# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=155 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 156 --- ## [Documentation bug on splitting shards -- free disk space requirement?](https://discuss.elastic.co/t/documentation-bug-on-splitting-shards-free-disk-space-requirement/367203)
**Author:** [@Jamshid](https://discuss.elastic.co/u/Jamshid)\ **Replies:** 3\ **Last updated:** [October 11, 2024, 2:50am UTC](https://discuss.elastic.co/t/documentation-bug-on-splitting-shards-free-disk-space-requirement/367203 "2024-10-11T02:50:06Z")
This doc says elasticsearch requires enough free disk space for a second copy of the index when splitting shards. The node handling the split process must have sufficient free disk space to accommodate a second copy … --- ## [Elasticsearch 8.15.1 in FIPS mode](https://discuss.elastic.co/t/elasticsearch-8-15-1-in-fips-mode/366983)
**Author:** [@fox9](https://discuss.elastic.co/u/fox9)\ **Replies:** 12\ **Last updated:** [October 11, 2024, 2:25am UTC](https://discuss.elastic.co/t/elasticsearch-8-15-1-in-fips-mode/366983 "2024-10-11T02:25:53Z")
Heya, I am trying to configure a 3-node cluster in FIPS mode but TLS doesn't seem to work. Here are the system details: Ubuntu 20.04 Elasticsearch 8.15.1 FIPS enabled: bc-fips-2.0.0.jar, bctls-fips-2.0.19.jar, bcpkix-… --- ## [Remove xpack.security.authc.realms.active\_directory.my\_ad.secure\_bind\_password](https://discuss.elastic.co/t/remove-xpack-security-authc-realms-active-directory-my-ad-secure-bind-password/368436)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 1\ **Last updated:** [October 11, 2024, 2:23am UTC](https://discuss.elastic.co/t/remove-xpack-security-authc-realms-active-directory-my-ad-secure-bind-password/368436 "2024-10-11T02:23:17Z")
Hello I was trying to setup AD auth but I see the license doesnt support it anymore so I was trying to remove it but now I get Caused by: org.elasticsearch.common.settings.SettingsException: found settings for the real… --- ## [Elasticsearch watcher Error](https://discuss.elastic.co/t/elasticsearch-watcher-error/368562)
**Author:** [@0593098](https://discuss.elastic.co/u/0593098)\ **Replies:** 1\ **Last updated:** [October 11, 2024, 2:20am UTC](https://discuss.elastic.co/t/elasticsearch-watcher-error/368562 "2024-10-11T02:20:45Z")
Below is my watcher code its simply to send report via email. { "trigger": { "schedule": { "interval": "1m" } }, "input": { "none": {} }, "condition": { "always": {} }, "actions": { "email\_admin": { "email… --- ## [\[QUERY\] Top hits of nested fields sum aggregated by parent document](https://discuss.elastic.co/t/query-top-hits-of-nested-fields-sum-aggregated-by-parent-document/368656)
**Author:** [@zephyx](https://discuss.elastic.co/u/zephyx)\ **Replies:** 0\ **Last updated:** [October 10, 2024, 11:27pm UTC](https://discuss.elastic.co/t/query-top-hits-of-nested-fields-sum-aggregated-by-parent-document/368656 "2024-10-10T23:27:24Z")
Hi, I am a begginner in Elastic Search and I don't know how to write my aggregation correctly and even if what I want is possible. But between nested, inner\_hits, top\_hits, reverse\_nested, bucket\_sort, composite, etc..… --- ## [Filebeat not shipping kubectl logs output](https://discuss.elastic.co/t/filebeat-not-shipping-kubectl-logs-output/368050)
**Author:** [@paolovalladolid](https://discuss.elastic.co/u/paolovalladolid)\ **Replies:** 4\ **Last updated:** [October 10, 2024, 11:12pm UTC](https://discuss.elastic.co/t/filebeat-not-shipping-kubectl-logs-output/368050 "2024-10-10T23:12:16Z")
Hi all. I am trying to ship kubectl logs output to Elasticsearch with Filebeat. Example command: kubectl logs --tail=10 --timestamps ceo-container1 -n ceo-dev1 Example output: 2024-09-17T15:08:44.375437739Z 2024-0… --- ## [Trying to Stop an already running logstash pipeline via DELETE Api, getting 404 not found](https://discuss.elastic.co/t/trying-to-stop-an-already-running-logstash-pipeline-via-delete-api-getting-404-not-found/368641)
**Author:** [@pranchalm](https://discuss.elastic.co/u/pranchalm)\ **Replies:** 1\ **Last updated:** [October 10, 2024, 8:39pm UTC](https://discuss.elastic.co/t/trying-to-stop-an-already-running-logstash-pipeline-via-delete-api-getting-404-not-found/368641 "2024-10-10T20:39:31Z")
http://localhost:9600/\_node/pipelines/test123 this works and gives back the details of the running pipeline test123, but when trying to DELETE it using this same endpoint with a DELETE http method, it gives 404 not found… --- ## [Elasticsearch’s S3 Snapshot Repository: The Mystery of the Inaccessible S3 Bucket ==\> Access Denied](https://discuss.elastic.co/t/elasticsearch-s-s3-snapshot-repository-the-mystery-of-the-inaccessible-s3-bucket-access-denied/362900)
**Author:** [@Hadj\_Hassine\_Younes](https://discuss.elastic.co/u/Hadj_Hassine_Younes)\ **Replies:** 16\ **Last updated:** [October 10, 2024, 8:27pm UTC](https://discuss.elastic.co/t/elasticsearch-s-s3-snapshot-repository-the-mystery-of-the-inaccessible-s3-bucket-access-denied/362900 "2024-10-10T20:27:20Z")
Elasticsearch Version 7.17.12 Installed Plugins repository-s3 Java Version JAVA\_RUNTIME\_VERSION="20.0.2+9-78 OS Version Linux elasticsearch-data-0 5.10.214-202.855.amzn2.x86\_64 #1 SMP Tue Apr 9 06:57:12 UTC 2024 x86\_6… --- ## [S3 Snapshots (Storage Tiers)](https://discuss.elastic.co/t/s3-snapshots-storage-tiers/368643)
**Author:** [@Devin\_Acosta](https://discuss.elastic.co/u/Devin_Acosta)\ **Replies:** 1\ **Last updated:** [October 10, 2024, 8:31pm UTC](https://discuss.elastic.co/t/s3-snapshots-storage-tiers/368643 "2024-10-10T20:31:33Z")
I have been successfully using the Elasticsearch S3 Snapshot feature with version 7.15.1, and we are currently using the most expensive (standard) tier. My work has asked me to look into moving to data into S3 Glacier In… --- ## ["PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed"](https://discuss.elastic.co/t/pkix-path-validation-failed-java-security-cert-certpathvalidatorexception-validity-check-failed/368360)
**Author:** [@apal](https://discuss.elastic.co/u/apal)\ **Replies:** 4\ **Last updated:** [October 10, 2024, 8:10pm UTC](https://discuss.elastic.co/t/pkix-path-validation-failed-java-security-cert-certpathvalidatorexception-validity-check-failed/368360 "2024-10-10T20:10:57Z")
Here's the full error: Oct 07 11:57:38 elk.example.com logstash\[3697608\]: \[2024-10-07T11:57:38,571\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main\] Attempted to resurrect connection to dead ES instance, but got an error {:… --- ## [Tag clound in Element List](https://discuss.elastic.co/t/tag-clound-in-element-list/368648)
**Author:** [@Shell\_Dias](https://discuss.elastic.co/u/Shell_Dias)\ **Replies:** 0\ **Last updated:** [October 10, 2024, 7:12pm UTC](https://discuss.elastic.co/t/tag-clound-in-element-list/368648 "2024-10-10T19:12:31Z")
I have a document that contains a list formatted as a dictionary. How can I extract the first element or the value of an element by its key to create a tag cloud? { "document\_id": 1, "terms": \[ { "key": "… --- ## [Install Kibana plugin in Elastic Cloud](https://discuss.elastic.co/t/install-kibana-plugin-in-elastic-cloud/368621)
**Author:** [@sami-obvio](https://discuss.elastic.co/u/sami-obvio)\ **Replies:** 1\ **Last updated:** [October 10, 2024, 1:52pm UTC](https://discuss.elastic.co/t/install-kibana-plugin-in-elastic-cloud/368621 "2024-10-10T13:52:58Z")
Hi I am evaluating an Elastic Cloud instance I want to make a video player plugin for Kibana - I found a guide for isntallation but it's talking about putting the plugin in a folder... and I don't have terminal access… --- ## [How to change the kibana logo? (v7.17)](https://discuss.elastic.co/t/how-to-change-the-kibana-logo-v7-17/368620)
**Author:** [@lilyyy](https://discuss.elastic.co/u/lilyyy)\ **Replies:** 1\ **Last updated:** [October 10, 2024, 1:16pm UTC](https://discuss.elastic.co/t/how-to-change-the-kibana-logo-v7-17/368620 "2024-10-10T13:16:18Z")
Hello. I want to change the kibana logo to company logo. Navbar logo (sidebar top left logo) I searched a lot and tried to change the logo by changing the script or using third party plugin. I think this post is us… --- ## [Beats left old index templates after upgrade](https://discuss.elastic.co/t/beats-left-old-index-templates-after-upgrade/368626)
**Author:** [@SteelDi](https://discuss.elastic.co/u/SteelDi)\ **Replies:** 0\ **Last updated:** [October 10, 2024, 12:18pm UTC](https://discuss.elastic.co/t/beats-left-old-index-templates-after-upgrade/368626 "2024-10-10T12:18:24Z")
We are using beats with elastic in k8s, and every time after beats upgrade old index templates still left. And problem that the ILM still seen this templates and did rollover on all old indexes. And now i have a lot of t… --- ## [How to correctly calculate sync duration of connector run](https://discuss.elastic.co/t/how-to-correctly-calculate-sync-duration-of-connector-run/368623)
**Author:** [@Ankur\_Mathur](https://discuss.elastic.co/u/Ankur_Mathur)\ **Replies:** 2\ **Last updated:** [October 10, 2024, 11:43am UTC](https://discuss.elastic.co/t/how-to-correctly-calculate-sync-duration-of-connector-run/368623 "2024-10-10T11:43:47Z")
I need some help in calculating sync duration for a connector run. I am trying to measure performance of connector. Here is what I am observing:- My Google Drive connector is running for 5m and 20 seconds and has upser… --- ## [Error in logstash-plain-logs in /applog/logstash](https://discuss.elastic.co/t/error-in-logstash-plain-logs-in-applog-logstash/368260)
**Author:** [@rohit\_dhiman](https://discuss.elastic.co/u/rohit_dhiman)\ **Replies:** 2\ **Last updated:** [October 10, 2024, 11:30am UTC](https://discuss.elastic.co/t/error-in-logstash-plain-logs-in-applog-logstash/368260 "2024-10-10T11:30:17Z")
Hello All, We are getting below error in the logstash-plain-logs in /applog/logstash Below are the complete logs. \[logstash.outputs.opensearch\] \[main\] \[2cd0b680af9b49acc4d5ae414a3665aabb9aa76a58d0430b62230cc5c2e971bc\]… --- ## [Need help for creating a pipeline for app log](https://discuss.elastic.co/t/need-help-for-creating-a-pipeline-for-app-log/368619)
**Author:** [@JyotiPrakash](https://discuss.elastic.co/u/JyotiPrakash)\ **Replies:** 0\ **Last updated:** [October 10, 2024, 10:11am UTC](https://discuss.elastic.co/t/need-help-for-creating-a-pipeline-for-app-log/368619 "2024-10-10T10:11:15Z")
My app stores the log files on azure, and in the following format. mf-node-api 10-10-2024 06:07:36.760 AM info: Found existing fund core auth token. mf-node-api 10-10-2024 06:07:36.810 AM info: Existing fund core auth t… --- ## [Integrating Elasticsearch into Hugo project using Webpack 5](https://discuss.elastic.co/t/integrating-elasticsearch-into-hugo-project-using-webpack-5/368610)
**Author:** [@samiahmedsiddiqui](https://discuss.elastic.co/u/samiahmedsiddiqui)\ **Replies:** 0\ **Last updated:** [October 10, 2024, 9:10am UTC](https://discuss.elastic.co/t/integrating-elasticsearch-into-hugo-project-using-webpack-5/368610 "2024-10-10T09:10:01Z")
I am integrating Elasticsearch into my Hugo project using Webpack 5. I have created a new JavaScript file and imported the Elasticsearch client library. const { Client } = require('@elastic/elasticsearch'); However, I … --- ## [Need help reducing the volume of data](https://discuss.elastic.co/t/need-help-reducing-the-volume-of-data/368488)
**Author:** [@Cruz](https://discuss.elastic.co/u/Cruz)\ **Replies:** 4\ **Last updated:** [October 10, 2024, 11:09am UTC](https://discuss.elastic.co/t/need-help-reducing-the-volume-of-data/368488 "2024-10-10T11:09:22Z")
Hi there! I am trying to reduce the volume of my data in metrics monitoring. Currently, I filter out fields using Logstash and retain only the fields that I need for my dashboards. I have 7 servers, and each server gen… --- ## [Trying to Stop Logstash(version-8.15) process via its API call, not able to stop it via http://localhost:9600/\_node/shutdown, it results in 404 not found but call to \_node/stats works](https://discuss.elastic.co/t/trying-to-stop-logstash-version-8-15-process-via-its-api-call-not-able-to-stop-it-via-http-localhost-9600-node-shutdown-it-results-in-404-not-found-but-call-to-node-stats-works/368571)
**Author:** [@pranchalm](https://discuss.elastic.co/u/pranchalm)\ **Replies:** 2\ **Last updated:** [October 10, 2024, 10:16am UTC](https://discuss.elastic.co/t/trying-to-stop-logstash-version-8-15-process-via-its-api-call-not-able-to-stop-it-via-http-localhost-9600-node-shutdown-it-results-in-404-not-found-but-call-to-node-stats-works/368571 "2024-10-10T10:16:55Z")
I have written a spring boot application which starts the Logstash process internally by forming a command to get the conf file and trigger the command, similarly when i am trying to stop it via my application code the s… --- ## [GeoIP Service Elasticsearch requires connection to storage.googleapis.com](https://discuss.elastic.co/t/geoip-service-elasticsearch-requires-connection-to-storage-googleapis-com/368618)
**Author:** [@marmai16](https://discuss.elastic.co/u/marmai16)\ **Replies:** 0\ **Last updated:** [October 10, 2024, 9:55am UTC](https://discuss.elastic.co/t/geoip-service-elasticsearch-requires-connection-to-storage-googleapis-com/368618 "2024-10-10T09:55:55Z")
Hello everyone, i'am currently trying to setup the geoip service of elasticsearch. I'am mainly following the steps outlined in the documentation: Now i came across the circumstance that the geoip service requires to … --- ## [Logstash compressed data](https://discuss.elastic.co/t/logstash-compressed-data/368614)
**Author:** [@pradeep-logstashuser](https://discuss.elastic.co/u/pradeep-logstashuser)\ **Replies:** 0\ **Last updated:** [October 10, 2024, 9:36am UTC](https://discuss.elastic.co/t/logstash-compressed-data/368614 "2024-10-10T09:36:45Z")
Hi Sir, I have used the HTTP input plugin and the OpenSearch output plugin. I am receiving compressed data from the app to the HTTP input. Can I send the compressed data directly to OpenSearch, or should I handle decomp… --- ## [Thousands of predefined fields visible in "Default fields" in discover](https://discuss.elastic.co/t/thousands-of-predefined-fields-visible-in-default-fields-in-discover/368534)
**Author:** [@rkrzewski](https://discuss.elastic.co/u/rkrzewski)\ **Replies:** 2\ **Last updated:** [October 10, 2024, 9:20am UTC](https://discuss.elastic.co/t/thousands-of-predefined-fields-visible-in-default-fields-in-discover/368534 "2024-10-10T09:20:40Z")
I'm running Kibana/Elasticsearch/FileBeat 8.12.0 on Kubernetes, deployed using ECK operator. I'm only collecting logs from selected workloads in the kubernetes cluster. My filebeat configuration looks like this: f… --- ## [Pattern matching with Kibana](https://discuss.elastic.co/t/pattern-matching-with-kibana/367089)
**Author:** [@scrouet](https://discuss.elastic.co/u/scrouet)\ **Replies:** 1\ **Last updated:** [October 10, 2024, 8:46am UTC](https://discuss.elastic.co/t/pattern-matching-with-kibana/367089 "2024-10-10T08:46:29Z")
Hello, In Kibana I want to filter out messages when the field "EntryMessage" contains "Contact with Id {{numeric\_id}} has an incorrect login name or password." I tried this filter, but it does not work: { "regexp": … --- ## [ES 8.6 - High contention over Global Ordingals Field Data for terms aggregation under load](https://discuss.elastic.co/t/es-8-6-high-contention-over-global-ordingals-field-data-for-terms-aggregation-under-load/368525)
**Author:** [@Mikhail\_Khludnev](https://discuss.elastic.co/u/Mikhail_Khludnev)\ **Replies:** 1\ **Last updated:** [October 10, 2024, 8:33am UTC](https://discuss.elastic.co/t/es-8-6-high-contention-over-global-ordingals-field-data-for-terms-aggregation-under-load/368525 "2024-10-10T08:33:39Z")
Hello Under a moderate load (mostly filtering and massive terms aggregation) I see "benign" hot\_threads ie ..8.6..index.fielddata.ordinals.GlobalOrdinalMapping.lookupOrd(GlobalOrdinalMapping.java:71) ..8.6..index.mappe… --- ## [What are the requirements?](https://discuss.elastic.co/t/what-are-the-requirements/368279)
**Author:** [@dsagent](https://discuss.elastic.co/u/dsagent)\ **Replies:** 52\ **Last updated:** [October 10, 2024, 7:27am UTC](https://discuss.elastic.co/t/what-are-the-requirements/368279 "2024-10-10T07:27:40Z")
Hi If I have 1500 devices and each device uploads about 3 GB of data per day How much do I need a node? And what are their specifications such as RAM, hard disk and CPU ? --- ## [Fleet server API](https://discuss.elastic.co/t/fleet-server-api/368538)
**Author:** [@Viktor\_Movita](https://discuss.elastic.co/u/Viktor_Movita)\ **Replies:** 3\ **Last updated:** [October 10, 2024, 6:39am UTC](https://discuss.elastic.co/t/fleet-server-api/368538 "2024-10-10T06:39:24Z")
Hello everyone, I have a Fleet server that I manually installed on a Linux server. I am trying to follow the instructions from the Elastic documentation to use the API options (Fleet APIs | Fleet and Elastic Agent Guid… --- ## [Scientific Notation appearing for very small numbers during Sum aggregation](https://discuss.elastic.co/t/scientific-notation-appearing-for-very-small-numbers-during-sum-aggregation/368583)
**Author:** [@tejas7](https://discuss.elastic.co/u/tejas7)\ **Replies:** 0\ **Last updated:** [October 10, 2024, 3:50am UTC](https://discuss.elastic.co/t/scientific-notation-appearing-for-very-small-numbers-during-sum-aggregation/368583 "2024-10-10T03:50:23Z")
We are getting scientific notation for very small values approximately to zero when using the sum aggregation in Kibana visualizations. Could you please help us to workaround or provide a fix for the issue. Thanks i… --- ## [How can I use a boolean query with a filter that checks for strings that "do not end with", "does not start with" and "does not contain" a certain string,](https://discuss.elastic.co/t/how-can-i-use-a-boolean-query-with-a-filter-that-checks-for-strings-that-do-not-end-with-does-not-start-with-and-does-not-contain-a-certain-string/368577)
**Author:** [@sebbpp](https://discuss.elastic.co/u/sebbpp)\ **Replies:** 0\ **Last updated:** [October 9, 2024, 11:35pm UTC](https://discuss.elastic.co/t/how-can-i-use-a-boolean-query-with-a-filter-that-checks-for-strings-that-do-not-end-with-does-not-start-with-and-does-not-contain-a-certain-string/368577 "2024-10-09T23:35:11Z")
I am trying to get a query that help me out to get the records where tsv3message.connection.helo does not contain "dm3" string tsv3message.connection.host does not start with "qak" string tsv3message.connection.host do… --- ## [Filebeat is not sending logs to Kafka](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-kafka/368575)
**Author:** [@redangel](https://discuss.elastic.co/u/redangel)\ **Replies:** 1\ **Last updated:** [October 9, 2024, 11:06pm UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-kafka/368575 "2024-10-09T23:06:55Z")
I have filebeat running in GCP cluster and I am trying to send the logs to my Kafka in DC. I see in the logs that it was able to make a connection to Kafka. I configured the filebeat.yml with kafka output using the IP ad… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=154) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=156)