# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1531 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1532 --- ## [Aggregation to find largest range (diff of min max)](https://discuss.elastic.co/t/aggregation-to-find-largest-range-diff-of-min-max/265710)
**Author:** [@smlbiobot](https://discuss.elastic.co/u/smlbiobot)\ **Replies:** 2\ **Last updated:** [March 1, 2021, 12:03am UTC](https://discuss.elastic.co/t/aggregation-to-find-largest-range-diff-of-min-max/265710 "2021-03-01T00:03:16Z")
Is there a way to quickly find the largest range of values (i.e. the difference of min and max within a timeframe)? What I want to do: in a time series with an example doc structured as something like below, find the pr… --- ## [Calculating size of record in queue](https://discuss.elastic.co/t/calculating-size-of-record-in-queue/265727)
**Author:** [@pikomen](https://discuss.elastic.co/u/pikomen)\ **Replies:** 1\ **Last updated:** [February 28, 2021, 11:35pm UTC](https://discuss.elastic.co/t/calculating-size-of-record-in-queue/265727 "2021-02-28T23:35:30Z")
hi, any way to calculate record size in write.queue\_size? from 7.9 the write.queue\_size was updated from 200 to 10000 and I wonder if the heap size of 16 Gb can hold all the 10000 requests (most of them bulk requests) i… --- ## [Multi \_update\_by\_query API like MultiSearch \_msearch - how to? possible?](https://discuss.elastic.co/t/multi-update-by-query-api-like-multisearch-msearch-how-to-possible/261673)
**Author:** [@Datakids](https://discuss.elastic.co/u/Datakids)\ **Replies:** 3\ **Last updated:** [February 28, 2021, 11:15pm UTC](https://discuss.elastic.co/t/multi-update-by-query-api-like-multisearch-msearch-how-to-possible/261673 "2021-02-28T23:15:28Z")
Hi all, I have following question regarding the multiple search api \_msearch Is there a way to do the same by using the \_update\_by\_query api ? UseCase: change entries of fields based on mutliple bool query like: POST… --- ## [Uknown fields](https://discuss.elastic.co/t/uknown-fields/265254)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 4\ **Last updated:** [February 28, 2021, 10:51pm UTC](https://discuss.elastic.co/t/uknown-fields/265254 "2021-02-28T22:51:30Z")
In newest ELK stack, how I should deal with unknown fields? Before this version it was just about refresh index pattern. What should I do now? Removing and adding pattern will lead to lost my edits made in this pattern l… --- ## [Reindexing error](https://discuss.elastic.co/t/reindexing-error/265736)
**Author:** [@leemase004](https://discuss.elastic.co/u/leemase004)\ **Replies:** 1\ **Last updated:** [February 28, 2021, 10:48pm UTC](https://discuss.elastic.co/t/reindexing-error/265736 "2021-02-28T22:48:13Z")
We are attempting to update the mappings for an index. The new mapping includes multiple aliases (around 36) When we attempt to reindex the old indices to the new mappings we keep receiving this error: Reindex can not… --- ## [Manage connection between source and target clusters for remote index](https://discuss.elastic.co/t/manage-connection-between-source-and-target-clusters-for-remote-index/265701)
**Author:** [@jthoni](https://discuss.elastic.co/u/jthoni)\ **Replies:** 2\ **Last updated:** [February 28, 2021, 10:15pm UTC](https://discuss.elastic.co/t/manage-connection-between-source-and-target-clusters-for-remote-index/265701 "2021-02-28T22:15:17Z")
We are migrating our ES cluster to a new environment (from stand-alone Azure VMs to Service Fabric hosted, updating the OS image, upgrading ES version, adding security etc.). I have my new cluster ready for data and am w… --- ## [Newly inserted document not visible in searches](https://discuss.elastic.co/t/newly-inserted-document-not-visible-in-searches/265734)
**Author:** [@Cesidio\_DiBenedetto](https://discuss.elastic.co/u/Cesidio_DiBenedetto)\ **Replies:** 2\ **Last updated:** [February 28, 2021, 7:23pm UTC](https://discuss.elastic.co/t/newly-inserted-document-not-visible-in-searches/265734 "2021-02-28T19:23:20Z")
PUT https://elasticsearch-url/index-name/\_doc/customID?refresh { my data object } This is the response I get: { "\_index": "index-name", "\_type": "\_doc", "\_id": "customID", "\_version": 1, "result": "created",… --- ## [Parse "message" field on Syslog](https://discuss.elastic.co/t/parse-message-field-on-syslog/265729)
**Author:** [@Santiago\_Fernandez](https://discuss.elastic.co/u/Santiago_Fernandez)\ **Replies:** 3\ **Last updated:** [February 28, 2021, 6:53pm UTC](https://discuss.elastic.co/t/parse-message-field-on-syslog/265729 "2021-02-28T18:53:17Z")
Hi Guys! I m new in ELK. have managed to get the Stack up and send my syslogs from my API Manager. I would like to be able to transform a Syslog field into JSON. The "message" field. This is my logstash.conf input { … --- ## [503 license not available--security](https://discuss.elastic.co/t/503-license-not-available-security/264966)
**Author:** [@John\_McDonnell](https://discuss.elastic.co/u/John_McDonnell)\ **Replies:** 3\ **Last updated:** [February 28, 2021, 5:33pm UTC](https://discuss.elastic.co/t/503-license-not-available-security/264966 "2021-02-28T17:33:42Z")
Okay, I'm confused. Numerous elastic blogs now suggest that security features are available with the basic license, so I thought this would be a great opportunity to check out the features in my home lab. But, when I f… --- ## [Does Elasticsearch fit my project?](https://discuss.elastic.co/t/does-elasticsearch-fit-my-project/265721)
**Author:** [@duck](https://discuss.elastic.co/u/duck)\ **Replies:** 3\ **Last updated:** [February 28, 2021, 3:12pm UTC](https://discuss.elastic.co/t/does-elasticsearch-fit-my-project/265721 "2021-02-28T15:12:42Z")
Hi, I've been working on a project for a while. Recently, we've decided to build a system for logging and analyzing. About Project It's an online game project and type is MMORPG. Since it's a MMORPG, there'd be billion… --- ## [Elasticsearch voter\_only instance is taking 50% memory usage](https://discuss.elastic.co/t/elasticsearch-voter-only-instance-is-taking-50-memory-usage/265715)
**Author:** [@MCRBEm](https://discuss.elastic.co/u/MCRBEm)\ **Replies:** 2\ **Last updated:** [February 28, 2021, 1:41pm UTC](https://discuss.elastic.co/t/elasticsearch-voter-only-instance-is-taking-50-memory-usage/265715 "2021-02-28T13:41:42Z")
Hello everyone. Need some help to understand high memory issue we have and possibly fixed/improve our elastic stack setup (without adding new server). We were given only 2 servers to install elasticsearch and we must se… --- ## [Virtualization Error](https://discuss.elastic.co/t/virtualization-error/265455)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 2\ **Last updated:** [February 28, 2021, 12:21pm UTC](https://discuss.elastic.co/t/virtualization-error/265455 "2021-02-28T12:21:15Z")
Hi Unfortunately, when I want to visual some dashboards I face with the error bellow multiple times (See this error by every time I refresh the page) Do you have any idea?!? --- ## [How to generate ssl certificate for new node in existing cluster](https://discuss.elastic.co/t/how-to-generate-ssl-certificate-for-new-node-in-existing-cluster/265689)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [February 28, 2021, 11:56am UTC](https://discuss.elastic.co/t/how-to-generate-ssl-certificate-for-new-node-in-existing-cluster/265689 "2021-02-28T11:56:14Z")
I have 7 node cluster and now i want to add another node for previous nodes i have master\_node1.crt and master\_node1.key master\_node2.crt and master\_node2.key master\_node3.crt and master\_node3.key data\_node1.crt and da… --- ## [Godaddy SSL Wildcard Certificate](https://discuss.elastic.co/t/godaddy-ssl-wildcard-certificate/265503)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 2\ **Last updated:** [February 28, 2021, 11:52am UTC](https://discuss.elastic.co/t/godaddy-ssl-wildcard-certificate/265503 "2021-02-28T11:52:54Z")
Hello there, I´m trying to use my godaddy wildcard ssl on elk stack but for some reason is not working. Can someone point me to the right direction? Follow my config: xpack.security.transport.ssl.enabled: true xpack.sec… --- ## [Pipeline aggregation on average aggregation](https://discuss.elastic.co/t/pipeline-aggregation-on-average-aggregation/265718)
**Author:** [@zagmon](https://discuss.elastic.co/u/zagmon)\ **Replies:** 0\ **Last updated:** [February 28, 2021, 11:35am UTC](https://discuss.elastic.co/t/pipeline-aggregation-on-average-aggregation/265718 "2021-02-28T11:35:05Z")
Hello, Having index contain these fields: user\_id and score (integer between 0-100). Need to do the following: 1. Calculate average score per user. 2. Create 4 buckets with the count of users score: Bucket 1: users wi… --- ## [Count of not unique term's](https://discuss.elastic.co/t/count-of-not-unique-terms/265246)
**Author:** [@artobstrel](https://discuss.elastic.co/u/artobstrel)\ **Replies:** 8\ **Last updated:** [February 28, 2021, 2:41am UTC](https://discuss.elastic.co/t/count-of-not-unique-terms/265246 "2021-02-28T02:41:51Z")
There is my sample dataset: I can get a list of not unique text's in the table: source{ "aggs": { "2": { "terms": { "field": "text.keyword", … --- ## [How much disk and memory is my Elasticsearch using and occupying?](https://discuss.elastic.co/t/how-much-disk-and-memory-is-my-elasticsearch-using-and-occupying/263926)
**Author:** [@mahalabobis](https://discuss.elastic.co/u/mahalabobis)\ **Replies:** 3\ **Last updated:** [February 28, 2021, 12:59am UTC](https://discuss.elastic.co/t/how-much-disk-and-memory-is-my-elasticsearch-using-and-occupying/263926 "2021-02-28T00:59:27Z")
I'm trying to determine my hardware needs. So I want to find exactly how much memory and disk space am I using and occupying. What are the commands to use? --- ## [Configure metricbeat to use logstash--tutorial error?](https://discuss.elastic.co/t/configure-metricbeat-to-use-logstash-tutorial-error/265143)
**Author:** [@John\_McDonnell](https://discuss.elastic.co/u/John_McDonnell)\ **Replies:** 3\ **Last updated:** [February 27, 2021, 11:59pm UTC](https://discuss.elastic.co/t/configure-metricbeat-to-use-logstash-tutorial-error/265143 "2021-02-27T23:59:39Z")
I've set up a 7.11 Kibana-Elastisearch-Logstash-Beats stack more-or-less successfully, but I am unable to configure metricbeat to use logstash. (I am able to see metricbeat data sending it directly to elastisearch.) F… --- ## [Updating Elasticsearch Document](https://discuss.elastic.co/t/updating-elasticsearch-document/265705)
**Author:** [@vstevenson](https://discuss.elastic.co/u/vstevenson)\ **Replies:** 1\ **Last updated:** [February 27, 2021, 10:46pm UTC](https://discuss.elastic.co/t/updating-elasticsearch-document/265705 "2021-02-27T22:46:43Z")
I am running into trouble when I try to update a field within my document. Here's my JSON call: POST vs-users/\_update/bwMNiyZZMg4jZVMdueaZ6m { "name": "abc" } I get this error: { "error" :… --- ## [Indices are not allocate in hot nodes](https://discuss.elastic.co/t/indices-are-not-allocate-in-hot-nodes/265609)
**Author:** [@testsemd\_email](https://discuss.elastic.co/u/testsemd_email)\ **Replies:** 3\ **Last updated:** [February 27, 2021, 9:21pm UTC](https://discuss.elastic.co/t/indices-are-not-allocate-in-hot-nodes/265609 "2021-02-27T21:21:11Z")
I have defined, data\_hot, data\_warm roles in the elastic cluster nodes as below. node1, node2c- node.roles: \[ "data\_content", "ingest", "data\_hot" \] node3, node4 - node.roles: \[ "data\_content", "data\_hot" \] node5, nod… --- ## [Elastic Cloud Log Archiving Recommendations](https://discuss.elastic.co/t/elastic-cloud-log-archiving-recommendations/264532)
**Author:** [@dandrejvv](https://discuss.elastic.co/u/dandrejvv)\ **Replies:** 8\ **Last updated:** [February 27, 2021, 8:15pm UTC](https://discuss.elastic.co/t/elastic-cloud-log-archiving-recommendations/264532 "2021-02-27T20:15:55Z")
We recently moved to the Elastic Stack on the Elastic Cloud but we have a very minimal setup and would like to ask for guidance and recommendations as to how to go about archiving logs without doing anything unnecessaril… --- ## [Log stash schema less input fields](https://discuss.elastic.co/t/log-stash-schema-less-input-fields/265681)
**Author:** [@ali\_ghorbani](https://discuss.elastic.co/u/ali_ghorbani)\ **Replies:** 1\ **Last updated:** [February 27, 2021, 4:41pm UTC](https://discuss.elastic.co/t/log-stash-schema-less-input-fields/265681 "2021-02-27T16:41:49Z")
Hi, I'm new in log-stash what I trying to do is to store my request and response JSON of my web app into the elastic search using log-stash with no change in their JSON format. the problem is a field named start\_time i… --- ## [Filebeat logstash loadbalance to kafka](https://discuss.elastic.co/t/filebeat-logstash-loadbalance-to-kafka/265695)
**Author:** [@cool](https://discuss.elastic.co/u/cool)\ **Replies:** 1\ **Last updated:** [February 27, 2021, 4:14pm UTC](https://discuss.elastic.co/t/filebeat-logstash-loadbalance-to-kafka/265695 "2021-02-27T16:14:22Z")
How to send logs from filebeat/logstash to kafak to multiple datacenters if one datacenter is down logs to be sent to another datacenter. --- ## [Logstash split message by \\n into multiple message inputs](https://discuss.elastic.co/t/logstash-split-message-by-n-into-multiple-message-inputs/265620)
**Author:** [@Daniel\_Jankech](https://discuss.elastic.co/u/Daniel_Jankech)\ **Replies:** 1\ **Last updated:** [February 27, 2021, 1:08pm UTC](https://discuss.elastic.co/t/logstash-split-message-by-n-into-multiple-message-inputs/265620 "2021-02-27T13:08:40Z")
Hi , what im trying to do is pretty simple and straight forward but cant figure out why its not working. When I was using logstash with file input it parsed my logs correctly meaning that it separated my log file by \\n i… --- ## [How to execute a stored script in a search query](https://discuss.elastic.co/t/how-to-execute-a-stored-script-in-a-search-query/265514)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 3\ **Last updated:** [February 27, 2021, 12:48pm UTC](https://discuss.elastic.co/t/how-to-execute-a-stored-script-in-a-search-query/265514 "2021-02-27T12:48:41Z")
hey there, I created a stored script that should add a new field to all the docs into an index. POST \_scripts/set\_new\_field { "script": { "lang": "painless", "source": """ if (ctx.\_source.speaker == "TED… --- ## [Elasticsearch - Timestamp based document Upsert](https://discuss.elastic.co/t/elasticsearch-timestamp-based-document-upsert/265688)
**Author:** [@tag\_v](https://discuss.elastic.co/u/tag_v)\ **Replies:** 0\ **Last updated:** [February 27, 2021, 11:34am UTC](https://discuss.elastic.co/t/elasticsearch-timestamp-based-document-upsert/265688 "2021-02-27T11:34:45Z")
I am looking for more efficient and performance way to implement below use case: Every input JSON contains event\_timestamp and document\_id field. document\_id is '\_id' for the index. If a document with document\_id alre… --- ## [Cannot create index from news Data showcased in https://www.youtube.com/watch?v=CCTgroOcyfM&t=1315s](https://discuss.elastic.co/t/cannot-create-index-from-news-data-showcased-in-https-www-youtube-com-watch-v-cctgroocyfm-t-1315s/265687)
**Author:** [@sushicodee](https://discuss.elastic.co/u/sushicodee)\ **Replies:** 0\ **Last updated:** [February 27, 2021, 11:10am UTC](https://discuss.elastic.co/t/cannot-create-index-from-news-data-showcased-in-https-www-youtube-com-watch-v-cctgroocyfm-t-1315s/265687 "2021-02-27T11:10:49Z")
the error which i get from kibana is Error creating index \[mapper\_parsing\_exception\] No type specified for field \[properties\] More {"error":{"root\_cause":\[{"type":"mapper\_parsing\_exception","reason":"No type specifie… --- ## [Secured beats in a docker container](https://discuss.elastic.co/t/secured-beats-in-a-docker-container/265682)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 1\ **Last updated:** [February 27, 2021, 7:21am UTC](https://discuss.elastic.co/t/secured-beats-in-a-docker-container/265682 "2021-02-27T07:21:19Z")
Hi there, how is the approach to create a secured metricbeat docker container to send data to a secured elastick stack? Background: I have a secured stack, with self signed certificate authority in place. Now I would… --- ## [Best blueprint/architecture/best practice to monitor Logstash pipelines with alerts in Kibana?](https://discuss.elastic.co/t/best-blueprint-architecture-best-practice-to-monitor-logstash-pipelines-with-alerts-in-kibana/265677)
**Author:** [@byteandbit](https://discuss.elastic.co/u/byteandbit)\ **Replies:** 0\ **Last updated:** [February 27, 2021, 3:57am UTC](https://discuss.elastic.co/t/best-blueprint-architecture-best-practice-to-monitor-logstash-pipelines-with-alerts-in-kibana/265677 "2021-02-27T03:57:31Z")
Hello, We are looking for best practice to monitor our Logstash (several pipelines with various input and output plugins) and alert via Slack or eMail in case of problems. Do we just read Logstash logs? If so again wha… --- ## [Index share allocation question with Docker containers](https://discuss.elastic.co/t/index-share-allocation-question-with-docker-containers/265676)
**Author:** [@InnerJoin](https://discuss.elastic.co/u/InnerJoin)\ **Replies:** 8\ **Last updated:** [February 27, 2021, 3:43am UTC](https://discuss.elastic.co/t/index-share-allocation-question-with-docker-containers/265676 "2021-02-27T03:43:18Z")
Hi all, I am currently working on building out an Elasticsearch cluster. I have sent out for the hardware that I'm planning to use and created another topic with the architecture that I'm planning and hardware specs to … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1530) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1532)