# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1598 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1599 --- ## [How can I stop cluster from filling my cold nodes with hot data?](https://discuss.elastic.co/t/how-can-i-stop-cluster-from-filling-my-cold-nodes-with-hot-data/261044)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 5\ **Last updated:** [January 19, 2021, 1:11am UTC](https://discuss.elastic.co/t/how-can-i-stop-cluster-from-filling-my-cold-nodes-with-hot-data/261044 "2021-01-19T01:11:56Z")
title really says it all. I just added two cold nodes to my cluster -- these have slow disks and I don't want active indexes on them but I find that ES is treating them the same as the other nodes. both nodes have node… --- ## [I can't edit my deployment because I have too many shards in my cluster](https://discuss.elastic.co/t/i-cant-edit-my-deployment-because-i-have-too-many-shards-in-my-cluster/260774)
**Author:** [@daniel\_at\_gus](https://discuss.elastic.co/u/daniel_at_gus)\ **Replies:** 7\ **Last updated:** [January 19, 2021, 12:32am UTC](https://discuss.elastic.co/t/i-cant-edit-my-deployment-because-i-have-too-many-shards-in-my-cluster/260774 "2021-01-19T00:32:21Z")
Hi, community. Recently I have talked to Elastic Cloud support team and they told me that my cluster fails to edit my deployment because I have too many shards in my cluster. They suggested me to delete unused indexes. … --- ## [Filebeat Cloudtrail metricset breaks and stops returning "s3 log info" when upgrading past 7.9.1](https://discuss.elastic.co/t/filebeat-cloudtrail-metricset-breaks-and-stops-returning-s3-log-info-when-upgrading-past-7-9-1/261302)
**Author:** [@AddChickpeas](https://discuss.elastic.co/u/AddChickpeas)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 12:23am UTC](https://discuss.elastic.co/t/filebeat-cloudtrail-metricset-breaks-and-stops-returning-s3-log-info-when-upgrading-past-7-9-1/261302 "2021-01-19T00:23:51Z")
I was attempting to upgrade filebeat to the latest release from 7.9.0, but am unable to get any version past 7.9.1 to work. Starting with 7.9.2, debug shows filebeat receiving the SQS message, but it doesn't return any … --- ## [Cannot start filebeat because of instance/beat.go error](https://discuss.elastic.co/t/cannot-start-filebeat-because-of-instance-beat-go-error/261472)
**Author:** [@jfasajr](https://discuss.elastic.co/u/jfasajr)\ **Replies:** 9\ **Last updated:** [January 18, 2021, 11:32pm UTC](https://discuss.elastic.co/t/cannot-start-filebeat-because-of-instance-beat-go-error/261472 "2021-01-18T23:32:56Z")
When I run filebeat setup -e It runs through and it is able to get through to the point of installing dashboard for kibana, but then fails due to an error, below: Index setup finished. Loading dashboards (Kibana must b… --- ## [Query on multiple indices and covariance using NEST 7.9+](https://discuss.elastic.co/t/query-on-multiple-indices-and-covariance-using-nest-7-9/261474)
**Author:** [@bramford](https://discuss.elastic.co/u/bramford)\ **Replies:** 0\ **Last updated:** [January 18, 2021, 9:09pm UTC](https://discuss.elastic.co/t/query-on-multiple-indices-and-covariance-using-nest-7-9/261474 "2021-01-18T21:09:00Z")
I'm attempting to search multiple indices using NEST while providing covariance in the same way this topic describes: Query on multiple index using NEST Unfortunately the .Type() method no longer exists in the SearchDes… --- ## [How many RAM does lucene occupy](https://discuss.elastic.co/t/how-many-ram-does-lucene-occupy/261437)
**Author:** [@Hungming\_Chiu](https://discuss.elastic.co/u/Hungming_Chiu)\ **Replies:** 1\ **Last updated:** [January 18, 2021, 10:15pm UTC](https://discuss.elastic.co/t/how-many-ram-does-lucene-occupy/261437 "2021-01-18T22:15:00Z")
Hi there, Any way to know how many RAM does lucene occupy? Thank you --- ## [SQL to ElasticSearch, only new rows?](https://discuss.elastic.co/t/sql-to-elasticsearch-only-new-rows/261476)
**Author:** [@sath](https://discuss.elastic.co/u/sath)\ **Replies:** 2\ **Last updated:** [January 18, 2021, 9:43pm UTC](https://discuss.elastic.co/t/sql-to-elasticsearch-only-new-rows/261476 "2021-01-18T21:43:28Z")
Hello, I'm relatively new to the ELK stack. I'm wondering how I could send data from a SQL table to Elasticsearch in a way that every time it runs, it only sends the rows that are new since the last time it ran. The SQL… --- ## [How to change index status from warm to hot](https://discuss.elastic.co/t/how-to-change-index-status-from-warm-to-hot/261398)
**Author:** [@opouwels](https://discuss.elastic.co/u/opouwels)\ **Replies:** 2\ **Last updated:** [January 18, 2021, 9:24pm UTC](https://discuss.elastic.co/t/how-to-change-index-status-from-warm-to-hot/261398 "2021-01-18T21:24:38Z")
Hi How can I change the index from warm to hot? Regards Oscar --- ## [Delete old Elasticsearch Data Automatically](https://discuss.elastic.co/t/delete-old-elasticsearch-data-automatically/261464)
**Author:** [@Amantha](https://discuss.elastic.co/u/Amantha)\ **Replies:** 1\ **Last updated:** [January 18, 2021, 9:20pm UTC](https://discuss.elastic.co/t/delete-old-elasticsearch-data-automatically/261464 "2021-01-18T21:20:43Z")
I want to delete old elasticserach data automatically. Is there any proper method to do it? Can we delete those data within a preferred time period? --- ## [Need help figuring out AWS role for functionbeat](https://discuss.elastic.co/t/need-help-figuring-out-aws-role-for-functionbeat/261297)
**Author:** [@Jonathan\_Detert](https://discuss.elastic.co/u/Jonathan_Detert)\ **Replies:** 2\ **Last updated:** [January 18, 2021, 9:16pm UTC](https://discuss.elastic.co/t/need-help-figuring-out-aws-role-for-functionbeat/261297 "2021-01-18T21:16:41Z")
https://www.elastic.co/guide/en/beats/functionbeat/7.x/configuration-functionbeat-options.html#functionbeat-role says that I can add a parameter named role to my functionbeat config. Where to add it? I'm guessing it's… --- ## [Elasticsearch repository-azure kubernetes](https://discuss.elastic.co/t/elasticsearch-repository-azure-kubernetes/261473)
**Author:** [@Pmoraes13](https://discuss.elastic.co/u/Pmoraes13)\ **Replies:** 0\ **Last updated:** [January 18, 2021, 8:44pm UTC](https://discuss.elastic.co/t/elasticsearch-repository-azure-kubernetes/261473 "2021-01-18T20:44:51Z")
Hello, someone has using Elasticsearch with repository-azure or Azure storage account for backup the snapshots? I'm trying to configure my kubernetes yml to install azure plugin before pod start but not success. All good… --- ## [Multi match equal both fields](https://discuss.elastic.co/t/multi-match-equal-both-fields/261463)
**Author:** [@seefor](https://discuss.elastic.co/u/seefor)\ **Replies:** 1\ **Last updated:** [January 18, 2021, 7:32pm UTC](https://discuss.elastic.co/t/multi-match-equal-both-fields/261463 "2021-01-18T19:32:20Z")
New to elastic search I have the following search, which works great but I would like to only return when both "result.confidence", "result.severity" = HIGH instead of when either equal HIGH { "size": 10000, … --- ## [Update of field created by ruby script](https://discuss.elastic.co/t/update-of-field-created-by-ruby-script/261459)
**Author:** [@ggab31](https://discuss.elastic.co/u/ggab31)\ **Replies:** 3\ **Last updated:** [January 18, 2021, 6:24pm UTC](https://discuss.elastic.co/t/update-of-field-created-by-ruby-script/261459 "2021-01-18T18:24:33Z")
Hi, I have a logstash ruby filter that creates a few fields composed of two parts in a heartbeat index, this way : ruby { code =\> " temp=Time.new; event.set('time.second', temp.localtime.strftime('%S')); … --- ## [Getting multi-word synonyms used in the search for display](https://discuss.elastic.co/t/getting-multi-word-synonyms-used-in-the-search-for-display/261460)
**Author:** [@julioz](https://discuss.elastic.co/u/julioz)\ **Replies:** 0\ **Last updated:** [January 18, 2021, 6:17pm UTC](https://discuss.elastic.co/t/getting-multi-word-synonyms-used-in-the-search-for-display/261460 "2021-01-18T18:17:20Z")
I am developing a search system using Elasticsearch. In this system, users can register synonyms. When performing a search, in addition to the return of the documents, it is also necessary to display which of the synony… --- ## [Add tag if SNMP poll reaches its timeout](https://discuss.elastic.co/t/add-tag-if-snmp-poll-reaches-its-timeout/261447)
**Author:** [@Andrew22](https://discuss.elastic.co/u/Andrew22)\ **Replies:** 1\ **Last updated:** [January 18, 2021, 6:05pm UTC](https://discuss.elastic.co/t/add-tag-if-snmp-poll-reaches-its-timeout/261447 "2021-01-18T18:05:01Z")
Hello, I have recently started to use the SNMP plugin to poll a few devices and its great the only issue I am having is if the device reaches its timeout Logstash just logs it in its log file and I would like to have it… --- ## [High level rest client aggregations naming](https://discuss.elastic.co/t/high-level-rest-client-aggregations-naming/261458)
**Author:** [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\ **Replies:** 0\ **Last updated:** [January 18, 2021, 5:46pm UTC](https://discuss.elastic.co/t/high-level-rest-client-aggregations-naming/261458 "2021-01-18T17:46:25Z")
I am building a spring boot query builder for my end users. It looks like from the discussions that I am going to have to unpack the search response before sending. It appears the client appends the class info on the agg… --- ## [URL Filed formatter - to get value of other fields using script](https://discuss.elastic.co/t/url-filed-formatter-to-get-value-of-other-fields-using-script/261442)
**Author:** [@gulshann](https://discuss.elastic.co/u/gulshann)\ **Replies:** 2\ **Last updated:** [January 18, 2021, 4:19pm UTC](https://discuss.elastic.co/t/url-filed-formatter-to-get-value-of-other-fields-using-script/261442 "2021-01-18T16:19:54Z")
Continuing the discussion from URL field formatter - get values of other fields: Can You share an example for this. --- ## [Adding buttons in kibana markup visualisations](https://discuss.elastic.co/t/adding-buttons-in-kibana-markup-visualisations/261432)
**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\ **Replies:** 5\ **Last updated:** [January 18, 2021, 4:05pm UTC](https://discuss.elastic.co/t/adding-buttons-in-kibana-markup-visualisations/261432 "2021-01-18T16:05:47Z")
Kibana version : 7.9 I wanted to add button to my mark up visualisation . Is there any short cuts that we add in mark up like square bracket we add to get links . Any way we can bring buttons in that markup visualisati… --- ## [(2021) Can't cURL 9200 from some hosts in network](https://discuss.elastic.co/t/2021-cant-curl-9200-from-some-hosts-in-network/260388)
**Author:** [@brett.b](https://discuss.elastic.co/u/brett.b)\ **Replies:** 8\ **Last updated:** [January 18, 2021, 3:54pm UTC](https://discuss.elastic.co/t/2021-cant-curl-9200-from-some-hosts-in-network/260388 "2021-01-18T15:54:35Z")
Hello everyone, I have seen this question posted in other ways, but a lot of them were about Elasticsearch inside of a docker container. I hope this question is not truly a duplicate. My situation is that I have a DMZ … --- ## [Elasticsearch error](https://discuss.elastic.co/t/elasticsearch-error/260488)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 1\ **Last updated:** [January 9, 2021, 7:08am UTC](https://discuss.elastic.co/t/elasticsearch-error/260488 "2021-01-09T07:08:44Z")
Hello there, I have three node cluster implementation and I have noticed some error when I started elasticsearch for master node. \[2021-01-07T16:07:35,341\]\[WARN \]\[o.e.x.m.e.l.LocalExporter\] \[master\] unexpected error w… --- ## [How to unnest - flatten this answer](https://discuss.elastic.co/t/how-to-unnest-flatten-this-answer/261419)
**Author:** [@brunet](https://discuss.elastic.co/u/brunet)\ **Replies:** 2\ **Last updated:** [January 18, 2021, 3:48pm UTC](https://discuss.elastic.co/t/how-to-unnest-flatten-this-answer/261419 "2021-01-18T15:48:09Z")
Dear community, I need to transform the ES response to flatten the received data, i would like to make a radar type viz but i'm not able to unnest / flatten it. I have this answer (cleaned it a bit)... "aggregations"… --- ## [Group permission inconsistency between Kibana and Elasticsearch docker images](https://discuss.elastic.co/t/group-permission-inconsistency-between-kibana-and-elasticsearch-docker-images/261051)
**Author:** [@Aaron\_Norton](https://discuss.elastic.co/u/Aaron_Norton)\ **Replies:** 1\ **Last updated:** [January 18, 2021, 3:07pm UTC](https://discuss.elastic.co/t/group-permission-inconsistency-between-kibana-and-elasticsearch-docker-images/261051 "2021-01-18T15:07:45Z")
I noticed the latest Kibana and Elasticsearch docker images (7.10.0) have a difference that caused me issues when trying to change ownership of my bind mounted configuration and logging directories. The Elasticsearch doc… --- ## [Need help in configuring TLS/SSL for ELK with 3rd party certificates (comodo)](https://discuss.elastic.co/t/need-help-in-configuring-tls-ssl-for-elk-with-3rd-party-certificates-comodo/259745)
**Author:** [@Suddhasil\_Sarkar](https://discuss.elastic.co/u/Suddhasil_Sarkar)\ **Replies:** 2\ **Last updated:** [January 18, 2021, 3:04pm UTC](https://discuss.elastic.co/t/need-help-in-configuring-tls-ssl-for-elk-with-3rd-party-certificates-comodo/259745 "2021-01-18T15:04:47Z")
Hi Team, Need your help, I was successfully able to manage/configure TLS/SSL with self signed pk12 certs. Now I purchased cert(pem) single pem file with SAN ( having 43 hosts DNS and ips) .I have pem format cert, cert f… --- ## [CircuitBreakingException: \[parent\] Data too large](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large/260792)
**Author:** [@chaitra\_hegde](https://discuss.elastic.co/u/chaitra_hegde)\ **Replies:** 4\ **Last updated:** [January 18, 2021, 3:00pm UTC](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large/260792 "2021-01-18T15:00:34Z")
Hi, I am using Elasticsearch 7.8.0 in k8s environment. I have 3 master, 2 data and 3 ingest nodes. I am getting circuit breaker exception on one of the data node. Below are the details: java -version openjdk version… --- ## [Avoid loggin on a pipeline output](https://discuss.elastic.co/t/avoid-loggin-on-a-pipeline-output/261438)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 0\ **Last updated:** [January 18, 2021, 2:34pm UTC](https://discuss.elastic.co/t/avoid-loggin-on-a-pipeline-output/261438 "2021-01-18T14:34:39Z")
Hi, Im getting an error on a pipeline, the error doesnt affect the indexing of the data, but is filling the docker logs, is there a way to avoid this error from being shown? -the output plugin is elasticsearch -I dont … --- ## [Could not index '1' records: listener timeout after waiting for \[30000\] ms in Single node](https://discuss.elastic.co/t/could-not-index-1-records-listener-timeout-after-waiting-for-30000-ms-in-single-node/261425)
**Author:** [@ARULAMUTHAN](https://discuss.elastic.co/u/ARULAMUTHAN)\ **Replies:** 2\ **Last updated:** [January 18, 2021, 2:10pm UTC](https://discuss.elastic.co/t/could-not-index-1-records-listener-timeout-after-waiting-for-30000-ms-in-single-node/261425 "2021-01-18T14:10:33Z")
Getting below ERROR in the single node ELK. Configuration of elasticsearch.yml cluster.name: \*\*\*\*\*\*-elasticsearch node.name: \*\*\*\*\*\*Elastic-1 path.data: /data00/\*\*\*\*\*Elastic/data path.logs: /data00/\*\*\*\*\*Elastic/log netw… --- ## [System.cpu.total.norm.pct different of the sum system.process.cpu.total.norm.pct](https://discuss.elastic.co/t/system-cpu-total-norm-pct-different-of-the-sum-system-process-cpu-total-norm-pct/261130)
**Author:** [@Altamir\_Dias](https://discuss.elastic.co/u/Altamir_Dias)\ **Replies:** 3\ **Last updated:** [January 18, 2021, 1:44pm UTC](https://discuss.elastic.co/t/system-cpu-total-norm-pct-different-of-the-sum-system-process-cpu-total-norm-pct/261130 "2021-01-18T13:44:23Z")
Hello Guys, I using a ELK STACK with version 7.7.1 and I'm testing metricbeat to enviroment observability, but when I need view data about CPU process the calcule not close. Why system.cpu.total.norm.pct its not the … --- ## [Audit all users login to kibana](https://discuss.elastic.co/t/audit-all-users-login-to-kibana/261264)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 4\ **Last updated:** [January 18, 2021, 1:01pm UTC](https://discuss.elastic.co/t/audit-all-users-login-to-kibana/261264 "2021-01-18T13:01:39Z")
Hi All, We are planning to give Kibana access to other users. Now we need to monitor what all activities they are doing, who all logged in to Kibana and also if we can monitor whether same user id is getting user from … --- ## [Alerts based on increase in logged value, rather than specific threshold](https://discuss.elastic.co/t/alerts-based-on-increase-in-logged-value-rather-than-specific-threshold/261163)
**Author:** [@Christopher1](https://discuss.elastic.co/u/Christopher1)\ **Replies:** 2\ **Last updated:** [January 18, 2021, 12:48pm UTC](https://discuss.elastic.co/t/alerts-based-on-increase-in-logged-value-rather-than-specific-threshold/261163 "2021-01-18T12:48:54Z")
Hi there, I am quite new to the Elastic Stack, as is my company. We are attempting to build a centralized logging and alerting system, building dashboards and alerts in Kibana. Currently we have AWS Lambda functions ship… --- ## [Logstash drop unnecessary fields ( ip2location plugin )](https://discuss.elastic.co/t/logstash-drop-unnecessary-fields-ip2location-plugin/259694)
**Author:** [@Mohammad\_Mousavi](https://discuss.elastic.co/u/Mohammad_Mousavi)\ **Replies:** 6\ **Last updated:** [January 18, 2021, 11:42am UTC](https://discuss.elastic.co/t/logstash-drop-unnecessary-fields-ip2location-plugin/259694 "2021-01-18T11:42:46Z")
Hi, We use ip2locaion database and plugin to detect client's ISP. There are multiple versions of this database with different information but we bought the basic version with only ISP info. How can I prevent logstash t… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1597) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1599)