# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1595 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1596 --- ## [How to reduce index mapping fields while keeping data continuity](https://discuss.elastic.co/t/how-to-reduce-index-mapping-fields-while-keeping-data-continuity/260376)
**Author:** [@NadavKal](https://discuss.elastic.co/u/NadavKal)\ **Replies:** 4\ **Last updated:** [January 20, 2021, 1:28pm UTC](https://discuss.elastic.co/t/how-to-reduce-index-mapping-fields-while-keeping-data-continuity/260376 "2021-01-20T13:28:17Z")
my issue is like this. I am trying to switch a dynamic mapping to static without impacting the users. We have many text and keyword fields which are redundant. the trick is... if field A has both A (text) and A.keywor… --- ## [Elastic Search Query help](https://discuss.elastic.co/t/elastic-search-query-help/261656)
**Author:** [@Pazhanikanthan](https://discuss.elastic.co/u/Pazhanikanthan)\ **Replies:** 0\ **Last updated:** [January 20, 2021, 1:26pm UTC](https://discuss.elastic.co/t/elastic-search-query-help/261656 "2021-01-20T13:26:02Z")
Hello experts I have an index with accepts docs in JSON format. I have a specific JSON structure. { "title": "ABC", "admissions": \[ { "location": "Sydney", "year": 2020 }, { "location": "Melbourne", "year": 20… --- ## [Can filebeat be can initialed using initcontiner to forward logs](https://discuss.elastic.co/t/can-filebeat-be-can-initialed-using-initcontiner-to-forward-logs/261649)
**Author:** [@srini54](https://discuss.elastic.co/u/srini54)\ **Replies:** 0\ **Last updated:** [January 20, 2021, 12:54pm UTC](https://discuss.elastic.co/t/can-filebeat-be-can-initialed-using-initcontiner-to-forward-logs/261649 "2021-01-20T12:54:48Z")
We are exloring options to trigger the filebeat process as part of an initContainer to push the tomcat logs. Is it possible to initialize scirpt to copy tomcat log to another volume and push it to logstash/elastic. Plea… --- ## [Remove empty buckets from the query response](https://discuss.elastic.co/t/remove-empty-buckets-from-the-query-response/261648)
**Author:** [@wedkarz014](https://discuss.elastic.co/u/wedkarz014)\ **Replies:** 0\ **Last updated:** [January 20, 2021, 12:49pm UTC](https://discuss.elastic.co/t/remove-empty-buckets-from-the-query-response/261648 "2021-01-20T12:49:40Z")
Hi, do you have any idea how i can remove empty buckets from my response? My query looks like that: GET kubernetes-prod-metrics/\_search { "\_source": \[ "@timestamp", "kubernetes.namespace", "kubernetes.con… --- ## [Sane design thougts?](https://discuss.elastic.co/t/sane-design-thougts/261502)
**Author:** [@Andreas\_Falk](https://discuss.elastic.co/u/Andreas_Falk)\ **Replies:** 4\ **Last updated:** [January 20, 2021, 12:41pm UTC](https://discuss.elastic.co/t/sane-design-thougts/261502 "2021-01-20T12:41:56Z")
Hi, This is a x-post from Slack, but I think that it is perhaps easier to have a discussion here. :slight\_smile: We are setting up a new logcluster that should handle .. logs.. :slight\_smile: from our infrastructure mo… --- ## [Dissector mapping, pattern not found in Logstash](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-in-logstash/261210)
**Author:** [@Sharma3007](https://discuss.elastic.co/u/Sharma3007)\ **Replies:** 0\ **Last updated:** [January 15, 2021, 5:50am UTC](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-in-logstash/261210 "2021-01-15T05:50:25Z")
Hi Team, After a long time I am getting below error in my logstash config. \["beats\_input\_codec\_plain\_applied", "\_dissectfailure"\], "input"=\>{"type"=\>"log"}}} \[2021-01-15T04:02:07,055\]\[WARN \]\[org.logstash.dissect.Disse… --- ## [Dissector mapping, pattern not found in Logstash](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-in-logstash/261444)
**Author:** [@Sharma3007](https://discuss.elastic.co/u/Sharma3007)\ **Replies:** 7\ **Last updated:** [January 20, 2021, 12:29pm UTC](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-in-logstash/261444 "2021-01-20T12:29:32Z")
Hi Team, I am getting Dissector mapping, pattern not found in Logstash while start logstash. --- ## [Fleet agent tls settings](https://discuss.elastic.co/t/fleet-agent-tls-settings/261191)
**Author:** [@gregorys](https://discuss.elastic.co/u/gregorys)\ **Replies:** 8\ **Last updated:** [January 20, 2021, 12:09pm UTC](https://discuss.elastic.co/t/fleet-agent-tls-settings/261191 "2021-01-20T12:09:10Z")
Hi, I installed a fleet agent, its state in Kibana is online and its receiving logs over the UDP port configured in an integration. However I don't see a data stream, looks like it's not sending these logs to elasticse… --- ## [How to set elasticsearch jvm heap size?](https://discuss.elastic.co/t/how-to-set-elasticsearch-jvm-heap-size/261611)
**Author:** [@wangxr1985](https://discuss.elastic.co/u/wangxr1985)\ **Replies:** 10\ **Last updated:** [January 20, 2021, 11:54am UTC](https://discuss.elastic.co/t/how-to-set-elasticsearch-jvm-heap-size/261611 "2021-01-20T11:54:57Z")
If I have a 16C64G machine and install CentOS7.6 on it, There is 62gb available memory. total used free shared buff/cache available Mem: 62 34 0 … --- ## [Elastic Agent service stops after launching but doesn't throw any error in command line](https://discuss.elastic.co/t/elastic-agent-service-stops-after-launching-but-doesnt-throw-any-error-in-command-line/260547)
**Author:** [@icious](https://discuss.elastic.co/u/icious)\ **Replies:** 9\ **Last updated:** [January 20, 2021, 11:48am UTC](https://discuss.elastic.co/t/elastic-agent-service-stops-after-launching-but-doesnt-throw-any-error-in-command-line/260547 "2021-01-20T11:48:27Z")
Hi, I set up a Fleet environment and tested multiple integrations of Elastic Agent on Linux and Windows machines without any problem, but there is a specific Windows machine where it does not work, and I couldn't find t… --- ## [Why elasticsearch index log size larger than the actual size on the server?](https://discuss.elastic.co/t/why-elasticsearch-index-log-size-larger-than-the-actual-size-on-the-server/261636)
**Author:** [@xax](https://discuss.elastic.co/u/xax)\ **Replies:** 0\ **Last updated:** [January 20, 2021, 11:29am UTC](https://discuss.elastic.co/t/why-elasticsearch-index-log-size-larger-than-the-actual-size-on-the-server/261636 "2021-01-20T11:29:18Z")
If you look picture no.1 my server have 64G and used 39G. Container elasticsearch and logstash use like 2.2G, docker image 3.4G = 5.6 G. Then the volume use like 30.7 G. Meanwhile, if i check my index size at index … --- ## [How to take filter and selected timeframe from Visualize to Logs view?](https://discuss.elastic.co/t/how-to-take-filter-and-selected-timeframe-from-visualize-to-logs-view/259460)
**Author:** [@bluepuma77](https://discuss.elastic.co/u/bluepuma77)\ **Replies:** 6\ **Last updated:** [January 20, 2021, 11:22am UTC](https://discuss.elastic.co/t/how-to-take-filter-and-selected-timeframe-from-visualize-to-logs-view/259460 "2021-01-20T11:22:22Z")
Hi all, I have identified an anomaly (strange user behavior) in my logs with Visualize in Kibana. How can I now switch to log view to see the same matching log entries and details? Take the filter and selected timefra… --- ## [Endpoint Agent two host showing in logs-\* per host](https://discuss.elastic.co/t/endpoint-agent-two-host-showing-in-logs-per-host/261551)
**Author:** [@The1WhoPrtNocks](https://discuss.elastic.co/u/The1WhoPrtNocks)\ **Replies:** 2\ **Last updated:** [January 20, 2021, 10:58am UTC](https://discuss.elastic.co/t/endpoint-agent-two-host-showing-in-logs-per-host/261551 "2021-01-20T10:58:51Z")
Re-created with elastic-agent tag for better visibility. Hi, I have recently been rolling out the Endpoint agent to some host for testing. Within the fleet agents tab, there is a single entry for each host in the form… --- ## [FiltersAggregation does not use query filter and/or parent aggregation filter](https://discuss.elastic.co/t/filtersaggregation-does-not-use-query-filter-and-or-parent-aggregation-filter/261629)
**Author:** [@panthony](https://discuss.elastic.co/u/panthony)\ **Replies:** 0\ **Last updated:** [January 20, 2021, 10:32am UTC](https://discuss.elastic.co/t/filtersaggregation-does-not-use-query-filter-and-or-parent-aggregation-filter/261629 "2021-01-20T10:32:26Z")
Hi, I'm not sure if the issue was already reported but I couldn't find anything. It appears that the FiltersAggregation does not leverage the parent's aggregation filter and/or the query filter. Using: PUT /logs/\_bul… --- ## [Error parsing json](https://discuss.elastic.co/t/error-parsing-json/261618)
**Author:** [@shoaib\_akram](https://discuss.elastic.co/u/shoaib_akram)\ **Replies:** 0\ **Last updated:** [January 20, 2021, 7:49am UTC](https://discuss.elastic.co/t/error-parsing-json/261618 "2021-01-20T07:49:03Z")
Hi i am getting the following errors while ingesting urls into elasticsearch through logstash. Data is ingesting properly but i am getting these errors in log files please help me thanks, Error parsing json {:source=\>"… --- ## [Looks like you either have a bad certificate, an invalid key or your private key was not in PKCS8 format in logstash](https://discuss.elastic.co/t/looks-like-you-either-have-a-bad-certificate-an-invalid-key-or-your-private-key-was-not-in-pkcs8-format-in-logstash/261627)
**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Replies:** 0\ **Last updated:** [January 20, 2021, 10:12am UTC](https://discuss.elastic.co/t/looks-like-you-either-have-a-bad-certificate-an-invalid-key-or-your-private-key-was-not-in-pkcs8-format-in-logstash/261627 "2021-01-20T10:12:37Z")
Hi Team, Im using below configuration in logstash beats and im getting below error, Could anyone help to resolve this issue, input { beats { port =\> 5044 host =\> server" … --- ## [Enhanced Table Visualization](https://discuss.elastic.co/t/enhanced-table-visualization/255004)
**Author:** [@thuhaa](https://discuss.elastic.co/u/thuhaa)\ **Replies:** 11\ **Last updated:** [January 20, 2021, 9:16am UTC](https://discuss.elastic.co/t/enhanced-table-visualization/255004 "2021-01-20T09:16:01Z")
Hi @fbaligand, I'm very thank you for creating Kibana Enhanced Table Plugin. But I wonder why about the order of columns when I used split cols function. Example: The data of datetime field is 2020-11-05, 2020-11-06,… --- ## [Filbeat not publishing logs to logstash](https://discuss.elastic.co/t/filbeat-not-publishing-logs-to-logstash/261578)
**Author:** [@ranjini](https://discuss.elastic.co/u/ranjini)\ **Replies:** 1\ **Last updated:** [January 20, 2021, 9:13am UTC](https://discuss.elastic.co/t/filbeat-not-publishing-logs-to-logstash/261578 "2021-01-20T09:13:06Z")
filebeat logs 2021-01-19T17:07:14.953Z INFO \[publisher\_pipeline\_output\] pipeline/output.go:151 Connection to backoff(async(tcp://logsrv.example-elk.local:5044)) established 2021-01-19T17:07:14.978Z … --- ## [Understand log4j default strategy](https://discuss.elastic.co/t/understand-log4j-default-strategy/261622)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 0\ **Last updated:** [January 20, 2021, 9:04am UTC](https://discuss.elastic.co/t/understand-log4j-default-strategy/261622 "2021-01-20T09:04:30Z")
Hello all ! I'm not sure about my understanding of the default Elasticsearch log4j strategy : ######## Server JSON ############################ appender.rolling.type = RollingFile appender.rolling.name = rolling appen… --- ## [Create Kibana saved objects API documentation error](https://discuss.elastic.co/t/create-kibana-saved-objects-api-documentation-error/261582)
**Author:** [@ewolfman](https://discuss.elastic.co/u/ewolfman)\ **Replies:** 1\ **Last updated:** [January 20, 2021, 9:01am UTC](https://discuss.elastic.co/t/create-kibana-saved-objects-api-documentation-error/261582 "2021-01-20T09:01:25Z")
Hi, It looks like there is a bug in the documentation for Create saved objects API. If you click on the "Copy as cURL" the copied example has a couple of issues: Missing closing quatation marks after "my-pattern" Dup… --- ## [Pipeline processor to convert nested array to documents while reindexing](https://discuss.elastic.co/t/pipeline-processor-to-convert-nested-array-to-documents-while-reindexing/261547)
**Author:** [@darshan\_ambre](https://discuss.elastic.co/u/darshan_ambre)\ **Replies:** 5\ **Last updated:** [January 20, 2021, 8:17am UTC](https://discuss.elastic.co/t/pipeline-processor-to-convert-nested-array-to-documents-while-reindexing/261547 "2021-01-20T08:17:33Z")
Hi Team, Need a solution to take data from source index and have an ingest pipeline to extract data from array in each document of source index as individual document to destination index. e.g. main index data: {… --- ## [I/o timeout filebeat when send data to logstash](https://discuss.elastic.co/t/i-o-timeout-filebeat-when-send-data-to-logstash/261412)
**Author:** [@Eti\_Huri](https://discuss.elastic.co/u/Eti_Huri)\ **Replies:** 4\ **Last updated:** [January 20, 2021, 7:49am UTC](https://discuss.elastic.co/t/i-o-timeout-filebeat-when-send-data-to-logstash/261412 "2021-01-20T07:49:27Z")
Hi all:) I have my logstash vm and my application vm, they don't run in the same subnet I am trying send logs from my vm application to logstash vm this is my filebeat.yml filebeat.inputs: - type: log p… --- ## [Rolling upgrade: How many times should I flush?](https://discuss.elastic.co/t/rolling-upgrade-how-many-times-should-i-flush/260907)
**Author:** [@Dennis1](https://discuss.elastic.co/u/Dennis1)\ **Replies:** 13\ **Last updated:** [January 20, 2021, 7:42am UTC](https://discuss.elastic.co/t/rolling-upgrade-how-many-times-should-i-flush/260907 "2021-01-20T07:42:42Z")
If I follow the steps in the Rolling Upgrade docs in the order they're written, it seems to suggest performing a flush for every node I upgrade in my cluster. Is this really necessary, or would performing the flush once… --- ## [Log stash not loading exact number of records in elasticsearch and on every hit results are changing](https://discuss.elastic.co/t/log-stash-not-loading-exact-number-of-records-in-elasticsearch-and-on-every-hit-results-are-changing/261266)
**Author:** [@ocmvin](https://discuss.elastic.co/u/ocmvin)\ **Replies:** 1\ **Last updated:** [January 20, 2021, 7:07am UTC](https://discuss.elastic.co/t/log-stash-not-loading-exact-number-of-records-in-elasticsearch-and-on-every-hit-results-are-changing/261266 "2021-01-20T07:07:05Z")
Problem statement : Logstash is not loading all records from Database to elasticsearch correctly and everytime I hit same api gets different results (However sometimes correct but changes on every hit and shows only subs… --- ## [Creating Kibana watcher if two field values has been occured more than 2 times in a given interval of time](https://discuss.elastic.co/t/creating-kibana-watcher-if-two-field-values-has-been-occured-more-than-2-times-in-a-given-interval-of-time/260826)
**Author:** [@lokeshbabloo](https://discuss.elastic.co/u/lokeshbabloo)\ **Replies:** 3\ **Last updated:** [January 20, 2021, 5:17am UTC](https://discuss.elastic.co/t/creating-kibana-watcher-if-two-field-values-has-been-occured-more-than-2-times-in-a-given-interval-of-time/260826 "2021-01-20T05:17:38Z")
Hi , Can anyone please help me on this scenario to create an alert I am having a log events like the following \<#\> 20200806 17:04:23.261 280018000 EV.WRN \[ MVINB-LSL2.T1G1\_WEBSVR1 main.main TSP1.T1G1\_WEBSVR1 \] Failed … --- ## [Metricbeat prometheus module collector metricset escaping](https://discuss.elastic.co/t/metricbeat-prometheus-module-collector-metricset-escaping/261100)
**Author:** [@4orty](https://discuss.elastic.co/u/4orty)\ **Replies:** 4\ **Last updated:** [January 20, 2021, 5:09am UTC](https://discuss.elastic.co/t/metricbeat-prometheus-module-collector-metricset-escaping/261100 "2021-01-20T05:09:29Z")
Hi, i'm using metricbeat 7.10.1 and i want to get data with prometheus module(golang prometheus client) and send data to kafka output. Here's my yaml file. metricbeat.yml: |- metricbeat.autodiscover: provid… --- ## [Unable to create primary shard in hot-1 and replica shard in hot-2](https://discuss.elastic.co/t/unable-to-create-primary-shard-in-hot-1-and-replica-shard-in-hot-2/261606)
**Author:** [@aris\_lawrence](https://discuss.elastic.co/u/aris_lawrence)\ **Replies:** 5\ **Last updated:** [January 20, 2021, 4:45am UTC](https://discuss.elastic.co/t/unable-to-create-primary-shard-in-hot-1-and-replica-shard-in-hot-2/261606 "2021-01-20T04:45:17Z")
Elasticsearch version 7.7.1 We have the following setup in our elastic environment. 3 master only 2 ingest only 2 hot nodes (hot-1-p1 and hot-2-p1) 2 warm nodes (warm-1-p1 and warm-2-p1) 1 cold node (cold-p1) mast… --- ## [Get total no. of buckets using composite aggregation](https://discuss.elastic.co/t/get-total-no-of-buckets-using-composite-aggregation/261607)
**Author:** [@shreedhan](https://discuss.elastic.co/u/shreedhan)\ **Replies:** 0\ **Last updated:** [January 20, 2021, 1:25am UTC](https://discuss.elastic.co/t/get-total-no-of-buckets-using-composite-aggregation/261607 "2021-01-20T01:25:37Z")
Is there a way to get total no. of buckets using composite aggregation. I see there's a question asked almost 2 years ago https://discuss.elastic.co/t/composite-aggregation-buckets-total-count/137156/2. Has this changed?… --- ## [How to search with analyzed text](https://discuss.elastic.co/t/how-to-search-with-analyzed-text/261509)
**Author:** [@Myang\_G](https://discuss.elastic.co/u/Myang_G)\ **Replies:** 2\ **Last updated:** [January 20, 2021, 1:19am UTC](https://discuss.elastic.co/t/how-to-search-with-analyzed-text/261509 "2021-01-20T01:19:35Z")
Hi. I'd like to know if there's a way to use analyzed text when querying. The specific requirement is to search for a matched string in 'term' field && the document's 'term\_length' field should be less than equal to t… --- ## [Metricbeat/K8s: "error getting group status: open /proc/\/cgroup"](https://discuss.elastic.co/t/metricbeat-k8s-error-getting-group-status-open-proc-pid-cgroup/255371)
**Author:** [@jwhitehead](https://discuss.elastic.co/u/jwhitehead)\ **Replies:** 9\ **Last updated:** [January 20, 2021, 1:17am UTC](https://discuss.elastic.co/t/metricbeat-k8s-error-getting-group-status-open-proc-pid-cgroup/255371 "2021-01-20T01:17:18Z")
Running Metricbeat on AKS v1.16.3, seeing the following error in logs: instance/metrics.go:285 error getting group status: open /proc/\/cgroup: no such file or directory" I'm new to beats and, after several hours o… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1594) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1596)