# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1544 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1545 --- ## [Agent support for OS windows server and red hat](https://discuss.elastic.co/t/agent-support-for-os-windows-server-and-red-hat/262276)
**Author:** [@javig12](https://discuss.elastic.co/u/javig12)\ **Replies:** 3\ **Last updated:** [February 22, 2021, 3:59am UTC](https://discuss.elastic.co/t/agent-support-for-os-windows-server-and-red-hat/262276 "2021-02-22T03:59:54Z")
Hello Community, what about support agents on these servers: Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Linux Redhat desde 5.11 and 6.8 hope your comments, Regards. --- ## [Does Index/Shard size affects the performance of search/insert/update query?](https://discuss.elastic.co/t/does-index-shard-size-affects-the-performance-of-search-insert-update-query/264878)
**Author:** [@Nikunj210903](https://discuss.elastic.co/u/Nikunj210903)\ **Replies:** 2\ **Last updated:** [February 22, 2021, 3:59am UTC](https://discuss.elastic.co/t/does-index-shard-size-affects-the-performance-of-search-insert-update-query/264878 "2021-02-22T03:59:07Z")
Does Index/Shard size affects the performance of search/create/update query? So suppose I have 2 indexes. In one index I have 2 GB data and in another index I have 10 GB data. If I fire same search/insert/update query on… --- ## [In rollover, Is it possible to update the document of old indexes?](https://discuss.elastic.co/t/in-rollover-is-it-possible-to-update-the-document-of-old-indexes/264512)
**Author:** [@Nikunj210903](https://discuss.elastic.co/u/Nikunj210903)\ **Replies:** 16\ **Last updated:** [February 22, 2021, 3:57am UTC](https://discuss.elastic.co/t/in-rollover-is-it-possible-to-update-the-document-of-old-indexes/264512 "2021-02-22T03:57:41Z")
Hello community.I have implemented rollover feature of elastic search. It will create a new index every day. Below is my question Is it possible to update the document of old indexes ? I have read somewhere that old in… --- ## [Collect disk IO and network metrics from ESXi and AIX OS](https://discuss.elastic.co/t/collect-disk-io-and-network-metrics-from-esxi-and-aix-os/262173)
**Author:** [@Ishaan](https://discuss.elastic.co/u/Ishaan)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 3:53am UTC](https://discuss.elastic.co/t/collect-disk-io-and-network-metrics-from-esxi-and-aix-os/262173 "2021-02-22T03:53:21Z")
Hello, Is there a way to collect disk IO and network metrics from ESX and AIX OS just like we have diskio and network metricset available in the metricbeat system module? Any workaround available? Thanks --- ## [ECS Logging for PHP / Question](https://discuss.elastic.co/t/ecs-logging-for-php-question/265006)
**Author:** [@leostereo](https://discuss.elastic.co/u/leostereo)\ **Replies:** 2\ **Last updated:** [February 22, 2021, 3:48am UTC](https://discuss.elastic.co/t/ecs-logging-for-php-question/265006 "2021-02-22T03:48:20Z")
Hi guys, Im trying to ship my application events to my elasticsearch platform. My app and elk are running on different servers (ping reachable). I already have the php library working on a little example script taken f… --- ## [Test and Dev Migration Best Practice](https://discuss.elastic.co/t/test-and-dev-migration-best-practice/264774)
**Author:** [@johnwood](https://discuss.elastic.co/u/johnwood)\ **Replies:** 6\ **Last updated:** [February 22, 2021, 2:43am UTC](https://discuss.elastic.co/t/test-and-dev-migration-best-practice/264774 "2021-02-22T02:43:12Z")
Hi All, Does anyone have and good references for how people are handing the cycle of refreshes from production instances in the cloud back to Dev and Test instances on developer laptops. We are keen to keep dev/test la… --- ## [Elasticsearch cluster performance degradation](https://discuss.elastic.co/t/elasticsearch-cluster-performance-degradation/264915)
**Author:** [@mario12](https://discuss.elastic.co/u/mario12)\ **Replies:** 5\ **Last updated:** [February 22, 2021, 2:37am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-performance-degradation/264915 "2021-02-22T02:37:01Z")
We had a performance degradation for 5-10 minutes intervals. We looked into our monitoring tool and found there was high CPU utilization on the elasticsearch cluster. During this time we also noticed high fetch requests … --- ## [Search For a string in scripted index](https://discuss.elastic.co/t/search-for-a-string-in-scripted-index/264506)
**Author:** [@yash\_gupta](https://discuss.elastic.co/u/yash_gupta)\ **Replies:** 11\ **Last updated:** [February 22, 2021, 1:19am UTC](https://discuss.elastic.co/t/search-for-a-string-in-scripted-index/264506 "2021-02-22T01:19:25Z")
Hi, I need to search for a string in a field of an index using a scripted filed, below is how it looks like. build\_info.causes { "cause\_class": "some vaue", "short\_description": "Triggered by Gerrit: some value ." } … --- ## [Jre crash after running for days or hours](https://discuss.elastic.co/t/jre-crash-after-running-for-days-or-hours/262439)
**Author:** [@billhong-just](https://discuss.elastic.co/u/billhong-just)\ **Replies:** 8\ **Last updated:** [February 22, 2021, 1:19am UTC](https://discuss.elastic.co/t/jre-crash-after-running-for-days-or-hours/262439 "2021-02-22T01:19:19Z")
Hi community, My single node elasticsearch cluster crashed after running for days or hours. And here are relevant information and logs. Elasticsearch version (bin/elasticsearch --version): 7.10.2 Plugins installed: I… --- ## [Could not connect to SMTP host: xxx, port: nn, response: 554](https://discuss.elastic.co/t/could-not-connect-to-smtp-host-xxx-port-nn-response-554/264761)
**Author:** [@xyz2](https://discuss.elastic.co/u/xyz2)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 12:56am UTC](https://discuss.elastic.co/t/could-not-connect-to-smtp-host-xxx-port-nn-response-554/264761 "2021-02-22T00:56:38Z")
Hi, I am getting below error on watcher email alert. Hosts and port are defined in elasticsearch.yml Could not connect to SMTP host: xxx, port: nn, response: 554" smtp: auth: False starttls.enable: False --- ## [Logstash conditional output](https://discuss.elastic.co/t/logstash-conditional-output/264826)
**Author:** [@petegriggs](https://discuss.elastic.co/u/petegriggs)\ **Replies:** 6\ **Last updated:** [February 22, 2021, 12:54am UTC](https://discuss.elastic.co/t/logstash-conditional-output/264826 "2021-02-22T00:54:11Z")
Hello, Looking to use logstash to host multiple syslog listeners to start to aggregate logs from different vendors and then forward on for now to another syslog server. The question is whether we can set the syslog out… --- ## [FileBeat Setup Error : error loading index pattern: returned 413 to import file: \. Response: {"statusCode":413,"error":"Request Entity Too Large","message":"Payload content length greater than maximum allowed: 1048576"](https://discuss.elastic.co/t/filebeat-setup-error-error-loading-index-pattern-returned-413-to-import-file-nil-response-statuscode-413-error-request-entity-too-large-message-payload-content-length-greater-than-maximum-allowed-1048576/264845)
**Author:** [@Biswabhusan\_Dash](https://discuss.elastic.co/u/Biswabhusan_Dash)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 12:51am UTC](https://discuss.elastic.co/t/filebeat-setup-error-error-loading-index-pattern-returned-413-to-import-file-nil-response-statuscode-413-error-request-entity-too-large-message-payload-content-length-greater-than-maximum-allowed-1048576/264845 "2021-02-22T00:51:37Z")
We are working to capture logs from server to elasticsearch by filebeat. We are getting below issue, while setup the filebeat. Response: {"statusCode":413,"error":"Request Entity Too Large","message":"Payload content le… --- ## [What are the best practices for data retention?](https://discuss.elastic.co/t/what-are-the-best-practices-for-data-retention/264858)
**Author:** [@lachezar.uzunov](https://discuss.elastic.co/u/lachezar.uzunov)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 12:49am UTC](https://discuss.elastic.co/t/what-are-the-best-practices-for-data-retention/264858 "2021-02-22T00:49:42Z")
Hello, I am wondering what is the best practices for handling a big data indexes. For example if a firewall sends way too much logs to elastic stack, what is the best way to handle this situation? Is it possible to arch… --- ## [Cluster rebalancing parameters](https://discuss.elastic.co/t/cluster-rebalancing-parameters/264868)
**Author:** [@gorek](https://discuss.elastic.co/u/gorek)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 12:47am UTC](https://discuss.elastic.co/t/cluster-rebalancing-parameters/264868 "2021-02-22T00:47:23Z")
Currently we have one-node-cluster. This node has high heap usage (from time to time we even see "circuit breaking exception") and high disk usage (currently over high disk watermark value) because it keep lots of indice… --- ## [Simple Search by field query](https://discuss.elastic.co/t/simple-search-by-field-query/264879)
**Author:** [@cis4life](https://discuss.elastic.co/u/cis4life)\ **Replies:** 0\ **Last updated:** [February 19, 2021, 3:53pm UTC](https://discuss.elastic.co/t/simple-search-by-field-query/264879 "2021-02-19T15:53:07Z")
I'm using the C# library to query a string in my cluster, but keep getting back results thats outside the string i want to search for. I basically want something on the lines of 'Select \* where field = 'some value' In … --- ## [Kibana has stopped](https://discuss.elastic.co/t/kibana-has-stopped/264882)
**Author:** [@Prabhath\_samarasingh](https://discuss.elastic.co/u/Prabhath_samarasingh)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 12:44am UTC](https://discuss.elastic.co/t/kibana-has-stopped/264882 "2021-02-22T00:44:19Z")
Hi, I'm very new to elk and configured stack.Work fine. So I ship my syslog data to stack and now kibana stops. Stack run on Ubunto 20.04 AMD 64 server. cat /var/log/elasticsearch/elasticsearch.log \[2021-02-19T21:29… --- ## [Summing Timeseries](https://discuss.elastic.co/t/summing-timeseries/264883)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 12:42am UTC](https://discuss.elastic.co/t/summing-timeseries/264883 "2021-02-22T00:42:55Z")
Hi, How, in an aggregation, can I sum or do any other calculation across more than one timeseries? Thx D --- ## [ElasticSearch.NET query serialization](https://discuss.elastic.co/t/elasticsearch-net-query-serialization/264891)
**Author:** [@yongkeecho](https://discuss.elastic.co/u/yongkeecho)\ **Replies:** 0\ **Last updated:** [February 19, 2021, 5:02pm UTC](https://discuss.elastic.co/t/elasticsearch-net-query-serialization/264891 "2021-02-19T17:02:37Z")
Hi, I wonder if there is a public serializer or converter for QueryContainer object. var query = Query\.DateRange(r =\> r .Field(f =\> f.StartedOn) .GreaterThanOrEquals(new … --- ## [Kibana 7.11 Legacy GUI](https://discuss.elastic.co/t/kibana-7-11-legacy-gui/265009)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 2\ **Last updated:** [February 21, 2021, 9:46pm UTC](https://discuss.elastic.co/t/kibana-7-11-legacy-gui/265009 "2021-02-21T21:46:53Z")
Any way to change the UI to Legacy in 7.11? I don't like the big black bar at the top, we embed Kibana in our client portal and now the clients see 3 bars, it's too much. --- ## [Why does it have duplicate ID with normal logstash output and fingerprint filter?](https://discuss.elastic.co/t/why-does-it-have-duplicate-id-with-normal-logstash-output-and-fingerprint-filter/264931)
**Author:** [@Bo\_Pham\_Nguyen](https://discuss.elastic.co/u/Bo_Pham_Nguyen)\ **Replies:** 1\ **Last updated:** [February 21, 2021, 9:47pm UTC](https://discuss.elastic.co/t/why-does-it-have-duplicate-id-with-normal-logstash-output-and-fingerprint-filter/264931 "2021-02-21T21:47:43Z")
Hi team, This is my logstash config to get data, and I use fingerprint as \_id in order to prevent duplication from data. But it still has duplicated event as below. Any help? filter { if \[type\] == "cve" { … --- ## [Elastic search using more RAM and not release](https://discuss.elastic.co/t/elastic-search-using-more-ram-and-not-release/264928)
**Author:** [@xgx](https://discuss.elastic.co/u/xgx)\ **Replies:** 1\ **Last updated:** [February 21, 2021, 9:45pm UTC](https://discuss.elastic.co/t/elastic-search-using-more-ram-and-not-release/264928 "2021-02-21T21:45:52Z")
Hi, I have a problem with elastic search uses a lot of os memory (non buff / cache).Here are some details： 1.I am using a 64 GB Ram machine . 2.I have allocated 26gb as ES heap size. 3.only elasticsearch service runn… --- ## [Can you export the data from a bar chart into a csv?](https://discuss.elastic.co/t/can-you-export-the-data-from-a-bar-chart-into-a-csv/265007)
**Author:** [@Amphagory](https://discuss.elastic.co/u/Amphagory)\ **Replies:** 1\ **Last updated:** [February 21, 2021, 9:44pm UTC](https://discuss.elastic.co/t/can-you-export-the-data-from-a-bar-chart-into-a-csv/265007 "2021-02-21T21:44:11Z")
Like tables visuals, I was hoping there would be a nice link in the bar chart visual to down the data to CSV. Any thought how I can download the data for a char chart? Ideally a link in the visual would be preferred. M… --- ## [Perform aggregation on small set of documents](https://discuss.elastic.co/t/perform-aggregation-on-small-set-of-documents/264515)
**Author:** [@Madhu\_Dasa](https://discuss.elastic.co/u/Madhu_Dasa)\ **Replies:** 3\ **Last updated:** [February 21, 2021, 9:26pm UTC](https://discuss.elastic.co/t/perform-aggregation-on-small-set-of-documents/264515 "2021-02-21T21:26:50Z")
I have a query which returns 100 documents. While performing aggregation it considers all the documents . But I want to apply aggregation only on top 5 documents. Is there a way to achieve this? --- ## [How to monitor inodes using metricbeat?](https://discuss.elastic.co/t/how-to-monitor-inodes-using-metricbeat/263818)
**Author:** [@premierpsp](https://discuss.elastic.co/u/premierpsp)\ **Replies:** 1\ **Last updated:** [February 21, 2021, 8:52pm UTC](https://discuss.elastic.co/t/how-to-monitor-inodes-using-metricbeat/263818 "2021-02-21T20:52:12Z")
Hi, is there any option to monitor linux inodes with metricbeat? Thank you --- ## [Data directory on remort serever](https://discuss.elastic.co/t/data-directory-on-remort-serever/264972)
**Author:** [@Ankur\_Mahajan](https://discuss.elastic.co/u/Ankur_Mahajan)\ **Replies:** 4\ **Last updated:** [February 21, 2021, 9:18pm UTC](https://discuss.elastic.co/t/data-directory-on-remort-serever/264972 "2021-02-21T21:18:53Z")
Is there any possibility where I can put the data directory to a remort cloud instance? Cloud instance 1 Public IP: 1:11:11:111 (Dummy) Elasticsearch data directory path: /home/elasticsearch/data Cloud instance 2 El… --- ## [Updated to 7.11.00 - Resource is under maintenance / recovery](https://discuss.elastic.co/t/updated-to-7-11-00-resource-is-under-maintenance-recovery/264782)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 3\ **Last updated:** [February 21, 2021, 9:17pm UTC](https://discuss.elastic.co/t/updated-to-7-11-00-resource-is-under-maintenance-recovery/264782 "2021-02-21T21:17:52Z")
Upgraded to 7.11.0 and now have the following error {"ok":false,"message":"Resource is under maintenance / recovery."} --- ## [How can we add dynamic templates in existing elastic index](https://discuss.elastic.co/t/how-can-we-add-dynamic-templates-in-existing-elastic-index/264282)
**Author:** [@prakhara](https://discuss.elastic.co/u/prakhara)\ **Replies:** 5\ **Last updated:** [February 21, 2021, 9:16pm UTC](https://discuss.elastic.co/t/how-can-we-add-dynamic-templates-in-existing-elastic-index/264282 "2021-02-21T21:16:22Z")
I have a need to add more dynamic templates in my existing index mappings, how can I do that Tried doing below, but it didn't worked PUT {$indexname}\_mappings { "mappings" : { "dynamic\_templates" : \[ { "strings"… --- ## [Change analyzer into an existing index](https://discuss.elastic.co/t/change-analyzer-into-an-existing-index/264746)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 3\ **Last updated:** [February 21, 2021, 9:15pm UTC](https://discuss.elastic.co/t/change-analyzer-into-an-existing-index/264746 "2021-02-21T21:15:05Z")
Hey there, I have an existing index without any custom setting or mapping for any field, so everything is by default. Into the docs I have a field named category which contains words like Women's or Womens. POST my\_in… --- ## [Case Sensitive Query for Text fields in Elasticsearch](https://discuss.elastic.co/t/case-sensitive-query-for-text-fields-in-elasticsearch/264015)
**Author:** [@pathfinder225](https://discuss.elastic.co/u/pathfinder225)\ **Replies:** 6\ **Last updated:** [February 21, 2021, 9:01pm UTC](https://discuss.elastic.co/t/case-sensitive-query-for-text-fields-in-elasticsearch/264015 "2021-02-21T21:01:44Z")
I have a requirement of case sensitive search where I need to search for particular word(case sensitive ) in message field which is of type text. I am using Java Rest High level client. My search word is ERROR , query… --- ## [Alerting creating](https://discuss.elastic.co/t/alerting-creating/261939)
**Author:** [@alfredo.deluca](https://discuss.elastic.co/u/alfredo.deluca)\ **Replies:** 3\ **Last updated:** [February 21, 2021, 8:27pm UTC](https://discuss.elastic.co/t/alerting-creating/261939 "2021-02-21T20:27:01Z")
Hi all. I am using for test purpose elastic on cloud and I'd like to create an alert/watcher (not sure which one is the best option) to send an alert when a POD on K8S goes down. That d be easy but I want to send the al… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1543) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1545)