# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1608 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1609 --- ## [Line chart with two date count lines for use with ServiceNow incident data](https://discuss.elastic.co/t/line-chart-with-two-date-count-lines-for-use-with-servicenow-incident-data/260735)
**Author:** [@ykara84](https://discuss.elastic.co/u/ykara84)\ **Replies:** 2\ **Last updated:** [January 12, 2021, 11:06am UTC](https://discuss.elastic.co/t/line-chart-with-two-date-count-lines-for-use-with-servicenow-incident-data/260735 "2021-01-12T11:06:00Z")
Hi, I have ServiceNow incident data in an index and I would like to visualise the the trend of opened and resolved tickets on a per day basis. I can do it in separate visualisations but I cant figure out how to combine i… --- ## [Understanding Unusual Logstash Traffic Flow Rates](https://discuss.elastic.co/t/understanding-unusual-logstash-traffic-flow-rates/260821)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 0\ **Last updated:** [January 12, 2021, 10:59am UTC](https://discuss.elastic.co/t/understanding-unusual-logstash-traffic-flow-rates/260821 "2021-01-12T10:59:28Z")
Hi, I'd like to understand some apparently odd behaviour we're seeing with traffic hitting our logstashes vs what is being ingested into elasticsearch and s3. Note that we're using the output isolator pattern to decoupl… --- ## [How configure logstash in Kubernetes to point to a specific directory that is mapped as emptydir or local](https://discuss.elastic.co/t/how-configure-logstash-in-kubernetes-to-point-to-a-specific-directory-that-is-mapped-as-emptydir-or-local/260814)
**Author:** [@umen](https://discuss.elastic.co/u/umen)\ **Replies:** 0\ **Last updated:** [January 12, 2021, 10:16am UTC](https://discuss.elastic.co/t/how-configure-logstash-in-kubernetes-to-point-to-a-specific-directory-that-is-mapped-as-emptydir-or-local/260814 "2021-01-12T10:16:14Z")
hello all i need to configure logstash to listen to incoming logs in a directory. (which will be manually uploaded logs to ) And to process them and show them in kibana . i already have filebeat monitoring running the… --- ## [Error loading kibana on a web browser - 503 service unavailable](https://discuss.elastic.co/t/error-loading-kibana-on-a-web-browser-503-service-unavailable/260520)
**Author:** [@prajwal93](https://discuss.elastic.co/u/prajwal93)\ **Replies:** 5\ **Last updated:** [January 12, 2021, 10:03am UTC](https://discuss.elastic.co/t/error-loading-kibana-on-a-web-browser-503-service-unavailable/260520 "2021-01-12T10:03:34Z")
I have an ELK cluster running and I have trouble loading Kibana in my web browser. It was working fine until 3 days before I made a change to logstash configuration. I installed Logstash-amazon\_es plugin, used to load da… --- ## [Repository\_verification\_exception](https://discuss.elastic.co/t/repository-verification-exception/260805)
**Author:** [@Luca\_P](https://discuss.elastic.co/u/Luca_P)\ **Replies:** 0\ **Last updated:** [January 12, 2021, 9:43am UTC](https://discuss.elastic.co/t/repository-verification-exception/260805 "2021-01-12T09:43:34Z")
Hi All. I manage few ES clusters that perform snapshots on S3 bucket without issues, they are all configured with master nodes and hot-data nodes. Now, I have 1 cluster where we configured also warm nodes, and it seems… --- ## [Amount of replica's](https://discuss.elastic.co/t/amount-of-replicas/260801)
**Author:** [@opouwels](https://discuss.elastic.co/u/opouwels)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 9:22am UTC](https://discuss.elastic.co/t/amount-of-replicas/260801 "2021-01-12T09:22:55Z")
we have redundant elastic stack setup in 2 datacenters with CCR and redundant storage in each DC. as a lot of TB of data we want to set replica from 1 to 0 to save storage. is their any othe reason to keep the replica … --- ## [Elasticsearch : circuit\_breaking\_exception Data too large, data for \[\\] would be \[419575260/400.1mb\], which is larger than the limit of \[408420352/389.5mb\], real usage](https://discuss.elastic.co/t/elasticsearch-circuit-breaking-exception-data-too-large-data-for-http-request-would-be-419575260-400-1mb-which-is-larger-than-the-limit-of-408420352-389-5mb-real-usage/260685)
**Author:** [@Sathish\_Shanmugam](https://discuss.elastic.co/u/Sathish_Shanmugam)\ **Replies:** 2\ **Last updated:** [January 12, 2021, 9:18am UTC](https://discuss.elastic.co/t/elasticsearch-circuit-breaking-exception-data-too-large-data-for-http-request-would-be-419575260-400-1mb-which-is-larger-than-the-limit-of-408420352-389-5mb-real-usage/260685 "2021-01-12T09:18:18Z")
We are experiencing an issue while running elastic search bulk API on to elastic cloud 7.8.1 below is the exception when we get when we increase the batch size \> 100, The stack trace from NodeJS library @elastic/elasti… --- ## [Installing Elasticsearch plugins when ES is running as Kubernetes pod](https://discuss.elastic.co/t/installing-elasticsearch-plugins-when-es-is-running-as-kubernetes-pod/260799)
**Author:** [@sun24](https://discuss.elastic.co/u/sun24)\ **Replies:** 0\ **Last updated:** [January 12, 2021, 8:47am UTC](https://discuss.elastic.co/t/installing-elasticsearch-plugins-when-es-is-running-as-kubernetes-pod/260799 "2021-01-12T08:47:33Z")
I understand that one method is to use the containers: command: Required command But this data is not retained once the pod restarts and the command is run again and again resulting in a crashloopbackoff. How to res… --- ## [Metricbeat AWS module not sending data](https://discuss.elastic.co/t/metricbeat-aws-module-not-sending-data/260200)
**Author:** [@Jurilz](https://discuss.elastic.co/u/Jurilz)\ **Replies:** 17\ **Last updated:** [January 11, 2021, 11:45am UTC](https://discuss.elastic.co/t/metricbeat-aws-module-not-sending-data/260200 "2021-01-11T11:45:46Z")
Good day, I'm currently trying to collect AWS metrics with the Metricbeat AWS module. And although the status of metricbeat looks fine, elasticsearch doesn't seem to receive any data. my metricbeat.yml: metricbeat.con… --- ## [Ingest pipe line grok pattern with field name having spaces](https://discuss.elastic.co/t/ingest-pipe-line-grok-pattern-with-field-name-having-spaces/259840)
**Author:** [@Bo\_Koralage](https://discuss.elastic.co/u/Bo_Koralage)\ **Replies:** 10\ **Last updated:** [January 12, 2021, 9:00am UTC](https://discuss.elastic.co/t/ingest-pipe-line-grok-pattern-with-field-name-having-spaces/259840 "2021-01-12T09:00:09Z")
I am using a ingest pipeline to parse a tab separated log message coming from filebeat. One of the fields can have spaces. In the example below "Gui Process" should be parsed to the SourceName field. However, what happen… --- ## [Parsing Json from couchDb to ElasticSearch via Logstash](https://discuss.elastic.co/t/parsing-json-from-couchdb-to-elasticsearch-via-logstash/260797)
**Author:** [@skr007](https://discuss.elastic.co/u/skr007)\ **Replies:** 0\ **Last updated:** [January 12, 2021, 8:35am UTC](https://discuss.elastic.co/t/parsing-json-from-couchdb-to-elasticsearch-via-logstash/260797 "2021-01-12T08:35:42Z")
Can anyone please help me with this issue? --- ## [High CPU usage 100%](https://discuss.elastic.co/t/high-cpu-usage-100/260750)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 4\ **Last updated:** [January 12, 2021, 8:12am UTC](https://discuss.elastic.co/t/high-cpu-usage-100/260750 "2021-01-12T08:12:22Z")
Hello, I am using ELasticsearch and Kibana version 7.10.1 Since 3 days, I am noticing that my data nodes are using high CPU, 100% in my cluster I have: 3 master nodes ( 2 CPU, 4 Go RAM, 100 Go HDD) node.roles: \[ mas… --- ## [Index mapping at startup](https://discuss.elastic.co/t/index-mapping-at-startup/260741)
**Author:** [@hyunsoo](https://discuss.elastic.co/u/hyunsoo)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 7:22am UTC](https://discuss.elastic.co/t/index-mapping-at-startup/260741 "2021-01-12T07:22:25Z")
Hi all, This question is about launching elasticsearch with kubernetes. If I run k8s like below, ... containers: - name: elasticsearch image: docker.elastic.co/elasticsearch/elasticsearch:7.10.1 … --- ## [Can't get my host to talk to the kibana server](https://discuss.elastic.co/t/cant-get-my-host-to-talk-to-the-kibana-server/260660)
**Author:** [@Minx](https://discuss.elastic.co/u/Minx)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 7:21am UTC](https://discuss.elastic.co/t/cant-get-my-host-to-talk-to-the-kibana-server/260660 "2021-01-12T07:21:20Z")
I'm not sure why but all I seem to get it this error message, I'm using a server 2016 with Elastic search, kibana, file beat and winlog beat, it can see the windows log from itself but this message is from a Win 10 ho… --- ## [No SSL verification for Logstash filter: Elasticsearch](https://discuss.elastic.co/t/no-ssl-verification-for-logstash-filter-elasticsearch/260489)
**Author:** [@tinhn](https://discuss.elastic.co/u/tinhn)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 7:17am UTC](https://discuss.elastic.co/t/no-ssl-verification-for-logstash-filter-elasticsearch/260489 "2021-01-12T07:17:21Z")
Hello, I am fairly new to setting up security, so I'm sorry if there are holes in my logic. I'm running Elasticsearch (7.9.1 OSS with opendistro) + Kibana on one machine and Logstash (7.8.0) on another machine. Within … --- ## [How to reset my mail ID used in trial and start using in paid account](https://discuss.elastic.co/t/how-to-reset-my-mail-id-used-in-trial-and-start-using-in-paid-account/258863)
**Author:** [@SUMANT\_MISHRA](https://discuss.elastic.co/u/SUMANT_MISHRA)\ **Replies:** 3\ **Last updated:** [January 12, 2021, 7:13am UTC](https://discuss.elastic.co/t/how-to-reset-my-mail-id-used-in-trial-and-start-using-in-paid-account/258863 "2021-01-12T07:13:01Z")
Hi, I used my business email in a trial account for POC purposes. But with the paid account (set up using Azure Marketplace), I am not able to use my same business email. Am I following wrong approach? --- ## [Elasticsearch Cluster version 7.7 is not stable](https://discuss.elastic.co/t/elasticsearch-cluster-version-7-7-is-not-stable/259565)
**Author:** [@dat\_le](https://discuss.elastic.co/u/dat_le)\ **Replies:** 8\ **Last updated:** [January 12, 2021, 6:54am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-version-7-7-is-not-stable/259565 "2021-01-12T06:54:28Z")
Hello guys, Can anyone help me on this problem? My Cluster: I have a ES cluster with 3 nodes version 7.7. Every node have 2 vCPU and 16GB Ram. I have 2 index: Index 1: 121 MB (1.9M Doc, 2 Primary Shards, 1 Replica Sh… --- ## [Elasticsearch bulk index request failing with error “if \_id is specified it must not be empty”](https://discuss.elastic.co/t/elasticsearch-bulk-index-request-failing-with-error-if-id-is-specified-it-must-not-be-empty/260778)
**Author:** [@surenraju](https://discuss.elastic.co/u/surenraju)\ **Replies:** 3\ **Last updated:** [January 12, 2021, 6:29am UTC](https://discuss.elastic.co/t/elasticsearch-bulk-index-request-failing-with-error-if-id-is-specified-it-must-not-be-empty/260778 "2021-01-12T06:29:47Z")
I am trying to bulk insert records to index asset\_inventory\_dev index. Elastic search is returning error saying “if \_id is specified it must not be empty”. Following is the request i tried from Kibana dev tools. I can… --- ## [Google pubsub plugin not working as expected](https://discuss.elastic.co/t/google-pubsub-plugin-not-working-as-expected/260786)
**Author:** [@curiousmind](https://discuss.elastic.co/u/curiousmind)\ **Replies:** 0\ **Last updated:** [January 12, 2021, 5:34am UTC](https://discuss.elastic.co/t/google-pubsub-plugin-not-working-as-expected/260786 "2021-01-12T05:34:18Z")
I am using the google pub-sub input plugin. the following is my input configuration google\_pubsub { project\_id =\> "krail-proj-kgov-rai-doc-92zx4" topic =\> "rail\_logs" subscription =\> "rail… --- ## [Ms teams watcher](https://discuss.elastic.co/t/ms-teams-watcher/260230)
**Author:** [@Mohith\_Vegi](https://discuss.elastic.co/u/Mohith_Vegi)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 4:26am UTC](https://discuss.elastic.co/t/ms-teams-watcher/260230 "2021-01-12T04:26:06Z")
"aggs": { "cluster\_wise": { "terms": { "field": "fields.cluster" }, "aggs": { "namespace\_wise": { "terms": { "field": "kubernetes.namespace" }, "aggs": { "pod\_wise": { "terms": { "field": "kubernetes.pod.nam… --- ## [Migrate from 6.8 to 7.10](https://discuss.elastic.co/t/migrate-from-6-8-to-7-10/260498)
**Author:** [@blukit](https://discuss.elastic.co/u/blukit)\ **Replies:** 6\ **Last updated:** [January 12, 2021, 3:19am UTC](https://discuss.elastic.co/t/migrate-from-6-8-to-7-10/260498 "2021-01-12T03:19:19Z")
Hi folks... Need to know whats the proper way to migrate & upgrade from our current ELK 6.8 cluster to our new ELK 7.10 cluster. Should I first do rolling upgrade in our current cluster then rsync to 7.10 cluster? Or … --- ## [Can you query for elements between multiple children in a parent-child join?](https://discuss.elastic.co/t/can-you-query-for-elements-between-multiple-children-in-a-parent-child-join/260775)
**Author:** [@Aidan\_Tan](https://discuss.elastic.co/u/Aidan_Tan)\ **Replies:** 0\ **Last updated:** [January 12, 2021, 2:44am UTC](https://discuss.elastic.co/t/can-you-query-for-elements-between-multiple-children-in-a-parent-child-join/260775 "2021-01-12T02:44:28Z")
Is it possible to query among the elements of children and return the parent. So if one child has a gender of male and age of 17 and another has a gender of female and age of 21. Is it possible to return the parents if a… --- ## [How do we find the number unique dates that a field appears?](https://discuss.elastic.co/t/how-do-we-find-the-number-unique-dates-that-a-field-appears/260616)
**Author:** [@kenneth\_wang](https://discuss.elastic.co/u/kenneth_wang)\ **Replies:** 4\ **Last updated:** [January 12, 2021, 2:14am UTC](https://discuss.elastic.co/t/how-do-we-find-the-number-unique-dates-that-a-field-appears/260616 "2021-01-12T02:14:20Z")
Hello, For each log entry, I have "user identifier" and "date" fields. I would like to find out the number of unique dates that a "user identifier" appears in. Eg. For a given user identifier "1234567", if it appeared … --- ## [Stop Logstash with a Filter or Ruby-Code](https://discuss.elastic.co/t/stop-logstash-with-a-filter-or-ruby-code/259000)
**Author:** [@cwiechmann](https://discuss.elastic.co/u/cwiechmann)\ **Replies:** 3\ **Last updated:** [January 11, 2021, 10:59pm UTC](https://discuss.elastic.co/t/stop-logstash-with-a-filter-or-ruby-code/259000 "2021-01-11T22:59:09Z")
Hi All, I'm using Logstash to prepare/enrich documents before they are send to Elasticsearch. The enrichment is not really optional and will have an impact later, when the data is queried. Therefore, I need to make sure… --- ## [Signed certificates for transport SSL](https://discuss.elastic.co/t/signed-certificates-for-transport-ssl/260772)
**Author:** [@surphix](https://discuss.elastic.co/u/surphix)\ **Replies:** 0\ **Last updated:** [January 11, 2021, 10:31pm UTC](https://discuss.elastic.co/t/signed-certificates-for-transport-ssl/260772 "2021-01-11T22:31:25Z")
Hey everyone. I'm trying to understand how I go from once my CSR is sign by a CA to using it for remote clustering via transport SSL settings. I've gotten my certificate signed and received a .cer file. I'm a little con… --- ## [Logstash and Ingest Nodes](https://discuss.elastic.co/t/logstash-and-ingest-nodes/260350)
**Author:** [@jalaine](https://discuss.elastic.co/u/jalaine)\ **Replies:** 8\ **Last updated:** [January 11, 2021, 9:43pm UTC](https://discuss.elastic.co/t/logstash-and-ingest-nodes/260350 "2021-01-11T21:43:23Z")
Good Morning, My team and I are trying to improve a cluster that we inherited. I apologize for the following vagueness, but due to the location of the cluster I will give as much detail as possible. We currently are wor… --- ## [Memory usage for a particular directory](https://discuss.elastic.co/t/memory-usage-for-a-particular-directory/260553)
**Author:** [@akhileshtapdiya](https://discuss.elastic.co/u/akhileshtapdiya)\ **Replies:** 3\ **Last updated:** [January 11, 2021, 9:10pm UTC](https://discuss.elastic.co/t/memory-usage-for-a-particular-directory/260553 "2021-01-11T21:10:23Z")
Hi I am tyring to get memory usage information for a particular directory on my server. Is there any way to get this in kibana? Current system.memory.act.pct give me overall memory at os level and I am interested in me… --- ## [Client write error, trying connect {:e=\>#\ **Author:** [@PraveenKT](https://discuss.elastic.co/u/PraveenKT)\ **Replies:** 3\ **Last updated:** [January 11, 2021, 9:08pm UTC](https://discuss.elastic.co/t/client-write-error-trying-connect-e-ioerror-connection-reset-by-peer/260571 "2021-01-11T21:08:47Z") After restarting logstash, after few hours, beats data is not sending to elasticsearch. Beats ---\> Logstash ----\> logstash ---\> Elasticsearch. I have 2 logstash servers in the site, I am getting below error on one logst… --- ## [Query to return only doc with max value of one field, grouped by another field](https://discuss.elastic.co/t/query-to-return-only-doc-with-max-value-of-one-field-grouped-by-another-field/260764)
**Author:** [@aidanoc15](https://discuss.elastic.co/u/aidanoc15)\ **Replies:** 0\ **Last updated:** [January 11, 2021, 8:25pm UTC](https://discuss.elastic.co/t/query-to-return-only-doc-with-max-value-of-one-field-grouped-by-another-field/260764 "2021-01-11T20:25:10Z")
So to be specific with what we are trying to accomplish, we are using Elastic Security's detections and have a few rules set up. We then have a logstash pipeline that queries the index our detections go into every minute… --- ## [Unable to start ElasticSearch after install on CENTOS 8](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-install-on-centos-8/259650)
**Author:** [@Shariq\_Tejar](https://discuss.elastic.co/u/Shariq_Tejar)\ **Replies:** 4\ **Last updated:** [January 11, 2021, 8:23pm UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-install-on-centos-8/259650 "2021-01-11T20:23:36Z")
elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since Sat 2020-12-26 01:45:20 PKT; 10s ago … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1607) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1609)