# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1568 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1569 --- ## [Elasticsearch master node start failed. There is insufficient memory for the Java Runtime Environment to continue](https://discuss.elastic.co/t/elasticsearch-master-node-start-failed-there-is-insufficient-memory-for-the-java-runtime-environment-to-continue/263520)
**Author:** [@Jinlian\_Chen](https://discuss.elastic.co/u/Jinlian_Chen)\ **Replies:** 0\ **Last updated:** [February 7, 2021, 9:16am UTC](https://discuss.elastic.co/t/elasticsearch-master-node-start-failed-there-is-insufficient-memory-for-the-java-runtime-environment-to-continue/263520 "2021-02-07T09:16:51Z")
I have setup a elasticsearch cluster with 3 master node and 2 data node on k8s. While start master node , it failed. System config: ulimit -n 65535 ulimit -l unlimited sysctl -w vm.max\_map\_count=262144 sysctl -w vm.ove… --- ## [Logstash SPLIT plugin help](https://discuss.elastic.co/t/logstash-split-plugin-help/263462)
**Author:** [@Zdeno\_Liska](https://discuss.elastic.co/u/Zdeno_Liska)\ **Replies:** 5\ **Last updated:** [February 7, 2021, 12:51am UTC](https://discuss.elastic.co/t/logstash-split-plugin-help/263462 "2021-02-07T00:51:11Z")
Hi, I would like to ask thing about Split plugin. I have event like: {"name":"JASON", "phones":\[{ "mark":"Nokia", "model":"3310"},{"mark":"Apple","model":"12 Pro"}\]} I use clone, and want object like: {"name":"JAS… --- ## [Coordinating node](https://discuss.elastic.co/t/coordinating-node/263510)
**Author:** [@leemase004](https://discuss.elastic.co/u/leemase004)\ **Replies:** 2\ **Last updated:** [February 7, 2021, 12:39am UTC](https://discuss.elastic.co/t/coordinating-node/263510 "2021-02-07T00:39:31Z")
I know data nodes can act as coordinating nodes if one is not set; but, if I set up a designated coordinating-only node does that mean the data nodes will completely stop performing the coordinating function? Or will the… --- ## [Elasticsearch Nodes Crash After Attempt to Create Scripted Filed](https://discuss.elastic.co/t/elasticsearch-nodes-crash-after-attempt-to-create-scripted-filed/263179)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 3\ **Last updated:** [February 6, 2021, 11:33pm UTC](https://discuss.elastic.co/t/elasticsearch-nodes-crash-after-attempt-to-create-scripted-filed/263179 "2021-02-06T23:33:05Z")
Hello Community, I am trying to create a scripted field. I want to parse a string into a date format. I have created the following script DateTimeFormatter formatter = DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss… --- ## [Question in elastic search to get specific records with specific date and time range](https://discuss.elastic.co/t/question-in-elastic-search-to-get-specific-records-with-specific-date-and-time-range/261217)
**Author:** [@Kin\_Wan](https://discuss.elastic.co/u/Kin_Wan)\ **Replies:** 8\ **Last updated:** [February 6, 2021, 11:32pm UTC](https://discuss.elastic.co/t/question-in-elastic-search-to-get-specific-records-with-specific-date-and-time-range/261217 "2021-02-06T23:32:28Z")
Hello all, I would like to perform a query to get last weeks records on our log which the record are within Mon-Fri from (19:00-07:00) and Sat from (15:00-00:00) and full day on Sunday. How should I write the query? Than… --- ## [Securing Elasticsearch cluster](https://discuss.elastic.co/t/securing-elasticsearch-cluster/263509)
**Author:** [@ehsan\_kabiri\_33](https://discuss.elastic.co/u/ehsan_kabiri_33)\ **Replies:** 2\ **Last updated:** [February 6, 2021, 11:24pm UTC](https://discuss.elastic.co/t/securing-elasticsearch-cluster/263509 "2021-02-06T23:24:13Z")
I have a 3 nodes cluster in my local VM ware workstation. I followed the instructions on below to make my Elasticsearch 7.10 secure: configuring-security getting-started-with-elasticsearch-security I could complete th… --- ## [Error when build kibana 7.7 from source code](https://discuss.elastic.co/t/error-when-build-kibana-7-7-from-source-code/263502)
**Author:** [@Thien\_Hoang](https://discuss.elastic.co/u/Thien_Hoang)\ **Replies:** 2\ **Last updated:** [February 6, 2021, 11:13pm UTC](https://discuss.elastic.co/t/error-when-build-kibana-7-7-from-source-code/263502 "2021-02-06T23:13:51Z")
I get error about module 'static-extend' when build kibana from branch 7.7 version 7.7.2 run yarn kbn bootstrap F:\\Project\\kibana\>yarn kbn bootstrap yarn run v1.22.4 $ node scripts/kbn bootstrap F:\\Project\\kibana\\packa… --- ## [Question on what Elasticsearch considers data vs logs](https://discuss.elastic.co/t/question-on-what-elasticsearch-considers-data-vs-logs/263506)
**Author:** [@halfbakedprod](https://discuss.elastic.co/u/halfbakedprod)\ **Replies:** 1\ **Last updated:** [February 6, 2021, 6:10pm UTC](https://discuss.elastic.co/t/question-on-what-elasticsearch-considers-data-vs-logs/263506 "2021-02-06T18:10:12Z")
Hello all, I just setup Graylog + Elasticsearch for my first time. I'm trying to change the default location that ingested logs are saved. Currently, the default filepath is the OS drive, which will fill up in no time. … --- ## [Cluster with mix of cloud and self hosted](https://discuss.elastic.co/t/cluster-with-mix-of-cloud-and-self-hosted/263489)
**Author:** [@efftee](https://discuss.elastic.co/u/efftee)\ **Replies:** 2\ **Last updated:** [February 6, 2021, 5:35pm UTC](https://discuss.elastic.co/t/cluster-with-mix-of-cloud-and-self-hosted/263489 "2021-02-06T17:35:53Z")
Hi Are there any difficulties or limitations to have a cluster of instances mixing cloud-hosted Elasticsearch with self-hosted instances ? I have a main cloud instance, hosted by Elasticsearch. And I am wondering if it… --- ## [Use the index name in a scripted field](https://discuss.elastic.co/t/use-the-index-name-in-a-scripted-field/263496)
**Author:** [@Shalhevet](https://discuss.elastic.co/u/Shalhevet)\ **Replies:** 2\ **Last updated:** [February 6, 2021, 3:52pm UTC](https://discuss.elastic.co/t/use-the-index-name-in-a-scripted-field/263496 "2021-02-06T15:52:47Z")
I want to create a scripted field in an index pattern which takes the first word of the index's name and concatenate to it another value. How can I access the name of the index via painless in the scripted field? for e… --- ## [My elsticsearch cannot start](https://discuss.elastic.co/t/my-elsticsearch-cannot-start/263494)
**Author:** [@baber1223](https://discuss.elastic.co/u/baber1223)\ **Replies:** 3\ **Last updated:** [February 6, 2021, 2:39pm UTC](https://discuss.elastic.co/t/my-elsticsearch-cannot-start/263494 "2021-02-06T14:39:20Z")
I have installed elasticsearch-1.7.2-1.noarch now due start service show follow error : \[root@testopenbank ~\]# Exception in thread "main" java.lang.NoClassDefFoundError: Could not initialize class org.elasticsearch.Vers… --- ## [Combine two fields into one via add\_fields](https://discuss.elastic.co/t/combine-two-fields-into-one-via-add-fields/263468)
**Author:** [@bascht](https://discuss.elastic.co/u/bascht)\ **Replies:** 2\ **Last updated:** [February 6, 2021, 12:48pm UTC](https://discuss.elastic.co/t/combine-two-fields-into-one-via-add-fields/263468 "2021-02-06T12:48:07Z")
Hey everyone. I am trying to achieve something seemingly simple but cannot get this to work with the latest Filebeat 7.10: I want to combine the two fields foo.bar and foo.baz into a single new field that just joins th… --- ## [Beginner questions on Supervised ML](https://discuss.elastic.co/t/beginner-questions-on-supervised-ml/262744)
**Author:** [@kvtang](https://discuss.elastic.co/u/kvtang)\ **Replies:** 4\ **Last updated:** [February 6, 2021, 11:37am UTC](https://discuss.elastic.co/t/beginner-questions-on-supervised-ml/262744 "2021-02-06T11:37:31Z")
Hi all, Sorry if this question has been asked somewhere previously but I couldn't find any relevant information. For supervised ML, during training phase, do we have to provide label for each event that is already in E… --- ## [From Coveo to Elasticsearch](https://discuss.elastic.co/t/from-coveo-to-elasticsearch/263457)
**Author:** [@manideep](https://discuss.elastic.co/u/manideep)\ **Replies:** 3\ **Last updated:** [February 6, 2021, 5:03am UTC](https://discuss.elastic.co/t/from-coveo-to-elasticsearch/263457 "2021-02-06T05:03:04Z")
Dear Community, I have a web application built for enterprise search using Coveo. It has lot of sources (CSVs, Excel, Sharepoint, S3, APIs, etc.) indexed using default Coveo Connectors and few custom Connector written … --- ## [Best way to resolve this out of memory error in my ES Data Nodes](https://discuss.elastic.co/t/best-way-to-resolve-this-out-of-memory-error-in-my-es-data-nodes/263478)
**Author:** [@cis4life](https://discuss.elastic.co/u/cis4life)\ **Replies:** 2\ **Last updated:** [February 6, 2021, 4:04am UTC](https://discuss.elastic.co/t/best-way-to-resolve-this-out-of-memory-error-in-my-es-data-nodes/263478 "2021-02-06T04:04:57Z")
I have a cluster and now my data nodes are crashing. Looking over the logs i see this error. Its an out of memory error. Is there something i should set in the Elastic yml file to help lock memory? Add more data nodes… --- ## [How to export \`alerts\` as backup?](https://discuss.elastic.co/t/how-to-export-alerts-as-backup/261715)
**Author:** [@fzyzcjy](https://discuss.elastic.co/u/fzyzcjy)\ **Replies:** 12\ **Last updated:** [February 6, 2021, 3:58am UTC](https://discuss.elastic.co/t/how-to-export-alerts-as-backup/261715 "2021-02-06T03:58:02Z")
Hi thanks for the lib! I am trying to monitor my server by using monitoring and alerting. When, for example, CPU is too high or memory is almost full, I want to send an email to myself. Thus I use Kibana Alerting (is it … --- ## [Difference on dotted notation vs dictionary](https://discuss.elastic.co/t/difference-on-dotted-notation-vs-dictionary/263450)
**Author:** [@oskrdt](https://discuss.elastic.co/u/oskrdt)\ **Replies:** 2\ **Last updated:** [February 6, 2021, 3:00am UTC](https://discuss.elastic.co/t/difference-on-dotted-notation-vs-dictionary/263450 "2021-02-06T03:00:38Z")
I'm using a python script to populate data to elasticsearch using pandas to transform the data before the population. I was creating columns on pandas using dotted notation expecting that the elasticsearch index process… --- ## [Custom coloring in Kibana Visualize? e.g. the "failed" tag is red, "success" is green](https://discuss.elastic.co/t/custom-coloring-in-kibana-visualize-e-g-the-failed-tag-is-red-success-is-green/263346)
**Author:** [@fzyzcjy](https://discuss.elastic.co/u/fzyzcjy)\ **Replies:** 2\ **Last updated:** [February 6, 2021, 1:04am UTC](https://discuss.elastic.co/t/custom-coloring-in-kibana-visualize-e-g-the-failed-tag-is-red-success-is-green/263346 "2021-02-06T01:04:23Z")
Hi thanks for the lib! I wonder how can I custom the coloringin Kibana Visualize? e.g. the "failed" tag is red, "success" is green. Currently I cannot control it. See the following figure: where the "failed" and "suc… --- ## [Time of Day filter](https://discuss.elastic.co/t/time-of-day-filter/263277)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 4\ **Last updated:** [February 5, 2021, 11:20pm UTC](https://discuss.elastic.co/t/time-of-day-filter/263277 "2021-02-05T23:20:15Z")
I am trying to produce a dashboard that has some visualizations but also some data tables. In order to produce the results I need in the data tables, there are times that I must filter based on the time of day. For exa… --- ## [Cluster Health yellow because of unassigned shards](https://discuss.elastic.co/t/cluster-health-yellow-because-of-unassigned-shards/263459)
**Author:** [@maheshe](https://discuss.elastic.co/u/maheshe)\ **Replies:** 2\ **Last updated:** [February 5, 2021, 10:48pm UTC](https://discuss.elastic.co/t/cluster-health-yellow-because-of-unassigned-shards/263459 "2021-02-05T22:48:13Z")
The Cluster Health is yellow because of unassigned shards I have 1 master and 1 data node deployed through helm2 elastic repo. This is the getShards output, How can I turn cluster health to green by just having 1 master… --- ## [Swapping values within a field](https://discuss.elastic.co/t/swapping-values-within-a-field/263473)
**Author:** [@CoffeeDog](https://discuss.elastic.co/u/CoffeeDog)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 10:46pm UTC](https://discuss.elastic.co/t/swapping-values-within-a-field/263473 "2021-02-05T22:46:24Z")
I already have some data that is the following format: example\_field : test\_1,test\_2 I'd like to flip it to say example\_field: test\_2,test\_1 is painless the way to do this? Or should I leverage something else within … --- ## [Sum with negative fields (double type) strange result](https://discuss.elastic.co/t/sum-with-negative-fields-double-type-strange-result/263438)
**Author:** [@Maurip00](https://discuss.elastic.co/u/Maurip00)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 4:43pm UTC](https://discuss.elastic.co/t/sum-with-negative-fields-double-type-strange-result/263438 "2021-02-05T16:43:00Z")
There is someone that could me explain why by this simple aggregation: \> GET cfo1/\_search \> { \> "size": 0, \> "aggs": { \> "NAME": { \> "filter": {...}, \> "aggs": { \> … --- ## [ElasticSearch: L2 norm script\_score returns false distances](https://discuss.elastic.co/t/elasticsearch-l2-norm-script-score-returns-false-distances/257384)
**Author:** [@christiana](https://discuss.elastic.co/u/christiana)\ **Replies:** 1\ **Last updated:** [February 5, 2021, 9:57pm UTC](https://discuss.elastic.co/t/elasticsearch-l2-norm-script-score-returns-false-distances/257384 "2021-02-05T21:57:44Z")
i'm trying to calculate the L2-Norm between the fields of my database. To validate the correctness I setup a testing database with two documents, which are having equal vectors. My db look like this: Documents \_index:… --- ## [KQL to filter for documents where a field exists and its value is less than a fixed number?](https://discuss.elastic.co/t/kql-to-filter-for-documents-where-a-field-exists-and-its-value-is-less-than-a-fixed-number/262385)
**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\ **Replies:** 20\ **Last updated:** [February 5, 2021, 9:45pm UTC](https://discuss.elastic.co/t/kql-to-filter-for-documents-where-a-field-exists-and-its-value-is-less-than-a-fixed-number/262385 "2021-02-05T21:45:16Z")
In Kibana 7.7.1, is it possible to specify a KQL filter that selects only the documents where both of the following conditions are true: Field XYZ exists The value of field XYZ (the same field) is less than some fixed … --- ## [Intermittent exception using high-level-rest-client. Unable to load a DateTransformer](https://discuss.elastic.co/t/intermittent-exception-using-high-level-rest-client-unable-to-load-a-datetransformer/262375)
**Author:** [@Srikar\_Yekollu](https://discuss.elastic.co/u/Srikar_Yekollu)\ **Replies:** 10\ **Last updated:** [February 5, 2021, 9:29pm UTC](https://discuss.elastic.co/t/intermittent-exception-using-high-level-rest-client-unable-to-load-a-datetransformer/262375 "2021-02-05T21:29:42Z")
Elastic Search Version: 7.9.2 Client: Java: elasticsearch-rest-high-level-client We use elastic search on Kubernetes in AWS. We are noticing these errors sporadically in our server logs. When this happens, all searche… --- ## [Linux auditd to ECS mapping](https://discuss.elastic.co/t/linux-auditd-to-ecs-mapping/263150)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 0\ **Last updated:** [February 3, 2021, 4:48pm UTC](https://discuss.elastic.co/t/linux-auditd-to-ecs-mapping/263150 "2021-02-03T16:48:22Z")
hi We got data coming via syslog-\> logstash from certain Linux devices and don't have auditbeats. Is there a logstash pattern, where I can map the auditd fields to ECS (common schema) format? --- ## [Using processor in Filebeat Nginx module](https://discuss.elastic.co/t/using-processor-in-filebeat-nginx-module/263368)
**Author:** [@jz1603](https://discuss.elastic.co/u/jz1603)\ **Replies:** 2\ **Last updated:** [February 5, 2021, 7:47pm UTC](https://discuss.elastic.co/t/using-processor-in-filebeat-nginx-module/263368 "2021-02-05T19:47:02Z")
I am trying to drop some fields on the indices ingested by the filebeat Nginx module. I followed the instructions on the thread https://discuss.elastic.co/t/how-to-use-processors-in-filebeat-haproxys-module/216256/3, bu… --- ## [ES Data node global metadata not found](https://discuss.elastic.co/t/es-data-node-global-metadata-not-found/263452)
**Author:** [@Gratien](https://discuss.elastic.co/u/Gratien)\ **Replies:** 3\ **Last updated:** [February 5, 2021, 7:42pm UTC](https://discuss.elastic.co/t/es-data-node-global-metadata-not-found/263452 "2021-02-05T19:42:04Z")
Hello everyone, I'm working on a marathon hosted cluster (7.6.2) which is not very stable sometimes. Occasionnaly when there is a host failure, I end up with the following on a data node : java.lang.IllegalStateExcept… --- ## [Nodes being dropped from cluster](https://discuss.elastic.co/t/nodes-being-dropped-from-cluster/263161)
**Author:** [@khuang](https://discuss.elastic.co/u/khuang)\ **Replies:** 7\ **Last updated:** [February 5, 2021, 7:20pm UTC](https://discuss.elastic.co/t/nodes-being-dropped-from-cluster/263161 "2021-02-05T19:20:04Z")
I am currently trying to set up a 17 node cluster. 3 master nodes - 4 vCPU, 12 GB RAM, 7 GB Heap 10 data nodes - 15 vCPU, 116 GB RAM, 32 GB Heap 3 ingest nodes - 7 vCPU, 8 GB RAM, 2 GB Heap (Is this enough?) 1 coordi… --- ## [Logstash HTTP input plugin](https://discuss.elastic.co/t/logstash-http-input-plugin/263456)
**Author:** [@TrentB2000](https://discuss.elastic.co/u/TrentB2000)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 6:57pm UTC](https://discuss.elastic.co/t/logstash-http-input-plugin/263456 "2021-02-05T18:57:01Z")
I am attempting to use the logstash HTTP input plugin with my Docker container that I am running Elk in. I am currently using Docker Compose to run my stack and in trying to follow this page (below) I have been unsuc… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1567) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1569)