kibana version is 7.9.2 What I have done so far is modifying the seemingly relevant items in the path below ~/kiban… --- ## [Updating documents - immutability](https://discuss.elastic.co/t/updating-documents-immutability/266041)
**Author:** [@abhishekc92](https://discuss.elastic.co/u/abhishekc92)\ **Replies:** 4\ **Last updated:** [March 3, 2021, 2:33am UTC](https://discuss.elastic.co/t/updating-documents-immutability/266041 "2021-03-03T02:33:45Z")
Hi, I have a use case where a document can be updated or nested entries added to it over time. I get that documents are technically immutable and a new version is created, with the older one being soft deleted. Will this… --- ## [New cluster - every host an eligible master?](https://discuss.elastic.co/t/new-cluster-every-host-an-eligible-master/266040)
**Author:** [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\ **Replies:** 1\ **Last updated:** [March 3, 2021, 2:24am UTC](https://discuss.elastic.co/t/new-cluster-every-host-an-eligible-master/266040 "2021-03-03T02:24:01Z")
I setting up a new 5 host 7.x cluster to deal with audit and logging and such. Data should come to roughly 10T. How terrible an idea would it be to make every host an eligible master node (and data and ingest)? I can al… --- ## [Heartbeat and Elastic Agent](https://discuss.elastic.co/t/heartbeat-and-elastic-agent/266001)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 2\ **Last updated:** [March 3, 2021, 12:20am UTC](https://discuss.elastic.co/t/heartbeat-and-elastic-agent/266001 "2021-03-03T00:20:33Z")
Hello, If I install Elastic Agent on a Windows 10 machine, and then I want to see the machine in Uptime, why do I need to ping it using Heartbeat? Should not the agent know already it's uptime? Will not this make sense … --- ## [Change in logstash configuration](https://discuss.elastic.co/t/change-in-logstash-configuration/266011)
**Author:** [@sandeep3](https://discuss.elastic.co/u/sandeep3)\ **Replies:** 3\ **Last updated:** [March 3, 2021, 12:14am UTC](https://discuss.elastic.co/t/change-in-logstash-configuration/266011 "2021-03-03T00:14:07Z")
Hi, Here In our ELK. log stash have the sql query. Suppose if i want to add extra column in the sql query. Is it will impact the index like data lost any. Please help me in this context. --- ## [Kibana Pie Charts with Unique Count](https://discuss.elastic.co/t/kibana-pie-charts-with-unique-count/265725)
**Author:** [@Kapila](https://discuss.elastic.co/u/Kapila)\ **Replies:** 3\ **Last updated:** [March 2, 2021, 11:47pm UTC](https://discuss.elastic.co/t/kibana-pie-charts-with-unique-count/265725 "2021-03-02T23:47:34Z")
Here is my data set { ticket\_id: 1, status: Open, timestamp: 2019-02-10 } { ticket\_id: 2, status: Open, timestamp: 2019-02-10 } { ticket\_id: 1; status: Closed, timestamp: 2019-02-14 } { ticket\_id: 3; status: Open, ti… --- ## [Bar chart - Aggregate by Field1 or Field2](https://discuss.elastic.co/t/bar-chart-aggregate-by-field1-or-field2/264379)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 2\ **Last updated:** [March 2, 2021, 11:36pm UTC](https://discuss.elastic.co/t/bar-chart-aggregate-by-field1-or-field2/264379 "2021-03-02T23:36:44Z")
Hello, I have documents with 2 fields that I would like to use for aggregation. The document will look something like "\_source" : { "name" : "name\_value", "id" : "id\_value", ... ... … --- ## [Return JSON array of objects via webhook and script transform](https://discuss.elastic.co/t/return-json-array-of-objects-via-webhook-and-script-transform/266030)
**Author:** [@gabriel.ratcliff](https://discuss.elastic.co/u/gabriel.ratcliff)\ **Replies:** 0\ **Last updated:** [March 2, 2021, 11:18pm UTC](https://discuss.elastic.co/t/return-json-array-of-objects-via-webhook-and-script-transform/266030 "2021-03-02T23:18:05Z")
Hi there, I'm attempting to POST to an external webhook that takes an array of objects as a request body. So far, all I've been able to output is a JSON object with a \_value key that contains the array I'm looking for. … --- ## [About Snapshot Compatibility](https://discuss.elastic.co/t/about-snapshot-compatibility/266027)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 1\ **Last updated:** [March 2, 2021, 10:55pm UTC](https://discuss.elastic.co/t/about-snapshot-compatibility/266027 "2021-03-02T22:55:44Z")
I have a new 7.11 cluster which has access to a snapshot repo used by another 7.x cluster. How can I kick off a restore of one of the old snapshots into the new cluster? Thx D --- ## [Export visualization datawith Kiabana API (data table)](https://discuss.elastic.co/t/export-visualization-datawith-kiabana-api-data-table/264451)
**Author:** [@kibana069](https://discuss.elastic.co/u/kibana069)\ **Replies:** 1\ **Last updated:** [March 2, 2021, 10:24pm UTC](https://discuss.elastic.co/t/export-visualization-datawith-kiabana-api-data-table/264451 "2021-03-02T22:24:40Z")
Hi, is it possible to export the results of a visualization with the Kibana API? I tried to use the saved objects API, but this only exports the visualization itself, but not the data of the visualization. Thanks in ad… --- ## [Exporting Elastic cloud cluster performance stats](https://discuss.elastic.co/t/exporting-elastic-cloud-cluster-performance-stats/265707)
**Author:** [@kielni](https://discuss.elastic.co/u/kielni)\ **Replies:** 5\ **Last updated:** [March 2, 2021, 10:17pm UTC](https://discuss.elastic.co/t/exporting-elastic-cloud-cluster-performance-stats/265707 "2021-03-02T22:17:01Z")
I would like to make use of the the metrics available from Cloud / Deployments / \[deployment\] / Performance. The metrics are interesting, but the charts are difficult to use. I use Datadog for monitoring, and want to be … --- ## [Array\_index\_out\_of\_bounds\_exception during decode\_json\_fields for valid JSON](https://discuss.elastic.co/t/array-index-out-of-bounds-exception-during-decode-json-fields-for-valid-json/266019)
**Author:** [@pearj](https://discuss.elastic.co/u/pearj)\ **Replies:** 0\ **Last updated:** [March 2, 2021, 10:04pm UTC](https://discuss.elastic.co/t/array-index-out-of-bounds-exception-during-decode-json-fields-for-valid-json/266019 "2021-03-02T22:04:40Z")
I'm trying to use Functionbeat 7.11.1 to get EKS Kubernetes API server logs from Cloud Watch to Elasticsearch. Specifically, I was trying to convert the Kubernetes audit JSON events from a JSON string back into JSON usi… --- ## [What to do about shards from mixed versions](https://discuss.elastic.co/t/what-to-do-about-shards-from-mixed-versions/266018)
**Author:** [@modim1425](https://discuss.elastic.co/u/modim1425)\ **Replies:** 1\ **Last updated:** [March 2, 2021, 9:55pm UTC](https://discuss.elastic.co/t/what-to-do-about-shards-from-mixed-versions/266018 "2021-03-02T21:55:29Z")
Hello all! I am pretty new to elasticsearch but was tasked with replacing our cluster’s data nodes that were about to hit disc capacity. I started with one and thought I had done due diligence in researching the safe w… --- ## [Elasticsearch Transforms](https://discuss.elastic.co/t/elasticsearch-transforms/265874)
**Author:** [@karanp](https://discuss.elastic.co/u/karanp)\ **Replies:** 3\ **Last updated:** [March 2, 2021, 9:00pm UTC](https://discuss.elastic.co/t/elasticsearch-transforms/265874 "2021-03-02T21:00:06Z")
Hello, So recently I started using es pivot transform. At every stage I am getting some incomplete data and using scripted metric I am completing it and sending it to the new index. Currently what this does is that every… --- ## [High heap usage, old GC does not run consistently](https://discuss.elastic.co/t/high-heap-usage-old-gc-does-not-run-consistently/265253)
**Author:** [@jplaisted](https://discuss.elastic.co/u/jplaisted)\ **Replies:** 5\ **Last updated:** [March 2, 2021, 8:40pm UTC](https://discuss.elastic.co/t/high-heap-usage-old-gc-does-not-run-consistently/265253 "2021-03-02T20:40:58Z")
cross post from https://github.com/elastic/elasticsearch/issues/62278#issuecomment-783680804 per request. Elasticsearch version (bin/elasticsearch --version): 7.10.0 Plugins installed: JVM version (java -version): op… --- ## [Date Histogram calendar vs fixed intervals](https://discuss.elastic.co/t/date-histogram-calendar-vs-fixed-intervals/266010)
**Author:** [@spaffrath](https://discuss.elastic.co/u/spaffrath)\ **Replies:** 0\ **Last updated:** [March 2, 2021, 8:05pm UTC](https://discuss.elastic.co/t/date-histogram-calendar-vs-fixed-intervals/266010 "2021-03-02T20:05:36Z")
Hello, I am looking at the Date Histogram documentation and trying to understand the details of Calendar vs Fixed intervals. For periods of days or greater I get it, and the results I see from periods that span DST time … --- ## [Index Pattern Not Refreshing](https://discuss.elastic.co/t/index-pattern-not-refreshing/265070)
**Author:** [@misterek](https://discuss.elastic.co/u/misterek)\ **Replies:** 7\ **Last updated:** [March 2, 2021, 7:38pm UTC](https://discuss.elastic.co/t/index-pattern-not-refreshing/265070 "2021-03-02T19:38:15Z")
I have an index pattern that won't refresh. I have quite a few fields that aren't recognized. When I look at the index pattern, it recognizes 3630 fields. Clicking refresh sometimes recognizes the new fields (the t… --- ## [Sum of max value](https://discuss.elastic.co/t/sum-of-max-value/265135)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [March 2, 2021, 7:37pm UTC](https://discuss.elastic.co/t/sum-of-max-value/265135 "2021-03-02T19:37:35Z")
I have data coming once an hour 01am connection - 10, region1 01am connection - 20, region2 01am connection - 30, region3 02am connection - 01, region1 02am connection - 40, region2 02am connection - 50, region3 n… --- ## [Elasticsearch will not start after installing 7.9.2](https://discuss.elastic.co/t/elasticsearch-will-not-start-after-installing-7-9-2/264877)
**Author:** [@mike\_wills](https://discuss.elastic.co/u/mike_wills)\ **Replies:** 29\ **Last updated:** [March 2, 2021, 7:35pm UTC](https://discuss.elastic.co/t/elasticsearch-will-not-start-after-installing-7-9-2/264877 "2021-03-02T19:35:04Z")
Elasticsearch will not start after we installed 7.9.2. When started it enters a failed state. I ran journalctl -xe it points to Unregistered Authentication Agent. But when I check the logs I see the following: at … --- ## [Elasticsearch 7.11.1 Query cache empty](https://discuss.elastic.co/t/elasticsearch-7-11-1-query-cache-empty/265919)
**Author:** [@AllenBarra](https://discuss.elastic.co/u/AllenBarra)\ **Replies:** 1\ **Last updated:** [March 2, 2021, 7:34pm UTC](https://discuss.elastic.co/t/elasticsearch-7-11-1-query-cache-empty/265919 "2021-03-02T19:34:26Z")
GET test/\_search { "query": { "query\_string": { "query": "re:{ 0 TO \* }", "default\_operator": "AND", "analyze\_wildcard": false, "allow\_leading\_wildcard": false } }, "from": 0, "size": 10 } "indices" : { "qu… --- ## [Elasticsearch Cloud SSO with ActiveDirectory](https://discuss.elastic.co/t/elasticsearch-cloud-sso-with-activedirectory/265859)
**Author:** [@tchaudhry](https://discuss.elastic.co/u/tchaudhry)\ **Replies:** 7\ **Last updated:** [March 2, 2021, 7:22pm UTC](https://discuss.elastic.co/t/elasticsearch-cloud-sso-with-activedirectory/265859 "2021-03-02T19:22:49Z")
We jut subscribed to ElasticCloud. In the process of implementing SSO with Active Directory. Does SSO setup have to be done on a per deployment basis? The Kibana URLs I have used according to the following article: ar… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1525) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1527)