# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1533 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1534 --- ## [Memory Mapped files using full RAM leaving very less room for other processes](https://discuss.elastic.co/t/memory-mapped-files-using-full-ram-leaving-very-less-room-for-other-processes/265617)
**Author:** [@abhinavtk97](https://discuss.elastic.co/u/abhinavtk97)\ **Replies:** 1\ **Last updated:** [February 26, 2021, 1:59pm UTC](https://discuss.elastic.co/t/memory-mapped-files-using-full-ram-leaving-very-less-room-for-other-processes/265617 "2021-02-26T13:59:52Z")
We were testing out Elasticsearch with almost 1.5 TB index size and there is a different java process running on the same machine which does lots of data processing, which gives batch index jobs to Elasticsearch. The mac… --- ## [Missing fields in a document](https://discuss.elastic.co/t/missing-fields-in-a-document/265531)
**Author:** [@kvmuralidhar](https://discuss.elastic.co/u/kvmuralidhar)\ **Replies:** 1\ **Last updated:** [February 26, 2021, 1:20pm UTC](https://discuss.elastic.co/t/missing-fields-in-a-document/265531 "2021-02-26T13:20:07Z")
Hi, I am working on a watcher that's looking for a specific event type and extracting certain fields from the source document. The source document does not have all fields that I am trying to query. When I try to exec… --- ## [Display a ratio of data](https://discuss.elastic.co/t/display-a-ratio-of-data/265449)
**Author:** [@jazzdorf](https://discuss.elastic.co/u/jazzdorf)\ **Replies:** 9\ **Last updated:** [February 26, 2021, 1:01pm UTC](https://discuss.elastic.co/t/display-a-ratio-of-data/265449 "2021-02-26T13:01:03Z")
Hi guys, I have some difficulties with Kibana. My data contains IDs and links: { "\_index": "debug\_sample\_data", "\_type": "\_doc", "\_id": "rPeEz3cBYzpkMbM6YKCc", "\_version": 1, … --- ## [Need some help with Logstash and the XML filter plugin](https://discuss.elastic.co/t/need-some-help-with-logstash-and-the-xml-filter-plugin/265227)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 10\ **Last updated:** [February 26, 2021, 8:47am UTC](https://discuss.elastic.co/t/need-some-help-with-logstash-and-the-xml-filter-plugin/265227 "2021-02-26T08:47:37Z")
Hello Im trying to parse a XML that Im getting from a Windows Event Viewer. Ill try to explain as best I can and any questions or doubt can be further asked. I have this in a field that is winlog.event\_data.param2 (va… --- ## [Unable to Drop desired fields using drop\_fields processors in filebeat](https://discuss.elastic.co/t/unable-to-drop-desired-fields-using-drop-fields-processors-in-filebeat/264654)
**Author:** [@mauryaravi](https://discuss.elastic.co/u/mauryaravi)\ **Replies:** 2\ **Last updated:** [February 26, 2021, 12:15pm UTC](https://discuss.elastic.co/t/unable-to-drop-desired-fields-using-drop-fields-processors-in-filebeat/264654 "2021-02-26T12:15:17Z")
I am sending log data to elastic search directly using filebeat 7.10. I want to drop some fields of doc using drop\_fields processors before sending to ES. Filebeat is dropping some fields placed in drop\_fields conf but … --- ## [Custome Index name but getting "0" fields](https://discuss.elastic.co/t/custome-index-name-but-getting-0-fields/265474)
**Author:** [@shaiksubhan](https://discuss.elastic.co/u/shaiksubhan)\ **Replies:** 3\ **Last updated:** [February 26, 2021, 12:06pm UTC](https://discuss.elastic.co/t/custome-index-name-but-getting-0-fields/265474 "2021-02-26T12:06:46Z")
Hi, I am trying to create custom Index pattern Name and its coming but I am unable to see any fields in that pattern. Any one help me on this ? Below is my yml file ###################### Metricbeat Configuration Exa… --- ## [Filebeat multiple index rollover problem](https://discuss.elastic.co/t/filebeat-multiple-index-rollover-problem/264833)
**Author:** [@graimato](https://discuss.elastic.co/u/graimato)\ **Replies:** 5\ **Last updated:** [February 26, 2021, 11:32am UTC](https://discuss.elastic.co/t/filebeat-multiple-index-rollover-problem/264833 "2021-02-26T11:32:25Z")
Dear all I'm sending log data to elastic using filebeat. I have multiple files to read, actually I'm sending all log files (eg. \*.log) and it works correctly, I have index and rollover works. Now I need to have differe… --- ## [Cannot drop fields from checkpoint filebeat module](https://discuss.elastic.co/t/cannot-drop-fields-from-checkpoint-filebeat-module/265604)
**Author:** [@lachezar.uzunov](https://discuss.elastic.co/u/lachezar.uzunov)\ **Replies:** 0\ **Last updated:** [February 26, 2021, 11:31am UTC](https://discuss.elastic.co/t/cannot-drop-fields-from-checkpoint-filebeat-module/265604 "2021-02-26T11:31:29Z")
Hello everyone, I am using filebeat checkpoint module and want to reduce the log size of the logs, cutting fields like destination.geo.city.name. My /etc/filebeat/filebeat.yml contains: - drop\_fields: wh… --- ## [Failed to parse exception - Preview of field's value: ''](https://discuss.elastic.co/t/failed-to-parse-exception-preview-of-fields-value/265599)
**Author:** [@Q\_the\_River](https://discuss.elastic.co/u/Q_the_River)\ **Replies:** 0\ **Last updated:** [February 26, 2021, 11:02am UTC](https://discuss.elastic.co/t/failed-to-parse-exception-preview-of-fields-value/265599 "2021-02-26T11:02:11Z")
We are using fluentd to forward logs towards elasticsearch. A lot of messages are getting rejected by ES without a rejection reason, does anybody have idea on how to debug this? Rejected by Elasticsearch \[error type\]: … --- ## [Elastic stack issues Certificates and Kibana is not ready yet](https://discuss.elastic.co/t/elastic-stack-issues-certificates-and-kibana-is-not-ready-yet/264728)
**Author:** [@baddack](https://discuss.elastic.co/u/baddack)\ **Replies:** 9\ **Last updated:** [February 26, 2021, 10:36am UTC](https://discuss.elastic.co/t/elastic-stack-issues-certificates-and-kibana-is-not-ready-yet/264728 "2021-02-26T10:36:19Z")
Hello everyone, I am writing this topic because I have an issue on my Elastic Stack. It comes from the day when certificates reached its expiration date. The following message was on in my Kibana's interface : "Kibana i… --- ## [Matching fields in two different indexes together](https://discuss.elastic.co/t/matching-fields-in-two-different-indexes-together/265563)
**Author:** [@Sagar\_Mandal](https://discuss.elastic.co/u/Sagar_Mandal)\ **Replies:** 3\ **Last updated:** [February 26, 2021, 9:39am UTC](https://discuss.elastic.co/t/matching-fields-in-two-different-indexes-together/265563 "2021-02-26T09:39:08Z")
Hey Team, Let just say I have two different indexes named index1 and index2, they both have a column/ field in them named C1 and C2, what I basically want to do is I want to match where C1 and C2 are the same and creat… --- ## [How to re-indexed in Elasticsearch 6.8.13 before upgrading to 7.6.2](https://discuss.elastic.co/t/how-to-re-indexed-in-elasticsearch-6-8-13-before-upgrading-to-7-6-2/265525)
**Author:** [@MdRashid](https://discuss.elastic.co/u/MdRashid)\ **Replies:** 4\ **Last updated:** [February 26, 2021, 9:34am UTC](https://discuss.elastic.co/t/how-to-re-indexed-in-elasticsearch-6-8-13-before-upgrading-to-7-6-2/265525 "2021-02-26T09:34:03Z")
Hi All, I'm New in Elasticsearch and I don't know how to re-indexed Elasticsearch in Ubuntu Here is the ERROR :- java.lang.IllegalStateException: The index \[\[test-suites- tscount/kKudK8xxxxxxxxxxxXrvzAA\]\] was created … --- ## [Java high level client 7.10 shard successful 0 when took \> 1000](https://discuss.elastic.co/t/java-high-level-client-7-10-shard-successful-0-when-took-1000/265291)
**Author:** [@ZorroYue](https://discuss.elastic.co/u/ZorroYue)\ **Replies:** 2\ **Last updated:** [February 26, 2021, 9:32am UTC](https://discuss.elastic.co/t/java-high-level-client-7-10-shard-successful-0-when-took-1000/265291 "2021-02-26T09:32:48Z")
Hi I'm using java high level client to execute aggregation。 when the took in response gt 1000,it give a wrong result like below( it always ok when i do it in kibana): { "took": 1002, "timed\_out": false, "terminat… --- ## [High level client parse aggregation in response of GetAsyncSearchRequest failed](https://discuss.elastic.co/t/high-level-client-parse-aggregation-in-response-of-getasyncsearchrequest-failed/265582)
**Author:** [@ZorroYue](https://discuss.elastic.co/u/ZorroYue)\ **Replies:** 0\ **Last updated:** [February 26, 2021, 9:14am UTC](https://discuss.elastic.co/t/high-level-client-parse-aggregation-in-response-of-getasyncsearchrequest-failed/265582 "2021-02-26T09:14:48Z")
Hi i got problem that high level client parse aggregation in response of GetAsyncSearchRequest failed.Get async request in kibana as: GET /\_async\_search/FjJxanhwbHpoUS1lUXFDU2M1ajEyVHcdVnp4Z09RT3VTdjZYZWxDUUx3dDRMUTox… --- ## [Delete .reporting index](https://discuss.elastic.co/t/delete-reporting-index/265417)
**Author:** [@Tiephen](https://discuss.elastic.co/u/Tiephen)\ **Replies:** 2\ **Last updated:** [February 26, 2021, 8:37am UTC](https://discuss.elastic.co/t/delete-reporting-index/265417 "2021-02-26T08:37:48Z")
Hello, I use watcher to generate lots of pdf report. I have automatically many .reporting index each 3 days so too many index in my elastic cluster. I would like try to delete automatically index after some time. Is … --- ## [Failed to parse field \[agent\] of type \[text\]](https://discuss.elastic.co/t/failed-to-parse-field-agent-of-type-text/265361)
**Author:** [@meissen](https://discuss.elastic.co/u/meissen)\ **Replies:** 4\ **Last updated:** [February 26, 2021, 8:55am UTC](https://discuss.elastic.co/t/failed-to-parse-field-agent-of-type-text/265361 "2021-02-26T08:55:56Z")
Hello, ELK stack in version 7.9.2 it has been working fine with filebeat 6.4, but after upgrading filebeat to 7.0 I get the following error in logstash logs : \[2021-02-24T15:24:56,954\]\[WARN \]\[logstash.outputs.elasticse… --- ## [Logstash not receiving events from Kafka](https://discuss.elastic.co/t/logstash-not-receiving-events-from-kafka/263545)
**Author:** [@Boris\_Joseph](https://discuss.elastic.co/u/Boris_Joseph)\ **Replies:** 1\ **Last updated:** [February 26, 2021, 7:16am UTC](https://discuss.elastic.co/t/logstash-not-receiving-events-from-kafka/263545 "2021-02-26T07:16:07Z")
Hi team, I have a ELK Stack with 2 Logstash Nodes in DataCentre1 and a Kafka Cluster in another DataCentre2 accepting log events from servers in DataCentre2 . SitetoSite VPN connects the DC1 to DC2. Telnet from Kafka … --- ## [Troubles running Logstash on RHEL](https://discuss.elastic.co/t/troubles-running-logstash-on-rhel/265472)
**Author:** [@PawelKosiorek](https://discuss.elastic.co/u/PawelKosiorek)\ **Replies:** 4\ **Last updated:** [February 26, 2021, 7:12am UTC](https://discuss.elastic.co/t/troubles-running-logstash-on-rhel/265472 "2021-02-26T07:12:31Z")
It used to work fine, but recently it has been giving me this. Please help. Thank you. --- ## [Problem with parsing 'message' field in Winlogbeat](https://discuss.elastic.co/t/problem-with-parsing-message-field-in-winlogbeat/265572)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 0\ **Last updated:** [February 26, 2021, 7:00am UTC](https://discuss.elastic.co/t/problem-with-parsing-message-field-in-winlogbeat/265572 "2021-02-26T07:00:44Z")
Hello all! We are using Winlogbeat to collect data from Windows hosts. But we can't understand why 'message' field can't be parsed by Winlogbeat. Can anyone explain why this field doesn't parsed and maybe give answer how… --- ## [Exclude results using controls](https://discuss.elastic.co/t/exclude-results-using-controls/264787)
**Author:** [@vikramnr](https://discuss.elastic.co/u/vikramnr)\ **Replies:** 2\ **Last updated:** [February 26, 2021, 6:44am UTC](https://discuss.elastic.co/t/exclude-results-using-controls/264787 "2021-02-26T06:44:20Z")
Is there way to exclude results using Controls visualisation, similar to what we do manually with filter? Like the below NOT filter using controls --- ## [Kibana installation issue - 7.11](https://discuss.elastic.co/t/kibana-installation-issue-7-11/265147)
**Author:** [@AbhayN](https://discuss.elastic.co/u/AbhayN)\ **Replies:** 2\ **Last updated:** [February 26, 2021, 5:57am UTC](https://discuss.elastic.co/t/kibana-installation-issue-7-11/265147 "2021-02-26T05:57:19Z")
While running kibana.bat from bin folder I am getting this error "KIBANA log \[fatal\]\[root\] Error: Cannot find module '../../../spaces/server'" any idea/direction will help thanks --- ## [Auditbeat File Integrity (Windows OS) Doesn't Capture WHO Changed Files?](https://discuss.elastic.co/t/auditbeat-file-integrity-windows-os-doesnt-capture-who-changed-files/265518)
**Author:** [@efaile](https://discuss.elastic.co/u/efaile)\ **Replies:** 3\ **Last updated:** [February 26, 2021, 4:30am UTC](https://discuss.elastic.co/t/auditbeat-file-integrity-windows-os-doesnt-capture-who-changed-files/265518 "2021-02-26T04:30:50Z")
We need a File Integrity Monitoring solution for Windows OS's - on the server we use as file servers . To further explain "file servers" - not to monitor remotely across shares which is not supported - but directly on th… --- ## [Grook Format For APM Nginx Log](https://discuss.elastic.co/t/grook-format-for-apm-nginx-log/265439)
**Author:** [@reza\_naipospos](https://discuss.elastic.co/u/reza_naipospos)\ **Replies:** 2\ **Last updated:** [February 26, 2021, 4:25am UTC](https://discuss.elastic.co/t/grook-format-for-apm-nginx-log/265439 "2021-02-26T04:25:40Z")
i have format log like this, how logstash can make new field on elasticsearch for every this log, currently all log is in message field. timestamp="25/Feb/2021:13:34:22 +0700" client=192.168.0.21 request="GET /api/Supir… --- ## [Index Mapping- Update API](https://discuss.elastic.co/t/index-mapping-update-api/265515)
**Author:** [@leemase004](https://discuss.elastic.co/u/leemase004)\ **Replies:** 2\ **Last updated:** [February 26, 2021, 2:42am UTC](https://discuss.elastic.co/t/index-mapping-update-api/265515 "2021-02-26T02:42:32Z")
We found an error in our index mapping and have successfully fixed the issue- all future indices will have the correct mapping; however, we are now looking to go back and fix all the old indices that have the incorrect m… --- ## [Failed to start LSB, and Elasticsearch startup script does not exist or is not executable](https://discuss.elastic.co/t/failed-to-start-lsb-and-elasticsearch-startup-script-does-not-exist-or-is-not-executable/265351)
**Author:** [@PSandusky](https://discuss.elastic.co/u/PSandusky)\ **Replies:** 7\ **Last updated:** [February 26, 2021, 1:22am UTC](https://discuss.elastic.co/t/failed-to-start-lsb-and-elasticsearch-startup-script-does-not-exist-or-is-not-executable/265351 "2021-02-26T01:22:51Z")
I've been having a rough time getting Elasticsearch to start at all. On the most recent attempt, I got a response that the startup script did not exist or was not executable. When I pulled systemctl status and then journ… --- ## [Spanish stemming not working with 4 or less letter words](https://discuss.elastic.co/t/spanish-stemming-not-working-with-4-or-less-letter-words/265554)
**Author:** [@eperezf](https://discuss.elastic.co/u/eperezf)\ **Replies:** 0\ **Last updated:** [February 26, 2021, 12:11am UTC](https://discuss.elastic.co/t/spanish-stemming-not-working-with-4-or-less-letter-words/265554 "2021-02-26T00:11:59Z")
Hello! When trying to do stemming in spanish of 4 or less letter words, the stemming algorithm ignores them completely. For example, "roja" should return the following token "roj" due to the feminine/masculine form of … --- ## [Field's name](https://discuss.elastic.co/t/fields-name/265313)
**Author:** [@NourBM](https://discuss.elastic.co/u/NourBM)\ **Replies:** 10\ **Last updated:** [February 25, 2021, 11:47pm UTC](https://discuss.elastic.co/t/fields-name/265313 "2021-02-25T23:47:55Z")
Hi, i'm new with Kibana and Vega, I visualizated data that i entered manually and i noticed that when i enter a field name containing a dot (.) the visualization doesn't show up but when i remove the dot it works fine. … --- ## [TIme series based index strategy](https://discuss.elastic.co/t/time-series-based-index-strategy/265445)
**Author:** [@Kalpa](https://discuss.elastic.co/u/Kalpa)\ **Replies:** 1\ **Last updated:** [February 25, 2021, 11:06pm UTC](https://discuss.elastic.co/t/time-series-based-index-strategy/265445 "2021-02-25T23:06:59Z")
Hi All, I was looking into Indexint Strategy for multitenancy, i see that 1) user based index with shared index and big customers isolated index strategy. 2) time series based. any thought on clubbiing time based inde… --- ## [If I want Q&A system, should I use Elasticsearch or IBM Watson Discovery?](https://discuss.elastic.co/t/if-i-want-q-a-system-should-i-use-elasticsearch-or-ibm-watson-discovery/265469)
**Author:** [@Cloud9Clone](https://discuss.elastic.co/u/Cloud9Clone)\ **Replies:** 1\ **Last updated:** [February 25, 2021, 11:05pm UTC](https://discuss.elastic.co/t/if-i-want-q-a-system-should-i-use-elasticsearch-or-ibm-watson-discovery/265469 "2021-02-25T23:05:23Z")
Hello everyone, I am new to the elasticsearch and as such I would like to ask you for your meaning. In front of me stays a project where I save Q&A pairs in a database and then when a question is asked I would like to r… --- ## [Running Elasticsearch on Eclipse OpenJ9 JVM](https://discuss.elastic.co/t/running-elasticsearch-on-eclipse-openj9-jvm/265523)
**Author:** [@Naoshad\_Mehta](https://discuss.elastic.co/u/Naoshad_Mehta)\ **Replies:** 1\ **Last updated:** [February 25, 2021, 11:03pm UTC](https://discuss.elastic.co/t/running-elasticsearch-on-eclipse-openj9-jvm/265523 "2021-02-25T23:03:58Z")
We have been using Elasticsearch with AdoptJDK11 + Eclipse OpenJ9 JVM and it has worked well for the most part. We have lately been seeing some weird issues related to Garbage Collection and so were wondering why Elastic… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1532) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1534)