# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1559 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1560 --- ## [Kibana throwing error "{"statusCode":503,"error":"Service Unavailable","message":"Service Unavailable"}"](https://discuss.elastic.co/t/kibana-throwing-error-statuscode-503-error-service-unavailable-message-service-unavailable/263844)
**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Replies:** 9\ **Last updated:** [February 11, 2021, 4:22pm UTC](https://discuss.elastic.co/t/kibana-throwing-error-statuscode-503-error-service-unavailable-message-service-unavailable/263844 "2021-02-11T16:22:35Z")
Hi Team, Im using kibana version 6.4.0 and when ever i try to save or create new index im getting 503 error. All the elasticsearch service are up and running. My setup is 3 Master and 3 Data and 1 coordinate Node. My… --- ## [Unique Count by Bucket](https://discuss.elastic.co/t/unique-count-by-bucket/263978)
**Author:** [@Razvan\_Todea](https://discuss.elastic.co/u/Razvan_Todea)\ **Replies:** 5\ **Last updated:** [February 11, 2021, 4:13pm UTC](https://discuss.elastic.co/t/unique-count-by-bucket/263978 "2021-02-11T16:13:54Z")
How could we visualize an unique count grouped by bucket? We understand that the counting will only check the uniqueness inside the bucket, but is it another way to achieve this? Example: We want to visualize all the u… --- ## [Issue with ILM](https://discuss.elastic.co/t/issue-with-ilm/264035)
**Author:** [@jamesp220291](https://discuss.elastic.co/u/jamesp220291)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 4:13pm UTC](https://discuss.elastic.co/t/issue-with-ilm/264035 "2021-02-11T16:13:33Z")
Hi i am having an issue with iLM there error is - \`\> illegal\_argument\_exception: index.lifecycle.rollover\_alias \[filebeat\] does not point to index \[filebeat-test-2021.02.11-000001\]\` Logstash settings - elasticsearc… --- ## [Beats monitoring](https://discuss.elastic.co/t/beats-monitoring/264034)
**Author:** [@bolemebrige](https://discuss.elastic.co/u/bolemebrige)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 4:02pm UTC](https://discuss.elastic.co/t/beats-monitoring/264034 "2021-02-11T16:02:38Z")
Is there a way to send beats monitoring data (over interanal montiroing or metricbeat) to logstash and than to elasticsearch, so not with direct connection to elasticsearch? --- ## [Elasticsearch or Kibana servers / APIs as Vector tile server](https://discuss.elastic.co/t/elasticsearch-or-kibana-servers-apis-as-vector-tile-server/264017)
**Author:** [@Florin\_Virdol](https://discuss.elastic.co/u/Florin_Virdol)\ **Replies:** 1\ **Last updated:** [February 11, 2021, 3:58pm UTC](https://discuss.elastic.co/t/elasticsearch-or-kibana-servers-apis-as-vector-tile-server/264017 "2021-02-11T15:58:52Z")
Hello, As a bit of context, for my web app, on the Angular frontend, on top of Google Maps APIs, i'm using Uber's deck.gl library for better rendering geo-spatial data (GeoJson layers and MVT layers). For the deck.gl M… --- ## [ES7.9.1 : match\_phrase\_prefix irregular behaviour](https://discuss.elastic.co/t/es7-9-1-match-phrase-prefix-irregular-behaviour/264022)
**Author:** [@gap736uk](https://discuss.elastic.co/u/gap736uk)\ **Replies:** 3\ **Last updated:** [February 11, 2021, 3:48pm UTC](https://discuss.elastic.co/t/es7-9-1-match-phrase-prefix-irregular-behaviour/264022 "2021-02-11T15:48:34Z")
We have an ES index of the 230 million + files in our archive - each file gets indexed with details such as filename, directory path and file size I've been attempting to construct queries to aggregate information for a… --- ## [Running tasks on a node get terminated when node is shutdown](https://discuss.elastic.co/t/running-tasks-on-a-node-get-terminated-when-node-is-shutdown/263863)
**Author:** [@yabhishek](https://discuss.elastic.co/u/yabhishek)\ **Replies:** 2\ **Last updated:** [February 11, 2021, 3:36pm UTC](https://discuss.elastic.co/t/running-tasks-on-a-node-get-terminated-when-node-is-shutdown/263863 "2021-02-11T15:36:37Z")
I have a cluster with 3 nodes and trying to upgrade it from 6.6.2 to 7.10.2 using rolling upgrade. The documentation says that we shutdown the node and upgrade it to target version and performing this for all the nodes o… --- ## [Kibana Fleet error after upgrading Elastic Cloud to 7.11](https://discuss.elastic.co/t/kibana-fleet-error-after-upgrading-elastic-cloud-to-7-11/263969)
**Author:** [@nugroho-expereo](https://discuss.elastic.co/u/nugroho-expereo)\ **Replies:** 8\ **Last updated:** [February 11, 2021, 3:23pm UTC](https://discuss.elastic.co/t/kibana-fleet-error-after-upgrading-elastic-cloud-to-7-11/263969 "2021-02-11T15:23:50Z")
Hi, We get the following error when opening fleet page after upgrading from 7.10.2 to 7.11: Unable to initialize Fleet \[illegal\_argument\_exception\] updating component template \[logs-endpoint.events.file-mappings\] resu… --- ## [X-axis is not visible in vega visualization](https://discuss.elastic.co/t/x-axis-is-not-visible-in-vega-visualization/263981)
**Author:** [@saumya1](https://discuss.elastic.co/u/saumya1)\ **Replies:** 6\ **Last updated:** [February 11, 2021, 3:19pm UTC](https://discuss.elastic.co/t/x-axis-is-not-visible-in-vega-visualization/263981 "2021-02-11T15:19:46Z")
{ "$schema": "https://vega.github.io/schema/vega/v5.json", "description": "A basic bar chart example, with value labels shown upon mouse hover.", "signals": \[{ "name": "timeunit", "value": \["day"\], … --- ## [Issues with Fleet after upgrade to 7.11](https://discuss.elastic.co/t/issues-with-fleet-after-upgrade-to-7-11/264021)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 3\ **Last updated:** [February 11, 2021, 2:48pm UTC](https://discuss.elastic.co/t/issues-with-fleet-after-upgrade-to-7-11/264021 "2021-02-11T14:48:29Z")
After an Upgrade to 7.11, i receive Errors about composable templates that back data streams. Because of this, I can't open the Fleet view. The errors occur for seemingly all data streams. The indices have no aliases con… --- ## [Unable to setup Elasticsearch cluster mode](https://discuss.elastic.co/t/unable-to-setup-elasticsearch-cluster-mode/263987)
**Author:** [@Jose\_Angel\_Morena\_Si](https://discuss.elastic.co/u/Jose_Angel_Morena_Si)\ **Replies:** 5\ **Last updated:** [February 11, 2021, 2:30pm UTC](https://discuss.elastic.co/t/unable-to-setup-elasticsearch-cluster-mode/263987 "2021-02-11T14:30:17Z")
Hello there, I am trying to deploy Elasticsearch 7.10.2 in HA with three nodes, all of which play the roles: master, ingest and data. In order to do so, I am using the following configuration in each of the nodes: NOD… --- ## [Filebeat Auditd module: Failed to Parse field \[error\] of type \[keyword\]](https://discuss.elastic.co/t/filebeat-auditd-module-failed-to-parse-field-error-of-type-keyword/263579)
**Author:** [@ven67](https://discuss.elastic.co/u/ven67)\ **Replies:** 7\ **Last updated:** [February 11, 2021, 2:25pm UTC](https://discuss.elastic.co/t/filebeat-auditd-module-failed-to-parse-field-error-of-type-keyword/263579 "2021-02-11T14:25:33Z")
Hello! I have filebeat running in kubernetes with audtid module as such: Loading and configuring auditd module filebeat.modules: - module: auditd log: enabled: true var.paths: \["/var/lo… --- ## [\[SOLVED\] I can't use winlogbeat with Kibana](https://discuss.elastic.co/t/solved-i-cant-use-winlogbeat-with-kibana/263908)
**Author:** [@Christian\_SG](https://discuss.elastic.co/u/Christian_SG)\ **Replies:** 4\ **Last updated:** [February 11, 2021, 2:12pm UTC](https://discuss.elastic.co/t/solved-i-cant-use-winlogbeat-with-kibana/263908 "2021-02-11T14:12:41Z")
Hi everyone, I'm running elasticsearch and Kibana in a Debian10 machine, everything was working perfectly. Then I tried intalling winlogbeat in a Windows10 machine and here comes my problem, I've been searching for many … --- ## [Grok by beats agent](https://discuss.elastic.co/t/grok-by-beats-agent/264008)
**Author:** [@hugoboubou](https://discuss.elastic.co/u/hugoboubou)\ **Replies:** 2\ **Last updated:** [February 11, 2021, 2:12pm UTC](https://discuss.elastic.co/t/grok-by-beats-agent/264008 "2021-02-11T14:12:27Z")
Hello :smiley: I have several beats entries on my logstash, but the logs I process are different, so I would like to do a grok by beat. example log lines : 2017/07/27 18:02:37 VCS ERROR V-16-1-54031 Resource XXXXXXXXX… --- ## [Snapshot performance with ES 7.10](https://discuss.elastic.co/t/snapshot-performance-with-es-7-10/260739)
**Author:** [@karunelas](https://discuss.elastic.co/u/karunelas)\ **Replies:** 16\ **Last updated:** [February 11, 2021, 1:34pm UTC](https://discuss.elastic.co/t/snapshot-performance-with-es-7-10/260739 "2021-02-11T13:34:35Z")
Hi all: We have upgraded to ES 7.10 from 6.8. After the upgrade, we are observing that the time taken for the Snapshot on 7.10 is around 3 times slower compared to the snapshots with 6.8. These are snapshots of the ES c… --- ## [FIRST/FIRST\_VALUE function returning empty value](https://discuss.elastic.co/t/first-first-value-function-returning-empty-value/263963)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 1\ **Last updated:** [February 11, 2021, 1:23pm UTC](https://discuss.elastic.co/t/first-first-value-function-returning-empty-value/263963 "2021-02-11T13:23:26Z")
Hi All, I have to select records from an index, and have to select the latest values for a Mobile number. There can be more than one record for each mobile number. I am using FIrst function for the same and it is retur… --- ## [Error migrating after upgrading to 7.11](https://discuss.elastic.co/t/error-migrating-after-upgrading-to-7-11/263928)
**Author:** [@stephan13360](https://discuss.elastic.co/u/stephan13360)\ **Replies:** 6\ **Last updated:** [February 11, 2021, 1:22pm UTC](https://discuss.elastic.co/t/error-migrating-after-upgrading-to-7-11/263928 "2021-02-11T13:22:57Z")
I just upgraded my Elasticsearch / Kibana from 7.10.2 to 7.11 and now Kibana logs the following error when trying to run the migration: { "type": "log", "@timestamp": "2021-02-10T20:11:18+01:00", "tags": \["fatal",… --- ## [Show graph on Number of Lines instead of Number of Bytes](https://discuss.elastic.co/t/show-graph-on-number-of-lines-instead-of-number-of-bytes/263939)
**Author:** [@homius](https://discuss.elastic.co/u/homius)\ **Replies:** 1\ **Last updated:** [February 11, 2021, 1:14pm UTC](https://discuss.elastic.co/t/show-graph-on-number-of-lines-instead-of-number-of-bytes/263939 "2021-02-11T13:14:43Z")
Hi All, I am totally new in Kibana so my question might be dumb. In my Kibana Dashboard I see graph of my http requests/responses (Users, Total Processed, Request Rate,...). It also shows "Processed Prediction Bytes". Ho… --- ## [All shards failed for phase: \[query\]](https://discuss.elastic.co/t/all-shards-failed-for-phase-query/264020)
**Author:** [@Tabriz](https://discuss.elastic.co/u/Tabriz)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 1:09pm UTC](https://discuss.elastic.co/t/all-shards-failed-for-phase-query/264020 "2021-02-11T13:09:19Z")
There is a such problem.What can be reason? --- ## [Elastic cluster upgrading order for nodes](https://discuss.elastic.co/t/elastic-cluster-upgrading-order-for-nodes/263508)
**Author:** [@testsemd\_email](https://discuss.elastic.co/u/testsemd_email)\ **Replies:** 2\ **Last updated:** [February 11, 2021, 12:38pm UTC](https://discuss.elastic.co/t/elastic-cluster-upgrading-order-for-nodes/263508 "2021-02-11T12:38:30Z")
I have elastic 5 nodes cluster, node1-master only node2-master only node3-data\_ingest node4-data+ingest node5-master+data+ingest Can upgrade node1 before upgrade node5? Thank you! --- ## [Multiple problems with Kibana Dashboards (Metricbeat/Winlogbeat)](https://discuss.elastic.co/t/multiple-problems-with-kibana-dashboards-metricbeat-winlogbeat/263424)
**Author:** [@keyofstarrysky973](https://discuss.elastic.co/u/keyofstarrysky973)\ **Replies:** 5\ **Last updated:** [February 11, 2021, 12:29pm UTC](https://discuss.elastic.co/t/multiple-problems-with-kibana-dashboards-metricbeat-winlogbeat/263424 "2021-02-11T12:29:40Z")
Hey Everyone. I have followed a basic implementation of ELK Stack (version 7.10) on a Windows 10 machine. Now though, I'm having problems with the visualisation of data from two Beats agents (Metricbeat and Winlogbeat). … --- ## [Ho to make the URL Drill downs automatic as part of docker image or k8s configmap?](https://discuss.elastic.co/t/ho-to-make-the-url-drill-downs-automatic-as-part-of-docker-image-or-k8s-configmap/263957)
**Author:** [@Rajesh\_Reddy\_N](https://discuss.elastic.co/u/Rajesh_Reddy_N)\ **Replies:** 1\ **Last updated:** [February 11, 2021, 12:16pm UTC](https://discuss.elastic.co/t/ho-to-make-the-url-drill-downs-automatic-as-part-of-docker-image-or-k8s-configmap/263957 "2021-02-11T12:16:31Z")
Hi, we have ingested lots of data to elastic search and visualizing through the Kibana 7.7. We are able to do create drill-down charts but the URL mapping needs to be done manually. eg: loglevel.keyword -\> enable it as… --- ## [FSCrawler 7.2.7, Windows service, debug and trace logs](https://discuss.elastic.co/t/fscrawler-7-2-7-windows-service-debug-and-trace-logs/263092)
**Author:** [@newschapmj1](https://discuss.elastic.co/u/newschapmj1)\ **Replies:** 4\ **Last updated:** [February 11, 2021, 12:01pm UTC](https://discuss.elastic.co/t/fscrawler-7-2-7-windows-service-debug-and-trace-logs/263092 "2021-02-11T12:01:12Z")
When running fscrawler 7.2.7 as a service (Windows server 2016) should it be possible to see debug or trace logs by adding the --debug or --trace flag? We are using nssm v2.24 to generate the service. I successfully ad… --- ## [Convert Lucene BooleanQuery to ES BoolQueryBuilder](https://discuss.elastic.co/t/convert-lucene-booleanquery-to-es-boolquerybuilder/263993)
**Author:** [@Mladen\_Rusev](https://discuss.elastic.co/u/Mladen_Rusev)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 10:40am UTC](https://discuss.elastic.co/t/convert-lucene-booleanquery-to-es-boolquerybuilder/263993 "2021-02-11T10:40:48Z")
Hello, I'm porting some indices from lucene to ES. I've managed to use QueryBuilders.queryStringQuery(queryString); to parse old lucene string queries to elastic. However I can't seem to find a way to use Lucene's B… --- ## [Filebeat Pipelines](https://discuss.elastic.co/t/filebeat-pipelines/264005)
**Author:** [@st1988](https://discuss.elastic.co/u/st1988)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 11:14am UTC](https://discuss.elastic.co/t/filebeat-pipelines/264005 "2021-02-11T11:14:01Z")
Hi, I have generated some filebeat configurations using the Machine learning in Kibana which has been amazing. This has given me several configuration files that I can add to Filebeat. The issue I have is that all the i… --- ## [Fortinet module processor fail](https://discuss.elastic.co/t/fortinet-module-processor-fail/264003)
**Author:** [@Thomas74](https://discuss.elastic.co/u/Thomas74)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 11:04am UTC](https://discuss.elastic.co/t/fortinet-module-processor-fail/264003 "2021-02-11T11:04:51Z")
Hi, I'm configuring Fortinet module but processor condition added doesn't work and I don't understand why. Here you have config module : - module: fortinet firewall: enabled: true var.input: udp … --- ## [Coordination Only node and how does it affect cluster](https://discuss.elastic.co/t/coordination-only-node-and-how-does-it-affect-cluster/263769)
**Author:** [@vatsoo](https://discuss.elastic.co/u/vatsoo)\ **Replies:** 1\ **Last updated:** [February 11, 2021, 10:55am UTC](https://discuss.elastic.co/t/coordination-only-node-and-how-does-it-affect-cluster/263769 "2021-02-11T10:55:00Z")
Hi everyone, I did not find precise information about the topic so asking here. I want to add Coordination only node to the cluster running it on same machine as Kibana is running. Then update Kibana config by setting … --- ## [Custom Visualizations, How to pass in plugin start lifecycle](https://discuss.elastic.co/t/custom-visualizations-how-to-pass-in-plugin-start-lifecycle/263927)
**Author:** [@sdeck51](https://discuss.elastic.co/u/sdeck51)\ **Replies:** 1\ **Last updated:** [February 11, 2021, 10:50am UTC](https://discuss.elastic.co/t/custom-visualizations-how-to-pass-in-plugin-start-lifecycle/263927 "2021-02-11T10:50:27Z")
Hi, I was looking at the following example to see how a custom kibana viz is set up. From what I see we can create a react/base visualization in the setup lifecycle function of the plugin. This means we could pass set… --- ## [Using kv and Grok Pattern in Ingest Pipelines](https://discuss.elastic.co/t/using-kv-and-grok-pattern-in-ingest-pipelines/263997)
**Author:** [@geek876](https://discuss.elastic.co/u/geek876)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 10:50am UTC](https://discuss.elastic.co/t/using-kv-and-grok-pattern-in-ingest-pipelines/263997 "2021-02-11T10:50:22Z")
I am trying to extract a log-pattern \[LEVEL\] (COMPONENT) MESSAGE \[msgid: MESSAGE ID\] example message: \[INFO \] (core.workflow) Start scan, workflow\_id='lms::workflow::WorkflowExecutor(0x259c99f94b0, name = "WF-127.0.… --- ## [Starting elasticsearch in kubernetes](https://discuss.elastic.co/t/starting-elasticsearch-in-kubernetes/263996)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 0\ **Last updated:** [February 11, 2021, 10:46am UTC](https://discuss.elastic.co/t/starting-elasticsearch-in-kubernetes/263996 "2021-02-11T10:46:59Z")
I am trying to start elasticsearch in kubernetes. I have used the quick starting guide therefore my manifest file looks like this: kind: Elasticsearch metadata: name: elasticsearch namespace: rcc … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1558) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1560)