# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1536 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1537 --- ## [Filebeat windows service not starting](https://discuss.elastic.co/t/filebeat-windows-service-not-starting/260428)
**Author:** [@vuong43807](https://discuss.elastic.co/u/vuong43807)\ **Replies:** 15\ **Last updated:** [February 25, 2021, 3:44am UTC](https://discuss.elastic.co/t/filebeat-windows-service-not-starting/260428 "2021-02-25T03:44:21Z")
Hi, I follow up to install Filebeat 7.10.1 on Win server 2016 as below link but could not starting the Filebeat service by powershell or services console. Appreciate to your kindly help. PS C:\\Program Files\\Filebe… --- ## [Elasticsearch-Querty and Fetch phase](https://discuss.elastic.co/t/elasticsearch-querty-and-fetch-phase/265270)
**Author:** [@leemase004](https://discuss.elastic.co/u/leemase004)\ **Replies:** 2\ **Last updated:** [February 25, 2021, 3:24am UTC](https://discuss.elastic.co/t/elasticsearch-querty-and-fetch-phase/265270 "2021-02-25T03:24:38Z")
I am wondering if I can get a little clarification. When a query is run: "The coordinating node identifies which documents need to be fetched and issues a multi GET request to the relevant shards." I am wondering what … --- ## [Query and return up to n results based on a type field](https://discuss.elastic.co/t/query-and-return-up-to-n-results-based-on-a-type-field/265213)
**Author:** [@larswise](https://discuss.elastic.co/u/larswise)\ **Replies:** 1\ **Last updated:** [February 25, 2021, 3:02am UTC](https://discuss.elastic.co/t/query-and-return-up-to-n-results-based-on-a-type-field/265213 "2021-02-25T03:02:29Z")
Hi, I have a datamodel with different object types in the same index. These are simply distinguished by a field I have called "type". I would like to do a "all in one query" within each of these types, giving me the to… --- ## [Migration from self monitored to metricbeat Elasticsearch 7.11](https://discuss.elastic.co/t/migration-from-self-monitored-to-metricbeat-elasticsearch-7-11/265240)
**Author:** [@derekmizak](https://discuss.elastic.co/u/derekmizak)\ **Replies:** 0\ **Last updated:** [February 23, 2021, 5:57pm UTC](https://discuss.elastic.co/t/migration-from-self-monitored-to-metricbeat-elasticsearch-7-11/265240 "2021-02-23T17:57:20Z")
I am using Elasticsearch 7.11. I have tried to migrate from self-monitoring of the cluster to metric beats. I have metric beats setup, I can see logs coming through to indices. I have switched the node to the setup mode… --- ## [Watcher logic help](https://discuss.elastic.co/t/watcher-logic-help/265385)
**Author:** [@amStuckplsHelp](https://discuss.elastic.co/u/amStuckplsHelp)\ **Replies:** 0\ **Last updated:** [February 24, 2021, 5:40pm UTC](https://discuss.elastic.co/t/watcher-logic-help/265385 "2021-02-24T17:40:52Z")
Hi, I have a few servers which supply the number of 'current active users' on those servers to my Elastic stack via Logstash. I am trying to create a watch such that; If the number of 'current active users' drops by 7… --- ## [Adding more data.path after installation, Issues](https://discuss.elastic.co/t/adding-more-data-path-after-installation-issues/265250)
**Author:** [@mgr](https://discuss.elastic.co/u/mgr)\ **Replies:** 3\ **Last updated:** [February 25, 2021, 2:49am UTC](https://discuss.elastic.co/t/adding-more-data-path-after-installation-issues/265250 "2021-02-25T02:49:23Z")
We are facing space issue on elastic search /data folder. What is the process for adding new data.paths to address this. Saw some threads people sharing issues when data.paths are modified with additional location , elas… --- ## [Error Configuring Email for Watcher Kibana 7.3.2](https://discuss.elastic.co/t/error-configuring-email-for-watcher-kibana-7-3-2/264389)
**Author:** [@gobindbirsingh](https://discuss.elastic.co/u/gobindbirsingh)\ **Replies:** 3\ **Last updated:** [February 25, 2021, 2:48am UTC](https://discuss.elastic.co/t/error-configuring-email-for-watcher-kibana-7-3-2/264389 "2021-02-25T02:48:47Z")
I am trying to configure email for Watcher in Kibana 7.3.2. According to the article here, it suggests configuring gmail settings into Elasticsearch.yml as: xpack.notification.email.account: gmail\_account: profile: gm… --- ## [Removing default node roles](https://discuss.elastic.co/t/removing-default-node-roles/265392)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 1\ **Last updated:** [February 25, 2021, 2:40am UTC](https://discuss.elastic.co/t/removing-default-node-roles/265392 "2021-02-25T02:40:23Z")
when I display the setting for one of my nodes I get: "nodes": { "kAWPcpoxSNSN9WlUsYlQlg": { "timestamp": 1614190995674, "name": "secesprd01", "transport\_address": "10.6.0.67:9300", "host":… --- ## [Bulgarian stemming](https://discuss.elastic.co/t/bulgarian-stemming/265002)
**Author:** [@Hristo\_Hristov](https://discuss.elastic.co/u/Hristo_Hristov)\ **Replies:** 1\ **Last updated:** [February 25, 2021, 1:48am UTC](https://discuss.elastic.co/t/bulgarian-stemming/265002 "2021-02-25T01:48:38Z")
Bulgarian stemmer should stem the same way these words, but it does not. биография =\> "биограф" биографията =\> "биографи" The correct is "биограф". The problem is huge because it happens in very common case of stemmi… --- ## [Split JSON array doesn't work with multiple config files](https://discuss.elastic.co/t/split-json-array-doesnt-work-with-multiple-config-files/265415)
**Author:** [@alicango](https://discuss.elastic.co/u/alicango)\ **Replies:** 2\ **Last updated:** [February 25, 2021, 1:09am UTC](https://discuss.elastic.co/t/split-json-array-doesnt-work-with-multiple-config-files/265415 "2021-02-25T01:09:54Z")
Hi All, I have two config files under the /etc/logstash/conf.d directory. Each config is listening to a different HTTP port. When I run the logstash as a daemon(systemctl start logstash) with both config files, I see … --- ## [Metricbeat docker module appears to be leaking file descriptor when metricset cpu, diskio, memory, or network is enabled](https://discuss.elastic.co/t/metricbeat-docker-module-appears-to-be-leaking-file-descriptor-when-metricset-cpu-diskio-memory-or-network-is-enabled/264772)
**Author:** [@jmcclure](https://discuss.elastic.co/u/jmcclure)\ **Replies:** 9\ **Last updated:** [February 24, 2021, 10:57pm UTC](https://discuss.elastic.co/t/metricbeat-docker-module-appears-to-be-leaking-file-descriptor-when-metricset-cpu-diskio-memory-or-network-is-enabled/264772 "2021-02-24T22:57:13Z")
Environment Metricbeat oss: 7.10.2 Elasticsearch oss: 7.10.2 Docker Engine: 18.09.0 Docker API: 1.39 (minimum version 1.12) OS: CentOS 7.6.1810 Hi, My deployment is on Linux with Docker, where Elasticsearch runs as a… --- ## [Tooltip on the map gets reset when dashboard is in auto refresh?](https://discuss.elastic.co/t/tooltip-on-the-map-gets-reset-when-dashboard-is-in-auto-refresh/265375)
**Author:** [@richardchin](https://discuss.elastic.co/u/richardchin)\ **Replies:** 1\ **Last updated:** [February 24, 2021, 10:42pm UTC](https://discuss.elastic.co/t/tooltip-on-the-map-gets-reset-when-dashboard-is-in-auto-refresh/265375 "2021-02-24T22:42:55Z")
If I click on a feature on my map, I get the details of the features of each layer and I can go between them with the left/right arrows on the tooltip. But when the dashboard is auto-refreshed, the layer options disappea… --- ## [MetricBeat Failing on ElasticSearch AWS Instance - Unauthorized - Authentication required](https://discuss.elastic.co/t/metricbeat-failing-on-elasticsearch-aws-instance-unauthorized-authentication-required/265306)
**Author:** [@gr33nberet](https://discuss.elastic.co/u/gr33nberet)\ **Replies:** 0\ **Last updated:** [February 24, 2021, 9:35am UTC](https://discuss.elastic.co/t/metricbeat-failing-on-elasticsearch-aws-instance-unauthorized-authentication-required/265306 "2021-02-24T09:35:24Z")
Hello everyone, I'm having issues setting up MetricBeat on AWS ES Instance, I'm getting the following error : ERROR instance/beat.go:971 Exiting: 1 error: error loading index pattern: returned 401 to import file: \.… --- ## [Index not rolling over](https://discuss.elastic.co/t/index-not-rolling-over/264843)
**Author:** [@eco](https://discuss.elastic.co/u/eco)\ **Replies:** 15\ **Last updated:** [February 24, 2021, 10:30pm UTC](https://discuss.elastic.co/t/index-not-rolling-over/264843 "2021-02-24T22:30:24Z")
Hi, I have setup elasticsearch and created the following but the index will not roll over when a limit (size in this case) is reached. Policy { "policy" : { "phases" : { "hot" : { "min\_age" : "0ms"… --- ## [Forming query with unreserved characters](https://discuss.elastic.co/t/forming-query-with-unreserved-characters/265391)
**Author:** [@Shahsha\_21](https://discuss.elastic.co/u/Shahsha_21)\ **Replies:** 0\ **Last updated:** [February 24, 2021, 6:31pm UTC](https://discuss.elastic.co/t/forming-query-with-unreserved-characters/265391 "2021-02-24T18:31:35Z")
I am trying to query a keyword that has a dot (.) appended to it. The query works fine on Kibana's console but not on my application's function. This is the function that creates the query given a keyword: searchOpe… --- ## [Elastic Agent attempting to push data to the wrong URL](https://discuss.elastic.co/t/elastic-agent-attempting-to-push-data-to-the-wrong-url/264184)
**Author:** [@coreysabia](https://discuss.elastic.co/u/coreysabia)\ **Replies:** 8\ **Last updated:** [February 24, 2021, 9:06pm UTC](https://discuss.elastic.co/t/elastic-agent-attempting-to-push-data-to-the-wrong-url/264184 "2021-02-24T21:06:09Z")
I have spun up an Elastic Cloud on Kubernetes cluster with Let's Encrypt SSL certificates with a domain name I own. All of these SSL certs are running properly, as well as my cluster. I have tested this locally and publi… --- ## [Performance Impact of Deleting an Index](https://discuss.elastic.co/t/performance-impact-of-deleting-an-index/265405)
**Author:** [@xianhechen](https://discuss.elastic.co/u/xianhechen)\ **Replies:** 2\ **Last updated:** [February 24, 2021, 8:50pm UTC](https://discuss.elastic.co/t/performance-impact-of-deleting-an-index/265405 "2021-02-24T20:50:53Z")
Hello! We have an ElasticSearch 7.5.0 cluster with 5 master nodes, 3 coordinator nodes, and 15 data nodes, each of these nodes has a 20-core CPU (HyperThread disabled), 512GB RAM, 1.8TB SSD (RAID 1 +0), and 10GB of netw… --- ## [Error with geo\_shape polygon query with points on the dateline](https://discuss.elastic.co/t/error-with-geo-shape-polygon-query-with-points-on-the-dateline/265401)
**Author:** [@robqliu](https://discuss.elastic.co/u/robqliu)\ **Replies:** 0\ **Last updated:** [February 24, 2021, 7:26pm UTC](https://discuss.elastic.co/t/error-with-geo-shape-polygon-query-with-points-on-the-dateline/265401 "2021-02-24T19:26:28Z")
I have a polygon in a test that appears to be processed incorrectly and it ends up triggering an InvalidShapeException. The points are: -175, 20 180, 15 -177, 10 180, 5 -175, 0 -175, 20 (minor update: This also fails i… --- ## [Different output on query](https://discuss.elastic.co/t/different-output-on-query/265175)
**Author:** [@pjanzen](https://discuss.elastic.co/u/pjanzen)\ **Replies:** 1\ **Last updated:** [February 24, 2021, 8:47pm UTC](https://discuss.elastic.co/t/different-output-on-query/265175 "2021-02-24T20:47:50Z")
Hi All, I have a ES cluster version 6.8 and I am using python lib elasticsearch==7.11.0 and elasticsearch-dsl==7.3.0 I have created the following code index\_name = 'central\_log\_nl' query = Q('bool', must=\[ … --- ## [Visualization Based on Current Date](https://discuss.elastic.co/t/visualization-based-on-current-date/265399)
**Author:** [@massouza](https://discuss.elastic.co/u/massouza)\ **Replies:** 1\ **Last updated:** [February 24, 2021, 8:07pm UTC](https://discuss.elastic.co/t/visualization-based-on-current-date/265399 "2021-02-24T20:07:15Z")
Good day, team! I'm pretty new on Elastic stuff and would like to know if there is a way to create a visualization which shows a date field. If this field contains the current date, then set the background to green. Ot… --- ## [Missing year set to 1970 by Logstash](https://discuss.elastic.co/t/missing-year-set-to-1970-by-logstash/265373)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 16\ **Last updated:** [February 24, 2021, 7:46pm UTC](https://discuss.elastic.co/t/missing-year-set-to-1970-by-logstash/265373 "2021-02-24T19:46:24Z")
Hi, Running ELK 7.10.1 Recently I started to process new type of logs that does not include the year, so they come with format "MMM dd HH:mm:ss". According to the Logstash documentation (and this post), in cases like… --- ## [Geo\_shape query processing not thread-safe which causes issues with parallel shard requests](https://discuss.elastic.co/t/geo-shape-query-processing-not-thread-safe-which-causes-issues-with-parallel-shard-requests/265397)
**Author:** [@robqliu](https://discuss.elastic.co/u/robqliu)\ **Replies:** 0\ **Last updated:** [February 24, 2021, 7:00pm UTC](https://discuss.elastic.co/t/geo-shape-query-processing-not-thread-safe-which-causes-issues-with-parallel-shard-requests/265397 "2021-02-24T19:00:30Z")
We're on ES 6.8.x and we have an integration test that spins up an in-process ES node and it appears to be processed non-deterministically. It creates a geo\_shape query and occasionally we trigger this assert in JtsGeome… --- ## [New fied and visualizations](https://discuss.elastic.co/t/new-fied-and-visualizations/265355)
**Author:** [@Fred59](https://discuss.elastic.co/u/Fred59)\ **Replies:** 2\ **Last updated:** [February 24, 2021, 6:53pm UTC](https://discuss.elastic.co/t/new-fied-and-visualizations/265355 "2021-02-24T18:53:37Z")
Hello, On Kibana 6.8.14 Is it possible to rename a field to all visualizations already created with an old one? Is it possible to rename a field and that all visualizations linked to it are updated? Thanks ! --- ## [Granular Kibana permissions when creating users and roles](https://discuss.elastic.co/t/granular-kibana-permissions-when-creating-users-and-roles/265389)
**Author:** [@jhegarty](https://discuss.elastic.co/u/jhegarty)\ **Replies:** 1\ **Last updated:** [February 24, 2021, 6:52pm UTC](https://discuss.elastic.co/t/granular-kibana-permissions-when-creating-users-and-roles/265389 "2021-02-24T18:52:52Z")
My team needs to set up specific user access to Kibana, and we haven't quite figured out the combination of roles and space privileges. We need a user that has all the permissions of a superuser, with the exception of ac… --- ## [Elapsed time is not calculating for all requests - elapsed\_end\_without\_start](https://discuss.elastic.co/t/elapsed-time-is-not-calculating-for-all-requests-elapsed-end-without-start/262842)
**Author:** [@Ramesh535](https://discuss.elastic.co/u/Ramesh535)\ **Replies:** 1\ **Last updated:** [February 24, 2021, 6:15pm UTC](https://discuss.elastic.co/t/elapsed-time-is-not-calculating-for-all-requests-elapsed-end-without-start/262842 "2021-02-24T18:15:27Z")
Hi Everyone, Out of 1000 requests, elapsed time is not calculating for atleast 100 requests and it is throwing exception as elapsed\_end\_without\_start in tags. Can any one suggest solution to overcome this issue. Thanks… --- ## [Coverting miliseconds into HH:mm:ss in logstash](https://discuss.elastic.co/t/coverting-miliseconds-into-hhss-in-logstash/263098)
**Author:** [@mohanss08](https://discuss.elastic.co/u/mohanss08)\ **Replies:** 2\ **Last updated:** [February 24, 2021, 5:58pm UTC](https://discuss.elastic.co/t/coverting-miliseconds-into-hhss-in-logstash/263098 "2021-02-24T17:58:03Z")
The below is my csv output data inserted to elasticsearch through logstash. "build\_end\_time" =\> "2021-01-13 01:29:49", "build\_duration" =\> "6409651", "build\_start\_time" =\> "2021-01-12 23:43:00", "build\_date" =\> "2021-01… --- ## [Logstash extract a nested json object](https://discuss.elastic.co/t/logstash-extract-a-nested-json-object/265307)
**Author:** [@imsystem](https://discuss.elastic.co/u/imsystem)\ **Replies:** 2\ **Last updated:** [February 24, 2021, 5:51pm UTC](https://discuss.elastic.co/t/logstash-extract-a-nested-json-object/265307 "2021-02-24T17:51:13Z")
Hello! I have input json: { "fields":{ "created\_date":1614158456696703782, "value":"\\u001B\[35m-\\u001B\[0m | \\u001B\[32m2021-02-20T12:48:10.367337+0300\\u001B\[0m | \\u001B\[1mINFO \\u001B\[0m | application.ap… --- ## [Elastic Machine learning jobs - Prometheus Blackbox Exporter / Kafka Metrics](https://discuss.elastic.co/t/elastic-machine-learning-jobs-prometheus-blackbox-exporter-kafka-metrics/265362)
**Author:** [@jk247](https://discuss.elastic.co/u/jk247)\ **Replies:** 1\ **Last updated:** [February 24, 2021, 5:46pm UTC](https://discuss.elastic.co/t/elastic-machine-learning-jobs-prometheus-blackbox-exporter-kafka-metrics/265362 "2021-02-24T17:46:40Z")
Hi everyone, I am currently setting up a proactive monitoring solution with the help of the Elastic Machine Learning feature for a Web application. (In order to see the benefits vs my current (reactive) setup with Grafa… --- ## [Change service type on deployed elasticsearch using helm](https://discuss.elastic.co/t/change-service-type-on-deployed-elasticsearch-using-helm/265384)
**Author:** [@Owen\_P](https://discuss.elastic.co/u/Owen_P)\ **Replies:** 0\ **Last updated:** [February 24, 2021, 5:40pm UTC](https://discuss.elastic.co/t/change-service-type-on-deployed-elasticsearch-using-helm/265384 "2021-02-24T17:40:00Z")
Hi I'm new to this so bear with me. I deployed the elasticsearch helm chart from here https://github.com/elastic/helm-charts/tree/master/elasticsearch but the default service type is ClusterIP but I want to change it to… --- ## [ESSERVER trying to search for xpack plugin class even after disabling xpack security in elasticsearch.yml file](https://discuss.elastic.co/t/esserver-trying-to-search-for-xpack-plugin-class-even-after-disabling-xpack-security-in-elasticsearch-yml-file/265382)
**Author:** [@karthik\_m2](https://discuss.elastic.co/u/karthik_m2)\ **Replies:** 1\ **Last updated:** [February 24, 2021, 5:35pm UTC](https://discuss.elastic.co/t/esserver-trying-to-search-for-xpack-plugin-class-even-after-disabling-xpack-security-in-elasticsearch-yml-file/265382 "2021-02-24T17:35:41Z")
Hello Everyone, I have an issue with my elastic search server, Even though xpack security is not enabled, elasticsearch JVM is trying load them and throwing error and not allowing to start this server. This below value… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1535) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1537)