# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1606 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1607 --- ## [Elasticsearch BulkRequestHandler listener callback execution](https://discuss.elastic.co/t/elasticsearch-bulkrequesthandler-listener-callback-execution/260978)
**Author:** [@Faiz\_Ahmed\_Mushtak\_H](https://discuss.elastic.co/u/Faiz_Ahmed_Mushtak_H)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 10:48am UTC](https://discuss.elastic.co/t/elasticsearch-bulkrequesthandler-listener-callback-execution/260978 "2021-01-13T10:48:55Z")
In line https://github.com/elastic/elasticsearch/blob/master/server/src/main/java/org/elasticsearch/action/bulk/BulkRequestHandler.java#L58 Curious why the semaphore is acquired after the beforeBulk callback? While not … --- ## [Create a new metric for metricbeat](https://discuss.elastic.co/t/create-a-new-metric-for-metricbeat/260977)
**Author:** [@MatteoM](https://discuss.elastic.co/u/MatteoM)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 10:48am UTC](https://discuss.elastic.co/t/create-a-new-metric-for-metricbeat/260977 "2021-01-13T10:48:50Z")
Hi there! I'm new in the forum and even to elasticsearch and kibana. For an university project I have to monitor several docker container created with marathon. Initially I've used zabbix to get the docker metrics for… --- ## [Auditbeat socket dataset doesn't correlate process info](https://discuss.elastic.co/t/auditbeat-socket-dataset-doesnt-correlate-process-info/260844)
**Author:** [@bolemebrige](https://discuss.elastic.co/u/bolemebrige)\ **Replies:** 4\ **Last updated:** [January 13, 2021, 10:08am UTC](https://discuss.elastic.co/t/auditbeat-socket-dataset-doesnt-correlate-process-info/260844 "2021-01-13T10:08:49Z")
Why are some events in my socket dataset missing process info? --- ## [Indices.breaker.total.use\_real\_memory or search.check\_buckets\_step\_size  didn't work](https://discuss.elastic.co/t/indices-breaker-total-use-real-memory-or-search-check-buckets-step-size-didnt-work/260945)
**Author:** [@liwanjie](https://discuss.elastic.co/u/liwanjie)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 7:38am UTC](https://discuss.elastic.co/t/indices-breaker-total-use-real-memory-or-search-check-buckets-step-size-didnt-work/260945 "2021-01-13T07:38:19Z")
I always thought that with this new parameter, requests for too many buckets should be rejected。But I tested it today, making two requests and creating hundreds of thousands of buckets per request。In the end, the machine… --- ## [Bar Chart X-Axis Text Alignment](https://discuss.elastic.co/t/bar-chart-x-axis-text-alignment/260667)
**Author:** [@nameisnotimportant](https://discuss.elastic.co/u/nameisnotimportant)\ **Replies:** 3\ **Last updated:** [January 13, 2021, 9:44am UTC](https://discuss.elastic.co/t/bar-chart-x-axis-text-alignment/260667 "2021-01-13T09:44:54Z")
Hi, How do i set the text alignment on the X-Axis to vertical ? This bar chart created using Date Histogram where minimum interval = Day. I further aggregate the data using Split series and my Sub aggregation type is '… --- ## [All shards failed - 400 happens on certain indexes](https://discuss.elastic.co/t/all-shards-failed-400-happens-on-certain-indexes/260960)
**Author:** [@Yoav\_Alroy](https://discuss.elastic.co/u/Yoav_Alroy)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 9:26am UTC](https://discuss.elastic.co/t/all-shards-failed-400-happens-on-certain-indexes/260960 "2021-01-13T09:26:06Z")
Hi, A bit of a background - We are using ElasticSearch with index per client for search engine. Now we let the user have several types of search terms that one of them is "search by id" where we focus the search to cer… --- ## [Is it possible to fetch count of total number of docs that qualify an aggregation condition in elasticsearch?](https://discuss.elastic.co/t/is-it-possible-to-fetch-count-of-total-number-of-docs-that-qualify-an-aggregation-condition-in-elasticsearch/260958)
**Author:** [@yash.tandon](https://discuss.elastic.co/u/yash.tandon)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 9:11am UTC](https://discuss.elastic.co/t/is-it-possible-to-fetch-count-of-total-number-of-docs-that-qualify-an-aggregation-condition-in-elasticsearch/260958 "2021-01-13T09:11:17Z")
--- ## [Discovery configuration changes in 7.x](https://discuss.elastic.co/t/discovery-configuration-changes-in-7-x/260522)
**Author:** [@srikanth\_k](https://discuss.elastic.co/u/srikanth_k)\ **Replies:** 6\ **Last updated:** [January 13, 2021, 9:33am UTC](https://discuss.elastic.co/t/discovery-configuration-changes-in-7-x/260522 "2021-01-13T09:33:18Z")
Before an upgrade to 7.x, why is it required to set the below value discovery.zen.ping.unicast.hosts ? " After the cluster forms successfully for the first time, remove the cluster.initial\_master\_nodes setting from eac… --- ## [Hey i want to add some text into my message can anybody help me how to do it?](https://discuss.elastic.co/t/hey-i-want-to-add-some-text-into-my-message-can-anybody-help-me-how-to-do-it/260321)
**Author:** [@jolaniya](https://discuss.elastic.co/u/jolaniya)\ **Replies:** 4\ **Last updated:** [January 13, 2021, 8:51am UTC](https://discuss.elastic.co/t/hey-i-want-to-add-some-text-into-my-message-can-anybody-help-me-how-to-do-it/260321 "2021-01-13T08:51:23Z")
Hey i want to add some text into my message can anybody help me how to do it? --- ## [What value adds Data Streams vs Index Alias for time series data](https://discuss.elastic.co/t/what-value-adds-data-streams-vs-index-alias-for-time-series-data/260948)
**Author:** [@ismarslomic](https://discuss.elastic.co/u/ismarslomic)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 7:51am UTC](https://discuss.elastic.co/t/what-value-adds-data-streams-vs-index-alias-for-time-series-data/260948 "2021-01-13T07:51:50Z")
I'm struggling to understand what benefits Data Streams brings to the table, compared with Index Alias for time series data? Are there any performance (i.e indexing and querying) benefits? --- ## [Invalid format: \[yyyy-MM-ddTHH:mm:ssZ\]: Unknown pattern letter: T"](https://discuss.elastic.co/t/invalid-format-yyyy-mm-ddthhssz-unknown-pattern-letter-t/260874)
**Author:** [@vaclav1](https://discuss.elastic.co/u/vaclav1)\ **Replies:** 2\ **Last updated:** [January 13, 2021, 7:45am UTC](https://discuss.elastic.co/t/invalid-format-yyyy-mm-ddthhssz-unknown-pattern-letter-t/260874 "2021-01-13T07:45:30Z")
Hello team, strange thing happened. I have following mapping for the field in els with multiple formats: "createdAt" : { "type" : "date", "format" : "yyyy-MM-dd HH:mm:ssZ||yyyy-MM-dd… --- ## [Filebeat docker container with python 3. How to?](https://discuss.elastic.co/t/filebeat-docker-container-with-python-3-how-to/260946)
**Author:** [@Sreekanth\_Mannari](https://discuss.elastic.co/u/Sreekanth_Mannari)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 7:42am UTC](https://discuss.elastic.co/t/filebeat-docker-container-with-python-3-how-to/260946 "2021-01-13T07:42:26Z")
docker run docker.elastic.co/beats/filebeat:7.10.1 When I exec into above container and check Python version it is 2.7.5 How can I upgrade the python version within container to use 3.x Or is there any other image wit… --- ## [If condition regex error](https://discuss.elastic.co/t/if-condition-regex-error/260939)
**Author:** [@nyquillus](https://discuss.elastic.co/u/nyquillus)\ **Replies:** 1\ **Last updated:** [January 13, 2021, 7:29am UTC](https://discuss.elastic.co/t/if-condition-regex-error/260939 "2021-01-13T07:29:02Z")
Hi, I created a working logstash.conf with if/else conditions. Now I'm trying to implement regex to make the filters less messy. The current filter is like this: filter { if \[tag\] == /^\[a|b|c\]\*$/ { muta… --- ## [Error response code 503](https://discuss.elastic.co/t/error-response-code-503/260940)
**Author:** [@Tabriz](https://discuss.elastic.co/u/Tabriz)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 6:48am UTC](https://discuss.elastic.co/t/error-response-code-503/260940 "2021-01-13T06:48:10Z")
1 on kibana web interface appears that error message \> No result data 2 on redhat 6 logstash service down automatically 3 ithere are n the logstash log file errors a)too many attempts at sending even,dropping b)ret… --- ## [What happens when decommission a node?](https://discuss.elastic.co/t/what-happens-when-decommission-a-node/260938)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 6:25am UTC](https://discuss.elastic.co/t/what-happens-when-decommission-a-node/260938 "2021-01-13T06:25:35Z")
I just decommissioned a node from my cluster. I noticed there are many threads (15-20) doing the shard relocation, which is great. After about 30 minutes, the rebalancing threads dropped down to 3, which is my cluster … --- ## [Scripted field](https://discuss.elastic.co/t/scripted-field/260675)
**Author:** [@Jerry\_Yap](https://discuss.elastic.co/u/Jerry_Yap)\ **Replies:** 5\ **Last updated:** [January 13, 2021, 6:06am UTC](https://discuss.elastic.co/t/scripted-field/260675 "2021-01-13T06:06:43Z")
Hi all, My index fields consists of index\_name (containing P01, P02) X (numbers) How can i scripted the field to display the subtracted result of P01 of X - P02 of X? Thanks in advance. --- ## [Unable to restrict duplicate documents using http\_poller](https://discuss.elastic.co/t/unable-to-restrict-duplicate-documents-using-http-poller/260511)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 0\ **Last updated:** [January 8, 2021, 8:06am UTC](https://discuss.elastic.co/t/unable-to-restrict-duplicate-documents-using-http-poller/260511 "2021-01-08T08:06:55Z")
Hi All, I have been trying to ingest some, time series data into elasticsearch using logstash http poller plugin. my data is from a monitoring tool which capture the parameters like hostname, memory usage, cpu load, s… --- ## [No answers for bulk requests](https://discuss.elastic.co/t/no-answers-for-bulk-requests/260933)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 5:18am UTC](https://discuss.elastic.co/t/no-answers-for-bulk-requests/260933 "2021-01-13T05:18:46Z")
Hi, as I wrote in name of topic I have troubles with bulk requests (also with Follower Checker and Leader Checker messages). Usual bulk trace looks like: \[2021-01-13T08:30:44,163\]\[TRACE\]\[o.e.h.HttpTracer \] \[h1-… --- ## [Document count increase every time with jdbc driver](https://discuss.elastic.co/t/document-count-increase-every-time-with-jdbc-driver/260932)
**Author:** [@beachjf](https://discuss.elastic.co/u/beachjf)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 5:18am UTC](https://discuss.elastic.co/t/document-count-increase-every-time-with-jdbc-driver/260932 "2021-01-13T05:18:41Z")
input { jdbc { jdbc\_driver\_library =\> "" jdbc\_driver\_class =\> "com.microsoft.sqlserver.jdbc.SQLServerDriver" jdbc\_connection\_string =\> "jdbc:sqlserver://aasdf;instanceName=aaSQL;databasename=aaa" jdbc\_u… --- ## [\[esaggs\] \> too many requests is showing on dashboard](https://discuss.elastic.co/t/esaggs-too-many-requests-is-showing-on-dashboard/260878)
**Author:** [@Rohit\_Kumbhar](https://discuss.elastic.co/u/Rohit_Kumbhar)\ **Replies:** 8\ **Last updated:** [January 13, 2021, 4:47am UTC](https://discuss.elastic.co/t/esaggs-too-many-requests-is-showing-on-dashboard/260878 "2021-01-13T04:47:20Z")
Hi, I am getting \[esaggs\] \> too many requests on my Dashboard. Cannot find any solution for that. Please help Thanks . Regards Rohit. --- ## [Aggregation time complexity](https://discuss.elastic.co/t/aggregation-time-complexity/260925)
**Author:** [@isbee](https://discuss.elastic.co/u/isbee)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 3:02am UTC](https://discuss.elastic.co/t/aggregation-time-complexity/260925 "2021-01-13T03:02:32Z")
I want to aggregate N(= 10 million) data by percentile\_rank. And I want to call this query lively (more than 100 times per second). As far as I know, Elasticsearch uses t-digest algorithm on percentile. So total time co… --- ## [Insert multi fields data](https://discuss.elastic.co/t/insert-multi-fields-data/260606)
**Author:** [@mojtaba\_safavi](https://discuss.elastic.co/u/mojtaba_safavi)\ **Replies:** 5\ **Last updated:** [January 13, 2021, 1:04am UTC](https://discuss.elastic.co/t/insert-multi-fields-data/260606 "2021-01-13T01:04:48Z")
hi, I am looking for a solution that inserts translated data into multi fields for multi-language --- ## [How can I change the default size of the returned aggregations (10)?](https://discuss.elastic.co/t/how-can-i-change-the-default-size-of-the-returned-aggregations-10/260909)
**Author:** [@Catalin](https://discuss.elastic.co/u/Catalin)\ **Replies:** 2\ **Last updated:** [January 12, 2021, 11:52pm UTC](https://discuss.elastic.co/t/how-can-i-change-the-default-size-of-the-returned-aggregations-10/260909 "2021-01-12T23:52:36Z")
Is there an index setting in order to change default size of aggregations returned, which seems to be set at 10 ? --- ## [Data from Metricbeat AWS module](https://discuss.elastic.co/t/data-from-metricbeat-aws-module/260725)
**Author:** [@Jurilz](https://discuss.elastic.co/u/Jurilz)\ **Replies:** 0\ **Last updated:** [January 11, 2021, 1:13pm UTC](https://discuss.elastic.co/t/data-from-metricbeat-aws-module/260725 "2021-01-11T13:13:36Z")
metricbeat version 7.10.0 (amd64), libbeat 7.10.0 elasticsearch version: 7.10.0 kibana version: 7.10.0 Good day, I'm still trying to collect and display the AWS metrics, especially EC2-metrics and billing information… --- ## [Can the Logstash csv plug-in write to a remote server via sFTP?](https://discuss.elastic.co/t/can-the-logstash-csv-plug-in-write-to-a-remote-server-via-sftp/260815)
**Author:** [@Manuel\_Wong](https://discuss.elastic.co/u/Manuel_Wong)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 11:48pm UTC](https://discuss.elastic.co/t/can-the-logstash-csv-plug-in-write-to-a-remote-server-via-sftp/260815 "2021-01-12T23:48:17Z")
Hello, wish you all an excellent new year! I'd like to ask if the Logstash csv plug-in can write to a remove server via sFTP. I plan to setup the logstash in a container within a K8s cluster but the location where the c… --- ## [org.elasticsearch.action.search.SearchPhaseExecutionException - collector failed to collect data](https://discuss.elastic.co/t/org-elasticsearch-action-search-searchphaseexecutionexception-collector-failed-to-collect-data/260766)
**Author:** [@marcosvrrs](https://discuss.elastic.co/u/marcosvrrs)\ **Replies:** 3\ **Last updated:** [January 12, 2021, 11:32pm UTC](https://discuss.elastic.co/t/org-elasticsearch-action-search-searchphaseexecutionexception-collector-failed-to-collect-data/260766 "2021-01-12T23:32:11Z")
Hi all, We have a deployment in Elastic Cloud, and since yesterday my JVM is with a very high usage (about 85-90% of heap memory) and giving a few errors. Any help would be appreciated. I got this log through the consol… --- ## [("Enabled": false) does it work in index templates or only in mapping directly?](https://discuss.elastic.co/t/enabled-false-does-it-work-in-index-templates-or-only-in-mapping-directly/260898)
**Author:** [@marcosvitali](https://discuss.elastic.co/u/marcosvitali)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 11:29pm UTC](https://discuss.elastic.co/t/enabled-false-does-it-work-in-index-templates-or-only-in-mapping-directly/260898 "2021-01-12T23:29:00Z")
Hi, Im using filebeat with templates and 1 index per day pattern. Id like to disable object in a field but it doenst work in templates (works only in mapping directly) "Enabled": false does it work in index templates … --- ## [Filebeat Fortinet Module does't parse message fields when using tcp protocol](https://discuss.elastic.co/t/filebeat-fortinet-module-doest-parse-message-fields-when-using-tcp-protocol/260913)
**Author:** [@luigius](https://discuss.elastic.co/u/luigius)\ **Replies:** 0\ **Last updated:** [January 12, 2021, 10:01pm UTC](https://discuss.elastic.co/t/filebeat-fortinet-module-doest-parse-message-fields-when-using-tcp-protocol/260913 "2021-01-12T22:01:29Z")
Hi everyone, I have filebeat with Fortinet module working fine if I use UDP, but when I switch to TCP stops to parse the records as Fortinet log adds at the beginning the priority (usually \<189\> or \<190\>) Any idea on ho… --- ## [Feedback on tuning Data Streams for my use case](https://discuss.elastic.co/t/feedback-on-tuning-data-streams-for-my-use-case/260848)
**Author:** [@ismarslomic](https://discuss.elastic.co/u/ismarslomic)\ **Replies:** 0\ **Last updated:** [January 12, 2021, 3:21pm UTC](https://discuss.elastic.co/t/feedback-on-tuning-data-streams-for-my-use-case/260848 "2021-01-12T15:21:37Z")
I'm working on a use where we need to copy messages from 2 Kafka topics to Elasticsearch, in order to search and visualize data in Web App. I have setup Elastic Cloud on Kubernetes with Elasticsearch and Kibana, and per… --- ## [Elastic Stack architecture recommandation in production](https://discuss.elastic.co/t/elastic-stack-architecture-recommandation-in-production/260915)
**Author:** [@abdallah](https://discuss.elastic.co/u/abdallah)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 10:53pm UTC](https://discuss.elastic.co/t/elastic-stack-architecture-recommandation-in-production/260915 "2021-01-12T22:53:00Z")
Hi, we have an ELK cluster with 3 ES data, 2 ES master. We have also 2 Logstash and 1 kibana. Is it recommended to have a load balancer between logstash and ES nodes? Thank you [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1605) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1607)