# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1555 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1556 --- ## [Suggestion to Deploy Azure Elasticsearch (Self-Managed) deployment](https://discuss.elastic.co/t/suggestion-to-deploy-azure-elasticsearch-self-managed-deployment/263971)
**Author:** [@verma.s](https://discuss.elastic.co/u/verma.s)\ **Replies:** 3\ **Last updated:** [February 15, 2021, 11:17am UTC](https://discuss.elastic.co/t/suggestion-to-deploy-azure-elasticsearch-self-managed-deployment/263971 "2021-02-15T11:17:12Z")
Hello Team, We have requirement to deploy Elasticsearch (Self-Managed) marketplace solution in our Azure environment, Need clarification on couple of doubts. Is it possible to use our own OS image instead of default. I… --- ## [Fleet Admin user is invalid](https://discuss.elastic.co/t/fleet-admin-user-is-invalid/263862)
**Author:** [@Robo](https://discuss.elastic.co/u/Robo)\ **Replies:** 3\ **Last updated:** [February 15, 2021, 11:09am UTC](https://discuss.elastic.co/t/fleet-admin-user-is-invalid/263862 "2021-02-15T11:09:06Z")
I'm trying to enroll an agent using fleet, but seems there is something wrong with the api\_key. Is there a was how to initiate again the fleet setup (including user and role)? How could be below mentioned error be solv… --- ## [XML and .NET](https://discuss.elastic.co/t/xml-and-net/264264)
**Author:** [@Cgr\_EQ](https://discuss.elastic.co/u/Cgr_EQ)\ **Replies:** 3\ **Last updated:** [February 15, 2021, 10:55am UTC](https://discuss.elastic.co/t/xml-and-net/264264 "2021-02-15T10:55:28Z")
I am trying to send data to Elasticsearch using NEST and ASP.NET Core that contains mainly text and XML data. My class is defined as follow: public class TestData { public string text1{ get; set; } pu… --- ## [ELK sizing](https://discuss.elastic.co/t/elk-sizing/264292)
**Author:** [@Shalinicts](https://discuss.elastic.co/u/Shalinicts)\ **Replies:** 4\ **Last updated:** [February 15, 2021, 10:33am UTC](https://discuss.elastic.co/t/elk-sizing/264292 "2021-02-15T10:33:00Z")
What is the recommendation to aggregate 100GB log data per day using ELK stack(open source) 1 master node , 2 data node(1 TB disk space) is good approach? --- ## [Plugin development - Node Client has not been initialized exception](https://discuss.elastic.co/t/plugin-development-node-client-has-not-been-initialized-exception/264239)
**Author:** [@Tom\_Elias](https://discuss.elastic.co/u/Tom_Elias)\ **Replies:** 5\ **Last updated:** [February 15, 2021, 9:52am UTC](https://discuss.elastic.co/t/plugin-development-node-client-has-not-been-initialized-exception/264239 "2021-02-15T09:52:04Z")
Hello, i'm developing a plugin for elasticsearch 7.8.0 and i'm using the NodeClient to get all the mappings from the cluster on start-up, in order to find indices with "dense\_vector" field types. I am overriding the cr… --- ## [How to simulate long running Elasticsearch query?](https://discuss.elastic.co/t/how-to-simulate-long-running-elasticsearch-query/264288)
**Author:** [@aldm](https://discuss.elastic.co/u/aldm)\ **Replies:** 1\ **Last updated:** [February 15, 2021, 9:48am UTC](https://discuss.elastic.co/t/how-to-simulate-long-running-elasticsearch-query/264288 "2021-02-15T09:48:36Z")
Hi, We're having issues with our Elasticsearch topology. We're using default topology which behaves not so good when under heavy load, which is happening in the last few weeks. So we wanted to automatically cancel long… --- ## [Annotated text plugin and index\_options/term\_vectors](https://discuss.elastic.co/t/annotated-text-plugin-and-index-options-term-vectors/263989)
**Author:** [@robmartin11](https://discuss.elastic.co/u/robmartin11)\ **Replies:** 1\ **Last updated:** [February 15, 2021, 9:39am UTC](https://discuss.elastic.co/t/annotated-text-plugin-and-index-options-term-vectors/263989 "2021-02-15T09:39:39Z")
Im using the annotated\_text field to index documents but for larger documents Im getting errors: index has exceeded \[1000000\] - maximum allowed to be analyzed for highlighting. This maximum can be set by changing the \[i… --- ## [Array of objects Max value](https://discuss.elastic.co/t/array-of-objects-max-value/263849)
**Author:** [@sivanzakay](https://discuss.elastic.co/u/sivanzakay)\ **Replies:** 3\ **Last updated:** [February 15, 2021, 8:37am UTC](https://discuss.elastic.co/t/array-of-objects-max-value/263849 "2021-02-15T08:37:42Z")
According the documents below : How do I get all documents that field driver.vehicle.make = Powell Motors" and this field has the max year in the array ? (It should return only doc 1 and doc 3) I would like it will … --- ## [How to Create Threat MAP Paloalto in elasticsearch](https://discuss.elastic.co/t/how-to-create-threat-map-paloalto-in-elasticsearch/264269)
**Author:** [@syafeera](https://discuss.elastic.co/u/syafeera)\ **Replies:** 1\ **Last updated:** [February 15, 2021, 9:15am UTC](https://discuss.elastic.co/t/how-to-create-threat-map-paloalto-in-elasticsearch/264269 "2021-02-15T09:15:27Z")
Hi, May i know how to create Threat MAP in elastic-search? Before this, the threat map in the dashboard, however still no map in my dashboard.. --- ## [Delete recently viewed views](https://discuss.elastic.co/t/delete-recently-viewed-views/263665)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 4\ **Last updated:** [February 15, 2021, 9:06am UTC](https://discuss.elastic.co/t/delete-recently-viewed-views/263665 "2021-02-15T09:06:50Z")
In the upper left menu, dashboards and other things appear as recently view. Is there a way to clear/remove this? --- ## [Logstash dameon does not create index .... but manually running Logstash does](https://discuss.elastic.co/t/logstash-dameon-does-not-create-index-but-manually-running-logstash-does/262691)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 2\ **Last updated:** [February 15, 2021, 9:06am UTC](https://discuss.elastic.co/t/logstash-dameon-does-not-create-index-but-manually-running-logstash-does/262691 "2021-02-15T09:06:10Z")
Hello I believe this is more oriented to logstash but If I run as root: /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/01-winlogbeat-somefile.conf Kibana sees the index file, so it is created and as long as… --- ## [Elasticsearch log problem](https://discuss.elastic.co/t/elasticsearch-log-problem/263856)
**Author:** [@Tabriz](https://discuss.elastic.co/u/Tabriz)\ **Replies:** 8\ **Last updated:** [February 15, 2021, 8:53am UTC](https://discuss.elastic.co/t/elasticsearch-log-problem/263856 "2021-02-15T08:53:15Z")
Hi, there are some problem related the logs of elasticsearch. in log is writen error that -\>Failed to execute \[org.elasticsearch.action.search.elasticsearch.search.SearchParseException\]: parse failure \[failed to parse … --- ## [Returning the child fields next to matched field](https://discuss.elastic.co/t/returning-the-child-fields-next-to-matched-field/264077)
**Author:** [@jaripog](https://discuss.elastic.co/u/jaripog)\ **Replies:** 1\ **Last updated:** [February 15, 2021, 6:46am UTC](https://discuss.elastic.co/t/returning-the-child-fields-next-to-matched-field/264077 "2021-02-15T06:46:40Z")
Assume that I have a document like below { "\_index": "sample", "\_type": "doc", "\_id": "student\_id\_1", "\_version":2, "\_score":1, "\_source": { "title": "Higher secondary", "DOJ":2020-06-23, "S\_id":"SH123", "fir… --- ## [Put onprem snapshot to S3 and restoring it to cloud cluster](https://discuss.elastic.co/t/put-onprem-snapshot-to-s3-and-restoring-it-to-cloud-cluster/264249)
**Author:** [@Vishal\_Yadav1](https://discuss.elastic.co/u/Vishal_Yadav1)\ **Replies:** 7\ **Last updated:** [February 15, 2021, 5:42am UTC](https://discuss.elastic.co/t/put-onprem-snapshot-to-s3-and-restoring-it-to-cloud-cluster/264249 "2021-02-15T05:42:05Z")
Hi Team, Can we restore on prem snapshot to aws cloud through S3? We created snapshot and dump indices to S3 and then we want to restore it to the cloud cluster. We are using cloud-aws plugin both the sides --- ## [Selecting Multiple Entries in Controls Visualization](https://discuss.elastic.co/t/selecting-multiple-entries-in-controls-visualization/262221)
**Author:** [@Prithwi\_Lahiri](https://discuss.elastic.co/u/Prithwi_Lahiri)\ **Replies:** 3\ **Last updated:** [February 15, 2021, 5:22am UTC](https://discuss.elastic.co/t/selecting-multiple-entries-in-controls-visualization/262221 "2021-02-15T05:22:10Z")
Hello Everyone, I am creating a control visualization by which I can select more than 300 entries. Is there a "Select All" option in Controls? When I want to select them one by one after 6 to 7 entries the dashboard pag… --- ## [Elasticsearch:primary shards lost, after server restart due to power failure on datacenter](https://discuss.elastic.co/t/elasticsearch-primary-shards-lost-after-server-restart-due-to-power-failure-on-datacenter/264112)
**Author:** [@Sanjay\_Chinthala](https://discuss.elastic.co/u/Sanjay_Chinthala)\ **Replies:** 2\ **Last updated:** [February 15, 2021, 5:10am UTC](https://discuss.elastic.co/t/elasticsearch-primary-shards-lost-after-server-restart-due-to-power-failure-on-datacenter/264112 "2021-02-15T05:10:59Z")
Hi, we have loss the primary shard after datacenter power failure and My ES version: 2.4.6 and we have 5 data nodes ,1 master node \[2021-02-08 14:01:37,916\]\[INFO \]\[cluster.service \] \[es1\] detected\_master {es3}{5oxdhS4U… --- ## [Database on ELK stack](https://discuss.elastic.co/t/database-on-elk-stack/264265)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 2\ **Last updated:** [February 15, 2021, 4:48am UTC](https://discuss.elastic.co/t/database-on-elk-stack/264265 "2021-02-15T04:48:22Z")
is elastic has a database? --- ## [Elastic search data pod continuously restarting](https://discuss.elastic.co/t/elastic-search-data-pod-continuously-restarting/264272)
**Author:** [@jawed](https://discuss.elastic.co/u/jawed)\ **Replies:** 1\ **Last updated:** [February 15, 2021, 4:46am UTC](https://discuss.elastic.co/t/elastic-search-data-pod-continuously-restarting/264272 "2021-02-15T04:46:08Z")
\[\[/usr/share/elasticsearch/data (//fbeff48040de841b395c700.file.core.windows.net/kubernetes-dynamic-pvc-0f5e7e46-5138-45da-90e6-)\]\], net usable\_space \[37.1gb\], net total\_space \[50gb\], types \[cifs\] 2/15/2021 4:42:06 AM \[… --- ## [IP arrays break network conditionals?](https://discuss.elastic.co/t/ip-arrays-break-network-conditionals/263514)
**Author:** [@DPattee](https://discuss.elastic.co/u/DPattee)\ **Replies:** 1\ **Last updated:** [February 15, 2021, 1:04am UTC](https://discuss.elastic.co/t/ip-arrays-break-network-conditionals/263514 "2021-02-15T01:04:33Z")
Trying to tackle geocoding again... The public geoip lookup plugin works with IP addresses arrays now, but trying to get the private IP's geocoded isn't working well. Tried using processors in (for example) a metricbeat… --- ## [Elasticsearch not showing indexes after VM update](https://discuss.elastic.co/t/elasticsearch-not-showing-indexes-after-vm-update/263925)
**Author:** [@Giovanni\_Ferrari](https://discuss.elastic.co/u/Giovanni_Ferrari)\ **Replies:** 1\ **Last updated:** [February 14, 2021, 11:42pm UTC](https://discuss.elastic.co/t/elasticsearch-not-showing-indexes-after-vm-update/263925 "2021-02-14T23:42:33Z")
Hello everyone! I installed a cluster composed by a single node in a VM, with a disk attached to it and used for data storage (path.data configuration). The problem I'm facing is that in case the VM is destroyed and rebu… --- ## [org.elasticsearch.hadoop.rest.EsHadoopParsingException: org.elasticsearch.hadoop.EsHadoopIllegalStateException: Position for 'targetTableCount.site\_xref: ' not found in row; typically this is caused by a mapping inconsistency](https://discuss.elastic.co/t/org-elasticsearch-hadoop-rest-eshadoopparsingexception-org-elasticsearch-hadoop-eshadoopillegalstateexception-position-for-targettablecount-site-xref-not-found-in-row-typically-this-is-caused-by-a-mapping-inconsistency/264007)
**Author:** [@andrejavorski](https://discuss.elastic.co/u/andrejavorski)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 11:27am UTC](https://discuss.elastic.co/t/org-elasticsearch-hadoop-rest-eshadoopparsingexception-org-elasticsearch-hadoop-eshadoopillegalstateexception-position-for-targettablecount-site-xref-not-found-in-row-typically-this-is-caused-by-a-mapping-inconsistency/264007 "2021-02-11T11:27:51Z")
Hello everyone, I'm currently having issues with one of my jobs with below error: org.elasticsearch.hadoop.rest.EsHadoopParsingException: org.elasticsearch.hadoop.EsHadoopIllegalStateException: Position for 'targetTabl… --- ## [Want to copy specific data coming in and send to a new index](https://discuss.elastic.co/t/want-to-copy-specific-data-coming-in-and-send-to-a-new-index/264053)
**Author:** [@S3l3ct3d](https://discuss.elastic.co/u/S3l3ct3d)\ **Replies:** 1\ **Last updated:** [February 14, 2021, 11:32pm UTC](https://discuss.elastic.co/t/want-to-copy-specific-data-coming-in-and-send-to-a-new-index/264053 "2021-02-14T23:32:59Z")
I am going to try and explain this process we are wanting to accomplish. We have logs coming in from a specific vendor and going into its own index. We are wanting to capture specific data coming in from that index and… --- ## [Master Not Discovered Exception : FailedToCommitClusterStateException: node is no longer master for term 55 while handling publication](https://discuss.elastic.co/t/master-not-discovered-exception-failedtocommitclusterstateexception-node-is-no-longer-master-for-term-55-while-handling-publication/264049)
**Author:** [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)\ **Replies:** 1\ **Last updated:** [February 14, 2021, 11:29pm UTC](https://discuss.elastic.co/t/master-not-discovered-exception-failedtocommitclusterstateexception-node-is-no-longer-master-for-term-55-while-handling-publication/264049 "2021-02-14T23:29:52Z")
Hello Team, Last time i checked the cluster health was on December, from that time no one monitored the servers and didn't check the cluster health. Last week when i tried to access kibana, encountered an error "Kiban… --- ## [Unable to send data to AWS MSK, getting debug message: Kafka publish failed with: circuit breaker is open](https://discuss.elastic.co/t/unable-to-send-data-to-aws-msk-getting-debug-message-kafka-publish-failed-with-circuit-breaker-is-open/264044)
**Author:** [@saroja](https://discuss.elastic.co/u/saroja)\ **Replies:** 1\ **Last updated:** [February 14, 2021, 11:28pm UTC](https://discuss.elastic.co/t/unable-to-send-data-to-aws-msk-getting-debug-message-kafka-publish-failed-with-circuit-breaker-is-open/264044 "2021-02-14T23:28:35Z")
Dear Team , I am facing issue during data transfer in between filebeat and AWS msk cluster. The only error its showing like "circuit breaker open". I am using filebeat agent version 7.10.0 and AWS msk version 2.2.1.… --- ## [Elastic Role Mapping from IdP Role/Group](https://discuss.elastic.co/t/elastic-role-mapping-from-idp-role-group/263897)
**Author:** [@Ong3000](https://discuss.elastic.co/u/Ong3000)\ **Replies:** 3\ **Last updated:** [February 14, 2021, 11:25pm UTC](https://discuss.elastic.co/t/elastic-role-mapping-from-idp-role-group/263897 "2021-02-14T23:25:29Z")
Hi Elastic Forum, How is the role mapping working on elastic that integrating with IdP? In the mapping rules, we have fields like username, dn, realm.name. By creating role mapping and adding realm.name on mapping rule… --- ## [Index.mapping.total\_fields.limit for multiple indices in an elasticsearch cluster](https://discuss.elastic.co/t/index-mapping-total-fields-limit-for-multiple-indices-in-an-elasticsearch-cluster/264101)
**Author:** [@Deb](https://discuss.elastic.co/u/Deb)\ **Replies:** 1\ **Last updated:** [February 14, 2021, 11:14pm UTC](https://discuss.elastic.co/t/index-mapping-total-fields-limit-for-multiple-indices-in-an-elasticsearch-cluster/264101 "2021-02-14T23:14:25Z")
How does index.mapping.total\_field.limit works with multiple indices in an elasticsearch cluster? Let's say if I need to increase the index.mapping.total\_field.limit from the default 1000 to 2000 then will it be better … --- ## [How to reallocation shards in repurposed node](https://discuss.elastic.co/t/how-to-reallocation-shards-in-repurposed-node/264246)
**Author:** [@testsemd\_email](https://discuss.elastic.co/u/testsemd_email)\ **Replies:** 2\ **Last updated:** [February 14, 2021, 6:25pm UTC](https://discuss.elastic.co/t/how-to-reallocation-shards-in-repurposed-node/264246 "2021-02-14T18:25:21Z")
A data node was repurposed(to upgrade the node). Then it was unable to reallocate shards yet. It has configured as a warm node. I want to how to allocate shards to this node again? --- ## [How to convert field with "null" string value to 0 integer](https://discuss.elastic.co/t/how-to-convert-field-with-null-string-value-to-0-integer/264216)
**Author:** [@Die\_Meester](https://discuss.elastic.co/u/Die_Meester)\ **Replies:** 1\ **Last updated:** [February 14, 2021, 2:53am UTC](https://discuss.elastic.co/t/how-to-convert-field-with-null-string-value-to-0-integer/264216 "2021-02-14T02:53:36Z")
Hi, I am receiving the below error whilst trying to use filebeat to read log. I know that I can explicitly exclude the field %{processID} by appending ? %{?processID}, but sometimes the processID is valid integer and p… --- ## [Query about deleting snapshots](https://discuss.elastic.co/t/query-about-deleting-snapshots/264229)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 5\ **Last updated:** [February 14, 2021, 5:54pm UTC](https://discuss.elastic.co/t/query-about-deleting-snapshots/264229 "2021-02-14T17:54:12Z")
I know that snapshots are incremental, but what I don't understand is what happens when you delete a snapshot? I assume that deleting an earlier snapshot will remove all indexes that have not been modified since it wa… --- ## [Logstash output - set output file name](https://discuss.elastic.co/t/logstash-output-set-output-file-name/264023)
**Author:** [@liavsh](https://discuss.elastic.co/u/liavsh)\ **Replies:** 3\ **Last updated:** [February 14, 2021, 5:46pm UTC](https://discuss.elastic.co/t/logstash-output-set-output-file-name/264023 "2021-02-14T17:46:03Z")
Hi I'm new to logstash... I'm using logstash to stream logfiles from AWS MSK Kafka to AWS S3 bucket. I FAIL setting the output filename inside the bucket. I was able to set the folder that will hold the output file. … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1554) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1556)